Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6

Conflicts:
	drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
	net/llc/af_llc.c

84 files changed, 824 insertions, 516 deletions

diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
index ae5522703d16..2193a5d124c5 100644
--- a/Documentation/networking/ip-sysctl.txt
+++ b/Documentation/networking/ip-sysctl.txt
@@ -144,6 +144,7 @@ tcp_adv_win_scale - INTEGER
         Count buffering overhead as bytes/2^tcp_adv_win_scale
         (if tcp_adv_win_scale > 0) or bytes-bytes/2^(-tcp_adv_win_scale),
         if it is <= 0.
+        Possible values are [-31, 31], inclusive.
         Default: 2
 
 tcp_allowed_congestion_control - STRING
diff --git a/MAINTAINERS b/MAINTAINERS
index 8b6ca96435ee..9206cb462913 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1359,7 +1359,7 @@ F:	include/net/bluetooth/
 
 BONDING DRIVER
 M:      Jay Vosburgh <fubar@us.ibm.com>
-L:      bonding-devel@lists.sourceforge.net
+L:      netdev@vger.kernel.org
 W:      http://sourceforge.net/projects/bonding/
 S:      Supported
 F:      drivers/net/bonding/
diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
index 128cae4e8629..949ed09c6361 100644
--- a/drivers/bluetooth/ath3k.c
+++ b/drivers/bluetooth/ath3k.c
@@ -35,6 +35,10 @@
 static struct usb_device_id ath3k_table[] = {
         /* Atheros AR3011 */
         { USB_DEVICE(0x0CF3, 0x3000) },
+
+        /* Atheros AR3011 with sflash firmware*/
+        { USB_DEVICE(0x0CF3, 0x3002) },
+
         { }     /* Terminating entry */
 };
 
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index ab3894f742c3..1da773f899a2 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -99,6 +99,9 @@ static struct usb_device_id blacklist_table[] = {
         /* Broadcom BCM2033 without firmware */
         { USB_DEVICE(0x0a5c, 0x2033), .driver_info = BTUSB_IGNORE },
 
+        /* Atheros 3011 with sflash firmware */
+        { USB_DEVICE(0x0cf3, 0x3002), .driver_info = BTUSB_IGNORE },
+
         /* Broadcom BCM2035 */
         { USB_DEVICE(0x0a5c, 0x2035), .driver_info = BTUSB_WRONG_SCO_MTU },
         { USB_DEVICE(0x0a5c, 0x200a), .driver_info = BTUSB_WRONG_SCO_MTU },
@@ -239,7 +242,8 @@ static void btusb_intr_complete(struct urb *urb)
 
         err = usb_submit_urb(urb, GFP_ATOMIC);
         if (err < 0) {
-                BT_ERR("%s urb %p failed to resubmit (%d)",
+                if (err != -EPERM)
+                        BT_ERR("%s urb %p failed to resubmit (%d)",
                                                 hdev->name, urb, -err);
                 usb_unanchor_urb(urb);
         }
@@ -323,7 +327,8 @@ static void btusb_bulk_complete(struct urb *urb)
 
         err = usb_submit_urb(urb, GFP_ATOMIC);
         if (err < 0) {
-                BT_ERR("%s urb %p failed to resubmit (%d)",
+                if (err != -EPERM)
+                        BT_ERR("%s urb %p failed to resubmit (%d)",
                                                 hdev->name, urb, -err);
                 usb_unanchor_urb(urb);
         }
@@ -412,7 +417,8 @@ static void btusb_isoc_complete(struct urb *urb)
 
         err = usb_submit_urb(urb, GFP_ATOMIC);
         if (err < 0) {
-                BT_ERR("%s urb %p failed to resubmit (%d)",
+                if (err != -EPERM)
+                        BT_ERR("%s urb %p failed to resubmit (%d)",
                                                 hdev->name, urb, -err);
                 usb_unanchor_urb(urb);
         }
diff --git a/drivers/isdn/icn/icn.c b/drivers/isdn/icn/icn.c
index 2e847a90bad0..f2b5bab5e6a1 100644
--- a/drivers/isdn/icn/icn.c
+++ b/drivers/isdn/icn/icn.c
@@ -1627,7 +1627,7 @@ __setup("icn=", icn_setup);
 static int __init icn_init(void)
 {
         char *p;
-        char rev[10];
+        char rev[20];
 
         memset(&dev, 0, sizeof(icn_dev));
         dev.memaddr = (membase & 0x0ffc000);
@@ -1637,9 +1637,10 @@ static int __init icn_init(void)
         spin_lock_init(&dev.devlock);
 
         if ((p = strchr(revision, ':'))) {
-                strcpy(rev, p + 1);
+                strncpy(rev, p + 1, 20);
                 p = strchr(rev, '$');
-                *p = 0;
+                if (p)
+                        *p = 0;
         } else
                 strcpy(rev, " ??? ");
         printk(KERN_NOTICE "ICN-ISDN-driver Rev%smem=0x%08lx\n", rev,
diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
index a11dc735752c..a20693fcb321 100644
--- a/drivers/net/Kconfig
+++ b/drivers/net/Kconfig
@@ -2543,10 +2543,10 @@ config PCH_GBE
         depends on PCI
         select MII
         ---help---
-          This is a gigabit ethernet driver for Topcliff PCH.
-          Topcliff PCH is the platform controller hub that is used in Intel's
+          This is a gigabit ethernet driver for EG20T PCH.
+          EG20T PCH is the platform controller hub that is used in Intel's
           general embedded platform.
-          Topcliff PCH has Gigabit Ethernet interface.
+          EG20T PCH has Gigabit Ethernet interface.
           Using this interface, it is able to access system devices connected
           to Gigabit Ethernet.
           This driver enables Gigabit Ethernet function.
diff --git a/drivers/net/atl1c/atl1c_hw.c b/drivers/net/atl1c/atl1c_hw.c
index 919080b2c3a5..1bf672009948 100644
--- a/drivers/net/atl1c/atl1c_hw.c
+++ b/drivers/net/atl1c/atl1c_hw.c
@@ -82,7 +82,7 @@ static int atl1c_get_permanent_address(struct atl1c_hw *hw)
         addr[0] = addr[1] = 0;
         AT_READ_REG(hw, REG_OTP_CTRL, &otp_ctrl_data);
         if (atl1c_check_eeprom_exist(hw)) {
-                if (hw->nic_type == athr_l1c || hw->nic_type == athr_l2c_b) {
+                if (hw->nic_type == athr_l1c || hw->nic_type == athr_l2c) {
                         /* Enable OTP CLK */
                         if (!(otp_ctrl_data & OTP_CTRL_CLK_EN)) {
                                 otp_ctrl_data |= OTP_CTRL_CLK_EN;
diff --git a/drivers/net/au1000_eth.c b/drivers/net/au1000_eth.c
index 43489f89c142..53eff9ba6e95 100644
--- a/drivers/net/au1000_eth.c
+++ b/drivers/net/au1000_eth.c
@@ -155,10 +155,10 @@ static void au1000_enable_mac(struct net_device *dev, int force_reset)
         spin_lock_irqsave(&aup->lock, flags);
 
         if (force_reset || (!aup->mac_enabled)) {
-                writel(MAC_EN_CLOCK_ENABLE, &aup->enable);
+                writel(MAC_EN_CLOCK_ENABLE, aup->enable);
                 au_sync_delay(2);
                 writel((MAC_EN_RESET0 | MAC_EN_RESET1 | MAC_EN_RESET2
-                                | MAC_EN_CLOCK_ENABLE), &aup->enable);
+                                | MAC_EN_CLOCK_ENABLE), aup->enable);
                 au_sync_delay(2);
 
                 aup->mac_enabled = 1;
@@ -503,9 +503,9 @@ static void au1000_reset_mac_unlocked(struct net_device *dev)
 
         au1000_hard_stop(dev);
 
-        writel(MAC_EN_CLOCK_ENABLE, &aup->enable);
+        writel(MAC_EN_CLOCK_ENABLE, aup->enable);
         au_sync_delay(2);
-        writel(0, &aup->enable);
+        writel(0, aup->enable);
         au_sync_delay(2);
 
         aup->tx_full = 0;
@@ -1119,7 +1119,7 @@ static int __devinit au1000_probe(struct platform_device *pdev)
         /* set a random MAC now in case platform_data doesn't provide one */
         random_ether_addr(dev->dev_addr);
 
-        writel(0, &aup->enable);
+        writel(0, aup->enable);
         aup->mac_enabled = 0;
 
         pd = pdev->dev.platform_data;
diff --git a/drivers/net/b44.c b/drivers/net/b44.c
index c6e86315b3f8..2e2b76258ab4 100644
--- a/drivers/net/b44.c
+++ b/drivers/net/b44.c
@@ -381,11 +381,11 @@ static void b44_set_flow_ctrl(struct b44 *bp, u32 local, u32 remote)
         __b44_set_flow_ctrl(bp, pause_enab);
 }
 
-#ifdef SSB_DRIVER_MIPS
-extern char *nvram_get(char *name);
+#ifdef CONFIG_BCM47XX
+#include <asm/mach-bcm47xx/nvram.h>
 static void b44_wap54g10_workaround(struct b44 *bp)
 {
-        const char *str;
+        char buf[20];
         u32 val;
         int err;
 
@@ -394,10 +394,9 @@ static void b44_wap54g10_workaround(struct b44 *bp)
          * see https://dev.openwrt.org/ticket/146
          * check and reset bit "isolate"
          */
-        str = nvram_get("boardnum");
-        if (!str)
+        if (nvram_getenv("boardnum", buf, sizeof(buf)) < 0)
                 return;
-        if (simple_strtoul(str, NULL, 0) == 2) {
+        if (simple_strtoul(buf, NULL, 0) == 2) {
                 err = __b44_readphy(bp, 0, MII_BMCR, &val);
                 if (err)
                         goto error;
diff --git a/drivers/net/benet/be_cmds.c b/drivers/net/benet/be_cmds.c
index 31c5ddc08fc8..171a08caf2be 100644
--- a/drivers/net/benet/be_cmds.c
+++ b/drivers/net/benet/be_cmds.c
@@ -1274,7 +1274,7 @@ int be_cmd_multicast_set(struct be_adapter *adapter, u32 if_id,
 
                 i = 0;
                 netdev_for_each_mc_addr(ha, netdev)
-                        memcpy(req->mac[i].byte, ha->addr, ETH_ALEN);
+                        memcpy(req->mac[i++].byte, ha->addr, ETH_ALEN);
         } else {
                 req->promiscuous = 1;
         }
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 0273ad0b57bb..bb33b3b347fa 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1570,7 +1570,7 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
 
         /* If this is the first slave, then we need to set the master's hardware
          * address to be the same as the slave's. */
-        if (bond->slave_cnt == 0)
+        if (is_zero_ether_addr(bond->dev->dev_addr))
                 memcpy(bond->dev->dev_addr, slave_dev->dev_addr,
                        slave_dev->addr_len);
 
diff --git a/drivers/net/caif/caif_shm_u5500.c b/drivers/net/caif/caif_shm_u5500.c
index 1cd90da86f13..32b1c6fb2de1 100644
--- a/drivers/net/caif/caif_shm_u5500.c
+++ b/drivers/net/caif/caif_shm_u5500.c
@@ -5,7 +5,7 @@
  * License terms: GNU General Public License (GPL) version 2
  */
 
-#define pr_fmt(fmt) KBUILD_MODNAME ":" __func__ "():" fmt
+#define pr_fmt(fmt) KBUILD_MODNAME ":" fmt
 
 #include <linux/version.h>
 #include <linux/init.h>
diff --git a/drivers/net/caif/caif_shmcore.c b/drivers/net/caif/caif_shmcore.c
index 19f9c0656667..80511167f35b 100644
--- a/drivers/net/caif/caif_shmcore.c
+++ b/drivers/net/caif/caif_shmcore.c
@@ -6,7 +6,7 @@
  * License terms: GNU General Public License (GPL) version 2
  */
 
-#define pr_fmt(fmt) KBUILD_MODNAME ":" __func__ "():" fmt
+#define pr_fmt(fmt) KBUILD_MODNAME ":" fmt
 
 #include <linux/spinlock.h>
 #include <linux/sched.h>
diff --git a/drivers/net/cxgb4/t4_hw.c b/drivers/net/cxgb4/t4_hw.c
index bb813d94aea8..e97521c801ea 100644
--- a/drivers/net/cxgb4/t4_hw.c
+++ b/drivers/net/cxgb4/t4_hw.c
@@ -2408,7 +2408,7 @@ int t4_alloc_mac_filt(struct adapter *adap, unsigned int mbox,
                 if (index < NEXACT_MAC)
                         ret++;
                 else if (hash)
-                        *hash |= (1 << hash_mac_addr(addr[i]));
+                        *hash |= (1ULL << hash_mac_addr(addr[i]));
         }
         return ret;
 }
diff --git a/drivers/net/cxgb4vf/cxgb4vf_main.c b/drivers/net/cxgb4vf/cxgb4vf_main.c
index 9246d2fa6cf9..f54af48edb93 100644
--- a/drivers/net/cxgb4vf/cxgb4vf_main.c
+++ b/drivers/net/cxgb4vf/cxgb4vf_main.c
@@ -814,40 +814,48 @@ static struct net_device_stats *cxgb4vf_get_stats(struct net_device *dev)
 }
 
 /*
- * Collect up to maxaddrs worth of a netdevice's unicast addresses into an
- * array of addrss pointers and return the number collected.
+ * Collect up to maxaddrs worth of a netdevice's unicast addresses, starting
+ * at a specified offset within the list, into an array of addrss pointers and
+ * return the number collected.
  */
-static inline int collect_netdev_uc_list_addrs(const struct net_device *dev,
-                                               const u8 **addr,
-                                               unsigned int maxaddrs)
+static inline unsigned int collect_netdev_uc_list_addrs(const struct net_device *dev,
+                                                        const u8 **addr,
+                                                        unsigned int offset,
+                                                        unsigned int maxaddrs)
 {
+        unsigned int index = 0;
         unsigned int naddr = 0;
         const struct netdev_hw_addr *ha;
 
-        for_each_dev_addr(dev, ha) {
-                addr[naddr++] = ha->addr;
-                if (naddr >= maxaddrs)
-                        break;
-        }
+        for_each_dev_addr(dev, ha)
+                if (index++ >= offset) {
+                        addr[naddr++] = ha->addr;
+                        if (naddr >= maxaddrs)
+                                break;
+                }
         return naddr;
 }
 
 /*
- * Collect up to maxaddrs worth of a netdevice's multicast addresses into an
- * array of addrss pointers and return the number collected.
+ * Collect up to maxaddrs worth of a netdevice's multicast addresses, starting
+ * at a specified offset within the list, into an array of addrss pointers and
+ * return the number collected.
  */
-static inline int collect_netdev_mc_list_addrs(const struct net_device *dev,
-                                               const u8 **addr,
-                                               unsigned int maxaddrs)
+static inline unsigned int collect_netdev_mc_list_addrs(const struct net_device *dev,
+                                                        const u8 **addr,
+                                                        unsigned int offset,
+                                                        unsigned int maxaddrs)
 {
+        unsigned int index = 0;
         unsigned int naddr = 0;
         const struct netdev_hw_addr *ha;
 
-        netdev_for_each_mc_addr(ha, dev) {
-                addr[naddr++] = ha->addr;
-                if (naddr >= maxaddrs)
-                        break;
-        }
+        netdev_for_each_mc_addr(ha, dev)
+                if (index++ >= offset) {
+                        addr[naddr++] = ha->addr;
+                        if (naddr >= maxaddrs)
+                                break;
+                }
         return naddr;
 }
 
@@ -860,16 +868,20 @@ static int set_addr_filters(const struct net_device *dev, bool sleep)
         u64 mhash = 0;
         u64 uhash = 0;
         bool free = true;
-        u16 filt_idx[7];
+        unsigned int offset, naddr;
         const u8 *addr[7];
-        int ret, naddr = 0;
+        int ret;
         const struct port_info *pi = netdev_priv(dev);
 
         /* first do the secondary unicast addresses */
-        naddr = collect_netdev_uc_list_addrs(dev, addr, ARRAY_SIZE(addr));
-        if (naddr > 0) {
+        for (offset = 0; ; offset += naddr) {
+                naddr = collect_netdev_uc_list_addrs(dev, addr, offset,
+                                                     ARRAY_SIZE(addr));
+                if (naddr == 0)
+                        break;
+
                 ret = t4vf_alloc_mac_filt(pi->adapter, pi->viid, free,
-                                          naddr, addr, filt_idx, &uhash, sleep);
+                                          naddr, addr, NULL, &uhash, sleep);
                 if (ret < 0)
                         return ret;
 
@@ -877,12 +889,17 @@ static int set_addr_filters(const struct net_device *dev, bool sleep)
         }
 
         /* next set up the multicast addresses */
-        naddr = collect_netdev_mc_list_addrs(dev, addr, ARRAY_SIZE(addr));
-        if (naddr > 0) {
+        for (offset = 0; ; offset += naddr) {
+                naddr = collect_netdev_mc_list_addrs(dev, addr, offset,
+                                                     ARRAY_SIZE(addr));
+                if (naddr == 0)
+                        break;
+
                 ret = t4vf_alloc_mac_filt(pi->adapter, pi->viid, free,
-                                          naddr, addr, filt_idx, &mhash, sleep);
+                                          naddr, addr, NULL, &mhash, sleep);
                 if (ret < 0)
                         return ret;
+                free = false;
         }
 
         return t4vf_set_addr_hash(pi->adapter, pi->viid, uhash != 0,
diff --git a/drivers/net/cxgb4vf/t4vf_hw.c b/drivers/net/cxgb4vf/t4vf_hw.c
index f7d7f976064b..35fc803a6a04 100644
--- a/drivers/net/cxgb4vf/t4vf_hw.c
+++ b/drivers/net/cxgb4vf/t4vf_hw.c
@@ -1014,48 +1014,72 @@ int t4vf_alloc_mac_filt(struct adapter *adapter, unsigned int viid, bool free,
                         unsigned int naddr, const u8 **addr, u16 *idx,
                         u64 *hash, bool sleep_ok)
 {
-        int i, ret;
+        int offset, ret = 0;
+        unsigned nfilters = 0;
+        unsigned int rem = naddr;
         struct fw_vi_mac_cmd cmd, rpl;
-        struct fw_vi_mac_exact *p;
-        size_t len16;
 
-        if (naddr > ARRAY_SIZE(cmd.u.exact))
+        if (naddr > FW_CLS_TCAM_NUM_ENTRIES)
                 return -EINVAL;
-        len16 = DIV_ROUND_UP(offsetof(struct fw_vi_mac_cmd,
-                                      u.exact[naddr]), 16);
 
-        memset(&cmd, 0, sizeof(cmd));
-        cmd.op_to_viid = cpu_to_be32(FW_CMD_OP(FW_VI_MAC_CMD) |
-                                     FW_CMD_REQUEST |
-                                     FW_CMD_WRITE |
-                                     (free ? FW_CMD_EXEC : 0) |
-                                     FW_VI_MAC_CMD_VIID(viid));
-        cmd.freemacs_to_len16 = cpu_to_be32(FW_VI_MAC_CMD_FREEMACS(free) |
-                                            FW_CMD_LEN16(len16));
+        for (offset = 0; offset < naddr; /**/) {
+                unsigned int fw_naddr = (rem < ARRAY_SIZE(cmd.u.exact)
+                                         ? rem
+                                         : ARRAY_SIZE(cmd.u.exact));
+                size_t len16 = DIV_ROUND_UP(offsetof(struct fw_vi_mac_cmd,
+                                                     u.exact[fw_naddr]), 16);
+                struct fw_vi_mac_exact *p;
+                int i;
 
-        for (i = 0, p = cmd.u.exact; i < naddr; i++, p++) {
-                p->valid_to_idx =
-                        cpu_to_be16(FW_VI_MAC_CMD_VALID |
-                                    FW_VI_MAC_CMD_IDX(FW_VI_MAC_ADD_MAC));
-                memcpy(p->macaddr, addr[i], sizeof(p->macaddr));
-        }
+                memset(&cmd, 0, sizeof(cmd));
+                cmd.op_to_viid = cpu_to_be32(FW_CMD_OP(FW_VI_MAC_CMD) |
+                                             FW_CMD_REQUEST |
+                                             FW_CMD_WRITE |
+                                             (free ? FW_CMD_EXEC : 0) |
+                                             FW_VI_MAC_CMD_VIID(viid));
+                cmd.freemacs_to_len16 =
+                        cpu_to_be32(FW_VI_MAC_CMD_FREEMACS(free) |
+                                    FW_CMD_LEN16(len16));
+
+                for (i = 0, p = cmd.u.exact; i < fw_naddr; i++, p++) {
+                        p->valid_to_idx = cpu_to_be16(
+                                FW_VI_MAC_CMD_VALID |
+                                FW_VI_MAC_CMD_IDX(FW_VI_MAC_ADD_MAC));
+                        memcpy(p->macaddr, addr[offset+i], sizeof(p->macaddr));
+                }
+
+
+                ret = t4vf_wr_mbox_core(adapter, &cmd, sizeof(cmd), &rpl,
+                                        sleep_ok);
+                if (ret && ret != -ENOMEM)
+                        break;
 
-        ret = t4vf_wr_mbox_core(adapter, &cmd, sizeof(cmd), &rpl, sleep_ok);
-        if (ret)
-                return ret;
-
-        for (i = 0, p = rpl.u.exact; i < naddr; i++, p++) {
-                u16 index = FW_VI_MAC_CMD_IDX_GET(be16_to_cpu(p->valid_to_idx));
-
-                if (idx)
-                        idx[i] = (index >= FW_CLS_TCAM_NUM_ENTRIES
-                                  ? 0xffff
-                                  : index);
-                if (index < FW_CLS_TCAM_NUM_ENTRIES)
-                        ret++;
-                else if (hash)
-                        *hash |= (1 << hash_mac_addr(addr[i]));
+                for (i = 0, p = rpl.u.exact; i < fw_naddr; i++, p++) {
+                        u16 index = FW_VI_MAC_CMD_IDX_GET(
+                                be16_to_cpu(p->valid_to_idx));
+
+                        if (idx)
+                                idx[offset+i] =
+                                        (index >= FW_CLS_TCAM_NUM_ENTRIES
+                                         ? 0xffff
+                                         : index);
+                        if (index < FW_CLS_TCAM_NUM_ENTRIES)
+                                nfilters++;
+                        else if (hash)
+                                *hash |= (1ULL << hash_mac_addr(addr[offset+i]));
+                }
+
+                free = false;
+                offset += fw_naddr;
+                rem -= fw_naddr;
         }
+
+        /*
+         * If there were no errors or we merely ran out of room in our MAC
+         * address arena, return the number of filters actually written.
+         */
+        if (ret == 0 || ret == -ENOMEM)
+                ret = nfilters;
         return ret;
 }
 
diff --git a/drivers/net/e1000/e1000_main.c b/drivers/net/e1000/e1000_main.c
index dcb7f82c2701..06c7d1c67517 100644
--- a/drivers/net/e1000/e1000_main.c
+++ b/drivers/net/e1000/e1000_main.c
@@ -31,7 +31,7 @@
 
 char e1000_driver_name[] = "e1000";
 static char e1000_driver_string[] = "Intel(R) PRO/1000 Network Driver";
-#define DRV_VERSION "7.3.21-k6-NAPI"
+#define DRV_VERSION "7.3.21-k8-NAPI"
 const char e1000_driver_version[] = DRV_VERSION;
 static const char e1000_copyright[] = "Copyright (c) 1999-2006 Intel Corporation.";
 
@@ -485,9 +485,6 @@ void e1000_down(struct e1000_adapter *adapter)
         struct net_device *netdev = adapter->netdev;
         u32 rctl, tctl;
 
-        /* signal that we're down so the interrupt handler does not
-         * reschedule our watchdog timer */
-        set_bit(__E1000_DOWN, &adapter->flags);
 
         /* disable receives in the hardware */
         rctl = er32(RCTL);
@@ -508,6 +505,13 @@ void e1000_down(struct e1000_adapter *adapter)
 
         e1000_irq_disable(adapter);
 
+        /*
+         * Setting DOWN must be after irq_disable to prevent
+         * a screaming interrupt.  Setting DOWN also prevents
+         * timers and tasks from rescheduling.
+         */
+        set_bit(__E1000_DOWN, &adapter->flags);
+
         del_timer_sync(&adapter->tx_fifo_stall_timer);
         del_timer_sync(&adapter->watchdog_timer);
         del_timer_sync(&adapter->phy_info_timer);
diff --git a/drivers/net/ehea/ehea_ethtool.c b/drivers/net/ehea/ehea_ethtool.c
index 75b099ce49c9..1f37ee6b2a26 100644
--- a/drivers/net/ehea/ehea_ethtool.c
+++ b/drivers/net/ehea/ehea_ethtool.c
@@ -261,6 +261,13 @@ static void ehea_get_ethtool_stats(struct net_device *dev,
 
 }
 
+static int ehea_set_flags(struct net_device *dev, u32 data)
+{
+        return ethtool_op_set_flags(dev, data, ETH_FLAG_LRO
+                                        | ETH_FLAG_TXVLAN
+                                        | ETH_FLAG_RXVLAN);
+}
+
 const struct ethtool_ops ehea_ethtool_ops = {
         .get_settings = ehea_get_settings,
         .get_drvinfo = ehea_get_drvinfo,
@@ -273,6 +280,8 @@ const struct ethtool_ops ehea_ethtool_ops = {
         .get_ethtool_stats = ehea_get_ethtool_stats,
         .get_rx_csum = ehea_get_rx_csum,
         .set_settings = ehea_set_settings,
+        .get_flags = ethtool_op_get_flags,
+        .set_flags = ehea_set_flags,
         .nway_reset = ehea_nway_reset,          /* Restart autonegotiation */
 };
 
diff --git a/drivers/net/ehea/ehea_main.c b/drivers/net/ehea/ehea_main.c
index a84c389d3db7..69f61523fcc8 100644
--- a/drivers/net/ehea/ehea_main.c
+++ b/drivers/net/ehea/ehea_main.c
@@ -400,6 +400,7 @@ static void ehea_refill_rq1(struct ehea_port_res *pr, int index, int nr_of_wqes)
                         skb_arr_rq1[index] = netdev_alloc_skb(dev,
                                                               EHEA_L_PKT_SIZE);
                         if (!skb_arr_rq1[index]) {
+                                ehea_info("Unable to allocate enough skb in the array\n");
                                 pr->rq1_skba.os_skbs = fill_wqes - i;
                                 break;
                         }
@@ -422,13 +423,20 @@ static void ehea_init_fill_rq1(struct ehea_port_res *pr, int nr_rq1a)
         struct net_device *dev = pr->port->netdev;
         int i;
 
-        for (i = 0; i < pr->rq1_skba.len; i++) {
+        if (nr_rq1a > pr->rq1_skba.len) {
+                ehea_error("NR_RQ1A bigger than skb array len\n");
+                return;
+        }
+
+        for (i = 0; i < nr_rq1a; i++) {
                 skb_arr_rq1[i] = netdev_alloc_skb(dev, EHEA_L_PKT_SIZE);
-                if (!skb_arr_rq1[i])
+                if (!skb_arr_rq1[i]) {
+                        ehea_info("No enough memory to allocate skb array\n");
                         break;
+                }
         }
         /* Ring doorbell */
-        ehea_update_rq1a(pr->qp, nr_rq1a);
+        ehea_update_rq1a(pr->qp, i);
 }
 
 static int ehea_refill_rq_def(struct ehea_port_res *pr,
@@ -675,7 +683,7 @@ static void ehea_proc_skb(struct ehea_port_res *pr, struct ehea_cqe *cqe,
         int vlan_extracted = ((cqe->status & EHEA_CQE_VLAN_TAG_XTRACT) &&
                               pr->port->vgrp);
 
-        if (use_lro) {
+        if (skb->dev->features & NETIF_F_LRO) {
                 if (vlan_extracted)
                         lro_vlan_hwaccel_receive_skb(&pr->lro_mgr, skb,
                                                      pr->port->vgrp,
@@ -735,8 +743,10 @@ static int ehea_proc_rwqes(struct net_device *dev,
 
                                         skb = netdev_alloc_skb(dev,
                                                                EHEA_L_PKT_SIZE);
-                                        if (!skb)
+                                        if (!skb) {
+                                                ehea_info("Not enough memory to allocate skb\n");
                                                 break;
+                                        }
                                 }
                                 skb_copy_to_linear_data(skb, ((char *)cqe) + 64,
                                                  cqe->num_bytes_transfered - 4);
@@ -777,7 +787,7 @@ static int ehea_proc_rwqes(struct net_device *dev,
                 }
                 cqe = ehea_poll_rq1(qp, &wqe_index);
         }
-        if (use_lro)
+        if (dev->features & NETIF_F_LRO)
                 lro_flush_all(&pr->lro_mgr);
 
         pr->rx_packets += processed;
@@ -3266,6 +3276,9 @@ struct ehea_port *ehea_setup_single_port(struct ehea_adapter *adapter,
                       | NETIF_F_LLTX;
         dev->watchdog_timeo = EHEA_WATCH_DOG_TIMEOUT;
 
+        if (use_lro)
+                dev->features |= NETIF_F_LRO;
+
         INIT_WORK(&port->reset_task, ehea_reset_port);
 
         ret = register_netdev(dev);
diff --git a/drivers/net/ifb.c b/drivers/net/ifb.c
index ab9f675c5b8b..fe337bd121aa 100644
--- a/drivers/net/ifb.c
+++ b/drivers/net/ifb.c
@@ -104,6 +104,8 @@ static void ri_tasklet(unsigned long dev)
                         rcu_read_unlock();
                         dev_kfree_skb(skb);
                         stats->tx_dropped++;
+                        if (skb_queue_len(&dp->tq) != 0)
+                                goto resched;
                         break;
                 }
                 rcu_read_unlock();
diff --git a/drivers/net/irda/sh_sir.c b/drivers/net/irda/sh_sir.c
index 00b38bccd6d0..52a7c86af663 100644
--- a/drivers/net/irda/sh_sir.c
+++ b/drivers/net/irda/sh_sir.c
@@ -258,7 +258,7 @@ static int sh_sir_set_baudrate(struct sh_sir_self *self, u32 baudrate)
 
         /* Baud Rate Error Correction x 10000 */
         u32 rate_err_array[] = {
-                0000, 0625, 1250, 1875,
+                   0,  625, 1250, 1875,
                 2500, 3125, 3750, 4375,
                 5000, 5625, 6250, 6875,
                 7500, 8125, 8750, 9375,
diff --git a/drivers/net/ixgbe/ixgbe_main.c b/drivers/net/ixgbe/ixgbe_main.c
index a12e86fccb06..fdb35d040d23 100644
--- a/drivers/net/ixgbe/ixgbe_main.c
+++ b/drivers/net/ixgbe/ixgbe_main.c
@@ -4987,6 +4987,9 @@ void ixgbe_clear_interrupt_scheme(struct ixgbe_adapter *adapter)
                 adapter->rx_ring[i] = NULL;
         }
 
+        adapter->num_tx_queues = 0;
+        adapter->num_rx_queues = 0;
+
         ixgbe_free_q_vectors(adapter);
         ixgbe_reset_interrupt_capability(adapter);
 }
diff --git a/drivers/net/pch_gbe/pch_gbe_main.c b/drivers/net/pch_gbe/pch_gbe_main.c
index 58e79033a8ee..d7355306a738 100644
--- a/drivers/net/pch_gbe/pch_gbe_main.c
+++ b/drivers/net/pch_gbe/pch_gbe_main.c
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 1999 - 2010 Intel Corporation.
- * Copyright (C) 2010 OKI SEMICONDUCTOR Co., LTD.
+ * Copyright (C) 2010 OKI SEMICONDUCTOR CO., LTD.
  *
  * This code was derived from the Intel e1000e Linux driver.
  *
@@ -2462,8 +2462,8 @@ static void __exit pch_gbe_exit_module(void)
 module_init(pch_gbe_init_module);
 module_exit(pch_gbe_exit_module);
 
-MODULE_DESCRIPTION("OKI semiconductor PCH Gigabit ethernet Driver");
-MODULE_AUTHOR("OKI semiconductor, <masa-korg@dsn.okisemi.com>");
+MODULE_DESCRIPTION("EG20T PCH Gigabit ethernet Driver");
+MODULE_AUTHOR("OKI SEMICONDUCTOR, <toshiharu-linux@dsn.okisemi.com>");
 MODULE_LICENSE("GPL");
 MODULE_VERSION(DRV_VERSION);
 MODULE_DEVICE_TABLE(pci, pch_gbe_pcidev_id);
diff --git a/drivers/net/pch_gbe/pch_gbe_param.c b/drivers/net/pch_gbe/pch_gbe_param.c
index 2510146fc560..ef0996a0eaaa 100644
--- a/drivers/net/pch_gbe/pch_gbe_param.c
+++ b/drivers/net/pch_gbe/pch_gbe_param.c
@@ -434,8 +434,8 @@ void pch_gbe_check_options(struct pch_gbe_adapter *adapter)
                         .err  = "using default of "
                                 __MODULE_STRING(PCH_GBE_DEFAULT_TXD),
                         .def  = PCH_GBE_DEFAULT_TXD,
-                        .arg  = { .r = { .min = PCH_GBE_MIN_TXD } },
-                        .arg  = { .r = { .max = PCH_GBE_MAX_TXD } }
+                        .arg  = { .r = { .min = PCH_GBE_MIN_TXD,
+                                         .max = PCH_GBE_MAX_TXD } }
                 };
                 struct pch_gbe_tx_ring *tx_ring = adapter->tx_ring;
                 tx_ring->count = TxDescriptors;
@@ -450,8 +450,8 @@ void pch_gbe_check_options(struct pch_gbe_adapter *adapter)
                         .err  = "using default of "
                                 __MODULE_STRING(PCH_GBE_DEFAULT_RXD),
                         .def  = PCH_GBE_DEFAULT_RXD,
-                        .arg  = { .r = { .min = PCH_GBE_MIN_RXD } },
-                        .arg  = { .r = { .max = PCH_GBE_MAX_RXD } }
+                        .arg  = { .r = { .min = PCH_GBE_MIN_RXD,
+                                         .max = PCH_GBE_MAX_RXD } }
                 };
                 struct pch_gbe_rx_ring *rx_ring = adapter->rx_ring;
                 rx_ring->count = RxDescriptors;
diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c
index f0bd1a1aba3a..e8b9c53c304b 100644
--- a/drivers/net/phy/marvell.c
+++ b/drivers/net/phy/marvell.c
@@ -30,11 +30,14 @@
 #include <linux/ethtool.h>
 #include <linux/phy.h>
 #include <linux/marvell_phy.h>
+#include <linux/of.h>
 
 #include <asm/io.h>
 #include <asm/irq.h>
 #include <asm/uaccess.h>
 
+#define MII_MARVELL_PHY_PAGE            22
+
 #define MII_M1011_IEVENT                0x13
 #define MII_M1011_IEVENT_CLEAR          0x0000
 
@@ -80,7 +83,6 @@
 #define MII_88E1121_PHY_LED_CTRL        16
 #define MII_88E1121_PHY_LED_PAGE        3
 #define MII_88E1121_PHY_LED_DEF         0x0030
-#define MII_88E1121_PHY_PAGE            22
 
 #define MII_M1011_PHY_STATUS            0x11
 #define MII_M1011_PHY_STATUS_1000       0x8000
@@ -186,13 +188,94 @@ static int marvell_config_aneg(struct phy_device *phydev)
         return 0;
 }
 
+#ifdef CONFIG_OF_MDIO
+/*
+ * Set and/or override some configuration registers based on the
+ * marvell,reg-init property stored in the of_node for the phydev.
+ *
+ * marvell,reg-init = <reg-page reg mask value>,...;
+ *
+ * There may be one or more sets of <reg-page reg mask value>:
+ *
+ * reg-page: which register bank to use.
+ * reg: the register.
+ * mask: if non-zero, ANDed with existing register value.
+ * value: ORed with the masked value and written to the regiser.
+ *
+ */
+static int marvell_of_reg_init(struct phy_device *phydev)
+{
+        const __be32 *paddr;
+        int len, i, saved_page, current_page, page_changed, ret;
+
+        if (!phydev->dev.of_node)
+                return 0;
+
+        paddr = of_get_property(phydev->dev.of_node, "marvell,reg-init", &len);
+        if (!paddr || len < (4 * sizeof(*paddr)))
+                return 0;
+
+        saved_page = phy_read(phydev, MII_MARVELL_PHY_PAGE);
+        if (saved_page < 0)
+                return saved_page;
+        page_changed = 0;
+        current_page = saved_page;
+
+        ret = 0;
+        len /= sizeof(*paddr);
+        for (i = 0; i < len - 3; i += 4) {
+                u16 reg_page = be32_to_cpup(paddr + i);
+                u16 reg = be32_to_cpup(paddr + i + 1);
+                u16 mask = be32_to_cpup(paddr + i + 2);
+                u16 val_bits = be32_to_cpup(paddr + i + 3);
+                int val;
+
+                if (reg_page != current_page) {
+                        current_page = reg_page;
+                        page_changed = 1;
+                        ret = phy_write(phydev, MII_MARVELL_PHY_PAGE, reg_page);
+                        if (ret < 0)
+                                goto err;
+                }
+
+                val = 0;
+                if (mask) {
+                        val = phy_read(phydev, reg);
+                        if (val < 0) {
+                                ret = val;
+                                goto err;
+                        }
+                        val &= mask;
+                }
+                val |= val_bits;
+
+                ret = phy_write(phydev, reg, val);
+                if (ret < 0)
+                        goto err;
+
+        }
+err:
+        if (page_changed) {
+                i = phy_write(phydev, MII_MARVELL_PHY_PAGE, saved_page);
+                if (ret == 0)
+                        ret = i;
+        }
+        return ret;
+}
+#else
+static int marvell_of_reg_init(struct phy_device *phydev)
+{
+        return 0;
+}
+#endif /* CONFIG_OF_MDIO */
+
 static int m88e1121_config_aneg(struct phy_device *phydev)
 {
         int err, oldpage, mscr;
 
-        oldpage = phy_read(phydev, MII_88E1121_PHY_PAGE);
+        oldpage = phy_read(phydev, MII_MARVELL_PHY_PAGE);
 
-        err = phy_write(phydev, MII_88E1121_PHY_PAGE,
+        err = phy_write(phydev, MII_MARVELL_PHY_PAGE,
                         MII_88E1121_PHY_MSCR_PAGE);
         if (err < 0)
                 return err;
@@ -218,7 +301,7 @@ static int m88e1121_config_aneg(struct phy_device *phydev)
                         return err;
         }
 
-        phy_write(phydev, MII_88E1121_PHY_PAGE, oldpage);
+        phy_write(phydev, MII_MARVELL_PHY_PAGE, oldpage);
 
         err = phy_write(phydev, MII_BMCR, BMCR_RESET);
         if (err < 0)
@@ -229,11 +312,11 @@ static int m88e1121_config_aneg(struct phy_device *phydev)
         if (err < 0)
                 return err;
 
-        oldpage = phy_read(phydev, MII_88E1121_PHY_PAGE);
+        oldpage = phy_read(phydev, MII_MARVELL_PHY_PAGE);
 
-        phy_write(phydev, MII_88E1121_PHY_PAGE, MII_88E1121_PHY_LED_PAGE);
+        phy_write(phydev, MII_MARVELL_PHY_PAGE, MII_88E1121_PHY_LED_PAGE);
         phy_write(phydev, MII_88E1121_PHY_LED_CTRL, MII_88E1121_PHY_LED_DEF);
-        phy_write(phydev, MII_88E1121_PHY_PAGE, oldpage);
+        phy_write(phydev, MII_MARVELL_PHY_PAGE, oldpage);
 
         err = genphy_config_aneg(phydev);
 
@@ -244,9 +327,9 @@ static int m88e1318_config_aneg(struct phy_device *phydev)
 {
         int err, oldpage, mscr;
 
-        oldpage = phy_read(phydev, MII_88E1121_PHY_PAGE);
+        oldpage = phy_read(phydev, MII_MARVELL_PHY_PAGE);
 
-        err = phy_write(phydev, MII_88E1121_PHY_PAGE,
+        err = phy_write(phydev, MII_MARVELL_PHY_PAGE,
                         MII_88E1121_PHY_MSCR_PAGE);
         if (err < 0)
                 return err;
@@ -258,7 +341,7 @@ static int m88e1318_config_aneg(struct phy_device *phydev)
         if (err < 0)
                 return err;
 
-        err = phy_write(phydev, MII_88E1121_PHY_PAGE, oldpage);
+        err = phy_write(phydev, MII_MARVELL_PHY_PAGE, oldpage);
         if (err < 0)
                 return err;
 
@@ -368,6 +451,9 @@ static int m88e1111_config_init(struct phy_device *phydev)
                         return err;
         }
 
+        err = marvell_of_reg_init(phydev);
+        if (err < 0)
+                return err;
 
         err = phy_write(phydev, MII_BMCR, BMCR_RESET);
         if (err < 0)
@@ -398,7 +484,7 @@ static int m88e1118_config_init(struct phy_device *phydev)
         int err;
 
         /* Change address */
-        err = phy_write(phydev, 0x16, 0x0002);
+        err = phy_write(phydev, MII_MARVELL_PHY_PAGE, 0x0002);
         if (err < 0)
                 return err;
 
@@ -408,7 +494,7 @@ static int m88e1118_config_init(struct phy_device *phydev)
                 return err;
 
         /* Change address */
-        err = phy_write(phydev, 0x16, 0x0003);
+        err = phy_write(phydev, MII_MARVELL_PHY_PAGE, 0x0003);
         if (err < 0)
                 return err;
 
@@ -420,8 +506,42 @@ static int m88e1118_config_init(struct phy_device *phydev)
         if (err < 0)
                 return err;
 
+        err = marvell_of_reg_init(phydev);
+        if (err < 0)
+                return err;
+
         /* Reset address */
-        err = phy_write(phydev, 0x16, 0x0);
+        err = phy_write(phydev, MII_MARVELL_PHY_PAGE, 0x0);
+        if (err < 0)
+                return err;
+
+        err = phy_write(phydev, MII_BMCR, BMCR_RESET);
+        if (err < 0)
+                return err;
+
+        return 0;
+}
+
+static int m88e1149_config_init(struct phy_device *phydev)
+{
+        int err;
+
+        /* Change address */
+        err = phy_write(phydev, MII_MARVELL_PHY_PAGE, 0x0002);
+        if (err < 0)
+                return err;
+
+        /* Enable 1000 Mbit */
+        err = phy_write(phydev, 0x15, 0x1048);
+        if (err < 0)
+                return err;
+
+        err = marvell_of_reg_init(phydev);
+        if (err < 0)
+                return err;
+
+        /* Reset address */
+        err = phy_write(phydev, MII_MARVELL_PHY_PAGE, 0x0);
         if (err < 0)
                 return err;
 
@@ -491,6 +611,10 @@ static int m88e1145_config_init(struct phy_device *phydev)
                 }
         }
 
+        err = marvell_of_reg_init(phydev);
+        if (err < 0)
+                return err;
+
         return 0;
 }
 
@@ -685,6 +809,19 @@ static struct phy_driver marvell_drivers[] = {
                 .driver = { .owner = THIS_MODULE },
         },
         {
+                .phy_id = MARVELL_PHY_ID_88E1149R,
+                .phy_id_mask = MARVELL_PHY_ID_MASK,
+                .name = "Marvell 88E1149R",
+                .features = PHY_GBIT_FEATURES,
+                .flags = PHY_HAS_INTERRUPT,
+                .config_init = &m88e1149_config_init,
+                .config_aneg = &m88e1118_config_aneg,
+                .read_status = &genphy_read_status,
+                .ack_interrupt = &marvell_ack_interrupt,
+                .config_intr = &marvell_config_intr,
+                .driver = { .owner = THIS_MODULE },
+        },
+        {
                 .phy_id = MARVELL_PHY_ID_88E1240,
                 .phy_id_mask = MARVELL_PHY_ID_MASK,
                 .name = "Marvell 88E1240",
@@ -735,6 +872,7 @@ static struct mdio_device_id __maybe_unused marvell_tbl[] = {
         { 0x01410e10, 0xfffffff0 },
         { 0x01410cb0, 0xfffffff0 },
         { 0x01410cd0, 0xfffffff0 },
+        { 0x01410e50, 0xfffffff0 },
         { 0x01410e30, 0xfffffff0 },
         { 0x01410e90, 0xfffffff0 },
         { }
diff --git a/drivers/net/ppp_generic.c b/drivers/net/ppp_generic.c
index 0c91598ae280..b708f68471a6 100644
--- a/drivers/net/ppp_generic.c
+++ b/drivers/net/ppp_generic.c
@@ -2580,16 +2580,16 @@ ppp_create_interface(struct net *net, int unit, int *retp)
          */
         dev_net_set(dev, net);
 
-        ret = -EEXIST;
         mutex_lock(&pn->all_ppp_mutex);
 
         if (unit < 0) {
                 unit = unit_get(&pn->units_idr, ppp);
                 if (unit < 0) {
-                        *retp = unit;
+                        ret = unit;
                         goto out2;
                 }
         } else {
+                ret = -EEXIST;
                 if (unit_find(&pn->units_idr, unit))
                         goto out2; /* unit already exists */
                 /*
@@ -2664,10 +2664,10 @@ static void ppp_shutdown_interface(struct ppp *ppp)
                 ppp->closing = 1;
                 ppp_unlock(ppp);
                 unregister_netdev(ppp->dev);
+                unit_put(&pn->units_idr, ppp->file.index);
         } else
                 ppp_unlock(ppp);
 
-        unit_put(&pn->units_idr, ppp->file.index);
         ppp->file.dead = 1;
         ppp->owner = NULL;
         wake_up_interruptible(&ppp->file.rwait);
@@ -2855,8 +2855,7 @@ static void __exit ppp_cleanup(void)
  * by holding all_ppp_mutex
  */
 
-/* associate pointer with specified number */
-static int unit_set(struct idr *p, void *ptr, int n)
+static int __unit_alloc(struct idr *p, void *ptr, int n)
 {
         int unit, err;
 
@@ -2867,10 +2866,24 @@ again:
         }
 
         err = idr_get_new_above(p, ptr, n, &unit);
-        if (err == -EAGAIN)
-                goto again;
+        if (err < 0) {
+                if (err == -EAGAIN)
+                        goto again;
+                return err;
+        }
+
+        return unit;
+}
+
+/* associate pointer with specified number */
+static int unit_set(struct idr *p, void *ptr, int n)
+{
+        int unit;
 
-        if (unit != n) {
+        unit = __unit_alloc(p, ptr, n);
+        if (unit < 0)
+                return unit;
+        else if (unit != n) {
                 idr_remove(p, unit);
                 return -EINVAL;
         }
@@ -2881,19 +2894,7 @@ again:
 /* get new free unit number and associate pointer with it */
 static int unit_get(struct idr *p, void *ptr)
 {
-        int unit, err;
-
-again:
-        if (!idr_pre_get(p, GFP_KERNEL)) {
-                printk(KERN_ERR "PPP: No free memory for idr\n");
-                return -ENOMEM;
-        }
-
-        err = idr_get_new_above(p, ptr, 0, &unit);
-        if (err == -EAGAIN)
-                goto again;
-
-        return unit;
+        return __unit_alloc(p, ptr, 0);
 }
 
 /* put unit number back to a pool */
diff --git a/drivers/net/qlge/qlge_main.c b/drivers/net/qlge/qlge_main.c
index d9a76260880b..e4dbbbfec723 100644
--- a/drivers/net/qlge/qlge_main.c
+++ b/drivers/net/qlge/qlge_main.c
@@ -62,15 +62,15 @@ static const u32 default_msg =
 /* NETIF_MSG_PKTDATA | */
     NETIF_MSG_HW | NETIF_MSG_WOL | 0;
 
-static int debug = 0x00007fff;  /* defaults above */
-module_param(debug, int, 0);
+static int debug = -1;  /* defaults above */
+module_param(debug, int, 0664);
 MODULE_PARM_DESC(debug, "Debug level (0=none,...,16=all)");
 
 #define MSIX_IRQ 0
 #define MSI_IRQ 1
 #define LEG_IRQ 2
 static int qlge_irq_type = MSIX_IRQ;
-module_param(qlge_irq_type, int, MSIX_IRQ);
+module_param(qlge_irq_type, int, 0664);
 MODULE_PARM_DESC(qlge_irq_type, "0 = MSI-X, 1 = MSI, 2 = Legacy.");
 
 static int qlge_mpi_coredump;
diff --git a/drivers/net/sfc/efx.c b/drivers/net/sfc/efx.c
index f3e4043d70ee..2166c1d0a533 100644
--- a/drivers/net/sfc/efx.c
+++ b/drivers/net/sfc/efx.c
@@ -196,7 +196,9 @@ MODULE_PARM_DESC(debug, "Bitmapped debugging message enable value");
 
 static void efx_remove_channels(struct efx_nic *efx);
 static void efx_remove_port(struct efx_nic *efx);
+static void efx_init_napi(struct efx_nic *efx);
 static void efx_fini_napi(struct efx_nic *efx);
+static void efx_fini_napi_channel(struct efx_channel *channel);
 static void efx_fini_struct(struct efx_nic *efx);
 static void efx_start_all(struct efx_nic *efx);
 static void efx_stop_all(struct efx_nic *efx);
@@ -334,8 +336,10 @@ void efx_process_channel_now(struct efx_channel *channel)
 
         /* Disable interrupts and wait for ISRs to complete */
         efx_nic_disable_interrupts(efx);
-        if (efx->legacy_irq)
+        if (efx->legacy_irq) {
                 synchronize_irq(efx->legacy_irq);
+                efx->legacy_irq_enabled = false;
+        }
         if (channel->irq)
                 synchronize_irq(channel->irq);
 
@@ -350,6 +354,8 @@ void efx_process_channel_now(struct efx_channel *channel)
         efx_channel_processed(channel);
 
         napi_enable(&channel->napi_str);
+        if (efx->legacy_irq)
+                efx->legacy_irq_enabled = true;
         efx_nic_enable_interrupts(efx);
 }
 
@@ -425,6 +431,7 @@ efx_alloc_channel(struct efx_nic *efx, int i, struct efx_channel *old_channel)
 
                 *channel = *old_channel;
 
+                channel->napi_dev = NULL;
                 memset(&channel->eventq, 0, sizeof(channel->eventq));
 
                 rx_queue = &channel->rx_queue;
@@ -735,9 +742,13 @@ efx_realloc_channels(struct efx_nic *efx, u32 rxq_entries, u32 txq_entries)
         if (rc)
                 goto rollback;
 
+        efx_init_napi(efx);
+
         /* Destroy old channels */
-        for (i = 0; i < efx->n_channels; i++)
+        for (i = 0; i < efx->n_channels; i++) {
+                efx_fini_napi_channel(other_channel[i]);
                 efx_remove_channel(other_channel[i]);
+        }
 out:
         /* Free unused channel structures */
         for (i = 0; i < efx->n_channels; i++)
@@ -1401,6 +1412,8 @@ static void efx_start_all(struct efx_nic *efx)
                 efx_start_channel(channel);
         }
 
+        if (efx->legacy_irq)
+                efx->legacy_irq_enabled = true;
         efx_nic_enable_interrupts(efx);
 
         /* Switch to event based MCDI completions after enabling interrupts.
@@ -1461,8 +1474,10 @@ static void efx_stop_all(struct efx_nic *efx)
 
         /* Disable interrupts and wait for ISR to complete */
         efx_nic_disable_interrupts(efx);
-        if (efx->legacy_irq)
+        if (efx->legacy_irq) {
                 synchronize_irq(efx->legacy_irq);
+                efx->legacy_irq_enabled = false;
+        }
         efx_for_each_channel(channel, efx) {
                 if (channel->irq)
                         synchronize_irq(channel->irq);
@@ -1594,7 +1609,7 @@ static int efx_ioctl(struct net_device *net_dev, struct ifreq *ifr, int cmd)
  *
  **************************************************************************/
 
-static int efx_init_napi(struct efx_nic *efx)
+static void efx_init_napi(struct efx_nic *efx)
 {
         struct efx_channel *channel;
 
@@ -1603,18 +1618,21 @@ static int efx_init_napi(struct efx_nic *efx)
                 netif_napi_add(channel->napi_dev, &channel->napi_str,
                                efx_poll, napi_weight);
         }
-        return 0;
+}
+
+static void efx_fini_napi_channel(struct efx_channel *channel)
+{
+        if (channel->napi_dev)
+                netif_napi_del(&channel->napi_str);
+        channel->napi_dev = NULL;
 }
 
 static void efx_fini_napi(struct efx_nic *efx)
 {
         struct efx_channel *channel;
 
-        efx_for_each_channel(channel, efx) {
-                if (channel->napi_dev)
-                        netif_napi_del(&channel->napi_str);
-                channel->napi_dev = NULL;
-        }
+        efx_for_each_channel(channel, efx)
+                efx_fini_napi_channel(channel);
 }
 
 /**************************************************************************
@@ -2331,9 +2349,7 @@ static int efx_pci_probe_main(struct efx_nic *efx)
         if (rc)
                 goto fail1;
 
-        rc = efx_init_napi(efx);
-        if (rc)
-                goto fail2;
+        efx_init_napi(efx);
 
         rc = efx->type->init(efx);
         if (rc) {
@@ -2364,7 +2380,6 @@ static int efx_pci_probe_main(struct efx_nic *efx)
         efx->type->fini(efx);
  fail3:
         efx_fini_napi(efx);
- fail2:
         efx_remove_all(efx);
  fail1:
         return rc;
diff --git a/drivers/net/sfc/net_driver.h b/drivers/net/sfc/net_driver.h
index 0d19fbfc5c2c..4c12332434b7 100644
--- a/drivers/net/sfc/net_driver.h
+++ b/drivers/net/sfc/net_driver.h
@@ -621,6 +621,7 @@ struct efx_filter_state;
  * @pci_dev: The PCI device
  * @type: Controller type attributes
  * @legacy_irq: IRQ number
+ * @legacy_irq_enabled: Are IRQs enabled on NIC (INT_EN_KER register)?
  * @workqueue: Workqueue for port reconfigures and the HW monitor.
  *      Work items do not hold and must not acquire RTNL.
  * @workqueue_name: Name of workqueue
@@ -702,6 +703,7 @@ struct efx_nic {
         struct pci_dev *pci_dev;
         const struct efx_nic_type *type;
         int legacy_irq;
+        bool legacy_irq_enabled;
         struct workqueue_struct *workqueue;
         char workqueue_name[16];
         struct work_struct reset_work;
diff --git a/drivers/net/sfc/nic.c b/drivers/net/sfc/nic.c
index 9743cff15130..399b12abe2fd 100644
--- a/drivers/net/sfc/nic.c
+++ b/drivers/net/sfc/nic.c
@@ -1380,6 +1380,12 @@ static irqreturn_t efx_legacy_interrupt(int irq, void *dev_id)
         u32 queues;
         int syserr;
 
+        /* Could this be ours?  If interrupts are disabled then the
+         * channel state may not be valid.
+         */
+        if (!efx->legacy_irq_enabled)
+                return result;
+
         /* Read the ISR which also ACKs the interrupts */
         efx_readd(efx, &reg, FR_BZ_INT_ISR0);
         queues = EFX_EXTRACT_DWORD(reg, 0, 31);
diff --git a/drivers/net/stmmac/stmmac_main.c b/drivers/net/stmmac/stmmac_main.c
index bfc2d1251502..c0dc78571c62 100644
--- a/drivers/net/stmmac/stmmac_main.c
+++ b/drivers/net/stmmac/stmmac_main.c
@@ -1517,6 +1517,8 @@ static int stmmac_probe(struct net_device *dev)
                 pr_warning("\tno valid MAC address;"
                         "please, use ifconfig or nwhwconfig!\n");
 
+        spin_lock_init(&priv->lock);
+
         ret = register_netdev(dev);
         if (ret) {
                 pr_err("%s: ERROR %i registering the device\n",
@@ -1528,8 +1530,6 @@ static int stmmac_probe(struct net_device *dev)
             dev->name, (dev->features & NETIF_F_SG) ? "on" : "off",
             (dev->features & NETIF_F_IP_CSUM) ? "on" : "off");
 
-        spin_lock_init(&priv->lock);
-
         return ret;
 }
 
diff --git a/drivers/net/tulip/dmfe.c b/drivers/net/tulip/dmfe.c
index a9f7d5d1a269..7064e035757a 100644
--- a/drivers/net/tulip/dmfe.c
+++ b/drivers/net/tulip/dmfe.c
@@ -688,9 +688,6 @@ static netdev_tx_t dmfe_start_xmit(struct sk_buff *skb,
 
         DMFE_DBUG(0, "dmfe_start_xmit", 0);
 
-        /* Resource flag check */
-        netif_stop_queue(dev);
-
         /* Too large packet check */
         if (skb->len > MAX_PACKET_SIZE) {
                 pr_err("big packet = %d\n", (u16)skb->len);
@@ -698,6 +695,9 @@ static netdev_tx_t dmfe_start_xmit(struct sk_buff *skb,
                 return NETDEV_TX_OK;
         }
 
+        /* Resource flag check */
+        netif_stop_queue(dev);
+
         spin_lock_irqsave(&db->lock, flags);
 
         /* No Tx resource check, it never happen nromally */
diff --git a/drivers/net/ucc_geth.h b/drivers/net/ucc_geth.h
index 05a95586f3c5..055b87ab4f07 100644
--- a/drivers/net/ucc_geth.h
+++ b/drivers/net/ucc_geth.h
@@ -899,7 +899,8 @@ struct ucc_geth_hardware_statistics {
 #define UCC_GETH_UTFS_INIT                      512     /* Tx virtual FIFO size
                                                          */
 #define UCC_GETH_UTFET_INIT                     256     /* 1/2 utfs */
-#define UCC_GETH_UTFTT_INIT                     512
+#define UCC_GETH_UTFTT_INIT                     256     /* 1/2 utfs
+                                                           due to errata */
 /* Gigabit Ethernet (1000 Mbps) */
 #define UCC_GETH_URFS_GIGA_INIT                 4096/*2048*/    /* Rx virtual
                                                                    FIFO size */
diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
index be8cc2a8e213..93c6b5f62ac4 100644
--- a/drivers/net/usb/hso.c
+++ b/drivers/net/usb/hso.c
@@ -2993,12 +2993,14 @@ static int hso_probe(struct usb_interface *interface,
 
         case HSO_INTF_BULK:
                 /* It's a regular bulk interface */
-                if (((port_spec & HSO_PORT_MASK) == HSO_PORT_NETWORK) &&
-                    !disable_net)
-                        hso_dev = hso_create_net_device(interface, port_spec);
-                else
+                if ((port_spec & HSO_PORT_MASK) == HSO_PORT_NETWORK) {
+                        if (!disable_net)
+                                hso_dev =
+                                    hso_create_net_device(interface, port_spec);
+                } else {
                         hso_dev =
                             hso_create_bulk_serial_device(interface, port_spec);
+                }
                 if (!hso_dev)
                         goto exit;
                 break;
diff --git a/drivers/net/wan/x25_asy.c b/drivers/net/wan/x25_asy.c
index d81ad8397885..cf05504d9511 100644
--- a/drivers/net/wan/x25_asy.c
+++ b/drivers/net/wan/x25_asy.c
@@ -498,7 +498,6 @@ norbuff:
 static int x25_asy_close(struct net_device *dev)
 {
         struct x25_asy *sl = netdev_priv(dev);
-        int err;
 
         spin_lock(&sl->lock);
         if (sl->tty)
@@ -507,10 +506,6 @@ static int x25_asy_close(struct net_device *dev)
         netif_stop_queue(dev);
         sl->rcount = 0;
         sl->xleft  = 0;
-        err = lapb_unregister(dev);
-        if (err != LAPB_OK)
-                printk(KERN_ERR "x25_asy_close: lapb_unregister error -%d\n",
-                        err);
         spin_unlock(&sl->lock);
         return 0;
 }
@@ -595,6 +590,7 @@ static int x25_asy_open_tty(struct tty_struct *tty)
 static void x25_asy_close_tty(struct tty_struct *tty)
 {
         struct x25_asy *sl = tty->disc_data;
+        int err;
 
         /* First make sure we're connected. */
         if (!sl || sl->magic != X25_ASY_MAGIC)
@@ -605,6 +601,11 @@ static void x25_asy_close_tty(struct tty_struct *tty)
                 dev_close(sl->dev);
         rtnl_unlock();
 
+        err = lapb_unregister(sl->dev);
+        if (err != LAPB_OK)
+                printk(KERN_ERR "x25_asy_close: lapb_unregister error -%d\n",
+                        err);
+
         tty->disc_data = NULL;
         sl->tty = NULL;
         x25_asy_free(sl);
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
index 3161a5901a7a..f2eec388693b 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
@@ -59,6 +59,9 @@
 
 static int ar9003_hw_power_interpolate(int32_t x,
                                        int32_t *px, int32_t *py, u_int16_t np);
+
+#define CTL(_tpower, _flag) ((_tpower) | ((_flag) << 6))
+
 static const struct ar9300_eeprom ar9300_default = {
         .eepromVersion = 2,
         .templateVersion = 2,
@@ -296,21 +299,21 @@ static const struct ar9300_eeprom ar9300_default = {
                 }
          },
         .ctlPowerData_2G = {
-                 { { {60, 0}, {60, 1}, {60, 0}, {60, 0} } },
-                 { { {60, 0}, {60, 1}, {60, 0}, {60, 0} } },
-                 { { {60, 1}, {60, 0}, {60, 0}, {60, 1} } },
+                 { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
+                 { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
+                 { { CTL(60, 1), CTL(60, 0), CTL(60, 0), CTL(60, 1) } },
 
-                 { { {60, 1}, {60, 0}, {0, 0}, {0, 0} } },
-                 { { {60, 0}, {60, 1}, {60, 0}, {60, 0} } },
-                 { { {60, 0}, {60, 1}, {60, 0}, {60, 0} } },
+                 { { CTL(60, 1), CTL(60, 0), CTL(0, 0), CTL(0, 0) } },
+                 { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
+                 { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
 
-                 { { {60, 0}, {60, 1}, {60, 1}, {60, 0} } },
-                 { { {60, 0}, {60, 1}, {60, 0}, {60, 0} } },
-                 { { {60, 0}, {60, 1}, {60, 0}, {60, 0} } },
+                 { { CTL(60, 0), CTL(60, 1), CTL(60, 1), CTL(60, 0) } },
+                 { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
+                 { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
 
-                 { { {60, 0}, {60, 1}, {60, 0}, {60, 0} } },
-                 { { {60, 0}, {60, 1}, {60, 1}, {60, 1} } },
-                 { { {60, 0}, {60, 1}, {60, 1}, {60, 1} } },
+                 { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
+                 { { CTL(60, 0), CTL(60, 1), CTL(60, 1), CTL(60, 1) } },
+                 { { CTL(60, 0), CTL(60, 1), CTL(60, 1), CTL(60, 1) } },
          },
         .modalHeader5G = {
                 /* 4 idle,t1,t2,b (4 bits per setting) */
@@ -582,56 +585,56 @@ static const struct ar9300_eeprom ar9300_default = {
         .ctlPowerData_5G = {
                 {
                         {
-                                {60, 1}, {60, 1}, {60, 1}, {60, 1},
-                                {60, 1}, {60, 1}, {60, 1}, {60, 0},
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 1),
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 0),
                         }
                 },
                 {
                         {
-                                {60, 1}, {60, 1}, {60, 1}, {60, 1},
-                                {60, 1}, {60, 1}, {60, 1}, {60, 0},
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 1),
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 0),
                         }
                 },
                 {
                         {
-                                {60, 0}, {60, 1}, {60, 0}, {60, 1},
-                                {60, 1}, {60, 1}, {60, 1}, {60, 1},
+                                CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 1),
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 1),
                         }
                 },
                 {
                         {
-                                {60, 0}, {60, 1}, {60, 1}, {60, 0},
-                                {60, 1}, {60, 0}, {60, 0}, {60, 0},
+                                CTL(60, 0), CTL(60, 1), CTL(60, 1), CTL(60, 0),
+                                CTL(60, 1), CTL(60, 0), CTL(60, 0), CTL(60, 0),
                         }
                 },
                 {
                         {
-                                {60, 1}, {60, 1}, {60, 1}, {60, 0},
-                                {60, 0}, {60, 0}, {60, 0}, {60, 0},
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 0),
+                                CTL(60, 0), CTL(60, 0), CTL(60, 0), CTL(60, 0),
                         }
                 },
                 {
                         {
-                                {60, 1}, {60, 1}, {60, 1}, {60, 1},
-                                {60, 1}, {60, 0}, {60, 0}, {60, 0},
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 1),
+                                CTL(60, 1), CTL(60, 0), CTL(60, 0), CTL(60, 0),
                         }
                 },
                 {
                         {
-                                {60, 1}, {60, 1}, {60, 1}, {60, 1},
-                                {60, 1}, {60, 1}, {60, 1}, {60, 1},
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 1),
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 1),
                         }
                 },
                 {
                         {
-                                {60, 1}, {60, 1}, {60, 0}, {60, 1},
-                                {60, 1}, {60, 1}, {60, 1}, {60, 0},
+                                CTL(60, 1), CTL(60, 1), CTL(60, 0), CTL(60, 1),
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 0),
                         }
                 },
                 {
                         {
-                                {60, 1}, {60, 0}, {60, 1}, {60, 1},
-                                {60, 1}, {60, 1}, {60, 0}, {60, 1},
+                                CTL(60, 1), CTL(60, 0), CTL(60, 1), CTL(60, 1),
+                                CTL(60, 1), CTL(60, 1), CTL(60, 0), CTL(60, 1),
                         }
                 },
          }
@@ -873,21 +876,21 @@ static const struct ar9300_eeprom ar9300_x113 = {
                 }
          },
         .ctlPowerData_2G = {
-                 { { {60, 0}, {60, 1}, {60, 0}, {60, 0} } },
-                 { { {60, 0}, {60, 1}, {60, 0}, {60, 0} } },
-                 { { {60, 1}, {60, 0}, {60, 0}, {60, 1} } },
+                 { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
+                 { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
+                 { { CTL(60, 1), CTL(60, 0), CTL(60, 0), CTL(60, 1) } },
 
-                 { { {60, 1}, {60, 0}, {0, 0}, {0, 0} } },
-                 { { {60, 0}, {60, 1}, {60, 0}, {60, 0} } },
-                 { { {60, 0}, {60, 1}, {60, 0}, {60, 0} } },
+                 { { CTL(60, 1), CTL(60, 0), CTL(0, 0), CTL(0, 0) } },
+                 { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
+                 { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
 
-                 { { {60, 0}, {60, 1}, {60, 1}, {60, 0} } },
-                 { { {60, 0}, {60, 1}, {60, 0}, {60, 0} } },
-                 { { {60, 0}, {60, 1}, {60, 0}, {60, 0} } },
+                 { { CTL(60, 0), CTL(60, 1), CTL(60, 1), CTL(60, 0) } },
+                 { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
+                 { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
 
-                 { { {60, 0}, {60, 1}, {60, 0}, {60, 0} } },
-                 { { {60, 0}, {60, 1}, {60, 1}, {60, 1} } },
-                 { { {60, 0}, {60, 1}, {60, 1}, {60, 1} } },
+                 { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
+                 { { CTL(60, 0), CTL(60, 1), CTL(60, 1), CTL(60, 1) } },
+                 { { CTL(60, 0), CTL(60, 1), CTL(60, 1), CTL(60, 1) } },
          },
         .modalHeader5G = {
                 /* 4 idle,t1,t2,b (4 bits per setting) */
@@ -1159,56 +1162,56 @@ static const struct ar9300_eeprom ar9300_x113 = {
         .ctlPowerData_5G = {
                 {
                         {
-                                {60, 1}, {60, 1}, {60, 1}, {60, 1},
-                                {60, 1}, {60, 1}, {60, 1}, {60, 0},
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 1),
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 0),
                         }
                 },
                 {
                         {
-                                {60, 1}, {60, 1}, {60, 1}, {60, 1},
-                                {60, 1}, {60, 1}, {60, 1}, {60, 0},
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 1),
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 0),
                         }
                 },
                 {
                         {
-                                {60, 0}, {60, 1}, {60, 0}, {60, 1},
-                                {60, 1}, {60, 1}, {60, 1}, {60, 1},
+                                CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 1),
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 1),
                         }
                 },
                 {
                         {
-                                {60, 0}, {60, 1}, {60, 1}, {60, 0},
-                                {60, 1}, {60, 0}, {60, 0}, {60, 0},
+                                CTL(60, 0), CTL(60, 1), CTL(60, 1), CTL(60, 0),
+                                CTL(60, 1), CTL(60, 0), CTL(60, 0), CTL(60, 0),
                         }
                 },
                 {
                         {
-                                {60, 1}, {60, 1}, {60, 1}, {60, 0},
-                                {60, 0}, {60, 0}, {60, 0}, {60, 0},
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 0),
+                                CTL(60, 0), CTL(60, 0), CTL(60, 0), CTL(60, 0),
                         }
                 },
                 {
                         {
-                                {60, 1}, {60, 1}, {60, 1}, {60, 1},
-                                {60, 1}, {60, 0}, {60, 0}, {60, 0},
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 1),
+                                CTL(60, 1), CTL(60, 0), CTL(60, 0), CTL(60, 0),
                         }
                 },
                 {
                         {
-                                {60, 1}, {60, 1}, {60, 1}, {60, 1},
-                                {60, 1}, {60, 1}, {60, 1}, {60, 1},
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 1),
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 1),
                         }
                 },
                 {
                         {
-                                {60, 1}, {60, 1}, {60, 0}, {60, 1},
-                                {60, 1}, {60, 1}, {60, 1}, {60, 0},
+                                CTL(60, 1), CTL(60, 1), CTL(60, 0), CTL(60, 1),
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 0),
                         }
                 },
                 {
                         {
-                                {60, 1}, {60, 0}, {60, 1}, {60, 1},
-                                {60, 1}, {60, 1}, {60, 0}, {60, 1},
+                                CTL(60, 1), CTL(60, 0), CTL(60, 1), CTL(60, 1),
+                                CTL(60, 1), CTL(60, 1), CTL(60, 0), CTL(60, 1),
                         }
                 },
          }
@@ -1451,21 +1454,21 @@ static const struct ar9300_eeprom ar9300_h112 = {
                 }
         },
         .ctlPowerData_2G = {
-                { { {60, 0}, {60, 1}, {60, 0}, {60, 0} } },
-                { { {60, 0}, {60, 1}, {60, 0}, {60, 0} } },
-                { { {60, 1}, {60, 0}, {60, 0}, {60, 1} } },
+                { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
+                { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
+                { { CTL(60, 1), CTL(60, 0), CTL(60, 0), CTL(60, 1) } },
 
-                { { {60, 1}, {60, 0}, {0, 0}, {0, 0} } },
-                { { {60, 0}, {60, 1}, {60, 0}, {60, 0} } },
-                { { {60, 0}, {60, 1}, {60, 0}, {60, 0} } },
+                { { CTL(60, 1), CTL(60, 0), CTL(0, 0), CTL(0, 0) } },
+                { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
+                { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
 
-                { { {60, 0}, {60, 1}, {60, 1}, {60, 0} } },
-                { { {60, 0}, {60, 1}, {60, 0}, {60, 0} } },
-                { { {60, 0}, {60, 1}, {60, 0}, {60, 0} } },
+                { { CTL(60, 0), CTL(60, 1), CTL(60, 1), CTL(60, 0) } },
+                { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
+                { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
 
-                { { {60, 0}, {60, 1}, {60, 0}, {60, 0} } },
-                { { {60, 0}, {60, 1}, {60, 1}, {60, 1} } },
-                { { {60, 0}, {60, 1}, {60, 1}, {60, 1} } },
+                { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
+                { { CTL(60, 0), CTL(60, 1), CTL(60, 1), CTL(60, 1) } },
+                { { CTL(60, 0), CTL(60, 1), CTL(60, 1), CTL(60, 1) } },
         },
         .modalHeader5G = {
                 /* 4 idle,t1,t2,b (4 bits per setting) */
@@ -1737,56 +1740,56 @@ static const struct ar9300_eeprom ar9300_h112 = {
         .ctlPowerData_5G = {
                 {
                         {
-                                {60, 1}, {60, 1}, {60, 1}, {60, 1},
-                                {60, 1}, {60, 1}, {60, 1}, {60, 0},
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 1),
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 0),
                         }
                 },
                 {
                         {
-                                {60, 1}, {60, 1}, {60, 1}, {60, 1},
-                                {60, 1}, {60, 1}, {60, 1}, {60, 0},
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 1),
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 0),
                         }
                 },
                 {
                         {
-                                {60, 0}, {60, 1}, {60, 0}, {60, 1},
-                                {60, 1}, {60, 1}, {60, 1}, {60, 1},
+                                CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 1),
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 1),
                         }
                 },
                 {
                         {
-                                {60, 0}, {60, 1}, {60, 1}, {60, 0},
-                                {60, 1}, {60, 0}, {60, 0}, {60, 0},
+                                CTL(60, 0), CTL(60, 1), CTL(60, 1), CTL(60, 0),
+                                CTL(60, 1), CTL(60, 0), CTL(60, 0), CTL(60, 0),
                         }
                 },
                 {
                         {
-                                {60, 1}, {60, 1}, {60, 1}, {60, 0},
-                                {60, 0}, {60, 0}, {60, 0}, {60, 0},
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 0),
+                                CTL(60, 0), CTL(60, 0), CTL(60, 0), CTL(60, 0),
                         }
                 },
                 {
                         {
-                                {60, 1}, {60, 1}, {60, 1}, {60, 1},
-                                {60, 1}, {60, 0}, {60, 0}, {60, 0},
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 1),
+                                CTL(60, 1), CTL(60, 0), CTL(60, 0), CTL(60, 0),
                         }
                 },
                 {
                         {
-                                {60, 1}, {60, 1}, {60, 1}, {60, 1},
-                                {60, 1}, {60, 1}, {60, 1}, {60, 1},
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 1),
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 1),
                         }
                 },
                 {
                         {
-                                {60, 1}, {60, 1}, {60, 0}, {60, 1},
-                                {60, 1}, {60, 1}, {60, 1}, {60, 0},
+                                CTL(60, 1), CTL(60, 1), CTL(60, 0), CTL(60, 1),
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 0),
                         }
                 },
                 {
                         {
-                                {60, 1}, {60, 0}, {60, 1}, {60, 1},
-                                {60, 1}, {60, 1}, {60, 0}, {60, 1},
+                                CTL(60, 1), CTL(60, 0), CTL(60, 1), CTL(60, 1),
+                                CTL(60, 1), CTL(60, 1), CTL(60, 0), CTL(60, 1),
                         }
                 },
         }
@@ -2029,21 +2032,21 @@ static const struct ar9300_eeprom ar9300_x112 = {
                 }
         },
         .ctlPowerData_2G = {
-                { { {60, 0}, {60, 1}, {60, 0}, {60, 0} } },
-                { { {60, 0}, {60, 1}, {60, 0}, {60, 0} } },
-                { { {60, 1}, {60, 0}, {60, 0}, {60, 1} } },
+                { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
+                { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
+                { { CTL(60, 1), CTL(60, 0), CTL(60, 0), CTL(60, 1) } },
 
-                { { {60, 1}, {60, 0}, {0, 0}, {0, 0} } },
-                { { {60, 0}, {60, 1}, {60, 0}, {60, 0} } },
-                { { {60, 0}, {60, 1}, {60, 0}, {60, 0} } },
+                { { CTL(60, 1), CTL(60, 0), CTL(0, 0), CTL(0, 0) } },
+                { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
+                { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
 
-                { { {60, 0}, {60, 1}, {60, 1}, {60, 0} } },
-                { { {60, 0}, {60, 1}, {60, 0}, {60, 0} } },
-                { { {60, 0}, {60, 1}, {60, 0}, {60, 0} } },
+                { { CTL(60, 0), CTL(60, 1), CTL(60, 1), CTL(60, 0) } },
+                { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
+                { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
 
-                { { {60, 0}, {60, 1}, {60, 0}, {60, 0} } },
-                { { {60, 0}, {60, 1}, {60, 1}, {60, 1} } },
-                { { {60, 0}, {60, 1}, {60, 1}, {60, 1} } },
+                { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
+                { { CTL(60, 0), CTL(60, 1), CTL(60, 1), CTL(60, 1) } },
+                { { CTL(60, 0), CTL(60, 1), CTL(60, 1), CTL(60, 1) } },
         },
         .modalHeader5G = {
                 /* 4 idle,t1,t2,b (4 bits per setting) */
@@ -2315,56 +2318,56 @@ static const struct ar9300_eeprom ar9300_x112 = {
         .ctlPowerData_5G = {
                 {
                         {
-                                {60, 1}, {60, 1}, {60, 1}, {60, 1},
-                                {60, 1}, {60, 1}, {60, 1}, {60, 0},
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 1),
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 0),
                         }
                 },
                 {
                         {
-                                {60, 1}, {60, 1}, {60, 1}, {60, 1},
-                                {60, 1}, {60, 1}, {60, 1}, {60, 0},
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 1),
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 0),
                         }
                 },
                 {
                         {
-                                {60, 0}, {60, 1}, {60, 0}, {60, 1},
-                                {60, 1}, {60, 1}, {60, 1}, {60, 1},
+                                CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 1),
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 1),
                         }
                 },
                 {
                         {
-                                {60, 0}, {60, 1}, {60, 1}, {60, 0},
-                                {60, 1}, {60, 0}, {60, 0}, {60, 0},
+                                CTL(60, 0), CTL(60, 1), CTL(60, 1), CTL(60, 0),
+                                CTL(60, 1), CTL(60, 0), CTL(60, 0), CTL(60, 0),
                         }
                 },
                 {
                         {
-                                {60, 1}, {60, 1}, {60, 1}, {60, 0},
-                                {60, 0}, {60, 0}, {60, 0}, {60, 0},
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 0),
+                                CTL(60, 0), CTL(60, 0), CTL(60, 0), CTL(60, 0),
                         }
                 },
                 {
                         {
-                                {60, 1}, {60, 1}, {60, 1}, {60, 1},
-                                {60, 1}, {60, 0}, {60, 0}, {60, 0},
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 1),
+                                CTL(60, 1), CTL(60, 0), CTL(60, 0), CTL(60, 0),
                         }
                 },
                 {
                         {
-                                {60, 1}, {60, 1}, {60, 1}, {60, 1},
-                                {60, 1}, {60, 1}, {60, 1}, {60, 1},
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 1),
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 1),
                         }
                 },
                 {
                         {
-                                {60, 1}, {60, 1}, {60, 0}, {60, 1},
-                                {60, 1}, {60, 1}, {60, 1}, {60, 0},
+                                CTL(60, 1), CTL(60, 1), CTL(60, 0), CTL(60, 1),
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 0),
                         }
                 },
                 {
                         {
-                                {60, 1}, {60, 0}, {60, 1}, {60, 1},
-                                {60, 1}, {60, 1}, {60, 0}, {60, 1},
+                                CTL(60, 1), CTL(60, 0), CTL(60, 1), CTL(60, 1),
+                                CTL(60, 1), CTL(60, 1), CTL(60, 0), CTL(60, 1),
                         }
                 },
         }
@@ -2606,21 +2609,21 @@ static const struct ar9300_eeprom ar9300_h116 = {
                 }
          },
         .ctlPowerData_2G = {
-                 { { {60, 0}, {60, 1}, {60, 0}, {60, 0} } },
-                 { { {60, 0}, {60, 1}, {60, 0}, {60, 0} } },
-                 { { {60, 1}, {60, 0}, {60, 0}, {60, 1} } },
+                 { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
+                 { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
+                 { { CTL(60, 1), CTL(60, 0), CTL(60, 0), CTL(60, 1) } },
 
-                 { { {60, 1}, {60, 0}, {0, 0}, {0, 0} } },
-                 { { {60, 0}, {60, 1}, {60, 0}, {60, 0} } },
-                 { { {60, 0}, {60, 1}, {60, 0}, {60, 0} } },
+                 { { CTL(60, 1), CTL(60, 0), CTL(0, 0), CTL(0, 0) } },
+                 { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
+                 { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
 
-                 { { {60, 0}, {60, 1}, {60, 1}, {60, 0} } },
-                 { { {60, 0}, {60, 1}, {60, 0}, {60, 0} } },
-                 { { {60, 0}, {60, 1}, {60, 0}, {60, 0} } },
+                 { { CTL(60, 0), CTL(60, 1), CTL(60, 1), CTL(60, 0) } },
+                 { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
+                 { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
 
-                 { { {60, 0}, {60, 1}, {60, 0}, {60, 0} } },
-                 { { {60, 0}, {60, 1}, {60, 1}, {60, 1} } },
-                 { { {60, 0}, {60, 1}, {60, 1}, {60, 1} } },
+                 { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
+                 { { CTL(60, 0), CTL(60, 1), CTL(60, 1), CTL(60, 1) } },
+                 { { CTL(60, 0), CTL(60, 1), CTL(60, 1), CTL(60, 1) } },
          },
         .modalHeader5G = {
                 /* 4 idle,t1,t2,b (4 bits per setting) */
@@ -2892,56 +2895,56 @@ static const struct ar9300_eeprom ar9300_h116 = {
         .ctlPowerData_5G = {
                 {
                         {
-                                {60, 1}, {60, 1}, {60, 1}, {60, 1},
-                                {60, 1}, {60, 1}, {60, 1}, {60, 0},
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 1),
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 0),
                         }
                 },
                 {
                         {
-                                {60, 1}, {60, 1}, {60, 1}, {60, 1},
-                                {60, 1}, {60, 1}, {60, 1}, {60, 0},
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 1),
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 0),
                         }
                 },
                 {
                         {
-                                {60, 0}, {60, 1}, {60, 0}, {60, 1},
-                                {60, 1}, {60, 1}, {60, 1}, {60, 1},
+                                CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 1),
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 1),
                         }
                 },
                 {
                         {
-                                {60, 0}, {60, 1}, {60, 1}, {60, 0},
-                                {60, 1}, {60, 0}, {60, 0}, {60, 0},
+                                CTL(60, 0), CTL(60, 1), CTL(60, 1), CTL(60, 0),
+                                CTL(60, 1), CTL(60, 0), CTL(60, 0), CTL(60, 0),
                         }
                 },
                 {
                         {
-                                {60, 1}, {60, 1}, {60, 1}, {60, 0},
-                                {60, 0}, {60, 0}, {60, 0}, {60, 0},
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 0),
+                                CTL(60, 0), CTL(60, 0), CTL(60, 0), CTL(60, 0),
                         }
                 },
                 {
                         {
-                                {60, 1}, {60, 1}, {60, 1}, {60, 1},
-                                {60, 1}, {60, 0}, {60, 0}, {60, 0},
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 1),
+                                CTL(60, 1), CTL(60, 0), CTL(60, 0), CTL(60, 0),
                         }
                 },
                 {
                         {
-                                {60, 1}, {60, 1}, {60, 1}, {60, 1},
-                                {60, 1}, {60, 1}, {60, 1}, {60, 1},
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 1),
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 1),
                         }
                 },
                 {
                         {
-                                {60, 1}, {60, 1}, {60, 0}, {60, 1},
-                                {60, 1}, {60, 1}, {60, 1}, {60, 0},
+                                CTL(60, 1), CTL(60, 1), CTL(60, 0), CTL(60, 1),
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 0),
                         }
                 },
                 {
                         {
-                                {60, 1}, {60, 0}, {60, 1}, {60, 1},
-                                {60, 1}, {60, 1}, {60, 0}, {60, 1},
+                                CTL(60, 1), CTL(60, 0), CTL(60, 1), CTL(60, 1),
+                                CTL(60, 1), CTL(60, 1), CTL(60, 0), CTL(60, 1),
                         }
                 },
          }
@@ -4363,9 +4366,9 @@ static u16 ar9003_hw_get_direct_edge_power(struct ar9300_eeprom *eep,
         struct cal_ctl_data_5g *ctl_5g = eep->ctlPowerData_5G;
 
         if (is2GHz)
-                return ctl_2g[idx].ctlEdges[edge].tPower;
+                return CTL_EDGE_TPOWER(ctl_2g[idx].ctlEdges[edge]);
         else
-                return ctl_5g[idx].ctlEdges[edge].tPower;
+                return CTL_EDGE_TPOWER(ctl_5g[idx].ctlEdges[edge]);
 }
 
 static u16 ar9003_hw_get_indirect_edge_power(struct ar9300_eeprom *eep,
@@ -4383,12 +4386,12 @@ static u16 ar9003_hw_get_indirect_edge_power(struct ar9300_eeprom *eep,
 
         if (is2GHz) {
                 if (ath9k_hw_fbin2freq(ctl_freqbin[edge - 1], 1) < freq &&
-                    ctl_2g[idx].ctlEdges[edge - 1].flag)
-                        return ctl_2g[idx].ctlEdges[edge - 1].tPower;
+                    CTL_EDGE_FLAGS(ctl_2g[idx].ctlEdges[edge - 1]))
+                        return CTL_EDGE_TPOWER(ctl_2g[idx].ctlEdges[edge - 1]);
         } else {
                 if (ath9k_hw_fbin2freq(ctl_freqbin[edge - 1], 0) < freq &&
-                    ctl_5g[idx].ctlEdges[edge - 1].flag)
-                        return ctl_5g[idx].ctlEdges[edge - 1].tPower;
+                    CTL_EDGE_FLAGS(ctl_5g[idx].ctlEdges[edge - 1]))
+                        return CTL_EDGE_TPOWER(ctl_5g[idx].ctlEdges[edge - 1]);
         }
 
         return AR9300_MAX_RATE_POWER;
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.h b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.h
index 57f64dbbcd89..9c1463307f0c 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.h
+++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.h
@@ -270,17 +270,12 @@ struct cal_tgt_pow_ht {
         u8 tPow2x[14];
 } __packed;
 
-struct cal_ctl_edge_pwr {
-        u8 tPower:6,
-           flag:2;
-} __packed;
-
 struct cal_ctl_data_2g {
-        struct cal_ctl_edge_pwr ctlEdges[AR9300_NUM_BAND_EDGES_2G];
+        u8 ctlEdges[AR9300_NUM_BAND_EDGES_2G];
 } __packed;
 
 struct cal_ctl_data_5g {
-        struct cal_ctl_edge_pwr ctlEdges[AR9300_NUM_BAND_EDGES_5G];
+        u8 ctlEdges[AR9300_NUM_BAND_EDGES_5G];
 } __packed;
 
 struct ar9300_BaseExtension_1 {
diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
index 6f90acc5cca7..0b4b4704b1f0 100644
--- a/drivers/net/wireless/ath/ath9k/ath9k.h
+++ b/drivers/net/wireless/ath/ath9k/ath9k.h
@@ -21,6 +21,7 @@
 #include <linux/device.h>
 #include <linux/leds.h>
 #include <linux/completion.h>
+#include <linux/pm_qos_params.h>
 
 #include "debug.h"
 #include "common.h"
@@ -628,6 +629,8 @@ struct ath_softc {
         struct ath_descdma txsdma;
 
         struct ath_ant_comb ant_comb;
+
+        struct pm_qos_request_list pm_qos_req;
 };
 
 struct ath_wiphy {
@@ -657,7 +660,6 @@ static inline void ath_read_cachesize(struct ath_common *common, int *csz)
 }
 
 extern struct ieee80211_ops ath9k_ops;
-extern struct pm_qos_request_list ath9k_pm_qos_req;
 extern int modparam_nohwcrypt;
 extern int led_blink;
 
diff --git a/drivers/net/wireless/ath/ath9k/eeprom.c b/drivers/net/wireless/ath/ath9k/eeprom.c
index 1266333f586d..2bbf94d0191e 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom.c
@@ -240,16 +240,16 @@ u16 ath9k_hw_get_max_edge_power(u16 freq, struct cal_ctl_edges *pRdEdgesPower,
         for (i = 0; (i < num_band_edges) &&
                      (pRdEdgesPower[i].bChannel != AR5416_BCHAN_UNUSED); i++) {
                 if (freq == ath9k_hw_fbin2freq(pRdEdgesPower[i].bChannel, is2GHz)) {
-                        twiceMaxEdgePower = pRdEdgesPower[i].tPower;
+                        twiceMaxEdgePower = CTL_EDGE_TPOWER(pRdEdgesPower[i].ctl);
                         break;
                 } else if ((i > 0) &&
                            (freq < ath9k_hw_fbin2freq(pRdEdgesPower[i].bChannel,
                                                       is2GHz))) {
                         if (ath9k_hw_fbin2freq(pRdEdgesPower[i - 1].bChannel,
                                                is2GHz) < freq &&
-                            pRdEdgesPower[i - 1].flag) {
+                            CTL_EDGE_FLAGS(pRdEdgesPower[i - 1].ctl)) {
                                 twiceMaxEdgePower =
-                                        pRdEdgesPower[i - 1].tPower;
+                                        CTL_EDGE_TPOWER(pRdEdgesPower[i - 1].ctl);
                         }
                         break;
                 }
diff --git a/drivers/net/wireless/ath/ath9k/eeprom.h b/drivers/net/wireless/ath/ath9k/eeprom.h
index 3c99830dab0c..8a644fced5c9 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom.h
+++ b/drivers/net/wireless/ath/ath9k/eeprom.h
@@ -233,6 +233,18 @@
 
 #define AR9287_CHECKSUM_LOCATION (AR9287_EEP_START_LOC + 1)
 
+#define CTL_EDGE_TPOWER(_ctl) ((_ctl) & 0x3f)
+#define CTL_EDGE_FLAGS(_ctl) (((_ctl) >> 6) & 0x03)
+
+#define LNA_CTL_BUF_MODE        BIT(0)
+#define LNA_CTL_ISEL_LO         BIT(1)
+#define LNA_CTL_ISEL_HI         BIT(2)
+#define LNA_CTL_BUF_IN          BIT(3)
+#define LNA_CTL_FEM_BAND        BIT(4)
+#define LNA_CTL_LOCAL_BIAS      BIT(5)
+#define LNA_CTL_FORCE_XPA       BIT(6)
+#define LNA_CTL_USE_ANT1        BIT(7)
+
 enum eeprom_param {
         EEP_NFTHRESH_5,
         EEP_NFTHRESH_2,
@@ -378,10 +390,7 @@ struct modal_eep_header {
         u8 xatten2Margin[AR5416_MAX_CHAINS];
         u8 ob_ch1;
         u8 db_ch1;
-        u8 useAnt1:1,
-            force_xpaon:1,
-            local_bias:1,
-            femBandSelectUsed:1, xlnabufin:1, xlnaisel:2, xlnabufmode:1;
+        u8 lna_ctl;
         u8 miscBits;
         u16 xpaBiasLvlFreq[3];
         u8 futureModal[6];
@@ -535,18 +544,10 @@ struct cal_target_power_ht {
         u8 tPow2x[8];
 } __packed;
 
-
-#ifdef __BIG_ENDIAN_BITFIELD
-struct cal_ctl_edges {
-        u8 bChannel;
-        u8 flag:2, tPower:6;
-} __packed;
-#else
 struct cal_ctl_edges {
         u8 bChannel;
-        u8 tPower:6, flag:2;
+        u8 ctl;
 } __packed;
-#endif
 
 struct cal_data_op_loop_ar9287 {
         u8 pwrPdg[2][5];
diff --git a/drivers/net/wireless/ath/ath9k/eeprom_def.c b/drivers/net/wireless/ath/ath9k/eeprom_def.c
index e94216e1e107..45f70b2404a1 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom_def.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom_def.c
@@ -451,9 +451,10 @@ static void ath9k_hw_def_set_board_values(struct ath_hw *ah,
                 ath9k_hw_analog_shift_rmw(ah, AR_AN_TOP2,
                                           AR_AN_TOP2_LOCALBIAS,
                                           AR_AN_TOP2_LOCALBIAS_S,
-                                          pModal->local_bias);
+                                          !!(pModal->lna_ctl &
+                                             LNA_CTL_LOCAL_BIAS));
                 REG_RMW_FIELD(ah, AR_PHY_XPA_CFG, AR_PHY_FORCE_XPA_CFG,
-                              pModal->force_xpaon);
+                              !!(pModal->lna_ctl & LNA_CTL_FORCE_XPA));
         }
 
         REG_RMW_FIELD(ah, AR_PHY_SETTLING, AR_PHY_SETTLING_SWITCH,
@@ -1435,9 +1436,9 @@ static u8 ath9k_hw_def_get_num_ant_config(struct ath_hw *ah,
 
         num_ant_config = 1;
 
-        if (pBase->version >= 0x0E0D)
-                if (pModal->useAnt1)
-                        num_ant_config += 1;
+        if (pBase->version >= 0x0E0D &&
+            (pModal->lna_ctl & LNA_CTL_USE_ANT1))
+                num_ant_config += 1;
 
         return num_ant_config;
 }
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index ce9e59f4cd3d..380d0c651137 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -2046,7 +2046,8 @@ u32 ath9k_hw_gpio_get(struct ath_hw *ah, u32 gpio)
                 val = REG_READ(ah, AR7010_GPIO_IN);
                 return (MS(val, AR7010_GPIO_IN_VAL) & AR_GPIO_BIT(gpio)) == 0;
         } else if (AR_SREV_9300_20_OR_LATER(ah))
-                return MS_REG_READ(AR9300, gpio) != 0;
+                return (MS(REG_READ(ah, AR_GPIO_IN), AR9300_GPIO_IN_VAL) &
+                        AR_GPIO_BIT(gpio)) != 0;
         else if (AR_SREV_9271(ah))
                 return MS_REG_READ(AR9271, gpio) != 0;
         else if (AR_SREV_9287_11_OR_LATER(ah))
diff --git a/drivers/net/wireless/ath/ath9k/init.c b/drivers/net/wireless/ath/ath9k/init.c
index 7eef1faee668..84e19e504dd0 100644
--- a/drivers/net/wireless/ath/ath9k/init.c
+++ b/drivers/net/wireless/ath/ath9k/init.c
@@ -15,7 +15,6 @@
  */
 
 #include <linux/slab.h>
-#include <linux/pm_qos_params.h>
 
 #include "ath9k.h"
 
@@ -180,8 +179,6 @@ static const struct ath_ops ath9k_common_ops = {
         .write = ath9k_iowrite32,
 };
 
-struct pm_qos_request_list ath9k_pm_qos_req;
-
 /**************************/
 /*     Initialization     */
 /**************************/
@@ -657,6 +654,8 @@ void ath9k_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw)
                 hw->flags |= IEEE80211_HW_MFP_CAPABLE;
 
         hw->wiphy->interface_modes =
+                BIT(NL80211_IFTYPE_P2P_GO) |
+                BIT(NL80211_IFTYPE_P2P_CLIENT) |
                 BIT(NL80211_IFTYPE_AP) |
                 BIT(NL80211_IFTYPE_WDS) |
                 BIT(NL80211_IFTYPE_STATION) |
@@ -756,7 +755,7 @@ int ath9k_init_device(u16 devid, struct ath_softc *sc, u16 subsysid,
         ath_init_leds(sc);
         ath_start_rfkill_poll(sc);
 
-        pm_qos_add_request(&ath9k_pm_qos_req, PM_QOS_CPU_DMA_LATENCY,
+        pm_qos_add_request(&sc->pm_qos_req, PM_QOS_CPU_DMA_LATENCY,
                            PM_QOS_DEFAULT_VALUE);
 
         return 0;
@@ -827,7 +826,7 @@ void ath9k_deinit_device(struct ath_softc *sc)
         }
 
         ieee80211_unregister_hw(hw);
-        pm_qos_remove_request(&ath9k_pm_qos_req);
+        pm_qos_remove_request(&sc->pm_qos_req);
         ath_rx_cleanup(sc);
         ath_tx_cleanup(sc);
         ath9k_deinit_softc(sc);
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index 50bdb5db23b4..7acd6b0ca011 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -15,7 +15,6 @@
  */
 
 #include <linux/nl80211.h>
-#include <linux/pm_qos_params.h>
 #include "ath9k.h"
 #include "btcoex.h"
 
@@ -1184,7 +1183,7 @@ static int ath9k_start(struct ieee80211_hw *hw)
                         ath9k_btcoex_timer_resume(sc);
         }
 
-        pm_qos_update_request(&ath9k_pm_qos_req, 55);
+        pm_qos_update_request(&sc->pm_qos_req, 55);
 
 mutex_unlock:
         mutex_unlock(&sc->mutex);
@@ -1339,7 +1338,7 @@ static void ath9k_stop(struct ieee80211_hw *hw)
 
         sc->sc_flags |= SC_OP_INVALID;
 
-        pm_qos_update_request(&ath9k_pm_qos_req, PM_QOS_DEFAULT_VALUE);
+        pm_qos_update_request(&sc->pm_qos_req, PM_QOS_DEFAULT_VALUE);
 
         mutex_unlock(&sc->mutex);
 
@@ -1436,6 +1435,7 @@ static void ath9k_remove_interface(struct ieee80211_hw *hw,
         struct ath_softc *sc = aphy->sc;
         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
         struct ath_vif *avp = (void *)vif->drv_priv;
+        bool bs_valid = false;
         int i;
 
         ath_print(common, ATH_DBG_CONFIG, "Detach Interface\n");
@@ -1464,7 +1464,15 @@ static void ath9k_remove_interface(struct ieee80211_hw *hw,
                                "slot\n", __func__);
                         sc->beacon.bslot[i] = NULL;
                         sc->beacon.bslot_aphy[i] = NULL;
-                }
+                } else if (sc->beacon.bslot[i])
+                        bs_valid = true;
+        }
+        if (!bs_valid && (sc->sc_ah->imask & ATH9K_INT_SWBA)) {
+                /* Disable SWBA interrupt */
+                sc->sc_ah->imask &= ~ATH9K_INT_SWBA;
+                ath9k_ps_wakeup(sc);
+                ath9k_hw_set_interrupts(sc->sc_ah, sc->sc_ah->imask);
+                ath9k_ps_restore(sc);
         }
 
         sc->nvifs--;
diff --git a/drivers/net/wireless/ath/ath9k/reg.h b/drivers/net/wireless/ath/ath9k/reg.h
index a597cc8d8644..c2472edab5e0 100644
--- a/drivers/net/wireless/ath/ath9k/reg.h
+++ b/drivers/net/wireless/ath/ath9k/reg.h
@@ -976,11 +976,13 @@ enum {
 #define AR9287_GPIO_IN_VAL_S                     11
 #define AR9271_GPIO_IN_VAL                       0xFFFF0000
 #define AR9271_GPIO_IN_VAL_S                     16
-#define AR9300_GPIO_IN_VAL                       0x0001FFFF
-#define AR9300_GPIO_IN_VAL_S                     0
 #define AR7010_GPIO_IN_VAL                       0x0000FFFF
 #define AR7010_GPIO_IN_VAL_S                     0
 
+#define AR_GPIO_IN                               0x404c
+#define AR9300_GPIO_IN_VAL                       0x0001FFFF
+#define AR9300_GPIO_IN_VAL_S                     0
+
 #define AR_GPIO_OE_OUT                           (AR_SREV_9300_20_OR_LATER(ah) ? 0x4050 : 0x404c)
 #define AR_GPIO_OE_OUT_DRV                       0x3
 #define AR_GPIO_OE_OUT_DRV_NO                    0x0
diff --git a/drivers/net/wireless/ath/carl9170/fw.c b/drivers/net/wireless/ath/carl9170/fw.c
index ae6c006bbc56..546b4e4ec5ea 100644
--- a/drivers/net/wireless/ath/carl9170/fw.c
+++ b/drivers/net/wireless/ath/carl9170/fw.c
@@ -291,7 +291,8 @@ static int carl9170_fw(struct ar9170 *ar, const __u8 *data, size_t len)
 
                 if (SUPP(CARL9170FW_WLANTX_CAB)) {
                         ar->hw->wiphy->interface_modes |=
-                                BIT(NL80211_IFTYPE_AP);
+                                BIT(NL80211_IFTYPE_AP) |
+                                BIT(NL80211_IFTYPE_P2P_GO);
                 }
         }
 
diff --git a/drivers/net/wireless/ath/carl9170/main.c b/drivers/net/wireless/ath/carl9170/main.c
index 511dbe3caf58..870df8c42622 100644
--- a/drivers/net/wireless/ath/carl9170/main.c
+++ b/drivers/net/wireless/ath/carl9170/main.c
@@ -1648,7 +1648,8 @@ void *carl9170_alloc(size_t priv_size)
          * supports these modes. The code which will add the
          * additional interface_modes is in fw.c.
          */
-        hw->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION);
+        hw->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
+                                     BIT(NL80211_IFTYPE_P2P_CLIENT);
 
         hw->flags |= IEEE80211_HW_RX_INCLUDES_FCS |
                      IEEE80211_HW_REPORTS_TX_ACK_STATUS |
diff --git a/drivers/net/wireless/ath/carl9170/tx.c b/drivers/net/wireless/ath/carl9170/tx.c
index aee5c9d89a14..6cc58e052d10 100644
--- a/drivers/net/wireless/ath/carl9170/tx.c
+++ b/drivers/net/wireless/ath/carl9170/tx.c
@@ -867,7 +867,7 @@ static int carl9170_tx_prepare(struct ar9170 *ar, struct sk_buff *skb)
 
         mac_tmp = cpu_to_le16(AR9170_TX_MAC_HW_DURATION |
                               AR9170_TX_MAC_BACKOFF);
-        mac_tmp |= cpu_to_le16((hw_queue << AR9170_TX_MAC_QOS_S) &&
+        mac_tmp |= cpu_to_le16((hw_queue << AR9170_TX_MAC_QOS_S) &
                                AR9170_TX_MAC_QOS);
 
         no_ack = !!(info->flags & IEEE80211_TX_CTL_NO_ACK);
diff --git a/drivers/net/wireless/libertas/if_sdio.c b/drivers/net/wireless/libertas/if_sdio.c
index e5685dc317a8..b4de0ca10feb 100644
--- a/drivers/net/wireless/libertas/if_sdio.c
+++ b/drivers/net/wireless/libertas/if_sdio.c
@@ -1170,7 +1170,6 @@ static void if_sdio_remove(struct sdio_func *func)
         lbs_deb_sdio("call remove card\n");
         lbs_stop_card(card->priv);
         lbs_remove_card(card->priv);
-        card->priv->surpriseremoved = 1;
 
         flush_workqueue(card->workqueue);
         destroy_workqueue(card->workqueue);
diff --git a/drivers/net/wireless/libertas/if_spi.c b/drivers/net/wireless/libertas/if_spi.c
index 79bcb4e5d2ca..ecd4d04b2c3c 100644
--- a/drivers/net/wireless/libertas/if_spi.c
+++ b/drivers/net/wireless/libertas/if_spi.c
@@ -1055,7 +1055,6 @@ static int __devexit libertas_spi_remove(struct spi_device *spi)
         lbs_stop_card(priv);
         lbs_remove_card(priv); /* will call free_netdev */
 
-        priv->surpriseremoved = 1;
         free_irq(spi->irq, card);
         if_spi_terminate_spi_thread(card);
         if (card->pdata->teardown)
diff --git a/drivers/net/wireless/libertas/main.c b/drivers/net/wireless/libertas/main.c
index 143473c59393..6836a6dd9853 100644
--- a/drivers/net/wireless/libertas/main.c
+++ b/drivers/net/wireless/libertas/main.c
@@ -916,8 +916,6 @@ void lbs_remove_card(struct lbs_private *priv)
 
         lbs_free_adapter(priv);
         lbs_cfg_free(priv);
-
-        priv->dev = NULL;
         free_netdev(dev);
 
         lbs_deb_leave(LBS_DEB_MAIN);
diff --git a/drivers/net/wireless/orinoco/main.c b/drivers/net/wireless/orinoco/main.c
index e8e2d0f4763d..fa0cf744958f 100644
--- a/drivers/net/wireless/orinoco/main.c
+++ b/drivers/net/wireless/orinoco/main.c
@@ -1392,10 +1392,9 @@ static void orinoco_process_scan_results(struct work_struct *work)
                                 orinoco_add_hostscan_results(priv, buf, len);
 
                         kfree(buf);
-                } else if (priv->scan_request) {
+                } else {
                         /* Either abort or complete the scan */
-                        cfg80211_scan_done(priv->scan_request, (len < 0));
-                        priv->scan_request = NULL;
+                        orinoco_scan_done(priv, (len < 0));
                 }
 
                 spin_lock_irqsave(&priv->scan_lock, flags);
@@ -1684,6 +1683,8 @@ static int __orinoco_down(struct orinoco_private *priv)
                 hermes_write_regn(hw, EVACK, 0xffff);
         }
 
+        orinoco_scan_done(priv, true);
+
         /* firmware will have to reassociate */
         netif_carrier_off(dev);
         priv->last_linkstatus = 0xffff;
@@ -1762,10 +1763,7 @@ void orinoco_reset(struct work_struct *work)
         orinoco_unlock(priv, &flags);
 
         /* Scanning support: Notify scan cancellation */
-        if (priv->scan_request) {
-                cfg80211_scan_done(priv->scan_request, 1);
-                priv->scan_request = NULL;
-        }
+        orinoco_scan_done(priv, true);
 
         if (priv->hard_reset) {
                 err = (*priv->hard_reset)(priv);
diff --git a/drivers/net/wireless/orinoco/scan.c b/drivers/net/wireless/orinoco/scan.c
index 4300d9db7d8c..86cb54c842e7 100644
--- a/drivers/net/wireless/orinoco/scan.c
+++ b/drivers/net/wireless/orinoco/scan.c
@@ -229,3 +229,11 @@ void orinoco_add_hostscan_results(struct orinoco_private *priv,
                 priv->scan_request = NULL;
         }
 }
+
+void orinoco_scan_done(struct orinoco_private *priv, bool abort)
+{
+        if (priv->scan_request) {
+                cfg80211_scan_done(priv->scan_request, abort);
+                priv->scan_request = NULL;
+        }
+}
diff --git a/drivers/net/wireless/orinoco/scan.h b/drivers/net/wireless/orinoco/scan.h
index 2dc4e046dbdb..27281fb0a6dc 100644
--- a/drivers/net/wireless/orinoco/scan.h
+++ b/drivers/net/wireless/orinoco/scan.h
@@ -16,5 +16,6 @@ void orinoco_add_extscan_result(struct orinoco_private *priv,
 void orinoco_add_hostscan_results(struct orinoco_private *dev,
                                   unsigned char *buf,
                                   size_t len);
+void orinoco_scan_done(struct orinoco_private *priv, bool abort);
 
 #endif /* _ORINOCO_SCAN_H_ */
diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
index 4b4da5b86ff9..f442668a1e52 100644
--- a/drivers/vhost/net.c
+++ b/drivers/vhost/net.c
@@ -129,8 +129,9 @@ static void handle_tx(struct vhost_net *net)
         size_t hdr_size;
         struct socket *sock;
 
-        sock = rcu_dereference_check(vq->private_data,
-                                     lockdep_is_held(&vq->mutex));
+        /* TODO: check that we are running from vhost_worker?
+         * Not sure it's worth it, it's straight-forward enough. */
+        sock = rcu_dereference_check(vq->private_data, 1);
         if (!sock)
                 return;
 
diff --git a/include/linux/marvell_phy.h b/include/linux/marvell_phy.h
index 1ff81b51b656..dd3c34ebca9a 100644
--- a/include/linux/marvell_phy.h
+++ b/include/linux/marvell_phy.h
@@ -11,6 +11,7 @@
 #define MARVELL_PHY_ID_88E1118          0x01410e10
 #define MARVELL_PHY_ID_88E1121R         0x01410cb0
 #define MARVELL_PHY_ID_88E1145          0x01410cd0
+#define MARVELL_PHY_ID_88E1149R         0x01410e50
 #define MARVELL_PHY_ID_88E1240          0x01410e30
 #define MARVELL_PHY_ID_88E1318S         0x01410e90
 
diff --git a/include/linux/snmp.h b/include/linux/snmp.h
index ebb0c80ffd6e..12b2b18e50c1 100644
--- a/include/linux/snmp.h
+++ b/include/linux/snmp.h
@@ -230,6 +230,7 @@ enum
         LINUX_MIB_TCPMINTTLDROP, /* RFC 5082 */
         LINUX_MIB_TCPDEFERACCEPTDROP,
         LINUX_MIB_IPRPFILTER, /* IP Reverse Path Filter (rp_filter) */
+        LINUX_MIB_TCPTIMEWAITOVERFLOW,          /* TCPTimeWaitOverflow */
         __LINUX_MIB_MAX
 };
 
diff --git a/include/net/af_unix.h b/include/net/af_unix.h
index 90c9e2872f27..18e5c3f67580 100644
--- a/include/net/af_unix.h
+++ b/include/net/af_unix.h
@@ -10,6 +10,7 @@ extern void unix_inflight(struct file *fp);
 extern void unix_notinflight(struct file *fp);
 extern void unix_gc(void);
 extern void wait_for_unix_gc(void);
+extern struct sock *unix_get_socket(struct file *filp);
 
 #define UNIX_HASH_SIZE  256
 
@@ -56,6 +57,7 @@ struct unix_sock {
         spinlock_t              lock;
         unsigned int            gc_candidate : 1;
         unsigned int            gc_maybe_cycle : 1;
+        unsigned char           recursion_level;
         struct socket_wq        peer_wq;
 };
 #define unix_sk(__sk) ((struct unix_sock *)__sk)
diff --git a/include/net/sock.h b/include/net/sock.h
index 717cfbf649df..3482004e5c29 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -1159,6 +1159,8 @@ extern void sk_common_release(struct sock *sk);
 /* Initialise core socket variables */
 extern void sock_init_data(struct socket *sock, struct sock *sk);
 
+extern void sk_filter_release_rcu(struct rcu_head *rcu);
+
 /**
  *      sk_filter_release - release a socket filter
  *      @fp: filter to remove
@@ -1169,7 +1171,7 @@ extern void sock_init_data(struct socket *sock, struct sock *sk);
 static inline void sk_filter_release(struct sk_filter *fp)
 {
         if (atomic_dec_and_test(&fp->refcnt))
-                kfree(fp);
+                call_rcu_bh(&fp->rcu, sk_filter_release_rcu);
 }
 
 static inline void sk_filter_uncharge(struct sock *sk, struct sk_filter *fp)
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index d0927d1fdada..66b9e5c0523a 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -882,7 +882,7 @@ static int sco_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, __u8 type)
         int lm = 0;
 
         if (type != SCO_LINK && type != ESCO_LINK)
-                return 0;
+                return -EINVAL;
 
         BT_DBG("hdev %s, bdaddr %s", hdev->name, batostr(bdaddr));
 
@@ -908,7 +908,7 @@ static int sco_connect_cfm(struct hci_conn *hcon, __u8 status)
         BT_DBG("hcon %p bdaddr %s status %d", hcon, batostr(&hcon->dst), status);
 
         if (hcon->type != SCO_LINK && hcon->type != ESCO_LINK)
-                return 0;
+                return -EINVAL;
 
         if (!status) {
                 struct sco_conn *conn;
@@ -927,7 +927,7 @@ static int sco_disconn_cfm(struct hci_conn *hcon, __u8 reason)
         BT_DBG("hcon %p reason %d", hcon, reason);
 
         if (hcon->type != SCO_LINK && hcon->type != ESCO_LINK)
-                return 0;
+                return -EINVAL;
 
         sco_conn_del(hcon, bt_err(reason));
 
diff --git a/net/ceph/Makefile b/net/ceph/Makefile
index 153bdec40835..e87ef435e11b 100644
--- a/net/ceph/Makefile
+++ b/net/ceph/Makefile
@@ -1,9 +1,6 @@
 #
 # Makefile for CEPH filesystem.
 #
-
-ifneq ($(KERNELRELEASE),)
-
 obj-$(CONFIG_CEPH_LIB) += libceph.o
 
 libceph-y := ceph_common.o messenger.o msgpool.o buffer.o pagelist.o \
@@ -16,22 +13,3 @@ libceph-y := ceph_common.o messenger.o msgpool.o buffer.o pagelist.o \
         ceph_fs.o ceph_strings.o ceph_hash.o \
         pagevec.o
 
-else
-#Otherwise we were called directly from the command
-# line; invoke the kernel build system.
-
-KERNELDIR ?= /lib/modules/$(shell uname -r)/build
-PWD := $(shell pwd)
-
-default: all
-
-all:
-        $(MAKE) -C $(KERNELDIR) M=$(PWD) CONFIG_CEPH_LIB=m modules
-
-modules_install:
-        $(MAKE) -C $(KERNELDIR) M=$(PWD) CONFIG_CEPH_LIB=m modules_install
-
-clean:
-        $(MAKE) -C $(KERNELDIR) M=$(PWD) clean
-
-endif
diff --git a/net/ceph/buffer.c b/net/ceph/buffer.c
index 53d8abfa25d5..bf3e6a13c215 100644
--- a/net/ceph/buffer.c
+++ b/net/ceph/buffer.c
@@ -19,7 +19,7 @@ struct ceph_buffer *ceph_buffer_new(size_t len, gfp_t gfp)
         if (b->vec.iov_base) {
                 b->is_vmalloc = false;
         } else {
-                b->vec.iov_base = __vmalloc(len, gfp, PAGE_KERNEL);
+                b->vec.iov_base = __vmalloc(len, gfp | __GFP_HIGHMEM, PAGE_KERNEL);
                 if (!b->vec.iov_base) {
                         kfree(b);
                         return NULL;
diff --git a/net/core/filter.c b/net/core/filter.c
index 25500f16a18a..e193e29d4671 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -615,23 +615,16 @@ int sk_chk_filter(struct sock_filter *filter, int flen)
 EXPORT_SYMBOL(sk_chk_filter);
 
 /**
- *      sk_filter_rcu_release - Release a socket filter by rcu_head
+ *      sk_filter_release_rcu - Release a socket filter by rcu_head
  *      @rcu: rcu_head that contains the sk_filter to free
  */
-static void sk_filter_rcu_release(struct rcu_head *rcu)
+void sk_filter_release_rcu(struct rcu_head *rcu)
 {
         struct sk_filter *fp = container_of(rcu, struct sk_filter, rcu);
 
-        sk_filter_release(fp);
-}
-
-static void sk_filter_delayed_uncharge(struct sock *sk, struct sk_filter *fp)
-{
-        unsigned int size = sk_filter_len(fp);
-
-        atomic_sub(size, &sk->sk_omem_alloc);
-        call_rcu_bh(&fp->rcu, sk_filter_rcu_release);
+        kfree(fp);
 }
+EXPORT_SYMBOL(sk_filter_release_rcu);
 
 /**
  *      sk_attach_filter - attach a socket filter
@@ -675,7 +668,7 @@ int sk_attach_filter(struct sock_fprog *fprog, struct sock *sk)
         rcu_assign_pointer(sk->sk_filter, fp);
 
         if (old_fp)
-                sk_filter_delayed_uncharge(sk, old_fp);
+                sk_filter_uncharge(sk, old_fp);
         return 0;
 }
 EXPORT_SYMBOL_GPL(sk_attach_filter);
@@ -689,7 +682,7 @@ int sk_detach_filter(struct sock *sk)
                                            sock_owned_by_user(sk));
         if (filter) {
                 rcu_assign_pointer(sk->sk_filter, NULL);
-                sk_filter_delayed_uncharge(sk, filter);
+                sk_filter_uncharge(sk, filter);
                 ret = 0;
         }
         return ret;
diff --git a/net/core/request_sock.c b/net/core/request_sock.c
index 41d99435f62d..182236b2510a 100644
--- a/net/core/request_sock.c
+++ b/net/core/request_sock.c
@@ -46,9 +46,7 @@ int reqsk_queue_alloc(struct request_sock_queue *queue,
         nr_table_entries = roundup_pow_of_two(nr_table_entries + 1);
         lopt_size += nr_table_entries * sizeof(struct request_sock *);
         if (lopt_size > PAGE_SIZE)
-                lopt = __vmalloc(lopt_size,
-                        GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO,
-                        PAGE_KERNEL);
+                lopt = vzalloc(lopt_size);
         else
                 lopt = kzalloc(lopt_size, GFP_KERNEL);
         if (lopt == NULL)
diff --git a/net/dccp/input.c b/net/dccp/input.c
index 7d230d14ce22..15af247ea007 100644
--- a/net/dccp/input.c
+++ b/net/dccp/input.c
@@ -241,7 +241,8 @@ static int dccp_check_seqno(struct sock *sk, struct sk_buff *skb)
                 dccp_update_gsr(sk, seqno);
 
                 if (dh->dccph_type != DCCP_PKT_SYNC &&
-                    (ackno != DCCP_PKT_WITHOUT_ACK_SEQ))
+                    ackno != DCCP_PKT_WITHOUT_ACK_SEQ &&
+                    after48(ackno, dp->dccps_gar))
                         dp->dccps_gar = ackno;
         } else {
                 unsigned long now = jiffies;
diff --git a/net/decnet/af_decnet.c b/net/decnet/af_decnet.c
index 9ecef9968c39..0065e7e14af4 100644
--- a/net/decnet/af_decnet.c
+++ b/net/decnet/af_decnet.c
@@ -1556,6 +1556,8 @@ static int __dn_getsockopt(struct socket *sock, int level,int optname, char __us
                         if (r_len > sizeof(struct linkinfo_dn))
                                 r_len = sizeof(struct linkinfo_dn);
 
+                        memset(&link, 0, sizeof(link));
+
                         switch(sock->state) {
                                 case SS_CONNECTING:
                                         link.idn_linkstate = LL_CONNECTING;
diff --git a/net/econet/af_econet.c b/net/econet/af_econet.c
index f8c1ae4b41f0..f180371fa415 100644
--- a/net/econet/af_econet.c
+++ b/net/econet/af_econet.c
@@ -31,6 +31,7 @@
 #include <linux/skbuff.h>
 #include <linux/udp.h>
 #include <linux/slab.h>
+#include <linux/vmalloc.h>
 #include <net/sock.h>
 #include <net/inet_common.h>
 #include <linux/stat.h>
@@ -276,12 +277,12 @@ static int econet_sendmsg(struct kiocb *iocb, struct socket *sock,
 #endif
 #ifdef CONFIG_ECONET_AUNUDP
         struct msghdr udpmsg;
-        struct iovec iov[msg->msg_iovlen+1];
+        struct iovec iov[2];
         struct aunhdr ah;
         struct sockaddr_in udpdest;
         __kernel_size_t size;
-        int i;
         mm_segment_t oldfs;
+        char *userbuf;
 #endif
 
         /*
@@ -297,23 +298,14 @@ static int econet_sendmsg(struct kiocb *iocb, struct socket *sock,
 
         mutex_lock(&econet_mutex);
 
-        if (saddr == NULL) {
-                struct econet_sock *eo = ec_sk(sk);
-
-                addr.station = eo->station;
-                addr.net     = eo->net;
-                port         = eo->port;
-                cb           = eo->cb;
-        } else {
-                if (msg->msg_namelen < sizeof(struct sockaddr_ec)) {
-                        mutex_unlock(&econet_mutex);
-                        return -EINVAL;
-                }
-                addr.station = saddr->addr.station;
-                addr.net = saddr->addr.net;
-                port = saddr->port;
-                cb = saddr->cb;
-        }
+        if (saddr == NULL || msg->msg_namelen < sizeof(struct sockaddr_ec)) {
+                mutex_unlock(&econet_mutex);
+                return -EINVAL;
+        }
+        addr.station = saddr->addr.station;
+        addr.net = saddr->addr.net;
+        port = saddr->port;
+        cb = saddr->cb;
 
         /* Look for a device with the right network number. */
         dev = net2dev_map[addr.net];
@@ -328,17 +320,17 @@ static int econet_sendmsg(struct kiocb *iocb, struct socket *sock,
                 }
         }
 
-        if (len + 15 > dev->mtu) {
-                mutex_unlock(&econet_mutex);
-                return -EMSGSIZE;
-        }
-
         if (dev->type == ARPHRD_ECONET) {
                 /* Real hardware Econet.  We're not worthy etc. */
 #ifdef CONFIG_ECONET_NATIVE
                 unsigned short proto = 0;
                 int res;
 
+                if (len + 15 > dev->mtu) {
+                        mutex_unlock(&econet_mutex);
+                        return -EMSGSIZE;
+                }
+
                 dev_hold(dev);
 
                 skb = sock_alloc_send_skb(sk, len+LL_ALLOCATED_SPACE(dev),
@@ -351,7 +343,6 @@ static int econet_sendmsg(struct kiocb *iocb, struct socket *sock,
 
                 eb = (struct ec_cb *)&skb->cb;
 
-                /* BUG: saddr may be NULL */
                 eb->cookie = saddr->cookie;
                 eb->sec = *saddr;
                 eb->sent = ec_tx_done;
@@ -415,6 +406,11 @@ static int econet_sendmsg(struct kiocb *iocb, struct socket *sock,
                 return -ENETDOWN;               /* No socket - can't send */
         }
 
+        if (len > 32768) {
+                err = -E2BIG;
+                goto error;
+        }
+
         /* Make up a UDP datagram and hand it off to some higher intellect. */
 
         memset(&udpdest, 0, sizeof(udpdest));
@@ -446,36 +442,26 @@ static int econet_sendmsg(struct kiocb *iocb, struct socket *sock,
 
         /* tack our header on the front of the iovec */
         size = sizeof(struct aunhdr);
-        /*
-         * XXX: that is b0rken.  We can't mix userland and kernel pointers
-         * in iovec, since on a lot of platforms copy_from_user() will
-         * *not* work with the kernel and userland ones at the same time,
-         * regardless of what we do with set_fs().  And we are talking about
-         * econet-over-ethernet here, so "it's only ARM anyway" doesn't
-         * apply.  Any suggestions on fixing that code?         -- AV
-         */
         iov[0].iov_base = (void *)&ah;
         iov[0].iov_len = size;
-        for (i = 0; i < msg->msg_iovlen; i++) {
-                void __user *base = msg->msg_iov[i].iov_base;
-                size_t iov_len = msg->msg_iov[i].iov_len;
-                /* Check it now since we switch to KERNEL_DS later. */
-                if (!access_ok(VERIFY_READ, base, iov_len)) {
-                        mutex_unlock(&econet_mutex);
-                        return -EFAULT;
-                }
-                iov[i+1].iov_base = base;
-                iov[i+1].iov_len = iov_len;
-                size += iov_len;
+
+        userbuf = vmalloc(len);
+        if (userbuf == NULL) {
+                err = -ENOMEM;
+                goto error;
         }
 
+        iov[1].iov_base = userbuf;
+        iov[1].iov_len = len;
+        err = memcpy_fromiovec(userbuf, msg->msg_iov, len);
+        if (err)
+                goto error_free_buf;
+
         /* Get a skbuff (no data, just holds our cb information) */
         if ((skb = sock_alloc_send_skb(sk, 0,
                                        msg->msg_flags & MSG_DONTWAIT,
-                                       &err)) == NULL) {
-                mutex_unlock(&econet_mutex);
-                return err;
-        }
+                                       &err)) == NULL)
+                goto error_free_buf;
 
         eb = (struct ec_cb *)&skb->cb;
 
@@ -491,7 +477,7 @@ static int econet_sendmsg(struct kiocb *iocb, struct socket *sock,
         udpmsg.msg_name = (void *)&udpdest;
         udpmsg.msg_namelen = sizeof(udpdest);
         udpmsg.msg_iov = &iov[0];
-        udpmsg.msg_iovlen = msg->msg_iovlen + 1;
+        udpmsg.msg_iovlen = 2;
         udpmsg.msg_control = NULL;
         udpmsg.msg_controllen = 0;
         udpmsg.msg_flags=0;
@@ -499,9 +485,13 @@ static int econet_sendmsg(struct kiocb *iocb, struct socket *sock,
         oldfs = get_fs(); set_fs(KERNEL_DS);    /* More privs :-) */
         err = sock_sendmsg(udpsock, &udpmsg, size);
         set_fs(oldfs);
+
+error_free_buf:
+        vfree(userbuf);
 #else
         err = -EPROTOTYPE;
 #endif
+        error:
         mutex_unlock(&econet_mutex);
 
         return err;
@@ -671,6 +661,11 @@ static int ec_dev_ioctl(struct socket *sock, unsigned int cmd, void __user *arg)
         err = 0;
         switch (cmd) {
         case SIOCSIFADDR:
+                if (!capable(CAP_NET_ADMIN)) {
+                        err = -EPERM;
+                        break;
+                }
+
                 edev = dev->ec_ptr;
                 if (edev == NULL) {
                         /* Magic up a new one. */
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index 200eb538fbb3..0f280348e0fd 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -365,7 +365,7 @@ static struct tnode *tnode_alloc(size_t size)
         if (size <= PAGE_SIZE)
                 return kzalloc(size, GFP_KERNEL);
         else
-                return __vmalloc(size, GFP_KERNEL | __GFP_ZERO, PAGE_KERNEL);
+                return vzalloc(size);
 }
 
 static void __tnode_vfree(struct work_struct *arg)
diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
index 1b344f30b463..3c0369a3a663 100644
--- a/net/ipv4/inet_hashtables.c
+++ b/net/ipv4/inet_hashtables.c
@@ -133,8 +133,7 @@ int __inet_inherit_port(struct sock *sk, struct sock *child)
                         }
                 }
         }
-        sk_add_bind_node(child, &tb->owners);
-        inet_csk(child)->icsk_bind_hash = tb;
+        inet_bind_hash(child, tb, port);
         spin_unlock(&head->lock);
 
         return 0;
diff --git a/net/ipv4/proc.c b/net/ipv4/proc.c
index 1b48eb1ed453..b14ec7d03b6e 100644
--- a/net/ipv4/proc.c
+++ b/net/ipv4/proc.c
@@ -253,6 +253,7 @@ static const struct snmp_mib snmp4_net_list[] = {
         SNMP_MIB_ITEM("TCPMinTTLDrop", LINUX_MIB_TCPMINTTLDROP),
         SNMP_MIB_ITEM("TCPDeferAcceptDrop", LINUX_MIB_TCPDEFERACCEPTDROP),
         SNMP_MIB_ITEM("IPReversePathFilter", LINUX_MIB_IPRPFILTER),
+        SNMP_MIB_ITEM("TCPTimeWaitOverflow", LINUX_MIB_TCPTIMEWAITOVERFLOW),
         SNMP_MIB_SENTINEL
 };
 
diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
index e91911d7aae2..1b4ec21497a4 100644
--- a/net/ipv4/sysctl_net_ipv4.c
+++ b/net/ipv4/sysctl_net_ipv4.c
@@ -26,6 +26,8 @@ static int zero;
 static int tcp_retr1_max = 255;
 static int ip_local_port_range_min[] = { 1, 1 };
 static int ip_local_port_range_max[] = { 65535, 65535 };
+static int tcp_adv_win_scale_min = -31;
+static int tcp_adv_win_scale_max = 31;
 
 /* Update system visible IP port range */
 static void set_local_port_range(int range[2])
@@ -426,7 +428,9 @@ static struct ctl_table ipv4_table[] = {
                 .data           = &sysctl_tcp_adv_win_scale,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = proc_dointvec
+                .proc_handler   = proc_dointvec_minmax,
+                .extra1         = &tcp_adv_win_scale_min,
+                .extra2         = &tcp_adv_win_scale_max,
         },
         {
                 .procname       = "tcp_tw_reuse",
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 2bb46d55f40c..6c11eece262c 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -2244,7 +2244,7 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
                 /* Values greater than interface MTU won't take effect. However
                  * at the point when this call is done we typically don't yet
                  * know which interface is going to be used */
-                if (val < 64 || val > MAX_TCP_WINDOW) {
+                if (val < TCP_MIN_MSS || val > MAX_TCP_WINDOW) {
                         err = -EINVAL;
                         break;
                 }
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index dd555051ec8b..4fc3387aa994 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -2013,7 +2013,9 @@ get_req:
         }
 get_sk:
         sk_nulls_for_each_from(sk, node) {
-                if (sk->sk_family == st->family && net_eq(sock_net(sk), net)) {
+                if (!net_eq(sock_net(sk), net))
+                        continue;
+                if (sk->sk_family == st->family) {
                         cur = sk;
                         goto out;
                 }
diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
index 3527b51d6159..80b1f80759ab 100644
--- a/net/ipv4/tcp_minisocks.c
+++ b/net/ipv4/tcp_minisocks.c
@@ -392,7 +392,7 @@ void tcp_time_wait(struct sock *sk, int state, int timeo)
                  * socket up.  We've got bigger problems than
                  * non-graceful socket closings.
                  */
-                LIMIT_NETDEBUG(KERN_INFO "TCP: time wait bucket table overflow\n");
+                NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPTIMEWAITOVERFLOW);
         }
 
         tcp_update_metrics(sk);
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 749b6498588e..97041f24cd27 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -231,11 +231,10 @@ void tcp_select_initial_window(int __space, __u32 mss,
                 /* when initializing use the value from init_rcv_wnd
                  * rather than the default from above
                  */
-                if (init_rcv_wnd &&
-                    (*rcv_wnd > init_rcv_wnd * mss))
-                        *rcv_wnd = init_rcv_wnd * mss;
-                else if (*rcv_wnd > init_cwnd * mss)
-                        *rcv_wnd = init_cwnd * mss;
+                if (init_rcv_wnd)
+                        *rcv_wnd = min(*rcv_wnd, init_rcv_wnd * mss);
+                else
+                        *rcv_wnd = min(*rcv_wnd, init_cwnd * mss);
         }
 
         /* Set the clamp no higher than max representable value */
@@ -386,27 +385,30 @@ struct tcp_out_options {
  */
 static u8 tcp_cookie_size_check(u8 desired)
 {
-        if (desired > 0) {
+        int cookie_size;
+
+        if (desired > 0)
                 /* previously specified */
                 return desired;
-        }
-        if (sysctl_tcp_cookie_size <= 0) {
+
+        cookie_size = ACCESS_ONCE(sysctl_tcp_cookie_size);
+        if (cookie_size <= 0)
                 /* no default specified */
                 return 0;
-        }
-        if (sysctl_tcp_cookie_size <= TCP_COOKIE_MIN) {
+
+        if (cookie_size <= TCP_COOKIE_MIN)
                 /* value too small, specify minimum */
                 return TCP_COOKIE_MIN;
-        }
-        if (sysctl_tcp_cookie_size >= TCP_COOKIE_MAX) {
+
+        if (cookie_size >= TCP_COOKIE_MAX)
                 /* value too large, specify maximum */
                 return TCP_COOKIE_MAX;
-        }
-        if (0x1 & sysctl_tcp_cookie_size) {
+
+        if (cookie_size & 1)
                 /* 8-bit multiple, illegal, fix it */
-                return (u8)(sysctl_tcp_cookie_size + 0x1);
-        }
-        return (u8)sysctl_tcp_cookie_size;
+                cookie_size++;
+
+        return (u8)cookie_size;
 }
 
 /* Write previously computed TCP options to the packet.
@@ -1516,6 +1518,7 @@ static int tcp_tso_should_defer(struct sock *sk, struct sk_buff *skb)
         struct tcp_sock *tp = tcp_sk(sk);
         const struct inet_connection_sock *icsk = inet_csk(sk);
         u32 send_win, cong_win, limit, in_flight;
+        int win_divisor;
 
         if (TCP_SKB_CB(skb)->flags & TCPHDR_FIN)
                 goto send_now;
@@ -1547,13 +1550,14 @@ static int tcp_tso_should_defer(struct sock *sk, struct sk_buff *skb)
         if ((skb != tcp_write_queue_tail(sk)) && (limit >= skb->len))
                 goto send_now;
 
-        if (sysctl_tcp_tso_win_divisor) {
+        win_divisor = ACCESS_ONCE(sysctl_tcp_tso_win_divisor);
+        if (win_divisor) {
                 u32 chunk = min(tp->snd_wnd, tp->snd_cwnd * tp->mss_cache);
 
                 /* If at least some fraction of a window is available,
                  * just use it.
                  */
-                chunk /= sysctl_tcp_tso_win_divisor;
+                chunk /= win_divisor;
                 if (limit >= chunk)
                         goto send_now;
         } else {
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index b1155554bb18..4f4483e697bd 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -1173,6 +1173,8 @@ static void ip6_tnl_link_config(struct ip6_tnl *t)
                                 sizeof (struct ipv6hdr);
 
                         dev->mtu = rt->rt6i_dev->mtu - sizeof (struct ipv6hdr);
+                        if (!(t->parms.flags & IP6_TNL_F_IGN_ENCAP_LIMIT))
+                                dev->mtu-=8;
 
                         if (dev->mtu < IPV6_MIN_MTU)
                                 dev->mtu = IPV6_MIN_MTU;
@@ -1361,12 +1363,17 @@ static const struct net_device_ops ip6_tnl_netdev_ops = {
 
 static void ip6_tnl_dev_setup(struct net_device *dev)
 {
+        struct ip6_tnl *t;
+
         dev->netdev_ops = &ip6_tnl_netdev_ops;
         dev->destructor = ip6_dev_free;
 
         dev->type = ARPHRD_TUNNEL6;
         dev->hard_header_len = LL_MAX_HEADER + sizeof (struct ipv6hdr);
         dev->mtu = ETH_DATA_LEN - sizeof (struct ipv6hdr);
+        t = netdev_priv(dev);
+        if (!(t->parms.flags & IP6_TNL_F_IGN_ENCAP_LIMIT))
+                dev->mtu-=8;
         dev->flags |= IFF_NOARP;
         dev->addr_len = sizeof(struct in6_addr);
         dev->features |= NETIF_F_NETNS_LOCAL;
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 6e48a80d0f25..8ce38f10a547 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -606,8 +606,9 @@ static int ipip6_rcv(struct sk_buff *skb)
                 return 0;
         }
 
-        icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
+        /* no tunnel matched,  let upstream know, ipsec may handle it */
         rcu_read_unlock();
+        return 1;
 out:
         kfree_skb(skb);
         return 0;
diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c
index 04635e88e8ed..110efb704c9b 100644
--- a/net/l2tp/l2tp_ip.c
+++ b/net/l2tp/l2tp_ip.c
@@ -672,4 +672,8 @@ MODULE_LICENSE("GPL");
 MODULE_AUTHOR("James Chapman <jchapman@katalix.com>");
 MODULE_DESCRIPTION("L2TP over IP");
 MODULE_VERSION("1.0");
-MODULE_ALIAS_NET_PF_PROTO_TYPE(PF_INET, SOCK_DGRAM, IPPROTO_L2TP);
+
+/* Use the value of SOCK_DGRAM (2) directory, because __stringify does't like
+ * enums
+ */
+MODULE_ALIAS_NET_PF_PROTO_TYPE(PF_INET, 2, IPPROTO_L2TP);
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index d2fcd22ab06d..55337709de41 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -2245,6 +2245,10 @@ ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx)
                 break;
         case cpu_to_le16(IEEE80211_STYPE_DEAUTH):
         case cpu_to_le16(IEEE80211_STYPE_DISASSOC):
+                if (is_multicast_ether_addr(mgmt->da) &&
+                    !is_broadcast_ether_addr(mgmt->da))
+                        return RX_DROP_MONITOR;
+
                 /* process only for station */
                 if (sdata->vif.type != NL80211_IFTYPE_STATION)
                         return RX_DROP_MONITOR;
@@ -2739,6 +2743,7 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
 
                         if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
                                 return;
+                        goto out;
                 }
         }
 
@@ -2778,6 +2783,7 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
                         return;
         }
 
+ out:
         dev_kfree_skb(skb);
 }
 
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index e69483647f33..2ba742656825 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -1595,7 +1595,12 @@ static void ieee80211_xmit(struct ieee80211_sub_if_data *sdata,
                                                 list) {
                                 if (!ieee80211_sdata_running(tmp_sdata))
                                         continue;
-                                if (tmp_sdata->vif.type != NL80211_IFTYPE_AP)
+                                if (tmp_sdata->vif.type ==
+                                    NL80211_IFTYPE_MONITOR ||
+                                    tmp_sdata->vif.type ==
+                                    NL80211_IFTYPE_AP_VLAN ||
+                                        tmp_sdata->vif.type ==
+                                    NL80211_IFTYPE_WDS)
                                         continue;
                                 if (compare_ether_addr(tmp_sdata->vif.addr,
                                                        hdr->addr2) == 0) {
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 7ff31c60186a..417d7a6c36cf 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -1344,9 +1344,25 @@ static void unix_destruct_scm(struct sk_buff *skb)
         sock_wfree(skb);
 }
 
+#define MAX_RECURSION_LEVEL 4
+
 static int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb)
 {
         int i;
+        unsigned char max_level = 0;
+        int unix_sock_count = 0;
+
+        for (i = scm->fp->count - 1; i >= 0; i--) {
+                struct sock *sk = unix_get_socket(scm->fp->fp[i]);
+
+                if (sk) {
+                        unix_sock_count++;
+                        max_level = max(max_level,
+                                        unix_sk(sk)->recursion_level);
+                }
+        }
+        if (unlikely(max_level > MAX_RECURSION_LEVEL))
+                return -ETOOMANYREFS;
 
         /*
          * Need to duplicate file references for the sake of garbage
@@ -1357,9 +1373,11 @@ static int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb)
         if (!UNIXCB(skb).fp)
                 return -ENOMEM;
 
-        for (i = scm->fp->count-1; i >= 0; i--)
-                unix_inflight(scm->fp->fp[i]);
-        return 0;
+        if (unix_sock_count) {
+                for (i = scm->fp->count - 1; i >= 0; i--)
+                        unix_inflight(scm->fp->fp[i]);
+        }
+        return max_level;
 }
 
 static int unix_scm_to_skb(struct scm_cookie *scm, struct sk_buff *skb, bool send_fds)
@@ -1394,6 +1412,7 @@ static int unix_dgram_sendmsg(struct kiocb *kiocb, struct socket *sock,
         struct sk_buff *skb;
         long timeo;
         struct scm_cookie tmp_scm;
+        int max_level;
 
         if (NULL == siocb->scm)
                 siocb->scm = &tmp_scm;
@@ -1432,8 +1451,9 @@ static int unix_dgram_sendmsg(struct kiocb *kiocb, struct socket *sock,
                 goto out;
 
         err = unix_scm_to_skb(siocb->scm, skb, true);
-        if (err)
+        if (err < 0)
                 goto out_free;
+        max_level = err + 1;
         unix_get_secdata(siocb->scm, skb);
 
         skb_reset_transport_header(skb);
@@ -1515,6 +1535,8 @@ restart:
         if (sock_flag(other, SOCK_RCVTSTAMP))
                 __net_timestamp(skb);
         skb_queue_tail(&other->sk_receive_queue, skb);
+        if (max_level > unix_sk(other)->recursion_level)
+                unix_sk(other)->recursion_level = max_level;
         unix_state_unlock(other);
         other->sk_data_ready(other, len);
         sock_put(other);
@@ -1545,6 +1567,7 @@ static int unix_stream_sendmsg(struct kiocb *kiocb, struct socket *sock,
         int sent = 0;
         struct scm_cookie tmp_scm;
         bool fds_sent = false;
+        int max_level;
 
         if (NULL == siocb->scm)
                 siocb->scm = &tmp_scm;
@@ -1608,10 +1631,11 @@ static int unix_stream_sendmsg(struct kiocb *kiocb, struct socket *sock,
 
                 /* Only send the fds in the first buffer */
                 err = unix_scm_to_skb(siocb->scm, skb, !fds_sent);
-                if (err) {
+                if (err < 0) {
                         kfree_skb(skb);
                         goto out_err;
                 }
+                max_level = err + 1;
                 fds_sent = true;
 
                 err = memcpy_fromiovec(skb_put(skb, size), msg->msg_iov, size);
@@ -1627,6 +1651,8 @@ static int unix_stream_sendmsg(struct kiocb *kiocb, struct socket *sock,
                         goto pipe_err_free;
 
                 skb_queue_tail(&other->sk_receive_queue, skb);
+                if (max_level > unix_sk(other)->recursion_level)
+                        unix_sk(other)->recursion_level = max_level;
                 unix_state_unlock(other);
                 other->sk_data_ready(other, size);
                 sent += size;
@@ -1847,6 +1873,7 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
                 unix_state_lock(sk);
                 skb = skb_dequeue(&sk->sk_receive_queue);
                 if (skb == NULL) {
+                        unix_sk(sk)->recursion_level = 0;
                         if (copied >= target)
                                 goto unlock;
 
diff --git a/net/unix/garbage.c b/net/unix/garbage.c
index c8df6fda0b1f..f89f83bf828e 100644
--- a/net/unix/garbage.c
+++ b/net/unix/garbage.c
@@ -96,7 +96,7 @@ static DECLARE_WAIT_QUEUE_HEAD(unix_gc_wait);
 unsigned int unix_tot_inflight;
 
 
-static struct sock *unix_get_socket(struct file *filp)
+struct sock *unix_get_socket(struct file *filp)
 {
         struct sock *u_sock = NULL;
         struct inode *inode = filp->f_path.dentry->d_inode;
@@ -259,9 +259,16 @@ static void inc_inflight_move_tail(struct unix_sock *u)
 }
 
 static bool gc_in_progress = false;
+#define UNIX_INFLIGHT_TRIGGER_GC 16000
 
 void wait_for_unix_gc(void)
 {
+        /*
+         * If number of inflight sockets is insane,
+         * force a garbage collect right now.
+         */
+        if (unix_tot_inflight > UNIX_INFLIGHT_TRIGGER_GC && !gc_in_progress)
+                unix_gc();
         wait_event(unix_gc_wait, gc_in_progress == false);
 }
 
diff --git a/net/x25/x25_link.c b/net/x25/x25_link.c
index 4c81f6abb65b..4cbc942f762a 100644
--- a/net/x25/x25_link.c
+++ b/net/x25/x25_link.c
@@ -398,6 +398,7 @@ void __exit x25_link_free(void)
         list_for_each_safe(entry, tmp, &x25_neigh_list) {
                 nb = list_entry(entry, struct x25_neigh, node);
                 __x25_remove_neigh(nb);
+                dev_put(nb->dev);
         }
         write_unlock_bh(&x25_neigh_list_lock);
 }
diff --git a/net/xfrm/xfrm_hash.c b/net/xfrm/xfrm_hash.c
index a2023ec52329..1e98bc0fe0a5 100644
--- a/net/xfrm/xfrm_hash.c
+++ b/net/xfrm/xfrm_hash.c
@@ -19,7 +19,7 @@ struct hlist_head *xfrm_hash_alloc(unsigned int sz)
         if (sz <= PAGE_SIZE)
                 n = kzalloc(sz, GFP_KERNEL);
         else if (hashdist)
-                n = __vmalloc(sz, GFP_KERNEL | __GFP_ZERO, PAGE_KERNEL);
+                n = vzalloc(sz);
         else
                 n = (struct hlist_head *)
                         __get_free_pages(GFP_KERNEL | __GFP_NOWARN | __GFP_ZERO,