Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net:
  ipv6: Check dest prefix length on original route not copied one in rt6_alloc_cow().
  sch_gred: should not use GFP_KERNEL while holding a spinlock
  ipip, sit: copy parms.name after register_netdevice
  ipv6: Fix for adding multicast route for loopback device automatically.
  ssb: fix init regression with SoCs
  rtl8192{ce,cu,de,se}: avoid problems because of possible ERFOFF -> ERFSLEEP transition
  mac80211: fix another race in aggregation start
  fsl_pq_mdio: Clean up tbi address configuration
  ppp: fix pptp double release_sock in pptp_bind()
  net/fec: fix the use of pdev->id
  ath9k: fix check for antenna diversity support
  batman-adv: delete global entry in case of roaming
  batman-adv: in case of roaming mark the client with TT_CLIENT_ROAM
  Bluetooth: Correct version check in hci_setup
  btusb: fix a memory leak in btusb_send_frame()
  Bluetooth: bnep: Fix module reference
  Bluetooth: cmtp: Fix module reference
  Bluetooth: btmrvl: support Marvell Bluetooth device SD8797

22 files changed, 130 insertions, 129 deletions

diff --git a/drivers/bluetooth/Kconfig b/drivers/bluetooth/Kconfig
index 11b41fd40c27..5ccf142ef0b8 100644
--- a/drivers/bluetooth/Kconfig
+++ b/drivers/bluetooth/Kconfig
@@ -188,7 +188,7 @@ config BT_MRVL
           The core driver to support Marvell Bluetooth devices.
 
           This driver is required if you want to support
-          Marvell Bluetooth devices, such as 8688/8787.
+          Marvell Bluetooth devices, such as 8688/8787/8797.
 
           Say Y here to compile Marvell Bluetooth driver
           into the kernel or say M to compile it as module.
@@ -201,8 +201,8 @@ config BT_MRVL_SDIO
           The driver for Marvell Bluetooth chipsets with SDIO interface.
 
           This driver is required if you want to use Marvell Bluetooth
-          devices with SDIO interface. Currently SD8688/SD8787 chipsets are
-          supported.
+          devices with SDIO interface. Currently SD8688/SD8787/SD8797
+          chipsets are supported.
 
           Say Y here to compile support for Marvell BT-over-SDIO driver
           into the kernel or say M to compile it as module.
diff --git a/drivers/bluetooth/btmrvl_sdio.c b/drivers/bluetooth/btmrvl_sdio.c
index 9ef48167e2cf..27b74b0d547b 100644
--- a/drivers/bluetooth/btmrvl_sdio.c
+++ b/drivers/bluetooth/btmrvl_sdio.c
@@ -65,7 +65,7 @@ static const struct btmrvl_sdio_card_reg btmrvl_reg_8688 = {
         .io_port_1 = 0x01,
         .io_port_2 = 0x02,
 };
-static const struct btmrvl_sdio_card_reg btmrvl_reg_8787 = {
+static const struct btmrvl_sdio_card_reg btmrvl_reg_87xx = {
         .cfg = 0x00,
         .host_int_mask = 0x02,
         .host_intstatus = 0x03,
@@ -92,7 +92,14 @@ static const struct btmrvl_sdio_device btmrvl_sdio_sd8688 = {
 static const struct btmrvl_sdio_device btmrvl_sdio_sd8787 = {
         .helper         = NULL,
         .firmware       = "mrvl/sd8787_uapsta.bin",
-        .reg            = &btmrvl_reg_8787,
+        .reg            = &btmrvl_reg_87xx,
+        .sd_blksz_fw_dl = 256,
+};
+
+static const struct btmrvl_sdio_device btmrvl_sdio_sd8797 = {
+        .helper         = NULL,
+        .firmware       = "mrvl/sd8797_uapsta.bin",
+        .reg            = &btmrvl_reg_87xx,
         .sd_blksz_fw_dl = 256,
 };
 
@@ -103,6 +110,9 @@ static const struct sdio_device_id btmrvl_sdio_ids[] = {
         /* Marvell SD8787 Bluetooth device */
         { SDIO_DEVICE(SDIO_VENDOR_ID_MARVELL, 0x911A),
                         .driver_data = (unsigned long) &btmrvl_sdio_sd8787 },
+        /* Marvell SD8797 Bluetooth device */
+        { SDIO_DEVICE(SDIO_VENDOR_ID_MARVELL, 0x912A),
+                        .driver_data = (unsigned long) &btmrvl_sdio_sd8797 },
 
         { }     /* Terminating entry */
 };
@@ -1076,3 +1086,4 @@ MODULE_LICENSE("GPL v2");
 MODULE_FIRMWARE("sd8688_helper.bin");
 MODULE_FIRMWARE("sd8688.bin");
 MODULE_FIRMWARE("mrvl/sd8787_uapsta.bin");
+MODULE_FIRMWARE("mrvl/sd8797_uapsta.bin");
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index fe4ebc375b3d..eabc437ce500 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -777,9 +777,8 @@ skip_waking:
                 usb_mark_last_busy(data->udev);
         }
 
-        usb_free_urb(urb);
-
 done:
+        usb_free_urb(urb);
         return err;
 }
 
diff --git a/drivers/net/ethernet/freescale/fec.c b/drivers/net/ethernet/freescale/fec.c
index 1124ce0a1594..c136230d50bb 100644
--- a/drivers/net/ethernet/freescale/fec.c
+++ b/drivers/net/ethernet/freescale/fec.c
@@ -232,6 +232,7 @@ struct fec_enet_private {
         struct  platform_device *pdev;
 
         int     opened;
+        int     dev_id;
 
         /* Phylib and MDIO interface */
         struct  mii_bus *mii_bus;
@@ -837,7 +838,7 @@ static void __inline__ fec_get_mac(struct net_device *ndev)
 
         /* Adjust MAC if using macaddr */
         if (iap == macaddr)
-                 ndev->dev_addr[ETH_ALEN-1] = macaddr[ETH_ALEN-1] + fep->pdev->id;
+                 ndev->dev_addr[ETH_ALEN-1] = macaddr[ETH_ALEN-1] + fep->dev_id;
 }
 
 /* ------------------------------------------------------------------------- */
@@ -953,7 +954,7 @@ static int fec_enet_mii_probe(struct net_device *ndev)
         char mdio_bus_id[MII_BUS_ID_SIZE];
         char phy_name[MII_BUS_ID_SIZE + 3];
         int phy_id;
-        int dev_id = fep->pdev->id;
+        int dev_id = fep->dev_id;
 
         fep->phy_dev = NULL;
 
@@ -1031,7 +1032,7 @@ static int fec_enet_mii_init(struct platform_device *pdev)
          * mdio interface in board design, and need to be configured by
          * fec0 mii_bus.
          */
-        if ((id_entry->driver_data & FEC_QUIRK_ENET_MAC) && pdev->id > 0) {
+        if ((id_entry->driver_data & FEC_QUIRK_ENET_MAC) && fep->dev_id > 0) {
                 /* fec1 uses fec0 mii_bus */
                 fep->mii_bus = fec0_mii_bus;
                 return 0;
@@ -1063,7 +1064,7 @@ static int fec_enet_mii_init(struct platform_device *pdev)
         fep->mii_bus->read = fec_enet_mdio_read;
         fep->mii_bus->write = fec_enet_mdio_write;
         fep->mii_bus->reset = fec_enet_mdio_reset;
-        snprintf(fep->mii_bus->id, MII_BUS_ID_SIZE, "%x", pdev->id + 1);
+        snprintf(fep->mii_bus->id, MII_BUS_ID_SIZE, "%x", fep->dev_id + 1);
         fep->mii_bus->priv = fep;
         fep->mii_bus->parent = &pdev->dev;
 
@@ -1521,6 +1522,7 @@ fec_probe(struct platform_device *pdev)
         int i, irq, ret = 0;
         struct resource *r;
         const struct of_device_id *of_id;
+        static int dev_id;
 
         of_id = of_match_device(fec_dt_ids, &pdev->dev);
         if (of_id)
@@ -1548,6 +1550,7 @@ fec_probe(struct platform_device *pdev)
 
         fep->hwp = ioremap(r->start, resource_size(r));
         fep->pdev = pdev;
+        fep->dev_id = dev_id++;
 
         if (!fep->hwp) {
                 ret = -ENOMEM;
diff --git a/drivers/net/ethernet/freescale/fsl_pq_mdio.c b/drivers/net/ethernet/freescale/fsl_pq_mdio.c
index 52f4e8ad48e7..4d9f84b8ab97 100644
--- a/drivers/net/ethernet/freescale/fsl_pq_mdio.c
+++ b/drivers/net/ethernet/freescale/fsl_pq_mdio.c
@@ -183,28 +183,10 @@ void fsl_pq_mdio_bus_name(char *name, struct device_node *np)
 }
 EXPORT_SYMBOL_GPL(fsl_pq_mdio_bus_name);
 
-/* Scan the bus in reverse, looking for an empty spot */
-static int fsl_pq_mdio_find_free(struct mii_bus *new_bus)
-{
-        int i;
-
-        for (i = PHY_MAX_ADDR; i > 0; i--) {
-                u32 phy_id;
-
-                if (get_phy_id(new_bus, i, &phy_id))
-                        return -1;
-
-                if (phy_id == 0xffffffff)
-                        break;
-        }
-
-        return i;
-}
-
 
-#if defined(CONFIG_GIANFAR) || defined(CONFIG_GIANFAR_MODULE)
 static u32 __iomem *get_gfar_tbipa(struct fsl_pq_mdio __iomem *regs, struct device_node *np)
 {
+#if defined(CONFIG_GIANFAR) || defined(CONFIG_GIANFAR_MODULE)
         struct gfar __iomem *enet_regs;
 
         /*
@@ -220,15 +202,15 @@ static u32 __iomem *get_gfar_tbipa(struct fsl_pq_mdio __iomem *regs, struct devi
         } else if (of_device_is_compatible(np, "fsl,etsec2-mdio") ||
                         of_device_is_compatible(np, "fsl,etsec2-tbi")) {
                 return of_iomap(np, 1);
-        } else
-                return NULL;
-}
+        }
 #endif
+        return NULL;
+}
 
 
-#if defined(CONFIG_UCC_GETH) || defined(CONFIG_UCC_GETH_MODULE)
 static int get_ucc_id_for_range(u64 start, u64 end, u32 *ucc_id)
 {
+#if defined(CONFIG_UCC_GETH) || defined(CONFIG_UCC_GETH_MODULE)
         struct device_node *np = NULL;
         int err = 0;
 
@@ -261,9 +243,10 @@ static int get_ucc_id_for_range(u64 start, u64 end, u32 *ucc_id)
                 return err;
         else
                 return -EINVAL;
-}
+#else
+        return -ENODEV;
 #endif
-
+}
 
 static int fsl_pq_mdio_probe(struct platform_device *ofdev)
 {
@@ -339,19 +322,13 @@ static int fsl_pq_mdio_probe(struct platform_device *ofdev)
                         of_device_is_compatible(np, "fsl,etsec2-mdio") ||
                         of_device_is_compatible(np, "fsl,etsec2-tbi") ||
                         of_device_is_compatible(np, "gianfar")) {
-#if defined(CONFIG_GIANFAR) || defined(CONFIG_GIANFAR_MODULE)
                 tbipa = get_gfar_tbipa(regs, np);
                 if (!tbipa) {
                         err = -EINVAL;
                         goto err_free_irqs;
                 }
-#else
-                err = -ENODEV;
-                goto err_free_irqs;
-#endif
         } else if (of_device_is_compatible(np, "fsl,ucc-mdio") ||
                         of_device_is_compatible(np, "ucc_geth_phy")) {
-#if defined(CONFIG_UCC_GETH) || defined(CONFIG_UCC_GETH_MODULE)
                 u32 id;
                 static u32 mii_mng_master;
 
@@ -364,10 +341,6 @@ static int fsl_pq_mdio_probe(struct platform_device *ofdev)
                         mii_mng_master = id;
                         ucc_set_qe_mux_mii_mng(id - 1);
                 }
-#else
-                err = -ENODEV;
-                goto err_free_irqs;
-#endif
         } else {
                 err = -ENODEV;
                 goto err_free_irqs;
@@ -386,16 +359,6 @@ static int fsl_pq_mdio_probe(struct platform_device *ofdev)
         }
 
         if (tbiaddr == -1) {
-                out_be32(tbipa, 0);
-
-                tbiaddr = fsl_pq_mdio_find_free(new_bus);
-        }
-
-        /*
-         * We define TBIPA at 0 to be illegal, opting to fail for boards that
-         * have PHYs at 1-31, rather than change tbipa and rescan.
-         */
-        if (tbiaddr == 0) {
                 err = -EBUSY;
 
                 goto err_free_irqs;
diff --git a/drivers/net/ppp/pptp.c b/drivers/net/ppp/pptp.c
index 89f829f5f725..f8a6853b692e 100644
--- a/drivers/net/ppp/pptp.c
+++ b/drivers/net/ppp/pptp.c
@@ -423,10 +423,8 @@ static int pptp_bind(struct socket *sock, struct sockaddr *uservaddr,
         lock_sock(sk);
 
         opt->src_addr = sp->sa_addr.pptp;
-        if (add_chan(po)) {
-                release_sock(sk);
+        if (add_chan(po))
                 error = -EBUSY;
-        }
 
         release_sock(sk);
         return error;
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index 93fbe6f40898..d2348a5a7809 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -286,7 +286,7 @@ static bool ath_complete_reset(struct ath_softc *sc, bool start)
                         ath_start_ani(common);
         }
 
-        if (ath9k_hw_ops(ah)->antdiv_comb_conf_get && sc->ant_rx != 3) {
+        if ((ah->caps.hw_caps & ATH9K_HW_CAP_ANT_DIV_COMB) && sc->ant_rx != 3) {
                 struct ath_hw_antcomb_conf div_ant_conf;
                 u8 lna_conf;
 
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/phy.c b/drivers/net/wireless/rtlwifi/rtl8192ce/phy.c
index 592a10ac5929..3b585aadabfc 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ce/phy.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/phy.c
@@ -569,7 +569,7 @@ static bool _rtl92ce_phy_set_rf_power_state(struct ieee80211_hw *hw,
                 }
         case ERFSLEEP:{
                         if (ppsc->rfpwr_state == ERFOFF)
-                                break;
+                                return false;
                         for (queue_id = 0, i = 0;
                              queue_id < RTL_PCI_MAX_TX_QUEUE_COUNT;) {
                                 ring = &pcipriv->dev.tx_ring[queue_id];
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/phy.c b/drivers/net/wireless/rtlwifi/rtl8192cu/phy.c
index 72852900df84..e49cf2244c75 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/phy.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/phy.c
@@ -548,7 +548,7 @@ static bool _rtl92cu_phy_set_rf_power_state(struct ieee80211_hw *hw,
                 break;
         case ERFSLEEP:
                 if (ppsc->rfpwr_state == ERFOFF)
-                        break;
+                        return false;
                 for (queue_id = 0, i = 0;
                      queue_id < RTL_PCI_MAX_TX_QUEUE_COUNT;) {
                         ring = &pcipriv->dev.tx_ring[queue_id];
diff --git a/drivers/net/wireless/rtlwifi/rtl8192de/phy.c b/drivers/net/wireless/rtlwifi/rtl8192de/phy.c
index 3ac7af1c5509..0883349e1c83 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192de/phy.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192de/phy.c
@@ -3374,7 +3374,7 @@ bool rtl92d_phy_set_rf_power_state(struct ieee80211_hw *hw,
                 break;
         case ERFSLEEP:
                 if (ppsc->rfpwr_state == ERFOFF)
-                        break;
+                        return false;
 
                 for (queue_id = 0, i = 0;
                      queue_id < RTL_PCI_MAX_TX_QUEUE_COUNT;) {
diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/phy.c b/drivers/net/wireless/rtlwifi/rtl8192se/phy.c
index f27171af979c..f10ac1ad9087 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192se/phy.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192se/phy.c
@@ -602,7 +602,7 @@ bool rtl92s_phy_set_rf_power_state(struct ieee80211_hw *hw,
                 }
         case ERFSLEEP:
                         if (ppsc->rfpwr_state == ERFOFF)
-                                break;
+                                return false;
 
                         for (queue_id = 0, i = 0;
                              queue_id < RTL_PCI_MAX_TX_QUEUE_COUNT;) {
diff --git a/drivers/ssb/driver_pcicore.c b/drivers/ssb/driver_pcicore.c
index 84c934c0a545..520e8286db28 100644
--- a/drivers/ssb/driver_pcicore.c
+++ b/drivers/ssb/driver_pcicore.c
@@ -517,10 +517,14 @@ static void ssb_pcicore_pcie_setup_workarounds(struct ssb_pcicore *pc)
 
 static void __devinit ssb_pcicore_init_clientmode(struct ssb_pcicore *pc)
 {
-        ssb_pcicore_fix_sprom_core_index(pc);
+        struct ssb_device *pdev = pc->dev;
+        struct ssb_bus *bus = pdev->bus;
+
+        if (bus->bustype == SSB_BUSTYPE_PCI)
+                ssb_pcicore_fix_sprom_core_index(pc);
 
         /* Disable PCI interrupts. */
-        ssb_write32(pc->dev, SSB_INTVEC, 0);
+        ssb_write32(pdev, SSB_INTVEC, 0);
 
         /* Additional PCIe always once-executed workarounds */
         if (pc->dev->id.coreid == SSB_DEV_PCIE) {
diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c
index c7aafc7c5ed4..5f09a578d49d 100644
--- a/net/batman-adv/translation-table.c
+++ b/net/batman-adv/translation-table.c
@@ -245,9 +245,11 @@ void tt_local_add(struct net_device *soft_iface, const uint8_t *addr,
         if (tt_global_entry) {
                 /* This node is probably going to update its tt table */
                 tt_global_entry->orig_node->tt_poss_change = true;
-                /* The global entry has to be marked as PENDING and has to be
+                /* The global entry has to be marked as ROAMING and has to be
                  * kept for consistency purpose */
-                tt_global_entry->flags |= TT_CLIENT_PENDING;
+                tt_global_entry->flags |= TT_CLIENT_ROAM;
+                tt_global_entry->roam_at = jiffies;
+
                 send_roam_adv(bat_priv, tt_global_entry->addr,
                               tt_global_entry->orig_node);
         }
@@ -694,6 +696,7 @@ void tt_global_del(struct bat_priv *bat_priv,
                    const char *message, bool roaming)
 {
         struct tt_global_entry *tt_global_entry = NULL;
+        struct tt_local_entry *tt_local_entry = NULL;
 
         tt_global_entry = tt_global_hash_find(bat_priv, addr);
         if (!tt_global_entry)
@@ -701,15 +704,29 @@ void tt_global_del(struct bat_priv *bat_priv,
 
         if (tt_global_entry->orig_node == orig_node) {
                 if (roaming) {
-                        tt_global_entry->flags |= TT_CLIENT_ROAM;
-                        tt_global_entry->roam_at = jiffies;
-                        goto out;
+                        /* if we are deleting a global entry due to a roam
+                         * event, there are two possibilities:
+                         * 1) the client roamed from node A to node B => we mark
+                         *    it with TT_CLIENT_ROAM, we start a timer and we
+                         *    wait for node B to claim it. In case of timeout
+                         *    the entry is purged.
+                         * 2) the client roamed to us => we can directly delete
+                         *    the global entry, since it is useless now. */
+                        tt_local_entry = tt_local_hash_find(bat_priv,
+                                                        tt_global_entry->addr);
+                        if (!tt_local_entry) {
+                                tt_global_entry->flags |= TT_CLIENT_ROAM;
+                                tt_global_entry->roam_at = jiffies;
+                                goto out;
+                        }
                 }
                 _tt_global_del(bat_priv, tt_global_entry, message);
         }
 out:
         if (tt_global_entry)
                 tt_global_entry_free_ref(tt_global_entry);
+        if (tt_local_entry)
+                tt_local_entry_free_ref(tt_local_entry);
 }
 
 void tt_global_del_orig(struct bat_priv *bat_priv,
diff --git a/net/bluetooth/bnep/core.c b/net/bluetooth/bnep/core.c
index 91bcd3a961ec..1eea8208b2cc 100644
--- a/net/bluetooth/bnep/core.c
+++ b/net/bluetooth/bnep/core.c
@@ -79,17 +79,12 @@ static struct bnep_session *__bnep_get_session(u8 *dst)
 
 static void __bnep_link_session(struct bnep_session *s)
 {
-        /* It's safe to call __module_get() here because sessions are added
-           by the socket layer which has to hold the reference to this module.
-         */
-        __module_get(THIS_MODULE);
         list_add(&s->list, &bnep_session_list);
 }
 
 static void __bnep_unlink_session(struct bnep_session *s)
 {
         list_del(&s->list);
-        module_put(THIS_MODULE);
 }
 
 static int bnep_send(struct bnep_session *s, void *data, size_t len)
@@ -530,6 +525,7 @@ static int bnep_session(void *arg)
 
         up_write(&bnep_session_sem);
         free_netdev(dev);
+        module_put_and_exit(0);
         return 0;
 }
 
@@ -616,9 +612,11 @@ int bnep_add_connection(struct bnep_connadd_req *req, struct socket *sock)
 
         __bnep_link_session(s);
 
+        __module_get(THIS_MODULE);
         s->task = kthread_run(bnep_session, s, "kbnepd %s", dev->name);
         if (IS_ERR(s->task)) {
                 /* Session thread start failed, gotta cleanup. */
+                module_put(THIS_MODULE);
                 unregister_netdev(dev);
                 __bnep_unlink_session(s);
                 err = PTR_ERR(s->task);
diff --git a/net/bluetooth/cmtp/core.c b/net/bluetooth/cmtp/core.c
index 7d00ddf9e9dc..5a6e634f7fca 100644
--- a/net/bluetooth/cmtp/core.c
+++ b/net/bluetooth/cmtp/core.c
@@ -67,14 +67,12 @@ static struct cmtp_session *__cmtp_get_session(bdaddr_t *bdaddr)
 
 static void __cmtp_link_session(struct cmtp_session *session)
 {
-        __module_get(THIS_MODULE);
         list_add(&session->list, &cmtp_session_list);
 }
 
 static void __cmtp_unlink_session(struct cmtp_session *session)
 {
         list_del(&session->list);
-        module_put(THIS_MODULE);
 }
 
 static void __cmtp_copy_session(struct cmtp_session *session, struct cmtp_conninfo *ci)
@@ -327,6 +325,7 @@ static int cmtp_session(void *arg)
         up_write(&cmtp_session_sem);
 
         kfree(session);
+        module_put_and_exit(0);
         return 0;
 }
 
@@ -376,9 +375,11 @@ int cmtp_add_connection(struct cmtp_connadd_req *req, struct socket *sock)
 
         __cmtp_link_session(session);
 
+        __module_get(THIS_MODULE);
         session->task = kthread_run(cmtp_session, session, "kcmtpd_ctr_%d",
                                                                 session->num);
         if (IS_ERR(session->task)) {
+                module_put(THIS_MODULE);
                 err = PTR_ERR(session->task);
                 goto unlink;
         }
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index d7d96b6b1f0d..643a41b76e2e 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -545,7 +545,7 @@ static void hci_setup(struct hci_dev *hdev)
 {
         hci_setup_event_mask(hdev);
 
-        if (hdev->lmp_ver > 1)
+        if (hdev->hci_ver > 1)
                 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_COMMANDS, 0, NULL);
 
         if (hdev->features[6] & LMP_SIMPLE_PAIR) {
diff --git a/net/ipv4/ipip.c b/net/ipv4/ipip.c
index 065effd8349a..0b2e7329abda 100644
--- a/net/ipv4/ipip.c
+++ b/net/ipv4/ipip.c
@@ -285,6 +285,8 @@ static struct ip_tunnel * ipip_tunnel_locate(struct net *net,
         if (register_netdevice(dev) < 0)
                 goto failed_free;
 
+        strcpy(nt->parms.name, dev->name);
+
         dev_hold(dev);
         ipip_tunnel_link(ipn, nt);
         return nt;
@@ -759,7 +761,6 @@ static int ipip_tunnel_init(struct net_device *dev)
         struct ip_tunnel *tunnel = netdev_priv(dev);
 
         tunnel->dev = dev;
-        strcpy(tunnel->parms.name, dev->name);
 
         memcpy(dev->dev_addr, &tunnel->parms.iph.saddr, 4);
         memcpy(dev->broadcast, &tunnel->parms.iph.daddr, 4);
@@ -825,6 +826,7 @@ static void ipip_destroy_tunnels(struct ipip_net *ipn, struct list_head *head)
 static int __net_init ipip_init_net(struct net *net)
 {
         struct ipip_net *ipn = net_generic(net, ipip_net_id);
+        struct ip_tunnel *t;
         int err;
 
         ipn->tunnels[0] = ipn->tunnels_wc;
@@ -848,6 +850,9 @@ static int __net_init ipip_init_net(struct net *net)
         if ((err = register_netdev(ipn->fb_tunnel_dev)))
                 goto err_reg_dev;
 
+        t = netdev_priv(ipn->fb_tunnel_dev);
+
+        strcpy(t->parms.name, ipn->fb_tunnel_dev->name);
         return 0;
 
 err_reg_dev:
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index cf88df82e2c2..36806def8cfd 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -1805,7 +1805,8 @@ static struct inet6_dev *addrconf_add_dev(struct net_device *dev)
                 return ERR_PTR(-EACCES);
 
         /* Add default multicast route */
-        addrconf_add_mroute(dev);
+        if (!(dev->flags & IFF_LOOPBACK))
+                addrconf_add_mroute(dev);
 
         /* Add link local route */
         addrconf_add_lroute(dev);
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 3399dd326287..b582a0a0f1c5 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -728,7 +728,7 @@ static struct rt6_info *rt6_alloc_cow(const struct rt6_info *ort,
                 int attempts = !in_softirq();
 
                 if (!(rt->rt6i_flags&RTF_GATEWAY)) {
-                        if (rt->rt6i_dst.plen != 128 &&
+                        if (ort->rt6i_dst.plen != 128 &&
                             ipv6_addr_equal(&ort->rt6i_dst.addr, daddr))
                                 rt->rt6i_flags |= RTF_ANYCAST;
                         ipv6_addr_copy(&rt->rt6i_gateway, daddr);
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index a7a18602a046..96f3623618e3 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -263,6 +263,8 @@ static struct ip_tunnel *ipip6_tunnel_locate(struct net *net,
         if (register_netdevice(dev) < 0)
                 goto failed_free;
 
+        strcpy(nt->parms.name, dev->name);
+
         dev_hold(dev);
 
         ipip6_tunnel_link(sitn, nt);
@@ -1144,7 +1146,6 @@ static int ipip6_tunnel_init(struct net_device *dev)
         struct ip_tunnel *tunnel = netdev_priv(dev);
 
         tunnel->dev = dev;
-        strcpy(tunnel->parms.name, dev->name);
 
         memcpy(dev->dev_addr, &tunnel->parms.iph.saddr, 4);
         memcpy(dev->broadcast, &tunnel->parms.iph.daddr, 4);
@@ -1207,6 +1208,7 @@ static void __net_exit sit_destroy_tunnels(struct sit_net *sitn, struct list_hea
 static int __net_init sit_init_net(struct net *net)
 {
         struct sit_net *sitn = net_generic(net, sit_net_id);
+        struct ip_tunnel *t;
         int err;
 
         sitn->tunnels[0] = sitn->tunnels_wc;
@@ -1231,6 +1233,9 @@ static int __net_init sit_init_net(struct net *net)
         if ((err = register_netdev(sitn->fb_tunnel_dev)))
                 goto err_reg_dev;
 
+        t = netdev_priv(sitn->fb_tunnel_dev);
+
+        strcpy(t->parms.name, sitn->fb_tunnel_dev->name);
         return 0;
 
 err_reg_dev:
diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
index b064e4df12c6..2e4b961648d4 100644
--- a/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
@@ -303,6 +303,38 @@ ieee80211_wake_queue_agg(struct ieee80211_local *local, int tid)
         __release(agg_queue);
 }
 
+/*
+ * splice packets from the STA's pending to the local pending,
+ * requires a call to ieee80211_agg_splice_finish later
+ */
+static void __acquires(agg_queue)
+ieee80211_agg_splice_packets(struct ieee80211_local *local,
+                             struct tid_ampdu_tx *tid_tx, u16 tid)
+{
+        int queue = ieee80211_ac_from_tid(tid);
+        unsigned long flags;
+
+        ieee80211_stop_queue_agg(local, tid);
+
+        if (WARN(!tid_tx, "TID %d gone but expected when splicing aggregates"
+                          " from the pending queue\n", tid))
+                return;
+
+        if (!skb_queue_empty(&tid_tx->pending)) {
+                spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
+                /* copy over remaining packets */
+                skb_queue_splice_tail_init(&tid_tx->pending,
+                                           &local->pending[queue]);
+                spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
+        }
+}
+
+static void __releases(agg_queue)
+ieee80211_agg_splice_finish(struct ieee80211_local *local, u16 tid)
+{
+        ieee80211_wake_queue_agg(local, tid);
+}
+
 void ieee80211_tx_ba_session_handle_start(struct sta_info *sta, int tid)
 {
         struct tid_ampdu_tx *tid_tx;
@@ -314,19 +346,17 @@ void ieee80211_tx_ba_session_handle_start(struct sta_info *sta, int tid)
         tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
 
         /*
-         * While we're asking the driver about the aggregation,
-         * stop the AC queue so that we don't have to worry
-         * about frames that came in while we were doing that,
-         * which would require us to put them to the AC pending
-         * afterwards which just makes the code more complex.
+         * Start queuing up packets for this aggregation session.
+         * We're going to release them once the driver is OK with
+         * that.
          */
-        ieee80211_stop_queue_agg(local, tid);
-
         clear_bit(HT_AGG_STATE_WANT_START, &tid_tx->state);
 
         /*
-         * make sure no packets are being processed to get
-         * valid starting sequence number
+         * Make sure no packets are being processed. This ensures that
+         * we have a valid starting sequence number and that in-flight
+         * packets have been flushed out and no packets for this TID
+         * will go into the driver during the ampdu_action call.
          */
         synchronize_net();
 
@@ -340,17 +370,15 @@ void ieee80211_tx_ba_session_handle_start(struct sta_info *sta, int tid)
                                         " tid %d\n", tid);
 #endif
                 spin_lock_bh(&sta->lock);
+                ieee80211_agg_splice_packets(local, tid_tx, tid);
                 ieee80211_assign_tid_tx(sta, tid, NULL);
+                ieee80211_agg_splice_finish(local, tid);
                 spin_unlock_bh(&sta->lock);
 
-                ieee80211_wake_queue_agg(local, tid);
                 kfree_rcu(tid_tx, rcu_head);
                 return;
         }
 
-        /* we can take packets again now */
-        ieee80211_wake_queue_agg(local, tid);
-
         /* activate the timer for the recipient's addBA response */
         mod_timer(&tid_tx->addba_resp_timer, jiffies + ADDBA_RESP_INTERVAL);
 #ifdef CONFIG_MAC80211_HT_DEBUG
@@ -466,38 +494,6 @@ int ieee80211_start_tx_ba_session(struct ieee80211_sta *pubsta, u16 tid,
 }
 EXPORT_SYMBOL(ieee80211_start_tx_ba_session);
 
-/*
- * splice packets from the STA's pending to the local pending,
- * requires a call to ieee80211_agg_splice_finish later
- */
-static void __acquires(agg_queue)
-ieee80211_agg_splice_packets(struct ieee80211_local *local,
-                             struct tid_ampdu_tx *tid_tx, u16 tid)
-{
-        int queue = ieee80211_ac_from_tid(tid);
-        unsigned long flags;
-
-        ieee80211_stop_queue_agg(local, tid);
-
-        if (WARN(!tid_tx, "TID %d gone but expected when splicing aggregates"
-                          " from the pending queue\n", tid))
-                return;
-
-        if (!skb_queue_empty(&tid_tx->pending)) {
-                spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
-                /* copy over remaining packets */
-                skb_queue_splice_tail_init(&tid_tx->pending,
-                                           &local->pending[queue]);
-                spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
-        }
-}
-
-static void __releases(agg_queue)
-ieee80211_agg_splice_finish(struct ieee80211_local *local, u16 tid)
-{
-        ieee80211_wake_queue_agg(local, tid);
-}
-
 static void ieee80211_agg_tx_operational(struct ieee80211_local *local,
                                          struct sta_info *sta, u16 tid)
 {
diff --git a/net/sched/sch_gred.c b/net/sched/sch_gred.c
index b9493a09a870..6cd8ddfb512d 100644
--- a/net/sched/sch_gred.c
+++ b/net/sched/sch_gred.c
@@ -385,7 +385,7 @@ static inline int gred_change_vq(struct Qdisc *sch, int dp,
         struct gred_sched_data *q;
 
         if (table->tab[dp] == NULL) {
-                table->tab[dp] = kzalloc(sizeof(*q), GFP_KERNEL);
+                table->tab[dp] = kzalloc(sizeof(*q), GFP_ATOMIC);
                 if (table->tab[dp] == NULL)
                         return -ENOMEM;
         }