Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6

Conflicts:
	drivers/net/sfc/net_driver.h
	drivers/net/sfc/siena.c

49 files changed, 323 insertions, 270 deletions

diff --git a/drivers/isdn/capi/kcapi.c b/drivers/isdn/capi/kcapi.c
index bde3c88b8b27..b054494df846 100644
--- a/drivers/isdn/capi/kcapi.c
+++ b/drivers/isdn/capi/kcapi.c
@@ -1020,12 +1020,12 @@ static int old_capi_manufacturer(unsigned int cmd, void __user *data)
                 if (cmd == AVMB1_ADDCARD) {
                    if ((retval = copy_from_user(&cdef, data,
                                             sizeof(avmb1_carddef))))
-                           return retval;
+                           return -EFAULT;
                    cdef.cardtype = AVM_CARDTYPE_B1;
                 } else {
                    if ((retval = copy_from_user(&cdef, data,
                                             sizeof(avmb1_extcarddef))))
-                           return retval;
+                           return -EFAULT;
                 }
                 cparams.port = cdef.port;
                 cparams.irq = cdef.irq;
@@ -1218,7 +1218,7 @@ int capi20_manufacturer(unsigned int cmd, void __user *data)
                 kcapi_carddef cdef;
 
                 if ((retval = copy_from_user(&cdef, data, sizeof(cdef))))
-                        return retval;
+                        return -EFAULT;
 
                 cparams.port = cdef.port;
                 cparams.irq = cdef.irq;
diff --git a/drivers/isdn/hardware/mISDN/netjet.c b/drivers/isdn/hardware/mISDN/netjet.c
index 0a3553df065f..54ae71a907f9 100644
--- a/drivers/isdn/hardware/mISDN/netjet.c
+++ b/drivers/isdn/hardware/mISDN/netjet.c
@@ -320,12 +320,12 @@ inittiger(struct tiger_hw *card)
                 return -ENOMEM;
         }
         for (i = 0; i < 2; i++) {
-                card->bc[i].hsbuf = kmalloc(NJ_DMA_TXSIZE, GFP_KERNEL);
+                card->bc[i].hsbuf = kmalloc(NJ_DMA_TXSIZE, GFP_ATOMIC);
                 if (!card->bc[i].hsbuf) {
                         pr_info("%s: no B%d send buffer\n", card->name, i + 1);
                         return -ENOMEM;
                 }
-                card->bc[i].hrbuf = kmalloc(NJ_DMA_RXSIZE, GFP_KERNEL);
+                card->bc[i].hrbuf = kmalloc(NJ_DMA_RXSIZE, GFP_ATOMIC);
                 if (!card->bc[i].hrbuf) {
                         pr_info("%s: no B%d recv buffer\n", card->name, i + 1);
                         return -ENOMEM;
diff --git a/drivers/net/benet/be_cmds.c b/drivers/net/benet/be_cmds.c
index ce437b639cf8..ee1ad9693c8f 100644
--- a/drivers/net/benet/be_cmds.c
+++ b/drivers/net/benet/be_cmds.c
@@ -1592,7 +1592,7 @@ int be_cmd_loopback_test(struct be_adapter *adapter, u32 port_num,
 
         be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_LOWLEVEL,
                         OPCODE_LOWLEVEL_LOOPBACK_TEST, sizeof(*req));
-        req->hdr.timeout = 4;
+        req->hdr.timeout = cpu_to_le32(4);
 
         req->pattern = cpu_to_le64(pattern);
         req->src_port = cpu_to_le32(port_num);
diff --git a/drivers/net/bnx2.c b/drivers/net/bnx2.c
index 188e356c30a3..949d7a9dcf92 100644
--- a/drivers/net/bnx2.c
+++ b/drivers/net/bnx2.c
@@ -247,6 +247,7 @@ static const struct flash_spec flash_5709 = {
 MODULE_DEVICE_TABLE(pci, bnx2_pci_tbl);
 
 static void bnx2_init_napi(struct bnx2 *bp);
+static void bnx2_del_napi(struct bnx2 *bp);
 
 static inline u32 bnx2_tx_avail(struct bnx2 *bp, struct bnx2_tx_ring_info *txr)
 {
@@ -6270,6 +6271,7 @@ open_err:
         bnx2_free_skbs(bp);
         bnx2_free_irq(bp);
         bnx2_free_mem(bp);
+        bnx2_del_napi(bp);
         return rc;
 }
 
@@ -6537,6 +6539,7 @@ bnx2_close(struct net_device *dev)
         bnx2_free_irq(bp);
         bnx2_free_skbs(bp);
         bnx2_free_mem(bp);
+        bnx2_del_napi(bp);
         bp->link_up = 0;
         netif_carrier_off(bp->dev);
         bnx2_set_power_state(bp, PCI_D3hot);
@@ -8227,7 +8230,16 @@ bnx2_bus_string(struct bnx2 *bp, char *str)
         return str;
 }
 
-static void __devinit
+static void
+bnx2_del_napi(struct bnx2 *bp)
+{
+        int i;
+
+        for (i = 0; i < bp->irq_nvecs; i++)
+                netif_napi_del(&bp->bnx2_napi[i].napi);
+}
+
+static void
 bnx2_init_napi(struct bnx2 *bp)
 {
         int i;
diff --git a/drivers/net/can/mscan/mpc5xxx_can.c b/drivers/net/can/mscan/mpc5xxx_can.c
index 8af8442c694a..af753936e835 100644
--- a/drivers/net/can/mscan/mpc5xxx_can.c
+++ b/drivers/net/can/mscan/mpc5xxx_can.c
@@ -73,7 +73,7 @@ static u32 __devinit mpc52xx_can_get_clock(struct of_device *ofdev,
         else
                 *mscan_clksrc = MSCAN_CLKSRC_XTAL;
 
-        freq = mpc5xxx_get_bus_frequency(ofdev->node);
+        freq = mpc5xxx_get_bus_frequency(ofdev->dev.of_node);
         if (!freq)
                 return 0;
 
@@ -152,7 +152,7 @@ static u32 __devinit mpc512x_can_get_clock(struct of_device *ofdev,
         }
 
         /* Determine the MSCAN device index from the physical address */
-        pval = of_get_property(ofdev->node, "reg", &plen);
+        pval = of_get_property(ofdev->dev.of_node, "reg", &plen);
         BUG_ON(!pval || plen < sizeof(*pval));
         clockidx = (*pval & 0x80) ? 1 : 0;
         if (*pval & 0x2000)
@@ -168,11 +168,11 @@ static u32 __devinit mpc512x_can_get_clock(struct of_device *ofdev,
          */
         if (clock_name && !strcmp(clock_name, "ip")) {
                 *mscan_clksrc = MSCAN_CLKSRC_IPS;
-                freq = mpc5xxx_get_bus_frequency(ofdev->node);
+                freq = mpc5xxx_get_bus_frequency(ofdev->dev.of_node);
         } else {
                 *mscan_clksrc = MSCAN_CLKSRC_BUS;
 
-                pval = of_get_property(ofdev->node,
+                pval = of_get_property(ofdev->dev.of_node,
                                        "fsl,mscan-clock-divider", &plen);
                 if (pval && plen == sizeof(*pval))
                         clockdiv = *pval;
@@ -251,7 +251,7 @@ static int __devinit mpc5xxx_can_probe(struct of_device *ofdev,
                                        const struct of_device_id *id)
 {
         struct mpc5xxx_can_data *data = (struct mpc5xxx_can_data *)id->data;
-        struct device_node *np = ofdev->node;
+        struct device_node *np = ofdev->dev.of_node;
         struct net_device *dev;
         struct mscan_priv *priv;
         void __iomem *base;
diff --git a/drivers/net/e1000e/netdev.c b/drivers/net/e1000e/netdev.c
index 24507f3b8b17..57a7e41da69e 100644
--- a/drivers/net/e1000e/netdev.c
+++ b/drivers/net/e1000e/netdev.c
@@ -2554,7 +2554,7 @@ static void e1000_init_manageability_pt(struct e1000_adapter *adapter)
                         mdef = er32(MDEF(i));
 
                         /* Ignore filters with anything other than IPMI ports */
-                        if (mdef & !(E1000_MDEF_PORT_623 | E1000_MDEF_PORT_664))
+                        if (mdef & ~(E1000_MDEF_PORT_623 | E1000_MDEF_PORT_664))
                                 continue;
 
                         /* Enable this decision filter in MANC2H */
diff --git a/drivers/net/enic/enic.h b/drivers/net/enic/enic.h
index 85f2a2e7030a..45e86d1e5b1b 100644
--- a/drivers/net/enic/enic.h
+++ b/drivers/net/enic/enic.h
@@ -74,7 +74,14 @@ struct enic_msix_entry {
         void *devid;
 };
 
+#define ENIC_SET_APPLIED                (1 << 0)
+#define ENIC_SET_REQUEST                (1 << 1)
+#define ENIC_SET_NAME                   (1 << 2)
+#define ENIC_SET_INSTANCE               (1 << 3)
+#define ENIC_SET_HOST                   (1 << 4)
+
 struct enic_port_profile {
+        u32 set;
         u8 request;
         char name[PORT_PROFILE_MAX];
         u8 instance_uuid[PORT_UUID_MAX];
diff --git a/drivers/net/enic/enic_main.c b/drivers/net/enic/enic_main.c
index 6586b5c7e4b6..bc7d6b96de3d 100644
--- a/drivers/net/enic/enic_main.c
+++ b/drivers/net/enic/enic_main.c
@@ -1029,8 +1029,7 @@ static int enic_dev_init_done(struct enic *enic, int *done, int *error)
         return err;
 }
 
-static int enic_set_port_profile(struct enic *enic, u8 request, u8 *mac,
-        char *name, u8 *instance_uuid, u8 *host_uuid)
+static int enic_set_port_profile(struct enic *enic, u8 *mac)
 {
         struct vic_provinfo *vp;
         u8 oui[3] = VIC_PROVINFO_CISCO_OUI;
@@ -1040,97 +1039,112 @@ static int enic_set_port_profile(struct enic *enic, u8 request, u8 *mac,
                 "%02X%02X-%02X%02X%02X%02X%0X%02X";
         int err;
 
-        if (!name)
-                return -EINVAL;
+        err = enic_vnic_dev_deinit(enic);
+        if (err)
+                return err;
 
-        if (!is_valid_ether_addr(mac))
-                return -EADDRNOTAVAIL;
+        switch (enic->pp.request) {
 
-        vp = vic_provinfo_alloc(GFP_KERNEL, oui, VIC_PROVINFO_LINUX_TYPE);
-        if (!vp)
-                return -ENOMEM;
+        case PORT_REQUEST_ASSOCIATE:
 
-        vic_provinfo_add_tlv(vp,
-                VIC_LINUX_PROV_TLV_PORT_PROFILE_NAME_STR,
-                strlen(name) + 1, name);
-
-        vic_provinfo_add_tlv(vp,
-                VIC_LINUX_PROV_TLV_CLIENT_MAC_ADDR,
-                ETH_ALEN, mac);
-
-        if (instance_uuid) {
-                uuid = instance_uuid;
-                sprintf(uuid_str, uuid_fmt,
-                        uuid[0],  uuid[1],  uuid[2],  uuid[3],
-                        uuid[4],  uuid[5],  uuid[6],  uuid[7],
-                        uuid[8],  uuid[9],  uuid[10], uuid[11],
-                        uuid[12], uuid[13], uuid[14], uuid[15]);
-                vic_provinfo_add_tlv(vp,
-                        VIC_LINUX_PROV_TLV_CLIENT_UUID_STR,
-                        sizeof(uuid_str), uuid_str);
-        }
+                if (!(enic->pp.set & ENIC_SET_NAME) || !strlen(enic->pp.name))
+                        return -EINVAL;
 
-        if (host_uuid) {
-                uuid = host_uuid;
-                sprintf(uuid_str, uuid_fmt,
-                        uuid[0],  uuid[1],  uuid[2],  uuid[3],
-                        uuid[4],  uuid[5],  uuid[6],  uuid[7],
-                        uuid[8],  uuid[9],  uuid[10], uuid[11],
-                        uuid[12], uuid[13], uuid[14], uuid[15]);
-                vic_provinfo_add_tlv(vp,
-                        VIC_LINUX_PROV_TLV_HOST_UUID_STR,
-                        sizeof(uuid_str), uuid_str);
-        }
+                if (!is_valid_ether_addr(mac))
+                        return -EADDRNOTAVAIL;
 
-        err = enic_vnic_dev_deinit(enic);
-        if (err)
-                goto err_out;
+                vp = vic_provinfo_alloc(GFP_KERNEL, oui,
+                        VIC_PROVINFO_LINUX_TYPE);
+                if (!vp)
+                        return -ENOMEM;
 
-        memset(&enic->pp, 0, sizeof(enic->pp));
+                vic_provinfo_add_tlv(vp,
+                        VIC_LINUX_PROV_TLV_PORT_PROFILE_NAME_STR,
+                        strlen(enic->pp.name) + 1, enic->pp.name);
 
-        err = enic_dev_init_prov(enic, vp);
-        if (err)
-                goto err_out;
+                vic_provinfo_add_tlv(vp,
+                        VIC_LINUX_PROV_TLV_CLIENT_MAC_ADDR,
+                        ETH_ALEN, mac);
+
+                if (enic->pp.set & ENIC_SET_INSTANCE) {
+                        uuid = enic->pp.instance_uuid;
+                        sprintf(uuid_str, uuid_fmt,
+                                uuid[0],  uuid[1],  uuid[2],  uuid[3],
+                                uuid[4],  uuid[5],  uuid[6],  uuid[7],
+                                uuid[8],  uuid[9],  uuid[10], uuid[11],
+                                uuid[12], uuid[13], uuid[14], uuid[15]);
+                        vic_provinfo_add_tlv(vp,
+                                VIC_LINUX_PROV_TLV_CLIENT_UUID_STR,
+                                sizeof(uuid_str), uuid_str);
+                }
 
-        enic->pp.request = request;
-        memcpy(enic->pp.name, name, PORT_PROFILE_MAX);
-        if (instance_uuid)
-                memcpy(enic->pp.instance_uuid,
-                        instance_uuid, PORT_UUID_MAX);
-        if (host_uuid)
-                memcpy(enic->pp.host_uuid,
-                        host_uuid, PORT_UUID_MAX);
+                if (enic->pp.set & ENIC_SET_HOST) {
+                        uuid = enic->pp.host_uuid;
+                        sprintf(uuid_str, uuid_fmt,
+                                uuid[0],  uuid[1],  uuid[2],  uuid[3],
+                                uuid[4],  uuid[5],  uuid[6],  uuid[7],
+                                uuid[8],  uuid[9],  uuid[10], uuid[11],
+                                uuid[12], uuid[13], uuid[14], uuid[15]);
+                        vic_provinfo_add_tlv(vp,
+                                VIC_LINUX_PROV_TLV_HOST_UUID_STR,
+                                sizeof(uuid_str), uuid_str);
+                }
 
-err_out:
-        vic_provinfo_free(vp);
+                err = enic_dev_init_prov(enic, vp);
+                vic_provinfo_free(vp);
+                if (err)
+                        return err;
+                break;
 
-        return err;
-}
+        case PORT_REQUEST_DISASSOCIATE:
+                break;
 
-static int enic_unset_port_profile(struct enic *enic)
-{
-        memset(&enic->pp, 0, sizeof(enic->pp));
-        return enic_vnic_dev_deinit(enic);
+        default:
+                return -EINVAL;
+        }
+
+        enic->pp.set |= ENIC_SET_APPLIED;
+        return 0;
 }
 
 static int enic_set_vf_port(struct net_device *netdev, int vf,
         struct nlattr *port[])
 {
         struct enic *enic = netdev_priv(netdev);
-        char *name = NULL;
-        u8 *instance_uuid = NULL;
-        u8 *host_uuid = NULL;
-        u8 request = PORT_REQUEST_DISASSOCIATE;
+
+        memset(&enic->pp, 0, sizeof(enic->pp));
+
+        if (port[IFLA_PORT_REQUEST]) {
+                enic->pp.set |= ENIC_SET_REQUEST;
+                enic->pp.request = nla_get_u8(port[IFLA_PORT_REQUEST]);
+        }
+
+        if (port[IFLA_PORT_PROFILE]) {
+                enic->pp.set |= ENIC_SET_NAME;
+                memcpy(enic->pp.name, nla_data(port[IFLA_PORT_PROFILE]),
+                        PORT_PROFILE_MAX);
+        }
+
+        if (port[IFLA_PORT_INSTANCE_UUID]) {
+                enic->pp.set |= ENIC_SET_INSTANCE;
+                memcpy(enic->pp.instance_uuid,
+                        nla_data(port[IFLA_PORT_INSTANCE_UUID]), PORT_UUID_MAX);
+        }
+
+        if (port[IFLA_PORT_HOST_UUID]) {
+                enic->pp.set |= ENIC_SET_HOST;
+                memcpy(enic->pp.host_uuid,
+                        nla_data(port[IFLA_PORT_HOST_UUID]), PORT_UUID_MAX);
+        }
 
         /* don't support VFs, yet */
         if (vf != PORT_SELF_VF)
                 return -EOPNOTSUPP;
 
-        if (port[IFLA_PORT_REQUEST])
-                request = nla_get_u8(port[IFLA_PORT_REQUEST]);
+        if (!(enic->pp.set & ENIC_SET_REQUEST))
+                return -EOPNOTSUPP;
 
-        switch (request) {
-        case PORT_REQUEST_ASSOCIATE:
+        if (enic->pp.request == PORT_REQUEST_ASSOCIATE) {
 
                 /* If the interface mac addr hasn't been assigned,
                  * assign a random mac addr before setting port-
@@ -1139,30 +1153,9 @@ static int enic_set_vf_port(struct net_device *netdev, int vf,
 
                 if (is_zero_ether_addr(netdev->dev_addr))
                         random_ether_addr(netdev->dev_addr);
-
-                if (port[IFLA_PORT_PROFILE])
-                        name = nla_data(port[IFLA_PORT_PROFILE]);
-
-                if (port[IFLA_PORT_INSTANCE_UUID])
-                        instance_uuid =
-                                nla_data(port[IFLA_PORT_INSTANCE_UUID]);
-
-                if (port[IFLA_PORT_HOST_UUID])
-                        host_uuid = nla_data(port[IFLA_PORT_HOST_UUID]);
-
-                return enic_set_port_profile(enic, request,
-                        netdev->dev_addr, name,
-                        instance_uuid, host_uuid);
-
-        case PORT_REQUEST_DISASSOCIATE:
-
-                return enic_unset_port_profile(enic);
-
-        default:
-                break;
         }
 
-        return -EOPNOTSUPP;
+        return enic_set_port_profile(enic, netdev->dev_addr);
 }
 
 static int enic_get_vf_port(struct net_device *netdev, int vf,
@@ -1172,14 +1165,12 @@ static int enic_get_vf_port(struct net_device *netdev, int vf,
         int err, error, done;
         u16 response = PORT_PROFILE_RESPONSE_SUCCESS;
 
-        /* don't support VFs, yet */
-        if (vf != PORT_SELF_VF)
-                return -EOPNOTSUPP;
+        if (!(enic->pp.set & ENIC_SET_APPLIED))
+                return -ENODATA;
 
         err = enic_dev_init_done(enic, &done, &error);
-
         if (err)
-                return err;
+                error = err;
 
         switch (error) {
         case ERR_SUCCESS:
@@ -1202,12 +1193,15 @@ static int enic_get_vf_port(struct net_device *netdev, int vf,
 
         NLA_PUT_U16(skb, IFLA_PORT_REQUEST, enic->pp.request);
         NLA_PUT_U16(skb, IFLA_PORT_RESPONSE, response);
-        NLA_PUT(skb, IFLA_PORT_PROFILE, PORT_PROFILE_MAX,
-                enic->pp.name);
-        NLA_PUT(skb, IFLA_PORT_INSTANCE_UUID, PORT_UUID_MAX,
-                enic->pp.instance_uuid);
-        NLA_PUT(skb, IFLA_PORT_HOST_UUID, PORT_UUID_MAX,
-                enic->pp.host_uuid);
+        if (enic->pp.set & ENIC_SET_NAME)
+                NLA_PUT(skb, IFLA_PORT_PROFILE, PORT_PROFILE_MAX,
+                        enic->pp.name);
+        if (enic->pp.set & ENIC_SET_INSTANCE)
+                NLA_PUT(skb, IFLA_PORT_INSTANCE_UUID, PORT_UUID_MAX,
+                        enic->pp.instance_uuid);
+        if (enic->pp.set & ENIC_SET_HOST)
+                NLA_PUT(skb, IFLA_PORT_HOST_UUID, PORT_UUID_MAX,
+                        enic->pp.host_uuid);
 
         return 0;
 
diff --git a/drivers/net/epic100.c b/drivers/net/epic100.c
index 6838dfc9ef23..4c274657283c 100644
--- a/drivers/net/epic100.c
+++ b/drivers/net/epic100.c
@@ -87,6 +87,7 @@ static int rx_copybreak;
 #include <linux/bitops.h>
 #include <asm/io.h>
 #include <asm/uaccess.h>
+#include <asm/byteorder.h>
 
 /* These identify the driver base version and may not be removed. */
 static char version[] __devinitdata =
@@ -230,7 +231,7 @@ static const u16 media2miictl[16] = {
  * The EPIC100 Rx and Tx buffer descriptors.  Note that these
  * really ARE host-endian; it's not a misannotation.  We tell
  * the card to byteswap them internally on big-endian hosts -
- * look for #ifdef CONFIG_BIG_ENDIAN in epic_open().
+ * look for #ifdef __BIG_ENDIAN in epic_open().
  */
 
 struct epic_tx_desc {
@@ -690,7 +691,7 @@ static int epic_open(struct net_device *dev)
                 outl((inl(ioaddr + NVCTL) & ~0x003C) | 0x4800, ioaddr + NVCTL);
 
         /* Tell the chip to byteswap descriptors on big-endian hosts */
-#ifdef CONFIG_BIG_ENDIAN
+#ifdef __BIG_ENDIAN
         outl(0x4432 | (RX_FIFO_THRESH<<8), ioaddr + GENCTL);
         inl(ioaddr + GENCTL);
         outl(0x0432 | (RX_FIFO_THRESH<<8), ioaddr + GENCTL);
@@ -806,7 +807,7 @@ static void epic_restart(struct net_device *dev)
         for (i = 16; i > 0; i--)
                 outl(0x0008, ioaddr + TEST1);
 
-#ifdef CONFIG_BIG_ENDIAN
+#ifdef __BIG_ENDIAN
         outl(0x0432 | (RX_FIFO_THRESH<<8), ioaddr + GENCTL);
 #else
         outl(0x0412 | (RX_FIFO_THRESH<<8), ioaddr + GENCTL);
diff --git a/drivers/net/fec.c b/drivers/net/fec.c
index a3565adc034c..a3cae4ed6ac9 100644
--- a/drivers/net/fec.c
+++ b/drivers/net/fec.c
@@ -1369,10 +1369,9 @@ fec_suspend(struct platform_device *dev, pm_message_t state)
 
         if (ndev) {
                 fep = netdev_priv(ndev);
-                if (netif_running(ndev)) {
-                        netif_device_detach(ndev);
-                        fec_stop(ndev);
-                }
+                if (netif_running(ndev))
+                        fec_enet_close(ndev);
+                clk_disable(fep->clk);
         }
         return 0;
 }
@@ -1381,12 +1380,13 @@ static int
 fec_resume(struct platform_device *dev)
 {
         struct net_device *ndev = platform_get_drvdata(dev);
+        struct fec_enet_private *fep;
 
         if (ndev) {
-                if (netif_running(ndev)) {
-                        fec_enet_init(ndev, 0);
-                        netif_device_attach(ndev);
-                }
+                fep = netdev_priv(ndev);
+                clk_enable(fep->clk);
+                if (netif_running(ndev))
+                        fec_enet_open(ndev);
         }
         return 0;
 }
diff --git a/drivers/net/greth.c b/drivers/net/greth.c
index f37a4c143ddd..3a029d02c2b4 100644
--- a/drivers/net/greth.c
+++ b/drivers/net/greth.c
@@ -1607,14 +1607,13 @@ static struct of_device_id greth_of_match[] = {
 MODULE_DEVICE_TABLE(of, greth_of_match);
 
 static struct of_platform_driver greth_of_driver = {
-        .name = "grlib-greth",
-        .match_table = greth_of_match,
+        .driver = {
+                .name = "grlib-greth",
+                .owner = THIS_MODULE,
+                .of_match_table = greth_of_match,
+        },
         .probe = greth_of_probe,
         .remove = __devexit_p(greth_of_remove),
-        .driver = {
-                   .owner = THIS_MODULE,
-                   .name = "grlib-greth",
-                   },
 };
 
 static int __init greth_init(void)
diff --git a/drivers/net/ixgbe/ixgbe_common.c b/drivers/net/ixgbe/ixgbe_common.c
index 1159d9138f05..9595b1bfb8dd 100644
--- a/drivers/net/ixgbe/ixgbe_common.c
+++ b/drivers/net/ixgbe/ixgbe_common.c
@@ -1188,6 +1188,7 @@ s32 ixgbe_set_rar_generic(struct ixgbe_hw *hw, u32 index, u8 *addr, u32 vmdq,
                 IXGBE_WRITE_REG(hw, IXGBE_RAH(index), rar_high);
         } else {
                 hw_dbg(hw, "RAR index %d is out of range.\n", index);
+                return IXGBE_ERR_RAR_INDEX;
         }
 
         return 0;
@@ -1219,6 +1220,7 @@ s32 ixgbe_clear_rar_generic(struct ixgbe_hw *hw, u32 index)
                 IXGBE_WRITE_REG(hw, IXGBE_RAH(index), rar_high);
         } else {
                 hw_dbg(hw, "RAR index %d is out of range.\n", index);
+                return IXGBE_ERR_RAR_INDEX;
         }
 
         /* clear VMDq pool/queue selection for this RAR */
diff --git a/drivers/net/ixgbe/ixgbe_main.c b/drivers/net/ixgbe/ixgbe_main.c
index 04e64de4a600..6b483d352f23 100644
--- a/drivers/net/ixgbe/ixgbe_main.c
+++ b/drivers/net/ixgbe/ixgbe_main.c
@@ -642,7 +642,7 @@ static inline bool ixgbe_tx_xon_state(struct ixgbe_adapter *adapter,
         u32 txoff = IXGBE_TFCS_TXOFF;
 
 #ifdef CONFIG_IXGBE_DCB
-        if (adapter->flags & IXGBE_FLAG_DCB_ENABLED) {
+        if (adapter->dcb_cfg.pfc_mode_enable) {
                 int tc;
                 int reg_idx = tx_ring->reg_idx;
                 int dcb_i = adapter->ring_feature[RING_F_DCB].indices;
diff --git a/drivers/net/ixgbe/ixgbe_type.h b/drivers/net/ixgbe/ixgbe_type.h
index 2eb6e151016c..cdd1998f18c7 100644
--- a/drivers/net/ixgbe/ixgbe_type.h
+++ b/drivers/net/ixgbe/ixgbe_type.h
@@ -2609,6 +2609,7 @@ struct ixgbe_info {
 #define IXGBE_ERR_EEPROM_VERSION                -24
 #define IXGBE_ERR_NO_SPACE                      -25
 #define IXGBE_ERR_OVERTEMP                      -26
+#define IXGBE_ERR_RAR_INDEX                     -27
 #define IXGBE_NOT_IMPLEMENTED                   0x7FFFFFFF
 
 #endif /* _IXGBE_TYPE_H_ */
diff --git a/drivers/net/korina.c b/drivers/net/korina.c
index 26bf1b76b997..c7a9bef4dfb0 100644
--- a/drivers/net/korina.c
+++ b/drivers/net/korina.c
@@ -135,6 +135,7 @@ struct korina_private {
         struct napi_struct napi;
         struct timer_list media_check_timer;
         struct mii_if_info mii_if;
+        struct work_struct restart_task;
         struct net_device *dev;
         int phy_addr;
 };
@@ -375,7 +376,7 @@ static int korina_rx(struct net_device *dev, int limit)
                 if (devcs & ETH_RX_LE)
                         dev->stats.rx_length_errors++;
                 if (devcs & ETH_RX_OVR)
-                        dev->stats.rx_over_errors++;
+                        dev->stats.rx_fifo_errors++;
                 if (devcs & ETH_RX_CV)
                         dev->stats.rx_frame_errors++;
                 if (devcs & ETH_RX_CES)
@@ -764,10 +765,9 @@ static int korina_alloc_ring(struct net_device *dev)
 
         /* Initialize the receive descriptors */
         for (i = 0; i < KORINA_NUM_RDS; i++) {
-                skb = dev_alloc_skb(KORINA_RBSIZE + 2);
+                skb = netdev_alloc_skb_ip_align(dev, KORINA_RBSIZE);
                 if (!skb)
                         return -ENOMEM;
-                skb_reserve(skb, 2);
                 lp->rx_skb[i] = skb;
                 lp->rd_ring[i].control = DMA_DESC_IOD |
                                 DMA_COUNT(KORINA_RBSIZE);
@@ -890,12 +890,12 @@ static int korina_init(struct net_device *dev)
 
 /*
  * Restart the RC32434 ethernet controller.
- * FIXME: check the return status where we call it
  */
-static int korina_restart(struct net_device *dev)
+static void korina_restart_task(struct work_struct *work)
 {
-        struct korina_private *lp = netdev_priv(dev);
-        int ret;
+        struct korina_private *lp = container_of(work,
+                        struct korina_private, restart_task);
+        struct net_device *dev = lp->dev;
 
         /*
          * Disable interrupts
@@ -916,10 +916,9 @@ static int korina_restart(struct net_device *dev)
 
         napi_disable(&lp->napi);
 
-        ret = korina_init(dev);
-        if (ret < 0) {
+        if (korina_init(dev) < 0) {
                 printk(KERN_ERR "%s: cannot restart device\n", dev->name);
-                return ret;
+                return;
         }
         korina_multicast_list(dev);
 
@@ -927,8 +926,6 @@ static int korina_restart(struct net_device *dev)
         enable_irq(lp->ovr_irq);
         enable_irq(lp->tx_irq);
         enable_irq(lp->rx_irq);
-
-        return ret;
 }
 
 static void korina_clear_and_restart(struct net_device *dev, u32 value)
@@ -937,7 +934,7 @@ static void korina_clear_and_restart(struct net_device *dev, u32 value)
 
         netif_stop_queue(dev);
         writel(value, &lp->eth_regs->ethintfc);
-        korina_restart(dev);
+        schedule_work(&lp->restart_task);
 }
 
 /* Ethernet Tx Underflow interrupt */
@@ -962,11 +959,8 @@ static irqreturn_t korina_und_interrupt(int irq, void *dev_id)
 static void korina_tx_timeout(struct net_device *dev)
 {
         struct korina_private *lp = netdev_priv(dev);
-        unsigned long flags;
 
-        spin_lock_irqsave(&lp->lock, flags);
-        korina_restart(dev);
-        spin_unlock_irqrestore(&lp->lock, flags);
+        schedule_work(&lp->restart_task);
 }
 
 /* Ethernet Rx Overflow interrupt */
@@ -1086,6 +1080,8 @@ static int korina_close(struct net_device *dev)
 
         napi_disable(&lp->napi);
 
+        cancel_work_sync(&lp->restart_task);
+
         free_irq(lp->rx_irq, dev);
         free_irq(lp->tx_irq, dev);
         free_irq(lp->ovr_irq, dev);
@@ -1198,6 +1194,8 @@ static int korina_probe(struct platform_device *pdev)
         }
         setup_timer(&lp->media_check_timer, korina_poll_media, (unsigned long) dev);
 
+        INIT_WORK(&lp->restart_task, korina_restart_task);
+
         printk(KERN_INFO "%s: " DRV_NAME "-" DRV_VERSION " " DRV_RELDATE "\n",
                         dev->name);
 out:
diff --git a/drivers/net/ksz884x.c b/drivers/net/ksz884x.c
index c80ca64277b2..7805bbf1d53a 100644
--- a/drivers/net/ksz884x.c
+++ b/drivers/net/ksz884x.c
@@ -4854,7 +4854,7 @@ static inline void copy_old_skb(struct sk_buff *old, struct sk_buff *skb)
  *
  * Return 0 if successful; otherwise an error code indicating failure.
  */
-static int netdev_tx(struct sk_buff *skb, struct net_device *dev)
+static netdev_tx_t netdev_tx(struct sk_buff *skb, struct net_device *dev)
 {
         struct dev_priv *priv = netdev_priv(dev);
         struct dev_info *hw_priv = priv->adapter;
@@ -6863,6 +6863,7 @@ static const struct net_device_ops netdev_ops = {
         .ndo_tx_timeout         = netdev_tx_timeout,
         .ndo_change_mtu         = netdev_change_mtu,
         .ndo_set_mac_address    = netdev_set_mac_address,
+        .ndo_validate_addr      = eth_validate_addr,
         .ndo_do_ioctl           = netdev_ioctl,
         .ndo_set_rx_mode        = netdev_set_rx_mode,
 #ifdef CONFIG_NET_POLL_CONTROLLER
diff --git a/drivers/net/ppp_generic.c b/drivers/net/ppp_generic.c
index e38f603a71f1..e7b4187da057 100644
--- a/drivers/net/ppp_generic.c
+++ b/drivers/net/ppp_generic.c
@@ -1416,7 +1416,7 @@ static int ppp_mp_explode(struct ppp *ppp, struct sk_buff *skb)
                 flen = len;
                 if (nfree > 0) {
                         if (pch->speed == 0) {
-                                flen = totlen/nfree;
+                                flen = len/nfree;
                                 if (nbigger > 0) {
                                         flen++;
                                         nbigger--;
diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
index ca93cdf002a7..6949504589db 100644
--- a/drivers/net/r8169.c
+++ b/drivers/net/r8169.c
@@ -559,6 +559,11 @@ static void mdio_write(void __iomem *ioaddr, int reg_addr, int value)
                         break;
                 udelay(25);
         }
+        /*
+         * Some configurations require a small delay even after the write
+         * completed indication or the next write might fail.
+         */
+        udelay(25);
 }
 
 static int mdio_read(void __iomem *ioaddr, int reg_addr)
diff --git a/drivers/net/sfc/net_driver.h b/drivers/net/sfc/net_driver.h
index 6b2e4402ec57..ba636e086fc3 100644
--- a/drivers/net/sfc/net_driver.h
+++ b/drivers/net/sfc/net_driver.h
@@ -836,7 +836,7 @@ static inline const char *efx_dev_name(struct efx_nic *efx)
 
 static inline unsigned int efx_port_num(struct efx_nic *efx)
 {
-        return efx->port_num;
+        return efx->net_dev->dev_id;
 }
 
 /**
diff --git a/drivers/net/sfc/siena.c b/drivers/net/sfc/siena.c
index 7ecd255a7cc0..f2b1e6180753 100644
--- a/drivers/net/sfc/siena.c
+++ b/drivers/net/sfc/siena.c
@@ -222,7 +222,7 @@ static int siena_probe_nic(struct efx_nic *efx)
         }
 
         efx_reado(efx, &reg, FR_AZ_CS_DEBUG);
-        efx->port_num = EFX_OWORD_FIELD(reg, FRF_CZ_CS_PORT_NUM) - 1;
+        efx->net_dev->dev_id = EFX_OWORD_FIELD(reg, FRF_CZ_CS_PORT_NUM) - 1;
 
         efx_mcdi_init(efx);
 
diff --git a/drivers/net/tehuti.c b/drivers/net/tehuti.c
index 20ab16192325..737df6032bbc 100644
--- a/drivers/net/tehuti.c
+++ b/drivers/net/tehuti.c
@@ -646,7 +646,7 @@ static int bdx_ioctl_priv(struct net_device *ndev, struct ifreq *ifr, int cmd)
                 error = copy_from_user(data, ifr->ifr_data, sizeof(data));
                 if (error) {
                         pr_err("cant copy from user\n");
-                        RET(error);
+                        RET(-EFAULT);
                 }
                 DBG("%d 0x%x 0x%x\n", data[0], data[1], data[2]);
         }
@@ -665,7 +665,7 @@ static int bdx_ioctl_priv(struct net_device *ndev, struct ifreq *ifr, int cmd)
                     data[2]);
                 error = copy_to_user(ifr->ifr_data, data, sizeof(data));
                 if (error)
-                        RET(error);
+                        RET(-EFAULT);
                 break;
 
         case BDX_OP_WRITE:
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 78eb3190b9b1..1edb7a61983c 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -340,7 +340,7 @@ static int add_recvbuf_small(struct virtnet_info *vi, gfp_t gfp)
 
         skb_to_sgvec(skb, vi->rx_sg + 1, 0, skb->len);
 
-        err = virtqueue_add_buf(vi->rvq, vi->rx_sg, 0, 2, skb);
+        err = virtqueue_add_buf_gfp(vi->rvq, vi->rx_sg, 0, 2, skb, gfp);
         if (err < 0)
                 dev_kfree_skb(skb);
 
@@ -385,8 +385,8 @@ static int add_recvbuf_big(struct virtnet_info *vi, gfp_t gfp)
 
         /* chain first in list head */
         first->private = (unsigned long)list;
-        err = virtqueue_add_buf(vi->rvq, vi->rx_sg, 0, MAX_SKB_FRAGS + 2,
-                                       first);
+        err = virtqueue_add_buf_gfp(vi->rvq, vi->rx_sg, 0, MAX_SKB_FRAGS + 2,
+                                    first, gfp);
         if (err < 0)
                 give_pages(vi, first);
 
@@ -404,7 +404,7 @@ static int add_recvbuf_mergeable(struct virtnet_info *vi, gfp_t gfp)
 
         sg_init_one(vi->rx_sg, page_address(page), PAGE_SIZE);
 
-        err = virtqueue_add_buf(vi->rvq, vi->rx_sg, 0, 1, page);
+        err = virtqueue_add_buf_gfp(vi->rvq, vi->rx_sg, 0, 1, page, gfp);
         if (err < 0)
                 give_pages(vi, page);
 
diff --git a/drivers/net/wan/x25_asy.c b/drivers/net/wan/x25_asy.c
index 166e77dfffda..e47f5a986b1c 100644
--- a/drivers/net/wan/x25_asy.c
+++ b/drivers/net/wan/x25_asy.c
@@ -37,8 +37,6 @@
 #include <net/x25device.h>
 #include "x25_asy.h"
 
-#include <net/x25device.h>
-
 static struct net_device **x25_asy_devs;
 static int x25_asy_maxdev = SL_NRUNIT;
 
diff --git a/drivers/net/wireless/ath/ath5k/base.c b/drivers/net/wireless/ath/ath5k/base.c
index cc6d41dec332..2978359c4366 100644
--- a/drivers/net/wireless/ath/ath5k/base.c
+++ b/drivers/net/wireless/ath/ath5k/base.c
@@ -222,7 +222,6 @@ static int ath5k_tx(struct ieee80211_hw *hw, struct sk_buff *skb);
 static int ath5k_tx_queue(struct ieee80211_hw *hw, struct sk_buff *skb,
                 struct ath5k_txq *txq);
 static int ath5k_reset(struct ath5k_softc *sc, struct ieee80211_channel *chan);
-static int ath5k_reset_wake(struct ath5k_softc *sc);
 static int ath5k_start(struct ieee80211_hw *hw);
 static void ath5k_stop(struct ieee80211_hw *hw);
 static int ath5k_add_interface(struct ieee80211_hw *hw,
@@ -2770,7 +2769,7 @@ ath5k_tasklet_reset(unsigned long data)
 {
         struct ath5k_softc *sc = (void *)data;
 
-        ath5k_reset_wake(sc);
+        ath5k_reset(sc, sc->curchan);
 }
 
 /*
@@ -2941,23 +2940,13 @@ ath5k_reset(struct ath5k_softc *sc, struct ieee80211_channel *chan)
         ath5k_beacon_config(sc);
         /* intrs are enabled by ath5k_beacon_config */
 
+        ieee80211_wake_queues(sc->hw);
+
         return 0;
 err:
         return ret;
 }
 
-static int
-ath5k_reset_wake(struct ath5k_softc *sc)
-{
-        int ret;
-
-        ret = ath5k_reset(sc, sc->curchan);
-        if (!ret)
-                ieee80211_wake_queues(sc->hw);
-
-        return ret;
-}
-
 static int ath5k_start(struct ieee80211_hw *hw)
 {
         return ath5k_init(hw->priv);
diff --git a/include/linux/netfilter/x_tables.h b/include/linux/netfilter/x_tables.h
index c00cc0c4d0b7..24e5d01d27d0 100644
--- a/include/linux/netfilter/x_tables.h
+++ b/include/linux/netfilter/x_tables.h
@@ -397,7 +397,7 @@ struct xt_table_info {
          * @stacksize jumps (number of user chains) can possibly be made.
          */
         unsigned int stacksize;
-        unsigned int *stackptr;
+        unsigned int __percpu *stackptr;
         void ***jumpstack;
         /* ipt_entry tables: one per CPU */
         /* Note : this field MUST be the last one, see XT_TABLE_INFO_SZ */
diff --git a/include/net/dst.h b/include/net/dst.h
index 612069beda73..81d1413a8701 100644
--- a/include/net/dst.h
+++ b/include/net/dst.h
@@ -250,11 +250,11 @@ static inline void skb_tunnel_rx(struct sk_buff *skb, struct net_device *dev)
  * Linux networking.  Thus, destinations are stackable.
  */
 
-static inline struct dst_entry *dst_pop(struct dst_entry *dst)
+static inline struct dst_entry *skb_dst_pop(struct sk_buff *skb)
 {
-        struct dst_entry *child = dst_clone(dst->child);
+        struct dst_entry *child = skb_dst(skb)->child;
 
-        dst_release(dst);
+        skb_dst_drop(skb);
         return child;
 }
 
diff --git a/include/net/sock.h b/include/net/sock.h
index 3461e5d1e9ad..f8acf38f092f 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -1524,20 +1524,7 @@ extern void sk_stop_timer(struct sock *sk, struct timer_list* timer);
 
 extern int sock_queue_rcv_skb(struct sock *sk, struct sk_buff *skb);
 
-static inline int sock_queue_err_skb(struct sock *sk, struct sk_buff *skb)
-{
-        /* Cast skb->rcvbuf to unsigned... It's pointless, but reduces
-           number of warnings when compiling with -W --ANK
-         */
-        if (atomic_read(&sk->sk_rmem_alloc) + skb->truesize >=
-            (unsigned)sk->sk_rcvbuf)
-                return -ENOMEM;
-        skb_set_owner_r(skb, sk);
-        skb_queue_tail(&sk->sk_error_queue, skb);
-        if (!sock_flag(sk, SOCK_DEAD))
-                sk->sk_data_ready(sk, skb->len);
-        return 0;
-}
+extern int sock_queue_err_skb(struct sock *sk, struct sk_buff *skb);
 
 /*
  *      Recover an error report and clear atomically
diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
index 55be90826f5f..529842677817 100644
--- a/net/8021q/vlan_dev.c
+++ b/net/8021q/vlan_dev.c
@@ -708,7 +708,8 @@ static int vlan_dev_init(struct net_device *dev)
         netif_carrier_off(dev);
 
         /* IFF_BROADCAST|IFF_MULTICAST; ??? */
-        dev->flags  = real_dev->flags & ~(IFF_UP | IFF_PROMISC | IFF_ALLMULTI);
+        dev->flags  = real_dev->flags & ~(IFF_UP | IFF_PROMISC | IFF_ALLMULTI |
+                                          IFF_MASTER | IFF_SLAVE);
         dev->iflink = real_dev->ifindex;
         dev->state  = (real_dev->state & ((1<<__LINK_STATE_NOCARRIER) |
                                           (1<<__LINK_STATE_DORMANT))) |
diff --git a/net/core/dev.c b/net/core/dev.c
index 3abb3a6058be..b65347c2cf2a 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2805,7 +2805,7 @@ static int __netif_receive_skb(struct sk_buff *skb)
         struct net_device *orig_dev;
         struct net_device *master;
         struct net_device *null_or_orig;
-        struct net_device *null_or_bond;
+        struct net_device *orig_or_bond;
         int ret = NET_RX_DROP;
         __be16 type;
 
@@ -2882,10 +2882,10 @@ ncls:
          * device that may have registered for a specific ptype.  The
          * handler may have to adjust skb->dev and orig_dev.
          */
-        null_or_bond = NULL;
+        orig_or_bond = orig_dev;
         if ((skb->dev->priv_flags & IFF_802_1Q_VLAN) &&
             (vlan_dev_real_dev(skb->dev)->priv_flags & IFF_BONDING)) {
-                null_or_bond = vlan_dev_real_dev(skb->dev);
+                orig_or_bond = vlan_dev_real_dev(skb->dev);
         }
 
         type = skb->protocol;
@@ -2893,7 +2893,7 @@ ncls:
                         &ptype_base[ntohs(type) & PTYPE_HASH_MASK], list) {
                 if (ptype->type == type && (ptype->dev == null_or_orig ||
                      ptype->dev == skb->dev || ptype->dev == orig_dev ||
-                     ptype->dev == null_or_bond)) {
+                     ptype->dev == orig_or_bond)) {
                         if (pt_prev)
                                 ret = deliver_skb(skb, pt_prev, orig_dev);
                         pt_prev = ptype;
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 4e7ac09c281a..9f07e749d7b1 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -2965,6 +2965,34 @@ int skb_cow_data(struct sk_buff *skb, int tailbits, struct sk_buff **trailer)
 }
 EXPORT_SYMBOL_GPL(skb_cow_data);
 
+static void sock_rmem_free(struct sk_buff *skb)
+{
+        struct sock *sk = skb->sk;
+
+        atomic_sub(skb->truesize, &sk->sk_rmem_alloc);
+}
+
+/*
+ * Note: We dont mem charge error packets (no sk_forward_alloc changes)
+ */
+int sock_queue_err_skb(struct sock *sk, struct sk_buff *skb)
+{
+        if (atomic_read(&sk->sk_rmem_alloc) + skb->truesize >=
+            (unsigned)sk->sk_rcvbuf)
+                return -ENOMEM;
+
+        skb_orphan(skb);
+        skb->sk = sk;
+        skb->destructor = sock_rmem_free;
+        atomic_add(skb->truesize, &sk->sk_rmem_alloc);
+
+        skb_queue_tail(&sk->sk_error_queue, skb);
+        if (!sock_flag(sk, SOCK_DEAD))
+                sk->sk_data_ready(sk, skb->len);
+        return 0;
+}
+EXPORT_SYMBOL(sock_queue_err_skb);
+
 void skb_tstamp_tx(struct sk_buff *orig_skb,
                 struct skb_shared_hwtstamps *hwtstamps)
 {
@@ -2997,9 +3025,7 @@ void skb_tstamp_tx(struct sk_buff *orig_skb,
         serr->ee.ee_errno = ENOMSG;
         serr->ee.ee_origin = SO_EE_ORIGIN_TIMESTAMPING;
 
-        bh_lock_sock(sk);
         err = sock_queue_err_skb(sk, skb);
-        bh_unlock_sock(sk);
 
         if (err)
                 kfree_skb(skb);
diff --git a/net/ipv4/Kconfig b/net/ipv4/Kconfig
index 8e3a1fd938ab..7c3a7d191249 100644
--- a/net/ipv4/Kconfig
+++ b/net/ipv4/Kconfig
@@ -303,7 +303,7 @@ config ARPD
           If unsure, say N.
 
 config SYN_COOKIES
-        bool "IP: TCP syncookie support (disabled per default)"
+        bool "IP: TCP syncookie support"
         ---help---
           Normal TCP/IP networking is open to an attack known as "SYN
           flooding". This denial-of-service attack prevents legitimate remote
@@ -328,13 +328,13 @@ config SYN_COOKIES
           server is really overloaded. If this happens frequently better turn
           them off.
 
-          If you say Y here, note that SYN cookies aren't enabled by default;
-          you can enable them by saying Y to "/proc file system support" and
+          If you say Y here, you can disable SYN cookies at run time by
+          saying Y to "/proc file system support" and
           "Sysctl support" below and executing the command
 
-          echo 1 >/proc/sys/net/ipv4/tcp_syncookies
+          echo 0 > /proc/sys/net/ipv4/tcp_syncookies
 
-          at boot time after the /proc file system has been mounted.
+          after the /proc file system has been mounted.
 
           If unsure, say N.
 
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index 63958f3394a5..4b6c5ca610fc 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -336,7 +336,7 @@ ipt_do_table(struct sk_buff *skb,
         cpu        = smp_processor_id();
         table_base = private->entries[cpu];
         jumpstack  = (struct ipt_entry **)private->jumpstack[cpu];
-        stackptr   = &private->stackptr[cpu];
+        stackptr   = per_cpu_ptr(private->stackptr, cpu);
         origptr    = *stackptr;
 
         e = get_entry(table_base, private->hook_entry[hook]);
diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
index a7cbcc4b726b..5c48124332de 100644
--- a/net/ipv4/syncookies.c
+++ b/net/ipv4/syncookies.c
@@ -347,7 +347,7 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
                                                { .sport = th->dest,
                                                  .dport = th->source } } };
                 security_req_classify_flow(req, &fl);
-                if (ip_route_output_key(&init_net, &rt, &fl)) {
+                if (ip_route_output_key(sock_net(sk), &rt, &fl)) {
                         reqsk_free(req);
                         goto out;
                 }
diff --git a/net/ipv4/tcp_hybla.c b/net/ipv4/tcp_hybla.c
index c209e054a634..377bc9349371 100644
--- a/net/ipv4/tcp_hybla.c
+++ b/net/ipv4/tcp_hybla.c
@@ -126,8 +126,8 @@ static void hybla_cong_avoid(struct sock *sk, u32 ack, u32 in_flight)
                  * calculate 2^fract in a <<7 value.
                  */
                 is_slowstart = 1;
-                increment = ((1 << ca->rho) * hybla_fraction(rho_fractions))
-                        - 128;
+                increment = ((1 << min(ca->rho, 16U)) *
+                        hybla_fraction(rho_fractions)) - 128;
         } else {
                 /*
                  * congestion avoidance
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 3e6dafcb1071..548d575e6cc6 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -2639,7 +2639,7 @@ static void DBGUNDO(struct sock *sk, const char *msg)
         if (sk->sk_family == AF_INET) {
                 printk(KERN_DEBUG "Undo %s %pI4/%u c%u l%u ss%u/%u p%u\n",
                        msg,
-                       &inet->daddr, ntohs(inet->dport),
+                       &inet->inet_daddr, ntohs(inet->inet_dport),
                        tp->snd_cwnd, tcp_left_out(tp),
                        tp->snd_ssthresh, tp->prior_ssthresh,
                        tp->packets_out);
@@ -2649,7 +2649,7 @@ static void DBGUNDO(struct sock *sk, const char *msg)
                 struct ipv6_pinfo *np = inet6_sk(sk);
                 printk(KERN_DEBUG "Undo %s %pI6/%u c%u l%u ss%u/%u p%u\n",
                        msg,
-                       &np->daddr, ntohs(inet->dport),
+                       &np->daddr, ntohs(inet->inet_dport),
                        tp->snd_cwnd, tcp_left_out(tp),
                        tp->snd_ssthresh, tp->prior_ssthresh,
                        tp->packets_out);
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 6558dfd899da..acdc4c989853 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1557,6 +1557,7 @@ int tcp_v4_do_rcv(struct sock *sk, struct sk_buff *skb)
 #endif
 
         if (sk->sk_state == TCP_ESTABLISHED) { /* Fast path */
+                sock_rps_save_rxhash(sk, skb->rxhash);
                 TCP_CHECK_TIMER(sk);
                 if (tcp_rcv_established(sk, skb, tcp_hdr(skb), skb->len)) {
                         rsk = sk;
@@ -1581,7 +1582,9 @@ int tcp_v4_do_rcv(struct sock *sk, struct sk_buff *skb)
                         }
                         return 0;
                 }
-        }
+        } else
+                sock_rps_save_rxhash(sk, skb->rxhash);
+
 
         TCP_CHECK_TIMER(sk);
         if (tcp_rcv_state_process(sk, skb, tcp_hdr(skb), skb->len)) {
@@ -1674,8 +1677,6 @@ process:
 
         skb->dev = NULL;
 
-        sock_rps_save_rxhash(sk, skb->rxhash);
-
         bh_lock_sock_nested(sk);
         ret = 0;
         if (!sock_owned_by_user(sk)) {
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 50678f9a2763..eec4ff456e33 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -633,11 +633,9 @@ void __udp4_lib_err(struct sk_buff *skb, u32 info, struct udp_table *udptable)
         if (!inet->recverr) {
                 if (!harderr || sk->sk_state != TCP_ESTABLISHED)
                         goto out;
-        } else {
-                bh_lock_sock(sk);
+        } else
                 ip_icmp_error(sk, skb, err, uh->dest, info, (u8 *)(uh+1));
-                bh_unlock_sock(sk);
-        }
+
         sk->sk_err = err;
         sk->sk_error_report(sk);
 out:
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index 073071f2b75b..89c0b077c7aa 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -120,7 +120,7 @@ static void mroute_clean_tables(struct mr6_table *mrt);
 static void ipmr_expire_process(unsigned long arg);
 
 #ifdef CONFIG_IPV6_MROUTE_MULTIPLE_TABLES
-#define ip6mr_for_each_table(mrt, met) \
+#define ip6mr_for_each_table(mrt, net) \
         list_for_each_entry_rcu(mrt, &net->ipv6.mr6_tables, list)
 
 static struct mr6_table *ip6mr_get_table(struct net *net, u32 id)
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index 7b5fb43c227c..8752e8084806 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -1356,7 +1356,10 @@ static struct sk_buff *mld_newpack(struct net_device *dev, int size)
                      IPV6_TLV_PADN, 0 };
 
         /* we assume size > sizeof(ra) here */
-        skb = sock_alloc_send_skb(sk, size + LL_ALLOCATED_SPACE(dev), 1, &err);
+        size += LL_ALLOCATED_SPACE(dev);
+        /* limit our allocations to order-0 page */
+        size = min_t(int, size, SKB_MAX_ORDER(0, 0));
+        skb = sock_alloc_send_skb(sk, size, 1, &err);
 
         if (!skb)
                 return NULL;
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 6f517bd83692..9d2d68f0e605 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -363,7 +363,7 @@ ip6t_do_table(struct sk_buff *skb,
         cpu        = smp_processor_id();
         table_base = private->entries[cpu];
         jumpstack  = (struct ip6t_entry **)private->jumpstack[cpu];
-        stackptr   = &private->stackptr[cpu];
+        stackptr   = per_cpu_ptr(private->stackptr, cpu);
         origptr    = *stackptr;
 
         e = get_entry(table_base, private->hook_entry[hook]);
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 4aea57dec75f..1dd1affdead2 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -466,11 +466,9 @@ void __udp6_lib_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
         if (sk->sk_state != TCP_ESTABLISHED && !np->recverr)
                 goto out;
 
-        if (np->recverr) {
-                bh_lock_sock(sk);
+        if (np->recverr)
                 ipv6_icmp_error(sk, skb, err, uh->dest, ntohl(info), (u8 *)(uh+1));
-                bh_unlock_sock(sk);
-        }
+
         sk->sk_err = err;
         sk->sk_error_report(sk);
 out:
diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
index c163d0a149f4..98258b7341e3 100644
--- a/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
@@ -332,14 +332,16 @@ int ieee80211_start_tx_ba_session(struct ieee80211_sta *pubsta, u16 tid)
                 IEEE80211_QUEUE_STOP_REASON_AGGREGATION);
 
         spin_unlock(&local->ampdu_lock);
-        spin_unlock_bh(&sta->lock);
 
-        /* send an addBA request */
+        /* prepare tid data */
         sta->ampdu_mlme.dialog_token_allocator++;
         sta->ampdu_mlme.tid_tx[tid]->dialog_token =
                         sta->ampdu_mlme.dialog_token_allocator;
         sta->ampdu_mlme.tid_tx[tid]->ssn = start_seq_num;
 
+        spin_unlock_bh(&sta->lock);
+
+        /* send AddBA request */
         ieee80211_send_addba_request(sdata, pubsta->addr, tid,
                          sta->ampdu_mlme.tid_tx[tid]->dialog_token,
                          sta->ampdu_mlme.tid_tx[tid]->ssn,
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 2d9a2ee94e17..dd232061e4c4 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -1818,17 +1818,26 @@ ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx, struct sk_buff_head *frames)
                 return RX_CONTINUE;
 
         if (ieee80211_is_back_req(bar->frame_control)) {
+                struct {
+                        __le16 control, start_seq_num;
+                } __packed bar_data;
+
                 if (!rx->sta)
                         return RX_DROP_MONITOR;
+
+                if (skb_copy_bits(skb, offsetof(struct ieee80211_bar, control),
+                                  &bar_data, sizeof(bar_data)))
+                        return RX_DROP_MONITOR;
+
                 spin_lock(&rx->sta->lock);
-                tid = le16_to_cpu(bar->control) >> 12;
+                tid = le16_to_cpu(bar_data.control) >> 12;
                 if (!rx->sta->ampdu_mlme.tid_active_rx[tid]) {
                         spin_unlock(&rx->sta->lock);
                         return RX_DROP_MONITOR;
                 }
                 tid_agg_rx = rx->sta->ampdu_mlme.tid_rx[tid];
 
-                start_seq_num = le16_to_cpu(bar->start_seq_num) >> 4;
+                start_seq_num = le16_to_cpu(bar_data.start_seq_num) >> 4;
 
                 /* reset session timer */
                 if (tid_agg_rx->timeout)
diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index 445de702b8b7..e34622fa0003 100644
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -699,10 +699,8 @@ void xt_free_table_info(struct xt_table_info *info)
                 vfree(info->jumpstack);
         else
                 kfree(info->jumpstack);
-        if (sizeof(unsigned int) * nr_cpu_ids > PAGE_SIZE)
-                vfree(info->stackptr);
-        else
-                kfree(info->stackptr);
+
+        free_percpu(info->stackptr);
 
         kfree(info);
 }
@@ -753,14 +751,9 @@ static int xt_jumpstack_alloc(struct xt_table_info *i)
         unsigned int size;
         int cpu;
 
-        size = sizeof(unsigned int) * nr_cpu_ids;
-        if (size > PAGE_SIZE)
-                i->stackptr = vmalloc(size);
-        else
-                i->stackptr = kmalloc(size, GFP_KERNEL);
+        i->stackptr = alloc_percpu(unsigned int);
         if (i->stackptr == NULL)
                 return -ENOMEM;
-        memset(i->stackptr, 0, size);
 
         size = sizeof(void **) * nr_cpu_ids;
         if (size > PAGE_SIZE)
@@ -844,10 +837,6 @@ struct xt_table *xt_register_table(struct net *net,
         struct xt_table_info *private;
         struct xt_table *t, *table;
 
-        ret = xt_jumpstack_alloc(newinfo);
-        if (ret < 0)
-                return ERR_PTR(ret);
-
         /* Don't add one object to multiple lists. */
         table = kmemdup(input_table, sizeof(struct xt_table), GFP_KERNEL);
         if (!table) {
diff --git a/net/sched/act_nat.c b/net/sched/act_nat.c
index d885ba311564..570949417f38 100644
--- a/net/sched/act_nat.c
+++ b/net/sched/act_nat.c
@@ -159,6 +159,9 @@ static int tcf_nat(struct sk_buff *skb, struct tc_action *a,
                         iph->daddr = new_addr;
 
                 csum_replace4(&iph->check, addr, new_addr);
+        } else if ((iph->frag_off & htons(IP_OFFSET)) ||
+                   iph->protocol != IPPROTO_ICMP) {
+                goto out;
         }
 
         ihl = iph->ihl * 4;
@@ -247,6 +250,7 @@ static int tcf_nat(struct sk_buff *skb, struct tc_action *a,
                 break;
         }
 
+out:
         return action;
 
 drop:
diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c
index fdbd0b7bd840..50e3d945e1f4 100644
--- a/net/sched/act_pedit.c
+++ b/net/sched/act_pedit.c
@@ -125,7 +125,7 @@ static int tcf_pedit(struct sk_buff *skb, struct tc_action *a,
 {
         struct tcf_pedit *p = a->priv;
         int i, munged = 0;
-        u8 *pptr;
+        unsigned int off;
 
         if (!(skb->tc_verd & TC_OK2MUNGE)) {
                 /* should we set skb->cloned? */
@@ -134,7 +134,7 @@ static int tcf_pedit(struct sk_buff *skb, struct tc_action *a,
                 }
         }
 
-        pptr = skb_network_header(skb);
+        off = skb_network_offset(skb);
 
         spin_lock(&p->tcf_lock);
 
@@ -144,17 +144,17 @@ static int tcf_pedit(struct sk_buff *skb, struct tc_action *a,
                 struct tc_pedit_key *tkey = p->tcfp_keys;
 
                 for (i = p->tcfp_nkeys; i > 0; i--, tkey++) {
-                        u32 *ptr;
+                        u32 *ptr, _data;
                         int offset = tkey->off;
 
                         if (tkey->offmask) {
-                                if (skb->len > tkey->at) {
-                                         char *j = pptr + tkey->at;
-                                         offset += ((*j & tkey->offmask) >>
-                                                   tkey->shift);
-                                } else {
+                                char *d, _d;
+
+                                d = skb_header_pointer(skb, off + tkey->at, 1,
+                                                       &_d);
+                                if (!d)
                                         goto bad;
-                                }
+                                offset += (*d & tkey->offmask) >> tkey->shift;
                         }
 
                         if (offset % 4) {
@@ -169,9 +169,13 @@ static int tcf_pedit(struct sk_buff *skb, struct tc_action *a,
                                 goto bad;
                         }
 
-                        ptr = (u32 *)(pptr+offset);
+                        ptr = skb_header_pointer(skb, off + offset, 4, &_data);
+                        if (!ptr)
+                                goto bad;
                         /* just do it, baby */
                         *ptr = ((*ptr & tkey->mask) ^ tkey->val);
+                        if (ptr == &_data)
+                                skb_store_bits(skb, off + offset, ptr, 4);
                         munged++;
                 }
 
diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c
index 96275422c619..4f522143811e 100644
--- a/net/sched/cls_u32.c
+++ b/net/sched/cls_u32.c
@@ -98,11 +98,11 @@ static int u32_classify(struct sk_buff *skb, struct tcf_proto *tp, struct tcf_re
 {
         struct {
                 struct tc_u_knode *knode;
-                u8                *ptr;
+                unsigned int      off;
         } stack[TC_U32_MAXDEPTH];
 
         struct tc_u_hnode *ht = (struct tc_u_hnode*)tp->root;
-        u8 *ptr = skb_network_header(skb);
+        unsigned int off = skb_network_offset(skb);
         struct tc_u_knode *n;
         int sdepth = 0;
         int off2 = 0;
@@ -134,8 +134,14 @@ next_knode:
 #endif
 
                 for (i = n->sel.nkeys; i>0; i--, key++) {
-
-                        if ((*(__be32*)(ptr+key->off+(off2&key->offmask))^key->val)&key->mask) {
+                        unsigned int toff;
+                        __be32 *data, _data;
+
+                        toff = off + key->off + (off2 & key->offmask);
+                        data = skb_header_pointer(skb, toff, 4, &_data);
+                        if (!data)
+                                goto out;
+                        if ((*data ^ key->val) & key->mask) {
                                 n = n->next;
                                 goto next_knode;
                         }
@@ -174,29 +180,45 @@ check_terminal:
                 if (sdepth >= TC_U32_MAXDEPTH)
                         goto deadloop;
                 stack[sdepth].knode = n;
-                stack[sdepth].ptr = ptr;
+                stack[sdepth].off = off;
                 sdepth++;
 
                 ht = n->ht_down;
                 sel = 0;
-                if (ht->divisor)
-                        sel = ht->divisor&u32_hash_fold(*(__be32*)(ptr+n->sel.hoff), &n->sel,n->fshift);
-
+                if (ht->divisor) {
+                        __be32 *data, _data;
+
+                        data = skb_header_pointer(skb, off + n->sel.hoff, 4,
+                                                  &_data);
+                        if (!data)
+                                goto out;
+                        sel = ht->divisor & u32_hash_fold(*data, &n->sel,
+                                                          n->fshift);
+                }
                 if (!(n->sel.flags&(TC_U32_VAROFFSET|TC_U32_OFFSET|TC_U32_EAT)))
                         goto next_ht;
 
                 if (n->sel.flags&(TC_U32_OFFSET|TC_U32_VAROFFSET)) {
                         off2 = n->sel.off + 3;
-                        if (n->sel.flags&TC_U32_VAROFFSET)
-                                off2 += ntohs(n->sel.offmask & *(__be16*)(ptr+n->sel.offoff)) >>n->sel.offshift;
+                        if (n->sel.flags & TC_U32_VAROFFSET) {
+                                __be16 *data, _data;
+
+                                data = skb_header_pointer(skb,
+                                                          off + n->sel.offoff,
+                                                          2, &_data);
+                                if (!data)
+                                        goto out;
+                                off2 += ntohs(n->sel.offmask & *data) >>
+                                        n->sel.offshift;
+                        }
                         off2 &= ~3;
                 }
                 if (n->sel.flags&TC_U32_EAT) {
-                        ptr += off2;
+                        off += off2;
                         off2 = 0;
                 }
 
-                if (ptr < skb_tail_pointer(skb))
+                if (off < skb->len)
                         goto next_ht;
         }
 
@@ -204,9 +226,10 @@ check_terminal:
         if (sdepth--) {
                 n = stack[sdepth].knode;
                 ht = n->ht_up;
-                ptr = stack[sdepth].ptr;
+                off = stack[sdepth].off;
                 goto check_terminal;
         }
+out:
         return -1;
 
 deadloop:
diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c
index 6a329158bdfa..a3cca0a94346 100644
--- a/net/xfrm/xfrm_output.c
+++ b/net/xfrm/xfrm_output.c
@@ -95,13 +95,13 @@ resume:
                         goto error_nolock;
                 }
 
-                dst = dst_pop(dst);
+                dst = skb_dst_pop(skb);
                 if (!dst) {
                         XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTERROR);
                         err = -EHOSTUNREACH;
                         goto error_nolock;
                 }
-                skb_dst_set(skb, dst);
+                skb_dst_set_noref(skb, dst);
                 x = dst->xfrm;
         } while (x && !(x->outer_mode->flags & XFRM_MODE_FLAG_TUNNEL));
 
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index d965a2bad8d3..4bf27d901333 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -2153,6 +2153,7 @@ int __xfrm_route_forward(struct sk_buff *skb, unsigned short family)
                 return 0;
         }
 
+        skb_dst_force(skb);
         dst = skb_dst(skb);
 
         res = xfrm_lookup(net, &dst, &fl, NULL, 0) == 0;