Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (29 commits)
  zaurus: add usb id for motomagx phones
  usbnet: make usbnet_get_link() fall back to ethtool_op_get_link()
  veth: Fix carrier detect
  cdc_ether: add usb id for Ericsson F3507g
  r8169: read MAC address from EEPROM on init (2nd attempt)
  tcp: fix retrans_out leaks
  net headers: export dcbnl.h
  net headers: cleanup dcbnl.h
  netpoll: Add drop checks to all entry points
  gianfar: Do right check on num_txbdfree
  pkt_sched: sch_drr: Fix oops in drr_change_class.
  b44: Disable device on shutdown
  b44: Unconditionally enable interrupt routing on reset
  net: fix hp-plus build error
  libertas: fix misuse of netdev_priv() and dev->ml_priv
  ipv6: don't use tw net when accounting for recycled tw
  asix: new device ids
  tcp_scalable: Update malformed & dead url
  netfilter: xt_recent: fix proc-file addition/removal of IPv4 addresses
  netxen: handle pci bar 0 mapping failure
  ...

34 files changed, 467 insertions, 209 deletions

diff --git a/drivers/net/b44.c b/drivers/net/b44.c
index c38512ebcea6..dc5f051005fa 100644
--- a/drivers/net/b44.c
+++ b/drivers/net/b44.c
@@ -1264,8 +1264,14 @@ static void b44_clear_stats(struct b44 *bp)
 static void b44_chip_reset(struct b44 *bp, int reset_kind)
 {
         struct ssb_device *sdev = bp->sdev;
+        bool was_enabled;
 
-        if (ssb_device_is_enabled(bp->sdev)) {
+        was_enabled = ssb_device_is_enabled(bp->sdev);
+
+        ssb_device_enable(bp->sdev, 0);
+        ssb_pcicore_dev_irqvecs_enable(&sdev->bus->pcicore, sdev);
+
+        if (was_enabled) {
                 bw32(bp, B44_RCV_LAZY, 0);
                 bw32(bp, B44_ENET_CTRL, ENET_CTRL_DISABLE);
                 b44_wait_bit(bp, B44_ENET_CTRL, ENET_CTRL_DISABLE, 200, 1);
@@ -1277,10 +1283,8 @@ static void b44_chip_reset(struct b44 *bp, int reset_kind)
                 }
                 bw32(bp, B44_DMARX_CTRL, 0);
                 bp->rx_prod = bp->rx_cons = 0;
-        } else
-                ssb_pcicore_dev_irqvecs_enable(&sdev->bus->pcicore, sdev);
+        }
 
-        ssb_device_enable(bp->sdev, 0);
         b44_clear_stats(bp);
 
         /*
@@ -2236,6 +2240,7 @@ static void __devexit b44_remove_one(struct ssb_device *sdev)
         struct net_device *dev = ssb_get_drvdata(sdev);
 
         unregister_netdev(dev);
+        ssb_device_disable(sdev, 0);
         ssb_bus_may_powerdown(sdev->bus);
         free_netdev(dev);
         ssb_pcihost_set_power_state(sdev, PCI_D3hot);
diff --git a/drivers/net/gianfar.c b/drivers/net/gianfar.c
index 9b12a13a640f..9831b3f408aa 100644
--- a/drivers/net/gianfar.c
+++ b/drivers/net/gianfar.c
@@ -1284,7 +1284,7 @@ static int gfar_start_xmit(struct sk_buff *skb, struct net_device *dev)
         spin_lock_irqsave(&priv->txlock, flags);
 
         /* check if there is space to queue this packet */
-        if (nr_frags > priv->num_txbdfree) {
+        if ((nr_frags+1) > priv->num_txbdfree) {
                 /* no space, stop the queue */
                 netif_stop_queue(dev);
                 dev->stats.tx_fifo_errors++;
diff --git a/drivers/net/hp-plus.c b/drivers/net/hp-plus.c
index 5e070f446635..0486cbe01adb 100644
--- a/drivers/net/hp-plus.c
+++ b/drivers/net/hp-plus.c
@@ -467,7 +467,7 @@ init_module(void)
                         if (this_dev != 0) break; /* only autoprobe 1st one */
                         printk(KERN_NOTICE "hp-plus.c: Presently autoprobing (not recommended) for a single card.\n");
                 }
-                dev = alloc_ei_netdev();
+                dev = alloc_eip_netdev();
                 if (!dev)
                         break;
                 dev->irq = irq[this_dev];
diff --git a/drivers/net/netxen/netxen_nic_main.c b/drivers/net/netxen/netxen_nic_main.c
index 9f33e442f403..13087782ac40 100644
--- a/drivers/net/netxen/netxen_nic_main.c
+++ b/drivers/net/netxen/netxen_nic_main.c
@@ -588,7 +588,12 @@ netxen_nic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
                 adapter->pci_mem_read = netxen_nic_pci_mem_read_2M;
                 adapter->pci_mem_write = netxen_nic_pci_mem_write_2M;
 
-                mem_ptr0 = ioremap(mem_base, mem_len);
+                mem_ptr0 = pci_ioremap_bar(pdev, 0);
+                if (mem_ptr0 == NULL) {
+                        dev_err(&pdev->dev, "failed to map PCI bar 0\n");
+                        return -EIO;
+                }
+
                 pci_len0 = mem_len;
                 first_page_group_start = 0;
                 first_page_group_end   = 0;
@@ -795,9 +800,12 @@ netxen_nic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
          * See if the firmware gave us a virtual-physical port mapping.
          */
         adapter->physical_port = adapter->portnum;
-        i = adapter->pci_read_normalize(adapter, CRB_V2P(adapter->portnum));
-        if (i != 0x55555555)
-                adapter->physical_port = i;
+        if (adapter->fw_major < 4) {
+                i = adapter->pci_read_normalize(adapter,
+                                CRB_V2P(adapter->portnum));
+                if (i != 0x55555555)
+                        adapter->physical_port = i;
+        }
 
         adapter->flags &= ~(NETXEN_NIC_MSI_ENABLED | NETXEN_NIC_MSIX_ENABLED);
 
diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
index 0771eb6fc6eb..b3473401c83a 100644
--- a/drivers/net/r8169.c
+++ b/drivers/net/r8169.c
@@ -81,9 +81,9 @@ static const int multicast_filter_limit = 32;
 #define RTL8169_TX_TIMEOUT      (6*HZ)
 #define RTL8169_PHY_TIMEOUT     (10*HZ)
 
-#define RTL_EEPROM_SIG          cpu_to_le32(0x8129)
-#define RTL_EEPROM_SIG_MASK     cpu_to_le32(0xffff)
+#define RTL_EEPROM_SIG          0x8129
 #define RTL_EEPROM_SIG_ADDR     0x0000
+#define RTL_EEPROM_MAC_ADDR     0x0007
 
 /* write/read MMIO register */
 #define RTL_W8(reg, val8)       writeb ((val8), ioaddr + (reg))
@@ -293,6 +293,11 @@ enum rtl_register_content {
         /* Cfg9346Bits */
         Cfg9346_Lock    = 0x00,
         Cfg9346_Unlock  = 0xc0,
+        Cfg9346_Program = 0x80,         /* Programming mode */
+        Cfg9346_EECS    = 0x08,         /* Chip select */
+        Cfg9346_EESK    = 0x04,         /* Serial data clock */
+        Cfg9346_EEDI    = 0x02,         /* Data input */
+        Cfg9346_EEDO    = 0x01,         /* Data output */
 
         /* rx_mode_bits */
         AcceptErr       = 0x20,
@@ -305,6 +310,7 @@ enum rtl_register_content {
         /* RxConfigBits */
         RxCfgFIFOShift  = 13,
         RxCfgDMAShift   =  8,
+        RxCfg9356SEL    =  6,           /* EEPROM type: 0 = 9346, 1 = 9356 */
 
         /* TxConfigBits */
         TxInterFrameGapShift = 24,
@@ -1963,6 +1969,108 @@ static const struct net_device_ops rtl8169_netdev_ops = {
 
 };
 
+/* Delay between EEPROM clock transitions. Force out buffered PCI writes. */
+#define RTL_EEPROM_DELAY()      RTL_R8(Cfg9346)
+#define RTL_EEPROM_READ_CMD     6
+
+/* read 16bit word stored in EEPROM. EEPROM is addressed by words. */
+static u16 rtl_eeprom_read(void __iomem *ioaddr, int addr)
+{
+        u16 result = 0;
+        int cmd, cmd_len, i;
+
+        /* check for EEPROM address size (in bits) */
+        if (RTL_R32(RxConfig) & (1 << RxCfg9356SEL)) {
+                /* EEPROM is 93C56 */
+                cmd_len = 3 + 8; /* 3 bits for command id and 8 for address */
+                cmd = (RTL_EEPROM_READ_CMD << 8) | (addr & 0xff);
+        } else {
+                /* EEPROM is 93C46 */
+                cmd_len = 3 + 6; /* 3 bits for command id and 6 for address */
+                cmd = (RTL_EEPROM_READ_CMD << 6) | (addr & 0x3f);
+        }
+
+        /* enter programming mode */
+        RTL_W8(Cfg9346, Cfg9346_Program | Cfg9346_EECS);
+        RTL_EEPROM_DELAY();
+
+        /* write command and requested address */
+        while (cmd_len--) {
+                u8 x = Cfg9346_Program | Cfg9346_EECS;
+
+                x |= (cmd & (1 << cmd_len)) ? Cfg9346_EEDI : 0;
+
+                /* write a bit */
+                RTL_W8(Cfg9346, x);
+                RTL_EEPROM_DELAY();
+
+                /* raise clock */
+                RTL_W8(Cfg9346, x | Cfg9346_EESK);
+                RTL_EEPROM_DELAY();
+        }
+
+        /* lower clock */
+        RTL_W8(Cfg9346, Cfg9346_Program | Cfg9346_EECS);
+        RTL_EEPROM_DELAY();
+
+        /* read back 16bit value */
+        for (i = 16; i > 0; i--) {
+                /* raise clock */
+                RTL_W8(Cfg9346, Cfg9346_Program | Cfg9346_EECS | Cfg9346_EESK);
+                RTL_EEPROM_DELAY();
+
+                result <<= 1;
+                result |= (RTL_R8(Cfg9346) & Cfg9346_EEDO) ? 1 : 0;
+
+                /* lower clock */
+                RTL_W8(Cfg9346, Cfg9346_Program | Cfg9346_EECS);
+                RTL_EEPROM_DELAY();
+        }
+
+        RTL_W8(Cfg9346, Cfg9346_Program);
+        /* leave programming mode */
+        RTL_W8(Cfg9346, Cfg9346_Lock);
+
+        return result;
+}
+
+static void rtl_init_mac_address(struct rtl8169_private *tp,
+                                 void __iomem *ioaddr)
+{
+        struct pci_dev *pdev = tp->pci_dev;
+        u16 x;
+        u8 mac[8];
+
+        /* read EEPROM signature */
+        x = rtl_eeprom_read(ioaddr, RTL_EEPROM_SIG_ADDR);
+
+        if (x != RTL_EEPROM_SIG) {
+                dev_info(&pdev->dev, "Missing EEPROM signature: %04x\n", x);
+                return;
+        }
+
+        /* read MAC address */
+        x = rtl_eeprom_read(ioaddr, RTL_EEPROM_MAC_ADDR);
+        mac[0] = x & 0xff;
+        mac[1] = x >> 8;
+        x = rtl_eeprom_read(ioaddr, RTL_EEPROM_MAC_ADDR + 1);
+        mac[2] = x & 0xff;
+        mac[3] = x >> 8;
+        x = rtl_eeprom_read(ioaddr, RTL_EEPROM_MAC_ADDR + 2);
+        mac[4] = x & 0xff;
+        mac[5] = x >> 8;
+
+        if (netif_msg_probe(tp)) {
+                DECLARE_MAC_BUF(buf);
+
+                dev_info(&pdev->dev, "MAC address found in EEPROM: %s\n",
+                         print_mac(buf, mac));
+        }
+
+        if (is_valid_ether_addr(mac))
+                rtl_rar_set(tp, mac);
+}
+
 static int __devinit
 rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
 {
@@ -2141,6 +2249,8 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
 
         tp->mmio_addr = ioaddr;
 
+        rtl_init_mac_address(tp, ioaddr);
+
         /* Get MAC address */
         for (i = 0; i < MAC_ADDR_LEN; i++)
                 dev->dev_addr[i] = RTL_R8(MAC0 + i);
diff --git a/drivers/net/usb/asix.c b/drivers/net/usb/asix.c
index e009481c606c..396f821b5ff0 100644
--- a/drivers/net/usb/asix.c
+++ b/drivers/net/usb/asix.c
@@ -1451,6 +1451,14 @@ static const struct usb_device_id	products [] = {
         // Cables-to-Go USB Ethernet Adapter
         USB_DEVICE(0x0b95, 0x772a),
         .driver_info = (unsigned long) &ax88772_info,
+}, {
+        // ABOCOM for pci
+        USB_DEVICE(0x14ea, 0xab11),
+        .driver_info = (unsigned long) &ax88178_info,
+}, {
+        // ASIX 88772a
+        USB_DEVICE(0x0db0, 0xa877),
+        .driver_info = (unsigned long) &ax88772_info,
 },
         { },            // END
 };
diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
index 0e061dfea78d..55e8ecc3a9e5 100644
--- a/drivers/net/usb/cdc_ether.c
+++ b/drivers/net/usb/cdc_ether.c
@@ -559,6 +559,11 @@ static const struct usb_device_id	products [] = {
         USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ETHERNET,
                         USB_CDC_PROTO_NONE),
         .driver_info = (unsigned long) &cdc_info,
+}, {
+        /* Ericsson F3507g */
+        USB_DEVICE_AND_INTERFACE_INFO(0x0bdb, 0x1900, USB_CLASS_COMM,
+                        USB_CDC_SUBCLASS_MDLM, USB_CDC_PROTO_NONE),
+        .driver_info = (unsigned long) &cdc_info,
 },
         { },            // END
 };
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index aa3149078888..c32284ff3f54 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -723,8 +723,8 @@ u32 usbnet_get_link (struct net_device *net)
         if (dev->mii.mdio_read)
                 return mii_link_ok(&dev->mii);
 
-        /* Otherwise, say we're up (to avoid breaking scripts) */
-        return 1;
+        /* Otherwise, dtrt for drivers calling netif_carrier_{on,off} */
+        return ethtool_op_get_link(net);
 }
 EXPORT_SYMBOL_GPL(usbnet_get_link);
 
diff --git a/drivers/net/usb/zaurus.c b/drivers/net/usb/zaurus.c
index e24f7b3ace4b..04882c8f9bf1 100644
--- a/drivers/net/usb/zaurus.c
+++ b/drivers/net/usb/zaurus.c
@@ -341,6 +341,11 @@ static const struct usb_device_id	products [] = {
         USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_MDLM,
                         USB_CDC_PROTO_NONE),
         .driver_info = (unsigned long) &bogus_mdlm_info,
+}, {
+        /* Motorola MOTOMAGX phones */
+        USB_DEVICE_AND_INTERFACE_INFO(0x22b8, 0x6425, USB_CLASS_COMM,
+                        USB_CDC_SUBCLASS_MDLM, USB_CDC_PROTO_NONE),
+        .driver_info = (unsigned long) &bogus_mdlm_info,
 },
 
 /* Olympus has some models with a Zaurus-compatible option.
diff --git a/drivers/net/veth.c b/drivers/net/veth.c
index 108bbbeacfb6..124fe75b8a8a 100644
--- a/drivers/net/veth.c
+++ b/drivers/net/veth.c
@@ -239,6 +239,16 @@ static int veth_open(struct net_device *dev)
         return 0;
 }
 
+static int veth_close(struct net_device *dev)
+{
+        struct veth_priv *priv = netdev_priv(dev);
+
+        netif_carrier_off(dev);
+        netif_carrier_off(priv->peer);
+
+        return 0;
+}
+
 static int veth_dev_init(struct net_device *dev)
 {
         struct veth_net_stats *stats;
@@ -265,6 +275,7 @@ static void veth_dev_free(struct net_device *dev)
 static const struct net_device_ops veth_netdev_ops = {
         .ndo_init            = veth_dev_init,
         .ndo_open            = veth_open,
+        .ndo_stop            = veth_close,
         .ndo_start_xmit      = veth_xmit,
         .ndo_get_stats       = veth_get_stats,
         .ndo_set_mac_address = eth_mac_addr,
@@ -280,44 +291,6 @@ static void veth_setup(struct net_device *dev)
         dev->destructor = veth_dev_free;
 }
 
-static void veth_change_state(struct net_device *dev)
-{
-        struct net_device *peer;
-        struct veth_priv *priv;
-
-        priv = netdev_priv(dev);
-        peer = priv->peer;
-
-        if (netif_carrier_ok(peer)) {
-                if (!netif_carrier_ok(dev))
-                        netif_carrier_on(dev);
-        } else {
-                if (netif_carrier_ok(dev))
-                        netif_carrier_off(dev);
-        }
-}
-
-static int veth_device_event(struct notifier_block *unused,
-                             unsigned long event, void *ptr)
-{
-        struct net_device *dev = ptr;
-
-        if (dev->netdev_ops->ndo_open != veth_open)
-                goto out;
-
-        switch (event) {
-        case NETDEV_CHANGE:
-                veth_change_state(dev);
-                break;
-        }
-out:
-        return NOTIFY_DONE;
-}
-
-static struct notifier_block veth_notifier_block __read_mostly = {
-        .notifier_call  = veth_device_event,
-};
-
 /*
  * netlink interface
  */
@@ -468,14 +441,12 @@ static struct rtnl_link_ops veth_link_ops = {
 
 static __init int veth_init(void)
 {
-        register_netdevice_notifier(&veth_notifier_block);
         return rtnl_link_register(&veth_link_ops);
 }
 
 static __exit void veth_exit(void)
 {
         rtnl_link_unregister(&veth_link_ops);
-        unregister_netdevice_notifier(&veth_notifier_block);
 }
 
 module_init(veth_init);
diff --git a/drivers/net/wireless/ath9k/main.c b/drivers/net/wireless/ath9k/main.c
index 727f067aca4f..0e80990d8e84 100644
--- a/drivers/net/wireless/ath9k/main.c
+++ b/drivers/net/wireless/ath9k/main.c
@@ -1538,6 +1538,7 @@ bad2:
 bad:
         if (ah)
                 ath9k_hw_detach(ah);
+        ath9k_exit_debug(sc);
 
         return error;
 }
@@ -1545,7 +1546,7 @@ bad:
 static int ath_attach(u16 devid, struct ath_softc *sc)
 {
         struct ieee80211_hw *hw = sc->hw;
-        int error = 0;
+        int error = 0, i;
 
         DPRINTF(sc, ATH_DBG_CONFIG, "Attach ATH hw\n");
 
@@ -1589,11 +1590,11 @@ static int ath_attach(u16 devid, struct ath_softc *sc)
         /* initialize tx/rx engine */
         error = ath_tx_init(sc, ATH_TXBUF);
         if (error != 0)
-                goto detach;
+                goto error_attach;
 
         error = ath_rx_init(sc, ATH_RXBUF);
         if (error != 0)
-                goto detach;
+                goto error_attach;
 
 #if defined(CONFIG_RFKILL) || defined(CONFIG_RFKILL_MODULE)
         /* Initialze h/w Rfkill */
@@ -1601,8 +1602,9 @@ static int ath_attach(u16 devid, struct ath_softc *sc)
                 INIT_DELAYED_WORK(&sc->rf_kill.rfkill_poll, ath_rfkill_poll);
 
         /* Initialize s/w rfkill */
-        if (ath_init_sw_rfkill(sc))
-                goto detach;
+        error = ath_init_sw_rfkill(sc);
+        if (error)
+                goto error_attach;
 #endif
 
         error = ieee80211_register_hw(hw);
@@ -1611,8 +1613,16 @@ static int ath_attach(u16 devid, struct ath_softc *sc)
         ath_init_leds(sc);
 
         return 0;
-detach:
-        ath_detach(sc);
+
+error_attach:
+        /* cleanup tx queues */
+        for (i = 0; i < ATH9K_NUM_TX_QUEUES; i++)
+                if (ATH_TXQ_SETUP(sc, i))
+                        ath_tx_cleanupq(sc, &sc->tx.txq[i]);
+
+        ath9k_hw_detach(sc->sc_ah);
+        ath9k_exit_debug(sc);
+
         return error;
 }
 
diff --git a/drivers/net/wireless/libertas/ethtool.c b/drivers/net/wireless/libertas/ethtool.c
index 61d2f50470c8..b118a35ec605 100644
--- a/drivers/net/wireless/libertas/ethtool.c
+++ b/drivers/net/wireless/libertas/ethtool.c
@@ -23,7 +23,7 @@ static const char * mesh_stat_strings[]= {
 static void lbs_ethtool_get_drvinfo(struct net_device *dev,
                                          struct ethtool_drvinfo *info)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
 
         snprintf(info->fw_version, 32, "%u.%u.%u.p%u",
                 priv->fwrelease >> 24 & 0xff,
@@ -47,7 +47,7 @@ static int lbs_ethtool_get_eeprom_len(struct net_device *dev)
 static int lbs_ethtool_get_eeprom(struct net_device *dev,
                                   struct ethtool_eeprom *eeprom, u8 * bytes)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         struct cmd_ds_802_11_eeprom_access cmd;
         int ret;
 
@@ -76,7 +76,7 @@ out:
 static void lbs_ethtool_get_stats(struct net_device *dev,
                                   struct ethtool_stats *stats, uint64_t *data)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         struct cmd_ds_mesh_access mesh_access;
         int ret;
 
@@ -113,7 +113,7 @@ static void lbs_ethtool_get_stats(struct net_device *dev,
 
 static int lbs_ethtool_get_sset_count(struct net_device *dev, int sset)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
 
         if (sset == ETH_SS_STATS && dev == priv->mesh_dev)
                 return MESH_STATS_NUM;
@@ -143,7 +143,7 @@ static void lbs_ethtool_get_strings(struct net_device *dev,
 static void lbs_ethtool_get_wol(struct net_device *dev,
                                 struct ethtool_wolinfo *wol)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
 
         if (priv->wol_criteria == 0xffffffff) {
                 /* Interface driver didn't configure wake */
@@ -166,7 +166,7 @@ static void lbs_ethtool_get_wol(struct net_device *dev,
 static int lbs_ethtool_set_wol(struct net_device *dev,
                                struct ethtool_wolinfo *wol)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         uint32_t criteria = 0;
 
         if (priv->wol_criteria == 0xffffffff && wol->wolopts)
diff --git a/drivers/net/wireless/libertas/if_usb.c b/drivers/net/wireless/libertas/if_usb.c
index 2fc637ad85c7..ea3dc038be76 100644
--- a/drivers/net/wireless/libertas/if_usb.c
+++ b/drivers/net/wireless/libertas/if_usb.c
@@ -59,7 +59,7 @@ static int if_usb_reset_device(struct if_usb_card *cardp);
 static ssize_t if_usb_firmware_set(struct device *dev,
                 struct device_attribute *attr, const char *buf, size_t count)
 {
-        struct lbs_private *priv = netdev_priv(to_net_dev(dev));
+        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
         struct if_usb_card *cardp = priv->card;
         char fwname[FIRMWARE_NAME_MAX];
         int ret;
@@ -86,7 +86,7 @@ static DEVICE_ATTR(lbs_flash_fw, 0200, NULL, if_usb_firmware_set);
 static ssize_t if_usb_boot2_set(struct device *dev,
                 struct device_attribute *attr, const char *buf, size_t count)
 {
-        struct lbs_private *priv = netdev_priv(to_net_dev(dev));
+        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
         struct if_usb_card *cardp = priv->card;
         char fwname[FIRMWARE_NAME_MAX];
         int ret;
diff --git a/drivers/net/wireless/libertas/main.c b/drivers/net/wireless/libertas/main.c
index 4e0007d20030..f76623e0ff9a 100644
--- a/drivers/net/wireless/libertas/main.c
+++ b/drivers/net/wireless/libertas/main.c
@@ -222,7 +222,7 @@ u8 lbs_data_rate_to_fw_index(u32 rate)
 static ssize_t lbs_anycast_get(struct device *dev,
                 struct device_attribute *attr, char * buf)
 {
-        struct lbs_private *priv = netdev_priv(to_net_dev(dev));
+        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
         struct cmd_ds_mesh_access mesh_access;
         int ret;
 
@@ -241,7 +241,7 @@ static ssize_t lbs_anycast_get(struct device *dev,
 static ssize_t lbs_anycast_set(struct device *dev,
                 struct device_attribute *attr, const char * buf, size_t count)
 {
-        struct lbs_private *priv = netdev_priv(to_net_dev(dev));
+        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
         struct cmd_ds_mesh_access mesh_access;
         uint32_t datum;
         int ret;
@@ -263,7 +263,7 @@ static ssize_t lbs_anycast_set(struct device *dev,
 static ssize_t lbs_prb_rsp_limit_get(struct device *dev,
                 struct device_attribute *attr, char *buf)
 {
-        struct lbs_private *priv = netdev_priv(to_net_dev(dev));
+        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
         struct cmd_ds_mesh_access mesh_access;
         int ret;
         u32 retry_limit;
@@ -286,7 +286,7 @@ static ssize_t lbs_prb_rsp_limit_get(struct device *dev,
 static ssize_t lbs_prb_rsp_limit_set(struct device *dev,
                 struct device_attribute *attr, const char *buf, size_t count)
 {
-        struct lbs_private *priv = netdev_priv(to_net_dev(dev));
+        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
         struct cmd_ds_mesh_access mesh_access;
         int ret;
         unsigned long retry_limit;
@@ -321,7 +321,7 @@ static void lbs_remove_mesh(struct lbs_private *priv);
 static ssize_t lbs_rtap_get(struct device *dev,
                 struct device_attribute *attr, char * buf)
 {
-        struct lbs_private *priv = netdev_priv(to_net_dev(dev));
+        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
         return snprintf(buf, 5, "0x%X\n", priv->monitormode);
 }
 
@@ -332,7 +332,7 @@ static ssize_t lbs_rtap_set(struct device *dev,
                 struct device_attribute *attr, const char * buf, size_t count)
 {
         int monitor_mode;
-        struct lbs_private *priv = netdev_priv(to_net_dev(dev));
+        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
 
         sscanf(buf, "%x", &monitor_mode);
         if (monitor_mode) {
@@ -383,7 +383,7 @@ static DEVICE_ATTR(lbs_rtap, 0644, lbs_rtap_get, lbs_rtap_set );
 static ssize_t lbs_mesh_get(struct device *dev,
                 struct device_attribute *attr, char * buf)
 {
-        struct lbs_private *priv = netdev_priv(to_net_dev(dev));
+        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
         return snprintf(buf, 5, "0x%X\n", !!priv->mesh_dev);
 }
 
@@ -393,7 +393,7 @@ static ssize_t lbs_mesh_get(struct device *dev,
 static ssize_t lbs_mesh_set(struct device *dev,
                 struct device_attribute *attr, const char * buf, size_t count)
 {
-        struct lbs_private *priv = netdev_priv(to_net_dev(dev));
+        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
         int enable;
         int ret, action = CMD_ACT_MESH_CONFIG_STOP;
 
@@ -452,7 +452,7 @@ static struct attribute_group lbs_mesh_attr_group = {
  */
 static int lbs_dev_open(struct net_device *dev)
 {
-        struct lbs_private *priv = netdev_priv(dev) ;
+        struct lbs_private *priv = dev->ml_priv;
         int ret = 0;
 
         lbs_deb_enter(LBS_DEB_NET);
@@ -521,7 +521,7 @@ static int lbs_mesh_stop(struct net_device *dev)
  */
 static int lbs_eth_stop(struct net_device *dev)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
 
         lbs_deb_enter(LBS_DEB_NET);
 
@@ -538,7 +538,7 @@ static int lbs_eth_stop(struct net_device *dev)
 
 static void lbs_tx_timeout(struct net_device *dev)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
 
         lbs_deb_enter(LBS_DEB_TX);
 
@@ -590,7 +590,7 @@ EXPORT_SYMBOL_GPL(lbs_host_to_card_done);
  */
 static struct net_device_stats *lbs_get_stats(struct net_device *dev)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
 
         lbs_deb_enter(LBS_DEB_NET);
         return &priv->stats;
@@ -599,7 +599,7 @@ static struct net_device_stats *lbs_get_stats(struct net_device *dev)
 static int lbs_set_mac_address(struct net_device *dev, void *addr)
 {
         int ret = 0;
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         struct sockaddr *phwaddr = addr;
         struct cmd_ds_802_11_mac_address cmd;
 
@@ -732,7 +732,7 @@ static void lbs_set_mcast_worker(struct work_struct *work)
 
 static void lbs_set_multicast_list(struct net_device *dev)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
 
         schedule_work(&priv->mcast_work);
 }
@@ -748,7 +748,7 @@ static void lbs_set_multicast_list(struct net_device *dev)
 static int lbs_thread(void *data)
 {
         struct net_device *dev = data;
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         wait_queue_t wait;
 
         lbs_deb_enter(LBS_DEB_THREAD);
@@ -1184,6 +1184,7 @@ struct lbs_private *lbs_add_card(void *card, struct device *dmdev)
                 goto done;
         }
         priv = netdev_priv(dev);
+        dev->ml_priv = priv;
 
         if (lbs_init_adapter(priv)) {
                 lbs_pr_err("failed to initialize adapter structure.\n");
diff --git a/drivers/net/wireless/libertas/persistcfg.c b/drivers/net/wireless/libertas/persistcfg.c
index d42b7a5a1b3f..18fe29faf99b 100644
--- a/drivers/net/wireless/libertas/persistcfg.c
+++ b/drivers/net/wireless/libertas/persistcfg.c
@@ -18,7 +18,7 @@
 static int mesh_get_default_parameters(struct device *dev,
                                        struct mrvl_mesh_defaults *defs)
 {
-        struct lbs_private *priv = netdev_priv(to_net_dev(dev));
+        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
         struct cmd_ds_mesh_config cmd;
         int ret;
 
@@ -57,7 +57,7 @@ static ssize_t bootflag_get(struct device *dev,
 static ssize_t bootflag_set(struct device *dev, struct device_attribute *attr,
                             const char *buf, size_t count)
 {
-        struct lbs_private *priv = netdev_priv(to_net_dev(dev));
+        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
         struct cmd_ds_mesh_config cmd;
         uint32_t datum;
         int ret;
@@ -100,7 +100,7 @@ static ssize_t boottime_get(struct device *dev,
 static ssize_t boottime_set(struct device *dev,
                 struct device_attribute *attr, const char *buf, size_t count)
 {
-        struct lbs_private *priv = netdev_priv(to_net_dev(dev));
+        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
         struct cmd_ds_mesh_config cmd;
         uint32_t datum;
         int ret;
@@ -152,7 +152,7 @@ static ssize_t channel_get(struct device *dev,
 static ssize_t channel_set(struct device *dev, struct device_attribute *attr,
                            const char *buf, size_t count)
 {
-        struct lbs_private *priv = netdev_priv(to_net_dev(dev));
+        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
         struct cmd_ds_mesh_config cmd;
         uint32_t datum;
         int ret;
@@ -210,7 +210,7 @@ static ssize_t mesh_id_set(struct device *dev, struct device_attribute *attr,
         struct cmd_ds_mesh_config cmd;
         struct mrvl_mesh_defaults defs;
         struct mrvl_meshie *ie;
-        struct lbs_private *priv = netdev_priv(to_net_dev(dev));
+        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
         int len;
         int ret;
 
@@ -269,7 +269,7 @@ static ssize_t protocol_id_set(struct device *dev,
         struct cmd_ds_mesh_config cmd;
         struct mrvl_mesh_defaults defs;
         struct mrvl_meshie *ie;
-        struct lbs_private *priv = netdev_priv(to_net_dev(dev));
+        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
         uint32_t datum;
         int ret;
 
@@ -323,7 +323,7 @@ static ssize_t metric_id_set(struct device *dev, struct device_attribute *attr,
         struct cmd_ds_mesh_config cmd;
         struct mrvl_mesh_defaults defs;
         struct mrvl_meshie *ie;
-        struct lbs_private *priv = netdev_priv(to_net_dev(dev));
+        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
         uint32_t datum;
         int ret;
 
@@ -377,7 +377,7 @@ static ssize_t capability_set(struct device *dev, struct device_attribute *attr,
         struct cmd_ds_mesh_config cmd;
         struct mrvl_mesh_defaults defs;
         struct mrvl_meshie *ie;
-        struct lbs_private *priv = netdev_priv(to_net_dev(dev));
+        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
         uint32_t datum;
         int ret;
 
diff --git a/drivers/net/wireless/libertas/scan.c b/drivers/net/wireless/libertas/scan.c
index 57f6c12cda20..9014950f4328 100644
--- a/drivers/net/wireless/libertas/scan.c
+++ b/drivers/net/wireless/libertas/scan.c
@@ -945,7 +945,7 @@ int lbs_set_scan(struct net_device *dev, struct iw_request_info *info,
                  union iwreq_data *wrqu, char *extra)
 {
         DECLARE_SSID_BUF(ssid);
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         int ret = 0;
 
         lbs_deb_enter(LBS_DEB_WEXT);
@@ -1008,7 +1008,7 @@ int lbs_get_scan(struct net_device *dev, struct iw_request_info *info,
                  struct iw_point *dwrq, char *extra)
 {
 #define SCAN_ITEM_SIZE 128
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         int err = 0;
         char *ev = extra;
         char *stop = ev + dwrq->length;
diff --git a/drivers/net/wireless/libertas/tx.c b/drivers/net/wireless/libertas/tx.c
index dac462641170..68bec31ae03b 100644
--- a/drivers/net/wireless/libertas/tx.c
+++ b/drivers/net/wireless/libertas/tx.c
@@ -60,7 +60,7 @@ static u32 convert_radiotap_rate_to_mv(u8 rate)
 int lbs_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
 {
         unsigned long flags;
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         struct txpd *txpd;
         char *p802x_hdr;
         uint16_t pkt_len;
diff --git a/drivers/net/wireless/libertas/wext.c b/drivers/net/wireless/libertas/wext.c
index c6102e08179e..f16d136ab4bb 100644
--- a/drivers/net/wireless/libertas/wext.c
+++ b/drivers/net/wireless/libertas/wext.c
@@ -163,7 +163,7 @@ static int lbs_get_name(struct net_device *dev, struct iw_request_info *info,
 static int lbs_get_freq(struct net_device *dev, struct iw_request_info *info,
                          struct iw_freq *fwrq, char *extra)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         struct chan_freq_power *cfp;
 
         lbs_deb_enter(LBS_DEB_WEXT);
@@ -189,7 +189,7 @@ static int lbs_get_freq(struct net_device *dev, struct iw_request_info *info,
 static int lbs_get_wap(struct net_device *dev, struct iw_request_info *info,
                         struct sockaddr *awrq, char *extra)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
 
         lbs_deb_enter(LBS_DEB_WEXT);
 
@@ -207,7 +207,7 @@ static int lbs_get_wap(struct net_device *dev, struct iw_request_info *info,
 static int lbs_set_nick(struct net_device *dev, struct iw_request_info *info,
                          struct iw_point *dwrq, char *extra)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
 
         lbs_deb_enter(LBS_DEB_WEXT);
 
@@ -231,7 +231,7 @@ static int lbs_set_nick(struct net_device *dev, struct iw_request_info *info,
 static int lbs_get_nick(struct net_device *dev, struct iw_request_info *info,
                          struct iw_point *dwrq, char *extra)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
 
         lbs_deb_enter(LBS_DEB_WEXT);
 
@@ -248,7 +248,7 @@ static int lbs_get_nick(struct net_device *dev, struct iw_request_info *info,
 static int mesh_get_nick(struct net_device *dev, struct iw_request_info *info,
                          struct iw_point *dwrq, char *extra)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
 
         lbs_deb_enter(LBS_DEB_WEXT);
 
@@ -273,7 +273,7 @@ static int lbs_set_rts(struct net_device *dev, struct iw_request_info *info,
                         struct iw_param *vwrq, char *extra)
 {
         int ret = 0;
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         u32 val = vwrq->value;
 
         lbs_deb_enter(LBS_DEB_WEXT);
@@ -293,7 +293,7 @@ static int lbs_set_rts(struct net_device *dev, struct iw_request_info *info,
 static int lbs_get_rts(struct net_device *dev, struct iw_request_info *info,
                         struct iw_param *vwrq, char *extra)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         int ret = 0;
         u16 val = 0;
 
@@ -315,7 +315,7 @@ out:
 static int lbs_set_frag(struct net_device *dev, struct iw_request_info *info,
                          struct iw_param *vwrq, char *extra)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         int ret = 0;
         u32 val = vwrq->value;
 
@@ -336,7 +336,7 @@ static int lbs_set_frag(struct net_device *dev, struct iw_request_info *info,
 static int lbs_get_frag(struct net_device *dev, struct iw_request_info *info,
                          struct iw_param *vwrq, char *extra)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         int ret = 0;
         u16 val = 0;
 
@@ -359,7 +359,7 @@ out:
 static int lbs_get_mode(struct net_device *dev,
                          struct iw_request_info *info, u32 * uwrq, char *extra)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
 
         lbs_deb_enter(LBS_DEB_WEXT);
 
@@ -385,7 +385,7 @@ static int lbs_get_txpow(struct net_device *dev,
                           struct iw_request_info *info,
                           struct iw_param *vwrq, char *extra)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         s16 curlevel = 0;
         int ret = 0;
 
@@ -418,7 +418,7 @@ out:
 static int lbs_set_retry(struct net_device *dev, struct iw_request_info *info,
                           struct iw_param *vwrq, char *extra)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         int ret = 0;
         u16 slimit = 0, llimit = 0;
 
@@ -466,7 +466,7 @@ out:
 static int lbs_get_retry(struct net_device *dev, struct iw_request_info *info,
                           struct iw_param *vwrq, char *extra)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         int ret = 0;
         u16 val = 0;
 
@@ -542,7 +542,7 @@ static int lbs_get_range(struct net_device *dev, struct iw_request_info *info,
                           struct iw_point *dwrq, char *extra)
 {
         int i, j;
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         struct iw_range *range = (struct iw_range *)extra;
         struct chan_freq_power *cfp;
         u8 rates[MAX_RATES + 1];
@@ -708,7 +708,7 @@ out:
 static int lbs_set_power(struct net_device *dev, struct iw_request_info *info,
                           struct iw_param *vwrq, char *extra)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
 
         lbs_deb_enter(LBS_DEB_WEXT);
 
@@ -758,7 +758,7 @@ static int lbs_set_power(struct net_device *dev, struct iw_request_info *info,
 static int lbs_get_power(struct net_device *dev, struct iw_request_info *info,
                           struct iw_param *vwrq, char *extra)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
 
         lbs_deb_enter(LBS_DEB_WEXT);
 
@@ -781,7 +781,7 @@ static struct iw_statistics *lbs_get_wireless_stats(struct net_device *dev)
                 EXCELLENT = 95,
                 PERFECT = 100
         };
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         u32 rssi_qual;
         u32 tx_qual;
         u32 quality = 0;
@@ -886,7 +886,7 @@ static int lbs_set_freq(struct net_device *dev, struct iw_request_info *info,
                   struct iw_freq *fwrq, char *extra)
 {
         int ret = -EINVAL;
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         struct chan_freq_power *cfp;
         struct assoc_request * assoc_req;
 
@@ -943,7 +943,7 @@ static int lbs_mesh_set_freq(struct net_device *dev,
                              struct iw_request_info *info,
                              struct iw_freq *fwrq, char *extra)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         struct chan_freq_power *cfp;
         int ret = -EINVAL;
 
@@ -994,7 +994,7 @@ out:
 static int lbs_set_rate(struct net_device *dev, struct iw_request_info *info,
                   struct iw_param *vwrq, char *extra)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         u8 new_rate = 0;
         int ret = -EINVAL;
         u8 rates[MAX_RATES + 1];
@@ -1054,7 +1054,7 @@ out:
 static int lbs_get_rate(struct net_device *dev, struct iw_request_info *info,
                   struct iw_param *vwrq, char *extra)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
 
         lbs_deb_enter(LBS_DEB_WEXT);
 
@@ -1079,7 +1079,7 @@ static int lbs_set_mode(struct net_device *dev,
                   struct iw_request_info *info, u32 * uwrq, char *extra)
 {
         int ret = 0;
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         struct assoc_request * assoc_req;
 
         lbs_deb_enter(LBS_DEB_WEXT);
@@ -1124,7 +1124,7 @@ static int lbs_get_encode(struct net_device *dev,
                            struct iw_request_info *info,
                            struct iw_point *dwrq, u8 * extra)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         int index = (dwrq->flags & IW_ENCODE_INDEX) - 1;
 
         lbs_deb_enter(LBS_DEB_WEXT);
@@ -1319,7 +1319,7 @@ static int lbs_set_encode(struct net_device *dev,
                     struct iw_point *dwrq, char *extra)
 {
         int ret = 0;
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         struct assoc_request * assoc_req;
         u16 is_default = 0, index = 0, set_tx_key = 0;
 
@@ -1395,7 +1395,7 @@ static int lbs_get_encodeext(struct net_device *dev,
                               char *extra)
 {
         int ret = -EINVAL;
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         struct iw_encode_ext *ext = (struct iw_encode_ext *)extra;
         int index, max_key_len;
 
@@ -1501,7 +1501,7 @@ static int lbs_set_encodeext(struct net_device *dev,
                               char *extra)
 {
         int ret = 0;
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         struct iw_encode_ext *ext = (struct iw_encode_ext *)extra;
         int alg = ext->alg;
         struct assoc_request * assoc_req;
@@ -1639,7 +1639,7 @@ static int lbs_set_genie(struct net_device *dev,
                           struct iw_point *dwrq,
                           char *extra)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         int ret = 0;
         struct assoc_request * assoc_req;
 
@@ -1685,7 +1685,7 @@ static int lbs_get_genie(struct net_device *dev,
                           char *extra)
 {
         int ret = 0;
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
 
         lbs_deb_enter(LBS_DEB_WEXT);
 
@@ -1713,7 +1713,7 @@ static int lbs_set_auth(struct net_device *dev,
                          struct iw_param *dwrq,
                          char *extra)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         struct assoc_request * assoc_req;
         int ret = 0;
         int updated = 0;
@@ -1816,7 +1816,7 @@ static int lbs_get_auth(struct net_device *dev,
                          char *extra)
 {
         int ret = 0;
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
 
         lbs_deb_enter(LBS_DEB_WEXT);
 
@@ -1857,7 +1857,7 @@ static int lbs_set_txpow(struct net_device *dev, struct iw_request_info *info,
                    struct iw_param *vwrq, char *extra)
 {
         int ret = 0;
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         s16 dbm = (s16) vwrq->value;
 
         lbs_deb_enter(LBS_DEB_WEXT);
@@ -1936,7 +1936,7 @@ out:
 static int lbs_get_essid(struct net_device *dev, struct iw_request_info *info,
                    struct iw_point *dwrq, char *extra)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
 
         lbs_deb_enter(LBS_DEB_WEXT);
 
@@ -1971,7 +1971,7 @@ static int lbs_get_essid(struct net_device *dev, struct iw_request_info *info,
 static int lbs_set_essid(struct net_device *dev, struct iw_request_info *info,
                    struct iw_point *dwrq, char *extra)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         int ret = 0;
         u8 ssid[IW_ESSID_MAX_SIZE];
         u8 ssid_len = 0;
@@ -2040,7 +2040,7 @@ static int lbs_mesh_get_essid(struct net_device *dev,
                               struct iw_request_info *info,
                               struct iw_point *dwrq, char *extra)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
 
         lbs_deb_enter(LBS_DEB_WEXT);
 
@@ -2058,7 +2058,7 @@ static int lbs_mesh_set_essid(struct net_device *dev,
                               struct iw_request_info *info,
                               struct iw_point *dwrq, char *extra)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         int ret = 0;
 
         lbs_deb_enter(LBS_DEB_WEXT);
@@ -2102,7 +2102,7 @@ static int lbs_mesh_set_essid(struct net_device *dev,
 static int lbs_set_wap(struct net_device *dev, struct iw_request_info *info,
                  struct sockaddr *awrq, char *extra)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         struct assoc_request * assoc_req;
         int ret = 0;
 
diff --git a/drivers/net/wireless/orinoco/orinoco.c b/drivers/net/wireless/orinoco/orinoco.c
index 45a04faa7818..067d1a9c728b 100644
--- a/drivers/net/wireless/orinoco/orinoco.c
+++ b/drivers/net/wireless/orinoco/orinoco.c
@@ -3157,8 +3157,20 @@ static int orinoco_pm_notifier(struct notifier_block *notifier,
 
         return NOTIFY_DONE;
 }
+
+static void orinoco_register_pm_notifier(struct orinoco_private *priv)
+{
+        priv->pm_notifier.notifier_call = orinoco_pm_notifier;
+        register_pm_notifier(&priv->pm_notifier);
+}
+
+static void orinoco_unregister_pm_notifier(struct orinoco_private *priv)
+{
+        unregister_pm_notifier(&priv->pm_notifier);
+}
 #else /* !PM_SLEEP || HERMES_CACHE_FW_ON_INIT */
-#define orinoco_pm_notifier NULL
+#define orinoco_register_pm_notifier(priv) do { } while(0)
+#define orinoco_unregister_pm_notifier(priv) do { } while(0)
 #endif
 
 /********************************************************************/
@@ -3648,8 +3660,7 @@ struct net_device
         priv->cached_fw = NULL;
 
         /* Register PM notifiers */
-        priv->pm_notifier.notifier_call = orinoco_pm_notifier;
-        register_pm_notifier(&priv->pm_notifier);
+        orinoco_register_pm_notifier(priv);
 
         return dev;
 }
@@ -3673,7 +3684,7 @@ void free_orinocodev(struct net_device *dev)
                 kfree(rx_data);
         }
 
-        unregister_pm_notifier(&priv->pm_notifier);
+        orinoco_unregister_pm_notifier(priv);
         orinoco_uncache_fw(priv);
 
         priv->wpa_ie_len = 0;
diff --git a/drivers/net/wireless/rtl818x/rtl8187_dev.c b/drivers/net/wireless/rtl818x/rtl8187_dev.c
index 22bc07ef2f37..f4747a1134ba 100644
--- a/drivers/net/wireless/rtl818x/rtl8187_dev.c
+++ b/drivers/net/wireless/rtl818x/rtl8187_dev.c
@@ -48,6 +48,10 @@ static struct usb_device_id rtl8187_table[] __devinitdata = {
         {USB_DEVICE(0x0bda, 0x8189), .driver_info = DEVICE_RTL8187B},
         {USB_DEVICE(0x0bda, 0x8197), .driver_info = DEVICE_RTL8187B},
         {USB_DEVICE(0x0bda, 0x8198), .driver_info = DEVICE_RTL8187B},
+        /* Surecom */
+        {USB_DEVICE(0x0769, 0x11F2), .driver_info = DEVICE_RTL8187},
+        /* Logitech */
+        {USB_DEVICE(0x0789, 0x010C), .driver_info = DEVICE_RTL8187},
         /* Netgear */
         {USB_DEVICE(0x0846, 0x6100), .driver_info = DEVICE_RTL8187},
         {USB_DEVICE(0x0846, 0x6a00), .driver_info = DEVICE_RTL8187},
@@ -57,8 +61,16 @@ static struct usb_device_id rtl8187_table[] __devinitdata = {
         /* Sitecom */
         {USB_DEVICE(0x0df6, 0x000d), .driver_info = DEVICE_RTL8187},
         {USB_DEVICE(0x0df6, 0x0028), .driver_info = DEVICE_RTL8187B},
+        /* Sphairon Access Systems GmbH */
+        {USB_DEVICE(0x114B, 0x0150), .driver_info = DEVICE_RTL8187},
+        /* Dick Smith Electronics */
+        {USB_DEVICE(0x1371, 0x9401), .driver_info = DEVICE_RTL8187},
         /* Abocom */
         {USB_DEVICE(0x13d1, 0xabe6), .driver_info = DEVICE_RTL8187},
+        /* Qcom */
+        {USB_DEVICE(0x18E8, 0x6232), .driver_info = DEVICE_RTL8187},
+        /* AirLive */
+        {USB_DEVICE(0x1b75, 0x8187), .driver_info = DEVICE_RTL8187},
         {}
 };
 
diff --git a/include/linux/Kbuild b/include/linux/Kbuild
index b97cdc516a8f..106c3ba50844 100644
--- a/include/linux/Kbuild
+++ b/include/linux/Kbuild
@@ -52,6 +52,7 @@ header-y += const.h
 header-y += cgroupstats.h
 header-y += cramfs_fs.h
 header-y += cycx_cfm.h
+header-y += dcbnl.h
 header-y += dlmconstants.h
 header-y += dlm_device.h
 header-y += dlm_netlink.h
diff --git a/include/linux/dcbnl.h b/include/linux/dcbnl.h
index b0ef274e0031..7d2e10006188 100644
--- a/include/linux/dcbnl.h
+++ b/include/linux/dcbnl.h
@@ -20,10 +20,12 @@
 #ifndef __LINUX_DCBNL_H__
 #define __LINUX_DCBNL_H__
 
+#include <linux/types.h>
+
 #define DCB_PROTO_VERSION 1
 
 struct dcbmsg {
-        unsigned char      dcb_family;
+        __u8               dcb_family;
         __u8               cmd;
         __u16              dcb_pad;
 };
diff --git a/include/linux/netfilter/xt_NFLOG.h b/include/linux/netfilter/xt_NFLOG.h
index cdcd0ed58f7a..4b36aeb46a10 100644
--- a/include/linux/netfilter/xt_NFLOG.h
+++ b/include/linux/netfilter/xt_NFLOG.h
@@ -2,7 +2,7 @@
 #define _XT_NFLOG_TARGET
 
 #define XT_NFLOG_DEFAULT_GROUP          0x1
-#define XT_NFLOG_DEFAULT_THRESHOLD      1
+#define XT_NFLOG_DEFAULT_THRESHOLD      0
 
 #define XT_NFLOG_MASK                   0x0
 
diff --git a/include/net/netfilter/nf_conntrack_core.h b/include/net/netfilter/nf_conntrack_core.h
index e78afe7f28e3..c25068e38516 100644
--- a/include/net/netfilter/nf_conntrack_core.h
+++ b/include/net/netfilter/nf_conntrack_core.h
@@ -59,7 +59,7 @@ static inline int nf_conntrack_confirm(struct sk_buff *skb)
         struct nf_conn *ct = (struct nf_conn *)skb->nfct;
         int ret = NF_ACCEPT;
 
-        if (ct) {
+        if (ct && ct != &nf_conntrack_untracked) {
                 if (!nf_ct_is_confirmed(ct) && !nf_ct_is_dying(ct))
                         ret = __nf_conntrack_confirm(skb);
                 nf_ct_deliver_cached_events(ct);
diff --git a/net/8021q/vlan_core.c b/net/8021q/vlan_core.c
index e9db889d6222..2886d2fb9ab5 100644
--- a/net/8021q/vlan_core.c
+++ b/net/8021q/vlan_core.c
@@ -1,12 +1,16 @@
 #include <linux/skbuff.h>
 #include <linux/netdevice.h>
 #include <linux/if_vlan.h>
+#include <linux/netpoll.h>
 #include "vlan.h"
 
 /* VLAN rx hw acceleration helper.  This acts like netif_{rx,receive_skb}(). */
 int __vlan_hwaccel_rx(struct sk_buff *skb, struct vlan_group *grp,
                       u16 vlan_tci, int polling)
 {
+        if (netpoll_rx(skb))
+                return NET_RX_DROP;
+
         if (skb_bond_should_drop(skb))
                 goto drop;
 
@@ -100,6 +104,9 @@ int vlan_gro_receive(struct napi_struct *napi, struct vlan_group *grp,
 {
         int err = NET_RX_SUCCESS;
 
+        if (netpoll_receive_skb(skb))
+                return NET_RX_DROP;
+
         switch (vlan_gro_common(napi, grp, vlan_tci, skb)) {
         case -1:
                 return netif_receive_skb(skb);
@@ -126,6 +133,9 @@ int vlan_gro_frags(struct napi_struct *napi, struct vlan_group *grp,
         if (!skb)
                 goto out;
 
+        if (netpoll_receive_skb(skb))
+                goto out;
+
         err = NET_RX_SUCCESS;
 
         switch (vlan_gro_common(napi, grp, vlan_tci, skb)) {
diff --git a/net/core/dev.c b/net/core/dev.c
index a17e00662363..72b0d26fd46d 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2488,6 +2488,9 @@ static int __napi_gro_receive(struct napi_struct *napi, struct sk_buff *skb)
 
 int napi_gro_receive(struct napi_struct *napi, struct sk_buff *skb)
 {
+        if (netpoll_receive_skb(skb))
+                return NET_RX_DROP;
+
         switch (__napi_gro_receive(napi, skb)) {
         case -1:
                 return netif_receive_skb(skb);
@@ -2558,6 +2561,9 @@ int napi_gro_frags(struct napi_struct *napi, struct napi_gro_fraginfo *info)
         if (!skb)
                 goto out;
 
+        if (netpoll_receive_skb(skb))
+                goto out;
+
         err = NET_RX_SUCCESS;
 
         switch (__napi_gro_receive(napi, skb)) {
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index a6961d75c7ea..c28976a7e596 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -1374,7 +1374,8 @@ static u8 tcp_sacktag_one(struct sk_buff *skb, struct sock *sk,
 
 static int tcp_shifted_skb(struct sock *sk, struct sk_buff *skb,
                            struct tcp_sacktag_state *state,
-                           unsigned int pcount, int shifted, int mss)
+                           unsigned int pcount, int shifted, int mss,
+                           int dup_sack)
 {
         struct tcp_sock *tp = tcp_sk(sk);
         struct sk_buff *prev = tcp_write_queue_prev(sk, skb);
@@ -1410,7 +1411,7 @@ static int tcp_shifted_skb(struct sock *sk, struct sk_buff *skb,
         }
 
         /* We discard results */
-        tcp_sacktag_one(skb, sk, state, 0, pcount);
+        tcp_sacktag_one(skb, sk, state, dup_sack, pcount);
 
         /* Difference in this won't matter, both ACKed by the same cumul. ACK */
         TCP_SKB_CB(prev)->sacked |= (TCP_SKB_CB(skb)->sacked & TCPCB_EVER_RETRANS);
@@ -1561,7 +1562,7 @@ static struct sk_buff *tcp_shift_skb_data(struct sock *sk, struct sk_buff *skb,
 
         if (!skb_shift(prev, skb, len))
                 goto fallback;
-        if (!tcp_shifted_skb(sk, skb, state, pcount, len, mss))
+        if (!tcp_shifted_skb(sk, skb, state, pcount, len, mss, dup_sack))
                 goto out;
 
         /* Hole filled allows collapsing with the next as well, this is very
@@ -1580,7 +1581,7 @@ static struct sk_buff *tcp_shift_skb_data(struct sock *sk, struct sk_buff *skb,
         len = skb->len;
         if (skb_shift(prev, skb, len)) {
                 pcount += tcp_skb_pcount(skb);
-                tcp_shifted_skb(sk, skb, state, tcp_skb_pcount(skb), len, mss);
+                tcp_shifted_skb(sk, skb, state, tcp_skb_pcount(skb), len, mss, 0);
         }
 
 out:
diff --git a/net/ipv4/tcp_scalable.c b/net/ipv4/tcp_scalable.c
index 2747ec7bfb63..4660b088a8ce 100644
--- a/net/ipv4/tcp_scalable.c
+++ b/net/ipv4/tcp_scalable.c
@@ -1,6 +1,6 @@
 /* Tom Kelly's Scalable TCP
  *
- * See htt://www-lce.eng.cam.ac.uk/~ctk21/scalable/
+ * See http://www.deneholme.net/tom/scalable/
  *
  * John Heffner <jheffner@sc.edu>
  */
diff --git a/net/ipv6/inet6_hashtables.c b/net/ipv6/inet6_hashtables.c
index 8fe267feb81e..1bcc3431859e 100644
--- a/net/ipv6/inet6_hashtables.c
+++ b/net/ipv6/inet6_hashtables.c
@@ -258,11 +258,11 @@ unique:
 
         if (twp != NULL) {
                 *twp = tw;
-                NET_INC_STATS_BH(twsk_net(tw), LINUX_MIB_TIMEWAITRECYCLED);
+                NET_INC_STATS_BH(net, LINUX_MIB_TIMEWAITRECYCLED);
         } else if (tw != NULL) {
                 /* Silly. Should hash-dance instead... */
                 inet_twsk_deschedule(tw, death_row);
-                NET_INC_STATS_BH(twsk_net(tw), LINUX_MIB_TIMEWAITRECYCLED);
+                NET_INC_STATS_BH(net, LINUX_MIB_TIMEWAITRECYCLED);
 
                 inet_twsk_put(tw);
         }
diff --git a/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c b/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
index c323643ffcf9..72dbb6d1a6b3 100644
--- a/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
+++ b/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
@@ -201,8 +201,9 @@ icmpv6_error(struct net *net, struct sk_buff *skb, unsigned int dataoff,
 
         if (net->ct.sysctl_checksum && hooknum == NF_INET_PRE_ROUTING &&
             nf_ip6_checksum(skb, hooknum, dataoff, IPPROTO_ICMPV6)) {
-                nf_log_packet(PF_INET6, 0, skb, NULL, NULL, NULL,
-                              "nf_ct_icmpv6: ICMPv6 checksum failed\n");
+                if (LOG_INVALID(net, IPPROTO_ICMPV6))
+                        nf_log_packet(PF_INET6, 0, skb, NULL, NULL, NULL,
+                                      "nf_ct_icmpv6: ICMPv6 checksum failed ");
                 return -NF_ACCEPT;
         }
 
diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
index fa49dc7fe100..c712e9fc6bba 100644
--- a/net/netfilter/nfnetlink_log.c
+++ b/net/netfilter/nfnetlink_log.c
@@ -39,7 +39,7 @@
 #endif
 
 #define NFULNL_NLBUFSIZ_DEFAULT NLMSG_GOODSIZE
-#define NFULNL_TIMEOUT_DEFAULT  HZ      /* every second */
+#define NFULNL_TIMEOUT_DEFAULT  100     /* every second */
 #define NFULNL_QTHRESH_DEFAULT  100     /* 100 packets */
 #define NFULNL_COPY_RANGE_MAX   0xFFFF  /* max packet size is limited by 16-bit struct nfattr nfa_len field */
 
@@ -590,8 +590,10 @@ nfulnl_log_packet(u_int8_t pf,
 
         qthreshold = inst->qthreshold;
         /* per-rule qthreshold overrides per-instance */
-        if (qthreshold > li->u.ulog.qthreshold)
-                qthreshold = li->u.ulog.qthreshold;
+        if (li->u.ulog.qthreshold)
+                if (qthreshold > li->u.ulog.qthreshold)
+                        qthreshold = li->u.ulog.qthreshold;
+
 
         switch (inst->copy_mode) {
         case NFULNL_COPY_META:
diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index bfbf521f6ea5..5baccfa5a0de 100644
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -827,59 +827,143 @@ static const struct file_operations xt_table_ops = {
         .release = seq_release_net,
 };
 
-static void *xt_match_seq_start(struct seq_file *seq, loff_t *pos)
+/*
+ * Traverse state for ip{,6}_{tables,matches} for helping crossing
+ * the multi-AF mutexes.
+ */
+struct nf_mttg_trav {
+        struct list_head *head, *curr;
+        uint8_t class, nfproto;
+};
+
+enum {
+        MTTG_TRAV_INIT,
+        MTTG_TRAV_NFP_UNSPEC,
+        MTTG_TRAV_NFP_SPEC,
+        MTTG_TRAV_DONE,
+};
+
+static void *xt_mttg_seq_next(struct seq_file *seq, void *v, loff_t *ppos,
+    bool is_target)
 {
-        struct proc_dir_entry *pde = (struct proc_dir_entry *)seq->private;
-        u_int16_t af = (unsigned long)pde->data;
+        static const uint8_t next_class[] = {
+                [MTTG_TRAV_NFP_UNSPEC] = MTTG_TRAV_NFP_SPEC,
+                [MTTG_TRAV_NFP_SPEC]   = MTTG_TRAV_DONE,
+        };
+        struct nf_mttg_trav *trav = seq->private;
+
+        switch (trav->class) {
+        case MTTG_TRAV_INIT:
+                trav->class = MTTG_TRAV_NFP_UNSPEC;
+                mutex_lock(&xt[NFPROTO_UNSPEC].mutex);
+                trav->head = trav->curr = is_target ?
+                        &xt[NFPROTO_UNSPEC].target : &xt[NFPROTO_UNSPEC].match;
+                break;
+        case MTTG_TRAV_NFP_UNSPEC:
+                trav->curr = trav->curr->next;
+                if (trav->curr != trav->head)
+                        break;
+                mutex_unlock(&xt[NFPROTO_UNSPEC].mutex);
+                mutex_lock(&xt[trav->nfproto].mutex);
+                trav->head = trav->curr = is_target ?
+                        &xt[trav->nfproto].target : &xt[trav->nfproto].match;
+                trav->class = next_class[trav->class];
+                break;
+        case MTTG_TRAV_NFP_SPEC:
+                trav->curr = trav->curr->next;
+                if (trav->curr != trav->head)
+                        break;
+                /* fallthru, _stop will unlock */
+        default:
+                return NULL;
+        }
 
-        mutex_lock(&xt[af].mutex);
-        return seq_list_start(&xt[af].match, *pos);
+        if (ppos != NULL)
+                ++*ppos;
+        return trav;
 }
 
-static void *xt_match_seq_next(struct seq_file *seq, void *v, loff_t *pos)
+static void *xt_mttg_seq_start(struct seq_file *seq, loff_t *pos,
+    bool is_target)
 {
-        struct proc_dir_entry *pde = (struct proc_dir_entry *)seq->private;
-        u_int16_t af = (unsigned long)pde->data;
+        struct nf_mttg_trav *trav = seq->private;
+        unsigned int j;
 
-        return seq_list_next(v, &xt[af].match, pos);
+        trav->class = MTTG_TRAV_INIT;
+        for (j = 0; j < *pos; ++j)
+                if (xt_mttg_seq_next(seq, NULL, NULL, is_target) == NULL)
+                        return NULL;
+        return trav;
 }
 
-static void xt_match_seq_stop(struct seq_file *seq, void *v)
+static void xt_mttg_seq_stop(struct seq_file *seq, void *v)
 {
-        struct proc_dir_entry *pde = seq->private;
-        u_int16_t af = (unsigned long)pde->data;
+        struct nf_mttg_trav *trav = seq->private;
+
+        switch (trav->class) {
+        case MTTG_TRAV_NFP_UNSPEC:
+                mutex_unlock(&xt[NFPROTO_UNSPEC].mutex);
+                break;
+        case MTTG_TRAV_NFP_SPEC:
+                mutex_unlock(&xt[trav->nfproto].mutex);
+                break;
+        }
+}
 
-        mutex_unlock(&xt[af].mutex);
+static void *xt_match_seq_start(struct seq_file *seq, loff_t *pos)
+{
+        return xt_mttg_seq_start(seq, pos, false);
 }
 
-static int xt_match_seq_show(struct seq_file *seq, void *v)
+static void *xt_match_seq_next(struct seq_file *seq, void *v, loff_t *ppos)
 {
-        struct xt_match *match = list_entry(v, struct xt_match, list);
+        return xt_mttg_seq_next(seq, v, ppos, false);
+}
 
-        if (strlen(match->name))
-                return seq_printf(seq, "%s\n", match->name);
-        else
-                return 0;
+static int xt_match_seq_show(struct seq_file *seq, void *v)
+{
+        const struct nf_mttg_trav *trav = seq->private;
+        const struct xt_match *match;
+
+        switch (trav->class) {
+        case MTTG_TRAV_NFP_UNSPEC:
+        case MTTG_TRAV_NFP_SPEC:
+                if (trav->curr == trav->head)
+                        return 0;
+                match = list_entry(trav->curr, struct xt_match, list);
+                return (*match->name == '\0') ? 0 :
+                       seq_printf(seq, "%s\n", match->name);
+        }
+        return 0;
 }
 
 static const struct seq_operations xt_match_seq_ops = {
         .start  = xt_match_seq_start,
         .next   = xt_match_seq_next,
-        .stop   = xt_match_seq_stop,
+        .stop   = xt_mttg_seq_stop,
         .show   = xt_match_seq_show,
 };
 
 static int xt_match_open(struct inode *inode, struct file *file)
 {
+        struct seq_file *seq;
+        struct nf_mttg_trav *trav;
         int ret;
 
-        ret = seq_open(file, &xt_match_seq_ops);
-        if (!ret) {
-                struct seq_file *seq = file->private_data;
+        trav = kmalloc(sizeof(*trav), GFP_KERNEL);
+        if (trav == NULL)
+                return -ENOMEM;
 
-                seq->private = PDE(inode);
+        ret = seq_open(file, &xt_match_seq_ops);
+        if (ret < 0) {
+                kfree(trav);
+                return ret;
         }
-        return ret;
+
+        seq = file->private_data;
+        seq->private = trav;
+        trav->nfproto = (unsigned long)PDE(inode)->data;
+        return 0;
 }
 
 static const struct file_operations xt_match_ops = {
@@ -887,62 +971,63 @@ static const struct file_operations xt_match_ops = {
         .open    = xt_match_open,
         .read    = seq_read,
         .llseek  = seq_lseek,
-        .release = seq_release,
+        .release = seq_release_private,
 };
 
 static void *xt_target_seq_start(struct seq_file *seq, loff_t *pos)
 {
-        struct proc_dir_entry *pde = (struct proc_dir_entry *)seq->private;
-        u_int16_t af = (unsigned long)pde->data;
-
-        mutex_lock(&xt[af].mutex);
-        return seq_list_start(&xt[af].target, *pos);
+        return xt_mttg_seq_start(seq, pos, true);
 }
 
-static void *xt_target_seq_next(struct seq_file *seq, void *v, loff_t *pos)
+static void *xt_target_seq_next(struct seq_file *seq, void *v, loff_t *ppos)
 {
-        struct proc_dir_entry *pde = (struct proc_dir_entry *)seq->private;
-        u_int16_t af = (unsigned long)pde->data;
-
-        return seq_list_next(v, &xt[af].target, pos);
-}
-
-static void xt_target_seq_stop(struct seq_file *seq, void *v)
-{
-        struct proc_dir_entry *pde = seq->private;
-        u_int16_t af = (unsigned long)pde->data;
-
-        mutex_unlock(&xt[af].mutex);
+        return xt_mttg_seq_next(seq, v, ppos, true);
 }
 
 static int xt_target_seq_show(struct seq_file *seq, void *v)
 {
-        struct xt_target *target = list_entry(v, struct xt_target, list);
-
-        if (strlen(target->name))
-                return seq_printf(seq, "%s\n", target->name);
-        else
-                return 0;
+        const struct nf_mttg_trav *trav = seq->private;
+        const struct xt_target *target;
+
+        switch (trav->class) {
+        case MTTG_TRAV_NFP_UNSPEC:
+        case MTTG_TRAV_NFP_SPEC:
+                if (trav->curr == trav->head)
+                        return 0;
+                target = list_entry(trav->curr, struct xt_target, list);
+                return (*target->name == '\0') ? 0 :
+                       seq_printf(seq, "%s\n", target->name);
+        }
+        return 0;
 }
 
 static const struct seq_operations xt_target_seq_ops = {
         .start  = xt_target_seq_start,
         .next   = xt_target_seq_next,
-        .stop   = xt_target_seq_stop,
+        .stop   = xt_mttg_seq_stop,
         .show   = xt_target_seq_show,
 };
 
 static int xt_target_open(struct inode *inode, struct file *file)
 {
+        struct seq_file *seq;
+        struct nf_mttg_trav *trav;
         int ret;
 
-        ret = seq_open(file, &xt_target_seq_ops);
-        if (!ret) {
-                struct seq_file *seq = file->private_data;
+        trav = kmalloc(sizeof(*trav), GFP_KERNEL);
+        if (trav == NULL)
+                return -ENOMEM;
 
-                seq->private = PDE(inode);
+        ret = seq_open(file, &xt_target_seq_ops);
+        if (ret < 0) {
+                kfree(trav);
+                return ret;
         }
-        return ret;
+
+        seq = file->private_data;
+        seq->private = trav;
+        trav->nfproto = (unsigned long)PDE(inode)->data;
+        return 0;
 }
 
 static const struct file_operations xt_target_ops = {
@@ -950,7 +1035,7 @@ static const struct file_operations xt_target_ops = {
         .open    = xt_target_open,
         .read    = seq_read,
         .llseek  = seq_lseek,
-        .release = seq_release,
+        .release = seq_release_private,
 };
 
 #define FORMAT_TABLES   "_tables_names"
diff --git a/net/netfilter/xt_recent.c b/net/netfilter/xt_recent.c
index fe80b614a400..791e030ea903 100644
--- a/net/netfilter/xt_recent.c
+++ b/net/netfilter/xt_recent.c
@@ -542,7 +542,7 @@ recent_mt_proc_write(struct file *file, const char __user *input,
         struct recent_entry *e;
         char buf[sizeof("+b335:1d35:1e55:dead:c0de:1715:5afe:c0de")];
         const char *c = buf;
-        union nf_inet_addr addr;
+        union nf_inet_addr addr = {};
         u_int16_t family;
         bool add, succ;
 
diff --git a/net/sched/sch_drr.c b/net/sched/sch_drr.c
index f6b4fa97df70..e36e94ab4e10 100644
--- a/net/sched/sch_drr.c
+++ b/net/sched/sch_drr.c
@@ -66,11 +66,15 @@ static int drr_change_class(struct Qdisc *sch, u32 classid, u32 parentid,
 {
         struct drr_sched *q = qdisc_priv(sch);
         struct drr_class *cl = (struct drr_class *)*arg;
+        struct nlattr *opt = tca[TCA_OPTIONS];
         struct nlattr *tb[TCA_DRR_MAX + 1];
         u32 quantum;
         int err;
 
-        err = nla_parse_nested(tb, TCA_DRR_MAX, tca[TCA_OPTIONS], drr_policy);
+        if (!opt)
+                return -EINVAL;
+
+        err = nla_parse_nested(tb, TCA_DRR_MAX, opt, drr_policy);
         if (err < 0)
                 return err;