Merge remote branch 'alsa/devel' into topic/hda

56 files changed, 533 insertions, 262 deletions

diff --git a/Documentation/sound/alsa/HD-Audio.txt b/Documentation/sound/alsa/HD-Audio.txt
index f4dd3bf99d12..bdb220c28315 100644
--- a/Documentation/sound/alsa/HD-Audio.txt
+++ b/Documentation/sound/alsa/HD-Audio.txt
@@ -196,7 +196,6 @@ generic parser regardless of the codec.  Usually the codec-specific
 parser is much better than the generic parser (as now).  Thus this
 option is more about the debugging purpose.
 
-
 Speaker and Headphone Output
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 One of the most frequent (and obvious) bugs with HD-audio is the
@@ -592,6 +591,9 @@ probing, the proc file is available, so you can get the raw codec
 information before modified by the driver.  Of course, the driver
 isn't usable with `probe_only=1`.  But you can continue the
 configuration via hwdep sysfs file if hda-reconfig option is enabled.
+Using `probe_only` mask 2 skips the reset of HDA codecs (use
+`probe_only=3` as module option). The hwdep interface can be used
+to determine the BIOS codec initialization.
 
 
 hda-verb
diff --git a/arch/x86/kernel/cpu/perf_event_amd.c b/arch/x86/kernel/cpu/perf_event_amd.c
index 573458f1caf2..b87e0b6970cb 100644
--- a/arch/x86/kernel/cpu/perf_event_amd.c
+++ b/arch/x86/kernel/cpu/perf_event_amd.c
@@ -348,10 +348,12 @@ static void amd_pmu_cpu_offline(int cpu)
 
         raw_spin_lock(&amd_nb_lock);
 
-        if (--cpuhw->amd_nb->refcnt == 0)
-                kfree(cpuhw->amd_nb);
+        if (cpuhw->amd_nb) {
+                if (--cpuhw->amd_nb->refcnt == 0)
+                        kfree(cpuhw->amd_nb);
 
-        cpuhw->amd_nb = NULL;
+                cpuhw->amd_nb = NULL;
+        }
 
         raw_spin_unlock(&amd_nb_lock);
 }
diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
index f404ccfc9c20..44288ce0cb45 100644
--- a/drivers/char/virtio_console.c
+++ b/drivers/char/virtio_console.c
@@ -681,6 +681,10 @@ static void resize_console(struct port *port)
         struct virtio_device *vdev;
         struct winsize ws;
 
+        /* The port could have been hot-unplugged */
+        if (!port)
+                return;
+
         vdev = port->portdev->vdev;
         if (virtio_has_feature(vdev, VIRTIO_CONSOLE_F_SIZE)) {
                 vdev->config->get(vdev,
@@ -947,11 +951,18 @@ static void handle_control_message(struct ports_device *portdev,
                  */
                 err = sysfs_create_group(&port->dev->kobj,
                                          &port_attribute_group);
-                if (err)
+                if (err) {
                         dev_err(port->dev,
                                 "Error %d creating sysfs device attributes\n",
                                 err);
-
+                } else {
+                        /*
+                         * Generate a udev event so that appropriate
+                         * symlinks can be created based on udev
+                         * rules.
+                         */
+                        kobject_uevent(&port->dev->kobj, KOBJ_CHANGE);
+                }
                 break;
         case VIRTIO_CONSOLE_PORT_REMOVE:
                 /*
diff --git a/drivers/edac/edac_mce_amd.c b/drivers/edac/edac_mce_amd.c
index 8fc91a019620..f5b6d9fe4def 100644
--- a/drivers/edac/edac_mce_amd.c
+++ b/drivers/edac/edac_mce_amd.c
@@ -316,7 +316,12 @@ void amd_decode_nb_mce(int node_id, struct err_regs *regs, int handle_errors)
                 if (regs->nbsh & K8_NBSH_ERR_CPU_VAL)
                         pr_cont(", core: %u\n", (u8)(regs->nbsh & 0xf));
         } else {
-                pr_cont(", core: %d\n", fls((regs->nbsh & 0xf) - 1));
+                u8 assoc_cpus = regs->nbsh & 0xf;
+
+                if (assoc_cpus > 0)
+                        pr_cont(", core: %d", fls(assoc_cpus) - 1);
+
+                pr_cont("\n");
         }
 
         pr_emerg("%s.\n", EXT_ERR_MSG(xec));
diff --git a/drivers/net/arm/ks8695net.c b/drivers/net/arm/ks8695net.c
index a1d4188c430b..e7810b74f396 100644
--- a/drivers/net/arm/ks8695net.c
+++ b/drivers/net/arm/ks8695net.c
@@ -449,11 +449,10 @@ ks8695_rx_irq(int irq, void *dev_id)
 }
 
 /**
- *      ks8695_rx - Receive packets  called by NAPI poll method
+ *      ks8695_rx - Receive packets called by NAPI poll method
  *      @ksp: Private data for the KS8695 Ethernet
- *      @budget: The max packets would be receive
+ *      @budget: Number of packets allowed to process
  */
-
 static int ks8695_rx(struct ks8695_priv *ksp, int budget)
 {
         struct net_device *ndev = ksp->ndev;
@@ -461,7 +460,6 @@ static int ks8695_rx(struct ks8695_priv *ksp, int budget)
         int buff_n;
         u32 flags;
         int pktlen;
-        int last_rx_processed = -1;
         int received = 0;
 
         buff_n = ksp->next_rx_desc_read;
@@ -471,6 +469,7 @@ static int ks8695_rx(struct ks8695_priv *ksp, int budget)
                                         cpu_to_le32(RDES_OWN)))) {
                         rmb();
                         flags = le32_to_cpu(ksp->rx_ring[buff_n].status);
+
                         /* Found an SKB which we own, this means we
                          * received a packet
                          */
@@ -533,23 +532,18 @@ rx_failure:
                         ksp->rx_ring[buff_n].status = cpu_to_le32(RDES_OWN);
 rx_finished:
                         received++;
-                        /* And note this as processed so we can start
-                         * from here next time
-                         */
-                        last_rx_processed = buff_n;
                         buff_n = (buff_n + 1) & MAX_RX_DESC_MASK;
-                        /*And note which RX descriptor we last did */
-                        if (likely(last_rx_processed != -1))
-                                ksp->next_rx_desc_read =
-                                        (last_rx_processed + 1) &
-                                        MAX_RX_DESC_MASK;
         }
+
+        /* And note which RX descriptor we last did */
+        ksp->next_rx_desc_read = buff_n;
+
         /* And refill the buffers */
         ks8695_refill_rxbuffers(ksp);
 
-        /* Kick the RX DMA engine, in case it became
-         *  suspended */
+        /* Kick the RX DMA engine, in case it became suspended */
         ks8695_writereg(ksp, KS8695_DRSC, 0);
+
         return received;
 }
 
diff --git a/drivers/net/igb/e1000_82575.c b/drivers/net/igb/e1000_82575.c
index 9d7fa2fb85ea..0bc990ec4a8e 100644
--- a/drivers/net/igb/e1000_82575.c
+++ b/drivers/net/igb/e1000_82575.c
@@ -94,6 +94,7 @@ static s32 igb_get_invariants_82575(struct e1000_hw *hw)
         case E1000_DEV_ID_82576_FIBER:
         case E1000_DEV_ID_82576_SERDES:
         case E1000_DEV_ID_82576_QUAD_COPPER:
+        case E1000_DEV_ID_82576_QUAD_COPPER_ET2:
         case E1000_DEV_ID_82576_SERDES_QUAD:
                 mac->type = e1000_82576;
                 break;
diff --git a/drivers/net/igb/e1000_hw.h b/drivers/net/igb/e1000_hw.h
index 448005276b26..82a533f5192a 100644
--- a/drivers/net/igb/e1000_hw.h
+++ b/drivers/net/igb/e1000_hw.h
@@ -41,6 +41,7 @@ struct e1000_hw;
 #define E1000_DEV_ID_82576_FIBER              0x10E6
 #define E1000_DEV_ID_82576_SERDES             0x10E7
 #define E1000_DEV_ID_82576_QUAD_COPPER        0x10E8
+#define E1000_DEV_ID_82576_QUAD_COPPER_ET2    0x1526
 #define E1000_DEV_ID_82576_NS                 0x150A
 #define E1000_DEV_ID_82576_NS_SERDES          0x1518
 #define E1000_DEV_ID_82576_SERDES_QUAD        0x150D
diff --git a/drivers/net/igb/igb_main.c b/drivers/net/igb/igb_main.c
index 0ed25f059a00..45a0e4fd5871 100644
--- a/drivers/net/igb/igb_main.c
+++ b/drivers/net/igb/igb_main.c
@@ -72,6 +72,7 @@ static DEFINE_PCI_DEVICE_TABLE(igb_pci_tbl) = {
         { PCI_VDEVICE(INTEL, E1000_DEV_ID_82576_FIBER), board_82575 },
         { PCI_VDEVICE(INTEL, E1000_DEV_ID_82576_SERDES), board_82575 },
         { PCI_VDEVICE(INTEL, E1000_DEV_ID_82576_SERDES_QUAD), board_82575 },
+        { PCI_VDEVICE(INTEL, E1000_DEV_ID_82576_QUAD_COPPER_ET2), board_82575 },
         { PCI_VDEVICE(INTEL, E1000_DEV_ID_82576_QUAD_COPPER), board_82575 },
         { PCI_VDEVICE(INTEL, E1000_DEV_ID_82575EB_COPPER), board_82575 },
         { PCI_VDEVICE(INTEL, E1000_DEV_ID_82575EB_FIBER_SERDES), board_82575 },
diff --git a/drivers/net/ixgbe/ixgbe_82599.c b/drivers/net/ixgbe/ixgbe_82599.c
index 1f30e163bd9c..b405a00817c6 100644
--- a/drivers/net/ixgbe/ixgbe_82599.c
+++ b/drivers/net/ixgbe/ixgbe_82599.c
@@ -39,6 +39,7 @@
 #define IXGBE_82599_MC_TBL_SIZE   128
 #define IXGBE_82599_VFT_TBL_SIZE  128
 
+void ixgbe_flap_tx_laser_multispeed_fiber(struct ixgbe_hw *hw);
 s32 ixgbe_setup_mac_link_multispeed_fiber(struct ixgbe_hw *hw,
                                           ixgbe_link_speed speed,
                                           bool autoneg,
@@ -68,7 +69,9 @@ static void ixgbe_init_mac_link_ops_82599(struct ixgbe_hw *hw)
         if (hw->phy.multispeed_fiber) {
                 /* Set up dual speed SFP+ support */
                 mac->ops.setup_link = &ixgbe_setup_mac_link_multispeed_fiber;
+                mac->ops.flap_tx_laser = &ixgbe_flap_tx_laser_multispeed_fiber;
         } else {
+                mac->ops.flap_tx_laser = NULL;
                 if ((mac->ops.get_media_type(hw) ==
                      ixgbe_media_type_backplane) &&
                     (hw->phy.smart_speed == ixgbe_smart_speed_auto ||
@@ -413,6 +416,41 @@ s32 ixgbe_start_mac_link_82599(struct ixgbe_hw *hw,
 }
 
 /**
+ *  ixgbe_flap_tx_laser_multispeed_fiber - Flap Tx laser
+ *  @hw: pointer to hardware structure
+ *
+ *  When the driver changes the link speeds that it can support,
+ *  it sets autotry_restart to true to indicate that we need to
+ *  initiate a new autotry session with the link partner.  To do
+ *  so, we set the speed then disable and re-enable the tx laser, to
+ *  alert the link partner that it also needs to restart autotry on its
+ *  end.  This is consistent with true clause 37 autoneg, which also
+ *  involves a loss of signal.
+ **/
+void ixgbe_flap_tx_laser_multispeed_fiber(struct ixgbe_hw *hw)
+{
+        u32 esdp_reg = IXGBE_READ_REG(hw, IXGBE_ESDP);
+
+        hw_dbg(hw, "ixgbe_flap_tx_laser_multispeed_fiber\n");
+
+        if (hw->mac.autotry_restart) {
+                /* Disable tx laser; allow 100us to go dark per spec */
+                esdp_reg |= IXGBE_ESDP_SDP3;
+                IXGBE_WRITE_REG(hw, IXGBE_ESDP, esdp_reg);
+                IXGBE_WRITE_FLUSH(hw);
+                udelay(100);
+
+                /* Enable tx laser; allow 100ms to light up */
+                esdp_reg &= ~IXGBE_ESDP_SDP3;
+                IXGBE_WRITE_REG(hw, IXGBE_ESDP, esdp_reg);
+                IXGBE_WRITE_FLUSH(hw);
+                msleep(100);
+
+                hw->mac.autotry_restart = false;
+        }
+}
+
+/**
  *  ixgbe_setup_mac_link_multispeed_fiber - Set MAC link speed
  *  @hw: pointer to hardware structure
  *  @speed: new link speed
@@ -440,16 +478,6 @@ s32 ixgbe_setup_mac_link_multispeed_fiber(struct ixgbe_hw *hw,
         speed &= phy_link_speed;
 
         /*
-         * When the driver changes the link speeds that it can support,
-         * it sets autotry_restart to true to indicate that we need to
-         * initiate a new autotry session with the link partner.  To do
-         * so, we set the speed then disable and re-enable the tx laser, to
-         * alert the link partner that it also needs to restart autotry on its
-         * end.  This is consistent with true clause 37 autoneg, which also
-         * involves a loss of signal.
-         */
-
-        /*
          * Try each speed one by one, highest priority first.  We do this in
          * software because 10gb fiber doesn't support speed autonegotiation.
          */
@@ -466,6 +494,7 @@ s32 ixgbe_setup_mac_link_multispeed_fiber(struct ixgbe_hw *hw,
                 /* Set the module link speed */
                 esdp_reg |= (IXGBE_ESDP_SDP5_DIR | IXGBE_ESDP_SDP5);
                 IXGBE_WRITE_REG(hw, IXGBE_ESDP, esdp_reg);
+                IXGBE_WRITE_FLUSH(hw);
 
                 /* Allow module to change analog characteristics (1G->10G) */
                 msleep(40);
@@ -478,19 +507,7 @@ s32 ixgbe_setup_mac_link_multispeed_fiber(struct ixgbe_hw *hw,
                         return status;
 
                 /* Flap the tx laser if it has not already been done */
-                if (hw->mac.autotry_restart) {
-                        /* Disable tx laser; allow 100us to go dark per spec */
-                        esdp_reg |= IXGBE_ESDP_SDP3;
-                        IXGBE_WRITE_REG(hw, IXGBE_ESDP, esdp_reg);
-                        udelay(100);
-
-                        /* Enable tx laser; allow 2ms to light up per spec */
-                        esdp_reg &= ~IXGBE_ESDP_SDP3;
-                        IXGBE_WRITE_REG(hw, IXGBE_ESDP, esdp_reg);
-                        msleep(2);
-
-                        hw->mac.autotry_restart = false;
-                }
+                hw->mac.ops.flap_tx_laser(hw);
 
                 /*
                  * Wait for the controller to acquire link.  Per IEEE 802.3ap,
@@ -525,6 +542,7 @@ s32 ixgbe_setup_mac_link_multispeed_fiber(struct ixgbe_hw *hw,
                 esdp_reg &= ~IXGBE_ESDP_SDP5;
                 esdp_reg |= IXGBE_ESDP_SDP5_DIR;
                 IXGBE_WRITE_REG(hw, IXGBE_ESDP, esdp_reg);
+                IXGBE_WRITE_FLUSH(hw);
 
                 /* Allow module to change analog characteristics (10G->1G) */
                 msleep(40);
@@ -537,19 +555,7 @@ s32 ixgbe_setup_mac_link_multispeed_fiber(struct ixgbe_hw *hw,
                         return status;
 
                 /* Flap the tx laser if it has not already been done */
-                if (hw->mac.autotry_restart) {
-                        /* Disable tx laser; allow 100us to go dark per spec */
-                        esdp_reg |= IXGBE_ESDP_SDP3;
-                        IXGBE_WRITE_REG(hw, IXGBE_ESDP, esdp_reg);
-                        udelay(100);
-
-                        /* Enable tx laser; allow 2ms to light up per spec */
-                        esdp_reg &= ~IXGBE_ESDP_SDP3;
-                        IXGBE_WRITE_REG(hw, IXGBE_ESDP, esdp_reg);
-                        msleep(2);
-
-                        hw->mac.autotry_restart = false;
-                }
+                hw->mac.ops.flap_tx_laser(hw);
 
                 /* Wait for the link partner to also set speed */
                 msleep(100);
diff --git a/drivers/net/ixgbe/ixgbe_fcoe.c b/drivers/net/ixgbe/ixgbe_fcoe.c
index 4123dec0dfb7..700cfc0aa1b9 100644
--- a/drivers/net/ixgbe/ixgbe_fcoe.c
+++ b/drivers/net/ixgbe/ixgbe_fcoe.c
@@ -614,9 +614,9 @@ int ixgbe_fcoe_enable(struct net_device *netdev)
         netdev->vlan_features |= NETIF_F_FSO;
         netdev->vlan_features |= NETIF_F_FCOE_MTU;
         netdev->fcoe_ddp_xid = IXGBE_FCOE_DDP_MAX - 1;
-        netdev_features_change(netdev);
 
         ixgbe_init_interrupt_scheme(adapter);
+        netdev_features_change(netdev);
 
         if (netif_running(netdev))
                 netdev->netdev_ops->ndo_open(netdev);
@@ -660,11 +660,11 @@ int ixgbe_fcoe_disable(struct net_device *netdev)
         netdev->vlan_features &= ~NETIF_F_FSO;
         netdev->vlan_features &= ~NETIF_F_FCOE_MTU;
         netdev->fcoe_ddp_xid = 0;
-        netdev_features_change(netdev);
 
         ixgbe_cleanup_fcoe(adapter);
-
         ixgbe_init_interrupt_scheme(adapter);
+        netdev_features_change(netdev);
+
         if (netif_running(netdev))
                 netdev->netdev_ops->ndo_open(netdev);
         rc = 0;
diff --git a/drivers/net/ixgbe/ixgbe_main.c b/drivers/net/ixgbe/ixgbe_main.c
index 684af371462d..d75c46ff31f6 100644
--- a/drivers/net/ixgbe/ixgbe_main.c
+++ b/drivers/net/ixgbe/ixgbe_main.c
@@ -935,10 +935,12 @@ static bool ixgbe_clean_rx_irq(struct ixgbe_q_vector *q_vector,
                         if (skb->prev)
                                 skb = ixgbe_transform_rsc_queue(skb, &(rx_ring->rsc_count));
                         if (adapter->flags2 & IXGBE_FLAG2_RSC_ENABLED) {
-                                if (IXGBE_RSC_CB(skb)->dma)
+                                if (IXGBE_RSC_CB(skb)->dma) {
                                         pci_unmap_single(pdev, IXGBE_RSC_CB(skb)->dma,
                                                          rx_ring->rx_buf_len,
                                                          PCI_DMA_FROMDEVICE);
+                                        IXGBE_RSC_CB(skb)->dma = 0;
+                                }
                                 if (rx_ring->flags & IXGBE_RING_RX_PS_ENABLED)
                                         rx_ring->rsc_count += skb_shinfo(skb)->nr_frags;
                                 else
@@ -3126,10 +3128,12 @@ static void ixgbe_clean_rx_ring(struct ixgbe_adapter *adapter,
                         rx_buffer_info->skb = NULL;
                         do {
                                 struct sk_buff *this = skb;
-                                if (IXGBE_RSC_CB(this)->dma)
+                                if (IXGBE_RSC_CB(this)->dma) {
                                         pci_unmap_single(pdev, IXGBE_RSC_CB(this)->dma,
                                                          rx_ring->rx_buf_len,
                                                          PCI_DMA_FROMDEVICE);
+                                        IXGBE_RSC_CB(this)->dma = 0;
+                                }
                                 skb = skb->prev;
                                 dev_kfree_skb(this);
                         } while (skb);
@@ -5018,6 +5022,7 @@ static void ixgbe_multispeed_fiber_task(struct work_struct *work)
         autoneg = hw->phy.autoneg_advertised;
         if ((!autoneg) && (hw->mac.ops.get_link_capabilities))
                 hw->mac.ops.get_link_capabilities(hw, &autoneg, &negotiation);
+        hw->mac.autotry_restart = false;
         if (hw->mac.ops.setup_link)
                 hw->mac.ops.setup_link(hw, autoneg, negotiation, true);
         adapter->flags |= IXGBE_FLAG_NEED_LINK_UPDATE;
@@ -6245,9 +6250,6 @@ static int __devinit ixgbe_probe(struct pci_dev *pdev,
         case IXGBE_DEV_ID_82599_KX4:
                 adapter->wol = (IXGBE_WUFC_MAG | IXGBE_WUFC_EX |
                                 IXGBE_WUFC_MC | IXGBE_WUFC_BC);
-                /* Enable ACPI wakeup in GRC */
-                IXGBE_WRITE_REG(hw, IXGBE_GRC,
-                             (IXGBE_READ_REG(hw, IXGBE_GRC) & ~IXGBE_GRC_APME));
                 break;
         default:
                 adapter->wol = 0;
@@ -6380,6 +6382,16 @@ static void __devexit ixgbe_remove(struct pci_dev *pdev)
         del_timer_sync(&adapter->sfp_timer);
         cancel_work_sync(&adapter->watchdog_task);
         cancel_work_sync(&adapter->sfp_task);
+        if (adapter->hw.phy.multispeed_fiber) {
+                struct ixgbe_hw *hw = &adapter->hw;
+                /*
+                 * Restart clause 37 autoneg, disable and re-enable
+                 * the tx laser, to clear & alert the link partner
+                 * that it needs to restart autotry
+                 */
+                hw->mac.autotry_restart = true;
+                hw->mac.ops.flap_tx_laser(hw);
+        }
         cancel_work_sync(&adapter->multispeed_fiber_task);
         cancel_work_sync(&adapter->sfp_config_module_task);
         if (adapter->flags & IXGBE_FLAG_FDIR_HASH_CAPABLE ||
diff --git a/drivers/net/ixgbe/ixgbe_type.h b/drivers/net/ixgbe/ixgbe_type.h
index 2be907466593..0ed5ab37cc53 100644
--- a/drivers/net/ixgbe/ixgbe_type.h
+++ b/drivers/net/ixgbe/ixgbe_type.h
@@ -2397,6 +2397,7 @@ struct ixgbe_mac_operations {
         s32 (*enable_rx_dma)(struct ixgbe_hw *, u32);
 
         /* Link */
+        void (*flap_tx_laser)(struct ixgbe_hw *);
         s32 (*setup_link)(struct ixgbe_hw *, ixgbe_link_speed, bool, bool);
         s32 (*check_link)(struct ixgbe_hw *, ixgbe_link_speed *, bool *, bool);
         s32 (*get_link_capabilities)(struct ixgbe_hw *, ixgbe_link_speed *,
diff --git a/drivers/net/ixgbevf/ethtool.c b/drivers/net/ixgbevf/ethtool.c
index 399be0c34c36..6fdd651abcd1 100644
--- a/drivers/net/ixgbevf/ethtool.c
+++ b/drivers/net/ixgbevf/ethtool.c
@@ -46,22 +46,32 @@ struct ixgbe_stats {
         int sizeof_stat;
         int stat_offset;
         int base_stat_offset;
+        int saved_reset_offset;
 };
 
-#define IXGBEVF_STAT(m, b)  sizeof(((struct ixgbevf_adapter *)0)->m), \
-                            offsetof(struct ixgbevf_adapter, m),      \
-                            offsetof(struct ixgbevf_adapter, b)
+#define IXGBEVF_STAT(m, b, r)  sizeof(((struct ixgbevf_adapter *)0)->m), \
+                            offsetof(struct ixgbevf_adapter, m),         \
+                            offsetof(struct ixgbevf_adapter, b),         \
+                            offsetof(struct ixgbevf_adapter, r)
 static struct ixgbe_stats ixgbe_gstrings_stats[] = {
-        {"rx_packets", IXGBEVF_STAT(stats.vfgprc, stats.base_vfgprc)},
-        {"tx_packets", IXGBEVF_STAT(stats.vfgptc, stats.base_vfgptc)},
-        {"rx_bytes", IXGBEVF_STAT(stats.vfgorc, stats.base_vfgorc)},
-        {"tx_bytes", IXGBEVF_STAT(stats.vfgotc, stats.base_vfgotc)},
-        {"tx_busy", IXGBEVF_STAT(tx_busy, zero_base)},
-        {"multicast", IXGBEVF_STAT(stats.vfmprc, stats.base_vfmprc)},
-        {"rx_csum_offload_good", IXGBEVF_STAT(hw_csum_rx_good, zero_base)},
-        {"rx_csum_offload_errors", IXGBEVF_STAT(hw_csum_rx_error, zero_base)},
-        {"tx_csum_offload_ctxt", IXGBEVF_STAT(hw_csum_tx_good, zero_base)},
-        {"rx_header_split", IXGBEVF_STAT(rx_hdr_split, zero_base)},
+        {"rx_packets", IXGBEVF_STAT(stats.vfgprc, stats.base_vfgprc,
+                                    stats.saved_reset_vfgprc)},
+        {"tx_packets", IXGBEVF_STAT(stats.vfgptc, stats.base_vfgptc,
+                                    stats.saved_reset_vfgptc)},
+        {"rx_bytes", IXGBEVF_STAT(stats.vfgorc, stats.base_vfgorc,
+                                  stats.saved_reset_vfgorc)},
+        {"tx_bytes", IXGBEVF_STAT(stats.vfgotc, stats.base_vfgotc,
+                                  stats.saved_reset_vfgotc)},
+        {"tx_busy", IXGBEVF_STAT(tx_busy, zero_base, zero_base)},
+        {"multicast", IXGBEVF_STAT(stats.vfmprc, stats.base_vfmprc,
+                                   stats.saved_reset_vfmprc)},
+        {"rx_csum_offload_good", IXGBEVF_STAT(hw_csum_rx_good, zero_base,
+                                              zero_base)},
+        {"rx_csum_offload_errors", IXGBEVF_STAT(hw_csum_rx_error, zero_base,
+                                                zero_base)},
+        {"tx_csum_offload_ctxt", IXGBEVF_STAT(hw_csum_tx_good, zero_base,
+                                              zero_base)},
+        {"rx_header_split", IXGBEVF_STAT(rx_hdr_split, zero_base, zero_base)},
 };
 
 #define IXGBE_QUEUE_STATS_LEN 0
@@ -455,10 +465,14 @@ static void ixgbevf_get_ethtool_stats(struct net_device *netdev,
                         ixgbe_gstrings_stats[i].stat_offset;
                 char *b = (char *)adapter +
                         ixgbe_gstrings_stats[i].base_stat_offset;
+                char *r = (char *)adapter +
+                        ixgbe_gstrings_stats[i].saved_reset_offset;
                 data[i] = ((ixgbe_gstrings_stats[i].sizeof_stat ==
                             sizeof(u64)) ? *(u64 *)p : *(u32 *)p) -
                           ((ixgbe_gstrings_stats[i].sizeof_stat ==
-                            sizeof(u64)) ? *(u64 *)b : *(u32 *)b);
+                            sizeof(u64)) ? *(u64 *)b : *(u32 *)b) +
+                          ((ixgbe_gstrings_stats[i].sizeof_stat ==
+                            sizeof(u64)) ? *(u64 *)r : *(u32 *)r);
         }
 }
 
diff --git a/drivers/net/ixgbevf/ixgbevf_main.c b/drivers/net/ixgbevf/ixgbevf_main.c
index ca653c49b765..d6cbd943a6f0 100644
--- a/drivers/net/ixgbevf/ixgbevf_main.c
+++ b/drivers/net/ixgbevf/ixgbevf_main.c
@@ -965,7 +965,7 @@ static irqreturn_t ixgbevf_msix_mbx(int irq, void *data)
 
         if ((msg & IXGBE_MBVFICR_VFREQ_MASK) == IXGBE_PF_CONTROL_MSG)
                 mod_timer(&adapter->watchdog_timer,
-                          round_jiffies(jiffies + 10));
+                          round_jiffies(jiffies + 1));
 
         return IRQ_HANDLED;
 }
@@ -1610,6 +1610,44 @@ static inline void ixgbevf_rx_desc_queue_enable(struct ixgbevf_adapter *adapter,
                                 (adapter->rx_ring[rxr].count - 1));
 }
 
+static void ixgbevf_save_reset_stats(struct ixgbevf_adapter *adapter)
+{
+        /* Only save pre-reset stats if there are some */
+        if (adapter->stats.vfgprc || adapter->stats.vfgptc) {
+                adapter->stats.saved_reset_vfgprc += adapter->stats.vfgprc -
+                        adapter->stats.base_vfgprc;
+                adapter->stats.saved_reset_vfgptc += adapter->stats.vfgptc -
+                        adapter->stats.base_vfgptc;
+                adapter->stats.saved_reset_vfgorc += adapter->stats.vfgorc -
+                        adapter->stats.base_vfgorc;
+                adapter->stats.saved_reset_vfgotc += adapter->stats.vfgotc -
+                        adapter->stats.base_vfgotc;
+                adapter->stats.saved_reset_vfmprc += adapter->stats.vfmprc -
+                        adapter->stats.base_vfmprc;
+        }
+}
+
+static void ixgbevf_init_last_counter_stats(struct ixgbevf_adapter *adapter)
+{
+        struct ixgbe_hw *hw = &adapter->hw;
+
+        adapter->stats.last_vfgprc = IXGBE_READ_REG(hw, IXGBE_VFGPRC);
+        adapter->stats.last_vfgorc = IXGBE_READ_REG(hw, IXGBE_VFGORC_LSB);
+        adapter->stats.last_vfgorc |=
+                (((u64)(IXGBE_READ_REG(hw, IXGBE_VFGORC_MSB))) << 32);
+        adapter->stats.last_vfgptc = IXGBE_READ_REG(hw, IXGBE_VFGPTC);
+        adapter->stats.last_vfgotc = IXGBE_READ_REG(hw, IXGBE_VFGOTC_LSB);
+        adapter->stats.last_vfgotc |=
+                (((u64)(IXGBE_READ_REG(hw, IXGBE_VFGOTC_MSB))) << 32);
+        adapter->stats.last_vfmprc = IXGBE_READ_REG(hw, IXGBE_VFMPRC);
+
+        adapter->stats.base_vfgprc = adapter->stats.last_vfgprc;
+        adapter->stats.base_vfgorc = adapter->stats.last_vfgorc;
+        adapter->stats.base_vfgptc = adapter->stats.last_vfgptc;
+        adapter->stats.base_vfgotc = adapter->stats.last_vfgotc;
+        adapter->stats.base_vfmprc = adapter->stats.last_vfmprc;
+}
+
 static int ixgbevf_up_complete(struct ixgbevf_adapter *adapter)
 {
         struct net_device *netdev = adapter->netdev;
@@ -1656,6 +1694,9 @@ static int ixgbevf_up_complete(struct ixgbevf_adapter *adapter)
         /* enable transmits */
         netif_tx_start_all_queues(netdev);
 
+        ixgbevf_save_reset_stats(adapter);
+        ixgbevf_init_last_counter_stats(adapter);
+
         /* bring the link up in the watchdog, this could race with our first
          * link up interrupt but shouldn't be a problem */
         adapter->flags |= IXGBE_FLAG_NEED_LINK_UPDATE;
@@ -2228,27 +2269,6 @@ out:
         return err;
 }
 
-static void ixgbevf_init_last_counter_stats(struct ixgbevf_adapter *adapter)
-{
-        struct ixgbe_hw *hw = &adapter->hw;
-
-        adapter->stats.last_vfgprc = IXGBE_READ_REG(hw, IXGBE_VFGPRC);
-        adapter->stats.last_vfgorc = IXGBE_READ_REG(hw, IXGBE_VFGORC_LSB);
-        adapter->stats.last_vfgorc |=
-                (((u64)(IXGBE_READ_REG(hw, IXGBE_VFGORC_MSB))) << 32);
-        adapter->stats.last_vfgptc = IXGBE_READ_REG(hw, IXGBE_VFGPTC);
-        adapter->stats.last_vfgotc = IXGBE_READ_REG(hw, IXGBE_VFGOTC_LSB);
-        adapter->stats.last_vfgotc |=
-                (((u64)(IXGBE_READ_REG(hw, IXGBE_VFGOTC_MSB))) << 32);
-        adapter->stats.last_vfmprc = IXGBE_READ_REG(hw, IXGBE_VFMPRC);
-
-        adapter->stats.base_vfgprc = adapter->stats.last_vfgprc;
-        adapter->stats.base_vfgorc = adapter->stats.last_vfgorc;
-        adapter->stats.base_vfgptc = adapter->stats.last_vfgptc;
-        adapter->stats.base_vfgotc = adapter->stats.last_vfgotc;
-        adapter->stats.base_vfmprc = adapter->stats.last_vfmprc;
-}
-
 #define UPDATE_VF_COUNTER_32bit(reg, last_counter, counter)     \
         {                                                       \
                 u32 current_counter = IXGBE_READ_REG(hw, reg);  \
@@ -2399,7 +2419,7 @@ static void ixgbevf_watchdog_task(struct work_struct *work)
                 if (!netif_carrier_ok(netdev)) {
                         hw_dbg(&adapter->hw, "NIC Link is Up %s, ",
                                ((link_speed == IXGBE_LINK_SPEED_10GB_FULL) ?
-                                "10 Gbps" : "1 Gbps"));
+                                "10 Gbps\n" : "1 Gbps\n"));
                         netif_carrier_on(netdev);
                         netif_tx_wake_all_queues(netdev);
                 } else {
@@ -2416,9 +2436,9 @@ static void ixgbevf_watchdog_task(struct work_struct *work)
                 }
         }
 
-pf_has_reset:
         ixgbevf_update_stats(adapter);
 
+pf_has_reset:
         /* Force detection of hung controller every watchdog period */
         adapter->detect_tx_hung = true;
 
@@ -2675,7 +2695,7 @@ static int ixgbevf_open(struct net_device *netdev)
                 if (hw->adapter_stopped) {
                         err = IXGBE_ERR_MBX;
                         printk(KERN_ERR "Unable to start - perhaps the PF"
-                               "Driver isn't up yet\n");
+                               " Driver isn't up yet\n");
                         goto err_setup_reset;
                 }
         }
@@ -3390,8 +3410,6 @@ static int __devinit ixgbevf_probe(struct pci_dev *pdev,
         /* setup the private structure */
         err = ixgbevf_sw_init(adapter);
 
-        ixgbevf_init_last_counter_stats(adapter);
-
 #ifdef MAX_SKB_FRAGS
         netdev->features = NETIF_F_SG |
                            NETIF_F_IP_CSUM |
@@ -3449,6 +3467,8 @@ static int __devinit ixgbevf_probe(struct pci_dev *pdev,
 
         adapter->netdev_registered = true;
 
+        ixgbevf_init_last_counter_stats(adapter);
+
         /* print the MAC address */
         hw_dbg(hw, "%2.2x:%2.2x:%2.2x:%2.2x:%2.2x:%2.2x\n",
                netdev->dev_addr[0],
diff --git a/drivers/net/ixgbevf/vf.h b/drivers/net/ixgbevf/vf.h
index 799600e92700..1f31b052d4b4 100644
--- a/drivers/net/ixgbevf/vf.h
+++ b/drivers/net/ixgbevf/vf.h
@@ -157,6 +157,12 @@ struct ixgbevf_hw_stats {
         u64 vfgorc;
         u64 vfgotc;
         u64 vfmprc;
+
+        u64 saved_reset_vfgprc;
+        u64 saved_reset_vfgptc;
+        u64 saved_reset_vfgorc;
+        u64 saved_reset_vfgotc;
+        u64 saved_reset_vfmprc;
 };
 
 struct ixgbevf_info {
diff --git a/drivers/net/jme.c b/drivers/net/jme.c
index 0f31497833df..c0b59a555384 100644
--- a/drivers/net/jme.c
+++ b/drivers/net/jme.c
@@ -946,6 +946,8 @@ jme_alloc_and_feed_skb(struct jme_adapter *jme, int idx)
                                 jme->jme_vlan_rx(skb, jme->vlgrp,
                                         le16_to_cpu(rxdesc->descwb.vlan));
                                 NET_STAT(jme).rx_bytes += 4;
+                        } else {
+                                dev_kfree_skb(skb);
                         }
                 } else {
                         jme->jme_rx(skb);
@@ -2081,12 +2083,45 @@ jme_tx_timeout(struct net_device *netdev)
         jme_reset_link(jme);
 }
 
+static inline void jme_pause_rx(struct jme_adapter *jme)
+{
+        atomic_dec(&jme->link_changing);
+
+        jme_set_rx_pcc(jme, PCC_OFF);
+        if (test_bit(JME_FLAG_POLL, &jme->flags)) {
+                JME_NAPI_DISABLE(jme);
+        } else {
+                tasklet_disable(&jme->rxclean_task);
+                tasklet_disable(&jme->rxempty_task);
+        }
+}
+
+static inline void jme_resume_rx(struct jme_adapter *jme)
+{
+        struct dynpcc_info *dpi = &(jme->dpi);
+
+        if (test_bit(JME_FLAG_POLL, &jme->flags)) {
+                JME_NAPI_ENABLE(jme);
+        } else {
+                tasklet_hi_enable(&jme->rxclean_task);
+                tasklet_hi_enable(&jme->rxempty_task);
+        }
+        dpi->cur                = PCC_P1;
+        dpi->attempt            = PCC_P1;
+        dpi->cnt                = 0;
+        jme_set_rx_pcc(jme, PCC_P1);
+
+        atomic_inc(&jme->link_changing);
+}
+
 static void
 jme_vlan_rx_register(struct net_device *netdev, struct vlan_group *grp)
 {
         struct jme_adapter *jme = netdev_priv(netdev);
 
+        jme_pause_rx(jme);
         jme->vlgrp = grp;
+        jme_resume_rx(jme);
 }
 
 static void
diff --git a/drivers/net/jme.h b/drivers/net/jme.h
index c19db9146a2f..07ad3a457185 100644
--- a/drivers/net/jme.h
+++ b/drivers/net/jme.h
@@ -25,7 +25,7 @@
 #define __JME_H_INCLUDED__
 
 #define DRV_NAME        "jme"
-#define DRV_VERSION     "1.0.5"
+#define DRV_VERSION     "1.0.6"
 #define PFX             DRV_NAME ": "
 
 #define PCI_DEVICE_ID_JMICRON_JMC250    0x0250
diff --git a/drivers/net/ks8851.c b/drivers/net/ks8851.c
index 0573e0bb4444..13cc1ca261d9 100644
--- a/drivers/net/ks8851.c
+++ b/drivers/net/ks8851.c
@@ -976,7 +976,6 @@ static void ks8851_set_rx_mode(struct net_device *dev)
                         crc >>= (32 - 6);  /* get top six bits */
 
                         rxctrl.mchash[crc >> 4] |= (1 << (crc & 0xf));
-                        mcptr = mcptr->next;
                 }
 
                 rxctrl.rxcr1 = RXCR1_RXME | RXCR1_RXPAFMA;
diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c
index d222d7e25273..73f9a31cf94d 100644
--- a/drivers/net/usb/smsc95xx.c
+++ b/drivers/net/usb/smsc95xx.c
@@ -1189,9 +1189,21 @@ static struct sk_buff *smsc95xx_tx_fixup(struct usbnet *dev,
         }
 
         if (csum) {
-                u32 csum_preamble = smsc95xx_calc_csum_preamble(skb);
-                skb_push(skb, 4);
-                memcpy(skb->data, &csum_preamble, 4);
+                if (skb->len <= 45) {
+                        /* workaround - hardware tx checksum does not work
+                         * properly with extremely small packets */
+                        long csstart = skb->csum_start - skb_headroom(skb);
+                        __wsum calc = csum_partial(skb->data + csstart,
+                                skb->len - csstart, 0);
+                        *((__sum16 *)(skb->data + csstart
+                                + skb->csum_offset)) = csum_fold(calc);
+
+                        csum = false;
+                } else {
+                        u32 csum_preamble = smsc95xx_calc_csum_preamble(skb);
+                        skb_push(skb, 4);
+                        memcpy(skb->data, &csum_preamble, 4);
+                }
         }
 
         skb_push(skb, 4);
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index b2c8207f7bc1..294b486bc3ed 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -1353,25 +1353,6 @@ static enum ath9k_pkt_type get_hw_packet_type(struct sk_buff *skb)
         return htype;
 }
 
-static bool is_pae(struct sk_buff *skb)
-{
-        struct ieee80211_hdr *hdr;
-        __le16 fc;
-
-        hdr = (struct ieee80211_hdr *)skb->data;
-        fc = hdr->frame_control;
-
-        if (ieee80211_is_data(fc)) {
-                if (ieee80211_is_nullfunc(fc) ||
-                    /* Port Access Entity (IEEE 802.1X) */
-                    (skb->protocol == cpu_to_be16(ETH_P_PAE))) {
-                        return true;
-                }
-        }
-
-        return false;
-}
-
 static int get_hw_crypto_keytype(struct sk_buff *skb)
 {
         struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
@@ -1696,7 +1677,7 @@ static void ath_tx_start_dma(struct ath_softc *sc, struct ath_buf *bf,
                         goto tx_done;
                 }
 
-                if ((tx_info->flags & IEEE80211_TX_CTL_AMPDU) && !is_pae(skb)) {
+                if (tx_info->flags & IEEE80211_TX_CTL_AMPDU) {
                         /*
                          * Try aggregation if it's a unicast data frame
                          * and the destination is HT capable.
diff --git a/drivers/net/wireless/iwlwifi/iwl-tx.c b/drivers/net/wireless/iwlwifi/iwl-tx.c
index 1ed5206721ec..8c12311dbb0a 100644
--- a/drivers/net/wireless/iwlwifi/iwl-tx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-tx.c
@@ -124,7 +124,7 @@ void iwl_free_tfds_in_queue(struct iwl_priv *priv,
         if (priv->stations[sta_id].tid[tid].tfds_in_queue >= freed)
                 priv->stations[sta_id].tid[tid].tfds_in_queue -= freed;
         else {
-                IWL_ERR(priv, "free more than tfds_in_queue (%u:%d)\n",
+                IWL_DEBUG_TX(priv, "free more than tfds_in_queue (%u:%d)\n",
                         priv->stations[sta_id].tid[tid].tfds_in_queue,
                         freed);
                 priv->stations[sta_id].tid[tid].tfds_in_queue = 0;
diff --git a/drivers/net/wireless/wl12xx/wl1251_debugfs.c b/drivers/net/wireless/wl12xx/wl1251_debugfs.c
index 0ccba57fb9fb..05e4d68eb4cc 100644
--- a/drivers/net/wireless/wl12xx/wl1251_debugfs.c
+++ b/drivers/net/wireless/wl12xx/wl1251_debugfs.c
@@ -466,7 +466,8 @@ out:
 
 void wl1251_debugfs_reset(struct wl1251 *wl)
 {
-        memset(wl->stats.fw_stats, 0, sizeof(*wl->stats.fw_stats));
+        if (wl->stats.fw_stats != NULL)
+                memset(wl->stats.fw_stats, 0, sizeof(*wl->stats.fw_stats));
         wl->stats.retry_count = 0;
         wl->stats.excessive_retries = 0;
 }
diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
index ad37da2b6cb5..a6a88dfd5029 100644
--- a/drivers/vhost/net.c
+++ b/drivers/vhost/net.c
@@ -125,7 +125,7 @@ static void handle_tx(struct vhost_net *net)
         mutex_lock(&vq->mutex);
         vhost_disable_notify(vq);
 
-        if (wmem < sock->sk->sk_sndbuf * 2)
+        if (wmem < sock->sk->sk_sndbuf / 2)
                 tx_poll_stop(net);
         hdr_size = vq->hdr_size;
 
@@ -508,12 +508,12 @@ static long vhost_net_set_backend(struct vhost_net *n, unsigned index, int fd)
         /* Verify that ring has been setup correctly. */
         if (!vhost_vq_access_ok(vq)) {
                 r = -EFAULT;
-                goto err;
+                goto err_vq;
         }
         sock = get_socket(fd);
         if (IS_ERR(sock)) {
                 r = PTR_ERR(sock);
-                goto err;
+                goto err_vq;
         }
 
         /* start polling new socket */
@@ -524,12 +524,14 @@ static long vhost_net_set_backend(struct vhost_net *n, unsigned index, int fd)
         vhost_net_disable_vq(n, vq);
         rcu_assign_pointer(vq->private_data, sock);
         vhost_net_enable_vq(n, vq);
-        mutex_unlock(&vq->mutex);
 done:
         if (oldsock) {
                 vhost_net_flush_vq(n, index);
                 fput(oldsock->file);
         }
+
+err_vq:
+        mutex_unlock(&vq->mutex);
 err:
         mutex_unlock(&n->dev.mutex);
         return r;
diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index 7cd55e078794..7bd7a1e4409d 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -476,8 +476,10 @@ static long vhost_set_vring(struct vhost_dev *d, int ioctl, void __user *argp)
                 if (r < 0)
                         break;
                 eventfp = f.fd == -1 ? NULL : eventfd_fget(f.fd);
-                if (IS_ERR(eventfp))
-                        return PTR_ERR(eventfp);
+                if (IS_ERR(eventfp)) {
+                        r = PTR_ERR(eventfp);
+                        break;
+                }
                 if (eventfp != vq->kick) {
                         pollstop = filep = vq->kick;
                         pollstart = vq->kick = eventfp;
@@ -489,8 +491,10 @@ static long vhost_set_vring(struct vhost_dev *d, int ioctl, void __user *argp)
                 if (r < 0)
                         break;
                 eventfp = f.fd == -1 ? NULL : eventfd_fget(f.fd);
-                if (IS_ERR(eventfp))
-                        return PTR_ERR(eventfp);
+                if (IS_ERR(eventfp)) {
+                        r = PTR_ERR(eventfp);
+                        break;
+                }
                 if (eventfp != vq->call) {
                         filep = vq->call;
                         ctx = vq->call_ctx;
@@ -505,8 +509,10 @@ static long vhost_set_vring(struct vhost_dev *d, int ioctl, void __user *argp)
                 if (r < 0)
                         break;
                 eventfp = f.fd == -1 ? NULL : eventfd_fget(f.fd);
-                if (IS_ERR(eventfp))
-                        return PTR_ERR(eventfp);
+                if (IS_ERR(eventfp)) {
+                        r = PTR_ERR(eventfp);
+                        break;
+                }
                 if (eventfp != vq->error) {
                         filep = vq->error;
                         vq->error = eventfp;
diff --git a/fs/afs/security.c b/fs/afs/security.c
index 3ef504370034..bb4ed144d0e4 100644
--- a/fs/afs/security.c
+++ b/fs/afs/security.c
@@ -189,8 +189,9 @@ void afs_cache_permit(struct afs_vnode *vnode, struct key *key, long acl_order)
         if (!permits)
                 goto out_unlock;
 
-        memcpy(permits->permits, xpermits->permits,
-               count * sizeof(struct afs_permit));
+        if (xpermits)
+                memcpy(permits->permits, xpermits->permits,
+                        count * sizeof(struct afs_permit));
 
         _debug("key %x access %x",
                key_serial(key), vnode->status.caller_access);
diff --git a/include/linux/if_tunnel.h b/include/linux/if_tunnel.h
index 1822d635be6b..16b92d008bed 100644
--- a/include/linux/if_tunnel.h
+++ b/include/linux/if_tunnel.h
@@ -2,6 +2,7 @@
 #define _IF_TUNNEL_H_
 
 #include <linux/types.h>
+#include <asm/byteorder.h>
 
 #ifdef __KERNEL__
 #include <linux/ip.h>
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index c79a88be7c33..fa8b47637997 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -2059,12 +2059,12 @@ static inline void skb_bond_set_mac_by_master(struct sk_buff *skb,
  * duplicates except for 802.3ad ETH_P_SLOW, alb non-mcast/bcast, and
  * ARP on active-backup slaves with arp_validate enabled.
  */
-static inline int skb_bond_should_drop(struct sk_buff *skb)
+static inline int skb_bond_should_drop(struct sk_buff *skb,
+                                       struct net_device *master)
 {
-        struct net_device *dev = skb->dev;
-        struct net_device *master = dev->master;
-
         if (master) {
+                struct net_device *dev = skb->dev;
+
                 if (master->priv_flags & IFF_MASTER_ARPMON)
                         dev->last_rx = jiffies;
 
diff --git a/include/linux/netfilter/nfnetlink.h b/include/linux/netfilter/nfnetlink.h
index 53923868c9bd..361d6b5630ee 100644
--- a/include/linux/netfilter/nfnetlink.h
+++ b/include/linux/netfilter/nfnetlink.h
@@ -76,7 +76,7 @@ extern int nfnetlink_subsys_unregister(const struct nfnetlink_subsystem *n);
 extern int nfnetlink_has_listeners(struct net *net, unsigned int group);
 extern int nfnetlink_send(struct sk_buff *skb, struct net *net, u32 pid, unsigned group,
                           int echo, gfp_t flags);
-extern void nfnetlink_set_err(struct net *net, u32 pid, u32 group, int error);
+extern int nfnetlink_set_err(struct net *net, u32 pid, u32 group, int error);
 extern int nfnetlink_unicast(struct sk_buff *skb, struct net *net, u_int32_t pid, int flags);
 
 extern void nfnl_lock(void);
diff --git a/include/linux/netlink.h b/include/linux/netlink.h
index fde27c017326..6eaca5e1e8ca 100644
--- a/include/linux/netlink.h
+++ b/include/linux/netlink.h
@@ -188,7 +188,7 @@ extern int netlink_has_listeners(struct sock *sk, unsigned int group);
 extern int netlink_unicast(struct sock *ssk, struct sk_buff *skb, __u32 pid, int nonblock);
 extern int netlink_broadcast(struct sock *ssk, struct sk_buff *skb, __u32 pid,
                              __u32 group, gfp_t allocation);
-extern void netlink_set_err(struct sock *ssk, __u32 pid, __u32 group, int code);
+extern int netlink_set_err(struct sock *ssk, __u32 pid, __u32 group, int code);
 extern int netlink_register_notifier(struct notifier_block *nb);
 extern int netlink_unregister_notifier(struct notifier_block *nb);
 
diff --git a/include/linux/syscalls.h b/include/linux/syscalls.h
index f994ae58a002..057929b0a651 100644
--- a/include/linux/syscalls.h
+++ b/include/linux/syscalls.h
@@ -688,7 +688,7 @@ asmlinkage long sys_shmat(int shmid, char __user *shmaddr, int shmflg);
 asmlinkage long sys_shmget(key_t key, size_t size, int flag);
 asmlinkage long sys_shmdt(char __user *shmaddr);
 asmlinkage long sys_shmctl(int shmid, int cmd, struct shmid_ds __user *buf);
-asmlinkage long sys_ipc(unsigned int call, int first, int second,
+asmlinkage long sys_ipc(unsigned int call, int first, unsigned long second,
                 unsigned long third, void __user *ptr, long fifth);
 
 asmlinkage long sys_mq_open(const char __user *name, int oflag, mode_t mode, struct mq_attr __user *attr);
diff --git a/include/net/bluetooth/bluetooth.h b/include/net/bluetooth/bluetooth.h
index 04a6908e38d2..ff77e8f882f1 100644
--- a/include/net/bluetooth/bluetooth.h
+++ b/include/net/bluetooth/bluetooth.h
@@ -176,6 +176,6 @@ extern void hci_sock_cleanup(void);
 extern int bt_sysfs_init(void);
 extern void bt_sysfs_cleanup(void);
 
-extern struct class *bt_class;
+extern struct dentry *bt_debugfs;
 
 #endif /* __BLUETOOTH_H */
diff --git a/include/net/netlink.h b/include/net/netlink.h
index f82e463c875a..4fc05b58503e 100644
--- a/include/net/netlink.h
+++ b/include/net/netlink.h
@@ -945,7 +945,11 @@ static inline u64 nla_get_u64(const struct nlattr *nla)
  */
 static inline __be64 nla_get_be64(const struct nlattr *nla)
 {
-        return *(__be64 *) nla_data(nla);
+        __be64 tmp;
+
+        nla_memcpy(&tmp, nla, sizeof(tmp));
+
+        return tmp;
 }
 
 /**
diff --git a/ipc/syscall.c b/ipc/syscall.c
index 355a3da9ec73..1d6f53f6b562 100644
--- a/ipc/syscall.c
+++ b/ipc/syscall.c
@@ -13,7 +13,7 @@
 #include <linux/syscalls.h>
 #include <linux/uaccess.h>
 
-SYSCALL_DEFINE6(ipc, unsigned int, call, int, first, int, second,
+SYSCALL_DEFINE6(ipc, unsigned int, call, int, first, unsigned long, second,
                 unsigned long, third, void __user *, ptr, long, fifth)
 {
         int version, ret;
diff --git a/net/8021q/vlan_core.c b/net/8021q/vlan_core.c
index c0316e0ca6e8..c584a0af77d3 100644
--- a/net/8021q/vlan_core.c
+++ b/net/8021q/vlan_core.c
@@ -11,7 +11,7 @@ int __vlan_hwaccel_rx(struct sk_buff *skb, struct vlan_group *grp,
         if (netpoll_rx(skb))
                 return NET_RX_DROP;
 
-        if (skb_bond_should_drop(skb))
+        if (skb_bond_should_drop(skb, ACCESS_ONCE(skb->dev->master)))
                 goto drop;
 
         skb->skb_iif = skb->dev->ifindex;
@@ -83,7 +83,7 @@ vlan_gro_common(struct napi_struct *napi, struct vlan_group *grp,
 {
         struct sk_buff *p;
 
-        if (skb_bond_should_drop(skb))
+        if (skb_bond_should_drop(skb, ACCESS_ONCE(skb->dev->master)))
                 goto drop;
 
         skb->skb_iif = skb->dev->ifindex;
diff --git a/net/bluetooth/hci_sysfs.c b/net/bluetooth/hci_sysfs.c
index cafb55b0cea5..05fd125f74fe 100644
--- a/net/bluetooth/hci_sysfs.c
+++ b/net/bluetooth/hci_sysfs.c
@@ -8,8 +8,7 @@
 #include <net/bluetooth/bluetooth.h>
 #include <net/bluetooth/hci_core.h>
 
-struct class *bt_class = NULL;
-EXPORT_SYMBOL_GPL(bt_class);
+static struct class *bt_class;
 
 struct dentry *bt_debugfs = NULL;
 EXPORT_SYMBOL_GPL(bt_debugfs);
diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
index 4db7ae2fe07d..7794a2e2adce 100644
--- a/net/bluetooth/l2cap.c
+++ b/net/bluetooth/l2cap.c
@@ -40,6 +40,8 @@
 #include <linux/skbuff.h>
 #include <linux/list.h>
 #include <linux/device.h>
+#include <linux/debugfs.h>
+#include <linux/seq_file.h>
 #include <linux/uaccess.h>
 #include <linux/crc16.h>
 #include <net/sock.h>
@@ -2830,6 +2832,11 @@ static inline int l2cap_config_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr
                         int len = cmd->len - sizeof(*rsp);
                         char req[64];
 
+                        if (len > sizeof(req) - sizeof(struct l2cap_conf_req)) {
+                                l2cap_send_disconn_req(conn, sk);
+                                goto done;
+                        }
+
                         /* throw out any old stored conf requests */
                         result = L2CAP_CONF_SUCCESS;
                         len = l2cap_parse_conf_rsp(sk, rsp->data,
@@ -3937,31 +3944,42 @@ drop:
         return 0;
 }
 
-static ssize_t l2cap_sysfs_show(struct class *dev,
-                                struct class_attribute *attr,
-                                char *buf)
+static int l2cap_debugfs_show(struct seq_file *f, void *p)
 {
         struct sock *sk;
         struct hlist_node *node;
-        char *str = buf;
 
         read_lock_bh(&l2cap_sk_list.lock);
 
         sk_for_each(sk, node, &l2cap_sk_list.head) {
                 struct l2cap_pinfo *pi = l2cap_pi(sk);
 
-                str += sprintf(str, "%s %s %d %d 0x%4.4x 0x%4.4x %d %d %d\n",
-                                batostr(&bt_sk(sk)->src), batostr(&bt_sk(sk)->dst),
-                                sk->sk_state, __le16_to_cpu(pi->psm), pi->scid,
-                                pi->dcid, pi->imtu, pi->omtu, pi->sec_level);
+                seq_printf(f, "%s %s %d %d 0x%4.4x 0x%4.4x %d %d %d\n",
+                                        batostr(&bt_sk(sk)->src),
+                                        batostr(&bt_sk(sk)->dst),
+                                        sk->sk_state, __le16_to_cpu(pi->psm),
+                                        pi->scid, pi->dcid,
+                                        pi->imtu, pi->omtu, pi->sec_level);
         }
 
         read_unlock_bh(&l2cap_sk_list.lock);
 
-        return str - buf;
+        return 0;
 }
 
-static CLASS_ATTR(l2cap, S_IRUGO, l2cap_sysfs_show, NULL);
+static int l2cap_debugfs_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, l2cap_debugfs_show, inode->i_private);
+}
+
+static const struct file_operations l2cap_debugfs_fops = {
+        .open           = l2cap_debugfs_open,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+        .release        = single_release,
+};
+
+static struct dentry *l2cap_debugfs;
 
 static const struct proto_ops l2cap_sock_ops = {
         .family         = PF_BLUETOOTH,
@@ -4021,8 +4039,12 @@ static int __init l2cap_init(void)
                 goto error;
         }
 
-        if (class_create_file(bt_class, &class_attr_l2cap) < 0)
-                BT_ERR("Failed to create L2CAP info file");
+        if (bt_debugfs) {
+                l2cap_debugfs = debugfs_create_file("l2cap", 0444,
+                                        bt_debugfs, NULL, &l2cap_debugfs_fops);
+                if (!l2cap_debugfs)
+                        BT_ERR("Failed to create L2CAP debug file");
+        }
 
         BT_INFO("L2CAP ver %s", VERSION);
         BT_INFO("L2CAP socket layer initialized");
@@ -4036,7 +4058,7 @@ error:
 
 static void __exit l2cap_exit(void)
 {
-        class_remove_file(bt_class, &class_attr_l2cap);
+        debugfs_remove(l2cap_debugfs);
 
         if (bt_sock_unregister(BTPROTO_L2CAP) < 0)
                 BT_ERR("L2CAP socket unregistration failed");
diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index db8a68e1a5ba..13f114e8b0f9 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -33,6 +33,8 @@
 #include <linux/init.h>
 #include <linux/wait.h>
 #include <linux/device.h>
+#include <linux/debugfs.h>
+#include <linux/seq_file.h>
 #include <linux/net.h>
 #include <linux/mutex.h>
 #include <linux/kthread.h>
@@ -2098,13 +2100,10 @@ static struct hci_cb rfcomm_cb = {
         .security_cfm   = rfcomm_security_cfm
 };
 
-static ssize_t rfcomm_dlc_sysfs_show(struct class *dev,
-                                     struct class_attribute *attr,
-                                     char *buf)
+static int rfcomm_dlc_debugfs_show(struct seq_file *f, void *x)
 {
         struct rfcomm_session *s;
         struct list_head *pp, *p;
-        char *str = buf;
 
         rfcomm_lock();
 
@@ -2114,18 +2113,32 @@ static ssize_t rfcomm_dlc_sysfs_show(struct class *dev,
                         struct sock *sk = s->sock->sk;
                         struct rfcomm_dlc *d = list_entry(pp, struct rfcomm_dlc, list);
 
-                        str += sprintf(str, "%s %s %ld %d %d %d %d\n",
-                                        batostr(&bt_sk(sk)->src), batostr(&bt_sk(sk)->dst),
-                                        d->state, d->dlci, d->mtu, d->rx_credits, d->tx_credits);
+                        seq_printf(f, "%s %s %ld %d %d %d %d\n",
+                                                batostr(&bt_sk(sk)->src),
+                                                batostr(&bt_sk(sk)->dst),
+                                                d->state, d->dlci, d->mtu,
+                                                d->rx_credits, d->tx_credits);
                 }
         }
 
         rfcomm_unlock();
 
-        return (str - buf);
+        return 0;
 }
 
-static CLASS_ATTR(rfcomm_dlc, S_IRUGO, rfcomm_dlc_sysfs_show, NULL);
+static int rfcomm_dlc_debugfs_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, rfcomm_dlc_debugfs_show, inode->i_private);
+}
+
+static const struct file_operations rfcomm_dlc_debugfs_fops = {
+        .open           = rfcomm_dlc_debugfs_open,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+        .release        = single_release,
+};
+
+static struct dentry *rfcomm_dlc_debugfs;
 
 /* ---- Initialization ---- */
 static int __init rfcomm_init(void)
@@ -2142,8 +2155,12 @@ static int __init rfcomm_init(void)
                 goto unregister;
         }
 
-        if (class_create_file(bt_class, &class_attr_rfcomm_dlc) < 0)
-                BT_ERR("Failed to create RFCOMM info file");
+        if (bt_debugfs) {
+                rfcomm_dlc_debugfs = debugfs_create_file("rfcomm_dlc", 0444,
+                                bt_debugfs, NULL, &rfcomm_dlc_debugfs_fops);
+                if (!rfcomm_dlc_debugfs)
+                        BT_ERR("Failed to create RFCOMM debug file");
+        }
 
         err = rfcomm_init_ttys();
         if (err < 0)
@@ -2171,7 +2188,7 @@ unregister:
 
 static void __exit rfcomm_exit(void)
 {
-        class_remove_file(bt_class, &class_attr_rfcomm_dlc);
+        debugfs_remove(rfcomm_dlc_debugfs);
 
         hci_unregister_cb(&rfcomm_cb);
 
diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index ca87d6ac6a20..7f439765403d 100644
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -40,6 +40,8 @@
 #include <linux/skbuff.h>
 #include <linux/list.h>
 #include <linux/device.h>
+#include <linux/debugfs.h>
+#include <linux/seq_file.h>
 #include <net/sock.h>
 
 #include <asm/system.h>
@@ -1061,28 +1063,38 @@ done:
         return result;
 }
 
-static ssize_t rfcomm_sock_sysfs_show(struct class *dev,
-                                      struct class_attribute *attr,
-                                      char *buf)
+static int rfcomm_sock_debugfs_show(struct seq_file *f, void *p)
 {
         struct sock *sk;
         struct hlist_node *node;
-        char *str = buf;
 
         read_lock_bh(&rfcomm_sk_list.lock);
 
         sk_for_each(sk, node, &rfcomm_sk_list.head) {
-                str += sprintf(str, "%s %s %d %d\n",
-                                batostr(&bt_sk(sk)->src), batostr(&bt_sk(sk)->dst),
+                seq_printf(f, "%s %s %d %d\n",
+                                batostr(&bt_sk(sk)->src),
+                                batostr(&bt_sk(sk)->dst),
                                 sk->sk_state, rfcomm_pi(sk)->channel);
         }
 
         read_unlock_bh(&rfcomm_sk_list.lock);
 
-        return (str - buf);
+        return 0;
 }
 
-static CLASS_ATTR(rfcomm, S_IRUGO, rfcomm_sock_sysfs_show, NULL);
+static int rfcomm_sock_debugfs_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, rfcomm_sock_debugfs_show, inode->i_private);
+}
+
+static const struct file_operations rfcomm_sock_debugfs_fops = {
+        .open           = rfcomm_sock_debugfs_open,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+        .release        = single_release,
+};
+
+static struct dentry *rfcomm_sock_debugfs;
 
 static const struct proto_ops rfcomm_sock_ops = {
         .family         = PF_BLUETOOTH,
@@ -1122,8 +1134,12 @@ int __init rfcomm_init_sockets(void)
         if (err < 0)
                 goto error;
 
-        if (class_create_file(bt_class, &class_attr_rfcomm) < 0)
-                BT_ERR("Failed to create RFCOMM info file");
+        if (bt_debugfs) {
+                rfcomm_sock_debugfs = debugfs_create_file("rfcomm", 0444,
+                                bt_debugfs, NULL, &rfcomm_sock_debugfs_fops);
+                if (!rfcomm_sock_debugfs)
+                        BT_ERR("Failed to create RFCOMM debug file");
+        }
 
         BT_INFO("RFCOMM socket layer initialized");
 
@@ -1137,7 +1153,7 @@ error:
 
 void rfcomm_cleanup_sockets(void)
 {
-        class_remove_file(bt_class, &class_attr_rfcomm);
+        debugfs_remove(rfcomm_sock_debugfs);
 
         if (bt_sock_unregister(BTPROTO_RFCOMM) < 0)
                 BT_ERR("RFCOMM socket layer unregistration failed");
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index f93b939539bc..e5b16b76b22e 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -38,6 +38,8 @@
 #include <linux/socket.h>
 #include <linux/skbuff.h>
 #include <linux/device.h>
+#include <linux/debugfs.h>
+#include <linux/seq_file.h>
 #include <linux/list.h>
 #include <net/sock.h>
 
@@ -953,28 +955,36 @@ drop:
         return 0;
 }
 
-static ssize_t sco_sysfs_show(struct class *dev,
-                                struct class_attribute *attr,
-                                char *buf)
+static int sco_debugfs_show(struct seq_file *f, void *p)
 {
         struct sock *sk;
         struct hlist_node *node;
-        char *str = buf;
 
         read_lock_bh(&sco_sk_list.lock);
 
         sk_for_each(sk, node, &sco_sk_list.head) {
-                str += sprintf(str, "%s %s %d\n",
-                                batostr(&bt_sk(sk)->src), batostr(&bt_sk(sk)->dst),
-                                sk->sk_state);
+                seq_printf(f, "%s %s %d\n", batostr(&bt_sk(sk)->src),
+                                batostr(&bt_sk(sk)->dst), sk->sk_state);
         }
 
         read_unlock_bh(&sco_sk_list.lock);
 
-        return (str - buf);
+        return 0;
 }
 
-static CLASS_ATTR(sco, S_IRUGO, sco_sysfs_show, NULL);
+static int sco_debugfs_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, sco_debugfs_show, inode->i_private);
+}
+
+static const struct file_operations sco_debugfs_fops = {
+        .open           = sco_debugfs_open,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+        .release        = single_release,
+};
+
+static struct dentry *sco_debugfs;
 
 static const struct proto_ops sco_sock_ops = {
         .family         = PF_BLUETOOTH,
@@ -1032,8 +1042,12 @@ static int __init sco_init(void)
                 goto error;
         }
 
-        if (class_create_file(bt_class, &class_attr_sco) < 0)
-                BT_ERR("Failed to create SCO info file");
+        if (bt_debugfs) {
+                sco_debugfs = debugfs_create_file("sco", 0444,
+                                        bt_debugfs, NULL, &sco_debugfs_fops);
+                if (!sco_debugfs)
+                        BT_ERR("Failed to create SCO debug file");
+        }
 
         BT_INFO("SCO (Voice Link) ver %s", VERSION);
         BT_INFO("SCO socket layer initialized");
@@ -1047,7 +1061,7 @@ error:
 
 static void __exit sco_exit(void)
 {
-        class_remove_file(bt_class, &class_attr_sco);
+        debugfs_remove(sco_debugfs);
 
         if (bt_sock_unregister(BTPROTO_SCO) < 0)
                 BT_ERR("SCO socket unregistration failed");
diff --git a/net/core/dev.c b/net/core/dev.c
index bcc490cc9452..59d4394d2ce8 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2483,6 +2483,7 @@ int netif_receive_skb(struct sk_buff *skb)
 {
         struct packet_type *ptype, *pt_prev;
         struct net_device *orig_dev;
+        struct net_device *master;
         struct net_device *null_or_orig;
         struct net_device *null_or_bond;
         int ret = NET_RX_DROP;
@@ -2503,11 +2504,12 @@ int netif_receive_skb(struct sk_buff *skb)
 
         null_or_orig = NULL;
         orig_dev = skb->dev;
-        if (orig_dev->master) {
-                if (skb_bond_should_drop(skb))
+        master = ACCESS_ONCE(orig_dev->master);
+        if (master) {
+                if (skb_bond_should_drop(skb, master))
                         null_or_orig = orig_dev; /* deliver only exact match */
                 else
-                        skb->dev = orig_dev->master;
+                        skb->dev = master;
         }
 
         __get_cpu_var(netdev_rx_stat).total++;
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index af5d89792860..01ef8ba9025c 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -961,7 +961,9 @@ fib_find_node(struct trie *t, u32 key)
         struct node *n;
 
         pos = 0;
-        n = rcu_dereference(t->trie);
+        n = rcu_dereference_check(t->trie,
+                                  rcu_read_lock_held() ||
+                                  lockdep_rtnl_is_held());
 
         while (n != NULL &&  NODE_TYPE(n) == T_TNODE) {
                 tn = (struct tnode *) n;
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index f47c9f76754b..f78402d097b3 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -810,11 +810,13 @@ static netdev_tx_t ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev
                         tunnel->err_count = 0;
         }
 
-        max_headroom = LL_RESERVED_SPACE(tdev) + gre_hlen;
+        max_headroom = LL_RESERVED_SPACE(tdev) + gre_hlen + rt->u.dst.header_len;
 
         if (skb_headroom(skb) < max_headroom || skb_shared(skb)||
             (skb_cloned(skb) && !skb_clone_writable(skb, 0))) {
                 struct sk_buff *new_skb = skb_realloc_headroom(skb, max_headroom);
+                if (max_headroom > dev->needed_headroom)
+                        dev->needed_headroom = max_headroom;
                 if (!new_skb) {
                         ip_rt_put(rt);
                         txq->tx_dropped++;
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index 8582e12e4a62..0b9d03c54dc3 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -802,6 +802,9 @@ static int ipmr_mfc_add(struct net *net, struct mfcctl *mfc, int mrtsock)
         int line;
         struct mfc_cache *uc, *c, **cp;
 
+        if (mfc->mfcc_parent >= MAXVIFS)
+                return -ENFILE;
+
         line = MFC_HASH(mfc->mfcc_mcastgrp.s_addr, mfc->mfcc_origin.s_addr);
 
         for (cp = &net->ipv4.mfc_cache_array[line];
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index a770df2493d2..54fd68c14c87 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1441,7 +1441,7 @@ void ip_rt_redirect(__be32 old_gw, __be32 daddr, __be32 new_gw,
                                         dev_hold(rt->u.dst.dev);
                                 if (rt->idev)
                                         in_dev_hold(rt->idev);
-                                rt->u.dst.obsolete      = 0;
+                                rt->u.dst.obsolete      = -1;
                                 rt->u.dst.lastuse       = jiffies;
                                 rt->u.dst.path          = &rt->u.dst;
                                 rt->u.dst.neighbour     = NULL;
@@ -1506,11 +1506,12 @@ static struct dst_entry *ipv4_negative_advice(struct dst_entry *dst)
         struct dst_entry *ret = dst;
 
         if (rt) {
-                if (dst->obsolete) {
+                if (dst->obsolete > 0) {
                         ip_rt_put(rt);
                         ret = NULL;
                 } else if ((rt->rt_flags & RTCF_REDIRECTED) ||
-                           rt->u.dst.expires) {
+                           (rt->u.dst.expires &&
+                            time_after_eq(jiffies, rt->u.dst.expires))) {
                         unsigned hash = rt_hash(rt->fl.fl4_dst, rt->fl.fl4_src,
                                                 rt->fl.oif,
                                                 rt_genid(dev_net(dst->dev)));
@@ -1726,7 +1727,9 @@ static void ip_rt_update_pmtu(struct dst_entry *dst, u32 mtu)
 
 static struct dst_entry *ipv4_dst_check(struct dst_entry *dst, u32 cookie)
 {
-        return NULL;
+        if (rt_is_expired((struct rtable *)dst))
+                return NULL;
+        return dst;
 }
 
 static void ipv4_dst_destroy(struct dst_entry *dst)
@@ -1888,7 +1891,8 @@ static int ip_route_input_mc(struct sk_buff *skb, __be32 daddr, __be32 saddr,
         if (!rth)
                 goto e_nobufs;
 
-        rth->u.dst.output= ip_rt_bug;
+        rth->u.dst.output = ip_rt_bug;
+        rth->u.dst.obsolete = -1;
 
         atomic_set(&rth->u.dst.__refcnt, 1);
         rth->u.dst.flags= DST_HOST;
@@ -2054,6 +2058,7 @@ static int __mkroute_input(struct sk_buff *skb,
         rth->fl.oif     = 0;
         rth->rt_spec_dst= spec_dst;
 
+        rth->u.dst.obsolete = -1;
         rth->u.dst.input = ip_forward;
         rth->u.dst.output = ip_output;
         rth->rt_genid = rt_genid(dev_net(rth->u.dst.dev));
@@ -2218,6 +2223,7 @@ local_input:
                 goto e_nobufs;
 
         rth->u.dst.output= ip_rt_bug;
+        rth->u.dst.obsolete = -1;
         rth->rt_genid = rt_genid(net);
 
         atomic_set(&rth->u.dst.__refcnt, 1);
@@ -2444,6 +2450,7 @@ static int __mkroute_output(struct rtable **result,
         rth->rt_spec_dst= fl->fl4_src;
 
         rth->u.dst.output=ip_output;
+        rth->u.dst.obsolete = -1;
         rth->rt_genid = rt_genid(dev_net(dev_out));
 
         RT_CACHE_STAT_INC(out_slow_tot);
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 5901010fad55..6afb6d8662b2 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -429,7 +429,7 @@ unsigned int tcp_poll(struct file *file, struct socket *sock, poll_table *wait)
                 if (tp->urg_seq == tp->copied_seq &&
                     !sock_flag(sk, SOCK_URGINLINE) &&
                     tp->urg_data)
-                        target--;
+                        target++;
 
                 /* Potential race condition. If read of tp below will
                  * escape above sk->sk_state, we can be illegally awaken
@@ -1254,6 +1254,39 @@ static void tcp_prequeue_process(struct sock *sk)
         tp->ucopy.memory = 0;
 }
 
+#ifdef CONFIG_NET_DMA
+static void tcp_service_net_dma(struct sock *sk, bool wait)
+{
+        dma_cookie_t done, used;
+        dma_cookie_t last_issued;
+        struct tcp_sock *tp = tcp_sk(sk);
+
+        if (!tp->ucopy.dma_chan)
+                return;
+
+        last_issued = tp->ucopy.dma_cookie;
+        dma_async_memcpy_issue_pending(tp->ucopy.dma_chan);
+
+        do {
+                if (dma_async_memcpy_complete(tp->ucopy.dma_chan,
+                                              last_issued, &done,
+                                              &used) == DMA_SUCCESS) {
+                        /* Safe to free early-copied skbs now */
+                        __skb_queue_purge(&sk->sk_async_wait_queue);
+                        break;
+                } else {
+                        struct sk_buff *skb;
+                        while ((skb = skb_peek(&sk->sk_async_wait_queue)) &&
+                               (dma_async_is_complete(skb->dma_cookie, done,
+                                                      used) == DMA_SUCCESS)) {
+                                __skb_dequeue(&sk->sk_async_wait_queue);
+                                kfree_skb(skb);
+                        }
+                }
+        } while (wait);
+}
+#endif
+
 static inline struct sk_buff *tcp_recv_skb(struct sock *sk, u32 seq, u32 *off)
 {
         struct sk_buff *skb;
@@ -1546,6 +1579,10 @@ int tcp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                         /* __ Set realtime policy in scheduler __ */
                 }
 
+#ifdef CONFIG_NET_DMA
+                if (tp->ucopy.dma_chan)
+                        dma_async_memcpy_issue_pending(tp->ucopy.dma_chan);
+#endif
                 if (copied >= target) {
                         /* Do not sleep, just process backlog. */
                         release_sock(sk);
@@ -1554,6 +1591,7 @@ int tcp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                         sk_wait_data(sk, &timeo);
 
 #ifdef CONFIG_NET_DMA
+                tcp_service_net_dma(sk, false);  /* Don't block */
                 tp->ucopy.wakeup = 0;
 #endif
 
@@ -1633,6 +1671,9 @@ do_prequeue:
                                                 copied = -EFAULT;
                                         break;
                                 }
+
+                                dma_async_memcpy_issue_pending(tp->ucopy.dma_chan);
+
                                 if ((offset + used) == skb->len)
                                         copied_early = 1;
 
@@ -1702,27 +1743,9 @@ skip_copy:
         }
 
 #ifdef CONFIG_NET_DMA
-        if (tp->ucopy.dma_chan) {
-                dma_cookie_t done, used;
-
-                dma_async_memcpy_issue_pending(tp->ucopy.dma_chan);
-
-                while (dma_async_memcpy_complete(tp->ucopy.dma_chan,
-                                                 tp->ucopy.dma_cookie, &done,
-                                                 &used) == DMA_IN_PROGRESS) {
-                        /* do partial cleanup of sk_async_wait_queue */
-                        while ((skb = skb_peek(&sk->sk_async_wait_queue)) &&
-                               (dma_async_is_complete(skb->dma_cookie, done,
-                                                      used) == DMA_SUCCESS)) {
-                                __skb_dequeue(&sk->sk_async_wait_queue);
-                                kfree_skb(skb);
-                        }
-                }
+        tcp_service_net_dma(sk, true);  /* Wait for queue to drain */
+        tp->ucopy.dma_chan = NULL;
 
-                /* Safe to free early-copied skbs now */
-                __skb_queue_purge(&sk->sk_async_wait_queue);
-                tp->ucopy.dma_chan = NULL;
-        }
         if (tp->ucopy.pinned_list) {
                 dma_unpin_iovec_pages(tp->ucopy.pinned_list);
                 tp->ucopy.pinned_list = NULL;
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 788851ca8c5d..c096a4218b8f 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -2511,6 +2511,9 @@ static void tcp_mark_head_lost(struct sock *sk, int packets)
         int err;
         unsigned int mss;
 
+        if (packets == 0)
+                return;
+
         WARN_ON(packets > tp->packets_out);
         if (tp->lost_skb_hint) {
                 skb = tp->lost_skb_hint;
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 70df40980a87..f4df5f931f36 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -370,6 +370,11 @@ void tcp_v4_err(struct sk_buff *icmp_skb, u32 info)
         if (sk->sk_state == TCP_CLOSE)
                 goto out;
 
+        if (unlikely(iph->ttl < inet_sk(sk)->min_ttl)) {
+                NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
+                goto out;
+        }
+
         icsk = inet_csk(sk);
         tp = tcp_sk(sk);
         seq = ntohl(th->seq);
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index 52e0f74fdfe0..23e4ac0cc30e 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -1113,6 +1113,9 @@ static int ip6mr_mfc_add(struct net *net, struct mf6cctl *mfc, int mrtsock)
         unsigned char ttls[MAXMIFS];
         int i;
 
+        if (mfc->mf6cc_parent >= MAXMIFS)
+                return -ENFILE;
+
         memset(ttls, 255, MAXMIFS);
         for (i = 0; i < MAXMIFS; i++) {
                 if (IF_ISSET(i, &mfc->mf6cc_ifset))
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 52cd3eff31dc..7fcb0e5d1213 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -879,7 +879,7 @@ static struct dst_entry *ip6_dst_check(struct dst_entry *dst, u32 cookie)
 
         rt = (struct rt6_info *) dst;
 
-        if (rt && rt->rt6i_node && (rt->rt6i_node->fn_sernum == cookie))
+        if (rt->rt6i_node && (rt->rt6i_node->fn_sernum == cookie))
                 return dst;
 
         return NULL;
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 2b2af631d2b8..569410a85953 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -582,7 +582,9 @@ nla_put_failure:
 nlmsg_failure:
         kfree_skb(skb);
 errout:
-        nfnetlink_set_err(net, 0, group, -ENOBUFS);
+        if (nfnetlink_set_err(net, 0, group, -ENOBUFS) > 0)
+                return -ENOBUFS;
+
         return 0;
 }
 #endif /* CONFIG_NF_CONNTRACK_EVENTS */
diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c
index 8eb0cc23ada3..6afa3d52ea5f 100644
--- a/net/netfilter/nfnetlink.c
+++ b/net/netfilter/nfnetlink.c
@@ -113,9 +113,9 @@ int nfnetlink_send(struct sk_buff *skb, struct net *net, u32 pid,
 }
 EXPORT_SYMBOL_GPL(nfnetlink_send);
 
-void nfnetlink_set_err(struct net *net, u32 pid, u32 group, int error)
+int nfnetlink_set_err(struct net *net, u32 pid, u32 group, int error)
 {
-        netlink_set_err(net->nfnl, pid, group, error);
+        return netlink_set_err(net->nfnl, pid, group, error);
 }
 EXPORT_SYMBOL_GPL(nfnetlink_set_err);
 
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 320d0423a240..acbbae1e89b5 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -1093,6 +1093,7 @@ static inline int do_one_set_err(struct sock *sk,
                                  struct netlink_set_err_data *p)
 {
         struct netlink_sock *nlk = nlk_sk(sk);
+        int ret = 0;
 
         if (sk == p->exclude_sk)
                 goto out;
@@ -1104,10 +1105,15 @@ static inline int do_one_set_err(struct sock *sk,
             !test_bit(p->group - 1, nlk->groups))
                 goto out;
 
+        if (p->code == ENOBUFS && nlk->flags & NETLINK_RECV_NO_ENOBUFS) {
+                ret = 1;
+                goto out;
+        }
+
         sk->sk_err = p->code;
         sk->sk_error_report(sk);
 out:
-        return 0;
+        return ret;
 }
 
 /**
@@ -1116,12 +1122,16 @@ out:
  * @pid: the PID of a process that we want to skip (if any)
  * @groups: the broadcast group that will notice the error
  * @code: error code, must be negative (as usual in kernelspace)
+ *
+ * This function returns the number of broadcast listeners that have set the
+ * NETLINK_RECV_NO_ENOBUFS socket option.
  */
-void netlink_set_err(struct sock *ssk, u32 pid, u32 group, int code)
+int netlink_set_err(struct sock *ssk, u32 pid, u32 group, int code)
 {
         struct netlink_set_err_data info;
         struct hlist_node *node;
         struct sock *sk;
+        int ret = 0;
 
         info.exclude_sk = ssk;
         info.pid = pid;
@@ -1132,9 +1142,10 @@ void netlink_set_err(struct sock *ssk, u32 pid, u32 group, int code)
         read_lock(&nl_table_lock);
 
         sk_for_each_bound(sk, node, &nl_table[ssk->sk_protocol].mc_list)
-                do_one_set_err(sk, &info);
+                ret += do_one_set_err(sk, &info);
 
         read_unlock(&nl_table_lock);
+        return ret;
 }
 EXPORT_SYMBOL(netlink_set_err);
 
diff --git a/net/rxrpc/ar-accept.c b/net/rxrpc/ar-accept.c
index 77228f28fa36..2d744f22a9a1 100644
--- a/net/rxrpc/ar-accept.c
+++ b/net/rxrpc/ar-accept.c
@@ -88,6 +88,11 @@ static int rxrpc_accept_incoming_call(struct rxrpc_local *local,
 
         /* get a notification message to send to the server app */
         notification = alloc_skb(0, GFP_NOFS);
+        if (!notification) {
+                _debug("no memory");
+                ret = -ENOMEM;
+                goto error_nofree;
+        }
         rxrpc_new_skb(notification);
         notification->mark = RXRPC_SKB_MARK_NEW_CALL;
 
@@ -189,6 +194,7 @@ invalid_service:
         ret = -ECONNREFUSED;
 error:
         rxrpc_free_skb(notification);
+error_nofree:
         _leave(" = %d", ret);
         return ret;
 }
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index 8b2915631cc3..a33c1c50b310 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -84,7 +84,7 @@ module_param_array(bdl_pos_adj, int, NULL, 0644);
 MODULE_PARM_DESC(bdl_pos_adj, "BDL position adjustment offset.");
 module_param_array(probe_mask, int, NULL, 0444);
 MODULE_PARM_DESC(probe_mask, "Bitmask to probe codecs (default = -1).");
-module_param_array(probe_only, bool, NULL, 0444);
+module_param_array(probe_only, int, NULL, 0444);
 MODULE_PARM_DESC(probe_only, "Only probing and no codec initialization.");
 module_param(single_cmd, bool, 0444);
 MODULE_PARM_DESC(single_cmd, "Use single command to communicate with codecs "
@@ -858,10 +858,13 @@ static void azx_power_notify(struct hda_bus *bus);
 #endif
 
 /* reset codec link */
-static int azx_reset(struct azx *chip)
+static int azx_reset(struct azx *chip, int full_reset)
 {
         int count;
 
+        if (!full_reset)
+                goto __skip;
+
         /* clear STATESTS */
         azx_writeb(chip, STATESTS, STATESTS_INT_MASK);
 
@@ -887,6 +890,7 @@ static int azx_reset(struct azx *chip)
         /* Brent Chartrand said to wait >= 540us for codecs to initialize */
         msleep(1);
 
+      __skip:
         /* check to see if controller is ready */
         if (!azx_readb(chip, GCTL)) {
                 snd_printd(SFX "azx_reset: controller not ready!\n");
@@ -998,13 +1002,13 @@ static void azx_stream_stop(struct azx *chip, struct azx_dev *azx_dev)
 /*
  * reset and start the controller registers
  */
-static void azx_init_chip(struct azx *chip)
+static void azx_init_chip(struct azx *chip, int full_reset)
 {
         if (chip->initialized)
                 return;
 
         /* reset controller */
-        azx_reset(chip);
+        azx_reset(chip, full_reset);
 
         /* initialize interrupts */
         azx_int_clear(chip);
@@ -1348,7 +1352,7 @@ static void azx_bus_reset(struct hda_bus *bus)
 
         bus->in_reset = 1;
         azx_stop_chip(chip);
-        azx_init_chip(chip);
+        azx_init_chip(chip, 1);
 #ifdef CONFIG_PM
         if (chip->initialized) {
                 int i;
@@ -1422,7 +1426,7 @@ static int __devinit azx_codec_create(struct azx *chip, const char *model)
                                  * get back to the sanity state.
                                  */
                                 azx_stop_chip(chip);
-                                azx_init_chip(chip);
+                                azx_init_chip(chip, 1);
                         }
                 }
         }
@@ -2112,7 +2116,7 @@ static void azx_power_notify(struct hda_bus *bus)
                 }
         }
         if (power_on)
-                azx_init_chip(chip);
+                azx_init_chip(chip, 1);
         else if (chip->running && power_save_controller &&
                  !bus->power_keep_link_on)
                 azx_stop_chip(chip);
@@ -2182,7 +2186,7 @@ static int azx_resume(struct pci_dev *pci)
         azx_init_pci(chip);
 
         if (snd_hda_codecs_inuse(chip->bus))
-                azx_init_chip(chip);
+                azx_init_chip(chip, 1);
 
         snd_hda_resume(chip->bus);
         snd_power_change_state(card, SNDRV_CTL_POWER_D0);
@@ -2573,7 +2577,7 @@ static int __devinit azx_create(struct snd_card *card, struct pci_dev *pci,
 
         /* initialize chip */
         azx_init_pci(chip);
-        azx_init_chip(chip);
+        azx_init_chip(chip, (probe_only[dev] & 2) == 0);
 
         /* codec detection */
         if (!chip->codec_mask) {
@@ -2662,7 +2666,7 @@ static int __devinit azx_probe(struct pci_dev *pci,
                         goto out_free;
         }
 #endif
-        if (!probe_only[dev]) {
+        if ((probe_only[dev] & 1) == 0) {
                 err = azx_codec_configure(chip);
                 if (err < 0)
                         goto out_free;
diff --git a/sound/pci/hda/patch_analog.c b/sound/pci/hda/patch_analog.c
index e6d1bdff1b6e..262f5b5decf1 100644
--- a/sound/pci/hda/patch_analog.c
+++ b/sound/pci/hda/patch_analog.c
@@ -71,9 +71,10 @@ struct ad198x_spec {
         struct hda_input_mux private_imux;
         hda_nid_t private_dac_nids[AUTO_CFG_MAX_OUTS];
 
-        unsigned int jack_present :1;
-        unsigned int inv_jack_detect:1; /* inverted jack-detection */
-        unsigned int inv_eapd:1;        /* inverted EAPD implementation */
+        unsigned int jack_present: 1;
+        unsigned int inv_jack_detect: 1;/* inverted jack-detection */
+        unsigned int inv_eapd: 1;       /* inverted EAPD implementation */
+        unsigned int analog_beep: 1;    /* analog beep input present */
 
 #ifdef CONFIG_SND_HDA_POWER_SAVE
         struct hda_loopback_check loopback;
@@ -165,6 +166,12 @@ static struct snd_kcontrol_new ad_beep_mixer[] = {
         { } /* end */
 };
 
+static struct snd_kcontrol_new ad_beep2_mixer[] = {
+        HDA_CODEC_VOLUME("Digital Beep Playback Volume", 0, 0, HDA_OUTPUT),
+        HDA_CODEC_MUTE_BEEP("Digital Beep Playback Switch", 0, 0, HDA_OUTPUT),
+        { } /* end */
+};
+
 #define set_beep_amp(spec, nid, idx, dir) \
         ((spec)->beep_amp = HDA_COMPOSE_AMP_VAL(nid, 1, idx, dir)) /* mono */
 #else
@@ -203,7 +210,8 @@ static int ad198x_build_controls(struct hda_codec *codec)
 #ifdef CONFIG_SND_HDA_INPUT_BEEP
         if (spec->beep_amp) {
                 struct snd_kcontrol_new *knew;
-                for (knew = ad_beep_mixer; knew->name; knew++) {
+                knew = spec->analog_beep ? ad_beep2_mixer : ad_beep_mixer;
+                for ( ; knew->name; knew++) {
                         struct snd_kcontrol *kctl;
                         kctl = snd_ctl_new1(knew, codec);
                         if (!kctl)
@@ -3482,6 +3490,8 @@ static struct snd_kcontrol_new ad1984_thinkpad_mixers[] = {
         HDA_CODEC_MUTE("Mic Playback Switch", 0x20, 0x00, HDA_INPUT),
         HDA_CODEC_VOLUME("Internal Mic Playback Volume", 0x20, 0x01, HDA_INPUT),
         HDA_CODEC_MUTE("Internal Mic Playback Switch", 0x20, 0x01, HDA_INPUT),
+        HDA_CODEC_VOLUME("Beep Playback Volume", 0x20, 0x03, HDA_INPUT),
+        HDA_CODEC_MUTE("Beep Playback Switch", 0x20, 0x03, HDA_INPUT),
         HDA_CODEC_VOLUME("Docking Mic Playback Volume", 0x20, 0x04, HDA_INPUT),
         HDA_CODEC_MUTE("Docking Mic Playback Switch", 0x20, 0x04, HDA_INPUT),
         HDA_CODEC_VOLUME("Mic Boost", 0x14, 0x0, HDA_INPUT),
@@ -3523,6 +3533,8 @@ static struct hda_verb ad1984_thinkpad_init_verbs[] = {
         {0x1c, AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_MUTE},
         /* docking mic boost */
         {0x25, AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_ZERO},
+        /* Analog PC Beeper - allow firmware/ACPI beeps */
+        {0x20, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_UNMUTE(3) | 0x1a},
         /* Analog mixer - docking mic; mute as default */
         {0x20, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_MUTE(4)},
         /* enable EAPD bit */
@@ -3655,6 +3667,7 @@ static int patch_ad1984(struct hda_codec *codec)
                 spec->input_mux = &ad1984_thinkpad_capture_source;
                 spec->mixers[0] = ad1984_thinkpad_mixers;
                 spec->init_verbs[spec->num_init_verbs++] = ad1984_thinkpad_init_verbs;
+                spec->analog_beep = 1;
                 break;
         case AD1984_DELL_DESKTOP:
                 spec->multiout.dig_out_nid = 0;
diff --git a/sound/usb/Kconfig b/sound/usb/Kconfig
index c570ae3e6d55..3273b47b3a64 100644
--- a/sound/usb/Kconfig
+++ b/sound/usb/Kconfig
@@ -22,8 +22,7 @@ config SND_USB_AUDIO
           will be called snd-usb-audio.
 
 config SND_USB_UA101
-        tristate "Edirol UA-101/UA-1000 driver (EXPERIMENTAL)"
-        depends on EXPERIMENTAL
+        tristate "Edirol UA-101/UA-1000 driver"
         select SND_PCM
         select SND_RAWMIDI
         help