26 files changed, 173 insertions, 94 deletions

diff --git a/drivers/net/Makefile b/drivers/net/Makefile
index 01b604ad155e..e5a7375685ad 100644
--- a/drivers/net/Makefile
+++ b/drivers/net/Makefile
@@ -144,7 +144,7 @@ obj-$(CONFIG_NE3210) += ne3210.o 8390.o
 obj-$(CONFIG_SB1250_MAC) += sb1250-mac.o
 obj-$(CONFIG_B44) += b44.o
 obj-$(CONFIG_FORCEDETH) += forcedeth.o
-obj-$(CONFIG_NE_H8300) += ne-h8300.o 8390.o
+obj-$(CONFIG_NE_H8300) += ne-h8300.o
 obj-$(CONFIG_AX88796) += ax88796.o
 obj-$(CONFIG_BCM63XX_ENET) += bcm63xx_enet.o
 obj-$(CONFIG_FTMAC100) += ftmac100.o
@@ -219,7 +219,7 @@ obj-$(CONFIG_SC92031) += sc92031.o
 obj-$(CONFIG_LP486E) += lp486e.o
 
 obj-$(CONFIG_ETH16I) += eth16i.o
-obj-$(CONFIG_ZORRO8390) += zorro8390.o 8390.o
+obj-$(CONFIG_ZORRO8390) += zorro8390.o
 obj-$(CONFIG_HPLANCE) += hplance.o 7990.o
 obj-$(CONFIG_MVME147_NET) += mvme147.o 7990.o
 obj-$(CONFIG_EQUALIZER) += eql.o
@@ -231,7 +231,7 @@ obj-$(CONFIG_SGI_IOC3_ETH) += ioc3-eth.o
 obj-$(CONFIG_DECLANCE) += declance.o
 obj-$(CONFIG_ATARILANCE) += atarilance.o
 obj-$(CONFIG_A2065) += a2065.o
-obj-$(CONFIG_HYDRA) += hydra.o 8390.o
+obj-$(CONFIG_HYDRA) += hydra.o
 obj-$(CONFIG_ARIADNE) += ariadne.o
 obj-$(CONFIG_CS89x0) += cs89x0.o
 obj-$(CONFIG_MACSONIC) += macsonic.o
diff --git a/drivers/net/bonding/bond_3ad.h b/drivers/net/bonding/bond_3ad.h
index 291dbd4d1f3d..0ee3f1632c46 100644
--- a/drivers/net/bonding/bond_3ad.h
+++ b/drivers/net/bonding/bond_3ad.h
@@ -39,7 +39,7 @@
 
 typedef struct mac_addr {
         u8 mac_addr_value[ETH_ALEN];
-} mac_addr_t;
+} __packed mac_addr_t;
 
 enum {
         BOND_AD_STABLE = 0,
@@ -134,12 +134,12 @@ typedef struct lacpdu {
         u8 tlv_type_terminator;      // = terminator
         u8 terminator_length;        // = 0
         u8 reserved_50[50];          // = 0
-} lacpdu_t;
+} __packed lacpdu_t;
 
 typedef struct lacpdu_header {
         struct ethhdr hdr;
         struct lacpdu lacpdu;
-} lacpdu_header_t;
+} __packed lacpdu_header_t;
 
 // Marker Protocol Data Unit(PDU) structure(43.5.3.2 in the 802.3ad standard)
 typedef struct bond_marker {
@@ -155,12 +155,12 @@ typedef struct bond_marker {
         u8 tlv_type_terminator;      //  = 0x00
         u8 terminator_length;        //  = 0x00
         u8 reserved_90[90];          //  = 0
-} bond_marker_t;
+} __packed bond_marker_t;
 
 typedef struct bond_marker_header {
         struct ethhdr hdr;
         struct bond_marker marker;
-} bond_marker_header_t;
+} __packed bond_marker_header_t;
 
 #pragma pack()
 
diff --git a/drivers/net/ehea/ehea_main.c b/drivers/net/ehea/ehea_main.c
index a004bbcf72e6..ba763e0481e3 100644
--- a/drivers/net/ehea/ehea_main.c
+++ b/drivers/net/ehea/ehea_main.c
@@ -2688,9 +2688,6 @@ static int ehea_open(struct net_device *dev)
                 netif_start_queue(dev);
         }
 
-        init_waitqueue_head(&port->swqe_avail_wq);
-        init_waitqueue_head(&port->restart_wq);
-
         mutex_unlock(&port->port_lock);
 
         return ret;
@@ -3278,6 +3275,9 @@ struct ehea_port *ehea_setup_single_port(struct ehea_adapter *adapter,
 
         INIT_WORK(&port->reset_task, ehea_reset_port);
 
+        init_waitqueue_head(&port->swqe_avail_wq);
+        init_waitqueue_head(&port->restart_wq);
+
         ret = register_netdev(dev);
         if (ret) {
                 pr_err("register_netdev failed. ret=%d\n", ret);
diff --git a/drivers/net/hydra.c b/drivers/net/hydra.c
index c5ef62ceb840..1cd481c04202 100644
--- a/drivers/net/hydra.c
+++ b/drivers/net/hydra.c
@@ -98,15 +98,15 @@ static const struct net_device_ops hydra_netdev_ops = {
         .ndo_open               = hydra_open,
         .ndo_stop               = hydra_close,
 
-        .ndo_start_xmit         = ei_start_xmit,
-        .ndo_tx_timeout         = ei_tx_timeout,
-        .ndo_get_stats          = ei_get_stats,
-        .ndo_set_multicast_list = ei_set_multicast_list,
+        .ndo_start_xmit         = __ei_start_xmit,
+        .ndo_tx_timeout         = __ei_tx_timeout,
+        .ndo_get_stats          = __ei_get_stats,
+        .ndo_set_multicast_list = __ei_set_multicast_list,
         .ndo_validate_addr      = eth_validate_addr,
-        .ndo_set_mac_address    = eth_mac_addr,
+        .ndo_set_mac_address    = eth_mac_addr,
         .ndo_change_mtu         = eth_change_mtu,
 #ifdef CONFIG_NET_POLL_CONTROLLER
-        .ndo_poll_controller    = ei_poll,
+        .ndo_poll_controller    = __ei_poll,
 #endif
 };
 
@@ -125,7 +125,7 @@ static int __devinit hydra_init(struct zorro_dev *z)
         0x10, 0x12, 0x14, 0x16, 0x18, 0x1a, 0x1c, 0x1e,
     };
 
-    dev = alloc_ei_netdev();
+    dev = ____alloc_ei_netdev(0);
     if (!dev)
         return -ENOMEM;
 
diff --git a/drivers/net/ne-h8300.c b/drivers/net/ne-h8300.c
index 30be8c634ebd..7298a34bc795 100644
--- a/drivers/net/ne-h8300.c
+++ b/drivers/net/ne-h8300.c
@@ -167,7 +167,7 @@ static void cleanup_card(struct net_device *dev)
 #ifndef MODULE
 struct net_device * __init ne_probe(int unit)
 {
-        struct net_device *dev = alloc_ei_netdev();
+        struct net_device *dev = ____alloc_ei_netdev(0);
         int err;
 
         if (!dev)
@@ -197,15 +197,15 @@ static const struct net_device_ops ne_netdev_ops = {
         .ndo_open               = ne_open,
         .ndo_stop               = ne_close,
 
-        .ndo_start_xmit         = ei_start_xmit,
-        .ndo_tx_timeout         = ei_tx_timeout,
-        .ndo_get_stats          = ei_get_stats,
-        .ndo_set_multicast_list = ei_set_multicast_list,
+        .ndo_start_xmit         = __ei_start_xmit,
+        .ndo_tx_timeout         = __ei_tx_timeout,
+        .ndo_get_stats          = __ei_get_stats,
+        .ndo_set_multicast_list = __ei_set_multicast_list,
         .ndo_validate_addr      = eth_validate_addr,
-        .ndo_set_mac_address    = eth_mac_addr,
+        .ndo_set_mac_address    = eth_mac_addr,
         .ndo_change_mtu         = eth_change_mtu,
 #ifdef CONFIG_NET_POLL_CONTROLLER
-        .ndo_poll_controller    = ei_poll,
+        .ndo_poll_controller    = __ei_poll,
 #endif
 };
 
@@ -637,7 +637,7 @@ int init_module(void)
         int err;
 
         for (this_dev = 0; this_dev < MAX_NE_CARDS; this_dev++) {
-                struct net_device *dev = alloc_ei_netdev();
+                struct net_device *dev = ____alloc_ei_netdev(0);
                 if (!dev)
                         break;
                 if (io[this_dev]) {
diff --git a/drivers/net/sfc/mcdi.c b/drivers/net/sfc/mcdi.c
index d98479030ef2..3dd45ed61f0a 100644
--- a/drivers/net/sfc/mcdi.c
+++ b/drivers/net/sfc/mcdi.c
@@ -50,6 +50,20 @@ static inline struct efx_mcdi_iface *efx_mcdi(struct efx_nic *efx)
         return &nic_data->mcdi;
 }
 
+static inline void
+efx_mcdi_readd(struct efx_nic *efx, efx_dword_t *value, unsigned reg)
+{
+        struct siena_nic_data *nic_data = efx->nic_data;
+        value->u32[0] = (__force __le32)__raw_readl(nic_data->mcdi_smem + reg);
+}
+
+static inline void
+efx_mcdi_writed(struct efx_nic *efx, const efx_dword_t *value, unsigned reg)
+{
+        struct siena_nic_data *nic_data = efx->nic_data;
+        __raw_writel((__force u32)value->u32[0], nic_data->mcdi_smem + reg);
+}
+
 void efx_mcdi_init(struct efx_nic *efx)
 {
         struct efx_mcdi_iface *mcdi;
@@ -70,8 +84,8 @@ static void efx_mcdi_copyin(struct efx_nic *efx, unsigned cmd,
                             const u8 *inbuf, size_t inlen)
 {
         struct efx_mcdi_iface *mcdi = efx_mcdi(efx);
-        unsigned pdu = FR_CZ_MC_TREG_SMEM + MCDI_PDU(efx);
-        unsigned doorbell = FR_CZ_MC_TREG_SMEM + MCDI_DOORBELL(efx);
+        unsigned pdu = MCDI_PDU(efx);
+        unsigned doorbell = MCDI_DOORBELL(efx);
         unsigned int i;
         efx_dword_t hdr;
         u32 xflags, seqno;
@@ -92,30 +106,28 @@ static void efx_mcdi_copyin(struct efx_nic *efx, unsigned cmd,
                              MCDI_HEADER_SEQ, seqno,
                              MCDI_HEADER_XFLAGS, xflags);
 
-        efx_writed(efx, &hdr, pdu);
+        efx_mcdi_writed(efx, &hdr, pdu);
 
-        for (i = 0; i < inlen; i += 4) {
-                _efx_writed(efx, *((__le32 *)(inbuf + i)), pdu + 4 + i);
-                /* use wmb() within loop to inhibit write combining */
-                wmb();
-        }
+        for (i = 0; i < inlen; i += 4)
+                efx_mcdi_writed(efx, (const efx_dword_t *)(inbuf + i),
+                                pdu + 4 + i);
 
         /* ring the doorbell with a distinctive value */
-        _efx_writed(efx, (__force __le32) 0x45789abc, doorbell);
-        wmb();
+        EFX_POPULATE_DWORD_1(hdr, EFX_DWORD_0, 0x45789abc);
+        efx_mcdi_writed(efx, &hdr, doorbell);
 }
 
 static void efx_mcdi_copyout(struct efx_nic *efx, u8 *outbuf, size_t outlen)
 {
         struct efx_mcdi_iface *mcdi = efx_mcdi(efx);
-        unsigned int pdu = FR_CZ_MC_TREG_SMEM + MCDI_PDU(efx);
+        unsigned int pdu = MCDI_PDU(efx);
         int i;
 
         BUG_ON(atomic_read(&mcdi->state) == MCDI_STATE_QUIESCENT);
         BUG_ON(outlen & 3 || outlen >= 0x100);
 
         for (i = 0; i < outlen; i += 4)
-                *((__le32 *)(outbuf + i)) = _efx_readd(efx, pdu + 4 + i);
+                efx_mcdi_readd(efx, (efx_dword_t *)(outbuf + i), pdu + 4 + i);
 }
 
 static int efx_mcdi_poll(struct efx_nic *efx)
@@ -123,7 +135,7 @@ static int efx_mcdi_poll(struct efx_nic *efx)
         struct efx_mcdi_iface *mcdi = efx_mcdi(efx);
         unsigned int time, finish;
         unsigned int respseq, respcmd, error;
-        unsigned int pdu = FR_CZ_MC_TREG_SMEM + MCDI_PDU(efx);
+        unsigned int pdu = MCDI_PDU(efx);
         unsigned int rc, spins;
         efx_dword_t reg;
 
@@ -149,8 +161,7 @@ static int efx_mcdi_poll(struct efx_nic *efx)
 
                 time = get_seconds();
 
-                rmb();
-                efx_readd(efx, &reg, pdu);
+                efx_mcdi_readd(efx, &reg, pdu);
 
                 /* All 1's indicates that shared memory is in reset (and is
                  * not a valid header). Wait for it to come out reset before
@@ -177,7 +188,7 @@ static int efx_mcdi_poll(struct efx_nic *efx)
                           respseq, mcdi->seqno);
                 rc = EIO;
         } else if (error) {
-                efx_readd(efx, &reg, pdu + 4);
+                efx_mcdi_readd(efx, &reg, pdu + 4);
                 switch (EFX_DWORD_FIELD(reg, EFX_DWORD_0)) {
 #define TRANSLATE_ERROR(name)                                   \
                 case MC_CMD_ERR_ ## name:                       \
@@ -211,21 +222,21 @@ out:
 /* Test and clear MC-rebooted flag for this port/function */
 int efx_mcdi_poll_reboot(struct efx_nic *efx)
 {
-        unsigned int addr = FR_CZ_MC_TREG_SMEM + MCDI_REBOOT_FLAG(efx);
+        unsigned int addr = MCDI_REBOOT_FLAG(efx);
         efx_dword_t reg;
         uint32_t value;
 
         if (efx_nic_rev(efx) < EFX_REV_SIENA_A0)
                 return false;
 
-        efx_readd(efx, &reg, addr);
+        efx_mcdi_readd(efx, &reg, addr);
         value = EFX_DWORD_FIELD(reg, EFX_DWORD_0);
 
         if (value == 0)
                 return 0;
 
         EFX_ZERO_DWORD(reg);
-        efx_writed(efx, &reg, addr);
+        efx_mcdi_writed(efx, &reg, addr);
 
         if (value == MC_STATUS_DWORD_ASSERT)
                 return -EINTR;
diff --git a/drivers/net/sfc/nic.c b/drivers/net/sfc/nic.c
index 5ac9fa2cd3bc..f2a2b947f860 100644
--- a/drivers/net/sfc/nic.c
+++ b/drivers/net/sfc/nic.c
@@ -1935,6 +1935,13 @@ void efx_nic_get_regs(struct efx_nic *efx, void *buf)
 
                 size = min_t(size_t, table->step, 16);
 
+                if (table->offset >= efx->type->mem_map_size) {
+                        /* No longer mapped; return dummy data */
+                        memcpy(buf, "\xde\xc0\xad\xde", 4);
+                        buf += table->rows * size;
+                        continue;
+                }
+
                 for (i = 0; i < table->rows; i++) {
                         switch (table->step) {
                         case 4: /* 32-bit register or SRAM */
diff --git a/drivers/net/sfc/nic.h b/drivers/net/sfc/nic.h
index 7443f99c977f..4bd1f2839dfe 100644
--- a/drivers/net/sfc/nic.h
+++ b/drivers/net/sfc/nic.h
@@ -143,10 +143,12 @@ static inline struct falcon_board *falcon_board(struct efx_nic *efx)
 /**
  * struct siena_nic_data - Siena NIC state
  * @mcdi: Management-Controller-to-Driver Interface
+ * @mcdi_smem: MCDI shared memory mapping. The mapping is always uncacheable.
  * @wol_filter_id: Wake-on-LAN packet filter id
  */
 struct siena_nic_data {
         struct efx_mcdi_iface mcdi;
+        void __iomem *mcdi_smem;
         int wol_filter_id;
 };
 
diff --git a/drivers/net/sfc/siena.c b/drivers/net/sfc/siena.c
index ceac1c9907f0..fb4721f780ff 100644
--- a/drivers/net/sfc/siena.c
+++ b/drivers/net/sfc/siena.c
@@ -220,12 +220,26 @@ static int siena_probe_nic(struct efx_nic *efx)
         efx_reado(efx, &reg, FR_AZ_CS_DEBUG);
         efx->net_dev->dev_id = EFX_OWORD_FIELD(reg, FRF_CZ_CS_PORT_NUM) - 1;
 
+        /* Initialise MCDI */
+        nic_data->mcdi_smem = ioremap_nocache(efx->membase_phys +
+                                              FR_CZ_MC_TREG_SMEM,
+                                              FR_CZ_MC_TREG_SMEM_STEP *
+                                              FR_CZ_MC_TREG_SMEM_ROWS);
+        if (!nic_data->mcdi_smem) {
+                netif_err(efx, probe, efx->net_dev,
+                          "could not map MCDI at %llx+%x\n",
+                          (unsigned long long)efx->membase_phys +
+                          FR_CZ_MC_TREG_SMEM,
+                          FR_CZ_MC_TREG_SMEM_STEP * FR_CZ_MC_TREG_SMEM_ROWS);
+                rc = -ENOMEM;
+                goto fail1;
+        }
         efx_mcdi_init(efx);
 
         /* Recover from a failed assertion before probing */
         rc = efx_mcdi_handle_assertion(efx);
         if (rc)
-                goto fail1;
+                goto fail2;
 
         /* Let the BMC know that the driver is now in charge of link and
          * filter settings. We must do this before we reset the NIC */
@@ -280,6 +294,7 @@ fail4:
 fail3:
         efx_mcdi_drv_attach(efx, false, NULL);
 fail2:
+        iounmap(nic_data->mcdi_smem);
 fail1:
         kfree(efx->nic_data);
         return rc;
@@ -359,6 +374,8 @@ static int siena_init_nic(struct efx_nic *efx)
 
 static void siena_remove_nic(struct efx_nic *efx)
 {
+        struct siena_nic_data *nic_data = efx->nic_data;
+
         efx_nic_free_buffer(efx, &efx->irq_status);
 
         siena_reset_hw(efx, RESET_TYPE_ALL);
@@ -368,7 +385,8 @@ static void siena_remove_nic(struct efx_nic *efx)
                 efx_mcdi_drv_attach(efx, false, NULL);
 
         /* Tear down the private nic state */
-        kfree(efx->nic_data);
+        iounmap(nic_data->mcdi_smem);
+        kfree(nic_data);
         efx->nic_data = NULL;
 }
 
@@ -606,8 +624,7 @@ const struct efx_nic_type siena_a0_nic_type = {
         .default_mac_ops = &efx_mcdi_mac_operations,
 
         .revision = EFX_REV_SIENA_A0,
-        .mem_map_size = (FR_CZ_MC_TREG_SMEM +
-                         FR_CZ_MC_TREG_SMEM_STEP * FR_CZ_MC_TREG_SMEM_ROWS),
+        .mem_map_size = FR_CZ_MC_TREG_SMEM, /* MC_TREG_SMEM mapped separately */
         .txd_ptr_tbl_base = FR_BZ_TX_DESC_PTR_TBL,
         .rxd_ptr_tbl_base = FR_BZ_RX_DESC_PTR_TBL,
         .buf_tbl_base = FR_BZ_BUF_FULL_TBL,
diff --git a/drivers/net/vmxnet3/vmxnet3_ethtool.c b/drivers/net/vmxnet3/vmxnet3_ethtool.c
index 64303eb3a5fc..dc959fe27aa5 100644
--- a/drivers/net/vmxnet3/vmxnet3_ethtool.c
+++ b/drivers/net/vmxnet3/vmxnet3_ethtool.c
@@ -276,6 +276,7 @@ int vmxnet3_set_features(struct net_device *netdev, u32 features)
                         adapter->shared->devRead.misc.uptFeatures &=
                         ~UPT1_F_RXCSUM;
 
+                /* update harware LRO capability accordingly */
                 if (features & NETIF_F_LRO)
                         adapter->shared->devRead.misc.uptFeatures |=
                                                         UPT1_F_LRO;
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index 45303bdbc465..17ebdf1e8b7b 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -2265,6 +2265,8 @@ static void ath9k_set_coverage_class(struct ieee80211_hw *hw, u8 coverage_class)
 static void ath9k_flush(struct ieee80211_hw *hw, bool drop)
 {
         struct ath_softc *sc = hw->priv;
+        struct ath_hw *ah = sc->sc_ah;
+        struct ath_common *common = ath9k_hw_common(ah);
         int timeout = 200; /* ms */
         int i, j;
         bool drain_txq;
@@ -2272,6 +2274,12 @@ static void ath9k_flush(struct ieee80211_hw *hw, bool drop)
         mutex_lock(&sc->mutex);
         cancel_delayed_work_sync(&sc->tx_complete_work);
 
+        if (sc->sc_flags & SC_OP_INVALID) {
+                ath_dbg(common, ATH_DBG_ANY, "Device not present\n");
+                mutex_unlock(&sc->mutex);
+                return;
+        }
+
         if (drop)
                 timeout = 1;
 
diff --git a/drivers/net/wireless/iwlegacy/iwl-core.c b/drivers/net/wireless/iwlegacy/iwl-core.c
index d743373a9424..42df8321dae8 100644
--- a/drivers/net/wireless/iwlegacy/iwl-core.c
+++ b/drivers/net/wireless/iwlegacy/iwl-core.c
@@ -2151,6 +2151,13 @@ int iwl_legacy_mac_config(struct ieee80211_hw *hw, u32 changed)
                         goto set_ch_out;
                 }
 
+                if (priv->iw_mode == NL80211_IFTYPE_ADHOC &&
+                    !iwl_legacy_is_channel_ibss(ch_info)) {
+                        IWL_DEBUG_MAC80211(priv, "leave - not IBSS channel\n");
+                        ret = -EINVAL;
+                        goto set_ch_out;
+                }
+
                 spin_lock_irqsave(&priv->lock, flags);
 
                 for_each_context(priv, ctx) {
diff --git a/drivers/net/wireless/iwlegacy/iwl-dev.h b/drivers/net/wireless/iwlegacy/iwl-dev.h
index 2d87dba2cfa3..be0106c6a2da 100644
--- a/drivers/net/wireless/iwlegacy/iwl-dev.h
+++ b/drivers/net/wireless/iwlegacy/iwl-dev.h
@@ -1411,6 +1411,12 @@ iwl_legacy_is_channel_passive(const struct iwl_channel_info *ch)
         return (!(ch->flags & EEPROM_CHANNEL_ACTIVE)) ? 1 : 0;
 }
 
+static inline int
+iwl_legacy_is_channel_ibss(const struct iwl_channel_info *ch)
+{
+        return (ch->flags & EEPROM_CHANNEL_IBSS) ? 1 : 0;
+}
+
 static inline void
 __iwl_legacy_free_pages(struct iwl_priv *priv, struct page *page)
 {
diff --git a/drivers/net/wireless/libertas/cmd.c b/drivers/net/wireless/libertas/cmd.c
index 6d59b4cf8fce..84566db486d2 100644
--- a/drivers/net/wireless/libertas/cmd.c
+++ b/drivers/net/wireless/libertas/cmd.c
@@ -1354,8 +1354,8 @@ int lbs_execute_next_command(struct lbs_private *priv)
                                     cpu_to_le16(PS_MODE_ACTION_EXIT_PS)) {
                                         lbs_deb_host(
                                                "EXEC_NEXT_CMD: ignore ENTER_PS cmd\n");
-                                        list_del(&cmdnode->list);
                                         spin_lock_irqsave(&priv->driver_lock, flags);
+                                        list_del(&cmdnode->list);
                                         lbs_complete_command(priv, cmdnode, 0);
                                         spin_unlock_irqrestore(&priv->driver_lock, flags);
 
@@ -1367,8 +1367,8 @@ int lbs_execute_next_command(struct lbs_private *priv)
                                     (priv->psstate == PS_STATE_PRE_SLEEP)) {
                                         lbs_deb_host(
                                                "EXEC_NEXT_CMD: ignore EXIT_PS cmd in sleep\n");
-                                        list_del(&cmdnode->list);
                                         spin_lock_irqsave(&priv->driver_lock, flags);
+                                        list_del(&cmdnode->list);
                                         lbs_complete_command(priv, cmdnode, 0);
                                         spin_unlock_irqrestore(&priv->driver_lock, flags);
                                         priv->needtowakeup = 1;
@@ -1381,7 +1381,9 @@ int lbs_execute_next_command(struct lbs_private *priv)
                                        "EXEC_NEXT_CMD: sending EXIT_PS\n");
                         }
                 }
+                spin_lock_irqsave(&priv->driver_lock, flags);
                 list_del(&cmdnode->list);
+                spin_unlock_irqrestore(&priv->driver_lock, flags);
                 lbs_deb_host("EXEC_NEXT_CMD: sending command 0x%04x\n",
                             le16_to_cpu(cmd->command));
                 lbs_submit_command(priv, cmdnode);
diff --git a/drivers/net/zorro8390.c b/drivers/net/zorro8390.c
index b78a38d9172a..8c7c522a056a 100644
--- a/drivers/net/zorro8390.c
+++ b/drivers/net/zorro8390.c
@@ -126,7 +126,7 @@ static int __devinit zorro8390_init_one(struct zorro_dev *z,
 
     board = z->resource.start;
     ioaddr = board+cards[i].offset;
-    dev = alloc_ei_netdev();
+    dev = ____alloc_ei_netdev(0);
     if (!dev)
         return -ENOMEM;
     if (!request_mem_region(ioaddr, NE_IO_EXTENT*2, DRV_NAME)) {
@@ -146,15 +146,15 @@ static int __devinit zorro8390_init_one(struct zorro_dev *z,
 static const struct net_device_ops zorro8390_netdev_ops = {
         .ndo_open               = zorro8390_open,
         .ndo_stop               = zorro8390_close,
-        .ndo_start_xmit         = ei_start_xmit,
-        .ndo_tx_timeout         = ei_tx_timeout,
-        .ndo_get_stats          = ei_get_stats,
-        .ndo_set_multicast_list = ei_set_multicast_list,
+        .ndo_start_xmit         = __ei_start_xmit,
+        .ndo_tx_timeout         = __ei_tx_timeout,
+        .ndo_get_stats          = __ei_get_stats,
+        .ndo_set_multicast_list = __ei_set_multicast_list,
         .ndo_validate_addr      = eth_validate_addr,
         .ndo_set_mac_address    = eth_mac_addr,
         .ndo_change_mtu         = eth_change_mtu,
 #ifdef CONFIG_NET_POLL_CONTROLLER
-        .ndo_poll_controller    = ei_poll,
+        .ndo_poll_controller    = __ei_poll,
 #endif
 };
 
diff --git a/include/net/inet_ecn.h b/include/net/inet_ecn.h
index 88bdd010d65d..2fa8d1341a0a 100644
--- a/include/net/inet_ecn.h
+++ b/include/net/inet_ecn.h
@@ -38,9 +38,19 @@ static inline __u8 INET_ECN_encapsulate(__u8 outer, __u8 inner)
         return outer;
 }
 
-#define INET_ECN_xmit(sk) do { inet_sk(sk)->tos |= INET_ECN_ECT_0; } while (0)
-#define INET_ECN_dontxmit(sk) \
-        do { inet_sk(sk)->tos &= ~INET_ECN_MASK; } while (0)
+static inline void INET_ECN_xmit(struct sock *sk)
+{
+        inet_sk(sk)->tos |= INET_ECN_ECT_0;
+        if (inet6_sk(sk) != NULL)
+                inet6_sk(sk)->tclass |= INET_ECN_ECT_0;
+}
+
+static inline void INET_ECN_dontxmit(struct sock *sk)
+{
+        inet_sk(sk)->tos &= ~INET_ECN_MASK;
+        if (inet6_sk(sk) != NULL)
+                inet6_sk(sk)->tclass &= ~INET_ECN_MASK;
+}
 
 #define IP6_ECN_flow_init(label) do {           \
       (label) &= ~htonl(INET_ECN_MASK << 20);   \
diff --git a/include/net/llc_pdu.h b/include/net/llc_pdu.h
index 75b8e2968c9b..f57e7d46a453 100644
--- a/include/net/llc_pdu.h
+++ b/include/net/llc_pdu.h
@@ -199,7 +199,7 @@ struct llc_pdu_sn {
         u8 ssap;
         u8 ctrl_1;
         u8 ctrl_2;
-};
+} __packed;
 
 static inline struct llc_pdu_sn *llc_pdu_sn_hdr(struct sk_buff *skb)
 {
@@ -211,7 +211,7 @@ struct llc_pdu_un {
         u8 dsap;
         u8 ssap;
         u8 ctrl_1;
-};
+} __packed;
 
 static inline struct llc_pdu_un *llc_pdu_un_hdr(struct sk_buff *skb)
 {
@@ -359,7 +359,7 @@ struct llc_xid_info {
         u8 fmt_id;      /* always 0x81 for LLC */
         u8 type;        /* different if NULL/non-NULL LSAP */
         u8 rw;          /* sender receive window */
-};
+} __packed;
 
 /**
  *      llc_pdu_init_as_xid_cmd - sets bytes 3, 4 & 5 of LLC header as XID
@@ -415,7 +415,7 @@ struct llc_frmr_info {
         u8  curr_ssv;           /* current send state variable val */
         u8  curr_rsv;           /* current receive state variable */
         u8  ind_bits;           /* indicator bits set with macro */
-};
+} __packed;
 
 extern void llc_pdu_set_cmd_rsp(struct sk_buff *skb, u8 type);
 extern void llc_pdu_set_pf_bit(struct sk_buff *skb, u8 bit_value);
diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index 5614907525e1..e1f5ec75e91c 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -737,7 +737,7 @@ static unsigned int br_nf_forward_ip(unsigned int hook, struct sk_buff *skb,
                 nf_bridge->mask |= BRNF_PKT_TYPE;
         }
 
-        if (br_parse_ip_options(skb))
+        if (pf == PF_INET && br_parse_ip_options(skb))
                 return NF_DROP;
 
         /* The physdev module checks on this */
diff --git a/net/core/dev.c b/net/core/dev.c
index 3ed09f8ecbf8..155de2094e71 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1007,7 +1007,7 @@ rollback:
         }
 
         write_lock_bh(&dev_base_lock);
-        hlist_del(&dev->name_hlist);
+        hlist_del_rcu(&dev->name_hlist);
         write_unlock_bh(&dev_base_lock);
 
         synchronize_rcu();
@@ -5196,27 +5196,27 @@ u32 netdev_fix_features(struct net_device *dev, u32 features)
         /* Fix illegal checksum combinations */
         if ((features & NETIF_F_HW_CSUM) &&
             (features & (NETIF_F_IP_CSUM|NETIF_F_IPV6_CSUM))) {
-                netdev_info(dev, "mixed HW and IP checksum settings.\n");
+                netdev_warn(dev, "mixed HW and IP checksum settings.\n");
                 features &= ~(NETIF_F_IP_CSUM|NETIF_F_IPV6_CSUM);
         }
 
         if ((features & NETIF_F_NO_CSUM) &&
             (features & (NETIF_F_HW_CSUM|NETIF_F_IP_CSUM|NETIF_F_IPV6_CSUM))) {
-                netdev_info(dev, "mixed no checksumming and other settings.\n");
+                netdev_warn(dev, "mixed no checksumming and other settings.\n");
                 features &= ~(NETIF_F_IP_CSUM|NETIF_F_IPV6_CSUM|NETIF_F_HW_CSUM);
         }
 
         /* Fix illegal SG+CSUM combinations. */
         if ((features & NETIF_F_SG) &&
             !(features & NETIF_F_ALL_CSUM)) {
-                netdev_info(dev,
-                            "Dropping NETIF_F_SG since no checksum feature.\n");
+                netdev_dbg(dev,
+                        "Dropping NETIF_F_SG since no checksum feature.\n");
                 features &= ~NETIF_F_SG;
         }
 
         /* TSO requires that SG is present as well. */
         if ((features & NETIF_F_ALL_TSO) && !(features & NETIF_F_SG)) {
-                netdev_info(dev, "Dropping TSO features since no SG feature.\n");
+                netdev_dbg(dev, "Dropping TSO features since no SG feature.\n");
                 features &= ~NETIF_F_ALL_TSO;
         }
 
@@ -5226,7 +5226,7 @@ u32 netdev_fix_features(struct net_device *dev, u32 features)
 
         /* Software GSO depends on SG. */
         if ((features & NETIF_F_GSO) && !(features & NETIF_F_SG)) {
-                netdev_info(dev, "Dropping NETIF_F_GSO since no SG feature.\n");
+                netdev_dbg(dev, "Dropping NETIF_F_GSO since no SG feature.\n");
                 features &= ~NETIF_F_GSO;
         }
 
@@ -5236,13 +5236,13 @@ u32 netdev_fix_features(struct net_device *dev, u32 features)
                 if (!((features & NETIF_F_GEN_CSUM) ||
                     (features & (NETIF_F_IP_CSUM|NETIF_F_IPV6_CSUM))
                             == (NETIF_F_IP_CSUM|NETIF_F_IPV6_CSUM))) {
-                        netdev_info(dev,
+                        netdev_dbg(dev,
                                 "Dropping NETIF_F_UFO since no checksum offload features.\n");
                         features &= ~NETIF_F_UFO;
                 }
 
                 if (!(features & NETIF_F_SG)) {
-                        netdev_info(dev,
+                        netdev_dbg(dev,
                                 "Dropping NETIF_F_UFO since no NETIF_F_SG feature.\n");
                         features &= ~NETIF_F_UFO;
                 }
@@ -5270,7 +5270,7 @@ int __netdev_update_features(struct net_device *dev)
         if (dev->features == features)
                 return 0;
 
-        netdev_info(dev, "Features changed: 0x%08x -> 0x%08x\n",
+        netdev_dbg(dev, "Features changed: 0x%08x -> 0x%08x\n",
                 dev->features, features);
 
         if (dev->netdev_ops->ndo_set_features)
@@ -5462,12 +5462,6 @@ int register_netdevice(struct net_device *dev)
         dev->features |= NETIF_F_SOFT_FEATURES;
         dev->wanted_features = dev->features & dev->hw_features;
 
-        /* Avoid warning from netdev_fix_features() for GSO without SG */
-        if (!(dev->wanted_features & NETIF_F_SG)) {
-                dev->wanted_features &= ~NETIF_F_GSO;
-                dev->features &= ~NETIF_F_GSO;
-        }
-
         /* Turn on no cache copy if HW is doing checksum */
         dev->hw_features |= NETIF_F_NOCACHE_COPY;
         if ((dev->features & NETIF_F_ALL_CSUM) &&
diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index b8c2bcfee6af..84e7304532e6 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -332,7 +332,7 @@ static const char netdev_features_strings[ETHTOOL_DEV_FEATURE_WORDS * 32][ETH_GS
         /* NETIF_F_IP_CSUM */         "tx-checksum-ipv4",
         /* NETIF_F_NO_CSUM */         "tx-checksum-unneeded",
         /* NETIF_F_HW_CSUM */         "tx-checksum-ip-generic",
-        /* NETIF_F_IPV6_CSUM */       "tx_checksum-ipv6",
+        /* NETIF_F_IPV6_CSUM */       "tx-checksum-ipv6",
         /* NETIF_F_HIGHDMA */         "highdma",
         /* NETIF_F_FRAGLIST */        "tx-scatter-gather-fraglist",
         /* NETIF_F_HW_VLAN_TX */      "tx-vlan-hw-insert",
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 6eeaaa2bbafe..64e0f7587e6d 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -237,6 +237,10 @@ ieee80211_tx_h_dynamic_ps(struct ieee80211_tx_data *tx)
                                      &local->dynamic_ps_disable_work);
         }
 
+        /* Don't restart the timer if we're not disassociated */
+        if (!ifmgd->associated)
+                return TX_CONTINUE;
+
         mod_timer(&local->dynamic_ps_timer, jiffies +
                   msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout));
 
diff --git a/net/netfilter/ipvs/ip_vs_app.c b/net/netfilter/ipvs/ip_vs_app.c
index 51f3af7c4743..059af3120be7 100644
--- a/net/netfilter/ipvs/ip_vs_app.c
+++ b/net/netfilter/ipvs/ip_vs_app.c
@@ -572,7 +572,7 @@ static const struct file_operations ip_vs_app_fops = {
         .open    = ip_vs_app_open,
         .read    = seq_read,
         .llseek  = seq_lseek,
-        .release = seq_release,
+        .release = seq_release_net,
 };
 #endif
 
diff --git a/net/netfilter/ipvs/ip_vs_conn.c b/net/netfilter/ipvs/ip_vs_conn.c
index d3fd91bbba49..bf28ac2fc99b 100644
--- a/net/netfilter/ipvs/ip_vs_conn.c
+++ b/net/netfilter/ipvs/ip_vs_conn.c
@@ -1046,7 +1046,7 @@ static const struct file_operations ip_vs_conn_fops = {
         .open    = ip_vs_conn_open,
         .read    = seq_read,
         .llseek  = seq_lseek,
-        .release = seq_release,
+        .release = seq_release_net,
 };
 
 static const char *ip_vs_origin_name(unsigned flags)
@@ -1114,7 +1114,7 @@ static const struct file_operations ip_vs_conn_sync_fops = {
         .open    = ip_vs_conn_sync_open,
         .read    = seq_read,
         .llseek  = seq_lseek,
-        .release = seq_release,
+        .release = seq_release_net,
 };
 
 #endif
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index 89842f06931d..699c79a55657 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -2066,7 +2066,7 @@ static const struct file_operations ip_vs_info_fops = {
         .open    = ip_vs_info_open,
         .read    = seq_read,
         .llseek  = seq_lseek,
-        .release = seq_release_private,
+        .release = seq_release_net,
 };
 
 static int ip_vs_stats_show(struct seq_file *seq, void *v)
@@ -2106,7 +2106,7 @@ static const struct file_operations ip_vs_stats_fops = {
         .open = ip_vs_stats_seq_open,
         .read = seq_read,
         .llseek = seq_lseek,
-        .release = single_release,
+        .release = single_release_net,
 };
 
 static int ip_vs_stats_percpu_show(struct seq_file *seq, void *v)
@@ -2175,7 +2175,7 @@ static const struct file_operations ip_vs_stats_percpu_fops = {
         .open = ip_vs_stats_percpu_seq_open,
         .read = seq_read,
         .llseek = seq_lseek,
-        .release = single_release,
+        .release = single_release_net,
 };
 #endif
 
diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c
index 237cc1981b89..cb5a28581782 100644
--- a/net/netfilter/nf_conntrack_sip.c
+++ b/net/netfilter/nf_conntrack_sip.c
@@ -1419,6 +1419,7 @@ static int sip_help_tcp(struct sk_buff *skb, unsigned int protoff,
         const char *dptr, *end;
         s16 diff, tdiff = 0;
         int ret = NF_ACCEPT;
+        bool term;
         typeof(nf_nat_sip_seq_adjust_hook) nf_nat_sip_seq_adjust;
 
         if (ctinfo != IP_CT_ESTABLISHED &&
@@ -1453,14 +1454,21 @@ static int sip_help_tcp(struct sk_buff *skb, unsigned int protoff,
                 if (dptr + matchoff == end)
                         break;
 
-                if (end + strlen("\r\n\r\n") > dptr + datalen)
-                        break;
-                if (end[0] != '\r' || end[1] != '\n' ||
-                    end[2] != '\r' || end[3] != '\n')
+                term = false;
+                for (; end + strlen("\r\n\r\n") <= dptr + datalen; end++) {
+                        if (end[0] == '\r' && end[1] == '\n' &&
+                            end[2] == '\r' && end[3] == '\n') {
+                                term = true;
+                                break;
+                        }
+                }
+                if (!term)
                         break;
                 end += strlen("\r\n\r\n") + clen;
 
                 msglen = origlen = end - dptr;
+                if (msglen > datalen)
+                        return NF_DROP;
 
                 ret = process_sip_msg(skb, ct, dataoff, &dptr, &msglen);
                 if (ret != NF_ACCEPT)
diff --git a/net/socket.c b/net/socket.c
index ed50255143d5..2d5382d0de54 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -2232,14 +2232,16 @@ int __sys_recvmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
                  */
                 if (MSG_CMSG_COMPAT & flags) {
                         err = __sys_recvmsg(sock, (struct msghdr __user *)compat_entry,
-                                            &msg_sys, flags, datagrams);
+                                            &msg_sys, flags & ~MSG_WAITFORONE,
+                                            datagrams);
                         if (err < 0)
                                 break;
                         err = __put_user(err, &compat_entry->msg_len);
                         ++compat_entry;
                 } else {
                         err = __sys_recvmsg(sock, (struct msghdr __user *)entry,
-                                            &msg_sys, flags, datagrams);
+                                            &msg_sys, flags & ~MSG_WAITFORONE,
+                                            datagrams);
                         if (err < 0)
                                 break;
                         err = put_user(err, &entry->msg_len);