89 files changed, 909 insertions, 566 deletions
diff --git a/MAINTAINERS b/MAINTAINERS
index 13608bd2e791..0924a76da873 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -2978,7 +2978,6 @@ F:	drivers/net/ixgb/
 F:      drivers/net/ixgbe/
 INTEL PRO/WIRELESS 2100 NETWORK CONNECTION SUPPORT
-M:      Zhu Yi <yi.zhu@intel.com>
 M:      Reinette Chatre <reinette.chatre@intel.com>
 M:      Intel Linux Wireless <ilw@linux.intel.com>
 L:      linux-wireless@vger.kernel.org
@@ -2988,7 +2987,6 @@ F:	Documentation/networking/README.ipw2100
 F:      drivers/net/wireless/ipw2x00/ipw2100.*
 INTEL PRO/WIRELESS 2915ABG NETWORK CONNECTION SUPPORT
-M:      Zhu Yi <yi.zhu@intel.com>
 M:      Reinette Chatre <reinette.chatre@intel.com>
 M:      Intel Linux Wireless <ilw@linux.intel.com>
 L:      linux-wireless@vger.kernel.org
@@ -3019,8 +3017,8 @@ F:	drivers/net/wimax/i2400m/
 F:      include/linux/wimax/i2400m.h
 INTEL WIRELESS WIFI LINK (iwlwifi)
-M:      Zhu Yi <yi.zhu@intel.com>
 M:      Reinette Chatre <reinette.chatre@intel.com>
+M:      Wey-Yi Guy <wey-yi.w.guy@intel.com>
 M:      Intel Linux Wireless <ilw@linux.intel.com>
 L:      linux-wireless@vger.kernel.org
 W:      http://intellinuxwireless.org
@@ -3030,7 +3028,6 @@ F:	drivers/net/wireless/iwlwifi/
 INTEL WIRELESS MULTICOMM 3200 WIFI (iwmc3200wifi)
 M:      Samuel Ortiz <samuel.ortiz@intel.com>
-M:      Zhu Yi <yi.zhu@intel.com>
 M:      Intel Linux Wireless <ilw@linux.intel.com>
 L:      linux-wireless@vger.kernel.org
 S:      Supported
diff --git a/drivers/isdn/capi/kcapi.c b/drivers/isdn/capi/kcapi.c
index bde3c88b8b27..b054494df846 100644
--- a/drivers/isdn/capi/kcapi.c
+++ b/drivers/isdn/capi/kcapi.c
@@ -1020,12 +1020,12 @@ static int old_capi_manufacturer(unsigned int cmd, void __user *data)
                if (cmd == AVMB1_ADDCARD) {
                   if ((retval = copy_from_user(&cdef, data,
                                            sizeof(avmb1_carddef))))
-                           return retval;
+                           return -EFAULT;
                   cdef.cardtype = AVM_CARDTYPE_B1;
                } else {
                   if ((retval = copy_from_user(&cdef, data,
                                            sizeof(avmb1_extcarddef))))
-                           return retval;
+                           return -EFAULT;
                }
                cparams.port = cdef.port;
                cparams.irq = cdef.irq;
@@ -1218,7 +1218,7 @@ int capi20_manufacturer(unsigned int cmd, void __user *data)
                kcapi_carddef cdef;
                if ((retval = copy_from_user(&cdef, data, sizeof(cdef))))
-                        return retval;
+                        return -EFAULT;
                cparams.port = cdef.port;
                cparams.irq = cdef.irq;
diff --git a/drivers/isdn/hardware/mISDN/hfcsusb.c b/drivers/isdn/hardware/mISDN/hfcsusb.c
index b3b7e2879bac..8700474747e8 100644
--- a/drivers/isdn/hardware/mISDN/hfcsusb.c
+++ b/drivers/isdn/hardware/mISDN/hfcsusb.c
@@ -97,8 +97,10 @@ static int write_reg(struct hfcsusb *hw, __u8 reg, __u8 val)
                        hw->name, __func__, reg, val);
        spin_lock(&hw->ctrl_lock);
-        if (hw->ctrl_cnt >= HFC_CTRL_BUFSIZE)
+        if (hw->ctrl_cnt >= HFC_CTRL_BUFSIZE) {
+                spin_unlock(&hw->ctrl_lock);
                return 1;
+        }
        buf = &hw->ctrl_buff[hw->ctrl_in_idx];
        buf->hfcs_reg = reg;
        buf->reg_val = val;
diff --git a/drivers/isdn/hardware/mISDN/netjet.c b/drivers/isdn/hardware/mISDN/netjet.c
index 0a3553df065f..54ae71a907f9 100644
--- a/drivers/isdn/hardware/mISDN/netjet.c
+++ b/drivers/isdn/hardware/mISDN/netjet.c
@@ -320,12 +320,12 @@ inittiger(struct tiger_hw *card)
                return -ENOMEM;
        }
        for (i = 0; i < 2; i++) {
-                card->bc[i].hsbuf = kmalloc(NJ_DMA_TXSIZE, GFP_KERNEL);
+                card->bc[i].hsbuf = kmalloc(NJ_DMA_TXSIZE, GFP_ATOMIC);
                if (!card->bc[i].hsbuf) {
                        pr_info("%s: no B%d send buffer\n", card->name, i + 1);
                        return -ENOMEM;
                }
-                card->bc[i].hrbuf = kmalloc(NJ_DMA_RXSIZE, GFP_KERNEL);
+                card->bc[i].hrbuf = kmalloc(NJ_DMA_RXSIZE, GFP_ATOMIC);
                if (!card->bc[i].hrbuf) {
                        pr_info("%s: no B%d recv buffer\n", card->name, i + 1);
                        return -ENOMEM;
diff --git a/drivers/net/8139cp.c b/drivers/net/8139cp.c
index 9c149750e2bf..284a5f4a63ac 100644
--- a/drivers/net/8139cp.c
+++ b/drivers/net/8139cp.c
@@ -598,8 +598,8 @@ rx_next:
                        goto rx_status_loop;
                spin_lock_irqsave(&cp->lock, flags);
-                cpw16_f(IntrMask, cp_intr_mask);
                __napi_complete(napi);
+                cpw16_f(IntrMask, cp_intr_mask);
                spin_unlock_irqrestore(&cp->lock, flags);
        }
diff --git a/drivers/net/8139too.c b/drivers/net/8139too.c
index 4ba72933f0da..97d8068b372b 100644
--- a/drivers/net/8139too.c
+++ b/drivers/net/8139too.c
@@ -860,6 +860,7 @@ retry:
                }
        /* if unknown chip, assume array element #0, original RTL-8139 in this case */
+        i = 0;
        dev_dbg(&pdev->dev, "unknown chip version, assuming RTL-8139\n");
        dev_dbg(&pdev->dev, "TxConfig = 0x%lx\n", RTL_R32 (TxConfig));
        tp->chipset = 0;
@@ -2088,8 +2089,8 @@ static int rtl8139_poll(struct napi_struct *napi, int budget)
                 * again when we think we are done.
                 */
                spin_lock_irqsave(&tp->lock, flags);
-                RTL_W16_F(IntrMask, rtl8139_intr_mask);
                __napi_complete(napi);
+                RTL_W16_F(IntrMask, rtl8139_intr_mask);
                spin_unlock_irqrestore(&tp->lock, flags);
        }
        spin_unlock(&tp->rx_lock);
diff --git a/drivers/net/benet/be_cmds.c b/drivers/net/benet/be_cmds.c
index 9d11dbf5e4da..b9ad799c719f 100644
--- a/drivers/net/benet/be_cmds.c
+++ b/drivers/net/benet/be_cmds.c
@@ -1429,7 +1429,7 @@ int be_cmd_write_flashrom(struct be_adapter *adapter, struct be_dma_mem *cmd,
        wrb = wrb_from_mccq(adapter);
        if (!wrb) {
                status = -EBUSY;
-                goto err;
+                goto err_unlock;
        }
        req = cmd->va;
        sge = nonembedded_sgl(wrb);
@@ -1457,7 +1457,10 @@ int be_cmd_write_flashrom(struct be_adapter *adapter, struct be_dma_mem *cmd,
        else
                status = adapter->flash_status;
-err:
+        return status;
+err_unlock:
+        spin_unlock_bh(&adapter->mcc_lock);
        return status;
 }
@@ -1497,7 +1500,7 @@ err:
        return status;
 }
-extern int be_cmd_enable_magic_wol(struct be_adapter *adapter, u8 *mac,
+int be_cmd_enable_magic_wol(struct be_adapter *adapter, u8 *mac,
                                struct be_dma_mem *nonemb_cmd)
 {
        struct be_mcc_wrb *wrb;
@@ -1590,7 +1593,7 @@ int be_cmd_loopback_test(struct be_adapter *adapter, u32 port_num,
        be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_LOWLEVEL,
                        OPCODE_LOWLEVEL_LOOPBACK_TEST, sizeof(*req));
-        req->hdr.timeout = 4;
+        req->hdr.timeout = cpu_to_le32(4);
        req->pattern = cpu_to_le64(pattern);
        req->src_port = cpu_to_le32(port_num);
@@ -1662,7 +1665,7 @@ err:
        return status;
 }
-extern int be_cmd_get_seeprom_data(struct be_adapter *adapter,
+int be_cmd_get_seeprom_data(struct be_adapter *adapter,
                                struct be_dma_mem *nonemb_cmd)
 {
        struct be_mcc_wrb *wrb;
diff --git a/drivers/net/bnx2.c b/drivers/net/bnx2.c
index 188e356c30a3..949d7a9dcf92 100644
--- a/drivers/net/bnx2.c
+++ b/drivers/net/bnx2.c
@@ -247,6 +247,7 @@ static const struct flash_spec flash_5709 = {
 MODULE_DEVICE_TABLE(pci, bnx2_pci_tbl);
 static void bnx2_init_napi(struct bnx2 *bp);
+static void bnx2_del_napi(struct bnx2 *bp);
 static inline u32 bnx2_tx_avail(struct bnx2 *bp, struct bnx2_tx_ring_info *txr)
 {
@@ -6270,6 +6271,7 @@ open_err:
        bnx2_free_skbs(bp);
        bnx2_free_irq(bp);
        bnx2_free_mem(bp);
+        bnx2_del_napi(bp);
        return rc;
 }
@@ -6537,6 +6539,7 @@ bnx2_close(struct net_device *dev)
        bnx2_free_irq(bp);
        bnx2_free_skbs(bp);
        bnx2_free_mem(bp);
+        bnx2_del_napi(bp);
        bp->link_up = 0;
        netif_carrier_off(bp->dev);
        bnx2_set_power_state(bp, PCI_D3hot);
@@ -8227,7 +8230,16 @@ bnx2_bus_string(struct bnx2 *bp, char *str)
        return str;
 }
-static void __devinit
+static void
+bnx2_del_napi(struct bnx2 *bp)
+{
+        int i;
+        for (i = 0; i < bp->irq_nvecs; i++)
+                netif_napi_del(&bp->bnx2_napi[i].napi);
+}
+static void
 bnx2_init_napi(struct bnx2 *bp)
 {
        int i;
diff --git a/drivers/net/can/mscan/mpc5xxx_can.c b/drivers/net/can/mscan/mpc5xxx_can.c
index 8af8442c694a..af753936e835 100644
--- a/drivers/net/can/mscan/mpc5xxx_can.c
+++ b/drivers/net/can/mscan/mpc5xxx_can.c
@@ -73,7 +73,7 @@ static u32 __devinit mpc52xx_can_get_clock(struct of_device *ofdev,
        else
                *mscan_clksrc = MSCAN_CLKSRC_XTAL;
-        freq = mpc5xxx_get_bus_frequency(ofdev->node);
+        freq = mpc5xxx_get_bus_frequency(ofdev->dev.of_node);
        if (!freq)
                return 0;
@@ -152,7 +152,7 @@ static u32 __devinit mpc512x_can_get_clock(struct of_device *ofdev,
        }
        /* Determine the MSCAN device index from the physical address */
-        pval = of_get_property(ofdev->node, "reg", &plen);
+        pval = of_get_property(ofdev->dev.of_node, "reg", &plen);
        BUG_ON(!pval || plen < sizeof(*pval));
        clockidx = (*pval & 0x80) ? 1 : 0;
        if (*pval & 0x2000)
@@ -168,11 +168,11 @@ static u32 __devinit mpc512x_can_get_clock(struct of_device *ofdev,
         */
        if (clock_name && !strcmp(clock_name, "ip")) {
                *mscan_clksrc = MSCAN_CLKSRC_IPS;
-                freq = mpc5xxx_get_bus_frequency(ofdev->node);
+                freq = mpc5xxx_get_bus_frequency(ofdev->dev.of_node);
        } else {
                *mscan_clksrc = MSCAN_CLKSRC_BUS;
-                pval = of_get_property(ofdev->node,
+                pval = of_get_property(ofdev->dev.of_node,
                                       "fsl,mscan-clock-divider", &plen);
                if (pval && plen == sizeof(*pval))
                        clockdiv = *pval;
@@ -251,7 +251,7 @@ static int __devinit mpc5xxx_can_probe(struct of_device *ofdev,
                                       const struct of_device_id *id)
 {
        struct mpc5xxx_can_data *data = (struct mpc5xxx_can_data *)id->data;
-        struct device_node *np = ofdev->node;
+        struct device_node *np = ofdev->dev.of_node;
        struct net_device *dev;
        struct mscan_priv *priv;
        void __iomem *base;
diff --git a/drivers/net/e1000/e1000_main.c b/drivers/net/e1000/e1000_main.c
index ebdea0891665..68a80893dce1 100644
--- a/drivers/net/e1000/e1000_main.c
+++ b/drivers/net/e1000/e1000_main.c
@@ -1047,15 +1047,14 @@ static int __devinit e1000_probe(struct pci_dev *pdev,
                goto err_register;
        /* print bus type/speed/width info */
-        e_info("(PCI%s:%s:%s) ",
+        e_info("(PCI%s:%dMHz:%d-bit) %pM\n",
-                ((hw->bus_type == e1000_bus_type_pcix) ? "-X" : ""),
+               ((hw->bus_type == e1000_bus_type_pcix) ? "-X" : ""),
-                ((hw->bus_speed == e1000_bus_speed_133) ? "133MHz" :
+               ((hw->bus_speed == e1000_bus_speed_133) ? 133 :
-                 (hw->bus_speed == e1000_bus_speed_120) ? "120MHz" :
+                (hw->bus_speed == e1000_bus_speed_120) ? 120 :
-                 (hw->bus_speed == e1000_bus_speed_100) ? "100MHz" :
+                (hw->bus_speed == e1000_bus_speed_100) ? 100 :
-                 (hw->bus_speed == e1000_bus_speed_66) ? "66MHz" : "33MHz"),
+                (hw->bus_speed == e1000_bus_speed_66) ? 66 : 33),
-                ((hw->bus_width == e1000_bus_width_64) ? "64-bit" : "32-bit"));
+               ((hw->bus_width == e1000_bus_width_64) ? 64 : 32),
+               netdev->dev_addr);
-        e_info("%pM\n", netdev->dev_addr);
        /* carrier off reporting is important to ethtool even BEFORE open */
        netif_carrier_off(netdev);
diff --git a/drivers/net/e1000e/netdev.c b/drivers/net/e1000e/netdev.c
index 24507f3b8b17..57a7e41da69e 100644
--- a/drivers/net/e1000e/netdev.c
+++ b/drivers/net/e1000e/netdev.c
@@ -2554,7 +2554,7 @@ static void e1000_init_manageability_pt(struct e1000_adapter *adapter)
                        mdef = er32(MDEF(i));
                        /* Ignore filters with anything other than IPMI ports */
-                        if (mdef & !(E1000_MDEF_PORT_623 | E1000_MDEF_PORT_664))
+                        if (mdef & ~(E1000_MDEF_PORT_623 | E1000_MDEF_PORT_664))
                                continue;
                        /* Enable this decision filter in MANC2H */
diff --git a/drivers/net/enic/enic.h b/drivers/net/enic/enic.h
index 85f2a2e7030a..45e86d1e5b1b 100644
--- a/drivers/net/enic/enic.h
+++ b/drivers/net/enic/enic.h
@@ -74,7 +74,14 @@ struct enic_msix_entry {
        void *devid;
 };
+#define ENIC_SET_APPLIED                (1 << 0)
+#define ENIC_SET_REQUEST                (1 << 1)
+#define ENIC_SET_NAME                   (1 << 2)
+#define ENIC_SET_INSTANCE               (1 << 3)
+#define ENIC_SET_HOST                   (1 << 4)
 struct enic_port_profile {
+        u32 set;
        u8 request;
        char name[PORT_PROFILE_MAX];
        u8 instance_uuid[PORT_UUID_MAX];
diff --git a/drivers/net/enic/enic_main.c b/drivers/net/enic/enic_main.c
index 6586b5c7e4b6..bc7d6b96de3d 100644
--- a/drivers/net/enic/enic_main.c
+++ b/drivers/net/enic/enic_main.c
@@ -1029,8 +1029,7 @@ static int enic_dev_init_done(struct enic *enic, int *done, int *error)
        return err;
 }
-static int enic_set_port_profile(struct enic *enic, u8 request, u8 *mac,
+static int enic_set_port_profile(struct enic *enic, u8 *mac)
-        char *name, u8 *instance_uuid, u8 *host_uuid)
 {
        struct vic_provinfo *vp;
        u8 oui[3] = VIC_PROVINFO_CISCO_OUI;
@@ -1040,97 +1039,112 @@ static int enic_set_port_profile(struct enic *enic, u8 request, u8 *mac,
                "%02X%02X-%02X%02X%02X%02X%0X%02X";
        int err;
-        if (!name)
+        err = enic_vnic_dev_deinit(enic);
-                return -EINVAL;
+        if (err)
+                return err;
-        if (!is_valid_ether_addr(mac))
+        switch (enic->pp.request) {
-                return -EADDRNOTAVAIL;
-        vp = vic_provinfo_alloc(GFP_KERNEL, oui, VIC_PROVINFO_LINUX_TYPE);
+        case PORT_REQUEST_ASSOCIATE:
-        if (!vp)
-                return -ENOMEM;
-        vic_provinfo_add_tlv(vp,
+                if (!(enic->pp.set & ENIC_SET_NAME) || !strlen(enic->pp.name))
-                VIC_LINUX_PROV_TLV_PORT_PROFILE_NAME_STR,
+                        return -EINVAL;
-                strlen(name) + 1, name);
-        vic_provinfo_add_tlv(vp,
-                VIC_LINUX_PROV_TLV_CLIENT_MAC_ADDR,
-                ETH_ALEN, mac);
-        if (instance_uuid) {
-                uuid = instance_uuid;
-                sprintf(uuid_str, uuid_fmt,
-                        uuid[0],  uuid[1],  uuid[2],  uuid[3],
-                        uuid[4],  uuid[5],  uuid[6],  uuid[7],
-                        uuid[8],  uuid[9],  uuid[10], uuid[11],
-                        uuid[12], uuid[13], uuid[14], uuid[15]);
-                vic_provinfo_add_tlv(vp,
-                        VIC_LINUX_PROV_TLV_CLIENT_UUID_STR,
-                        sizeof(uuid_str), uuid_str);
-        }
-        if (host_uuid) {
+                if (!is_valid_ether_addr(mac))
-                uuid = host_uuid;
+                        return -EADDRNOTAVAIL;
-                sprintf(uuid_str, uuid_fmt,
-                        uuid[0],  uuid[1],  uuid[2],  uuid[3],
-                        uuid[4],  uuid[5],  uuid[6],  uuid[7],
-                        uuid[8],  uuid[9],  uuid[10], uuid[11],
-                        uuid[12], uuid[13], uuid[14], uuid[15]);
-                vic_provinfo_add_tlv(vp,
-                        VIC_LINUX_PROV_TLV_HOST_UUID_STR,
-                        sizeof(uuid_str), uuid_str);
-        }
-        err = enic_vnic_dev_deinit(enic);
+                vp = vic_provinfo_alloc(GFP_KERNEL, oui,
-        if (err)
+                        VIC_PROVINFO_LINUX_TYPE);
-                goto err_out;
+                if (!vp)
+                        return -ENOMEM;
-        memset(&enic->pp, 0, sizeof(enic->pp));
+                vic_provinfo_add_tlv(vp,
+                        VIC_LINUX_PROV_TLV_PORT_PROFILE_NAME_STR,
+                        strlen(enic->pp.name) + 1, enic->pp.name);
-        err = enic_dev_init_prov(enic, vp);
+                vic_provinfo_add_tlv(vp,
-        if (err)
+                        VIC_LINUX_PROV_TLV_CLIENT_MAC_ADDR,
-                goto err_out;
+                        ETH_ALEN, mac);
+                if (enic->pp.set & ENIC_SET_INSTANCE) {
+                        uuid = enic->pp.instance_uuid;
+                        sprintf(uuid_str, uuid_fmt,
+                                uuid[0],  uuid[1],  uuid[2],  uuid[3],
+                                uuid[4],  uuid[5],  uuid[6],  uuid[7],
+                                uuid[8],  uuid[9],  uuid[10], uuid[11],
+                                uuid[12], uuid[13], uuid[14], uuid[15]);
+                        vic_provinfo_add_tlv(vp,
+                                VIC_LINUX_PROV_TLV_CLIENT_UUID_STR,
+                                sizeof(uuid_str), uuid_str);
+                }
-        enic->pp.request = request;
+                if (enic->pp.set & ENIC_SET_HOST) {
-        memcpy(enic->pp.name, name, PORT_PROFILE_MAX);
+                        uuid = enic->pp.host_uuid;
-        if (instance_uuid)
+                        sprintf(uuid_str, uuid_fmt,
-                memcpy(enic->pp.instance_uuid,
+                                uuid[0],  uuid[1],  uuid[2],  uuid[3],
-                        instance_uuid, PORT_UUID_MAX);
+                                uuid[4],  uuid[5],  uuid[6],  uuid[7],
-        if (host_uuid)
+                                uuid[8],  uuid[9],  uuid[10], uuid[11],
-                memcpy(enic->pp.host_uuid,
+                                uuid[12], uuid[13], uuid[14], uuid[15]);
-                        host_uuid, PORT_UUID_MAX);
+                        vic_provinfo_add_tlv(vp,
+                                VIC_LINUX_PROV_TLV_HOST_UUID_STR,
+                                sizeof(uuid_str), uuid_str);
+                }
-err_out:
+                err = enic_dev_init_prov(enic, vp);
-        vic_provinfo_free(vp);
+                vic_provinfo_free(vp);
+                if (err)
+                        return err;
+                break;
-        return err;
+        case PORT_REQUEST_DISASSOCIATE:
-}
+                break;
-static int enic_unset_port_profile(struct enic *enic)
+        default:
-{
+                return -EINVAL;
-        memset(&enic->pp, 0, sizeof(enic->pp));
+        }
-        return enic_vnic_dev_deinit(enic);
+        enic->pp.set |= ENIC_SET_APPLIED;
+        return 0;
 }
 static int enic_set_vf_port(struct net_device *netdev, int vf,
        struct nlattr *port[])
 {
        struct enic *enic = netdev_priv(netdev);
-        char *name = NULL;
-        u8 *instance_uuid = NULL;
+        memset(&enic->pp, 0, sizeof(enic->pp));
-        u8 *host_uuid = NULL;
-        u8 request = PORT_REQUEST_DISASSOCIATE;
+        if (port[IFLA_PORT_REQUEST]) {
+                enic->pp.set |= ENIC_SET_REQUEST;
+                enic->pp.request = nla_get_u8(port[IFLA_PORT_REQUEST]);
+        }
+        if (port[IFLA_PORT_PROFILE]) {
+                enic->pp.set |= ENIC_SET_NAME;
+                memcpy(enic->pp.name, nla_data(port[IFLA_PORT_PROFILE]),
+                        PORT_PROFILE_MAX);
+        }
+        if (port[IFLA_PORT_INSTANCE_UUID]) {
+                enic->pp.set |= ENIC_SET_INSTANCE;
+                memcpy(enic->pp.instance_uuid,
+                        nla_data(port[IFLA_PORT_INSTANCE_UUID]), PORT_UUID_MAX);
+        }
+        if (port[IFLA_PORT_HOST_UUID]) {
+                enic->pp.set |= ENIC_SET_HOST;
+                memcpy(enic->pp.host_uuid,
+                        nla_data(port[IFLA_PORT_HOST_UUID]), PORT_UUID_MAX);
+        }
        /* don't support VFs, yet */
        if (vf != PORT_SELF_VF)
                return -EOPNOTSUPP;
-        if (port[IFLA_PORT_REQUEST])
+        if (!(enic->pp.set & ENIC_SET_REQUEST))
-                request = nla_get_u8(port[IFLA_PORT_REQUEST]);
+                return -EOPNOTSUPP;
-        switch (request) {
+        if (enic->pp.request == PORT_REQUEST_ASSOCIATE) {
-        case PORT_REQUEST_ASSOCIATE:
                /* If the interface mac addr hasn't been assigned,
                 * assign a random mac addr before setting port-
@@ -1139,30 +1153,9 @@ static int enic_set_vf_port(struct net_device *netdev, int vf,
                if (is_zero_ether_addr(netdev->dev_addr))
                        random_ether_addr(netdev->dev_addr);
-                if (port[IFLA_PORT_PROFILE])
-                        name = nla_data(port[IFLA_PORT_PROFILE]);
-                if (port[IFLA_PORT_INSTANCE_UUID])
-                        instance_uuid =
-                                nla_data(port[IFLA_PORT_INSTANCE_UUID]);
-                if (port[IFLA_PORT_HOST_UUID])
-                        host_uuid = nla_data(port[IFLA_PORT_HOST_UUID]);
-                return enic_set_port_profile(enic, request,
-                        netdev->dev_addr, name,
-                        instance_uuid, host_uuid);
-        case PORT_REQUEST_DISASSOCIATE:
-                return enic_unset_port_profile(enic);
-        default:
-                break;
        }
-        return -EOPNOTSUPP;
+        return enic_set_port_profile(enic, netdev->dev_addr);
 }
 static int enic_get_vf_port(struct net_device *netdev, int vf,
@@ -1172,14 +1165,12 @@ static int enic_get_vf_port(struct net_device *netdev, int vf,
        int err, error, done;
        u16 response = PORT_PROFILE_RESPONSE_SUCCESS;
-        /* don't support VFs, yet */
+        if (!(enic->pp.set & ENIC_SET_APPLIED))
-        if (vf != PORT_SELF_VF)
+                return -ENODATA;
-                return -EOPNOTSUPP;
        err = enic_dev_init_done(enic, &done, &error);
        if (err)
-                return err;
+                error = err;
        switch (error) {
        case ERR_SUCCESS:
@@ -1202,12 +1193,15 @@ static int enic_get_vf_port(struct net_device *netdev, int vf,
        NLA_PUT_U16(skb, IFLA_PORT_REQUEST, enic->pp.request);
        NLA_PUT_U16(skb, IFLA_PORT_RESPONSE, response);
-        NLA_PUT(skb, IFLA_PORT_PROFILE, PORT_PROFILE_MAX,
+        if (enic->pp.set & ENIC_SET_NAME)
-                enic->pp.name);
+                NLA_PUT(skb, IFLA_PORT_PROFILE, PORT_PROFILE_MAX,
-        NLA_PUT(skb, IFLA_PORT_INSTANCE_UUID, PORT_UUID_MAX,
+                        enic->pp.name);
-                enic->pp.instance_uuid);
+        if (enic->pp.set & ENIC_SET_INSTANCE)
-        NLA_PUT(skb, IFLA_PORT_HOST_UUID, PORT_UUID_MAX,
+                NLA_PUT(skb, IFLA_PORT_INSTANCE_UUID, PORT_UUID_MAX,
-                enic->pp.host_uuid);
+                        enic->pp.instance_uuid);
+        if (enic->pp.set & ENIC_SET_HOST)
+                NLA_PUT(skb, IFLA_PORT_HOST_UUID, PORT_UUID_MAX,
+                        enic->pp.host_uuid);
        return 0;
diff --git a/drivers/net/enic/vnic_dev.c b/drivers/net/enic/vnic_dev.c
index 2b3e16db5c82..e0d33281ec98 100644
--- a/drivers/net/enic/vnic_dev.c
+++ b/drivers/net/enic/vnic_dev.c
@@ -709,7 +709,7 @@ int vnic_dev_init_prov(struct vnic_dev *vdev, u8 *buf, u32 len)
 {
        u64 a0, a1 = len;
        int wait = 1000;
-        u64 prov_pa;
+        dma_addr_t prov_pa;
        void *prov_buf;
        int ret;
diff --git a/drivers/net/epic100.c b/drivers/net/epic100.c
index 6838dfc9ef23..4c274657283c 100644
--- a/drivers/net/epic100.c
+++ b/drivers/net/epic100.c
@@ -87,6 +87,7 @@ static int rx_copybreak;
 #include <linux/bitops.h>
 #include <asm/io.h>
 #include <asm/uaccess.h>
+#include <asm/byteorder.h>
 /* These identify the driver base version and may not be removed. */
 static char version[] __devinitdata =
@@ -230,7 +231,7 @@ static const u16 media2miictl[16] = {
 * The EPIC100 Rx and Tx buffer descriptors.  Note that these
 * really ARE host-endian; it's not a misannotation.  We tell
 * the card to byteswap them internally on big-endian hosts -
- * look for #ifdef CONFIG_BIG_ENDIAN in epic_open().
+ * look for #ifdef __BIG_ENDIAN in epic_open().
 */
 struct epic_tx_desc {
@@ -690,7 +691,7 @@ static int epic_open(struct net_device *dev)
                outl((inl(ioaddr + NVCTL) & ~0x003C) | 0x4800, ioaddr + NVCTL);
        /* Tell the chip to byteswap descriptors on big-endian hosts */
-#ifdef CONFIG_BIG_ENDIAN
+#ifdef __BIG_ENDIAN
        outl(0x4432 | (RX_FIFO_THRESH<<8), ioaddr + GENCTL);
        inl(ioaddr + GENCTL);
        outl(0x0432 | (RX_FIFO_THRESH<<8), ioaddr + GENCTL);
@@ -806,7 +807,7 @@ static void epic_restart(struct net_device *dev)
        for (i = 16; i > 0; i--)
                outl(0x0008, ioaddr + TEST1);
-#ifdef CONFIG_BIG_ENDIAN
+#ifdef __BIG_ENDIAN
        outl(0x0432 | (RX_FIFO_THRESH<<8), ioaddr + GENCTL);
 #else
        outl(0x0412 | (RX_FIFO_THRESH<<8), ioaddr + GENCTL);
diff --git a/drivers/net/fec.c b/drivers/net/fec.c
index ddf7a86cd466..edfff92a6d8e 100644
--- a/drivers/net/fec.c
+++ b/drivers/net/fec.c
@@ -1373,10 +1373,9 @@ fec_suspend(struct platform_device *dev, pm_message_t state)
        if (ndev) {
                fep = netdev_priv(ndev);
-                if (netif_running(ndev)) {
+                if (netif_running(ndev))
-                        netif_device_detach(ndev);
+                        fec_enet_close(ndev);
-                        fec_stop(ndev);
+                clk_disable(fep->clk);
-                }
        }
        return 0;
 }
@@ -1385,12 +1384,13 @@ static int
 fec_resume(struct platform_device *dev)
 {
        struct net_device *ndev = platform_get_drvdata(dev);
+        struct fec_enet_private *fep;
        if (ndev) {
-                if (netif_running(ndev)) {
+                fep = netdev_priv(ndev);
-                        fec_enet_init(ndev, 0);
+                clk_enable(fep->clk);
-                        netif_device_attach(ndev);
+                if (netif_running(ndev))
-                }
+                        fec_enet_open(ndev);
        }
        return 0;
 }
diff --git a/drivers/net/fs_enet/mac-fcc.c b/drivers/net/fs_enet/mac-fcc.c
index 5d45084b287d..48e91b6242ce 100644
--- a/drivers/net/fs_enet/mac-fcc.c
+++ b/drivers/net/fs_enet/mac-fcc.c
@@ -504,17 +504,54 @@ static int get_regs_len(struct net_device *dev)
 }
 /* Some transmit errors cause the transmitter to shut
- * down.  We now issue a restart transmit.  Since the
+ * down.  We now issue a restart transmit.
- * errors close the BD and update the pointers, the restart
+ * Also, to workaround 8260 device erratum CPM37, we must
- * _should_ pick up without having to reset any of our
+ * disable and then re-enable the transmitterfollowing a
- * pointers either.  Also, To workaround 8260 device erratum
+ * Late Collision, Underrun, or Retry Limit error.
- * CPM37, we must disable and then re-enable the transmitter
+ * In addition, tbptr may point beyond BDs beyond still marked
- * following a Late Collision, Underrun, or Retry Limit error.
+ * as ready due to internal pipelining, so we need to look back
+ * through the BDs and adjust tbptr to point to the last BD
+ * marked as ready.  This may result in some buffers being
+ * retransmitted.
 */
 static void tx_restart(struct net_device *dev)
 {
        struct fs_enet_private *fep = netdev_priv(dev);
        fcc_t __iomem *fccp = fep->fcc.fccp;
+        const struct fs_platform_info *fpi = fep->fpi;
+        fcc_enet_t __iomem *ep = fep->fcc.ep;
+        cbd_t __iomem *curr_tbptr;
+        cbd_t __iomem *recheck_bd;
+        cbd_t __iomem *prev_bd;
+        cbd_t __iomem *last_tx_bd;
+        last_tx_bd = fep->tx_bd_base + (fpi->tx_ring * sizeof(cbd_t));
+        /* get the current bd held in TBPTR  and scan back from this point */
+        recheck_bd = curr_tbptr = (cbd_t __iomem *)
+                ((R32(ep, fen_genfcc.fcc_tbptr) - fep->ring_mem_addr) +
+                fep->ring_base);
+        prev_bd = (recheck_bd == fep->tx_bd_base) ? last_tx_bd : recheck_bd - 1;
+        /* Move through the bds in reverse, look for the earliest buffer
+         * that is not ready.  Adjust TBPTR to the following buffer */
+        while ((CBDR_SC(prev_bd) & BD_ENET_TX_READY) != 0) {
+                /* Go back one buffer */
+                recheck_bd = prev_bd;
+                /* update the previous buffer */
+                prev_bd = (prev_bd == fep->tx_bd_base) ? last_tx_bd : prev_bd - 1;
+                /* We should never see all bds marked as ready, check anyway */
+                if (recheck_bd == curr_tbptr)
+                        break;
+        }
+        /* Now update the TBPTR and dirty flag to the current buffer */
+        W32(ep, fen_genfcc.fcc_tbptr,
+                (uint) (((void *)recheck_bd - fep->ring_base) +
+                fep->ring_mem_addr));
+        fep->dirty_tx = recheck_bd;
        C32(fccp, fcc_gfmr, FCC_GFMR_ENT);
        udelay(10);
diff --git a/drivers/net/gianfar.c b/drivers/net/gianfar.c
index 1830f3199cb5..46c69cd06553 100644
--- a/drivers/net/gianfar.c
+++ b/drivers/net/gianfar.c
@@ -747,8 +747,7 @@ static int gfar_of_init(struct of_device *ofdev, struct net_device **pdev)
                        FSL_GIANFAR_DEV_HAS_CSUM |
                        FSL_GIANFAR_DEV_HAS_VLAN |
                        FSL_GIANFAR_DEV_HAS_MAGIC_PACKET |
-                        FSL_GIANFAR_DEV_HAS_EXTENDED_HASH |
+                        FSL_GIANFAR_DEV_HAS_EXTENDED_HASH;
-                        FSL_GIANFAR_DEV_HAS_TIMER;
        ctype = of_get_property(np, "phy-connection-type", NULL);
diff --git a/drivers/net/greth.c b/drivers/net/greth.c
index f37a4c143ddd..3a029d02c2b4 100644
--- a/drivers/net/greth.c
+++ b/drivers/net/greth.c
@@ -1607,14 +1607,13 @@ static struct of_device_id greth_of_match[] = {
 MODULE_DEVICE_TABLE(of, greth_of_match);
 static struct of_platform_driver greth_of_driver = {
-        .name = "grlib-greth",
+        .driver = {
-        .match_table = greth_of_match,
+                .name = "grlib-greth",
+                .owner = THIS_MODULE,
+                .of_match_table = greth_of_match,
+        },
        .probe = greth_of_probe,
        .remove = __devexit_p(greth_of_remove),
-        .driver = {
-                   .owner = THIS_MODULE,
-                   .name = "grlib-greth",
-                   },
 };
 static int __init greth_init(void)
diff --git a/drivers/net/ixgbe/ixgbe_common.c b/drivers/net/ixgbe/ixgbe_common.c
index 1159d9138f05..9595b1bfb8dd 100644
--- a/drivers/net/ixgbe/ixgbe_common.c
+++ b/drivers/net/ixgbe/ixgbe_common.c
@@ -1188,6 +1188,7 @@ s32 ixgbe_set_rar_generic(struct ixgbe_hw *hw, u32 index, u8 *addr, u32 vmdq,
                IXGBE_WRITE_REG(hw, IXGBE_RAH(index), rar_high);
        } else {
                hw_dbg(hw, "RAR index %d is out of range.\n", index);
+                return IXGBE_ERR_RAR_INDEX;
        }
        return 0;
@@ -1219,6 +1220,7 @@ s32 ixgbe_clear_rar_generic(struct ixgbe_hw *hw, u32 index)
                IXGBE_WRITE_REG(hw, IXGBE_RAH(index), rar_high);
        } else {
                hw_dbg(hw, "RAR index %d is out of range.\n", index);
+                return IXGBE_ERR_RAR_INDEX;
        }
        /* clear VMDq pool/queue selection for this RAR */
diff --git a/drivers/net/ixgbe/ixgbe_ethtool.c b/drivers/net/ixgbe/ixgbe_ethtool.c
index c50a7541ffec..3a93a81872b8 100644
--- a/drivers/net/ixgbe/ixgbe_ethtool.c
+++ b/drivers/net/ixgbe/ixgbe_ethtool.c
@@ -2077,25 +2077,6 @@ static int ixgbe_get_coalesce(struct net_device *netdev,
        return 0;
 }
-/*
- * this function must be called before setting the new value of
- * rx_itr_setting
- */
-static bool ixgbe_reenable_rsc(struct ixgbe_adapter *adapter,
-                               struct ethtool_coalesce *ec)
-{
-        /* check the old value and enable RSC if necessary */
-        if ((adapter->rx_itr_setting == 0) &&
-            (adapter->flags2 & IXGBE_FLAG2_RSC_CAPABLE)) {
-                adapter->flags2 |= IXGBE_FLAG2_RSC_ENABLED;
-                adapter->netdev->features |= NETIF_F_LRO;
-                DPRINTK(PROBE, INFO, "rx-usecs set to %d, re-enabling RSC\n",
-                        ec->rx_coalesce_usecs);
-                return true;
-        }
-        return false;
-}
 static int ixgbe_set_coalesce(struct net_device *netdev,
                              struct ethtool_coalesce *ec)
 {
@@ -2124,9 +2105,6 @@ static int ixgbe_set_coalesce(struct net_device *netdev,
                    (1000000/ec->rx_coalesce_usecs < IXGBE_MIN_INT_RATE))
                        return -EINVAL;
-                /* check the old value and enable RSC if necessary */
-                need_reset = ixgbe_reenable_rsc(adapter, ec);
                /* store the value in ints/second */
                adapter->rx_eitr_param = 1000000/ec->rx_coalesce_usecs;
@@ -2135,9 +2113,6 @@ static int ixgbe_set_coalesce(struct net_device *netdev,
                /* clear the lower bit as its used for dynamic state */
                adapter->rx_itr_setting &= ~1;
        } else if (ec->rx_coalesce_usecs == 1) {
-                /* check the old value and enable RSC if necessary */
-                need_reset = ixgbe_reenable_rsc(adapter, ec);
                /* 1 means dynamic mode */
                adapter->rx_eitr_param = 20000;
                adapter->rx_itr_setting = 1;
@@ -2157,10 +2132,11 @@ static int ixgbe_set_coalesce(struct net_device *netdev,
                 */
                if (adapter->flags2 & IXGBE_FLAG2_RSC_ENABLED) {
                        adapter->flags2 &= ~IXGBE_FLAG2_RSC_ENABLED;
-                        netdev->features &= ~NETIF_F_LRO;
+                        if (netdev->features & NETIF_F_LRO) {
-                        DPRINTK(PROBE, INFO,
+                                netdev->features &= ~NETIF_F_LRO;
-                                "rx-usecs set to 0, disabling RSC\n");
+                                DPRINTK(PROBE, INFO, "rx-usecs set to 0, "
+                                        "disabling LRO/RSC\n");
+                        }
                        need_reset = true;
                }
        }
@@ -2255,6 +2231,9 @@ static int ixgbe_set_flags(struct net_device *netdev, u32 data)
                        }
                } else if (!adapter->rx_itr_setting) {
                        netdev->features &= ~ETH_FLAG_LRO;
+                        if (data & ETH_FLAG_LRO)
+                                DPRINTK(PROBE, INFO, "rx-usecs set to 0, "
+                                        "LRO/RSC cannot be enabled.\n");
                }
        }
diff --git a/drivers/net/ixgbe/ixgbe_main.c b/drivers/net/ixgbe/ixgbe_main.c
index d571d101de08..ce30c62a97f7 100644
--- a/drivers/net/ixgbe/ixgbe_main.c
+++ b/drivers/net/ixgbe/ixgbe_main.c
@@ -642,7 +642,7 @@ static inline bool ixgbe_tx_xon_state(struct ixgbe_adapter *adapter,
        u32 txoff = IXGBE_TFCS_TXOFF;
 #ifdef CONFIG_IXGBE_DCB
-        if (adapter->flags & IXGBE_FLAG_DCB_ENABLED) {
+        if (adapter->dcb_cfg.pfc_mode_enable) {
                int tc;
                int reg_idx = tx_ring->reg_idx;
                int dcb_i = adapter->ring_feature[RING_F_DCB].indices;
@@ -5282,6 +5282,10 @@ void ixgbe_update_stats(struct ixgbe_adapter *adapter)
        u32 i, missed_rx = 0, mpc, bprc, lxon, lxoff, xon_off_tot;
        u64 non_eop_descs = 0, restart_queue = 0;
+        if (test_bit(__IXGBE_DOWN, &adapter->state) ||
+            test_bit(__IXGBE_RESETTING, &adapter->state))
+                return;
        if (adapter->flags2 & IXGBE_FLAG2_RSC_ENABLED) {
                u64 rsc_count = 0;
                u64 rsc_flush = 0;
diff --git a/drivers/net/ixgbe/ixgbe_type.h b/drivers/net/ixgbe/ixgbe_type.h
index 2eb6e151016c..cdd1998f18c7 100644
--- a/drivers/net/ixgbe/ixgbe_type.h
+++ b/drivers/net/ixgbe/ixgbe_type.h
@@ -2609,6 +2609,7 @@ struct ixgbe_info {
 #define IXGBE_ERR_EEPROM_VERSION                -24
 #define IXGBE_ERR_NO_SPACE                      -25
 #define IXGBE_ERR_OVERTEMP                      -26
+#define IXGBE_ERR_RAR_INDEX                     -27
 #define IXGBE_NOT_IMPLEMENTED                   0x7FFFFFFF
 #endif /* _IXGBE_TYPE_H_ */
diff --git a/drivers/net/korina.c b/drivers/net/korina.c
index 26bf1b76b997..c7a9bef4dfb0 100644
--- a/drivers/net/korina.c
+++ b/drivers/net/korina.c
@@ -135,6 +135,7 @@ struct korina_private {
        struct napi_struct napi;
        struct timer_list media_check_timer;
        struct mii_if_info mii_if;
+        struct work_struct restart_task;
        struct net_device *dev;
        int phy_addr;
 };
@@ -375,7 +376,7 @@ static int korina_rx(struct net_device *dev, int limit)
                if (devcs & ETH_RX_LE)
                        dev->stats.rx_length_errors++;
                if (devcs & ETH_RX_OVR)
-                        dev->stats.rx_over_errors++;
+                        dev->stats.rx_fifo_errors++;
                if (devcs & ETH_RX_CV)
                        dev->stats.rx_frame_errors++;
                if (devcs & ETH_RX_CES)
@@ -764,10 +765,9 @@ static int korina_alloc_ring(struct net_device *dev)
        /* Initialize the receive descriptors */
        for (i = 0; i < KORINA_NUM_RDS; i++) {
-                skb = dev_alloc_skb(KORINA_RBSIZE + 2);
+                skb = netdev_alloc_skb_ip_align(dev, KORINA_RBSIZE);
                if (!skb)
                        return -ENOMEM;
-                skb_reserve(skb, 2);
                lp->rx_skb[i] = skb;
                lp->rd_ring[i].control = DMA_DESC_IOD |
                                DMA_COUNT(KORINA_RBSIZE);
@@ -890,12 +890,12 @@ static int korina_init(struct net_device *dev)
 /*
 * Restart the RC32434 ethernet controller.
- * FIXME: check the return status where we call it
 */
-static int korina_restart(struct net_device *dev)
+static void korina_restart_task(struct work_struct *work)
 {
-        struct korina_private *lp = netdev_priv(dev);
+        struct korina_private *lp = container_of(work,
-        int ret;
+                        struct korina_private, restart_task);
+        struct net_device *dev = lp->dev;
        /*
         * Disable interrupts
@@ -916,10 +916,9 @@ static int korina_restart(struct net_device *dev)
        napi_disable(&lp->napi);
-        ret = korina_init(dev);
+        if (korina_init(dev) < 0) {
-        if (ret < 0) {
                printk(KERN_ERR "%s: cannot restart device\n", dev->name);
-                return ret;
+                return;
        }
        korina_multicast_list(dev);
@@ -927,8 +926,6 @@ static int korina_restart(struct net_device *dev)
        enable_irq(lp->ovr_irq);
        enable_irq(lp->tx_irq);
        enable_irq(lp->rx_irq);
-        return ret;
 }
 static void korina_clear_and_restart(struct net_device *dev, u32 value)
@@ -937,7 +934,7 @@ static void korina_clear_and_restart(struct net_device *dev, u32 value)
        netif_stop_queue(dev);
        writel(value, &lp->eth_regs->ethintfc);
-        korina_restart(dev);
+        schedule_work(&lp->restart_task);
 }
 /* Ethernet Tx Underflow interrupt */
@@ -962,11 +959,8 @@ static irqreturn_t korina_und_interrupt(int irq, void *dev_id)
 static void korina_tx_timeout(struct net_device *dev)
 {
        struct korina_private *lp = netdev_priv(dev);
-        unsigned long flags;
-        spin_lock_irqsave(&lp->lock, flags);
+        schedule_work(&lp->restart_task);
-        korina_restart(dev);
-        spin_unlock_irqrestore(&lp->lock, flags);
 }
 /* Ethernet Rx Overflow interrupt */
@@ -1086,6 +1080,8 @@ static int korina_close(struct net_device *dev)
        napi_disable(&lp->napi);
+        cancel_work_sync(&lp->restart_task);
        free_irq(lp->rx_irq, dev);
        free_irq(lp->tx_irq, dev);
        free_irq(lp->ovr_irq, dev);
@@ -1198,6 +1194,8 @@ static int korina_probe(struct platform_device *pdev)
        }
        setup_timer(&lp->media_check_timer, korina_poll_media, (unsigned long) dev);
+        INIT_WORK(&lp->restart_task, korina_restart_task);
        printk(KERN_INFO "%s: " DRV_NAME "-" DRV_VERSION " " DRV_RELDATE "\n",
                        dev->name);
 out:
diff --git a/drivers/net/ksz884x.c b/drivers/net/ksz884x.c
index c80ca64277b2..7805bbf1d53a 100644
--- a/drivers/net/ksz884x.c
+++ b/drivers/net/ksz884x.c
@@ -4854,7 +4854,7 @@ static inline void copy_old_skb(struct sk_buff *old, struct sk_buff *skb)
 *
 * Return 0 if successful; otherwise an error code indicating failure.
 */
-static int netdev_tx(struct sk_buff *skb, struct net_device *dev)
+static netdev_tx_t netdev_tx(struct sk_buff *skb, struct net_device *dev)
 {
        struct dev_priv *priv = netdev_priv(dev);
        struct dev_info *hw_priv = priv->adapter;
@@ -6863,6 +6863,7 @@ static const struct net_device_ops netdev_ops = {
        .ndo_tx_timeout         = netdev_tx_timeout,
        .ndo_change_mtu         = netdev_change_mtu,
        .ndo_set_mac_address    = netdev_set_mac_address,
+        .ndo_validate_addr      = eth_validate_addr,
        .ndo_do_ioctl           = netdev_ioctl,
        .ndo_set_rx_mode        = netdev_set_rx_mode,
 #ifdef CONFIG_NET_POLL_CONTROLLER
diff --git a/drivers/net/phy/lxt.c b/drivers/net/phy/lxt.c
index 8ee929b796d8..dbd003453737 100644
--- a/drivers/net/phy/lxt.c
+++ b/drivers/net/phy/lxt.c
@@ -53,6 +53,9 @@
 #define MII_LXT971_ISR          19  /* Interrupt Status Register */
+/* register definitions for the 973 */
+#define MII_LXT973_PCR 16 /* Port Configuration Register */
+#define PCR_FIBER_SELECT 1
 MODULE_DESCRIPTION("Intel LXT PHY driver");
 MODULE_AUTHOR("Andy Fleming");
@@ -119,6 +122,33 @@ static int lxt971_config_intr(struct phy_device *phydev)
        return err;
 }
+static int lxt973_probe(struct phy_device *phydev)
+{
+        int val = phy_read(phydev, MII_LXT973_PCR);
+        if (val & PCR_FIBER_SELECT) {
+                /*
+                 * If fiber is selected, then the only correct setting
+                 * is 100Mbps, full duplex, and auto negotiation off.
+                 */
+                val = phy_read(phydev, MII_BMCR);
+                val |= (BMCR_SPEED100 | BMCR_FULLDPLX);
+                val &= ~BMCR_ANENABLE;
+                phy_write(phydev, MII_BMCR, val);
+                /* Remember that the port is in fiber mode. */
+                phydev->priv = lxt973_probe;
+        } else {
+                phydev->priv = NULL;
+        }
+        return 0;
+}
+static int lxt973_config_aneg(struct phy_device *phydev)
+{
+        /* Do nothing if port is in fiber mode. */
+        return phydev->priv ? 0 : genphy_config_aneg(phydev);
+}
 static struct phy_driver lxt970_driver = {
        .phy_id         = 0x78100000,
        .name           = "LXT970",
@@ -146,6 +176,18 @@ static struct phy_driver lxt971_driver = {
        .driver         = { .owner = THIS_MODULE,},
 };
+static struct phy_driver lxt973_driver = {
+        .phy_id         = 0x00137a10,
+        .name           = "LXT973",
+        .phy_id_mask    = 0xfffffff0,
+        .features       = PHY_BASIC_FEATURES,
+        .flags          = 0,
+        .probe          = lxt973_probe,
+        .config_aneg    = lxt973_config_aneg,
+        .read_status    = genphy_read_status,
+        .driver         = { .owner = THIS_MODULE,},
+};
 static int __init lxt_init(void)
 {
        int ret;
@@ -157,9 +199,15 @@ static int __init lxt_init(void)
        ret = phy_driver_register(&lxt971_driver);
        if (ret)
                goto err2;
+        ret = phy_driver_register(&lxt973_driver);
+        if (ret)
+                goto err3;
        return 0;
- err2:  
+ err3:
+        phy_driver_unregister(&lxt971_driver);
+ err2:
        phy_driver_unregister(&lxt970_driver);
 err1:
        return ret;
@@ -169,6 +217,7 @@ static void __exit lxt_exit(void)
 {
        phy_driver_unregister(&lxt970_driver);
        phy_driver_unregister(&lxt971_driver);
+        phy_driver_unregister(&lxt973_driver);
 }
 module_init(lxt_init);
diff --git a/drivers/net/ppp_generic.c b/drivers/net/ppp_generic.c
index c5f8eb102bf7..1b2c29150202 100644
--- a/drivers/net/ppp_generic.c
+++ b/drivers/net/ppp_generic.c
@@ -1422,7 +1422,7 @@ static int ppp_mp_explode(struct ppp *ppp, struct sk_buff *skb)
                flen = len;
                if (nfree > 0) {
                        if (pch->speed == 0) {
-                                flen = totlen/nfree;
+                                flen = len/nfree;
                                if (nbigger > 0) {
                                        flen++;
                                        nbigger--;
diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
index 217e709bda3e..96b6cfbf0a3a 100644
--- a/drivers/net/r8169.c
+++ b/drivers/net/r8169.c
@@ -559,6 +559,11 @@ static void mdio_write(void __iomem *ioaddr, int reg_addr, int value)
                        break;
                udelay(25);
        }
+        /*
+         * According to hardware specs a 20us delay is required after write
+         * complete indication, but before sending next command.
+         */
+        udelay(20);
 }
 static int mdio_read(void __iomem *ioaddr, int reg_addr)
@@ -578,6 +583,12 @@ static int mdio_read(void __iomem *ioaddr, int reg_addr)
                }
                udelay(25);
        }
+        /*
+         * According to hardware specs a 20us delay is required after read
+         * complete indication, but before sending next command.
+         */
+        udelay(20);
        return value;
 }
diff --git a/drivers/net/sfc/net_driver.h b/drivers/net/sfc/net_driver.h
index 2e6fd89f2a72..4762c91cb587 100644
--- a/drivers/net/sfc/net_driver.h
+++ b/drivers/net/sfc/net_driver.h
@@ -830,7 +830,7 @@ static inline const char *efx_dev_name(struct efx_nic *efx)
 static inline unsigned int efx_port_num(struct efx_nic *efx)
 {
-        return PCI_FUNC(efx->pci_dev->devfn);
+        return efx->net_dev->dev_id;
 }
 /**
diff --git a/drivers/net/sfc/siena.c b/drivers/net/sfc/siena.c
index 727b4228e081..f2b1e6180753 100644
--- a/drivers/net/sfc/siena.c
+++ b/drivers/net/sfc/siena.c
@@ -206,6 +206,7 @@ static int siena_probe_nic(struct efx_nic *efx)
 {
        struct siena_nic_data *nic_data;
        bool already_attached = 0;
+        efx_oword_t reg;
        int rc;
        /* Allocate storage for hardware specific data */
@@ -220,6 +221,9 @@ static int siena_probe_nic(struct efx_nic *efx)
                goto fail1;
        }
+        efx_reado(efx, &reg, FR_AZ_CS_DEBUG);
+        efx->net_dev->dev_id = EFX_OWORD_FIELD(reg, FRF_CZ_CS_PORT_NUM) - 1;
        efx_mcdi_init(efx);
        /* Recover from a failed assertion before probing */
diff --git a/drivers/net/tehuti.c b/drivers/net/tehuti.c
index 20ab16192325..737df6032bbc 100644
--- a/drivers/net/tehuti.c
+++ b/drivers/net/tehuti.c
@@ -646,7 +646,7 @@ static int bdx_ioctl_priv(struct net_device *ndev, struct ifreq *ifr, int cmd)
                error = copy_from_user(data, ifr->ifr_data, sizeof(data));
                if (error) {
                        pr_err("cant copy from user\n");
-                        RET(error);
+                        RET(-EFAULT);
                }
                DBG("%d 0x%x 0x%x\n", data[0], data[1], data[2]);
        }
@@ -665,7 +665,7 @@ static int bdx_ioctl_priv(struct net_device *ndev, struct ifreq *ifr, int cmd)
                    data[2]);
                error = copy_to_user(ifr->ifr_data, data, sizeof(data));
                if (error)
-                        RET(error);
+                        RET(-EFAULT);
                break;
        case BDX_OP_WRITE:
diff --git a/drivers/net/usb/asix.c b/drivers/net/usb/asix.c
index 1f802e90474c..9516f382a6ba 100644
--- a/drivers/net/usb/asix.c
+++ b/drivers/net/usb/asix.c
@@ -344,7 +344,7 @@ static int asix_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
                        return 2;
                }
-                if (size > ETH_FRAME_LEN) {
+                if (size > dev->net->mtu + ETH_HLEN) {
                        netdev_err(dev->net, "asix_rx_fixup() Bad RX Length %d\n",
                                   size);
                        return 0;
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 78eb3190b9b1..1edb7a61983c 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -340,7 +340,7 @@ static int add_recvbuf_small(struct virtnet_info *vi, gfp_t gfp)
        skb_to_sgvec(skb, vi->rx_sg + 1, 0, skb->len);
-        err = virtqueue_add_buf(vi->rvq, vi->rx_sg, 0, 2, skb);
+        err = virtqueue_add_buf_gfp(vi->rvq, vi->rx_sg, 0, 2, skb, gfp);
        if (err < 0)
                dev_kfree_skb(skb);
@@ -385,8 +385,8 @@ static int add_recvbuf_big(struct virtnet_info *vi, gfp_t gfp)
        /* chain first in list head */
        first->private = (unsigned long)list;
-        err = virtqueue_add_buf(vi->rvq, vi->rx_sg, 0, MAX_SKB_FRAGS + 2,
+        err = virtqueue_add_buf_gfp(vi->rvq, vi->rx_sg, 0, MAX_SKB_FRAGS + 2,
-                                       first);
+                                    first, gfp);
        if (err < 0)
                give_pages(vi, first);
@@ -404,7 +404,7 @@ static int add_recvbuf_mergeable(struct virtnet_info *vi, gfp_t gfp)
        sg_init_one(vi->rx_sg, page_address(page), PAGE_SIZE);
-        err = virtqueue_add_buf(vi->rvq, vi->rx_sg, 0, 1, page);
+        err = virtqueue_add_buf_gfp(vi->rvq, vi->rx_sg, 0, 1, page, gfp);
        if (err < 0)
                give_pages(vi, page);
diff --git a/drivers/net/wan/x25_asy.c b/drivers/net/wan/x25_asy.c
index 166e77dfffda..e47f5a986b1c 100644
--- a/drivers/net/wan/x25_asy.c
+++ b/drivers/net/wan/x25_asy.c
@@ -37,8 +37,6 @@
 #include <net/x25device.h>
 #include "x25_asy.h"
-#include <net/x25device.h>
 static struct net_device **x25_asy_devs;
 static int x25_asy_maxdev = SL_NRUNIT;
diff --git a/drivers/net/wimax/i2400m/fw.c b/drivers/net/wimax/i2400m/fw.c
index 3f283bff0ff7..11491354e5b5 100644
--- a/drivers/net/wimax/i2400m/fw.c
+++ b/drivers/net/wimax/i2400m/fw.c
@@ -1192,7 +1192,7 @@ int i2400m_fw_hdr_check(struct i2400m *i2400m,
        unsigned module_type, header_len, major_version, minor_version,
                module_id, module_vendor, date, size;
-        module_type = bcf_hdr->module_type;
+        module_type = le32_to_cpu(bcf_hdr->module_type);
        header_len = sizeof(u32) * le32_to_cpu(bcf_hdr->header_len);
        major_version = (le32_to_cpu(bcf_hdr->header_version) & 0xffff0000)
                >> 16;
diff --git a/drivers/net/wireless/ath/ar9170/usb.c b/drivers/net/wireless/ath/ar9170/usb.c
index 82ab532a4923..a93dc18a45c3 100644
--- a/drivers/net/wireless/ath/ar9170/usb.c
+++ b/drivers/net/wireless/ath/ar9170/usb.c
@@ -739,17 +739,27 @@ err_out:
 static void ar9170_usb_firmware_failed(struct ar9170_usb *aru)
 {
        struct device *parent = aru->udev->dev.parent;
+        struct usb_device *udev;
+        /*
+         * Store a copy of the usb_device pointer locally.
+         * This is because device_release_driver initiates
+         * ar9170_usb_disconnect, which in turn frees our
+         * driver context (aru).
+         */
+        udev = aru->udev;
        complete(&aru->firmware_loading_complete);
        /* unbind anything failed */
        if (parent)
                device_lock(parent);
-        device_release_driver(&aru->udev->dev);
+        device_release_driver(&udev->dev);
        if (parent)
                device_unlock(parent);
-        usb_put_dev(aru->udev);
+        usb_put_dev(udev);
 }
 static void ar9170_usb_firmware_finish(const struct firmware *fw, void *context)
diff --git a/drivers/net/wireless/ath/ath5k/base.c b/drivers/net/wireless/ath/ath5k/base.c
index cc6d41dec332..648972df369d 100644
--- a/drivers/net/wireless/ath/ath5k/base.c
+++ b/drivers/net/wireless/ath/ath5k/base.c
@@ -195,7 +195,7 @@ static const struct ieee80211_rate ath5k_rates[] = {
 static int __devinit    ath5k_pci_probe(struct pci_dev *pdev,
                                const struct pci_device_id *id);
 static void __devexit   ath5k_pci_remove(struct pci_dev *pdev);
-#ifdef CONFIG_PM
+#ifdef CONFIG_PM_SLEEP
 static int              ath5k_pci_suspend(struct device *dev);
 static int              ath5k_pci_resume(struct device *dev);
@@ -203,7 +203,7 @@ static SIMPLE_DEV_PM_OPS(ath5k_pm_ops, ath5k_pci_suspend, ath5k_pci_resume);
 #define ATH5K_PM_OPS    (&ath5k_pm_ops)
 #else
 #define ATH5K_PM_OPS    NULL
-#endif /* CONFIG_PM */
+#endif /* CONFIG_PM_SLEEP */
 static struct pci_driver ath5k_pci_driver = {
        .name           = KBUILD_MODNAME,
@@ -222,7 +222,6 @@ static int ath5k_tx(struct ieee80211_hw *hw, struct sk_buff *skb);
 static int ath5k_tx_queue(struct ieee80211_hw *hw, struct sk_buff *skb,
                struct ath5k_txq *txq);
 static int ath5k_reset(struct ath5k_softc *sc, struct ieee80211_channel *chan);
-static int ath5k_reset_wake(struct ath5k_softc *sc);
 static int ath5k_start(struct ieee80211_hw *hw);
 static void ath5k_stop(struct ieee80211_hw *hw);
 static int ath5k_add_interface(struct ieee80211_hw *hw,
@@ -709,7 +708,7 @@ ath5k_pci_remove(struct pci_dev *pdev)
        ieee80211_free_hw(hw);
 }
-#ifdef CONFIG_PM
+#ifdef CONFIG_PM_SLEEP
 static int ath5k_pci_suspend(struct device *dev)
 {
        struct ieee80211_hw *hw = pci_get_drvdata(to_pci_dev(dev));
@@ -735,7 +734,7 @@ static int ath5k_pci_resume(struct device *dev)
        ath5k_led_enable(sc);
        return 0;
 }
-#endif /* CONFIG_PM */
+#endif /* CONFIG_PM_SLEEP */
 /***********************\
@@ -2770,7 +2769,7 @@ ath5k_tasklet_reset(unsigned long data)
 {
        struct ath5k_softc *sc = (void *)data;
-        ath5k_reset_wake(sc);
+        ath5k_reset(sc, sc->curchan);
 }
 /*
@@ -2941,23 +2940,13 @@ ath5k_reset(struct ath5k_softc *sc, struct ieee80211_channel *chan)
        ath5k_beacon_config(sc);
        /* intrs are enabled by ath5k_beacon_config */
+        ieee80211_wake_queues(sc->hw);
        return 0;
 err:
        return ret;
 }
-static int
-ath5k_reset_wake(struct ath5k_softc *sc)
-{
-        int ret;
-        ret = ath5k_reset(sc, sc->curchan);
-        if (!ret)
-                ieee80211_wake_queues(sc->hw);
-        return ret;
-}
 static int ath5k_start(struct ieee80211_hw *hw)
 {
        return ath5k_init(hw->priv);
@@ -3151,13 +3140,15 @@ static void ath5k_configure_filter(struct ieee80211_hw *hw,
        if (changed_flags & (FIF_PROMISC_IN_BSS | FIF_OTHER_BSS)) {
                if (*new_flags & FIF_PROMISC_IN_BSS) {
-                        rfilt |= AR5K_RX_FILTER_PROM;
                        __set_bit(ATH_STAT_PROMISC, sc->status);
                } else {
                        __clear_bit(ATH_STAT_PROMISC, sc->status);
                }
        }
+        if (test_bit(ATH_STAT_PROMISC, sc->status))
+                rfilt |= AR5K_RX_FILTER_PROM;
        /* Note, AR5K_RX_FILTER_MCAST is already enabled */
        if (*new_flags & FIF_ALLMULTI) {
                mfilt[0] =  ~0;
diff --git a/drivers/net/wireless/ath/ath5k/phy.c b/drivers/net/wireless/ath/ath5k/phy.c
index 1b81c4778800..492cbb15720d 100644
--- a/drivers/net/wireless/ath/ath5k/phy.c
+++ b/drivers/net/wireless/ath/ath5k/phy.c
@@ -1814,6 +1814,13 @@ ath5k_hw_set_antenna_mode(struct ath5k_hw *ah, u8 ant_mode)
        u8 def_ant, tx_ant, ee_mode;
        u32 sta_id1 = 0;
+        /* if channel is not initialized yet we can't set the antennas
+         * so just store the mode. it will be set on the next reset */
+        if (channel == NULL) {
+                ah->ah_ant_mode = ant_mode;
+                return;
+        }
        def_ant = ah->ah_def_ant;
        ATH5K_TRACE(ah->ah_sc);
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index 3db19172b43b..859aa4ab0769 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -1198,7 +1198,7 @@ void ath_drain_all_txq(struct ath_softc *sc, bool retry_tx)
                int r;
                ath_print(common, ATH_DBG_FATAL,
-                          "Unable to stop TxDMA. Reset HAL!\n");
+                          "Failed to stop TX DMA. Resetting hardware!\n");
                spin_lock_bh(&sc->sc_resetlock);
                r = ath9k_hw_reset(ah, sc->sc_ah->curchan, false);
@@ -1728,6 +1728,8 @@ static int ath_tx_setup_buffer(struct ieee80211_hw *hw, struct ath_buf *bf,
        } else
                bf->bf_isnullfunc = false;
+        bf->bf_tx_aborted = false;
        return 0;
 }
@@ -1989,7 +1991,7 @@ static int ath_tx_num_badfrms(struct ath_softc *sc, struct ath_buf *bf,
        int nbad = 0;
        int isaggr = 0;
-        if (bf->bf_tx_aborted)
+        if (bf->bf_lastbf->bf_tx_aborted)
                return 0;
        isaggr = bf_isaggr(bf);
diff --git a/drivers/net/wireless/hostap/hostap_hw.c b/drivers/net/wireless/hostap/hostap_hw.c
index d70732819423..ff9b5c882184 100644
--- a/drivers/net/wireless/hostap/hostap_hw.c
+++ b/drivers/net/wireless/hostap/hostap_hw.c
@@ -2618,15 +2618,6 @@ static irqreturn_t prism2_interrupt(int irq, void *dev_id)
        int events = 0;
        u16 ev;
-        /* Detect early interrupt before driver is fully configued */
-        if (!dev->base_addr) {
-                if (net_ratelimit()) {
-                        printk(KERN_DEBUG "%s: Interrupt, but dev not configured\n",
-                               dev->name);
-                }
-                return IRQ_HANDLED;
-        }
        iface = netdev_priv(dev);
        local = iface->local;
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945.c b/drivers/net/wireless/iwlwifi/iwl-3945.c
index 068f7f8435c5..c44a303e62ed 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945.c
+++ b/drivers/net/wireless/iwlwifi/iwl-3945.c
@@ -2852,6 +2852,7 @@ static struct iwl_lib_ops iwl3945_lib = {
        .isr = iwl_isr_legacy,
        .config_ap = iwl3945_config_ap,
        .manage_ibss_station = iwl3945_manage_ibss_station,
+        .recover_from_tx_stall = iwl_bg_monitor_recover,
        .check_plcp_health = iwl3945_good_plcp_health,
        .debugfs_ops = {
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-lib.c b/drivers/net/wireless/iwlwifi/iwl-agn-lib.c
index 1004cfc403b1..0f292a210ed9 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-lib.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-lib.c
@@ -1119,10 +1119,9 @@ static int iwl_get_single_channel_for_scan(struct iwl_priv *priv,
                                           struct iwl_scan_channel *scan_ch)
 {
        const struct ieee80211_supported_band *sband;
-        const struct iwl_channel_info *ch_info;
        u16 passive_dwell = 0;
        u16 active_dwell = 0;
-        int i, added = 0;
+        int added = 0;
        u16 channel = 0;
        sband = iwl_get_hw_mode(priv, band);
@@ -1137,32 +1136,7 @@ static int iwl_get_single_channel_for_scan(struct iwl_priv *priv,
        if (passive_dwell <= active_dwell)
                passive_dwell = active_dwell + 1;
-        /* only scan single channel, good enough to reset the RF */
+        channel = iwl_get_single_channel_number(priv, band);
-        /* pick the first valid not in-use channel */
-        if (band == IEEE80211_BAND_5GHZ) {
-                for (i = 14; i < priv->channel_count; i++) {
-                        if (priv->channel_info[i].channel !=
-                            le16_to_cpu(priv->staging_rxon.channel)) {
-                                channel = priv->channel_info[i].channel;
-                                ch_info = iwl_get_channel_info(priv,
-                                        band, channel);
-                                if (is_channel_valid(ch_info))
-                                        break;
-                        }
-                }
-        } else {
-                for (i = 0; i < 14; i++) {
-                        if (priv->channel_info[i].channel !=
-                            le16_to_cpu(priv->staging_rxon.channel)) {
-                                        channel =
-                                                priv->channel_info[i].channel;
-                                        ch_info = iwl_get_channel_info(priv,
-                                                band, channel);
-                                        if (is_channel_valid(ch_info))
-                                                break;
-                        }
-                }
-        }
        if (channel) {
                scan_ch->channel = cpu_to_le16(channel);
                scan_ch->type = SCAN_CHANNEL_TYPE_PASSIVE;
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-tx.c b/drivers/net/wireless/iwlwifi/iwl-agn-tx.c
index c402bfc83f36..a732f1094e5d 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-tx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-tx.c
@@ -1125,6 +1125,7 @@ static void iwlagn_tx_status(struct iwl_priv *priv, struct sk_buff *skb)
        struct ieee80211_sta *sta;
        struct iwl_station_priv *sta_priv;
+        rcu_read_lock();
        sta = ieee80211_find_sta(priv->vif, hdr->addr1);
        if (sta) {
                sta_priv = (void *)sta->drv_priv;
@@ -1133,6 +1134,7 @@ static void iwlagn_tx_status(struct iwl_priv *priv, struct sk_buff *skb)
                    atomic_dec_return(&sta_priv->pending_frames) == 0)
                        ieee80211_sta_block_awake(priv->hw, sta, false);
        }
+        rcu_read_unlock();
        ieee80211_tx_status_irqsafe(priv->hw, skb);
 }
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index aef4f71f1981..7726e67044c0 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -1484,6 +1484,156 @@ bool iwl_good_ack_health(struct iwl_priv *priv,
 }
+/*****************************************************************************
+ *
+ * sysfs attributes
+ *
+ *****************************************************************************/
+#ifdef CONFIG_IWLWIFI_DEBUG
+/*
+ * The following adds a new attribute to the sysfs representation
+ * of this device driver (i.e. a new file in /sys/class/net/wlan0/device/)
+ * used for controlling the debug level.
+ *
+ * See the level definitions in iwl for details.
+ *
+ * The debug_level being managed using sysfs below is a per device debug
+ * level that is used instead of the global debug level if it (the per
+ * device debug level) is set.
+ */
+static ssize_t show_debug_level(struct device *d,
+                                struct device_attribute *attr, char *buf)
+{
+        struct iwl_priv *priv = dev_get_drvdata(d);
+        return sprintf(buf, "0x%08X\n", iwl_get_debug_level(priv));
+}
+static ssize_t store_debug_level(struct device *d,
+                                struct device_attribute *attr,
+                                 const char *buf, size_t count)
+{
+        struct iwl_priv *priv = dev_get_drvdata(d);
+        unsigned long val;
+        int ret;
+        ret = strict_strtoul(buf, 0, &val);
+        if (ret)
+                IWL_ERR(priv, "%s is not in hex or decimal form.\n", buf);
+        else {
+                priv->debug_level = val;
+                if (iwl_alloc_traffic_mem(priv))
+                        IWL_ERR(priv,
+                                "Not enough memory to generate traffic log\n");
+        }
+        return strnlen(buf, count);
+}
+static DEVICE_ATTR(debug_level, S_IWUSR | S_IRUGO,
+                        show_debug_level, store_debug_level);
+#endif /* CONFIG_IWLWIFI_DEBUG */
+static ssize_t show_temperature(struct device *d,
+                                struct device_attribute *attr, char *buf)
+{
+        struct iwl_priv *priv = dev_get_drvdata(d);
+        if (!iwl_is_alive(priv))
+                return -EAGAIN;
+        return sprintf(buf, "%d\n", priv->temperature);
+}
+static DEVICE_ATTR(temperature, S_IRUGO, show_temperature, NULL);
+static ssize_t show_tx_power(struct device *d,
+                             struct device_attribute *attr, char *buf)
+{
+        struct iwl_priv *priv = dev_get_drvdata(d);
+        if (!iwl_is_ready_rf(priv))
+                return sprintf(buf, "off\n");
+        else
+                return sprintf(buf, "%d\n", priv->tx_power_user_lmt);
+}
+static ssize_t store_tx_power(struct device *d,
+                              struct device_attribute *attr,
+                              const char *buf, size_t count)
+{
+        struct iwl_priv *priv = dev_get_drvdata(d);
+        unsigned long val;
+        int ret;
+        ret = strict_strtoul(buf, 10, &val);
+        if (ret)
+                IWL_INFO(priv, "%s is not in decimal form.\n", buf);
+        else {
+                ret = iwl_set_tx_power(priv, val, false);
+                if (ret)
+                        IWL_ERR(priv, "failed setting tx power (0x%d).\n",
+                                ret);
+                else
+                        ret = count;
+        }
+        return ret;
+}
+static DEVICE_ATTR(tx_power, S_IWUSR | S_IRUGO, show_tx_power, store_tx_power);
+static ssize_t show_rts_ht_protection(struct device *d,
+                             struct device_attribute *attr, char *buf)
+{
+        struct iwl_priv *priv = dev_get_drvdata(d);
+        return sprintf(buf, "%s\n",
+                priv->cfg->use_rts_for_ht ? "RTS/CTS" : "CTS-to-self");
+}
+static ssize_t store_rts_ht_protection(struct device *d,
+                              struct device_attribute *attr,
+                              const char *buf, size_t count)
+{
+        struct iwl_priv *priv = dev_get_drvdata(d);
+        unsigned long val;
+        int ret;
+        ret = strict_strtoul(buf, 10, &val);
+        if (ret)
+                IWL_INFO(priv, "Input is not in decimal form.\n");
+        else {
+                if (!iwl_is_associated(priv))
+                        priv->cfg->use_rts_for_ht = val ? true : false;
+                else
+                        IWL_ERR(priv, "Sta associated with AP - "
+                                "Change protection mechanism is not allowed\n");
+                ret = count;
+        }
+        return ret;
+}
+static DEVICE_ATTR(rts_ht_protection, S_IWUSR | S_IRUGO,
+                        show_rts_ht_protection, store_rts_ht_protection);
+static struct attribute *iwl_sysfs_entries[] = {
+        &dev_attr_temperature.attr,
+        &dev_attr_tx_power.attr,
+        &dev_attr_rts_ht_protection.attr,
+#ifdef CONFIG_IWLWIFI_DEBUG
+        &dev_attr_debug_level.attr,
+#endif
+        NULL
+};
+static struct attribute_group iwl_attribute_group = {
+        .name = NULL,           /* put in device directory */
+        .attrs = iwl_sysfs_entries,
+};
 /******************************************************************************
 *
 * uCode download functions
@@ -1965,6 +2115,13 @@ static void iwl_ucode_callback(const struct firmware *ucode_raw, void *context)
        if (err)
                IWL_ERR(priv, "failed to create debugfs files. Ignoring error: %d\n", err);
+        err = sysfs_create_group(&priv->pci_dev->dev.kobj,
+                                        &iwl_attribute_group);
+        if (err) {
+                IWL_ERR(priv, "failed to create sysfs device attributes\n");
+                goto out_unbind;
+        }
        /* We have our copies now, allow OS release its copies */
        release_firmware(ucode_raw);
        complete(&priv->_agn.firmware_loading_complete);
@@ -3264,141 +3421,6 @@ static int iwlagn_mac_sta_add(struct ieee80211_hw *hw,
 /*****************************************************************************
 *
- * sysfs attributes
- *
- *****************************************************************************/
-#ifdef CONFIG_IWLWIFI_DEBUG
-/*
- * The following adds a new attribute to the sysfs representation
- * of this device driver (i.e. a new file in /sys/class/net/wlan0/device/)
- * used for controlling the debug level.
- *
- * See the level definitions in iwl for details.
- *
- * The debug_level being managed using sysfs below is a per device debug
- * level that is used instead of the global debug level if it (the per
- * device debug level) is set.
- */
-static ssize_t show_debug_level(struct device *d,
-                                struct device_attribute *attr, char *buf)
-{
-        struct iwl_priv *priv = dev_get_drvdata(d);
-        return sprintf(buf, "0x%08X\n", iwl_get_debug_level(priv));
-}
-static ssize_t store_debug_level(struct device *d,
-                                struct device_attribute *attr,
-                                 const char *buf, size_t count)
-{
-        struct iwl_priv *priv = dev_get_drvdata(d);
-        unsigned long val;
-        int ret;
-        ret = strict_strtoul(buf, 0, &val);
-        if (ret)
-                IWL_ERR(priv, "%s is not in hex or decimal form.\n", buf);
-        else {
-                priv->debug_level = val;
-                if (iwl_alloc_traffic_mem(priv))
-                        IWL_ERR(priv,
-                                "Not enough memory to generate traffic log\n");
-        }
-        return strnlen(buf, count);
-}
-static DEVICE_ATTR(debug_level, S_IWUSR | S_IRUGO,
-                        show_debug_level, store_debug_level);
-#endif /* CONFIG_IWLWIFI_DEBUG */
-static ssize_t show_temperature(struct device *d,
-                                struct device_attribute *attr, char *buf)
-{
-        struct iwl_priv *priv = dev_get_drvdata(d);
-        if (!iwl_is_alive(priv))
-                return -EAGAIN;
-        return sprintf(buf, "%d\n", priv->temperature);
-}
-static DEVICE_ATTR(temperature, S_IRUGO, show_temperature, NULL);
-static ssize_t show_tx_power(struct device *d,
-                             struct device_attribute *attr, char *buf)
-{
-        struct iwl_priv *priv = dev_get_drvdata(d);
-        if (!iwl_is_ready_rf(priv))
-                return sprintf(buf, "off\n");
-        else
-                return sprintf(buf, "%d\n", priv->tx_power_user_lmt);
-}
-static ssize_t store_tx_power(struct device *d,
-                              struct device_attribute *attr,
-                              const char *buf, size_t count)
-{
-        struct iwl_priv *priv = dev_get_drvdata(d);
-        unsigned long val;
-        int ret;
-        ret = strict_strtoul(buf, 10, &val);
-        if (ret)
-                IWL_INFO(priv, "%s is not in decimal form.\n", buf);
-        else {
-                ret = iwl_set_tx_power(priv, val, false);
-                if (ret)
-                        IWL_ERR(priv, "failed setting tx power (0x%d).\n",
-                                ret);
-                else
-                        ret = count;
-        }
-        return ret;
-}
-static DEVICE_ATTR(tx_power, S_IWUSR | S_IRUGO, show_tx_power, store_tx_power);
-static ssize_t show_rts_ht_protection(struct device *d,
-                             struct device_attribute *attr, char *buf)
-{
-        struct iwl_priv *priv = dev_get_drvdata(d);
-        return sprintf(buf, "%s\n",
-                priv->cfg->use_rts_for_ht ? "RTS/CTS" : "CTS-to-self");
-}
-static ssize_t store_rts_ht_protection(struct device *d,
-                              struct device_attribute *attr,
-                              const char *buf, size_t count)
-{
-        struct iwl_priv *priv = dev_get_drvdata(d);
-        unsigned long val;
-        int ret;
-        ret = strict_strtoul(buf, 10, &val);
-        if (ret)
-                IWL_INFO(priv, "Input is not in decimal form.\n");
-        else {
-                if (!iwl_is_associated(priv))
-                        priv->cfg->use_rts_for_ht = val ? true : false;
-                else
-                        IWL_ERR(priv, "Sta associated with AP - "
-                                "Change protection mechanism is not allowed\n");
-                ret = count;
-        }
-        return ret;
-}
-static DEVICE_ATTR(rts_ht_protection, S_IWUSR | S_IRUGO,
-                        show_rts_ht_protection, store_rts_ht_protection);
-/*****************************************************************************
- *
 * driver setup and teardown
 *
 *****************************************************************************/
@@ -3550,21 +3572,6 @@ static void iwl_uninit_drv(struct iwl_priv *priv)
        kfree(priv->scan_cmd);
 }
-static struct attribute *iwl_sysfs_entries[] = {
-        &dev_attr_temperature.attr,
-        &dev_attr_tx_power.attr,
-        &dev_attr_rts_ht_protection.attr,
-#ifdef CONFIG_IWLWIFI_DEBUG
-        &dev_attr_debug_level.attr,
-#endif
-        NULL
-};
-static struct attribute_group iwl_attribute_group = {
-        .name = NULL,           /* put in device directory */
-        .attrs = iwl_sysfs_entries,
-};
 static struct ieee80211_ops iwl_hw_ops = {
        .tx = iwl_mac_tx,
        .start = iwl_mac_start,
@@ -3750,11 +3757,6 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
                IWL_ERR(priv, "Error allocating IRQ %d\n", priv->pci_dev->irq);
                goto out_disable_msi;
        }
-        err = sysfs_create_group(&pdev->dev.kobj, &iwl_attribute_group);
-        if (err) {
-                IWL_ERR(priv, "failed to create sysfs device attributes\n");
-                goto out_free_irq;
-        }
        iwl_setup_deferred_work(priv);
        iwl_setup_rx_handlers(priv);
@@ -3788,15 +3790,13 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
        err = iwl_request_firmware(priv, true);
        if (err)
-                goto out_remove_sysfs;
+                goto out_destroy_workqueue;
        return 0;
- out_remove_sysfs:
+ out_destroy_workqueue:
        destroy_workqueue(priv->workqueue);
        priv->workqueue = NULL;
-        sysfs_remove_group(&pdev->dev.kobj, &iwl_attribute_group);
- out_free_irq:
        free_irq(priv->pci_dev->irq, priv);
        iwl_free_isr_ict(priv);
 out_disable_msi:
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.c b/drivers/net/wireless/iwlwifi/iwl-core.c
index 5a7eca8fb789..426e95567de3 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.c
+++ b/drivers/net/wireless/iwlwifi/iwl-core.c
@@ -854,6 +854,45 @@ void iwl_set_rxon_chain(struct iwl_priv *priv)
 }
 EXPORT_SYMBOL(iwl_set_rxon_chain);
+/* Return valid channel */
+u8 iwl_get_single_channel_number(struct iwl_priv *priv,
+                                  enum ieee80211_band band)
+{
+        const struct iwl_channel_info *ch_info;
+        int i;
+        u8 channel = 0;
+        /* only scan single channel, good enough to reset the RF */
+        /* pick the first valid not in-use channel */
+        if (band == IEEE80211_BAND_5GHZ) {
+                for (i = 14; i < priv->channel_count; i++) {
+                        if (priv->channel_info[i].channel !=
+                            le16_to_cpu(priv->staging_rxon.channel)) {
+                                channel = priv->channel_info[i].channel;
+                                ch_info = iwl_get_channel_info(priv,
+                                        band, channel);
+                                if (is_channel_valid(ch_info))
+                                        break;
+                        }
+                }
+        } else {
+                for (i = 0; i < 14; i++) {
+                        if (priv->channel_info[i].channel !=
+                            le16_to_cpu(priv->staging_rxon.channel)) {
+                                        channel =
+                                                priv->channel_info[i].channel;
+                                        ch_info = iwl_get_channel_info(priv,
+                                                band, channel);
+                                        if (is_channel_valid(ch_info))
+                                                break;
+                        }
+                }
+        }
+        return channel;
+}
+EXPORT_SYMBOL(iwl_get_single_channel_number);
 /**
 * iwl_set_rxon_channel - Set the phymode and channel values in staging RXON
 * @phymode: MODE_IEEE80211A sets to 5.2GHz; all else set to 2.4GHz
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.h b/drivers/net/wireless/iwlwifi/iwl-core.h
index 7e5a5ba41fd2..31775bd9c361 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.h
+++ b/drivers/net/wireless/iwlwifi/iwl-core.h
@@ -343,6 +343,8 @@ int iwl_check_rxon_cmd(struct iwl_priv *priv);
 int iwl_full_rxon_required(struct iwl_priv *priv);
 void iwl_set_rxon_chain(struct iwl_priv *priv);
 int iwl_set_rxon_channel(struct iwl_priv *priv, struct ieee80211_channel *ch);
+u8 iwl_get_single_channel_number(struct iwl_priv *priv,
+                                  enum ieee80211_band band);
 void iwl_set_rxon_ht(struct iwl_priv *priv, struct iwl_ht_config *ht_conf);
 u8 iwl_is_ht40_tx_allowed(struct iwl_priv *priv,
                         struct ieee80211_sta_ht_cap *sta_ht_inf);
diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
index 3e5bffb6034f..6c353cacc8d6 100644
--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -1844,6 +1844,49 @@ static void iwl3945_irq_tasklet(struct iwl_priv *priv)
 #endif
 }
+static int iwl3945_get_single_channel_for_scan(struct iwl_priv *priv,
+                                               struct ieee80211_vif *vif,
+                                               enum ieee80211_band band,
+                                               struct iwl3945_scan_channel *scan_ch)
+{
+        const struct ieee80211_supported_band *sband;
+        u16 passive_dwell = 0;
+        u16 active_dwell = 0;
+        int added = 0;
+        u8 channel = 0;
+        sband = iwl_get_hw_mode(priv, band);
+        if (!sband) {
+                IWL_ERR(priv, "invalid band\n");
+                return added;
+        }
+        active_dwell = iwl_get_active_dwell_time(priv, band, 0);
+        passive_dwell = iwl_get_passive_dwell_time(priv, band, vif);
+        if (passive_dwell <= active_dwell)
+                passive_dwell = active_dwell + 1;
+        channel = iwl_get_single_channel_number(priv, band);
+        if (channel) {
+                scan_ch->channel = channel;
+                scan_ch->type = 0;      /* passive */
+                scan_ch->active_dwell = cpu_to_le16(active_dwell);
+                scan_ch->passive_dwell = cpu_to_le16(passive_dwell);
+                /* Set txpower levels to defaults */
+                scan_ch->tpc.dsp_atten = 110;
+                if (band == IEEE80211_BAND_5GHZ)
+                        scan_ch->tpc.tx_gain = ((1 << 5) | (3 << 3)) | 3;
+                else
+                        scan_ch->tpc.tx_gain = ((1 << 5) | (5 << 3));
+                added++;
+        } else
+                IWL_ERR(priv, "no valid channel found\n");
+        return added;
+}
 static int iwl3945_get_channels_for_scan(struct iwl_priv *priv,
                                         enum ieee80211_band band,
                                     u8 is_active, u8 n_probes,
@@ -2992,9 +3035,16 @@ void iwl3945_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
        /* select Rx antennas */
        scan->flags |= iwl3945_get_antenna_flags(priv);
-        scan->channel_count =
+        if (priv->is_internal_short_scan) {
-                iwl3945_get_channels_for_scan(priv, band, is_active, n_probes,
+                scan->channel_count =
-                        (void *)&scan->data[le16_to_cpu(scan->tx_cmd.len)], vif);
+                        iwl3945_get_single_channel_for_scan(priv, vif, band,
+                                (void *)&scan->data[le16_to_cpu(
+                                scan->tx_cmd.len)]);
+        } else {
+                scan->channel_count =
+                        iwl3945_get_channels_for_scan(priv, band, is_active, n_probes,
+                                (void *)&scan->data[le16_to_cpu(scan->tx_cmd.len)], vif);
+        }
        if (scan->channel_count == 0) {
                IWL_DEBUG_SCAN(priv, "channel count %d\n", scan->channel_count);
diff --git a/drivers/net/wireless/libertas/rx.c b/drivers/net/wireless/libertas/rx.c
index a115bfa9513a..7a377f5b7662 100644
--- a/drivers/net/wireless/libertas/rx.c
+++ b/drivers/net/wireless/libertas/rx.c
@@ -329,9 +329,8 @@ static int process_rxed_802_11_packet(struct lbs_private *priv,
        /* create the exported radio header */
        /* radiotap header */
-        radiotap_hdr.hdr.it_version = 0;
+        memset(&radiotap_hdr, 0, sizeof(radiotap_hdr));
-        /* XXX must check this value for pad */
+        /* XXX must check radiotap_hdr.hdr.it_pad for pad */
-        radiotap_hdr.hdr.it_pad = 0;
        radiotap_hdr.hdr.it_len = cpu_to_le16 (sizeof(struct rx_radiotap_hdr));
        radiotap_hdr.hdr.it_present = cpu_to_le32 (RX_RADIOTAP_PRESENT);
        radiotap_hdr.rate = convert_mv_rate_to_radiotap(prxpd->rx_rate);
diff --git a/drivers/net/wireless/p54/p54usb.c b/drivers/net/wireless/p54/p54usb.c
index d5b197b4d5bb..73073259f508 100644
--- a/drivers/net/wireless/p54/p54usb.c
+++ b/drivers/net/wireless/p54/p54usb.c
@@ -80,6 +80,7 @@ static struct usb_device_id p54u_table[] __devinitdata = {
        {USB_DEVICE(0x1413, 0x5400)},   /* Telsey 802.11g USB2.0 Adapter */
        {USB_DEVICE(0x1435, 0x0427)},   /* Inventel UR054G */
        {USB_DEVICE(0x2001, 0x3704)},   /* DLink DWL-G122 rev A2 */
+        {USB_DEVICE(0x413c, 0x5513)},   /* Dell WLA3310 USB Wireless Adapter */
        {USB_DEVICE(0x413c, 0x8102)},   /* Spinnaker DUT */
        {USB_DEVICE(0x413c, 0x8104)},   /* Cohiba Proto board */
        {}
diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c
index 699161327d65..0f8b84b7224c 100644
--- a/drivers/net/wireless/rt2x00/rt2800usb.c
+++ b/drivers/net/wireless/rt2x00/rt2800usb.c
@@ -413,7 +413,7 @@ static void rt2800usb_write_tx_desc(struct rt2x00_dev *rt2x00dev,
         */
        rt2x00_desc_read(txi, 0, &word);
        rt2x00_set_field32(&word, TXINFO_W0_USB_DMA_TX_PKT_LEN,
-                           skb->len - TXINFO_DESC_SIZE);
+                           skb->len + TXWI_DESC_SIZE);
        rt2x00_set_field32(&word, TXINFO_W0_WIV,
                           !test_bit(ENTRY_TXD_ENCRYPT_IV, &txdesc->flags));
        rt2x00_set_field32(&word, TXINFO_W0_QSEL, 2);
diff --git a/drivers/net/wireless/wl12xx/wl1251_sdio.c b/drivers/net/wireless/wl12xx/wl1251_sdio.c
index d234285c2c81..c561332e7009 100644
--- a/drivers/net/wireless/wl12xx/wl1251_sdio.c
+++ b/drivers/net/wireless/wl12xx/wl1251_sdio.c
@@ -259,6 +259,7 @@ disable:
        sdio_disable_func(func);
 release:
        sdio_release_host(func);
+        wl1251_free_hw(wl);
        return ret;
 }
diff --git a/drivers/ssb/pci.c b/drivers/ssb/pci.c
index 989e2752cc36..6dcda86be6eb 100644
--- a/drivers/ssb/pci.c
+++ b/drivers/ssb/pci.c
@@ -625,9 +625,12 @@ static int ssb_pci_sprom_get(struct ssb_bus *bus,
                ssb_printk(KERN_ERR PFX "No SPROM available!\n");
                return -ENODEV;
        }
+        if (bus->chipco.dev) {  /* can be unavailible! */
-        bus->sprom_offset = (bus->chipco.dev->id.revision < 31) ?
+                bus->sprom_offset = (bus->chipco.dev->id.revision < 31) ?
-                SSB_SPROM_BASE1 : SSB_SPROM_BASE31;
+                        SSB_SPROM_BASE1 : SSB_SPROM_BASE31;
+        } else {
+                bus->sprom_offset = SSB_SPROM_BASE1;
+        }
        buf = kcalloc(SSB_SPROMSIZE_WORDS_R123, sizeof(u16), GFP_KERNEL);
        if (!buf)
diff --git a/drivers/ssb/sprom.c b/drivers/ssb/sprom.c
index 007bc3a03486..4f7cc8d13277 100644
--- a/drivers/ssb/sprom.c
+++ b/drivers/ssb/sprom.c
@@ -185,6 +185,7 @@ bool ssb_is_sprom_available(struct ssb_bus *bus)
        /* this routine differs from specs as we do not access SPROM directly
           on PCMCIA */
        if (bus->bustype == SSB_BUSTYPE_PCI &&
+            bus->chipco.dev &&  /* can be unavailible! */
            bus->chipco.dev->id.revision >= 31)
                return bus->chipco.capabilities & SSB_CHIPCO_CAP_SPROM;
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 7cdfb4d52847..f89e7fd59a4c 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -380,7 +380,10 @@ struct sk_buff {
        kmemcheck_bitfield_begin(flags2);
        __u16                   queue_mapping:16;
 #ifdef CONFIG_IPV6_NDISC_NODETYPE
-        __u8                    ndisc_nodetype:2;
+        __u8                    ndisc_nodetype:2,
+                                deliver_no_wcard:1;
+#else
+        __u8                    deliver_no_wcard:1;
 #endif
        kmemcheck_bitfield_end(flags2);
@@ -501,7 +504,7 @@ static inline struct sk_buff *alloc_skb_fclone(unsigned int size,
        return __alloc_skb(size, priority, 1, -1);
 }
-extern int skb_recycle_check(struct sk_buff *skb, int skb_size);
+extern bool skb_recycle_check(struct sk_buff *skb, int skb_size);
 extern struct sk_buff *skb_morph(struct sk_buff *dst, struct sk_buff *src);
 extern struct sk_buff *skb_clone(struct sk_buff *skb,
diff --git a/include/net/dst.h b/include/net/dst.h
index 612069beda73..81d1413a8701 100644
--- a/include/net/dst.h
+++ b/include/net/dst.h
@@ -250,11 +250,11 @@ static inline void skb_tunnel_rx(struct sk_buff *skb, struct net_device *dev)
 * Linux networking.  Thus, destinations are stackable.
 */
-static inline struct dst_entry *dst_pop(struct dst_entry *dst)
+static inline struct dst_entry *skb_dst_pop(struct sk_buff *skb)
 {
-        struct dst_entry *child = dst_clone(dst->child);
+        struct dst_entry *child = skb_dst(skb)->child;
-        dst_release(dst);
+        skb_dst_drop(skb);
        return child;
 }
diff --git a/include/net/sock.h b/include/net/sock.h
index ca241ea14875..731150d52799 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -1524,20 +1524,7 @@ extern void sk_stop_timer(struct sock *sk, struct timer_list* timer);
 extern int sock_queue_rcv_skb(struct sock *sk, struct sk_buff *skb);
-static inline int sock_queue_err_skb(struct sock *sk, struct sk_buff *skb)
+extern int sock_queue_err_skb(struct sock *sk, struct sk_buff *skb);
-{
-        /* Cast skb->rcvbuf to unsigned... It's pointless, but reduces
-           number of warnings when compiling with -W --ANK
-         */
-        if (atomic_read(&sk->sk_rmem_alloc) + skb->truesize >=
-            (unsigned)sk->sk_rcvbuf)
-                return -ENOMEM;
-        skb_set_owner_r(skb, sk);
-        skb_queue_tail(&sk->sk_error_queue, skb);
-        if (!sock_flag(sk, SOCK_DEAD))
-                sk->sk_data_ready(sk, skb->len);
-        return 0;
-}
 /*
 *      Recover an error report and clear atomically
diff --git a/net/8021q/vlan_core.c b/net/8021q/vlan_core.c
index bd537fc10254..50f58f5f1c34 100644
--- a/net/8021q/vlan_core.c
+++ b/net/8021q/vlan_core.c
@@ -12,7 +12,7 @@ int __vlan_hwaccel_rx(struct sk_buff *skb, struct vlan_group *grp,
                return NET_RX_DROP;
        if (skb_bond_should_drop(skb, ACCESS_ONCE(skb->dev->master)))
-                goto drop;
+                skb->deliver_no_wcard = 1;
        skb->skb_iif = skb->dev->ifindex;
        __vlan_hwaccel_put_tag(skb, vlan_tci);
@@ -84,7 +84,7 @@ vlan_gro_common(struct napi_struct *napi, struct vlan_group *grp,
        struct sk_buff *p;
        if (skb_bond_should_drop(skb, ACCESS_ONCE(skb->dev->master)))
-                goto drop;
+                skb->deliver_no_wcard = 1;
        skb->skb_iif = skb->dev->ifindex;
        __vlan_hwaccel_put_tag(skb, vlan_tci);
diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
index 55be90826f5f..529842677817 100644
--- a/net/8021q/vlan_dev.c
+++ b/net/8021q/vlan_dev.c
@@ -708,7 +708,8 @@ static int vlan_dev_init(struct net_device *dev)
        netif_carrier_off(dev);
        /* IFF_BROADCAST|IFF_MULTICAST; ??? */
-        dev->flags  = real_dev->flags & ~(IFF_UP | IFF_PROMISC | IFF_ALLMULTI);
+        dev->flags  = real_dev->flags & ~(IFF_UP | IFF_PROMISC | IFF_ALLMULTI |
+                                          IFF_MASTER | IFF_SLAVE);
        dev->iflink = real_dev->ifindex;
        dev->state  = (real_dev->state & ((1<<__LINK_STATE_NOCARRIER) |
                                          (1<<__LINK_STATE_DORMANT))) |
diff --git a/net/caif/cfrfml.c b/net/caif/cfrfml.c
index cd2830fec935..fd27b172fb5d 100644
--- a/net/caif/cfrfml.c
+++ b/net/caif/cfrfml.c
@@ -83,7 +83,7 @@ static int cfrfml_transmit(struct cflayer *layr, struct cfpkt *pkt)
        if (!cfsrvl_ready(service, &ret))
                return ret;
-        if (!cfpkt_getlen(pkt) > CAIF_MAX_PAYLOAD_SIZE) {
+        if (cfpkt_getlen(pkt) > CAIF_MAX_PAYLOAD_SIZE) {
                pr_err("CAIF: %s():Packet too large - size=%d\n",
                        __func__, cfpkt_getlen(pkt));
                return -EOVERFLOW;
diff --git a/net/caif/cfserl.c b/net/caif/cfserl.c
index cb4325a3dc83..965c5baace40 100644
--- a/net/caif/cfserl.c
+++ b/net/caif/cfserl.c
@@ -59,16 +59,18 @@ static int cfserl_receive(struct cflayer *l, struct cfpkt *newpkt)
        u8 stx = CFSERL_STX;
        int ret;
        u16 expectlen = 0;
        caif_assert(newpkt != NULL);
        spin_lock(&layr->sync);
        if (layr->incomplete_frm != NULL) {
                layr->incomplete_frm =
                    cfpkt_append(layr->incomplete_frm, newpkt, expectlen);
                pkt = layr->incomplete_frm;
-                if (pkt == NULL)
+                if (pkt == NULL) {
+                        spin_unlock(&layr->sync);
                        return -ENOMEM;
+                }
        } else {
                pkt = newpkt;
        }
diff --git a/net/caif/cfveil.c b/net/caif/cfveil.c
index 0fd827f49491..e04f7d964e83 100644
--- a/net/caif/cfveil.c
+++ b/net/caif/cfveil.c
@@ -84,7 +84,7 @@ static int cfvei_transmit(struct cflayer *layr, struct cfpkt *pkt)
                return ret;
        caif_assert(layr->dn != NULL);
        caif_assert(layr->dn->transmit != NULL);
-        if (!cfpkt_getlen(pkt) > CAIF_MAX_PAYLOAD_SIZE) {
+        if (cfpkt_getlen(pkt) > CAIF_MAX_PAYLOAD_SIZE) {
                pr_warning("CAIF: %s(): Packet too large - size=%d\n",
                           __func__, cfpkt_getlen(pkt));
                return -EOVERFLOW;
diff --git a/net/core/dev.c b/net/core/dev.c
index 1845b08c624e..2b3bf53bc687 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2253,11 +2253,9 @@ static int get_rps_cpu(struct net_device *dev, struct sk_buff *skb,
        if (skb_rx_queue_recorded(skb)) {
                u16 index = skb_get_rx_queue(skb);
                if (unlikely(index >= dev->num_rx_queues)) {
-                        if (net_ratelimit()) {
+                        WARN_ONCE(dev->num_rx_queues > 1, "%s received packet "
-                                pr_warning("%s received packet on queue "
+                                "on queue %u, but number of RX queues is %u\n",
-                                        "%u, but number of RX queues is %u\n",
+                                dev->name, index, dev->num_rx_queues);
-                                        dev->name, index, dev->num_rx_queues);
-                        }
                        goto done;
                }
                rxqueue = dev->_rx + index;
@@ -2795,7 +2793,7 @@ static int __netif_receive_skb(struct sk_buff *skb)
        struct net_device *orig_dev;
        struct net_device *master;
        struct net_device *null_or_orig;
-        struct net_device *null_or_bond;
+        struct net_device *orig_or_bond;
        int ret = NET_RX_DROP;
        __be16 type;
@@ -2812,13 +2810,24 @@ static int __netif_receive_skb(struct sk_buff *skb)
        if (!skb->skb_iif)
                skb->skb_iif = skb->dev->ifindex;
+        /*
+         * bonding note: skbs received on inactive slaves should only
+         * be delivered to pkt handlers that are exact matches.  Also
+         * the deliver_no_wcard flag will be set.  If packet handlers
+         * are sensitive to duplicate packets these skbs will need to
+         * be dropped at the handler.  The vlan accel path may have
+         * already set the deliver_no_wcard flag.
+         */
        null_or_orig = NULL;
        orig_dev = skb->dev;
        master = ACCESS_ONCE(orig_dev->master);
-        if (master) {
+        if (skb->deliver_no_wcard)
-                if (skb_bond_should_drop(skb, master))
+                null_or_orig = orig_dev;
+        else if (master) {
+                if (skb_bond_should_drop(skb, master)) {
+                        skb->deliver_no_wcard = 1;
                        null_or_orig = orig_dev; /* deliver only exact match */
-                else
+                } else
                        skb->dev = master;
        }
@@ -2868,10 +2877,10 @@ ncls:
         * device that may have registered for a specific ptype.  The
         * handler may have to adjust skb->dev and orig_dev.
         */
-        null_or_bond = NULL;
+        orig_or_bond = orig_dev;
        if ((skb->dev->priv_flags & IFF_802_1Q_VLAN) &&
            (vlan_dev_real_dev(skb->dev)->priv_flags & IFF_BONDING)) {
-                null_or_bond = vlan_dev_real_dev(skb->dev);
+                orig_or_bond = vlan_dev_real_dev(skb->dev);
        }
        type = skb->protocol;
@@ -2879,7 +2888,7 @@ ncls:
                        &ptype_base[ntohs(type) & PTYPE_HASH_MASK], list) {
                if (ptype->type == type && (ptype->dev == null_or_orig ||
                     ptype->dev == skb->dev || ptype->dev == orig_dev ||
-                     ptype->dev == null_or_bond)) {
+                     ptype->dev == orig_or_bond)) {
                        if (pt_prev)
                                ret = deliver_skb(skb, pt_prev, orig_dev);
                        pt_prev = ptype;
diff --git a/net/core/gen_estimator.c b/net/core/gen_estimator.c
index cf8e70392fe0..785e5276a300 100644
--- a/net/core/gen_estimator.c
+++ b/net/core/gen_estimator.c
@@ -107,6 +107,7 @@ static DEFINE_RWLOCK(est_lock);
 /* Protects against soft lockup during large deletion */
 static struct rb_root est_root = RB_ROOT;
+static DEFINE_SPINLOCK(est_tree_lock);
 static void est_timer(unsigned long arg)
 {
@@ -201,7 +202,6 @@ struct gen_estimator *gen_find_node(const struct gnet_stats_basic_packed *bstats
 *
 * Returns 0 on success or a negative error code.
 *
- * NOTE: Called under rtnl_mutex
 */
 int gen_new_estimator(struct gnet_stats_basic_packed *bstats,
                      struct gnet_stats_rate_est *rate_est,
@@ -232,6 +232,7 @@ int gen_new_estimator(struct gnet_stats_basic_packed *bstats,
        est->last_packets = bstats->packets;
        est->avpps = rate_est->pps<<10;
+        spin_lock(&est_tree_lock);
        if (!elist[idx].timer.function) {
                INIT_LIST_HEAD(&elist[idx].list);
                setup_timer(&elist[idx].timer, est_timer, idx);
@@ -242,6 +243,7 @@ int gen_new_estimator(struct gnet_stats_basic_packed *bstats,
        list_add_rcu(&est->list, &elist[idx].list);
        gen_add_node(est);
+        spin_unlock(&est_tree_lock);
        return 0;
 }
@@ -261,13 +263,13 @@ static void __gen_kill_estimator(struct rcu_head *head)
 *
 * Removes the rate estimator specified by &bstats and &rate_est.
 *
- * NOTE: Called under rtnl_mutex
 */
 void gen_kill_estimator(struct gnet_stats_basic_packed *bstats,
                        struct gnet_stats_rate_est *rate_est)
 {
        struct gen_estimator *e;
+        spin_lock(&est_tree_lock);
        while ((e = gen_find_node(bstats, rate_est))) {
                rb_erase(&e->node, &est_root);
@@ -278,6 +280,7 @@ void gen_kill_estimator(struct gnet_stats_basic_packed *bstats,
                list_del_rcu(&e->list);
                call_rcu(&e->e_rcu, __gen_kill_estimator);
        }
+        spin_unlock(&est_tree_lock);
 }
 EXPORT_SYMBOL(gen_kill_estimator);
@@ -312,8 +315,14 @@ EXPORT_SYMBOL(gen_replace_estimator);
 bool gen_estimator_active(const struct gnet_stats_basic_packed *bstats,
                          const struct gnet_stats_rate_est *rate_est)
 {
+        bool res;
        ASSERT_RTNL();
-        return gen_find_node(bstats, rate_est) != NULL;
+        spin_lock(&est_tree_lock);
+        res = gen_find_node(bstats, rate_est) != NULL;
+        spin_unlock(&est_tree_lock);
+        return res;
 }
 EXPORT_SYMBOL(gen_estimator_active);
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index 2ad68da418df..1dacd7ba8dbb 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -2170,7 +2170,7 @@ static void spin(struct pktgen_dev *pkt_dev, ktime_t spin_until)
        end_time = ktime_now();
        pkt_dev->idle_acc += ktime_to_ns(ktime_sub(end_time, start_time));
-        pkt_dev->next_tx = ktime_add_ns(end_time, pkt_dev->delay);
+        pkt_dev->next_tx = ktime_add_ns(spin_until, pkt_dev->delay);
 }
 static inline void set_pkt_overhead(struct pktgen_dev *pkt_dev)
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index f8abf68e3988..34432b4e96bb 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -482,22 +482,22 @@ EXPORT_SYMBOL(consume_skb);
 *      reference count dropping and cleans up the skbuff as if it
 *      just came from __alloc_skb().
 */
-int skb_recycle_check(struct sk_buff *skb, int skb_size)
+bool skb_recycle_check(struct sk_buff *skb, int skb_size)
 {
        struct skb_shared_info *shinfo;
        if (irqs_disabled())
-                return 0;
+                return false;
        if (skb_is_nonlinear(skb) || skb->fclone != SKB_FCLONE_UNAVAILABLE)
-                return 0;
+                return false;
        skb_size = SKB_DATA_ALIGN(skb_size + NET_SKB_PAD);
        if (skb_end_pointer(skb) - skb->head < skb_size)
-                return 0;
+                return false;
        if (skb_shared(skb) || skb_cloned(skb))
-                return 0;
+                return false;
        skb_release_head_state(skb);
@@ -509,7 +509,7 @@ int skb_recycle_check(struct sk_buff *skb, int skb_size)
        skb->data = skb->head + NET_SKB_PAD;
        skb_reset_tail_pointer(skb);
-        return 1;
+        return true;
 }
 EXPORT_SYMBOL(skb_recycle_check);
@@ -532,6 +532,7 @@ static void __copy_skb_header(struct sk_buff *new, const struct sk_buff *old)
        new->ip_summed          = old->ip_summed;
        skb_copy_queue_mapping(new, old);
        new->priority           = old->priority;
+        new->deliver_no_wcard   = old->deliver_no_wcard;
 #if defined(CONFIG_IP_VS) || defined(CONFIG_IP_VS_MODULE)
        new->ipvs_property      = old->ipvs_property;
 #endif
@@ -569,7 +570,6 @@ static struct sk_buff *__skb_clone(struct sk_buff *n, struct sk_buff *skb)
        C(len);
        C(data_len);
        C(mac_len);
-        C(rxhash);
        n->hdr_len = skb->nohdr ? skb_headroom(skb) : skb->hdr_len;
        n->cloned = 1;
        n->nohdr = 0;
@@ -2965,6 +2965,34 @@ int skb_cow_data(struct sk_buff *skb, int tailbits, struct sk_buff **trailer)
 }
 EXPORT_SYMBOL_GPL(skb_cow_data);
+static void sock_rmem_free(struct sk_buff *skb)
+{
+        struct sock *sk = skb->sk;
+        atomic_sub(skb->truesize, &sk->sk_rmem_alloc);
+}
+/*
+ * Note: We dont mem charge error packets (no sk_forward_alloc changes)
+ */
+int sock_queue_err_skb(struct sock *sk, struct sk_buff *skb)
+{
+        if (atomic_read(&sk->sk_rmem_alloc) + skb->truesize >=
+            (unsigned)sk->sk_rcvbuf)
+                return -ENOMEM;
+        skb_orphan(skb);
+        skb->sk = sk;
+        skb->destructor = sock_rmem_free;
+        atomic_add(skb->truesize, &sk->sk_rmem_alloc);
+        skb_queue_tail(&sk->sk_error_queue, skb);
+        if (!sock_flag(sk, SOCK_DEAD))
+                sk->sk_data_ready(sk, skb->len);
+        return 0;
+}
+EXPORT_SYMBOL(sock_queue_err_skb);
 void skb_tstamp_tx(struct sk_buff *orig_skb,
                struct skb_shared_hwtstamps *hwtstamps)
 {
@@ -2996,7 +3024,9 @@ void skb_tstamp_tx(struct sk_buff *orig_skb,
        memset(serr, 0, sizeof(*serr));
        serr->ee.ee_errno = ENOMSG;
        serr->ee.ee_origin = SO_EE_ORIGIN_TIMESTAMPING;
        err = sock_queue_err_skb(sk, skb);
        if (err)
                kfree_skb(skb);
 }
diff --git a/net/ipv4/Kconfig b/net/ipv4/Kconfig
index 8e3a1fd938ab..7c3a7d191249 100644
--- a/net/ipv4/Kconfig
+++ b/net/ipv4/Kconfig
@@ -303,7 +303,7 @@ config ARPD
          If unsure, say N.
 config SYN_COOKIES
-        bool "IP: TCP syncookie support (disabled per default)"
+        bool "IP: TCP syncookie support"
        ---help---
          Normal TCP/IP networking is open to an attack known as "SYN
          flooding". This denial-of-service attack prevents legitimate remote
@@ -328,13 +328,13 @@ config SYN_COOKIES
          server is really overloaded. If this happens frequently better turn
          them off.
-          If you say Y here, note that SYN cookies aren't enabled by default;
+          If you say Y here, you can disable SYN cookies at run time by
-          you can enable them by saying Y to "/proc file system support" and
+          saying Y to "/proc file system support" and
          "Sysctl support" below and executing the command
-          echo 1 >/proc/sys/net/ipv4/tcp_syncookies
+          echo 0 > /proc/sys/net/ipv4/tcp_syncookies
-          at boot time after the /proc file system has been mounted.
+          after the /proc file system has been mounted.
          If unsure, say N.
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index 856123fe32f9..757f25eb9b4b 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -267,8 +267,10 @@ static void __net_exit ipmr_rules_exit(struct net *net)
 {
        struct mr_table *mrt, *next;
-        list_for_each_entry_safe(mrt, next, &net->ipv4.mr_tables, list)
+        list_for_each_entry_safe(mrt, next, &net->ipv4.mr_tables, list) {
+                list_del(&mrt->list);
                kfree(mrt);
+        }
        fib_rules_unregister(net->ipv4.mr_rules_ops);
 }
 #else
diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
index 5c24db4a3c91..9f6b22206c52 100644
--- a/net/ipv4/syncookies.c
+++ b/net/ipv4/syncookies.c
@@ -347,7 +347,7 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
                                               { .sport = th->dest,
                                                 .dport = th->source } } };
                security_req_classify_flow(req, &fl);
-                if (ip_route_output_key(&init_net, &rt, &fl)) {
+                if (ip_route_output_key(sock_net(sk), &rt, &fl)) {
                        reqsk_free(req);
                        goto out;
                }
diff --git a/net/ipv4/tcp_hybla.c b/net/ipv4/tcp_hybla.c
index c209e054a634..377bc9349371 100644
--- a/net/ipv4/tcp_hybla.c
+++ b/net/ipv4/tcp_hybla.c
@@ -126,8 +126,8 @@ static void hybla_cong_avoid(struct sock *sk, u32 ack, u32 in_flight)
                 * calculate 2^fract in a <<7 value.
                 */
                is_slowstart = 1;
-                increment = ((1 << ca->rho) * hybla_fraction(rho_fractions))
+                increment = ((1 << min(ca->rho, 16U)) *
-                        - 128;
+                        hybla_fraction(rho_fractions)) - 128;
        } else {
                /*
                 * congestion avoidance
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 3e6dafcb1071..548d575e6cc6 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -2639,7 +2639,7 @@ static void DBGUNDO(struct sock *sk, const char *msg)
        if (sk->sk_family == AF_INET) {
                printk(KERN_DEBUG "Undo %s %pI4/%u c%u l%u ss%u/%u p%u\n",
                       msg,
-                       &inet->daddr, ntohs(inet->dport),
+                       &inet->inet_daddr, ntohs(inet->inet_dport),
                       tp->snd_cwnd, tcp_left_out(tp),
                       tp->snd_ssthresh, tp->prior_ssthresh,
                       tp->packets_out);
@@ -2649,7 +2649,7 @@ static void DBGUNDO(struct sock *sk, const char *msg)
                struct ipv6_pinfo *np = inet6_sk(sk);
                printk(KERN_DEBUG "Undo %s %pI6/%u c%u l%u ss%u/%u p%u\n",
                       msg,
-                       &np->daddr, ntohs(inet->dport),
+                       &np->daddr, ntohs(inet->inet_dport),
                       tp->snd_cwnd, tcp_left_out(tp),
                       tp->snd_ssthresh, tp->prior_ssthresh,
                       tp->packets_out);
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 202cf09c4cd4..fe193e53af44 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1555,6 +1555,7 @@ int tcp_v4_do_rcv(struct sock *sk, struct sk_buff *skb)
 #endif
        if (sk->sk_state == TCP_ESTABLISHED) { /* Fast path */
+                sock_rps_save_rxhash(sk, skb->rxhash);
                TCP_CHECK_TIMER(sk);
                if (tcp_rcv_established(sk, skb, tcp_hdr(skb), skb->len)) {
                        rsk = sk;
@@ -1579,7 +1580,9 @@ int tcp_v4_do_rcv(struct sock *sk, struct sk_buff *skb)
                        }
                        return 0;
                }
-        }
+        } else
+                sock_rps_save_rxhash(sk, skb->rxhash);
        TCP_CHECK_TIMER(sk);
        if (tcp_rcv_state_process(sk, skb, tcp_hdr(skb), skb->len)) {
@@ -1672,8 +1675,6 @@ process:
        skb->dev = NULL;
-        sock_rps_save_rxhash(sk, skb->rxhash);
        bh_lock_sock_nested(sk);
        ret = 0;
        if (!sock_owned_by_user(sk)) {
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 58585748bdac..eec4ff456e33 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -633,9 +633,9 @@ void __udp4_lib_err(struct sk_buff *skb, u32 info, struct udp_table *udptable)
        if (!inet->recverr) {
                if (!harderr || sk->sk_state != TCP_ESTABLISHED)
                        goto out;
-        } else {
+        } else
                ip_icmp_error(sk, skb, err, uh->dest, info, (u8 *)(uh+1));
-        }
        sk->sk_err = err;
        sk->sk_error_report(sk);
 out:
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index ce7992982557..03e62f94ff8e 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -483,7 +483,7 @@ route_done:
                              np->tclass, NULL, &fl, (struct rt6_info*)dst,
                              MSG_DONTWAIT, np->dontfrag);
        if (err) {
-                ICMP6_INC_STATS_BH(net, idev, ICMP6_MIB_OUTMSGS);
+                ICMP6_INC_STATS_BH(net, idev, ICMP6_MIB_OUTERRORS);
                ip6_flush_pending_frames(sk);
                goto out_put;
        }
@@ -565,7 +565,7 @@ static void icmpv6_echo_reply(struct sk_buff *skb)
                                np->dontfrag);
        if (err) {
-                ICMP6_INC_STATS_BH(net, idev, ICMP6_MIB_OUTMSGS);
+                ICMP6_INC_STATS_BH(net, idev, ICMP6_MIB_OUTERRORS);
                ip6_flush_pending_frames(sk);
                goto out_put;
        }
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index 073071f2b75b..66078dad7fe8 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -120,7 +120,7 @@ static void mroute_clean_tables(struct mr6_table *mrt);
 static void ipmr_expire_process(unsigned long arg);
 #ifdef CONFIG_IPV6_MROUTE_MULTIPLE_TABLES
-#define ip6mr_for_each_table(mrt, met) \
+#define ip6mr_for_each_table(mrt, net) \
        list_for_each_entry_rcu(mrt, &net->ipv6.mr6_tables, list)
 static struct mr6_table *ip6mr_get_table(struct net *net, u32 id)
@@ -254,8 +254,10 @@ static void __net_exit ip6mr_rules_exit(struct net *net)
 {
        struct mr6_table *mrt, *next;
-        list_for_each_entry_safe(mrt, next, &net->ipv6.mr6_tables, list)
+        list_for_each_entry_safe(mrt, next, &net->ipv6.mr6_tables, list) {
+                list_del(&mrt->list);
                ip6mr_free_table(mrt);
+        }
        fib_rules_unregister(net->ipv6.mr6_rules_ops);
 }
 #else
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index 59f1881968c7..ab1622d7d409 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -1356,7 +1356,10 @@ static struct sk_buff *mld_newpack(struct net_device *dev, int size)
                     IPV6_TLV_PADN, 0 };
        /* we assume size > sizeof(ra) here */
-        skb = sock_alloc_send_skb(sk, size + LL_ALLOCATED_SPACE(dev), 1, &err);
+        size += LL_ALLOCATED_SPACE(dev);
+        /* limit our allocations to order-0 page */
+        size = min_t(int, size, SKB_MAX_ORDER(0, 0));
+        skb = sock_alloc_send_skb(sk, size, 1, &err);
        if (!skb)
                return NULL;
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 294cbe8b0725..252d76199c41 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -814,7 +814,7 @@ struct dst_entry * ip6_route_output(struct net *net, struct sock *sk,
 {
        int flags = 0;
-        if (fl->oif || rt6_need_strict(&fl->fl6_dst))
+        if ((sk && sk->sk_bound_dev_if) || rt6_need_strict(&fl->fl6_dst))
                flags |= RT6_LOOKUP_F_IFACE;
        if (!ipv6_addr_any(&fl->fl6_src))
diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
index c163d0a149f4..98258b7341e3 100644
--- a/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
@@ -332,14 +332,16 @@ int ieee80211_start_tx_ba_session(struct ieee80211_sta *pubsta, u16 tid)
                IEEE80211_QUEUE_STOP_REASON_AGGREGATION);
        spin_unlock(&local->ampdu_lock);
-        spin_unlock_bh(&sta->lock);
-        /* send an addBA request */
+        /* prepare tid data */
        sta->ampdu_mlme.dialog_token_allocator++;
        sta->ampdu_mlme.tid_tx[tid]->dialog_token =
                        sta->ampdu_mlme.dialog_token_allocator;
        sta->ampdu_mlme.tid_tx[tid]->ssn = start_seq_num;
+        spin_unlock_bh(&sta->lock);
+        /* send AddBA request */
        ieee80211_send_addba_request(sdata, pubsta->addr, tid,
                         sta->ampdu_mlme.tid_tx[tid]->dialog_token,
                         sta->ampdu_mlme.tid_tx[tid]->ssn,
diff --git a/net/mac80211/chan.c b/net/mac80211/chan.c
index 5d218c530a4e..32be11e4c4d9 100644
--- a/net/mac80211/chan.c
+++ b/net/mac80211/chan.c
@@ -5,7 +5,7 @@
 #include <linux/nl80211.h>
 #include "ieee80211_i.h"
-enum ieee80211_chan_mode
+static enum ieee80211_chan_mode
 __ieee80211_get_channel_mode(struct ieee80211_local *local,
                             struct ieee80211_sub_if_data *ignore)
 {
diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h
index 4f2271316650..9c1da0809160 100644
--- a/net/mac80211/driver-ops.h
+++ b/net/mac80211/driver-ops.h
@@ -349,7 +349,7 @@ static inline int drv_get_survey(struct ieee80211_local *local, int idx,
                                struct survey_info *survey)
 {
        int ret = -EOPNOTSUPP;
-        if (local->ops->conf_tx)
+        if (local->ops->get_survey)
                ret = local->ops->get_survey(&local->hw, idx, survey);
        /* trace_drv_get_survey(local, idx, survey, ret); */
        return ret;
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 0839c4e8fd2e..f803f8b72a93 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -1692,14 +1692,52 @@ static void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
                        rma = ieee80211_rx_mgmt_disassoc(sdata, mgmt, skb->len);
                        break;
                case IEEE80211_STYPE_ACTION:
-                        if (mgmt->u.action.category != WLAN_CATEGORY_SPECTRUM_MGMT)
+                        switch (mgmt->u.action.category) {
+                        case WLAN_CATEGORY_BACK: {
+                                struct ieee80211_local *local = sdata->local;
+                                int len = skb->len;
+                                struct sta_info *sta;
+                                rcu_read_lock();
+                                sta = sta_info_get(sdata, mgmt->sa);
+                                if (!sta) {
+                                        rcu_read_unlock();
+                                        break;
+                                }
+                                local_bh_disable();
+                                switch (mgmt->u.action.u.addba_req.action_code) {
+                                case WLAN_ACTION_ADDBA_REQ:
+                                        if (len < (IEEE80211_MIN_ACTION_SIZE +
+                                                   sizeof(mgmt->u.action.u.addba_req)))
+                                                break;
+                                        ieee80211_process_addba_request(local, sta, mgmt, len);
+                                        break;
+                                case WLAN_ACTION_ADDBA_RESP:
+                                        if (len < (IEEE80211_MIN_ACTION_SIZE +
+                                                   sizeof(mgmt->u.action.u.addba_resp)))
+                                                break;
+                                        ieee80211_process_addba_resp(local, sta, mgmt, len);
+                                        break;
+                                case WLAN_ACTION_DELBA:
+                                        if (len < (IEEE80211_MIN_ACTION_SIZE +
+                                                   sizeof(mgmt->u.action.u.delba)))
+                                                break;
+                                        ieee80211_process_delba(sdata, sta, mgmt, len);
+                                        break;
+                                }
+                                local_bh_enable();
+                                rcu_read_unlock();
                                break;
+                                }
-                        ieee80211_sta_process_chanswitch(sdata,
+                        case WLAN_CATEGORY_SPECTRUM_MGMT:
-                                        &mgmt->u.action.u.chan_switch.sw_elem,
+                                ieee80211_sta_process_chanswitch(sdata,
-                                        (void *)ifmgd->associated->priv,
+                                                &mgmt->u.action.u.chan_switch.sw_elem,
-                                        rx_status->mactime);
+                                                (void *)ifmgd->associated->priv,
-                        break;
+                                                rx_status->mactime);
+                                break;
+                        }
                }
                mutex_unlock(&ifmgd->mtx);
@@ -1722,9 +1760,45 @@ static void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
        mutex_unlock(&ifmgd->mtx);
        if (skb->len >= 24 + 2 /* mgmt + deauth reason */ &&
-            (fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_DEAUTH)
+            (fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_DEAUTH) {
-                cfg80211_send_deauth(sdata->dev, (u8 *)mgmt, skb->len);
+                struct ieee80211_local *local = sdata->local;
+                struct ieee80211_work *wk;
+                mutex_lock(&local->work_mtx);
+                list_for_each_entry(wk, &local->work_list, list) {
+                        if (wk->sdata != sdata)
+                                continue;
+                        if (wk->type != IEEE80211_WORK_ASSOC)
+                                continue;
+                        if (memcmp(mgmt->bssid, wk->filter_ta, ETH_ALEN))
+                                continue;
+                        if (memcmp(mgmt->sa, wk->filter_ta, ETH_ALEN))
+                                continue;
+                        /*
+                         * Printing the message only here means we can't
+                         * spuriously print it, but it also means that it
+                         * won't be printed when the frame comes in before
+                         * we even tried to associate or in similar cases.
+                         *
+                         * Ultimately, I suspect cfg80211 should print the
+                         * messages instead.
+                         */
+                        printk(KERN_DEBUG
+                               "%s: deauthenticated from %pM (Reason: %u)\n",
+                               sdata->name, mgmt->bssid,
+                               le16_to_cpu(mgmt->u.deauth.reason_code));
+                        list_del_rcu(&wk->list);
+                        free_work(wk);
+                        break;
+                }
+                mutex_unlock(&local->work_mtx);
+                cfg80211_send_deauth(sdata->dev, (u8 *)mgmt, skb->len);
+        }
 out:
        kfree_skb(skb);
 }
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 6e2a7bcd8cb8..be9abc2e6348 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -1818,17 +1818,26 @@ ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx, struct sk_buff_head *frames)
                return RX_CONTINUE;
        if (ieee80211_is_back_req(bar->frame_control)) {
+                struct {
+                        __le16 control, start_seq_num;
+                } __packed bar_data;
                if (!rx->sta)
                        return RX_DROP_MONITOR;
+                if (skb_copy_bits(skb, offsetof(struct ieee80211_bar, control),
+                                  &bar_data, sizeof(bar_data)))
+                        return RX_DROP_MONITOR;
                spin_lock(&rx->sta->lock);
-                tid = le16_to_cpu(bar->control) >> 12;
+                tid = le16_to_cpu(bar_data.control) >> 12;
                if (!rx->sta->ampdu_mlme.tid_active_rx[tid]) {
                        spin_unlock(&rx->sta->lock);
                        return RX_DROP_MONITOR;
                }
                tid_agg_rx = rx->sta->ampdu_mlme.tid_rx[tid];
-                start_seq_num = le16_to_cpu(bar->start_seq_num) >> 4;
+                start_seq_num = le16_to_cpu(bar_data.start_seq_num) >> 4;
                /* reset session timer */
                if (tid_agg_rx->timeout)
@@ -1935,6 +1944,9 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
                if (len < IEEE80211_MIN_ACTION_SIZE + 1)
                        break;
+                if (sdata->vif.type == NL80211_IFTYPE_STATION)
+                        return ieee80211_sta_rx_mgmt(sdata, rx->skb);
                switch (mgmt->u.action.u.addba_req.action_code) {
                case WLAN_ACTION_ADDBA_REQ:
                        if (len < (IEEE80211_MIN_ACTION_SIZE +
diff --git a/net/phonet/pep.c b/net/phonet/pep.c
index 7b048a35ca58..94d72e85a475 100644
--- a/net/phonet/pep.c
+++ b/net/phonet/pep.c
@@ -1045,12 +1045,12 @@ static void pep_sock_unhash(struct sock *sk)
        lock_sock(sk);
        if ((1 << sk->sk_state) & ~(TCPF_CLOSE|TCPF_LISTEN)) {
                skparent = pn->listener;
-                sk_del_node_init(sk);
                release_sock(sk);
-                sk = skparent;
                pn = pep_sk(skparent);
-                lock_sock(sk);
+                lock_sock(skparent);
+                sk_del_node_init(sk);
+                sk = skparent;
        }
        /* Unhash a listening sock only when it is closed
         * and all of its active connected pipes are closed. */
diff --git a/net/rds/ib_cm.c b/net/rds/ib_cm.c
index 10ed0d55f759..f68832798db2 100644
--- a/net/rds/ib_cm.c
+++ b/net/rds/ib_cm.c
@@ -475,6 +475,7 @@ int rds_ib_cm_handle_connect(struct rdma_cm_id *cm_id,
        err = rds_ib_setup_qp(conn);
        if (err) {
                rds_ib_conn_error(conn, "rds_ib_setup_qp failed (%d)\n", err);
+                mutex_unlock(&conn->c_cm_lock);
                goto out;
        }
diff --git a/net/rds/iw_cm.c b/net/rds/iw_cm.c
index a9d951b4fbae..b5dd6ac39be8 100644
--- a/net/rds/iw_cm.c
+++ b/net/rds/iw_cm.c
@@ -452,6 +452,7 @@ int rds_iw_cm_handle_connect(struct rdma_cm_id *cm_id,
        err = rds_iw_setup_qp(conn);
        if (err) {
                rds_iw_conn_error(conn, "rds_iw_setup_qp failed (%d)\n", err);
+                mutex_unlock(&conn->c_cm_lock);
                goto out;
        }
diff --git a/net/sched/act_nat.c b/net/sched/act_nat.c
index d885ba311564..570949417f38 100644
--- a/net/sched/act_nat.c
+++ b/net/sched/act_nat.c
@@ -159,6 +159,9 @@ static int tcf_nat(struct sk_buff *skb, struct tc_action *a,
                        iph->daddr = new_addr;
                csum_replace4(&iph->check, addr, new_addr);
+        } else if ((iph->frag_off & htons(IP_OFFSET)) ||
+                   iph->protocol != IPPROTO_ICMP) {
+                goto out;
        }
        ihl = iph->ihl * 4;
@@ -247,6 +250,7 @@ static int tcf_nat(struct sk_buff *skb, struct tc_action *a,
                break;
        }
+out:
        return action;
 drop:
diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c
index fdbd0b7bd840..50e3d945e1f4 100644
--- a/net/sched/act_pedit.c
+++ b/net/sched/act_pedit.c
@@ -125,7 +125,7 @@ static int tcf_pedit(struct sk_buff *skb, struct tc_action *a,
 {
        struct tcf_pedit *p = a->priv;
        int i, munged = 0;
-        u8 *pptr;
+        unsigned int off;
        if (!(skb->tc_verd & TC_OK2MUNGE)) {
                /* should we set skb->cloned? */
@@ -134,7 +134,7 @@ static int tcf_pedit(struct sk_buff *skb, struct tc_action *a,
                }
        }
-        pptr = skb_network_header(skb);
+        off = skb_network_offset(skb);
        spin_lock(&p->tcf_lock);
@@ -144,17 +144,17 @@ static int tcf_pedit(struct sk_buff *skb, struct tc_action *a,
                struct tc_pedit_key *tkey = p->tcfp_keys;
                for (i = p->tcfp_nkeys; i > 0; i--, tkey++) {
-                        u32 *ptr;
+                        u32 *ptr, _data;
                        int offset = tkey->off;
                        if (tkey->offmask) {
-                                if (skb->len > tkey->at) {
+                                char *d, _d;
-                                         char *j = pptr + tkey->at;
-                                         offset += ((*j & tkey->offmask) >>
+                                d = skb_header_pointer(skb, off + tkey->at, 1,
-                                                   tkey->shift);
+                                                       &_d);
-                                } else {
+                                if (!d)
                                        goto bad;
-                                }
+                                offset += (*d & tkey->offmask) >> tkey->shift;
                        }
                        if (offset % 4) {
@@ -169,9 +169,13 @@ static int tcf_pedit(struct sk_buff *skb, struct tc_action *a,
                                goto bad;
                        }
-                        ptr = (u32 *)(pptr+offset);
+                        ptr = skb_header_pointer(skb, off + offset, 4, &_data);
+                        if (!ptr)
+                                goto bad;
                        /* just do it, baby */
                        *ptr = ((*ptr & tkey->mask) ^ tkey->val);
+                        if (ptr == &_data)
+                                skb_store_bits(skb, off + offset, ptr, 4);
                        munged++;
                }
diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c
index 96275422c619..4f522143811e 100644
--- a/net/sched/cls_u32.c
+++ b/net/sched/cls_u32.c
@@ -98,11 +98,11 @@ static int u32_classify(struct sk_buff *skb, struct tcf_proto *tp, struct tcf_re
 {
        struct {
                struct tc_u_knode *knode;
-                u8                *ptr;
+                unsigned int      off;
        } stack[TC_U32_MAXDEPTH];
        struct tc_u_hnode *ht = (struct tc_u_hnode*)tp->root;
-        u8 *ptr = skb_network_header(skb);
+        unsigned int off = skb_network_offset(skb);
        struct tc_u_knode *n;
        int sdepth = 0;
        int off2 = 0;
@@ -134,8 +134,14 @@ next_knode:
 #endif
                for (i = n->sel.nkeys; i>0; i--, key++) {
+                        unsigned int toff;
-                        if ((*(__be32*)(ptr+key->off+(off2&key->offmask))^key->val)&key->mask) {
+                        __be32 *data, _data;
+                        toff = off + key->off + (off2 & key->offmask);
+                        data = skb_header_pointer(skb, toff, 4, &_data);
+                        if (!data)
+                                goto out;
+                        if ((*data ^ key->val) & key->mask) {
                                n = n->next;
                                goto next_knode;
                        }
@@ -174,29 +180,45 @@ check_terminal:
                if (sdepth >= TC_U32_MAXDEPTH)
                        goto deadloop;
                stack[sdepth].knode = n;
-                stack[sdepth].ptr = ptr;
+                stack[sdepth].off = off;
                sdepth++;
                ht = n->ht_down;
                sel = 0;
-                if (ht->divisor)
+                if (ht->divisor) {
-                        sel = ht->divisor&u32_hash_fold(*(__be32*)(ptr+n->sel.hoff), &n->sel,n->fshift);
+                        __be32 *data, _data;
+                        data = skb_header_pointer(skb, off + n->sel.hoff, 4,
+                                                  &_data);
+                        if (!data)
+                                goto out;
+                        sel = ht->divisor & u32_hash_fold(*data, &n->sel,
+                                                          n->fshift);
+                }
                if (!(n->sel.flags&(TC_U32_VAROFFSET|TC_U32_OFFSET|TC_U32_EAT)))
                        goto next_ht;
                if (n->sel.flags&(TC_U32_OFFSET|TC_U32_VAROFFSET)) {
                        off2 = n->sel.off + 3;
-                        if (n->sel.flags&TC_U32_VAROFFSET)
+                        if (n->sel.flags & TC_U32_VAROFFSET) {
-                                off2 += ntohs(n->sel.offmask & *(__be16*)(ptr+n->sel.offoff)) >>n->sel.offshift;
+                                __be16 *data, _data;
+                                data = skb_header_pointer(skb,
+                                                          off + n->sel.offoff,
+                                                          2, &_data);
+                                if (!data)
+                                        goto out;
+                                off2 += ntohs(n->sel.offmask & *data) >>
+                                        n->sel.offshift;
+                        }
                        off2 &= ~3;
                }
                if (n->sel.flags&TC_U32_EAT) {
-                        ptr += off2;
+                        off += off2;
                        off2 = 0;
                }
-                if (ptr < skb_tail_pointer(skb))
+                if (off < skb->len)
                        goto next_ht;
        }
@@ -204,9 +226,10 @@ check_terminal:
        if (sdepth--) {
                n = stack[sdepth].knode;
                ht = n->ht_up;
-                ptr = stack[sdepth].ptr;
+                off = stack[sdepth].off;
                goto check_terminal;
        }
+out:
        return -1;
 deadloop:
diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c
index 6a329158bdfa..a3cca0a94346 100644
--- a/net/xfrm/xfrm_output.c
+++ b/net/xfrm/xfrm_output.c
@@ -95,13 +95,13 @@ resume:
                        goto error_nolock;
                }
-                dst = dst_pop(dst);
+                dst = skb_dst_pop(skb);
                if (!dst) {
                        XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTERROR);
                        err = -EHOSTUNREACH;
                        goto error_nolock;
                }
-                skb_dst_set(skb, dst);
+                skb_dst_set_noref(skb, dst);
                x = dst->xfrm;
        } while (x && !(x->outer_mode->flags & XFRM_MODE_FLAG_TUNNEL));
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index d965a2bad8d3..4bf27d901333 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -2153,6 +2153,7 @@ int __xfrm_route_forward(struct sk_buff *skb, unsigned short family)
                return 0;
        }
+        skb_dst_force(skb);
        dst = skb_dst(skb);
        res = xfrm_lookup(net, &dst, &fl, NULL, 0) == 0;