37 files changed, 256 insertions, 165 deletions

diff --git a/drivers/net/8139too.c b/drivers/net/8139too.c
index 98517a373473..e3bad8247fd1 100644
--- a/drivers/net/8139too.c
+++ b/drivers/net/8139too.c
@@ -992,6 +992,7 @@ static int __devinit rtl8139_init_one (struct pci_dev *pdev,
          * features
          */
         dev->features |= NETIF_F_SG | NETIF_F_HW_CSUM | NETIF_F_HIGHDMA;
+        dev->vlan_features = dev->features;
 
         dev->irq = pdev->irq;
 
diff --git a/drivers/net/bna/bnad.c b/drivers/net/bna/bnad.c
index 7d25a97d33f6..44e219c910da 100644
--- a/drivers/net/bna/bnad.c
+++ b/drivers/net/bna/bnad.c
@@ -1111,7 +1111,7 @@ bnad_mbox_irq_alloc(struct bnad *bnad,
                     struct bna_intr_info *intr_info)
 {
         int             err = 0;
-        unsigned long   flags;
+        unsigned long   irq_flags = 0, flags;
         u32     irq;
         irq_handler_t   irq_handler;
 
@@ -1125,18 +1125,17 @@ bnad_mbox_irq_alloc(struct bnad *bnad,
         if (bnad->cfg_flags & BNAD_CF_MSIX) {
                 irq_handler = (irq_handler_t)bnad_msix_mbox_handler;
                 irq = bnad->msix_table[bnad->msix_num - 1].vector;
-                flags = 0;
                 intr_info->intr_type = BNA_INTR_T_MSIX;
                 intr_info->idl[0].vector = bnad->msix_num - 1;
         } else {
                 irq_handler = (irq_handler_t)bnad_isr;
                 irq = bnad->pcidev->irq;
-                flags = IRQF_SHARED;
+                irq_flags = IRQF_SHARED;
                 intr_info->intr_type = BNA_INTR_T_INTX;
                 /* intr_info->idl.vector = 0 ? */
         }
         spin_unlock_irqrestore(&bnad->bna_lock, flags);
-
+        flags = irq_flags;
         sprintf(bnad->mbox_irq_name, "%s", BNAD_NAME);
 
         /*
diff --git a/drivers/net/greth.c b/drivers/net/greth.c
index f181304a7ab6..672f096fe090 100644
--- a/drivers/net/greth.c
+++ b/drivers/net/greth.c
@@ -1015,11 +1015,10 @@ static int greth_set_mac_add(struct net_device *dev, void *p)
                 return -EINVAL;
 
         memcpy(dev->dev_addr, addr->sa_data, dev->addr_len);
+        GRETH_REGSAVE(regs->esa_msb, dev->dev_addr[0] << 8 | dev->dev_addr[1]);
+        GRETH_REGSAVE(regs->esa_lsb, dev->dev_addr[2] << 24 | dev->dev_addr[3] << 16 |
+                      dev->dev_addr[4] << 8 | dev->dev_addr[5]);
 
-        GRETH_REGSAVE(regs->esa_msb, addr->sa_data[0] << 8 | addr->sa_data[1]);
-        GRETH_REGSAVE(regs->esa_lsb,
-                      addr->sa_data[2] << 24 | addr->
-                      sa_data[3] << 16 | addr->sa_data[4] << 8 | addr->sa_data[5]);
         return 0;
 }
 
diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c
index 3e5d0b6b6516..0d283781bc5e 100644
--- a/drivers/net/hamradio/6pack.c
+++ b/drivers/net/hamradio/6pack.c
@@ -692,10 +692,10 @@ static void sixpack_close(struct tty_struct *tty)
 {
         struct sixpack *sp;
 
-        write_lock(&disc_data_lock);
+        write_lock_bh(&disc_data_lock);
         sp = tty->disc_data;
         tty->disc_data = NULL;
-        write_unlock(&disc_data_lock);
+        write_unlock_bh(&disc_data_lock);
         if (!sp)
                 return;
 
diff --git a/drivers/net/hamradio/mkiss.c b/drivers/net/hamradio/mkiss.c
index 4c628393c8b1..bc02968cee16 100644
--- a/drivers/net/hamradio/mkiss.c
+++ b/drivers/net/hamradio/mkiss.c
@@ -813,10 +813,10 @@ static void mkiss_close(struct tty_struct *tty)
 {
         struct mkiss *ax;
 
-        write_lock(&disc_data_lock);
+        write_lock_bh(&disc_data_lock);
         ax = tty->disc_data;
         tty->disc_data = NULL;
-        write_unlock(&disc_data_lock);
+        write_unlock_bh(&disc_data_lock);
 
         if (!ax)
                 return;
diff --git a/drivers/net/natsemi.c b/drivers/net/natsemi.c
index b78be088c4ad..8f8b65af9ed5 100644
--- a/drivers/net/natsemi.c
+++ b/drivers/net/natsemi.c
@@ -2360,7 +2360,8 @@ static void netdev_rx(struct net_device *dev, int *work_done, int work_to_do)
                                         PCI_DMA_FROMDEVICE);
                         } else {
                                 pci_unmap_single(np->pci_dev, np->rx_dma[entry],
-                                        buflen, PCI_DMA_FROMDEVICE);
+                                                 buflen + NATSEMI_PADDING,
+                                                 PCI_DMA_FROMDEVICE);
                                 skb_put(skb = np->rx_skbuff[entry], pkt_len);
                                 np->rx_skbuff[entry] = NULL;
                         }
diff --git a/drivers/net/qlge/qlge.h b/drivers/net/qlge/qlge.h
index d32850715f5c..ca306fd5f588 100644
--- a/drivers/net/qlge/qlge.h
+++ b/drivers/net/qlge/qlge.h
@@ -16,7 +16,7 @@
  */
 #define DRV_NAME        "qlge"
 #define DRV_STRING      "QLogic 10 Gigabit PCI-E Ethernet Driver "
-#define DRV_VERSION     "v1.00.00.27.00.00-01"
+#define DRV_VERSION     "v1.00.00.29.00.00-01"
 
 #define WQ_ADDR_ALIGN   0x3     /* 4 byte alignment */
 
@@ -1996,6 +1996,7 @@ enum {
         QL_LB_LINK_UP = 10,
         QL_FRC_COREDUMP = 11,
         QL_EEH_FATAL = 12,
+        QL_ASIC_RECOVERY = 14, /* We are in ascic recovery. */
 };
 
 /* link_status bit definitions */
diff --git a/drivers/net/qlge/qlge_main.c b/drivers/net/qlge/qlge_main.c
index 930ae45457bb..6b4ff970972b 100644
--- a/drivers/net/qlge/qlge_main.c
+++ b/drivers/net/qlge/qlge_main.c
@@ -2152,6 +2152,10 @@ void ql_queue_asic_error(struct ql_adapter *qdev)
          * thread
          */
         clear_bit(QL_ADAPTER_UP, &qdev->flags);
+        /* Set asic recovery bit to indicate reset process that we are
+         * in fatal error recovery process rather than normal close
+         */
+        set_bit(QL_ASIC_RECOVERY, &qdev->flags);
         queue_delayed_work(qdev->workqueue, &qdev->asic_reset_work, 0);
 }
 
@@ -2166,23 +2170,20 @@ static void ql_process_chip_ae_intr(struct ql_adapter *qdev,
                 return;
 
         case CAM_LOOKUP_ERR_EVENT:
-                netif_err(qdev, link, qdev->ndev,
-                          "Multiple CAM hits lookup occurred.\n");
-                netif_err(qdev, drv, qdev->ndev,
-                          "This event shouldn't occur.\n");
+                netdev_err(qdev->ndev, "Multiple CAM hits lookup occurred.\n");
+                netdev_err(qdev->ndev, "This event shouldn't occur.\n");
                 ql_queue_asic_error(qdev);
                 return;
 
         case SOFT_ECC_ERROR_EVENT:
-                netif_err(qdev, rx_err, qdev->ndev,
-                          "Soft ECC error detected.\n");
+                netdev_err(qdev->ndev, "Soft ECC error detected.\n");
                 ql_queue_asic_error(qdev);
                 break;
 
         case PCI_ERR_ANON_BUF_RD:
-                netif_err(qdev, rx_err, qdev->ndev,
-                          "PCI error occurred when reading anonymous buffers from rx_ring %d.\n",
-                          ib_ae_rsp->q_id);
+                netdev_err(qdev->ndev, "PCI error occurred when reading "
+                                        "anonymous buffers from rx_ring %d.\n",
+                                        ib_ae_rsp->q_id);
                 ql_queue_asic_error(qdev);
                 break;
 
@@ -2437,11 +2438,10 @@ static irqreturn_t qlge_isr(int irq, void *dev_id)
          */
         if (var & STS_FE) {
                 ql_queue_asic_error(qdev);
-                netif_err(qdev, intr, qdev->ndev,
-                          "Got fatal error, STS = %x.\n", var);
+                netdev_err(qdev->ndev, "Got fatal error, STS = %x.\n", var);
                 var = ql_read32(qdev, ERR_STS);
-                netif_err(qdev, intr, qdev->ndev,
-                          "Resetting chip. Error Status Register = 0x%x\n", var);
+                netdev_err(qdev->ndev, "Resetting chip. "
+                                        "Error Status Register = 0x%x\n", var);
                 return IRQ_HANDLED;
         }
 
@@ -3818,11 +3818,17 @@ static int ql_adapter_reset(struct ql_adapter *qdev)
         end_jiffies = jiffies +
                 max((unsigned long)1, usecs_to_jiffies(30));
 
-        /* Stop management traffic. */
-        ql_mb_set_mgmnt_traffic_ctl(qdev, MB_SET_MPI_TFK_STOP);
+        /* Check if bit is set then skip the mailbox command and
+         * clear the bit, else we are in normal reset process.
+         */
+        if (!test_bit(QL_ASIC_RECOVERY, &qdev->flags)) {
+                /* Stop management traffic. */
+                ql_mb_set_mgmnt_traffic_ctl(qdev, MB_SET_MPI_TFK_STOP);
 
-        /* Wait for the NIC and MGMNT FIFOs to empty. */
-        ql_wait_fifo_empty(qdev);
+                /* Wait for the NIC and MGMNT FIFOs to empty. */
+                ql_wait_fifo_empty(qdev);
+        } else
+                clear_bit(QL_ASIC_RECOVERY, &qdev->flags);
 
         ql_write32(qdev, RST_FO, (RST_FO_FR << 16) | RST_FO_FR);
 
diff --git a/drivers/net/sh_eth.c b/drivers/net/sh_eth.c
index 8a72a979ee71..1f3f7b4dd638 100644
--- a/drivers/net/sh_eth.c
+++ b/drivers/net/sh_eth.c
@@ -140,6 +140,8 @@ static struct sh_eth_cpu_data sh_eth_my_cpu_data = {
         .tpauser        = 1,
         .hw_swap        = 1,
         .no_ade         = 1,
+        .rpadir         = 1,
+        .rpadir_value   = 2 << 16,
 };
 
 #define SH_GIGA_ETH_BASE        0xfee00000
@@ -1184,8 +1186,8 @@ static void sh_eth_adjust_link(struct net_device *ndev)
                                 mdp->cd->set_rate(ndev);
                 }
                 if (mdp->link == PHY_DOWN) {
-                        sh_eth_write(ndev, (sh_eth_read(ndev, ECMR) & ~ECMR_TXF)
-                                        | ECMR_DM, ECMR);
+                        sh_eth_write(ndev,
+                                (sh_eth_read(ndev, ECMR) & ~ECMR_TXF), ECMR);
                         new_state = 1;
                         mdp->link = phydev->link;
                 }
diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
index fa6e2ac7475a..67402350d0df 100644
--- a/drivers/net/vmxnet3/vmxnet3_drv.c
+++ b/drivers/net/vmxnet3/vmxnet3_drv.c
@@ -575,7 +575,7 @@ vmxnet3_rq_alloc_rx_buf(struct vmxnet3_rx_queue *rq, u32 ring_idx,
         struct vmxnet3_cmd_ring *ring = &rq->rx_ring[ring_idx];
         u32 val;
 
-        while (num_allocated < num_to_alloc) {
+        while (num_allocated <= num_to_alloc) {
                 struct vmxnet3_rx_buf_info *rbi;
                 union Vmxnet3_GenericDesc *gd;
 
@@ -621,9 +621,15 @@ vmxnet3_rq_alloc_rx_buf(struct vmxnet3_rx_queue *rq, u32 ring_idx,
 
                 BUG_ON(rbi->dma_addr == 0);
                 gd->rxd.addr = cpu_to_le64(rbi->dma_addr);
-                gd->dword[2] = cpu_to_le32((ring->gen << VMXNET3_RXD_GEN_SHIFT)
+                gd->dword[2] = cpu_to_le32((!ring->gen << VMXNET3_RXD_GEN_SHIFT)
                                            | val | rbi->len);
 
+                /* Fill the last buffer but dont mark it ready, or else the
+                 * device will think that the queue is full */
+                if (num_allocated == num_to_alloc)
+                        break;
+
+                gd->dword[2] |= cpu_to_le32(ring->gen << VMXNET3_RXD_GEN_SHIFT);
                 num_allocated++;
                 vmxnet3_cmd_ring_adv_next2fill(ring);
         }
@@ -1140,6 +1146,7 @@ vmxnet3_rq_rx_complete(struct vmxnet3_rx_queue *rq,
                 VMXNET3_REG_RXPROD, VMXNET3_REG_RXPROD2
         };
         u32 num_rxd = 0;
+        bool skip_page_frags = false;
         struct Vmxnet3_RxCompDesc *rcd;
         struct vmxnet3_rx_ctx *ctx = &rq->rx_ctx;
 #ifdef __BIG_ENDIAN_BITFIELD
@@ -1150,11 +1157,12 @@ vmxnet3_rq_rx_complete(struct vmxnet3_rx_queue *rq,
                           &rxComp);
         while (rcd->gen == rq->comp_ring.gen) {
                 struct vmxnet3_rx_buf_info *rbi;
-                struct sk_buff *skb;
+                struct sk_buff *skb, *new_skb = NULL;
+                struct page *new_page = NULL;
                 int num_to_alloc;
                 struct Vmxnet3_RxDesc *rxd;
                 u32 idx, ring_idx;
-
+                struct vmxnet3_cmd_ring *ring = NULL;
                 if (num_rxd >= quota) {
                         /* we may stop even before we see the EOP desc of
                          * the current pkt
@@ -1165,6 +1173,7 @@ vmxnet3_rq_rx_complete(struct vmxnet3_rx_queue *rq,
                 BUG_ON(rcd->rqID != rq->qid && rcd->rqID != rq->qid2);
                 idx = rcd->rxdIdx;
                 ring_idx = rcd->rqID < adapter->num_rx_queues ? 0 : 1;
+                ring = rq->rx_ring + ring_idx;
                 vmxnet3_getRxDesc(rxd, &rq->rx_ring[ring_idx].base[idx].rxd,
                                   &rxCmdDesc);
                 rbi = rq->buf_info[ring_idx] + idx;
@@ -1193,37 +1202,80 @@ vmxnet3_rq_rx_complete(struct vmxnet3_rx_queue *rq,
                                 goto rcd_done;
                         }
 
+                        skip_page_frags = false;
                         ctx->skb = rbi->skb;
-                        rbi->skb = NULL;
+                        new_skb = dev_alloc_skb(rbi->len + NET_IP_ALIGN);
+                        if (new_skb == NULL) {
+                                /* Skb allocation failed, do not handover this
+                                 * skb to stack. Reuse it. Drop the existing pkt
+                                 */
+                                rq->stats.rx_buf_alloc_failure++;
+                                ctx->skb = NULL;
+                                rq->stats.drop_total++;
+                                skip_page_frags = true;
+                                goto rcd_done;
+                        }
 
                         pci_unmap_single(adapter->pdev, rbi->dma_addr, rbi->len,
                                          PCI_DMA_FROMDEVICE);
 
                         skb_put(ctx->skb, rcd->len);
+
+                        /* Immediate refill */
+                        new_skb->dev = adapter->netdev;
+                        skb_reserve(new_skb, NET_IP_ALIGN);
+                        rbi->skb = new_skb;
+                        rbi->dma_addr = pci_map_single(adapter->pdev,
+                                        rbi->skb->data, rbi->len,
+                                        PCI_DMA_FROMDEVICE);
+                        rxd->addr = cpu_to_le64(rbi->dma_addr);
+                        rxd->len = rbi->len;
+
                 } else {
-                        BUG_ON(ctx->skb == NULL);
+                        BUG_ON(ctx->skb == NULL && !skip_page_frags);
+
                         /* non SOP buffer must be type 1 in most cases */
-                        if (rbi->buf_type == VMXNET3_RX_BUF_PAGE) {
-                                BUG_ON(rxd->btype != VMXNET3_RXD_BTYPE_BODY);
+                        BUG_ON(rbi->buf_type != VMXNET3_RX_BUF_PAGE);
+                        BUG_ON(rxd->btype != VMXNET3_RXD_BTYPE_BODY);
 
-                                if (rcd->len) {
-                                        pci_unmap_page(adapter->pdev,
-                                                       rbi->dma_addr, rbi->len,
-                                                       PCI_DMA_FROMDEVICE);
+                        /* If an sop buffer was dropped, skip all
+                         * following non-sop fragments. They will be reused.
+                         */
+                        if (skip_page_frags)
+                                goto rcd_done;
 
-                                        vmxnet3_append_frag(ctx->skb, rcd, rbi);
-                                        rbi->page = NULL;
-                                }
-                        } else {
-                                /*
-                                 * The only time a non-SOP buffer is type 0 is
-                                 * when it's EOP and error flag is raised, which
-                                 * has already been handled.
+                        new_page = alloc_page(GFP_ATOMIC);
+                        if (unlikely(new_page == NULL)) {
+                                /* Replacement page frag could not be allocated.
+                                 * Reuse this page. Drop the pkt and free the
+                                 * skb which contained this page as a frag. Skip
+                                 * processing all the following non-sop frags.
                                  */
-                                BUG_ON(true);
+                                rq->stats.rx_buf_alloc_failure++;
+                                dev_kfree_skb(ctx->skb);
+                                ctx->skb = NULL;
+                                skip_page_frags = true;
+                                goto rcd_done;
+                        }
+
+                        if (rcd->len) {
+                                pci_unmap_page(adapter->pdev,
+                                               rbi->dma_addr, rbi->len,
+                                               PCI_DMA_FROMDEVICE);
+
+                                vmxnet3_append_frag(ctx->skb, rcd, rbi);
                         }
+
+                        /* Immediate refill */
+                        rbi->page = new_page;
+                        rbi->dma_addr = pci_map_page(adapter->pdev, rbi->page,
+                                                     0, PAGE_SIZE,
+                                                     PCI_DMA_FROMDEVICE);
+                        rxd->addr = cpu_to_le64(rbi->dma_addr);
+                        rxd->len = rbi->len;
                 }
 
+
                 skb = ctx->skb;
                 if (rcd->eop) {
                         skb->len += skb->data_len;
@@ -1244,26 +1296,27 @@ vmxnet3_rq_rx_complete(struct vmxnet3_rx_queue *rq,
                 }
 
 rcd_done:
-                /* device may skip some rx descs */
-                rq->rx_ring[ring_idx].next2comp = idx;
-                VMXNET3_INC_RING_IDX_ONLY(rq->rx_ring[ring_idx].next2comp,
-                                          rq->rx_ring[ring_idx].size);
-
-                /* refill rx buffers frequently to avoid starving the h/w */
-                num_to_alloc = vmxnet3_cmd_ring_desc_avail(rq->rx_ring +
-                                                           ring_idx);
-                if (unlikely(num_to_alloc > VMXNET3_RX_ALLOC_THRESHOLD(rq,
-                                                        ring_idx, adapter))) {
-                        vmxnet3_rq_alloc_rx_buf(rq, ring_idx, num_to_alloc,
-                                                adapter);
-
-                        /* if needed, update the register */
-                        if (unlikely(rq->shared->updateRxProd)) {
-                                VMXNET3_WRITE_BAR0_REG(adapter,
-                                        rxprod_reg[ring_idx] + rq->qid * 8,
-                                        rq->rx_ring[ring_idx].next2fill);
-                                rq->uncommitted[ring_idx] = 0;
-                        }
+                /* device may have skipped some rx descs */
+                ring->next2comp = idx;
+                num_to_alloc = vmxnet3_cmd_ring_desc_avail(ring);
+                ring = rq->rx_ring + ring_idx;
+                while (num_to_alloc) {
+                        vmxnet3_getRxDesc(rxd, &ring->base[ring->next2fill].rxd,
+                                          &rxCmdDesc);
+                        BUG_ON(!rxd->addr);
+
+                        /* Recv desc is ready to be used by the device */
+                        rxd->gen = ring->gen;
+                        vmxnet3_cmd_ring_adv_next2fill(ring);
+                        num_to_alloc--;
+                }
+
+                /* if needed, update the register */
+                if (unlikely(rq->shared->updateRxProd)) {
+                        VMXNET3_WRITE_BAR0_REG(adapter,
+                                rxprod_reg[ring_idx] + rq->qid * 8,
+                                ring->next2fill);
+                        rq->uncommitted[ring_idx] = 0;
                 }
 
                 vmxnet3_comp_ring_adv_next2proc(&rq->comp_ring);
@@ -2894,6 +2947,7 @@ vmxnet3_probe_device(struct pci_dev *pdev,
         else
 #endif
                 num_rx_queues = 1;
+        num_rx_queues = rounddown_pow_of_two(num_rx_queues);
 
         if (enable_mq)
                 num_tx_queues = min(VMXNET3_DEVICE_MAX_TX_QUEUES,
@@ -2901,6 +2955,7 @@ vmxnet3_probe_device(struct pci_dev *pdev,
         else
                 num_tx_queues = 1;
 
+        num_tx_queues = rounddown_pow_of_two(num_tx_queues);
         netdev = alloc_etherdev_mq(sizeof(struct vmxnet3_adapter),
                                    max(num_tx_queues, num_rx_queues));
         printk(KERN_INFO "# of Tx queues : %d, # of Rx queues : %d\n",
@@ -3085,6 +3140,7 @@ vmxnet3_remove_device(struct pci_dev *pdev)
         else
 #endif
                 num_rx_queues = 1;
+        num_rx_queues = rounddown_pow_of_two(num_rx_queues);
 
         cancel_work_sync(&adapter->work);
 
diff --git a/drivers/net/vmxnet3/vmxnet3_int.h b/drivers/net/vmxnet3/vmxnet3_int.h
index f50d36fdf405..e08d75e3f170 100644
--- a/drivers/net/vmxnet3/vmxnet3_int.h
+++ b/drivers/net/vmxnet3/vmxnet3_int.h
@@ -55,6 +55,7 @@
 #include <linux/if_vlan.h>
 #include <linux/if_arp.h>
 #include <linux/inetdevice.h>
+#include <linux/log2.h>
 
 #include "vmxnet3_defs.h"
 
@@ -68,10 +69,10 @@
 /*
  * Version numbers
  */
-#define VMXNET3_DRIVER_VERSION_STRING   "1.1.9.0-k"
+#define VMXNET3_DRIVER_VERSION_STRING   "1.1.18.0-k"
 
 /* a 32-bit int, each byte encode a verion number in VMXNET3_DRIVER_VERSION */
-#define VMXNET3_DRIVER_VERSION_NUM      0x01010900
+#define VMXNET3_DRIVER_VERSION_NUM      0x01011200
 
 #if defined(CONFIG_PCI_MSI)
         /* RSS only makes sense if MSI-X is supported. */
diff --git a/drivers/net/wireless/ath/ath5k/eeprom.c b/drivers/net/wireless/ath/ath5k/eeprom.c
index 1fef84f87c78..392771f93759 100644
--- a/drivers/net/wireless/ath/ath5k/eeprom.c
+++ b/drivers/net/wireless/ath/ath5k/eeprom.c
@@ -691,14 +691,12 @@ ath5k_eeprom_free_pcal_info(struct ath5k_hw *ah, int mode)
                 if (!chinfo[pier].pd_curves)
                         continue;
 
-                for (pdg = 0; pdg < ee->ee_pd_gains[mode]; pdg++) {
+                for (pdg = 0; pdg < AR5K_EEPROM_N_PD_CURVES; pdg++) {
                         struct ath5k_pdgain_info *pd =
                                         &chinfo[pier].pd_curves[pdg];
 
-                        if (pd != NULL) {
-                                kfree(pd->pd_step);
-                                kfree(pd->pd_pwr);
-                        }
+                        kfree(pd->pd_step);
+                        kfree(pd->pd_pwr);
                 }
 
                 kfree(chinfo[pier].pd_curves);
diff --git a/drivers/net/wireless/ath/ath9k/pci.c b/drivers/net/wireless/ath/ath9k/pci.c
index b8cbfc707213..3bad0b2cf9a3 100644
--- a/drivers/net/wireless/ath/ath9k/pci.c
+++ b/drivers/net/wireless/ath/ath9k/pci.c
@@ -278,6 +278,12 @@ static int ath_pci_suspend(struct device *device)
 
         ath9k_hw_set_gpio(sc->sc_ah, sc->sc_ah->led_pin, 1);
 
+        /* The device has to be moved to FULLSLEEP forcibly.
+         * Otherwise the chip never moved to full sleep,
+         * when no interface is up.
+         */
+        ath9k_hw_setpower(sc->sc_ah, ATH9K_PM_FULL_SLEEP);
+
         return 0;
 }
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-1000.c b/drivers/net/wireless/iwlwifi/iwl-1000.c
index 61d4a11f566b..2a88e73bb39c 100644
--- a/drivers/net/wireless/iwlwifi/iwl-1000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-1000.c
@@ -36,6 +36,7 @@
 #include <net/mac80211.h>
 #include <linux/etherdevice.h>
 #include <asm/unaligned.h>
+#include <linux/stringify.h>
 
 #include "iwl-eeprom.h"
 #include "iwl-dev.h"
@@ -55,10 +56,10 @@
 #define IWL100_UCODE_API_MIN 5
 
 #define IWL1000_FW_PRE "iwlwifi-1000-"
-#define IWL1000_MODULE_FIRMWARE(api) IWL1000_FW_PRE #api ".ucode"
+#define IWL1000_MODULE_FIRMWARE(api) IWL1000_FW_PRE __stringify(api) ".ucode"
 
 #define IWL100_FW_PRE "iwlwifi-100-"
-#define IWL100_MODULE_FIRMWARE(api) IWL100_FW_PRE #api ".ucode"
+#define IWL100_MODULE_FIRMWARE(api) IWL100_FW_PRE __stringify(api) ".ucode"
 
 
 /*
diff --git a/drivers/net/wireless/iwlwifi/iwl-2000.c b/drivers/net/wireless/iwlwifi/iwl-2000.c
index 2282279cffc4..3df76f53a41b 100644
--- a/drivers/net/wireless/iwlwifi/iwl-2000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-2000.c
@@ -36,6 +36,7 @@
 #include <net/mac80211.h>
 #include <linux/etherdevice.h>
 #include <asm/unaligned.h>
+#include <linux/stringify.h>
 
 #include "iwl-eeprom.h"
 #include "iwl-dev.h"
@@ -58,13 +59,13 @@
 #define IWL105_UCODE_API_MIN 5
 
 #define IWL2030_FW_PRE "iwlwifi-2030-"
-#define IWL2030_MODULE_FIRMWARE(api) IWL2030_FW_PRE #api ".ucode"
+#define IWL2030_MODULE_FIRMWARE(api) IWL2030_FW_PRE __stringify(api) ".ucode"
 
 #define IWL2000_FW_PRE "iwlwifi-2000-"
-#define IWL2000_MODULE_FIRMWARE(api) IWL2000_FW_PRE #api ".ucode"
+#define IWL2000_MODULE_FIRMWARE(api) IWL2000_FW_PRE __stringify(api) ".ucode"
 
 #define IWL105_FW_PRE "iwlwifi-105-"
-#define IWL105_MODULE_FIRMWARE(api) IWL105_FW_PRE #api ".ucode"
+#define IWL105_MODULE_FIRMWARE(api) IWL105_FW_PRE __stringify(api) ".ucode"
 
 static void iwl2000_set_ct_threshold(struct iwl_priv *priv)
 {
diff --git a/drivers/net/wireless/iwlwifi/iwl-5000.c b/drivers/net/wireless/iwlwifi/iwl-5000.c
index f99f9c193352..e816c27db794 100644
--- a/drivers/net/wireless/iwlwifi/iwl-5000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-5000.c
@@ -37,6 +37,7 @@
 #include <net/mac80211.h>
 #include <linux/etherdevice.h>
 #include <asm/unaligned.h>
+#include <linux/stringify.h>
 
 #include "iwl-eeprom.h"
 #include "iwl-dev.h"
@@ -57,10 +58,10 @@
 #define IWL5150_UCODE_API_MIN 1
 
 #define IWL5000_FW_PRE "iwlwifi-5000-"
-#define IWL5000_MODULE_FIRMWARE(api) IWL5000_FW_PRE #api ".ucode"
+#define IWL5000_MODULE_FIRMWARE(api) IWL5000_FW_PRE __stringify(api) ".ucode"
 
 #define IWL5150_FW_PRE "iwlwifi-5150-"
-#define IWL5150_MODULE_FIRMWARE(api) IWL5150_FW_PRE #api ".ucode"
+#define IWL5150_MODULE_FIRMWARE(api) IWL5150_FW_PRE __stringify(api) ".ucode"
 
 /* NIC configuration for 5000 series */
 static void iwl5000_nic_config(struct iwl_priv *priv)
diff --git a/drivers/net/wireless/iwlwifi/iwl-6000.c b/drivers/net/wireless/iwlwifi/iwl-6000.c
index fbe565c816e3..5b150bc70b06 100644
--- a/drivers/net/wireless/iwlwifi/iwl-6000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-6000.c
@@ -36,6 +36,7 @@
 #include <net/mac80211.h>
 #include <linux/etherdevice.h>
 #include <asm/unaligned.h>
+#include <linux/stringify.h>
 
 #include "iwl-eeprom.h"
 #include "iwl-dev.h"
@@ -58,16 +59,16 @@
 #define IWL6000G2_UCODE_API_MIN 4
 
 #define IWL6000_FW_PRE "iwlwifi-6000-"
-#define IWL6000_MODULE_FIRMWARE(api) IWL6000_FW_PRE #api ".ucode"
+#define IWL6000_MODULE_FIRMWARE(api) IWL6000_FW_PRE __stringify(api) ".ucode"
 
 #define IWL6050_FW_PRE "iwlwifi-6050-"
-#define IWL6050_MODULE_FIRMWARE(api) IWL6050_FW_PRE #api ".ucode"
+#define IWL6050_MODULE_FIRMWARE(api) IWL6050_FW_PRE __stringify(api) ".ucode"
 
 #define IWL6005_FW_PRE "iwlwifi-6000g2a-"
-#define IWL6005_MODULE_FIRMWARE(api) IWL6005_FW_PRE #api ".ucode"
+#define IWL6005_MODULE_FIRMWARE(api) IWL6005_FW_PRE __stringify(api) ".ucode"
 
 #define IWL6030_FW_PRE "iwlwifi-6000g2b-"
-#define IWL6030_MODULE_FIRMWARE(api) IWL6030_FW_PRE #api ".ucode"
+#define IWL6030_MODULE_FIRMWARE(api) IWL6030_FW_PRE __stringify(api) ".ucode"
 
 static void iwl6000_set_ct_threshold(struct iwl_priv *priv)
 {
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.c b/drivers/net/wireless/iwlwifi/iwl-core.c
index 213c80c6a668..45cc51c9c93e 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.c
+++ b/drivers/net/wireless/iwlwifi/iwl-core.c
@@ -1763,6 +1763,7 @@ int iwl_mac_change_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
         struct iwl_rxon_context *ctx = iwl_rxon_ctx_from_vif(vif);
         struct iwl_rxon_context *bss_ctx = &priv->contexts[IWL_RXON_CTX_BSS];
         struct iwl_rxon_context *tmp;
+        enum nl80211_iftype newviftype = newtype;
         u32 interface_modes;
         int err;
 
@@ -1818,7 +1819,7 @@ int iwl_mac_change_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
 
         /* success */
         iwl_teardown_interface(priv, vif, true);
-        vif->type = newtype;
+        vif->type = newviftype;
         vif->p2p = newp2p;
         err = iwl_setup_interface(priv, ctx);
         WARN_ON(err);
diff --git a/drivers/net/wireless/iwlwifi/iwl-tx.c b/drivers/net/wireless/iwlwifi/iwl-tx.c
index 686e176b5ebd..137dba95b1ad 100644
--- a/drivers/net/wireless/iwlwifi/iwl-tx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-tx.c
@@ -126,7 +126,7 @@ static inline u8 iwl_tfd_get_num_tbs(struct iwl_tfd *tfd)
 }
 
 static void iwlagn_unmap_tfd(struct iwl_priv *priv, struct iwl_cmd_meta *meta,
-                             struct iwl_tfd *tfd)
+                             struct iwl_tfd *tfd, int dma_dir)
 {
         struct pci_dev *dev = priv->pci_dev;
         int i;
@@ -151,7 +151,7 @@ static void iwlagn_unmap_tfd(struct iwl_priv *priv, struct iwl_cmd_meta *meta,
         /* Unmap chunks, if any. */
         for (i = 1; i < num_tbs; i++)
                 pci_unmap_single(dev, iwl_tfd_tb_get_addr(tfd, i),
-                                iwl_tfd_tb_get_len(tfd, i), PCI_DMA_TODEVICE);
+                                iwl_tfd_tb_get_len(tfd, i), dma_dir);
 }
 
 /**
@@ -167,7 +167,8 @@ void iwlagn_txq_free_tfd(struct iwl_priv *priv, struct iwl_tx_queue *txq)
         struct iwl_tfd *tfd_tmp = txq->tfds;
         int index = txq->q.read_ptr;
 
-        iwlagn_unmap_tfd(priv, &txq->meta[index], &tfd_tmp[index]);
+        iwlagn_unmap_tfd(priv, &txq->meta[index], &tfd_tmp[index],
+                         PCI_DMA_TODEVICE);
 
         /* free SKB */
         if (txq->txb) {
@@ -310,9 +311,7 @@ void iwl_cmd_queue_unmap(struct iwl_priv *priv)
                 i = get_cmd_index(q, q->read_ptr);
 
                 if (txq->meta[i].flags & CMD_MAPPED) {
-                        pci_unmap_single(priv->pci_dev,
-                                         dma_unmap_addr(&txq->meta[i], mapping),
-                                         dma_unmap_len(&txq->meta[i], len),
+                        iwlagn_unmap_tfd(priv, &txq->meta[i], &txq->tfds[i],
                                          PCI_DMA_BIDIRECTIONAL);
                         txq->meta[i].flags = 0;
                 }
@@ -535,12 +534,7 @@ out_free_arrays:
 void iwl_tx_queue_reset(struct iwl_priv *priv, struct iwl_tx_queue *txq,
                         int slots_num, u32 txq_id)
 {
-        int actual_slots = slots_num;
-
-        if (txq_id == priv->cmd_queue)
-                actual_slots++;
-
-        memset(txq->meta, 0, sizeof(struct iwl_cmd_meta) * actual_slots);
+        memset(txq->meta, 0, sizeof(struct iwl_cmd_meta) * slots_num);
 
         txq->need_update = 0;
 
@@ -700,10 +694,11 @@ int iwl_enqueue_hcmd(struct iwl_priv *priv, struct iwl_host_cmd *cmd)
                 if (!(cmd->dataflags[i] & IWL_HCMD_DFL_NOCOPY))
                         continue;
                 phys_addr = pci_map_single(priv->pci_dev, (void *)cmd->data[i],
-                                           cmd->len[i], PCI_DMA_TODEVICE);
+                                           cmd->len[i], PCI_DMA_BIDIRECTIONAL);
                 if (pci_dma_mapping_error(priv->pci_dev, phys_addr)) {
                         iwlagn_unmap_tfd(priv, out_meta,
-                                         &txq->tfds[q->write_ptr]);
+                                         &txq->tfds[q->write_ptr],
+                                         PCI_DMA_BIDIRECTIONAL);
                         idx = -ENOMEM;
                         goto out;
                 }
@@ -807,7 +802,7 @@ void iwl_tx_cmd_complete(struct iwl_priv *priv, struct iwl_rx_mem_buffer *rxb)
         cmd = txq->cmd[cmd_index];
         meta = &txq->meta[cmd_index];
 
-        iwlagn_unmap_tfd(priv, meta, &txq->tfds[index]);
+        iwlagn_unmap_tfd(priv, meta, &txq->tfds[index], PCI_DMA_BIDIRECTIONAL);
 
         /* Input error checking is done when commands are added to queue. */
         if (meta->flags & CMD_WANT_SKB) {
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 0589f554788a..396e8fc8910e 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -2688,7 +2688,7 @@ void cfg80211_send_unprot_disassoc(struct net_device *dev, const u8 *buf,
  * @dev: network device
  * @addr: The source MAC address of the frame
  * @key_type: The key type that the received frame used
- * @key_id: Key identifier (0..3)
+ * @key_id: Key identifier (0..3). Can be -1 if missing.
  * @tsc: The TSC value of the frame that generated the MIC failure (6 octets)
  * @gfp: allocation flags
  *
diff --git a/include/net/dst.h b/include/net/dst.h
index 7d15d238b6ec..e12ddfb9eb16 100644
--- a/include/net/dst.h
+++ b/include/net/dst.h
@@ -77,6 +77,7 @@ struct dst_entry {
 #define DST_NOPOLICY            0x0004
 #define DST_NOHASH              0x0008
 #define DST_NOCACHE             0x0010
+#define DST_NOCOUNT             0x0020
         union {
                 struct dst_entry        *next;
                 struct rtable __rcu     *rt_next;
diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
index 7ea5cf9ea08a..86bff9b1ac47 100644
--- a/net/8021q/vlan_dev.c
+++ b/net/8021q/vlan_dev.c
@@ -586,9 +586,14 @@ static void vlan_dev_uninit(struct net_device *dev)
 static u32 vlan_dev_fix_features(struct net_device *dev, u32 features)
 {
         struct net_device *real_dev = vlan_dev_info(dev)->real_dev;
+        u32 old_features = features;
 
         features &= real_dev->features;
         features &= real_dev->vlan_features;
+
+        if (old_features & NETIF_F_SOFT_FEATURES)
+                features |= old_features & NETIF_F_SOFT_FEATURES;
+
         if (dev_ethtool_get_rx_csum(real_dev))
                 features |= NETIF_F_RXCSUM;
         features |= NETIF_F_LLTX;
diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
index c188c803c09c..32b8f9f7f79e 100644
--- a/net/bridge/br_device.c
+++ b/net/bridge/br_device.c
@@ -49,7 +49,9 @@ netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev)
         skb_pull(skb, ETH_HLEN);
 
         rcu_read_lock();
-        if (is_multicast_ether_addr(dest)) {
+        if (is_broadcast_ether_addr(dest))
+                br_flood_deliver(br, skb);
+        else if (is_multicast_ether_addr(dest)) {
                 if (unlikely(netpoll_tx_running(dev))) {
                         br_flood_deliver(br, skb);
                         goto out;
diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c
index f3ac1e858ee1..f06ee39c73fd 100644
--- a/net/bridge/br_input.c
+++ b/net/bridge/br_input.c
@@ -60,7 +60,7 @@ int br_handle_frame_finish(struct sk_buff *skb)
         br = p->br;
         br_fdb_update(br, p, eth_hdr(skb)->h_source);
 
-        if (is_multicast_ether_addr(dest) &&
+        if (!is_broadcast_ether_addr(dest) && is_multicast_ether_addr(dest) &&
             br_multicast_rcv(br, p, skb))
                 goto drop;
 
@@ -77,7 +77,9 @@ int br_handle_frame_finish(struct sk_buff *skb)
 
         dst = NULL;
 
-        if (is_multicast_ether_addr(dest)) {
+        if (is_broadcast_ether_addr(dest))
+                skb2 = skb;
+        else if (is_multicast_ether_addr(dest)) {
                 mdst = br_mdb_get(br, skb);
                 if (mdst || BR_INPUT_SKB_CB_MROUTERS_ONLY(skb)) {
                         if ((mdst && mdst->mglist) ||
diff --git a/net/core/dst.c b/net/core/dst.c
index 9ccca038444f..6135f3671692 100644
--- a/net/core/dst.c
+++ b/net/core/dst.c
@@ -190,7 +190,8 @@ void *dst_alloc(struct dst_ops *ops, struct net_device *dev,
         dst->lastuse = jiffies;
         dst->flags = flags;
         dst->next = NULL;
-        dst_entries_add(ops, 1);
+        if (!(flags & DST_NOCOUNT))
+                dst_entries_add(ops, 1);
         return dst;
 }
 EXPORT_SYMBOL(dst_alloc);
@@ -243,7 +244,8 @@ again:
                 neigh_release(neigh);
         }
 
-        dst_entries_add(dst->ops, -1);
+        if (!(dst->flags & DST_NOCOUNT))
+                dst_entries_add(dst->ops, -1);
 
         if (dst->ops->destroy)
                 dst->ops->destroy(dst);
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index eae1f676f870..ef1528af7abf 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -465,8 +465,10 @@ int inet_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
         if (addr_len < sizeof(struct sockaddr_in))
                 goto out;
 
-        if (addr->sin_family != AF_INET)
+        if (addr->sin_family != AF_INET) {
+                err = -EAFNOSUPPORT;
                 goto out;
+        }
 
         chk_addr_ret = inet_addr_type(sock_net(sk), addr->sin_addr.s_addr);
 
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 4a7e16b5d3f3..84f26e8e6c60 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -828,7 +828,7 @@ static int __ip_append_data(struct sock *sk,
         cork->length += length;
         if (((length > mtu) || (skb && skb_is_gso(skb))) &&
             (sk->sk_protocol == IPPROTO_UDP) &&
-            (rt->dst.dev->features & NETIF_F_UFO)) {
+            (rt->dst.dev->features & NETIF_F_UFO) && !rt->dst.header_len) {
                 err = ip_ufo_append_data(sk, queue, getfrag, from, length,
                                          hh_len, fragheaderlen, transhdrlen,
                                          mtu, flags);
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 054a59d21eb0..46febcacb729 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -3220,7 +3220,7 @@ __setup("thash_entries=", set_thash_entries);
 void __init tcp_init(void)
 {
         struct sk_buff *skb = NULL;
-        unsigned long nr_pages, limit;
+        unsigned long limit;
         int i, max_share, cnt;
         unsigned long jiffy = jiffies;
 
@@ -3277,13 +3277,7 @@ void __init tcp_init(void)
         sysctl_tcp_max_orphans = cnt / 2;
         sysctl_max_syn_backlog = max(128, cnt / 256);
 
-        /* Set the pressure threshold to be a fraction of global memory that
-         * is up to 1/2 at 256 MB, decreasing toward zero with the amount of
-         * memory, with a floor of 128 pages.
-         */
-        nr_pages = totalram_pages - totalhigh_pages;
-        limit = min(nr_pages, 1UL<<(28-PAGE_SHIFT)) >> (20-PAGE_SHIFT);
-        limit = (limit * (nr_pages >> (20-PAGE_SHIFT))) >> (PAGE_SHIFT-11);
+        limit = nr_free_buffer_pages() / 8;
         limit = max(limit, 128UL);
         sysctl_tcp_mem[0] = limit / 4 * 3;
         sysctl_tcp_mem[1] = limit;
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 48cd88e62553..198f75b7bdd3 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -2209,16 +2209,10 @@ void __init udp_table_init(struct udp_table *table, const char *name)
 
 void __init udp_init(void)
 {
-        unsigned long nr_pages, limit;
+        unsigned long limit;
 
         udp_table_init(&udp_table, "UDP");
-        /* Set the pressure threshold up by the same strategy of TCP. It is a
-         * fraction of global memory that is up to 1/2 at 256 MB, decreasing
-         * toward zero with the amount of memory, with a floor of 128 pages.
-         */
-        nr_pages = totalram_pages - totalhigh_pages;
-        limit = min(nr_pages, 1UL<<(28-PAGE_SHIFT)) >> (20-PAGE_SHIFT);
-        limit = (limit * (nr_pages >> (20-PAGE_SHIFT))) >> (PAGE_SHIFT-11);
+        limit = nr_free_buffer_pages() / 8;
         limit = max(limit, 128UL);
         sysctl_udp_mem[0] = limit / 4 * 3;
         sysctl_udp_mem[1] = limit;
diff --git a/net/ipv4/xfrm4_output.c b/net/ipv4/xfrm4_output.c
index 2d51840e53a1..327a617d594c 100644
--- a/net/ipv4/xfrm4_output.c
+++ b/net/ipv4/xfrm4_output.c
@@ -32,7 +32,12 @@ static int xfrm4_tunnel_check_size(struct sk_buff *skb)
         dst = skb_dst(skb);
         mtu = dst_mtu(dst);
         if (skb->len > mtu) {
-                icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED, htonl(mtu));
+                if (skb->sk)
+                        ip_local_error(skb->sk, EMSGSIZE, ip_hdr(skb)->daddr,
+                                       inet_sk(skb->sk)->inet_dport, mtu);
+                else
+                        icmp_send(skb, ICMP_DEST_UNREACH,
+                                  ICMP_FRAG_NEEDED, htonl(mtu));
                 ret = -EMSGSIZE;
         }
 out:
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index d450a2f9fc06..3b5669a2582d 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -274,7 +274,7 @@ int inet6_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
                 return -EINVAL;
 
         if (addr->sin6_family != AF_INET6)
-                return -EINVAL;
+                return -EAFNOSUPPORT;
 
         addr_type = ipv6_addr_type(&addr->sin6_addr);
         if ((addr_type & IPV6_ADDR_MULTICAST) && sock->type == SOCK_STREAM)
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index de2b1decd786..0ef1f086feb8 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -228,9 +228,10 @@ static struct rt6_info ip6_blk_hole_entry_template = {
 
 /* allocate dst with ip6_dst_ops */
 static inline struct rt6_info *ip6_dst_alloc(struct dst_ops *ops,
-                                             struct net_device *dev)
+                                             struct net_device *dev,
+                                             int flags)
 {
-        struct rt6_info *rt = dst_alloc(ops, dev, 0, 0, 0);
+        struct rt6_info *rt = dst_alloc(ops, dev, 0, 0, flags);
 
         memset(&rt->rt6i_table, 0, sizeof(*rt) - sizeof(struct dst_entry));
 
@@ -1042,7 +1043,7 @@ struct dst_entry *icmp6_dst_alloc(struct net_device *dev,
         if (unlikely(idev == NULL))
                 return NULL;
 
-        rt = ip6_dst_alloc(&net->ipv6.ip6_dst_ops, dev);
+        rt = ip6_dst_alloc(&net->ipv6.ip6_dst_ops, dev, 0);
         if (unlikely(rt == NULL)) {
                 in6_dev_put(idev);
                 goto out;
@@ -1062,14 +1063,6 @@ struct dst_entry *icmp6_dst_alloc(struct net_device *dev,
         dst_metric_set(&rt->dst, RTAX_HOPLIMIT, 255);
         rt->dst.output  = ip6_output;
 
-#if 0   /* there's no chance to use these for ndisc */
-        rt->dst.flags   = ipv6_addr_type(addr) & IPV6_ADDR_UNICAST
-                                ? DST_HOST
-                                : 0;
-        ipv6_addr_copy(&rt->rt6i_dst.addr, addr);
-        rt->rt6i_dst.plen = 128;
-#endif
-
         spin_lock_bh(&icmp6_dst_lock);
         rt->dst.next = icmp6_dst_gc_list;
         icmp6_dst_gc_list = &rt->dst;
@@ -1214,7 +1207,7 @@ int ip6_route_add(struct fib6_config *cfg)
                 goto out;
         }
 
-        rt = ip6_dst_alloc(&net->ipv6.ip6_dst_ops, NULL);
+        rt = ip6_dst_alloc(&net->ipv6.ip6_dst_ops, NULL, DST_NOCOUNT);
 
         if (rt == NULL) {
                 err = -ENOMEM;
@@ -1244,7 +1237,7 @@ int ip6_route_add(struct fib6_config *cfg)
         ipv6_addr_prefix(&rt->rt6i_dst.addr, &cfg->fc_dst, cfg->fc_dst_len);
         rt->rt6i_dst.plen = cfg->fc_dst_len;
         if (rt->rt6i_dst.plen == 128)
-               rt->dst.flags = DST_HOST;
+               rt->dst.flags |= DST_HOST;
 
 #ifdef CONFIG_IPV6_SUBTREES
         ipv6_addr_prefix(&rt->rt6i_src.addr, &cfg->fc_src, cfg->fc_src_len);
@@ -1734,7 +1727,7 @@ static struct rt6_info * ip6_rt_copy(struct rt6_info *ort)
 {
         struct net *net = dev_net(ort->rt6i_dev);
         struct rt6_info *rt = ip6_dst_alloc(&net->ipv6.ip6_dst_ops,
-                                            ort->dst.dev);
+                                            ort->dst.dev, 0);
 
         if (rt) {
                 rt->dst.input = ort->dst.input;
@@ -2013,7 +2006,7 @@ struct rt6_info *addrconf_dst_alloc(struct inet6_dev *idev,
 {
         struct net *net = dev_net(idev->dev);
         struct rt6_info *rt = ip6_dst_alloc(&net->ipv6.ip6_dst_ops,
-                                            net->loopback_dev);
+                                            net->loopback_dev, 0);
         struct neighbour *neigh;
 
         if (rt == NULL) {
@@ -2025,7 +2018,7 @@ struct rt6_info *addrconf_dst_alloc(struct inet6_dev *idev,
 
         in6_dev_hold(idev);
 
-        rt->dst.flags = DST_HOST;
+        rt->dst.flags |= DST_HOST;
         rt->dst.input = ip6_input;
         rt->dst.output = ip6_output;
         rt->rt6i_idev = idev;
diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c
index 9dc3b5f26e80..d91c1a26630d 100644
--- a/net/mac80211/wpa.c
+++ b/net/mac80211/wpa.c
@@ -154,7 +154,13 @@ update_iv:
         return RX_CONTINUE;
 
 mic_fail:
-        mac80211_ev_michael_mic_failure(rx->sdata, rx->key->conf.keyidx,
+        /*
+         * In some cases the key can be unset - e.g. a multicast packet, in
+         * a driver that supports HW encryption. Send up the key idx only if
+         * the key is set.
+         */
+        mac80211_ev_michael_mic_failure(rx->sdata,
+                                        rx->key ? rx->key->conf.keyidx : -1,
                                         (void *) skb->data, NULL, GFP_ATOMIC);
         return RX_DROP_UNUSABLE;
 }
diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
index 67380a29e2e9..207175b2f40a 100644
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -1058,7 +1058,6 @@ SCTP_STATIC __init int sctp_init(void)
         int status = -EINVAL;
         unsigned long goal;
         unsigned long limit;
-        unsigned long nr_pages;
         int max_share;
         int order;
 
@@ -1148,15 +1147,7 @@ SCTP_STATIC __init int sctp_init(void)
         /* Initialize handle used for association ids. */
         idr_init(&sctp_assocs_id);
 
-        /* Set the pressure threshold to be a fraction of global memory that
-         * is up to 1/2 at 256 MB, decreasing toward zero with the amount of
-         * memory, with a floor of 128 pages.
-         * Note this initializes the data in sctpv6_prot too
-         * Unabashedly stolen from tcp_init
-         */
-        nr_pages = totalram_pages - totalhigh_pages;
-        limit = min(nr_pages, 1UL<<(28-PAGE_SHIFT)) >> (20-PAGE_SHIFT);
-        limit = (limit * (nr_pages >> (20-PAGE_SHIFT))) >> (PAGE_SHIFT-11);
+        limit = nr_free_buffer_pages() / 8;
         limit = max(limit, 128UL);
         sysctl_sctp_mem[0] = limit / 4 * 3;
         sysctl_sctp_mem[1] = limit;
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 6766913a53e6..08c6238802de 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -2073,10 +2073,33 @@ static int sctp_setsockopt_disable_fragments(struct sock *sk,
 static int sctp_setsockopt_events(struct sock *sk, char __user *optval,
                                   unsigned int optlen)
 {
+        struct sctp_association *asoc;
+        struct sctp_ulpevent *event;
+
         if (optlen > sizeof(struct sctp_event_subscribe))
                 return -EINVAL;
         if (copy_from_user(&sctp_sk(sk)->subscribe, optval, optlen))
                 return -EFAULT;
+
+        /*
+         * At the time when a user app subscribes to SCTP_SENDER_DRY_EVENT,
+         * if there is no data to be sent or retransmit, the stack will
+         * immediately send up this notification.
+         */
+        if (sctp_ulpevent_type_enabled(SCTP_SENDER_DRY_EVENT,
+                                       &sctp_sk(sk)->subscribe)) {
+                asoc = sctp_id2assoc(sk, 0);
+
+                if (asoc && sctp_outq_is_empty(&asoc->outqueue)) {
+                        event = sctp_ulpevent_make_sender_dry_event(asoc,
+                                        GFP_ATOMIC);
+                        if (!event)
+                                return -ENOMEM;
+
+                        sctp_ulpq_tail_event(&asoc->ulpq, event);
+                }
+        }
+
         return 0;
 }
 
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 98fa8eb6cc4b..f07602d7bf68 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -6463,7 +6463,8 @@ void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
         if (addr)
                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
         NLA_PUT_U32(msg, NL80211_ATTR_KEY_TYPE, key_type);
-        NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_id);
+        if (key_id != -1)
+                NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_id);
         if (tsc)
                 NLA_PUT(msg, NL80211_ATTR_KEY_SEQ, 6, tsc);
 
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 9bec2e8a838c..5ce74a385525 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -50,7 +50,7 @@ static struct xfrm_policy_afinfo *xfrm_policy_get_afinfo(unsigned short family);
 static void xfrm_policy_put_afinfo(struct xfrm_policy_afinfo *afinfo);
 static void xfrm_init_pmtu(struct dst_entry *dst);
 static int stale_bundle(struct dst_entry *dst);
-static int xfrm_bundle_ok(struct xfrm_dst *xdst, int family);
+static int xfrm_bundle_ok(struct xfrm_dst *xdst);
 
 
 static struct xfrm_policy *__xfrm_policy_unlink(struct xfrm_policy *pol,
@@ -2241,7 +2241,7 @@ static struct dst_entry *xfrm_dst_check(struct dst_entry *dst, u32 cookie)
 
 static int stale_bundle(struct dst_entry *dst)
 {
-        return !xfrm_bundle_ok((struct xfrm_dst *)dst, AF_UNSPEC);
+        return !xfrm_bundle_ok((struct xfrm_dst *)dst);
 }
 
 void xfrm_dst_ifdown(struct dst_entry *dst, struct net_device *dev)
@@ -2313,7 +2313,7 @@ static void xfrm_init_pmtu(struct dst_entry *dst)
  * still valid.
  */
 
-static int xfrm_bundle_ok(struct xfrm_dst *first, int family)
+static int xfrm_bundle_ok(struct xfrm_dst *first)
 {
         struct dst_entry *dst = &first->u.dst;
         struct xfrm_dst *last;