69 files changed, 520 insertions, 347 deletions

diff --git a/MAINTAINERS b/MAINTAINERS
index 2c4326c0de9a..557d4dcc2c2c 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -904,7 +904,7 @@ F:	drivers/input/misc/ati_remote2.c
 
 ATLX ETHERNET DRIVERS
 M:      Jay Cliburn <jcliburn@gmail.com>
-M:      Chris Snook <csnook@redhat.com>
+M:      Chris Snook <chris.snook@gmail.com>
 M:      Jie Yang <jie.yang@atheros.com>
 L:      atl1-devel@lists.sourceforge.net
 W:      http://sourceforge.net/projects/atl1
@@ -3563,6 +3563,9 @@ T:	git git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6.git
 S:      Maintained
 F:      net/
 F:      include/net/
+F:      include/linux/in.h
+F:      include/linux/net.h
+F:      include/linux/netdevice.h
 
 NETWORKING [IPv4/IPv6]
 M:      "David S. Miller" <davem@davemloft.net>
@@ -3598,6 +3601,8 @@ W:	http://www.linuxfoundation.org/en/Net
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6.git
 S:      Odd Fixes
 F:      drivers/net/
+F:      include/linux/if_*
+F:      include/linux/*device.h
 
 NETXEN (1/10) GbE SUPPORT
 M:      Dhananjay Phadke <dhananjay@netxen.com>
diff --git a/drivers/net/3c59x.c b/drivers/net/3c59x.c
index c20416850948..45675889850b 100644
--- a/drivers/net/3c59x.c
+++ b/drivers/net/3c59x.c
@@ -235,6 +235,7 @@ enum vortex_chips {
         CH_3C900B_FL,
         CH_3C905_1,
         CH_3C905_2,
+        CH_3C905B_TX,
         CH_3C905B_1,
 
         CH_3C905B_2,
@@ -307,6 +308,8 @@ static struct vortex_chip_info {
          PCI_USES_MASTER, IS_BOOMERANG|HAS_MII|EEPROM_RESET, 64, },
         {"3c905 Boomerang 100baseT4",
          PCI_USES_MASTER, IS_BOOMERANG|HAS_MII|EEPROM_RESET, 64, },
+        {"3C905B-TX Fast Etherlink XL PCI",
+         PCI_USES_MASTER, IS_CYCLONE|HAS_NWAY|HAS_HWCKSM|EXTRA_PREAMBLE, 128, },
         {"3c905B Cyclone 100baseTx",
          PCI_USES_MASTER, IS_CYCLONE|HAS_NWAY|HAS_HWCKSM|EXTRA_PREAMBLE, 128, },
 
@@ -389,6 +392,7 @@ static struct pci_device_id vortex_pci_tbl[] = {
         { 0x10B7, 0x900A, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CH_3C900B_FL },
         { 0x10B7, 0x9050, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CH_3C905_1 },
         { 0x10B7, 0x9051, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CH_3C905_2 },
+        { 0x10B7, 0x9054, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CH_3C905B_TX },
         { 0x10B7, 0x9055, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CH_3C905B_1 },
 
         { 0x10B7, 0x9058, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CH_3C905B_2 },
diff --git a/drivers/net/8139cp.c b/drivers/net/8139cp.c
index 50efde11ea6c..d0dbbf39349a 100644
--- a/drivers/net/8139cp.c
+++ b/drivers/net/8139cp.c
@@ -515,7 +515,7 @@ rx_status_loop:
                 dma_addr_t mapping;
                 struct sk_buff *skb, *new_skb;
                 struct cp_desc *desc;
-                unsigned buflen;
+                const unsigned buflen = cp->rx_buf_sz;
 
                 skb = cp->rx_skb[rx_tail];
                 BUG_ON(!skb);
@@ -549,8 +549,7 @@ rx_status_loop:
                         pr_debug("%s: rx slot %d status 0x%x len %d\n",
                                dev->name, rx_tail, status, len);
 
-                buflen = cp->rx_buf_sz + NET_IP_ALIGN;
-                new_skb = netdev_alloc_skb(dev, buflen);
+                new_skb = netdev_alloc_skb(dev, buflen + NET_IP_ALIGN);
                 if (!new_skb) {
                         dev->stats.rx_dropped++;
                         goto rx_next;
diff --git a/drivers/net/atl1c/atl1c_ethtool.c b/drivers/net/atl1c/atl1c_ethtool.c
index 607007d75b6f..00d11b480af3 100644
--- a/drivers/net/atl1c/atl1c_ethtool.c
+++ b/drivers/net/atl1c/atl1c_ethtool.c
@@ -232,11 +232,11 @@ static void atl1c_get_drvinfo(struct net_device *netdev,
 {
         struct atl1c_adapter *adapter = netdev_priv(netdev);
 
-        strncpy(drvinfo->driver,  atl1c_driver_name, sizeof(drvinfo->driver));
-        strncpy(drvinfo->version, atl1c_driver_version,
+        strlcpy(drvinfo->driver,  atl1c_driver_name, sizeof(drvinfo->driver));
+        strlcpy(drvinfo->version, atl1c_driver_version,
                 sizeof(drvinfo->version));
-        strncpy(drvinfo->fw_version, "N/A", sizeof(drvinfo->fw_version));
-        strncpy(drvinfo->bus_info, pci_name(adapter->pdev),
+        strlcpy(drvinfo->fw_version, "N/A", sizeof(drvinfo->fw_version));
+        strlcpy(drvinfo->bus_info, pci_name(adapter->pdev),
                 sizeof(drvinfo->bus_info));
         drvinfo->n_stats = 0;
         drvinfo->testinfo_len = 0;
diff --git a/drivers/net/atlx/atl1.c b/drivers/net/atlx/atl1.c
index 94d7325caf4f..8bca12f71390 100644
--- a/drivers/net/atlx/atl1.c
+++ b/drivers/net/atlx/atl1.c
@@ -3378,11 +3378,11 @@ static void atl1_get_drvinfo(struct net_device *netdev,
 {
         struct atl1_adapter *adapter = netdev_priv(netdev);
 
-        strncpy(drvinfo->driver, ATLX_DRIVER_NAME, sizeof(drvinfo->driver));
-        strncpy(drvinfo->version, ATLX_DRIVER_VERSION,
+        strlcpy(drvinfo->driver, ATLX_DRIVER_NAME, sizeof(drvinfo->driver));
+        strlcpy(drvinfo->version, ATLX_DRIVER_VERSION,
                 sizeof(drvinfo->version));
-        strncpy(drvinfo->fw_version, "N/A", sizeof(drvinfo->fw_version));
-        strncpy(drvinfo->bus_info, pci_name(adapter->pdev),
+        strlcpy(drvinfo->fw_version, "N/A", sizeof(drvinfo->fw_version));
+        strlcpy(drvinfo->bus_info, pci_name(adapter->pdev),
                 sizeof(drvinfo->bus_info));
         drvinfo->eedump_len = ATL1_EEDUMP_LEN;
 }
diff --git a/drivers/net/b44.c b/drivers/net/b44.c
index 36d4d377ec2f..bafca672ea7d 100644
--- a/drivers/net/b44.c
+++ b/drivers/net/b44.c
@@ -952,9 +952,10 @@ static int b44_start_xmit(struct sk_buff *skb, struct net_device *dev)
         int rc = NETDEV_TX_OK;
         dma_addr_t mapping;
         u32 len, entry, ctrl;
+        unsigned long flags;
 
         len = skb->len;
-        spin_lock_irq(&bp->lock);
+        spin_lock_irqsave(&bp->lock, flags);
 
         /* This is a hard error, log it. */
         if (unlikely(TX_BUFFS_AVAIL(bp) < 1)) {
@@ -1027,7 +1028,7 @@ static int b44_start_xmit(struct sk_buff *skb, struct net_device *dev)
         dev->trans_start = jiffies;
 
 out_unlock:
-        spin_unlock_irq(&bp->lock);
+        spin_unlock_irqrestore(&bp->lock, flags);
 
         return rc;
 
diff --git a/drivers/net/bnx2.c b/drivers/net/bnx2.c
index b70cc99962fc..06b901152d44 100644
--- a/drivers/net/bnx2.c
+++ b/drivers/net/bnx2.c
@@ -399,9 +399,11 @@ static int bnx2_unregister_cnic(struct net_device *dev)
         struct bnx2_napi *bnapi = &bp->bnx2_napi[0];
         struct cnic_eth_dev *cp = &bp->cnic_eth_dev;
 
+        mutex_lock(&bp->cnic_lock);
         cp->drv_state = 0;
         bnapi->cnic_present = 0;
         rcu_assign_pointer(bp->cnic_ops, NULL);
+        mutex_unlock(&bp->cnic_lock);
         synchronize_rcu();
         return 0;
 }
@@ -429,13 +431,13 @@ bnx2_cnic_stop(struct bnx2 *bp)
         struct cnic_ops *c_ops;
         struct cnic_ctl_info info;
 
-        rcu_read_lock();
-        c_ops = rcu_dereference(bp->cnic_ops);
+        mutex_lock(&bp->cnic_lock);
+        c_ops = bp->cnic_ops;
         if (c_ops) {
                 info.cmd = CNIC_CTL_STOP_CMD;
                 c_ops->cnic_ctl(bp->cnic_data, &info);
         }
-        rcu_read_unlock();
+        mutex_unlock(&bp->cnic_lock);
 }
 
 static void
@@ -444,8 +446,8 @@ bnx2_cnic_start(struct bnx2 *bp)
         struct cnic_ops *c_ops;
         struct cnic_ctl_info info;
 
-        rcu_read_lock();
-        c_ops = rcu_dereference(bp->cnic_ops);
+        mutex_lock(&bp->cnic_lock);
+        c_ops = bp->cnic_ops;
         if (c_ops) {
                 if (!(bp->flags & BNX2_FLAG_USING_MSIX)) {
                         struct bnx2_napi *bnapi = &bp->bnx2_napi[0];
@@ -455,7 +457,7 @@ bnx2_cnic_start(struct bnx2 *bp)
                 info.cmd = CNIC_CTL_START_CMD;
                 c_ops->cnic_ctl(bp->cnic_data, &info);
         }
-        rcu_read_unlock();
+        mutex_unlock(&bp->cnic_lock);
 }
 
 #else
@@ -7663,6 +7665,9 @@ bnx2_init_board(struct pci_dev *pdev, struct net_device *dev)
 
         spin_lock_init(&bp->phy_lock);
         spin_lock_init(&bp->indirect_lock);
+#ifdef BCM_CNIC
+        mutex_init(&bp->cnic_lock);
+#endif
         INIT_WORK(&bp->reset_task, bnx2_reset_task);
 
         dev->base_addr = dev->mem_start = pci_resource_start(pdev, 0);
diff --git a/drivers/net/bnx2.h b/drivers/net/bnx2.h
index f1edfaa9e56a..a4f12fd0ecd2 100644
--- a/drivers/net/bnx2.h
+++ b/drivers/net/bnx2.h
@@ -6902,6 +6902,7 @@ struct bnx2 {
         u32                     idle_chk_status_idx;
 
 #ifdef BCM_CNIC
+        struct mutex            cnic_lock;
         struct cnic_eth_dev     cnic_eth_dev;
 #endif
 
diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
index 9e4283aff828..e1a4f8214239 100644
--- a/drivers/net/can/dev.c
+++ b/drivers/net/can/dev.c
@@ -611,11 +611,18 @@ nla_put_failure:
         return -EMSGSIZE;
 }
 
+static int can_newlink(struct net_device *dev,
+                       struct nlattr *tb[], struct nlattr *data[])
+{
+        return -EOPNOTSUPP;
+}
+
 static struct rtnl_link_ops can_link_ops __read_mostly = {
         .kind           = "can",
         .maxtype        = IFLA_CAN_MAX,
         .policy         = can_policy,
         .setup          = can_setup,
+        .newlink        = can_newlink,
         .changelink     = can_changelink,
         .fill_info      = can_fill_info,
         .fill_xstats    = can_fill_xstats,
diff --git a/drivers/net/cnic.c b/drivers/net/cnic.c
index 4869d77cbe91..74c342959b7b 100644
--- a/drivers/net/cnic.c
+++ b/drivers/net/cnic.c
@@ -138,6 +138,16 @@ static struct cnic_dev *cnic_from_netdev(struct net_device *netdev)
         return NULL;
 }
 
+static inline void ulp_get(struct cnic_ulp_ops *ulp_ops)
+{
+        atomic_inc(&ulp_ops->ref_count);
+}
+
+static inline void ulp_put(struct cnic_ulp_ops *ulp_ops)
+{
+        atomic_dec(&ulp_ops->ref_count);
+}
+
 static void cnic_ctx_wr(struct cnic_dev *dev, u32 cid_addr, u32 off, u32 val)
 {
         struct cnic_local *cp = dev->cnic_priv;
@@ -358,6 +368,7 @@ int cnic_register_driver(int ulp_type, struct cnic_ulp_ops *ulp_ops)
         }
         read_unlock(&cnic_dev_lock);
 
+        atomic_set(&ulp_ops->ref_count, 0);
         rcu_assign_pointer(cnic_ulp_tbl[ulp_type], ulp_ops);
         mutex_unlock(&cnic_lock);
 
@@ -379,6 +390,8 @@ int cnic_register_driver(int ulp_type, struct cnic_ulp_ops *ulp_ops)
 int cnic_unregister_driver(int ulp_type)
 {
         struct cnic_dev *dev;
+        struct cnic_ulp_ops *ulp_ops;
+        int i = 0;
 
         if (ulp_type >= MAX_CNIC_ULP_TYPE) {
                 printk(KERN_ERR PFX "cnic_unregister_driver: Bad type %d\n",
@@ -386,7 +399,8 @@ int cnic_unregister_driver(int ulp_type)
                 return -EINVAL;
         }
         mutex_lock(&cnic_lock);
-        if (!cnic_ulp_tbl[ulp_type]) {
+        ulp_ops = cnic_ulp_tbl[ulp_type];
+        if (!ulp_ops) {
                 printk(KERN_ERR PFX "cnic_unregister_driver: Type %d has not "
                                     "been registered\n", ulp_type);
                 goto out_unlock;
@@ -411,6 +425,14 @@ int cnic_unregister_driver(int ulp_type)
 
         mutex_unlock(&cnic_lock);
         synchronize_rcu();
+        while ((atomic_read(&ulp_ops->ref_count) != 0) && (i < 20)) {
+                msleep(100);
+                i++;
+        }
+
+        if (atomic_read(&ulp_ops->ref_count) != 0)
+                printk(KERN_WARNING PFX "%s: Failed waiting for ref count to go"
+                                        " to zero.\n", dev->netdev->name);
         return 0;
 
 out_unlock:
@@ -466,6 +488,7 @@ EXPORT_SYMBOL(cnic_register_driver);
 static int cnic_unregister_device(struct cnic_dev *dev, int ulp_type)
 {
         struct cnic_local *cp = dev->cnic_priv;
+        int i = 0;
 
         if (ulp_type >= MAX_CNIC_ULP_TYPE) {
                 printk(KERN_ERR PFX "cnic_unregister_device: Bad type %d\n",
@@ -486,6 +509,15 @@ static int cnic_unregister_device(struct cnic_dev *dev, int ulp_type)
 
         synchronize_rcu();
 
+        while (test_bit(ULP_F_CALL_PENDING, &cp->ulp_flags[ulp_type]) &&
+               i < 20) {
+                msleep(100);
+                i++;
+        }
+        if (test_bit(ULP_F_CALL_PENDING, &cp->ulp_flags[ulp_type]))
+                printk(KERN_WARNING PFX "%s: Failed waiting for ULP up call"
+                                        " to complete.\n", dev->netdev->name);
+
         return 0;
 }
 EXPORT_SYMBOL(cnic_unregister_driver);
@@ -1076,18 +1108,23 @@ static void cnic_ulp_stop(struct cnic_dev *dev)
         if (cp->cnic_uinfo)
                 cnic_send_nlmsg(cp, ISCSI_KEVENT_IF_DOWN, NULL);
 
-        rcu_read_lock();
         for (if_type = 0; if_type < MAX_CNIC_ULP_TYPE; if_type++) {
                 struct cnic_ulp_ops *ulp_ops;
 
-                ulp_ops = rcu_dereference(cp->ulp_ops[if_type]);
-                if (!ulp_ops)
+                mutex_lock(&cnic_lock);
+                ulp_ops = cp->ulp_ops[if_type];
+                if (!ulp_ops) {
+                        mutex_unlock(&cnic_lock);
                         continue;
+                }
+                set_bit(ULP_F_CALL_PENDING, &cp->ulp_flags[if_type]);
+                mutex_unlock(&cnic_lock);
 
                 if (test_and_clear_bit(ULP_F_START, &cp->ulp_flags[if_type]))
                         ulp_ops->cnic_stop(cp->ulp_handle[if_type]);
+
+                clear_bit(ULP_F_CALL_PENDING, &cp->ulp_flags[if_type]);
         }
-        rcu_read_unlock();
 }
 
 static void cnic_ulp_start(struct cnic_dev *dev)
@@ -1095,18 +1132,23 @@ static void cnic_ulp_start(struct cnic_dev *dev)
         struct cnic_local *cp = dev->cnic_priv;
         int if_type;
 
-        rcu_read_lock();
         for (if_type = 0; if_type < MAX_CNIC_ULP_TYPE; if_type++) {
                 struct cnic_ulp_ops *ulp_ops;
 
-                ulp_ops = rcu_dereference(cp->ulp_ops[if_type]);
-                if (!ulp_ops || !ulp_ops->cnic_start)
+                mutex_lock(&cnic_lock);
+                ulp_ops = cp->ulp_ops[if_type];
+                if (!ulp_ops || !ulp_ops->cnic_start) {
+                        mutex_unlock(&cnic_lock);
                         continue;
+                }
+                set_bit(ULP_F_CALL_PENDING, &cp->ulp_flags[if_type]);
+                mutex_unlock(&cnic_lock);
 
                 if (!test_and_set_bit(ULP_F_START, &cp->ulp_flags[if_type]))
                         ulp_ops->cnic_start(cp->ulp_handle[if_type]);
+
+                clear_bit(ULP_F_CALL_PENDING, &cp->ulp_flags[if_type]);
         }
-        rcu_read_unlock();
 }
 
 static int cnic_ctl(void *data, struct cnic_ctl_info *info)
@@ -1116,22 +1158,18 @@ static int cnic_ctl(void *data, struct cnic_ctl_info *info)
         switch (info->cmd) {
         case CNIC_CTL_STOP_CMD:
                 cnic_hold(dev);
-                mutex_lock(&cnic_lock);
 
                 cnic_ulp_stop(dev);
                 cnic_stop_hw(dev);
 
-                mutex_unlock(&cnic_lock);
                 cnic_put(dev);
                 break;
         case CNIC_CTL_START_CMD:
                 cnic_hold(dev);
-                mutex_lock(&cnic_lock);
 
                 if (!cnic_start_hw(dev))
                         cnic_ulp_start(dev);
 
-                mutex_unlock(&cnic_lock);
                 cnic_put(dev);
                 break;
         default:
@@ -1145,19 +1183,23 @@ static void cnic_ulp_init(struct cnic_dev *dev)
         int i;
         struct cnic_local *cp = dev->cnic_priv;
 
-        rcu_read_lock();
         for (i = 0; i < MAX_CNIC_ULP_TYPE_EXT; i++) {
                 struct cnic_ulp_ops *ulp_ops;
 
-                ulp_ops = rcu_dereference(cnic_ulp_tbl[i]);
-                if (!ulp_ops || !ulp_ops->cnic_init)
+                mutex_lock(&cnic_lock);
+                ulp_ops = cnic_ulp_tbl[i];
+                if (!ulp_ops || !ulp_ops->cnic_init) {
+                        mutex_unlock(&cnic_lock);
                         continue;
+                }
+                ulp_get(ulp_ops);
+                mutex_unlock(&cnic_lock);
 
                 if (!test_and_set_bit(ULP_F_INIT, &cp->ulp_flags[i]))
                         ulp_ops->cnic_init(dev);
 
+                ulp_put(ulp_ops);
         }
-        rcu_read_unlock();
 }
 
 static void cnic_ulp_exit(struct cnic_dev *dev)
@@ -1165,19 +1207,23 @@ static void cnic_ulp_exit(struct cnic_dev *dev)
         int i;
         struct cnic_local *cp = dev->cnic_priv;
 
-        rcu_read_lock();
         for (i = 0; i < MAX_CNIC_ULP_TYPE_EXT; i++) {
                 struct cnic_ulp_ops *ulp_ops;
 
-                ulp_ops = rcu_dereference(cnic_ulp_tbl[i]);
-                if (!ulp_ops || !ulp_ops->cnic_exit)
+                mutex_lock(&cnic_lock);
+                ulp_ops = cnic_ulp_tbl[i];
+                if (!ulp_ops || !ulp_ops->cnic_exit) {
+                        mutex_unlock(&cnic_lock);
                         continue;
+                }
+                ulp_get(ulp_ops);
+                mutex_unlock(&cnic_lock);
 
                 if (test_and_clear_bit(ULP_F_INIT, &cp->ulp_flags[i]))
                         ulp_ops->cnic_exit(dev);
 
+                ulp_put(ulp_ops);
         }
-        rcu_read_unlock();
 }
 
 static int cnic_cm_offload_pg(struct cnic_sock *csk)
@@ -2393,21 +2439,45 @@ static int cnic_start_bnx2_hw(struct cnic_dev *dev)
         return 0;
 }
 
-static int cnic_start_hw(struct cnic_dev *dev)
+static int cnic_register_netdev(struct cnic_dev *dev)
 {
         struct cnic_local *cp = dev->cnic_priv;
         struct cnic_eth_dev *ethdev = cp->ethdev;
         int err;
 
-        if (test_bit(CNIC_F_CNIC_UP, &dev->flags))
-                return -EALREADY;
+        if (!ethdev)
+                return -ENODEV;
+
+        if (ethdev->drv_state & CNIC_DRV_STATE_REGD)
+                return 0;
 
         err = ethdev->drv_register_cnic(dev->netdev, cp->cnic_ops, dev);
-        if (err) {
+        if (err)
                 printk(KERN_ERR PFX "%s: register_cnic failed\n",
                        dev->netdev->name);
-                goto err2;
-        }
+
+        return err;
+}
+
+static void cnic_unregister_netdev(struct cnic_dev *dev)
+{
+        struct cnic_local *cp = dev->cnic_priv;
+        struct cnic_eth_dev *ethdev = cp->ethdev;
+
+        if (!ethdev)
+                return;
+
+        ethdev->drv_unregister_cnic(dev->netdev);
+}
+
+static int cnic_start_hw(struct cnic_dev *dev)
+{
+        struct cnic_local *cp = dev->cnic_priv;
+        struct cnic_eth_dev *ethdev = cp->ethdev;
+        int err;
+
+        if (test_bit(CNIC_F_CNIC_UP, &dev->flags))
+                return -EALREADY;
 
         dev->regview = ethdev->io_base;
         cp->chip_id = ethdev->chip_id;
@@ -2438,18 +2508,13 @@ static int cnic_start_hw(struct cnic_dev *dev)
         return 0;
 
 err1:
-        ethdev->drv_unregister_cnic(dev->netdev);
         cp->free_resc(dev);
         pci_dev_put(dev->pcidev);
-err2:
         return err;
 }
 
 static void cnic_stop_bnx2_hw(struct cnic_dev *dev)
 {
-        struct cnic_local *cp = dev->cnic_priv;
-        struct cnic_eth_dev *ethdev = cp->ethdev;
-
         cnic_disable_bnx2_int_sync(dev);
 
         cnic_reg_wr_ind(dev, BNX2_CP_SCRATCH + 0x20, 0);
@@ -2461,8 +2526,6 @@ static void cnic_stop_bnx2_hw(struct cnic_dev *dev)
         cnic_setup_5709_context(dev, 0);
         cnic_free_irq(dev);
 
-        ethdev->drv_unregister_cnic(dev->netdev);
-
         cnic_free_resc(dev);
 }
 
@@ -2543,7 +2606,7 @@ static struct cnic_dev *init_bnx2_cnic(struct net_device *dev)
         probe = symbol_get(bnx2_cnic_probe);
         if (probe) {
                 ethdev = (*probe)(dev);
-                symbol_put_addr(probe);
+                symbol_put(bnx2_cnic_probe);
         }
         if (!ethdev)
                 return NULL;
@@ -2646,10 +2709,12 @@ static int cnic_netdev_event(struct notifier_block *this, unsigned long event,
                 else if (event == NETDEV_UNREGISTER)
                         cnic_ulp_exit(dev);
                 else if (event == NETDEV_UP) {
-                        mutex_lock(&cnic_lock);
+                        if (cnic_register_netdev(dev) != 0) {
+                                cnic_put(dev);
+                                goto done;
+                        }
                         if (!cnic_start_hw(dev))
                                 cnic_ulp_start(dev);
-                        mutex_unlock(&cnic_lock);
                 }
 
                 rcu_read_lock();
@@ -2668,10 +2733,9 @@ static int cnic_netdev_event(struct notifier_block *this, unsigned long event,
                 rcu_read_unlock();
 
                 if (event == NETDEV_GOING_DOWN) {
-                        mutex_lock(&cnic_lock);
                         cnic_ulp_stop(dev);
                         cnic_stop_hw(dev);
-                        mutex_unlock(&cnic_lock);
+                        cnic_unregister_netdev(dev);
                 } else if (event == NETDEV_UNREGISTER) {
                         write_lock(&cnic_dev_lock);
                         list_del_init(&dev->list);
@@ -2703,6 +2767,7 @@ static void cnic_release(void)
                 }
 
                 cnic_ulp_exit(dev);
+                cnic_unregister_netdev(dev);
                 list_del_init(&dev->list);
                 cnic_free_dev(dev);
         }
diff --git a/drivers/net/cnic.h b/drivers/net/cnic.h
index 5192d4a9df5a..a94b302bb464 100644
--- a/drivers/net/cnic.h
+++ b/drivers/net/cnic.h
@@ -176,6 +176,7 @@ struct cnic_local {
         unsigned long ulp_flags[MAX_CNIC_ULP_TYPE];
 #define ULP_F_INIT      0
 #define ULP_F_START     1
+#define ULP_F_CALL_PENDING      2
         struct cnic_ulp_ops *ulp_ops[MAX_CNIC_ULP_TYPE];
 
         /* protected by ulp_lock */
diff --git a/drivers/net/cnic_if.h b/drivers/net/cnic_if.h
index d1bce27ee99e..a49235739eef 100644
--- a/drivers/net/cnic_if.h
+++ b/drivers/net/cnic_if.h
@@ -290,6 +290,7 @@ struct cnic_ulp_ops {
         void (*iscsi_nl_send_msg)(struct cnic_dev *dev, u32 msg_type,
                                   char *data, u16 data_size);
         struct module *owner;
+        atomic_t ref_count;
 };
 
 extern int cnic_register_driver(int ulp_type, struct cnic_ulp_ops *ulp_ops);
diff --git a/drivers/net/e1000e/ich8lan.c b/drivers/net/e1000e/ich8lan.c
index d56c7473144a..99df2abf82a9 100644
--- a/drivers/net/e1000e/ich8lan.c
+++ b/drivers/net/e1000e/ich8lan.c
@@ -338,10 +338,7 @@ static s32 e1000_init_nvm_params_ich8lan(struct e1000_hw *hw)
 {
         struct e1000_nvm_info *nvm = &hw->nvm;
         struct e1000_dev_spec_ich8lan *dev_spec = &hw->dev_spec.ich8lan;
-        union ich8_hws_flash_status hsfsts;
-        u32 gfpreg;
-        u32 sector_base_addr;
-        u32 sector_end_addr;
+        u32 gfpreg, sector_base_addr, sector_end_addr;
         u16 i;
 
         /* Can't read flash registers if the register set isn't mapped. */
@@ -375,20 +372,6 @@ static s32 e1000_init_nvm_params_ich8lan(struct e1000_hw *hw)
         /* Adjust to word count */
         nvm->flash_bank_size /= sizeof(u16);
 
-        /*
-         * Make sure the flash bank size does not overwrite the 4k
-         * sector ranges. We may have 64k allotted to us but we only care
-         * about the first 2 4k sectors. Therefore, if we have anything less
-         * than 64k set in the HSFSTS register, we will reduce the bank size
-         * down to 4k and let the rest remain unused. If berasesz == 3, then
-         * we are working in 64k mode. Otherwise we are not.
-         */
-        if (nvm->flash_bank_size > E1000_ICH8_SHADOW_RAM_WORDS) {
-                hsfsts.regval = er16flash(ICH_FLASH_HSFSTS);
-                if (hsfsts.hsf_status.berasesz != 3)
-                        nvm->flash_bank_size = E1000_ICH8_SHADOW_RAM_WORDS;
-        }
-
         nvm->word_size = E1000_ICH8_SHADOW_RAM_WORDS;
 
         /* Clear shadow ram */
@@ -594,8 +577,8 @@ static DEFINE_MUTEX(nvm_mutex);
  **/
 static s32 e1000_acquire_swflag_ich8lan(struct e1000_hw *hw)
 {
-        u32 extcnf_ctrl;
-        u32 timeout = PHY_CFG_TIMEOUT;
+        u32 extcnf_ctrl, timeout = PHY_CFG_TIMEOUT;
+        s32 ret_val = 0;
 
         might_sleep();
 
@@ -603,28 +586,46 @@ static s32 e1000_acquire_swflag_ich8lan(struct e1000_hw *hw)
 
         while (timeout) {
                 extcnf_ctrl = er32(EXTCNF_CTRL);
+                if (!(extcnf_ctrl & E1000_EXTCNF_CTRL_SWFLAG))
+                        break;
 
-                if (!(extcnf_ctrl & E1000_EXTCNF_CTRL_SWFLAG)) {
-                        extcnf_ctrl |= E1000_EXTCNF_CTRL_SWFLAG;
-                        ew32(EXTCNF_CTRL, extcnf_ctrl);
+                mdelay(1);
+                timeout--;
+        }
+
+        if (!timeout) {
+                hw_dbg(hw, "SW/FW/HW has locked the resource for too long.\n");
+                ret_val = -E1000_ERR_CONFIG;
+                goto out;
+        }
+
+        timeout = PHY_CFG_TIMEOUT * 2;
+
+        extcnf_ctrl |= E1000_EXTCNF_CTRL_SWFLAG;
+        ew32(EXTCNF_CTRL, extcnf_ctrl);
+
+        while (timeout) {
+                extcnf_ctrl = er32(EXTCNF_CTRL);
+                if (extcnf_ctrl & E1000_EXTCNF_CTRL_SWFLAG)
+                        break;
 
-                        extcnf_ctrl = er32(EXTCNF_CTRL);
-                        if (extcnf_ctrl & E1000_EXTCNF_CTRL_SWFLAG)
-                                break;
-                }
                 mdelay(1);
                 timeout--;
         }
 
         if (!timeout) {
-                hw_dbg(hw, "FW or HW has locked the resource for too long.\n");
+                hw_dbg(hw, "Failed to acquire the semaphore.\n");
                 extcnf_ctrl &= ~E1000_EXTCNF_CTRL_SWFLAG;
                 ew32(EXTCNF_CTRL, extcnf_ctrl);
-                mutex_unlock(&nvm_mutex);
-                return -E1000_ERR_CONFIG;
+                ret_val = -E1000_ERR_CONFIG;
+                goto out;
         }
 
-        return 0;
+out:
+        if (ret_val)
+                mutex_unlock(&nvm_mutex);
+
+        return ret_val;
 }
 
 /**
@@ -1306,7 +1307,7 @@ static s32 e1000_read_nvm_ich8lan(struct e1000_hw *hw, u16 offset, u16 words,
         struct e1000_nvm_info *nvm = &hw->nvm;
         struct e1000_dev_spec_ich8lan *dev_spec = &hw->dev_spec.ich8lan;
         u32 act_offset;
-        s32 ret_val;
+        s32 ret_val = 0;
         u32 bank = 0;
         u16 i, word;
 
@@ -1321,12 +1322,15 @@ static s32 e1000_read_nvm_ich8lan(struct e1000_hw *hw, u16 offset, u16 words,
                 goto out;
 
         ret_val = e1000_valid_nvm_bank_detect_ich8lan(hw, &bank);
-        if (ret_val)
-                goto release;
+        if (ret_val) {
+                hw_dbg(hw, "Could not detect valid bank, assuming bank 0\n");
+                bank = 0;
+        }
 
         act_offset = (bank) ? nvm->flash_bank_size : 0;
         act_offset += offset;
 
+        ret_val = 0;
         for (i = 0; i < words; i++) {
                 if ((dev_spec->shadow_ram) &&
                     (dev_spec->shadow_ram[offset+i].modified)) {
@@ -1341,7 +1345,6 @@ static s32 e1000_read_nvm_ich8lan(struct e1000_hw *hw, u16 offset, u16 words,
                 }
         }
 
-release:
         e1000_release_swflag_ich8lan(hw);
 
 out:
@@ -1592,7 +1595,6 @@ static s32 e1000_write_nvm_ich8lan(struct e1000_hw *hw, u16 offset, u16 words,
 {
         struct e1000_nvm_info *nvm = &hw->nvm;
         struct e1000_dev_spec_ich8lan *dev_spec = &hw->dev_spec.ich8lan;
-        s32 ret_val;
         u16 i;
 
         if ((offset >= nvm->word_size) || (words > nvm->word_size - offset) ||
@@ -1601,17 +1603,11 @@ static s32 e1000_write_nvm_ich8lan(struct e1000_hw *hw, u16 offset, u16 words,
                 return -E1000_ERR_NVM;
         }
 
-        ret_val = e1000_acquire_swflag_ich8lan(hw);
-        if (ret_val)
-                return ret_val;
-
         for (i = 0; i < words; i++) {
                 dev_spec->shadow_ram[offset+i].modified = 1;
                 dev_spec->shadow_ram[offset+i].value = data[i];
         }
 
-        e1000_release_swflag_ich8lan(hw);
-
         return 0;
 }
 
@@ -1652,8 +1648,8 @@ static s32 e1000_update_nvm_checksum_ich8lan(struct e1000_hw *hw)
          */
         ret_val =  e1000_valid_nvm_bank_detect_ich8lan(hw, &bank);
         if (ret_val) {
-                e1000_release_swflag_ich8lan(hw);
-                goto out;
+                hw_dbg(hw, "Could not detect valid bank, assuming bank 0\n");
+                bank = 0;
         }
 
         if (bank == 0) {
@@ -2039,12 +2035,8 @@ static s32 e1000_erase_flash_bank_ich8lan(struct e1000_hw *hw, u32 bank)
                 iteration = 1;
                 break;
         case 2:
-                if (hw->mac.type == e1000_ich9lan) {
-                        sector_size = ICH_FLASH_SEG_SIZE_8K;
-                        iteration = flash_bank_size / ICH_FLASH_SEG_SIZE_8K;
-                } else {
-                        return -E1000_ERR_NVM;
-                }
+                sector_size = ICH_FLASH_SEG_SIZE_8K;
+                iteration = 1;
                 break;
         case 3:
                 sector_size = ICH_FLASH_SEG_SIZE_64K;
@@ -2056,7 +2048,7 @@ static s32 e1000_erase_flash_bank_ich8lan(struct e1000_hw *hw, u32 bank)
 
         /* Start with the base address, then add the sector offset. */
         flash_linear_addr = hw->nvm.flash_base_addr;
-        flash_linear_addr += (bank) ? (sector_size * iteration) : 0;
+        flash_linear_addr += (bank) ? flash_bank_size : 0;
 
         for (j = 0; j < iteration ; j++) {
                 do {
diff --git a/drivers/net/e1000e/netdev.c b/drivers/net/e1000e/netdev.c
index 63415bb6f48f..fa92a683aefd 100644
--- a/drivers/net/e1000e/netdev.c
+++ b/drivers/net/e1000e/netdev.c
@@ -4538,8 +4538,7 @@ static int __e1000_shutdown(struct pci_dev *pdev, bool *enable_wake)
                 /* Allow time for pending master requests to run */
                 e1000e_disable_pcie_master(&adapter->hw);
 
-                if ((adapter->flags2 & FLAG2_HAS_PHY_WAKEUP) &&
-                    !(hw->mac.ops.check_mng_mode(hw))) {
+                if (adapter->flags2 & FLAG2_HAS_PHY_WAKEUP) {
                         /* enable wakeup by the PHY */
                         retval = e1000_init_phy_wakeup(adapter, wufc);
                         if (retval)
@@ -4557,7 +4556,8 @@ static int __e1000_shutdown(struct pci_dev *pdev, bool *enable_wake)
         *enable_wake = !!wufc;
 
         /* make sure adapter isn't asleep if manageability is enabled */
-        if (adapter->flags & FLAG_MNG_PT_ENABLED)
+        if ((adapter->flags & FLAG_MNG_PT_ENABLED) ||
+            (hw->mac.ops.check_mng_mode(hw)))
                 *enable_wake = true;
 
         if (adapter->hw.phy.type == e1000_phy_igp_3)
@@ -4670,14 +4670,6 @@ static int e1000_resume(struct pci_dev *pdev)
                 return err;
         }
 
-        /* AER (Advanced Error Reporting) hooks */
-        err = pci_enable_pcie_error_reporting(pdev);
-        if (err) {
-                dev_err(&pdev->dev, "pci_enable_pcie_error_reporting failed "
-                                    "0x%x\n", err);
-                /* non-fatal, continue */
-        }
-
         pci_set_master(pdev);
 
         pci_enable_wake(pdev, PCI_D3hot, 0);
@@ -4990,6 +4982,14 @@ static int __devinit e1000_probe(struct pci_dev *pdev,
         if (err)
                 goto err_pci_reg;
 
+        /* AER (Advanced Error Reporting) hooks */
+        err = pci_enable_pcie_error_reporting(pdev);
+        if (err) {
+                dev_err(&pdev->dev, "pci_enable_pcie_error_reporting failed "
+                        "0x%x\n", err);
+                /* non-fatal, continue */
+        }
+
         pci_set_master(pdev);
         /* PCI config space info */
         err = pci_save_state(pdev);
diff --git a/drivers/net/fec.c b/drivers/net/fec.c
index d4b98074b1b7..c9fd82d3a80d 100644
--- a/drivers/net/fec.c
+++ b/drivers/net/fec.c
@@ -285,6 +285,7 @@ fec_enet_start_xmit(struct sk_buff *skb, struct net_device *dev)
 {
         struct fec_enet_private *fep = netdev_priv(dev);
         struct bufdesc *bdp;
+        void *bufaddr;
         unsigned short  status;
         unsigned long flags;
 
@@ -312,7 +313,7 @@ fec_enet_start_xmit(struct sk_buff *skb, struct net_device *dev)
         status &= ~BD_ENET_TX_STATS;
 
         /* Set buffer length and buffer pointer */
-        bdp->cbd_bufaddr = __pa(skb->data);
+        bufaddr = skb->data;
         bdp->cbd_datlen = skb->len;
 
         /*
@@ -320,11 +321,11 @@ fec_enet_start_xmit(struct sk_buff *skb, struct net_device *dev)
          * 4-byte boundaries. Use bounce buffers to copy data
          * and get it aligned. Ugh.
          */
-        if (bdp->cbd_bufaddr & FEC_ALIGNMENT) {
+        if (((unsigned long) bufaddr) & FEC_ALIGNMENT) {
                 unsigned int index;
                 index = bdp - fep->tx_bd_base;
                 memcpy(fep->tx_bounce[index], (void *)skb->data, skb->len);
-                bdp->cbd_bufaddr = __pa(fep->tx_bounce[index]);
+                bufaddr = fep->tx_bounce[index];
         }
 
         /* Save skb pointer */
@@ -336,7 +337,7 @@ fec_enet_start_xmit(struct sk_buff *skb, struct net_device *dev)
         /* Push the data cache so the CPM does not get stale memory
          * data.
          */
-        bdp->cbd_bufaddr = dma_map_single(&dev->dev, skb->data,
+        bdp->cbd_bufaddr = dma_map_single(&dev->dev, bufaddr,
                         FEC_ENET_TX_FRSIZE, DMA_TO_DEVICE);
 
         /* Send it on its way.  Tell FEC it's ready, interrupt when done,
diff --git a/drivers/net/gianfar.c b/drivers/net/gianfar.c
index f8ffcbf0bc39..e212f2c5448b 100644
--- a/drivers/net/gianfar.c
+++ b/drivers/net/gianfar.c
@@ -936,6 +936,7 @@ int startup_gfar(struct net_device *dev)
         struct gfar __iomem *regs = priv->regs;
         int err = 0;
         u32 rctrl = 0;
+        u32 tctrl = 0;
         u32 attrs = 0;
 
         gfar_write(&regs->imask, IMASK_INIT_CLEAR);
@@ -1111,11 +1112,19 @@ int startup_gfar(struct net_device *dev)
                 rctrl |= RCTRL_PADDING(priv->padding);
         }
 
+        /* keep vlan related bits if it's enabled */
+        if (priv->vlgrp) {
+                rctrl |= RCTRL_VLEX | RCTRL_PRSDEP_INIT;
+                tctrl |= TCTRL_VLINS;
+        }
+
         /* Init rctrl based on our settings */
         gfar_write(&priv->regs->rctrl, rctrl);
 
         if (dev->features & NETIF_F_IP_CSUM)
-                gfar_write(&priv->regs->tctrl, TCTRL_INIT_CSUM);
+                tctrl |= TCTRL_INIT_CSUM;
+
+        gfar_write(&priv->regs->tctrl, tctrl);
 
         /* Set the extraction length and index */
         attrs = ATTRELI_EL(priv->rx_stash_size) |
@@ -1450,7 +1459,6 @@ static void gfar_vlan_rx_register(struct net_device *dev,
 
                 /* Enable VLAN tag extraction */
                 tempval = gfar_read(&priv->regs->rctrl);
-                tempval |= RCTRL_VLEX;
                 tempval |= (RCTRL_VLEX | RCTRL_PRSDEP_INIT);
                 gfar_write(&priv->regs->rctrl, tempval);
         } else {
diff --git a/drivers/net/irda/w83977af_ir.c b/drivers/net/irda/w83977af_ir.c
index d0883835b0c6..fe4f2b2bff96 100644
--- a/drivers/net/irda/w83977af_ir.c
+++ b/drivers/net/irda/w83977af_ir.c
@@ -115,7 +115,7 @@ static int __init w83977af_init(void)
 
         IRDA_DEBUG(0, "%s()\n", __func__ );
 
-        for (i=0; (io[i] < 2000) && (i < ARRAY_SIZE(dev_self)); i++) {
+        for (i=0; i < ARRAY_SIZE(dev_self) && io[i] < 2000; i++) {
                 if (w83977af_open(i, io[i], irq[i], dma[i]) == 0)
                         return 0;
         }
diff --git a/drivers/net/ixgbe/ixgbe.h b/drivers/net/ixgbe/ixgbe.h
index e11d83d5852b..2c4dc8221dcd 100644
--- a/drivers/net/ixgbe/ixgbe.h
+++ b/drivers/net/ixgbe/ixgbe.h
@@ -136,6 +136,8 @@ struct ixgbe_ring {
 
         u8 queue_index; /* needed for multiqueue queue management */
 
+#define IXGBE_RING_RX_PS_ENABLED                (u8)(1)
+        u8 flags;                       /* per ring feature flags */
         u16 head;
         u16 tail;
 
diff --git a/drivers/net/ixgbe/ixgbe_ethtool.c b/drivers/net/ixgbe/ixgbe_ethtool.c
index 79144e950a34..dff8dfac7ed9 100644
--- a/drivers/net/ixgbe/ixgbe_ethtool.c
+++ b/drivers/net/ixgbe/ixgbe_ethtool.c
@@ -1948,6 +1948,7 @@ static int ixgbe_set_coalesce(struct net_device *netdev,
                               struct ethtool_coalesce *ec)
 {
         struct ixgbe_adapter *adapter = netdev_priv(netdev);
+        struct ixgbe_q_vector *q_vector;
         int i;
 
         if (ec->tx_max_coalesced_frames_irq)
@@ -1982,14 +1983,24 @@ static int ixgbe_set_coalesce(struct net_device *netdev,
                 adapter->itr_setting = 0;
         }
 
-        for (i = 0; i < adapter->num_msix_vectors - NON_Q_VECTORS; i++) {
-                struct ixgbe_q_vector *q_vector = adapter->q_vector[i];
-                if (q_vector->txr_count && !q_vector->rxr_count)
-                        /* tx vector gets half the rate */
-                        q_vector->eitr = (adapter->eitr_param >> 1);
-                else
-                        /* rx only or mixed */
-                        q_vector->eitr = adapter->eitr_param;
+        /* MSI/MSIx Interrupt Mode */
+        if (adapter->flags &
+            (IXGBE_FLAG_MSIX_ENABLED | IXGBE_FLAG_MSI_ENABLED)) {
+                int num_vectors = adapter->num_msix_vectors - NON_Q_VECTORS;
+                for (i = 0; i < num_vectors; i++) {
+                        q_vector = adapter->q_vector[i];
+                        if (q_vector->txr_count && !q_vector->rxr_count)
+                                /* tx vector gets half the rate */
+                                q_vector->eitr = (adapter->eitr_param >> 1);
+                        else
+                                /* rx only or mixed */
+                                q_vector->eitr = adapter->eitr_param;
+                        ixgbe_write_eitr(q_vector);
+                }
+        /* Legacy Interrupt Mode */
+        } else {
+                q_vector = adapter->q_vector[0];
+                q_vector->eitr = adapter->eitr_param;
                 ixgbe_write_eitr(q_vector);
         }
 
diff --git a/drivers/net/ixgbe/ixgbe_fcoe.c b/drivers/net/ixgbe/ixgbe_fcoe.c
index fa9f24e23683..28cf104e36cc 100644
--- a/drivers/net/ixgbe/ixgbe_fcoe.c
+++ b/drivers/net/ixgbe/ixgbe_fcoe.c
@@ -336,7 +336,7 @@ int ixgbe_fcoe_ddp(struct ixgbe_adapter *adapter,
                 /* return 0 to bypass going to ULD for DDPed data */
                 if (fcstat == IXGBE_RXDADV_STAT_FCSTAT_DDP)
                         rc = 0;
-                else
+                else if (ddp->len)
                         rc = ddp->len;
         }
 
diff --git a/drivers/net/ixgbe/ixgbe_main.c b/drivers/net/ixgbe/ixgbe_main.c
index 110c65ab5cb5..77b0381a2b5c 100644
--- a/drivers/net/ixgbe/ixgbe_main.c
+++ b/drivers/net/ixgbe/ixgbe_main.c
@@ -492,12 +492,12 @@ static void ixgbe_receive_skb(struct ixgbe_q_vector *q_vector,
 
         skb_record_rx_queue(skb, ring->queue_index);
         if (!(adapter->flags & IXGBE_FLAG_IN_NETPOLL)) {
-                if (adapter->vlgrp && is_vlan && (tag != 0))
+                if (adapter->vlgrp && is_vlan && (tag & VLAN_VID_MASK))
                         vlan_gro_receive(napi, adapter->vlgrp, tag, skb);
                 else
                         napi_gro_receive(napi, skb);
         } else {
-                if (adapter->vlgrp && is_vlan && (tag != 0))
+                if (adapter->vlgrp && is_vlan && (tag & VLAN_VID_MASK))
                         vlan_hwaccel_rx(skb, adapter->vlgrp, tag);
                 else
                         netif_rx(skb);
@@ -585,7 +585,7 @@ static void ixgbe_alloc_rx_buffers(struct ixgbe_adapter *adapter,
                 rx_desc = IXGBE_RX_DESC_ADV(*rx_ring, i);
 
                 if (!bi->page_dma &&
-                    (adapter->flags & IXGBE_FLAG_RX_PS_ENABLED)) {
+                    (rx_ring->flags & IXGBE_RING_RX_PS_ENABLED)) {
                         if (!bi->page) {
                                 bi->page = alloc_page(GFP_ATOMIC);
                                 if (!bi->page) {
@@ -629,7 +629,7 @@ static void ixgbe_alloc_rx_buffers(struct ixgbe_adapter *adapter,
                 }
                 /* Refresh the desc even if buffer_addrs didn't change because
                  * each write-back erases this info. */
-                if (adapter->flags & IXGBE_FLAG_RX_PS_ENABLED) {
+                if (rx_ring->flags & IXGBE_RING_RX_PS_ENABLED) {
                         rx_desc->read.pkt_addr = cpu_to_le64(bi->page_dma);
                         rx_desc->read.hdr_addr = cpu_to_le64(bi->dma);
                 } else {
@@ -726,7 +726,7 @@ static bool ixgbe_clean_rx_irq(struct ixgbe_q_vector *q_vector,
                         break;
                 (*work_done)++;
 
-                if (adapter->flags & IXGBE_FLAG_RX_PS_ENABLED) {
+                if (rx_ring->flags & IXGBE_RING_RX_PS_ENABLED) {
                         hdr_info = le16_to_cpu(ixgbe_get_hdr_info(rx_desc));
                         len = (hdr_info & IXGBE_RXDADV_HDRBUFLEN_MASK) >>
                                IXGBE_RXDADV_HDRBUFLEN_SHIFT;
@@ -798,7 +798,7 @@ static bool ixgbe_clean_rx_irq(struct ixgbe_q_vector *q_vector,
                         rx_ring->stats.packets++;
                         rx_ring->stats.bytes += skb->len;
                 } else {
-                        if (adapter->flags & IXGBE_FLAG_RX_PS_ENABLED) {
+                        if (rx_ring->flags & IXGBE_RING_RX_PS_ENABLED) {
                                 rx_buffer_info->skb = next_buffer->skb;
                                 rx_buffer_info->dma = next_buffer->dma;
                                 next_buffer->skb = skb;
@@ -1898,46 +1898,19 @@ static void ixgbe_configure_tx(struct ixgbe_adapter *adapter)
 
 #define IXGBE_SRRCTL_BSIZEHDRSIZE_SHIFT 2
 
-static void ixgbe_configure_srrctl(struct ixgbe_adapter *adapter, int index)
+static void ixgbe_configure_srrctl(struct ixgbe_adapter *adapter,
+                                   struct ixgbe_ring *rx_ring)
 {
-        struct ixgbe_ring *rx_ring;
         u32 srrctl;
-        int queue0 = 0;
-        unsigned long mask;
+        int index;
         struct ixgbe_ring_feature *feature = adapter->ring_feature;
 
-        if (adapter->hw.mac.type == ixgbe_mac_82599EB) {
-                if (adapter->flags & IXGBE_FLAG_DCB_ENABLED) {
-                        int dcb_i = feature[RING_F_DCB].indices;
-                        if (dcb_i == 8)
-                                queue0 = index >> 4;
-                        else if (dcb_i == 4)
-                                queue0 = index >> 5;
-                        else
-                                dev_err(&adapter->pdev->dev, "Invalid DCB "
-                                        "configuration\n");
-#ifdef IXGBE_FCOE
-                        if (adapter->flags & IXGBE_FLAG_FCOE_ENABLED) {
-                                struct ixgbe_ring_feature *f;
-
-                                rx_ring = &adapter->rx_ring[queue0];
-                                f = &adapter->ring_feature[RING_F_FCOE];
-                                if ((queue0 == 0) && (index > rx_ring->reg_idx))
-                                        queue0 = f->mask + index -
-                                                 rx_ring->reg_idx - 1;
-                        }
-#endif /* IXGBE_FCOE */
-                } else {
-                        queue0 = index;
-                }
-        } else {
+        index = rx_ring->reg_idx;
+        if (adapter->hw.mac.type == ixgbe_mac_82598EB) {
+                unsigned long mask;
                 mask = (unsigned long) feature[RING_F_RSS].mask;
-                queue0 = index & mask;
                 index = index & mask;
         }
-
-        rx_ring = &adapter->rx_ring[queue0];
-
         srrctl = IXGBE_READ_REG(&adapter->hw, IXGBE_SRRCTL(index));
 
         srrctl &= ~IXGBE_SRRCTL_BSIZEHDR_MASK;
@@ -1946,7 +1919,7 @@ static void ixgbe_configure_srrctl(struct ixgbe_adapter *adapter, int index)
         srrctl |= (IXGBE_RX_HDR_SIZE << IXGBE_SRRCTL_BSIZEHDRSIZE_SHIFT) &
                   IXGBE_SRRCTL_BSIZEHDR_MASK;
 
-        if (adapter->flags & IXGBE_FLAG_RX_PS_ENABLED) {
+        if (rx_ring->flags & IXGBE_RING_RX_PS_ENABLED) {
 #if (PAGE_SIZE / 2) > IXGBE_MAX_RXBUFFER
                 srrctl |= IXGBE_MAX_RXBUFFER >> IXGBE_SRRCTL_BSIZEPKT_SHIFT;
 #else
@@ -2002,6 +1975,7 @@ static void ixgbe_configure_rx(struct ixgbe_adapter *adapter)
 {
         u64 rdba;
         struct ixgbe_hw *hw = &adapter->hw;
+        struct ixgbe_ring *rx_ring;
         struct net_device *netdev = adapter->netdev;
         int max_frame = netdev->mtu + ETH_HLEN + ETH_FCS_LEN;
         int i, j;
@@ -2018,11 +1992,6 @@ static void ixgbe_configure_rx(struct ixgbe_adapter *adapter)
         /* Decide whether to use packet split mode or not */
         adapter->flags |= IXGBE_FLAG_RX_PS_ENABLED;
 
-#ifdef IXGBE_FCOE
-        if (adapter->flags & IXGBE_FLAG_FCOE_ENABLED)
-                adapter->flags &= ~IXGBE_FLAG_RX_PS_ENABLED;
-#endif /* IXGBE_FCOE */
-
         /* Set the RX buffer length according to the mode */
         if (adapter->flags & IXGBE_FLAG_RX_PS_ENABLED) {
                 rx_buf_len = IXGBE_RX_HDR_SIZE;
@@ -2070,29 +2039,35 @@ static void ixgbe_configure_rx(struct ixgbe_adapter *adapter)
          * the Base and Length of the Rx Descriptor Ring
          */
         for (i = 0; i < adapter->num_rx_queues; i++) {
-                rdba = adapter->rx_ring[i].dma;
-                j = adapter->rx_ring[i].reg_idx;
+                rx_ring = &adapter->rx_ring[i];
+                rdba = rx_ring->dma;
+                j = rx_ring->reg_idx;
                 IXGBE_WRITE_REG(hw, IXGBE_RDBAL(j), (rdba & DMA_BIT_MASK(32)));
                 IXGBE_WRITE_REG(hw, IXGBE_RDBAH(j), (rdba >> 32));
                 IXGBE_WRITE_REG(hw, IXGBE_RDLEN(j), rdlen);
                 IXGBE_WRITE_REG(hw, IXGBE_RDH(j), 0);
                 IXGBE_WRITE_REG(hw, IXGBE_RDT(j), 0);
-                adapter->rx_ring[i].head = IXGBE_RDH(j);
-                adapter->rx_ring[i].tail = IXGBE_RDT(j);
-                adapter->rx_ring[i].rx_buf_len = rx_buf_len;
+                rx_ring->head = IXGBE_RDH(j);
+                rx_ring->tail = IXGBE_RDT(j);
+                rx_ring->rx_buf_len = rx_buf_len;
+
+                if (adapter->flags & IXGBE_FLAG_RX_PS_ENABLED)
+                        rx_ring->flags |= IXGBE_RING_RX_PS_ENABLED;
 
 #ifdef IXGBE_FCOE
                 if (adapter->flags & IXGBE_FLAG_FCOE_ENABLED) {
                         struct ixgbe_ring_feature *f;
                         f = &adapter->ring_feature[RING_F_FCOE];
-                        if ((rx_buf_len < IXGBE_FCOE_JUMBO_FRAME_SIZE) &&
-                            (i >= f->mask) && (i < f->mask + f->indices))
-                                adapter->rx_ring[i].rx_buf_len =
-                                        IXGBE_FCOE_JUMBO_FRAME_SIZE;
+                        if ((i >= f->mask) && (i < f->mask + f->indices)) {
+                                rx_ring->flags &= ~IXGBE_RING_RX_PS_ENABLED;
+                                if (rx_buf_len < IXGBE_FCOE_JUMBO_FRAME_SIZE)
+                                        rx_ring->rx_buf_len =
+                                                IXGBE_FCOE_JUMBO_FRAME_SIZE;
+                        }
                 }
 
 #endif /* IXGBE_FCOE */
-                ixgbe_configure_srrctl(adapter, j);
+                ixgbe_configure_srrctl(adapter, rx_ring);
         }
 
         if (hw->mac.type == ixgbe_mac_82598EB) {
@@ -2168,7 +2143,8 @@ static void ixgbe_configure_rx(struct ixgbe_adapter *adapter)
         if (adapter->flags2 & IXGBE_FLAG2_RSC_ENABLED) {
                 /* Enable 82599 HW-RSC */
                 for (i = 0; i < adapter->num_rx_queues; i++) {
-                        j = adapter->rx_ring[i].reg_idx;
+                        rx_ring = &adapter->rx_ring[i];
+                        j = rx_ring->reg_idx;
                         rscctrl = IXGBE_READ_REG(hw, IXGBE_RSCCTL(j));
                         rscctrl |= IXGBE_RSCCTL_RSCEN;
                         /*
@@ -2176,7 +2152,7 @@ static void ixgbe_configure_rx(struct ixgbe_adapter *adapter)
                          * total size of max desc * buf_len is not greater
                          * than 65535
                          */
-                        if (adapter->flags & IXGBE_FLAG_RX_PS_ENABLED) {
+                        if (rx_ring->flags & IXGBE_RING_RX_PS_ENABLED) {
 #if (MAX_SKB_FRAGS > 16)
                                 rscctrl |= IXGBE_RSCCTL_MAXDESC_16;
 #elif (MAX_SKB_FRAGS > 8)
diff --git a/drivers/net/mlx4/en_rx.c b/drivers/net/mlx4/en_rx.c
index 91bdfdfd431f..3ac0404d0d11 100644
--- a/drivers/net/mlx4/en_rx.c
+++ b/drivers/net/mlx4/en_rx.c
@@ -506,8 +506,9 @@ static int mlx4_en_complete_rx_desc(struct mlx4_en_priv *priv,
                                  PCI_DMA_FROMDEVICE);
         }
         /* Adjust size of last fragment to match actual length */
-        skb_frags_rx[nr - 1].size = length -
-                priv->frag_info[nr - 1].frag_prefix_size;
+        if (nr > 0)
+                skb_frags_rx[nr - 1].size = length -
+                        priv->frag_info[nr - 1].frag_prefix_size;
         return nr;
 
 fail:
diff --git a/drivers/net/netxen/netxen_nic.h b/drivers/net/netxen/netxen_nic.h
index f86e05047d19..a9c1fcca5e75 100644
--- a/drivers/net/netxen/netxen_nic.h
+++ b/drivers/net/netxen/netxen_nic.h
@@ -1254,7 +1254,7 @@ struct netxen_adapter {
         u8 mc_enabled;
         u8 max_mc_count;
         u8 rss_supported;
-        u8 resv2;
+        u8 link_changed;
         u32 resv3;
 
         u8 has_link_events;
diff --git a/drivers/net/netxen/netxen_nic_init.c b/drivers/net/netxen/netxen_nic_init.c
index 7acf204e38c9..5d3343ef3d86 100644
--- a/drivers/net/netxen/netxen_nic_init.c
+++ b/drivers/net/netxen/netxen_nic_init.c
@@ -184,13 +184,6 @@ void netxen_free_sw_resources(struct netxen_adapter *adapter)
         kfree(recv_ctx->rds_rings);
 
 skip_rds:
-        if (recv_ctx->sds_rings == NULL)
-                goto skip_sds;
-
-        for(ring = 0; ring < adapter->max_sds_rings; ring++)
-                recv_ctx->sds_rings[ring].consumer = 0;
-
-skip_sds:
         if (adapter->tx_ring == NULL)
                 return;
 
diff --git a/drivers/net/netxen/netxen_nic_main.c b/drivers/net/netxen/netxen_nic_main.c
index 3cd8cfcf627b..28f270f5ac78 100644
--- a/drivers/net/netxen/netxen_nic_main.c
+++ b/drivers/net/netxen/netxen_nic_main.c
@@ -94,10 +94,6 @@ static struct pci_device_id netxen_pci_tbl[] __devinitdata = {
 
 MODULE_DEVICE_TABLE(pci, netxen_pci_tbl);
 
-static struct workqueue_struct *netxen_workq;
-#define SCHEDULE_WORK(tp)       queue_work(netxen_workq, tp)
-#define FLUSH_SCHEDULED_WORK()  flush_workqueue(netxen_workq)
-
 static void netxen_watchdog(unsigned long);
 
 static uint32_t crb_cmd_producer[4] = {
@@ -171,6 +167,8 @@ netxen_free_sds_rings(struct netxen_recv_context *recv_ctx)
 {
         if (recv_ctx->sds_rings != NULL)
                 kfree(recv_ctx->sds_rings);
+
+        recv_ctx->sds_rings = NULL;
 }
 
 static int
@@ -193,6 +191,21 @@ netxen_napi_add(struct netxen_adapter *adapter, struct net_device *netdev)
 }
 
 static void
+netxen_napi_del(struct netxen_adapter *adapter)
+{
+        int ring;
+        struct nx_host_sds_ring *sds_ring;
+        struct netxen_recv_context *recv_ctx = &adapter->recv_ctx;
+
+        for (ring = 0; ring < adapter->max_sds_rings; ring++) {
+                sds_ring = &recv_ctx->sds_rings[ring];
+                netif_napi_del(&sds_ring->napi);
+        }
+
+        netxen_free_sds_rings(&adapter->recv_ctx);
+}
+
+static void
 netxen_napi_enable(struct netxen_adapter *adapter)
 {
         int ring;
@@ -260,7 +273,7 @@ nx_update_dma_mask(struct netxen_adapter *adapter)
         change = 0;
 
         shift = NXRD32(adapter, CRB_DMA_SHIFT);
-        if (shift >= 32)
+        if (shift > 32)
                 return 0;
 
         if (NX_IS_REVISION_P3(adapter->ahw.revision_id) && (shift > 9))
@@ -272,7 +285,7 @@ nx_update_dma_mask(struct netxen_adapter *adapter)
                 old_mask = pdev->dma_mask;
                 old_cmask = pdev->dev.coherent_dma_mask;
 
-                mask = (1ULL<<(32+shift)) - 1;
+                mask = DMA_BIT_MASK(32+shift);
 
                 err = pci_set_dma_mask(pdev, mask);
                 if (err)
@@ -880,7 +893,6 @@ netxen_nic_down(struct netxen_adapter *adapter, struct net_device *netdev)
         spin_unlock(&adapter->tx_clean_lock);
 
         del_timer_sync(&adapter->watchdog_timer);
-        FLUSH_SCHEDULED_WORK();
 }
 
 
@@ -894,10 +906,12 @@ netxen_nic_attach(struct netxen_adapter *adapter)
         struct nx_host_tx_ring *tx_ring;
 
         err = netxen_init_firmware(adapter);
-        if (err != 0) {
-                printk(KERN_ERR "Failed to init firmware\n");
-                return -EIO;
-        }
+        if (err)
+                return err;
+
+        err = netxen_napi_add(adapter, netdev);
+        if (err)
+                return err;
 
         if (adapter->fw_major < 4)
                 adapter->max_rds_rings = 3;
@@ -961,6 +975,7 @@ netxen_nic_detach(struct netxen_adapter *adapter)
         netxen_free_hw_resources(adapter);
         netxen_release_rx_buffers(adapter);
         netxen_nic_free_irq(adapter);
+        netxen_napi_del(adapter);
         netxen_free_sw_resources(adapter);
 
         adapter->is_up = 0;
@@ -1105,9 +1120,6 @@ netxen_nic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 
         netdev->irq = adapter->msix_entries[0].vector;
 
-        if (netxen_napi_add(adapter, netdev))
-                goto err_out_disable_msi;
-
         init_timer(&adapter->watchdog_timer);
         adapter->watchdog_timer.function = &netxen_watchdog;
         adapter->watchdog_timer.data = (unsigned long)adapter;
@@ -1177,6 +1189,9 @@ static void __devexit netxen_nic_remove(struct pci_dev *pdev)
 
         unregister_netdev(netdev);
 
+        cancel_work_sync(&adapter->watchdog_task);
+        cancel_work_sync(&adapter->tx_timeout_task);
+
         if (adapter->is_up == NETXEN_ADAPTER_UP_MAGIC) {
                 netxen_nic_detach(adapter);
         }
@@ -1185,7 +1200,6 @@ static void __devexit netxen_nic_remove(struct pci_dev *pdev)
                 netxen_free_adapter_offload(adapter);
 
         netxen_teardown_intr(adapter);
-        netxen_free_sds_rings(&adapter->recv_ctx);
 
         netxen_cleanup_pci_map(adapter);
 
@@ -1211,6 +1225,9 @@ netxen_nic_suspend(struct pci_dev *pdev, pm_message_t state)
         if (netif_running(netdev))
                 netxen_nic_down(adapter, netdev);
 
+        cancel_work_sync(&adapter->watchdog_task);
+        cancel_work_sync(&adapter->tx_timeout_task);
+
         if (adapter->is_up == NETXEN_ADAPTER_UP_MAGIC)
                 netxen_nic_detach(adapter);
 
@@ -1549,11 +1566,6 @@ static int netxen_nic_check_temp(struct netxen_adapter *adapter)
                        "%s: Device temperature %d degrees C exceeds"
                        " maximum allowed. Hardware has been shut down.\n",
                        netdev->name, temp_val);
-
-                netif_device_detach(netdev);
-                netxen_nic_down(adapter, netdev);
-                netxen_nic_detach(adapter);
-
                 rv = 1;
         } else if (temp_state == NX_TEMP_WARN) {
                 if (adapter->temp == NX_TEMP_NORMAL) {
@@ -1587,10 +1599,7 @@ void netxen_advert_link_change(struct netxen_adapter *adapter, int linkup)
                         netif_carrier_off(netdev);
                         netif_stop_queue(netdev);
                 }
-
-                if (!adapter->has_link_events)
-                        netxen_nic_set_link_parameters(adapter);
-
+                adapter->link_changed = !adapter->has_link_events;
         } else if (!adapter->ahw.linkup && linkup) {
                 printk(KERN_INFO "%s: %s NIC Link is up\n",
                        netxen_nic_driver_name, netdev->name);
@@ -1599,9 +1608,7 @@ void netxen_advert_link_change(struct netxen_adapter *adapter, int linkup)
                         netif_carrier_on(netdev);
                         netif_wake_queue(netdev);
                 }
-
-                if (!adapter->has_link_events)
-                        netxen_nic_set_link_parameters(adapter);
+                adapter->link_changed = !adapter->has_link_events;
         }
 }
 
@@ -1628,11 +1635,36 @@ static void netxen_nic_handle_phy_intr(struct netxen_adapter *adapter)
         netxen_advert_link_change(adapter, linkup);
 }
 
+static void netxen_nic_thermal_shutdown(struct netxen_adapter *adapter)
+{
+        struct net_device *netdev = adapter->netdev;
+
+        netif_device_detach(netdev);
+        netxen_nic_down(adapter, netdev);
+        netxen_nic_detach(adapter);
+}
+
 static void netxen_watchdog(unsigned long v)
 {
         struct netxen_adapter *adapter = (struct netxen_adapter *)v;
 
-        SCHEDULE_WORK(&adapter->watchdog_task);
+        if (netxen_nic_check_temp(adapter))
+                goto do_sched;
+
+        if (!adapter->has_link_events) {
+                netxen_nic_handle_phy_intr(adapter);
+
+                if (adapter->link_changed)
+                        goto do_sched;
+        }
+
+        if (netif_running(adapter->netdev))
+                mod_timer(&adapter->watchdog_timer, jiffies + 2 * HZ);
+
+        return;
+
+do_sched:
+        schedule_work(&adapter->watchdog_task);
 }
 
 void netxen_watchdog_task(struct work_struct *work)
@@ -1640,11 +1672,13 @@ void netxen_watchdog_task(struct work_struct *work)
         struct netxen_adapter *adapter =
                 container_of(work, struct netxen_adapter, watchdog_task);
 
-        if (netxen_nic_check_temp(adapter))
+        if (adapter->temp == NX_TEMP_PANIC) {
+                netxen_nic_thermal_shutdown(adapter);
                 return;
+        }
 
-        if (!adapter->has_link_events)
-                netxen_nic_handle_phy_intr(adapter);
+        if (adapter->link_changed)
+                netxen_nic_set_link_parameters(adapter);
 
         if (netif_running(adapter->netdev))
                 mod_timer(&adapter->watchdog_timer, jiffies + 2 * HZ);
@@ -1652,9 +1686,8 @@ void netxen_watchdog_task(struct work_struct *work)
 
 static void netxen_tx_timeout(struct net_device *netdev)
 {
-        struct netxen_adapter *adapter = (struct netxen_adapter *)
-                                                netdev_priv(netdev);
-        SCHEDULE_WORK(&adapter->tx_timeout_task);
+        struct netxen_adapter *adapter = netdev_priv(netdev);
+        schedule_work(&adapter->tx_timeout_task);
 }
 
 static void netxen_tx_timeout_task(struct work_struct *work)
@@ -1811,9 +1844,6 @@ static int __init netxen_init_module(void)
 {
         printk(KERN_INFO "%s\n", netxen_nic_driver_string);
 
-        if ((netxen_workq = create_singlethread_workqueue("netxen")) == NULL)
-                return -ENOMEM;
-
         return pci_register_driver(&netxen_driver);
 }
 
@@ -1822,7 +1852,6 @@ module_init(netxen_init_module);
 static void __exit netxen_exit_module(void)
 {
         pci_unregister_driver(&netxen_driver);
-        destroy_workqueue(netxen_workq);
 }
 
 module_exit(netxen_exit_module);
diff --git a/drivers/net/pcnet32.c b/drivers/net/pcnet32.c
index a646a445fda9..23e1a0750fe0 100644
--- a/drivers/net/pcnet32.c
+++ b/drivers/net/pcnet32.c
@@ -1839,7 +1839,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
         lp->chip_version = chip_version;
         lp->msg_enable = pcnet32_debug;
         if ((cards_found >= MAX_UNITS)
-            || (options[cards_found] > sizeof(options_mapping)))
+            || (options[cards_found] >= sizeof(options_mapping)))
                 lp->options = PCNET32_PORT_ASEL;
         else
                 lp->options = options_mapping[options[cards_found]];
diff --git a/drivers/net/tulip/tulip_core.c b/drivers/net/tulip/tulip_core.c
index 99a63649f4fc..4cf9a6588751 100644
--- a/drivers/net/tulip/tulip_core.c
+++ b/drivers/net/tulip/tulip_core.c
@@ -652,8 +652,9 @@ tulip_start_xmit(struct sk_buff *skb, struct net_device *dev)
         int entry;
         u32 flag;
         dma_addr_t mapping;
+        unsigned long flags;
 
-        spin_lock_irq(&tp->lock);
+        spin_lock_irqsave(&tp->lock, flags);
 
         /* Calculate the next Tx descriptor entry. */
         entry = tp->cur_tx % TX_RING_SIZE;
@@ -688,7 +689,7 @@ tulip_start_xmit(struct sk_buff *skb, struct net_device *dev)
         /* Trigger an immediate transmit demand. */
         iowrite32(0, tp->base_addr + CSR1);
 
-        spin_unlock_irq(&tp->lock);
+        spin_unlock_irqrestore(&tp->lock, flags);
 
         dev->trans_start = jiffies;
 
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 027f7aba26af..42b6c6319bc2 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -1048,20 +1048,15 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
         return err;
 }
 
-static int tun_get_iff(struct net *net, struct file *file, struct ifreq *ifr)
+static int tun_get_iff(struct net *net, struct tun_struct *tun,
+                       struct ifreq *ifr)
 {
-        struct tun_struct *tun = tun_get(file);
-
-        if (!tun)
-                return -EBADFD;
-
         DBG(KERN_INFO "%s: tun_get_iff\n", tun->dev->name);
 
         strcpy(ifr->ifr_name, tun->dev->name);
 
         ifr->ifr_flags = tun_flags(tun);
 
-        tun_put(tun);
         return 0;
 }
 
@@ -1105,8 +1100,8 @@ static int set_offload(struct net_device *dev, unsigned long arg)
         return 0;
 }
 
-static int tun_chr_ioctl(struct inode *inode, struct file *file,
-                         unsigned int cmd, unsigned long arg)
+static long tun_chr_ioctl(struct file *file, unsigned int cmd,
+                          unsigned long arg)
 {
         struct tun_file *tfile = file->private_data;
         struct tun_struct *tun;
@@ -1128,34 +1123,32 @@ static int tun_chr_ioctl(struct inode *inode, struct file *file,
                                 (unsigned int __user*)argp);
         }
 
+        rtnl_lock();
+
         tun = __tun_get(tfile);
         if (cmd == TUNSETIFF && !tun) {
-                int err;
-
                 ifr.ifr_name[IFNAMSIZ-1] = '\0';
 
-                rtnl_lock();
-                err = tun_set_iff(tfile->net, file, &ifr);
-                rtnl_unlock();
+                ret = tun_set_iff(tfile->net, file, &ifr);
 
-                if (err)
-                        return err;
+                if (ret)
+                        goto unlock;
 
                 if (copy_to_user(argp, &ifr, sizeof(ifr)))
-                        return -EFAULT;
-                return 0;
+                        ret = -EFAULT;
+                goto unlock;
         }
 
-
+        ret = -EBADFD;
         if (!tun)
-                return -EBADFD;
+                goto unlock;
 
         DBG(KERN_INFO "%s: tun_chr_ioctl cmd %d\n", tun->dev->name, cmd);
 
         ret = 0;
         switch (cmd) {
         case TUNGETIFF:
-                ret = tun_get_iff(current->nsproxy->net_ns, file, &ifr);
+                ret = tun_get_iff(current->nsproxy->net_ns, tun, &ifr);
                 if (ret)
                         break;
 
@@ -1201,7 +1194,6 @@ static int tun_chr_ioctl(struct inode *inode, struct file *file,
 
         case TUNSETLINK:
                 /* Only allow setting the type when the interface is down */
-                rtnl_lock();
                 if (tun->dev->flags & IFF_UP) {
                         DBG(KERN_INFO "%s: Linktype set failed because interface is up\n",
                                 tun->dev->name);
@@ -1211,7 +1203,6 @@ static int tun_chr_ioctl(struct inode *inode, struct file *file,
                         DBG(KERN_INFO "%s: linktype set to %d\n", tun->dev->name, tun->dev->type);
                         ret = 0;
                 }
-                rtnl_unlock();
                 break;
 
 #ifdef TUN_DEBUG
@@ -1220,9 +1211,7 @@ static int tun_chr_ioctl(struct inode *inode, struct file *file,
                 break;
 #endif
         case TUNSETOFFLOAD:
-                rtnl_lock();
                 ret = set_offload(tun->dev, arg);
-                rtnl_unlock();
                 break;
 
         case TUNSETTXFILTER:
@@ -1230,9 +1219,7 @@ static int tun_chr_ioctl(struct inode *inode, struct file *file,
                 ret = -EINVAL;
                 if ((tun->flags & TUN_TYPE_MASK) != TUN_TAP_DEV)
                         break;
-                rtnl_lock();
                 ret = update_filter(&tun->txflt, (void __user *)arg);
-                rtnl_unlock();
                 break;
 
         case SIOCGIFHWADDR:
@@ -1248,9 +1235,7 @@ static int tun_chr_ioctl(struct inode *inode, struct file *file,
                 DBG(KERN_DEBUG "%s: set hw address: %pM\n",
                         tun->dev->name, ifr.ifr_hwaddr.sa_data);
 
-                rtnl_lock();
                 ret = dev_set_mac_address(tun->dev, &ifr.ifr_hwaddr);
-                rtnl_unlock();
                 break;
 
         case TUNGETSNDBUF:
@@ -1273,7 +1258,10 @@ static int tun_chr_ioctl(struct inode *inode, struct file *file,
                 break;
         };
 
-        tun_put(tun);
+unlock:
+        rtnl_unlock();
+        if (tun)
+                tun_put(tun);
         return ret;
 }
 
@@ -1361,7 +1349,7 @@ static const struct file_operations tun_fops = {
         .write = do_sync_write,
         .aio_write = tun_chr_aio_write,
         .poll   = tun_chr_poll,
-        .ioctl  = tun_chr_ioctl,
+        .unlocked_ioctl = tun_chr_ioctl,
         .open   = tun_chr_open,
         .release = tun_chr_close,
         .fasync = tun_chr_fasync
diff --git a/drivers/net/ucc_geth.c b/drivers/net/ucc_geth.c
index 3b957e6412ee..8a7b8c7bd781 100644
--- a/drivers/net/ucc_geth.c
+++ b/drivers/net/ucc_geth.c
@@ -3111,10 +3111,11 @@ static int ucc_geth_start_xmit(struct sk_buff *skb, struct net_device *dev)
         u8 __iomem *bd;                 /* BD pointer */
         u32 bd_status;
         u8 txQ = 0;
+        unsigned long flags;
 
         ugeth_vdbg("%s: IN", __func__);
 
-        spin_lock_irq(&ugeth->lock);
+        spin_lock_irqsave(&ugeth->lock, flags);
 
         dev->stats.tx_bytes += skb->len;
 
@@ -3171,7 +3172,7 @@ static int ucc_geth_start_xmit(struct sk_buff *skb, struct net_device *dev)
         uccf = ugeth->uccf;
         out_be16(uccf->p_utodr, UCC_FAST_TOD);
 #endif
-        spin_unlock_irq(&ugeth->lock);
+        spin_unlock_irqrestore(&ugeth->lock, flags);
 
         return 0;
 }
diff --git a/drivers/net/usb/pegasus.h b/drivers/net/usb/pegasus.h
index c7467823cd1c..f968c834ff63 100644
--- a/drivers/net/usb/pegasus.h
+++ b/drivers/net/usb/pegasus.h
@@ -250,6 +250,8 @@ PEGASUS_DEV( "IO DATA USB ET/TX", VENDOR_IODATA, 0x0904,
                 DEFAULT_GPIO_RESET )
 PEGASUS_DEV( "IO DATA USB ET/TX-S", VENDOR_IODATA, 0x0913,
                 DEFAULT_GPIO_RESET | PEGASUS_II )
+PEGASUS_DEV( "IO DATA USB ETX-US2", VENDOR_IODATA, 0x092a,
+                DEFAULT_GPIO_RESET | PEGASUS_II )
 PEGASUS_DEV( "Kingston KNU101TX Ethernet", VENDOR_KINGSTON, 0x000a,
                 DEFAULT_GPIO_RESET)
 PEGASUS_DEV( "LANEED USB Ethernet LD-USB/TX", VENDOR_LANEED, 0x4002,
diff --git a/drivers/net/via-rhine.c b/drivers/net/via-rhine.c
index 88c30a58b4bd..934f7671650a 100644
--- a/drivers/net/via-rhine.c
+++ b/drivers/net/via-rhine.c
@@ -1218,6 +1218,7 @@ static int rhine_start_tx(struct sk_buff *skb, struct net_device *dev)
         struct rhine_private *rp = netdev_priv(dev);
         void __iomem *ioaddr = rp->base;
         unsigned entry;
+        unsigned long flags;
 
         /* Caution: the write order is important here, set the field
            with the "ownership" bits last. */
@@ -1261,7 +1262,7 @@ static int rhine_start_tx(struct sk_buff *skb, struct net_device *dev)
                 cpu_to_le32(TXDESC | (skb->len >= ETH_ZLEN ? skb->len : ETH_ZLEN));
 
         /* lock eth irq */
-        spin_lock_irq(&rp->lock);
+        spin_lock_irqsave(&rp->lock, flags);
         wmb();
         rp->tx_ring[entry].tx_status = cpu_to_le32(DescOwn);
         wmb();
@@ -1280,7 +1281,7 @@ static int rhine_start_tx(struct sk_buff *skb, struct net_device *dev)
 
         dev->trans_start = jiffies;
 
-        spin_unlock_irq(&rp->lock);
+        spin_unlock_irqrestore(&rp->lock, flags);
 
         if (debug > 4) {
                 printk(KERN_DEBUG "%s: Transmit frame #%d queued in slot %d.\n",
diff --git a/drivers/net/via-velocity.c b/drivers/net/via-velocity.c
index 3ba35956327a..cee08a1e497a 100644
--- a/drivers/net/via-velocity.c
+++ b/drivers/net/via-velocity.c
@@ -1778,7 +1778,7 @@ static void velocity_error(struct velocity_info *vptr, int status)
                          *       mode
                          */
                         if (vptr->rev_id < REV_ID_VT3216_A0) {
-                                if (vptr->mii_status | VELOCITY_DUPLEX_FULL)
+                                if (vptr->mii_status & VELOCITY_DUPLEX_FULL)
                                         BYTE_REG_BITS_ON(TCR_TB2BDIS, &regs->TCR);
                                 else
                                         BYTE_REG_BITS_OFF(TCR_TB2BDIS, &regs->TCR);
diff --git a/drivers/net/wireless/ath/ar9170/main.c b/drivers/net/wireless/ath/ar9170/main.c
index 9d38cf60a0db..88c3d8573869 100644
--- a/drivers/net/wireless/ath/ar9170/main.c
+++ b/drivers/net/wireless/ath/ar9170/main.c
@@ -1967,13 +1967,14 @@ static int ar9170_conf_tx(struct ieee80211_hw *hw, u16 queue,
         int ret;
 
         mutex_lock(&ar->mutex);
-        if ((param) && !(queue > __AR9170_NUM_TXQ)) {
+        if (queue < __AR9170_NUM_TXQ) {
                 memcpy(&ar->edcf[ar9170_qos_hwmap[queue]],
                        param, sizeof(*param));
 
                 ret = ar9170_set_qos(ar);
-        } else
+        } else {
                 ret = -EINVAL;
+        }
 
         mutex_unlock(&ar->mutex);
         return ret;
diff --git a/drivers/net/wireless/ath/ar9170/usb.c b/drivers/net/wireless/ath/ar9170/usb.c
index 754b1f8d8da9..007eb85fc67e 100644
--- a/drivers/net/wireless/ath/ar9170/usb.c
+++ b/drivers/net/wireless/ath/ar9170/usb.c
@@ -598,11 +598,15 @@ static int ar9170_usb_request_firmware(struct ar9170_usb *aru)
 
         err = request_firmware(&aru->init_values, "ar9170-1.fw",
                                &aru->udev->dev);
+        if (err) {
+                dev_err(&aru->udev->dev, "file with init values not found.\n");
+                return err;
+        }
 
         err = request_firmware(&aru->firmware, "ar9170-2.fw", &aru->udev->dev);
         if (err) {
                 release_firmware(aru->init_values);
-                dev_err(&aru->udev->dev, "file with init values not found.\n");
+                dev_err(&aru->udev->dev, "firmware file not found.\n");
                 return err;
         }
 
diff --git a/drivers/net/wireless/ipw2x00/ipw2200.c b/drivers/net/wireless/ipw2x00/ipw2200.c
index 44c29b3f6728..6dcac73b4d29 100644
--- a/drivers/net/wireless/ipw2x00/ipw2200.c
+++ b/drivers/net/wireless/ipw2x00/ipw2200.c
@@ -6226,7 +6226,7 @@ static void ipw_add_scan_channels(struct ipw_priv *priv,
                         };
 
                         u8 channel;
-                        while (channel_index < IPW_SCAN_CHANNELS) {
+                        while (channel_index < IPW_SCAN_CHANNELS - 1) {
                                 channel =
                                     priv->speed_scan[priv->speed_scan_pos];
                                 if (channel == 0) {
diff --git a/drivers/net/wireless/libertas/assoc.c b/drivers/net/wireless/libertas/assoc.c
index d6997371c27e..b9b374119033 100644
--- a/drivers/net/wireless/libertas/assoc.c
+++ b/drivers/net/wireless/libertas/assoc.c
@@ -1,7 +1,6 @@
 /* Copyright (C) 2006, Red Hat, Inc. */
 
 #include <linux/types.h>
-#include <linux/kernel.h>
 #include <linux/etherdevice.h>
 #include <linux/ieee80211.h>
 #include <linux/if_arp.h>
@@ -44,21 +43,21 @@ static int get_common_rates(struct lbs_private *priv,
         u16 *rates_size)
 {
         u8 *card_rates = lbs_bg_rates;
+        size_t num_card_rates = sizeof(lbs_bg_rates);
         int ret = 0, i, j;
-        u8 tmp[(ARRAY_SIZE(lbs_bg_rates) - 1) * (*rates_size - 1)];
+        u8 tmp[30];
         size_t tmp_size = 0;
 
         /* For each rate in card_rates that exists in rate1, copy to tmp */
-        for (i = 0; i < ARRAY_SIZE(lbs_bg_rates) && card_rates[i]; i++) {
-                for (j = 0; j < *rates_size && rates[j]; j++) {
+        for (i = 0; card_rates[i] && (i < num_card_rates); i++) {
+                for (j = 0; rates[j] && (j < *rates_size); j++) {
                         if (rates[j] == card_rates[i])
                                 tmp[tmp_size++] = card_rates[i];
                 }
         }
 
         lbs_deb_hex(LBS_DEB_JOIN, "AP rates    ", rates, *rates_size);
-        lbs_deb_hex(LBS_DEB_JOIN, "card rates  ", card_rates,
-                        ARRAY_SIZE(lbs_bg_rates));
+        lbs_deb_hex(LBS_DEB_JOIN, "card rates  ", card_rates, num_card_rates);
         lbs_deb_hex(LBS_DEB_JOIN, "common rates", tmp, tmp_size);
         lbs_deb_join("TX data rate 0x%02x\n", priv->cur_rate);
 
@@ -70,7 +69,10 @@ static int get_common_rates(struct lbs_private *priv,
                 lbs_pr_alert("Previously set fixed data rate %#x isn't "
                        "compatible with the network.\n", priv->cur_rate);
                 ret = -1;
+                goto done;
         }
+        ret = 0;
+
 done:
         memset(rates, 0, *rates_size);
         *rates_size = min_t(int, tmp_size, *rates_size);
@@ -320,7 +322,7 @@ static int lbs_associate(struct lbs_private *priv,
         rates = (struct mrvl_ie_rates_param_set *) pos;
         rates->header.type = cpu_to_le16(TLV_TYPE_RATES);
         memcpy(&rates->rates, &bss->rates, MAX_RATES);
-        tmplen = min_t(u16, ARRAY_SIZE(rates->rates), MAX_RATES);
+        tmplen = MAX_RATES;
         if (get_common_rates(priv, rates->rates, &tmplen)) {
                 ret = -1;
                 goto done;
@@ -596,7 +598,7 @@ static int lbs_adhoc_join(struct lbs_private *priv,
 
         /* Copy Data rates from the rates recorded in scan response */
         memset(cmd.bss.rates, 0, sizeof(cmd.bss.rates));
-        ratesize = min_t(u16, ARRAY_SIZE(cmd.bss.rates), MAX_RATES);
+        ratesize = min_t(u16, sizeof(cmd.bss.rates), MAX_RATES);
         memcpy(cmd.bss.rates, bss->rates, ratesize);
         if (get_common_rates(priv, cmd.bss.rates, &ratesize)) {
                 lbs_deb_join("ADHOC_JOIN: get_common_rates returned error.\n");
diff --git a/drivers/net/wireless/libertas/hostcmd.h b/drivers/net/wireless/libertas/hostcmd.h
index 0a2e29140add..c8a1998d4744 100644
--- a/drivers/net/wireless/libertas/hostcmd.h
+++ b/drivers/net/wireless/libertas/hostcmd.h
@@ -56,8 +56,8 @@ struct rxpd {
                         u8 bss_type;
                         /* BSS number */
                         u8 bss_num;
-                } bss;
-        } u;
+                } __attribute__ ((packed)) bss;
+        } __attribute__ ((packed)) u;
 
         /* SNR */
         u8 snr;
diff --git a/drivers/net/wireless/mwl8k.c b/drivers/net/wireless/mwl8k.c
index a263d5c84c08..83967afe0821 100644
--- a/drivers/net/wireless/mwl8k.c
+++ b/drivers/net/wireless/mwl8k.c
@@ -261,7 +261,7 @@ struct mwl8k_vif {
          */
 };
 
-#define MWL8K_VIF(_vif) (struct mwl8k_vif *)(&((_vif)->drv_priv))
+#define MWL8K_VIF(_vif) ((struct mwl8k_vif *)&((_vif)->drv_priv))
 
 static const struct ieee80211_channel mwl8k_channels[] = {
         { .center_freq = 2412, .hw_value = 1, },
@@ -1012,6 +1012,8 @@ static int rxq_process(struct ieee80211_hw *hw, int index, int limit)
                 rmb();
 
                 skb = rxq->rx_skb[rxq->rx_head];
+                if (skb == NULL)
+                        break;
                 rxq->rx_skb[rxq->rx_head] = NULL;
 
                 rxq->rx_head = (rxq->rx_head + 1) % MWL8K_RX_DESCS;
@@ -1591,6 +1593,9 @@ static int mwl8k_post_cmd(struct ieee80211_hw *hw, struct mwl8k_cmd_pkt *cmd)
         timeout = wait_for_completion_timeout(&cmd_wait,
                                 msecs_to_jiffies(MWL8K_CMD_TIMEOUT_MS));
 
+        pci_unmap_single(priv->pdev, dma_addr, dma_size,
+                                        PCI_DMA_BIDIRECTIONAL);
+
         result = &cmd->result;
         if (!timeout) {
                 spin_lock_irq(&priv->fw_lock);
@@ -1610,8 +1615,6 @@ static int mwl8k_post_cmd(struct ieee80211_hw *hw, struct mwl8k_cmd_pkt *cmd)
                                *result);
         }
 
-        pci_unmap_single(priv->pdev, dma_addr, dma_size,
-                                        PCI_DMA_BIDIRECTIONAL);
         return rc;
 }
 
@@ -1654,18 +1657,18 @@ static int mwl8k_cmd_get_hw_spec(struct ieee80211_hw *hw)
         memset(cmd->perm_addr, 0xff, sizeof(cmd->perm_addr));
         cmd->ps_cookie = cpu_to_le32(priv->cookie_dma);
         cmd->rx_queue_ptr = cpu_to_le32(priv->rxq[0].rx_desc_dma);
-        cmd->num_tx_queues = MWL8K_TX_QUEUES;
+        cmd->num_tx_queues = cpu_to_le32(MWL8K_TX_QUEUES);
         for (i = 0; i < MWL8K_TX_QUEUES; i++)
                 cmd->tx_queue_ptrs[i] = cpu_to_le32(priv->txq[i].tx_desc_dma);
-        cmd->num_tx_desc_per_queue = MWL8K_TX_DESCS;
-        cmd->total_rx_desc = MWL8K_RX_DESCS;
+        cmd->num_tx_desc_per_queue = cpu_to_le32(MWL8K_TX_DESCS);
+        cmd->total_rx_desc = cpu_to_le32(MWL8K_RX_DESCS);
 
         rc = mwl8k_post_cmd(hw, &cmd->header);
 
         if (!rc) {
                 SET_IEEE80211_PERM_ADDR(hw, cmd->perm_addr);
                 priv->num_mcaddrs = le16_to_cpu(cmd->num_mcaddrs);
-                priv->fw_rev = cmd->fw_rev;
+                priv->fw_rev = le32_to_cpu(cmd->fw_rev);
                 priv->hw_rev = cmd->hw_rev;
                 priv->region_code = le16_to_cpu(cmd->region_code);
         }
@@ -3216,15 +3219,19 @@ static int mwl8k_configure_filter_wt(struct work_struct *wt)
         struct dev_addr_list *mclist = worker->mclist;
 
         struct mwl8k_priv *priv = hw->priv;
-        struct mwl8k_vif *mv_vif;
         int rc = 0;
 
         if (changed_flags & FIF_BCN_PRBRESP_PROMISC) {
                 if (*total_flags & FIF_BCN_PRBRESP_PROMISC)
                         rc = mwl8k_cmd_set_pre_scan(hw);
                 else {
-                        mv_vif = MWL8K_VIF(priv->vif);
-                        rc = mwl8k_cmd_set_post_scan(hw, mv_vif->bssid);
+                        u8 *bssid;
+
+                        bssid = "\x00\x00\x00\x00\x00\x00";
+                        if (priv->vif != NULL)
+                                bssid = MWL8K_VIF(priv->vif)->bssid;
+
+                        rc = mwl8k_cmd_set_post_scan(hw, bssid);
                 }
         }
 
@@ -3726,6 +3733,8 @@ static void __devexit mwl8k_remove(struct pci_dev *pdev)
 
         ieee80211_stop_queues(hw);
 
+        ieee80211_unregister_hw(hw);
+
         /* Remove tx reclaim tasklet */
         tasklet_kill(&priv->tx_reclaim_task);
 
@@ -3739,8 +3748,6 @@ static void __devexit mwl8k_remove(struct pci_dev *pdev)
         for (i = 0; i < MWL8K_TX_QUEUES; i++)
                 mwl8k_txq_reclaim(hw, i, 1);
 
-        ieee80211_unregister_hw(hw);
-
         for (i = 0; i < MWL8K_TX_QUEUES; i++)
                 mwl8k_txq_deinit(hw, i);
 
diff --git a/drivers/net/wireless/rt2x00/rt2x00.h b/drivers/net/wireless/rt2x00/rt2x00.h
index a498dde024e1..49c9e2c1433d 100644
--- a/drivers/net/wireless/rt2x00/rt2x00.h
+++ b/drivers/net/wireless/rt2x00/rt2x00.h
@@ -849,13 +849,15 @@ struct rt2x00_dev {
 static inline void rt2x00_rf_read(struct rt2x00_dev *rt2x00dev,
                                   const unsigned int word, u32 *data)
 {
-        *data = rt2x00dev->rf[word];
+        BUG_ON(word < 1 || word > rt2x00dev->ops->rf_size / sizeof(u32));
+        *data = rt2x00dev->rf[word - 1];
 }
 
 static inline void rt2x00_rf_write(struct rt2x00_dev *rt2x00dev,
                                    const unsigned int word, u32 data)
 {
-        rt2x00dev->rf[word] = data;
+        BUG_ON(word < 1 || word > rt2x00dev->ops->rf_size / sizeof(u32));
+        rt2x00dev->rf[word - 1] = data;
 }
 
 /*
diff --git a/drivers/net/zorro8390.c b/drivers/net/zorro8390.c
index 37c84e3b8be0..81c753a617ab 100644
--- a/drivers/net/zorro8390.c
+++ b/drivers/net/zorro8390.c
@@ -120,6 +120,9 @@ static int __devinit zorro8390_init_one(struct zorro_dev *z,
     for (i = ARRAY_SIZE(cards)-1; i >= 0; i--)
         if (z->id == cards[i].id)
             break;
+    if (i < 0)
+        return -ENODEV;
+
     board = z->resource.start;
     ioaddr = board+cards[i].offset;
     dev = alloc_ei_netdev();
diff --git a/include/linux/gen_stats.h b/include/linux/gen_stats.h
index 0ffa41df0ee8..710e901085d0 100644
--- a/include/linux/gen_stats.h
+++ b/include/linux/gen_stats.h
@@ -22,6 +22,11 @@ struct gnet_stats_basic
 {
         __u64   bytes;
         __u32   packets;
+};
+struct gnet_stats_basic_packed
+{
+        __u64   bytes;
+        __u32   packets;
 } __attribute__ ((packed));
 
 /**
diff --git a/include/net/act_api.h b/include/net/act_api.h
index 565eed8fe496..c05fd717c588 100644
--- a/include/net/act_api.h
+++ b/include/net/act_api.h
@@ -16,7 +16,7 @@ struct tcf_common {
         u32                             tcfc_capab;
         int                             tcfc_action;
         struct tcf_t                    tcfc_tm;
-        struct gnet_stats_basic         tcfc_bstats;
+        struct gnet_stats_basic_packed  tcfc_bstats;
         struct gnet_stats_queue         tcfc_qstats;
         struct gnet_stats_rate_est      tcfc_rate_est;
         spinlock_t                      tcfc_lock;
diff --git a/include/net/gen_stats.h b/include/net/gen_stats.h
index d136b5240ef2..c1488553e349 100644
--- a/include/net/gen_stats.h
+++ b/include/net/gen_stats.h
@@ -28,7 +28,7 @@ extern int gnet_stats_start_copy_compat(struct sk_buff *skb, int type,
                                         spinlock_t *lock, struct gnet_dump *d);
 
 extern int gnet_stats_copy_basic(struct gnet_dump *d,
-                                 struct gnet_stats_basic *b);
+                                 struct gnet_stats_basic_packed *b);
 extern int gnet_stats_copy_rate_est(struct gnet_dump *d,
                                     struct gnet_stats_rate_est *r);
 extern int gnet_stats_copy_queue(struct gnet_dump *d,
@@ -37,14 +37,14 @@ extern int gnet_stats_copy_app(struct gnet_dump *d, void *st, int len);
 
 extern int gnet_stats_finish_copy(struct gnet_dump *d);
 
-extern int gen_new_estimator(struct gnet_stats_basic *bstats,
+extern int gen_new_estimator(struct gnet_stats_basic_packed *bstats,
                              struct gnet_stats_rate_est *rate_est,
                              spinlock_t *stats_lock, struct nlattr *opt);
-extern void gen_kill_estimator(struct gnet_stats_basic *bstats,
+extern void gen_kill_estimator(struct gnet_stats_basic_packed *bstats,
                                struct gnet_stats_rate_est *rate_est);
-extern int gen_replace_estimator(struct gnet_stats_basic *bstats,
+extern int gen_replace_estimator(struct gnet_stats_basic_packed *bstats,
                                  struct gnet_stats_rate_est *rate_est,
                                  spinlock_t *stats_lock, struct nlattr *opt);
-extern bool gen_estimator_active(const struct gnet_stats_basic *bstats,
+extern bool gen_estimator_active(const struct gnet_stats_basic_packed *bstats,
                                  const struct gnet_stats_rate_est *rate_est);
 #endif
diff --git a/include/net/netfilter/xt_rateest.h b/include/net/netfilter/xt_rateest.h
index 65d594dffbff..ddbf37e19616 100644
--- a/include/net/netfilter/xt_rateest.h
+++ b/include/net/netfilter/xt_rateest.h
@@ -8,7 +8,7 @@ struct xt_rateest {
         spinlock_t                      lock;
         struct gnet_estimator           params;
         struct gnet_stats_rate_est      rstats;
-        struct gnet_stats_basic         bstats;
+        struct gnet_stats_basic_packed  bstats;
 };
 
 extern struct xt_rateest *xt_rateest_lookup(const char *name);
diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h
index 964ffa0d8815..5482e9582f55 100644
--- a/include/net/sch_generic.h
+++ b/include/net/sch_generic.h
@@ -72,7 +72,7 @@ struct Qdisc
          */
         unsigned long           state;
         struct sk_buff_head     q;
-        struct gnet_stats_basic bstats;
+        struct gnet_stats_basic_packed bstats;
         struct gnet_stats_queue qstats;
 };
 
diff --git a/net/appletalk/ddp.c b/net/appletalk/ddp.c
index bfbe13786bb4..875eda5dbad7 100644
--- a/net/appletalk/ddp.c
+++ b/net/appletalk/ddp.c
@@ -1238,6 +1238,7 @@ static int atalk_getname(struct socket *sock, struct sockaddr *uaddr,
                         return -ENOBUFS;
 
         *uaddr_len = sizeof(struct sockaddr_at);
+        memset(&sat.sat_zero, 0, sizeof(sat.sat_zero));
 
         if (peer) {
                 if (sk->sk_state != TCP_ESTABLISHED)
diff --git a/net/can/raw.c b/net/can/raw.c
index f4cc44548bda..db3152df7d2b 100644
--- a/net/can/raw.c
+++ b/net/can/raw.c
@@ -401,6 +401,7 @@ static int raw_getname(struct socket *sock, struct sockaddr *uaddr,
         if (peer)
                 return -EOPNOTSUPP;
 
+        memset(addr, 0, sizeof(*addr));
         addr->can_family  = AF_CAN;
         addr->can_ifindex = ro->ifindex;
 
diff --git a/net/core/gen_estimator.c b/net/core/gen_estimator.c
index 78e5bfc454ae..493775f4f2f1 100644
--- a/net/core/gen_estimator.c
+++ b/net/core/gen_estimator.c
@@ -81,7 +81,7 @@
 struct gen_estimator
 {
         struct list_head        list;
-        struct gnet_stats_basic *bstats;
+        struct gnet_stats_basic_packed  *bstats;
         struct gnet_stats_rate_est      *rate_est;
         spinlock_t              *stats_lock;
         int                     ewma_log;
@@ -165,7 +165,7 @@ static void gen_add_node(struct gen_estimator *est)
 }
 
 static
-struct gen_estimator *gen_find_node(const struct gnet_stats_basic *bstats,
+struct gen_estimator *gen_find_node(const struct gnet_stats_basic_packed *bstats,
                                     const struct gnet_stats_rate_est *rate_est)
 {
         struct rb_node *p = est_root.rb_node;
@@ -202,7 +202,7 @@ struct gen_estimator *gen_find_node(const struct gnet_stats_basic *bstats,
  *
  * NOTE: Called under rtnl_mutex
  */
-int gen_new_estimator(struct gnet_stats_basic *bstats,
+int gen_new_estimator(struct gnet_stats_basic_packed *bstats,
                       struct gnet_stats_rate_est *rate_est,
                       spinlock_t *stats_lock,
                       struct nlattr *opt)
@@ -262,7 +262,7 @@ static void __gen_kill_estimator(struct rcu_head *head)
  *
  * NOTE: Called under rtnl_mutex
  */
-void gen_kill_estimator(struct gnet_stats_basic *bstats,
+void gen_kill_estimator(struct gnet_stats_basic_packed *bstats,
                         struct gnet_stats_rate_est *rate_est)
 {
         struct gen_estimator *e;
@@ -292,7 +292,7 @@ EXPORT_SYMBOL(gen_kill_estimator);
  *
  * Returns 0 on success or a negative error code.
  */
-int gen_replace_estimator(struct gnet_stats_basic *bstats,
+int gen_replace_estimator(struct gnet_stats_basic_packed *bstats,
                           struct gnet_stats_rate_est *rate_est,
                           spinlock_t *stats_lock, struct nlattr *opt)
 {
@@ -308,7 +308,7 @@ EXPORT_SYMBOL(gen_replace_estimator);
  *
  * Returns true if estimator is active, and false if not.
  */
-bool gen_estimator_active(const struct gnet_stats_basic *bstats,
+bool gen_estimator_active(const struct gnet_stats_basic_packed *bstats,
                           const struct gnet_stats_rate_est *rate_est)
 {
         ASSERT_RTNL();
diff --git a/net/core/gen_stats.c b/net/core/gen_stats.c
index c3d0ffeac243..8569310268ab 100644
--- a/net/core/gen_stats.c
+++ b/net/core/gen_stats.c
@@ -106,16 +106,21 @@ gnet_stats_start_copy(struct sk_buff *skb, int type, spinlock_t *lock,
  * if the room in the socket buffer was not sufficient.
  */
 int
-gnet_stats_copy_basic(struct gnet_dump *d, struct gnet_stats_basic *b)
+gnet_stats_copy_basic(struct gnet_dump *d, struct gnet_stats_basic_packed *b)
 {
         if (d->compat_tc_stats) {
                 d->tc_stats.bytes = b->bytes;
                 d->tc_stats.packets = b->packets;
         }
 
-        if (d->tail)
-                return gnet_stats_copy(d, TCA_STATS_BASIC, b, sizeof(*b));
+        if (d->tail) {
+                struct gnet_stats_basic sb;
 
+                memset(&sb, 0, sizeof(sb));
+                sb.bytes = b->bytes;
+                sb.packets = b->packets;
+                return gnet_stats_copy(d, TCA_STATS_BASIC, &sb, sizeof(sb));
+        }
         return 0;
 }
 
diff --git a/net/dccp/proto.c b/net/dccp/proto.c
index 3281013ce038..1bca9205104e 100644
--- a/net/dccp/proto.c
+++ b/net/dccp/proto.c
@@ -1159,6 +1159,7 @@ static void __exit dccp_fini(void)
         kmem_cache_destroy(dccp_hashinfo.bind_bucket_cachep);
         dccp_ackvec_exit();
         dccp_sysctl_exit();
+        percpu_counter_destroy(&dccp_orphan_count);
 }
 
 module_init(dccp_init);
diff --git a/net/econet/af_econet.c b/net/econet/af_econet.c
index 2e1f836d4240..f0bbc57926cd 100644
--- a/net/econet/af_econet.c
+++ b/net/econet/af_econet.c
@@ -520,6 +520,7 @@ static int econet_getname(struct socket *sock, struct sockaddr *uaddr,
         if (peer)
                 return -EOPNOTSUPP;
 
+        memset(sec, 0, sizeof(*sec));
         mutex_lock(&econet_mutex);
 
         sk = sock->sk;
diff --git a/net/ieee802154/af_ieee802154.c b/net/ieee802154/af_ieee802154.c
index 3bb6bdb1dac1..af661805b9fa 100644
--- a/net/ieee802154/af_ieee802154.c
+++ b/net/ieee802154/af_ieee802154.c
@@ -136,7 +136,7 @@ static int ieee802154_dev_ioctl(struct sock *sk, struct ifreq __user *arg,
                 unsigned int cmd)
 {
         struct ifreq ifr;
-        int ret = -EINVAL;
+        int ret = -ENOIOCTLCMD;
         struct net_device *dev;
 
         if (copy_from_user(&ifr, arg, sizeof(struct ifreq)))
@@ -146,8 +146,10 @@ static int ieee802154_dev_ioctl(struct sock *sk, struct ifreq __user *arg,
 
         dev_load(sock_net(sk), ifr.ifr_name);
         dev = dev_get_by_name(sock_net(sk), ifr.ifr_name);
-        if (dev->type == ARPHRD_IEEE802154 ||
-            dev->type == ARPHRD_IEEE802154_PHY)
+
+        if ((dev->type == ARPHRD_IEEE802154 ||
+             dev->type == ARPHRD_IEEE802154_PHY) &&
+            dev->netdev_ops->ndo_do_ioctl)
                 ret = dev->netdev_ops->ndo_do_ioctl(dev, &ifr, cmd);
 
         if (!ret && copy_to_user(arg, &ifr, sizeof(struct ifreq)))
diff --git a/net/ieee802154/dgram.c b/net/ieee802154/dgram.c
index 14d39840dd62..ba8b214dda8f 100644
--- a/net/ieee802154/dgram.c
+++ b/net/ieee802154/dgram.c
@@ -377,6 +377,18 @@ int ieee802154_dgram_deliver(struct net_device *dev, struct sk_buff *skb)
         return ret;
 }
 
+static int dgram_getsockopt(struct sock *sk, int level, int optname,
+                    char __user *optval, int __user *optlen)
+{
+        return -EOPNOTSUPP;
+}
+
+static int dgram_setsockopt(struct sock *sk, int level, int optname,
+                    char __user *optval, int __user optlen)
+{
+        return -EOPNOTSUPP;
+}
+
 struct proto ieee802154_dgram_prot = {
         .name           = "IEEE-802.15.4-MAC",
         .owner          = THIS_MODULE,
@@ -391,5 +403,7 @@ struct proto ieee802154_dgram_prot = {
         .connect        = dgram_connect,
         .disconnect     = dgram_disconnect,
         .ioctl          = dgram_ioctl,
+        .getsockopt     = dgram_getsockopt,
+        .setsockopt     = dgram_setsockopt,
 };
 
diff --git a/net/ieee802154/raw.c b/net/ieee802154/raw.c
index fca44d59f97e..9315977c4c61 100644
--- a/net/ieee802154/raw.c
+++ b/net/ieee802154/raw.c
@@ -238,6 +238,18 @@ void ieee802154_raw_deliver(struct net_device *dev, struct sk_buff *skb)
         read_unlock(&raw_lock);
 }
 
+static int raw_getsockopt(struct sock *sk, int level, int optname,
+                    char __user *optval, int __user *optlen)
+{
+        return -EOPNOTSUPP;
+}
+
+static int raw_setsockopt(struct sock *sk, int level, int optname,
+                    char __user *optval, int __user optlen)
+{
+        return -EOPNOTSUPP;
+}
+
 struct proto ieee802154_raw_prot = {
         .name           = "IEEE-802.15.4-RAW",
         .owner          = THIS_MODULE,
@@ -250,5 +262,7 @@ struct proto ieee802154_raw_prot = {
         .unhash         = raw_unhash,
         .connect        = raw_connect,
         .disconnect     = raw_disconnect,
+        .getsockopt     = raw_getsockopt,
+        .setsockopt     = raw_setsockopt,
 };
 
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index cb4a0f4bd5e5..82c11dd10a62 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -951,7 +951,7 @@ static int ipgre_tunnel_bind_dev(struct net_device *dev)
                         addend += 4;
         }
         dev->needed_headroom = addend + hlen;
-        mtu -= dev->hard_header_len - addend;
+        mtu -= dev->hard_header_len + addend;
 
         if (mtu < 68)
                 mtu = 68;
diff --git a/net/irda/af_irda.c b/net/irda/af_irda.c
index 80cf29aae096..50b43c57d5d8 100644
--- a/net/irda/af_irda.c
+++ b/net/irda/af_irda.c
@@ -715,6 +715,7 @@ static int irda_getname(struct socket *sock, struct sockaddr *uaddr,
         struct sock *sk = sock->sk;
         struct irda_sock *self = irda_sk(sk);
 
+        memset(&saddr, 0, sizeof(saddr));
         if (peer) {
                 if (sk->sk_state != TCP_ESTABLISHED)
                         return -ENOTCONN;
diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
index 9e5762ad307d..a24e59816b93 100644
--- a/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
@@ -381,6 +381,14 @@ static void ieee80211_agg_splice_packets(struct ieee80211_local *local,
                 &local->hw, queue,
                 IEEE80211_QUEUE_STOP_REASON_AGGREGATION);
 
+        if (!(sta->ampdu_mlme.tid_state_tx[tid] & HT_ADDBA_REQUESTED_MSK))
+                return;
+
+        if (WARN(!sta->ampdu_mlme.tid_tx[tid],
+                 "TID %d gone but expected when splicing aggregates from"
+                 "the pending queue\n", tid))
+                return;
+
         if (!skb_queue_empty(&sta->ampdu_mlme.tid_tx[tid]->pending)) {
                 spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
                 /* mark queue as pending, it is stopped already */
diff --git a/net/netfilter/xt_RATEEST.c b/net/netfilter/xt_RATEEST.c
index 43f5676b1af4..d80b8192e0d4 100644
--- a/net/netfilter/xt_RATEEST.c
+++ b/net/netfilter/xt_RATEEST.c
@@ -74,7 +74,7 @@ static unsigned int
 xt_rateest_tg(struct sk_buff *skb, const struct xt_target_param *par)
 {
         const struct xt_rateest_target_info *info = par->targinfo;
-        struct gnet_stats_basic *stats = &info->est->bstats;
+        struct gnet_stats_basic_packed *stats = &info->est->bstats;
 
         spin_lock_bh(&info->est->lock);
         stats->bytes += skb->len;
diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
index ce51ce012cda..ce1a34b99c23 100644
--- a/net/netrom/af_netrom.c
+++ b/net/netrom/af_netrom.c
@@ -847,6 +847,7 @@ static int nr_getname(struct socket *sock, struct sockaddr *uaddr,
                 sax->fsa_ax25.sax25_family = AF_NETROM;
                 sax->fsa_ax25.sax25_ndigis = 1;
                 sax->fsa_ax25.sax25_call   = nr->user_addr;
+                memset(sax->fsa_digipeater, 0, sizeof(sax->fsa_digipeater));
                 sax->fsa_digipeater[0]     = nr->dest_addr;
                 *uaddr_len = sizeof(struct full_sockaddr_ax25);
         } else {
diff --git a/net/netrom/nr_route.c b/net/netrom/nr_route.c
index e943c16552a2..4eb1ac9a7679 100644
--- a/net/netrom/nr_route.c
+++ b/net/netrom/nr_route.c
@@ -630,23 +630,23 @@ out:
         return dev;
 }
 
-static ax25_digi *nr_call_to_digi(int ndigis, ax25_address *digipeaters)
+static ax25_digi *nr_call_to_digi(ax25_digi *digi, int ndigis,
+        ax25_address *digipeaters)
 {
-        static ax25_digi ax25_digi;
         int i;
 
         if (ndigis == 0)
                 return NULL;
 
         for (i = 0; i < ndigis; i++) {
-                ax25_digi.calls[i]    = digipeaters[i];
-                ax25_digi.repeated[i] = 0;
+                digi->calls[i]    = digipeaters[i];
+                digi->repeated[i] = 0;
         }
 
-        ax25_digi.ndigi      = ndigis;
-        ax25_digi.lastrepeat = -1;
+        digi->ndigi      = ndigis;
+        digi->lastrepeat = -1;
 
-        return &ax25_digi;
+        return digi;
 }
 
 /*
@@ -656,6 +656,7 @@ int nr_rt_ioctl(unsigned int cmd, void __user *arg)
 {
         struct nr_route_struct nr_route;
         struct net_device *dev;
+        ax25_digi digi;
         int ret;
 
         switch (cmd) {
@@ -673,13 +674,15 @@ int nr_rt_ioctl(unsigned int cmd, void __user *arg)
                         ret = nr_add_node(&nr_route.callsign,
                                 nr_route.mnemonic,
                                 &nr_route.neighbour,
-                                nr_call_to_digi(nr_route.ndigis, nr_route.digipeaters),
+                                nr_call_to_digi(&digi, nr_route.ndigis,
+                                                nr_route.digipeaters),
                                 dev, nr_route.quality,
                                 nr_route.obs_count);
                         break;
                 case NETROM_NEIGH:
                         ret = nr_add_neigh(&nr_route.callsign,
-                                nr_call_to_digi(nr_route.ndigis, nr_route.digipeaters),
+                                nr_call_to_digi(&digi, nr_route.ndigis,
+                                                nr_route.digipeaters),
                                 dev, nr_route.quality);
                         break;
                 default:
diff --git a/net/phonet/pn_dev.c b/net/phonet/pn_dev.c
index b0d6ddd82a9d..c2b77a698695 100644
--- a/net/phonet/pn_dev.c
+++ b/net/phonet/pn_dev.c
@@ -96,7 +96,7 @@ struct net_device *phonet_device_get(struct net *net)
 {
         struct phonet_device_list *pndevs = phonet_device_list(net);
         struct phonet_device *pnd;
-        struct net_device *dev;
+        struct net_device *dev = NULL;
 
         spin_lock_bh(&pndevs->lock);
         list_for_each_entry(pnd, &pndevs->list, list) {
diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index f0a76f6bca71..e5f478ca3d61 100644
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -954,6 +954,7 @@ static int rose_getname(struct socket *sock, struct sockaddr *uaddr,
         struct rose_sock *rose = rose_sk(sk);
         int n;
 
+        memset(srose, 0, sizeof(*srose));
         if (peer != 0) {
                 if (sk->sk_state != TCP_ESTABLISHED)
                         return -ENOTCONN;
diff --git a/net/sched/sch_atm.c b/net/sched/sch_atm.c
index 2a8b83af7c47..ab82f145f689 100644
--- a/net/sched/sch_atm.c
+++ b/net/sched/sch_atm.c
@@ -49,7 +49,7 @@ struct atm_flow_data {
         struct socket           *sock;          /* for closing */
         u32                     classid;        /* x:y type ID */
         int                     ref;            /* reference count */
-        struct gnet_stats_basic bstats;
+        struct gnet_stats_basic_packed  bstats;
         struct gnet_stats_queue qstats;
         struct atm_flow_data    *next;
         struct atm_flow_data    *excess;        /* flow for excess traffic;
diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c
index 23a167670fd5..d5798e17a832 100644
--- a/net/sched/sch_cbq.c
+++ b/net/sched/sch_cbq.c
@@ -128,7 +128,7 @@ struct cbq_class
         long                    avgidle;
         long                    deficit;        /* Saved deficit for WRR */
         psched_time_t           penalized;
-        struct gnet_stats_basic bstats;
+        struct gnet_stats_basic_packed bstats;
         struct gnet_stats_queue qstats;
         struct gnet_stats_rate_est rate_est;
         struct tc_cbq_xstats    xstats;
diff --git a/net/sched/sch_drr.c b/net/sched/sch_drr.c
index 7597fe146866..12b2fb04b29b 100644
--- a/net/sched/sch_drr.c
+++ b/net/sched/sch_drr.c
@@ -22,7 +22,7 @@ struct drr_class {
         unsigned int                    refcnt;
         unsigned int                    filter_cnt;
 
-        struct gnet_stats_basic         bstats;
+        struct gnet_stats_basic_packed          bstats;
         struct gnet_stats_queue         qstats;
         struct gnet_stats_rate_est      rate_est;
         struct list_head                alist;
diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c
index 362c2811b2df..dad0144423da 100644
--- a/net/sched/sch_hfsc.c
+++ b/net/sched/sch_hfsc.c
@@ -116,7 +116,7 @@ struct hfsc_class
         struct Qdisc_class_common cl_common;
         unsigned int    refcnt;         /* usage count */
 
-        struct gnet_stats_basic bstats;
+        struct gnet_stats_basic_packed bstats;
         struct gnet_stats_queue qstats;
         struct gnet_stats_rate_est rate_est;
         unsigned int    level;          /* class level in hierarchy */
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index 88cd02626621..ec4d46399d59 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -74,7 +74,7 @@ enum htb_cmode {
 struct htb_class {
         struct Qdisc_class_common common;
         /* general class parameters */
-        struct gnet_stats_basic bstats;
+        struct gnet_stats_basic_packed bstats;
         struct gnet_stats_queue qstats;
         struct gnet_stats_rate_est rate_est;
         struct tc_htb_xstats xstats;    /* our special stats */
diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
index 79cbd47f4df7..a76da657244a 100644
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -160,6 +160,7 @@ static void sctp_proc_exit(void)
                 remove_proc_entry("sctp", init_net.proc_net);
         }
 #endif
+        percpu_counter_destroy(&sctp_sockets_allocated);
 }
 
 /* Private helper to extract ipv4 address and stash them in
diff --git a/net/xfrm/xfrm_hash.h b/net/xfrm/xfrm_hash.h
index d401dc8f05ed..e5195c99f71e 100644
--- a/net/xfrm/xfrm_hash.h
+++ b/net/xfrm/xfrm_hash.h
@@ -16,7 +16,7 @@ static inline unsigned int __xfrm6_addr_hash(xfrm_address_t *addr)
 
 static inline unsigned int __xfrm4_daddr_saddr_hash(xfrm_address_t *daddr, xfrm_address_t *saddr)
 {
-        return ntohl(daddr->a4 ^ saddr->a4);
+        return ntohl(daddr->a4 + saddr->a4);
 }
 
 static inline unsigned int __xfrm6_daddr_saddr_hash(xfrm_address_t *daddr, xfrm_address_t *saddr)