17 files changed, 132 insertions, 65 deletions

diff --git a/drivers/net/Makefile b/drivers/net/Makefile
index 01b604ad155e..e5a7375685ad 100644
--- a/drivers/net/Makefile
+++ b/drivers/net/Makefile
@@ -144,7 +144,7 @@ obj-$(CONFIG_NE3210) += ne3210.o 8390.o
 obj-$(CONFIG_SB1250_MAC) += sb1250-mac.o
 obj-$(CONFIG_B44) += b44.o
 obj-$(CONFIG_FORCEDETH) += forcedeth.o
-obj-$(CONFIG_NE_H8300) += ne-h8300.o 8390.o
+obj-$(CONFIG_NE_H8300) += ne-h8300.o
 obj-$(CONFIG_AX88796) += ax88796.o
 obj-$(CONFIG_BCM63XX_ENET) += bcm63xx_enet.o
 obj-$(CONFIG_FTMAC100) += ftmac100.o
@@ -219,7 +219,7 @@ obj-$(CONFIG_SC92031) += sc92031.o
 obj-$(CONFIG_LP486E) += lp486e.o
 
 obj-$(CONFIG_ETH16I) += eth16i.o
-obj-$(CONFIG_ZORRO8390) += zorro8390.o 8390.o
+obj-$(CONFIG_ZORRO8390) += zorro8390.o
 obj-$(CONFIG_HPLANCE) += hplance.o 7990.o
 obj-$(CONFIG_MVME147_NET) += mvme147.o 7990.o
 obj-$(CONFIG_EQUALIZER) += eql.o
@@ -231,7 +231,7 @@ obj-$(CONFIG_SGI_IOC3_ETH) += ioc3-eth.o
 obj-$(CONFIG_DECLANCE) += declance.o
 obj-$(CONFIG_ATARILANCE) += atarilance.o
 obj-$(CONFIG_A2065) += a2065.o
-obj-$(CONFIG_HYDRA) += hydra.o 8390.o
+obj-$(CONFIG_HYDRA) += hydra.o
 obj-$(CONFIG_ARIADNE) += ariadne.o
 obj-$(CONFIG_CS89x0) += cs89x0.o
 obj-$(CONFIG_MACSONIC) += macsonic.o
diff --git a/drivers/net/bonding/bond_3ad.h b/drivers/net/bonding/bond_3ad.h
index b28baff70864..01b8a6af275b 100644
--- a/drivers/net/bonding/bond_3ad.h
+++ b/drivers/net/bonding/bond_3ad.h
@@ -39,7 +39,7 @@
 
 typedef struct mac_addr {
         u8 mac_addr_value[ETH_ALEN];
-} mac_addr_t;
+} __packed mac_addr_t;
 
 enum {
         BOND_AD_STABLE = 0,
@@ -134,12 +134,12 @@ typedef struct lacpdu {
         u8 tlv_type_terminator;      // = terminator
         u8 terminator_length;        // = 0
         u8 reserved_50[50];          // = 0
-} lacpdu_t;
+} __packed lacpdu_t;
 
 typedef struct lacpdu_header {
         struct ethhdr hdr;
         struct lacpdu lacpdu;
-} lacpdu_header_t;
+} __packed lacpdu_header_t;
 
 // Marker Protocol Data Unit(PDU) structure(43.5.3.2 in the 802.3ad standard)
 typedef struct bond_marker {
@@ -155,12 +155,12 @@ typedef struct bond_marker {
         u8 tlv_type_terminator;      //  = 0x00
         u8 terminator_length;        //  = 0x00
         u8 reserved_90[90];          //  = 0
-} bond_marker_t;
+} __packed bond_marker_t;
 
 typedef struct bond_marker_header {
         struct ethhdr hdr;
         struct bond_marker marker;
-} bond_marker_header_t;
+} __packed bond_marker_header_t;
 
 #pragma pack()
 
diff --git a/drivers/net/ehea/ehea_main.c b/drivers/net/ehea/ehea_main.c
index 53c0f04b1b23..cf79cf759e13 100644
--- a/drivers/net/ehea/ehea_main.c
+++ b/drivers/net/ehea/ehea_main.c
@@ -2688,9 +2688,6 @@ static int ehea_open(struct net_device *dev)
                 netif_start_queue(dev);
         }
 
-        init_waitqueue_head(&port->swqe_avail_wq);
-        init_waitqueue_head(&port->restart_wq);
-
         mutex_unlock(&port->port_lock);
 
         return ret;
@@ -3276,6 +3273,9 @@ struct ehea_port *ehea_setup_single_port(struct ehea_adapter *adapter,
 
         INIT_WORK(&port->reset_task, ehea_reset_port);
 
+        init_waitqueue_head(&port->swqe_avail_wq);
+        init_waitqueue_head(&port->restart_wq);
+
         ret = register_netdev(dev);
         if (ret) {
                 pr_err("register_netdev failed. ret=%d\n", ret);
diff --git a/drivers/net/hydra.c b/drivers/net/hydra.c
index c5ef62ceb840..1cd481c04202 100644
--- a/drivers/net/hydra.c
+++ b/drivers/net/hydra.c
@@ -98,15 +98,15 @@ static const struct net_device_ops hydra_netdev_ops = {
         .ndo_open               = hydra_open,
         .ndo_stop               = hydra_close,
 
-        .ndo_start_xmit         = ei_start_xmit,
-        .ndo_tx_timeout         = ei_tx_timeout,
-        .ndo_get_stats          = ei_get_stats,
-        .ndo_set_multicast_list = ei_set_multicast_list,
+        .ndo_start_xmit         = __ei_start_xmit,
+        .ndo_tx_timeout         = __ei_tx_timeout,
+        .ndo_get_stats          = __ei_get_stats,
+        .ndo_set_multicast_list = __ei_set_multicast_list,
         .ndo_validate_addr      = eth_validate_addr,
-        .ndo_set_mac_address    = eth_mac_addr,
+        .ndo_set_mac_address    = eth_mac_addr,
         .ndo_change_mtu         = eth_change_mtu,
 #ifdef CONFIG_NET_POLL_CONTROLLER
-        .ndo_poll_controller    = ei_poll,
+        .ndo_poll_controller    = __ei_poll,
 #endif
 };
 
@@ -125,7 +125,7 @@ static int __devinit hydra_init(struct zorro_dev *z)
         0x10, 0x12, 0x14, 0x16, 0x18, 0x1a, 0x1c, 0x1e,
     };
 
-    dev = alloc_ei_netdev();
+    dev = ____alloc_ei_netdev(0);
     if (!dev)
         return -ENOMEM;
 
diff --git a/drivers/net/ne-h8300.c b/drivers/net/ne-h8300.c
index 30be8c634ebd..7298a34bc795 100644
--- a/drivers/net/ne-h8300.c
+++ b/drivers/net/ne-h8300.c
@@ -167,7 +167,7 @@ static void cleanup_card(struct net_device *dev)
 #ifndef MODULE
 struct net_device * __init ne_probe(int unit)
 {
-        struct net_device *dev = alloc_ei_netdev();
+        struct net_device *dev = ____alloc_ei_netdev(0);
         int err;
 
         if (!dev)
@@ -197,15 +197,15 @@ static const struct net_device_ops ne_netdev_ops = {
         .ndo_open               = ne_open,
         .ndo_stop               = ne_close,
 
-        .ndo_start_xmit         = ei_start_xmit,
-        .ndo_tx_timeout         = ei_tx_timeout,
-        .ndo_get_stats          = ei_get_stats,
-        .ndo_set_multicast_list = ei_set_multicast_list,
+        .ndo_start_xmit         = __ei_start_xmit,
+        .ndo_tx_timeout         = __ei_tx_timeout,
+        .ndo_get_stats          = __ei_get_stats,
+        .ndo_set_multicast_list = __ei_set_multicast_list,
         .ndo_validate_addr      = eth_validate_addr,
-        .ndo_set_mac_address    = eth_mac_addr,
+        .ndo_set_mac_address    = eth_mac_addr,
         .ndo_change_mtu         = eth_change_mtu,
 #ifdef CONFIG_NET_POLL_CONTROLLER
-        .ndo_poll_controller    = ei_poll,
+        .ndo_poll_controller    = __ei_poll,
 #endif
 };
 
@@ -637,7 +637,7 @@ int init_module(void)
         int err;
 
         for (this_dev = 0; this_dev < MAX_NE_CARDS; this_dev++) {
-                struct net_device *dev = alloc_ei_netdev();
+                struct net_device *dev = ____alloc_ei_netdev(0);
                 if (!dev)
                         break;
                 if (io[this_dev]) {
diff --git a/drivers/net/sfc/mcdi.c b/drivers/net/sfc/mcdi.c
index d98479030ef2..3dd45ed61f0a 100644
--- a/drivers/net/sfc/mcdi.c
+++ b/drivers/net/sfc/mcdi.c
@@ -50,6 +50,20 @@ static inline struct efx_mcdi_iface *efx_mcdi(struct efx_nic *efx)
         return &nic_data->mcdi;
 }
 
+static inline void
+efx_mcdi_readd(struct efx_nic *efx, efx_dword_t *value, unsigned reg)
+{
+        struct siena_nic_data *nic_data = efx->nic_data;
+        value->u32[0] = (__force __le32)__raw_readl(nic_data->mcdi_smem + reg);
+}
+
+static inline void
+efx_mcdi_writed(struct efx_nic *efx, const efx_dword_t *value, unsigned reg)
+{
+        struct siena_nic_data *nic_data = efx->nic_data;
+        __raw_writel((__force u32)value->u32[0], nic_data->mcdi_smem + reg);
+}
+
 void efx_mcdi_init(struct efx_nic *efx)
 {
         struct efx_mcdi_iface *mcdi;
@@ -70,8 +84,8 @@ static void efx_mcdi_copyin(struct efx_nic *efx, unsigned cmd,
                             const u8 *inbuf, size_t inlen)
 {
         struct efx_mcdi_iface *mcdi = efx_mcdi(efx);
-        unsigned pdu = FR_CZ_MC_TREG_SMEM + MCDI_PDU(efx);
-        unsigned doorbell = FR_CZ_MC_TREG_SMEM + MCDI_DOORBELL(efx);
+        unsigned pdu = MCDI_PDU(efx);
+        unsigned doorbell = MCDI_DOORBELL(efx);
         unsigned int i;
         efx_dword_t hdr;
         u32 xflags, seqno;
@@ -92,30 +106,28 @@ static void efx_mcdi_copyin(struct efx_nic *efx, unsigned cmd,
                              MCDI_HEADER_SEQ, seqno,
                              MCDI_HEADER_XFLAGS, xflags);
 
-        efx_writed(efx, &hdr, pdu);
+        efx_mcdi_writed(efx, &hdr, pdu);
 
-        for (i = 0; i < inlen; i += 4) {
-                _efx_writed(efx, *((__le32 *)(inbuf + i)), pdu + 4 + i);
-                /* use wmb() within loop to inhibit write combining */
-                wmb();
-        }
+        for (i = 0; i < inlen; i += 4)
+                efx_mcdi_writed(efx, (const efx_dword_t *)(inbuf + i),
+                                pdu + 4 + i);
 
         /* ring the doorbell with a distinctive value */
-        _efx_writed(efx, (__force __le32) 0x45789abc, doorbell);
-        wmb();
+        EFX_POPULATE_DWORD_1(hdr, EFX_DWORD_0, 0x45789abc);
+        efx_mcdi_writed(efx, &hdr, doorbell);
 }
 
 static void efx_mcdi_copyout(struct efx_nic *efx, u8 *outbuf, size_t outlen)
 {
         struct efx_mcdi_iface *mcdi = efx_mcdi(efx);
-        unsigned int pdu = FR_CZ_MC_TREG_SMEM + MCDI_PDU(efx);
+        unsigned int pdu = MCDI_PDU(efx);
         int i;
 
         BUG_ON(atomic_read(&mcdi->state) == MCDI_STATE_QUIESCENT);
         BUG_ON(outlen & 3 || outlen >= 0x100);
 
         for (i = 0; i < outlen; i += 4)
-                *((__le32 *)(outbuf + i)) = _efx_readd(efx, pdu + 4 + i);
+                efx_mcdi_readd(efx, (efx_dword_t *)(outbuf + i), pdu + 4 + i);
 }
 
 static int efx_mcdi_poll(struct efx_nic *efx)
@@ -123,7 +135,7 @@ static int efx_mcdi_poll(struct efx_nic *efx)
         struct efx_mcdi_iface *mcdi = efx_mcdi(efx);
         unsigned int time, finish;
         unsigned int respseq, respcmd, error;
-        unsigned int pdu = FR_CZ_MC_TREG_SMEM + MCDI_PDU(efx);
+        unsigned int pdu = MCDI_PDU(efx);
         unsigned int rc, spins;
         efx_dword_t reg;
 
@@ -149,8 +161,7 @@ static int efx_mcdi_poll(struct efx_nic *efx)
 
                 time = get_seconds();
 
-                rmb();
-                efx_readd(efx, &reg, pdu);
+                efx_mcdi_readd(efx, &reg, pdu);
 
                 /* All 1's indicates that shared memory is in reset (and is
                  * not a valid header). Wait for it to come out reset before
@@ -177,7 +188,7 @@ static int efx_mcdi_poll(struct efx_nic *efx)
                           respseq, mcdi->seqno);
                 rc = EIO;
         } else if (error) {
-                efx_readd(efx, &reg, pdu + 4);
+                efx_mcdi_readd(efx, &reg, pdu + 4);
                 switch (EFX_DWORD_FIELD(reg, EFX_DWORD_0)) {
 #define TRANSLATE_ERROR(name)                                   \
                 case MC_CMD_ERR_ ## name:                       \
@@ -211,21 +222,21 @@ out:
 /* Test and clear MC-rebooted flag for this port/function */
 int efx_mcdi_poll_reboot(struct efx_nic *efx)
 {
-        unsigned int addr = FR_CZ_MC_TREG_SMEM + MCDI_REBOOT_FLAG(efx);
+        unsigned int addr = MCDI_REBOOT_FLAG(efx);
         efx_dword_t reg;
         uint32_t value;
 
         if (efx_nic_rev(efx) < EFX_REV_SIENA_A0)
                 return false;
 
-        efx_readd(efx, &reg, addr);
+        efx_mcdi_readd(efx, &reg, addr);
         value = EFX_DWORD_FIELD(reg, EFX_DWORD_0);
 
         if (value == 0)
                 return 0;
 
         EFX_ZERO_DWORD(reg);
-        efx_writed(efx, &reg, addr);
+        efx_mcdi_writed(efx, &reg, addr);
 
         if (value == MC_STATUS_DWORD_ASSERT)
                 return -EINTR;
diff --git a/drivers/net/sfc/nic.h b/drivers/net/sfc/nic.h
index a42db6e35be3..d91701abd331 100644
--- a/drivers/net/sfc/nic.h
+++ b/drivers/net/sfc/nic.h
@@ -143,10 +143,12 @@ static inline struct falcon_board *falcon_board(struct efx_nic *efx)
 /**
  * struct siena_nic_data - Siena NIC state
  * @mcdi: Management-Controller-to-Driver Interface
+ * @mcdi_smem: MCDI shared memory mapping. The mapping is always uncacheable.
  * @wol_filter_id: Wake-on-LAN packet filter id
  */
 struct siena_nic_data {
         struct efx_mcdi_iface mcdi;
+        void __iomem *mcdi_smem;
         int wol_filter_id;
 };
 
diff --git a/drivers/net/sfc/siena.c b/drivers/net/sfc/siena.c
index e4dd8986b1fe..837869b71db9 100644
--- a/drivers/net/sfc/siena.c
+++ b/drivers/net/sfc/siena.c
@@ -220,12 +220,26 @@ static int siena_probe_nic(struct efx_nic *efx)
         efx_reado(efx, &reg, FR_AZ_CS_DEBUG);
         efx->net_dev->dev_id = EFX_OWORD_FIELD(reg, FRF_CZ_CS_PORT_NUM) - 1;
 
+        /* Initialise MCDI */
+        nic_data->mcdi_smem = ioremap_nocache(efx->membase_phys +
+                                              FR_CZ_MC_TREG_SMEM,
+                                              FR_CZ_MC_TREG_SMEM_STEP *
+                                              FR_CZ_MC_TREG_SMEM_ROWS);
+        if (!nic_data->mcdi_smem) {
+                netif_err(efx, probe, efx->net_dev,
+                          "could not map MCDI at %llx+%x\n",
+                          (unsigned long long)efx->membase_phys +
+                          FR_CZ_MC_TREG_SMEM,
+                          FR_CZ_MC_TREG_SMEM_STEP * FR_CZ_MC_TREG_SMEM_ROWS);
+                rc = -ENOMEM;
+                goto fail1;
+        }
         efx_mcdi_init(efx);
 
         /* Recover from a failed assertion before probing */
         rc = efx_mcdi_handle_assertion(efx);
         if (rc)
-                goto fail1;
+                goto fail2;
 
         /* Let the BMC know that the driver is now in charge of link and
          * filter settings. We must do this before we reset the NIC */
@@ -280,6 +294,7 @@ fail4:
 fail3:
         efx_mcdi_drv_attach(efx, false, NULL);
 fail2:
+        iounmap(nic_data->mcdi_smem);
 fail1:
         kfree(efx->nic_data);
         return rc;
@@ -359,6 +374,8 @@ static int siena_init_nic(struct efx_nic *efx)
 
 static void siena_remove_nic(struct efx_nic *efx)
 {
+        struct siena_nic_data *nic_data = efx->nic_data;
+
         efx_nic_free_buffer(efx, &efx->irq_status);
 
         siena_reset_hw(efx, RESET_TYPE_ALL);
@@ -368,7 +385,8 @@ static void siena_remove_nic(struct efx_nic *efx)
                 efx_mcdi_drv_attach(efx, false, NULL);
 
         /* Tear down the private nic state */
-        kfree(efx->nic_data);
+        iounmap(nic_data->mcdi_smem);
+        kfree(nic_data);
         efx->nic_data = NULL;
 }
 
@@ -606,8 +624,7 @@ struct efx_nic_type siena_a0_nic_type = {
         .default_mac_ops = &efx_mcdi_mac_operations,
 
         .revision = EFX_REV_SIENA_A0,
-        .mem_map_size = (FR_CZ_MC_TREG_SMEM +
-                         FR_CZ_MC_TREG_SMEM_STEP * FR_CZ_MC_TREG_SMEM_ROWS),
+        .mem_map_size = FR_CZ_MC_TREG_SMEM, /* MC_TREG_SMEM mapped separately */
         .txd_ptr_tbl_base = FR_BZ_TX_DESC_PTR_TBL,
         .rxd_ptr_tbl_base = FR_BZ_RX_DESC_PTR_TBL,
         .buf_tbl_base = FR_BZ_BUF_FULL_TBL,
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index 17d04ff8d678..1482fa650833 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -2141,6 +2141,8 @@ static void ath9k_set_coverage_class(struct ieee80211_hw *hw, u8 coverage_class)
 static void ath9k_flush(struct ieee80211_hw *hw, bool drop)
 {
         struct ath_softc *sc = hw->priv;
+        struct ath_hw *ah = sc->sc_ah;
+        struct ath_common *common = ath9k_hw_common(ah);
         int timeout = 200; /* ms */
         int i, j;
 
@@ -2149,6 +2151,12 @@ static void ath9k_flush(struct ieee80211_hw *hw, bool drop)
 
         cancel_delayed_work_sync(&sc->tx_complete_work);
 
+        if (sc->sc_flags & SC_OP_INVALID) {
+                ath_dbg(common, ATH_DBG_ANY, "Device not present\n");
+                mutex_unlock(&sc->mutex);
+                return;
+        }
+
         if (drop)
                 timeout = 1;
 
diff --git a/drivers/net/wireless/iwlegacy/iwl-core.c b/drivers/net/wireless/iwlegacy/iwl-core.c
index c1511b14b239..42db0fc8b921 100644
--- a/drivers/net/wireless/iwlegacy/iwl-core.c
+++ b/drivers/net/wireless/iwlegacy/iwl-core.c
@@ -2155,6 +2155,13 @@ int iwl_legacy_mac_config(struct ieee80211_hw *hw, u32 changed)
                         goto set_ch_out;
                 }
 
+                if (priv->iw_mode == NL80211_IFTYPE_ADHOC &&
+                    !iwl_legacy_is_channel_ibss(ch_info)) {
+                        IWL_DEBUG_MAC80211(priv, "leave - not IBSS channel\n");
+                        ret = -EINVAL;
+                        goto set_ch_out;
+                }
+
                 spin_lock_irqsave(&priv->lock, flags);
 
                 for_each_context(priv, ctx) {
diff --git a/drivers/net/wireless/iwlegacy/iwl-dev.h b/drivers/net/wireless/iwlegacy/iwl-dev.h
index 9ee849d669f3..f43ac1eb9014 100644
--- a/drivers/net/wireless/iwlegacy/iwl-dev.h
+++ b/drivers/net/wireless/iwlegacy/iwl-dev.h
@@ -1411,6 +1411,12 @@ iwl_legacy_is_channel_passive(const struct iwl_channel_info *ch)
         return (!(ch->flags & EEPROM_CHANNEL_ACTIVE)) ? 1 : 0;
 }
 
+static inline int
+iwl_legacy_is_channel_ibss(const struct iwl_channel_info *ch)
+{
+        return (ch->flags & EEPROM_CHANNEL_IBSS) ? 1 : 0;
+}
+
 static inline void
 __iwl_legacy_free_pages(struct iwl_priv *priv, struct page *page)
 {
diff --git a/drivers/net/wireless/libertas/cmd.c b/drivers/net/wireless/libertas/cmd.c
index 7e8a658b7670..f3ac62431a30 100644
--- a/drivers/net/wireless/libertas/cmd.c
+++ b/drivers/net/wireless/libertas/cmd.c
@@ -1339,8 +1339,8 @@ int lbs_execute_next_command(struct lbs_private *priv)
                                     cpu_to_le16(PS_MODE_ACTION_EXIT_PS)) {
                                         lbs_deb_host(
                                                "EXEC_NEXT_CMD: ignore ENTER_PS cmd\n");
-                                        list_del(&cmdnode->list);
                                         spin_lock_irqsave(&priv->driver_lock, flags);
+                                        list_del(&cmdnode->list);
                                         lbs_complete_command(priv, cmdnode, 0);
                                         spin_unlock_irqrestore(&priv->driver_lock, flags);
 
@@ -1352,8 +1352,8 @@ int lbs_execute_next_command(struct lbs_private *priv)
                                     (priv->psstate == PS_STATE_PRE_SLEEP)) {
                                         lbs_deb_host(
                                                "EXEC_NEXT_CMD: ignore EXIT_PS cmd in sleep\n");
-                                        list_del(&cmdnode->list);
                                         spin_lock_irqsave(&priv->driver_lock, flags);
+                                        list_del(&cmdnode->list);
                                         lbs_complete_command(priv, cmdnode, 0);
                                         spin_unlock_irqrestore(&priv->driver_lock, flags);
                                         priv->needtowakeup = 1;
@@ -1366,7 +1366,9 @@ int lbs_execute_next_command(struct lbs_private *priv)
                                        "EXEC_NEXT_CMD: sending EXIT_PS\n");
                         }
                 }
+                spin_lock_irqsave(&priv->driver_lock, flags);
                 list_del(&cmdnode->list);
+                spin_unlock_irqrestore(&priv->driver_lock, flags);
                 lbs_deb_host("EXEC_NEXT_CMD: sending command 0x%04x\n",
                             le16_to_cpu(cmd->command));
                 lbs_submit_command(priv, cmdnode);
diff --git a/drivers/net/zorro8390.c b/drivers/net/zorro8390.c
index b78a38d9172a..8c7c522a056a 100644
--- a/drivers/net/zorro8390.c
+++ b/drivers/net/zorro8390.c
@@ -126,7 +126,7 @@ static int __devinit zorro8390_init_one(struct zorro_dev *z,
 
     board = z->resource.start;
     ioaddr = board+cards[i].offset;
-    dev = alloc_ei_netdev();
+    dev = ____alloc_ei_netdev(0);
     if (!dev)
         return -ENOMEM;
     if (!request_mem_region(ioaddr, NE_IO_EXTENT*2, DRV_NAME)) {
@@ -146,15 +146,15 @@ static int __devinit zorro8390_init_one(struct zorro_dev *z,
 static const struct net_device_ops zorro8390_netdev_ops = {
         .ndo_open               = zorro8390_open,
         .ndo_stop               = zorro8390_close,
-        .ndo_start_xmit         = ei_start_xmit,
-        .ndo_tx_timeout         = ei_tx_timeout,
-        .ndo_get_stats          = ei_get_stats,
-        .ndo_set_multicast_list = ei_set_multicast_list,
+        .ndo_start_xmit         = __ei_start_xmit,
+        .ndo_tx_timeout         = __ei_tx_timeout,
+        .ndo_get_stats          = __ei_get_stats,
+        .ndo_set_multicast_list = __ei_set_multicast_list,
         .ndo_validate_addr      = eth_validate_addr,
         .ndo_set_mac_address    = eth_mac_addr,
         .ndo_change_mtu         = eth_change_mtu,
 #ifdef CONFIG_NET_POLL_CONTROLLER
-        .ndo_poll_controller    = ei_poll,
+        .ndo_poll_controller    = __ei_poll,
 #endif
 };
 
diff --git a/include/net/inet_ecn.h b/include/net/inet_ecn.h
index 88bdd010d65d..2fa8d1341a0a 100644
--- a/include/net/inet_ecn.h
+++ b/include/net/inet_ecn.h
@@ -38,9 +38,19 @@ static inline __u8 INET_ECN_encapsulate(__u8 outer, __u8 inner)
         return outer;
 }
 
-#define INET_ECN_xmit(sk) do { inet_sk(sk)->tos |= INET_ECN_ECT_0; } while (0)
-#define INET_ECN_dontxmit(sk) \
-        do { inet_sk(sk)->tos &= ~INET_ECN_MASK; } while (0)
+static inline void INET_ECN_xmit(struct sock *sk)
+{
+        inet_sk(sk)->tos |= INET_ECN_ECT_0;
+        if (inet6_sk(sk) != NULL)
+                inet6_sk(sk)->tclass |= INET_ECN_ECT_0;
+}
+
+static inline void INET_ECN_dontxmit(struct sock *sk)
+{
+        inet_sk(sk)->tos &= ~INET_ECN_MASK;
+        if (inet6_sk(sk) != NULL)
+                inet6_sk(sk)->tclass &= ~INET_ECN_MASK;
+}
 
 #define IP6_ECN_flow_init(label) do {           \
       (label) &= ~htonl(INET_ECN_MASK << 20);   \
diff --git a/include/net/llc_pdu.h b/include/net/llc_pdu.h
index 75b8e2968c9b..f57e7d46a453 100644
--- a/include/net/llc_pdu.h
+++ b/include/net/llc_pdu.h
@@ -199,7 +199,7 @@ struct llc_pdu_sn {
         u8 ssap;
         u8 ctrl_1;
         u8 ctrl_2;
-};
+} __packed;
 
 static inline struct llc_pdu_sn *llc_pdu_sn_hdr(struct sk_buff *skb)
 {
@@ -211,7 +211,7 @@ struct llc_pdu_un {
         u8 dsap;
         u8 ssap;
         u8 ctrl_1;
-};
+} __packed;
 
 static inline struct llc_pdu_un *llc_pdu_un_hdr(struct sk_buff *skb)
 {
@@ -359,7 +359,7 @@ struct llc_xid_info {
         u8 fmt_id;      /* always 0x81 for LLC */
         u8 type;        /* different if NULL/non-NULL LSAP */
         u8 rw;          /* sender receive window */
-};
+} __packed;
 
 /**
  *      llc_pdu_init_as_xid_cmd - sets bytes 3, 4 & 5 of LLC header as XID
@@ -415,7 +415,7 @@ struct llc_frmr_info {
         u8  curr_ssv;           /* current send state variable val */
         u8  curr_rsv;           /* current receive state variable */
         u8  ind_bits;           /* indicator bits set with macro */
-};
+} __packed;
 
 extern void llc_pdu_set_cmd_rsp(struct sk_buff *skb, u8 type);
 extern void llc_pdu_set_pf_bit(struct sk_buff *skb, u8 bit_value);
diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index f3bc322c5891..74ef4d4846a4 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -737,7 +737,7 @@ static unsigned int br_nf_forward_ip(unsigned int hook, struct sk_buff *skb,
                 nf_bridge->mask |= BRNF_PKT_TYPE;
         }
 
-        if (br_parse_ip_options(skb))
+        if (pf == PF_INET && br_parse_ip_options(skb))
                 return NF_DROP;
 
         /* The physdev module checks on this */
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index ce4596ed1268..bd1224fd216a 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -237,6 +237,10 @@ ieee80211_tx_h_dynamic_ps(struct ieee80211_tx_data *tx)
                                      &local->dynamic_ps_disable_work);
         }
 
+        /* Don't restart the timer if we're not disassociated */
+        if (!ifmgd->associated)
+                return TX_CONTINUE;
+
         mod_timer(&local->dynamic_ps_timer, jiffies +
                   msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout));