33 files changed, 384 insertions, 240 deletions

diff --git a/Documentation/ABI/testing/sysfs-platform-at91 b/Documentation/ABI/testing/sysfs-platform-at91
new file mode 100644
index 000000000000..4cc6a865ae66
--- /dev/null
+++ b/Documentation/ABI/testing/sysfs-platform-at91
@@ -0,0 +1,25 @@
+What:           /sys/devices/platform/at91_can/net/<iface>/mb0_id
+Date:           January 2011
+KernelVersion:  2.6.38
+Contact:        Marc Kleine-Budde <kernel@pengutronix.de>
+Description:
+                Value representing the can_id of mailbox 0.
+
+                Default: 0x7ff (standard frame)
+
+                Due to a chip bug (errata 50.2.6.3 & 50.3.5.3 in
+                "AT91SAM9263 Preliminary 6249H-ATARM-27-Jul-09") the
+                contents of mailbox 0 may be send under certain
+                conditions (even if disabled or in rx mode).
+
+                The workaround in the errata suggests not to use the
+                mailbox and load it with an unused identifier.
+
+                In order to use an extended can_id add the
+                CAN_EFF_FLAG (0x80000000U) to the can_id. Example:
+
+                - standard id 0x7ff:
+                echo 0x7ff      > /sys/class/net/can0/mb0_id
+
+                - extended id 0x1fffffff:
+                echo 0x9fffffff > /sys/class/net/can0/mb0_id
diff --git a/Documentation/networking/bonding.txt b/Documentation/networking/bonding.txt
index 5dc638791d97..25d2f4141d27 100644
--- a/Documentation/networking/bonding.txt
+++ b/Documentation/networking/bonding.txt
@@ -49,7 +49,8 @@ Table of Contents
 3.3     Configuring Bonding Manually with Ifenslave
 3.3.1           Configuring Multiple Bonds Manually
 3.4     Configuring Bonding Manually via Sysfs
-3.5     Overriding Configuration for Special Cases
+3.5     Configuration with Interfaces Support
+3.6     Overriding Configuration for Special Cases
 
 4. Querying Bonding Configuration
 4.1     Bonding Configuration
@@ -161,8 +162,8 @@ onwards) do not have /usr/include/linux symbolically linked to the
 default kernel source include directory.
 
 SECOND IMPORTANT NOTE:
-        If you plan to configure bonding using sysfs, you do not need
-to use ifenslave.
+        If you plan to configure bonding using sysfs or using the
+/etc/network/interfaces file, you do not need to use ifenslave.
 
 2. Bonding Driver Options
 =========================
@@ -779,22 +780,26 @@ resend_igmp
 
         You can configure bonding using either your distro's network
 initialization scripts, or manually using either ifenslave or the
-sysfs interface.  Distros generally use one of two packages for the
-network initialization scripts: initscripts or sysconfig.  Recent
-versions of these packages have support for bonding, while older
+sysfs interface.  Distros generally use one of three packages for the
+network initialization scripts: initscripts, sysconfig or interfaces.
+Recent versions of these packages have support for bonding, while older
 versions do not.
 
         We will first describe the options for configuring bonding for
-distros using versions of initscripts and sysconfig with full or
-partial support for bonding, then provide information on enabling
+distros using versions of initscripts, sysconfig and interfaces with full
+or partial support for bonding, then provide information on enabling
 bonding without support from the network initialization scripts (i.e.,
 older versions of initscripts or sysconfig).
 
-        If you're unsure whether your distro uses sysconfig or
-initscripts, or don't know if it's new enough, have no fear.
+        If you're unsure whether your distro uses sysconfig,
+initscripts or interfaces, or don't know if it's new enough, have no fear.
 Determining this is fairly straightforward.
 
-        First, issue the command:
+        First, look for a file called interfaces in /etc/network directory.
+If this file is present in your system, then your system use interfaces. See
+Configuration with Interfaces Support.
+
+        Else, issue the command:
 
 $ rpm -qf /sbin/ifup
 
@@ -1327,8 +1332,62 @@ echo 2000 > /sys/class/net/bond1/bonding/arp_interval
 echo +eth2 > /sys/class/net/bond1/bonding/slaves
 echo +eth3 > /sys/class/net/bond1/bonding/slaves
 
-3.5 Overriding Configuration for Special Cases
+3.5 Configuration with Interfaces Support
+-----------------------------------------
+
+        This section applies to distros which use /etc/network/interfaces file
+to describe network interface configuration, most notably Debian and it's
+derivatives.
+
+        The ifup and ifdown commands on Debian don't support bonding out of
+the box. The ifenslave-2.6 package should be installed to provide bonding
+support.  Once installed, this package will provide bond-* options to be used
+into /etc/network/interfaces.
+
+        Note that ifenslave-2.6 package will load the bonding module and use
+the ifenslave command when appropriate.
+
+Example Configurations
+----------------------
+
+In /etc/network/interfaces, the following stanza will configure bond0, in
+active-backup mode, with eth0 and eth1 as slaves.
+
+auto bond0
+iface bond0 inet dhcp
+        bond-slaves eth0 eth1
+        bond-mode active-backup
+        bond-miimon 100
+        bond-primary eth0 eth1
+
+If the above configuration doesn't work, you might have a system using
+upstart for system startup. This is most notably true for recent
+Ubuntu versions. The following stanza in /etc/network/interfaces will
+produce the same result on those systems.
+
+auto bond0
+iface bond0 inet dhcp
+        bond-slaves none
+        bond-mode active-backup
+        bond-miimon 100
+
+auto eth0
+iface eth0 inet manual
+        bond-master bond0
+        bond-primary eth0 eth1
+
+auto eth1
+iface eth1 inet manual
+        bond-master bond0
+        bond-primary eth0 eth1
+
+For a full list of bond-* supported options in /etc/network/interfaces and some
+more advanced examples tailored to you particular distros, see the files in
+/usr/share/doc/ifenslave-2.6.
+
+3.6 Overriding Configuration for Special Cases
 ----------------------------------------------
+
 When using the bonding driver, the physical port which transmits a frame is
 typically selected by the bonding driver, and is not relevant to the user or
 system administrator.  The output port is simply selected using the policies of
diff --git a/MAINTAINERS b/MAINTAINERS
index cf0f3a5c09cc..9d12977b6baf 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3327,7 +3327,6 @@ F:	drivers/net/wimax/i2400m/
 F:      include/linux/wimax/i2400m.h
 
 INTEL WIRELESS WIFI LINK (iwlwifi)
-M:      Reinette Chatre <reinette.chatre@intel.com>
 M:      Wey-Yi Guy <wey-yi.w.guy@intel.com>
 M:      Intel Linux Wireless <ilw@linux.intel.com>
 L:      linux-wireless@vger.kernel.org
diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
index 949ed09c6361..a126e614601f 100644
--- a/drivers/bluetooth/ath3k.c
+++ b/drivers/bluetooth/ath3k.c
@@ -47,46 +47,40 @@ MODULE_DEVICE_TABLE(usb, ath3k_table);
 #define USB_REQ_DFU_DNLOAD      1
 #define BULK_SIZE               4096
 
-struct ath3k_data {
-        struct usb_device *udev;
-        u8 *fw_data;
-        u32 fw_size;
-        u32 fw_sent;
-};
-
-static int ath3k_load_firmware(struct ath3k_data *data,
-                                unsigned char *firmware,
-                                int count)
+static int ath3k_load_firmware(struct usb_device *udev,
+                                const struct firmware *firmware)
 {
         u8 *send_buf;
         int err, pipe, len, size, sent = 0;
+        int count = firmware->size;
 
-        BT_DBG("ath3k %p udev %p", data, data->udev);
+        BT_DBG("udev %p", udev);
 
-        pipe = usb_sndctrlpipe(data->udev, 0);
+        pipe = usb_sndctrlpipe(udev, 0);
 
-        if ((usb_control_msg(data->udev, pipe,
+        send_buf = kmalloc(BULK_SIZE, GFP_ATOMIC);
+        if (!send_buf) {
+                BT_ERR("Can't allocate memory chunk for firmware");
+                return -ENOMEM;
+        }
+
+        memcpy(send_buf, firmware->data, 20);
+        if ((err = usb_control_msg(udev, pipe,
                                 USB_REQ_DFU_DNLOAD,
                                 USB_TYPE_VENDOR, 0, 0,
-                                firmware, 20, USB_CTRL_SET_TIMEOUT)) < 0) {
+                                send_buf, 20, USB_CTRL_SET_TIMEOUT)) < 0) {
                 BT_ERR("Can't change to loading configuration err");
-                return -EBUSY;
+                goto error;
         }
         sent += 20;
         count -= 20;
 
-        send_buf = kmalloc(BULK_SIZE, GFP_ATOMIC);
-        if (!send_buf) {
-                BT_ERR("Can't allocate memory chunk for firmware");
-                return -ENOMEM;
-        }
-
         while (count) {
                 size = min_t(uint, count, BULK_SIZE);
-                pipe = usb_sndbulkpipe(data->udev, 0x02);
-                memcpy(send_buf, firmware + sent, size);
+                pipe = usb_sndbulkpipe(udev, 0x02);
+                memcpy(send_buf, firmware->data + sent, size);
 
-                err = usb_bulk_msg(data->udev, pipe, send_buf, size,
+                err = usb_bulk_msg(udev, pipe, send_buf, size,
                                         &len, 3000);
 
                 if (err || (len != size)) {
@@ -112,57 +106,28 @@ static int ath3k_probe(struct usb_interface *intf,
 {
         const struct firmware *firmware;
         struct usb_device *udev = interface_to_usbdev(intf);
-        struct ath3k_data *data;
-        int size;
 
         BT_DBG("intf %p id %p", intf, id);
 
         if (intf->cur_altsetting->desc.bInterfaceNumber != 0)
                 return -ENODEV;
 
-        data = kzalloc(sizeof(*data), GFP_KERNEL);
-        if (!data)
-                return -ENOMEM;
-
-        data->udev = udev;
-
         if (request_firmware(&firmware, "ath3k-1.fw", &udev->dev) < 0) {
-                kfree(data);
                 return -EIO;
         }
 
-        size = max_t(uint, firmware->size, 4096);
-        data->fw_data = kmalloc(size, GFP_KERNEL);
-        if (!data->fw_data) {
+        if (ath3k_load_firmware(udev, firmware)) {
                 release_firmware(firmware);
-                kfree(data);
-                return -ENOMEM;
-        }
-
-        memcpy(data->fw_data, firmware->data, firmware->size);
-        data->fw_size = firmware->size;
-        data->fw_sent = 0;
-        release_firmware(firmware);
-
-        usb_set_intfdata(intf, data);
-        if (ath3k_load_firmware(data, data->fw_data, data->fw_size)) {
-                usb_set_intfdata(intf, NULL);
-                kfree(data->fw_data);
-                kfree(data);
                 return -EIO;
         }
+        release_firmware(firmware);
 
         return 0;
 }
 
 static void ath3k_disconnect(struct usb_interface *intf)
 {
-        struct ath3k_data *data = usb_get_intfdata(intf);
-
         BT_DBG("ath3k_disconnect intf %p", intf);
-
-        kfree(data->fw_data);
-        kfree(data);
 }
 
 static struct usb_driver ath3k_driver = {
diff --git a/drivers/net/bnx2.c b/drivers/net/bnx2.c
index cab96fa4cd3a..231aa97745ef 100644
--- a/drivers/net/bnx2.c
+++ b/drivers/net/bnx2.c
@@ -7553,6 +7553,10 @@ bnx2_set_flags(struct net_device *dev, u32 data)
             !(data & ETH_FLAG_RXVLAN))
                 return -EINVAL;
 
+        /* TSO with VLAN tag won't work with current firmware */
+        if (!(data & ETH_FLAG_TXVLAN))
+                return -EINVAL;
+
         rc = ethtool_op_set_flags(dev, data, ETH_FLAG_RXHASH | ETH_FLAG_RXVLAN |
                                   ETH_FLAG_TXVLAN);
         if (rc)
diff --git a/drivers/net/can/at91_can.c b/drivers/net/can/at91_can.c
index 7ef83d06f7ed..2532b9631538 100644
--- a/drivers/net/can/at91_can.c
+++ b/drivers/net/can/at91_can.c
@@ -2,7 +2,7 @@
  * at91_can.c - CAN network driver for AT91 SoC CAN controller
  *
  * (C) 2007 by Hans J. Koch <hjk@hansjkoch.de>
- * (C) 2008, 2009, 2010 by Marc Kleine-Budde <kernel@pengutronix.de>
+ * (C) 2008, 2009, 2010, 2011 by Marc Kleine-Budde <kernel@pengutronix.de>
  *
  * This software may be distributed under the terms of the GNU General
  * Public License ("GPL") version 2 as distributed in the 'COPYING'
@@ -30,6 +30,7 @@
 #include <linux/module.h>
 #include <linux/netdevice.h>
 #include <linux/platform_device.h>
+#include <linux/rtnetlink.h>
 #include <linux/skbuff.h>
 #include <linux/spinlock.h>
 #include <linux/string.h>
@@ -40,22 +41,23 @@
 
 #include <mach/board.h>
 
-#define AT91_NAPI_WEIGHT        12
+#define AT91_NAPI_WEIGHT        11
 
 /*
  * RX/TX Mailbox split
  * don't dare to touch
  */
-#define AT91_MB_RX_NUM          12
+#define AT91_MB_RX_NUM          11
 #define AT91_MB_TX_SHIFT        2
 
-#define AT91_MB_RX_FIRST        0
+#define AT91_MB_RX_FIRST        1
 #define AT91_MB_RX_LAST         (AT91_MB_RX_FIRST + AT91_MB_RX_NUM - 1)
 
 #define AT91_MB_RX_MASK(i)      ((1 << (i)) - 1)
 #define AT91_MB_RX_SPLIT        8
 #define AT91_MB_RX_LOW_LAST     (AT91_MB_RX_SPLIT - 1)
-#define AT91_MB_RX_LOW_MASK     (AT91_MB_RX_MASK(AT91_MB_RX_SPLIT))
+#define AT91_MB_RX_LOW_MASK     (AT91_MB_RX_MASK(AT91_MB_RX_SPLIT) & \
+                                 ~AT91_MB_RX_MASK(AT91_MB_RX_FIRST))
 
 #define AT91_MB_TX_NUM          (1 << AT91_MB_TX_SHIFT)
 #define AT91_MB_TX_FIRST        (AT91_MB_RX_LAST + 1)
@@ -168,6 +170,8 @@ struct at91_priv {
 
         struct clk              *clk;
         struct at91_can_data    *pdata;
+
+        canid_t                 mb0_id;
 };
 
 static struct can_bittiming_const at91_bittiming_const = {
@@ -220,6 +224,18 @@ static inline void set_mb_mode(const struct at91_priv *priv, unsigned int mb,
         set_mb_mode_prio(priv, mb, mode, 0);
 }
 
+static inline u32 at91_can_id_to_reg_mid(canid_t can_id)
+{
+        u32 reg_mid;
+
+        if (can_id & CAN_EFF_FLAG)
+                reg_mid = (can_id & CAN_EFF_MASK) | AT91_MID_MIDE;
+        else
+                reg_mid = (can_id & CAN_SFF_MASK) << 18;
+
+        return reg_mid;
+}
+
 /*
  * Swtich transceiver on or off
  */
@@ -233,12 +249,22 @@ static void at91_setup_mailboxes(struct net_device *dev)
 {
         struct at91_priv *priv = netdev_priv(dev);
         unsigned int i;
+        u32 reg_mid;
 
         /*
-         * The first 12 mailboxes are used as a reception FIFO. The
-         * last mailbox is configured with overwrite option. The
-         * overwrite flag indicates a FIFO overflow.
+         * Due to a chip bug (errata 50.2.6.3 & 50.3.5.3) the first
+         * mailbox is disabled. The next 11 mailboxes are used as a
+         * reception FIFO. The last mailbox is configured with
+         * overwrite option. The overwrite flag indicates a FIFO
+         * overflow.
          */
+        reg_mid = at91_can_id_to_reg_mid(priv->mb0_id);
+        for (i = 0; i < AT91_MB_RX_FIRST; i++) {
+                set_mb_mode(priv, i, AT91_MB_MODE_DISABLED);
+                at91_write(priv, AT91_MID(i), reg_mid);
+                at91_write(priv, AT91_MCR(i), 0x0);     /* clear dlc */
+        }
+
         for (i = AT91_MB_RX_FIRST; i < AT91_MB_RX_LAST; i++)
                 set_mb_mode(priv, i, AT91_MB_MODE_RX);
         set_mb_mode(priv, AT91_MB_RX_LAST, AT91_MB_MODE_RX_OVRWR);
@@ -254,7 +280,8 @@ static void at91_setup_mailboxes(struct net_device *dev)
                 set_mb_mode_prio(priv, i, AT91_MB_MODE_TX, 0);
 
         /* Reset tx and rx helper pointers */
-        priv->tx_next = priv->tx_echo = priv->rx_next = 0;
+        priv->tx_next = priv->tx_echo = 0;
+        priv->rx_next = AT91_MB_RX_FIRST;
 }
 
 static int at91_set_bittiming(struct net_device *dev)
@@ -372,12 +399,7 @@ static netdev_tx_t at91_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 netdev_err(dev, "BUG! TX buffer full when queue awake!\n");
                 return NETDEV_TX_BUSY;
         }
-
-        if (cf->can_id & CAN_EFF_FLAG)
-                reg_mid = (cf->can_id & CAN_EFF_MASK) | AT91_MID_MIDE;
-        else
-                reg_mid = (cf->can_id & CAN_SFF_MASK) << 18;
-
+        reg_mid = at91_can_id_to_reg_mid(cf->can_id);
         reg_mcr = ((cf->can_id & CAN_RTR_FLAG) ? AT91_MCR_MRTR : 0) |
                 (cf->can_dlc << 16) | AT91_MCR_MTCR;
 
@@ -539,27 +561,31 @@ static void at91_read_msg(struct net_device *dev, unsigned int mb)
  *
  * Theory of Operation:
  *
- * 12 of the 16 mailboxes on the chip are reserved for RX. we split
- * them into 2 groups. The lower group holds 8 and upper 4 mailboxes.
+ * 11 of the 16 mailboxes on the chip are reserved for RX. we split
+ * them into 2 groups. The lower group holds 7 and upper 4 mailboxes.
  *
  * Like it or not, but the chip always saves a received CAN message
  * into the first free mailbox it finds (starting with the
  * lowest). This makes it very difficult to read the messages in the
  * right order from the chip. This is how we work around that problem:
  *
- * The first message goes into mb nr. 0 and issues an interrupt. All
+ * The first message goes into mb nr. 1 and issues an interrupt. All
  * rx ints are disabled in the interrupt handler and a napi poll is
  * scheduled. We read the mailbox, but do _not_ reenable the mb (to
  * receive another message).
  *
  *    lower mbxs      upper
- *   ______^______    __^__
- *  /             \  /     \
+ *     ____^______    __^__
+ *    /           \  /     \
  * +-+-+-+-+-+-+-+-++-+-+-+-+
- * |x|x|x|x|x|x|x|x|| | | | |
+ * | |x|x|x|x|x|x|x|| | | | |
  * +-+-+-+-+-+-+-+-++-+-+-+-+
  *  0 0 0 0 0 0  0 0 0 0 1 1  \ mail
  *  0 1 2 3 4 5  6 7 8 9 0 1  / box
+ *  ^
+ *  |
+ *   \
+ *     unused, due to chip bug
  *
  * The variable priv->rx_next points to the next mailbox to read a
  * message from. As long we're in the lower mailboxes we just read the
@@ -590,10 +616,10 @@ static int at91_poll_rx(struct net_device *dev, int quota)
                         "order of incoming frames cannot be guaranteed\n");
 
  again:
-        for (mb = find_next_bit(addr, AT91_MB_RX_NUM, priv->rx_next);
-             mb < AT91_MB_RX_NUM && quota > 0;
+        for (mb = find_next_bit(addr, AT91_MB_RX_LAST + 1, priv->rx_next);
+             mb < AT91_MB_RX_LAST + 1 && quota > 0;
              reg_sr = at91_read(priv, AT91_SR),
-             mb = find_next_bit(addr, AT91_MB_RX_NUM, ++priv->rx_next)) {
+             mb = find_next_bit(addr, AT91_MB_RX_LAST + 1, ++priv->rx_next)) {
                 at91_read_msg(dev, mb);
 
                 /* reactivate mailboxes */
@@ -610,8 +636,8 @@ static int at91_poll_rx(struct net_device *dev, int quota)
 
         /* upper group completed, look again in lower */
         if (priv->rx_next > AT91_MB_RX_LOW_LAST &&
-            quota > 0 && mb >= AT91_MB_RX_NUM) {
-                priv->rx_next = 0;
+            quota > 0 && mb > AT91_MB_RX_LAST) {
+                priv->rx_next = AT91_MB_RX_FIRST;
                 goto again;
         }
 
@@ -1037,6 +1063,64 @@ static const struct net_device_ops at91_netdev_ops = {
         .ndo_start_xmit = at91_start_xmit,
 };
 
+static ssize_t at91_sysfs_show_mb0_id(struct device *dev,
+                struct device_attribute *attr, char *buf)
+{
+        struct at91_priv *priv = netdev_priv(to_net_dev(dev));
+
+        if (priv->mb0_id & CAN_EFF_FLAG)
+                return snprintf(buf, PAGE_SIZE, "0x%08x\n", priv->mb0_id);
+        else
+                return snprintf(buf, PAGE_SIZE, "0x%03x\n", priv->mb0_id);
+}
+
+static ssize_t at91_sysfs_set_mb0_id(struct device *dev,
+                struct device_attribute *attr, const char *buf, size_t count)
+{
+        struct net_device *ndev = to_net_dev(dev);
+        struct at91_priv *priv = netdev_priv(ndev);
+        unsigned long can_id;
+        ssize_t ret;
+        int err;
+
+        rtnl_lock();
+
+        if (ndev->flags & IFF_UP) {
+                ret = -EBUSY;
+                goto out;
+        }
+
+        err = strict_strtoul(buf, 0, &can_id);
+        if (err) {
+                ret = err;
+                goto out;
+        }
+
+        if (can_id & CAN_EFF_FLAG)
+                can_id &= CAN_EFF_MASK | CAN_EFF_FLAG;
+        else
+                can_id &= CAN_SFF_MASK;
+
+        priv->mb0_id = can_id;
+        ret = count;
+
+ out:
+        rtnl_unlock();
+        return ret;
+}
+
+static DEVICE_ATTR(mb0_id, S_IWUGO | S_IRUGO,
+        at91_sysfs_show_mb0_id, at91_sysfs_set_mb0_id);
+
+static struct attribute *at91_sysfs_attrs[] = {
+        &dev_attr_mb0_id.attr,
+        NULL,
+};
+
+static struct attribute_group at91_sysfs_attr_group = {
+        .attrs = at91_sysfs_attrs,
+};
+
 static int __devinit at91_can_probe(struct platform_device *pdev)
 {
         struct net_device *dev;
@@ -1082,6 +1166,7 @@ static int __devinit at91_can_probe(struct platform_device *pdev)
         dev->netdev_ops = &at91_netdev_ops;
         dev->irq = irq;
         dev->flags |= IFF_ECHO;
+        dev->sysfs_groups[0] = &at91_sysfs_attr_group;
 
         priv = netdev_priv(dev);
         priv->can.clock.freq = clk_get_rate(clk);
@@ -1093,6 +1178,7 @@ static int __devinit at91_can_probe(struct platform_device *pdev)
         priv->dev = dev;
         priv->clk = clk;
         priv->pdata = pdev->dev.platform_data;
+        priv->mb0_id = 0x7ff;
 
         netif_napi_add(dev, &priv->napi, at91_poll, AT91_NAPI_WEIGHT);
 
diff --git a/drivers/net/pch_gbe/pch_gbe_main.c b/drivers/net/pch_gbe/pch_gbe_main.c
index d7355306a738..1bf12339441b 100644
--- a/drivers/net/pch_gbe/pch_gbe_main.c
+++ b/drivers/net/pch_gbe/pch_gbe_main.c
@@ -2247,7 +2247,7 @@ static void pch_gbe_remove(struct pci_dev *pdev)
         struct net_device *netdev = pci_get_drvdata(pdev);
         struct pch_gbe_adapter *adapter = netdev_priv(netdev);
 
-        flush_scheduled_work();
+        cancel_work_sync(&adapter->reset_task);
         unregister_netdev(netdev);
 
         pch_gbe_hal_phy_hw_reset(&adapter->hw);
diff --git a/drivers/net/usb/kaweth.c b/drivers/net/usb/kaweth.c
index 5e98643a4a21..7dc84971f26f 100644
--- a/drivers/net/usb/kaweth.c
+++ b/drivers/net/usb/kaweth.c
@@ -406,6 +406,7 @@ static int kaweth_download_firmware(struct kaweth_device *kaweth,
 
         if (fw->size > KAWETH_FIRMWARE_BUF_SIZE) {
                 err("Firmware too big: %zu", fw->size);
+                release_firmware(fw);
                 return -ENOSPC;
         }
         data_len = fw->size;
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index 1afb8bb85756..9f01e50d5cda 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -369,6 +369,9 @@ static void ath9k_hw_init_config(struct ath_hw *ah)
         else
                 ah->config.ht_enable = 0;
 
+        /* PAPRD needs some more work to be enabled */
+        ah->config.paprd_disable = 1;
+
         ah->config.rx_intr_mitigation = true;
         ah->config.pcieSerDesWrite = true;
 
@@ -1933,7 +1936,8 @@ int ath9k_hw_fill_cap_info(struct ath_hw *ah)
                 pCap->rx_status_len = sizeof(struct ar9003_rxs);
                 pCap->tx_desc_len = sizeof(struct ar9003_txc);
                 pCap->txs_len = sizeof(struct ar9003_txs);
-                if (ah->eep_ops->get_eeprom(ah, EEP_PAPRD))
+                if (!ah->config.paprd_disable &&
+                    ah->eep_ops->get_eeprom(ah, EEP_PAPRD))
                         pCap->hw_caps |= ATH9K_HW_CAP_PAPRD;
         } else {
                 pCap->tx_desc_len = sizeof(struct ath_desc);
diff --git a/drivers/net/wireless/ath/ath9k/hw.h b/drivers/net/wireless/ath/ath9k/hw.h
index 5a3dfec45e96..ea9fde670646 100644
--- a/drivers/net/wireless/ath/ath9k/hw.h
+++ b/drivers/net/wireless/ath/ath9k/hw.h
@@ -225,6 +225,7 @@ struct ath9k_ops_config {
         u32 pcie_waen;
         u8 analog_shiftreg;
         u8 ht_enable;
+        u8 paprd_disable;
         u32 ofdm_trig_low;
         u32 ofdm_trig_high;
         u32 cck_trig_high;
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index f90a6ca94a76..c79c97be6cd4 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -592,14 +592,12 @@ void ath9k_tasklet(unsigned long data)
         u32 status = sc->intrstatus;
         u32 rxmask;
 
-        ath9k_ps_wakeup(sc);
-
         if (status & ATH9K_INT_FATAL) {
                 ath_reset(sc, true);
-                ath9k_ps_restore(sc);
                 return;
         }
 
+        ath9k_ps_wakeup(sc);
         spin_lock(&sc->sc_pcu_lock);
 
         if (!ath9k_hw_check_alive(ah))
@@ -969,6 +967,7 @@ int ath_reset(struct ath_softc *sc, bool retry_tx)
         /* Stop ANI */
         del_timer_sync(&common->ani.timer);
 
+        ath9k_ps_wakeup(sc);
         spin_lock_bh(&sc->sc_pcu_lock);
 
         ieee80211_stop_queues(hw);
@@ -1015,6 +1014,7 @@ int ath_reset(struct ath_softc *sc, bool retry_tx)
 
         /* Start ANI */
         ath_start_ani(common);
+        ath9k_ps_restore(sc);
 
         return r;
 }
@@ -1701,7 +1701,9 @@ static int ath9k_config(struct ieee80211_hw *hw, u32 changed)
 skip_chan_change:
         if (changed & IEEE80211_CONF_CHANGE_POWER) {
                 sc->config.txpowlimit = 2 * conf->power_level;
+                ath9k_ps_wakeup(sc);
                 ath_update_txpow(sc);
+                ath9k_ps_restore(sc);
         }
 
         spin_lock_bh(&sc->wiphy_lock);
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index 332d1feb5c18..33a37edbaf79 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -2113,9 +2113,7 @@ static void ath_tx_complete_poll_work(struct work_struct *work)
         if (needreset) {
                 ath_dbg(ath9k_hw_common(sc->sc_ah), ATH_DBG_RESET,
                         "tx hung, resetting the chip\n");
-                ath9k_ps_wakeup(sc);
                 ath_reset(sc, true);
-                ath9k_ps_restore(sc);
         }
 
         ieee80211_queue_delayed_work(sc->hw, &sc->tx_complete_work,
diff --git a/drivers/net/wireless/iwlwifi/iwl-4965.c b/drivers/net/wireless/iwlwifi/iwl-4965.c
index 3f1e5f1bf847..91a9f5253469 100644
--- a/drivers/net/wireless/iwlwifi/iwl-4965.c
+++ b/drivers/net/wireless/iwlwifi/iwl-4965.c
@@ -2624,6 +2624,7 @@ struct iwl_cfg iwl4965_agn_cfg = {
         .fw_name_pre = IWL4965_FW_PRE,
         .ucode_api_max = IWL4965_UCODE_API_MAX,
         .ucode_api_min = IWL4965_UCODE_API_MIN,
+        .sku = IWL_SKU_A|IWL_SKU_G|IWL_SKU_N,
         .valid_tx_ant = ANT_AB,
         .valid_rx_ant = ANT_ABC,
         .eeprom_ver = EEPROM_4965_EEPROM_VERSION,
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-eeprom.c b/drivers/net/wireless/iwlwifi/iwl-agn-eeprom.c
index 14ceb4df72f6..27b5a3eec9dc 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-eeprom.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-eeprom.c
@@ -152,11 +152,14 @@ int iwl_eeprom_check_sku(struct iwl_priv *priv)
 
         eeprom_sku = iwl_eeprom_query16(priv, EEPROM_SKU_CAP);
 
-        priv->cfg->sku = ((eeprom_sku & EEPROM_SKU_CAP_BAND_SELECTION) >>
+        if (!priv->cfg->sku) {
+                /* not using sku overwrite */
+                priv->cfg->sku =
+                        ((eeprom_sku & EEPROM_SKU_CAP_BAND_SELECTION) >>
                         EEPROM_SKU_CAP_BAND_POS);
-        if (eeprom_sku & EEPROM_SKU_CAP_11N_ENABLE)
-                priv->cfg->sku |= IWL_SKU_N;
-
+                if (eeprom_sku & EEPROM_SKU_CAP_11N_ENABLE)
+                        priv->cfg->sku |= IWL_SKU_N;
+        }
         if (!priv->cfg->sku) {
                 IWL_ERR(priv, "Invalid device sku\n");
                 return -EINVAL;
diff --git a/drivers/net/wireless/rt2x00/rt73usb.c b/drivers/net/wireless/rt2x00/rt73usb.c
index 0b4e8590cbb7..029be3c6c030 100644
--- a/drivers/net/wireless/rt2x00/rt73usb.c
+++ b/drivers/net/wireless/rt2x00/rt73usb.c
@@ -2446,6 +2446,7 @@ static struct usb_device_id rt73usb_device_table[] = {
         { USB_DEVICE(0x04bb, 0x093d), USB_DEVICE_DATA(&rt73usb_ops) },
         { USB_DEVICE(0x148f, 0x2573), USB_DEVICE_DATA(&rt73usb_ops) },
         { USB_DEVICE(0x148f, 0x2671), USB_DEVICE_DATA(&rt73usb_ops) },
+        { USB_DEVICE(0x0812, 0x3101), USB_DEVICE_DATA(&rt73usb_ops) },
         /* Qcom */
         { USB_DEVICE(0x18e8, 0x6196), USB_DEVICE_DATA(&rt73usb_ops) },
         { USB_DEVICE(0x18e8, 0x6229), USB_DEVICE_DATA(&rt73usb_ops) },
diff --git a/drivers/net/wireless/rtlwifi/pci.c b/drivers/net/wireless/rtlwifi/pci.c
index 0fa36aa6701a..1758d4463247 100644
--- a/drivers/net/wireless/rtlwifi/pci.c
+++ b/drivers/net/wireless/rtlwifi/pci.c
@@ -619,6 +619,13 @@ static void _rtl_pci_rx_interrupt(struct ieee80211_hw *hw)
                                         struct sk_buff *uskb = NULL;
                                         u8 *pdata;
                                         uskb = dev_alloc_skb(skb->len + 128);
+                                        if (!uskb) {
+                                                RT_TRACE(rtlpriv,
+                                                        (COMP_INTR | COMP_RECV),
+                                                        DBG_EMERG,
+                                                        ("can't alloc rx skb\n"));
+                                                goto done;
+                                        }
                                         memcpy(IEEE80211_SKB_RXCB(uskb),
                                                         &rx_status,
                                                         sizeof(rx_status));
@@ -641,7 +648,7 @@ static void _rtl_pci_rx_interrupt(struct ieee80211_hw *hw)
                         new_skb = dev_alloc_skb(rtlpci->rxbuffersize);
                         if (unlikely(!new_skb)) {
                                 RT_TRACE(rtlpriv, (COMP_INTR | COMP_RECV),
-                                         DBG_DMESG,
+                                         DBG_EMERG,
                                          ("can't alloc skb for rx\n"));
                                 goto done;
                         }
@@ -1066,9 +1073,9 @@ static int _rtl_pci_init_rx_ring(struct ieee80211_hw *hw)
                         struct sk_buff *skb =
                             dev_alloc_skb(rtlpci->rxbuffersize);
                         u32 bufferaddress;
-                        entry = &rtlpci->rx_ring[rx_queue_idx].desc[i];
                         if (!skb)
                                 return 0;
+                        entry = &rtlpci->rx_ring[rx_queue_idx].desc[i];
 
                         /*skb->dev = dev; */
 
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index a29feb01854e..d2cf88407690 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -184,6 +184,7 @@ struct hci_conn {
         __u32            link_mode;
         __u8             auth_type;
         __u8             sec_level;
+        __u8             pending_sec_level;
         __u8             power_save;
         __u16            disc_timeout;
         unsigned long    pend;
diff --git a/lib/textsearch.c b/lib/textsearch.c
index d608331b3e47..e0cc0146ae62 100644
--- a/lib/textsearch.c
+++ b/lib/textsearch.c
@@ -13,7 +13,7 @@
  *
  * INTRODUCTION
  *
- *   The textsearch infrastructure provides text searching facitilies for
+ *   The textsearch infrastructure provides text searching facilities for
  *   both linear and non-linear data. Individual search algorithms are
  *   implemented in modules and chosen by the user.
  *
@@ -43,7 +43,7 @@
  *       to the algorithm to store persistent variables.
  *   (4) Core eventually resets the search offset and forwards the find()
  *       request to the algorithm.
- *   (5) Algorithm calls get_next_block() provided by the user continously
+ *   (5) Algorithm calls get_next_block() provided by the user continuously
  *       to fetch the data to be searched in block by block.
  *   (6) Algorithm invokes finish() after the last call to get_next_block
  *       to clean up any leftovers from get_next_block. (Optional)
@@ -58,15 +58,15 @@
  *   the pattern to look for and flags. As a flag, you can set TS_IGNORECASE
  *   to perform case insensitive matching. But it might slow down
  *   performance of algorithm, so you should use it at own your risk.
- *   The returned configuration may then be used for an arbitary
+ *   The returned configuration may then be used for an arbitrary
  *   amount of times and even in parallel as long as a separate struct
  *   ts_state variable is provided to every instance.
  *
  *   The actual search is performed by either calling textsearch_find_-
  *   continuous() for linear data or by providing an own get_next_block()
  *   implementation and calling textsearch_find(). Both functions return
- *   the position of the first occurrence of the patern or UINT_MAX if
- *   no match was found. Subsequent occurences can be found by calling
+ *   the position of the first occurrence of the pattern or UINT_MAX if
+ *   no match was found. Subsequent occurrences can be found by calling
  *   textsearch_next() regardless of the linearity of the data.
  *
  *   Once you're done using a configuration it must be given back via
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index 6b90a4191734..99cd8d9d891b 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -379,14 +379,10 @@ struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst, __u8
         hci_conn_hold(acl);
 
         if (acl->state == BT_OPEN || acl->state == BT_CLOSED) {
-                acl->sec_level = sec_level;
+                acl->sec_level = BT_SECURITY_LOW;
+                acl->pending_sec_level = sec_level;
                 acl->auth_type = auth_type;
                 hci_acl_connect(acl);
-        } else {
-                if (acl->sec_level < sec_level)
-                        acl->sec_level = sec_level;
-                if (acl->auth_type < auth_type)
-                        acl->auth_type = auth_type;
         }
 
         if (type == ACL_LINK)
@@ -442,11 +438,17 @@ static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
 {
         BT_DBG("conn %p", conn);
 
+        if (conn->pending_sec_level > sec_level)
+                sec_level = conn->pending_sec_level;
+
         if (sec_level > conn->sec_level)
-                conn->sec_level = sec_level;
+                conn->pending_sec_level = sec_level;
         else if (conn->link_mode & HCI_LM_AUTH)
                 return 1;
 
+        /* Make sure we preserve an existing MITM requirement*/
+        auth_type |= (conn->auth_type & 0x01);
+
         conn->auth_type = auth_type;
 
         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 8b602d881fd7..9c4541bc488a 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -1011,6 +1011,10 @@ int hci_unregister_dev(struct hci_dev *hdev)
 
         destroy_workqueue(hdev->workqueue);
 
+        hci_dev_lock_bh(hdev);
+        hci_blacklist_clear(hdev);
+        hci_dev_unlock_bh(hdev);
+
         __hci_dev_put(hdev);
 
         return 0;
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 38100170d380..a290854fdaa6 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -692,13 +692,13 @@ static int hci_outgoing_auth_needed(struct hci_dev *hdev,
         if (conn->state != BT_CONFIG || !conn->out)
                 return 0;
 
-        if (conn->sec_level == BT_SECURITY_SDP)
+        if (conn->pending_sec_level == BT_SECURITY_SDP)
                 return 0;
 
         /* Only request authentication for SSP connections or non-SSP
          * devices with sec_level HIGH */
         if (!(hdev->ssp_mode > 0 && conn->ssp_mode > 0) &&
-                                        conn->sec_level != BT_SECURITY_HIGH)
+                                conn->pending_sec_level != BT_SECURITY_HIGH)
                 return 0;
 
         return 1;
@@ -1095,9 +1095,10 @@ static inline void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *s
 
         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
         if (conn) {
-                if (!ev->status)
+                if (!ev->status) {
                         conn->link_mode |= HCI_LM_AUTH;
-                else
+                        conn->sec_level = conn->pending_sec_level;
+                } else
                         conn->sec_level = BT_SECURITY_LOW;
 
                 clear_bit(HCI_CONN_AUTH_PEND, &conn->pend);
diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
index c791fcda7b2d..7550abb0c96a 100644
--- a/net/bluetooth/l2cap.c
+++ b/net/bluetooth/l2cap.c
@@ -305,33 +305,44 @@ static void l2cap_chan_del(struct sock *sk, int err)
         }
 }
 
-/* Service level security */
-static inline int l2cap_check_security(struct sock *sk)
+static inline u8 l2cap_get_auth_type(struct sock *sk)
 {
-        struct l2cap_conn *conn = l2cap_pi(sk)->conn;
-        __u8 auth_type;
+        if (sk->sk_type == SOCK_RAW) {
+                switch (l2cap_pi(sk)->sec_level) {
+                case BT_SECURITY_HIGH:
+                        return HCI_AT_DEDICATED_BONDING_MITM;
+                case BT_SECURITY_MEDIUM:
+                        return HCI_AT_DEDICATED_BONDING;
+                default:
+                        return HCI_AT_NO_BONDING;
+                }
+        } else if (l2cap_pi(sk)->psm == cpu_to_le16(0x0001)) {
+                if (l2cap_pi(sk)->sec_level == BT_SECURITY_LOW)
+                        l2cap_pi(sk)->sec_level = BT_SECURITY_SDP;
 
-        if (l2cap_pi(sk)->psm == cpu_to_le16(0x0001)) {
                 if (l2cap_pi(sk)->sec_level == BT_SECURITY_HIGH)
-                        auth_type = HCI_AT_NO_BONDING_MITM;
+                        return HCI_AT_NO_BONDING_MITM;
                 else
-                        auth_type = HCI_AT_NO_BONDING;
-
-                if (l2cap_pi(sk)->sec_level == BT_SECURITY_LOW)
-                        l2cap_pi(sk)->sec_level = BT_SECURITY_SDP;
+                        return HCI_AT_NO_BONDING;
         } else {
                 switch (l2cap_pi(sk)->sec_level) {
                 case BT_SECURITY_HIGH:
-                        auth_type = HCI_AT_GENERAL_BONDING_MITM;
-                        break;
+                        return HCI_AT_GENERAL_BONDING_MITM;
                 case BT_SECURITY_MEDIUM:
-                        auth_type = HCI_AT_GENERAL_BONDING;
-                        break;
+                        return HCI_AT_GENERAL_BONDING;
                 default:
-                        auth_type = HCI_AT_NO_BONDING;
-                        break;
+                        return HCI_AT_NO_BONDING;
                 }
         }
+}
+
+/* Service level security */
+static inline int l2cap_check_security(struct sock *sk)
+{
+        struct l2cap_conn *conn = l2cap_pi(sk)->conn;
+        __u8 auth_type;
+
+        auth_type = l2cap_get_auth_type(sk);
 
         return hci_conn_security(conn->hcon, l2cap_pi(sk)->sec_level,
                                                                 auth_type);
@@ -1068,39 +1079,7 @@ static int l2cap_do_connect(struct sock *sk)
 
         err = -ENOMEM;
 
-        if (sk->sk_type == SOCK_RAW) {
-                switch (l2cap_pi(sk)->sec_level) {
-                case BT_SECURITY_HIGH:
-                        auth_type = HCI_AT_DEDICATED_BONDING_MITM;
-                        break;
-                case BT_SECURITY_MEDIUM:
-                        auth_type = HCI_AT_DEDICATED_BONDING;
-                        break;
-                default:
-                        auth_type = HCI_AT_NO_BONDING;
-                        break;
-                }
-        } else if (l2cap_pi(sk)->psm == cpu_to_le16(0x0001)) {
-                if (l2cap_pi(sk)->sec_level == BT_SECURITY_HIGH)
-                        auth_type = HCI_AT_NO_BONDING_MITM;
-                else
-                        auth_type = HCI_AT_NO_BONDING;
-
-                if (l2cap_pi(sk)->sec_level == BT_SECURITY_LOW)
-                        l2cap_pi(sk)->sec_level = BT_SECURITY_SDP;
-        } else {
-                switch (l2cap_pi(sk)->sec_level) {
-                case BT_SECURITY_HIGH:
-                        auth_type = HCI_AT_GENERAL_BONDING_MITM;
-                        break;
-                case BT_SECURITY_MEDIUM:
-                        auth_type = HCI_AT_GENERAL_BONDING;
-                        break;
-                default:
-                        auth_type = HCI_AT_NO_BONDING;
-                        break;
-                }
-        }
+        auth_type = l2cap_get_auth_type(sk);
 
         hcon = hci_connect(hdev, ACL_LINK, dst,
                                         l2cap_pi(sk)->sec_level, auth_type);
@@ -1127,7 +1106,8 @@ static int l2cap_do_connect(struct sock *sk)
                 if (sk->sk_type != SOCK_SEQPACKET &&
                                 sk->sk_type != SOCK_STREAM) {
                         l2cap_sock_clear_timer(sk);
-                        sk->sk_state = BT_CONNECTED;
+                        if (l2cap_check_security(sk))
+                                sk->sk_state = BT_CONNECTED;
                 } else
                         l2cap_do_start(sk);
         }
@@ -1893,8 +1873,8 @@ static int l2cap_sock_sendmsg(struct kiocb *iocb, struct socket *sock, struct ms
                 if (pi->mode == L2CAP_MODE_STREAMING) {
                         l2cap_streaming_send(sk);
                 } else {
-                        if (pi->conn_state & L2CAP_CONN_REMOTE_BUSY &&
-                                        pi->conn_state && L2CAP_CONN_WAIT_F) {
+                        if ((pi->conn_state & L2CAP_CONN_REMOTE_BUSY) &&
+                                        (pi->conn_state & L2CAP_CONN_WAIT_F)) {
                                 err = len;
                                 break;
                         }
diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index ff8aaa736650..6b83776534fb 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -1164,7 +1164,8 @@ static int rfcomm_recv_ua(struct rfcomm_session *s, u8 dlci)
                          * initiator rfcomm_process_rx already calls
                          * rfcomm_session_put() */
                         if (s->sock->sk->sk_state != BT_CLOSED)
-                                rfcomm_session_put(s);
+                                if (list_empty(&s->dlcs))
+                                        rfcomm_session_put(s);
                         break;
                 }
         }
diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index bd1af99e1122..5984ee0c7136 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -817,7 +817,7 @@ static int ethtool_get_regs(struct net_device *dev, char __user *useraddr)
         if (regs.len > reglen)
                 regs.len = reglen;
 
-        regbuf = vmalloc(reglen);
+        regbuf = vzalloc(reglen);
         if (!regbuf)
                 return -ENOMEM;
 
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 436c4c439240..a8b1e3c70d23 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -2744,8 +2744,12 @@ int skb_gro_receive(struct sk_buff **head, struct sk_buff *skb)
 
 merge:
         if (offset > headlen) {
-                skbinfo->frags[0].page_offset += offset - headlen;
-                skbinfo->frags[0].size -= offset - headlen;
+                unsigned int eat = offset - headlen;
+
+                skbinfo->frags[0].page_offset += eat;
+                skbinfo->frags[0].size -= eat;
+                skb->data_len -= eat;
+                skb->len -= eat;
                 offset = headlen;
         }
 
diff --git a/net/dcb/dcbnl.c b/net/dcb/dcbnl.c
index d900ab99814a..6b03f561caec 100644
--- a/net/dcb/dcbnl.c
+++ b/net/dcb/dcbnl.c
@@ -583,7 +583,7 @@ static int dcbnl_getapp(struct net_device *netdev, struct nlattr **tb,
         u8 up, idtype;
         int ret = -EINVAL;
 
-        if (!tb[DCB_ATTR_APP] || !netdev->dcbnl_ops->getapp)
+        if (!tb[DCB_ATTR_APP])
                 goto out;
 
         ret = nla_parse_nested(app_tb, DCB_APP_ATTR_MAX, tb[DCB_ATTR_APP],
@@ -604,7 +604,16 @@ static int dcbnl_getapp(struct net_device *netdev, struct nlattr **tb,
                 goto out;
 
         id = nla_get_u16(app_tb[DCB_APP_ATTR_ID]);
-        up = netdev->dcbnl_ops->getapp(netdev, idtype, id);
+
+        if (netdev->dcbnl_ops->getapp) {
+                up = netdev->dcbnl_ops->getapp(netdev, idtype, id);
+        } else {
+                struct dcb_app app = {
+                                        .selector = idtype,
+                                        .protocol = id,
+                                     };
+                up = dcb_getapp(netdev, &app);
+        }
 
         /* send this back */
         dcbnl_skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c
index d9bc85751c74..a96e65674ac3 100644
--- a/net/ipv4/inetpeer.c
+++ b/net/ipv4/inetpeer.c
@@ -475,7 +475,7 @@ static int cleanup_once(unsigned long ttl)
 struct inet_peer *inet_getpeer(struct inetpeer_addr *daddr, int create)
 {
         struct inet_peer __rcu **stack[PEER_MAXDEPTH], ***stackptr;
-        struct inet_peer_base *base = family_to_base(AF_INET);
+        struct inet_peer_base *base = family_to_base(daddr->family);
         struct inet_peer *p;
 
         /* Look up for the address quickly, lockless.
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 2549b29b062d..eb7f82ebf4a3 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -4399,7 +4399,7 @@ static void tcp_data_queue(struct sock *sk, struct sk_buff *skb)
                         if (!skb_copy_datagram_iovec(skb, 0, tp->ucopy.iov, chunk)) {
                                 tp->ucopy.len -= chunk;
                                 tp->copied_seq += chunk;
-                                eaten = (chunk == skb->len && !th->fin);
+                                eaten = (chunk == skb->len);
                                 tcp_rcv_space_adjust(sk);
                         }
                         local_bh_disable();
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 856f68466d49..02f583b3744a 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1994,7 +1994,6 @@ static void *listening_get_next(struct seq_file *seq, void *cur)
                                 }
                                 req = req->dl_next;
                         }
-                        st->offset = 0;
                         if (++st->sbucket >= icsk->icsk_accept_queue.listen_opt->nr_table_entries)
                                 break;
 get_req:
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 24a1cf110d80..fd6782e3a038 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -2661,14 +2661,12 @@ static int addrconf_ifdown(struct net_device *dev, int how)
         struct net *net = dev_net(dev);
         struct inet6_dev *idev;
         struct inet6_ifaddr *ifa;
-        LIST_HEAD(keep_list);
-        int state;
+        int state, i;
 
         ASSERT_RTNL();
 
-        /* Flush routes if device is being removed or it is not loopback */
-        if (how || !(dev->flags & IFF_LOOPBACK))
-                rt6_ifdown(net, dev);
+        rt6_ifdown(net, dev);
+        neigh_ifdown(&nd_tbl, dev);
 
         idev = __in6_dev_get(dev);
         if (idev == NULL)
@@ -2689,6 +2687,23 @@ static int addrconf_ifdown(struct net_device *dev, int how)
 
         }
 
+        /* Step 2: clear hash table */
+        for (i = 0; i < IN6_ADDR_HSIZE; i++) {
+                struct hlist_head *h = &inet6_addr_lst[i];
+                struct hlist_node *n;
+
+                spin_lock_bh(&addrconf_hash_lock);
+        restart:
+                hlist_for_each_entry_rcu(ifa, n, h, addr_lst) {
+                        if (ifa->idev == idev) {
+                                hlist_del_init_rcu(&ifa->addr_lst);
+                                addrconf_del_timer(ifa);
+                                goto restart;
+                        }
+                }
+                spin_unlock_bh(&addrconf_hash_lock);
+        }
+
         write_lock_bh(&idev->lock);
 
         /* Step 2: clear flags for stateless addrconf */
@@ -2722,52 +2737,23 @@ static int addrconf_ifdown(struct net_device *dev, int how)
                                        struct inet6_ifaddr, if_list);
                 addrconf_del_timer(ifa);
 
-                /* If just doing link down, and address is permanent
-                   and not link-local, then retain it. */
-                if (!how &&
-                    (ifa->flags&IFA_F_PERMANENT) &&
-                    !(ipv6_addr_type(&ifa->addr) & IPV6_ADDR_LINKLOCAL)) {
-                        list_move_tail(&ifa->if_list, &keep_list);
-
-                        /* If not doing DAD on this address, just keep it. */
-                        if ((dev->flags&(IFF_NOARP|IFF_LOOPBACK)) ||
-                            idev->cnf.accept_dad <= 0 ||
-                            (ifa->flags & IFA_F_NODAD))
-                                continue;
+                list_del(&ifa->if_list);
 
-                        /* If it was tentative already, no need to notify */
-                        if (ifa->flags & IFA_F_TENTATIVE)
-                                continue;
+                write_unlock_bh(&idev->lock);
 
-                        /* Flag it for later restoration when link comes up */
-                        ifa->flags |= IFA_F_TENTATIVE;
-                        ifa->state = INET6_IFADDR_STATE_DAD;
-                } else {
-                        list_del(&ifa->if_list);
-
-                        /* clear hash table */
-                        spin_lock_bh(&addrconf_hash_lock);
-                        hlist_del_init_rcu(&ifa->addr_lst);
-                        spin_unlock_bh(&addrconf_hash_lock);
-
-                        write_unlock_bh(&idev->lock);
-                        spin_lock_bh(&ifa->state_lock);
-                        state = ifa->state;
-                        ifa->state = INET6_IFADDR_STATE_DEAD;
-                        spin_unlock_bh(&ifa->state_lock);
-
-                        if (state != INET6_IFADDR_STATE_DEAD) {
-                                __ipv6_ifa_notify(RTM_DELADDR, ifa);
-                                atomic_notifier_call_chain(&inet6addr_chain,
-                                                           NETDEV_DOWN, ifa);
-                        }
+                spin_lock_bh(&ifa->state_lock);
+                state = ifa->state;
+                ifa->state = INET6_IFADDR_STATE_DEAD;
+                spin_unlock_bh(&ifa->state_lock);
 
-                        in6_ifa_put(ifa);
-                        write_lock_bh(&idev->lock);
+                if (state != INET6_IFADDR_STATE_DEAD) {
+                        __ipv6_ifa_notify(RTM_DELADDR, ifa);
+                        atomic_notifier_call_chain(&inet6addr_chain, NETDEV_DOWN, ifa);
                 }
-        }
+                in6_ifa_put(ifa);
 
-        list_splice(&keep_list, &idev->addr_list);
+                write_lock_bh(&idev->lock);
+        }
 
         write_unlock_bh(&idev->lock);
 
@@ -4156,8 +4142,7 @@ static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp)
                 addrconf_leave_solict(ifp->idev, &ifp->addr);
                 dst_hold(&ifp->rt->dst);
 
-                if (ifp->state == INET6_IFADDR_STATE_DEAD &&
-                    ip6_del_rt(ifp->rt))
+                if (ip6_del_rt(ifp->rt))
                         dst_free(&ifp->rt->dst);
                 break;
         }
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 373bd0416f69..1534508f6c68 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -72,8 +72,6 @@
 #define RT6_TRACE(x...) do { ; } while (0)
 #endif
 
-#define CLONE_OFFLINK_ROUTE 0
-
 static struct rt6_info * ip6_rt_copy(struct rt6_info *ort);
 static struct dst_entry *ip6_dst_check(struct dst_entry *dst, u32 cookie);
 static unsigned int      ip6_default_advmss(const struct dst_entry *dst);
@@ -738,13 +736,8 @@ restart:
 
         if (!rt->rt6i_nexthop && !(rt->rt6i_flags & RTF_NONEXTHOP))
                 nrt = rt6_alloc_cow(rt, &fl->fl6_dst, &fl->fl6_src);
-        else {
-#if CLONE_OFFLINK_ROUTE
+        else
                 nrt = rt6_alloc_clone(rt, &fl->fl6_dst);
-#else
-                goto out2;
-#endif
-        }
 
         dst_release(&rt->dst);
         rt = nrt ? : net->ipv6.ip6_null_entry;
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index 7e74023ea6e4..da87428681cc 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -98,6 +98,10 @@ static int xfrm6_fill_dst(struct xfrm_dst *xdst, struct net_device *dev,
         if (!xdst->u.rt6.rt6i_idev)
                 return -ENODEV;
 
+        xdst->u.rt6.rt6i_peer = rt->rt6i_peer;
+        if (rt->rt6i_peer)
+                atomic_inc(&rt->rt6i_peer->refcnt);
+
         /* Sheit... I remember I did this right. Apparently,
          * it was magically lost, so this code needs audit */
         xdst->u.rt6.rt6i_flags = rt->rt6i_flags & (RTF_ANYCAST |
@@ -216,6 +220,8 @@ static void xfrm6_dst_destroy(struct dst_entry *dst)
 
         if (likely(xdst->u.rt6.rt6i_idev))
                 in6_dev_put(xdst->u.rt6.rt6i_idev);
+        if (likely(xdst->u.rt6.rt6i_peer))
+                inet_putpeer(xdst->u.rt6.rt6i_peer);
         xfrm_dst_destroy(xdst);
 }
 
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 5950e3abead9..b64b42bc774b 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -2230,6 +2230,9 @@ struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
 
         sdata = vif_to_sdata(vif);
 
+        if (!ieee80211_sdata_running(sdata))
+                goto out;
+
         if (tim_offset)
                 *tim_offset = 0;
         if (tim_length)