67 files changed, 364 insertions, 228 deletions

diff --git a/drivers/atm/iphase.c b/drivers/atm/iphase.c
index d4386019af5d..96cce6d53195 100644
--- a/drivers/atm/iphase.c
+++ b/drivers/atm/iphase.c
@@ -2362,7 +2362,7 @@ static int __devinit ia_init(struct atm_dev *dev)
         {  
                 printk(DEV_LABEL " (itf %d): can't set up page mapping\n",  
                             dev->number);  
-                return error;  
+                return -ENOMEM;
         }  
         IF_INIT(printk(DEV_LABEL " (itf %d): rev.%d,base=%p,irq=%d\n",  
                         dev->number, iadev->pci->revision, base, iadev->irq);)
diff --git a/drivers/bcma/host_pci.c b/drivers/bcma/host_pci.c
index 11b32d2642df..a6e5672c67e7 100644
--- a/drivers/bcma/host_pci.c
+++ b/drivers/bcma/host_pci.c
@@ -272,6 +272,7 @@ static DEFINE_PCI_DEVICE_TABLE(bcma_pci_bridge_tbl) = {
         { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4331) },
         { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4353) },
         { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4357) },
+        { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4359) },
         { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4727) },
         { 0, },
 };
diff --git a/drivers/bcma/sprom.c b/drivers/bcma/sprom.c
index 26823d97fd9f..9ea4627dc0c2 100644
--- a/drivers/bcma/sprom.c
+++ b/drivers/bcma/sprom.c
@@ -507,7 +507,9 @@ static bool bcma_sprom_onchip_available(struct bcma_bus *bus)
                 /* for these chips OTP is always available */
                 present = true;
                 break;
-
+        case BCMA_CHIP_ID_BCM43228:
+                present = chip_status & BCMA_CC_CHIPST_43228_OTP_PRESENT;
+                break;
         default:
                 present = false;
                 break;
diff --git a/drivers/isdn/isdnloop/isdnloop.c b/drivers/isdn/isdnloop/isdnloop.c
index 5405ec644db3..baf2686aa8eb 100644
--- a/drivers/isdn/isdnloop/isdnloop.c
+++ b/drivers/isdn/isdnloop/isdnloop.c
@@ -16,7 +16,6 @@
 #include <linux/sched.h>
 #include "isdnloop.h"
 
-static char *revision = "$Revision: 1.11.6.7 $";
 static char *isdnloop_id = "loop0";
 
 MODULE_DESCRIPTION("ISDN4Linux: Pseudo Driver that simulates an ISDN card");
@@ -1494,17 +1493,6 @@ isdnloop_addcard(char *id1)
 static int __init
 isdnloop_init(void)
 {
-        char *p;
-        char rev[10];
-
-        if ((p = strchr(revision, ':'))) {
-                strcpy(rev, p + 1);
-                p = strchr(rev, '$');
-                *p = 0;
-        } else
-                strcpy(rev, " ??? ");
-        printk(KERN_NOTICE "isdnloop-ISDN-driver Rev%s\n", rev);
-
         if (isdnloop_id)
                 return (isdnloop_addcard(isdnloop_id));
 
diff --git a/drivers/isdn/mISDN/layer2.c b/drivers/isdn/mISDN/layer2.c
index 0dc8abca1407..949cabb88f1c 100644
--- a/drivers/isdn/mISDN/layer2.c
+++ b/drivers/isdn/mISDN/layer2.c
@@ -2222,7 +2222,7 @@ create_l2(struct mISDNchannel *ch, u_int protocol, u_long options, int tei,
         InitWin(l2);
         l2->l2m.fsm = &l2fsm;
         if (test_bit(FLG_LAPB, &l2->flag) ||
-            test_bit(FLG_PTP, &l2->flag) ||
+            test_bit(FLG_FIXED_TEI, &l2->flag) ||
             test_bit(FLG_LAPD_NET, &l2->flag))
                 l2->l2m.state = ST_L2_4;
         else
diff --git a/drivers/net/appletalk/cops.c b/drivers/net/appletalk/cops.c
index 545c09ed9079..cff6f023c03a 100644
--- a/drivers/net/appletalk/cops.c
+++ b/drivers/net/appletalk/cops.c
@@ -996,9 +996,7 @@ static int __init cops_module_init(void)
                 printk(KERN_WARNING "%s: You shouldn't autoprobe with insmod\n",
                         cardname);
         cops_dev = cops_probe(-1);
-        if (IS_ERR(cops_dev))
-                return PTR_ERR(cops_dev);
-        return 0;
+        return PTR_RET(cops_dev);
 }
 
 static void __exit cops_module_exit(void)
diff --git a/drivers/net/appletalk/ltpc.c b/drivers/net/appletalk/ltpc.c
index 0910dce3996d..b5782cdf0bca 100644
--- a/drivers/net/appletalk/ltpc.c
+++ b/drivers/net/appletalk/ltpc.c
@@ -1243,9 +1243,7 @@ static int __init ltpc_module_init(void)
                        "ltpc: Autoprobing is not recommended for modules\n");
 
         dev_ltpc = ltpc_probe();
-        if (IS_ERR(dev_ltpc))
-                return PTR_ERR(dev_ltpc);
-        return 0;
+        return PTR_RET(dev_ltpc);
 }
 module_init(ltpc_module_init);
 #endif
diff --git a/drivers/net/cris/eth_v10.c b/drivers/net/cris/eth_v10.c
index f0c8bd54ce29..021d69c5d9bc 100644
--- a/drivers/net/cris/eth_v10.c
+++ b/drivers/net/cris/eth_v10.c
@@ -1712,7 +1712,7 @@ e100_set_network_leds(int active)
 static void
 e100_netpoll(struct net_device* netdev)
 {
-        e100rxtx_interrupt(NETWORK_DMA_TX_IRQ_NBR, netdev, NULL);
+        e100rxtx_interrupt(NETWORK_DMA_TX_IRQ_NBR, netdev);
 }
 #endif
 
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c
index 734fd87cd990..62f754bd0dfe 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c
@@ -2485,6 +2485,7 @@ static int bnx2x_mcast_enqueue_cmd(struct bnx2x *bp,
                 break;
 
         default:
+                kfree(new_cmd);
                 BNX2X_ERR("Unknown command: %d\n", cmd);
                 return -EINVAL;
         }
diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
index c60de89b6669..90a903d83d87 100644
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -1948,7 +1948,7 @@ static int be_rx_cqs_create(struct be_adapter *adapter)
 
         if (adapter->num_rx_qs != MAX_RX_QS)
                 dev_info(&adapter->pdev->dev,
-                        "Created only %d receive queues", adapter->num_rx_qs);
+                        "Created only %d receive queues\n", adapter->num_rx_qs);
 
         return 0;
 }
diff --git a/drivers/net/ethernet/intel/igb/e1000_82575.c b/drivers/net/ethernet/intel/igb/e1000_82575.c
index 5e84eaac48c1..ba994fb4cec6 100644
--- a/drivers/net/ethernet/intel/igb/e1000_82575.c
+++ b/drivers/net/ethernet/intel/igb/e1000_82575.c
@@ -254,6 +254,14 @@ static s32 igb_get_invariants_82575(struct e1000_hw *hw)
          */
         size += NVM_WORD_SIZE_BASE_SHIFT;
 
+        /*
+         * Check for invalid size
+         */
+        if ((hw->mac.type == e1000_82576) && (size > 15)) {
+                pr_notice("The NVM size is not valid, defaulting to 32K\n");
+                size = 15;
+        }
+
         nvm->word_size = 1 << size;
         if (hw->mac.type < e1000_i210) {
                 nvm->opcode_bits        = 8;
@@ -281,14 +289,6 @@ static s32 igb_get_invariants_82575(struct e1000_hw *hw)
         } else
                 nvm->type = e1000_nvm_flash_hw;
 
-        /*
-         * Check for invalid size
-         */
-        if ((hw->mac.type == e1000_82576) && (size > 15)) {
-                pr_notice("The NVM size is not valid, defaulting to 32K\n");
-                size = 15;
-        }
-
         /* NVM Function Pointers */
         switch (hw->mac.type) {
         case e1000_82580:
diff --git a/drivers/net/ethernet/intel/igb/igb_ethtool.c b/drivers/net/ethernet/intel/igb/igb_ethtool.c
index a19c84cad0e9..90550f5e3dd9 100644
--- a/drivers/net/ethernet/intel/igb/igb_ethtool.c
+++ b/drivers/net/ethernet/intel/igb/igb_ethtool.c
@@ -209,8 +209,8 @@ static int igb_set_settings(struct net_device *netdev, struct ethtool_cmd *ecmd)
         /* When SoL/IDER sessions are active, autoneg/speed/duplex
          * cannot be changed */
         if (igb_check_reset_block(hw)) {
-                dev_err(&adapter->pdev->dev, "Cannot change link "
-                        "characteristics when SoL/IDER is active.\n");
+                dev_err(&adapter->pdev->dev,
+                        "Cannot change link characteristics when SoL/IDER is active.\n");
                 return -EINVAL;
         }
 
@@ -1089,8 +1089,8 @@ static bool reg_pattern_test(struct igb_adapter *adapter, u64 *data,
                 wr32(reg, (_test[pat] & write));
                 val = rd32(reg) & mask;
                 if (val != (_test[pat] & write & mask)) {
-                        dev_err(&adapter->pdev->dev, "pattern test reg %04X "
-                                "failed: got 0x%08X expected 0x%08X\n",
+                        dev_err(&adapter->pdev->dev,
+                                "pattern test reg %04X failed: got 0x%08X expected 0x%08X\n",
                                 reg, val, (_test[pat] & write & mask));
                         *data = reg;
                         return 1;
@@ -1108,8 +1108,8 @@ static bool reg_set_and_check(struct igb_adapter *adapter, u64 *data,
         wr32(reg, write & mask);
         val = rd32(reg);
         if ((write & mask) != (val & mask)) {
-                dev_err(&adapter->pdev->dev, "set/check reg %04X test failed:"
-                        " got 0x%08X expected 0x%08X\n", reg,
+                dev_err(&adapter->pdev->dev,
+                        "set/check reg %04X test failed: got 0x%08X expected 0x%08X\n", reg,
                         (val & mask), (write & mask));
                 *data = reg;
                 return 1;
@@ -1171,8 +1171,9 @@ static int igb_reg_test(struct igb_adapter *adapter, u64 *data)
         wr32(E1000_STATUS, toggle);
         after = rd32(E1000_STATUS) & toggle;
         if (value != after) {
-                dev_err(&adapter->pdev->dev, "failed STATUS register test "
-                        "got: 0x%08X expected: 0x%08X\n", after, value);
+                dev_err(&adapter->pdev->dev,
+                        "failed STATUS register test got: 0x%08X expected: 0x%08X\n",
+                        after, value);
                 *data = 1;
                 return 1;
         }
@@ -1777,16 +1778,14 @@ static int igb_loopback_test(struct igb_adapter *adapter, u64 *data)
          * sessions are active */
         if (igb_check_reset_block(&adapter->hw)) {
                 dev_err(&adapter->pdev->dev,
-                        "Cannot do PHY loopback test "
-                        "when SoL/IDER is active.\n");
+                        "Cannot do PHY loopback test when SoL/IDER is active.\n");
                 *data = 0;
                 goto out;
         }
         if ((adapter->hw.mac.type == e1000_i210)
-                || (adapter->hw.mac.type == e1000_i210)) {
+                || (adapter->hw.mac.type == e1000_i211)) {
                 dev_err(&adapter->pdev->dev,
-                        "Loopback test not supported "
-                        "on this part at this time.\n");
+                        "Loopback test not supported on this part at this time.\n");
                 *data = 0;
                 goto out;
         }
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_rx.c b/drivers/net/ethernet/mellanox/mlx4/en_rx.c
index f32e70300770..5aba5ecdf1e2 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_rx.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_rx.c
@@ -614,8 +614,8 @@ int mlx4_en_process_rx_cq(struct net_device *dev, struct mlx4_en_cq *cq, int bud
                 /* If source MAC is equal to our own MAC and not performing
                  * the selftest or flb disabled - drop the packet */
                 if (s_mac == priv->mac &&
-                        (!(dev->features & NETIF_F_LOOPBACK) ||
-                         !priv->validate_loopback))
+                    !((dev->features & NETIF_F_LOOPBACK) ||
+                      priv->validate_loopback))
                         goto next;
 
                 /*
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_tx.c b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
index 019d856b1334..10bba09c44ea 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_tx.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
@@ -164,7 +164,6 @@ int mlx4_en_activate_tx_ring(struct mlx4_en_priv *priv,
         ring->cons = 0xffffffff;
         ring->last_nr_txbb = 1;
         ring->poll_cnt = 0;
-        ring->blocked = 0;
         memset(ring->tx_info, 0, ring->size * sizeof(struct mlx4_en_tx_info));
         memset(ring->buf, 0, ring->buf_size);
 
@@ -365,14 +364,13 @@ static void mlx4_en_process_tx_cq(struct net_device *dev, struct mlx4_en_cq *cq)
         ring->cons += txbbs_skipped;
         netdev_tx_completed_queue(ring->tx_queue, packets, bytes);
 
-        /* Wakeup Tx queue if this ring stopped it */
-        if (unlikely(ring->blocked)) {
-                if ((u32) (ring->prod - ring->cons) <=
-                     ring->size - HEADROOM - MAX_DESC_TXBBS) {
-                        ring->blocked = 0;
-                        netif_tx_wake_queue(ring->tx_queue);
-                        priv->port_stats.wake_queue++;
-                }
+        /*
+         * Wakeup Tx queue if this stopped, and at least 1 packet
+         * was completed
+         */
+        if (netif_tx_queue_stopped(ring->tx_queue) && txbbs_skipped > 0) {
+                netif_tx_wake_queue(ring->tx_queue);
+                priv->port_stats.wake_queue++;
         }
 }
 
@@ -592,7 +590,6 @@ netdev_tx_t mlx4_en_xmit(struct sk_buff *skb, struct net_device *dev)
                      ring->size - HEADROOM - MAX_DESC_TXBBS)) {
                 /* every full Tx ring stops queue */
                 netif_tx_stop_queue(ring->tx_queue);
-                ring->blocked = 1;
                 priv->port_stats.queue_stopped++;
 
                 return NETDEV_TX_BUSY;
diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
index 48d0e90194cb..827b72dfce99 100644
--- a/drivers/net/ethernet/mellanox/mlx4/main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/main.c
@@ -157,9 +157,6 @@ int mlx4_check_port_params(struct mlx4_dev *dev,
                                          "on this HCA, aborting.\n");
                                 return -EINVAL;
                         }
-                        if (port_type[i] == MLX4_PORT_TYPE_ETH &&
-                            port_type[i + 1] == MLX4_PORT_TYPE_IB)
-                                return -EINVAL;
                 }
         }
 
diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
index 5f1ab105debc..9d27e42264e2 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
+++ b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
@@ -248,7 +248,6 @@ struct mlx4_en_tx_ring {
         u32 doorbell_qpn;
         void *buf;
         u16 poll_cnt;
-        int blocked;
         struct mlx4_en_tx_info *tx_info;
         u8 *bounce_buf;
         u32 last_nr_txbb;
diff --git a/drivers/net/ethernet/mellanox/mlx4/sense.c b/drivers/net/ethernet/mellanox/mlx4/sense.c
index 802498293528..34ee09bae36e 100644
--- a/drivers/net/ethernet/mellanox/mlx4/sense.c
+++ b/drivers/net/ethernet/mellanox/mlx4/sense.c
@@ -81,20 +81,6 @@ void mlx4_do_sense_ports(struct mlx4_dev *dev,
         }
 
         /*
-         * Adjust port configuration:
-         * If port 1 sensed nothing and port 2 is IB, set both as IB
-         * If port 2 sensed nothing and port 1 is Eth, set both as Eth
-         */
-        if (stype[0] == MLX4_PORT_TYPE_ETH) {
-                for (i = 1; i < dev->caps.num_ports; i++)
-                        stype[i] = stype[i] ? stype[i] : MLX4_PORT_TYPE_ETH;
-        }
-        if (stype[dev->caps.num_ports - 1] == MLX4_PORT_TYPE_IB) {
-                for (i = 0; i < dev->caps.num_ports - 1; i++)
-                        stype[i] = stype[i] ? stype[i] : MLX4_PORT_TYPE_IB;
-        }
-
-        /*
          * If sensed nothing, remain in current configuration.
          */
         for (i = 0; i < dev->caps.num_ports; i++)
diff --git a/drivers/net/ethernet/sfc/efx.c b/drivers/net/ethernet/sfc/efx.c
index 70554a1b2b02..65a8d49106a4 100644
--- a/drivers/net/ethernet/sfc/efx.c
+++ b/drivers/net/ethernet/sfc/efx.c
@@ -1503,6 +1503,11 @@ static int efx_probe_all(struct efx_nic *efx)
                 goto fail2;
         }
 
+        BUILD_BUG_ON(EFX_DEFAULT_DMAQ_SIZE < EFX_RXQ_MIN_ENT);
+        if (WARN_ON(EFX_DEFAULT_DMAQ_SIZE < EFX_TXQ_MIN_ENT(efx))) {
+                rc = -EINVAL;
+                goto fail3;
+        }
         efx->rxq_entries = efx->txq_entries = EFX_DEFAULT_DMAQ_SIZE;
 
         rc = efx_probe_filters(efx);
@@ -2070,6 +2075,7 @@ static int efx_register_netdev(struct efx_nic *efx)
         net_dev->irq = efx->pci_dev->irq;
         net_dev->netdev_ops = &efx_netdev_ops;
         SET_ETHTOOL_OPS(net_dev, &efx_ethtool_ops);
+        net_dev->gso_max_segs = EFX_TSO_MAX_SEGS;
 
         rtnl_lock();
 
diff --git a/drivers/net/ethernet/sfc/efx.h b/drivers/net/ethernet/sfc/efx.h
index be8f9158a714..70755c97251a 100644
--- a/drivers/net/ethernet/sfc/efx.h
+++ b/drivers/net/ethernet/sfc/efx.h
@@ -30,6 +30,7 @@ extern netdev_tx_t
 efx_enqueue_skb(struct efx_tx_queue *tx_queue, struct sk_buff *skb);
 extern void efx_xmit_done(struct efx_tx_queue *tx_queue, unsigned int index);
 extern int efx_setup_tc(struct net_device *net_dev, u8 num_tc);
+extern unsigned int efx_tx_max_skb_descs(struct efx_nic *efx);
 
 /* RX */
 extern int efx_probe_rx_queue(struct efx_rx_queue *rx_queue);
@@ -52,10 +53,15 @@ extern void efx_schedule_slow_fill(struct efx_rx_queue *rx_queue);
 #define EFX_MAX_EVQ_SIZE 16384UL
 #define EFX_MIN_EVQ_SIZE 512UL
 
-/* The smallest [rt]xq_entries that the driver supports. Callers of
- * efx_wake_queue() assume that they can subsequently send at least one
- * skb. Falcon/A1 may require up to three descriptors per skb_frag. */
-#define EFX_MIN_RING_SIZE (roundup_pow_of_two(2 * 3 * MAX_SKB_FRAGS))
+/* Maximum number of TCP segments we support for soft-TSO */
+#define EFX_TSO_MAX_SEGS        100
+
+/* The smallest [rt]xq_entries that the driver supports.  RX minimum
+ * is a bit arbitrary.  For TX, we must have space for at least 2
+ * TSO skbs.
+ */
+#define EFX_RXQ_MIN_ENT         128U
+#define EFX_TXQ_MIN_ENT(efx)    (2 * efx_tx_max_skb_descs(efx))
 
 /* Filters */
 extern int efx_probe_filters(struct efx_nic *efx);
diff --git a/drivers/net/ethernet/sfc/ethtool.c b/drivers/net/ethernet/sfc/ethtool.c
index 10536f93b561..8cba2df82b18 100644
--- a/drivers/net/ethernet/sfc/ethtool.c
+++ b/drivers/net/ethernet/sfc/ethtool.c
@@ -680,21 +680,27 @@ static int efx_ethtool_set_ringparam(struct net_device *net_dev,
                                      struct ethtool_ringparam *ring)
 {
         struct efx_nic *efx = netdev_priv(net_dev);
+        u32 txq_entries;
 
         if (ring->rx_mini_pending || ring->rx_jumbo_pending ||
             ring->rx_pending > EFX_MAX_DMAQ_SIZE ||
             ring->tx_pending > EFX_MAX_DMAQ_SIZE)
                 return -EINVAL;
 
-        if (ring->rx_pending < EFX_MIN_RING_SIZE ||
-            ring->tx_pending < EFX_MIN_RING_SIZE) {
+        if (ring->rx_pending < EFX_RXQ_MIN_ENT) {
                 netif_err(efx, drv, efx->net_dev,
-                          "TX and RX queues cannot be smaller than %ld\n",
-                          EFX_MIN_RING_SIZE);
+                          "RX queues cannot be smaller than %u\n",
+                          EFX_RXQ_MIN_ENT);
                 return -EINVAL;
         }
 
-        return efx_realloc_channels(efx, ring->rx_pending, ring->tx_pending);
+        txq_entries = max(ring->tx_pending, EFX_TXQ_MIN_ENT(efx));
+        if (txq_entries != ring->tx_pending)
+                netif_warn(efx, drv, efx->net_dev,
+                           "increasing TX queue size to minimum of %u\n",
+                           txq_entries);
+
+        return efx_realloc_channels(efx, ring->rx_pending, txq_entries);
 }
 
 static int efx_ethtool_set_pauseparam(struct net_device *net_dev,
diff --git a/drivers/net/ethernet/sfc/tx.c b/drivers/net/ethernet/sfc/tx.c
index 9b225a7769f7..18713436b443 100644
--- a/drivers/net/ethernet/sfc/tx.c
+++ b/drivers/net/ethernet/sfc/tx.c
@@ -119,6 +119,25 @@ efx_max_tx_len(struct efx_nic *efx, dma_addr_t dma_addr)
         return len;
 }
 
+unsigned int efx_tx_max_skb_descs(struct efx_nic *efx)
+{
+        /* Header and payload descriptor for each output segment, plus
+         * one for every input fragment boundary within a segment
+         */
+        unsigned int max_descs = EFX_TSO_MAX_SEGS * 2 + MAX_SKB_FRAGS;
+
+        /* Possibly one more per segment for the alignment workaround */
+        if (EFX_WORKAROUND_5391(efx))
+                max_descs += EFX_TSO_MAX_SEGS;
+
+        /* Possibly more for PCIe page boundaries within input fragments */
+        if (PAGE_SIZE > EFX_PAGE_SIZE)
+                max_descs += max_t(unsigned int, MAX_SKB_FRAGS,
+                                   DIV_ROUND_UP(GSO_MAX_SIZE, EFX_PAGE_SIZE));
+
+        return max_descs;
+}
+
 /*
  * Add a socket buffer to a TX queue
  *
diff --git a/drivers/net/ethernet/xscale/ixp4xx_eth.c b/drivers/net/ethernet/xscale/ixp4xx_eth.c
index 482648fcf0b6..98934bdf6acf 100644
--- a/drivers/net/ethernet/xscale/ixp4xx_eth.c
+++ b/drivers/net/ethernet/xscale/ixp4xx_eth.c
@@ -1003,6 +1003,7 @@ static int ixp4xx_nway_reset(struct net_device *dev)
 }
 
 int ixp46x_phc_index = -1;
+EXPORT_SYMBOL_GPL(ixp46x_phc_index);
 
 static int ixp4xx_get_ts_info(struct net_device *dev,
                               struct ethtool_ts_info *info)
diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c
index 6cee2917eb02..4a1a5f58fa73 100644
--- a/drivers/net/hyperv/netvsc.c
+++ b/drivers/net/hyperv/netvsc.c
@@ -383,13 +383,6 @@ int netvsc_device_remove(struct hv_device *device)
         unsigned long flags;
 
         net_device = hv_get_drvdata(device);
-        spin_lock_irqsave(&device->channel->inbound_lock, flags);
-        net_device->destroy = true;
-        spin_unlock_irqrestore(&device->channel->inbound_lock, flags);
-
-        /* Wait for all send completions */
-        wait_event(net_device->wait_drain,
-                   atomic_read(&net_device->num_outstanding_sends) == 0);
 
         netvsc_disconnect_vsp(net_device);
 
diff --git a/drivers/net/hyperv/rndis_filter.c b/drivers/net/hyperv/rndis_filter.c
index e5d6146937fa..1e88a1095934 100644
--- a/drivers/net/hyperv/rndis_filter.c
+++ b/drivers/net/hyperv/rndis_filter.c
@@ -718,6 +718,9 @@ static void rndis_filter_halt_device(struct rndis_device *dev)
 {
         struct rndis_request *request;
         struct rndis_halt_request *halt;
+        struct netvsc_device *nvdev = dev->net_dev;
+        struct hv_device *hdev = nvdev->dev;
+        ulong flags;
 
         /* Attempt to do a rndis device halt */
         request = get_rndis_request(dev, RNDIS_MSG_HALT,
@@ -735,6 +738,14 @@ static void rndis_filter_halt_device(struct rndis_device *dev)
         dev->state = RNDIS_DEV_UNINITIALIZED;
 
 cleanup:
+        spin_lock_irqsave(&hdev->channel->inbound_lock, flags);
+        nvdev->destroy = true;
+        spin_unlock_irqrestore(&hdev->channel->inbound_lock, flags);
+
+        /* Wait for all send completions */
+        wait_event(nvdev->wait_drain,
+                atomic_read(&nvdev->num_outstanding_sends) == 0);
+
         if (request)
                 put_rndis_request(dev, request);
         return;
diff --git a/drivers/net/phy/mdio-mux-gpio.c b/drivers/net/phy/mdio-mux-gpio.c
index e0cc4ef33dee..eefe49e8713c 100644
--- a/drivers/net/phy/mdio-mux-gpio.c
+++ b/drivers/net/phy/mdio-mux-gpio.c
@@ -101,7 +101,6 @@ err:
                 n--;
                 gpio_free(s->gpio[n]);
         }
-        devm_kfree(&pdev->dev, s);
         return r;
 }
 
diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
index f4ce5957df32..4cd582a4f625 100644
--- a/drivers/net/usb/cdc_ncm.c
+++ b/drivers/net/usb/cdc_ncm.c
@@ -1225,6 +1225,26 @@ static const struct usb_device_id cdc_devs[] = {
           .driver_info = (unsigned long) &wwan_info,
         },
 
+        /* Dell branded MBM devices like DW5550 */
+        { .match_flags = USB_DEVICE_ID_MATCH_INT_INFO
+                | USB_DEVICE_ID_MATCH_VENDOR,
+          .idVendor = 0x413c,
+          .bInterfaceClass = USB_CLASS_COMM,
+          .bInterfaceSubClass = USB_CDC_SUBCLASS_NCM,
+          .bInterfaceProtocol = USB_CDC_PROTO_NONE,
+          .driver_info = (unsigned long) &wwan_info,
+        },
+
+        /* Toshiba branded MBM devices */
+        { .match_flags = USB_DEVICE_ID_MATCH_INT_INFO
+                | USB_DEVICE_ID_MATCH_VENDOR,
+          .idVendor = 0x0930,
+          .bInterfaceClass = USB_CLASS_COMM,
+          .bInterfaceSubClass = USB_CDC_SUBCLASS_NCM,
+          .bInterfaceProtocol = USB_CDC_PROTO_NONE,
+          .driver_info = (unsigned long) &wwan_info,
+        },
+
         /* Generic CDC-NCM devices */
         { USB_INTERFACE_INFO(USB_CLASS_COMM,
                 USB_CDC_SUBCLASS_NCM, USB_CDC_PROTO_NONE),
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index cfa91ab7acf8..60b6a9daff7e 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -730,6 +730,7 @@ int ath9k_hw_init(struct ath_hw *ah)
         case AR9300_DEVID_QCA955X:
         case AR9300_DEVID_AR9580:
         case AR9300_DEVID_AR9462:
+        case AR9485_DEVID_AR1111:
                 break;
         default:
                 if (common->bus_ops->ath_bus_type == ATH_USB)
diff --git a/drivers/net/wireless/ath/ath9k/hw.h b/drivers/net/wireless/ath/ath9k/hw.h
index dd0c146d81dc..ce7332c64efb 100644
--- a/drivers/net/wireless/ath/ath9k/hw.h
+++ b/drivers/net/wireless/ath/ath9k/hw.h
@@ -49,6 +49,7 @@
 #define AR9300_DEVID_AR9462     0x0034
 #define AR9300_DEVID_AR9330     0x0035
 #define AR9300_DEVID_QCA955X    0x0038
+#define AR9485_DEVID_AR1111     0x0037
 
 #define AR5416_AR9100_DEVID     0x000b
 
diff --git a/drivers/net/wireless/ath/ath9k/pci.c b/drivers/net/wireless/ath/ath9k/pci.c
index 87b89d55e637..d455de9162ec 100644
--- a/drivers/net/wireless/ath/ath9k/pci.c
+++ b/drivers/net/wireless/ath/ath9k/pci.c
@@ -37,6 +37,7 @@ static DEFINE_PCI_DEVICE_TABLE(ath_pci_id_table) = {
         { PCI_VDEVICE(ATHEROS, 0x0032) }, /* PCI-E  AR9485 */
         { PCI_VDEVICE(ATHEROS, 0x0033) }, /* PCI-E  AR9580 */
         { PCI_VDEVICE(ATHEROS, 0x0034) }, /* PCI-E  AR9462 */
+        { PCI_VDEVICE(ATHEROS, 0x0037) }, /* PCI-E  AR1111/AR9485 */
         { 0 }
 };
 
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index b80352b308d5..a140165dfee0 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -2719,32 +2719,37 @@ static int b43_gpio_init(struct b43_wldev *dev)
         if (dev->dev->chip_id == 0x4301) {
                 mask |= 0x0060;
                 set |= 0x0060;
+        } else if (dev->dev->chip_id == 0x5354) {
+                /* Don't allow overtaking buttons GPIOs */
+                set &= 0x2; /* 0x2 is LED GPIO on BCM5354 */
         }
-        if (dev->dev->chip_id == 0x5354)
-                set &= 0xff02;
+
         if (0 /* FIXME: conditional unknown */ ) {
                 b43_write16(dev, B43_MMIO_GPIO_MASK,
                             b43_read16(dev, B43_MMIO_GPIO_MASK)
                             | 0x0100);
-                mask |= 0x0180;
-                set |= 0x0180;
+                /* BT Coexistance Input */
+                mask |= 0x0080;
+                set |= 0x0080;
+                /* BT Coexistance Out */
+                mask |= 0x0100;
+                set |= 0x0100;
         }
         if (dev->dev->bus_sprom->boardflags_lo & B43_BFL_PACTRL) {
+                /* PA is controlled by gpio 9, let ucode handle it */
                 b43_write16(dev, B43_MMIO_GPIO_MASK,
                             b43_read16(dev, B43_MMIO_GPIO_MASK)
                             | 0x0200);
                 mask |= 0x0200;
                 set |= 0x0200;
         }
-        if (dev->dev->core_rev >= 2)
-                mask |= 0x0010; /* FIXME: This is redundant. */
 
         switch (dev->dev->bus_type) {
 #ifdef CONFIG_B43_BCMA
         case B43_BUS_BCMA:
                 bcma_cc_write32(&dev->dev->bdev->bus->drv_cc, BCMA_CC_GPIOCTL,
                                 (bcma_cc_read32(&dev->dev->bdev->bus->drv_cc,
-                                        BCMA_CC_GPIOCTL) & mask) | set);
+                                        BCMA_CC_GPIOCTL) & ~mask) | set);
                 break;
 #endif
 #ifdef CONFIG_B43_SSB
@@ -2753,7 +2758,7 @@ static int b43_gpio_init(struct b43_wldev *dev)
                 if (gpiodev)
                         ssb_write32(gpiodev, B43_GPIO_CONTROL,
                                     (ssb_read32(gpiodev, B43_GPIO_CONTROL)
-                                    & mask) | set);
+                                    & ~mask) | set);
                 break;
 #endif
         }
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/channel.c b/drivers/net/wireless/brcm80211/brcmsmac/channel.c
index 9a4c63f927cb..7ed7d7577024 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/channel.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/channel.c
@@ -382,9 +382,7 @@ brcms_c_channel_set_chanspec(struct brcms_cm_info *wlc_cm, u16 chanspec,
 {
         struct brcms_c_info *wlc = wlc_cm->wlc;
         struct ieee80211_channel *ch = wlc->pub->ieee_hw->conf.channel;
-        const struct ieee80211_reg_rule *reg_rule;
         struct txpwr_limits txpwr;
-        int ret;
 
         brcms_c_channel_reg_limits(wlc_cm, chanspec, &txpwr);
 
@@ -393,8 +391,7 @@ brcms_c_channel_set_chanspec(struct brcms_cm_info *wlc_cm, u16 chanspec,
         );
 
         /* set or restore gmode as required by regulatory */
-        ret = freq_reg_info(wlc->wiphy, ch->center_freq, 0, &reg_rule);
-        if (!ret && (reg_rule->flags & NL80211_RRF_NO_OFDM))
+        if (ch->flags & IEEE80211_CHAN_NO_OFDM)
                 brcms_c_set_gmode(wlc, GMODE_LEGACY_B, false);
         else
                 brcms_c_set_gmode(wlc, wlc->protection->gmode_user, false);
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
index 9e79d47e077f..192ad5c1fcc8 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
@@ -121,7 +121,8 @@ static struct ieee80211_channel brcms_2ghz_chantable[] = {
                  IEEE80211_CHAN_NO_HT40PLUS),
         CHAN2GHZ(14, 2484,
                  IEEE80211_CHAN_PASSIVE_SCAN | IEEE80211_CHAN_NO_IBSS |
-                 IEEE80211_CHAN_NO_HT40PLUS | IEEE80211_CHAN_NO_HT40MINUS)
+                 IEEE80211_CHAN_NO_HT40PLUS | IEEE80211_CHAN_NO_HT40MINUS |
+                 IEEE80211_CHAN_NO_OFDM)
 };
 
 static struct ieee80211_channel brcms_5ghz_nphy_chantable[] = {
diff --git a/drivers/net/wireless/libertas/cfg.c b/drivers/net/wireless/libertas/cfg.c
index eb5de800ed90..1c10b542ab23 100644
--- a/drivers/net/wireless/libertas/cfg.c
+++ b/drivers/net/wireless/libertas/cfg.c
@@ -1254,6 +1254,7 @@ static int lbs_associate(struct lbs_private *priv,
                         netif_tx_wake_all_queues(priv->dev);
         }
 
+        kfree(cmd);
 done:
         lbs_deb_leave_args(LBS_DEB_CFG80211, "ret %d", ret);
         return ret;
diff --git a/drivers/net/wireless/libertas/if_sdio.c b/drivers/net/wireless/libertas/if_sdio.c
index 76caebaa4397..e970897f6ab5 100644
--- a/drivers/net/wireless/libertas/if_sdio.c
+++ b/drivers/net/wireless/libertas/if_sdio.c
@@ -1314,6 +1314,7 @@ static void if_sdio_remove(struct sdio_func *func)
                 kfree(packet);
         }
 
+        kfree(card);
         lbs_deb_leave(LBS_DEB_SDIO);
 }
 
diff --git a/drivers/net/wireless/libertas/main.c b/drivers/net/wireless/libertas/main.c
index 58048189bd24..fe1ea43c5149 100644
--- a/drivers/net/wireless/libertas/main.c
+++ b/drivers/net/wireless/libertas/main.c
@@ -571,7 +571,10 @@ static int lbs_thread(void *data)
                         netdev_info(dev, "Timeout submitting command 0x%04x\n",
                                     le16_to_cpu(cmdnode->cmdbuf->command));
                         lbs_complete_command(priv, cmdnode, -ETIMEDOUT);
-                        if (priv->reset_card)
+
+                        /* Reset card, but only when it isn't in the process
+                         * of being shutdown anyway. */
+                        if (!dev->dismantle && priv->reset_card)
                                 priv->reset_card(priv);
                 }
                 priv->cmd_timed_out = 0;
diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c b/drivers/net/wireless/rt2x00/rt2800lib.c
index 88455b1b9fe0..cb8c2aca54e4 100644
--- a/drivers/net/wireless/rt2x00/rt2800lib.c
+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
@@ -221,6 +221,67 @@ static void rt2800_rf_write(struct rt2x00_dev *rt2x00dev,
         mutex_unlock(&rt2x00dev->csr_mutex);
 }
 
+static int rt2800_enable_wlan_rt3290(struct rt2x00_dev *rt2x00dev)
+{
+        u32 reg;
+        int i, count;
+
+        rt2800_register_read(rt2x00dev, WLAN_FUN_CTRL, &reg);
+        if (rt2x00_get_field32(reg, WLAN_EN))
+                return 0;
+
+        rt2x00_set_field32(&reg, WLAN_GPIO_OUT_OE_BIT_ALL, 0xff);
+        rt2x00_set_field32(&reg, FRC_WL_ANT_SET, 1);
+        rt2x00_set_field32(&reg, WLAN_CLK_EN, 0);
+        rt2x00_set_field32(&reg, WLAN_EN, 1);
+        rt2800_register_write(rt2x00dev, WLAN_FUN_CTRL, reg);
+
+        udelay(REGISTER_BUSY_DELAY);
+
+        count = 0;
+        do {
+                /*
+                 * Check PLL_LD & XTAL_RDY.
+                 */
+                for (i = 0; i < REGISTER_BUSY_COUNT; i++) {
+                        rt2800_register_read(rt2x00dev, CMB_CTRL, &reg);
+                        if (rt2x00_get_field32(reg, PLL_LD) &&
+                            rt2x00_get_field32(reg, XTAL_RDY))
+                                break;
+                        udelay(REGISTER_BUSY_DELAY);
+                }
+
+                if (i >= REGISTER_BUSY_COUNT) {
+
+                        if (count >= 10)
+                                return -EIO;
+
+                        rt2800_register_write(rt2x00dev, 0x58, 0x018);
+                        udelay(REGISTER_BUSY_DELAY);
+                        rt2800_register_write(rt2x00dev, 0x58, 0x418);
+                        udelay(REGISTER_BUSY_DELAY);
+                        rt2800_register_write(rt2x00dev, 0x58, 0x618);
+                        udelay(REGISTER_BUSY_DELAY);
+                        count++;
+                } else {
+                        count = 0;
+                }
+
+                rt2800_register_read(rt2x00dev, WLAN_FUN_CTRL, &reg);
+                rt2x00_set_field32(&reg, PCIE_APP0_CLK_REQ, 0);
+                rt2x00_set_field32(&reg, WLAN_CLK_EN, 1);
+                rt2x00_set_field32(&reg, WLAN_RESET, 1);
+                rt2800_register_write(rt2x00dev, WLAN_FUN_CTRL, reg);
+                udelay(10);
+                rt2x00_set_field32(&reg, WLAN_RESET, 0);
+                rt2800_register_write(rt2x00dev, WLAN_FUN_CTRL, reg);
+                udelay(10);
+                rt2800_register_write(rt2x00dev, INT_SOURCE_CSR, 0x7fffffff);
+        } while (count != 0);
+
+        return 0;
+}
+
 void rt2800_mcu_request(struct rt2x00_dev *rt2x00dev,
                         const u8 command, const u8 token,
                         const u8 arg0, const u8 arg1)
@@ -400,6 +461,13 @@ int rt2800_load_firmware(struct rt2x00_dev *rt2x00dev,
 {
         unsigned int i;
         u32 reg;
+        int retval;
+
+        if (rt2x00_rt(rt2x00dev, RT3290)) {
+                retval = rt2800_enable_wlan_rt3290(rt2x00dev);
+                if (retval)
+                        return -EBUSY;
+        }
 
         /*
          * If driver doesn't wake up firmware here,
diff --git a/drivers/net/wireless/rt2x00/rt2800pci.c b/drivers/net/wireless/rt2x00/rt2800pci.c
index 235376e9cb04..98aa426a3564 100644
--- a/drivers/net/wireless/rt2x00/rt2800pci.c
+++ b/drivers/net/wireless/rt2x00/rt2800pci.c
@@ -980,66 +980,6 @@ static int rt2800pci_validate_eeprom(struct rt2x00_dev *rt2x00dev)
         return rt2800_validate_eeprom(rt2x00dev);
 }
 
-static int rt2800_enable_wlan_rt3290(struct rt2x00_dev *rt2x00dev)
-{
-        u32 reg;
-        int i, count;
-
-        rt2800_register_read(rt2x00dev, WLAN_FUN_CTRL, &reg);
-        if (rt2x00_get_field32(reg, WLAN_EN))
-                return 0;
-
-        rt2x00_set_field32(&reg, WLAN_GPIO_OUT_OE_BIT_ALL, 0xff);
-        rt2x00_set_field32(&reg, FRC_WL_ANT_SET, 1);
-        rt2x00_set_field32(&reg, WLAN_CLK_EN, 0);
-        rt2x00_set_field32(&reg, WLAN_EN, 1);
-        rt2800_register_write(rt2x00dev, WLAN_FUN_CTRL, reg);
-
-        udelay(REGISTER_BUSY_DELAY);
-
-        count = 0;
-        do {
-                /*
-                 * Check PLL_LD & XTAL_RDY.
-                 */
-                for (i = 0; i < REGISTER_BUSY_COUNT; i++) {
-                        rt2800_register_read(rt2x00dev, CMB_CTRL, &reg);
-                        if (rt2x00_get_field32(reg, PLL_LD) &&
-                            rt2x00_get_field32(reg, XTAL_RDY))
-                                break;
-                        udelay(REGISTER_BUSY_DELAY);
-                }
-
-                if (i >= REGISTER_BUSY_COUNT) {
-
-                        if (count >= 10)
-                                return -EIO;
-
-                        rt2800_register_write(rt2x00dev, 0x58, 0x018);
-                        udelay(REGISTER_BUSY_DELAY);
-                        rt2800_register_write(rt2x00dev, 0x58, 0x418);
-                        udelay(REGISTER_BUSY_DELAY);
-                        rt2800_register_write(rt2x00dev, 0x58, 0x618);
-                        udelay(REGISTER_BUSY_DELAY);
-                        count++;
-                } else {
-                        count = 0;
-                }
-
-                rt2800_register_read(rt2x00dev, WLAN_FUN_CTRL, &reg);
-                rt2x00_set_field32(&reg, PCIE_APP0_CLK_REQ, 0);
-                rt2x00_set_field32(&reg, WLAN_CLK_EN, 1);
-                rt2x00_set_field32(&reg, WLAN_RESET, 1);
-                rt2800_register_write(rt2x00dev, WLAN_FUN_CTRL, reg);
-                udelay(10);
-                rt2x00_set_field32(&reg, WLAN_RESET, 0);
-                rt2800_register_write(rt2x00dev, WLAN_FUN_CTRL, reg);
-                udelay(10);
-                rt2800_register_write(rt2x00dev, INT_SOURCE_CSR, 0x7fffffff);
-        } while (count != 0);
-
-        return 0;
-}
 static int rt2800pci_probe_hw(struct rt2x00_dev *rt2x00dev)
 {
         int retval;
@@ -1063,17 +1003,6 @@ static int rt2800pci_probe_hw(struct rt2x00_dev *rt2x00dev)
                 return retval;
 
         /*
-         * In probe phase call rt2800_enable_wlan_rt3290 to enable wlan
-         * clk for rt3290. That avoid the MCU fail in start phase.
-         */
-        if (rt2x00_rt(rt2x00dev, RT3290)) {
-                retval = rt2800_enable_wlan_rt3290(rt2x00dev);
-
-                if (retval)
-                        return retval;
-        }
-
-        /*
          * This device has multiple filters for control frames
          * and has a separate filter for PS Poll frames.
          */
diff --git a/include/linux/bcma/bcma_driver_chipcommon.h b/include/linux/bcma/bcma_driver_chipcommon.h
index 3c80885fa829..d323a4b4143c 100644
--- a/include/linux/bcma/bcma_driver_chipcommon.h
+++ b/include/linux/bcma/bcma_driver_chipcommon.h
@@ -89,6 +89,12 @@
 #define  BCMA_CC_CHIPST_4313_OTP_PRESENT        2
 #define  BCMA_CC_CHIPST_4331_SPROM_PRESENT      2
 #define  BCMA_CC_CHIPST_4331_OTP_PRESENT        4
+#define  BCMA_CC_CHIPST_43228_ILP_DIV_EN        0x00000001
+#define  BCMA_CC_CHIPST_43228_OTP_PRESENT       0x00000002
+#define  BCMA_CC_CHIPST_43228_SERDES_REFCLK_PADSEL      0x00000004
+#define  BCMA_CC_CHIPST_43228_SDIO_MODE         0x00000008
+#define  BCMA_CC_CHIPST_43228_SDIO_OTP_PRESENT  0x00000010
+#define  BCMA_CC_CHIPST_43228_SDIO_RESET        0x00000020
 #define  BCMA_CC_CHIPST_4706_PKG_OPTION         BIT(0) /* 0: full-featured package 1: low-cost package */
 #define  BCMA_CC_CHIPST_4706_SFLASH_PRESENT     BIT(1) /* 0: parallel, 1: serial flash is present */
 #define  BCMA_CC_CHIPST_4706_SFLASH_TYPE        BIT(2) /* 0: 8b-p/ST-s flash, 1: 16b-p/Atmal-s flash */
diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h
index 379e433e15e0..879db26ec401 100644
--- a/include/linux/ipv6.h
+++ b/include/linux/ipv6.h
@@ -369,6 +369,7 @@ struct ipv6_pinfo {
         __u8                    rcv_tclass;
 
         __u32                   dst_cookie;
+        __u32                   rx_dst_cookie;
 
         struct ipv6_mc_socklist __rcu *ipv6_mc_list;
         struct ipv6_ac_socklist *ipv6_ac_list;
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index eb06e58bed0b..a9db4f33407f 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -1300,6 +1300,8 @@ struct net_device {
         /* for setting kernel sock attribute on TCP connection setup */
 #define GSO_MAX_SIZE            65536
         unsigned int            gso_max_size;
+#define GSO_MAX_SEGS            65535
+        u16                     gso_max_segs;
 
 #ifdef CONFIG_DCB
         /* Data Center Bridging netlink ops */
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 493fa0c79005..3d254e10ff30 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -96,6 +96,7 @@ enum ieee80211_band {
  *      is not permitted.
  * @IEEE80211_CHAN_NO_HT40MINUS: extension channel below this channel
  *      is not permitted.
+ * @IEEE80211_CHAN_NO_OFDM: OFDM is not allowed on this channel.
  */
 enum ieee80211_channel_flags {
         IEEE80211_CHAN_DISABLED         = 1<<0,
@@ -104,6 +105,7 @@ enum ieee80211_channel_flags {
         IEEE80211_CHAN_RADAR            = 1<<3,
         IEEE80211_CHAN_NO_HT40PLUS      = 1<<4,
         IEEE80211_CHAN_NO_HT40MINUS     = 1<<5,
+        IEEE80211_CHAN_NO_OFDM          = 1<<6,
 };
 
 #define IEEE80211_CHAN_NO_HT40 \
diff --git a/include/net/inet_connection_sock.h b/include/net/inet_connection_sock.h
index 5ee66f517b4f..ba1d3615acbb 100644
--- a/include/net/inet_connection_sock.h
+++ b/include/net/inet_connection_sock.h
@@ -39,6 +39,7 @@ struct inet_connection_sock_af_ops {
         int         (*queue_xmit)(struct sk_buff *skb, struct flowi *fl);
         void        (*send_check)(struct sock *sk, struct sk_buff *skb);
         int         (*rebuild_header)(struct sock *sk);
+        void        (*sk_rx_dst_set)(struct sock *sk, const struct sk_buff *skb);
         int         (*conn_request)(struct sock *sk, struct sk_buff *skb);
         struct sock *(*syn_recv_sock)(struct sock *sk, struct sk_buff *skb,
                                       struct request_sock *req,
diff --git a/include/net/inet_sock.h b/include/net/inet_sock.h
index 83b567fe1941..613cfa401672 100644
--- a/include/net/inet_sock.h
+++ b/include/net/inet_sock.h
@@ -249,13 +249,4 @@ static inline __u8 inet_sk_flowi_flags(const struct sock *sk)
         return flags;
 }
 
-static inline void inet_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb)
-{
-        struct dst_entry *dst = skb_dst(skb);
-
-        dst_hold(dst);
-        sk->sk_rx_dst = dst;
-        inet_sk(sk)->rx_dst_ifindex = skb->skb_iif;
-}
-
 #endif  /* _INET_SOCK_H */
diff --git a/include/net/sock.h b/include/net/sock.h
index b3730239bf18..72132aef53fc 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -218,6 +218,7 @@ struct cg_proto;
   *     @sk_route_nocaps: forbidden route capabilities (e.g NETIF_F_GSO_MASK)
   *     @sk_gso_type: GSO type (e.g. %SKB_GSO_TCPV4)
   *     @sk_gso_max_size: Maximum GSO segment size to build
+  *     @sk_gso_max_segs: Maximum number of GSO segments
   *     @sk_lingertime: %SO_LINGER l_linger setting
   *     @sk_backlog: always used with the per-socket spinlock held
   *     @sk_callback_lock: used with the callbacks in the end of this struct
@@ -338,6 +339,7 @@ struct sock {
         netdev_features_t       sk_route_nocaps;
         int                     sk_gso_type;
         unsigned int            sk_gso_max_size;
+        u16                     sk_gso_max_segs;
         int                     sk_rcvlowat;
         unsigned long           sk_lingertime;
         struct sk_buff_head     sk_error_queue;
diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index d9509eb29b80..62b619e82a90 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -213,6 +213,9 @@ struct xfrm_state {
         struct xfrm_lifetime_cur curlft;
         struct tasklet_hrtimer  mtimer;
 
+        /* used to fix curlft->add_time when changing date */
+        long            saved_tmo;
+
         /* Last used time */
         unsigned long           lastused;
 
@@ -238,6 +241,7 @@ static inline struct net *xs_net(struct xfrm_state *x)
 
 /* xflags - make enum if more show up */
 #define XFRM_TIME_DEFER 1
+#define XFRM_SOFT_EXPIRE 2
 
 enum {
         XFRM_STATE_VOID,
diff --git a/net/batman-adv/gateway_client.c b/net/batman-adv/gateway_client.c
index b421cc49d2cd..fc866f2e4528 100644
--- a/net/batman-adv/gateway_client.c
+++ b/net/batman-adv/gateway_client.c
@@ -200,11 +200,11 @@ void batadv_gw_election(struct batadv_priv *bat_priv)
         if (atomic_read(&bat_priv->gw_mode) != BATADV_GW_MODE_CLIENT)
                 goto out;
 
-        if (!batadv_atomic_dec_not_zero(&bat_priv->gw_reselect))
-                goto out;
-
         curr_gw = batadv_gw_get_selected_gw_node(bat_priv);
 
+        if (!batadv_atomic_dec_not_zero(&bat_priv->gw_reselect) && curr_gw)
+                goto out;
+
         next_gw = batadv_gw_get_best_gw_node(bat_priv);
 
         if (curr_gw == next_gw)
diff --git a/net/core/dev.c b/net/core/dev.c
index 0cb3fe8d8e72..f91abf800161 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2134,6 +2134,9 @@ netdev_features_t netif_skb_features(struct sk_buff *skb)
         __be16 protocol = skb->protocol;
         netdev_features_t features = skb->dev->features;
 
+        if (skb_shinfo(skb)->gso_segs > skb->dev->gso_max_segs)
+                features &= ~NETIF_F_GSO_MASK;
+
         if (protocol == htons(ETH_P_8021Q)) {
                 struct vlan_ethhdr *veh = (struct vlan_ethhdr *)skb->data;
                 protocol = veh->h_vlan_encapsulated_proto;
@@ -5986,6 +5989,7 @@ struct net_device *alloc_netdev_mqs(int sizeof_priv, const char *name,
         dev_net_set(dev, &init_net);
 
         dev->gso_max_size = GSO_MAX_SIZE;
+        dev->gso_max_segs = GSO_MAX_SEGS;
 
         INIT_LIST_HEAD(&dev->napi_list);
         INIT_LIST_HEAD(&dev->unreg_list);
diff --git a/net/core/sock.c b/net/core/sock.c
index 6b654b3ddfda..8f67ced8d6a8 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -1458,6 +1458,7 @@ void sk_setup_caps(struct sock *sk, struct dst_entry *dst)
                 } else {
                         sk->sk_route_caps |= NETIF_F_SG | NETIF_F_HW_CSUM;
                         sk->sk_gso_max_size = dst->dev->gso_max_size;
+                        sk->sk_gso_max_segs = dst->dev->gso_max_segs;
                 }
         }
 }
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index ba39a52d18c1..76dde25fb9a0 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -197,7 +197,7 @@ static inline int ip_finish_output2(struct sk_buff *skb)
         neigh = __ipv4_neigh_lookup_noref(dev, nexthop);
         if (unlikely(!neigh))
                 neigh = __neigh_create(&arp_tbl, &nexthop, dev, false);
-        if (neigh) {
+        if (!IS_ERR(neigh)) {
                 int res = dst_neigh_output(dst, neigh, skb);
 
                 rcu_read_unlock_bh();
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index c035251beb07..e4ba974f143c 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -70,7 +70,6 @@
 #include <linux/types.h>
 #include <linux/kernel.h>
 #include <linux/mm.h>
-#include <linux/bootmem.h>
 #include <linux/string.h>
 #include <linux/socket.h>
 #include <linux/sockios.h>
@@ -80,7 +79,6 @@
 #include <linux/netdevice.h>
 #include <linux/proc_fs.h>
 #include <linux/init.h>
-#include <linux/workqueue.h>
 #include <linux/skbuff.h>
 #include <linux/inetdevice.h>
 #include <linux/igmp.h>
@@ -88,11 +86,9 @@
 #include <linux/mroute.h>
 #include <linux/netfilter_ipv4.h>
 #include <linux/random.h>
-#include <linux/jhash.h>
 #include <linux/rcupdate.h>
 #include <linux/times.h>
 #include <linux/slab.h>
-#include <linux/prefetch.h>
 #include <net/dst.h>
 #include <net/net_namespace.h>
 #include <net/protocol.h>
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index e7e6eeae49c0..2109ff4a1daf 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -811,7 +811,9 @@ static unsigned int tcp_xmit_size_goal(struct sock *sk, u32 mss_now,
                            old_size_goal + mss_now > xmit_size_goal)) {
                         xmit_size_goal = old_size_goal;
                 } else {
-                        tp->xmit_size_goal_segs = xmit_size_goal / mss_now;
+                        tp->xmit_size_goal_segs =
+                                min_t(u16, xmit_size_goal / mss_now,
+                                      sk->sk_gso_max_segs);
                         xmit_size_goal = tp->xmit_size_goal_segs * mss_now;
                 }
         }
diff --git a/net/ipv4/tcp_cong.c b/net/ipv4/tcp_cong.c
index 4d4db16e336e..1432cdb0644c 100644
--- a/net/ipv4/tcp_cong.c
+++ b/net/ipv4/tcp_cong.c
@@ -291,7 +291,8 @@ bool tcp_is_cwnd_limited(const struct sock *sk, u32 in_flight)
         left = tp->snd_cwnd - in_flight;
         if (sk_can_gso(sk) &&
             left * sysctl_tcp_tso_win_divisor < tp->snd_cwnd &&
-            left * tp->mss_cache < sk->sk_gso_max_size)
+            left * tp->mss_cache < sk->sk_gso_max_size &&
+            left < sk->sk_gso_max_segs)
                 return true;
         return left <= tcp_max_tso_deferred_mss(tp);
 }
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 2fd2bc9e3c64..85308b90df80 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -5392,6 +5392,8 @@ int tcp_rcv_established(struct sock *sk, struct sk_buff *skb,
 {
         struct tcp_sock *tp = tcp_sk(sk);
 
+        if (unlikely(sk->sk_rx_dst == NULL))
+                inet_csk(sk)->icsk_af_ops->sk_rx_dst_set(sk, skb);
         /*
          *      Header prediction.
          *      The code loosely follows the one in the famous
@@ -5605,7 +5607,7 @@ void tcp_finish_connect(struct sock *sk, struct sk_buff *skb)
         tcp_set_state(sk, TCP_ESTABLISHED);
 
         if (skb != NULL) {
-                inet_sk_rx_dst_set(sk, skb);
+                icsk->icsk_af_ops->sk_rx_dst_set(sk, skb);
                 security_inet_conn_established(sk, skb);
         }
 
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 42b2a6a73092..272241f16fcb 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1627,9 +1627,6 @@ int tcp_v4_do_rcv(struct sock *sk, struct sk_buff *skb)
                                 sk->sk_rx_dst = NULL;
                         }
                 }
-                if (unlikely(sk->sk_rx_dst == NULL))
-                        inet_sk_rx_dst_set(sk, skb);
-
                 if (tcp_rcv_established(sk, skb, tcp_hdr(skb), skb->len)) {
                         rsk = sk;
                         goto reset;
@@ -1872,10 +1869,20 @@ static struct timewait_sock_ops tcp_timewait_sock_ops = {
         .twsk_destructor= tcp_twsk_destructor,
 };
 
+static void inet_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb)
+{
+        struct dst_entry *dst = skb_dst(skb);
+
+        dst_hold(dst);
+        sk->sk_rx_dst = dst;
+        inet_sk(sk)->rx_dst_ifindex = skb->skb_iif;
+}
+
 const struct inet_connection_sock_af_ops ipv4_specific = {
         .queue_xmit        = ip_queue_xmit,
         .send_check        = tcp_v4_send_check,
         .rebuild_header    = inet_sk_rebuild_header,
+        .sk_rx_dst_set     = inet_sk_rx_dst_set,
         .conn_request      = tcp_v4_conn_request,
         .syn_recv_sock     = tcp_v4_syn_recv_sock,
         .net_header_len    = sizeof(struct iphdr),
diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
index 232a90c3ec86..d9c9dcef2de3 100644
--- a/net/ipv4/tcp_minisocks.c
+++ b/net/ipv4/tcp_minisocks.c
@@ -387,7 +387,7 @@ struct sock *tcp_create_openreq_child(struct sock *sk, struct request_sock *req,
                 struct tcp_sock *oldtp = tcp_sk(sk);
                 struct tcp_cookie_values *oldcvp = oldtp->cookie_values;
 
-                inet_sk_rx_dst_set(newsk, skb);
+                newicsk->icsk_af_ops->sk_rx_dst_set(newsk, skb);
 
                 /* TCP Cookie Transactions require space for the cookie pair,
                  * as it differs for each connection.  There is no need to
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 3f1bcff0b10b..20dfd892c86f 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -940,7 +940,7 @@ void __init tcp_tasklet_init(void)
  * We cant xmit new skbs from this context, as we might already
  * hold qdisc lock.
  */
-void tcp_wfree(struct sk_buff *skb)
+static void tcp_wfree(struct sk_buff *skb)
 {
         struct sock *sk = skb->sk;
         struct tcp_sock *tp = tcp_sk(sk);
@@ -1522,21 +1522,21 @@ static void tcp_cwnd_validate(struct sock *sk)
  * when we would be allowed to send the split-due-to-Nagle skb fully.
  */
 static unsigned int tcp_mss_split_point(const struct sock *sk, const struct sk_buff *skb,
-                                        unsigned int mss_now, unsigned int cwnd)
+                                        unsigned int mss_now, unsigned int max_segs)
 {
         const struct tcp_sock *tp = tcp_sk(sk);
-        u32 needed, window, cwnd_len;
+        u32 needed, window, max_len;
 
         window = tcp_wnd_end(tp) - TCP_SKB_CB(skb)->seq;
-        cwnd_len = mss_now * cwnd;
+        max_len = mss_now * max_segs;
 
-        if (likely(cwnd_len <= window && skb != tcp_write_queue_tail(sk)))
-                return cwnd_len;
+        if (likely(max_len <= window && skb != tcp_write_queue_tail(sk)))
+                return max_len;
 
         needed = min(skb->len, window);
 
-        if (cwnd_len <= needed)
-                return cwnd_len;
+        if (max_len <= needed)
+                return max_len;
 
         return needed - needed % mss_now;
 }
@@ -1765,7 +1765,8 @@ static bool tcp_tso_should_defer(struct sock *sk, struct sk_buff *skb)
         limit = min(send_win, cong_win);
 
         /* If a full-sized TSO skb can be sent, do it. */
-        if (limit >= sk->sk_gso_max_size)
+        if (limit >= min_t(unsigned int, sk->sk_gso_max_size,
+                           sk->sk_gso_max_segs * tp->mss_cache))
                 goto send_now;
 
         /* Middle in queue won't get any more data, full sendable already? */
@@ -1999,7 +2000,9 @@ static bool tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle,
                 limit = mss_now;
                 if (tso_segs > 1 && !tcp_urg_mode(tp))
                         limit = tcp_mss_split_point(sk, skb, mss_now,
-                                                    cwnd_quota);
+                                                    min_t(unsigned int,
+                                                          cwnd_quota,
+                                                          sk->sk_gso_max_segs));
 
                 if (skb->len > limit &&
                     unlikely(tso_fragment(sk, skb, limit, mss_now, gfp)))
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index c66b90f71c9b..5a439e9a4c01 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -1447,7 +1447,17 @@ static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
                 opt_skb = skb_clone(skb, sk_gfp_atomic(sk, GFP_ATOMIC));
 
         if (sk->sk_state == TCP_ESTABLISHED) { /* Fast path */
+                struct dst_entry *dst = sk->sk_rx_dst;
+
                 sock_rps_save_rxhash(sk, skb);
+                if (dst) {
+                        if (inet_sk(sk)->rx_dst_ifindex != skb->skb_iif ||
+                            dst->ops->check(dst, np->rx_dst_cookie) == NULL) {
+                                dst_release(dst);
+                                sk->sk_rx_dst = NULL;
+                        }
+                }
+
                 if (tcp_rcv_established(sk, skb, tcp_hdr(skb), skb->len))
                         goto reset;
                 if (opt_skb)
@@ -1705,9 +1715,9 @@ static void tcp_v6_early_demux(struct sk_buff *skb)
                         struct dst_entry *dst = sk->sk_rx_dst;
                         struct inet_sock *icsk = inet_sk(sk);
                         if (dst)
-                                dst = dst_check(dst, 0);
+                                dst = dst_check(dst, inet6_sk(sk)->rx_dst_cookie);
                         if (dst &&
-                            icsk->rx_dst_ifindex == inet6_iif(skb))
+                            icsk->rx_dst_ifindex == skb->skb_iif)
                                 skb_dst_set_noref(skb, dst);
                 }
         }
@@ -1719,10 +1729,23 @@ static struct timewait_sock_ops tcp6_timewait_sock_ops = {
         .twsk_destructor= tcp_twsk_destructor,
 };
 
+static void inet6_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb)
+{
+        struct dst_entry *dst = skb_dst(skb);
+        const struct rt6_info *rt = (const struct rt6_info *)dst;
+
+        dst_hold(dst);
+        sk->sk_rx_dst = dst;
+        inet_sk(sk)->rx_dst_ifindex = skb->skb_iif;
+        if (rt->rt6i_node)
+                inet6_sk(sk)->rx_dst_cookie = rt->rt6i_node->fn_sernum;
+}
+
 static const struct inet_connection_sock_af_ops ipv6_specific = {
         .queue_xmit        = inet6_csk_xmit,
         .send_check        = tcp_v6_send_check,
         .rebuild_header    = inet6_sk_rebuild_header,
+        .sk_rx_dst_set     = inet6_sk_rx_dst_set,
         .conn_request      = tcp_v6_conn_request,
         .syn_recv_sock     = tcp_v6_syn_recv_sock,
         .net_header_len    = sizeof(struct ipv6hdr),
diff --git a/net/llc/llc_station.c b/net/llc/llc_station.c
index 39a8d8924b9c..6828e39ec2ec 100644
--- a/net/llc/llc_station.c
+++ b/net/llc/llc_station.c
@@ -268,7 +268,7 @@ static int llc_station_ac_send_null_dsap_xid_c(struct sk_buff *skb)
 out:
         return rc;
 free:
-        kfree_skb(skb);
+        kfree_skb(nskb);
         goto out;
 }
 
@@ -293,7 +293,7 @@ static int llc_station_ac_send_xid_r(struct sk_buff *skb)
 out:
         return rc;
 free:
-        kfree_skb(skb);
+        kfree_skb(nskb);
         goto out;
 }
 
@@ -322,7 +322,7 @@ static int llc_station_ac_send_test_r(struct sk_buff *skb)
 out:
         return rc;
 free:
-        kfree_skb(skb);
+        kfree_skb(nskb);
         goto out;
 }
 
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index 6fac18c0423f..85572353a7e3 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -622,6 +622,7 @@ void ieee80211_stop_mesh(struct ieee80211_sub_if_data *sdata)
 
         del_timer_sync(&sdata->u.mesh.housekeeping_timer);
         del_timer_sync(&sdata->u.mesh.mesh_path_root_timer);
+        del_timer_sync(&sdata->u.mesh.mesh_path_timer);
         /*
          * If the timer fired while we waited for it, it will have
          * requeued the work. Now the work will be running again
@@ -634,6 +635,8 @@ void ieee80211_stop_mesh(struct ieee80211_sub_if_data *sdata)
         local->fif_other_bss--;
         atomic_dec(&local->iff_allmultis);
         ieee80211_configure_filter(local);
+
+        sdata->u.mesh.timers_running = 0;
 }
 
 static void ieee80211_mesh_rx_bcn_presp(struct ieee80211_sub_if_data *sdata,
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index cef0c9e79aba..a4a5acdbaa4d 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -1430,6 +1430,8 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
         del_timer_sync(&sdata->u.mgd.bcn_mon_timer);
         del_timer_sync(&sdata->u.mgd.timer);
         del_timer_sync(&sdata->u.mgd.chswitch_timer);
+
+        sdata->u.mgd.timers_running = 0;
 }
 
 void ieee80211_sta_rx_notify(struct ieee80211_sub_if_data *sdata,
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index bcaee5d12839..839dd9737989 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -299,7 +299,7 @@ static void __ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted,
         if (local->scan_req != local->int_scan_req)
                 cfg80211_scan_done(local->scan_req, aborted);
         local->scan_req = NULL;
-        local->scan_sdata = NULL;
+        rcu_assign_pointer(local->scan_sdata, NULL);
 
         local->scanning = 0;
         local->scan_channel = NULL;
@@ -984,7 +984,6 @@ int ieee80211_request_sched_scan_stop(struct ieee80211_sub_if_data *sdata)
                         kfree(local->sched_scan_ies.ie[i]);
 
                 drv_sched_scan_stop(local, sdata);
-                rcu_assign_pointer(local->sched_scan_sdata, NULL);
         }
 out:
         mutex_unlock(&local->mtx);
diff --git a/net/sched/act_gact.c b/net/sched/act_gact.c
index f10fb8256442..05d60859d8e3 100644
--- a/net/sched/act_gact.c
+++ b/net/sched/act_gact.c
@@ -67,6 +67,9 @@ static int tcf_gact_init(struct nlattr *nla, struct nlattr *est,
         struct tcf_common *pc;
         int ret = 0;
         int err;
+#ifdef CONFIG_GACT_PROB
+        struct tc_gact_p *p_parm = NULL;
+#endif
 
         if (nla == NULL)
                 return -EINVAL;
@@ -82,6 +85,12 @@ static int tcf_gact_init(struct nlattr *nla, struct nlattr *est,
 #ifndef CONFIG_GACT_PROB
         if (tb[TCA_GACT_PROB] != NULL)
                 return -EOPNOTSUPP;
+#else
+        if (tb[TCA_GACT_PROB]) {
+                p_parm = nla_data(tb[TCA_GACT_PROB]);
+                if (p_parm->ptype >= MAX_RAND)
+                        return -EINVAL;
+        }
 #endif
 
         pc = tcf_hash_check(parm->index, a, bind, &gact_hash_info);
@@ -103,8 +112,7 @@ static int tcf_gact_init(struct nlattr *nla, struct nlattr *est,
         spin_lock_bh(&gact->tcf_lock);
         gact->tcf_action = parm->action;
 #ifdef CONFIG_GACT_PROB
-        if (tb[TCA_GACT_PROB] != NULL) {
-                struct tc_gact_p *p_parm = nla_data(tb[TCA_GACT_PROB]);
+        if (p_parm) {
                 gact->tcfg_paction = p_parm->paction;
                 gact->tcfg_pval    = p_parm->pval;
                 gact->tcfg_ptype   = p_parm->ptype;
@@ -133,7 +141,7 @@ static int tcf_gact(struct sk_buff *skb, const struct tc_action *a,
 
         spin_lock(&gact->tcf_lock);
 #ifdef CONFIG_GACT_PROB
-        if (gact->tcfg_ptype && gact_rand[gact->tcfg_ptype] != NULL)
+        if (gact->tcfg_ptype)
                 action = gact_rand[gact->tcfg_ptype](gact);
         else
                 action = gact->tcf_action;
diff --git a/net/sched/act_ipt.c b/net/sched/act_ipt.c
index 60e281ad0f07..58fb3c7aab9e 100644
--- a/net/sched/act_ipt.c
+++ b/net/sched/act_ipt.c
@@ -185,7 +185,12 @@ err3:
 err2:
         kfree(tname);
 err1:
-        kfree(pc);
+        if (ret == ACT_P_CREATED) {
+                if (est)
+                        gen_kill_estimator(&pc->tcfc_bstats,
+                                           &pc->tcfc_rate_est);
+                kfree_rcu(pc, tcfc_rcu);
+        }
         return err;
 }
 
diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c
index 26aa2f6ce257..45c53ab067a6 100644
--- a/net/sched/act_pedit.c
+++ b/net/sched/act_pedit.c
@@ -74,7 +74,10 @@ static int tcf_pedit_init(struct nlattr *nla, struct nlattr *est,
                 p = to_pedit(pc);
                 keys = kmalloc(ksize, GFP_KERNEL);
                 if (keys == NULL) {
-                        kfree(pc);
+                        if (est)
+                                gen_kill_estimator(&pc->tcfc_bstats,
+                                                   &pc->tcfc_rate_est);
+                        kfree_rcu(pc, tcfc_rcu);
                         return -ENOMEM;
                 }
                 ret = ACT_P_CREATED;
diff --git a/net/sched/act_simple.c b/net/sched/act_simple.c
index 3922f2a2821b..3714f60f0b3c 100644
--- a/net/sched/act_simple.c
+++ b/net/sched/act_simple.c
@@ -131,7 +131,10 @@ static int tcf_simp_init(struct nlattr *nla, struct nlattr *est,
                 d = to_defact(pc);
                 ret = alloc_defdata(d, defdata);
                 if (ret < 0) {
-                        kfree(pc);
+                        if (est)
+                                gen_kill_estimator(&pc->tcfc_bstats,
+                                                   &pc->tcfc_rate_est);
+                        kfree_rcu(pc, tcfc_rcu);
                         return ret;
                 }
                 d->tcf_action = parm->action;
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 2303ee73b50a..2ded3c7fad06 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -680,6 +680,8 @@ static u32 map_regdom_flags(u32 rd_flags)
                 channel_flags |= IEEE80211_CHAN_NO_IBSS;
         if (rd_flags & NL80211_RRF_DFS)
                 channel_flags |= IEEE80211_CHAN_RADAR;
+        if (rd_flags & NL80211_RRF_NO_OFDM)
+                channel_flags |= IEEE80211_CHAN_NO_OFDM;
         return channel_flags;
 }
 
@@ -901,7 +903,21 @@ static void handle_channel(struct wiphy *wiphy,
         chan->max_antenna_gain = min(chan->orig_mag,
                 (int) MBI_TO_DBI(power_rule->max_antenna_gain));
         chan->max_reg_power = (int) MBM_TO_DBM(power_rule->max_eirp);
-        chan->max_power = min(chan->max_power, chan->max_reg_power);
+        if (chan->orig_mpwr) {
+                /*
+                 * Devices that have their own custom regulatory domain
+                 * but also use WIPHY_FLAG_STRICT_REGULATORY will follow the
+                 * passed country IE power settings.
+                 */
+                if (initiator == NL80211_REGDOM_SET_BY_COUNTRY_IE &&
+                    wiphy->flags & WIPHY_FLAG_CUSTOM_REGULATORY &&
+                    wiphy->flags & WIPHY_FLAG_STRICT_REGULATORY)
+                        chan->max_power = chan->max_reg_power;
+                else
+                        chan->max_power = min(chan->orig_mpwr,
+                                              chan->max_reg_power);
+        } else
+                chan->max_power = chan->max_reg_power;
 }
 
 static void handle_band(struct wiphy *wiphy,
@@ -1885,6 +1901,7 @@ static void restore_custom_reg_settings(struct wiphy *wiphy)
                         chan->flags = chan->orig_flags;
                         chan->max_antenna_gain = chan->orig_mag;
                         chan->max_power = chan->orig_mpwr;
+                        chan->beacon_found = false;
                 }
         }
 }
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index 5b228f97d4b3..87cd0e4d4282 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -415,8 +415,17 @@ static enum hrtimer_restart xfrm_timer_handler(struct hrtimer * me)
         if (x->lft.hard_add_expires_seconds) {
                 long tmo = x->lft.hard_add_expires_seconds +
                         x->curlft.add_time - now;
-                if (tmo <= 0)
-                        goto expired;
+                if (tmo <= 0) {
+                        if (x->xflags & XFRM_SOFT_EXPIRE) {
+                                /* enter hard expire without soft expire first?!
+                                 * setting a new date could trigger this.
+                                 * workarbound: fix x->curflt.add_time by below:
+                                 */
+                                x->curlft.add_time = now - x->saved_tmo - 1;
+                                tmo = x->lft.hard_add_expires_seconds - x->saved_tmo;
+                        } else
+                                goto expired;
+                }
                 if (tmo < next)
                         next = tmo;
         }
@@ -433,10 +442,14 @@ static enum hrtimer_restart xfrm_timer_handler(struct hrtimer * me)
         if (x->lft.soft_add_expires_seconds) {
                 long tmo = x->lft.soft_add_expires_seconds +
                         x->curlft.add_time - now;
-                if (tmo <= 0)
+                if (tmo <= 0) {
                         warn = 1;
-                else if (tmo < next)
+                        x->xflags &= ~XFRM_SOFT_EXPIRE;
+                } else if (tmo < next) {
                         next = tmo;
+                        x->xflags |= XFRM_SOFT_EXPIRE;
+                        x->saved_tmo = tmo;
+                }
         }
         if (x->lft.soft_use_expires_seconds) {
                 long tmo = x->lft.soft_use_expires_seconds +