diff --git a/[refs] b/[refs]
index 5a02dfbcb006..244ace473c47 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 28c8e4790ca5ef75f54895ca46437f9fbb433ddf
+refs/heads/master: aea9d711f3d68c656ad31ab578ecfb0bb5cd7f97
diff --git a/trunk/MAINTAINERS b/trunk/MAINTAINERS
index 0924a76da873..13608bd2e791 100644
--- a/trunk/MAINTAINERS
+++ b/trunk/MAINTAINERS
@@ -2978,6 +2978,7 @@ F:	drivers/net/ixgb/
 F:	drivers/net/ixgbe/
 
 INTEL PRO/WIRELESS 2100 NETWORK CONNECTION SUPPORT
+M:	Zhu Yi <yi.zhu@intel.com>
 M:	Reinette Chatre <reinette.chatre@intel.com>
 M:	Intel Linux Wireless <ilw@linux.intel.com>
 L:	linux-wireless@vger.kernel.org
@@ -2987,6 +2988,7 @@ F:	Documentation/networking/README.ipw2100
 F:	drivers/net/wireless/ipw2x00/ipw2100.*
 
 INTEL PRO/WIRELESS 2915ABG NETWORK CONNECTION SUPPORT
+M:	Zhu Yi <yi.zhu@intel.com>
 M:	Reinette Chatre <reinette.chatre@intel.com>
 M:	Intel Linux Wireless <ilw@linux.intel.com>
 L:	linux-wireless@vger.kernel.org
@@ -3017,8 +3019,8 @@ F:	drivers/net/wimax/i2400m/
 F:	include/linux/wimax/i2400m.h
 
 INTEL WIRELESS WIFI LINK (iwlwifi)
+M:	Zhu Yi <yi.zhu@intel.com>
 M:	Reinette Chatre <reinette.chatre@intel.com>
-M:	Wey-Yi Guy <wey-yi.w.guy@intel.com>
 M:	Intel Linux Wireless <ilw@linux.intel.com>
 L:	linux-wireless@vger.kernel.org
 W:	http://intellinuxwireless.org
@@ -3028,6 +3030,7 @@ F:	drivers/net/wireless/iwlwifi/
 
 INTEL WIRELESS MULTICOMM 3200 WIFI (iwmc3200wifi)
 M:	Samuel Ortiz <samuel.ortiz@intel.com>
+M:	Zhu Yi <yi.zhu@intel.com>
 M:	Intel Linux Wireless <ilw@linux.intel.com>
 L:	linux-wireless@vger.kernel.org
 S:	Supported
diff --git a/trunk/drivers/isdn/capi/kcapi.c b/trunk/drivers/isdn/capi/kcapi.c
index b054494df846..bde3c88b8b27 100644
--- a/trunk/drivers/isdn/capi/kcapi.c
+++ b/trunk/drivers/isdn/capi/kcapi.c
@@ -1020,12 +1020,12 @@ static int old_capi_manufacturer(unsigned int cmd, void __user *data)
 		if (cmd == AVMB1_ADDCARD) {
 		   if ((retval = copy_from_user(&cdef, data,
 					    sizeof(avmb1_carddef))))
-			   return -EFAULT;
+			   return retval;
 		   cdef.cardtype = AVM_CARDTYPE_B1;
 		} else {
 		   if ((retval = copy_from_user(&cdef, data,
 					    sizeof(avmb1_extcarddef))))
-			   return -EFAULT;
+			   return retval;
 		}
 		cparams.port = cdef.port;
 		cparams.irq = cdef.irq;
@@ -1218,7 +1218,7 @@ int capi20_manufacturer(unsigned int cmd, void __user *data)
 		kcapi_carddef cdef;
 
 		if ((retval = copy_from_user(&cdef, data, sizeof(cdef))))
-			return -EFAULT;
+			return retval;
 
 		cparams.port = cdef.port;
 		cparams.irq = cdef.irq;
diff --git a/trunk/drivers/isdn/hardware/mISDN/hfcsusb.c b/trunk/drivers/isdn/hardware/mISDN/hfcsusb.c
index 8700474747e8..b3b7e2879bac 100644
--- a/trunk/drivers/isdn/hardware/mISDN/hfcsusb.c
+++ b/trunk/drivers/isdn/hardware/mISDN/hfcsusb.c
@@ -97,10 +97,8 @@ static int write_reg(struct hfcsusb *hw, __u8 reg, __u8 val)
 			hw->name, __func__, reg, val);
 
 	spin_lock(&hw->ctrl_lock);
-	if (hw->ctrl_cnt >= HFC_CTRL_BUFSIZE) {
-		spin_unlock(&hw->ctrl_lock);
+	if (hw->ctrl_cnt >= HFC_CTRL_BUFSIZE)
 		return 1;
-	}
 	buf = &hw->ctrl_buff[hw->ctrl_in_idx];
 	buf->hfcs_reg = reg;
 	buf->reg_val = val;
diff --git a/trunk/drivers/isdn/hardware/mISDN/netjet.c b/trunk/drivers/isdn/hardware/mISDN/netjet.c
index 54ae71a907f9..0a3553df065f 100644
--- a/trunk/drivers/isdn/hardware/mISDN/netjet.c
+++ b/trunk/drivers/isdn/hardware/mISDN/netjet.c
@@ -320,12 +320,12 @@ inittiger(struct tiger_hw *card)
 		return -ENOMEM;
 	}
 	for (i = 0; i < 2; i++) {
-		card->bc[i].hsbuf = kmalloc(NJ_DMA_TXSIZE, GFP_ATOMIC);
+		card->bc[i].hsbuf = kmalloc(NJ_DMA_TXSIZE, GFP_KERNEL);
 		if (!card->bc[i].hsbuf) {
 			pr_info("%s: no B%d send buffer\n", card->name, i + 1);
 			return -ENOMEM;
 		}
-		card->bc[i].hrbuf = kmalloc(NJ_DMA_RXSIZE, GFP_ATOMIC);
+		card->bc[i].hrbuf = kmalloc(NJ_DMA_RXSIZE, GFP_KERNEL);
 		if (!card->bc[i].hrbuf) {
 			pr_info("%s: no B%d recv buffer\n", card->name, i + 1);
 			return -ENOMEM;
diff --git a/trunk/drivers/net/8139cp.c b/trunk/drivers/net/8139cp.c
index 284a5f4a63ac..9c149750e2bf 100644
--- a/trunk/drivers/net/8139cp.c
+++ b/trunk/drivers/net/8139cp.c
@@ -598,8 +598,8 @@ static int cp_rx_poll(struct napi_struct *napi, int budget)
 			goto rx_status_loop;
 
 		spin_lock_irqsave(&cp->lock, flags);
-		__napi_complete(napi);
 		cpw16_f(IntrMask, cp_intr_mask);
+		__napi_complete(napi);
 		spin_unlock_irqrestore(&cp->lock, flags);
 	}
 
diff --git a/trunk/drivers/net/8139too.c b/trunk/drivers/net/8139too.c
index 97d8068b372b..4ba72933f0da 100644
--- a/trunk/drivers/net/8139too.c
+++ b/trunk/drivers/net/8139too.c
@@ -860,7 +860,6 @@ static __devinit struct net_device * rtl8139_init_board (struct pci_dev *pdev)
 		}
 
 	/* if unknown chip, assume array element #0, original RTL-8139 in this case */
-	i = 0;
 	dev_dbg(&pdev->dev, "unknown chip version, assuming RTL-8139\n");
 	dev_dbg(&pdev->dev, "TxConfig = 0x%lx\n", RTL_R32 (TxConfig));
 	tp->chipset = 0;
@@ -2089,8 +2088,8 @@ static int rtl8139_poll(struct napi_struct *napi, int budget)
 		 * again when we think we are done.
 		 */
 		spin_lock_irqsave(&tp->lock, flags);
-		__napi_complete(napi);
 		RTL_W16_F(IntrMask, rtl8139_intr_mask);
+		__napi_complete(napi);
 		spin_unlock_irqrestore(&tp->lock, flags);
 	}
 	spin_unlock(&tp->rx_lock);
diff --git a/trunk/drivers/net/benet/be_cmds.c b/trunk/drivers/net/benet/be_cmds.c
index b9ad799c719f..9d11dbf5e4da 100644
--- a/trunk/drivers/net/benet/be_cmds.c
+++ b/trunk/drivers/net/benet/be_cmds.c
@@ -1429,7 +1429,7 @@ int be_cmd_write_flashrom(struct be_adapter *adapter, struct be_dma_mem *cmd,
 	wrb = wrb_from_mccq(adapter);
 	if (!wrb) {
 		status = -EBUSY;
-		goto err_unlock;
+		goto err;
 	}
 	req = cmd->va;
 	sge = nonembedded_sgl(wrb);
@@ -1457,10 +1457,7 @@ int be_cmd_write_flashrom(struct be_adapter *adapter, struct be_dma_mem *cmd,
 	else
 		status = adapter->flash_status;
 
-	return status;
-
-err_unlock:
-	spin_unlock_bh(&adapter->mcc_lock);
+err:
 	return status;
 }
 
@@ -1500,7 +1497,7 @@ int be_cmd_get_flash_crc(struct be_adapter *adapter, u8 *flashed_crc,
 	return status;
 }
 
-int be_cmd_enable_magic_wol(struct be_adapter *adapter, u8 *mac,
+extern int be_cmd_enable_magic_wol(struct be_adapter *adapter, u8 *mac,
 				struct be_dma_mem *nonemb_cmd)
 {
 	struct be_mcc_wrb *wrb;
@@ -1593,7 +1590,7 @@ int be_cmd_loopback_test(struct be_adapter *adapter, u32 port_num,
 
 	be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_LOWLEVEL,
 			OPCODE_LOWLEVEL_LOOPBACK_TEST, sizeof(*req));
-	req->hdr.timeout = cpu_to_le32(4);
+	req->hdr.timeout = 4;
 
 	req->pattern = cpu_to_le64(pattern);
 	req->src_port = cpu_to_le32(port_num);
@@ -1665,7 +1662,7 @@ int be_cmd_ddr_dma_test(struct be_adapter *adapter, u64 pattern,
 	return status;
 }
 
-int be_cmd_get_seeprom_data(struct be_adapter *adapter,
+extern int be_cmd_get_seeprom_data(struct be_adapter *adapter,
 				struct be_dma_mem *nonemb_cmd)
 {
 	struct be_mcc_wrb *wrb;
diff --git a/trunk/drivers/net/bnx2.c b/trunk/drivers/net/bnx2.c
index 949d7a9dcf92..188e356c30a3 100644
--- a/trunk/drivers/net/bnx2.c
+++ b/trunk/drivers/net/bnx2.c
@@ -247,7 +247,6 @@ static const struct flash_spec flash_5709 = {
 MODULE_DEVICE_TABLE(pci, bnx2_pci_tbl);
 
 static void bnx2_init_napi(struct bnx2 *bp);
-static void bnx2_del_napi(struct bnx2 *bp);
 
 static inline u32 bnx2_tx_avail(struct bnx2 *bp, struct bnx2_tx_ring_info *txr)
 {
@@ -6271,7 +6270,6 @@ bnx2_open(struct net_device *dev)
 	bnx2_free_skbs(bp);
 	bnx2_free_irq(bp);
 	bnx2_free_mem(bp);
-	bnx2_del_napi(bp);
 	return rc;
 }
 
@@ -6539,7 +6537,6 @@ bnx2_close(struct net_device *dev)
 	bnx2_free_irq(bp);
 	bnx2_free_skbs(bp);
 	bnx2_free_mem(bp);
-	bnx2_del_napi(bp);
 	bp->link_up = 0;
 	netif_carrier_off(bp->dev);
 	bnx2_set_power_state(bp, PCI_D3hot);
@@ -8230,16 +8227,7 @@ bnx2_bus_string(struct bnx2 *bp, char *str)
 	return str;
 }
 
-static void
-bnx2_del_napi(struct bnx2 *bp)
-{
-	int i;
-
-	for (i = 0; i < bp->irq_nvecs; i++)
-		netif_napi_del(&bp->bnx2_napi[i].napi);
-}
-
-static void
+static void __devinit
 bnx2_init_napi(struct bnx2 *bp)
 {
 	int i;
diff --git a/trunk/drivers/net/can/mscan/mpc5xxx_can.c b/trunk/drivers/net/can/mscan/mpc5xxx_can.c
index af753936e835..8af8442c694a 100644
--- a/trunk/drivers/net/can/mscan/mpc5xxx_can.c
+++ b/trunk/drivers/net/can/mscan/mpc5xxx_can.c
@@ -73,7 +73,7 @@ static u32 __devinit mpc52xx_can_get_clock(struct of_device *ofdev,
 	else
 		*mscan_clksrc = MSCAN_CLKSRC_XTAL;
 
-	freq = mpc5xxx_get_bus_frequency(ofdev->dev.of_node);
+	freq = mpc5xxx_get_bus_frequency(ofdev->node);
 	if (!freq)
 		return 0;
 
@@ -152,7 +152,7 @@ static u32 __devinit mpc512x_can_get_clock(struct of_device *ofdev,
 	}
 
 	/* Determine the MSCAN device index from the physical address */
-	pval = of_get_property(ofdev->dev.of_node, "reg", &plen);
+	pval = of_get_property(ofdev->node, "reg", &plen);
 	BUG_ON(!pval || plen < sizeof(*pval));
 	clockidx = (*pval & 0x80) ? 1 : 0;
 	if (*pval & 0x2000)
@@ -168,11 +168,11 @@ static u32 __devinit mpc512x_can_get_clock(struct of_device *ofdev,
 	 */
 	if (clock_name && !strcmp(clock_name, "ip")) {
 		*mscan_clksrc = MSCAN_CLKSRC_IPS;
-		freq = mpc5xxx_get_bus_frequency(ofdev->dev.of_node);
+		freq = mpc5xxx_get_bus_frequency(ofdev->node);
 	} else {
 		*mscan_clksrc = MSCAN_CLKSRC_BUS;
 
-		pval = of_get_property(ofdev->dev.of_node,
+		pval = of_get_property(ofdev->node,
 				       "fsl,mscan-clock-divider", &plen);
 		if (pval && plen == sizeof(*pval))
 			clockdiv = *pval;
@@ -251,7 +251,7 @@ static int __devinit mpc5xxx_can_probe(struct of_device *ofdev,
 				       const struct of_device_id *id)
 {
 	struct mpc5xxx_can_data *data = (struct mpc5xxx_can_data *)id->data;
-	struct device_node *np = ofdev->dev.of_node;
+	struct device_node *np = ofdev->node;
 	struct net_device *dev;
 	struct mscan_priv *priv;
 	void __iomem *base;
diff --git a/trunk/drivers/net/e1000/e1000_main.c b/trunk/drivers/net/e1000/e1000_main.c
index 68a80893dce1..ebdea0891665 100644
--- a/trunk/drivers/net/e1000/e1000_main.c
+++ b/trunk/drivers/net/e1000/e1000_main.c
@@ -1047,14 +1047,15 @@ static int __devinit e1000_probe(struct pci_dev *pdev,
 		goto err_register;
 
 	/* print bus type/speed/width info */
-	e_info("(PCI%s:%dMHz:%d-bit) %pM\n",
-	       ((hw->bus_type == e1000_bus_type_pcix) ? "-X" : ""),
-	       ((hw->bus_speed == e1000_bus_speed_133) ? 133 :
-		(hw->bus_speed == e1000_bus_speed_120) ? 120 :
-		(hw->bus_speed == e1000_bus_speed_100) ? 100 :
-		(hw->bus_speed == e1000_bus_speed_66) ? 66 : 33),
-	       ((hw->bus_width == e1000_bus_width_64) ? 64 : 32),
-	       netdev->dev_addr);
+	e_info("(PCI%s:%s:%s) ",
+		((hw->bus_type == e1000_bus_type_pcix) ? "-X" : ""),
+		((hw->bus_speed == e1000_bus_speed_133) ? "133MHz" :
+		 (hw->bus_speed == e1000_bus_speed_120) ? "120MHz" :
+		 (hw->bus_speed == e1000_bus_speed_100) ? "100MHz" :
+		 (hw->bus_speed == e1000_bus_speed_66) ? "66MHz" : "33MHz"),
+		((hw->bus_width == e1000_bus_width_64) ? "64-bit" : "32-bit"));
+
+	e_info("%pM\n", netdev->dev_addr);
 
 	/* carrier off reporting is important to ethtool even BEFORE open */
 	netif_carrier_off(netdev);
diff --git a/trunk/drivers/net/e1000e/netdev.c b/trunk/drivers/net/e1000e/netdev.c
index 57a7e41da69e..24507f3b8b17 100644
--- a/trunk/drivers/net/e1000e/netdev.c
+++ b/trunk/drivers/net/e1000e/netdev.c
@@ -2554,7 +2554,7 @@ static void e1000_init_manageability_pt(struct e1000_adapter *adapter)
 			mdef = er32(MDEF(i));
 
 			/* Ignore filters with anything other than IPMI ports */
-			if (mdef & ~(E1000_MDEF_PORT_623 | E1000_MDEF_PORT_664))
+			if (mdef & !(E1000_MDEF_PORT_623 | E1000_MDEF_PORT_664))
 				continue;
 
 			/* Enable this decision filter in MANC2H */
diff --git a/trunk/drivers/net/enic/enic.h b/trunk/drivers/net/enic/enic.h
index 45e86d1e5b1b..85f2a2e7030a 100644
--- a/trunk/drivers/net/enic/enic.h
+++ b/trunk/drivers/net/enic/enic.h
@@ -74,14 +74,7 @@ struct enic_msix_entry {
 	void *devid;
 };
 
-#define ENIC_SET_APPLIED		(1 << 0)
-#define ENIC_SET_REQUEST		(1 << 1)
-#define ENIC_SET_NAME			(1 << 2)
-#define ENIC_SET_INSTANCE		(1 << 3)
-#define ENIC_SET_HOST			(1 << 4)
-
 struct enic_port_profile {
-	u32 set;
 	u8 request;
 	char name[PORT_PROFILE_MAX];
 	u8 instance_uuid[PORT_UUID_MAX];
diff --git a/trunk/drivers/net/enic/enic_main.c b/trunk/drivers/net/enic/enic_main.c
index bc7d6b96de3d..6586b5c7e4b6 100644
--- a/trunk/drivers/net/enic/enic_main.c
+++ b/trunk/drivers/net/enic/enic_main.c
@@ -1029,7 +1029,8 @@ static int enic_dev_init_done(struct enic *enic, int *done, int *error)
 	return err;
 }
 
-static int enic_set_port_profile(struct enic *enic, u8 *mac)
+static int enic_set_port_profile(struct enic *enic, u8 request, u8 *mac,
+	char *name, u8 *instance_uuid, u8 *host_uuid)
 {
 	struct vic_provinfo *vp;
 	u8 oui[3] = VIC_PROVINFO_CISCO_OUI;
@@ -1039,112 +1040,97 @@ static int enic_set_port_profile(struct enic *enic, u8 *mac)
 		"%02X%02X-%02X%02X%02X%02X%0X%02X";
 	int err;
 
-	err = enic_vnic_dev_deinit(enic);
-	if (err)
-		return err;
-
-	switch (enic->pp.request) {
-
-	case PORT_REQUEST_ASSOCIATE:
+	if (!name)
+		return -EINVAL;
 
-		if (!(enic->pp.set & ENIC_SET_NAME) || !strlen(enic->pp.name))
-			return -EINVAL;
+	if (!is_valid_ether_addr(mac))
+		return -EADDRNOTAVAIL;
 
-		if (!is_valid_ether_addr(mac))
-			return -EADDRNOTAVAIL;
-
-		vp = vic_provinfo_alloc(GFP_KERNEL, oui,
-			VIC_PROVINFO_LINUX_TYPE);
-		if (!vp)
-			return -ENOMEM;
+	vp = vic_provinfo_alloc(GFP_KERNEL, oui, VIC_PROVINFO_LINUX_TYPE);
+	if (!vp)
+		return -ENOMEM;
 
+	vic_provinfo_add_tlv(vp,
+		VIC_LINUX_PROV_TLV_PORT_PROFILE_NAME_STR,
+		strlen(name) + 1, name);
+
+	vic_provinfo_add_tlv(vp,
+		VIC_LINUX_PROV_TLV_CLIENT_MAC_ADDR,
+		ETH_ALEN, mac);
+
+	if (instance_uuid) {
+		uuid = instance_uuid;
+		sprintf(uuid_str, uuid_fmt,
+			uuid[0],  uuid[1],  uuid[2],  uuid[3],
+			uuid[4],  uuid[5],  uuid[6],  uuid[7],
+			uuid[8],  uuid[9],  uuid[10], uuid[11],
+			uuid[12], uuid[13], uuid[14], uuid[15]);
 		vic_provinfo_add_tlv(vp,
-			VIC_LINUX_PROV_TLV_PORT_PROFILE_NAME_STR,
-			strlen(enic->pp.name) + 1, enic->pp.name);
+			VIC_LINUX_PROV_TLV_CLIENT_UUID_STR,
+			sizeof(uuid_str), uuid_str);
+	}
 
+	if (host_uuid) {
+		uuid = host_uuid;
+		sprintf(uuid_str, uuid_fmt,
+			uuid[0],  uuid[1],  uuid[2],  uuid[3],
+			uuid[4],  uuid[5],  uuid[6],  uuid[7],
+			uuid[8],  uuid[9],  uuid[10], uuid[11],
+			uuid[12], uuid[13], uuid[14], uuid[15]);
 		vic_provinfo_add_tlv(vp,
-			VIC_LINUX_PROV_TLV_CLIENT_MAC_ADDR,
-			ETH_ALEN, mac);
-
-		if (enic->pp.set & ENIC_SET_INSTANCE) {
-			uuid = enic->pp.instance_uuid;
-			sprintf(uuid_str, uuid_fmt,
-				uuid[0],  uuid[1],  uuid[2],  uuid[3],
-				uuid[4],  uuid[5],  uuid[6],  uuid[7],
-				uuid[8],  uuid[9],  uuid[10], uuid[11],
-				uuid[12], uuid[13], uuid[14], uuid[15]);
-			vic_provinfo_add_tlv(vp,
-				VIC_LINUX_PROV_TLV_CLIENT_UUID_STR,
-				sizeof(uuid_str), uuid_str);
-		}
+			VIC_LINUX_PROV_TLV_HOST_UUID_STR,
+			sizeof(uuid_str), uuid_str);
+	}
 
-		if (enic->pp.set & ENIC_SET_HOST) {
-			uuid = enic->pp.host_uuid;
-			sprintf(uuid_str, uuid_fmt,
-				uuid[0],  uuid[1],  uuid[2],  uuid[3],
-				uuid[4],  uuid[5],  uuid[6],  uuid[7],
-				uuid[8],  uuid[9],  uuid[10], uuid[11],
-				uuid[12], uuid[13], uuid[14], uuid[15]);
-			vic_provinfo_add_tlv(vp,
-				VIC_LINUX_PROV_TLV_HOST_UUID_STR,
-				sizeof(uuid_str), uuid_str);
-		}
+	err = enic_vnic_dev_deinit(enic);
+	if (err)
+		goto err_out;
 
-		err = enic_dev_init_prov(enic, vp);
-		vic_provinfo_free(vp);
-		if (err)
-			return err;
-		break;
+	memset(&enic->pp, 0, sizeof(enic->pp));
 
-	case PORT_REQUEST_DISASSOCIATE:
-		break;
+	err = enic_dev_init_prov(enic, vp);
+	if (err)
+		goto err_out;
 
-	default:
-		return -EINVAL;
-	}
+	enic->pp.request = request;
+	memcpy(enic->pp.name, name, PORT_PROFILE_MAX);
+	if (instance_uuid)
+		memcpy(enic->pp.instance_uuid,
+			instance_uuid, PORT_UUID_MAX);
+	if (host_uuid)
+		memcpy(enic->pp.host_uuid,
+			host_uuid, PORT_UUID_MAX);
 
-	enic->pp.set |= ENIC_SET_APPLIED;
-	return 0;
+err_out:
+	vic_provinfo_free(vp);
+
+	return err;
+}
+
+static int enic_unset_port_profile(struct enic *enic)
+{
+	memset(&enic->pp, 0, sizeof(enic->pp));
+	return enic_vnic_dev_deinit(enic);
 }
 
 static int enic_set_vf_port(struct net_device *netdev, int vf,
 	struct nlattr *port[])
 {
 	struct enic *enic = netdev_priv(netdev);
-
-	memset(&enic->pp, 0, sizeof(enic->pp));
-
-	if (port[IFLA_PORT_REQUEST]) {
-		enic->pp.set |= ENIC_SET_REQUEST;
-		enic->pp.request = nla_get_u8(port[IFLA_PORT_REQUEST]);
-	}
-
-	if (port[IFLA_PORT_PROFILE]) {
-		enic->pp.set |= ENIC_SET_NAME;
-		memcpy(enic->pp.name, nla_data(port[IFLA_PORT_PROFILE]),
-			PORT_PROFILE_MAX);
-	}
-
-	if (port[IFLA_PORT_INSTANCE_UUID]) {
-		enic->pp.set |= ENIC_SET_INSTANCE;
-		memcpy(enic->pp.instance_uuid,
-			nla_data(port[IFLA_PORT_INSTANCE_UUID]), PORT_UUID_MAX);
-	}
-
-	if (port[IFLA_PORT_HOST_UUID]) {
-		enic->pp.set |= ENIC_SET_HOST;
-		memcpy(enic->pp.host_uuid,
-			nla_data(port[IFLA_PORT_HOST_UUID]), PORT_UUID_MAX);
-	}
+	char *name = NULL;
+	u8 *instance_uuid = NULL;
+	u8 *host_uuid = NULL;
+	u8 request = PORT_REQUEST_DISASSOCIATE;
 
 	/* don't support VFs, yet */
 	if (vf != PORT_SELF_VF)
 		return -EOPNOTSUPP;
 
-	if (!(enic->pp.set & ENIC_SET_REQUEST))
-		return -EOPNOTSUPP;
+	if (port[IFLA_PORT_REQUEST])
+		request = nla_get_u8(port[IFLA_PORT_REQUEST]);
 
-	if (enic->pp.request == PORT_REQUEST_ASSOCIATE) {
+	switch (request) {
+	case PORT_REQUEST_ASSOCIATE:
 
 		/* If the interface mac addr hasn't been assigned,
 		 * assign a random mac addr before setting port-
@@ -1153,9 +1139,30 @@ static int enic_set_vf_port(struct net_device *netdev, int vf,
 
 		if (is_zero_ether_addr(netdev->dev_addr))
 			random_ether_addr(netdev->dev_addr);
+
+		if (port[IFLA_PORT_PROFILE])
+			name = nla_data(port[IFLA_PORT_PROFILE]);
+
+		if (port[IFLA_PORT_INSTANCE_UUID])
+			instance_uuid =
+				nla_data(port[IFLA_PORT_INSTANCE_UUID]);
+
+		if (port[IFLA_PORT_HOST_UUID])
+			host_uuid = nla_data(port[IFLA_PORT_HOST_UUID]);
+
+		return enic_set_port_profile(enic, request,
+			netdev->dev_addr, name,
+			instance_uuid, host_uuid);
+
+	case PORT_REQUEST_DISASSOCIATE:
+
+		return enic_unset_port_profile(enic);
+
+	default:
+		break;
 	}
 
-	return enic_set_port_profile(enic, netdev->dev_addr);
+	return -EOPNOTSUPP;
 }
 
 static int enic_get_vf_port(struct net_device *netdev, int vf,
@@ -1165,12 +1172,14 @@ static int enic_get_vf_port(struct net_device *netdev, int vf,
 	int err, error, done;
 	u16 response = PORT_PROFILE_RESPONSE_SUCCESS;
 
-	if (!(enic->pp.set & ENIC_SET_APPLIED))
-		return -ENODATA;
+	/* don't support VFs, yet */
+	if (vf != PORT_SELF_VF)
+		return -EOPNOTSUPP;
 
 	err = enic_dev_init_done(enic, &done, &error);
+
 	if (err)
-		error = err;
+		return err;
 
 	switch (error) {
 	case ERR_SUCCESS:
@@ -1193,15 +1202,12 @@ static int enic_get_vf_port(struct net_device *netdev, int vf,
 
 	NLA_PUT_U16(skb, IFLA_PORT_REQUEST, enic->pp.request);
 	NLA_PUT_U16(skb, IFLA_PORT_RESPONSE, response);
-	if (enic->pp.set & ENIC_SET_NAME)
-		NLA_PUT(skb, IFLA_PORT_PROFILE, PORT_PROFILE_MAX,
-			enic->pp.name);
-	if (enic->pp.set & ENIC_SET_INSTANCE)
-		NLA_PUT(skb, IFLA_PORT_INSTANCE_UUID, PORT_UUID_MAX,
-			enic->pp.instance_uuid);
-	if (enic->pp.set & ENIC_SET_HOST)
-		NLA_PUT(skb, IFLA_PORT_HOST_UUID, PORT_UUID_MAX,
-			enic->pp.host_uuid);
+	NLA_PUT(skb, IFLA_PORT_PROFILE, PORT_PROFILE_MAX,
+		enic->pp.name);
+	NLA_PUT(skb, IFLA_PORT_INSTANCE_UUID, PORT_UUID_MAX,
+		enic->pp.instance_uuid);
+	NLA_PUT(skb, IFLA_PORT_HOST_UUID, PORT_UUID_MAX,
+		enic->pp.host_uuid);
 
 	return 0;
 
diff --git a/trunk/drivers/net/enic/vnic_dev.c b/trunk/drivers/net/enic/vnic_dev.c
index e0d33281ec98..2b3e16db5c82 100644
--- a/trunk/drivers/net/enic/vnic_dev.c
+++ b/trunk/drivers/net/enic/vnic_dev.c
@@ -709,7 +709,7 @@ int vnic_dev_init_prov(struct vnic_dev *vdev, u8 *buf, u32 len)
 {
 	u64 a0, a1 = len;
 	int wait = 1000;
-	dma_addr_t prov_pa;
+	u64 prov_pa;
 	void *prov_buf;
 	int ret;
 
diff --git a/trunk/drivers/net/epic100.c b/trunk/drivers/net/epic100.c
index 4c274657283c..6838dfc9ef23 100644
--- a/trunk/drivers/net/epic100.c
+++ b/trunk/drivers/net/epic100.c
@@ -87,7 +87,6 @@ static int rx_copybreak;
 #include <linux/bitops.h>
 #include <asm/io.h>
 #include <asm/uaccess.h>
-#include <asm/byteorder.h>
 
 /* These identify the driver base version and may not be removed. */
 static char version[] __devinitdata =
@@ -231,7 +230,7 @@ static const u16 media2miictl[16] = {
  * The EPIC100 Rx and Tx buffer descriptors.  Note that these
  * really ARE host-endian; it's not a misannotation.  We tell
  * the card to byteswap them internally on big-endian hosts -
- * look for #ifdef __BIG_ENDIAN in epic_open().
+ * look for #ifdef CONFIG_BIG_ENDIAN in epic_open().
  */
 
 struct epic_tx_desc {
@@ -691,7 +690,7 @@ static int epic_open(struct net_device *dev)
 		outl((inl(ioaddr + NVCTL) & ~0x003C) | 0x4800, ioaddr + NVCTL);
 
 	/* Tell the chip to byteswap descriptors on big-endian hosts */
-#ifdef __BIG_ENDIAN
+#ifdef CONFIG_BIG_ENDIAN
 	outl(0x4432 | (RX_FIFO_THRESH<<8), ioaddr + GENCTL);
 	inl(ioaddr + GENCTL);
 	outl(0x0432 | (RX_FIFO_THRESH<<8), ioaddr + GENCTL);
@@ -807,7 +806,7 @@ static void epic_restart(struct net_device *dev)
 	for (i = 16; i > 0; i--)
 		outl(0x0008, ioaddr + TEST1);
 
-#ifdef __BIG_ENDIAN
+#ifdef CONFIG_BIG_ENDIAN
 	outl(0x0432 | (RX_FIFO_THRESH<<8), ioaddr + GENCTL);
 #else
 	outl(0x0412 | (RX_FIFO_THRESH<<8), ioaddr + GENCTL);
diff --git a/trunk/drivers/net/fec.c b/trunk/drivers/net/fec.c
index edfff92a6d8e..ddf7a86cd466 100644
--- a/trunk/drivers/net/fec.c
+++ b/trunk/drivers/net/fec.c
@@ -1373,9 +1373,10 @@ fec_suspend(struct platform_device *dev, pm_message_t state)
 
 	if (ndev) {
 		fep = netdev_priv(ndev);
-		if (netif_running(ndev))
-			fec_enet_close(ndev);
-		clk_disable(fep->clk);
+		if (netif_running(ndev)) {
+			netif_device_detach(ndev);
+			fec_stop(ndev);
+		}
 	}
 	return 0;
 }
@@ -1384,13 +1385,12 @@ static int
 fec_resume(struct platform_device *dev)
 {
 	struct net_device *ndev = platform_get_drvdata(dev);
-	struct fec_enet_private *fep;
 
 	if (ndev) {
-		fep = netdev_priv(ndev);
-		clk_enable(fep->clk);
-		if (netif_running(ndev))
-			fec_enet_open(ndev);
+		if (netif_running(ndev)) {
+			fec_enet_init(ndev, 0);
+			netif_device_attach(ndev);
+		}
 	}
 	return 0;
 }
diff --git a/trunk/drivers/net/fs_enet/mac-fcc.c b/trunk/drivers/net/fs_enet/mac-fcc.c
index 48e91b6242ce..5d45084b287d 100644
--- a/trunk/drivers/net/fs_enet/mac-fcc.c
+++ b/trunk/drivers/net/fs_enet/mac-fcc.c
@@ -504,54 +504,17 @@ static int get_regs_len(struct net_device *dev)
 }
 
 /* Some transmit errors cause the transmitter to shut
- * down.  We now issue a restart transmit.
- * Also, to workaround 8260 device erratum CPM37, we must
- * disable and then re-enable the transmitterfollowing a
- * Late Collision, Underrun, or Retry Limit error.
- * In addition, tbptr may point beyond BDs beyond still marked
- * as ready due to internal pipelining, so we need to look back
- * through the BDs and adjust tbptr to point to the last BD
- * marked as ready.  This may result in some buffers being
- * retransmitted.
+ * down.  We now issue a restart transmit.  Since the
+ * errors close the BD and update the pointers, the restart
+ * _should_ pick up without having to reset any of our
+ * pointers either.  Also, To workaround 8260 device erratum
+ * CPM37, we must disable and then re-enable the transmitter
+ * following a Late Collision, Underrun, or Retry Limit error.
  */
 static void tx_restart(struct net_device *dev)
 {
 	struct fs_enet_private *fep = netdev_priv(dev);
 	fcc_t __iomem *fccp = fep->fcc.fccp;
-	const struct fs_platform_info *fpi = fep->fpi;
-	fcc_enet_t __iomem *ep = fep->fcc.ep;
-	cbd_t __iomem *curr_tbptr;
-	cbd_t __iomem *recheck_bd;
-	cbd_t __iomem *prev_bd;
-	cbd_t __iomem *last_tx_bd;
-
-	last_tx_bd = fep->tx_bd_base + (fpi->tx_ring * sizeof(cbd_t));
-
-	/* get the current bd held in TBPTR  and scan back from this point */
-	recheck_bd = curr_tbptr = (cbd_t __iomem *)
-		((R32(ep, fen_genfcc.fcc_tbptr) - fep->ring_mem_addr) +
-		fep->ring_base);
-
-	prev_bd = (recheck_bd == fep->tx_bd_base) ? last_tx_bd : recheck_bd - 1;
-
-	/* Move through the bds in reverse, look for the earliest buffer
-	 * that is not ready.  Adjust TBPTR to the following buffer */
-	while ((CBDR_SC(prev_bd) & BD_ENET_TX_READY) != 0) {
-		/* Go back one buffer */
-		recheck_bd = prev_bd;
-
-		/* update the previous buffer */
-		prev_bd = (prev_bd == fep->tx_bd_base) ? last_tx_bd : prev_bd - 1;
-
-		/* We should never see all bds marked as ready, check anyway */
-		if (recheck_bd == curr_tbptr)
-			break;
-	}
-	/* Now update the TBPTR and dirty flag to the current buffer */
-	W32(ep, fen_genfcc.fcc_tbptr,
-		(uint) (((void *)recheck_bd - fep->ring_base) +
-		fep->ring_mem_addr));
-	fep->dirty_tx = recheck_bd;
 
 	C32(fccp, fcc_gfmr, FCC_GFMR_ENT);
 	udelay(10);
diff --git a/trunk/drivers/net/gianfar.c b/trunk/drivers/net/gianfar.c
index 46c69cd06553..1830f3199cb5 100644
--- a/trunk/drivers/net/gianfar.c
+++ b/trunk/drivers/net/gianfar.c
@@ -747,7 +747,8 @@ static int gfar_of_init(struct of_device *ofdev, struct net_device **pdev)
 			FSL_GIANFAR_DEV_HAS_CSUM |
 			FSL_GIANFAR_DEV_HAS_VLAN |
 			FSL_GIANFAR_DEV_HAS_MAGIC_PACKET |
-			FSL_GIANFAR_DEV_HAS_EXTENDED_HASH;
+			FSL_GIANFAR_DEV_HAS_EXTENDED_HASH |
+			FSL_GIANFAR_DEV_HAS_TIMER;
 
 	ctype = of_get_property(np, "phy-connection-type", NULL);
 
diff --git a/trunk/drivers/net/greth.c b/trunk/drivers/net/greth.c
index 3a029d02c2b4..f37a4c143ddd 100644
--- a/trunk/drivers/net/greth.c
+++ b/trunk/drivers/net/greth.c
@@ -1607,13 +1607,14 @@ static struct of_device_id greth_of_match[] = {
 MODULE_DEVICE_TABLE(of, greth_of_match);
 
 static struct of_platform_driver greth_of_driver = {
-	.driver = {
-		.name = "grlib-greth",
-		.owner = THIS_MODULE,
-		.of_match_table = greth_of_match,
-	},
+	.name = "grlib-greth",
+	.match_table = greth_of_match,
 	.probe = greth_of_probe,
 	.remove = __devexit_p(greth_of_remove),
+	.driver = {
+		   .owner = THIS_MODULE,
+		   .name = "grlib-greth",
+		   },
 };
 
 static int __init greth_init(void)
diff --git a/trunk/drivers/net/ixgbe/ixgbe_common.c b/trunk/drivers/net/ixgbe/ixgbe_common.c
index 9595b1bfb8dd..1159d9138f05 100644
--- a/trunk/drivers/net/ixgbe/ixgbe_common.c
+++ b/trunk/drivers/net/ixgbe/ixgbe_common.c
@@ -1188,7 +1188,6 @@ s32 ixgbe_set_rar_generic(struct ixgbe_hw *hw, u32 index, u8 *addr, u32 vmdq,
 		IXGBE_WRITE_REG(hw, IXGBE_RAH(index), rar_high);
 	} else {
 		hw_dbg(hw, "RAR index %d is out of range.\n", index);
-		return IXGBE_ERR_RAR_INDEX;
 	}
 
 	return 0;
@@ -1220,7 +1219,6 @@ s32 ixgbe_clear_rar_generic(struct ixgbe_hw *hw, u32 index)
 		IXGBE_WRITE_REG(hw, IXGBE_RAH(index), rar_high);
 	} else {
 		hw_dbg(hw, "RAR index %d is out of range.\n", index);
-		return IXGBE_ERR_RAR_INDEX;
 	}
 
 	/* clear VMDq pool/queue selection for this RAR */
diff --git a/trunk/drivers/net/ixgbe/ixgbe_ethtool.c b/trunk/drivers/net/ixgbe/ixgbe_ethtool.c
index 3a93a81872b8..c50a7541ffec 100644
--- a/trunk/drivers/net/ixgbe/ixgbe_ethtool.c
+++ b/trunk/drivers/net/ixgbe/ixgbe_ethtool.c
@@ -2077,6 +2077,25 @@ static int ixgbe_get_coalesce(struct net_device *netdev,
 	return 0;
 }
 
+/*
+ * this function must be called before setting the new value of
+ * rx_itr_setting
+ */
+static bool ixgbe_reenable_rsc(struct ixgbe_adapter *adapter,
+                               struct ethtool_coalesce *ec)
+{
+	/* check the old value and enable RSC if necessary */
+	if ((adapter->rx_itr_setting == 0) &&
+	    (adapter->flags2 & IXGBE_FLAG2_RSC_CAPABLE)) {
+		adapter->flags2 |= IXGBE_FLAG2_RSC_ENABLED;
+		adapter->netdev->features |= NETIF_F_LRO;
+		DPRINTK(PROBE, INFO, "rx-usecs set to %d, re-enabling RSC\n",
+		        ec->rx_coalesce_usecs);
+		return true;
+	}
+	return false;
+}
+
 static int ixgbe_set_coalesce(struct net_device *netdev,
                               struct ethtool_coalesce *ec)
 {
@@ -2105,6 +2124,9 @@ static int ixgbe_set_coalesce(struct net_device *netdev,
 		    (1000000/ec->rx_coalesce_usecs < IXGBE_MIN_INT_RATE))
 			return -EINVAL;
 
+		/* check the old value and enable RSC if necessary */
+		need_reset = ixgbe_reenable_rsc(adapter, ec);
+
 		/* store the value in ints/second */
 		adapter->rx_eitr_param = 1000000/ec->rx_coalesce_usecs;
 
@@ -2113,6 +2135,9 @@ static int ixgbe_set_coalesce(struct net_device *netdev,
 		/* clear the lower bit as its used for dynamic state */
 		adapter->rx_itr_setting &= ~1;
 	} else if (ec->rx_coalesce_usecs == 1) {
+		/* check the old value and enable RSC if necessary */
+		need_reset = ixgbe_reenable_rsc(adapter, ec);
+
 		/* 1 means dynamic mode */
 		adapter->rx_eitr_param = 20000;
 		adapter->rx_itr_setting = 1;
@@ -2132,11 +2157,10 @@ static int ixgbe_set_coalesce(struct net_device *netdev,
 		 */
 		if (adapter->flags2 & IXGBE_FLAG2_RSC_ENABLED) {
 			adapter->flags2 &= ~IXGBE_FLAG2_RSC_ENABLED;
-			if (netdev->features & NETIF_F_LRO) {
-				netdev->features &= ~NETIF_F_LRO;
-				DPRINTK(PROBE, INFO, "rx-usecs set to 0, "
-					"disabling LRO/RSC\n");
-			}
+			netdev->features &= ~NETIF_F_LRO;
+			DPRINTK(PROBE, INFO,
+			        "rx-usecs set to 0, disabling RSC\n");
+
 			need_reset = true;
 		}
 	}
@@ -2231,9 +2255,6 @@ static int ixgbe_set_flags(struct net_device *netdev, u32 data)
 			}
 		} else if (!adapter->rx_itr_setting) {
 			netdev->features &= ~ETH_FLAG_LRO;
-			if (data & ETH_FLAG_LRO)
-				DPRINTK(PROBE, INFO, "rx-usecs set to 0, "
-					"LRO/RSC cannot be enabled.\n");
 		}
 	}
 
diff --git a/trunk/drivers/net/ixgbe/ixgbe_main.c b/trunk/drivers/net/ixgbe/ixgbe_main.c
index ce30c62a97f7..d571d101de08 100644
--- a/trunk/drivers/net/ixgbe/ixgbe_main.c
+++ b/trunk/drivers/net/ixgbe/ixgbe_main.c
@@ -642,7 +642,7 @@ static inline bool ixgbe_tx_xon_state(struct ixgbe_adapter *adapter,
 	u32 txoff = IXGBE_TFCS_TXOFF;
 
 #ifdef CONFIG_IXGBE_DCB
-	if (adapter->dcb_cfg.pfc_mode_enable) {
+	if (adapter->flags & IXGBE_FLAG_DCB_ENABLED) {
 		int tc;
 		int reg_idx = tx_ring->reg_idx;
 		int dcb_i = adapter->ring_feature[RING_F_DCB].indices;
@@ -5282,10 +5282,6 @@ void ixgbe_update_stats(struct ixgbe_adapter *adapter)
 	u32 i, missed_rx = 0, mpc, bprc, lxon, lxoff, xon_off_tot;
 	u64 non_eop_descs = 0, restart_queue = 0;
 
-	if (test_bit(__IXGBE_DOWN, &adapter->state) ||
-	    test_bit(__IXGBE_RESETTING, &adapter->state))
-		return;
-
 	if (adapter->flags2 & IXGBE_FLAG2_RSC_ENABLED) {
 		u64 rsc_count = 0;
 		u64 rsc_flush = 0;
diff --git a/trunk/drivers/net/ixgbe/ixgbe_type.h b/trunk/drivers/net/ixgbe/ixgbe_type.h
index cdd1998f18c7..2eb6e151016c 100644
--- a/trunk/drivers/net/ixgbe/ixgbe_type.h
+++ b/trunk/drivers/net/ixgbe/ixgbe_type.h
@@ -2609,7 +2609,6 @@ struct ixgbe_info {
 #define IXGBE_ERR_EEPROM_VERSION                -24
 #define IXGBE_ERR_NO_SPACE                      -25
 #define IXGBE_ERR_OVERTEMP                      -26
-#define IXGBE_ERR_RAR_INDEX                     -27
 #define IXGBE_NOT_IMPLEMENTED                   0x7FFFFFFF
 
 #endif /* _IXGBE_TYPE_H_ */
diff --git a/trunk/drivers/net/korina.c b/trunk/drivers/net/korina.c
index c7a9bef4dfb0..26bf1b76b997 100644
--- a/trunk/drivers/net/korina.c
+++ b/trunk/drivers/net/korina.c
@@ -135,7 +135,6 @@ struct korina_private {
 	struct napi_struct napi;
 	struct timer_list media_check_timer;
 	struct mii_if_info mii_if;
-	struct work_struct restart_task;
 	struct net_device *dev;
 	int phy_addr;
 };
@@ -376,7 +375,7 @@ static int korina_rx(struct net_device *dev, int limit)
 		if (devcs & ETH_RX_LE)
 			dev->stats.rx_length_errors++;
 		if (devcs & ETH_RX_OVR)
-			dev->stats.rx_fifo_errors++;
+			dev->stats.rx_over_errors++;
 		if (devcs & ETH_RX_CV)
 			dev->stats.rx_frame_errors++;
 		if (devcs & ETH_RX_CES)
@@ -765,9 +764,10 @@ static int korina_alloc_ring(struct net_device *dev)
 
 	/* Initialize the receive descriptors */
 	for (i = 0; i < KORINA_NUM_RDS; i++) {
-		skb = netdev_alloc_skb_ip_align(dev, KORINA_RBSIZE);
+		skb = dev_alloc_skb(KORINA_RBSIZE + 2);
 		if (!skb)
 			return -ENOMEM;
+		skb_reserve(skb, 2);
 		lp->rx_skb[i] = skb;
 		lp->rd_ring[i].control = DMA_DESC_IOD |
 				DMA_COUNT(KORINA_RBSIZE);
@@ -890,12 +890,12 @@ static int korina_init(struct net_device *dev)
 
 /*
  * Restart the RC32434 ethernet controller.
+ * FIXME: check the return status where we call it
  */
-static void korina_restart_task(struct work_struct *work)
+static int korina_restart(struct net_device *dev)
 {
-	struct korina_private *lp = container_of(work,
-			struct korina_private, restart_task);
-	struct net_device *dev = lp->dev;
+	struct korina_private *lp = netdev_priv(dev);
+	int ret;
 
 	/*
 	 * Disable interrupts
@@ -916,9 +916,10 @@ static void korina_restart_task(struct work_struct *work)
 
 	napi_disable(&lp->napi);
 
-	if (korina_init(dev) < 0) {
+	ret = korina_init(dev);
+	if (ret < 0) {
 		printk(KERN_ERR "%s: cannot restart device\n", dev->name);
-		return;
+		return ret;
 	}
 	korina_multicast_list(dev);
 
@@ -926,6 +927,8 @@ static void korina_restart_task(struct work_struct *work)
 	enable_irq(lp->ovr_irq);
 	enable_irq(lp->tx_irq);
 	enable_irq(lp->rx_irq);
+
+	return ret;
 }
 
 static void korina_clear_and_restart(struct net_device *dev, u32 value)
@@ -934,7 +937,7 @@ static void korina_clear_and_restart(struct net_device *dev, u32 value)
 
 	netif_stop_queue(dev);
 	writel(value, &lp->eth_regs->ethintfc);
-	schedule_work(&lp->restart_task);
+	korina_restart(dev);
 }
 
 /* Ethernet Tx Underflow interrupt */
@@ -959,8 +962,11 @@ static irqreturn_t korina_und_interrupt(int irq, void *dev_id)
 static void korina_tx_timeout(struct net_device *dev)
 {
 	struct korina_private *lp = netdev_priv(dev);
+	unsigned long flags;
 
-	schedule_work(&lp->restart_task);
+	spin_lock_irqsave(&lp->lock, flags);
+	korina_restart(dev);
+	spin_unlock_irqrestore(&lp->lock, flags);
 }
 
 /* Ethernet Rx Overflow interrupt */
@@ -1080,8 +1086,6 @@ static int korina_close(struct net_device *dev)
 
 	napi_disable(&lp->napi);
 
-	cancel_work_sync(&lp->restart_task);
-
 	free_irq(lp->rx_irq, dev);
 	free_irq(lp->tx_irq, dev);
 	free_irq(lp->ovr_irq, dev);
@@ -1194,8 +1198,6 @@ static int korina_probe(struct platform_device *pdev)
 	}
 	setup_timer(&lp->media_check_timer, korina_poll_media, (unsigned long) dev);
 
-	INIT_WORK(&lp->restart_task, korina_restart_task);
-
 	printk(KERN_INFO "%s: " DRV_NAME "-" DRV_VERSION " " DRV_RELDATE "\n",
 			dev->name);
 out:
diff --git a/trunk/drivers/net/ksz884x.c b/trunk/drivers/net/ksz884x.c
index 7805bbf1d53a..c80ca64277b2 100644
--- a/trunk/drivers/net/ksz884x.c
+++ b/trunk/drivers/net/ksz884x.c
@@ -4854,7 +4854,7 @@ static inline void copy_old_skb(struct sk_buff *old, struct sk_buff *skb)
  *
  * Return 0 if successful; otherwise an error code indicating failure.
  */
-static netdev_tx_t netdev_tx(struct sk_buff *skb, struct net_device *dev)
+static int netdev_tx(struct sk_buff *skb, struct net_device *dev)
 {
 	struct dev_priv *priv = netdev_priv(dev);
 	struct dev_info *hw_priv = priv->adapter;
@@ -6863,7 +6863,6 @@ static const struct net_device_ops netdev_ops = {
 	.ndo_tx_timeout		= netdev_tx_timeout,
 	.ndo_change_mtu		= netdev_change_mtu,
 	.ndo_set_mac_address	= netdev_set_mac_address,
-	.ndo_validate_addr	= eth_validate_addr,
 	.ndo_do_ioctl		= netdev_ioctl,
 	.ndo_set_rx_mode	= netdev_set_rx_mode,
 #ifdef CONFIG_NET_POLL_CONTROLLER
diff --git a/trunk/drivers/net/phy/lxt.c b/trunk/drivers/net/phy/lxt.c
index dbd003453737..8ee929b796d8 100644
--- a/trunk/drivers/net/phy/lxt.c
+++ b/trunk/drivers/net/phy/lxt.c
@@ -53,9 +53,6 @@
 
 #define MII_LXT971_ISR		19  /* Interrupt Status Register */
 
-/* register definitions for the 973 */
-#define MII_LXT973_PCR 16 /* Port Configuration Register */
-#define PCR_FIBER_SELECT 1
 
 MODULE_DESCRIPTION("Intel LXT PHY driver");
 MODULE_AUTHOR("Andy Fleming");
@@ -122,33 +119,6 @@ static int lxt971_config_intr(struct phy_device *phydev)
 	return err;
 }
 
-static int lxt973_probe(struct phy_device *phydev)
-{
-	int val = phy_read(phydev, MII_LXT973_PCR);
-
-	if (val & PCR_FIBER_SELECT) {
-		/*
-		 * If fiber is selected, then the only correct setting
-		 * is 100Mbps, full duplex, and auto negotiation off.
-		 */
-		val = phy_read(phydev, MII_BMCR);
-		val |= (BMCR_SPEED100 | BMCR_FULLDPLX);
-		val &= ~BMCR_ANENABLE;
-		phy_write(phydev, MII_BMCR, val);
-		/* Remember that the port is in fiber mode. */
-		phydev->priv = lxt973_probe;
-	} else {
-		phydev->priv = NULL;
-	}
-	return 0;
-}
-
-static int lxt973_config_aneg(struct phy_device *phydev)
-{
-	/* Do nothing if port is in fiber mode. */
-	return phydev->priv ? 0 : genphy_config_aneg(phydev);
-}
-
 static struct phy_driver lxt970_driver = {
 	.phy_id		= 0x78100000,
 	.name		= "LXT970",
@@ -176,18 +146,6 @@ static struct phy_driver lxt971_driver = {
 	.driver 	= { .owner = THIS_MODULE,},
 };
 
-static struct phy_driver lxt973_driver = {
-	.phy_id		= 0x00137a10,
-	.name		= "LXT973",
-	.phy_id_mask	= 0xfffffff0,
-	.features	= PHY_BASIC_FEATURES,
-	.flags		= 0,
-	.probe		= lxt973_probe,
-	.config_aneg	= lxt973_config_aneg,
-	.read_status	= genphy_read_status,
-	.driver 	= { .owner = THIS_MODULE,},
-};
-
 static int __init lxt_init(void)
 {
 	int ret;
@@ -199,15 +157,9 @@ static int __init lxt_init(void)
 	ret = phy_driver_register(&lxt971_driver);
 	if (ret)
 		goto err2;
-
-	ret = phy_driver_register(&lxt973_driver);
-	if (ret)
-		goto err3;
 	return 0;
 
- err3:
-	phy_driver_unregister(&lxt971_driver);
- err2:
+ err2:	
 	phy_driver_unregister(&lxt970_driver);
  err1:
 	return ret;
@@ -217,7 +169,6 @@ static void __exit lxt_exit(void)
 {
 	phy_driver_unregister(&lxt970_driver);
 	phy_driver_unregister(&lxt971_driver);
-	phy_driver_unregister(&lxt973_driver);
 }
 
 module_init(lxt_init);
diff --git a/trunk/drivers/net/ppp_generic.c b/trunk/drivers/net/ppp_generic.c
index 1b2c29150202..c5f8eb102bf7 100644
--- a/trunk/drivers/net/ppp_generic.c
+++ b/trunk/drivers/net/ppp_generic.c
@@ -1422,7 +1422,7 @@ static int ppp_mp_explode(struct ppp *ppp, struct sk_buff *skb)
 		flen = len;
 		if (nfree > 0) {
 			if (pch->speed == 0) {
-				flen = len/nfree;
+				flen = totlen/nfree;
 				if (nbigger > 0) {
 					flen++;
 					nbigger--;
diff --git a/trunk/drivers/net/r8169.c b/trunk/drivers/net/r8169.c
index 96b6cfbf0a3a..217e709bda3e 100644
--- a/trunk/drivers/net/r8169.c
+++ b/trunk/drivers/net/r8169.c
@@ -559,11 +559,6 @@ static void mdio_write(void __iomem *ioaddr, int reg_addr, int value)
 			break;
 		udelay(25);
 	}
-	/*
-	 * According to hardware specs a 20us delay is required after write
-	 * complete indication, but before sending next command.
-	 */
-	udelay(20);
 }
 
 static int mdio_read(void __iomem *ioaddr, int reg_addr)
@@ -583,12 +578,6 @@ static int mdio_read(void __iomem *ioaddr, int reg_addr)
 		}
 		udelay(25);
 	}
-	/*
-	 * According to hardware specs a 20us delay is required after read
-	 * complete indication, but before sending next command.
-	 */
-	udelay(20);
-
 	return value;
 }
 
diff --git a/trunk/drivers/net/sfc/net_driver.h b/trunk/drivers/net/sfc/net_driver.h
index 4762c91cb587..2e6fd89f2a72 100644
--- a/trunk/drivers/net/sfc/net_driver.h
+++ b/trunk/drivers/net/sfc/net_driver.h
@@ -830,7 +830,7 @@ static inline const char *efx_dev_name(struct efx_nic *efx)
 
 static inline unsigned int efx_port_num(struct efx_nic *efx)
 {
-	return efx->net_dev->dev_id;
+	return PCI_FUNC(efx->pci_dev->devfn);
 }
 
 /**
diff --git a/trunk/drivers/net/sfc/siena.c b/trunk/drivers/net/sfc/siena.c
index f2b1e6180753..727b4228e081 100644
--- a/trunk/drivers/net/sfc/siena.c
+++ b/trunk/drivers/net/sfc/siena.c
@@ -206,7 +206,6 @@ static int siena_probe_nic(struct efx_nic *efx)
 {
 	struct siena_nic_data *nic_data;
 	bool already_attached = 0;
-	efx_oword_t reg;
 	int rc;
 
 	/* Allocate storage for hardware specific data */
@@ -221,9 +220,6 @@ static int siena_probe_nic(struct efx_nic *efx)
 		goto fail1;
 	}
 
-	efx_reado(efx, &reg, FR_AZ_CS_DEBUG);
-	efx->net_dev->dev_id = EFX_OWORD_FIELD(reg, FRF_CZ_CS_PORT_NUM) - 1;
-
 	efx_mcdi_init(efx);
 
 	/* Recover from a failed assertion before probing */
diff --git a/trunk/drivers/net/tehuti.c b/trunk/drivers/net/tehuti.c
index 737df6032bbc..20ab16192325 100644
--- a/trunk/drivers/net/tehuti.c
+++ b/trunk/drivers/net/tehuti.c
@@ -646,7 +646,7 @@ static int bdx_ioctl_priv(struct net_device *ndev, struct ifreq *ifr, int cmd)
 		error = copy_from_user(data, ifr->ifr_data, sizeof(data));
 		if (error) {
 			pr_err("cant copy from user\n");
-			RET(-EFAULT);
+			RET(error);
 		}
 		DBG("%d 0x%x 0x%x\n", data[0], data[1], data[2]);
 	}
@@ -665,7 +665,7 @@ static int bdx_ioctl_priv(struct net_device *ndev, struct ifreq *ifr, int cmd)
 		    data[2]);
 		error = copy_to_user(ifr->ifr_data, data, sizeof(data));
 		if (error)
-			RET(-EFAULT);
+			RET(error);
 		break;
 
 	case BDX_OP_WRITE:
diff --git a/trunk/drivers/net/usb/asix.c b/trunk/drivers/net/usb/asix.c
index 9516f382a6ba..1f802e90474c 100644
--- a/trunk/drivers/net/usb/asix.c
+++ b/trunk/drivers/net/usb/asix.c
@@ -344,7 +344,7 @@ static int asix_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
 			return 2;
 		}
 
-		if (size > dev->net->mtu + ETH_HLEN) {
+		if (size > ETH_FRAME_LEN) {
 			netdev_err(dev->net, "asix_rx_fixup() Bad RX Length %d\n",
 				   size);
 			return 0;
diff --git a/trunk/drivers/net/virtio_net.c b/trunk/drivers/net/virtio_net.c
index 1edb7a61983c..78eb3190b9b1 100644
--- a/trunk/drivers/net/virtio_net.c
+++ b/trunk/drivers/net/virtio_net.c
@@ -340,7 +340,7 @@ static int add_recvbuf_small(struct virtnet_info *vi, gfp_t gfp)
 
 	skb_to_sgvec(skb, vi->rx_sg + 1, 0, skb->len);
 
-	err = virtqueue_add_buf_gfp(vi->rvq, vi->rx_sg, 0, 2, skb, gfp);
+	err = virtqueue_add_buf(vi->rvq, vi->rx_sg, 0, 2, skb);
 	if (err < 0)
 		dev_kfree_skb(skb);
 
@@ -385,8 +385,8 @@ static int add_recvbuf_big(struct virtnet_info *vi, gfp_t gfp)
 
 	/* chain first in list head */
 	first->private = (unsigned long)list;
-	err = virtqueue_add_buf_gfp(vi->rvq, vi->rx_sg, 0, MAX_SKB_FRAGS + 2,
-				    first, gfp);
+	err = virtqueue_add_buf(vi->rvq, vi->rx_sg, 0, MAX_SKB_FRAGS + 2,
+				       first);
 	if (err < 0)
 		give_pages(vi, first);
 
@@ -404,7 +404,7 @@ static int add_recvbuf_mergeable(struct virtnet_info *vi, gfp_t gfp)
 
 	sg_init_one(vi->rx_sg, page_address(page), PAGE_SIZE);
 
-	err = virtqueue_add_buf_gfp(vi->rvq, vi->rx_sg, 0, 1, page, gfp);
+	err = virtqueue_add_buf(vi->rvq, vi->rx_sg, 0, 1, page);
 	if (err < 0)
 		give_pages(vi, page);
 
diff --git a/trunk/drivers/net/wan/x25_asy.c b/trunk/drivers/net/wan/x25_asy.c
index e47f5a986b1c..166e77dfffda 100644
--- a/trunk/drivers/net/wan/x25_asy.c
+++ b/trunk/drivers/net/wan/x25_asy.c
@@ -37,6 +37,8 @@
 #include <net/x25device.h>
 #include "x25_asy.h"
 
+#include <net/x25device.h>
+
 static struct net_device **x25_asy_devs;
 static int x25_asy_maxdev = SL_NRUNIT;
 
diff --git a/trunk/drivers/net/wimax/i2400m/fw.c b/trunk/drivers/net/wimax/i2400m/fw.c
index 11491354e5b5..3f283bff0ff7 100644
--- a/trunk/drivers/net/wimax/i2400m/fw.c
+++ b/trunk/drivers/net/wimax/i2400m/fw.c
@@ -1192,7 +1192,7 @@ int i2400m_fw_hdr_check(struct i2400m *i2400m,
 	unsigned module_type, header_len, major_version, minor_version,
 		module_id, module_vendor, date, size;
 
-	module_type = le32_to_cpu(bcf_hdr->module_type);
+	module_type = bcf_hdr->module_type;
 	header_len = sizeof(u32) * le32_to_cpu(bcf_hdr->header_len);
 	major_version = (le32_to_cpu(bcf_hdr->header_version) & 0xffff0000)
 		>> 16;
diff --git a/trunk/drivers/net/wireless/ath/ar9170/usb.c b/trunk/drivers/net/wireless/ath/ar9170/usb.c
index a93dc18a45c3..82ab532a4923 100644
--- a/trunk/drivers/net/wireless/ath/ar9170/usb.c
+++ b/trunk/drivers/net/wireless/ath/ar9170/usb.c
@@ -739,27 +739,17 @@ static int ar9170_usb_init_device(struct ar9170_usb *aru)
 static void ar9170_usb_firmware_failed(struct ar9170_usb *aru)
 {
 	struct device *parent = aru->udev->dev.parent;
-	struct usb_device *udev;
-
-	/*
-	 * Store a copy of the usb_device pointer locally.
-	 * This is because device_release_driver initiates
-	 * ar9170_usb_disconnect, which in turn frees our
-	 * driver context (aru).
-	 */
-	udev = aru->udev;
 
 	complete(&aru->firmware_loading_complete);
 
 	/* unbind anything failed */
 	if (parent)
 		device_lock(parent);
-
-	device_release_driver(&udev->dev);
+	device_release_driver(&aru->udev->dev);
 	if (parent)
 		device_unlock(parent);
 
-	usb_put_dev(udev);
+	usb_put_dev(aru->udev);
 }
 
 static void ar9170_usb_firmware_finish(const struct firmware *fw, void *context)
diff --git a/trunk/drivers/net/wireless/ath/ath5k/base.c b/trunk/drivers/net/wireless/ath/ath5k/base.c
index 648972df369d..cc6d41dec332 100644
--- a/trunk/drivers/net/wireless/ath/ath5k/base.c
+++ b/trunk/drivers/net/wireless/ath/ath5k/base.c
@@ -195,7 +195,7 @@ static const struct ieee80211_rate ath5k_rates[] = {
 static int __devinit	ath5k_pci_probe(struct pci_dev *pdev,
 				const struct pci_device_id *id);
 static void __devexit	ath5k_pci_remove(struct pci_dev *pdev);
-#ifdef CONFIG_PM_SLEEP
+#ifdef CONFIG_PM
 static int		ath5k_pci_suspend(struct device *dev);
 static int		ath5k_pci_resume(struct device *dev);
 
@@ -203,7 +203,7 @@ static SIMPLE_DEV_PM_OPS(ath5k_pm_ops, ath5k_pci_suspend, ath5k_pci_resume);
 #define ATH5K_PM_OPS	(&ath5k_pm_ops)
 #else
 #define ATH5K_PM_OPS	NULL
-#endif /* CONFIG_PM_SLEEP */
+#endif /* CONFIG_PM */
 
 static struct pci_driver ath5k_pci_driver = {
 	.name		= KBUILD_MODNAME,
@@ -222,6 +222,7 @@ static int ath5k_tx(struct ieee80211_hw *hw, struct sk_buff *skb);
 static int ath5k_tx_queue(struct ieee80211_hw *hw, struct sk_buff *skb,
 		struct ath5k_txq *txq);
 static int ath5k_reset(struct ath5k_softc *sc, struct ieee80211_channel *chan);
+static int ath5k_reset_wake(struct ath5k_softc *sc);
 static int ath5k_start(struct ieee80211_hw *hw);
 static void ath5k_stop(struct ieee80211_hw *hw);
 static int ath5k_add_interface(struct ieee80211_hw *hw,
@@ -708,7 +709,7 @@ ath5k_pci_remove(struct pci_dev *pdev)
 	ieee80211_free_hw(hw);
 }
 
-#ifdef CONFIG_PM_SLEEP
+#ifdef CONFIG_PM
 static int ath5k_pci_suspend(struct device *dev)
 {
 	struct ieee80211_hw *hw = pci_get_drvdata(to_pci_dev(dev));
@@ -734,7 +735,7 @@ static int ath5k_pci_resume(struct device *dev)
 	ath5k_led_enable(sc);
 	return 0;
 }
-#endif /* CONFIG_PM_SLEEP */
+#endif /* CONFIG_PM */
 
 
 /***********************\
@@ -2769,7 +2770,7 @@ ath5k_tasklet_reset(unsigned long data)
 {
 	struct ath5k_softc *sc = (void *)data;
 
-	ath5k_reset(sc, sc->curchan);
+	ath5k_reset_wake(sc);
 }
 
 /*
@@ -2940,13 +2941,23 @@ ath5k_reset(struct ath5k_softc *sc, struct ieee80211_channel *chan)
 	ath5k_beacon_config(sc);
 	/* intrs are enabled by ath5k_beacon_config */
 
-	ieee80211_wake_queues(sc->hw);
-
 	return 0;
 err:
 	return ret;
 }
 
+static int
+ath5k_reset_wake(struct ath5k_softc *sc)
+{
+	int ret;
+
+	ret = ath5k_reset(sc, sc->curchan);
+	if (!ret)
+		ieee80211_wake_queues(sc->hw);
+
+	return ret;
+}
+
 static int ath5k_start(struct ieee80211_hw *hw)
 {
 	return ath5k_init(hw->priv);
@@ -3140,15 +3151,13 @@ static void ath5k_configure_filter(struct ieee80211_hw *hw,
 
 	if (changed_flags & (FIF_PROMISC_IN_BSS | FIF_OTHER_BSS)) {
 		if (*new_flags & FIF_PROMISC_IN_BSS) {
+			rfilt |= AR5K_RX_FILTER_PROM;
 			__set_bit(ATH_STAT_PROMISC, sc->status);
 		} else {
 			__clear_bit(ATH_STAT_PROMISC, sc->status);
 		}
 	}
 
-	if (test_bit(ATH_STAT_PROMISC, sc->status))
-		rfilt |= AR5K_RX_FILTER_PROM;
-
 	/* Note, AR5K_RX_FILTER_MCAST is already enabled */
 	if (*new_flags & FIF_ALLMULTI) {
 		mfilt[0] =  ~0;
diff --git a/trunk/drivers/net/wireless/ath/ath5k/phy.c b/trunk/drivers/net/wireless/ath/ath5k/phy.c
index 492cbb15720d..1b81c4778800 100644
--- a/trunk/drivers/net/wireless/ath/ath5k/phy.c
+++ b/trunk/drivers/net/wireless/ath/ath5k/phy.c
@@ -1814,13 +1814,6 @@ ath5k_hw_set_antenna_mode(struct ath5k_hw *ah, u8 ant_mode)
 	u8 def_ant, tx_ant, ee_mode;
 	u32 sta_id1 = 0;
 
-	/* if channel is not initialized yet we can't set the antennas
-	 * so just store the mode. it will be set on the next reset */
-	if (channel == NULL) {
-		ah->ah_ant_mode = ant_mode;
-		return;
-	}
-
 	def_ant = ah->ah_def_ant;
 
 	ATH5K_TRACE(ah->ah_sc);
diff --git a/trunk/drivers/net/wireless/ath/ath9k/xmit.c b/trunk/drivers/net/wireless/ath/ath9k/xmit.c
index 859aa4ab0769..3db19172b43b 100644
--- a/trunk/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/trunk/drivers/net/wireless/ath/ath9k/xmit.c
@@ -1198,7 +1198,7 @@ void ath_drain_all_txq(struct ath_softc *sc, bool retry_tx)
 		int r;
 
 		ath_print(common, ATH_DBG_FATAL,
-			  "Failed to stop TX DMA. Resetting hardware!\n");
+			  "Unable to stop TxDMA. Reset HAL!\n");
 
 		spin_lock_bh(&sc->sc_resetlock);
 		r = ath9k_hw_reset(ah, sc->sc_ah->curchan, false);
@@ -1728,8 +1728,6 @@ static int ath_tx_setup_buffer(struct ieee80211_hw *hw, struct ath_buf *bf,
 	} else
 		bf->bf_isnullfunc = false;
 
-	bf->bf_tx_aborted = false;
-
 	return 0;
 }
 
@@ -1991,7 +1989,7 @@ static int ath_tx_num_badfrms(struct ath_softc *sc, struct ath_buf *bf,
 	int nbad = 0;
 	int isaggr = 0;
 
-	if (bf->bf_lastbf->bf_tx_aborted)
+	if (bf->bf_tx_aborted)
 		return 0;
 
 	isaggr = bf_isaggr(bf);
diff --git a/trunk/drivers/net/wireless/hostap/hostap_hw.c b/trunk/drivers/net/wireless/hostap/hostap_hw.c
index ff9b5c882184..d70732819423 100644
--- a/trunk/drivers/net/wireless/hostap/hostap_hw.c
+++ b/trunk/drivers/net/wireless/hostap/hostap_hw.c
@@ -2618,6 +2618,15 @@ static irqreturn_t prism2_interrupt(int irq, void *dev_id)
 	int events = 0;
 	u16 ev;
 
+	/* Detect early interrupt before driver is fully configued */
+	if (!dev->base_addr) {
+		if (net_ratelimit()) {
+			printk(KERN_DEBUG "%s: Interrupt, but dev not configured\n",
+			       dev->name);
+		}
+		return IRQ_HANDLED;
+	}
+
 	iface = netdev_priv(dev);
 	local = iface->local;
 
diff --git a/trunk/drivers/net/wireless/iwlwifi/iwl-3945.c b/trunk/drivers/net/wireless/iwlwifi/iwl-3945.c
index c44a303e62ed..068f7f8435c5 100644
--- a/trunk/drivers/net/wireless/iwlwifi/iwl-3945.c
+++ b/trunk/drivers/net/wireless/iwlwifi/iwl-3945.c
@@ -2852,7 +2852,6 @@ static struct iwl_lib_ops iwl3945_lib = {
 	.isr = iwl_isr_legacy,
 	.config_ap = iwl3945_config_ap,
 	.manage_ibss_station = iwl3945_manage_ibss_station,
-	.recover_from_tx_stall = iwl_bg_monitor_recover,
 	.check_plcp_health = iwl3945_good_plcp_health,
 
 	.debugfs_ops = {
diff --git a/trunk/drivers/net/wireless/iwlwifi/iwl-agn-lib.c b/trunk/drivers/net/wireless/iwlwifi/iwl-agn-lib.c
index 0f292a210ed9..1004cfc403b1 100644
--- a/trunk/drivers/net/wireless/iwlwifi/iwl-agn-lib.c
+++ b/trunk/drivers/net/wireless/iwlwifi/iwl-agn-lib.c
@@ -1119,9 +1119,10 @@ static int iwl_get_single_channel_for_scan(struct iwl_priv *priv,
 					   struct iwl_scan_channel *scan_ch)
 {
 	const struct ieee80211_supported_band *sband;
+	const struct iwl_channel_info *ch_info;
 	u16 passive_dwell = 0;
 	u16 active_dwell = 0;
-	int added = 0;
+	int i, added = 0;
 	u16 channel = 0;
 
 	sband = iwl_get_hw_mode(priv, band);
@@ -1136,7 +1137,32 @@ static int iwl_get_single_channel_for_scan(struct iwl_priv *priv,
 	if (passive_dwell <= active_dwell)
 		passive_dwell = active_dwell + 1;
 
-	channel = iwl_get_single_channel_number(priv, band);
+	/* only scan single channel, good enough to reset the RF */
+	/* pick the first valid not in-use channel */
+	if (band == IEEE80211_BAND_5GHZ) {
+		for (i = 14; i < priv->channel_count; i++) {
+			if (priv->channel_info[i].channel !=
+			    le16_to_cpu(priv->staging_rxon.channel)) {
+				channel = priv->channel_info[i].channel;
+				ch_info = iwl_get_channel_info(priv,
+					band, channel);
+				if (is_channel_valid(ch_info))
+					break;
+			}
+		}
+	} else {
+		for (i = 0; i < 14; i++) {
+			if (priv->channel_info[i].channel !=
+			    le16_to_cpu(priv->staging_rxon.channel)) {
+					channel =
+						priv->channel_info[i].channel;
+					ch_info = iwl_get_channel_info(priv,
+						band, channel);
+					if (is_channel_valid(ch_info))
+						break;
+			}
+		}
+	}
 	if (channel) {
 		scan_ch->channel = cpu_to_le16(channel);
 		scan_ch->type = SCAN_CHANNEL_TYPE_PASSIVE;
diff --git a/trunk/drivers/net/wireless/iwlwifi/iwl-agn-tx.c b/trunk/drivers/net/wireless/iwlwifi/iwl-agn-tx.c
index a732f1094e5d..c402bfc83f36 100644
--- a/trunk/drivers/net/wireless/iwlwifi/iwl-agn-tx.c
+++ b/trunk/drivers/net/wireless/iwlwifi/iwl-agn-tx.c
@@ -1125,7 +1125,6 @@ static void iwlagn_tx_status(struct iwl_priv *priv, struct sk_buff *skb)
 	struct ieee80211_sta *sta;
 	struct iwl_station_priv *sta_priv;
 
-	rcu_read_lock();
 	sta = ieee80211_find_sta(priv->vif, hdr->addr1);
 	if (sta) {
 		sta_priv = (void *)sta->drv_priv;
@@ -1134,7 +1133,6 @@ static void iwlagn_tx_status(struct iwl_priv *priv, struct sk_buff *skb)
 		    atomic_dec_return(&sta_priv->pending_frames) == 0)
 			ieee80211_sta_block_awake(priv->hw, sta, false);
 	}
-	rcu_read_unlock();
 
 	ieee80211_tx_status_irqsafe(priv->hw, skb);
 }
diff --git a/trunk/drivers/net/wireless/iwlwifi/iwl-agn.c b/trunk/drivers/net/wireless/iwlwifi/iwl-agn.c
index 7726e67044c0..aef4f71f1981 100644
--- a/trunk/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/trunk/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -1484,156 +1484,6 @@ bool iwl_good_ack_health(struct iwl_priv *priv,
 }
 
 
-/*****************************************************************************
- *
- * sysfs attributes
- *
- *****************************************************************************/
-
-#ifdef CONFIG_IWLWIFI_DEBUG
-
-/*
- * The following adds a new attribute to the sysfs representation
- * of this device driver (i.e. a new file in /sys/class/net/wlan0/device/)
- * used for controlling the debug level.
- *
- * See the level definitions in iwl for details.
- *
- * The debug_level being managed using sysfs below is a per device debug
- * level that is used instead of the global debug level if it (the per
- * device debug level) is set.
- */
-static ssize_t show_debug_level(struct device *d,
-				struct device_attribute *attr, char *buf)
-{
-	struct iwl_priv *priv = dev_get_drvdata(d);
-	return sprintf(buf, "0x%08X\n", iwl_get_debug_level(priv));
-}
-static ssize_t store_debug_level(struct device *d,
-				struct device_attribute *attr,
-				 const char *buf, size_t count)
-{
-	struct iwl_priv *priv = dev_get_drvdata(d);
-	unsigned long val;
-	int ret;
-
-	ret = strict_strtoul(buf, 0, &val);
-	if (ret)
-		IWL_ERR(priv, "%s is not in hex or decimal form.\n", buf);
-	else {
-		priv->debug_level = val;
-		if (iwl_alloc_traffic_mem(priv))
-			IWL_ERR(priv,
-				"Not enough memory to generate traffic log\n");
-	}
-	return strnlen(buf, count);
-}
-
-static DEVICE_ATTR(debug_level, S_IWUSR | S_IRUGO,
-			show_debug_level, store_debug_level);
-
-
-#endif /* CONFIG_IWLWIFI_DEBUG */
-
-
-static ssize_t show_temperature(struct device *d,
-				struct device_attribute *attr, char *buf)
-{
-	struct iwl_priv *priv = dev_get_drvdata(d);
-
-	if (!iwl_is_alive(priv))
-		return -EAGAIN;
-
-	return sprintf(buf, "%d\n", priv->temperature);
-}
-
-static DEVICE_ATTR(temperature, S_IRUGO, show_temperature, NULL);
-
-static ssize_t show_tx_power(struct device *d,
-			     struct device_attribute *attr, char *buf)
-{
-	struct iwl_priv *priv = dev_get_drvdata(d);
-
-	if (!iwl_is_ready_rf(priv))
-		return sprintf(buf, "off\n");
-	else
-		return sprintf(buf, "%d\n", priv->tx_power_user_lmt);
-}
-
-static ssize_t store_tx_power(struct device *d,
-			      struct device_attribute *attr,
-			      const char *buf, size_t count)
-{
-	struct iwl_priv *priv = dev_get_drvdata(d);
-	unsigned long val;
-	int ret;
-
-	ret = strict_strtoul(buf, 10, &val);
-	if (ret)
-		IWL_INFO(priv, "%s is not in decimal form.\n", buf);
-	else {
-		ret = iwl_set_tx_power(priv, val, false);
-		if (ret)
-			IWL_ERR(priv, "failed setting tx power (0x%d).\n",
-				ret);
-		else
-			ret = count;
-	}
-	return ret;
-}
-
-static DEVICE_ATTR(tx_power, S_IWUSR | S_IRUGO, show_tx_power, store_tx_power);
-
-static ssize_t show_rts_ht_protection(struct device *d,
-			     struct device_attribute *attr, char *buf)
-{
-	struct iwl_priv *priv = dev_get_drvdata(d);
-
-	return sprintf(buf, "%s\n",
-		priv->cfg->use_rts_for_ht ? "RTS/CTS" : "CTS-to-self");
-}
-
-static ssize_t store_rts_ht_protection(struct device *d,
-			      struct device_attribute *attr,
-			      const char *buf, size_t count)
-{
-	struct iwl_priv *priv = dev_get_drvdata(d);
-	unsigned long val;
-	int ret;
-
-	ret = strict_strtoul(buf, 10, &val);
-	if (ret)
-		IWL_INFO(priv, "Input is not in decimal form.\n");
-	else {
-		if (!iwl_is_associated(priv))
-			priv->cfg->use_rts_for_ht = val ? true : false;
-		else
-			IWL_ERR(priv, "Sta associated with AP - "
-				"Change protection mechanism is not allowed\n");
-		ret = count;
-	}
-	return ret;
-}
-
-static DEVICE_ATTR(rts_ht_protection, S_IWUSR | S_IRUGO,
-			show_rts_ht_protection, store_rts_ht_protection);
-
-
-static struct attribute *iwl_sysfs_entries[] = {
-	&dev_attr_temperature.attr,
-	&dev_attr_tx_power.attr,
-	&dev_attr_rts_ht_protection.attr,
-#ifdef CONFIG_IWLWIFI_DEBUG
-	&dev_attr_debug_level.attr,
-#endif
-	NULL
-};
-
-static struct attribute_group iwl_attribute_group = {
-	.name = NULL,		/* put in device directory */
-	.attrs = iwl_sysfs_entries,
-};
-
 /******************************************************************************
  *
  * uCode download functions
@@ -2115,13 +1965,6 @@ static void iwl_ucode_callback(const struct firmware *ucode_raw, void *context)
 	if (err)
 		IWL_ERR(priv, "failed to create debugfs files. Ignoring error: %d\n", err);
 
-	err = sysfs_create_group(&priv->pci_dev->dev.kobj,
-					&iwl_attribute_group);
-	if (err) {
-		IWL_ERR(priv, "failed to create sysfs device attributes\n");
-		goto out_unbind;
-	}
-
 	/* We have our copies now, allow OS release its copies */
 	release_firmware(ucode_raw);
 	complete(&priv->_agn.firmware_loading_complete);
@@ -3419,6 +3262,141 @@ static int iwlagn_mac_sta_add(struct ieee80211_hw *hw,
 	return 0;
 }
 
+/*****************************************************************************
+ *
+ * sysfs attributes
+ *
+ *****************************************************************************/
+
+#ifdef CONFIG_IWLWIFI_DEBUG
+
+/*
+ * The following adds a new attribute to the sysfs representation
+ * of this device driver (i.e. a new file in /sys/class/net/wlan0/device/)
+ * used for controlling the debug level.
+ *
+ * See the level definitions in iwl for details.
+ *
+ * The debug_level being managed using sysfs below is a per device debug
+ * level that is used instead of the global debug level if it (the per
+ * device debug level) is set.
+ */
+static ssize_t show_debug_level(struct device *d,
+				struct device_attribute *attr, char *buf)
+{
+	struct iwl_priv *priv = dev_get_drvdata(d);
+	return sprintf(buf, "0x%08X\n", iwl_get_debug_level(priv));
+}
+static ssize_t store_debug_level(struct device *d,
+				struct device_attribute *attr,
+				 const char *buf, size_t count)
+{
+	struct iwl_priv *priv = dev_get_drvdata(d);
+	unsigned long val;
+	int ret;
+
+	ret = strict_strtoul(buf, 0, &val);
+	if (ret)
+		IWL_ERR(priv, "%s is not in hex or decimal form.\n", buf);
+	else {
+		priv->debug_level = val;
+		if (iwl_alloc_traffic_mem(priv))
+			IWL_ERR(priv,
+				"Not enough memory to generate traffic log\n");
+	}
+	return strnlen(buf, count);
+}
+
+static DEVICE_ATTR(debug_level, S_IWUSR | S_IRUGO,
+			show_debug_level, store_debug_level);
+
+
+#endif /* CONFIG_IWLWIFI_DEBUG */
+
+
+static ssize_t show_temperature(struct device *d,
+				struct device_attribute *attr, char *buf)
+{
+	struct iwl_priv *priv = dev_get_drvdata(d);
+
+	if (!iwl_is_alive(priv))
+		return -EAGAIN;
+
+	return sprintf(buf, "%d\n", priv->temperature);
+}
+
+static DEVICE_ATTR(temperature, S_IRUGO, show_temperature, NULL);
+
+static ssize_t show_tx_power(struct device *d,
+			     struct device_attribute *attr, char *buf)
+{
+	struct iwl_priv *priv = dev_get_drvdata(d);
+
+	if (!iwl_is_ready_rf(priv))
+		return sprintf(buf, "off\n");
+	else
+		return sprintf(buf, "%d\n", priv->tx_power_user_lmt);
+}
+
+static ssize_t store_tx_power(struct device *d,
+			      struct device_attribute *attr,
+			      const char *buf, size_t count)
+{
+	struct iwl_priv *priv = dev_get_drvdata(d);
+	unsigned long val;
+	int ret;
+
+	ret = strict_strtoul(buf, 10, &val);
+	if (ret)
+		IWL_INFO(priv, "%s is not in decimal form.\n", buf);
+	else {
+		ret = iwl_set_tx_power(priv, val, false);
+		if (ret)
+			IWL_ERR(priv, "failed setting tx power (0x%d).\n",
+				ret);
+		else
+			ret = count;
+	}
+	return ret;
+}
+
+static DEVICE_ATTR(tx_power, S_IWUSR | S_IRUGO, show_tx_power, store_tx_power);
+
+static ssize_t show_rts_ht_protection(struct device *d,
+			     struct device_attribute *attr, char *buf)
+{
+	struct iwl_priv *priv = dev_get_drvdata(d);
+
+	return sprintf(buf, "%s\n",
+		priv->cfg->use_rts_for_ht ? "RTS/CTS" : "CTS-to-self");
+}
+
+static ssize_t store_rts_ht_protection(struct device *d,
+			      struct device_attribute *attr,
+			      const char *buf, size_t count)
+{
+	struct iwl_priv *priv = dev_get_drvdata(d);
+	unsigned long val;
+	int ret;
+
+	ret = strict_strtoul(buf, 10, &val);
+	if (ret)
+		IWL_INFO(priv, "Input is not in decimal form.\n");
+	else {
+		if (!iwl_is_associated(priv))
+			priv->cfg->use_rts_for_ht = val ? true : false;
+		else
+			IWL_ERR(priv, "Sta associated with AP - "
+				"Change protection mechanism is not allowed\n");
+		ret = count;
+	}
+	return ret;
+}
+
+static DEVICE_ATTR(rts_ht_protection, S_IWUSR | S_IRUGO,
+			show_rts_ht_protection, store_rts_ht_protection);
+
+
 /*****************************************************************************
  *
  * driver setup and teardown
@@ -3572,6 +3550,21 @@ static void iwl_uninit_drv(struct iwl_priv *priv)
 	kfree(priv->scan_cmd);
 }
 
+static struct attribute *iwl_sysfs_entries[] = {
+	&dev_attr_temperature.attr,
+	&dev_attr_tx_power.attr,
+	&dev_attr_rts_ht_protection.attr,
+#ifdef CONFIG_IWLWIFI_DEBUG
+	&dev_attr_debug_level.attr,
+#endif
+	NULL
+};
+
+static struct attribute_group iwl_attribute_group = {
+	.name = NULL,		/* put in device directory */
+	.attrs = iwl_sysfs_entries,
+};
+
 static struct ieee80211_ops iwl_hw_ops = {
 	.tx = iwl_mac_tx,
 	.start = iwl_mac_start,
@@ -3757,6 +3750,11 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 		IWL_ERR(priv, "Error allocating IRQ %d\n", priv->pci_dev->irq);
 		goto out_disable_msi;
 	}
+	err = sysfs_create_group(&pdev->dev.kobj, &iwl_attribute_group);
+	if (err) {
+		IWL_ERR(priv, "failed to create sysfs device attributes\n");
+		goto out_free_irq;
+	}
 
 	iwl_setup_deferred_work(priv);
 	iwl_setup_rx_handlers(priv);
@@ -3790,13 +3788,15 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 
 	err = iwl_request_firmware(priv, true);
 	if (err)
-		goto out_destroy_workqueue;
+		goto out_remove_sysfs;
 
 	return 0;
 
- out_destroy_workqueue:
+ out_remove_sysfs:
 	destroy_workqueue(priv->workqueue);
 	priv->workqueue = NULL;
+	sysfs_remove_group(&pdev->dev.kobj, &iwl_attribute_group);
+ out_free_irq:
 	free_irq(priv->pci_dev->irq, priv);
 	iwl_free_isr_ict(priv);
  out_disable_msi:
diff --git a/trunk/drivers/net/wireless/iwlwifi/iwl-core.c b/trunk/drivers/net/wireless/iwlwifi/iwl-core.c
index 426e95567de3..5a7eca8fb789 100644
--- a/trunk/drivers/net/wireless/iwlwifi/iwl-core.c
+++ b/trunk/drivers/net/wireless/iwlwifi/iwl-core.c
@@ -854,45 +854,6 @@ void iwl_set_rxon_chain(struct iwl_priv *priv)
 }
 EXPORT_SYMBOL(iwl_set_rxon_chain);
 
-/* Return valid channel */
-u8 iwl_get_single_channel_number(struct iwl_priv *priv,
-				  enum ieee80211_band band)
-{
-	const struct iwl_channel_info *ch_info;
-	int i;
-	u8 channel = 0;
-
-	/* only scan single channel, good enough to reset the RF */
-	/* pick the first valid not in-use channel */
-	if (band == IEEE80211_BAND_5GHZ) {
-		for (i = 14; i < priv->channel_count; i++) {
-			if (priv->channel_info[i].channel !=
-			    le16_to_cpu(priv->staging_rxon.channel)) {
-				channel = priv->channel_info[i].channel;
-				ch_info = iwl_get_channel_info(priv,
-					band, channel);
-				if (is_channel_valid(ch_info))
-					break;
-			}
-		}
-	} else {
-		for (i = 0; i < 14; i++) {
-			if (priv->channel_info[i].channel !=
-			    le16_to_cpu(priv->staging_rxon.channel)) {
-					channel =
-						priv->channel_info[i].channel;
-					ch_info = iwl_get_channel_info(priv,
-						band, channel);
-					if (is_channel_valid(ch_info))
-						break;
-			}
-		}
-	}
-
-	return channel;
-}
-EXPORT_SYMBOL(iwl_get_single_channel_number);
-
 /**
  * iwl_set_rxon_channel - Set the phymode and channel values in staging RXON
  * @phymode: MODE_IEEE80211A sets to 5.2GHz; all else set to 2.4GHz
diff --git a/trunk/drivers/net/wireless/iwlwifi/iwl-core.h b/trunk/drivers/net/wireless/iwlwifi/iwl-core.h
index 31775bd9c361..7e5a5ba41fd2 100644
--- a/trunk/drivers/net/wireless/iwlwifi/iwl-core.h
+++ b/trunk/drivers/net/wireless/iwlwifi/iwl-core.h
@@ -343,8 +343,6 @@ int iwl_check_rxon_cmd(struct iwl_priv *priv);
 int iwl_full_rxon_required(struct iwl_priv *priv);
 void iwl_set_rxon_chain(struct iwl_priv *priv);
 int iwl_set_rxon_channel(struct iwl_priv *priv, struct ieee80211_channel *ch);
-u8 iwl_get_single_channel_number(struct iwl_priv *priv,
-				  enum ieee80211_band band);
 void iwl_set_rxon_ht(struct iwl_priv *priv, struct iwl_ht_config *ht_conf);
 u8 iwl_is_ht40_tx_allowed(struct iwl_priv *priv,
 			 struct ieee80211_sta_ht_cap *sta_ht_inf);
diff --git a/trunk/drivers/net/wireless/iwlwifi/iwl3945-base.c b/trunk/drivers/net/wireless/iwlwifi/iwl3945-base.c
index 6c353cacc8d6..3e5bffb6034f 100644
--- a/trunk/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ b/trunk/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -1844,49 +1844,6 @@ static void iwl3945_irq_tasklet(struct iwl_priv *priv)
 #endif
 }
 
-static int iwl3945_get_single_channel_for_scan(struct iwl_priv *priv,
-					       struct ieee80211_vif *vif,
-					       enum ieee80211_band band,
-					       struct iwl3945_scan_channel *scan_ch)
-{
-	const struct ieee80211_supported_band *sband;
-	u16 passive_dwell = 0;
-	u16 active_dwell = 0;
-	int added = 0;
-	u8 channel = 0;
-
-	sband = iwl_get_hw_mode(priv, band);
-	if (!sband) {
-		IWL_ERR(priv, "invalid band\n");
-		return added;
-	}
-
-	active_dwell = iwl_get_active_dwell_time(priv, band, 0);
-	passive_dwell = iwl_get_passive_dwell_time(priv, band, vif);
-
-	if (passive_dwell <= active_dwell)
-		passive_dwell = active_dwell + 1;
-
-
-	channel = iwl_get_single_channel_number(priv, band);
-
-	if (channel) {
-		scan_ch->channel = channel;
-		scan_ch->type = 0;	/* passive */
-		scan_ch->active_dwell = cpu_to_le16(active_dwell);
-		scan_ch->passive_dwell = cpu_to_le16(passive_dwell);
-		/* Set txpower levels to defaults */
-		scan_ch->tpc.dsp_atten = 110;
-		if (band == IEEE80211_BAND_5GHZ)
-			scan_ch->tpc.tx_gain = ((1 << 5) | (3 << 3)) | 3;
-		else
-			scan_ch->tpc.tx_gain = ((1 << 5) | (5 << 3));
-		added++;
-	} else
-		IWL_ERR(priv, "no valid channel found\n");
-	return added;
-}
-
 static int iwl3945_get_channels_for_scan(struct iwl_priv *priv,
 					 enum ieee80211_band band,
 				     u8 is_active, u8 n_probes,
@@ -3035,16 +2992,9 @@ void iwl3945_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
 	/* select Rx antennas */
 	scan->flags |= iwl3945_get_antenna_flags(priv);
 
-	if (priv->is_internal_short_scan) {
-		scan->channel_count =
-			iwl3945_get_single_channel_for_scan(priv, vif, band,
-				(void *)&scan->data[le16_to_cpu(
-				scan->tx_cmd.len)]);
-	} else {
-		scan->channel_count =
-			iwl3945_get_channels_for_scan(priv, band, is_active, n_probes,
-				(void *)&scan->data[le16_to_cpu(scan->tx_cmd.len)], vif);
-	}
+	scan->channel_count =
+		iwl3945_get_channels_for_scan(priv, band, is_active, n_probes,
+			(void *)&scan->data[le16_to_cpu(scan->tx_cmd.len)], vif);
 
 	if (scan->channel_count == 0) {
 		IWL_DEBUG_SCAN(priv, "channel count %d\n", scan->channel_count);
diff --git a/trunk/drivers/net/wireless/libertas/rx.c b/trunk/drivers/net/wireless/libertas/rx.c
index 7a377f5b7662..a115bfa9513a 100644
--- a/trunk/drivers/net/wireless/libertas/rx.c
+++ b/trunk/drivers/net/wireless/libertas/rx.c
@@ -329,8 +329,9 @@ static int process_rxed_802_11_packet(struct lbs_private *priv,
 	/* create the exported radio header */
 
 	/* radiotap header */
-	memset(&radiotap_hdr, 0, sizeof(radiotap_hdr));
-	/* XXX must check radiotap_hdr.hdr.it_pad for pad */
+	radiotap_hdr.hdr.it_version = 0;
+	/* XXX must check this value for pad */
+	radiotap_hdr.hdr.it_pad = 0;
 	radiotap_hdr.hdr.it_len = cpu_to_le16 (sizeof(struct rx_radiotap_hdr));
 	radiotap_hdr.hdr.it_present = cpu_to_le32 (RX_RADIOTAP_PRESENT);
 	radiotap_hdr.rate = convert_mv_rate_to_radiotap(prxpd->rx_rate);
diff --git a/trunk/drivers/net/wireless/p54/p54usb.c b/trunk/drivers/net/wireless/p54/p54usb.c
index 73073259f508..d5b197b4d5bb 100644
--- a/trunk/drivers/net/wireless/p54/p54usb.c
+++ b/trunk/drivers/net/wireless/p54/p54usb.c
@@ -80,7 +80,6 @@ static struct usb_device_id p54u_table[] __devinitdata = {
 	{USB_DEVICE(0x1413, 0x5400)},   /* Telsey 802.11g USB2.0 Adapter */
 	{USB_DEVICE(0x1435, 0x0427)},	/* Inventel UR054G */
 	{USB_DEVICE(0x2001, 0x3704)},	/* DLink DWL-G122 rev A2 */
-	{USB_DEVICE(0x413c, 0x5513)},	/* Dell WLA3310 USB Wireless Adapter */
 	{USB_DEVICE(0x413c, 0x8102)},	/* Spinnaker DUT */
 	{USB_DEVICE(0x413c, 0x8104)},	/* Cohiba Proto board */
 	{}
diff --git a/trunk/drivers/net/wireless/rt2x00/rt2800usb.c b/trunk/drivers/net/wireless/rt2x00/rt2800usb.c
index 0f8b84b7224c..699161327d65 100644
--- a/trunk/drivers/net/wireless/rt2x00/rt2800usb.c
+++ b/trunk/drivers/net/wireless/rt2x00/rt2800usb.c
@@ -413,7 +413,7 @@ static void rt2800usb_write_tx_desc(struct rt2x00_dev *rt2x00dev,
 	 */
 	rt2x00_desc_read(txi, 0, &word);
 	rt2x00_set_field32(&word, TXINFO_W0_USB_DMA_TX_PKT_LEN,
-			   skb->len + TXWI_DESC_SIZE);
+			   skb->len - TXINFO_DESC_SIZE);
 	rt2x00_set_field32(&word, TXINFO_W0_WIV,
 			   !test_bit(ENTRY_TXD_ENCRYPT_IV, &txdesc->flags));
 	rt2x00_set_field32(&word, TXINFO_W0_QSEL, 2);
diff --git a/trunk/drivers/net/wireless/wl12xx/wl1251_sdio.c b/trunk/drivers/net/wireless/wl12xx/wl1251_sdio.c
index c561332e7009..d234285c2c81 100644
--- a/trunk/drivers/net/wireless/wl12xx/wl1251_sdio.c
+++ b/trunk/drivers/net/wireless/wl12xx/wl1251_sdio.c
@@ -259,7 +259,6 @@ static int wl1251_sdio_probe(struct sdio_func *func,
 	sdio_disable_func(func);
 release:
 	sdio_release_host(func);
-	wl1251_free_hw(wl);
 	return ret;
 }
 
diff --git a/trunk/drivers/ssb/pci.c b/trunk/drivers/ssb/pci.c
index 6dcda86be6eb..989e2752cc36 100644
--- a/trunk/drivers/ssb/pci.c
+++ b/trunk/drivers/ssb/pci.c
@@ -625,12 +625,9 @@ static int ssb_pci_sprom_get(struct ssb_bus *bus,
 		ssb_printk(KERN_ERR PFX "No SPROM available!\n");
 		return -ENODEV;
 	}
-	if (bus->chipco.dev) {	/* can be unavailible! */
-		bus->sprom_offset = (bus->chipco.dev->id.revision < 31) ?
-			SSB_SPROM_BASE1 : SSB_SPROM_BASE31;
-	} else {
-		bus->sprom_offset = SSB_SPROM_BASE1;
-	}
+
+	bus->sprom_offset = (bus->chipco.dev->id.revision < 31) ?
+		SSB_SPROM_BASE1 : SSB_SPROM_BASE31;
 
 	buf = kcalloc(SSB_SPROMSIZE_WORDS_R123, sizeof(u16), GFP_KERNEL);
 	if (!buf)
diff --git a/trunk/drivers/ssb/sprom.c b/trunk/drivers/ssb/sprom.c
index 4f7cc8d13277..007bc3a03486 100644
--- a/trunk/drivers/ssb/sprom.c
+++ b/trunk/drivers/ssb/sprom.c
@@ -185,7 +185,6 @@ bool ssb_is_sprom_available(struct ssb_bus *bus)
 	/* this routine differs from specs as we do not access SPROM directly
 	   on PCMCIA */
 	if (bus->bustype == SSB_BUSTYPE_PCI &&
-	    bus->chipco.dev &&	/* can be unavailible! */
 	    bus->chipco.dev->id.revision >= 31)
 		return bus->chipco.capabilities & SSB_CHIPCO_CAP_SPROM;
 
diff --git a/trunk/include/linux/skbuff.h b/trunk/include/linux/skbuff.h
index f89e7fd59a4c..7cdfb4d52847 100644
--- a/trunk/include/linux/skbuff.h
+++ b/trunk/include/linux/skbuff.h
@@ -380,10 +380,7 @@ struct sk_buff {
 	kmemcheck_bitfield_begin(flags2);
 	__u16			queue_mapping:16;
 #ifdef CONFIG_IPV6_NDISC_NODETYPE
-	__u8			ndisc_nodetype:2,
-				deliver_no_wcard:1;
-#else
-	__u8			deliver_no_wcard:1;
+	__u8			ndisc_nodetype:2;
 #endif
 	kmemcheck_bitfield_end(flags2);
 
@@ -504,7 +501,7 @@ static inline struct sk_buff *alloc_skb_fclone(unsigned int size,
 	return __alloc_skb(size, priority, 1, -1);
 }
 
-extern bool skb_recycle_check(struct sk_buff *skb, int skb_size);
+extern int skb_recycle_check(struct sk_buff *skb, int skb_size);
 
 extern struct sk_buff *skb_morph(struct sk_buff *dst, struct sk_buff *src);
 extern struct sk_buff *skb_clone(struct sk_buff *skb,
diff --git a/trunk/include/net/dst.h b/trunk/include/net/dst.h
index 81d1413a8701..612069beda73 100644
--- a/trunk/include/net/dst.h
+++ b/trunk/include/net/dst.h
@@ -250,11 +250,11 @@ static inline void skb_tunnel_rx(struct sk_buff *skb, struct net_device *dev)
  * Linux networking.  Thus, destinations are stackable.
  */
 
-static inline struct dst_entry *skb_dst_pop(struct sk_buff *skb)
+static inline struct dst_entry *dst_pop(struct dst_entry *dst)
 {
-	struct dst_entry *child = skb_dst(skb)->child;
+	struct dst_entry *child = dst_clone(dst->child);
 
-	skb_dst_drop(skb);
+	dst_release(dst);
 	return child;
 }
 
diff --git a/trunk/include/net/sock.h b/trunk/include/net/sock.h
index 731150d52799..ca241ea14875 100644
--- a/trunk/include/net/sock.h
+++ b/trunk/include/net/sock.h
@@ -1524,7 +1524,20 @@ extern void sk_stop_timer(struct sock *sk, struct timer_list* timer);
 
 extern int sock_queue_rcv_skb(struct sock *sk, struct sk_buff *skb);
 
-extern int sock_queue_err_skb(struct sock *sk, struct sk_buff *skb);
+static inline int sock_queue_err_skb(struct sock *sk, struct sk_buff *skb)
+{
+	/* Cast skb->rcvbuf to unsigned... It's pointless, but reduces
+	   number of warnings when compiling with -W --ANK
+	 */
+	if (atomic_read(&sk->sk_rmem_alloc) + skb->truesize >=
+	    (unsigned)sk->sk_rcvbuf)
+		return -ENOMEM;
+	skb_set_owner_r(skb, sk);
+	skb_queue_tail(&sk->sk_error_queue, skb);
+	if (!sock_flag(sk, SOCK_DEAD))
+		sk->sk_data_ready(sk, skb->len);
+	return 0;
+}
 
 /*
  *	Recover an error report and clear atomically
diff --git a/trunk/net/8021q/vlan_core.c b/trunk/net/8021q/vlan_core.c
index 50f58f5f1c34..bd537fc10254 100644
--- a/trunk/net/8021q/vlan_core.c
+++ b/trunk/net/8021q/vlan_core.c
@@ -12,7 +12,7 @@ int __vlan_hwaccel_rx(struct sk_buff *skb, struct vlan_group *grp,
 		return NET_RX_DROP;
 
 	if (skb_bond_should_drop(skb, ACCESS_ONCE(skb->dev->master)))
-		skb->deliver_no_wcard = 1;
+		goto drop;
 
 	skb->skb_iif = skb->dev->ifindex;
 	__vlan_hwaccel_put_tag(skb, vlan_tci);
@@ -84,7 +84,7 @@ vlan_gro_common(struct napi_struct *napi, struct vlan_group *grp,
 	struct sk_buff *p;
 
 	if (skb_bond_should_drop(skb, ACCESS_ONCE(skb->dev->master)))
-		skb->deliver_no_wcard = 1;
+		goto drop;
 
 	skb->skb_iif = skb->dev->ifindex;
 	__vlan_hwaccel_put_tag(skb, vlan_tci);
diff --git a/trunk/net/8021q/vlan_dev.c b/trunk/net/8021q/vlan_dev.c
index 529842677817..55be90826f5f 100644
--- a/trunk/net/8021q/vlan_dev.c
+++ b/trunk/net/8021q/vlan_dev.c
@@ -708,8 +708,7 @@ static int vlan_dev_init(struct net_device *dev)
 	netif_carrier_off(dev);
 
 	/* IFF_BROADCAST|IFF_MULTICAST; ??? */
-	dev->flags  = real_dev->flags & ~(IFF_UP | IFF_PROMISC | IFF_ALLMULTI |
-					  IFF_MASTER | IFF_SLAVE);
+	dev->flags  = real_dev->flags & ~(IFF_UP | IFF_PROMISC | IFF_ALLMULTI);
 	dev->iflink = real_dev->ifindex;
 	dev->state  = (real_dev->state & ((1<<__LINK_STATE_NOCARRIER) |
 					  (1<<__LINK_STATE_DORMANT))) |
diff --git a/trunk/net/caif/cfrfml.c b/trunk/net/caif/cfrfml.c
index fd27b172fb5d..cd2830fec935 100644
--- a/trunk/net/caif/cfrfml.c
+++ b/trunk/net/caif/cfrfml.c
@@ -83,7 +83,7 @@ static int cfrfml_transmit(struct cflayer *layr, struct cfpkt *pkt)
 	if (!cfsrvl_ready(service, &ret))
 		return ret;
 
-	if (cfpkt_getlen(pkt) > CAIF_MAX_PAYLOAD_SIZE) {
+	if (!cfpkt_getlen(pkt) > CAIF_MAX_PAYLOAD_SIZE) {
 		pr_err("CAIF: %s():Packet too large - size=%d\n",
 			__func__, cfpkt_getlen(pkt));
 		return -EOVERFLOW;
diff --git a/trunk/net/caif/cfserl.c b/trunk/net/caif/cfserl.c
index 965c5baace40..cb4325a3dc83 100644
--- a/trunk/net/caif/cfserl.c
+++ b/trunk/net/caif/cfserl.c
@@ -59,18 +59,16 @@ static int cfserl_receive(struct cflayer *l, struct cfpkt *newpkt)
 	u8 stx = CFSERL_STX;
 	int ret;
 	u16 expectlen = 0;
-
 	caif_assert(newpkt != NULL);
 	spin_lock(&layr->sync);
 
 	if (layr->incomplete_frm != NULL) {
+
 		layr->incomplete_frm =
 		    cfpkt_append(layr->incomplete_frm, newpkt, expectlen);
 		pkt = layr->incomplete_frm;
-		if (pkt == NULL) {
-			spin_unlock(&layr->sync);
+		if (pkt == NULL)
 			return -ENOMEM;
-		}
 	} else {
 		pkt = newpkt;
 	}
diff --git a/trunk/net/caif/cfveil.c b/trunk/net/caif/cfveil.c
index e04f7d964e83..0fd827f49491 100644
--- a/trunk/net/caif/cfveil.c
+++ b/trunk/net/caif/cfveil.c
@@ -84,7 +84,7 @@ static int cfvei_transmit(struct cflayer *layr, struct cfpkt *pkt)
 		return ret;
 	caif_assert(layr->dn != NULL);
 	caif_assert(layr->dn->transmit != NULL);
-	if (cfpkt_getlen(pkt) > CAIF_MAX_PAYLOAD_SIZE) {
+	if (!cfpkt_getlen(pkt) > CAIF_MAX_PAYLOAD_SIZE) {
 		pr_warning("CAIF: %s(): Packet too large - size=%d\n",
 			   __func__, cfpkt_getlen(pkt));
 		return -EOVERFLOW;
diff --git a/trunk/net/core/dev.c b/trunk/net/core/dev.c
index 2b3bf53bc687..1845b08c624e 100644
--- a/trunk/net/core/dev.c
+++ b/trunk/net/core/dev.c
@@ -2253,9 +2253,11 @@ static int get_rps_cpu(struct net_device *dev, struct sk_buff *skb,
 	if (skb_rx_queue_recorded(skb)) {
 		u16 index = skb_get_rx_queue(skb);
 		if (unlikely(index >= dev->num_rx_queues)) {
-			WARN_ONCE(dev->num_rx_queues > 1, "%s received packet "
-				"on queue %u, but number of RX queues is %u\n",
-				dev->name, index, dev->num_rx_queues);
+			if (net_ratelimit()) {
+				pr_warning("%s received packet on queue "
+					"%u, but number of RX queues is %u\n",
+					dev->name, index, dev->num_rx_queues);
+			}
 			goto done;
 		}
 		rxqueue = dev->_rx + index;
@@ -2793,7 +2795,7 @@ static int __netif_receive_skb(struct sk_buff *skb)
 	struct net_device *orig_dev;
 	struct net_device *master;
 	struct net_device *null_or_orig;
-	struct net_device *orig_or_bond;
+	struct net_device *null_or_bond;
 	int ret = NET_RX_DROP;
 	__be16 type;
 
@@ -2810,24 +2812,13 @@ static int __netif_receive_skb(struct sk_buff *skb)
 	if (!skb->skb_iif)
 		skb->skb_iif = skb->dev->ifindex;
 
-	/*
-	 * bonding note: skbs received on inactive slaves should only
-	 * be delivered to pkt handlers that are exact matches.  Also
-	 * the deliver_no_wcard flag will be set.  If packet handlers
-	 * are sensitive to duplicate packets these skbs will need to
-	 * be dropped at the handler.  The vlan accel path may have
-	 * already set the deliver_no_wcard flag.
-	 */
 	null_or_orig = NULL;
 	orig_dev = skb->dev;
 	master = ACCESS_ONCE(orig_dev->master);
-	if (skb->deliver_no_wcard)
-		null_or_orig = orig_dev;
-	else if (master) {
-		if (skb_bond_should_drop(skb, master)) {
-			skb->deliver_no_wcard = 1;
+	if (master) {
+		if (skb_bond_should_drop(skb, master))
 			null_or_orig = orig_dev; /* deliver only exact match */
-		} else
+		else
 			skb->dev = master;
 	}
 
@@ -2877,10 +2868,10 @@ static int __netif_receive_skb(struct sk_buff *skb)
 	 * device that may have registered for a specific ptype.  The
 	 * handler may have to adjust skb->dev and orig_dev.
 	 */
-	orig_or_bond = orig_dev;
+	null_or_bond = NULL;
 	if ((skb->dev->priv_flags & IFF_802_1Q_VLAN) &&
 	    (vlan_dev_real_dev(skb->dev)->priv_flags & IFF_BONDING)) {
-		orig_or_bond = vlan_dev_real_dev(skb->dev);
+		null_or_bond = vlan_dev_real_dev(skb->dev);
 	}
 
 	type = skb->protocol;
@@ -2888,7 +2879,7 @@ static int __netif_receive_skb(struct sk_buff *skb)
 			&ptype_base[ntohs(type) & PTYPE_HASH_MASK], list) {
 		if (ptype->type == type && (ptype->dev == null_or_orig ||
 		     ptype->dev == skb->dev || ptype->dev == orig_dev ||
-		     ptype->dev == orig_or_bond)) {
+		     ptype->dev == null_or_bond)) {
 			if (pt_prev)
 				ret = deliver_skb(skb, pt_prev, orig_dev);
 			pt_prev = ptype;
diff --git a/trunk/net/core/gen_estimator.c b/trunk/net/core/gen_estimator.c
index 785e5276a300..cf8e70392fe0 100644
--- a/trunk/net/core/gen_estimator.c
+++ b/trunk/net/core/gen_estimator.c
@@ -107,7 +107,6 @@ static DEFINE_RWLOCK(est_lock);
 
 /* Protects against soft lockup during large deletion */
 static struct rb_root est_root = RB_ROOT;
-static DEFINE_SPINLOCK(est_tree_lock);
 
 static void est_timer(unsigned long arg)
 {
@@ -202,6 +201,7 @@ struct gen_estimator *gen_find_node(const struct gnet_stats_basic_packed *bstats
  *
  * Returns 0 on success or a negative error code.
  *
+ * NOTE: Called under rtnl_mutex
  */
 int gen_new_estimator(struct gnet_stats_basic_packed *bstats,
 		      struct gnet_stats_rate_est *rate_est,
@@ -232,7 +232,6 @@ int gen_new_estimator(struct gnet_stats_basic_packed *bstats,
 	est->last_packets = bstats->packets;
 	est->avpps = rate_est->pps<<10;
 
-	spin_lock(&est_tree_lock);
 	if (!elist[idx].timer.function) {
 		INIT_LIST_HEAD(&elist[idx].list);
 		setup_timer(&elist[idx].timer, est_timer, idx);
@@ -243,7 +242,6 @@ int gen_new_estimator(struct gnet_stats_basic_packed *bstats,
 
 	list_add_rcu(&est->list, &elist[idx].list);
 	gen_add_node(est);
-	spin_unlock(&est_tree_lock);
 
 	return 0;
 }
@@ -263,13 +261,13 @@ static void __gen_kill_estimator(struct rcu_head *head)
  *
  * Removes the rate estimator specified by &bstats and &rate_est.
  *
+ * NOTE: Called under rtnl_mutex
  */
 void gen_kill_estimator(struct gnet_stats_basic_packed *bstats,
 			struct gnet_stats_rate_est *rate_est)
 {
 	struct gen_estimator *e;
 
-	spin_lock(&est_tree_lock);
 	while ((e = gen_find_node(bstats, rate_est))) {
 		rb_erase(&e->node, &est_root);
 
@@ -280,7 +278,6 @@ void gen_kill_estimator(struct gnet_stats_basic_packed *bstats,
 		list_del_rcu(&e->list);
 		call_rcu(&e->e_rcu, __gen_kill_estimator);
 	}
-	spin_unlock(&est_tree_lock);
 }
 EXPORT_SYMBOL(gen_kill_estimator);
 
@@ -315,14 +312,8 @@ EXPORT_SYMBOL(gen_replace_estimator);
 bool gen_estimator_active(const struct gnet_stats_basic_packed *bstats,
 			  const struct gnet_stats_rate_est *rate_est)
 {
-	bool res;
-
 	ASSERT_RTNL();
 
-	spin_lock(&est_tree_lock);
-	res = gen_find_node(bstats, rate_est) != NULL;
-	spin_unlock(&est_tree_lock);
-
-	return res;
+	return gen_find_node(bstats, rate_est) != NULL;
 }
 EXPORT_SYMBOL(gen_estimator_active);
diff --git a/trunk/net/core/pktgen.c b/trunk/net/core/pktgen.c
index 1dacd7ba8dbb..2ad68da418df 100644
--- a/trunk/net/core/pktgen.c
+++ b/trunk/net/core/pktgen.c
@@ -2170,7 +2170,7 @@ static void spin(struct pktgen_dev *pkt_dev, ktime_t spin_until)
 	end_time = ktime_now();
 
 	pkt_dev->idle_acc += ktime_to_ns(ktime_sub(end_time, start_time));
-	pkt_dev->next_tx = ktime_add_ns(spin_until, pkt_dev->delay);
+	pkt_dev->next_tx = ktime_add_ns(end_time, pkt_dev->delay);
 }
 
 static inline void set_pkt_overhead(struct pktgen_dev *pkt_dev)
diff --git a/trunk/net/core/skbuff.c b/trunk/net/core/skbuff.c
index 34432b4e96bb..f8abf68e3988 100644
--- a/trunk/net/core/skbuff.c
+++ b/trunk/net/core/skbuff.c
@@ -482,22 +482,22 @@ EXPORT_SYMBOL(consume_skb);
  *	reference count dropping and cleans up the skbuff as if it
  *	just came from __alloc_skb().
  */
-bool skb_recycle_check(struct sk_buff *skb, int skb_size)
+int skb_recycle_check(struct sk_buff *skb, int skb_size)
 {
 	struct skb_shared_info *shinfo;
 
 	if (irqs_disabled())
-		return false;
+		return 0;
 
 	if (skb_is_nonlinear(skb) || skb->fclone != SKB_FCLONE_UNAVAILABLE)
-		return false;
+		return 0;
 
 	skb_size = SKB_DATA_ALIGN(skb_size + NET_SKB_PAD);
 	if (skb_end_pointer(skb) - skb->head < skb_size)
-		return false;
+		return 0;
 
 	if (skb_shared(skb) || skb_cloned(skb))
-		return false;
+		return 0;
 
 	skb_release_head_state(skb);
 
@@ -509,7 +509,7 @@ bool skb_recycle_check(struct sk_buff *skb, int skb_size)
 	skb->data = skb->head + NET_SKB_PAD;
 	skb_reset_tail_pointer(skb);
 
-	return true;
+	return 1;
 }
 EXPORT_SYMBOL(skb_recycle_check);
 
@@ -532,7 +532,6 @@ static void __copy_skb_header(struct sk_buff *new, const struct sk_buff *old)
 	new->ip_summed		= old->ip_summed;
 	skb_copy_queue_mapping(new, old);
 	new->priority		= old->priority;
-	new->deliver_no_wcard	= old->deliver_no_wcard;
 #if defined(CONFIG_IP_VS) || defined(CONFIG_IP_VS_MODULE)
 	new->ipvs_property	= old->ipvs_property;
 #endif
@@ -570,6 +569,7 @@ static struct sk_buff *__skb_clone(struct sk_buff *n, struct sk_buff *skb)
 	C(len);
 	C(data_len);
 	C(mac_len);
+	C(rxhash);
 	n->hdr_len = skb->nohdr ? skb_headroom(skb) : skb->hdr_len;
 	n->cloned = 1;
 	n->nohdr = 0;
@@ -2965,34 +2965,6 @@ int skb_cow_data(struct sk_buff *skb, int tailbits, struct sk_buff **trailer)
 }
 EXPORT_SYMBOL_GPL(skb_cow_data);
 
-static void sock_rmem_free(struct sk_buff *skb)
-{
-	struct sock *sk = skb->sk;
-
-	atomic_sub(skb->truesize, &sk->sk_rmem_alloc);
-}
-
-/*
- * Note: We dont mem charge error packets (no sk_forward_alloc changes)
- */
-int sock_queue_err_skb(struct sock *sk, struct sk_buff *skb)
-{
-	if (atomic_read(&sk->sk_rmem_alloc) + skb->truesize >=
-	    (unsigned)sk->sk_rcvbuf)
-		return -ENOMEM;
-
-	skb_orphan(skb);
-	skb->sk = sk;
-	skb->destructor = sock_rmem_free;
-	atomic_add(skb->truesize, &sk->sk_rmem_alloc);
-
-	skb_queue_tail(&sk->sk_error_queue, skb);
-	if (!sock_flag(sk, SOCK_DEAD))
-		sk->sk_data_ready(sk, skb->len);
-	return 0;
-}
-EXPORT_SYMBOL(sock_queue_err_skb);
-
 void skb_tstamp_tx(struct sk_buff *orig_skb,
 		struct skb_shared_hwtstamps *hwtstamps)
 {
@@ -3024,9 +2996,7 @@ void skb_tstamp_tx(struct sk_buff *orig_skb,
 	memset(serr, 0, sizeof(*serr));
 	serr->ee.ee_errno = ENOMSG;
 	serr->ee.ee_origin = SO_EE_ORIGIN_TIMESTAMPING;
-
 	err = sock_queue_err_skb(sk, skb);
-
 	if (err)
 		kfree_skb(skb);
 }
diff --git a/trunk/net/ipv4/Kconfig b/trunk/net/ipv4/Kconfig
index 7c3a7d191249..8e3a1fd938ab 100644
--- a/trunk/net/ipv4/Kconfig
+++ b/trunk/net/ipv4/Kconfig
@@ -303,7 +303,7 @@ config ARPD
 	  If unsure, say N.
 
 config SYN_COOKIES
-	bool "IP: TCP syncookie support"
+	bool "IP: TCP syncookie support (disabled per default)"
 	---help---
 	  Normal TCP/IP networking is open to an attack known as "SYN
 	  flooding". This denial-of-service attack prevents legitimate remote
@@ -328,13 +328,13 @@ config SYN_COOKIES
 	  server is really overloaded. If this happens frequently better turn
 	  them off.
 
-	  If you say Y here, you can disable SYN cookies at run time by
-	  saying Y to "/proc file system support" and
+	  If you say Y here, note that SYN cookies aren't enabled by default;
+	  you can enable them by saying Y to "/proc file system support" and
 	  "Sysctl support" below and executing the command
 
-	  echo 0 > /proc/sys/net/ipv4/tcp_syncookies
+	  echo 1 >/proc/sys/net/ipv4/tcp_syncookies
 
-	  after the /proc file system has been mounted.
+	  at boot time after the /proc file system has been mounted.
 
 	  If unsure, say N.
 
diff --git a/trunk/net/ipv4/ipmr.c b/trunk/net/ipv4/ipmr.c
index 757f25eb9b4b..856123fe32f9 100644
--- a/trunk/net/ipv4/ipmr.c
+++ b/trunk/net/ipv4/ipmr.c
@@ -267,10 +267,8 @@ static void __net_exit ipmr_rules_exit(struct net *net)
 {
 	struct mr_table *mrt, *next;
 
-	list_for_each_entry_safe(mrt, next, &net->ipv4.mr_tables, list) {
-		list_del(&mrt->list);
+	list_for_each_entry_safe(mrt, next, &net->ipv4.mr_tables, list)
 		kfree(mrt);
-	}
 	fib_rules_unregister(net->ipv4.mr_rules_ops);
 }
 #else
diff --git a/trunk/net/ipv4/syncookies.c b/trunk/net/ipv4/syncookies.c
index 9f6b22206c52..5c24db4a3c91 100644
--- a/trunk/net/ipv4/syncookies.c
+++ b/trunk/net/ipv4/syncookies.c
@@ -347,7 +347,7 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
 					       { .sport = th->dest,
 						 .dport = th->source } } };
 		security_req_classify_flow(req, &fl);
-		if (ip_route_output_key(sock_net(sk), &rt, &fl)) {
+		if (ip_route_output_key(&init_net, &rt, &fl)) {
 			reqsk_free(req);
 			goto out;
 		}
diff --git a/trunk/net/ipv4/tcp_hybla.c b/trunk/net/ipv4/tcp_hybla.c
index 377bc9349371..c209e054a634 100644
--- a/trunk/net/ipv4/tcp_hybla.c
+++ b/trunk/net/ipv4/tcp_hybla.c
@@ -126,8 +126,8 @@ static void hybla_cong_avoid(struct sock *sk, u32 ack, u32 in_flight)
 		 * calculate 2^fract in a <<7 value.
 		 */
 		is_slowstart = 1;
-		increment = ((1 << min(ca->rho, 16U)) *
-			hybla_fraction(rho_fractions)) - 128;
+		increment = ((1 << ca->rho) * hybla_fraction(rho_fractions))
+			- 128;
 	} else {
 		/*
 		 * congestion avoidance
diff --git a/trunk/net/ipv4/tcp_input.c b/trunk/net/ipv4/tcp_input.c
index 548d575e6cc6..3e6dafcb1071 100644
--- a/trunk/net/ipv4/tcp_input.c
+++ b/trunk/net/ipv4/tcp_input.c
@@ -2639,7 +2639,7 @@ static void DBGUNDO(struct sock *sk, const char *msg)
 	if (sk->sk_family == AF_INET) {
 		printk(KERN_DEBUG "Undo %s %pI4/%u c%u l%u ss%u/%u p%u\n",
 		       msg,
-		       &inet->inet_daddr, ntohs(inet->inet_dport),
+		       &inet->daddr, ntohs(inet->dport),
 		       tp->snd_cwnd, tcp_left_out(tp),
 		       tp->snd_ssthresh, tp->prior_ssthresh,
 		       tp->packets_out);
@@ -2649,7 +2649,7 @@ static void DBGUNDO(struct sock *sk, const char *msg)
 		struct ipv6_pinfo *np = inet6_sk(sk);
 		printk(KERN_DEBUG "Undo %s %pI6/%u c%u l%u ss%u/%u p%u\n",
 		       msg,
-		       &np->daddr, ntohs(inet->inet_dport),
+		       &np->daddr, ntohs(inet->dport),
 		       tp->snd_cwnd, tcp_left_out(tp),
 		       tp->snd_ssthresh, tp->prior_ssthresh,
 		       tp->packets_out);
diff --git a/trunk/net/ipv4/tcp_ipv4.c b/trunk/net/ipv4/tcp_ipv4.c
index fe193e53af44..202cf09c4cd4 100644
--- a/trunk/net/ipv4/tcp_ipv4.c
+++ b/trunk/net/ipv4/tcp_ipv4.c
@@ -1555,7 +1555,6 @@ int tcp_v4_do_rcv(struct sock *sk, struct sk_buff *skb)
 #endif
 
 	if (sk->sk_state == TCP_ESTABLISHED) { /* Fast path */
-		sock_rps_save_rxhash(sk, skb->rxhash);
 		TCP_CHECK_TIMER(sk);
 		if (tcp_rcv_established(sk, skb, tcp_hdr(skb), skb->len)) {
 			rsk = sk;
@@ -1580,9 +1579,7 @@ int tcp_v4_do_rcv(struct sock *sk, struct sk_buff *skb)
 			}
 			return 0;
 		}
-	} else
-		sock_rps_save_rxhash(sk, skb->rxhash);
-
+	}
 
 	TCP_CHECK_TIMER(sk);
 	if (tcp_rcv_state_process(sk, skb, tcp_hdr(skb), skb->len)) {
@@ -1675,6 +1672,8 @@ int tcp_v4_rcv(struct sk_buff *skb)
 
 	skb->dev = NULL;
 
+	sock_rps_save_rxhash(sk, skb->rxhash);
+
 	bh_lock_sock_nested(sk);
 	ret = 0;
 	if (!sock_owned_by_user(sk)) {
diff --git a/trunk/net/ipv4/udp.c b/trunk/net/ipv4/udp.c
index eec4ff456e33..58585748bdac 100644
--- a/trunk/net/ipv4/udp.c
+++ b/trunk/net/ipv4/udp.c
@@ -633,9 +633,9 @@ void __udp4_lib_err(struct sk_buff *skb, u32 info, struct udp_table *udptable)
 	if (!inet->recverr) {
 		if (!harderr || sk->sk_state != TCP_ESTABLISHED)
 			goto out;
-	} else
+	} else {
 		ip_icmp_error(sk, skb, err, uh->dest, info, (u8 *)(uh+1));
-
+	}
 	sk->sk_err = err;
 	sk->sk_error_report(sk);
 out:
diff --git a/trunk/net/ipv6/icmp.c b/trunk/net/ipv6/icmp.c
index 03e62f94ff8e..ce7992982557 100644
--- a/trunk/net/ipv6/icmp.c
+++ b/trunk/net/ipv6/icmp.c
@@ -483,7 +483,7 @@ void icmpv6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info)
 			      np->tclass, NULL, &fl, (struct rt6_info*)dst,
 			      MSG_DONTWAIT, np->dontfrag);
 	if (err) {
-		ICMP6_INC_STATS_BH(net, idev, ICMP6_MIB_OUTERRORS);
+		ICMP6_INC_STATS_BH(net, idev, ICMP6_MIB_OUTMSGS);
 		ip6_flush_pending_frames(sk);
 		goto out_put;
 	}
@@ -565,7 +565,7 @@ static void icmpv6_echo_reply(struct sk_buff *skb)
 				np->dontfrag);
 
 	if (err) {
-		ICMP6_INC_STATS_BH(net, idev, ICMP6_MIB_OUTERRORS);
+		ICMP6_INC_STATS_BH(net, idev, ICMP6_MIB_OUTMSGS);
 		ip6_flush_pending_frames(sk);
 		goto out_put;
 	}
diff --git a/trunk/net/ipv6/ip6mr.c b/trunk/net/ipv6/ip6mr.c
index 66078dad7fe8..073071f2b75b 100644
--- a/trunk/net/ipv6/ip6mr.c
+++ b/trunk/net/ipv6/ip6mr.c
@@ -120,7 +120,7 @@ static void mroute_clean_tables(struct mr6_table *mrt);
 static void ipmr_expire_process(unsigned long arg);
 
 #ifdef CONFIG_IPV6_MROUTE_MULTIPLE_TABLES
-#define ip6mr_for_each_table(mrt, net) \
+#define ip6mr_for_each_table(mrt, met) \
 	list_for_each_entry_rcu(mrt, &net->ipv6.mr6_tables, list)
 
 static struct mr6_table *ip6mr_get_table(struct net *net, u32 id)
@@ -254,10 +254,8 @@ static void __net_exit ip6mr_rules_exit(struct net *net)
 {
 	struct mr6_table *mrt, *next;
 
-	list_for_each_entry_safe(mrt, next, &net->ipv6.mr6_tables, list) {
-		list_del(&mrt->list);
+	list_for_each_entry_safe(mrt, next, &net->ipv6.mr6_tables, list)
 		ip6mr_free_table(mrt);
-	}
 	fib_rules_unregister(net->ipv6.mr6_rules_ops);
 }
 #else
diff --git a/trunk/net/ipv6/mcast.c b/trunk/net/ipv6/mcast.c
index ab1622d7d409..59f1881968c7 100644
--- a/trunk/net/ipv6/mcast.c
+++ b/trunk/net/ipv6/mcast.c
@@ -1356,10 +1356,7 @@ static struct sk_buff *mld_newpack(struct net_device *dev, int size)
 		     IPV6_TLV_PADN, 0 };
 
 	/* we assume size > sizeof(ra) here */
-	size += LL_ALLOCATED_SPACE(dev);
-	/* limit our allocations to order-0 page */
-	size = min_t(int, size, SKB_MAX_ORDER(0, 0));
-	skb = sock_alloc_send_skb(sk, size, 1, &err);
+	skb = sock_alloc_send_skb(sk, size + LL_ALLOCATED_SPACE(dev), 1, &err);
 
 	if (!skb)
 		return NULL;
diff --git a/trunk/net/ipv6/route.c b/trunk/net/ipv6/route.c
index 252d76199c41..294cbe8b0725 100644
--- a/trunk/net/ipv6/route.c
+++ b/trunk/net/ipv6/route.c
@@ -814,7 +814,7 @@ struct dst_entry * ip6_route_output(struct net *net, struct sock *sk,
 {
 	int flags = 0;
 
-	if ((sk && sk->sk_bound_dev_if) || rt6_need_strict(&fl->fl6_dst))
+	if (fl->oif || rt6_need_strict(&fl->fl6_dst))
 		flags |= RT6_LOOKUP_F_IFACE;
 
 	if (!ipv6_addr_any(&fl->fl6_src))
diff --git a/trunk/net/mac80211/agg-tx.c b/trunk/net/mac80211/agg-tx.c
index 98258b7341e3..c163d0a149f4 100644
--- a/trunk/net/mac80211/agg-tx.c
+++ b/trunk/net/mac80211/agg-tx.c
@@ -332,16 +332,14 @@ int ieee80211_start_tx_ba_session(struct ieee80211_sta *pubsta, u16 tid)
 		IEEE80211_QUEUE_STOP_REASON_AGGREGATION);
 
 	spin_unlock(&local->ampdu_lock);
+	spin_unlock_bh(&sta->lock);
 
-	/* prepare tid data */
+	/* send an addBA request */
 	sta->ampdu_mlme.dialog_token_allocator++;
 	sta->ampdu_mlme.tid_tx[tid]->dialog_token =
 			sta->ampdu_mlme.dialog_token_allocator;
 	sta->ampdu_mlme.tid_tx[tid]->ssn = start_seq_num;
 
-	spin_unlock_bh(&sta->lock);
-
-	/* send AddBA request */
 	ieee80211_send_addba_request(sdata, pubsta->addr, tid,
 			 sta->ampdu_mlme.tid_tx[tid]->dialog_token,
 			 sta->ampdu_mlme.tid_tx[tid]->ssn,
diff --git a/trunk/net/mac80211/chan.c b/trunk/net/mac80211/chan.c
index 32be11e4c4d9..5d218c530a4e 100644
--- a/trunk/net/mac80211/chan.c
+++ b/trunk/net/mac80211/chan.c
@@ -5,7 +5,7 @@
 #include <linux/nl80211.h>
 #include "ieee80211_i.h"
 
-static enum ieee80211_chan_mode
+enum ieee80211_chan_mode
 __ieee80211_get_channel_mode(struct ieee80211_local *local,
 			     struct ieee80211_sub_if_data *ignore)
 {
diff --git a/trunk/net/mac80211/driver-ops.h b/trunk/net/mac80211/driver-ops.h
index 9c1da0809160..4f2271316650 100644
--- a/trunk/net/mac80211/driver-ops.h
+++ b/trunk/net/mac80211/driver-ops.h
@@ -349,7 +349,7 @@ static inline int drv_get_survey(struct ieee80211_local *local, int idx,
 				struct survey_info *survey)
 {
 	int ret = -EOPNOTSUPP;
-	if (local->ops->get_survey)
+	if (local->ops->conf_tx)
 		ret = local->ops->get_survey(&local->hw, idx, survey);
 	/* trace_drv_get_survey(local, idx, survey, ret); */
 	return ret;
diff --git a/trunk/net/mac80211/mlme.c b/trunk/net/mac80211/mlme.c
index f803f8b72a93..0839c4e8fd2e 100644
--- a/trunk/net/mac80211/mlme.c
+++ b/trunk/net/mac80211/mlme.c
@@ -1692,52 +1692,14 @@ static void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
 			rma = ieee80211_rx_mgmt_disassoc(sdata, mgmt, skb->len);
 			break;
 		case IEEE80211_STYPE_ACTION:
-			switch (mgmt->u.action.category) {
-			case WLAN_CATEGORY_BACK: {
-				struct ieee80211_local *local = sdata->local;
-				int len = skb->len;
-				struct sta_info *sta;
-
-				rcu_read_lock();
-				sta = sta_info_get(sdata, mgmt->sa);
-				if (!sta) {
-					rcu_read_unlock();
-					break;
-				}
-
-				local_bh_disable();
-
-				switch (mgmt->u.action.u.addba_req.action_code) {
-				case WLAN_ACTION_ADDBA_REQ:
-					if (len < (IEEE80211_MIN_ACTION_SIZE +
-						   sizeof(mgmt->u.action.u.addba_req)))
-						break;
-					ieee80211_process_addba_request(local, sta, mgmt, len);
-					break;
-				case WLAN_ACTION_ADDBA_RESP:
-					if (len < (IEEE80211_MIN_ACTION_SIZE +
-						   sizeof(mgmt->u.action.u.addba_resp)))
-						break;
-					ieee80211_process_addba_resp(local, sta, mgmt, len);
-					break;
-				case WLAN_ACTION_DELBA:
-					if (len < (IEEE80211_MIN_ACTION_SIZE +
-						   sizeof(mgmt->u.action.u.delba)))
-						break;
-					ieee80211_process_delba(sdata, sta, mgmt, len);
-					break;
-				}
-				local_bh_enable();
-				rcu_read_unlock();
+			if (mgmt->u.action.category != WLAN_CATEGORY_SPECTRUM_MGMT)
 				break;
-				}
-			case WLAN_CATEGORY_SPECTRUM_MGMT:
-				ieee80211_sta_process_chanswitch(sdata,
-						&mgmt->u.action.u.chan_switch.sw_elem,
-						(void *)ifmgd->associated->priv,
-						rx_status->mactime);
-				break;
-			}
+
+			ieee80211_sta_process_chanswitch(sdata,
+					&mgmt->u.action.u.chan_switch.sw_elem,
+					(void *)ifmgd->associated->priv,
+					rx_status->mactime);
+			break;
 		}
 		mutex_unlock(&ifmgd->mtx);
 
@@ -1760,45 +1722,9 @@ static void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
 	mutex_unlock(&ifmgd->mtx);
 
 	if (skb->len >= 24 + 2 /* mgmt + deauth reason */ &&
-	    (fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_DEAUTH) {
-		struct ieee80211_local *local = sdata->local;
-		struct ieee80211_work *wk;
-
-		mutex_lock(&local->work_mtx);
-		list_for_each_entry(wk, &local->work_list, list) {
-			if (wk->sdata != sdata)
-				continue;
-
-			if (wk->type != IEEE80211_WORK_ASSOC)
-				continue;
-
-			if (memcmp(mgmt->bssid, wk->filter_ta, ETH_ALEN))
-				continue;
-			if (memcmp(mgmt->sa, wk->filter_ta, ETH_ALEN))
-				continue;
-
-			/*
-			 * Printing the message only here means we can't
-			 * spuriously print it, but it also means that it
-			 * won't be printed when the frame comes in before
-			 * we even tried to associate or in similar cases.
-			 *
-			 * Ultimately, I suspect cfg80211 should print the
-			 * messages instead.
-			 */
-			printk(KERN_DEBUG
-			       "%s: deauthenticated from %pM (Reason: %u)\n",
-			       sdata->name, mgmt->bssid,
-			       le16_to_cpu(mgmt->u.deauth.reason_code));
-
-			list_del_rcu(&wk->list);
-			free_work(wk);
-			break;
-		}
-		mutex_unlock(&local->work_mtx);
-
+	    (fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_DEAUTH)
 		cfg80211_send_deauth(sdata->dev, (u8 *)mgmt, skb->len);
-	}
+
  out:
 	kfree_skb(skb);
 }
diff --git a/trunk/net/mac80211/rx.c b/trunk/net/mac80211/rx.c
index be9abc2e6348..6e2a7bcd8cb8 100644
--- a/trunk/net/mac80211/rx.c
+++ b/trunk/net/mac80211/rx.c
@@ -1818,26 +1818,17 @@ ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx, struct sk_buff_head *frames)
 		return RX_CONTINUE;
 
 	if (ieee80211_is_back_req(bar->frame_control)) {
-		struct {
-			__le16 control, start_seq_num;
-		} __packed bar_data;
-
 		if (!rx->sta)
 			return RX_DROP_MONITOR;
-
-		if (skb_copy_bits(skb, offsetof(struct ieee80211_bar, control),
-				  &bar_data, sizeof(bar_data)))
-			return RX_DROP_MONITOR;
-
 		spin_lock(&rx->sta->lock);
-		tid = le16_to_cpu(bar_data.control) >> 12;
+		tid = le16_to_cpu(bar->control) >> 12;
 		if (!rx->sta->ampdu_mlme.tid_active_rx[tid]) {
 			spin_unlock(&rx->sta->lock);
 			return RX_DROP_MONITOR;
 		}
 		tid_agg_rx = rx->sta->ampdu_mlme.tid_rx[tid];
 
-		start_seq_num = le16_to_cpu(bar_data.start_seq_num) >> 4;
+		start_seq_num = le16_to_cpu(bar->start_seq_num) >> 4;
 
 		/* reset session timer */
 		if (tid_agg_rx->timeout)
@@ -1944,9 +1935,6 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
 		if (len < IEEE80211_MIN_ACTION_SIZE + 1)
 			break;
 
-		if (sdata->vif.type == NL80211_IFTYPE_STATION)
-			return ieee80211_sta_rx_mgmt(sdata, rx->skb);
-
 		switch (mgmt->u.action.u.addba_req.action_code) {
 		case WLAN_ACTION_ADDBA_REQ:
 			if (len < (IEEE80211_MIN_ACTION_SIZE +
diff --git a/trunk/net/netfilter/ipvs/ip_vs_conn.c b/trunk/net/netfilter/ipvs/ip_vs_conn.c
index d8f7e8ef67b4..ff04e9edbed6 100644
--- a/trunk/net/netfilter/ipvs/ip_vs_conn.c
+++ b/trunk/net/netfilter/ipvs/ip_vs_conn.c
@@ -162,6 +162,7 @@ static inline int ip_vs_conn_hash(struct ip_vs_conn *cp)
 	hash = ip_vs_conn_hashkey(cp->af, cp->protocol, &cp->caddr, cp->cport);
 
 	ct_write_lock(hash);
+	spin_lock(&cp->lock);
 
 	if (!(cp->flags & IP_VS_CONN_F_HASHED)) {
 		list_add(&cp->c_list, &ip_vs_conn_tab[hash]);
@@ -174,6 +175,7 @@ static inline int ip_vs_conn_hash(struct ip_vs_conn *cp)
 		ret = 0;
 	}
 
+	spin_unlock(&cp->lock);
 	ct_write_unlock(hash);
 
 	return ret;
@@ -193,6 +195,7 @@ static inline int ip_vs_conn_unhash(struct ip_vs_conn *cp)
 	hash = ip_vs_conn_hashkey(cp->af, cp->protocol, &cp->caddr, cp->cport);
 
 	ct_write_lock(hash);
+	spin_lock(&cp->lock);
 
 	if (cp->flags & IP_VS_CONN_F_HASHED) {
 		list_del(&cp->c_list);
@@ -202,6 +205,7 @@ static inline int ip_vs_conn_unhash(struct ip_vs_conn *cp)
 	} else
 		ret = 0;
 
+	spin_unlock(&cp->lock);
 	ct_write_unlock(hash);
 
 	return ret;
diff --git a/trunk/net/phonet/pep.c b/trunk/net/phonet/pep.c
index 94d72e85a475..7b048a35ca58 100644
--- a/trunk/net/phonet/pep.c
+++ b/trunk/net/phonet/pep.c
@@ -1045,12 +1045,12 @@ static void pep_sock_unhash(struct sock *sk)
 	lock_sock(sk);
 	if ((1 << sk->sk_state) & ~(TCPF_CLOSE|TCPF_LISTEN)) {
 		skparent = pn->listener;
+		sk_del_node_init(sk);
 		release_sock(sk);
 
-		pn = pep_sk(skparent);
-		lock_sock(skparent);
-		sk_del_node_init(sk);
 		sk = skparent;
+		pn = pep_sk(skparent);
+		lock_sock(sk);
 	}
 	/* Unhash a listening sock only when it is closed
 	 * and all of its active connected pipes are closed. */
diff --git a/trunk/net/rds/ib_cm.c b/trunk/net/rds/ib_cm.c
index f68832798db2..10ed0d55f759 100644
--- a/trunk/net/rds/ib_cm.c
+++ b/trunk/net/rds/ib_cm.c
@@ -475,7 +475,6 @@ int rds_ib_cm_handle_connect(struct rdma_cm_id *cm_id,
 	err = rds_ib_setup_qp(conn);
 	if (err) {
 		rds_ib_conn_error(conn, "rds_ib_setup_qp failed (%d)\n", err);
-		mutex_unlock(&conn->c_cm_lock);
 		goto out;
 	}
 
diff --git a/trunk/net/rds/iw_cm.c b/trunk/net/rds/iw_cm.c
index b5dd6ac39be8..a9d951b4fbae 100644
--- a/trunk/net/rds/iw_cm.c
+++ b/trunk/net/rds/iw_cm.c
@@ -452,7 +452,6 @@ int rds_iw_cm_handle_connect(struct rdma_cm_id *cm_id,
 	err = rds_iw_setup_qp(conn);
 	if (err) {
 		rds_iw_conn_error(conn, "rds_iw_setup_qp failed (%d)\n", err);
-		mutex_unlock(&conn->c_cm_lock);
 		goto out;
 	}
 
diff --git a/trunk/net/sched/act_nat.c b/trunk/net/sched/act_nat.c
index 570949417f38..d885ba311564 100644
--- a/trunk/net/sched/act_nat.c
+++ b/trunk/net/sched/act_nat.c
@@ -159,9 +159,6 @@ static int tcf_nat(struct sk_buff *skb, struct tc_action *a,
 			iph->daddr = new_addr;
 
 		csum_replace4(&iph->check, addr, new_addr);
-	} else if ((iph->frag_off & htons(IP_OFFSET)) ||
-		   iph->protocol != IPPROTO_ICMP) {
-		goto out;
 	}
 
 	ihl = iph->ihl * 4;
@@ -250,7 +247,6 @@ static int tcf_nat(struct sk_buff *skb, struct tc_action *a,
 		break;
 	}
 
-out:
 	return action;
 
 drop:
diff --git a/trunk/net/sched/act_pedit.c b/trunk/net/sched/act_pedit.c
index 50e3d945e1f4..fdbd0b7bd840 100644
--- a/trunk/net/sched/act_pedit.c
+++ b/trunk/net/sched/act_pedit.c
@@ -125,7 +125,7 @@ static int tcf_pedit(struct sk_buff *skb, struct tc_action *a,
 {
 	struct tcf_pedit *p = a->priv;
 	int i, munged = 0;
-	unsigned int off;
+	u8 *pptr;
 
 	if (!(skb->tc_verd & TC_OK2MUNGE)) {
 		/* should we set skb->cloned? */
@@ -134,7 +134,7 @@ static int tcf_pedit(struct sk_buff *skb, struct tc_action *a,
 		}
 	}
 
-	off = skb_network_offset(skb);
+	pptr = skb_network_header(skb);
 
 	spin_lock(&p->tcf_lock);
 
@@ -144,17 +144,17 @@ static int tcf_pedit(struct sk_buff *skb, struct tc_action *a,
 		struct tc_pedit_key *tkey = p->tcfp_keys;
 
 		for (i = p->tcfp_nkeys; i > 0; i--, tkey++) {
-			u32 *ptr, _data;
+			u32 *ptr;
 			int offset = tkey->off;
 
 			if (tkey->offmask) {
-				char *d, _d;
-
-				d = skb_header_pointer(skb, off + tkey->at, 1,
-						       &_d);
-				if (!d)
+				if (skb->len > tkey->at) {
+					 char *j = pptr + tkey->at;
+					 offset += ((*j & tkey->offmask) >>
+						   tkey->shift);
+				} else {
 					goto bad;
-				offset += (*d & tkey->offmask) >> tkey->shift;
+				}
 			}
 
 			if (offset % 4) {
@@ -169,13 +169,9 @@ static int tcf_pedit(struct sk_buff *skb, struct tc_action *a,
 				goto bad;
 			}
 
-			ptr = skb_header_pointer(skb, off + offset, 4, &_data);
-			if (!ptr)
-				goto bad;
+			ptr = (u32 *)(pptr+offset);
 			/* just do it, baby */
 			*ptr = ((*ptr & tkey->mask) ^ tkey->val);
-			if (ptr == &_data)
-				skb_store_bits(skb, off + offset, ptr, 4);
 			munged++;
 		}
 
diff --git a/trunk/net/sched/cls_u32.c b/trunk/net/sched/cls_u32.c
index 4f522143811e..96275422c619 100644
--- a/trunk/net/sched/cls_u32.c
+++ b/trunk/net/sched/cls_u32.c
@@ -98,11 +98,11 @@ static int u32_classify(struct sk_buff *skb, struct tcf_proto *tp, struct tcf_re
 {
 	struct {
 		struct tc_u_knode *knode;
-		unsigned int	  off;
+		u8		  *ptr;
 	} stack[TC_U32_MAXDEPTH];
 
 	struct tc_u_hnode *ht = (struct tc_u_hnode*)tp->root;
-	unsigned int off = skb_network_offset(skb);
+	u8 *ptr = skb_network_header(skb);
 	struct tc_u_knode *n;
 	int sdepth = 0;
 	int off2 = 0;
@@ -134,14 +134,8 @@ static int u32_classify(struct sk_buff *skb, struct tcf_proto *tp, struct tcf_re
 #endif
 
 		for (i = n->sel.nkeys; i>0; i--, key++) {
-			unsigned int toff;
-			__be32 *data, _data;
-
-			toff = off + key->off + (off2 & key->offmask);
-			data = skb_header_pointer(skb, toff, 4, &_data);
-			if (!data)
-				goto out;
-			if ((*data ^ key->val) & key->mask) {
+
+			if ((*(__be32*)(ptr+key->off+(off2&key->offmask))^key->val)&key->mask) {
 				n = n->next;
 				goto next_knode;
 			}
@@ -180,45 +174,29 @@ static int u32_classify(struct sk_buff *skb, struct tcf_proto *tp, struct tcf_re
 		if (sdepth >= TC_U32_MAXDEPTH)
 			goto deadloop;
 		stack[sdepth].knode = n;
-		stack[sdepth].off = off;
+		stack[sdepth].ptr = ptr;
 		sdepth++;
 
 		ht = n->ht_down;
 		sel = 0;
-		if (ht->divisor) {
-			__be32 *data, _data;
-
-			data = skb_header_pointer(skb, off + n->sel.hoff, 4,
-						  &_data);
-			if (!data)
-				goto out;
-			sel = ht->divisor & u32_hash_fold(*data, &n->sel,
-							  n->fshift);
-		}
+		if (ht->divisor)
+			sel = ht->divisor&u32_hash_fold(*(__be32*)(ptr+n->sel.hoff), &n->sel,n->fshift);
+
 		if (!(n->sel.flags&(TC_U32_VAROFFSET|TC_U32_OFFSET|TC_U32_EAT)))
 			goto next_ht;
 
 		if (n->sel.flags&(TC_U32_OFFSET|TC_U32_VAROFFSET)) {
 			off2 = n->sel.off + 3;
-			if (n->sel.flags & TC_U32_VAROFFSET) {
-				__be16 *data, _data;
-
-				data = skb_header_pointer(skb,
-							  off + n->sel.offoff,
-							  2, &_data);
-				if (!data)
-					goto out;
-				off2 += ntohs(n->sel.offmask & *data) >>
-					n->sel.offshift;
-			}
+			if (n->sel.flags&TC_U32_VAROFFSET)
+				off2 += ntohs(n->sel.offmask & *(__be16*)(ptr+n->sel.offoff)) >>n->sel.offshift;
 			off2 &= ~3;
 		}
 		if (n->sel.flags&TC_U32_EAT) {
-			off += off2;
+			ptr += off2;
 			off2 = 0;
 		}
 
-		if (off < skb->len)
+		if (ptr < skb_tail_pointer(skb))
 			goto next_ht;
 	}
 
@@ -226,10 +204,9 @@ static int u32_classify(struct sk_buff *skb, struct tcf_proto *tp, struct tcf_re
 	if (sdepth--) {
 		n = stack[sdepth].knode;
 		ht = n->ht_up;
-		off = stack[sdepth].off;
+		ptr = stack[sdepth].ptr;
 		goto check_terminal;
 	}
-out:
 	return -1;
 
 deadloop:
diff --git a/trunk/net/xfrm/xfrm_output.c b/trunk/net/xfrm/xfrm_output.c
index a3cca0a94346..6a329158bdfa 100644
--- a/trunk/net/xfrm/xfrm_output.c
+++ b/trunk/net/xfrm/xfrm_output.c
@@ -95,13 +95,13 @@ static int xfrm_output_one(struct sk_buff *skb, int err)
 			goto error_nolock;
 		}
 
-		dst = skb_dst_pop(skb);
+		dst = dst_pop(dst);
 		if (!dst) {
 			XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTERROR);
 			err = -EHOSTUNREACH;
 			goto error_nolock;
 		}
-		skb_dst_set_noref(skb, dst);
+		skb_dst_set(skb, dst);
 		x = dst->xfrm;
 	} while (x && !(x->outer_mode->flags & XFRM_MODE_FLAG_TUNNEL));
 
diff --git a/trunk/net/xfrm/xfrm_policy.c b/trunk/net/xfrm/xfrm_policy.c
index 4bf27d901333..d965a2bad8d3 100644
--- a/trunk/net/xfrm/xfrm_policy.c
+++ b/trunk/net/xfrm/xfrm_policy.c
@@ -2153,7 +2153,6 @@ int __xfrm_route_forward(struct sk_buff *skb, unsigned short family)
 		return 0;
 	}
 
-	skb_dst_force(skb);
 	dst = skb_dst(skb);
 
 	res = xfrm_lookup(net, &dst, &fl, NULL, 0) == 0;