Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6

* 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6:
  rose: Socket lock was not released before returning to user space
  hci_usb: remove code obfuscation
  drivers/net/appletalk: use time_before, time_before_eq, etc
  drivers/atm: use time_before, time_before_eq, etc
  hci_usb: do not initialize static variables to 0
  tg3: 5701 DMA corruption fix
  atm nicstar: Removal of debug code containing deprecated calls to cli()/sti()
  iwlwifi: Fix unconditional access to station->tidp[].agg.
  netfilter: Fix SIP conntrack build with NAT disabled.
  netfilter: Fix SCTP nat build.

12 files changed, 105 insertions, 144 deletions

diff --git a/drivers/atm/iphase.c b/drivers/atm/iphase.c
index 670c093..5c28ca7 100644
--- a/drivers/atm/iphase.c
+++ b/drivers/atm/iphase.c
@@ -60,7 +60,8 @@
 #include <asm/uaccess.h>  
 #include <asm/string.h>  
 #include <asm/byteorder.h>  
-#include <linux/vmalloc.h>  
+#include <linux/vmalloc.h>
+#include <linux/jiffies.h>
 #include "iphase.h"		  
 #include "suni.h"		  
 #define swap(x) (((x & 0xff) << 8) | ((x & 0xff00) >> 8))  
@@ -189,7 +190,7 @@ static u16 get_desc (IADEV *dev, struct ia_vcc *iavcc) {
   int ltimeout;
 
   ia_hack_tcq (dev);
-  if(((jiffies - timer)>50)||((dev->ffL.tcq_rd==dev->host_tcq_wr))){      
+  if((time_after(jiffies,timer+50)) || ((dev->ffL.tcq_rd==dev->host_tcq_wr))) {
      timer = jiffies; 
      i=0;
      while (i < dev->num_tx_desc) {
@@ -1225,7 +1226,7 @@ static void rx_intr(struct atm_dev *dev)
         iadev->rx_tmp_jif = jiffies; 
         iadev->rxing = 0;
      } 
-     else if (((jiffies - iadev->rx_tmp_jif) > 50) && 
+     else if ((time_after(jiffies, iadev->rx_tmp_jif + 50)) &&
                ((iadev->rx_pkt_cnt - iadev->rx_tmp_cnt) == 0)) {
         for (i = 1; i <= iadev->num_rx_desc; i++)
                free_desc(dev, i);
diff --git a/drivers/atm/nicstar.c b/drivers/atm/nicstar.c
index 0c205b0..38c769f 100644
--- a/drivers/atm/nicstar.c
+++ b/drivers/atm/nicstar.c
@@ -125,85 +125,6 @@
 #define ATM_SKB(s) (&(s)->atm)
 #endif
 
-   /* Spinlock debugging stuff */
-#ifdef NS_DEBUG_SPINLOCKS /* See nicstar.h */
-#define ns_grab_int_lock(card,flags) \
- do { \
-    unsigned long nsdsf, nsdsf2; \
-    local_irq_save(flags); \
-    save_flags(nsdsf); cli();\
-    if (nsdsf & (1<<9)) printk ("nicstar.c: ints %sabled -> enabled.\n", \
-                                (flags)&(1<<9)?"en":"dis"); \
-    if (spin_is_locked(&(card)->int_lock) && \
-        (card)->cpu_int == smp_processor_id()) { \
-       printk("nicstar.c: line %d (cpu %d) int_lock already locked at line %d (cpu %d)\n", \
-              __LINE__, smp_processor_id(), (card)->has_int_lock, \
-              (card)->cpu_int); \
-       printk("nicstar.c: ints were %sabled.\n", ((flags)&(1<<9)?"en":"dis")); \
-    } \
-    if (spin_is_locked(&(card)->res_lock) && \
-        (card)->cpu_res == smp_processor_id()) { \
-       printk("nicstar.c: line %d (cpu %d) res_lock locked at line %d (cpu %d)(trying int)\n", \
-              __LINE__, smp_processor_id(), (card)->has_res_lock, \
-              (card)->cpu_res); \
-       printk("nicstar.c: ints were %sabled.\n", ((flags)&(1<<9)?"en":"dis")); \
-    } \
-    spin_lock_irq(&(card)->int_lock); \
-    (card)->has_int_lock = __LINE__; \
-    (card)->cpu_int = smp_processor_id(); \
-    restore_flags(nsdsf); } while (0)
-#define ns_grab_res_lock(card,flags) \
- do { \
-    unsigned long nsdsf, nsdsf2; \
-    local_irq_save(flags); \
-    save_flags(nsdsf); cli();\
-    if (nsdsf & (1<<9)) printk ("nicstar.c: ints %sabled -> enabled.\n", \
-                                (flags)&(1<<9)?"en":"dis"); \
-    if (spin_is_locked(&(card)->res_lock) && \
-        (card)->cpu_res == smp_processor_id()) { \
-       printk("nicstar.c: line %d (cpu %d) res_lock already locked at line %d (cpu %d)\n", \
-              __LINE__, smp_processor_id(), (card)->has_res_lock, \
-              (card)->cpu_res); \
-       printk("nicstar.c: ints were %sabled.\n", ((flags)&(1<<9)?"en":"dis")); \
-    } \
-    spin_lock_irq(&(card)->res_lock); \
-    (card)->has_res_lock = __LINE__; \
-    (card)->cpu_res = smp_processor_id(); \
-    restore_flags(nsdsf); } while (0)
-#define ns_grab_scq_lock(card,scq,flags) \
- do { \
-    unsigned long nsdsf, nsdsf2; \
-    local_irq_save(flags); \
-    save_flags(nsdsf); cli();\
-    if (nsdsf & (1<<9)) printk ("nicstar.c: ints %sabled -> enabled.\n", \
-                                (flags)&(1<<9)?"en":"dis"); \
-    if (spin_is_locked(&(scq)->lock) && \
-        (scq)->cpu_lock == smp_processor_id()) { \
-       printk("nicstar.c: line %d (cpu %d) this scq_lock already locked at line %d (cpu %d)\n", \
-              __LINE__, smp_processor_id(), (scq)->has_lock, \
-              (scq)->cpu_lock); \
-       printk("nicstar.c: ints were %sabled.\n", ((flags)&(1<<9)?"en":"dis")); \
-    } \
-    if (spin_is_locked(&(card)->res_lock) && \
-        (card)->cpu_res == smp_processor_id()) { \
-       printk("nicstar.c: line %d (cpu %d) res_lock locked at line %d (cpu %d)(trying scq)\n", \
-              __LINE__, smp_processor_id(), (card)->has_res_lock, \
-              (card)->cpu_res); \
-       printk("nicstar.c: ints were %sabled.\n", ((flags)&(1<<9)?"en":"dis")); \
-    } \
-    spin_lock_irq(&(scq)->lock); \
-    (scq)->has_lock = __LINE__; \
-    (scq)->cpu_lock = smp_processor_id(); \
-    restore_flags(nsdsf); } while (0)
-#else /* !NS_DEBUG_SPINLOCKS */
-#define ns_grab_int_lock(card,flags) \
-        spin_lock_irqsave(&(card)->int_lock,(flags))
-#define ns_grab_res_lock(card,flags) \
-        spin_lock_irqsave(&(card)->res_lock,(flags))
-#define ns_grab_scq_lock(card,scq,flags) \
-        spin_lock_irqsave(&(scq)->lock,flags)
-#endif /* NS_DEBUG_SPINLOCKS */
-
 
 /* Function declarations ******************************************************/
 
@@ -422,7 +343,7 @@ static u32 ns_read_sram(ns_dev *card, u32 sram_address)
    sram_address <<= 2;
    sram_address &= 0x0007FFFC;	/* address must be dword aligned */
    sram_address |= 0x50000000;	/* SRAM read command */
-   ns_grab_res_lock(card, flags);
+   spin_lock_irqsave(&card->res_lock, flags);
    while (CMD_BUSY(card));
    writel(sram_address, card->membase + CMD);
    while (CMD_BUSY(card));
@@ -440,7 +361,7 @@ static void ns_write_sram(ns_dev *card, u32 sram_address, u32 *value, int count)
    count--;	/* count range now is 0..3 instead of 1..4 */
    c = count;
    c <<= 2;	/* to use increments of 4 */
-   ns_grab_res_lock(card, flags);
+   spin_lock_irqsave(&card->res_lock, flags);
    while (CMD_BUSY(card));
    for (i = 0; i <= c; i += 4)
       writel(*(value++), card->membase + i);
@@ -1166,7 +1087,7 @@ static void push_rxbufs(ns_dev *card, struct sk_buff *skb)
             card->lbfqc += 2;
       }
 
-      ns_grab_res_lock(card, flags);
+      spin_lock_irqsave(&card->res_lock, flags);
 
       while (CMD_BUSY(card));
       writel(addr2, card->membase + DR3);
@@ -1206,7 +1127,7 @@ static irqreturn_t ns_irq_handler(int irq, void *dev_id)
 
    PRINTK("nicstar%d: NICStAR generated an interrupt\n", card->index);
 
-   ns_grab_int_lock(card, flags);
+   spin_lock_irqsave(&card->int_lock, flags);
    
    stat_r = readl(card->membase + STAT);
 
@@ -1585,7 +1506,7 @@ static void ns_close(struct atm_vcc *vcc)
       unsigned long flags;
       
       addr = NS_RCT + (vcc->vpi << card->vcibits | vcc->vci) * NS_RCT_ENTRY_SIZE;
-      ns_grab_res_lock(card, flags);
+      spin_lock_irqsave(&card->res_lock, flags);
       while(CMD_BUSY(card));
       writel(NS_CMD_CLOSE_CONNECTION | addr << 2, card->membase + CMD);
       spin_unlock_irqrestore(&card->res_lock, flags);
@@ -1607,7 +1528,7 @@ static void ns_close(struct atm_vcc *vcc)
 	                       NS_SKB(iovb)->iovcnt);
          NS_SKB(iovb)->iovcnt = 0;
          NS_SKB(iovb)->vcc = NULL;
-         ns_grab_int_lock(card, flags);
+         spin_lock_irqsave(&card->int_lock, flags);
          recycle_iov_buf(card, iovb);
          spin_unlock_irqrestore(&card->int_lock, flags);
          vc->rx_iov = NULL;
@@ -1629,7 +1550,7 @@ static void ns_close(struct atm_vcc *vcc)
 
       for (;;)
       {
-         ns_grab_scq_lock(card, scq, flags);
+         spin_lock_irqsave(&scq->lock, flags);
          scqep = scq->next;
          if (scqep == scq->base)
             scqep = scq->last;
@@ -1691,7 +1612,7 @@ static void ns_close(struct atm_vcc *vcc)
      unsigned long flags;
      scq_info *scq = card->scq0;
 
-     ns_grab_scq_lock(card, scq, flags);
+     spin_lock_irqsave(&scq->lock, flags);
 
      for(i = 0; i < scq->num_entries; i++) {
        if(scq->skb[i] && ATM_SKB(scq->skb[i])->vcc == vcc) {
@@ -1892,7 +1813,7 @@ static int push_scqe(ns_dev *card, vc_map *vc, scq_info *scq, ns_scqe *tbd,
    u32 data;
    int index;
    
-   ns_grab_scq_lock(card, scq, flags);
+   spin_lock_irqsave(&scq->lock, flags);
    while (scq->tail == scq->next)
    {
       if (in_interrupt()) {
@@ -1904,7 +1825,7 @@ static int push_scqe(ns_dev *card, vc_map *vc, scq_info *scq, ns_scqe *tbd,
       scq->full = 1;
       spin_unlock_irqrestore(&scq->lock, flags);
       interruptible_sleep_on_timeout(&scq->scqfull_waitq, SCQFULL_TIMEOUT);
-      ns_grab_scq_lock(card, scq, flags);
+      spin_lock_irqsave(&scq->lock, flags);
 
       if (scq->full) {
          spin_unlock_irqrestore(&scq->lock, flags);
@@ -1953,7 +1874,7 @@ static int push_scqe(ns_dev *card, vc_map *vc, scq_info *scq, ns_scqe *tbd,
          if (has_run++) break;
          spin_unlock_irqrestore(&scq->lock, flags);
          interruptible_sleep_on_timeout(&scq->scqfull_waitq, SCQFULL_TIMEOUT);
-         ns_grab_scq_lock(card, scq, flags);
+         spin_lock_irqsave(&scq->lock, flags);
       }
 
       if (!scq->full)
@@ -2090,7 +2011,7 @@ static void drain_scq(ns_dev *card, scq_info *scq, int pos)
       return;
    }
 
-   ns_grab_scq_lock(card, scq, flags);
+   spin_lock_irqsave(&scq->lock, flags);
    i = (int) (scq->tail - scq->base);
    if (++i == scq->num_entries)
       i = 0;
@@ -2898,7 +2819,7 @@ static int ns_ioctl(struct atm_dev *dev, unsigned int cmd, void __user *arg)
 	       {
                   struct sk_buff *hb;
 
-                  ns_grab_int_lock(card, flags);
+                  spin_lock_irqsave(&card->int_lock, flags);
 		  hb = skb_dequeue(&card->hbpool.queue);
 		  card->hbpool.count--;
                   spin_unlock_irqrestore(&card->int_lock, flags);
@@ -2917,7 +2838,7 @@ static int ns_ioctl(struct atm_dev *dev, unsigned int cmd, void __user *arg)
                   if (hb == NULL)
                      return -ENOMEM;
                   NS_SKB_CB(hb)->buf_type = BUF_NONE;
-                  ns_grab_int_lock(card, flags);
+                  spin_lock_irqsave(&card->int_lock, flags);
                   skb_queue_tail(&card->hbpool.queue, hb);
                   card->hbpool.count++;
                   spin_unlock_irqrestore(&card->int_lock, flags);
@@ -2929,7 +2850,7 @@ static int ns_ioctl(struct atm_dev *dev, unsigned int cmd, void __user *arg)
 	       {
 	          struct sk_buff *iovb;
 
-                  ns_grab_int_lock(card, flags);
+                  spin_lock_irqsave(&card->int_lock, flags);
 		  iovb = skb_dequeue(&card->iovpool.queue);
 		  card->iovpool.count--;
                   spin_unlock_irqrestore(&card->int_lock, flags);
@@ -2948,7 +2869,7 @@ static int ns_ioctl(struct atm_dev *dev, unsigned int cmd, void __user *arg)
                   if (iovb == NULL)
                      return -ENOMEM;
                   NS_SKB_CB(iovb)->buf_type = BUF_NONE;
-                  ns_grab_int_lock(card, flags);
+                  spin_lock_irqsave(&card->int_lock, flags);
                   skb_queue_tail(&card->iovpool.queue, iovb);
                   card->iovpool.count++;
                   spin_unlock_irqrestore(&card->int_lock, flags);
@@ -2995,7 +2916,7 @@ static void ns_poll(unsigned long arg)
       /* Probably it isn't worth spinning */
          continue;
       }
-      ns_grab_int_lock(card, flags);
+      spin_lock_irqsave(&card->int_lock, flags);
 
       stat_w = 0;
       stat_r = readl(card->membase + STAT);
@@ -3062,7 +2983,7 @@ static void ns_phy_put(struct atm_dev *dev, unsigned char value,
    unsigned long flags;
 
    card = dev->dev_data;
-   ns_grab_res_lock(card, flags);
+   spin_lock_irqsave(&card->res_lock, flags);
    while(CMD_BUSY(card));
    writel((unsigned long) value, card->membase + DR0);
    writel(NS_CMD_WRITE_UTILITY | 0x00000200 | (addr & 0x000000FF),
@@ -3079,7 +3000,7 @@ static unsigned char ns_phy_get(struct atm_dev *dev, unsigned long addr)
    unsigned long data;
 
    card = dev->dev_data;
-   ns_grab_res_lock(card, flags);
+   spin_lock_irqsave(&card->res_lock, flags);
    while(CMD_BUSY(card));
    writel(NS_CMD_READ_UTILITY | 0x00000200 | (addr & 0x000000FF),
           card->membase + CMD);
diff --git a/drivers/atm/nicstar.h b/drivers/atm/nicstar.h
index 5997bcb..6010e3d 100644
--- a/drivers/atm/nicstar.h
+++ b/drivers/atm/nicstar.h
@@ -28,8 +28,6 @@
 
 /* Options ********************************************************************/
 
-#undef NS_DEBUG_SPINLOCKS
-
 #define NS_MAX_CARDS 4		/* Maximum number of NICStAR based cards
 				   controlled by the device driver. Must
                                    be <= 5 */
@@ -721,10 +719,6 @@ typedef struct scq_info
    wait_queue_head_t scqfull_waitq;
    volatile char full;			/* SCQ full indicator */
    spinlock_t lock;			/* SCQ spinlock */
-#ifdef NS_DEBUG_SPINLOCKS
-   volatile long has_lock;
-   volatile int cpu_lock;
-#endif /* NS_DEBUG_SPINLOCKS */
 } scq_info;
 
 
@@ -810,12 +804,6 @@ typedef struct ns_dev
    unsigned intcnt;			/* Interrupt counter */
    spinlock_t int_lock;		/* Interrupt lock */
    spinlock_t res_lock;		/* Card resource lock */
-#ifdef NS_DEBUG_SPINLOCKS
-   volatile long has_int_lock;
-   volatile int cpu_int;
-   volatile long has_res_lock;
-   volatile int cpu_res;
-#endif /* NS_DEBUG_SPINLOCKS */
 } ns_dev;
 
 
diff --git a/drivers/bluetooth/hci_usb.c b/drivers/bluetooth/hci_usb.c
index 8b884f8..192522e 100644
--- a/drivers/bluetooth/hci_usb.c
+++ b/drivers/bluetooth/hci_usb.c
@@ -62,13 +62,13 @@
 #define URB_ZERO_PACKET 0
 #endif
 
-static int ignore = 0;
-static int ignore_dga = 0;
-static int ignore_csr = 0;
-static int ignore_sniffer = 0;
-static int disable_scofix = 0;
-static int force_scofix = 0;
-static int reset = 0;
+static int ignore;
+static int ignore_dga;
+static int ignore_csr;
+static int ignore_sniffer;
+static int disable_scofix;
+static int force_scofix;
+static int reset;
 
 #ifdef CONFIG_BT_HCIUSB_SCO
 static int isoc = 2;
@@ -265,7 +265,7 @@ static int hci_usb_intr_rx_submit(struct hci_usb *husb)
 		BT_ERR("%s intr rx submit failed urb %p err %d",
 				husb->hdev->name, urb, err);
 		_urb_unlink(_urb);
-		_urb_free(_urb);
+		kfree(_urb);
 		kfree(buf);
 	}
 	return err;
@@ -302,7 +302,7 @@ static int hci_usb_bulk_rx_submit(struct hci_usb *husb)
 		BT_ERR("%s bulk rx submit failed urb %p err %d",
 				husb->hdev->name, urb, err);
 		_urb_unlink(_urb);
-		_urb_free(_urb);
+		kfree(_urb);
 		kfree(buf);
 	}
 	return err;
@@ -353,7 +353,7 @@ static int hci_usb_isoc_rx_submit(struct hci_usb *husb)
 		BT_ERR("%s isoc rx submit failed urb %p err %d",
 				husb->hdev->name, urb, err);
 		_urb_unlink(_urb);
-		_urb_free(_urb);
+		kfree(_urb);
 		kfree(buf);
 	}
 	return err;
@@ -431,7 +431,7 @@ static void hci_usb_unlink_urbs(struct hci_usb *husb)
 					husb->hdev->name, _urb, _urb->type, urb);
 			kfree(urb->setup_packet);
 			kfree(urb->transfer_buffer);
-			_urb_free(_urb);
+			kfree(_urb);
 		}
 	}
 }
@@ -490,7 +490,7 @@ static inline int hci_usb_send_ctrl(struct hci_usb *husb, struct sk_buff *skb)
 
 		dr = kmalloc(sizeof(*dr), GFP_ATOMIC);
 		if (!dr) {
-			_urb_free(_urb);
+			kfree(_urb);
 			return -ENOMEM;
 		}
 	} else
diff --git a/drivers/bluetooth/hci_usb.h b/drivers/bluetooth/hci_usb.h
index 56cd3a9..414080a 100644
--- a/drivers/bluetooth/hci_usb.h
+++ b/drivers/bluetooth/hci_usb.h
@@ -60,11 +60,6 @@ struct _urb {
 	struct urb        urb;
 };
 
-static inline void _urb_free(struct _urb *_urb)
-{
-	kfree(_urb);
-}
-
 static inline void _urb_queue_init(struct _urb_queue *q)
 {
 	INIT_LIST_HEAD(&q->head);
diff --git a/drivers/net/appletalk/cops.c b/drivers/net/appletalk/cops.c
index 65b901e..82e9a5b 100644
--- a/drivers/net/appletalk/cops.c
+++ b/drivers/net/appletalk/cops.c
@@ -69,6 +69,7 @@ static const char *version =
 #include <linux/atalk.h>
 #include <linux/spinlock.h>
 #include <linux/bitops.h>
+#include <linux/jiffies.h>
 
 #include <asm/system.h>
 #include <asm/io.h>
@@ -503,7 +504,7 @@ static void cops_reset(struct net_device *dev, int sleep)
                         long snap=jiffies;
 
 			/* Let card finish initializing, about 1/3 second */
-	                while(jiffies-snap<HZ/3)
+			while (time_before(jiffies, snap + HZ/3))
                                 schedule();
                 }
                 else
diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
index 96043c5..bc4c62b 100644
--- a/drivers/net/tg3.c
+++ b/drivers/net/tg3.c
@@ -64,8 +64,8 @@
 
 #define DRV_MODULE_NAME		"tg3"
 #define PFX DRV_MODULE_NAME	": "
-#define DRV_MODULE_VERSION	"3.90"
-#define DRV_MODULE_RELDATE	"April 12, 2008"
+#define DRV_MODULE_VERSION	"3.91"
+#define DRV_MODULE_RELDATE	"April 18, 2008"
 
 #define TG3_DEF_MAC_MODE	0
 #define TG3_DEF_RX_MODE		0
@@ -4135,11 +4135,21 @@ static int tigon3_dma_hwbug_workaround(struct tg3 *tp, struct sk_buff *skb,
 				       u32 last_plus_one, u32 *start,
 				       u32 base_flags, u32 mss)
 {
-	struct sk_buff *new_skb = skb_copy(skb, GFP_ATOMIC);
+	struct sk_buff *new_skb;
 	dma_addr_t new_addr = 0;
 	u32 entry = *start;
 	int i, ret = 0;
 
+	if (GET_ASIC_REV(tp->pci_chip_rev_id) != ASIC_REV_5701)
+		new_skb = skb_copy(skb, GFP_ATOMIC);
+	else {
+		int more_headroom = 4 - ((unsigned long)skb->data & 3);
+
+		new_skb = skb_copy_expand(skb,
+					  skb_headroom(skb) + more_headroom,
+					  skb_tailroom(skb), GFP_ATOMIC);
+	}
+
 	if (!new_skb) {
 		ret = -1;
 	} else {
@@ -4462,7 +4472,9 @@ static int tg3_start_xmit_dma_bug(struct sk_buff *skb, struct net_device *dev)
 
 	would_hit_hwbug = 0;
 
-	if (tg3_4g_overflow_test(mapping, len))
+	if (tp->tg3_flags3 & TG3_FLG3_5701_DMA_BUG)
+		would_hit_hwbug = 1;
+	else if (tg3_4g_overflow_test(mapping, len))
 		would_hit_hwbug = 1;
 
 	tg3_set_txd(tp, entry, mapping, len, base_flags,
@@ -11339,6 +11351,38 @@ static int __devinit tg3_get_invariants(struct tg3 *tp)
 		}
 	}
 
+	if ((GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5701)) {
+		static struct tg3_dev_id {
+			u32	vendor;
+			u32	device;
+		} bridge_chipsets[] = {
+			{ PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_PXH_0 },
+			{ PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_PXH_1 },
+			{ },
+		};
+		struct tg3_dev_id *pci_id = &bridge_chipsets[0];
+		struct pci_dev *bridge = NULL;
+
+		while (pci_id->vendor != 0) {
+			bridge = pci_get_device(pci_id->vendor,
+						pci_id->device,
+						bridge);
+			if (!bridge) {
+				pci_id++;
+				continue;
+			}
+			if (bridge->subordinate &&
+			    (bridge->subordinate->number <=
+			     tp->pdev->bus->number) &&
+			    (bridge->subordinate->subordinate >=
+			     tp->pdev->bus->number)) {
+				tp->tg3_flags3 |= TG3_FLG3_5701_DMA_BUG;
+				pci_dev_put(bridge);
+				break;
+			}
+		}
+	}
+
 	/* The EPB bridge inside 5714, 5715, and 5780 cannot support
 	 * DMA addresses > 40-bit. This bridge may have other additional
 	 * 57xx devices behind it in some 4-port NIC designs for example.
diff --git a/drivers/net/tg3.h b/drivers/net/tg3.h
index c1075a7..c688c3a 100644
--- a/drivers/net/tg3.h
+++ b/drivers/net/tg3.h
@@ -2476,6 +2476,7 @@ struct tg3 {
 #define TG3_FLG3_NO_NVRAM_ADDR_TRANS	0x00000001
 #define TG3_FLG3_ENABLE_APE		0x00000002
 #define TG3_FLG3_5761_5784_AX_FIXES	0x00000004
+#define TG3_FLG3_5701_DMA_BUG		0x00000008
 
 	struct timer_list		timer;
 	u16				timer_counter;
diff --git a/drivers/net/wireless/iwlwifi/iwl-debugfs.c b/drivers/net/wireless/iwlwifi/iwl-debugfs.c
index 0f16f26..9a30e1d 100644
--- a/drivers/net/wireless/iwlwifi/iwl-debugfs.c
+++ b/drivers/net/wireless/iwlwifi/iwl-debugfs.c
@@ -239,28 +239,34 @@ static ssize_t iwl_dbgfs_stations_read(struct file *file, char __user *user_buf,
 					"ps_status: %u\n", station->ps_status);
 			pos += scnprintf(buf + pos, bufsz - pos, "tid data:\n");
 			pos += scnprintf(buf + pos, bufsz - pos,
-					"seq_num\t\ttxq_id\t");
+					"seq_num\t\ttxq_id");
+#ifdef CONFIG_IWL4965_HT
 			pos += scnprintf(buf + pos, bufsz - pos,
-					"frame_count\twait_for_ba\t");
+					"\tframe_count\twait_for_ba\t");
 			pos += scnprintf(buf + pos, bufsz - pos,
 					"start_idx\tbitmap0\t");
 			pos += scnprintf(buf + pos, bufsz - pos,
-					"bitmap1\trate_n_flags\n");
+					"bitmap1\trate_n_flags");
+#endif
+			pos += scnprintf(buf + pos, bufsz - pos, "\n");
 
 			for (j = 0; j < MAX_TID_COUNT; j++) {
 				pos += scnprintf(buf + pos, bufsz - pos,
-						"[%d]:\t\t%u\t", j,
+						"[%d]:\t\t%u", j,
 						station->tid[j].seq_number);
+#ifdef CONFIG_IWL4965_HT
 				pos += scnprintf(buf + pos, bufsz - pos,
-						"%u\t\t%u\t\t%u\t\t",
+						"\t%u\t\t%u\t\t%u\t\t",
 						station->tid[j].agg.txq_id,
 						station->tid[j].agg.frame_count,
 						station->tid[j].agg.wait_for_ba);
 				pos += scnprintf(buf + pos, bufsz - pos,
-						"%u\t%llu\t%u\n",
+						"%u\t%llu\t%u",
 						station->tid[j].agg.start_idx,
 						(unsigned long long)station->tid[j].agg.bitmap,
 						station->tid[j].agg.rate_n_flags);
+#endif
+				pos += scnprintf(buf + pos, bufsz - pos, "\n");
 			}
 			pos += scnprintf(buf + pos, bufsz - pos, "\n");
 		}
diff --git a/net/ipv4/netfilter/Kconfig b/net/ipv4/netfilter/Kconfig
index 0c95cd5..2767841 100644
--- a/net/ipv4/netfilter/Kconfig
+++ b/net/ipv4/netfilter/Kconfig
@@ -259,6 +259,7 @@ config NF_NAT_PROTO_SCTP
 	tristate
 	default NF_NAT && NF_CT_PROTO_SCTP
 	depends on NF_NAT && NF_CT_PROTO_SCTP
+	select LIBCRC32C
 
 config NF_NAT_FTP
 	tristate
diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c
index 65b3ba5..9f49000 100644
--- a/net/netfilter/nf_conntrack_sip.c
+++ b/net/netfilter/nf_conntrack_sip.c
@@ -781,7 +781,7 @@ static int set_expected_rtp_rtcp(struct sk_buff *skb,
 		    nfct_help(exp->master)->helper != nfct_help(ct)->helper ||
 		    exp->class != class)
 			break;
-
+#ifdef CONFIG_NF_NAT_NEEDED
 		if (exp->tuple.src.l3num == AF_INET && !direct_rtp &&
 		    (exp->saved_ip != exp->tuple.dst.u3.ip ||
 		     exp->saved_proto.udp.port != exp->tuple.dst.u.udp.port) &&
@@ -791,6 +791,7 @@ static int set_expected_rtp_rtcp(struct sk_buff *skb,
 			tuple.dst.u.udp.port	= exp->saved_proto.udp.port;
 			direct_rtp = 1;
 		} else
+#endif
 			skip_expect = 1;
 	} while (!skip_expect);
 	rcu_read_unlock();
diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index d1ff3f8..1ebf652 100644
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -760,8 +760,10 @@ static int rose_connect(struct socket *sock, struct sockaddr *uaddr, int addr_le
 
 	rose->neighbour = rose_get_neigh(&addr->srose_addr, &cause,
 					 &diagnostic);
-	if (!rose->neighbour)
-		return -ENETUNREACH;
+	if (!rose->neighbour) {
+		err = -ENETUNREACH;
+		goto out_release;
+	}
 
 	rose->lci = rose_new_lci(rose->neighbour);
 	if (!rose->lci) {