164 files changed, 3216 insertions, 1239 deletions
diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
index f342278539d5..494b888a6568 100644
--- a/drivers/net/Kconfig
+++ b/drivers/net/Kconfig
@@ -139,7 +139,7 @@ config MACVTAP
          This adds a specialized tap character device driver that is based
          on the MAC-VLAN network interface, called macvtap. A macvtap device
          can be added in the same way as a macvlan device, using 'type
-          macvlan', and then be accessed through the tap user space interface.
+          macvtap', and then be accessed through the tap user space interface.
          To compile this driver as a module, choose M here: the module
          will be called macvtap.
diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c
index cce1f1bf90b4..dcde56057fe1 100644
--- a/drivers/net/bonding/bond_3ad.c
+++ b/drivers/net/bonding/bond_3ad.c
@@ -181,7 +181,7 @@ static inline int __agg_has_partner(struct aggregator *agg)
 */
 static inline void __disable_port(struct port *port)
 {
-        bond_set_slave_inactive_flags(port->slave);
+        bond_set_slave_inactive_flags(port->slave, BOND_SLAVE_NOTIFY_LATER);
 }
 /**
@@ -193,7 +193,7 @@ static inline void __enable_port(struct port *port)
        struct slave *slave = port->slave;
        if ((slave->link == BOND_LINK_UP) && IS_UP(slave->dev))
-                bond_set_slave_active_flags(slave);
+                bond_set_slave_active_flags(slave, BOND_SLAVE_NOTIFY_LATER);
 }
 /**
@@ -1796,8 +1796,6 @@ void bond_3ad_initiate_agg_selection(struct bonding *bond, int timeout)
        BOND_AD_INFO(bond).agg_select_timer = timeout;
 }
-static u16 aggregator_identifier;
 /**
 * bond_3ad_initialize - initialize a bond's 802.3ad parameters and structures
 * @bond: bonding struct to work on
@@ -1811,7 +1809,7 @@ void bond_3ad_initialize(struct bonding *bond, u16 tick_resolution)
        if (!MAC_ADDRESS_EQUAL(&(BOND_AD_INFO(bond).system.sys_mac_addr),
                                bond->dev->dev_addr)) {
-                aggregator_identifier = 0;
+                BOND_AD_INFO(bond).aggregator_identifier = 0;
                BOND_AD_INFO(bond).system.sys_priority = 0xFFFF;
                BOND_AD_INFO(bond).system.sys_mac_addr = *((struct mac_addr *)bond->dev->dev_addr);
@@ -1880,7 +1878,7 @@ void bond_3ad_bind_slave(struct slave *slave)
                ad_initialize_agg(aggregator);
                aggregator->aggregator_mac_address = *((struct mac_addr *)bond->dev->dev_addr);
-                aggregator->aggregator_identifier = (++aggregator_identifier);
+                aggregator->aggregator_identifier = ++BOND_AD_INFO(bond).aggregator_identifier;
                aggregator->slave = slave;
                aggregator->is_active = 0;
                aggregator->num_of_ports = 0;
@@ -2064,6 +2062,7 @@ void bond_3ad_state_machine_handler(struct work_struct *work)
        struct list_head *iter;
        struct slave *slave;
        struct port *port;
+        bool should_notify_rtnl = BOND_SLAVE_NOTIFY_LATER;
        read_lock(&bond->lock);
        rcu_read_lock();
@@ -2121,8 +2120,19 @@ void bond_3ad_state_machine_handler(struct work_struct *work)
        }
 re_arm:
+        bond_for_each_slave_rcu(bond, slave, iter) {
+                if (slave->should_notify) {
+                        should_notify_rtnl = BOND_SLAVE_NOTIFY_NOW;
+                        break;
+                }
+        }
        rcu_read_unlock();
        read_unlock(&bond->lock);
+        if (should_notify_rtnl && rtnl_trylock()) {
+                bond_slave_state_notify(bond);
+                rtnl_unlock();
+        }
        queue_delayed_work(bond->wq, &bond->ad_work, ad_delta_in_ticks);
 }
diff --git a/drivers/net/bonding/bond_3ad.h b/drivers/net/bonding/bond_3ad.h
index 13dc9d3c5e34..f4dd9592ac62 100644
--- a/drivers/net/bonding/bond_3ad.h
+++ b/drivers/net/bonding/bond_3ad.h
@@ -253,6 +253,7 @@ struct ad_system {
 struct ad_bond_info {
        struct ad_system system;            /* 802.3ad system structure */
        u32 agg_select_timer;       // Timer to select aggregator after all adapter's hand shakes
+        u16 aggregator_identifier;
 };
 struct ad_slave_info {
diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c
index a2c47476804d..e8f133e926aa 100644
--- a/drivers/net/bonding/bond_alb.c
+++ b/drivers/net/bonding/bond_alb.c
@@ -730,7 +730,7 @@ static struct slave *rlb_choose_channel(struct sk_buff *skb, struct bonding *bon
                        client_info->ntt = 0;
                }
-                if (!vlan_get_tag(skb, &client_info->vlan_id))
+                if (vlan_get_tag(skb, &client_info->vlan_id))
                        client_info->vlan_id = 0;
                if (!client_info->assigned) {
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 4c08018d7333..e5628fc725c3 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -829,21 +829,25 @@ void bond_change_active_slave(struct bonding *bond, struct slave *new_active)
        if (bond_is_lb(bond)) {
                bond_alb_handle_active_change(bond, new_active);
                if (old_active)
-                        bond_set_slave_inactive_flags(old_active);
+                        bond_set_slave_inactive_flags(old_active,
+                                                      BOND_SLAVE_NOTIFY_NOW);
                if (new_active)
-                        bond_set_slave_active_flags(new_active);
+                        bond_set_slave_active_flags(new_active,
+                                                    BOND_SLAVE_NOTIFY_NOW);
        } else {
                rcu_assign_pointer(bond->curr_active_slave, new_active);
        }
        if (bond->params.mode == BOND_MODE_ACTIVEBACKUP) {
                if (old_active)
-                        bond_set_slave_inactive_flags(old_active);
+                        bond_set_slave_inactive_flags(old_active,
+                                                      BOND_SLAVE_NOTIFY_NOW);
                if (new_active) {
                        bool should_notify_peers = false;
-                        bond_set_slave_active_flags(new_active);
+                        bond_set_slave_active_flags(new_active,
+                                                    BOND_SLAVE_NOTIFY_NOW);
                        if (bond->params.fail_over_mac)
                                bond_do_fail_over_mac(bond, new_active,
@@ -1193,6 +1197,11 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
                return -EBUSY;
        }
+        if (bond_dev == slave_dev) {
+                pr_err("%s: cannot enslave bond to itself.\n", bond_dev->name);
+                return -EPERM;
+        }
        /* vlan challenged mutual exclusion */
        /* no need to lock since we're protected by rtnl_lock */
        if (slave_dev->features & NETIF_F_VLAN_CHALLENGED) {
@@ -1270,9 +1279,13 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
        if (slave_ops->ndo_set_mac_address == NULL) {
                if (!bond_has_slaves(bond)) {
-                        pr_warning("%s: Warning: The first slave device specified does not support setting the MAC address. Setting fail_over_mac to active.",
+                        pr_warn("%s: Warning: The first slave device specified does not support setting the MAC address.\n",
-                                   bond_dev->name);
+                                bond_dev->name);
-                        bond->params.fail_over_mac = BOND_FOM_ACTIVE;
+                        if (bond->params.mode == BOND_MODE_ACTIVEBACKUP) {
+                                bond->params.fail_over_mac = BOND_FOM_ACTIVE;
+                                pr_warn("%s: Setting fail_over_mac to active for active-backup mode.\n",
+                                        bond_dev->name);
+                        }
                } else if (bond->params.fail_over_mac != BOND_FOM_ACTIVE) {
                        pr_err("%s: Error: The slave device specified does not support setting the MAC address, but fail_over_mac is not set to active.\n",
                               bond_dev->name);
@@ -1315,7 +1328,8 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
         */
        memcpy(new_slave->perm_hwaddr, slave_dev->dev_addr, ETH_ALEN);
-        if (!bond->params.fail_over_mac) {
+        if (!bond->params.fail_over_mac ||
+            bond->params.mode != BOND_MODE_ACTIVEBACKUP) {
                /*
                 * Set slave to master's mac address.  The application already
                 * set the master's mac address to that of the first slave
@@ -1458,14 +1472,15 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
        switch (bond->params.mode) {
        case BOND_MODE_ACTIVEBACKUP:
-                bond_set_slave_inactive_flags(new_slave);
+                bond_set_slave_inactive_flags(new_slave,
+                                              BOND_SLAVE_NOTIFY_NOW);
                break;
        case BOND_MODE_8023AD:
                /* in 802.3ad mode, the internal mechanism
                 * will activate the slaves in the selected
                 * aggregator
                 */
-                bond_set_slave_inactive_flags(new_slave);
+                bond_set_slave_inactive_flags(new_slave, BOND_SLAVE_NOTIFY_NOW);
                /* if this is the first slave */
                if (!prev_slave) {
                        SLAVE_AD_INFO(new_slave).id = 1;
@@ -1483,7 +1498,7 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
        case BOND_MODE_TLB:
        case BOND_MODE_ALB:
                bond_set_active_slave(new_slave);
-                bond_set_slave_inactive_flags(new_slave);
+                bond_set_slave_inactive_flags(new_slave, BOND_SLAVE_NOTIFY_NOW);
                break;
        default:
                pr_debug("This slave is always active in trunk mode\n");
@@ -1505,7 +1520,6 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
        slave_dev->npinfo = bond->dev->npinfo;
        if (slave_dev->npinfo) {
                if (slave_enable_netpoll(new_slave)) {
-                        read_unlock(&bond->lock);
                        pr_info("Error, %s: master_dev is using netpoll, "
                                 "but new slave device does not support netpoll.\n",
                                 bond_dev->name);
@@ -1539,9 +1553,11 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
        bond_set_carrier(bond);
        if (USES_PRIMARY(bond->params.mode)) {
+                block_netpoll_tx();
                write_lock_bh(&bond->curr_slave_lock);
                bond_select_active_slave(bond);
                write_unlock_bh(&bond->curr_slave_lock);
+                unblock_netpoll_tx();
        }
        pr_info("%s: enslaving %s as a%s interface with a%s link.\n",
@@ -1567,10 +1583,12 @@ err_detach:
        if (bond->primary_slave == new_slave)
                bond->primary_slave = NULL;
        if (bond->curr_active_slave == new_slave) {
+                block_netpoll_tx();
                write_lock_bh(&bond->curr_slave_lock);
                bond_change_active_slave(bond, NULL);
                bond_select_active_slave(bond);
                write_unlock_bh(&bond->curr_slave_lock);
+                unblock_netpoll_tx();
        }
        slave_disable_netpoll(new_slave);
@@ -1579,7 +1597,8 @@ err_close:
        dev_close(slave_dev);
 err_restore_mac:
-        if (!bond->params.fail_over_mac) {
+        if (!bond->params.fail_over_mac ||
+            bond->params.mode != BOND_MODE_ACTIVEBACKUP) {
                /* XXX TODO - fom follow mode needs to change master's
                 * MAC if this slave's MAC is in use by the bond, or at
                 * least print a warning.
@@ -1645,9 +1664,6 @@ static int __bond_release_one(struct net_device *bond_dev,
                return -EINVAL;
        }
-        /* release the slave from its bond */
-        bond->slave_cnt--;
        bond_sysfs_slave_del(slave);
        bond_upper_dev_unlink(bond_dev, slave_dev);
@@ -1672,7 +1688,8 @@ static int __bond_release_one(struct net_device *bond_dev,
        bond->current_arp_slave = NULL;
-        if (!all && !bond->params.fail_over_mac) {
+        if (!all && (!bond->params.fail_over_mac ||
+                     bond->params.mode != BOND_MODE_ACTIVEBACKUP)) {
                if (ether_addr_equal_64bits(bond_dev->dev_addr, slave->perm_hwaddr) &&
                    bond_has_slaves(bond))
                        pr_warn("%s: Warning: the permanent HWaddr of %s - %pM - is still in use by %s. Set the HWaddr of %s to a different address to avoid conflicts.\n",
@@ -1728,6 +1745,7 @@ static int __bond_release_one(struct net_device *bond_dev,
        unblock_netpoll_tx();
        synchronize_rcu();
+        bond->slave_cnt--;
        if (!bond_has_slaves(bond)) {
                call_netdevice_notifiers(NETDEV_CHANGEADDR, bond->dev);
@@ -1769,7 +1787,8 @@ static int __bond_release_one(struct net_device *bond_dev,
        /* close slave before restoring its mac address */
        dev_close(slave_dev);
-        if (bond->params.fail_over_mac != BOND_FOM_ACTIVE) {
+        if (bond->params.fail_over_mac != BOND_FOM_ACTIVE ||
+            bond->params.mode != BOND_MODE_ACTIVEBACKUP) {
                /* restore original ("permanent") mac address */
                memcpy(addr.sa_data, slave->perm_hwaddr, ETH_ALEN);
                addr.sa_family = slave_dev->type;
@@ -2004,7 +2023,8 @@ static void bond_miimon_commit(struct bonding *bond)
                        if (bond->params.mode == BOND_MODE_ACTIVEBACKUP ||
                            bond->params.mode == BOND_MODE_8023AD)
-                                bond_set_slave_inactive_flags(slave);
+                                bond_set_slave_inactive_flags(slave,
+                                                              BOND_SLAVE_NOTIFY_NOW);
                        pr_info("%s: link status definitely down for interface %s, disabling it\n",
                                bond->dev->name, slave->dev->name);
@@ -2551,7 +2571,8 @@ static void bond_ab_arp_commit(struct bonding *bond)
                                slave->link = BOND_LINK_UP;
                                if (bond->current_arp_slave) {
                                        bond_set_slave_inactive_flags(
-                                                bond->current_arp_slave);
+                                                bond->current_arp_slave,
+                                                BOND_SLAVE_NOTIFY_NOW);
                                        bond->current_arp_slave = NULL;
                                }
@@ -2571,7 +2592,8 @@ static void bond_ab_arp_commit(struct bonding *bond)
                                slave->link_failure_count++;
                        slave->link = BOND_LINK_DOWN;
-                        bond_set_slave_inactive_flags(slave);
+                        bond_set_slave_inactive_flags(slave,
+                                                      BOND_SLAVE_NOTIFY_NOW);
                        pr_info("%s: link status definitely down for interface %s, disabling it\n",
                                bond->dev->name, slave->dev->name);
@@ -2604,17 +2626,17 @@ do_failover:
 /*
 * Send ARP probes for active-backup mode ARP monitor.
+ *
+ * Called with rcu_read_lock hold.
 */
 static bool bond_ab_arp_probe(struct bonding *bond)
 {
        struct slave *slave, *before = NULL, *new_slave = NULL,
-                     *curr_arp_slave, *curr_active_slave;
+                     *curr_arp_slave = rcu_dereference(bond->current_arp_slave),
+                     *curr_active_slave = rcu_dereference(bond->curr_active_slave);
        struct list_head *iter;
        bool found = false;
+        bool should_notify_rtnl = BOND_SLAVE_NOTIFY_LATER;
-        rcu_read_lock();
-        curr_arp_slave = rcu_dereference(bond->current_arp_slave);
-        curr_active_slave = rcu_dereference(bond->curr_active_slave);
        if (curr_arp_slave && curr_active_slave)
                pr_info("PROBE: c_arp %s && cas %s BAD\n",
@@ -2623,32 +2645,23 @@ static bool bond_ab_arp_probe(struct bonding *bond)
        if (curr_active_slave) {
                bond_arp_send_all(bond, curr_active_slave);
-                rcu_read_unlock();
+                return should_notify_rtnl;
-                return true;
        }
-        rcu_read_unlock();
        /* if we don't have a curr_active_slave, search for the next available
         * backup slave from the current_arp_slave and make it the candidate
         * for becoming the curr_active_slave
         */
-        if (!rtnl_trylock())
-                return false;
-        /* curr_arp_slave might have gone away */
-        curr_arp_slave = ACCESS_ONCE(bond->current_arp_slave);
        if (!curr_arp_slave) {
-                curr_arp_slave = bond_first_slave(bond);
+                curr_arp_slave = bond_first_slave_rcu(bond);
-                if (!curr_arp_slave) {
+                if (!curr_arp_slave)
-                        rtnl_unlock();
+                        return should_notify_rtnl;
-                        return true;
-                }
        }
-        bond_set_slave_inactive_flags(curr_arp_slave);
+        bond_set_slave_inactive_flags(curr_arp_slave, BOND_SLAVE_NOTIFY_LATER);
-        bond_for_each_slave(bond, slave, iter) {
+        bond_for_each_slave_rcu(bond, slave, iter) {
                if (!found && !before && IS_UP(slave->dev))
                        before = slave;
@@ -2666,7 +2679,8 @@ static bool bond_ab_arp_probe(struct bonding *bond)
                        if (slave->link_failure_count < UINT_MAX)
                                slave->link_failure_count++;
-                        bond_set_slave_inactive_flags(slave);
+                        bond_set_slave_inactive_flags(slave,
+                                                      BOND_SLAVE_NOTIFY_LATER);
                        pr_info("%s: backup interface %s is now down.\n",
                                bond->dev->name, slave->dev->name);
@@ -2678,26 +2692,31 @@ static bool bond_ab_arp_probe(struct bonding *bond)
        if (!new_slave && before)
                new_slave = before;
-        if (!new_slave) {
+        if (!new_slave)
-                rtnl_unlock();
+                goto check_state;
-                return true;
-        }
        new_slave->link = BOND_LINK_BACK;
-        bond_set_slave_active_flags(new_slave);
+        bond_set_slave_active_flags(new_slave, BOND_SLAVE_NOTIFY_LATER);
        bond_arp_send_all(bond, new_slave);
        new_slave->jiffies = jiffies;
        rcu_assign_pointer(bond->current_arp_slave, new_slave);
-        rtnl_unlock();
-        return true;
+check_state:
+        bond_for_each_slave_rcu(bond, slave, iter) {
+                if (slave->should_notify) {
+                        should_notify_rtnl = BOND_SLAVE_NOTIFY_NOW;
+                        break;
+                }
+        }
+        return should_notify_rtnl;
 }
 static void bond_activebackup_arp_mon(struct work_struct *work)
 {
        struct bonding *bond = container_of(work, struct bonding,
                                            arp_work.work);
-        bool should_notify_peers = false, should_commit = false;
+        bool should_notify_peers = false;
+        bool should_notify_rtnl = false;
        int delta_in_ticks;
        delta_in_ticks = msecs_to_jiffies(bond->params.arp_interval);
@@ -2706,11 +2725,12 @@ static void bond_activebackup_arp_mon(struct work_struct *work)
                goto re_arm;
        rcu_read_lock();
        should_notify_peers = bond_should_notify_peers(bond);
-        should_commit = bond_ab_arp_inspect(bond);
-        rcu_read_unlock();
-        if (should_commit) {
+        if (bond_ab_arp_inspect(bond)) {
+                rcu_read_unlock();
                /* Race avoidance with bond_close flush of workqueue */
                if (!rtnl_trylock()) {
                        delta_in_ticks = 1;
@@ -2719,23 +2739,28 @@ static void bond_activebackup_arp_mon(struct work_struct *work)
                }
                bond_ab_arp_commit(bond);
                rtnl_unlock();
+                rcu_read_lock();
        }
-        if (!bond_ab_arp_probe(bond)) {
+        should_notify_rtnl = bond_ab_arp_probe(bond);
-                /* rtnl locking failed, re-arm */
+        rcu_read_unlock();
-                delta_in_ticks = 1;
-                should_notify_peers = false;
-        }
 re_arm:
        if (bond->params.arp_interval)
                queue_delayed_work(bond->wq, &bond->arp_work, delta_in_ticks);
-        if (should_notify_peers) {
+        if (should_notify_peers || should_notify_rtnl) {
                if (!rtnl_trylock())
                        return;
-                call_netdevice_notifiers(NETDEV_NOTIFY_PEERS, bond->dev);
+                if (should_notify_peers)
+                        call_netdevice_notifiers(NETDEV_NOTIFY_PEERS,
+                                                 bond->dev);
+                if (should_notify_rtnl)
+                        bond_slave_state_notify(bond);
                rtnl_unlock();
        }
 }
@@ -2857,9 +2882,12 @@ static int bond_slave_netdev_event(unsigned long event,
                pr_info("%s: Primary slave changed to %s, reselecting active slave.\n",
                        bond->dev->name, bond->primary_slave ? slave_dev->name :
                                                               "none");
+                block_netpoll_tx();
                write_lock_bh(&bond->curr_slave_lock);
                bond_select_active_slave(bond);
                write_unlock_bh(&bond->curr_slave_lock);
+                unblock_netpoll_tx();
                break;
        case NETDEV_FEAT_CHANGE:
                bond_compute_features(bond);
@@ -3032,9 +3060,11 @@ static int bond_open(struct net_device *bond_dev)
                bond_for_each_slave(bond, slave, iter) {
                        if ((bond->params.mode == BOND_MODE_ACTIVEBACKUP)
                                && (slave != bond->curr_active_slave)) {
-                                bond_set_slave_inactive_flags(slave);
+                                bond_set_slave_inactive_flags(slave,
+                                                              BOND_SLAVE_NOTIFY_NOW);
                        } else {
-                                bond_set_slave_active_flags(slave);
+                                bond_set_slave_active_flags(slave,
+                                                            BOND_SLAVE_NOTIFY_NOW);
                        }
                }
                read_unlock(&bond->curr_slave_lock);
@@ -3431,7 +3461,8 @@ static int bond_set_mac_address(struct net_device *bond_dev, void *addr)
        /* If fail_over_mac is enabled, do nothing and return success.
         * Returning an error causes ifenslave to fail.
         */
-        if (bond->params.fail_over_mac)
+        if (bond->params.fail_over_mac &&
+            bond->params.mode == BOND_MODE_ACTIVEBACKUP)
                return 0;
        if (!is_valid_ether_addr(sa->sa_data))
@@ -3692,7 +3723,7 @@ static inline int bond_slave_override(struct bonding *bond,
 static u16 bond_select_queue(struct net_device *dev, struct sk_buff *skb,
-                             void *accel_priv)
+                             void *accel_priv, select_queue_fallback_t fallback)
 {
        /*
         * This helper function exists to help dev_pick_tx get the correct
diff --git a/drivers/net/bonding/bond_options.c b/drivers/net/bonding/bond_options.c
index 11cb943222d5..298c26509095 100644
--- a/drivers/net/bonding/bond_options.c
+++ b/drivers/net/bonding/bond_options.c
@@ -14,7 +14,7 @@
 #include <linux/errno.h>
 #include <linux/if.h>
 #include <linux/netdevice.h>
-#include <linux/rwlock.h>
+#include <linux/spinlock.h>
 #include <linux/rcupdate.h>
 #include <linux/ctype.h>
 #include <linux/inet.h>
@@ -121,6 +121,7 @@ static struct bond_opt_value bond_resend_igmp_tbl[] = {
 static struct bond_opt_value bond_lp_interval_tbl[] = {
        { "minval",  1,       BOND_VALFLAG_MIN | BOND_VALFLAG_DEFAULT},
        { "maxval",  INT_MAX, BOND_VALFLAG_MAX},
+        { NULL,      -1,      0},
 };
 static struct bond_option bond_opts[] = {
diff --git a/drivers/net/bonding/bonding.h b/drivers/net/bonding/bonding.h
index 86ccfb9f71cc..2b0fdec695f7 100644
--- a/drivers/net/bonding/bonding.h
+++ b/drivers/net/bonding/bonding.h
@@ -195,7 +195,8 @@ struct slave {
        s8     new_link;
        u8     backup:1,   /* indicates backup slave. Value corresponds with
                              BOND_STATE_ACTIVE and BOND_STATE_BACKUP */
-               inactive:1; /* indicates inactive slave */
+               inactive:1, /* indicates inactive slave */
+               should_notify:1; /* indicateds whether the state changed */
        u8     duplex;
        u32    original_mtu;
        u32    link_failure_count;
@@ -303,6 +304,24 @@ static inline void bond_set_backup_slave(struct slave *slave)
        }
 }
+static inline void bond_set_slave_state(struct slave *slave,
+                                        int slave_state, bool notify)
+{
+        if (slave->backup == slave_state)
+                return;
+        slave->backup = slave_state;
+        if (notify) {
+                rtmsg_ifinfo(RTM_NEWLINK, slave->dev, 0, GFP_KERNEL);
+                slave->should_notify = 0;
+        } else {
+                if (slave->should_notify)
+                        slave->should_notify = 0;
+                else
+                        slave->should_notify = 1;
+        }
+}
 static inline void bond_slave_state_change(struct bonding *bond)
 {
        struct list_head *iter;
@@ -316,6 +335,19 @@ static inline void bond_slave_state_change(struct bonding *bond)
        }
 }
+static inline void bond_slave_state_notify(struct bonding *bond)
+{
+        struct list_head *iter;
+        struct slave *tmp;
+        bond_for_each_slave(bond, tmp, iter) {
+                if (tmp->should_notify) {
+                        rtmsg_ifinfo(RTM_NEWLINK, tmp->dev, 0, GFP_KERNEL);
+                        tmp->should_notify = 0;
+                }
+        }
+}
 static inline int bond_slave_state(struct slave *slave)
 {
        return slave->backup;
@@ -343,6 +375,9 @@ static inline bool bond_is_active_slave(struct slave *slave)
 #define BOND_ARP_VALIDATE_ALL           (BOND_ARP_VALIDATE_ACTIVE | \
                                         BOND_ARP_VALIDATE_BACKUP)
+#define BOND_SLAVE_NOTIFY_NOW           true
+#define BOND_SLAVE_NOTIFY_LATER         false
 static inline int slave_do_arp_validate(struct bonding *bond,
                                        struct slave *slave)
 {
@@ -394,17 +429,19 @@ static inline void bond_netpoll_send_skb(const struct slave *slave,
 }
 #endif
-static inline void bond_set_slave_inactive_flags(struct slave *slave)
+static inline void bond_set_slave_inactive_flags(struct slave *slave,
+                                                 bool notify)
 {
        if (!bond_is_lb(slave->bond))
-                bond_set_backup_slave(slave);
+                bond_set_slave_state(slave, BOND_STATE_BACKUP, notify);
        if (!slave->bond->params.all_slaves_active)
                slave->inactive = 1;
 }
-static inline void bond_set_slave_active_flags(struct slave *slave)
+static inline void bond_set_slave_active_flags(struct slave *slave,
+                                               bool notify)
 {
-        bond_set_active_slave(slave);
+        bond_set_slave_state(slave, BOND_STATE_ACTIVE, notify);
        slave->inactive = 0;
 }
diff --git a/drivers/net/can/Kconfig b/drivers/net/can/Kconfig
index d447b881bbde..9e7d95dae2c7 100644
--- a/drivers/net/can/Kconfig
+++ b/drivers/net/can/Kconfig
@@ -104,7 +104,7 @@ config CAN_JANZ_ICAN3
 config CAN_FLEXCAN
        tristate "Support for Freescale FLEXCAN based chips"
-        depends on (ARM && CPU_LITTLE_ENDIAN) || PPC
+        depends on ARM || PPC
        ---help---
          Say Y here if you want to support for Freescale FlexCAN.
diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
index 13a909822e25..fc59bc6f040b 100644
--- a/drivers/net/can/dev.c
+++ b/drivers/net/can/dev.c
@@ -323,19 +323,10 @@ void can_put_echo_skb(struct sk_buff *skb, struct net_device *dev,
        }
        if (!priv->echo_skb[idx]) {
-                struct sock *srcsk = skb->sk;
-                if (atomic_read(&skb->users) != 1) {
+                skb = can_create_echo_skb(skb);
-                        struct sk_buff *old_skb = skb;
+                if (!skb)
+                        return;
-                        skb = skb_clone(old_skb, GFP_ATOMIC);
-                        kfree_skb(old_skb);
-                        if (!skb)
-                                return;
-                } else
-                        skb_orphan(skb);
-                skb->sk = srcsk;
                /* make settings for echo to reduce code in irq context */
                skb->protocol = htons(ETH_P_CAN);
diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
index aaed97bee471..61376abdab39 100644
--- a/drivers/net/can/flexcan.c
+++ b/drivers/net/can/flexcan.c
@@ -144,6 +144,8 @@
 #define FLEXCAN_MB_CODE_MASK            (0xf0ffffff)
+#define FLEXCAN_TIMEOUT_US             (50)
 /*
 * FLEXCAN hardware feature flags
 *
@@ -235,9 +237,12 @@ static const struct can_bittiming_const flexcan_bittiming_const = {
 };
 /*
- * Abstract off the read/write for arm versus ppc.
+ * Abstract off the read/write for arm versus ppc. This
+ * assumes that PPC uses big-endian registers and everything
+ * else uses little-endian registers, independent of CPU
+ * endianess.
 */
-#if defined(__BIG_ENDIAN)
+#if defined(CONFIG_PPC)
 static inline u32 flexcan_read(void __iomem *addr)
 {
        return in_be32(addr);
@@ -259,6 +264,22 @@ static inline void flexcan_write(u32 val, void __iomem *addr)
 }
 #endif
+static inline int flexcan_transceiver_enable(const struct flexcan_priv *priv)
+{
+        if (!priv->reg_xceiver)
+                return 0;
+        return regulator_enable(priv->reg_xceiver);
+}
+static inline int flexcan_transceiver_disable(const struct flexcan_priv *priv)
+{
+        if (!priv->reg_xceiver)
+                return 0;
+        return regulator_disable(priv->reg_xceiver);
+}
 static inline int flexcan_has_and_handle_berr(const struct flexcan_priv *priv,
                                              u32 reg_esr)
 {
@@ -266,26 +287,95 @@ static inline int flexcan_has_and_handle_berr(const struct flexcan_priv *priv,
                (reg_esr & FLEXCAN_ESR_ERR_BUS);
 }
-static inline void flexcan_chip_enable(struct flexcan_priv *priv)
+static int flexcan_chip_enable(struct flexcan_priv *priv)
 {
        struct flexcan_regs __iomem *regs = priv->base;
+        unsigned int timeout = FLEXCAN_TIMEOUT_US / 10;
        u32 reg;
        reg = flexcan_read(&regs->mcr);
        reg &= ~FLEXCAN_MCR_MDIS;
        flexcan_write(reg, &regs->mcr);
-        udelay(10);
+        while (timeout-- && (flexcan_read(&regs->mcr) & FLEXCAN_MCR_LPM_ACK))
+                usleep_range(10, 20);
+        if (flexcan_read(&regs->mcr) & FLEXCAN_MCR_LPM_ACK)
+                return -ETIMEDOUT;
+        return 0;
 }
-static inline void flexcan_chip_disable(struct flexcan_priv *priv)
+static int flexcan_chip_disable(struct flexcan_priv *priv)
 {
        struct flexcan_regs __iomem *regs = priv->base;
+        unsigned int timeout = FLEXCAN_TIMEOUT_US / 10;
        u32 reg;
        reg = flexcan_read(&regs->mcr);
        reg |= FLEXCAN_MCR_MDIS;
        flexcan_write(reg, &regs->mcr);
+        while (timeout-- && !(flexcan_read(&regs->mcr) & FLEXCAN_MCR_LPM_ACK))
+                usleep_range(10, 20);
+        if (!(flexcan_read(&regs->mcr) & FLEXCAN_MCR_LPM_ACK))
+                return -ETIMEDOUT;
+        return 0;
+}
+static int flexcan_chip_freeze(struct flexcan_priv *priv)
+{
+        struct flexcan_regs __iomem *regs = priv->base;
+        unsigned int timeout = 1000 * 1000 * 10 / priv->can.bittiming.bitrate;
+        u32 reg;
+        reg = flexcan_read(&regs->mcr);
+        reg |= FLEXCAN_MCR_HALT;
+        flexcan_write(reg, &regs->mcr);
+        while (timeout-- && !(flexcan_read(&regs->mcr) & FLEXCAN_MCR_FRZ_ACK))
+                usleep_range(100, 200);
+        if (!(flexcan_read(&regs->mcr) & FLEXCAN_MCR_FRZ_ACK))
+                return -ETIMEDOUT;
+        return 0;
+}
+static int flexcan_chip_unfreeze(struct flexcan_priv *priv)
+{
+        struct flexcan_regs __iomem *regs = priv->base;
+        unsigned int timeout = FLEXCAN_TIMEOUT_US / 10;
+        u32 reg;
+        reg = flexcan_read(&regs->mcr);
+        reg &= ~FLEXCAN_MCR_HALT;
+        flexcan_write(reg, &regs->mcr);
+        while (timeout-- && (flexcan_read(&regs->mcr) & FLEXCAN_MCR_FRZ_ACK))
+                usleep_range(10, 20);
+        if (flexcan_read(&regs->mcr) & FLEXCAN_MCR_FRZ_ACK)
+                return -ETIMEDOUT;
+        return 0;
+}
+static int flexcan_chip_softreset(struct flexcan_priv *priv)
+{
+        struct flexcan_regs __iomem *regs = priv->base;
+        unsigned int timeout = FLEXCAN_TIMEOUT_US / 10;
+        flexcan_write(FLEXCAN_MCR_SOFTRST, &regs->mcr);
+        while (timeout-- && (flexcan_read(&regs->mcr) & FLEXCAN_MCR_SOFTRST))
+                usleep_range(10, 20);
+        if (flexcan_read(&regs->mcr) & FLEXCAN_MCR_SOFTRST)
+                return -ETIMEDOUT;
+        return 0;
 }
 static int flexcan_get_berr_counter(const struct net_device *dev,
@@ -706,19 +796,14 @@ static int flexcan_chip_start(struct net_device *dev)
        u32 reg_mcr, reg_ctrl;
        /* enable module */
-        flexcan_chip_enable(priv);
+        err = flexcan_chip_enable(priv);
+        if (err)
+                return err;
        /* soft reset */
-        flexcan_write(FLEXCAN_MCR_SOFTRST, &regs->mcr);
+        err = flexcan_chip_softreset(priv);
-        udelay(10);
+        if (err)
+                goto out_chip_disable;
-        reg_mcr = flexcan_read(&regs->mcr);
-        if (reg_mcr & FLEXCAN_MCR_SOFTRST) {
-                netdev_err(dev, "Failed to softreset can module (mcr=0x%08x)\n",
-                           reg_mcr);
-                err = -ENODEV;
-                goto out;
-        }
        flexcan_set_bittiming(dev);
@@ -785,16 +870,14 @@ static int flexcan_chip_start(struct net_device *dev)
        if (priv->devtype_data->features & FLEXCAN_HAS_V10_FEATURES)
                flexcan_write(0x0, &regs->rxfgmask);
-        if (priv->reg_xceiver)  {
+        err = flexcan_transceiver_enable(priv);
-                err = regulator_enable(priv->reg_xceiver);
+        if (err)
-                if (err)
+                goto out_chip_disable;
-                        goto out;
-        }
        /* synchronize with the can bus */
-        reg_mcr = flexcan_read(&regs->mcr);
+        err = flexcan_chip_unfreeze(priv);
-        reg_mcr &= ~FLEXCAN_MCR_HALT;
+        if (err)
-        flexcan_write(reg_mcr, &regs->mcr);
+                goto out_transceiver_disable;
        priv->can.state = CAN_STATE_ERROR_ACTIVE;
@@ -807,7 +890,9 @@ static int flexcan_chip_start(struct net_device *dev)
        return 0;
- out:
+ out_transceiver_disable:
+        flexcan_transceiver_disable(priv);
+ out_chip_disable:
        flexcan_chip_disable(priv);
        return err;
 }
@@ -822,18 +907,17 @@ static void flexcan_chip_stop(struct net_device *dev)
 {
        struct flexcan_priv *priv = netdev_priv(dev);
        struct flexcan_regs __iomem *regs = priv->base;
-        u32 reg;
+        /* freeze + disable module */
+        flexcan_chip_freeze(priv);
+        flexcan_chip_disable(priv);
        /* Disable all interrupts */
        flexcan_write(0, &regs->imask1);
+        flexcan_write(priv->reg_ctrl_default & ~FLEXCAN_CTRL_ERR_ALL,
+                      &regs->ctrl);
-        /* Disable + halt module */
+        flexcan_transceiver_disable(priv);
-        reg = flexcan_read(&regs->mcr);
-        reg |= FLEXCAN_MCR_MDIS | FLEXCAN_MCR_HALT;
-        flexcan_write(reg, &regs->mcr);
-        if (priv->reg_xceiver)
-                regulator_disable(priv->reg_xceiver);
        priv->can.state = CAN_STATE_STOPPED;
        return;
@@ -863,7 +947,7 @@ static int flexcan_open(struct net_device *dev)
        /* start chip and queuing */
        err = flexcan_chip_start(dev);
        if (err)
-                goto out_close;
+                goto out_free_irq;
        can_led_event(dev, CAN_LED_EVENT_OPEN);
@@ -872,6 +956,8 @@ static int flexcan_open(struct net_device *dev)
        return 0;
+ out_free_irq:
+        free_irq(dev->irq, dev);
 out_close:
        close_candev(dev);
 out_disable_per:
@@ -942,12 +1028,16 @@ static int register_flexcandev(struct net_device *dev)
                goto out_disable_ipg;
        /* select "bus clock", chip must be disabled */
-        flexcan_chip_disable(priv);
+        err = flexcan_chip_disable(priv);
+        if (err)
+                goto out_disable_per;
        reg = flexcan_read(&regs->ctrl);
        reg |= FLEXCAN_CTRL_CLK_SRC;
        flexcan_write(reg, &regs->ctrl);
-        flexcan_chip_enable(priv);
+        err = flexcan_chip_enable(priv);
+        if (err)
+                goto out_chip_disable;
        /* set freeze, halt and activate FIFO, restrict register access */
        reg = flexcan_read(&regs->mcr);
@@ -964,14 +1054,15 @@ static int register_flexcandev(struct net_device *dev)
        if (!(reg & FLEXCAN_MCR_FEN)) {
                netdev_err(dev, "Could not enable RX FIFO, unsupported core\n");
                err = -ENODEV;
-                goto out_disable_per;
+                goto out_chip_disable;
        }
        err = register_candev(dev);
- out_disable_per:
        /* disable core and turn off clocks */
+ out_chip_disable:
        flexcan_chip_disable(priv);
+ out_disable_per:
        clk_disable_unprepare(priv->clk_per);
 out_disable_ipg:
        clk_disable_unprepare(priv->clk_ipg);
@@ -1101,9 +1192,10 @@ static int flexcan_probe(struct platform_device *pdev)
 static int flexcan_remove(struct platform_device *pdev)
 {
        struct net_device *dev = platform_get_drvdata(pdev);
+        struct flexcan_priv *priv = netdev_priv(dev);
        unregister_flexcandev(dev);
+        netif_napi_del(&priv->napi);
        free_candev(dev);
        return 0;
@@ -1114,8 +1206,11 @@ static int flexcan_suspend(struct device *device)
 {
        struct net_device *dev = dev_get_drvdata(device);
        struct flexcan_priv *priv = netdev_priv(dev);
+        int err;
-        flexcan_chip_disable(priv);
+        err = flexcan_chip_disable(priv);
+        if (err)
+                return err;
        if (netif_running(dev)) {
                netif_stop_queue(dev);
@@ -1136,9 +1231,7 @@ static int flexcan_resume(struct device *device)
                netif_device_attach(dev);
                netif_start_queue(dev);
        }
-        flexcan_chip_enable(priv);
+        return flexcan_chip_enable(priv);
-        return 0;
 }
 #endif /* CONFIG_PM_SLEEP */
diff --git a/drivers/net/can/janz-ican3.c b/drivers/net/can/janz-ican3.c
index e24e6690d672..71594e5676fd 100644
--- a/drivers/net/can/janz-ican3.c
+++ b/drivers/net/can/janz-ican3.c
@@ -18,6 +18,7 @@
 #include <linux/netdevice.h>
 #include <linux/can.h>
 #include <linux/can/dev.h>
+#include <linux/can/skb.h>
 #include <linux/can/error.h>
 #include <linux/mfd/janz.h>
@@ -1133,20 +1134,9 @@ static void ican3_handle_message(struct ican3_dev *mod, struct ican3_msg *msg)
 */
 static void ican3_put_echo_skb(struct ican3_dev *mod, struct sk_buff *skb)
 {
-        struct sock *srcsk = skb->sk;
+        skb = can_create_echo_skb(skb);
+        if (!skb)
-        if (atomic_read(&skb->users) != 1) {
+                return;
-                struct sk_buff *old_skb = skb;
-                skb = skb_clone(old_skb, GFP_ATOMIC);
-                kfree_skb(old_skb);
-                if (!skb)
-                        return;
-        } else {
-                skb_orphan(skb);
-        }
-        skb->sk = srcsk;
        /* save this skb for tx interrupt echo handling */
        skb_queue_tail(&mod->echoq, skb);
@@ -1322,7 +1312,7 @@ static int ican3_napi(struct napi_struct *napi, int budget)
        /* process all communication messages */
        while (true) {
-                struct ican3_msg msg;
+                struct ican3_msg uninitialized_var(msg);
                ret = ican3_recv_msg(mod, &msg);
                if (ret)
                        break;
diff --git a/drivers/net/can/usb/kvaser_usb.c b/drivers/net/can/usb/kvaser_usb.c
index 6c859bba8b65..e77d11049747 100644
--- a/drivers/net/can/usb/kvaser_usb.c
+++ b/drivers/net/can/usb/kvaser_usb.c
@@ -473,6 +473,8 @@ static int kvaser_usb_get_card_info(struct kvaser_usb *dev)
                return err;
        dev->nchannels = msg.u.cardinfo.nchannels;
+        if (dev->nchannels > MAX_NET_DEVICES)
+                return -EINVAL;
        return 0;
 }
diff --git a/drivers/net/can/vcan.c b/drivers/net/can/vcan.c
index 0a2a5ee79a17..4e94057ef5cf 100644
--- a/drivers/net/can/vcan.c
+++ b/drivers/net/can/vcan.c
@@ -46,6 +46,7 @@
 #include <linux/if_ether.h>
 #include <linux/can.h>
 #include <linux/can/dev.h>
+#include <linux/can/skb.h>
 #include <linux/slab.h>
 #include <net/rtnetlink.h>
@@ -109,25 +110,23 @@ static netdev_tx_t vcan_tx(struct sk_buff *skb, struct net_device *dev)
                        stats->rx_packets++;
                        stats->rx_bytes += cfd->len;
                }
-                kfree_skb(skb);
+                consume_skb(skb);
                return NETDEV_TX_OK;
        }
        /* perform standard echo handling for CAN network interfaces */
        if (loop) {
-                struct sock *srcsk = skb->sk;
-                skb = skb_share_check(skb, GFP_ATOMIC);
+                skb = can_create_echo_skb(skb);
                if (!skb)
                        return NETDEV_TX_OK;
                /* receive with packet counting */
-                skb->sk = srcsk;
                vcan_rx(skb, dev);
        } else {
                /* no looped packets => no counting */
-                kfree_skb(skb);
+                consume_skb(skb);
        }
        return NETDEV_TX_OK;
 }
diff --git a/drivers/net/ethernet/3com/3c59x.c b/drivers/net/ethernet/3com/3c59x.c
index 0f4241c6e97e..238ccea965c8 100644
--- a/drivers/net/ethernet/3com/3c59x.c
+++ b/drivers/net/ethernet/3com/3c59x.c
@@ -3294,7 +3294,6 @@ static int __init vortex_init(void)
 static void __exit vortex_eisa_cleanup(void)
 {
-        struct vortex_private *vp;
        void __iomem *ioaddr;
 #ifdef CONFIG_EISA
@@ -3303,7 +3302,6 @@ static void __exit vortex_eisa_cleanup(void)
 #endif
        if (compaq_net_device) {
-                vp = netdev_priv(compaq_net_device);
                ioaddr = ioport_map(compaq_net_device->base_addr,
                                    VORTEX_TOTAL_SIZE);
diff --git a/drivers/net/ethernet/allwinner/sun4i-emac.c b/drivers/net/ethernet/allwinner/sun4i-emac.c
index 0cc21437478c..511f6eecd58b 100644
--- a/drivers/net/ethernet/allwinner/sun4i-emac.c
+++ b/drivers/net/ethernet/allwinner/sun4i-emac.c
@@ -929,6 +929,9 @@ static int emac_resume(struct platform_device *dev)
 }
 static const struct of_device_id emac_of_match[] = {
+        {.compatible = "allwinner,sun4i-a10-emac",},
+        /* Deprecated */
        {.compatible = "allwinner,sun4i-emac",},
        {},
 };
diff --git a/drivers/net/ethernet/atheros/alx/main.c b/drivers/net/ethernet/atheros/alx/main.c
index e92ffd6e1c15..380d24922049 100644
--- a/drivers/net/ethernet/atheros/alx/main.c
+++ b/drivers/net/ethernet/atheros/alx/main.c
@@ -1248,19 +1248,13 @@ static int alx_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         * shared register for the high 32 bits, so only a single, aligned,
         * 4 GB physical address range can be used for descriptors.
         */
-        if (!dma_set_mask(&pdev->dev, DMA_BIT_MASK(64)) &&
+        if (!dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(64))) {
-            !dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(64))) {
                dev_dbg(&pdev->dev, "DMA to 64-BIT addresses\n");
        } else {
-                err = dma_set_mask(&pdev->dev, DMA_BIT_MASK(32));
+                err = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(32));
                if (err) {
-                        err = dma_set_coherent_mask(&pdev->dev,
+                        dev_err(&pdev->dev, "No usable DMA config, aborting\n");
-                                                    DMA_BIT_MASK(32));
+                        goto out_pci_disable;
-                        if (err) {
-                                dev_err(&pdev->dev,
-                                        "No usable DMA config, aborting\n");
-                                goto out_pci_disable;
-                        }
                }
        }
@@ -1292,6 +1286,7 @@ static int alx_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
        alx = netdev_priv(netdev);
        spin_lock_init(&alx->hw.mdio_lock);
        spin_lock_init(&alx->irq_lock);
+        spin_lock_init(&alx->stats_lock);
        alx->dev = netdev;
        alx->hw.pdev = pdev;
        alx->msg_enable = NETIF_MSG_LINK | NETIF_MSG_HW | NETIF_MSG_IFUP |
diff --git a/drivers/net/ethernet/atheros/atl1e/atl1e_main.c b/drivers/net/ethernet/atheros/atl1e/atl1e_main.c
index d5c2d3e912e5..422aab27ea1b 100644
--- a/drivers/net/ethernet/atheros/atl1e/atl1e_main.c
+++ b/drivers/net/ethernet/atheros/atl1e/atl1e_main.c
@@ -2436,7 +2436,7 @@ err_reset:
 err_register:
 err_sw_init:
 err_eeprom:
-        iounmap(adapter->hw.hw_addr);
+        pci_iounmap(pdev, adapter->hw.hw_addr);
 err_init_netdev:
 err_ioremap:
        free_netdev(netdev);
@@ -2474,7 +2474,7 @@ static void atl1e_remove(struct pci_dev *pdev)
        unregister_netdev(netdev);
        atl1e_free_ring_resources(adapter);
        atl1e_force_ps(&adapter->hw);
-        iounmap(adapter->hw.hw_addr);
+        pci_iounmap(pdev, adapter->hw.hw_addr);
        pci_release_regions(pdev);
        free_netdev(netdev);
        pci_disable_device(pdev);
diff --git a/drivers/net/ethernet/broadcom/b44.c b/drivers/net/ethernet/broadcom/b44.c
index 1f7b5aa114fa..8a7bf7dad898 100644
--- a/drivers/net/ethernet/broadcom/b44.c
+++ b/drivers/net/ethernet/broadcom/b44.c
@@ -1484,6 +1484,10 @@ static int b44_open(struct net_device *dev)
        add_timer(&bp->timer);
        b44_enable_ints(bp);
+        if (bp->flags & B44_FLAG_EXTERNAL_PHY)
+                phy_start(bp->phydev);
        netif_start_queue(dev);
 out:
        return err;
@@ -1646,6 +1650,9 @@ static int b44_close(struct net_device *dev)
        netif_stop_queue(dev);
+        if (bp->flags & B44_FLAG_EXTERNAL_PHY)
+                phy_stop(bp->phydev);
        napi_disable(&bp->napi);
        del_timer_sync(&bp->timer);
@@ -2222,7 +2229,12 @@ static void b44_adjust_link(struct net_device *dev)
        }
        if (status_changed) {
-                b44_check_phy(bp);
+                u32 val = br32(bp, B44_TX_CTRL);
+                if (bp->flags & B44_FLAG_FULL_DUPLEX)
+                        val |= TX_CTRL_DUPLEX;
+                else
+                        val &= ~TX_CTRL_DUPLEX;
+                bw32(bp, B44_TX_CTRL, val);
                phy_print_status(phydev);
        }
 }
diff --git a/drivers/net/ethernet/broadcom/bnx2.c b/drivers/net/ethernet/broadcom/bnx2.c
index 9d2dedadf2df..6c9e1c9bdeb8 100644
--- a/drivers/net/ethernet/broadcom/bnx2.c
+++ b/drivers/net/ethernet/broadcom/bnx2.c
@@ -85,7 +85,7 @@ MODULE_FIRMWARE(FW_RV2P_FILE_09_Ax);
 static int disable_msi = 0;
-module_param(disable_msi, int, 0);
+module_param(disable_msi, int, S_IRUGO);
 MODULE_PARM_DESC(disable_msi, "Disable Message Signaled Interrupt (MSI)");
 typedef enum {
@@ -2507,6 +2507,7 @@ bnx2_fw_sync(struct bnx2 *bp, u32 msg_data, int ack, int silent)
        bp->fw_wr_seq++;
        msg_data |= bp->fw_wr_seq;
+        bp->fw_last_msg = msg_data;
        bnx2_shmem_wr(bp, BNX2_DRV_MB, msg_data);
@@ -4000,8 +4001,23 @@ bnx2_setup_wol(struct bnx2 *bp)
                        wol_msg = BNX2_DRV_MSG_CODE_SUSPEND_NO_WOL;
        }
-        if (!(bp->flags & BNX2_FLAG_NO_WOL))
+        if (!(bp->flags & BNX2_FLAG_NO_WOL)) {
-                bnx2_fw_sync(bp, BNX2_DRV_MSG_DATA_WAIT3 | wol_msg, 1, 0);
+                u32 val;
+                wol_msg |= BNX2_DRV_MSG_DATA_WAIT3;
+                if (bp->fw_last_msg || BNX2_CHIP(bp) != BNX2_CHIP_5709) {
+                        bnx2_fw_sync(bp, wol_msg, 1, 0);
+                        return;
+                }
+                /* Tell firmware not to power down the PHY yet, otherwise
+                 * the chip will take a long time to respond to MMIO reads.
+                 */
+                val = bnx2_shmem_rd(bp, BNX2_PORT_FEATURE);
+                bnx2_shmem_wr(bp, BNX2_PORT_FEATURE,
+                              val | BNX2_PORT_FEATURE_ASF_ENABLED);
+                bnx2_fw_sync(bp, wol_msg, 1, 0);
+                bnx2_shmem_wr(bp, BNX2_PORT_FEATURE, val);
+        }
 }
@@ -4033,9 +4049,22 @@ bnx2_set_power_state(struct bnx2 *bp, pci_power_t state)
                        if (bp->wol)
                                pci_set_power_state(bp->pdev, PCI_D3hot);
-                } else {
+                        break;
-                        pci_set_power_state(bp->pdev, PCI_D3hot);
+                }
+                if (!bp->fw_last_msg && BNX2_CHIP(bp) == BNX2_CHIP_5709) {
+                        u32 val;
+                        /* Tell firmware not to power down the PHY yet,
+                         * otherwise the other port may not respond to
+                         * MMIO reads.
+                         */
+                        val = bnx2_shmem_rd(bp, BNX2_BC_STATE_CONDITION);
+                        val &= ~BNX2_CONDITION_PM_STATE_MASK;
+                        val |= BNX2_CONDITION_PM_STATE_UNPREP;
+                        bnx2_shmem_wr(bp, BNX2_BC_STATE_CONDITION, val);
                }
+                pci_set_power_state(bp->pdev, PCI_D3hot);
                /* No more memory access after this point until
                 * device is brought back to D0.
diff --git a/drivers/net/ethernet/broadcom/bnx2.h b/drivers/net/ethernet/broadcom/bnx2.h
index f1cf2c44e7ed..e341bc366fa5 100644
--- a/drivers/net/ethernet/broadcom/bnx2.h
+++ b/drivers/net/ethernet/broadcom/bnx2.h
@@ -6900,6 +6900,7 @@ struct bnx2 {
        u16                     fw_wr_seq;
        u16                     fw_drv_pulse_wr_seq;
+        u32                     fw_last_msg;
        int                     rx_max_ring;
        int                     rx_ring_size;
@@ -7406,6 +7407,10 @@ struct bnx2_rv2p_fw_file {
 #define BNX2_CONDITION_MFW_RUN_NCSI              0x00006000
 #define BNX2_CONDITION_MFW_RUN_NONE              0x0000e000
 #define BNX2_CONDITION_MFW_RUN_MASK              0x0000e000
+#define BNX2_CONDITION_PM_STATE_MASK             0x00030000
+#define BNX2_CONDITION_PM_STATE_FULL             0x00030000
+#define BNX2_CONDITION_PM_STATE_PREP             0x00020000
+#define BNX2_CONDITION_PM_STATE_UNPREP           0x00010000
 #define BNX2_BC_STATE_DEBUG_CMD                 0x1dc
 #define BNX2_BC_STATE_BC_DBG_CMD_SIGNATURE       0x42440000
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
index 9d7419e0390b..dbcff509dc3f 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
@@ -1873,7 +1873,7 @@ void bnx2x_netif_stop(struct bnx2x *bp, int disable_hw)
 }
 u16 bnx2x_select_queue(struct net_device *dev, struct sk_buff *skb,
-                       void *accel_priv)
+                       void *accel_priv, select_queue_fallback_t fallback)
 {
        struct bnx2x *bp = netdev_priv(dev);
@@ -1895,7 +1895,7 @@ u16 bnx2x_select_queue(struct net_device *dev, struct sk_buff *skb,
        }
        /* select a non-FCoE queue */
-        return __netdev_pick_tx(dev, skb) % BNX2X_NUM_ETH_QUEUES(bp);
+        return fallback(dev, skb) % BNX2X_NUM_ETH_QUEUES(bp);
 }
 void bnx2x_set_num_queues(struct bnx2x *bp)
@@ -3875,7 +3875,9 @@ netdev_tx_t bnx2x_start_xmit(struct sk_buff *skb, struct net_device *dev)
                                                     xmit_type);
                }
-                /* Add the macs to the parsing BD this is a vf */
+                /* Add the macs to the parsing BD if this is a vf or if
+                 * Tx Switching is enabled.
+                 */
                if (IS_VF(bp)) {
                        /* override GRE parameters in BD */
                        bnx2x_set_fw_mac_addr(&pbd_e2->data.mac_addr.src_hi,
@@ -3887,6 +3889,11 @@ netdev_tx_t bnx2x_start_xmit(struct sk_buff *skb, struct net_device *dev)
                                              &pbd_e2->data.mac_addr.dst_mid,
                                              &pbd_e2->data.mac_addr.dst_lo,
                                              eth->h_dest);
+                } else if (bp->flags & TX_SWITCHING) {
+                        bnx2x_set_fw_mac_addr(&pbd_e2->data.mac_addr.dst_hi,
+                                              &pbd_e2->data.mac_addr.dst_mid,
+                                              &pbd_e2->data.mac_addr.dst_lo,
+                                              eth->h_dest);
                }
                SET_FLAG(pbd_e2_parsing_data,
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h
index 17d1689aec6b..a89a40f88c25 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h
@@ -496,7 +496,7 @@ int bnx2x_set_vf_vlan(struct net_device *netdev, int vf, u16 vlan, u8 qos);
 /* select_queue callback */
 u16 bnx2x_select_queue(struct net_device *dev, struct sk_buff *skb,
-                       void *accel_priv);
+                       void *accel_priv, select_queue_fallback_t fallback);
 static inline void bnx2x_update_rx_prod(struct bnx2x *bp,
                                        struct bnx2x_fastpath *fp,
@@ -936,7 +936,7 @@ static inline int bnx2x_func_start(struct bnx2x *bp)
        else /* CHIP_IS_E1X */
                start_params->network_cos_mode = FW_WRR;
-        start_params->gre_tunnel_mode = IPGRE_TUNNEL;
+        start_params->gre_tunnel_mode = L2GRE_TUNNEL;
        start_params->gre_tunnel_rss = GRE_INNER_HEADERS_RSS;
        return bnx2x_func_state_change(bp, &func_params);
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index c9c445e7b4a5..7d4382286457 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -95,29 +95,29 @@ MODULE_FIRMWARE(FW_FILE_NAME_E1H);
 MODULE_FIRMWARE(FW_FILE_NAME_E2);
 int bnx2x_num_queues;
-module_param_named(num_queues, bnx2x_num_queues, int, 0);
+module_param_named(num_queues, bnx2x_num_queues, int, S_IRUGO);
 MODULE_PARM_DESC(num_queues,
                 " Set number of queues (default is as a number of CPUs)");
 static int disable_tpa;
-module_param(disable_tpa, int, 0);
+module_param(disable_tpa, int, S_IRUGO);
 MODULE_PARM_DESC(disable_tpa, " Disable the TPA (LRO) feature");
 static int int_mode;
-module_param(int_mode, int, 0);
+module_param(int_mode, int, S_IRUGO);
 MODULE_PARM_DESC(int_mode, " Force interrupt mode other than MSI-X "
                                "(1 INT#x; 2 MSI)");
 static int dropless_fc;
-module_param(dropless_fc, int, 0);
+module_param(dropless_fc, int, S_IRUGO);
 MODULE_PARM_DESC(dropless_fc, " Pause on exhausted host ring");
 static int mrrs = -1;
-module_param(mrrs, int, 0);
+module_param(mrrs, int, S_IRUGO);
 MODULE_PARM_DESC(mrrs, " Force Max Read Req Size (0..3) (for debug)");
 static int debug;
-module_param(debug, int, 0);
+module_param(debug, int, S_IRUGO);
 MODULE_PARM_DESC(debug, " Default debug msglevel");
 struct workqueue_struct *bnx2x_wq;
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
index aec5ef2ed7ce..e42f48df6e94 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
@@ -1446,12 +1446,12 @@ static void bnx2x_vf_igu_reset(struct bnx2x *bp, struct bnx2x_virtf *vf)
        if (vf->cfg_flags & VF_CFG_INT_SIMD)
                val |= IGU_VF_CONF_SINGLE_ISR_EN;
        val &= ~IGU_VF_CONF_PARENT_MASK;
-        val |= BP_FUNC(bp) << IGU_VF_CONF_PARENT_SHIFT; /* parent PF */
+        val |= (BP_ABS_FUNC(bp) >> 1) << IGU_VF_CONF_PARENT_SHIFT;
        REG_WR(bp, IGU_REG_VF_CONFIGURATION, val);
        DP(BNX2X_MSG_IOV,
-           "value in IGU_REG_VF_CONFIGURATION of vf %d after write %x\n",
+           "value in IGU_REG_VF_CONFIGURATION of vf %d after write is 0x%08x\n",
-           vf->abs_vfid, REG_RD(bp, IGU_REG_VF_CONFIGURATION));
+           vf->abs_vfid, val);
        bnx2x_pretend_func(bp, BP_ABS_FUNC(bp));
diff --git a/drivers/net/ethernet/broadcom/cnic.c b/drivers/net/ethernet/broadcom/cnic.c
index fcf9105a5476..09f3fefcbf9c 100644
--- a/drivers/net/ethernet/broadcom/cnic.c
+++ b/drivers/net/ethernet/broadcom/cnic.c
@@ -1,6 +1,6 @@
 /* cnic.c: Broadcom CNIC core network driver.
 *
- * Copyright (c) 2006-2013 Broadcom Corporation
+ * Copyright (c) 2006-2014 Broadcom Corporation
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
@@ -342,7 +342,7 @@ static int cnic_send_nlmsg(struct cnic_local *cp, u32 type,
        while (retry < 3) {
                rc = 0;
                rcu_read_lock();
-                ulp_ops = rcu_dereference(cnic_ulp_tbl[CNIC_ULP_ISCSI]);
+                ulp_ops = rcu_dereference(cp->ulp_ops[CNIC_ULP_ISCSI]);
                if (ulp_ops)
                        rc = ulp_ops->iscsi_nl_send_msg(
                                cp->ulp_handle[CNIC_ULP_ISCSI],
@@ -726,7 +726,7 @@ static void cnic_free_dma(struct cnic_dev *dev, struct cnic_dma *dma)
        for (i = 0; i < dma->num_pages; i++) {
                if (dma->pg_arr[i]) {
-                        dma_free_coherent(&dev->pcidev->dev, BNX2_PAGE_SIZE,
+                        dma_free_coherent(&dev->pcidev->dev, CNIC_PAGE_SIZE,
                                          dma->pg_arr[i], dma->pg_map_arr[i]);
                        dma->pg_arr[i] = NULL;
                }
@@ -785,7 +785,7 @@ static int cnic_alloc_dma(struct cnic_dev *dev, struct cnic_dma *dma,
        for (i = 0; i < pages; i++) {
                dma->pg_arr[i] = dma_alloc_coherent(&dev->pcidev->dev,
-                                                    BNX2_PAGE_SIZE,
+                                                    CNIC_PAGE_SIZE,
                                                    &dma->pg_map_arr[i],
                                                    GFP_ATOMIC);
                if (dma->pg_arr[i] == NULL)
@@ -794,8 +794,8 @@ static int cnic_alloc_dma(struct cnic_dev *dev, struct cnic_dma *dma,
        if (!use_pg_tbl)
                return 0;
-        dma->pgtbl_size = ((pages * 8) + BNX2_PAGE_SIZE - 1) &
+        dma->pgtbl_size = ((pages * 8) + CNIC_PAGE_SIZE - 1) &
-                          ~(BNX2_PAGE_SIZE - 1);
+                          ~(CNIC_PAGE_SIZE - 1);
        dma->pgtbl = dma_alloc_coherent(&dev->pcidev->dev, dma->pgtbl_size,
                                        &dma->pgtbl_map, GFP_ATOMIC);
        if (dma->pgtbl == NULL)
@@ -900,8 +900,8 @@ static int cnic_alloc_context(struct cnic_dev *dev)
        if (BNX2_CHIP(cp) == BNX2_CHIP_5709) {
                int i, k, arr_size;
-                cp->ctx_blk_size = BNX2_PAGE_SIZE;
+                cp->ctx_blk_size = CNIC_PAGE_SIZE;
-                cp->cids_per_blk = BNX2_PAGE_SIZE / 128;
+                cp->cids_per_blk = CNIC_PAGE_SIZE / 128;
                arr_size = BNX2_MAX_CID / cp->cids_per_blk *
                           sizeof(struct cnic_ctx);
                cp->ctx_arr = kzalloc(arr_size, GFP_KERNEL);
@@ -933,7 +933,7 @@ static int cnic_alloc_context(struct cnic_dev *dev)
                for (i = 0; i < cp->ctx_blks; i++) {
                        cp->ctx_arr[i].ctx =
                                dma_alloc_coherent(&dev->pcidev->dev,
-                                                   BNX2_PAGE_SIZE,
+                                                   CNIC_PAGE_SIZE,
                                                   &cp->ctx_arr[i].mapping,
                                                   GFP_KERNEL);
                        if (cp->ctx_arr[i].ctx == NULL)
@@ -1013,7 +1013,7 @@ static int __cnic_alloc_uio_rings(struct cnic_uio_dev *udev, int pages)
        if (udev->l2_ring)
                return 0;
-        udev->l2_ring_size = pages * BNX2_PAGE_SIZE;
+        udev->l2_ring_size = pages * CNIC_PAGE_SIZE;
        udev->l2_ring = dma_alloc_coherent(&udev->pdev->dev, udev->l2_ring_size,
                                           &udev->l2_ring_map,
                                           GFP_KERNEL | __GFP_COMP);
@@ -1021,7 +1021,7 @@ static int __cnic_alloc_uio_rings(struct cnic_uio_dev *udev, int pages)
                return -ENOMEM;
        udev->l2_buf_size = (cp->l2_rx_ring_size + 1) * cp->l2_single_buf_size;
-        udev->l2_buf_size = PAGE_ALIGN(udev->l2_buf_size);
+        udev->l2_buf_size = CNIC_PAGE_ALIGN(udev->l2_buf_size);
        udev->l2_buf = dma_alloc_coherent(&udev->pdev->dev, udev->l2_buf_size,
                                          &udev->l2_buf_map,
                                          GFP_KERNEL | __GFP_COMP);
@@ -1102,7 +1102,7 @@ static int cnic_init_uio(struct cnic_dev *dev)
                uinfo->mem[0].size = MB_GET_CID_ADDR(TX_TSS_CID +
                                                     TX_MAX_TSS_RINGS + 1);
                uinfo->mem[1].addr = (unsigned long) cp->status_blk.gen &
-                                        PAGE_MASK;
+                                        CNIC_PAGE_MASK;
                if (cp->ethdev->drv_state & CNIC_DRV_STATE_USING_MSIX)
                        uinfo->mem[1].size = BNX2_SBLK_MSIX_ALIGN_SIZE * 9;
                else
@@ -1113,7 +1113,7 @@ static int cnic_init_uio(struct cnic_dev *dev)
                uinfo->mem[0].size = pci_resource_len(dev->pcidev, 0);
                uinfo->mem[1].addr = (unsigned long) cp->bnx2x_def_status_blk &
-                        PAGE_MASK;
+                        CNIC_PAGE_MASK;
                uinfo->mem[1].size = sizeof(*cp->bnx2x_def_status_blk);
                uinfo->name = "bnx2x_cnic";
@@ -1267,14 +1267,14 @@ static int cnic_alloc_bnx2x_resc(struct cnic_dev *dev)
        for (i = MAX_ISCSI_TBL_SZ; i < cp->max_cid_space; i++)
                cp->ctx_tbl[i].ulp_proto_id = CNIC_ULP_FCOE;
-        pages = PAGE_ALIGN(cp->max_cid_space * CNIC_KWQ16_DATA_SIZE) /
+        pages = CNIC_PAGE_ALIGN(cp->max_cid_space * CNIC_KWQ16_DATA_SIZE) /
-                PAGE_SIZE;
+                CNIC_PAGE_SIZE;
        ret = cnic_alloc_dma(dev, kwq_16_dma, pages, 0);
        if (ret)
                return -ENOMEM;
-        n = PAGE_SIZE / CNIC_KWQ16_DATA_SIZE;
+        n = CNIC_PAGE_SIZE / CNIC_KWQ16_DATA_SIZE;
        for (i = 0, j = 0; i < cp->max_cid_space; i++) {
                long off = CNIC_KWQ16_DATA_SIZE * (i % n);
@@ -1296,7 +1296,7 @@ static int cnic_alloc_bnx2x_resc(struct cnic_dev *dev)
                        goto error;
        }
-        pages = PAGE_ALIGN(BNX2X_ISCSI_GLB_BUF_SIZE) / PAGE_SIZE;
+        pages = CNIC_PAGE_ALIGN(BNX2X_ISCSI_GLB_BUF_SIZE) / CNIC_PAGE_SIZE;
        ret = cnic_alloc_dma(dev, &cp->gbl_buf_info, pages, 0);
        if (ret)
                goto error;
@@ -1466,8 +1466,8 @@ static int cnic_bnx2x_iscsi_init1(struct cnic_dev *dev, struct kwqe *kwqe)
        cp->r2tq_size = cp->num_iscsi_tasks * BNX2X_ISCSI_MAX_PENDING_R2TS *
                        BNX2X_ISCSI_R2TQE_SIZE;
        cp->hq_size = cp->num_ccells * BNX2X_ISCSI_HQ_BD_SIZE;
-        pages = PAGE_ALIGN(cp->hq_size) / PAGE_SIZE;
+        pages = CNIC_PAGE_ALIGN(cp->hq_size) / CNIC_PAGE_SIZE;
-        hq_bds = pages * (PAGE_SIZE / BNX2X_ISCSI_HQ_BD_SIZE);
+        hq_bds = pages * (CNIC_PAGE_SIZE / BNX2X_ISCSI_HQ_BD_SIZE);
        cp->num_cqs = req1->num_cqs;
        if (!dev->max_iscsi_conn)
@@ -1477,9 +1477,9 @@ static int cnic_bnx2x_iscsi_init1(struct cnic_dev *dev, struct kwqe *kwqe)
        CNIC_WR16(dev, BAR_TSTRORM_INTMEM + TSTORM_ISCSI_RQ_SIZE_OFFSET(pfid),
                  req1->rq_num_wqes);
        CNIC_WR16(dev, BAR_TSTRORM_INTMEM + TSTORM_ISCSI_PAGE_SIZE_OFFSET(pfid),
-                  PAGE_SIZE);
+                  CNIC_PAGE_SIZE);
        CNIC_WR8(dev, BAR_TSTRORM_INTMEM +
-                 TSTORM_ISCSI_PAGE_SIZE_LOG_OFFSET(pfid), PAGE_SHIFT);
+                 TSTORM_ISCSI_PAGE_SIZE_LOG_OFFSET(pfid), CNIC_PAGE_BITS);
        CNIC_WR16(dev, BAR_TSTRORM_INTMEM +
                  TSTORM_ISCSI_NUM_OF_TASKS_OFFSET(pfid),
                  req1->num_tasks_per_conn);
@@ -1489,9 +1489,9 @@ static int cnic_bnx2x_iscsi_init1(struct cnic_dev *dev, struct kwqe *kwqe)
                  USTORM_ISCSI_RQ_BUFFER_SIZE_OFFSET(pfid),
                  req1->rq_buffer_size);
        CNIC_WR16(dev, BAR_USTRORM_INTMEM + USTORM_ISCSI_PAGE_SIZE_OFFSET(pfid),
-                  PAGE_SIZE);
+                  CNIC_PAGE_SIZE);
        CNIC_WR8(dev, BAR_USTRORM_INTMEM +
-                 USTORM_ISCSI_PAGE_SIZE_LOG_OFFSET(pfid), PAGE_SHIFT);
+                 USTORM_ISCSI_PAGE_SIZE_LOG_OFFSET(pfid), CNIC_PAGE_BITS);
        CNIC_WR16(dev, BAR_USTRORM_INTMEM +
                  USTORM_ISCSI_NUM_OF_TASKS_OFFSET(pfid),
                  req1->num_tasks_per_conn);
@@ -1504,9 +1504,9 @@ static int cnic_bnx2x_iscsi_init1(struct cnic_dev *dev, struct kwqe *kwqe)
        /* init Xstorm RAM */
        CNIC_WR16(dev, BAR_XSTRORM_INTMEM + XSTORM_ISCSI_PAGE_SIZE_OFFSET(pfid),
-                  PAGE_SIZE);
+                  CNIC_PAGE_SIZE);
        CNIC_WR8(dev, BAR_XSTRORM_INTMEM +
-                 XSTORM_ISCSI_PAGE_SIZE_LOG_OFFSET(pfid), PAGE_SHIFT);
+                 XSTORM_ISCSI_PAGE_SIZE_LOG_OFFSET(pfid), CNIC_PAGE_BITS);
        CNIC_WR16(dev, BAR_XSTRORM_INTMEM +
                  XSTORM_ISCSI_NUM_OF_TASKS_OFFSET(pfid),
                  req1->num_tasks_per_conn);
@@ -1519,9 +1519,9 @@ static int cnic_bnx2x_iscsi_init1(struct cnic_dev *dev, struct kwqe *kwqe)
        /* init Cstorm RAM */
        CNIC_WR16(dev, BAR_CSTRORM_INTMEM + CSTORM_ISCSI_PAGE_SIZE_OFFSET(pfid),
-                  PAGE_SIZE);
+                  CNIC_PAGE_SIZE);
        CNIC_WR8(dev, BAR_CSTRORM_INTMEM +
-                 CSTORM_ISCSI_PAGE_SIZE_LOG_OFFSET(pfid), PAGE_SHIFT);
+                 CSTORM_ISCSI_PAGE_SIZE_LOG_OFFSET(pfid), CNIC_PAGE_BITS);
        CNIC_WR16(dev, BAR_CSTRORM_INTMEM +
                  CSTORM_ISCSI_NUM_OF_TASKS_OFFSET(pfid),
                  req1->num_tasks_per_conn);
@@ -1623,18 +1623,18 @@ static int cnic_alloc_bnx2x_conn_resc(struct cnic_dev *dev, u32 l5_cid)
        }
        ctx->cid = cid;
-        pages = PAGE_ALIGN(cp->task_array_size) / PAGE_SIZE;
+        pages = CNIC_PAGE_ALIGN(cp->task_array_size) / CNIC_PAGE_SIZE;
        ret = cnic_alloc_dma(dev, &iscsi->task_array_info, pages, 1);
        if (ret)
                goto error;
-        pages = PAGE_ALIGN(cp->r2tq_size) / PAGE_SIZE;
+        pages = CNIC_PAGE_ALIGN(cp->r2tq_size) / CNIC_PAGE_SIZE;
        ret = cnic_alloc_dma(dev, &iscsi->r2tq_info, pages, 1);
        if (ret)
                goto error;
-        pages = PAGE_ALIGN(cp->hq_size) / PAGE_SIZE;
+        pages = CNIC_PAGE_ALIGN(cp->hq_size) / CNIC_PAGE_SIZE;
        ret = cnic_alloc_dma(dev, &iscsi->hq_info, pages, 1);
        if (ret)
                goto error;
@@ -1760,7 +1760,7 @@ static int cnic_setup_bnx2x_ctx(struct cnic_dev *dev, struct kwqe *wqes[],
        ictx->tstorm_st_context.iscsi.hdr_bytes_2_fetch = ISCSI_HEADER_SIZE;
        /* TSTORM requires the base address of RQ DB & not PTE */
        ictx->tstorm_st_context.iscsi.rq_db_phy_addr.lo =
-                req2->rq_page_table_addr_lo & PAGE_MASK;
+                req2->rq_page_table_addr_lo & CNIC_PAGE_MASK;
        ictx->tstorm_st_context.iscsi.rq_db_phy_addr.hi =
                req2->rq_page_table_addr_hi;
        ictx->tstorm_st_context.iscsi.iscsi_conn_id = req1->iscsi_conn_id;
@@ -1842,7 +1842,7 @@ static int cnic_setup_bnx2x_ctx(struct cnic_dev *dev, struct kwqe *wqes[],
        /* CSTORM and USTORM initialization is different, CSTORM requires
         * CQ DB base & not PTE addr */
        ictx->cstorm_st_context.cq_db_base.lo =
-                req1->cq_page_table_addr_lo & PAGE_MASK;
+                req1->cq_page_table_addr_lo & CNIC_PAGE_MASK;
        ictx->cstorm_st_context.cq_db_base.hi = req1->cq_page_table_addr_hi;
        ictx->cstorm_st_context.iscsi_conn_id = req1->iscsi_conn_id;
        ictx->cstorm_st_context.cq_proc_en_bit_map = (1 << cp->num_cqs) - 1;
@@ -2911,7 +2911,7 @@ static int cnic_l2_completion(struct cnic_local *cp)
        u16 hw_cons, sw_cons;
        struct cnic_uio_dev *udev = cp->udev;
        union eth_rx_cqe *cqe, *cqe_ring = (union eth_rx_cqe *)
-                                        (udev->l2_ring + (2 * BNX2_PAGE_SIZE));
+                                        (udev->l2_ring + (2 * CNIC_PAGE_SIZE));
        u32 cmd;
        int comp = 0;
@@ -3244,7 +3244,8 @@ static int cnic_copy_ulp_stats(struct cnic_dev *dev, int ulp_type)
        int rc;
        mutex_lock(&cnic_lock);
-        ulp_ops = cnic_ulp_tbl_prot(ulp_type);
+        ulp_ops = rcu_dereference_protected(cp->ulp_ops[ulp_type],
+                                            lockdep_is_held(&cnic_lock));
        if (ulp_ops && ulp_ops->cnic_get_stats)
                rc = ulp_ops->cnic_get_stats(cp->ulp_handle[ulp_type]);
        else
@@ -4384,7 +4385,7 @@ static int cnic_setup_5709_context(struct cnic_dev *dev, int valid)
                u32 idx = cp->ctx_arr[i].cid / cp->cids_per_blk;
                u32 val;
-                memset(cp->ctx_arr[i].ctx, 0, BNX2_PAGE_SIZE);
+                memset(cp->ctx_arr[i].ctx, 0, CNIC_PAGE_SIZE);
                CNIC_WR(dev, BNX2_CTX_HOST_PAGE_TBL_DATA0,
                        (cp->ctx_arr[i].mapping & 0xffffffff) | valid_bit);
@@ -4628,7 +4629,7 @@ static void cnic_init_bnx2_rx_ring(struct cnic_dev *dev)
                val = BNX2_L2CTX_L2_STATUSB_NUM(sb_id);
        cnic_ctx_wr(dev, cid_addr, BNX2_L2CTX_HOST_BDIDX, val);
-        rxbd = udev->l2_ring + BNX2_PAGE_SIZE;
+        rxbd = udev->l2_ring + CNIC_PAGE_SIZE;
        for (i = 0; i < BNX2_MAX_RX_DESC_CNT; i++, rxbd++) {
                dma_addr_t buf_map;
                int n = (i % cp->l2_rx_ring_size) + 1;
@@ -4639,11 +4640,11 @@ static void cnic_init_bnx2_rx_ring(struct cnic_dev *dev)
                rxbd->rx_bd_haddr_hi = (u64) buf_map >> 32;
                rxbd->rx_bd_haddr_lo = (u64) buf_map & 0xffffffff;
        }
-        val = (u64) (ring_map + BNX2_PAGE_SIZE) >> 32;
+        val = (u64) (ring_map + CNIC_PAGE_SIZE) >> 32;
        cnic_ctx_wr(dev, cid_addr, BNX2_L2CTX_NX_BDHADDR_HI, val);
        rxbd->rx_bd_haddr_hi = val;
-        val = (u64) (ring_map + BNX2_PAGE_SIZE) & 0xffffffff;
+        val = (u64) (ring_map + CNIC_PAGE_SIZE) & 0xffffffff;
        cnic_ctx_wr(dev, cid_addr, BNX2_L2CTX_NX_BDHADDR_LO, val);
        rxbd->rx_bd_haddr_lo = val;
@@ -4709,10 +4710,10 @@ static int cnic_start_bnx2_hw(struct cnic_dev *dev)
        val = CNIC_RD(dev, BNX2_MQ_CONFIG);
        val &= ~BNX2_MQ_CONFIG_KNL_BYP_BLK_SIZE;
-        if (BNX2_PAGE_BITS > 12)
+        if (CNIC_PAGE_BITS > 12)
                val |= (12 - 8)  << 4;
        else
-                val |= (BNX2_PAGE_BITS - 8)  << 4;
+                val |= (CNIC_PAGE_BITS - 8)  << 4;
        CNIC_WR(dev, BNX2_MQ_CONFIG, val);
@@ -4742,13 +4743,13 @@ static int cnic_start_bnx2_hw(struct cnic_dev *dev)
        /* Initialize the kernel work queue context. */
        val = KRNLQ_TYPE_TYPE_KRNLQ | KRNLQ_SIZE_TYPE_SIZE |
-              (BNX2_PAGE_BITS - 8) | KRNLQ_FLAGS_QE_SELF_SEQ;
+              (CNIC_PAGE_BITS - 8) | KRNLQ_FLAGS_QE_SELF_SEQ;
        cnic_ctx_wr(dev, kwq_cid_addr, L5_KRNLQ_TYPE, val);
-        val = (BNX2_PAGE_SIZE / sizeof(struct kwqe) - 1) << 16;
+        val = (CNIC_PAGE_SIZE / sizeof(struct kwqe) - 1) << 16;
        cnic_ctx_wr(dev, kwq_cid_addr, L5_KRNLQ_QE_SELF_SEQ_MAX, val);
-        val = ((BNX2_PAGE_SIZE / sizeof(struct kwqe)) << 16) | KWQ_PAGE_CNT;
+        val = ((CNIC_PAGE_SIZE / sizeof(struct kwqe)) << 16) | KWQ_PAGE_CNT;
        cnic_ctx_wr(dev, kwq_cid_addr, L5_KRNLQ_PGTBL_NPAGES, val);
        val = (u32) ((u64) cp->kwq_info.pgtbl_map >> 32);
@@ -4768,13 +4769,13 @@ static int cnic_start_bnx2_hw(struct cnic_dev *dev)
        /* Initialize the kernel complete queue context. */
        val = KRNLQ_TYPE_TYPE_KRNLQ | KRNLQ_SIZE_TYPE_SIZE |
-              (BNX2_PAGE_BITS - 8) | KRNLQ_FLAGS_QE_SELF_SEQ;
+              (CNIC_PAGE_BITS - 8) | KRNLQ_FLAGS_QE_SELF_SEQ;
        cnic_ctx_wr(dev, kcq_cid_addr, L5_KRNLQ_TYPE, val);
-        val = (BNX2_PAGE_SIZE / sizeof(struct kcqe) - 1) << 16;
+        val = (CNIC_PAGE_SIZE / sizeof(struct kcqe) - 1) << 16;
        cnic_ctx_wr(dev, kcq_cid_addr, L5_KRNLQ_QE_SELF_SEQ_MAX, val);
-        val = ((BNX2_PAGE_SIZE / sizeof(struct kcqe)) << 16) | KCQ_PAGE_CNT;
+        val = ((CNIC_PAGE_SIZE / sizeof(struct kcqe)) << 16) | KCQ_PAGE_CNT;
        cnic_ctx_wr(dev, kcq_cid_addr, L5_KRNLQ_PGTBL_NPAGES, val);
        val = (u32) ((u64) cp->kcq1.dma.pgtbl_map >> 32);
@@ -4918,7 +4919,7 @@ static void cnic_init_bnx2x_tx_ring(struct cnic_dev *dev,
        u32 cli = cp->ethdev->iscsi_l2_client_id;
        u32 val;
-        memset(txbd, 0, BNX2_PAGE_SIZE);
+        memset(txbd, 0, CNIC_PAGE_SIZE);
        buf_map = udev->l2_buf_map;
        for (i = 0; i < BNX2_MAX_TX_DESC_CNT; i += 3, txbd += 3) {
@@ -4978,9 +4979,9 @@ static void cnic_init_bnx2x_rx_ring(struct cnic_dev *dev,
        struct bnx2x *bp = netdev_priv(dev->netdev);
        struct cnic_uio_dev *udev = cp->udev;
        struct eth_rx_bd *rxbd = (struct eth_rx_bd *) (udev->l2_ring +
-                                BNX2_PAGE_SIZE);
+                                CNIC_PAGE_SIZE);
        struct eth_rx_cqe_next_page *rxcqe = (struct eth_rx_cqe_next_page *)
-                                (udev->l2_ring + (2 * BNX2_PAGE_SIZE));
+                                (udev->l2_ring + (2 * CNIC_PAGE_SIZE));
        struct host_sp_status_block *sb = cp->bnx2x_def_status_blk;
        int i;
        u32 cli = cp->ethdev->iscsi_l2_client_id;
@@ -5004,20 +5005,20 @@ static void cnic_init_bnx2x_rx_ring(struct cnic_dev *dev,
                rxbd->addr_lo = cpu_to_le32(buf_map & 0xffffffff);
        }
-        val = (u64) (ring_map + BNX2_PAGE_SIZE) >> 32;
+        val = (u64) (ring_map + CNIC_PAGE_SIZE) >> 32;
        rxbd->addr_hi = cpu_to_le32(val);
        data->rx.bd_page_base.hi = cpu_to_le32(val);
-        val = (u64) (ring_map + BNX2_PAGE_SIZE) & 0xffffffff;
+        val = (u64) (ring_map + CNIC_PAGE_SIZE) & 0xffffffff;
        rxbd->addr_lo = cpu_to_le32(val);
        data->rx.bd_page_base.lo = cpu_to_le32(val);
        rxcqe += BNX2X_MAX_RCQ_DESC_CNT;
-        val = (u64) (ring_map + (2 * BNX2_PAGE_SIZE)) >> 32;
+        val = (u64) (ring_map + (2 * CNIC_PAGE_SIZE)) >> 32;
        rxcqe->addr_hi = cpu_to_le32(val);
        data->rx.cqe_page_base.hi = cpu_to_le32(val);
-        val = (u64) (ring_map + (2 * BNX2_PAGE_SIZE)) & 0xffffffff;
+        val = (u64) (ring_map + (2 * CNIC_PAGE_SIZE)) & 0xffffffff;
        rxcqe->addr_lo = cpu_to_le32(val);
        data->rx.cqe_page_base.lo = cpu_to_le32(val);
@@ -5265,8 +5266,8 @@ static void cnic_shutdown_rings(struct cnic_dev *dev)
                msleep(10);
        }
        clear_bit(CNIC_LCL_FL_RINGS_INITED, &cp->cnic_local_flags);
-        rx_ring = udev->l2_ring + BNX2_PAGE_SIZE;
+        rx_ring = udev->l2_ring + CNIC_PAGE_SIZE;
-        memset(rx_ring, 0, BNX2_PAGE_SIZE);
+        memset(rx_ring, 0, CNIC_PAGE_SIZE);
 }
 static int cnic_register_netdev(struct cnic_dev *dev)
diff --git a/drivers/net/ethernet/broadcom/cnic.h b/drivers/net/ethernet/broadcom/cnic.h
index 0d6b13f854d9..d535ae4228b4 100644
--- a/drivers/net/ethernet/broadcom/cnic.h
+++ b/drivers/net/ethernet/broadcom/cnic.h
@@ -1,6 +1,6 @@
 /* cnic.h: Broadcom CNIC core network driver.
 *
- * Copyright (c) 2006-2013 Broadcom Corporation
+ * Copyright (c) 2006-2014 Broadcom Corporation
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
diff --git a/drivers/net/ethernet/broadcom/cnic_defs.h b/drivers/net/ethernet/broadcom/cnic_defs.h
index 95a8e4b11c9f..dcbca6997e8f 100644
--- a/drivers/net/ethernet/broadcom/cnic_defs.h
+++ b/drivers/net/ethernet/broadcom/cnic_defs.h
@@ -1,7 +1,7 @@
 /* cnic.c: Broadcom CNIC core network driver.
 *
- * Copyright (c) 2006-2013 Broadcom Corporation
+ * Copyright (c) 2006-2014 Broadcom Corporation
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
diff --git a/drivers/net/ethernet/broadcom/cnic_if.h b/drivers/net/ethernet/broadcom/cnic_if.h
index 8cf6b1926069..5f4d5573a73d 100644
--- a/drivers/net/ethernet/broadcom/cnic_if.h
+++ b/drivers/net/ethernet/broadcom/cnic_if.h
@@ -1,6 +1,6 @@
 /* cnic_if.h: Broadcom CNIC core network driver.
 *
- * Copyright (c) 2006-2013 Broadcom Corporation
+ * Copyright (c) 2006-2014 Broadcom Corporation
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
@@ -14,8 +14,8 @@
 #include "bnx2x/bnx2x_mfw_req.h"
-#define CNIC_MODULE_VERSION     "2.5.19"
+#define CNIC_MODULE_VERSION     "2.5.20"
-#define CNIC_MODULE_RELDATE     "December 19, 2013"
+#define CNIC_MODULE_RELDATE     "March 14, 2014"
 #define CNIC_ULP_RDMA           0
 #define CNIC_ULP_ISCSI          1
@@ -24,6 +24,16 @@
 #define MAX_CNIC_ULP_TYPE_EXT   3
 #define MAX_CNIC_ULP_TYPE       4
+/* Use CPU native page size up to 16K for cnic ring sizes.  */
+#if (PAGE_SHIFT > 14)
+#define CNIC_PAGE_BITS  14
+#else
+#define CNIC_PAGE_BITS  PAGE_SHIFT
+#endif
+#define CNIC_PAGE_SIZE  (1 << (CNIC_PAGE_BITS))
+#define CNIC_PAGE_ALIGN(addr) ALIGN(addr, CNIC_PAGE_SIZE)
+#define CNIC_PAGE_MASK  (~((CNIC_PAGE_SIZE) - 1))
 struct kwqe {
        u32 kwqe_op_flag;
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index e2ca03e23dc1..3b6d0ba86c71 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -2609,13 +2609,14 @@ static int tg3_phy_reset_5703_4_5(struct tg3 *tp)
        tg3_writephy(tp, MII_CTRL1000, phy9_orig);
-        if (!tg3_readphy(tp, MII_TG3_EXT_CTRL, &reg32)) {
+        err = tg3_readphy(tp, MII_TG3_EXT_CTRL, &reg32);
-                reg32 &= ~0x3000;
+        if (err)
-                tg3_writephy(tp, MII_TG3_EXT_CTRL, reg32);
+                return err;
-        } else if (!err)
-                err = -EBUSY;
-        return err;
+        reg32 &= ~0x3000;
+        tg3_writephy(tp, MII_TG3_EXT_CTRL, reg32);
+        return 0;
 }
 static void tg3_carrier_off(struct tg3 *tp)
@@ -6842,8 +6843,7 @@ static int tg3_rx(struct tg3_napi *tnapi, int budget)
                work_mask |= opaque_key;
-                if ((desc->err_vlan & RXD_ERR_MASK) != 0 &&
+                if (desc->err_vlan & RXD_ERR_MASK) {
-                    (desc->err_vlan != RXD_ERR_ODD_NIBBLE_RCVD_MII)) {
                drop_it:
                        tg3_recycle_rx(tnapi, tpr, opaque_key,
                                       desc_idx, *post_ptr);
@@ -14113,12 +14113,12 @@ static int tg3_change_mtu(struct net_device *dev, int new_mtu)
        tg3_netif_stop(tp);
+        tg3_set_mtu(dev, tp, new_mtu);
        tg3_full_lock(tp, 1);
        tg3_halt(tp, RESET_KIND_SHUTDOWN, 1);
-        tg3_set_mtu(dev, tp, new_mtu);
        /* Reset PHY, otherwise the read DMA engine will be in a mode that
         * breaks all requests to 256 bytes.
         */
diff --git a/drivers/net/ethernet/broadcom/tg3.h b/drivers/net/ethernet/broadcom/tg3.h
index ef472385bce4..04321e5a356e 100644
--- a/drivers/net/ethernet/broadcom/tg3.h
+++ b/drivers/net/ethernet/broadcom/tg3.h
@@ -2608,7 +2608,11 @@ struct tg3_rx_buffer_desc {
 #define RXD_ERR_TOO_SMALL               0x00400000
 #define RXD_ERR_NO_RESOURCES            0x00800000
 #define RXD_ERR_HUGE_FRAME              0x01000000
-#define RXD_ERR_MASK                    0xffff0000
+#define RXD_ERR_MASK    (RXD_ERR_BAD_CRC | RXD_ERR_COLLISION |          \
+                         RXD_ERR_LINK_LOST | RXD_ERR_PHY_DECODE |       \
+                         RXD_ERR_MAC_ABRT | RXD_ERR_TOO_SMALL |         \
+                         RXD_ERR_NO_RESOURCES | RXD_ERR_HUGE_FRAME)
        u32                             reserved;
        u32                             opaque;
diff --git a/drivers/net/ethernet/brocade/bna/bfa_ioc.c b/drivers/net/ethernet/brocade/bna/bfa_ioc.c
index 1803c3959044..354ae9792bad 100644
--- a/drivers/net/ethernet/brocade/bna/bfa_ioc.c
+++ b/drivers/net/ethernet/brocade/bna/bfa_ioc.c
@@ -1704,7 +1704,7 @@ bfa_flash_sem_get(void __iomem *bar)
        while (!bfa_raw_sem_get(bar)) {
                if (--n <= 0)
                        return BFA_STATUS_BADFLASH;
-                udelay(10000);
+                mdelay(10);
        }
        return BFA_STATUS_OK;
 }
diff --git a/drivers/net/ethernet/brocade/bna/bnad.c b/drivers/net/ethernet/brocade/bna/bnad.c
index cf64f3d0b60d..4ad1187e82fb 100644
--- a/drivers/net/ethernet/brocade/bna/bnad.c
+++ b/drivers/net/ethernet/brocade/bna/bnad.c
@@ -707,7 +707,8 @@ bnad_cq_process(struct bnad *bnad, struct bna_ccb *ccb, int budget)
                else
                        skb_checksum_none_assert(skb);
-                if (flags & BNA_CQ_EF_VLAN)
+                if ((flags & BNA_CQ_EF_VLAN) &&
+                    (bnad->netdev->features & NETIF_F_HW_VLAN_CTAG_RX))
                        __vlan_hwaccel_put_tag(skb, htons(ETH_P_8021Q), ntohs(cmpl->vlan_tag));
                if (BNAD_RXBUF_IS_SK_BUFF(unmap_q->type))
@@ -2094,7 +2095,9 @@ bnad_init_rx_config(struct bnad *bnad, struct bna_rx_config *rx_config)
                rx_config->q1_buf_size = BFI_SMALL_RXBUF_SIZE;
        }
-        rx_config->vlan_strip_status = BNA_STATUS_T_ENABLED;
+        rx_config->vlan_strip_status =
+                (bnad->netdev->features & NETIF_F_HW_VLAN_CTAG_RX) ?
+                BNA_STATUS_T_ENABLED : BNA_STATUS_T_DISABLED;
 }
 static void
@@ -3245,11 +3248,6 @@ bnad_set_rx_mode(struct net_device *netdev)
                        BNA_RXMODE_ALLMULTI;
        bna_rx_mode_set(bnad->rx_info[0].rx, new_mode, mode_mask, NULL);
-        if (bnad->cfg_flags & BNAD_CF_PROMISC)
-                bna_rx_vlan_strip_disable(bnad->rx_info[0].rx);
-        else
-                bna_rx_vlan_strip_enable(bnad->rx_info[0].rx);
        spin_unlock_irqrestore(&bnad->bna_lock, flags);
 }
@@ -3374,6 +3372,27 @@ bnad_vlan_rx_kill_vid(struct net_device *netdev, __be16 proto, u16 vid)
        return 0;
 }
+static int bnad_set_features(struct net_device *dev, netdev_features_t features)
+{
+        struct bnad *bnad = netdev_priv(dev);
+        netdev_features_t changed = features ^ dev->features;
+        if ((changed & NETIF_F_HW_VLAN_CTAG_RX) && netif_running(dev)) {
+                unsigned long flags;
+                spin_lock_irqsave(&bnad->bna_lock, flags);
+                if (features & NETIF_F_HW_VLAN_CTAG_RX)
+                        bna_rx_vlan_strip_enable(bnad->rx_info[0].rx);
+                else
+                        bna_rx_vlan_strip_disable(bnad->rx_info[0].rx);
+                spin_unlock_irqrestore(&bnad->bna_lock, flags);
+        }
+        return 0;
+}
 #ifdef CONFIG_NET_POLL_CONTROLLER
 static void
 bnad_netpoll(struct net_device *netdev)
@@ -3421,6 +3440,7 @@ static const struct net_device_ops bnad_netdev_ops = {
        .ndo_change_mtu         = bnad_change_mtu,
        .ndo_vlan_rx_add_vid    = bnad_vlan_rx_add_vid,
        .ndo_vlan_rx_kill_vid   = bnad_vlan_rx_kill_vid,
+        .ndo_set_features       = bnad_set_features,
 #ifdef CONFIG_NET_POLL_CONTROLLER
        .ndo_poll_controller    = bnad_netpoll
 #endif
@@ -3433,14 +3453,14 @@ bnad_netdev_init(struct bnad *bnad, bool using_dac)
        netdev->hw_features = NETIF_F_SG | NETIF_F_RXCSUM |
                NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
-                NETIF_F_TSO | NETIF_F_TSO6 | NETIF_F_HW_VLAN_CTAG_TX;
+                NETIF_F_TSO | NETIF_F_TSO6 | NETIF_F_HW_VLAN_CTAG_TX |
+                NETIF_F_HW_VLAN_CTAG_RX;
        netdev->vlan_features = NETIF_F_SG | NETIF_F_HIGHDMA |
                NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
                NETIF_F_TSO | NETIF_F_TSO6;
-        netdev->features |= netdev->hw_features |
+        netdev->features |= netdev->hw_features | NETIF_F_HW_VLAN_CTAG_FILTER;
-                NETIF_F_HW_VLAN_CTAG_RX | NETIF_F_HW_VLAN_CTAG_FILTER;
        if (using_dac)
                netdev->features |= NETIF_F_HIGHDMA;
diff --git a/drivers/net/ethernet/cadence/macb.c b/drivers/net/ethernet/cadence/macb.c
index 3190d38e16fb..d0c38e01e99f 100644
--- a/drivers/net/ethernet/cadence/macb.c
+++ b/drivers/net/ethernet/cadence/macb.c
@@ -632,11 +632,16 @@ static void gem_rx_refill(struct macb *bp)
                                           "Unable to allocate sk_buff\n");
                                break;
                        }
-                        bp->rx_skbuff[entry] = skb;
                        /* now fill corresponding descriptor entry */
                        paddr = dma_map_single(&bp->pdev->dev, skb->data,
                                               bp->rx_buffer_size, DMA_FROM_DEVICE);
+                        if (dma_mapping_error(&bp->pdev->dev, paddr)) {
+                                dev_kfree_skb(skb);
+                                break;
+                        }
+                        bp->rx_skbuff[entry] = skb;
                        if (entry == RX_RING_SIZE - 1)
                                paddr |= MACB_BIT(RX_WRAP);
@@ -725,7 +730,7 @@ static int gem_rx(struct macb *bp, int budget)
                skb_put(skb, len);
                addr = MACB_BF(RX_WADDR, MACB_BFEXT(RX_WADDR, addr));
                dma_unmap_single(&bp->pdev->dev, addr,
-                                 len, DMA_FROM_DEVICE);
+                                 bp->rx_buffer_size, DMA_FROM_DEVICE);
                skb->protocol = eth_type_trans(skb, bp->dev);
                skb_checksum_none_assert(skb);
@@ -1036,11 +1041,15 @@ static int macb_start_xmit(struct sk_buff *skb, struct net_device *dev)
        }
        entry = macb_tx_ring_wrap(bp->tx_head);
-        bp->tx_head++;
        netdev_vdbg(bp->dev, "Allocated ring entry %u\n", entry);
        mapping = dma_map_single(&bp->pdev->dev, skb->data,
                                 len, DMA_TO_DEVICE);
+        if (dma_mapping_error(&bp->pdev->dev, mapping)) {
+                kfree_skb(skb);
+                goto unlock;
+        }
+        bp->tx_head++;
        tx_skb = &bp->tx_skb[entry];
        tx_skb->skb = skb;
        tx_skb->mapping = mapping;
@@ -1066,6 +1075,7 @@ static int macb_start_xmit(struct sk_buff *skb, struct net_device *dev)
        if (CIRC_SPACE(bp->tx_head, bp->tx_tail, TX_RING_SIZE) < 1)
                netif_stop_queue(dev);
+unlock:
        spin_unlock_irqrestore(&bp->lock, flags);
        return NETDEV_TX_OK;
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
index 43ab35fea48d..34e2488767d9 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
@@ -6179,6 +6179,7 @@ static struct pci_driver cxgb4_driver = {
        .id_table = cxgb4_pci_tbl,
        .probe    = init_one,
        .remove   = remove_one,
+        .shutdown = remove_one,
        .err_handler = &cxgb4_eeh,
 };
diff --git a/drivers/net/ethernet/dec/tulip/tulip_core.c b/drivers/net/ethernet/dec/tulip/tulip_core.c
index add05f14b38b..1642de78aac8 100644
--- a/drivers/net/ethernet/dec/tulip/tulip_core.c
+++ b/drivers/net/ethernet/dec/tulip/tulip_core.c
@@ -1939,6 +1939,7 @@ static void tulip_remove_one(struct pci_dev *pdev)
        pci_iounmap(pdev, tp->base_addr);
        free_netdev (dev);
        pci_release_regions (pdev);
+        pci_disable_device(pdev);
        /* pci_power_off (pdev, -1); */
 }
diff --git a/drivers/net/ethernet/emulex/benet/be.h b/drivers/net/ethernet/emulex/benet/be.h
index 8d09615da585..05529e273050 100644
--- a/drivers/net/ethernet/emulex/benet/be.h
+++ b/drivers/net/ethernet/emulex/benet/be.h
@@ -350,11 +350,13 @@ struct be_drv_stats {
        u32 roce_drops_crc;
 };
+/* A vlan-id of 0xFFFF must be used to clear transparent vlan-tagging */
+#define BE_RESET_VLAN_TAG_ID    0xFFFF
 struct be_vf_cfg {
        unsigned char mac_addr[ETH_ALEN];
        int if_handle;
        int pmac_id;
-        u16 def_vid;
        u16 vlan_tag;
        u32 tx_rate;
 };
diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
index 04ac9c6a0d39..36c80612e21a 100644
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -913,24 +913,14 @@ static int be_ipv6_tx_stall_chk(struct be_adapter *adapter,
        return BE3_chip(adapter) && be_ipv6_exthdr_check(skb);
 }
-static struct sk_buff *be_xmit_workarounds(struct be_adapter *adapter,
+static struct sk_buff *be_lancer_xmit_workarounds(struct be_adapter *adapter,
-                                           struct sk_buff *skb,
+                                                  struct sk_buff *skb,
-                                           bool *skip_hw_vlan)
+                                                  bool *skip_hw_vlan)
 {
        struct vlan_ethhdr *veh = (struct vlan_ethhdr *)skb->data;
        unsigned int eth_hdr_len;
        struct iphdr *ip;
-        /* Lancer, SH-R ASICs have a bug wherein Packets that are 32 bytes or less
-         * may cause a transmit stall on that port. So the work-around is to
-         * pad short packets (<= 32 bytes) to a 36-byte length.
-         */
-        if (unlikely(!BEx_chip(adapter) && skb->len <= 32)) {
-                if (skb_padto(skb, 36))
-                        goto tx_drop;
-                skb->len = 36;
-        }
        /* For padded packets, BE HW modifies tot_len field in IP header
         * incorrecly when VLAN tag is inserted by HW.
         * For padded packets, Lancer computes incorrect checksum.
@@ -959,7 +949,7 @@ static struct sk_buff *be_xmit_workarounds(struct be_adapter *adapter,
            vlan_tx_tag_present(skb)) {
                skb = be_insert_vlan_in_pkt(adapter, skb, skip_hw_vlan);
                if (unlikely(!skb))
-                        goto tx_drop;
+                        goto err;
        }
        /* HW may lockup when VLAN HW tagging is requested on
@@ -981,15 +971,39 @@ static struct sk_buff *be_xmit_workarounds(struct be_adapter *adapter,
            be_vlan_tag_tx_chk(adapter, skb)) {
                skb = be_insert_vlan_in_pkt(adapter, skb, skip_hw_vlan);
                if (unlikely(!skb))
-                        goto tx_drop;
+                        goto err;
        }
        return skb;
 tx_drop:
        dev_kfree_skb_any(skb);
+err:
        return NULL;
 }
+static struct sk_buff *be_xmit_workarounds(struct be_adapter *adapter,
+                                           struct sk_buff *skb,
+                                           bool *skip_hw_vlan)
+{
+        /* Lancer, SH-R ASICs have a bug wherein Packets that are 32 bytes or
+         * less may cause a transmit stall on that port. So the work-around is
+         * to pad short packets (<= 32 bytes) to a 36-byte length.
+         */
+        if (unlikely(!BEx_chip(adapter) && skb->len <= 32)) {
+                if (skb_padto(skb, 36))
+                        return NULL;
+                skb->len = 36;
+        }
+        if (BEx_chip(adapter) || lancer_chip(adapter)) {
+                skb = be_lancer_xmit_workarounds(adapter, skb, skip_hw_vlan);
+                if (!skb)
+                        return NULL;
+        }
+        return skb;
+}
 static netdev_tx_t be_xmit(struct sk_buff *skb, struct net_device *netdev)
 {
        struct be_adapter *adapter = netdev_priv(netdev);
@@ -1157,6 +1171,14 @@ ret:
        return status;
 }
+static void be_clear_promisc(struct be_adapter *adapter)
+{
+        adapter->promiscuous = false;
+        adapter->flags &= ~BE_FLAGS_VLAN_PROMISC;
+        be_cmd_rx_filter(adapter, IFF_PROMISC, OFF);
+}
 static void be_set_rx_mode(struct net_device *netdev)
 {
        struct be_adapter *adapter = netdev_priv(netdev);
@@ -1170,9 +1192,7 @@ static void be_set_rx_mode(struct net_device *netdev)
        /* BE was previously in promiscuous mode; disable it */
        if (adapter->promiscuous) {
-                adapter->promiscuous = false;
+                be_clear_promisc(adapter);
-                be_cmd_rx_filter(adapter, IFF_PROMISC, OFF);
                if (adapter->vlans_added)
                        be_vid_config(adapter);
        }
@@ -1287,24 +1307,20 @@ static int be_set_vf_vlan(struct net_device *netdev,
        if (vlan || qos) {
                vlan |= qos << VLAN_PRIO_SHIFT;
-                if (vf_cfg->vlan_tag != vlan) {
+                if (vf_cfg->vlan_tag != vlan)
-                        /* If this is new value, program it. Else skip. */
-                        vf_cfg->vlan_tag = vlan;
                        status = be_cmd_set_hsw_config(adapter, vlan, vf + 1,
                                                       vf_cfg->if_handle, 0);
-                }
        } else {
                /* Reset Transparent Vlan Tagging. */
-                vf_cfg->vlan_tag = 0;
+                status = be_cmd_set_hsw_config(adapter, BE_RESET_VLAN_TAG_ID,
-                vlan = vf_cfg->def_vid;
+                                               vf + 1, vf_cfg->if_handle, 0);
-                status = be_cmd_set_hsw_config(adapter, vlan, vf + 1,
-                                               vf_cfg->if_handle, 0);
        }
+        if (!status)
-        if (status)
+                vf_cfg->vlan_tag = vlan;
+        else
                dev_info(&adapter->pdev->dev,
-                                "VLAN %d config on VF %d failed\n", vlan, vf);
+                         "VLAN %d config on VF %d failed\n", vlan, vf);
        return status;
 }
@@ -3013,11 +3029,11 @@ static int be_vf_setup_init(struct be_adapter *adapter)
 static int be_vf_setup(struct be_adapter *adapter)
 {
+        struct device *dev = &adapter->pdev->dev;
        struct be_vf_cfg *vf_cfg;
-        u16 def_vlan, lnk_speed;
        int status, old_vfs, vf;
-        struct device *dev = &adapter->pdev->dev;
        u32 privileges;
+        u16 lnk_speed;
        old_vfs = pci_num_vf(adapter->pdev);
        if (old_vfs) {
@@ -3084,12 +3100,6 @@ static int be_vf_setup(struct be_adapter *adapter)
                if (!status)
                        vf_cfg->tx_rate = lnk_speed;
-                status = be_cmd_get_hsw_config(adapter, &def_vlan,
-                                               vf + 1, vf_cfg->if_handle, NULL);
-                if (status)
-                        goto err;
-                vf_cfg->def_vid = def_vlan;
                if (!old_vfs)
                        be_cmd_enable_vf(adapter, vf + 1);
        }
diff --git a/drivers/net/ethernet/ethoc.c b/drivers/net/ethernet/ethoc.c
index 4de8cfd149cf..55e0fa03dc90 100644
--- a/drivers/net/ethernet/ethoc.c
+++ b/drivers/net/ethernet/ethoc.c
@@ -13,6 +13,7 @@
 #include <linux/dma-mapping.h>
 #include <linux/etherdevice.h>
+#include <linux/clk.h>
 #include <linux/crc32.h>
 #include <linux/interrupt.h>
 #include <linux/io.h>
@@ -51,6 +52,7 @@ MODULE_PARM_DESC(buffer_size, "DMA buffer allocation size");
 #define ETH_HASH0       0x48
 #define ETH_HASH1       0x4c
 #define ETH_TXCTRL      0x50
+#define ETH_END         0x54
 /* mode register */
 #define MODER_RXEN      (1 <<  0) /* receive enable */
@@ -179,6 +181,7 @@ MODULE_PARM_DESC(buffer_size, "DMA buffer allocation size");
 * @membase:    pointer to buffer memory region
 * @dma_alloc:  dma allocated buffer size
 * @io_region_size:     I/O memory region size
+ * @num_bd:     number of buffer descriptors
 * @num_tx:     number of send buffers
 * @cur_tx:     last send buffer written
 * @dty_tx:     last buffer actually sent
@@ -199,6 +202,7 @@ struct ethoc {
        int dma_alloc;
        resource_size_t io_region_size;
+        unsigned int num_bd;
        unsigned int num_tx;
        unsigned int cur_tx;
        unsigned int dty_tx;
@@ -216,6 +220,7 @@ struct ethoc {
        struct phy_device *phy;
        struct mii_bus *mdio;
+        struct clk *clk;
        s8 phy_id;
 };
@@ -688,6 +693,11 @@ static int ethoc_mdio_probe(struct net_device *dev)
        }
        priv->phy = phy;
+        phy->advertising &= ~(ADVERTISED_1000baseT_Full |
+                              ADVERTISED_1000baseT_Half);
+        phy->supported &= ~(SUPPORTED_1000baseT_Full |
+                            SUPPORTED_1000baseT_Half);
        return 0;
 }
@@ -890,6 +900,102 @@ out:
        return NETDEV_TX_OK;
 }
+static int ethoc_get_settings(struct net_device *dev, struct ethtool_cmd *cmd)
+{
+        struct ethoc *priv = netdev_priv(dev);
+        struct phy_device *phydev = priv->phy;
+        if (!phydev)
+                return -EOPNOTSUPP;
+        return phy_ethtool_gset(phydev, cmd);
+}
+static int ethoc_set_settings(struct net_device *dev, struct ethtool_cmd *cmd)
+{
+        struct ethoc *priv = netdev_priv(dev);
+        struct phy_device *phydev = priv->phy;
+        if (!phydev)
+                return -EOPNOTSUPP;
+        return phy_ethtool_sset(phydev, cmd);
+}
+static int ethoc_get_regs_len(struct net_device *netdev)
+{
+        return ETH_END;
+}
+static void ethoc_get_regs(struct net_device *dev, struct ethtool_regs *regs,
+                           void *p)
+{
+        struct ethoc *priv = netdev_priv(dev);
+        u32 *regs_buff = p;
+        unsigned i;
+        regs->version = 0;
+        for (i = 0; i < ETH_END / sizeof(u32); ++i)
+                regs_buff[i] = ethoc_read(priv, i * sizeof(u32));
+}
+static void ethoc_get_ringparam(struct net_device *dev,
+                                struct ethtool_ringparam *ring)
+{
+        struct ethoc *priv = netdev_priv(dev);
+        ring->rx_max_pending = priv->num_bd - 1;
+        ring->rx_mini_max_pending = 0;
+        ring->rx_jumbo_max_pending = 0;
+        ring->tx_max_pending = priv->num_bd - 1;
+        ring->rx_pending = priv->num_rx;
+        ring->rx_mini_pending = 0;
+        ring->rx_jumbo_pending = 0;
+        ring->tx_pending = priv->num_tx;
+}
+static int ethoc_set_ringparam(struct net_device *dev,
+                               struct ethtool_ringparam *ring)
+{
+        struct ethoc *priv = netdev_priv(dev);
+        if (ring->tx_pending < 1 || ring->rx_pending < 1 ||
+            ring->tx_pending + ring->rx_pending > priv->num_bd)
+                return -EINVAL;
+        if (ring->rx_mini_pending || ring->rx_jumbo_pending)
+                return -EINVAL;
+        if (netif_running(dev)) {
+                netif_tx_disable(dev);
+                ethoc_disable_rx_and_tx(priv);
+                ethoc_disable_irq(priv, INT_MASK_TX | INT_MASK_RX);
+                synchronize_irq(dev->irq);
+        }
+        priv->num_tx = rounddown_pow_of_two(ring->tx_pending);
+        priv->num_rx = ring->rx_pending;
+        ethoc_init_ring(priv, dev->mem_start);
+        if (netif_running(dev)) {
+                ethoc_enable_irq(priv, INT_MASK_TX | INT_MASK_RX);
+                ethoc_enable_rx_and_tx(priv);
+                netif_wake_queue(dev);
+        }
+        return 0;
+}
+const struct ethtool_ops ethoc_ethtool_ops = {
+        .get_settings = ethoc_get_settings,
+        .set_settings = ethoc_set_settings,
+        .get_regs_len = ethoc_get_regs_len,
+        .get_regs = ethoc_get_regs,
+        .get_link = ethtool_op_get_link,
+        .get_ringparam = ethoc_get_ringparam,
+        .set_ringparam = ethoc_set_ringparam,
+        .get_ts_info = ethtool_op_get_ts_info,
+};
 static const struct net_device_ops ethoc_netdev_ops = {
        .ndo_open = ethoc_open,
        .ndo_stop = ethoc_stop,
@@ -917,6 +1023,8 @@ static int ethoc_probe(struct platform_device *pdev)
        int num_bd;
        int ret = 0;
        bool random_mac = false;
+        struct ethoc_platform_data *pdata = dev_get_platdata(&pdev->dev);
+        u32 eth_clkfreq = pdata ? pdata->eth_clkfreq : 0;
        /* allocate networking device */
        netdev = alloc_etherdev(sizeof(struct ethoc));
@@ -1016,6 +1124,7 @@ static int ethoc_probe(struct platform_device *pdev)
                ret = -ENODEV;
                goto error;
        }
+        priv->num_bd = num_bd;
        /* num_tx must be a power of two */
        priv->num_tx = rounddown_pow_of_two(num_bd >> 1);
        priv->num_rx = num_bd - priv->num_tx;
@@ -1030,8 +1139,7 @@ static int ethoc_probe(struct platform_device *pdev)
        }
        /* Allow the platform setup code to pass in a MAC address. */
-        if (dev_get_platdata(&pdev->dev)) {
+        if (pdata) {
-                struct ethoc_platform_data *pdata = dev_get_platdata(&pdev->dev);
                memcpy(netdev->dev_addr, pdata->hwaddr, IFHWADDRLEN);
                priv->phy_id = pdata->phy_id;
        } else {
@@ -1069,6 +1177,27 @@ static int ethoc_probe(struct platform_device *pdev)
        if (random_mac)
                netdev->addr_assign_type = NET_ADDR_RANDOM;
+        /* Allow the platform setup code to adjust MII management bus clock. */
+        if (!eth_clkfreq) {
+                struct clk *clk = devm_clk_get(&pdev->dev, NULL);
+                if (!IS_ERR(clk)) {
+                        priv->clk = clk;
+                        clk_prepare_enable(clk);
+                        eth_clkfreq = clk_get_rate(clk);
+                }
+        }
+        if (eth_clkfreq) {
+                u32 clkdiv = MIIMODER_CLKDIV(eth_clkfreq / 2500000 + 1);
+                if (!clkdiv)
+                        clkdiv = 2;
+                dev_dbg(&pdev->dev, "setting MII clkdiv to %u\n", clkdiv);
+                ethoc_write(priv, MIIMODER,
+                            (ethoc_read(priv, MIIMODER) & MIIMODER_NOPRE) |
+                            clkdiv);
+        }
        /* register MII bus */
        priv->mdio = mdiobus_alloc();
        if (!priv->mdio) {
@@ -1111,6 +1240,7 @@ static int ethoc_probe(struct platform_device *pdev)
        netdev->netdev_ops = &ethoc_netdev_ops;
        netdev->watchdog_timeo = ETHOC_TIMEOUT;
        netdev->features |= 0;
+        netdev->ethtool_ops = &ethoc_ethtool_ops;
        /* setup NAPI */
        netif_napi_add(netdev, &priv->napi, ethoc_poll, 64);
@@ -1133,6 +1263,8 @@ free_mdio:
        kfree(priv->mdio->irq);
        mdiobus_free(priv->mdio);
 free:
+        if (priv->clk)
+                clk_disable_unprepare(priv->clk);
        free_netdev(netdev);
 out:
        return ret;
@@ -1157,6 +1289,8 @@ static int ethoc_remove(struct platform_device *pdev)
                        kfree(priv->mdio->irq);
                        mdiobus_free(priv->mdio);
                }
+                if (priv->clk)
+                        clk_disable_unprepare(priv->clk);
                unregister_netdev(netdev);
                free_netdev(netdev);
        }
diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index d4782b42401b..03a351300013 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -389,12 +389,6 @@ fec_enet_start_xmit(struct sk_buff *skb, struct net_device *ndev)
                        netdev_err(ndev, "Tx DMA memory map failed\n");
                return NETDEV_TX_OK;
        }
-        /* Send it on its way.  Tell FEC it's ready, interrupt when done,
-         * it's the last BD of the frame, and to put the CRC on the end.
-         */
-        status |= (BD_ENET_TX_READY | BD_ENET_TX_INTR
-                        | BD_ENET_TX_LAST | BD_ENET_TX_TC);
-        bdp->cbd_sc = status;
        if (fep->bufdesc_ex) {
@@ -416,6 +410,13 @@ fec_enet_start_xmit(struct sk_buff *skb, struct net_device *ndev)
                }
        }
+        /* Send it on its way.  Tell FEC it's ready, interrupt when done,
+         * it's the last BD of the frame, and to put the CRC on the end.
+         */
+        status |= (BD_ENET_TX_READY | BD_ENET_TX_INTR
+                        | BD_ENET_TX_LAST | BD_ENET_TX_TC);
+        bdp->cbd_sc = status;
        bdp_pre = fec_enet_get_prevdesc(bdp, fep);
        if ((id_entry->driver_data & FEC_QUIRK_ERR006358) &&
            !(bdp_pre->cbd_sc & BD_ENET_TX_READY)) {
@@ -527,13 +528,6 @@ fec_restart(struct net_device *ndev, int duplex)
        /* Clear any outstanding interrupt. */
        writel(0xffc00000, fep->hwp + FEC_IEVENT);
-        /* Setup multicast filter. */
-        set_multicast_list(ndev);
-#ifndef CONFIG_M5272
-        writel(0, fep->hwp + FEC_HASH_TABLE_HIGH);
-        writel(0, fep->hwp + FEC_HASH_TABLE_LOW);
-#endif
        /* Set maximum receive buffer size. */
        writel(PKT_MAXBLR_SIZE, fep->hwp + FEC_R_BUFF_SIZE);
@@ -654,6 +648,13 @@ fec_restart(struct net_device *ndev, int duplex)
        writel(rcntl, fep->hwp + FEC_R_CNTRL);
+        /* Setup multicast filter. */
+        set_multicast_list(ndev);
+#ifndef CONFIG_M5272
+        writel(0, fep->hwp + FEC_HASH_TABLE_HIGH);
+        writel(0, fep->hwp + FEC_HASH_TABLE_LOW);
+#endif
        if (id_entry->driver_data & FEC_QUIRK_ENET_MAC) {
                /* enable ENET endian swap */
                ecntl |= (1 << 8);
@@ -1778,8 +1779,6 @@ fec_enet_open(struct net_device *ndev)
        struct fec_enet_private *fep = netdev_priv(ndev);
        int ret;
-        napi_enable(&fep->napi);
        /* I should reset the ring buffers here, but I don't yet know
         * a simple way to do that.
         */
@@ -1794,6 +1793,8 @@ fec_enet_open(struct net_device *ndev)
                fec_enet_free_buffers(ndev);
                return ret;
        }
+        napi_enable(&fep->napi);
        phy_start(fep->phy_dev);
        netif_start_queue(ndev);
        fep->opened = 1;
diff --git a/drivers/net/ethernet/ibm/ibmveth.c b/drivers/net/ethernet/ibm/ibmveth.c
index 4be971590461..1fc8334fc181 100644
--- a/drivers/net/ethernet/ibm/ibmveth.c
+++ b/drivers/net/ethernet/ibm/ibmveth.c
@@ -522,10 +522,21 @@ retry:
        return rc;
 }
+static u64 ibmveth_encode_mac_addr(u8 *mac)
+{
+        int i;
+        u64 encoded = 0;
+        for (i = 0; i < ETH_ALEN; i++)
+                encoded = (encoded << 8) | mac[i];
+        return encoded;
+}
 static int ibmveth_open(struct net_device *netdev)
 {
        struct ibmveth_adapter *adapter = netdev_priv(netdev);
-        u64 mac_address = 0;
+        u64 mac_address;
        int rxq_entries = 1;
        unsigned long lpar_rc;
        int rc;
@@ -579,8 +590,7 @@ static int ibmveth_open(struct net_device *netdev)
        adapter->rx_queue.num_slots = rxq_entries;
        adapter->rx_queue.toggle = 1;
-        memcpy(&mac_address, netdev->dev_addr, netdev->addr_len);
+        mac_address = ibmveth_encode_mac_addr(netdev->dev_addr);
-        mac_address = mac_address >> 16;
        rxq_desc.fields.flags_len = IBMVETH_BUF_VALID |
                                        adapter->rx_queue.queue_len;
@@ -1183,8 +1193,8 @@ static void ibmveth_set_multicast_list(struct net_device *netdev)
                /* add the addresses to the filter table */
                netdev_for_each_mc_addr(ha, netdev) {
                        /* add the multicast address to the filter table */
-                        unsigned long mcast_addr = 0;
+                        u64 mcast_addr;
-                        memcpy(((char *)&mcast_addr)+2, ha->addr, ETH_ALEN);
+                        mcast_addr = ibmveth_encode_mac_addr(ha->addr);
                        lpar_rc = h_multicast_ctrl(adapter->vdev->unit_address,
                                                   IbmVethMcastAddFilter,
                                                   mcast_addr);
@@ -1372,9 +1382,6 @@ static int ibmveth_probe(struct vio_dev *dev, const struct vio_device_id *id)
        netif_napi_add(netdev, &adapter->napi, ibmveth_poll, 16);
-        adapter->mac_addr = 0;
-        memcpy(&adapter->mac_addr, mac_addr_p, ETH_ALEN);
        netdev->irq = dev->irq;
        netdev->netdev_ops = &ibmveth_netdev_ops;
        netdev->ethtool_ops = &netdev_ethtool_ops;
@@ -1383,7 +1390,7 @@ static int ibmveth_probe(struct vio_dev *dev, const struct vio_device_id *id)
                NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM;
        netdev->features |= netdev->hw_features;
-        memcpy(netdev->dev_addr, &adapter->mac_addr, netdev->addr_len);
+        memcpy(netdev->dev_addr, mac_addr_p, ETH_ALEN);
        for (i = 0; i < IBMVETH_NUM_BUFF_POOLS; i++) {
                struct kobject *kobj = &adapter->rx_buff_pool[i].kobj;
diff --git a/drivers/net/ethernet/ibm/ibmveth.h b/drivers/net/ethernet/ibm/ibmveth.h
index 451ba7949e15..1f37499d4398 100644
--- a/drivers/net/ethernet/ibm/ibmveth.h
+++ b/drivers/net/ethernet/ibm/ibmveth.h
@@ -138,7 +138,6 @@ struct ibmveth_adapter {
    struct napi_struct napi;
    struct net_device_stats stats;
    unsigned int mcastFilterSize;
-    unsigned long mac_addr;
    void * buffer_list_addr;
    void * filter_list_addr;
    dma_addr_t buffer_list_dma;
diff --git a/drivers/net/ethernet/intel/e100.c b/drivers/net/ethernet/intel/e100.c
index cbaba4442d4b..bf7a01ef9a57 100644
--- a/drivers/net/ethernet/intel/e100.c
+++ b/drivers/net/ethernet/intel/e100.c
@@ -3034,7 +3034,7 @@ static void __e100_shutdown(struct pci_dev *pdev, bool *enable_wake)
                *enable_wake = false;
        }
-        pci_disable_device(pdev);
+        pci_clear_master(pdev);
 }
 static int __e100_power_off(struct pci_dev *pdev, bool wake)
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
index 6d4ada72dfd0..18076c4178b4 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
@@ -6881,7 +6881,7 @@ static inline int ixgbe_maybe_stop_tx(struct ixgbe_ring *tx_ring, u16 size)
 }
 static u16 ixgbe_select_queue(struct net_device *dev, struct sk_buff *skb,
-                              void *accel_priv)
+                              void *accel_priv, select_queue_fallback_t fallback)
 {
        struct ixgbe_fwd_adapter *fwd_adapter = accel_priv;
 #ifdef IXGBE_FCOE
@@ -6907,7 +6907,7 @@ static u16 ixgbe_select_queue(struct net_device *dev, struct sk_buff *skb,
                if (adapter->flags & IXGBE_FLAG_FCOE_ENABLED)
                        break;
        default:
-                return __netdev_pick_tx(dev, skb);
+                return fallback(dev, skb);
        }
        f = &adapter->ring_feature[RING_F_FCOE];
@@ -6920,7 +6920,7 @@ static u16 ixgbe_select_queue(struct net_device *dev, struct sk_buff *skb,
        return txq + f->offset;
 #else
-        return __netdev_pick_tx(dev, skb);
+        return fallback(dev, skb);
 #endif
 }
diff --git a/drivers/net/ethernet/lantiq_etop.c b/drivers/net/ethernet/lantiq_etop.c
index 8f9266c64c75..fd4b6aecf6ee 100644
--- a/drivers/net/ethernet/lantiq_etop.c
+++ b/drivers/net/ethernet/lantiq_etop.c
@@ -619,7 +619,7 @@ ltq_etop_set_multicast_list(struct net_device *dev)
 static u16
 ltq_etop_select_queue(struct net_device *dev, struct sk_buff *skb,
-                      void *accel_priv)
+                      void *accel_priv, select_queue_fallback_t fallback)
 {
        /* we are currently only using the first queue */
        return 0;
diff --git a/drivers/net/ethernet/marvell/Kconfig b/drivers/net/ethernet/marvell/Kconfig
index 6300fd27f2db..68e6a6613e9a 100644
--- a/drivers/net/ethernet/marvell/Kconfig
+++ b/drivers/net/ethernet/marvell/Kconfig
@@ -43,12 +43,12 @@ config MVMDIO
          This driver is used by the MV643XX_ETH and MVNETA drivers.
 config MVNETA
-        tristate "Marvell Armada 370/XP network interface support"
+        tristate "Marvell Armada 370/38x/XP network interface support"
-        depends on MACH_ARMADA_370_XP
+        depends on PLAT_ORION
        select MVMDIO
        ---help---
          This driver supports the network interface units in the
-          Marvell ARMADA XP and ARMADA 370 SoC family.
+          Marvell ARMADA XP, ARMADA 370 and ARMADA 38x SoC family.
          Note that this driver is distinct from the mv643xx_eth
          driver, which should be used for the older Marvell SoCs
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
index fad45316200a..84a96f70dfb5 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
@@ -742,6 +742,14 @@ static int mlx4_en_replace_mac(struct mlx4_en_priv *priv, int qpn,
                                err = mlx4_en_uc_steer_add(priv, new_mac,
                                                           &qpn,
                                                           &entry->reg_id);
+                                if (err)
+                                        return err;
+                                if (priv->tunnel_reg_id) {
+                                        mlx4_flow_detach(priv->mdev->dev, priv->tunnel_reg_id);
+                                        priv->tunnel_reg_id = 0;
+                                }
+                                err = mlx4_en_tunnel_steer_add(priv, new_mac, qpn,
+                                                               &priv->tunnel_reg_id);
                                return err;
                        }
                }
@@ -1792,6 +1800,8 @@ void mlx4_en_stop_port(struct net_device *dev, int detach)
                mc_list[5] = priv->port;
                mlx4_multicast_detach(mdev->dev, &priv->rss_map.indir_qp,
                                      mc_list, MLX4_PROT_ETH, mclist->reg_id);
+                if (mclist->tunnel_reg_id)
+                        mlx4_flow_detach(mdev->dev, mclist->tunnel_reg_id);
        }
        mlx4_en_clear_list(dev);
        list_for_each_entry_safe(mclist, tmp, &priv->curr_list, list) {
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_tx.c b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
index 8e8a7eb43a2c..13457032d15f 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_tx.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
@@ -629,7 +629,7 @@ static void build_inline_wqe(struct mlx4_en_tx_desc *tx_desc, struct sk_buff *sk
 }
 u16 mlx4_en_select_queue(struct net_device *dev, struct sk_buff *skb,
-                         void *accel_priv)
+                         void *accel_priv, select_queue_fallback_t fallback)
 {
        struct mlx4_en_priv *priv = netdev_priv(dev);
        u16 rings_p_up = priv->num_tx_rings_p_up;
@@ -641,7 +641,7 @@ u16 mlx4_en_select_queue(struct net_device *dev, struct sk_buff *skb,
        if (vlan_tx_tag_present(skb))
                up = vlan_tx_tag_get(skb) >> VLAN_PRIO_SHIFT;
-        return __netdev_pick_tx(dev, skb) % rings_p_up + up * rings_p_up;
+        return fallback(dev, skb) % rings_p_up + up * rings_p_up;
 }
 static void mlx4_bf_copy(void __iomem *dst, unsigned long *src, unsigned bytecnt)
diff --git a/drivers/net/ethernet/mellanox/mlx4/fw.c b/drivers/net/ethernet/mellanox/mlx4/fw.c
index 91b69ff4b4a2..7e2995ecea6f 100644
--- a/drivers/net/ethernet/mellanox/mlx4/fw.c
+++ b/drivers/net/ethernet/mellanox/mlx4/fw.c
@@ -129,13 +129,14 @@ static void dump_dev_cap_flags2(struct mlx4_dev *dev, u64 flags)
                [0] = "RSS support",
                [1] = "RSS Toeplitz Hash Function support",
                [2] = "RSS XOR Hash Function support",
-                [3] = "Device manage flow steering support",
+                [3] = "Device managed flow steering support",
                [4] = "Automatic MAC reassignment support",
                [5] = "Time stamping support",
                [6] = "VST (control vlan insertion/stripping) support",
                [7] = "FSM (MAC anti-spoofing) support",
                [8] = "Dynamic QP updates support",
-                [9] = "TCP/IP offloads/flow-steering for VXLAN support"
+                [9] = "Device managed flow steering IPoIB support",
+                [10] = "TCP/IP offloads/flow-steering for VXLAN support"
        };
        int i;
@@ -859,7 +860,7 @@ int mlx4_QUERY_DEV_CAP_wrapper(struct mlx4_dev *dev, int slave,
        MLX4_PUT(outbox->buf, field, QUERY_DEV_CAP_CQ_TS_SUPPORT_OFFSET);
        /* For guests, disable vxlan tunneling */
-        MLX4_GET(field, outbox, QUERY_DEV_CAP_VXLAN);
+        MLX4_GET(field, outbox->buf, QUERY_DEV_CAP_VXLAN);
        field &= 0xf7;
        MLX4_PUT(outbox->buf, field, QUERY_DEV_CAP_VXLAN);
@@ -869,7 +870,7 @@ int mlx4_QUERY_DEV_CAP_wrapper(struct mlx4_dev *dev, int slave,
        MLX4_PUT(outbox->buf, field, QUERY_DEV_CAP_BF_OFFSET);
        /* For guests, disable mw type 2 */
-        MLX4_GET(bmme_flags, outbox, QUERY_DEV_CAP_BMME_FLAGS_OFFSET);
+        MLX4_GET(bmme_flags, outbox->buf, QUERY_DEV_CAP_BMME_FLAGS_OFFSET);
        bmme_flags &= ~MLX4_BMME_FLAG_TYPE_2_WIN;
        MLX4_PUT(outbox->buf, bmme_flags, QUERY_DEV_CAP_BMME_FLAGS_OFFSET);
@@ -883,7 +884,7 @@ int mlx4_QUERY_DEV_CAP_wrapper(struct mlx4_dev *dev, int slave,
        }
        /* turn off ipoib managed steering for guests */
-        MLX4_GET(field, outbox, QUERY_DEV_CAP_FLOW_STEERING_IPOIB_OFFSET);
+        MLX4_GET(field, outbox->buf, QUERY_DEV_CAP_FLOW_STEERING_IPOIB_OFFSET);
        field &= ~0x80;
        MLX4_PUT(outbox->buf, field, QUERY_DEV_CAP_FLOW_STEERING_IPOIB_OFFSET);
diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
index d711158b0d4b..936c15364739 100644
--- a/drivers/net/ethernet/mellanox/mlx4/main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/main.c
@@ -150,6 +150,8 @@ struct mlx4_port_config {
        struct pci_dev *pdev;
 };
+static atomic_t pf_loading = ATOMIC_INIT(0);
 int mlx4_check_port_params(struct mlx4_dev *dev,
                           enum mlx4_port_type *port_type)
 {
@@ -749,7 +751,7 @@ static void mlx4_request_modules(struct mlx4_dev *dev)
                        has_eth_port = true;
        }
-        if (has_ib_port)
+        if (has_ib_port || (dev->caps.flags & MLX4_DEV_CAP_FLAG_IBOE))
                request_module_nowait(IB_DRV_NAME);
        if (has_eth_port)
                request_module_nowait(EN_DRV_NAME);
@@ -1407,6 +1409,11 @@ static int mlx4_init_slave(struct mlx4_dev *dev)
        u32 slave_read;
        u32 cmd_channel_ver;
+        if (atomic_read(&pf_loading)) {
+                mlx4_warn(dev, "PF is not ready. Deferring probe\n");
+                return -EPROBE_DEFER;
+        }
        mutex_lock(&priv->cmd.slave_cmd_mutex);
        priv->cmd.max_cmds = 1;
        mlx4_warn(dev, "Sending reset\n");
@@ -2319,7 +2326,11 @@ static int __mlx4_init_one(struct pci_dev *pdev, int pci_dev_data)
                if (num_vfs) {
                        mlx4_warn(dev, "Enabling SR-IOV with %d VFs\n", num_vfs);
+                        atomic_inc(&pf_loading);
                        err = pci_enable_sriov(pdev, num_vfs);
+                        atomic_dec(&pf_loading);
                        if (err) {
                                mlx4_err(dev, "Failed to enable SR-IOV, continuing without SR-IOV (err = %d).\n",
                                         err);
@@ -2684,6 +2695,7 @@ static struct pci_driver mlx4_driver = {
        .name           = DRV_NAME,
        .id_table       = mlx4_pci_table,
        .probe          = mlx4_init_one,
+        .shutdown       = mlx4_remove_one,
        .remove         = mlx4_remove_one,
        .err_handler    = &mlx4_err_handler,
 };
diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4.h b/drivers/net/ethernet/mellanox/mlx4/mlx4.h
index 6b65f7795215..7aec6c833973 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mlx4.h
+++ b/drivers/net/ethernet/mellanox/mlx4/mlx4.h
@@ -51,8 +51,8 @@
 #define DRV_NAME        "mlx4_core"
 #define PFX             DRV_NAME ": "
-#define DRV_VERSION     "1.1"
+#define DRV_VERSION     "2.2-1"
-#define DRV_RELDATE     "Dec, 2011"
+#define DRV_RELDATE     "Feb, 2014"
 #define MLX4_FS_UDP_UC_EN               (1 << 1)
 #define MLX4_FS_TCP_UC_EN               (1 << 2)
diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
index 3af04c3f42ea..b57e8c87a34e 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
+++ b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
@@ -57,8 +57,8 @@
 #include "en_port.h"
 #define DRV_NAME        "mlx4_en"
-#define DRV_VERSION     "2.0"
+#define DRV_VERSION     "2.2-1"
-#define DRV_RELDATE     "Dec 2011"
+#define DRV_RELDATE     "Feb 2014"
 #define MLX4_EN_MSG_LEVEL       (NETIF_MSG_LINK | NETIF_MSG_IFDOWN)
@@ -723,7 +723,7 @@ int mlx4_en_arm_cq(struct mlx4_en_priv *priv, struct mlx4_en_cq *cq);
 void mlx4_en_tx_irq(struct mlx4_cq *mcq);
 u16 mlx4_en_select_queue(struct net_device *dev, struct sk_buff *skb,
-                         void *accel_priv);
+                         void *accel_priv, select_queue_fallback_t fallback);
 netdev_tx_t mlx4_en_xmit(struct sk_buff *skb, struct net_device *dev);
 int mlx4_en_create_tx_ring(struct mlx4_en_priv *priv,
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/Kconfig b/drivers/net/ethernet/mellanox/mlx5/core/Kconfig
index 157fe8df2c3e..8ff57e8e3e91 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/Kconfig
+++ b/drivers/net/ethernet/mellanox/mlx5/core/Kconfig
@@ -4,5 +4,5 @@
 config MLX5_CORE
        tristate
-        depends on PCI && X86
+        depends on PCI
        default n
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
index a064f06e0cb8..23b7e2d35a93 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
@@ -46,8 +46,8 @@
 #include "mlx5_core.h"
 #define DRIVER_NAME "mlx5_core"
-#define DRIVER_VERSION "1.0"
+#define DRIVER_VERSION "2.2-1"
-#define DRIVER_RELDATE  "June 2013"
+#define DRIVER_RELDATE  "Feb 2014"
 MODULE_AUTHOR("Eli Cohen <eli@mellanox.com>");
 MODULE_DESCRIPTION("Mellanox ConnectX-IB HCA core library");
diff --git a/drivers/net/ethernet/micrel/ks8851.c b/drivers/net/ethernet/micrel/ks8851.c
index 727b546a9eb8..e0c92e0e5e1d 100644
--- a/drivers/net/ethernet/micrel/ks8851.c
+++ b/drivers/net/ethernet/micrel/ks8851.c
@@ -23,6 +23,7 @@
 #include <linux/crc32.h>
 #include <linux/mii.h>
 #include <linux/eeprom_93cx6.h>
+#include <linux/regulator/consumer.h>
 #include <linux/spi/spi.h>
@@ -83,6 +84,7 @@ union ks8851_tx_hdr {
 * @rc_rxqcr: Cached copy of KS_RXQCR.
 * @eeprom_size: Companion eeprom size in Bytes, 0 if no eeprom
 * @eeprom: 93CX6 EEPROM state for accessing on-board EEPROM.
+ * @vdd_reg:    Optional regulator supplying the chip
 *
 * The @lock ensures that the chip is protected when certain operations are
 * in progress. When the read or write packet transfer is in progress, most
@@ -130,6 +132,7 @@ struct ks8851_net {
        struct spi_transfer     spi_xfer2[2];
        struct eeprom_93cx6     eeprom;
+        struct regulator        *vdd_reg;
 };
 static int msg_enable;
@@ -1414,6 +1417,21 @@ static int ks8851_probe(struct spi_device *spi)
        ks->spidev = spi;
        ks->tx_space = 6144;
+        ks->vdd_reg = regulator_get_optional(&spi->dev, "vdd");
+        if (IS_ERR(ks->vdd_reg)) {
+                ret = PTR_ERR(ks->vdd_reg);
+                if (ret == -EPROBE_DEFER)
+                        goto err_reg;
+        } else {
+                ret = regulator_enable(ks->vdd_reg);
+                if (ret) {
+                        dev_err(&spi->dev, "regulator enable fail: %d\n",
+                                ret);
+                        goto err_reg_en;
+                }
+        }
        mutex_init(&ks->lock);
        spin_lock_init(&ks->statelock);
@@ -1508,8 +1526,14 @@ static int ks8851_probe(struct spi_device *spi)
 err_netdev:
        free_irq(ndev->irq, ks);
-err_id:
 err_irq:
+err_id:
+        if (!IS_ERR(ks->vdd_reg))
+                regulator_disable(ks->vdd_reg);
+err_reg_en:
+        if (!IS_ERR(ks->vdd_reg))
+                regulator_put(ks->vdd_reg);
+err_reg:
        free_netdev(ndev);
        return ret;
 }
@@ -1523,6 +1547,10 @@ static int ks8851_remove(struct spi_device *spi)
        unregister_netdev(priv->netdev);
        free_irq(spi->irq, priv);
+        if (!IS_ERR(priv->vdd_reg)) {
+                regulator_disable(priv->vdd_reg);
+                regulator_put(priv->vdd_reg);
+        }
        free_netdev(priv->netdev);
        return 0;
diff --git a/drivers/net/ethernet/neterion/vxge/vxge-main.c b/drivers/net/ethernet/neterion/vxge/vxge-main.c
index 1ded50ca1600..e46e8698e630 100644
--- a/drivers/net/ethernet/neterion/vxge/vxge-main.c
+++ b/drivers/net/ethernet/neterion/vxge/vxge-main.c
@@ -726,9 +726,6 @@ static int vxge_learn_mac(struct vxgedev *vdev, u8 *mac_header)
        int vpath_idx = 0;
        enum vxge_hw_status status = VXGE_HW_OK;
        struct vxge_vpath *vpath = NULL;
-        struct __vxge_hw_device *hldev;
-        hldev = pci_get_drvdata(vdev->pdev);
        mac_address = (u8 *)&mac_addr;
        memcpy(mac_address, mac_header, ETH_ALEN);
@@ -2443,9 +2440,6 @@ static void vxge_rem_msix_isr(struct vxgedev *vdev)
 static void vxge_rem_isr(struct vxgedev *vdev)
 {
-        struct __vxge_hw_device *hldev;
-        hldev = pci_get_drvdata(vdev->pdev);
 #ifdef CONFIG_PCI_MSI
        if (vdev->config.intr_type == MSI_X) {
                vxge_rem_msix_isr(vdev);
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
index 4146664d4d6a..27c4f131863b 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
@@ -340,6 +340,7 @@ int qlcnic_83xx_setup_intr(struct qlcnic_adapter *adapter)
                        if (qlcnic_sriov_vf_check(adapter))
                                return -EINVAL;
                        num_msix = 1;
+                        adapter->drv_sds_rings = QLCNIC_SINGLE_RING;
                        adapter->drv_tx_rings = QLCNIC_SINGLE_RING;
                }
        }
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.c
index 77f1bce432d2..7d4f54912bad 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.c
@@ -807,7 +807,7 @@ qlcnic_dcb_get_pg_tc_cfg_tx(struct net_device *netdev, int tc, u8 *prio,
            !type->tc_param_valid)
                return;
-        if (tc < 0 || (tc > QLC_DCB_MAX_TC))
+        if (tc < 0 || (tc >= QLC_DCB_MAX_TC))
                return;
        tc_cfg = &type->tc_cfg[tc];
@@ -843,7 +843,7 @@ static void qlcnic_dcb_get_pg_bwg_cfg_tx(struct net_device *netdev, int pgid,
            !type->tc_param_valid)
                return;
-        if (pgid < 0 || pgid > QLC_DCB_MAX_PG)
+        if (pgid < 0 || pgid >= QLC_DCB_MAX_PG)
                return;
        pgcfg = &type->pg_cfg[pgid];
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
index ba78c7481fa3..1222865cfb73 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
@@ -816,9 +816,10 @@ static int qlcnic_82xx_setup_intr(struct qlcnic_adapter *adapter)
                if (!(adapter->flags & QLCNIC_MSIX_ENABLED)) {
                        qlcnic_disable_multi_tx(adapter);
+                        adapter->drv_sds_rings = QLCNIC_SINGLE_RING;
                        err = qlcnic_enable_msi_legacy(adapter);
-                        if (!err)
+                        if (err)
                                return err;
                }
        }
@@ -3863,7 +3864,7 @@ int qlcnic_validate_rings(struct qlcnic_adapter *adapter, __u32 ring_cnt,
                strcpy(buf, "Tx");
        }
-        if (!qlcnic_use_msi_x && !qlcnic_use_msi) {
+        if (!QLCNIC_IS_MSI_FAMILY(adapter)) {
                netdev_err(netdev, "No RSS/TSS support in INT-x mode\n");
                return -EINVAL;
        }
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c
index 09acf15c3a56..e5277a632671 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c
@@ -13,8 +13,6 @@
 #define QLC_VF_MIN_TX_RATE      100
 #define QLC_VF_MAX_TX_RATE      9999
 #define QLC_MAC_OPCODE_MASK     0x7
-#define QLC_MAC_STAR_ADD        6
-#define QLC_MAC_STAR_DEL        7
 #define QLC_VF_FLOOD_BIT        BIT_16
 #define QLC_FLOOD_MODE          0x5
@@ -1206,13 +1204,6 @@ static int qlcnic_sriov_validate_cfg_macvlan(struct qlcnic_adapter *adapter,
        struct qlcnic_vport *vp = vf->vp;
        u8 op, new_op;
-        if (((cmd->req.arg[1] & QLC_MAC_OPCODE_MASK) == QLC_MAC_STAR_ADD) ||
-            ((cmd->req.arg[1] & QLC_MAC_OPCODE_MASK) == QLC_MAC_STAR_DEL)) {
-                netdev_err(adapter->netdev, "MAC + any VLAN filter not allowed from VF %d\n",
-                           vf->pci_func);
-                return -EINVAL;
-        }
        if (!(cmd->req.arg[1] & BIT_8))
                return -EINVAL;
diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
index 91a67ae8f17b..3ff7bc3e7a23 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -209,7 +209,7 @@ static const struct {
        [RTL_GIGA_MAC_VER_16] =
                _R("RTL8101e",          RTL_TD_0, NULL, JUMBO_1K, true),
        [RTL_GIGA_MAC_VER_17] =
-                _R("RTL8168b/8111b",    RTL_TD_1, NULL, JUMBO_4K, false),
+                _R("RTL8168b/8111b",    RTL_TD_0, NULL, JUMBO_4K, false),
        [RTL_GIGA_MAC_VER_18] =
                _R("RTL8168cp/8111cp",  RTL_TD_1, NULL, JUMBO_6K, false),
        [RTL_GIGA_MAC_VER_19] =
@@ -7118,6 +7118,8 @@ rtl_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
        }
        mutex_init(&tp->wk.mutex);
+        u64_stats_init(&tp->rx_stats.syncp);
+        u64_stats_init(&tp->tx_stats.syncp);
        /* Get MAC address */
        for (i = 0; i < ETH_ALEN; i++)
diff --git a/drivers/net/ethernet/sfc/ptp.c b/drivers/net/ethernet/sfc/ptp.c
index eb75fbd11a01..d7a36829649a 100644
--- a/drivers/net/ethernet/sfc/ptp.c
+++ b/drivers/net/ethernet/sfc/ptp.c
@@ -1668,6 +1668,13 @@ void efx_ptp_event(struct efx_nic *efx, efx_qword_t *ev)
        struct efx_ptp_data *ptp = efx->ptp_data;
        int code = EFX_QWORD_FIELD(*ev, MCDI_EVENT_CODE);
+        if (!ptp) {
+                if (net_ratelimit())
+                        netif_warn(efx, drv, efx->net_dev,
+                                   "Received PTP event but PTP not set up\n");
+                return;
+        }
        if (!ptp->enabled)
                return;
diff --git a/drivers/net/ethernet/sfc/tx.c b/drivers/net/ethernet/sfc/tx.c
index c49d1fb16965..75d11fa4eb0a 100644
--- a/drivers/net/ethernet/sfc/tx.c
+++ b/drivers/net/ethernet/sfc/tx.c
@@ -429,7 +429,9 @@ netdev_tx_t efx_enqueue_skb(struct efx_tx_queue *tx_queue, struct sk_buff *skb)
        }
        /* Transfer ownership of the skb to the final buffer */
+#ifdef EFX_USE_PIO
 finish_packet:
+#endif
        buffer->skb = skb;
        buffer->flags = EFX_TX_BUF_SKB | dma_flags;
diff --git a/drivers/net/ethernet/stmicro/stmmac/Kconfig b/drivers/net/ethernet/stmicro/stmmac/Kconfig
index e2f202e3932f..f2d7c702c77f 100644
--- a/drivers/net/ethernet/stmicro/stmmac/Kconfig
+++ b/drivers/net/ethernet/stmicro/stmmac/Kconfig
@@ -37,6 +37,17 @@ config DWMAC_SUNXI
          stmmac device driver. This driver is used for A20/A31
          GMAC    ethernet controller.
+config DWMAC_STI
+        bool "STi GMAC support"
+        depends on STMMAC_PLATFORM && ARCH_STI
+        default y
+        ---help---
+          Support for ethernet controller on STi SOCs.
+          This selects STi SoC glue layer support for the stmmac
+          device driver. This driver is used on for the STi series
+          SOCs GMAC ethernet controller.
 config STMMAC_PCI
        bool "STMMAC PCI bus support"
        depends on STMMAC_ETH && PCI
diff --git a/drivers/net/ethernet/stmicro/stmmac/Makefile b/drivers/net/ethernet/stmicro/stmmac/Makefile
index ecadecea79b2..dcef28775dad 100644
--- a/drivers/net/ethernet/stmicro/stmmac/Makefile
+++ b/drivers/net/ethernet/stmicro/stmmac/Makefile
@@ -2,6 +2,7 @@ obj-$(CONFIG_STMMAC_ETH) += stmmac.o
 stmmac-$(CONFIG_STMMAC_PLATFORM) += stmmac_platform.o
 stmmac-$(CONFIG_STMMAC_PCI) += stmmac_pci.o
 stmmac-$(CONFIG_DWMAC_SUNXI) += dwmac-sunxi.o
+stmmac-$(CONFIG_DWMAC_STI) += dwmac-sti.o
 stmmac-objs:= stmmac_main.o stmmac_ethtool.o stmmac_mdio.o ring_mode.o  \
              chain_mode.o dwmac_lib.o dwmac1000_core.o  dwmac1000_dma.o \
              dwmac100_core.o dwmac100_dma.o enh_desc.o  norm_desc.o \
diff --git a/drivers/net/ethernet/stmicro/stmmac/chain_mode.c b/drivers/net/ethernet/stmicro/stmmac/chain_mode.c
index 72d282bf33a5..c553f6b5a913 100644
--- a/drivers/net/ethernet/stmicro/stmmac/chain_mode.c
+++ b/drivers/net/ethernet/stmicro/stmmac/chain_mode.c
@@ -151,7 +151,7 @@ static void stmmac_clean_desc3(void *priv_ptr, struct dma_desc *p)
                                          sizeof(struct dma_desc)));
 }
-const struct stmmac_chain_mode_ops chain_mode_ops = {
+const struct stmmac_mode_ops chain_mode_ops = {
        .init = stmmac_init_dma_chain,
        .is_jumbo_frm = stmmac_is_jumbo_frm,
        .jumbo_frm = stmmac_jumbo_frm,
diff --git a/drivers/net/ethernet/stmicro/stmmac/common.h b/drivers/net/ethernet/stmicro/stmmac/common.h
index 7834a3993946..74610f3aca9e 100644
--- a/drivers/net/ethernet/stmicro/stmmac/common.h
+++ b/drivers/net/ethernet/stmicro/stmmac/common.h
@@ -419,20 +419,13 @@ struct mii_regs {
        unsigned int data;      /* MII Data */
 };
-struct stmmac_ring_mode_ops {
+struct stmmac_mode_ops {
-        unsigned int (*is_jumbo_frm) (int len, int ehn_desc);
-        unsigned int (*jumbo_frm) (void *priv, struct sk_buff *skb, int csum);
-        void (*refill_desc3) (void *priv, struct dma_desc *p);
-        void (*init_desc3) (struct dma_desc *p);
-        void (*clean_desc3) (void *priv, struct dma_desc *p);
-        int (*set_16kib_bfsize) (int mtu);
-};
-struct stmmac_chain_mode_ops {
        void (*init) (void *des, dma_addr_t phy_addr, unsigned int size,
                      unsigned int extend_desc);
        unsigned int (*is_jumbo_frm) (int len, int ehn_desc);
        unsigned int (*jumbo_frm) (void *priv, struct sk_buff *skb, int csum);
+        int (*set_16kib_bfsize)(int mtu);
+        void (*init_desc3)(struct dma_desc *p);
        void (*refill_desc3) (void *priv, struct dma_desc *p);
        void (*clean_desc3) (void *priv, struct dma_desc *p);
 };
@@ -441,8 +434,7 @@ struct mac_device_info {
        const struct stmmac_ops *mac;
        const struct stmmac_desc_ops *desc;
        const struct stmmac_dma_ops *dma;
-        const struct stmmac_ring_mode_ops *ring;
+        const struct stmmac_mode_ops *mode;
-        const struct stmmac_chain_mode_ops *chain;
        const struct stmmac_hwtimestamp *ptp;
        struct mii_regs mii;    /* MII register Addresses */
        struct mac_link link;
@@ -460,7 +452,7 @@ void stmmac_get_mac_addr(void __iomem *ioaddr, unsigned char *addr,
 void stmmac_set_mac(void __iomem *ioaddr, bool enable);
 void dwmac_dma_flush_tx_fifo(void __iomem *ioaddr);
-extern const struct stmmac_ring_mode_ops ring_mode_ops;
+extern const struct stmmac_mode_ops ring_mode_ops;
-extern const struct stmmac_chain_mode_ops chain_mode_ops;
+extern const struct stmmac_mode_ops chain_mode_ops;
 #endif /* __COMMON_H__ */
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-sti.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-sti.c
new file mode 100644
index 000000000000..552bbc17863c
--- /dev/null
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sti.c
@@ -0,0 +1,330 @@
+/**
+ * dwmac-sti.c - STMicroelectronics DWMAC Specific Glue layer
+ *
+ * Copyright (C) 2003-2014 STMicroelectronics (R&D) Limited
+ * Author: Srinivas Kandagatla <srinivas.kandagatla@st.com>
+ *
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+#include <linux/kernel.h>
+#include <linux/slab.h>
+#include <linux/platform_device.h>
+#include <linux/stmmac.h>
+#include <linux/phy.h>
+#include <linux/mfd/syscon.h>
+#include <linux/regmap.h>
+#include <linux/clk.h>
+#include <linux/of.h>
+#include <linux/of_net.h>
+/**
+ *                      STi GMAC glue logic.
+ *                      --------------------
+ *
+ *               _
+ *              |  \
+ *      --------|0  \ ETH_SEL_INTERNAL_NOTEXT_PHYCLK
+ * phyclk       |    |___________________________________________
+ *              |    |  |                       (phyclk-in)
+ *      --------|1  /   |
+ * int-clk      |_ /    |
+ *                      |        _
+ *                      |       |  \
+ *                      |_______|1  \ ETH_SEL_TX_RETIME_CLK
+ *                              |    |___________________________
+ *                              |    |          (tx-retime-clk)
+ *                       _______|0  /
+ *                      |       |_ /
+ *               _      |
+ *              |  \    |
+ *      --------|0  \   |
+ * clk_125      |    |__|
+ *              |    |  ETH_SEL_TXCLK_NOT_CLK125
+ *      --------|1  /
+ * txclk        |_ /
+ *
+ *
+ * ETH_SEL_INTERNAL_NOTEXT_PHYCLK is valid only for RMII where PHY can
+ * generate 50MHz clock or MAC can generate it.
+ * This bit is configured by "st,ext-phyclk" property.
+ *
+ * ETH_SEL_TXCLK_NOT_CLK125 is only valid for gigabit modes, where the 125Mhz
+ * clock either comes from clk-125 pin or txclk pin. This configuration is
+ * totally driven by the board wiring. This bit is configured by
+ * "st,tx-retime-src" property.
+ *
+ * TXCLK configuration is different for different phy interface modes
+ * and changes according to link speed in modes like RGMII.
+ *
+ * Below table summarizes the clock requirement and clock sources for
+ * supported phy interface modes with link speeds.
+ * ________________________________________________
+ *|  PHY_MODE   | 1000 Mbit Link | 100 Mbit Link   |
+ * ------------------------------------------------
+ *|     MII     |       n/a      |      25Mhz      |
+ *|             |                |      txclk      |
+ * ------------------------------------------------
+ *|     GMII    |     125Mhz     |      25Mhz      |
+ *|             |  clk-125/txclk |      txclk      |
+ * ------------------------------------------------
+ *|     RGMII   |     125Mhz     |      25Mhz      |
+ *|             |  clk-125/txclk |      clkgen     |
+ * ------------------------------------------------
+ *|     RMII    |       n/a      |      25Mhz      |
+ *|             |                |clkgen/phyclk-in |
+ * ------------------------------------------------
+ *
+ * TX lines are always retimed with a clk, which can vary depending
+ * on the board configuration. Below is the table of these bits
+ * in eth configuration register depending on source of retime clk.
+ *
+ *---------------------------------------------------------------
+ * src   | tx_rt_clk    | int_not_ext_phyclk    | txclk_n_clk125|
+ *---------------------------------------------------------------
+ * txclk |      0       |       n/a             |       1       |
+ *---------------------------------------------------------------
+ * ck_125|      0       |       n/a             |       0       |
+ *---------------------------------------------------------------
+ * phyclk|      1       |       0               |       n/a     |
+ *---------------------------------------------------------------
+ * clkgen|      1       |       1               |       n/a     |
+ *---------------------------------------------------------------
+ */
+ /* Register definition */
+ /* 3 bits [8:6]
+  *  [6:6]      ETH_SEL_TXCLK_NOT_CLK125
+  *  [7:7]      ETH_SEL_INTERNAL_NOTEXT_PHYCLK
+  *  [8:8]      ETH_SEL_TX_RETIME_CLK
+  *
+  */
+#define TX_RETIME_SRC_MASK              GENMASK(8, 6)
+#define ETH_SEL_TX_RETIME_CLK           BIT(8)
+#define ETH_SEL_INTERNAL_NOTEXT_PHYCLK  BIT(7)
+#define ETH_SEL_TXCLK_NOT_CLK125        BIT(6)
+#define ENMII_MASK                      GENMASK(5, 5)
+#define ENMII                           BIT(5)
+/**
+ * 3 bits [4:2]
+ *      000-GMII/MII
+ *      001-RGMII
+ *      010-SGMII
+ *      100-RMII
+*/
+#define MII_PHY_SEL_MASK                GENMASK(4, 2)
+#define ETH_PHY_SEL_RMII                BIT(4)
+#define ETH_PHY_SEL_SGMII               BIT(3)
+#define ETH_PHY_SEL_RGMII               BIT(2)
+#define ETH_PHY_SEL_GMII                0x0
+#define ETH_PHY_SEL_MII                 0x0
+#define IS_PHY_IF_MODE_RGMII(iface)     (iface == PHY_INTERFACE_MODE_RGMII || \
+                        iface == PHY_INTERFACE_MODE_RGMII_ID || \
+                        iface == PHY_INTERFACE_MODE_RGMII_RXID || \
+                        iface == PHY_INTERFACE_MODE_RGMII_TXID)
+#define IS_PHY_IF_MODE_GBIT(iface)      (IS_PHY_IF_MODE_RGMII(iface) || \
+                        iface == PHY_INTERFACE_MODE_GMII)
+struct sti_dwmac {
+        int interface;
+        bool ext_phyclk;
+        bool is_tx_retime_src_clk_125;
+        struct clk *clk;
+        int reg;
+        struct device *dev;
+        struct regmap *regmap;
+};
+static u32 phy_intf_sels[] = {
+        [PHY_INTERFACE_MODE_MII] = ETH_PHY_SEL_MII,
+        [PHY_INTERFACE_MODE_GMII] = ETH_PHY_SEL_GMII,
+        [PHY_INTERFACE_MODE_RGMII] = ETH_PHY_SEL_RGMII,
+        [PHY_INTERFACE_MODE_RGMII_ID] = ETH_PHY_SEL_RGMII,
+        [PHY_INTERFACE_MODE_SGMII] = ETH_PHY_SEL_SGMII,
+        [PHY_INTERFACE_MODE_RMII] = ETH_PHY_SEL_RMII,
+};
+enum {
+        TX_RETIME_SRC_NA = 0,
+        TX_RETIME_SRC_TXCLK = 1,
+        TX_RETIME_SRC_CLK_125,
+        TX_RETIME_SRC_PHYCLK,
+        TX_RETIME_SRC_CLKGEN,
+};
+static const char *const tx_retime_srcs[] = {
+        [TX_RETIME_SRC_NA] = "",
+        [TX_RETIME_SRC_TXCLK] = "txclk",
+        [TX_RETIME_SRC_CLK_125] = "clk_125",
+        [TX_RETIME_SRC_PHYCLK] = "phyclk",
+        [TX_RETIME_SRC_CLKGEN] = "clkgen",
+};
+static u32 tx_retime_val[] = {
+        [TX_RETIME_SRC_TXCLK] = ETH_SEL_TXCLK_NOT_CLK125,
+        [TX_RETIME_SRC_CLK_125] = 0x0,
+        [TX_RETIME_SRC_PHYCLK] = ETH_SEL_TX_RETIME_CLK,
+        [TX_RETIME_SRC_CLKGEN] = ETH_SEL_TX_RETIME_CLK |
+            ETH_SEL_INTERNAL_NOTEXT_PHYCLK,
+};
+static void setup_retime_src(struct sti_dwmac *dwmac, u32 spd)
+{
+        u32 src = 0, freq = 0;
+        if (spd == SPEED_100) {
+                if (dwmac->interface == PHY_INTERFACE_MODE_MII ||
+                    dwmac->interface == PHY_INTERFACE_MODE_GMII) {
+                        src = TX_RETIME_SRC_TXCLK;
+                } else if (dwmac->interface == PHY_INTERFACE_MODE_RMII) {
+                        if (dwmac->ext_phyclk) {
+                                src = TX_RETIME_SRC_PHYCLK;
+                        } else {
+                                src = TX_RETIME_SRC_CLKGEN;
+                                freq = 50000000;
+                        }
+                } else if (IS_PHY_IF_MODE_RGMII(dwmac->interface)) {
+                        src = TX_RETIME_SRC_CLKGEN;
+                        freq = 25000000;
+                }
+                if (src == TX_RETIME_SRC_CLKGEN && dwmac->clk)
+                        clk_set_rate(dwmac->clk, freq);
+        } else if (spd == SPEED_1000) {
+                if (dwmac->is_tx_retime_src_clk_125)
+                        src = TX_RETIME_SRC_CLK_125;
+                else
+                        src = TX_RETIME_SRC_TXCLK;
+        }
+        regmap_update_bits(dwmac->regmap, dwmac->reg,
+                           TX_RETIME_SRC_MASK, tx_retime_val[src]);
+}
+static void sti_dwmac_exit(struct platform_device *pdev, void *priv)
+{
+        struct sti_dwmac *dwmac = priv;
+        if (dwmac->clk)
+                clk_disable_unprepare(dwmac->clk);
+}
+static void sti_fix_mac_speed(void *priv, unsigned int spd)
+{
+        struct sti_dwmac *dwmac = priv;
+        setup_retime_src(dwmac, spd);
+        return;
+}
+static int sti_dwmac_parse_data(struct sti_dwmac *dwmac,
+                                struct platform_device *pdev)
+{
+        struct resource *res;
+        struct device *dev = &pdev->dev;
+        struct device_node *np = dev->of_node;
+        struct regmap *regmap;
+        int err;
+        if (!np)
+                return -EINVAL;
+        res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "sti-ethconf");
+        if (!res)
+                return -ENODATA;
+        regmap = syscon_regmap_lookup_by_phandle(np, "st,syscon");
+        if (IS_ERR(regmap))
+                return PTR_ERR(regmap);
+        dwmac->dev = dev;
+        dwmac->interface = of_get_phy_mode(np);
+        dwmac->regmap = regmap;
+        dwmac->reg = res->start;
+        dwmac->ext_phyclk = of_property_read_bool(np, "st,ext-phyclk");
+        dwmac->is_tx_retime_src_clk_125 = false;
+        if (IS_PHY_IF_MODE_GBIT(dwmac->interface)) {
+                const char *rs;
+                err = of_property_read_string(np, "st,tx-retime-src", &rs);
+                if (err < 0) {
+                        dev_err(dev, "st,tx-retime-src not specified\n");
+                        return err;
+                }
+                if (!strcasecmp(rs, "clk_125"))
+                        dwmac->is_tx_retime_src_clk_125 = true;
+        }
+        dwmac->clk = devm_clk_get(dev, "sti-ethclk");
+        if (IS_ERR(dwmac->clk))
+                dwmac->clk = NULL;
+        return 0;
+}
+static int sti_dwmac_init(struct platform_device *pdev, void *priv)
+{
+        struct sti_dwmac *dwmac = priv;
+        struct regmap *regmap = dwmac->regmap;
+        int iface = dwmac->interface;
+        u32 reg = dwmac->reg;
+        u32 val, spd;
+        if (dwmac->clk)
+                clk_prepare_enable(dwmac->clk);
+        regmap_update_bits(regmap, reg, MII_PHY_SEL_MASK, phy_intf_sels[iface]);
+        val = (iface == PHY_INTERFACE_MODE_REVMII) ? 0 : ENMII;
+        regmap_update_bits(regmap, reg, ENMII_MASK, val);
+        if (IS_PHY_IF_MODE_GBIT(iface))
+                spd = SPEED_1000;
+        else
+                spd = SPEED_100;
+        setup_retime_src(dwmac, spd);
+        return 0;
+}
+static void *sti_dwmac_setup(struct platform_device *pdev)
+{
+        struct sti_dwmac *dwmac;
+        int ret;
+        dwmac = devm_kzalloc(&pdev->dev, sizeof(*dwmac), GFP_KERNEL);
+        if (!dwmac)
+                return ERR_PTR(-ENOMEM);
+        ret = sti_dwmac_parse_data(dwmac, pdev);
+        if (ret) {
+                dev_err(&pdev->dev, "Unable to parse OF data\n");
+                return ERR_PTR(ret);
+        }
+        return dwmac;
+}
+const struct stmmac_of_data sti_gmac_data = {
+        .fix_mac_speed = sti_fix_mac_speed,
+        .setup = sti_dwmac_setup,
+        .init = sti_dwmac_init,
+        .exit = sti_dwmac_exit,
+};
diff --git a/drivers/net/ethernet/stmicro/stmmac/ring_mode.c b/drivers/net/ethernet/stmicro/stmmac/ring_mode.c
index a96c7c2f5f3f..650a4be6bce5 100644
--- a/drivers/net/ethernet/stmicro/stmmac/ring_mode.c
+++ b/drivers/net/ethernet/stmicro/stmmac/ring_mode.c
@@ -100,10 +100,9 @@ static void stmmac_refill_desc3(void *priv_ptr, struct dma_desc *p)
 {
        struct stmmac_priv *priv = (struct stmmac_priv *)priv_ptr;
-        if (unlikely(priv->plat->has_gmac))
+        /* Fill DES3 in case of RING mode */
-                /* Fill DES3 in case of RING mode */
+        if (priv->dma_buf_sz >= BUF_SIZE_8KiB)
-                if (priv->dma_buf_sz >= BUF_SIZE_8KiB)
+                p->des3 = p->des2 + BUF_SIZE_8KiB;
-                        p->des3 = p->des2 + BUF_SIZE_8KiB;
 }
 /* In ring mode we need to fill the desc3 because it is used as buffer */
@@ -126,7 +125,7 @@ static int stmmac_set_16kib_bfsize(int mtu)
        return ret;
 }
-const struct stmmac_ring_mode_ops ring_mode_ops = {
+const struct stmmac_mode_ops ring_mode_ops = {
        .is_jumbo_frm = stmmac_is_jumbo_frm,
        .jumbo_frm = stmmac_jumbo_frm,
        .refill_desc3 = stmmac_refill_desc3,
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac.h b/drivers/net/ethernet/stmicro/stmmac/stmmac.h
index d9af26ed58ee..f9e60d7918c4 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac.h
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac.h
@@ -133,6 +133,9 @@ bool stmmac_eee_init(struct stmmac_priv *priv);
 #ifdef CONFIG_DWMAC_SUNXI
 extern const struct stmmac_of_data sun7i_gmac_data;
 #endif
+#ifdef CONFIG_DWMAC_STI
+extern const struct stmmac_of_data sti_gmac_data;
+#endif
 extern struct platform_driver stmmac_pltfr_driver;
 static inline int stmmac_register_platform(void)
 {
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index a2e7d2c96e36..8543e1cfd55e 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -92,8 +92,8 @@ static int tc = TC_DEFAULT;
 module_param(tc, int, S_IRUGO | S_IWUSR);
 MODULE_PARM_DESC(tc, "DMA threshold control value");
-#define DMA_BUFFER_SIZE BUF_SIZE_4KiB
+#define DEFAULT_BUFSIZE 1536
-static int buf_sz = DMA_BUFFER_SIZE;
+static int buf_sz = DEFAULT_BUFSIZE;
 module_param(buf_sz, int, S_IRUGO | S_IWUSR);
 MODULE_PARM_DESC(buf_sz, "DMA buffer size");
@@ -136,8 +136,8 @@ static void stmmac_verify_args(void)
                dma_rxsize = DMA_RX_SIZE;
        if (unlikely(dma_txsize < 0))
                dma_txsize = DMA_TX_SIZE;
-        if (unlikely((buf_sz < DMA_BUFFER_SIZE) || (buf_sz > BUF_SIZE_16KiB)))
+        if (unlikely((buf_sz < DEFAULT_BUFSIZE) || (buf_sz > BUF_SIZE_16KiB)))
-                buf_sz = DMA_BUFFER_SIZE;
+                buf_sz = DEFAULT_BUFSIZE;
        if (unlikely(flow_ctrl > 1))
                flow_ctrl = FLOW_AUTO;
        else if (likely(flow_ctrl < 0))
@@ -286,10 +286,25 @@ bool stmmac_eee_init(struct stmmac_priv *priv)
        /* MAC core supports the EEE feature. */
        if (priv->dma_cap.eee) {
+                int tx_lpi_timer = priv->tx_lpi_timer;
                /* Check if the PHY supports EEE */
-                if (phy_init_eee(priv->phydev, 1))
+                if (phy_init_eee(priv->phydev, 1)) {
+                        /* To manage at run-time if the EEE cannot be supported
+                         * anymore (for example because the lp caps have been
+                         * changed).
+                         * In that case the driver disable own timers.
+                         */
+                        if (priv->eee_active) {
+                                pr_debug("stmmac: disable EEE\n");
+                                del_timer_sync(&priv->eee_ctrl_timer);
+                                priv->hw->mac->set_eee_timer(priv->ioaddr, 0,
+                                                             tx_lpi_timer);
+                        }
+                        priv->eee_active = 0;
                        goto out;
+                }
+                /* Activate the EEE and start timers */
                if (!priv->eee_active) {
                        priv->eee_active = 1;
                        init_timer(&priv->eee_ctrl_timer);
@@ -300,13 +315,13 @@ bool stmmac_eee_init(struct stmmac_priv *priv)
                        priv->hw->mac->set_eee_timer(priv->ioaddr,
                                                     STMMAC_DEFAULT_LIT_LS,
-                                                     priv->tx_lpi_timer);
+                                                     tx_lpi_timer);
                } else
                        /* Set HW EEE according to the speed */
                        priv->hw->mac->set_eee_pls(priv->ioaddr,
                                                   priv->phydev->link);
-                pr_info("stmmac: Energy-Efficient Ethernet initialized\n");
+                pr_debug("stmmac: Energy-Efficient Ethernet initialized\n");
                ret = true;
        }
@@ -886,10 +901,10 @@ static int stmmac_set_bfsize(int mtu, int bufsize)
                ret = BUF_SIZE_8KiB;
        else if (mtu >= BUF_SIZE_2KiB)
                ret = BUF_SIZE_4KiB;
-        else if (mtu >= DMA_BUFFER_SIZE)
+        else if (mtu > DEFAULT_BUFSIZE)
                ret = BUF_SIZE_2KiB;
        else
-                ret = DMA_BUFFER_SIZE;
+                ret = DEFAULT_BUFSIZE;
        return ret;
 }
@@ -951,9 +966,9 @@ static int stmmac_init_rx_buffers(struct stmmac_priv *priv, struct dma_desc *p,
        p->des2 = priv->rx_skbuff_dma[i];
-        if ((priv->mode == STMMAC_RING_MODE) &&
+        if ((priv->hw->mode->init_desc3) &&
            (priv->dma_buf_sz == BUF_SIZE_16KiB))
-                priv->hw->ring->init_desc3(p);
+                priv->hw->mode->init_desc3(p);
        return 0;
 }
@@ -984,11 +999,8 @@ static int init_dma_desc_rings(struct net_device *dev)
        unsigned int bfsize = 0;
        int ret = -ENOMEM;
-        /* Set the max buffer size according to the DESC mode
+        if (priv->hw->mode->set_16kib_bfsize)
-         * and the MTU. Note that RING mode allows 16KiB bsize.
+                bfsize = priv->hw->mode->set_16kib_bfsize(dev->mtu);
-         */
-        if (priv->mode == STMMAC_RING_MODE)
-                bfsize = priv->hw->ring->set_16kib_bfsize(dev->mtu);
        if (bfsize < BUF_SIZE_16KiB)
                bfsize = stmmac_set_bfsize(dev->mtu, priv->dma_buf_sz);
@@ -1029,15 +1041,15 @@ static int init_dma_desc_rings(struct net_device *dev)
        /* Setup the chained descriptor addresses */
        if (priv->mode == STMMAC_CHAIN_MODE) {
                if (priv->extend_desc) {
-                        priv->hw->chain->init(priv->dma_erx, priv->dma_rx_phy,
+                        priv->hw->mode->init(priv->dma_erx, priv->dma_rx_phy,
-                                              rxsize, 1);
+                                             rxsize, 1);
-                        priv->hw->chain->init(priv->dma_etx, priv->dma_tx_phy,
+                        priv->hw->mode->init(priv->dma_etx, priv->dma_tx_phy,
-                                              txsize, 1);
+                                             txsize, 1);
                } else {
-                        priv->hw->chain->init(priv->dma_rx, priv->dma_rx_phy,
+                        priv->hw->mode->init(priv->dma_rx, priv->dma_rx_phy,
-                                              rxsize, 0);
+                                             rxsize, 0);
-                        priv->hw->chain->init(priv->dma_tx, priv->dma_tx_phy,
+                        priv->hw->mode->init(priv->dma_tx, priv->dma_tx_phy,
-                                              txsize, 0);
+                                             txsize, 0);
                }
        }
@@ -1288,7 +1300,7 @@ static void stmmac_tx_clean(struct stmmac_priv *priv)
                                         DMA_TO_DEVICE);
                        priv->tx_skbuff_dma[entry] = 0;
                }
-                priv->hw->ring->clean_desc3(priv, p);
+                priv->hw->mode->clean_desc3(priv, p);
                if (likely(skb != NULL)) {
                        dev_kfree_skb(skb);
@@ -1705,7 +1717,7 @@ static int stmmac_open(struct net_device *dev)
        priv->dma_rx_size = STMMAC_ALIGN(dma_rxsize);
        priv->dma_buf_sz = STMMAC_ALIGN(buf_sz);
-        alloc_dma_desc_resources(priv);
+        ret = alloc_dma_desc_resources(priv);
        if (ret < 0) {
                pr_err("%s: DMA descriptors allocation failed\n", __func__);
                goto dma_desc_error;
@@ -1844,6 +1856,7 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev)
        int nfrags = skb_shinfo(skb)->nr_frags;
        struct dma_desc *desc, *first;
        unsigned int nopaged_len = skb_headlen(skb);
+        unsigned int enh_desc = priv->plat->enh_desc;
        if (unlikely(stmmac_tx_avail(priv) < nfrags + 1)) {
                if (!netif_queue_stopped(dev)) {
@@ -1871,27 +1884,19 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev)
        first = desc;
        /* To program the descriptors according to the size of the frame */
-        if (priv->mode == STMMAC_RING_MODE) {
+        if (enh_desc)
-                is_jumbo = priv->hw->ring->is_jumbo_frm(skb->len,
+                is_jumbo = priv->hw->mode->is_jumbo_frm(skb->len, enh_desc);
-                                                        priv->plat->enh_desc);
-                if (unlikely(is_jumbo))
-                        entry = priv->hw->ring->jumbo_frm(priv, skb,
-                                                          csum_insertion);
-        } else {
-                is_jumbo = priv->hw->chain->is_jumbo_frm(skb->len,
-                                                         priv->plat->enh_desc);
-                if (unlikely(is_jumbo))
-                        entry = priv->hw->chain->jumbo_frm(priv, skb,
-                                                           csum_insertion);
-        }
        if (likely(!is_jumbo)) {
                desc->des2 = dma_map_single(priv->device, skb->data,
                                            nopaged_len, DMA_TO_DEVICE);
                priv->tx_skbuff_dma[entry] = desc->des2;
                priv->hw->desc->prepare_tx_desc(desc, 1, nopaged_len,
                                                csum_insertion, priv->mode);
-        } else
+        } else {
                desc = first;
+                entry = priv->hw->mode->jumbo_frm(priv, skb, csum_insertion);
+        }
        for (i = 0; i < nfrags; i++) {
                const skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
@@ -2029,7 +2034,7 @@ static inline void stmmac_rx_refill(struct stmmac_priv *priv)
                        p->des2 = priv->rx_skbuff_dma[entry];
-                        priv->hw->ring->refill_desc3(priv, p);
+                        priv->hw->mode->refill_desc3(priv, p);
                        if (netif_msg_rx_status(priv))
                                pr_debug("\trefill entry #%d\n", entry);
@@ -2633,11 +2638,11 @@ static int stmmac_hw_init(struct stmmac_priv *priv)
        /* To use the chained or ring mode */
        if (chain_mode) {
-                priv->hw->chain = &chain_mode_ops;
+                priv->hw->mode = &chain_mode_ops;
                pr_info(" Chain mode enabled\n");
                priv->mode = STMMAC_CHAIN_MODE;
        } else {
-                priv->hw->ring = &ring_mode_ops;
+                priv->hw->mode = &ring_mode_ops;
                pr_info(" Ring mode enabled\n");
                priv->mode = STMMAC_RING_MODE;
        }
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
index 5884a7d2063b..8fb32a80f1c1 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
@@ -33,6 +33,11 @@ static const struct of_device_id stmmac_dt_ids[] = {
 #ifdef CONFIG_DWMAC_SUNXI
        { .compatible = "allwinner,sun7i-a20-gmac", .data = &sun7i_gmac_data},
 #endif
+#ifdef CONFIG_DWMAC_STI
+        { .compatible = "st,stih415-dwmac", .data = &sti_gmac_data},
+        { .compatible = "st,stih416-dwmac", .data = &sti_gmac_data},
+        { .compatible = "st,stid127-dwmac", .data = &sti_gmac_data},
+#endif
        /* SoC specific glue layers should come before generic bindings */
        { .compatible = "st,spear600-gmac"},
        { .compatible = "snps,dwmac-3.610"},
diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
index bde63e3af96f..7d6d8ec676c8 100644
--- a/drivers/net/ethernet/ti/cpsw.c
+++ b/drivers/net/ethernet/ti/cpsw.c
@@ -554,7 +554,7 @@ static void cpsw_set_promiscious(struct net_device *ndev, bool enable)
                 * common for both the interface as the interface shares
                 * the same hardware resource.
                 */
-                for (i = 0; i <= priv->data.slaves; i++)
+                for (i = 0; i < priv->data.slaves; i++)
                        if (priv->slaves[i].ndev->flags & IFF_PROMISC)
                                flag = true;
@@ -578,7 +578,7 @@ static void cpsw_set_promiscious(struct net_device *ndev, bool enable)
                        unsigned long timeout = jiffies + HZ;
                        /* Disable Learn for all ports */
-                        for (i = 0; i <= priv->data.slaves; i++) {
+                        for (i = 0; i < priv->data.slaves; i++) {
                                cpsw_ale_control_set(ale, i,
                                                     ALE_PORT_NOLEARN, 1);
                                cpsw_ale_control_set(ale, i,
@@ -606,7 +606,7 @@ static void cpsw_set_promiscious(struct net_device *ndev, bool enable)
                        cpsw_ale_control_set(ale, 0, ALE_P0_UNI_FLOOD, 0);
                        /* Enable Learn for all ports */
-                        for (i = 0; i <= priv->data.slaves; i++) {
+                        for (i = 0; i < priv->data.slaves; i++) {
                                cpsw_ale_control_set(ale, i,
                                                     ALE_PORT_NOLEARN, 0);
                                cpsw_ale_control_set(ale, i,
@@ -1164,11 +1164,17 @@ static void cpsw_init_host_port(struct cpsw_priv *priv)
 static void cpsw_slave_stop(struct cpsw_slave *slave, struct cpsw_priv *priv)
 {
+        u32 slave_port;
+        slave_port = cpsw_get_slave_port(priv, slave->slave_num);
        if (!slave->phy)
                return;
        phy_stop(slave->phy);
        phy_disconnect(slave->phy);
        slave->phy = NULL;
+        cpsw_ale_control_set(priv->ale, slave_port,
+                             ALE_PORT_STATE, ALE_PORT_STATE_DISABLE);
 }
 static int cpsw_ndo_open(struct net_device *ndev)
@@ -1878,14 +1884,29 @@ static int cpsw_probe_dt(struct cpsw_platform_data *data,
                mdio_node = of_find_node_by_phandle(be32_to_cpup(parp));
                phyid = be32_to_cpup(parp+1);
                mdio = of_find_device_by_node(mdio_node);
-                snprintf(slave_data->phy_id, sizeof(slave_data->phy_id),
-                         PHY_ID_FMT, mdio->name, phyid);
+                if (strncmp(mdio->name, "gpio", 4) == 0) {
+                        /* GPIO bitbang MDIO driver attached */
+                        struct mii_bus *bus = dev_get_drvdata(&mdio->dev);
+                        snprintf(slave_data->phy_id, sizeof(slave_data->phy_id),
+                                 PHY_ID_FMT, bus->id, phyid);
+                } else {
+                        /* davinci MDIO driver attached */
+                        snprintf(slave_data->phy_id, sizeof(slave_data->phy_id),
+                                 PHY_ID_FMT, mdio->name, phyid);
+                }
                mac_addr = of_get_mac_address(slave_node);
                if (mac_addr)
                        memcpy(slave_data->mac_addr, mac_addr, ETH_ALEN);
                slave_data->phy_if = of_get_phy_mode(slave_node);
+                if (slave_data->phy_if < 0) {
+                        pr_err("Missing or malformed slave[%d] phy-mode property\n",
+                               i);
+                        return slave_data->phy_if;
+                }
                if (data->dual_emac) {
                        if (of_property_read_u32(slave_node, "dual_emac_res_vlan",
@@ -2208,10 +2229,6 @@ static int cpsw_probe(struct platform_device *pdev)
                goto clean_ale_ret;
        }
-        if (cpts_register(&pdev->dev, priv->cpts,
-                          data->cpts_clock_mult, data->cpts_clock_shift))
-                dev_err(priv->dev, "error registering cpts device\n");
        cpsw_notice(priv, probe, "initialized device (regs %pa, irq %d)\n",
                    &ss_res->start, ndev->irq);
diff --git a/drivers/net/ethernet/ti/davinci_cpdma.c b/drivers/net/ethernet/ti/davinci_cpdma.c
index 364d0c7952c0..88ef27067bf2 100644
--- a/drivers/net/ethernet/ti/davinci_cpdma.c
+++ b/drivers/net/ethernet/ti/davinci_cpdma.c
@@ -355,7 +355,7 @@ int cpdma_ctlr_stop(struct cpdma_ctlr *ctlr)
        int i;
        spin_lock_irqsave(&ctlr->lock, flags);
-        if (ctlr->state != CPDMA_STATE_ACTIVE) {
+        if (ctlr->state == CPDMA_STATE_TEARDOWN) {
                spin_unlock_irqrestore(&ctlr->lock, flags);
                return -EINVAL;
        }
@@ -891,7 +891,7 @@ int cpdma_chan_stop(struct cpdma_chan *chan)
        unsigned                timeout;
        spin_lock_irqsave(&chan->lock, flags);
-        if (chan->state != CPDMA_STATE_ACTIVE) {
+        if (chan->state == CPDMA_STATE_TEARDOWN) {
                spin_unlock_irqrestore(&chan->lock, flags);
                return -EINVAL;
        }
diff --git a/drivers/net/ethernet/ti/davinci_emac.c b/drivers/net/ethernet/ti/davinci_emac.c
index cd9b164a0434..8f0e69ce07ca 100644
--- a/drivers/net/ethernet/ti/davinci_emac.c
+++ b/drivers/net/ethernet/ti/davinci_emac.c
@@ -1532,9 +1532,9 @@ static int emac_dev_open(struct net_device *ndev)
        struct device *emac_dev = &ndev->dev;
        u32 cnt;
        struct resource *res;
-        int ret;
+        int q, m, ret;
+        int res_num = 0, irq_num = 0;
        int i = 0;
-        int k = 0;
        struct emac_priv *priv = netdev_priv(ndev);
        pm_runtime_get(&priv->pdev->dev);
@@ -1564,15 +1564,24 @@ static int emac_dev_open(struct net_device *ndev)
        }
        /* Request IRQ */
+        while ((res = platform_get_resource(priv->pdev, IORESOURCE_IRQ,
+                                            res_num))) {
+                for (irq_num = res->start; irq_num <= res->end; irq_num++) {
+                        dev_err(emac_dev, "Request IRQ %d\n", irq_num);
+                        if (request_irq(irq_num, emac_irq, 0, ndev->name,
+                                        ndev)) {
+                                dev_err(emac_dev,
+                                        "DaVinci EMAC: request_irq() failed\n");
+                                ret = -EBUSY;
-        while ((res = platform_get_resource(priv->pdev, IORESOURCE_IRQ, k))) {
-                for (i = res->start; i <= res->end; i++) {
-                        if (devm_request_irq(&priv->pdev->dev, i, emac_irq,
-                                             0, ndev->name, ndev))
                                goto rollback;
+                        }
                }
-                k++;
+                res_num++;
        }
+        /* prepare counters for rollback in case of an error */
+        res_num--;
+        irq_num--;
        /* Start/Enable EMAC hardware */
        emac_hw_enable(priv);
@@ -1639,11 +1648,23 @@ static int emac_dev_open(struct net_device *ndev)
        return 0;
-rollback:
-        dev_err(emac_dev, "DaVinci EMAC: devm_request_irq() failed");
-        ret = -EBUSY;
 err:
+        emac_int_disable(priv);
+        napi_disable(&priv->napi);
+rollback:
+        for (q = res_num; q >= 0; q--) {
+                res = platform_get_resource(priv->pdev, IORESOURCE_IRQ, q);
+                /* at the first iteration, irq_num is already set to the
+                 * right value
+                 */
+                if (q != res_num)
+                        irq_num = res->end;
+                for (m = irq_num; m >= res->start; m--)
+                        free_irq(m, ndev);
+        }
+        cpdma_ctlr_stop(priv->dma);
        pm_runtime_put(&priv->pdev->dev);
        return ret;
 }
@@ -1659,6 +1680,9 @@ err:
 */
 static int emac_dev_stop(struct net_device *ndev)
 {
+        struct resource *res;
+        int i = 0;
+        int irq_num;
        struct emac_priv *priv = netdev_priv(ndev);
        struct device *emac_dev = &ndev->dev;
@@ -1674,6 +1698,13 @@ static int emac_dev_stop(struct net_device *ndev)
        if (priv->phydev)
                phy_disconnect(priv->phydev);
+        /* Free IRQ */
+        while ((res = platform_get_resource(priv->pdev, IORESOURCE_IRQ, i))) {
+                for (irq_num = res->start; irq_num <= res->end; irq_num++)
+                        free_irq(irq_num, priv->ndev);
+                i++;
+        }
        if (netif_msg_drv(priv))
                dev_notice(emac_dev, "DaVinci EMAC: %s stopped\n", ndev->name);
diff --git a/drivers/net/ethernet/tile/tilegx.c b/drivers/net/ethernet/tile/tilegx.c
index 023237a65720..17503da9f7a5 100644
--- a/drivers/net/ethernet/tile/tilegx.c
+++ b/drivers/net/ethernet/tile/tilegx.c
@@ -2071,7 +2071,7 @@ static int tile_net_tx(struct sk_buff *skb, struct net_device *dev)
 /* Return subqueue id on this core (one per core). */
 static u16 tile_net_select_queue(struct net_device *dev, struct sk_buff *skb,
-                                 void *accel_priv)
+                                 void *accel_priv, select_queue_fallback_t fallback)
 {
        return smp_processor_id();
 }
diff --git a/drivers/net/ethernet/via/via-rhine.c b/drivers/net/ethernet/via/via-rhine.c
index ef312bc6b865..6ac20a6738f4 100644
--- a/drivers/net/ethernet/via/via-rhine.c
+++ b/drivers/net/ethernet/via/via-rhine.c
@@ -923,7 +923,7 @@ static int rhine_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
        if (rc) {
                dev_err(&pdev->dev,
                        "32-bit PCI DMA addresses not supported by the card!?\n");
-                goto err_out;
+                goto err_out_pci_disable;
        }
        /* sanity check */
@@ -931,7 +931,7 @@ static int rhine_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
            (pci_resource_len(pdev, 1) < io_size)) {
                rc = -EIO;
                dev_err(&pdev->dev, "Insufficient PCI resources, aborting\n");
-                goto err_out;
+                goto err_out_pci_disable;
        }
        pioaddr = pci_resource_start(pdev, 0);
@@ -942,7 +942,7 @@ static int rhine_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
        dev = alloc_etherdev(sizeof(struct rhine_private));
        if (!dev) {
                rc = -ENOMEM;
-                goto err_out;
+                goto err_out_pci_disable;
        }
        SET_NETDEV_DEV(dev, &pdev->dev);
@@ -1084,6 +1084,8 @@ err_out_free_res:
        pci_release_regions(pdev);
 err_out_free_netdev:
        free_netdev(dev);
+err_out_pci_disable:
+        pci_disable_device(pdev);
 err_out:
        return rc;
 }
diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
index 1ec65feebb9e..4bfdf8c7ada0 100644
--- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
+++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
@@ -26,6 +26,7 @@
 #include <linux/netdevice.h>
 #include <linux/of_mdio.h>
 #include <linux/of_platform.h>
+#include <linux/of_irq.h>
 #include <linux/of_address.h>
 #include <linux/skbuff.h>
 #include <linux/spinlock.h>
@@ -600,7 +601,8 @@ static void axienet_start_xmit_done(struct net_device *ndev)
                size += status & XAXIDMA_BD_STS_ACTUAL_LEN_MASK;
                packets++;
-                lp->tx_bd_ci = ++lp->tx_bd_ci % TX_BD_NUM;
+                ++lp->tx_bd_ci;
+                lp->tx_bd_ci %= TX_BD_NUM;
                cur_p = &lp->tx_bd_v[lp->tx_bd_ci];
                status = cur_p->status;
        }
@@ -686,7 +688,8 @@ static int axienet_start_xmit(struct sk_buff *skb, struct net_device *ndev)
                                     skb_headlen(skb), DMA_TO_DEVICE);
        for (ii = 0; ii < num_frag; ii++) {
-                lp->tx_bd_tail = ++lp->tx_bd_tail % TX_BD_NUM;
+                ++lp->tx_bd_tail;
+                lp->tx_bd_tail %= TX_BD_NUM;
                cur_p = &lp->tx_bd_v[lp->tx_bd_tail];
                frag = &skb_shinfo(skb)->frags[ii];
                cur_p->phys = dma_map_single(ndev->dev.parent,
@@ -702,7 +705,8 @@ static int axienet_start_xmit(struct sk_buff *skb, struct net_device *ndev)
        tail_p = lp->tx_bd_p + sizeof(*lp->tx_bd_v) * lp->tx_bd_tail;
        /* Start the transfer */
        axienet_dma_out32(lp, XAXIDMA_TX_TDESC_OFFSET, tail_p);
-        lp->tx_bd_tail = ++lp->tx_bd_tail % TX_BD_NUM;
+        ++lp->tx_bd_tail;
+        lp->tx_bd_tail %= TX_BD_NUM;
        return NETDEV_TX_OK;
 }
@@ -774,7 +778,8 @@ static void axienet_recv(struct net_device *ndev)
                cur_p->status = 0;
                cur_p->sw_id_offset = (u32) new_skb;
-                lp->rx_bd_ci = ++lp->rx_bd_ci % RX_BD_NUM;
+                ++lp->rx_bd_ci;
+                lp->rx_bd_ci %= RX_BD_NUM;
                cur_p = &lp->rx_bd_v[lp->rx_bd_ci];
        }
diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
index 7756118c2f0a..d6fce9750b95 100644
--- a/drivers/net/hyperv/netvsc_drv.c
+++ b/drivers/net/hyperv/netvsc_drv.c
@@ -88,8 +88,12 @@ static int netvsc_open(struct net_device *net)
 {
        struct net_device_context *net_device_ctx = netdev_priv(net);
        struct hv_device *device_obj = net_device_ctx->device_ctx;
+        struct netvsc_device *nvdev;
+        struct rndis_device *rdev;
        int ret = 0;
+        netif_carrier_off(net);
        /* Open up the device */
        ret = rndis_filter_open(device_obj);
        if (ret != 0) {
@@ -99,6 +103,11 @@ static int netvsc_open(struct net_device *net)
        netif_start_queue(net);
+        nvdev = hv_get_drvdata(device_obj);
+        rdev = nvdev->extension;
+        if (!rdev->link_state)
+                netif_carrier_on(net);
        return ret;
 }
@@ -229,23 +238,24 @@ void netvsc_linkstatus_callback(struct hv_device *device_obj,
        struct net_device *net;
        struct net_device_context *ndev_ctx;
        struct netvsc_device *net_device;
+        struct rndis_device *rdev;
        net_device = hv_get_drvdata(device_obj);
+        rdev = net_device->extension;
+        rdev->link_state = status != 1;
        net = net_device->ndev;
-        if (!net) {
+        if (!net || net->reg_state != NETREG_REGISTERED)
-                netdev_err(net, "got link status but net device "
-                                "not initialized yet\n");
                return;
-        }
+        ndev_ctx = netdev_priv(net);
        if (status == 1) {
-                netif_carrier_on(net);
-                ndev_ctx = netdev_priv(net);
                schedule_delayed_work(&ndev_ctx->dwork, 0);
                schedule_delayed_work(&ndev_ctx->dwork, msecs_to_jiffies(20));
        } else {
-                netif_carrier_off(net);
+                schedule_delayed_work(&ndev_ctx->dwork, 0);
        }
 }
@@ -388,17 +398,35 @@ static const struct net_device_ops device_ops = {
 * current context when receiving RNDIS_STATUS_MEDIA_CONNECT event. So, add
 * another netif_notify_peers() into a delayed work, otherwise GARP packet
 * will not be sent after quick migration, and cause network disconnection.
+ * Also, we update the carrier status here.
 */
-static void netvsc_send_garp(struct work_struct *w)
+static void netvsc_link_change(struct work_struct *w)
 {
        struct net_device_context *ndev_ctx;
        struct net_device *net;
        struct netvsc_device *net_device;
+        struct rndis_device *rdev;
+        bool notify;
+        rtnl_lock();
        ndev_ctx = container_of(w, struct net_device_context, dwork.work);
        net_device = hv_get_drvdata(ndev_ctx->device_ctx);
+        rdev = net_device->extension;
        net = net_device->ndev;
-        netdev_notify_peers(net);
+        if (rdev->link_state) {
+                netif_carrier_off(net);
+                notify = false;
+        } else {
+                netif_carrier_on(net);
+                notify = true;
+        }
+        rtnl_unlock();
+        if (notify)
+                netdev_notify_peers(net);
 }
@@ -414,13 +442,12 @@ static int netvsc_probe(struct hv_device *dev,
        if (!net)
                return -ENOMEM;
-        /* Set initial state */
        netif_carrier_off(net);
        net_device_ctx = netdev_priv(net);
        net_device_ctx->device_ctx = dev;
        hv_set_drvdata(dev, net);
-        INIT_DELAYED_WORK(&net_device_ctx->dwork, netvsc_send_garp);
+        INIT_DELAYED_WORK(&net_device_ctx->dwork, netvsc_link_change);
        INIT_WORK(&net_device_ctx->work, do_set_multicast);
        net->netdev_ops = &device_ops;
@@ -443,13 +470,13 @@ static int netvsc_probe(struct hv_device *dev,
        }
        memcpy(net->dev_addr, device_info.mac_adr, ETH_ALEN);
-        netif_carrier_on(net);
        ret = register_netdev(net);
        if (ret != 0) {
                pr_err("Unable to register netdev.\n");
                rndis_filter_device_remove(dev);
                free_netdev(net);
+        } else {
+                schedule_delayed_work(&net_device_ctx->dwork, 0);
        }
        return ret;
diff --git a/drivers/net/hyperv/rndis_filter.c b/drivers/net/hyperv/rndis_filter.c
index 1084e5de3ceb..b54fd257652b 100644
--- a/drivers/net/hyperv/rndis_filter.c
+++ b/drivers/net/hyperv/rndis_filter.c
@@ -243,6 +243,22 @@ static int rndis_filter_send_request(struct rndis_device *dev,
        return ret;
 }
+static void rndis_set_link_state(struct rndis_device *rdev,
+                                 struct rndis_request *request)
+{
+        u32 link_status;
+        struct rndis_query_complete *query_complete;
+        query_complete = &request->response_msg.msg.query_complete;
+        if (query_complete->status == RNDIS_STATUS_SUCCESS &&
+            query_complete->info_buflen == sizeof(u32)) {
+                memcpy(&link_status, (void *)((unsigned long)query_complete +
+                       query_complete->info_buf_offset), sizeof(u32));
+                rdev->link_state = link_status != 0;
+        }
+}
 static void rndis_filter_receive_response(struct rndis_device *dev,
                                       struct rndis_message *resp)
 {
@@ -272,6 +288,10 @@ static void rndis_filter_receive_response(struct rndis_device *dev,
                    sizeof(struct rndis_message) + RNDIS_EXT_LEN) {
                        memcpy(&request->response_msg, resp,
                               resp->msg_len);
+                        if (request->request_msg.ndis_msg_type ==
+                            RNDIS_MSG_QUERY && request->request_msg.msg.
+                            query_req.oid == RNDIS_OID_GEN_MEDIA_CONNECT_STATUS)
+                                rndis_set_link_state(dev, request);
                } else {
                        netdev_err(ndev,
                                "rndis response buffer overflow "
@@ -620,7 +640,6 @@ static int rndis_filter_query_device_link_status(struct rndis_device *dev)
        ret = rndis_filter_query_device(dev,
                                      RNDIS_OID_GEN_MEDIA_CONNECT_STATUS,
                                      &link_status, &size);
-        dev->link_state = (link_status != 0) ? true : false;
        return ret;
 }
diff --git a/drivers/net/ieee802154/at86rf230.c b/drivers/net/ieee802154/at86rf230.c
index ab31544bc254..a30258aad139 100644
--- a/drivers/net/ieee802154/at86rf230.c
+++ b/drivers/net/ieee802154/at86rf230.c
@@ -546,12 +546,12 @@ at86rf230_xmit(struct ieee802154_dev *dev, struct sk_buff *skb)
        int rc;
        unsigned long flags;
-        spin_lock(&lp->lock);
+        spin_lock_irqsave(&lp->lock, flags);
        if  (lp->irq_busy) {
-                spin_unlock(&lp->lock);
+                spin_unlock_irqrestore(&lp->lock, flags);
                return -EBUSY;
        }
-        spin_unlock(&lp->lock);
+        spin_unlock_irqrestore(&lp->lock, flags);
        might_sleep();
@@ -725,10 +725,11 @@ static void at86rf230_irqwork_level(struct work_struct *work)
 static irqreturn_t at86rf230_isr(int irq, void *data)
 {
        struct at86rf230_local *lp = data;
+        unsigned long flags;
-        spin_lock(&lp->lock);
+        spin_lock_irqsave(&lp->lock, flags);
        lp->irq_busy = 1;
-        spin_unlock(&lp->lock);
+        spin_unlock_irqrestore(&lp->lock, flags);
        schedule_work(&lp->irqwork);
diff --git a/drivers/net/irda/Kconfig b/drivers/net/irda/Kconfig
index 2dc82f1d2e70..3da44d5d9149 100644
--- a/drivers/net/irda/Kconfig
+++ b/drivers/net/irda/Kconfig
@@ -210,13 +210,6 @@ config KINGSUN_DONGLE
          To compile it as a module, choose M here: the module will be called
          kingsun-sir.
-config EP7211_DONGLE
-        tristate "Cirrus Logic clps711x I/R support"
-        depends on IRTTY_SIR && ARCH_CLPS711X && IRDA
-        help
-          Say Y here if you want to build support for the Cirrus logic
-          EP7211 chipset's infrared module.
 config KSDAZZLE_DONGLE
        tristate "KingSun Dazzle IrDA-USB dongle"
        depends on IRDA && USB
diff --git a/drivers/net/irda/Makefile b/drivers/net/irda/Makefile
index dfc64537f62f..be8ab5b9a4a2 100644
--- a/drivers/net/irda/Makefile
+++ b/drivers/net/irda/Makefile
@@ -35,7 +35,6 @@ obj-$(CONFIG_MCP2120_DONGLE)	+= mcp2120-sir.o
 obj-$(CONFIG_ACT200L_DONGLE)    += act200l-sir.o
 obj-$(CONFIG_MA600_DONGLE)      += ma600-sir.o
 obj-$(CONFIG_TOIM3232_DONGLE)   += toim3232-sir.o
-obj-$(CONFIG_EP7211_DONGLE)     += ep7211-sir.o
 obj-$(CONFIG_KINGSUN_DONGLE)    += kingsun-sir.o
 obj-$(CONFIG_KSDAZZLE_DONGLE)   += ksdazzle-sir.o
 obj-$(CONFIG_KS959_DONGLE)      += ks959-sir.o
diff --git a/drivers/net/irda/ep7211-sir.c b/drivers/net/irda/ep7211-sir.c
deleted file mode 100644
index 5fe1f4dd3369..000000000000
--- a/drivers/net/irda/ep7211-sir.c
+++ /dev/null
@@ -1,70 +0,0 @@
-/*
- * IR port driver for the Cirrus Logic CLPS711X processors
- *
- * Copyright 2001, Blue Mug Inc.  All rights reserved.
- * Copyright 2007, Samuel Ortiz <samuel@sortiz.org>
- */
-#include <linux/module.h>
-#include <linux/platform_device.h>
-#include <mach/hardware.h>
-#include "sir-dev.h"
-static int clps711x_dongle_open(struct sir_dev *dev)
-{
-        unsigned int syscon;
-        /* Turn on the SIR encoder. */
-        syscon = clps_readl(SYSCON1);
-        syscon |= SYSCON1_SIREN;
-        clps_writel(syscon, SYSCON1);
-        return 0;
-}
-static int clps711x_dongle_close(struct sir_dev *dev)
-{
-        unsigned int syscon;
-        /* Turn off the SIR encoder. */
-        syscon = clps_readl(SYSCON1);
-        syscon &= ~SYSCON1_SIREN;
-        clps_writel(syscon, SYSCON1);
-        return 0;
-}
-static struct dongle_driver clps711x_dongle = {
-        .owner          = THIS_MODULE,
-        .driver_name    = "EP7211 IR driver",
-        .type           = IRDA_EP7211_DONGLE,
-        .open           = clps711x_dongle_open,
-        .close          = clps711x_dongle_close,
-};
-static int clps711x_sir_probe(struct platform_device *pdev)
-{
-        return irda_register_dongle(&clps711x_dongle);
-}
-static int clps711x_sir_remove(struct platform_device *pdev)
-{
-        return irda_unregister_dongle(&clps711x_dongle);
-}
-static struct platform_driver clps711x_sir_driver = {
-        .driver = {
-                .name   = "sir-clps711x",
-                .owner  = THIS_MODULE,
-        },
-        .probe  = clps711x_sir_probe,
-        .remove = clps711x_sir_remove,
-};
-module_platform_driver(clps711x_sir_driver);
-MODULE_AUTHOR("Samuel Ortiz <samuel@sortiz.org>");
-MODULE_DESCRIPTION("EP7211 IR dongle driver");
-MODULE_LICENSE("GPL");
-MODULE_ALIAS("irda-dongle-13"); /* IRDA_EP7211_DONGLE */
diff --git a/drivers/net/irda/irtty-sir.c b/drivers/net/irda/irtty-sir.c
index 177441afeb96..24b6dddd7f2f 100644
--- a/drivers/net/irda/irtty-sir.c
+++ b/drivers/net/irda/irtty-sir.c
@@ -522,7 +522,6 @@ static void irtty_close(struct tty_struct *tty)
        sirdev_put_instance(priv->dev);
        /* Stop tty */
-        irtty_stop_receiver(tty, TRUE);
        clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
        if (tty->ops->stop)
                tty->ops->stop(tty);
diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
index 8433de4509c7..1831fb7cd017 100644
--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
@@ -506,6 +506,9 @@ static int macvlan_change_mtu(struct net_device *dev, int new_mtu)
 static struct lock_class_key macvlan_netdev_xmit_lock_key;
 static struct lock_class_key macvlan_netdev_addr_lock_key;
+#define ALWAYS_ON_FEATURES \
+        (NETIF_F_SG | NETIF_F_GEN_CSUM | NETIF_F_GSO_SOFTWARE | NETIF_F_LLTX)
 #define MACVLAN_FEATURES \
        (NETIF_F_SG | NETIF_F_ALL_CSUM | NETIF_F_HIGHDMA | NETIF_F_FRAGLIST | \
         NETIF_F_GSO | NETIF_F_TSO | NETIF_F_UFO | NETIF_F_GSO_ROBUST | \
@@ -539,7 +542,7 @@ static int macvlan_init(struct net_device *dev)
        dev->state              = (dev->state & ~MACVLAN_STATE_MASK) |
                                  (lowerdev->state & MACVLAN_STATE_MASK);
        dev->features           = lowerdev->features & MACVLAN_FEATURES;
-        dev->features           |= NETIF_F_LLTX;
+        dev->features           |= ALWAYS_ON_FEATURES;
        dev->gso_max_size       = lowerdev->gso_max_size;
        dev->iflink             = lowerdev->ifindex;
        dev->hard_header_len    = lowerdev->hard_header_len;
@@ -699,7 +702,7 @@ static netdev_features_t macvlan_fix_features(struct net_device *dev,
        features = netdev_increment_features(vlan->lowerdev->features,
                                             features,
                                             mask);
-        features |= NETIF_F_LLTX;
+        features |= ALWAYS_ON_FEATURES;
        return features;
 }
@@ -879,14 +882,15 @@ int macvlan_common_newlink(struct net *src_net, struct net_device *dev,
        dev->priv_flags |= IFF_MACVLAN;
        err = netdev_upper_dev_link(lowerdev, dev);
        if (err)
-                goto destroy_port;
+                goto unregister_netdev;
        list_add_tail_rcu(&vlan->list, &port->vlans);
        netif_stacked_transfer_operstate(lowerdev, dev);
        return 0;
+unregister_netdev:
+        unregister_netdevice(dev);
 destroy_port:
        port->count -= 1;
        if (!port->count)
diff --git a/drivers/net/phy/dp83640.c b/drivers/net/phy/dp83640.c
index 547725fa8671..98e7cbf720a5 100644
--- a/drivers/net/phy/dp83640.c
+++ b/drivers/net/phy/dp83640.c
@@ -437,7 +437,10 @@ static int ptp_dp83640_enable(struct ptp_clock_info *ptp,
                if (on) {
                        gpio_num = gpio_tab[EXTTS0_GPIO + index];
                        evnt |= (gpio_num & EVNT_GPIO_MASK) << EVNT_GPIO_SHIFT;
-                        evnt |= EVNT_RISE;
+                        if (rq->extts.flags & PTP_FALLING_EDGE)
+                                evnt |= EVNT_FALL;
+                        else
+                                evnt |= EVNT_RISE;
                }
                ext_write(0, phydev, PAGE5, PTP_EVNT, evnt);
                return 0;
@@ -1003,11 +1006,6 @@ static int dp83640_probe(struct phy_device *phydev)
        } else
                list_add_tail(&dp83640->list, &clock->phylist);
-        if (clock->chosen && !list_empty(&clock->phylist))
-                recalibrate(clock);
-        else
-                enable_broadcast(dp83640->phydev, clock->page, 1);
        dp83640_clock_put(clock);
        return 0;
@@ -1058,6 +1056,21 @@ static void dp83640_remove(struct phy_device *phydev)
        kfree(dp83640);
 }
+static int dp83640_config_init(struct phy_device *phydev)
+{
+        struct dp83640_private *dp83640 = phydev->priv;
+        struct dp83640_clock *clock = dp83640->clock;
+        if (clock->chosen && !list_empty(&clock->phylist))
+                recalibrate(clock);
+        else
+                enable_broadcast(phydev, clock->page, 1);
+        enable_status_frames(phydev, true);
+        ext_write(0, phydev, PAGE4, PTP_CTL, PTP_ENABLE);
+        return 0;
+}
 static int dp83640_ack_interrupt(struct phy_device *phydev)
 {
        int err = phy_read(phydev, MII_DP83640_MISR);
@@ -1195,11 +1208,6 @@ static int dp83640_hwtstamp(struct phy_device *phydev, struct ifreq *ifr)
        mutex_lock(&dp83640->clock->extreg_lock);
-        if (dp83640->hwts_tx_en || dp83640->hwts_rx_en) {
-                enable_status_frames(phydev, true);
-                ext_write(0, phydev, PAGE4, PTP_CTL, PTP_ENABLE);
-        }
        ext_write(0, phydev, PAGE5, PTP_TXCFG0, txcfg0);
        ext_write(0, phydev, PAGE5, PTP_RXCFG0, rxcfg0);
@@ -1281,6 +1289,7 @@ static void dp83640_txtstamp(struct phy_device *phydev,
                }
                /* fall through */
        case HWTSTAMP_TX_ON:
+                skb_shinfo(skb)->tx_flags |= SKBTX_IN_PROGRESS;
                skb_queue_tail(&dp83640->tx_queue, skb);
                schedule_work(&dp83640->ts_work);
                break;
@@ -1330,6 +1339,7 @@ static struct phy_driver dp83640_driver = {
        .flags          = PHY_HAS_INTERRUPT,
        .probe          = dp83640_probe,
        .remove         = dp83640_remove,
+        .config_init    = dp83640_config_init,
        .config_aneg    = genphy_config_aneg,
        .read_status    = genphy_read_status,
        .ack_interrupt  = dp83640_ack_interrupt,
diff --git a/drivers/net/phy/mdio-sun4i.c b/drivers/net/phy/mdio-sun4i.c
index bb88bc7d81fb..9367acc84fbb 100644
--- a/drivers/net/phy/mdio-sun4i.c
+++ b/drivers/net/phy/mdio-sun4i.c
@@ -170,6 +170,9 @@ static int sun4i_mdio_remove(struct platform_device *pdev)
 }
 static const struct of_device_id sun4i_mdio_dt_ids[] = {
+        { .compatible = "allwinner,sun4i-a10-mdio" },
+        /* Deprecated */
        { .compatible = "allwinner,sun4i-mdio" },
        { }
 };
diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
index 19c9eca0ef26..76d96b9ebcdb 100644
--- a/drivers/net/phy/phy.c
+++ b/drivers/net/phy/phy.c
@@ -164,9 +164,9 @@ static const struct phy_setting settings[] = {
 *   of that setting.  Returns the index of the last setting if
 *   none of the others match.
 */
-static inline int phy_find_setting(int speed, int duplex)
+static inline unsigned int phy_find_setting(int speed, int duplex)
 {
-        int idx = 0;
+        unsigned int idx = 0;
        while (idx < ARRAY_SIZE(settings) &&
               (settings[idx].speed != speed || settings[idx].duplex != duplex))
@@ -185,7 +185,7 @@ static inline int phy_find_setting(int speed, int duplex)
 *   the mask in features.  Returns the index of the last setting
 *   if nothing else matches.
 */
-static inline int phy_find_valid(int idx, u32 features)
+static inline unsigned int phy_find_valid(unsigned int idx, u32 features)
 {
        while (idx < MAX_NUM_SETTINGS && !(settings[idx].setting & features))
                idx++;
@@ -204,7 +204,7 @@ static inline int phy_find_valid(int idx, u32 features)
 static void phy_sanitize_settings(struct phy_device *phydev)
 {
        u32 features = phydev->supported;
-        int idx;
+        unsigned int idx;
        /* Sanitize settings based on PHY capabilities */
        if ((features & SUPPORTED_Autoneg) == 0)
@@ -954,7 +954,8 @@ int phy_init_eee(struct phy_device *phydev, bool clk_stop_enable)
            (phydev->interface == PHY_INTERFACE_MODE_RGMII))) {
                int eee_lp, eee_cap, eee_adv;
                u32 lp, cap, adv;
-                int idx, status;
+                int status;
+                unsigned int idx;
                /* Read phy status to properly get the right settings */
                status = phy_read_status(phydev);
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index 4b03e63639b7..2f6989b1e0dc 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -683,10 +683,9 @@ EXPORT_SYMBOL(phy_detach);
 int phy_suspend(struct phy_device *phydev)
 {
        struct phy_driver *phydrv = to_phy_driver(phydev->dev.driver);
-        struct ethtool_wolinfo wol;
+        struct ethtool_wolinfo wol = { .cmd = ETHTOOL_GWOL };
        /* If the device has WOL enabled, we cannot suspend the PHY */
-        wol.cmd = ETHTOOL_GWOL;
        phy_ethtool_get_wol(phydev, &wol);
        if (wol.wolopts)
                return -EBUSY;
@@ -719,7 +718,7 @@ int phy_resume(struct phy_device *phydev)
 static int genphy_config_advert(struct phy_device *phydev)
 {
        u32 advertise;
-        int oldadv, adv;
+        int oldadv, adv, bmsr;
        int err, changed = 0;
        /* Only allow advertising what this PHY supports */
@@ -744,26 +743,36 @@ static int genphy_config_advert(struct phy_device *phydev)
                changed = 1;
        }
+        bmsr = phy_read(phydev, MII_BMSR);
+        if (bmsr < 0)
+                return bmsr;
+        /* Per 802.3-2008, Section 22.2.4.2.16 Extended status all
+         * 1000Mbits/sec capable PHYs shall have the BMSR_ESTATEN bit set to a
+         * logical 1.
+         */
+        if (!(bmsr & BMSR_ESTATEN))
+                return changed;
        /* Configure gigabit if it's supported */
+        adv = phy_read(phydev, MII_CTRL1000);
+        if (adv < 0)
+                return adv;
+        oldadv = adv;
+        adv &= ~(ADVERTISE_1000FULL | ADVERTISE_1000HALF);
        if (phydev->supported & (SUPPORTED_1000baseT_Half |
                                 SUPPORTED_1000baseT_Full)) {
-                adv = phy_read(phydev, MII_CTRL1000);
-                if (adv < 0)
-                        return adv;
-                oldadv = adv;
-                adv &= ~(ADVERTISE_1000FULL | ADVERTISE_1000HALF);
                adv |= ethtool_adv_to_mii_ctrl1000_t(advertise);
+                if (adv != oldadv)
-                if (adv != oldadv) {
-                        err = phy_write(phydev, MII_CTRL1000, adv);
-                        if (err < 0)
-                                return err;
                        changed = 1;
-                }
        }
+        err = phy_write(phydev, MII_CTRL1000, adv);
+        if (err < 0)
+                return err;
        return changed;
 }
@@ -906,6 +915,8 @@ int genphy_read_status(struct phy_device *phydev)
        int err;
        int lpa;
        int lpagb = 0;
+        int common_adv;
+        int common_adv_gb = 0;
        /* Update the link, but return if there was an error */
        err = genphy_update_link(phydev);
@@ -927,7 +938,7 @@ int genphy_read_status(struct phy_device *phydev)
                        phydev->lp_advertising =
                                mii_stat1000_to_ethtool_lpa_t(lpagb);
-                        lpagb &= adv << 2;
+                        common_adv_gb = lpagb & adv << 2;
                }
                lpa = phy_read(phydev, MII_LPA);
@@ -940,25 +951,25 @@ int genphy_read_status(struct phy_device *phydev)
                if (adv < 0)
                        return adv;
-                lpa &= adv;
+                common_adv = lpa & adv;
                phydev->speed = SPEED_10;
                phydev->duplex = DUPLEX_HALF;
                phydev->pause = 0;
                phydev->asym_pause = 0;
-                if (lpagb & (LPA_1000FULL | LPA_1000HALF)) {
+                if (common_adv_gb & (LPA_1000FULL | LPA_1000HALF)) {
                        phydev->speed = SPEED_1000;
-                        if (lpagb & LPA_1000FULL)
+                        if (common_adv_gb & LPA_1000FULL)
                                phydev->duplex = DUPLEX_FULL;
-                } else if (lpa & (LPA_100FULL | LPA_100HALF)) {
+                } else if (common_adv & (LPA_100FULL | LPA_100HALF)) {
                        phydev->speed = SPEED_100;
-                        if (lpa & LPA_100FULL)
+                        if (common_adv & LPA_100FULL)
                                phydev->duplex = DUPLEX_FULL;
                } else
-                        if (lpa & LPA_10FULL)
+                        if (common_adv & LPA_10FULL)
                                phydev->duplex = DUPLEX_FULL;
                if (phydev->duplex == DUPLEX_FULL) {
diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
index 28407426fd6f..c8624a8235ab 100644
--- a/drivers/net/team/team.c
+++ b/drivers/net/team/team.c
@@ -1648,7 +1648,7 @@ static netdev_tx_t team_xmit(struct sk_buff *skb, struct net_device *dev)
 }
 static u16 team_select_queue(struct net_device *dev, struct sk_buff *skb,
-                             void *accel_priv)
+                             void *accel_priv, select_queue_fallback_t fallback)
 {
        /*
         * This helper function exists to help dev_pick_tx get the correct
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 44c4db8450f0..26f8635b027d 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -366,7 +366,7 @@ static inline void tun_flow_save_rps_rxhash(struct tun_flow_entry *e, u32 hash)
 * hope the rxq no. may help here.
 */
 static u16 tun_select_queue(struct net_device *dev, struct sk_buff *skb,
-                            void *accel_priv)
+                            void *accel_priv, select_queue_fallback_t fallback)
 {
        struct tun_struct *tun = netdev_priv(dev);
        struct tun_flow_entry *e;
@@ -1686,7 +1686,9 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
                                   TUN_USER_FEATURES | NETIF_F_HW_VLAN_CTAG_TX |
                                   NETIF_F_HW_VLAN_STAG_TX;
                dev->features = dev->hw_features;
-                dev->vlan_features = dev->features;
+                dev->vlan_features = dev->features &
+                                     ~(NETIF_F_HW_VLAN_CTAG_TX |
+                                       NETIF_F_HW_VLAN_STAG_TX);
                INIT_LIST_HEAD(&tun->disabled);
                err = tun_attach(tun, file, false);
diff --git a/drivers/net/usb/Kconfig b/drivers/net/usb/Kconfig
index 6b638a066c1d..7e7269fd3707 100644
--- a/drivers/net/usb/Kconfig
+++ b/drivers/net/usb/Kconfig
@@ -292,6 +292,21 @@ config USB_NET_SR9700
          This option adds support for CoreChip-sz SR9700 based USB 1.1
          10/100 Ethernet adapters.
+config USB_NET_SR9800
+        tristate "CoreChip-sz SR9800 based USB 2.0 10/100 ethernet devices"
+        depends on USB_USBNET
+        select CRC32
+        ---help---
+          Say Y if you want to use one of the following 100Mbps USB Ethernet
+          device based on the CoreChip-sz SR9800 chip.
+          This driver makes the adapter appear as a normal Ethernet interface,
+          typically on eth0, if it is the only ethernet device, or perhaps on
+          eth1, if you have a PCI or ISA ethernet card installed.
+          To compile this driver as a module, choose M here: the
+          module will be called sr9800.
 config USB_NET_SMSC75XX
        tristate "SMSC LAN75XX based USB 2.0 gigabit ethernet devices"
        depends on USB_USBNET
diff --git a/drivers/net/usb/Makefile b/drivers/net/usb/Makefile
index b17b5e88bbaf..e2797f1e1b31 100644
--- a/drivers/net/usb/Makefile
+++ b/drivers/net/usb/Makefile
@@ -11,10 +11,11 @@ obj-$(CONFIG_USB_HSO)		+= hso.o
 obj-$(CONFIG_USB_NET_AX8817X)   += asix.o
 asix-y := asix_devices.o asix_common.o ax88172a.o
 obj-$(CONFIG_USB_NET_AX88179_178A)      += ax88179_178a.o
-obj-$(CONFIG_USB_NET_CDCETHER)  += cdc_ether.o r815x.o
+obj-$(CONFIG_USB_NET_CDCETHER)  += cdc_ether.o
 obj-$(CONFIG_USB_NET_CDC_EEM)   += cdc_eem.o
 obj-$(CONFIG_USB_NET_DM9601)    += dm9601.o
 obj-$(CONFIG_USB_NET_SR9700)    += sr9700.o
+obj-$(CONFIG_USB_NET_SR9800)    += sr9800.o
 obj-$(CONFIG_USB_NET_SMSC75XX)  += smsc75xx.o
 obj-$(CONFIG_USB_NET_SMSC95XX)  += smsc95xx.o
 obj-$(CONFIG_USB_NET_GL620A)    += gl620a.o
diff --git a/drivers/net/usb/asix_devices.c b/drivers/net/usb/asix_devices.c
index 9765a7d4766d..5d194093f3e1 100644
--- a/drivers/net/usb/asix_devices.c
+++ b/drivers/net/usb/asix_devices.c
@@ -917,7 +917,8 @@ static const struct driver_info ax88178_info = {
        .status = asix_status,
        .link_reset = ax88178_link_reset,
        .reset = ax88178_reset,
-        .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_LINK_INTR,
+        .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_LINK_INTR |
+                 FLAG_MULTI_PACKET,
        .rx_fixup = asix_rx_fixup_common,
        .tx_fixup = asix_tx_fixup,
 };
diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c
index d6f64dad05bc..054e59ca6946 100644
--- a/drivers/net/usb/ax88179_178a.c
+++ b/drivers/net/usb/ax88179_178a.c
@@ -1029,20 +1029,12 @@ static int ax88179_bind(struct usbnet *dev, struct usb_interface *intf)
        dev->mii.phy_id = 0x03;
        dev->mii.supports_gmii = 1;
-        if (usb_device_no_sg_constraint(dev->udev))
-                dev->can_dma_sg = 1;
        dev->net->features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
                              NETIF_F_RXCSUM;
        dev->net->hw_features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
                                 NETIF_F_RXCSUM;
-        if (dev->can_dma_sg) {
-                dev->net->features |= NETIF_F_SG | NETIF_F_TSO;
-                dev->net->hw_features |= NETIF_F_SG | NETIF_F_TSO;
-        }
        /* Enable checksum offload */
        *tmp = AX_RXCOE_IP | AX_RXCOE_TCP | AX_RXCOE_UDP |
               AX_RXCOE_TCPV6 | AX_RXCOE_UDPV6;
@@ -1118,6 +1110,10 @@ static int ax88179_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
        u16 hdr_off;
        u32 *pkt_hdr;
+        /* This check is no longer done by usbnet */
+        if (skb->len < dev->net->hard_header_len)
+                return 0;
        skb_trim(skb, skb->len - 4);
        memcpy(&rx_hdr, skb_tail_pointer(skb), 4);
        le32_to_cpus(&rx_hdr);
@@ -1391,6 +1387,19 @@ static const struct driver_info ax88178a_info = {
        .tx_fixup = ax88179_tx_fixup,
 };
+static const struct driver_info dlink_dub1312_info = {
+        .description = "D-Link DUB-1312 USB 3.0 to Gigabit Ethernet Adapter",
+        .bind = ax88179_bind,
+        .unbind = ax88179_unbind,
+        .status = ax88179_status,
+        .link_reset = ax88179_link_reset,
+        .reset = ax88179_reset,
+        .stop = ax88179_stop,
+        .flags = FLAG_ETHER | FLAG_FRAMING_AX,
+        .rx_fixup = ax88179_rx_fixup,
+        .tx_fixup = ax88179_tx_fixup,
+};
 static const struct driver_info sitecom_info = {
        .description = "Sitecom USB 3.0 to Gigabit Adapter",
        .bind = ax88179_bind,
@@ -1417,6 +1426,19 @@ static const struct driver_info samsung_info = {
        .tx_fixup = ax88179_tx_fixup,
 };
+static const struct driver_info lenovo_info = {
+        .description = "Lenovo OneLinkDock Gigabit LAN",
+        .bind = ax88179_bind,
+        .unbind = ax88179_unbind,
+        .status = ax88179_status,
+        .link_reset = ax88179_link_reset,
+        .reset = ax88179_reset,
+        .stop = ax88179_stop,
+        .flags = FLAG_ETHER | FLAG_FRAMING_AX,
+        .rx_fixup = ax88179_rx_fixup,
+        .tx_fixup = ax88179_tx_fixup,
+};
 static const struct usb_device_id products[] = {
 {
        /* ASIX AX88179 10/100/1000 */
@@ -1427,6 +1449,10 @@ static const struct usb_device_id products[] = {
        USB_DEVICE(0x0b95, 0x178a),
        .driver_info = (unsigned long)&ax88178a_info,
 }, {
+        /* D-Link DUB-1312 USB 3.0 to Gigabit Ethernet Adapter */
+        USB_DEVICE(0x2001, 0x4a00),
+        .driver_info = (unsigned long)&dlink_dub1312_info,
+}, {
        /* Sitecom USB 3.0 to Gigabit Adapter */
        USB_DEVICE(0x0df6, 0x0072),
        .driver_info = (unsigned long)&sitecom_info,
@@ -1434,6 +1460,10 @@ static const struct usb_device_id products[] = {
        /* Samsung USB Ethernet Adapter */
        USB_DEVICE(0x04e8, 0xa100),
        .driver_info = (unsigned long)&samsung_info,
+}, {
+        /* Lenovo OneLinkDock Gigabit LAN */
+        USB_DEVICE(0x17ef, 0x304b),
+        .driver_info = (unsigned long)&lenovo_info,
 },
        { },
 };
diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
index 42e176912c8e..bd363b27e854 100644
--- a/drivers/net/usb/cdc_ether.c
+++ b/drivers/net/usb/cdc_ether.c
@@ -652,6 +652,13 @@ static const struct usb_device_id	products[] = {
        .driver_info = 0,
 },
+/* Samsung USB Ethernet Adapters */
+{
+        USB_DEVICE_AND_INTERFACE_INFO(SAMSUNG_VENDOR_ID, 0xa101, USB_CLASS_COMM,
+                        USB_CDC_SUBCLASS_ETHERNET, USB_CDC_PROTO_NONE),
+        .driver_info = 0,
+},
 /* WHITELIST!!!
 *
 * CDC Ether uses two interfaces, not necessarily consecutive.
diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
index dbff290ed0e4..d350d2795e10 100644
--- a/drivers/net/usb/cdc_ncm.c
+++ b/drivers/net/usb/cdc_ncm.c
@@ -68,7 +68,6 @@ static struct usb_driver cdc_ncm_driver;
 static int cdc_ncm_setup(struct usbnet *dev)
 {
        struct cdc_ncm_ctx *ctx = (struct cdc_ncm_ctx *)dev->data[0];
-        struct usb_cdc_ncm_ntb_parameters ncm_parm;
        u32 val;
        u8 flags;
        u8 iface_no;
@@ -82,22 +81,22 @@ static int cdc_ncm_setup(struct usbnet *dev)
        err = usbnet_read_cmd(dev, USB_CDC_GET_NTB_PARAMETERS,
                              USB_TYPE_CLASS | USB_DIR_IN
                              |USB_RECIP_INTERFACE,
-                              0, iface_no, &ncm_parm,
+                              0, iface_no, &ctx->ncm_parm,
-                              sizeof(ncm_parm));
+                              sizeof(ctx->ncm_parm));
        if (err < 0) {
                dev_err(&dev->intf->dev, "failed GET_NTB_PARAMETERS\n");
                return err; /* GET_NTB_PARAMETERS is required */
        }
        /* read correct set of parameters according to device mode */
-        ctx->rx_max = le32_to_cpu(ncm_parm.dwNtbInMaxSize);
+        ctx->rx_max = le32_to_cpu(ctx->ncm_parm.dwNtbInMaxSize);
-        ctx->tx_max = le32_to_cpu(ncm_parm.dwNtbOutMaxSize);
+        ctx->tx_max = le32_to_cpu(ctx->ncm_parm.dwNtbOutMaxSize);
-        ctx->tx_remainder = le16_to_cpu(ncm_parm.wNdpOutPayloadRemainder);
+        ctx->tx_remainder = le16_to_cpu(ctx->ncm_parm.wNdpOutPayloadRemainder);
-        ctx->tx_modulus = le16_to_cpu(ncm_parm.wNdpOutDivisor);
+        ctx->tx_modulus = le16_to_cpu(ctx->ncm_parm.wNdpOutDivisor);
-        ctx->tx_ndp_modulus = le16_to_cpu(ncm_parm.wNdpOutAlignment);
+        ctx->tx_ndp_modulus = le16_to_cpu(ctx->ncm_parm.wNdpOutAlignment);
        /* devices prior to NCM Errata shall set this field to zero */
-        ctx->tx_max_datagrams = le16_to_cpu(ncm_parm.wNtbOutMaxDatagrams);
+        ctx->tx_max_datagrams = le16_to_cpu(ctx->ncm_parm.wNtbOutMaxDatagrams);
-        ntb_fmt_supported = le16_to_cpu(ncm_parm.bmNtbFormatsSupported);
+        ntb_fmt_supported = le16_to_cpu(ctx->ncm_parm.bmNtbFormatsSupported);
        /* there are some minor differences in NCM and MBIM defaults */
        if (cdc_ncm_comm_intf_is_mbim(ctx->control->cur_altsetting)) {
@@ -146,7 +145,7 @@ static int cdc_ncm_setup(struct usbnet *dev)
        }
        /* inform device about NTB input size changes */
-        if (ctx->rx_max != le32_to_cpu(ncm_parm.dwNtbInMaxSize)) {
+        if (ctx->rx_max != le32_to_cpu(ctx->ncm_parm.dwNtbInMaxSize)) {
                __le32 dwNtbInMaxSize = cpu_to_le32(ctx->rx_max);
                err = usbnet_write_cmd(dev, USB_CDC_SET_NTB_INPUT_SIZE,
@@ -162,14 +161,6 @@ static int cdc_ncm_setup(struct usbnet *dev)
                dev_dbg(&dev->intf->dev, "Using default maximum transmit length=%d\n",
                        CDC_NCM_NTB_MAX_SIZE_TX);
                ctx->tx_max = CDC_NCM_NTB_MAX_SIZE_TX;
-                /* Adding a pad byte here simplifies the handling in
-                 * cdc_ncm_fill_tx_frame, by making tx_max always
-                 * represent the real skb max size.
-                 */
-                if (ctx->tx_max % usb_maxpacket(dev->udev, dev->out, 1) == 0)
-                        ctx->tx_max++;
        }
        /*
@@ -439,6 +430,10 @@ advance:
                goto error2;
        }
+        /* initialize data interface */
+        if (cdc_ncm_setup(dev))
+                goto error2;
        /* configure data interface */
        temp = usb_set_interface(dev->udev, iface_no, data_altsetting);
        if (temp) {
@@ -453,12 +448,6 @@ advance:
                goto error2;
        }
-        /* initialize data interface */
-        if (cdc_ncm_setup(dev)) {
-                dev_dbg(&intf->dev, "cdc_ncm_setup() failed\n");
-                goto error2;
-        }
        usb_set_intfdata(ctx->data, dev);
        usb_set_intfdata(ctx->control, dev);
@@ -475,6 +464,15 @@ advance:
        dev->hard_mtu = ctx->tx_max;
        dev->rx_urb_size = ctx->rx_max;
+        /* cdc_ncm_setup will override dwNtbOutMaxSize if it is
+         * outside the sane range. Adding a pad byte here if necessary
+         * simplifies the handling in cdc_ncm_fill_tx_frame, making
+         * tx_max always represent the real skb max size.
+         */
+        if (ctx->tx_max != le32_to_cpu(ctx->ncm_parm.dwNtbOutMaxSize) &&
+            ctx->tx_max % usb_maxpacket(dev->udev, dev->out, 1) == 0)
+                ctx->tx_max++;
        return 0;
 error2:
diff --git a/drivers/net/usb/gl620a.c b/drivers/net/usb/gl620a.c
index e4a8a93fbaf7..1cc24e6f23e2 100644
--- a/drivers/net/usb/gl620a.c
+++ b/drivers/net/usb/gl620a.c
@@ -84,6 +84,10 @@ static int genelink_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
        u32                     size;
        u32                     count;
+        /* This check is no longer done by usbnet */
+        if (skb->len < dev->net->hard_header_len)
+                return 0;
        header = (struct gl_header *) skb->data;
        // get the packet count of the received skb
diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
index 1a482344b3f5..660bd5ea9fc0 100644
--- a/drivers/net/usb/hso.c
+++ b/drivers/net/usb/hso.c
@@ -1201,16 +1201,18 @@ static void hso_std_serial_read_bulk_callback(struct urb *urb)
        struct hso_serial *serial = urb->context;
        int status = urb->status;
+        D4("\n--- Got serial_read_bulk callback %02x ---", status);
        /* sanity check */
        if (!serial) {
                D1("serial == NULL");
                return;
-        } else if (status) {
+        }
+        if (status) {
                handle_usb_error(status, __func__, serial->parent);
                return;
        }
-        D4("\n--- Got serial_read_bulk callback %02x ---", status);
        D1("Actual length = %d\n", urb->actual_length);
        DUMP1(urb->transfer_buffer, urb->actual_length);
@@ -1218,25 +1220,13 @@ static void hso_std_serial_read_bulk_callback(struct urb *urb)
        if (serial->port.count == 0)
                return;
-        if (status == 0) {
+        if (serial->parent->port_spec & HSO_INFO_CRC_BUG)
-                if (serial->parent->port_spec & HSO_INFO_CRC_BUG)
+                fix_crc_bug(urb, serial->in_endp->wMaxPacketSize);
-                        fix_crc_bug(urb, serial->in_endp->wMaxPacketSize);
+        /* Valid data, handle RX data */
-                /* Valid data, handle RX data */
+        spin_lock(&serial->serial_lock);
-                spin_lock(&serial->serial_lock);
+        serial->rx_urb_filled[hso_urb_to_index(serial, urb)] = 1;
-                serial->rx_urb_filled[hso_urb_to_index(serial, urb)] = 1;
+        put_rxbuf_data_and_resubmit_bulk_urb(serial);
-                put_rxbuf_data_and_resubmit_bulk_urb(serial);
+        spin_unlock(&serial->serial_lock);
-                spin_unlock(&serial->serial_lock);
-        } else if (status == -ENOENT || status == -ECONNRESET) {
-                /* Unlinked - check for throttled port. */
-                D2("Port %d, successfully unlinked urb", serial->minor);
-                spin_lock(&serial->serial_lock);
-                serial->rx_urb_filled[hso_urb_to_index(serial, urb)] = 0;
-                hso_resubmit_rx_bulk_urb(serial, urb);
-                spin_unlock(&serial->serial_lock);
-        } else {
-                D2("Port %d, status = %d for read urb", serial->minor, status);
-                return;
-        }
 }
 /*
diff --git a/drivers/net/usb/mcs7830.c b/drivers/net/usb/mcs7830.c
index a305a7b2dae6..82d844a8ebd0 100644
--- a/drivers/net/usb/mcs7830.c
+++ b/drivers/net/usb/mcs7830.c
@@ -526,8 +526,9 @@ static int mcs7830_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
 {
        u8 status;
-        if (skb->len == 0) {
+        /* This check is no longer done by usbnet */
-                dev_err(&dev->udev->dev, "unexpected empty rx frame\n");
+        if (skb->len < dev->net->hard_header_len) {
+                dev_err(&dev->udev->dev, "unexpected tiny rx frame\n");
                return 0;
        }
diff --git a/drivers/net/usb/net1080.c b/drivers/net/usb/net1080.c
index 0a85d9227775..4cbdb1307f3e 100644
--- a/drivers/net/usb/net1080.c
+++ b/drivers/net/usb/net1080.c
@@ -364,6 +364,10 @@ static int net1080_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
        struct nc_trailer       *trailer;
        u16                     hdr_len, packet_len;
+        /* This check is no longer done by usbnet */
+        if (skb->len < dev->net->hard_header_len)
+                return 0;
        if (!(skb->len & 0x01)) {
                netdev_dbg(dev->net, "rx framesize %d range %d..%d mtu %d\n",
                           skb->len, dev->net->hard_header_len, dev->hard_mtu,
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index 23bdd5b9274d..313cb6cd4848 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -80,10 +80,10 @@ static int qmi_wwan_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
 {
        __be16 proto;
-        /* usbnet rx_complete guarantees that skb->len is at least
+        /* This check is no longer done by usbnet */
-         * hard_header_len, so we can inspect the dest address without
+        if (skb->len < dev->net->hard_header_len)
-         * checking skb->len
+                return 0;
-         */
        switch (skb->data[0] & 0xf0) {
        case 0x40:
                proto = htons(ETH_P_IP);
@@ -712,6 +712,7 @@ static const struct usb_device_id products[] = {
        {QMI_FIXED_INTF(0x19d2, 0x1255, 3)},
        {QMI_FIXED_INTF(0x19d2, 0x1255, 4)},
        {QMI_FIXED_INTF(0x19d2, 0x1256, 4)},
+        {QMI_FIXED_INTF(0x19d2, 0x1270, 5)},    /* ZTE MF667 */
        {QMI_FIXED_INTF(0x19d2, 0x1401, 2)},
        {QMI_FIXED_INTF(0x19d2, 0x1402, 2)},    /* ZTE MF60 */
        {QMI_FIXED_INTF(0x19d2, 0x1424, 2)},
@@ -723,6 +724,7 @@ static const struct usb_device_id products[] = {
        {QMI_FIXED_INTF(0x1199, 0x68a2, 8)},    /* Sierra Wireless MC7710 in QMI mode */
        {QMI_FIXED_INTF(0x1199, 0x68a2, 19)},   /* Sierra Wireless MC7710 in QMI mode */
        {QMI_FIXED_INTF(0x1199, 0x901c, 8)},    /* Sierra Wireless EM7700 */
+        {QMI_FIXED_INTF(0x1199, 0x9051, 8)},    /* Netgear AirCard 340U */
        {QMI_FIXED_INTF(0x1bbb, 0x011e, 4)},    /* Telekom Speedstick LTE II (Alcatel One Touch L100V LTE) */
        {QMI_FIXED_INTF(0x2357, 0x0201, 4)},    /* TP-LINK HSUPA Modem MA180 */
        {QMI_FIXED_INTF(0x2357, 0x9000, 4)},    /* TP-LINK MA260 */
@@ -730,6 +732,7 @@ static const struct usb_device_id products[] = {
        {QMI_FIXED_INTF(0x1bc7, 0x1201, 2)},    /* Telit LE920 */
        {QMI_FIXED_INTF(0x0b3c, 0xc005, 6)},    /* Olivetti Olicard 200 */
        {QMI_FIXED_INTF(0x1e2d, 0x0060, 4)},    /* Cinterion PLxx */
+        {QMI_FIXED_INTF(0x1e2d, 0x0053, 4)},    /* Cinterion PHxx,PXxx */
        /* 4. Gobi 1000 devices */
        {QMI_GOBI1K_DEVICE(0x05c6, 0x9212)},    /* Acer Gobi Modem Device */
diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
index e8fac732c6f1..adb12f349a61 100644
--- a/drivers/net/usb/r8152.c
+++ b/drivers/net/usb/r8152.c
@@ -449,9 +449,6 @@ enum rtl8152_flags {
 #define MCU_TYPE_PLA                    0x0100
 #define MCU_TYPE_USB                    0x0000
-#define REALTEK_USB_DEVICE(vend, prod)  \
-        USB_DEVICE_INTERFACE_CLASS(vend, prod, USB_CLASS_VENDOR_SPEC)
 struct rx_desc {
        __le32 opts1;
 #define RX_LEN_MASK                     0x7fff
@@ -2273,22 +2270,21 @@ static int rtl8152_open(struct net_device *netdev)
        struct r8152 *tp = netdev_priv(netdev);
        int res = 0;
+        rtl8152_set_speed(tp, AUTONEG_ENABLE,
+                          tp->mii.supports_gmii ? SPEED_1000 : SPEED_100,
+                          DUPLEX_FULL);
+        tp->speed = 0;
+        netif_carrier_off(netdev);
+        netif_start_queue(netdev);
+        set_bit(WORK_ENABLE, &tp->flags);
        res = usb_submit_urb(tp->intr_urb, GFP_KERNEL);
        if (res) {
                if (res == -ENODEV)
                        netif_device_detach(tp->netdev);
                netif_warn(tp, ifup, netdev, "intr_urb submit failed: %d\n",
                           res);
-                return res;
        }
-        rtl8152_set_speed(tp, AUTONEG_ENABLE,
-                          tp->mii.supports_gmii ? SPEED_1000 : SPEED_100,
-                          DUPLEX_FULL);
-        tp->speed = 0;
-        netif_carrier_off(netdev);
-        netif_start_queue(netdev);
-        set_bit(WORK_ENABLE, &tp->flags);
        return res;
 }
@@ -2298,8 +2294,8 @@ static int rtl8152_close(struct net_device *netdev)
        struct r8152 *tp = netdev_priv(netdev);
        int res = 0;
-        usb_kill_urb(tp->intr_urb);
        clear_bit(WORK_ENABLE, &tp->flags);
+        usb_kill_urb(tp->intr_urb);
        cancel_delayed_work_sync(&tp->schedule);
        netif_stop_queue(netdev);
        tasklet_disable(&tp->tl);
@@ -2740,6 +2736,12 @@ static int rtl8152_probe(struct usb_interface *intf,
        struct net_device *netdev;
        int ret;
+        if (udev->actconfig->desc.bConfigurationValue != 1) {
+                usb_driver_set_configuration(udev, 1);
+                return -ENODEV;
+        }
+        usb_reset_device(udev);
        netdev = alloc_etherdev(sizeof(struct r8152));
        if (!netdev) {
                dev_err(&intf->dev, "Out of memory\n");
@@ -2820,9 +2822,9 @@ static void rtl8152_disconnect(struct usb_interface *intf)
 /* table of devices that work with this driver */
 static struct usb_device_id rtl8152_table[] = {
-        {REALTEK_USB_DEVICE(VENDOR_ID_REALTEK, PRODUCT_ID_RTL8152)},
+        {USB_DEVICE(VENDOR_ID_REALTEK, PRODUCT_ID_RTL8152)},
-        {REALTEK_USB_DEVICE(VENDOR_ID_REALTEK, PRODUCT_ID_RTL8153)},
+        {USB_DEVICE(VENDOR_ID_REALTEK, PRODUCT_ID_RTL8153)},
-        {REALTEK_USB_DEVICE(VENDOR_ID_SAMSUNG, PRODUCT_ID_SAMSUNG)},
+        {USB_DEVICE(VENDOR_ID_SAMSUNG, PRODUCT_ID_SAMSUNG)},
        {}
 };
diff --git a/drivers/net/usb/r815x.c b/drivers/net/usb/r815x.c
deleted file mode 100644
index f0a8791b7636..000000000000
--- a/drivers/net/usb/r815x.c
+++ /dev/null
@@ -1,248 +0,0 @@
-#include <linux/module.h>
-#include <linux/netdevice.h>
-#include <linux/mii.h>
-#include <linux/usb.h>
-#include <linux/usb/cdc.h>
-#include <linux/usb/usbnet.h>
-#define RTL815x_REQT_READ       0xc0
-#define RTL815x_REQT_WRITE      0x40
-#define RTL815x_REQ_GET_REGS    0x05
-#define RTL815x_REQ_SET_REGS    0x05
-#define MCU_TYPE_PLA            0x0100
-#define OCP_BASE                0xe86c
-#define BASE_MII                0xa400
-#define BYTE_EN_DWORD           0xff
-#define BYTE_EN_WORD            0x33
-#define BYTE_EN_BYTE            0x11
-#define R815x_PHY_ID            32
-#define REALTEK_VENDOR_ID       0x0bda
-static int pla_read_word(struct usb_device *udev, u16 index)
-{
-        int ret;
-        u8 shift = index & 2;
-        __le32 *tmp;
-        tmp = kmalloc(sizeof(*tmp), GFP_KERNEL);
-        if (!tmp)
-                return -ENOMEM;
-        index &= ~3;
-        ret = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
-                              RTL815x_REQ_GET_REGS, RTL815x_REQT_READ,
-                              index, MCU_TYPE_PLA, tmp, sizeof(*tmp), 500);
-        if (ret < 0)
-                goto out2;
-        ret = __le32_to_cpu(*tmp);
-        ret >>= (shift * 8);
-        ret &= 0xffff;
-out2:
-        kfree(tmp);
-        return ret;
-}
-static int pla_write_word(struct usb_device *udev, u16 index, u32 data)
-{
-        __le32 *tmp;
-        u32 mask = 0xffff;
-        u16 byen = BYTE_EN_WORD;
-        u8 shift = index & 2;
-        int ret;
-        tmp = kmalloc(sizeof(*tmp), GFP_KERNEL);
-        if (!tmp)
-                return -ENOMEM;
-        data &= mask;
-        if (shift) {
-                byen <<= shift;
-                mask <<= (shift * 8);
-                data <<= (shift * 8);
-                index &= ~3;
-        }
-        ret = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
-                              RTL815x_REQ_GET_REGS, RTL815x_REQT_READ,
-                              index, MCU_TYPE_PLA, tmp, sizeof(*tmp), 500);
-        if (ret < 0)
-                goto out3;
-        data |= __le32_to_cpu(*tmp) & ~mask;
-        *tmp = __cpu_to_le32(data);
-        ret = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
-                              RTL815x_REQ_SET_REGS, RTL815x_REQT_WRITE,
-                              index, MCU_TYPE_PLA | byen, tmp, sizeof(*tmp),
-                              500);
-out3:
-        kfree(tmp);
-        return ret;
-}
-static int ocp_reg_read(struct usbnet *dev, u16 addr)
-{
-        u16 ocp_base, ocp_index;
-        int ret;
-        ocp_base = addr & 0xf000;
-        ret = pla_write_word(dev->udev, OCP_BASE, ocp_base);
-        if (ret < 0)
-                goto out;
-        ocp_index = (addr & 0x0fff) | 0xb000;
-        ret = pla_read_word(dev->udev, ocp_index);
-out:
-        return ret;
-}
-static int ocp_reg_write(struct usbnet *dev, u16 addr, u16 data)
-{
-        u16 ocp_base, ocp_index;
-        int ret;
-        ocp_base = addr & 0xf000;
-        ret = pla_write_word(dev->udev, OCP_BASE, ocp_base);
-        if (ret < 0)
-                goto out1;
-        ocp_index = (addr & 0x0fff) | 0xb000;
-        ret = pla_write_word(dev->udev, ocp_index, data);
-out1:
-        return ret;
-}
-static int r815x_mdio_read(struct net_device *netdev, int phy_id, int reg)
-{
-        struct usbnet *dev = netdev_priv(netdev);
-        int ret;
-        if (phy_id != R815x_PHY_ID)
-                return -EINVAL;
-        if (usb_autopm_get_interface(dev->intf) < 0)
-                return -ENODEV;
-        ret = ocp_reg_read(dev, BASE_MII + reg * 2);
-        usb_autopm_put_interface(dev->intf);
-        return ret;
-}
-static
-void r815x_mdio_write(struct net_device *netdev, int phy_id, int reg, int val)
-{
-        struct usbnet *dev = netdev_priv(netdev);
-        if (phy_id != R815x_PHY_ID)
-                return;
-        if (usb_autopm_get_interface(dev->intf) < 0)
-                return;
-        ocp_reg_write(dev, BASE_MII + reg * 2, val);
-        usb_autopm_put_interface(dev->intf);
-}
-static int r8153_bind(struct usbnet *dev, struct usb_interface *intf)
-{
-        int status;
-        status = usbnet_cdc_bind(dev, intf);
-        if (status < 0)
-                return status;
-        dev->mii.dev = dev->net;
-        dev->mii.mdio_read = r815x_mdio_read;
-        dev->mii.mdio_write = r815x_mdio_write;
-        dev->mii.phy_id_mask = 0x3f;
-        dev->mii.reg_num_mask = 0x1f;
-        dev->mii.phy_id = R815x_PHY_ID;
-        dev->mii.supports_gmii = 1;
-        return status;
-}
-static int r8152_bind(struct usbnet *dev, struct usb_interface *intf)
-{
-        int status;
-        status = usbnet_cdc_bind(dev, intf);
-        if (status < 0)
-                return status;
-        dev->mii.dev = dev->net;
-        dev->mii.mdio_read = r815x_mdio_read;
-        dev->mii.mdio_write = r815x_mdio_write;
-        dev->mii.phy_id_mask = 0x3f;
-        dev->mii.reg_num_mask = 0x1f;
-        dev->mii.phy_id = R815x_PHY_ID;
-        dev->mii.supports_gmii = 0;
-        return status;
-}
-static const struct driver_info r8152_info = {
-        .description =  "RTL8152 ECM Device",
-        .flags =        FLAG_ETHER | FLAG_POINTTOPOINT,
-        .bind =         r8152_bind,
-        .unbind =       usbnet_cdc_unbind,
-        .status =       usbnet_cdc_status,
-        .manage_power = usbnet_manage_power,
-};
-static const struct driver_info r8153_info = {
-        .description =  "RTL8153 ECM Device",
-        .flags =        FLAG_ETHER | FLAG_POINTTOPOINT,
-        .bind =         r8153_bind,
-        .unbind =       usbnet_cdc_unbind,
-        .status =       usbnet_cdc_status,
-        .manage_power = usbnet_manage_power,
-};
-static const struct usb_device_id products[] = {
-{
-        USB_DEVICE_AND_INTERFACE_INFO(REALTEK_VENDOR_ID, 0x8152, USB_CLASS_COMM,
-                        USB_CDC_SUBCLASS_ETHERNET, USB_CDC_PROTO_NONE),
-        .driver_info = (unsigned long) &r8152_info,
-},
-{
-        USB_DEVICE_AND_INTERFACE_INFO(REALTEK_VENDOR_ID, 0x8153, USB_CLASS_COMM,
-                        USB_CDC_SUBCLASS_ETHERNET, USB_CDC_PROTO_NONE),
-        .driver_info = (unsigned long) &r8153_info,
-},
-        { },            /* END */
-};
-MODULE_DEVICE_TABLE(usb, products);
-static struct usb_driver r815x_driver = {
-        .name =         "r815x",
-        .id_table =     products,
-        .probe =        usbnet_probe,
-        .disconnect =   usbnet_disconnect,
-        .suspend =      usbnet_suspend,
-        .resume =       usbnet_resume,
-        .reset_resume = usbnet_resume,
-        .supports_autosuspend = 1,
-        .disable_hub_initiated_lpm = 1,
-};
-module_usb_driver(r815x_driver);
-MODULE_AUTHOR("Hayes Wang");
-MODULE_DESCRIPTION("Realtek USB ECM device");
-MODULE_LICENSE("GPL");
diff --git a/drivers/net/usb/rndis_host.c b/drivers/net/usb/rndis_host.c
index a48bc0f20c1a..524a47a28120 100644
--- a/drivers/net/usb/rndis_host.c
+++ b/drivers/net/usb/rndis_host.c
@@ -492,6 +492,10 @@ EXPORT_SYMBOL_GPL(rndis_unbind);
 */
 int rndis_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
 {
+        /* This check is no longer done by usbnet */
+        if (skb->len < dev->net->hard_header_len)
+                return 0;
        /* peripheral may have batched packets to us... */
        while (likely(skb->len)) {
                struct rndis_data_hdr   *hdr = (void *)skb->data;
diff --git a/drivers/net/usb/smsc75xx.c b/drivers/net/usb/smsc75xx.c
index f17b9e02dd34..d9e7892262fa 100644
--- a/drivers/net/usb/smsc75xx.c
+++ b/drivers/net/usb/smsc75xx.c
@@ -2106,6 +2106,10 @@ static void smsc75xx_rx_csum_offload(struct usbnet *dev, struct sk_buff *skb,
 static int smsc75xx_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
 {
+        /* This check is no longer done by usbnet */
+        if (skb->len < dev->net->hard_header_len)
+                return 0;
        while (skb->len > 0) {
                u32 rx_cmd_a, rx_cmd_b, align_count, size;
                struct sk_buff *ax_skb;
diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c
index 8dd54a0f7b29..424db65e4396 100644
--- a/drivers/net/usb/smsc95xx.c
+++ b/drivers/net/usb/smsc95xx.c
@@ -1723,6 +1723,10 @@ static void smsc95xx_rx_csum_offload(struct sk_buff *skb)
 static int smsc95xx_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
 {
+        /* This check is no longer done by usbnet */
+        if (skb->len < dev->net->hard_header_len)
+                return 0;
        while (skb->len > 0) {
                u32 header, align_count;
                struct sk_buff *ax_skb;
diff --git a/drivers/net/usb/sr9800.c b/drivers/net/usb/sr9800.c
new file mode 100644
index 000000000000..b94a0fbb8b3b
--- /dev/null
+++ b/drivers/net/usb/sr9800.c
@@ -0,0 +1,874 @@
+/* CoreChip-sz SR9800 one chip USB 2.0 Ethernet Devices
+ *
+ * Author : Liu Junliang <liujunliang_ljl@163.com>
+ *
+ * Based on asix_common.c, asix_devices.c
+ *
+ * This file is licensed under the terms of the GNU General Public License
+ * version 2.  This program is licensed "as is" without any warranty of any
+ * kind, whether express or implied.*
+ */
+#include <linux/module.h>
+#include <linux/kmod.h>
+#include <linux/init.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/ethtool.h>
+#include <linux/workqueue.h>
+#include <linux/mii.h>
+#include <linux/usb.h>
+#include <linux/crc32.h>
+#include <linux/usb/usbnet.h>
+#include <linux/slab.h>
+#include <linux/if_vlan.h>
+#include "sr9800.h"
+static int sr_read_cmd(struct usbnet *dev, u8 cmd, u16 value, u16 index,
+                            u16 size, void *data)
+{
+        int err;
+        err = usbnet_read_cmd(dev, cmd, SR_REQ_RD_REG, value, index,
+                              data, size);
+        if ((err != size) && (err >= 0))
+                err = -EINVAL;
+        return err;
+}
+static int sr_write_cmd(struct usbnet *dev, u8 cmd, u16 value, u16 index,
+                             u16 size, void *data)
+{
+        int err;
+        err = usbnet_write_cmd(dev, cmd, SR_REQ_WR_REG, value, index,
+                              data, size);
+        if ((err != size) && (err >= 0))
+                err = -EINVAL;
+        return err;
+}
+static void
+sr_write_cmd_async(struct usbnet *dev, u8 cmd, u16 value, u16 index,
+                   u16 size, void *data)
+{
+        usbnet_write_cmd_async(dev, cmd, SR_REQ_WR_REG, value, index, data,
+                               size);
+}
+static int sr_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
+{
+        int offset = 0;
+        /* This check is no longer done by usbnet */
+        if (skb->len < dev->net->hard_header_len)
+                return 0;
+        while (offset + sizeof(u32) < skb->len) {
+                struct sk_buff *sr_skb;
+                u16 size;
+                u32 header = get_unaligned_le32(skb->data + offset);
+                offset += sizeof(u32);
+                /* get the packet length */
+                size = (u16) (header & 0x7ff);
+                if (size != ((~header >> 16) & 0x07ff)) {
+                        netdev_err(dev->net, "%s : Bad Header Length\n",
+                                   __func__);
+                        return 0;
+                }
+                if ((size > dev->net->mtu + ETH_HLEN + VLAN_HLEN) ||
+                    (size + offset > skb->len)) {
+                        netdev_err(dev->net, "%s : Bad RX Length %d\n",
+                                   __func__, size);
+                        return 0;
+                }
+                sr_skb = netdev_alloc_skb_ip_align(dev->net, size);
+                if (!sr_skb)
+                        return 0;
+                skb_put(sr_skb, size);
+                memcpy(sr_skb->data, skb->data + offset, size);
+                usbnet_skb_return(dev, sr_skb);
+                offset += (size + 1) & 0xfffe;
+        }
+        if (skb->len != offset) {
+                netdev_err(dev->net, "%s : Bad SKB Length %d\n", __func__,
+                           skb->len);
+                return 0;
+        }
+        return 1;
+}
+static struct sk_buff *sr_tx_fixup(struct usbnet *dev, struct sk_buff *skb,
+                                        gfp_t flags)
+{
+        int headroom = skb_headroom(skb);
+        int tailroom = skb_tailroom(skb);
+        u32 padbytes = 0xffff0000;
+        u32 packet_len;
+        int padlen;
+        padlen = ((skb->len + 4) % (dev->maxpacket - 1)) ? 0 : 4;
+        if ((!skb_cloned(skb)) && ((headroom + tailroom) >= (4 + padlen))) {
+                if ((headroom < 4) || (tailroom < padlen)) {
+                        skb->data = memmove(skb->head + 4, skb->data,
+                                            skb->len);
+                        skb_set_tail_pointer(skb, skb->len);
+                }
+        } else {
+                struct sk_buff *skb2;
+                skb2 = skb_copy_expand(skb, 4, padlen, flags);
+                dev_kfree_skb_any(skb);
+                skb = skb2;
+                if (!skb)
+                        return NULL;
+        }
+        skb_push(skb, 4);
+        packet_len = (((skb->len - 4) ^ 0x0000ffff) << 16) + (skb->len - 4);
+        cpu_to_le32s(&packet_len);
+        skb_copy_to_linear_data(skb, &packet_len, sizeof(packet_len));
+        if (padlen) {
+                cpu_to_le32s(&padbytes);
+                memcpy(skb_tail_pointer(skb), &padbytes, sizeof(padbytes));
+                skb_put(skb, sizeof(padbytes));
+        }
+        return skb;
+}
+static void sr_status(struct usbnet *dev, struct urb *urb)
+{
+        struct sr9800_int_data *event;
+        int link;
+        if (urb->actual_length < 8)
+                return;
+        event = urb->transfer_buffer;
+        link = event->link & 0x01;
+        if (netif_carrier_ok(dev->net) != link) {
+                usbnet_link_change(dev, link, 1);
+                netdev_dbg(dev->net, "Link Status is: %d\n", link);
+        }
+        return;
+}
+static inline int sr_set_sw_mii(struct usbnet *dev)
+{
+        int ret;
+        ret = sr_write_cmd(dev, SR_CMD_SET_SW_MII, 0x0000, 0, 0, NULL);
+        if (ret < 0)
+                netdev_err(dev->net, "Failed to enable software MII access\n");
+        return ret;
+}
+static inline int sr_set_hw_mii(struct usbnet *dev)
+{
+        int ret;
+        ret = sr_write_cmd(dev, SR_CMD_SET_HW_MII, 0x0000, 0, 0, NULL);
+        if (ret < 0)
+                netdev_err(dev->net, "Failed to enable hardware MII access\n");
+        return ret;
+}
+static inline int sr_get_phy_addr(struct usbnet *dev)
+{
+        u8 buf[2];
+        int ret;
+        ret = sr_read_cmd(dev, SR_CMD_READ_PHY_ID, 0, 0, 2, buf);
+        if (ret < 0) {
+                netdev_err(dev->net, "%s : Error reading PHYID register:%02x\n",
+                           __func__, ret);
+                goto out;
+        }
+        netdev_dbg(dev->net, "%s : returning 0x%04x\n", __func__,
+                   *((__le16 *)buf));
+        ret = buf[1];
+out:
+        return ret;
+}
+static int sr_sw_reset(struct usbnet *dev, u8 flags)
+{
+        int ret;
+        ret = sr_write_cmd(dev, SR_CMD_SW_RESET, flags, 0, 0, NULL);
+        if (ret < 0)
+                netdev_err(dev->net, "Failed to send software reset:%02x\n",
+                           ret);
+        return ret;
+}
+static u16 sr_read_rx_ctl(struct usbnet *dev)
+{
+        __le16 v;
+        int ret;
+        ret = sr_read_cmd(dev, SR_CMD_READ_RX_CTL, 0, 0, 2, &v);
+        if (ret < 0) {
+                netdev_err(dev->net, "Error reading RX_CTL register:%02x\n",
+                           ret);
+                goto out;
+        }
+        ret = le16_to_cpu(v);
+out:
+        return ret;
+}
+static int sr_write_rx_ctl(struct usbnet *dev, u16 mode)
+{
+        int ret;
+        netdev_dbg(dev->net, "%s : mode = 0x%04x\n", __func__, mode);
+        ret = sr_write_cmd(dev, SR_CMD_WRITE_RX_CTL, mode, 0, 0, NULL);
+        if (ret < 0)
+                netdev_err(dev->net,
+                           "Failed to write RX_CTL mode to 0x%04x:%02x\n",
+                           mode, ret);
+        return ret;
+}
+static u16 sr_read_medium_status(struct usbnet *dev)
+{
+        __le16 v;
+        int ret;
+        ret = sr_read_cmd(dev, SR_CMD_READ_MEDIUM_STATUS, 0, 0, 2, &v);
+        if (ret < 0) {
+                netdev_err(dev->net,
+                           "Error reading Medium Status register:%02x\n", ret);
+                return ret;     /* TODO: callers not checking for error ret */
+        }
+        return le16_to_cpu(v);
+}
+static int sr_write_medium_mode(struct usbnet *dev, u16 mode)
+{
+        int ret;
+        netdev_dbg(dev->net, "%s : mode = 0x%04x\n", __func__, mode);
+        ret = sr_write_cmd(dev, SR_CMD_WRITE_MEDIUM_MODE, mode, 0, 0, NULL);
+        if (ret < 0)
+                netdev_err(dev->net,
+                           "Failed to write Medium Mode mode to 0x%04x:%02x\n",
+                           mode, ret);
+        return ret;
+}
+static int sr_write_gpio(struct usbnet *dev, u16 value, int sleep)
+{
+        int ret;
+        netdev_dbg(dev->net, "%s : value = 0x%04x\n", __func__, value);
+        ret = sr_write_cmd(dev, SR_CMD_WRITE_GPIOS, value, 0, 0, NULL);
+        if (ret < 0)
+                netdev_err(dev->net, "Failed to write GPIO value 0x%04x:%02x\n",
+                           value, ret);
+        if (sleep)
+                msleep(sleep);
+        return ret;
+}
+/* SR9800 have a 16-bit RX_CTL value */
+static void sr_set_multicast(struct net_device *net)
+{
+        struct usbnet *dev = netdev_priv(net);
+        struct sr_data *data = (struct sr_data *)&dev->data;
+        u16 rx_ctl = SR_DEFAULT_RX_CTL;
+        if (net->flags & IFF_PROMISC) {
+                rx_ctl |= SR_RX_CTL_PRO;
+        } else if (net->flags & IFF_ALLMULTI ||
+                   netdev_mc_count(net) > SR_MAX_MCAST) {
+                rx_ctl |= SR_RX_CTL_AMALL;
+        } else if (netdev_mc_empty(net)) {
+                /* just broadcast and directed */
+        } else {
+                /* We use the 20 byte dev->data
+                 * for our 8 byte filter buffer
+                 * to avoid allocating memory that
+                 * is tricky to free later
+                 */
+                struct netdev_hw_addr *ha;
+                u32 crc_bits;
+                memset(data->multi_filter, 0, SR_MCAST_FILTER_SIZE);
+                /* Build the multicast hash filter. */
+                netdev_for_each_mc_addr(ha, net) {
+                        crc_bits = ether_crc(ETH_ALEN, ha->addr) >> 26;
+                        data->multi_filter[crc_bits >> 3] |=
+                            1 << (crc_bits & 7);
+                }
+                sr_write_cmd_async(dev, SR_CMD_WRITE_MULTI_FILTER, 0, 0,
+                                   SR_MCAST_FILTER_SIZE, data->multi_filter);
+                rx_ctl |= SR_RX_CTL_AM;
+        }
+        sr_write_cmd_async(dev, SR_CMD_WRITE_RX_CTL, rx_ctl, 0, 0, NULL);
+}
+static int sr_mdio_read(struct net_device *net, int phy_id, int loc)
+{
+        struct usbnet *dev = netdev_priv(net);
+        __le16 res;
+        mutex_lock(&dev->phy_mutex);
+        sr_set_sw_mii(dev);
+        sr_read_cmd(dev, SR_CMD_READ_MII_REG, phy_id, (__u16)loc, 2, &res);
+        sr_set_hw_mii(dev);
+        mutex_unlock(&dev->phy_mutex);
+        netdev_dbg(dev->net,
+                   "%s : phy_id=0x%02x, loc=0x%02x, returns=0x%04x\n", __func__,
+                   phy_id, loc, le16_to_cpu(res));
+        return le16_to_cpu(res);
+}
+static void
+sr_mdio_write(struct net_device *net, int phy_id, int loc, int val)
+{
+        struct usbnet *dev = netdev_priv(net);
+        __le16 res = cpu_to_le16(val);
+        netdev_dbg(dev->net,
+                   "%s : phy_id=0x%02x, loc=0x%02x, val=0x%04x\n", __func__,
+                   phy_id, loc, val);
+        mutex_lock(&dev->phy_mutex);
+        sr_set_sw_mii(dev);
+        sr_write_cmd(dev, SR_CMD_WRITE_MII_REG, phy_id, (__u16)loc, 2, &res);
+        sr_set_hw_mii(dev);
+        mutex_unlock(&dev->phy_mutex);
+}
+/* Get the PHY Identifier from the PHYSID1 & PHYSID2 MII registers */
+static u32 sr_get_phyid(struct usbnet *dev)
+{
+        int phy_reg;
+        u32 phy_id;
+        int i;
+        /* Poll for the rare case the FW or phy isn't ready yet.  */
+        for (i = 0; i < 100; i++) {
+                phy_reg = sr_mdio_read(dev->net, dev->mii.phy_id, MII_PHYSID1);
+                if (phy_reg != 0 && phy_reg != 0xFFFF)
+                        break;
+                mdelay(1);
+        }
+        if (phy_reg <= 0 || phy_reg == 0xFFFF)
+                return 0;
+        phy_id = (phy_reg & 0xffff) << 16;
+        phy_reg = sr_mdio_read(dev->net, dev->mii.phy_id, MII_PHYSID2);
+        if (phy_reg < 0)
+                return 0;
+        phy_id |= (phy_reg & 0xffff);
+        return phy_id;
+}
+static void
+sr_get_wol(struct net_device *net, struct ethtool_wolinfo *wolinfo)
+{
+        struct usbnet *dev = netdev_priv(net);
+        u8 opt;
+        if (sr_read_cmd(dev, SR_CMD_READ_MONITOR_MODE, 0, 0, 1, &opt) < 0) {
+                wolinfo->supported = 0;
+                wolinfo->wolopts = 0;
+                return;
+        }
+        wolinfo->supported = WAKE_PHY | WAKE_MAGIC;
+        wolinfo->wolopts = 0;
+        if (opt & SR_MONITOR_LINK)
+                wolinfo->wolopts |= WAKE_PHY;
+        if (opt & SR_MONITOR_MAGIC)
+                wolinfo->wolopts |= WAKE_MAGIC;
+}
+static int
+sr_set_wol(struct net_device *net, struct ethtool_wolinfo *wolinfo)
+{
+        struct usbnet *dev = netdev_priv(net);
+        u8 opt = 0;
+        if (wolinfo->wolopts & WAKE_PHY)
+                opt |= SR_MONITOR_LINK;
+        if (wolinfo->wolopts & WAKE_MAGIC)
+                opt |= SR_MONITOR_MAGIC;
+        if (sr_write_cmd(dev, SR_CMD_WRITE_MONITOR_MODE,
+                         opt, 0, 0, NULL) < 0)
+                return -EINVAL;
+        return 0;
+}
+static int sr_get_eeprom_len(struct net_device *net)
+{
+        struct usbnet *dev = netdev_priv(net);
+        struct sr_data *data = (struct sr_data *)&dev->data;
+        return data->eeprom_len;
+}
+static int sr_get_eeprom(struct net_device *net,
+                              struct ethtool_eeprom *eeprom, u8 *data)
+{
+        struct usbnet *dev = netdev_priv(net);
+        __le16 *ebuf = (__le16 *)data;
+        int ret;
+        int i;
+        /* Crude hack to ensure that we don't overwrite memory
+         * if an odd length is supplied
+         */
+        if (eeprom->len % 2)
+                return -EINVAL;
+        eeprom->magic = SR_EEPROM_MAGIC;
+        /* sr9800 returns 2 bytes from eeprom on read */
+        for (i = 0; i < eeprom->len / 2; i++) {
+                ret = sr_read_cmd(dev, SR_CMD_READ_EEPROM, eeprom->offset + i,
+                                  0, 2, &ebuf[i]);
+                if (ret < 0)
+                        return -EINVAL;
+        }
+        return 0;
+}
+static void sr_get_drvinfo(struct net_device *net,
+                                 struct ethtool_drvinfo *info)
+{
+        struct usbnet *dev = netdev_priv(net);
+        struct sr_data *data = (struct sr_data *)&dev->data;
+        /* Inherit standard device info */
+        usbnet_get_drvinfo(net, info);
+        strncpy(info->driver, DRIVER_NAME, sizeof(info->driver));
+        strncpy(info->version, DRIVER_VERSION, sizeof(info->version));
+        info->eedump_len = data->eeprom_len;
+}
+static u32 sr_get_link(struct net_device *net)
+{
+        struct usbnet *dev = netdev_priv(net);
+        return mii_link_ok(&dev->mii);
+}
+static int sr_ioctl(struct net_device *net, struct ifreq *rq, int cmd)
+{
+        struct usbnet *dev = netdev_priv(net);
+        return generic_mii_ioctl(&dev->mii, if_mii(rq), cmd, NULL);
+}
+static int sr_set_mac_address(struct net_device *net, void *p)
+{
+        struct usbnet *dev = netdev_priv(net);
+        struct sr_data *data = (struct sr_data *)&dev->data;
+        struct sockaddr *addr = p;
+        if (netif_running(net))
+                return -EBUSY;
+        if (!is_valid_ether_addr(addr->sa_data))
+                return -EADDRNOTAVAIL;
+        memcpy(net->dev_addr, addr->sa_data, ETH_ALEN);
+        /* We use the 20 byte dev->data
+         * for our 6 byte mac buffer
+         * to avoid allocating memory that
+         * is tricky to free later
+         */
+        memcpy(data->mac_addr, addr->sa_data, ETH_ALEN);
+        sr_write_cmd_async(dev, SR_CMD_WRITE_NODE_ID, 0, 0, ETH_ALEN,
+                           data->mac_addr);
+        return 0;
+}
+static const struct ethtool_ops sr9800_ethtool_ops = {
+        .get_drvinfo    = sr_get_drvinfo,
+        .get_link       = sr_get_link,
+        .get_msglevel   = usbnet_get_msglevel,
+        .set_msglevel   = usbnet_set_msglevel,
+        .get_wol        = sr_get_wol,
+        .set_wol        = sr_set_wol,
+        .get_eeprom_len = sr_get_eeprom_len,
+        .get_eeprom     = sr_get_eeprom,
+        .get_settings   = usbnet_get_settings,
+        .set_settings   = usbnet_set_settings,
+        .nway_reset     = usbnet_nway_reset,
+};
+static int sr9800_link_reset(struct usbnet *dev)
+{
+        struct ethtool_cmd ecmd = { .cmd = ETHTOOL_GSET };
+        u16 mode;
+        mii_check_media(&dev->mii, 1, 1);
+        mii_ethtool_gset(&dev->mii, &ecmd);
+        mode = SR9800_MEDIUM_DEFAULT;
+        if (ethtool_cmd_speed(&ecmd) != SPEED_100)
+                mode &= ~SR_MEDIUM_PS;
+        if (ecmd.duplex != DUPLEX_FULL)
+                mode &= ~SR_MEDIUM_FD;
+        netdev_dbg(dev->net, "%s : speed: %u duplex: %d mode: 0x%04x\n",
+                   __func__, ethtool_cmd_speed(&ecmd), ecmd.duplex, mode);
+        sr_write_medium_mode(dev, mode);
+        return 0;
+}
+static int sr9800_set_default_mode(struct usbnet *dev)
+{
+        u16 rx_ctl;
+        int ret;
+        sr_mdio_write(dev->net, dev->mii.phy_id, MII_BMCR, BMCR_RESET);
+        sr_mdio_write(dev->net, dev->mii.phy_id, MII_ADVERTISE,
+                      ADVERTISE_ALL | ADVERTISE_CSMA);
+        mii_nway_restart(&dev->mii);
+        ret = sr_write_medium_mode(dev, SR9800_MEDIUM_DEFAULT);
+        if (ret < 0)
+                goto out;
+        ret = sr_write_cmd(dev, SR_CMD_WRITE_IPG012,
+                                SR9800_IPG0_DEFAULT | SR9800_IPG1_DEFAULT,
+                                SR9800_IPG2_DEFAULT, 0, NULL);
+        if (ret < 0) {
+                netdev_dbg(dev->net, "Write IPG,IPG1,IPG2 failed: %d\n", ret);
+                goto out;
+        }
+        /* Set RX_CTL to default values with 2k buffer, and enable cactus */
+        ret = sr_write_rx_ctl(dev, SR_DEFAULT_RX_CTL);
+        if (ret < 0)
+                goto out;
+        rx_ctl = sr_read_rx_ctl(dev);
+        netdev_dbg(dev->net, "RX_CTL is 0x%04x after all initializations\n",
+                   rx_ctl);
+        rx_ctl = sr_read_medium_status(dev);
+        netdev_dbg(dev->net, "Medium Status:0x%04x after all initializations\n",
+                   rx_ctl);
+        return 0;
+out:
+        return ret;
+}
+static int sr9800_reset(struct usbnet *dev)
+{
+        struct sr_data *data = (struct sr_data *)&dev->data;
+        int ret, embd_phy;
+        u16 rx_ctl;
+        ret = sr_write_gpio(dev,
+                        SR_GPIO_RSE | SR_GPIO_GPO_2 | SR_GPIO_GPO2EN, 5);
+        if (ret < 0)
+                goto out;
+        embd_phy = ((sr_get_phy_addr(dev) & 0x1f) == 0x10 ? 1 : 0);
+        ret = sr_write_cmd(dev, SR_CMD_SW_PHY_SELECT, embd_phy, 0, 0, NULL);
+        if (ret < 0) {
+                netdev_dbg(dev->net, "Select PHY #1 failed: %d\n", ret);
+                goto out;
+        }
+        ret = sr_sw_reset(dev, SR_SWRESET_IPPD | SR_SWRESET_PRL);
+        if (ret < 0)
+                goto out;
+        msleep(150);
+        ret = sr_sw_reset(dev, SR_SWRESET_CLEAR);
+        if (ret < 0)
+                goto out;
+        msleep(150);
+        if (embd_phy) {
+                ret = sr_sw_reset(dev, SR_SWRESET_IPRL);
+                if (ret < 0)
+                        goto out;
+        } else {
+                ret = sr_sw_reset(dev, SR_SWRESET_PRTE);
+                if (ret < 0)
+                        goto out;
+        }
+        msleep(150);
+        rx_ctl = sr_read_rx_ctl(dev);
+        netdev_dbg(dev->net, "RX_CTL is 0x%04x after software reset\n", rx_ctl);
+        ret = sr_write_rx_ctl(dev, 0x0000);
+        if (ret < 0)
+                goto out;
+        rx_ctl = sr_read_rx_ctl(dev);
+        netdev_dbg(dev->net, "RX_CTL is 0x%04x setting to 0x0000\n", rx_ctl);
+        ret = sr_sw_reset(dev, SR_SWRESET_PRL);
+        if (ret < 0)
+                goto out;
+        msleep(150);
+        ret = sr_sw_reset(dev, SR_SWRESET_IPRL | SR_SWRESET_PRL);
+        if (ret < 0)
+                goto out;
+        msleep(150);
+        ret = sr9800_set_default_mode(dev);
+        if (ret < 0)
+                goto out;
+        /* Rewrite MAC address */
+        memcpy(data->mac_addr, dev->net->dev_addr, ETH_ALEN);
+        ret = sr_write_cmd(dev, SR_CMD_WRITE_NODE_ID, 0, 0, ETH_ALEN,
+                                                        data->mac_addr);
+        if (ret < 0)
+                goto out;
+        return 0;
+out:
+        return ret;
+}
+static const struct net_device_ops sr9800_netdev_ops = {
+        .ndo_open               = usbnet_open,
+        .ndo_stop               = usbnet_stop,
+        .ndo_start_xmit         = usbnet_start_xmit,
+        .ndo_tx_timeout         = usbnet_tx_timeout,
+        .ndo_change_mtu         = usbnet_change_mtu,
+        .ndo_set_mac_address    = sr_set_mac_address,
+        .ndo_validate_addr      = eth_validate_addr,
+        .ndo_do_ioctl           = sr_ioctl,
+        .ndo_set_rx_mode        = sr_set_multicast,
+};
+static int sr9800_phy_powerup(struct usbnet *dev)
+{
+        int ret;
+        /* set the embedded Ethernet PHY in power-down state */
+        ret = sr_sw_reset(dev, SR_SWRESET_IPPD | SR_SWRESET_IPRL);
+        if (ret < 0) {
+                netdev_err(dev->net, "Failed to power down PHY : %d\n", ret);
+                return ret;
+        }
+        msleep(20);
+        /* set the embedded Ethernet PHY in power-up state */
+        ret = sr_sw_reset(dev, SR_SWRESET_IPRL);
+        if (ret < 0) {
+                netdev_err(dev->net, "Failed to reset PHY: %d\n", ret);
+                return ret;
+        }
+        msleep(600);
+        /* set the embedded Ethernet PHY in reset state */
+        ret = sr_sw_reset(dev, SR_SWRESET_CLEAR);
+        if (ret < 0) {
+                netdev_err(dev->net, "Failed to power up PHY: %d\n", ret);
+                return ret;
+        }
+        msleep(20);
+        /* set the embedded Ethernet PHY in power-up state */
+        ret = sr_sw_reset(dev, SR_SWRESET_IPRL);
+        if (ret < 0) {
+                netdev_err(dev->net, "Failed to reset PHY: %d\n", ret);
+                return ret;
+        }
+        return 0;
+}
+static int sr9800_bind(struct usbnet *dev, struct usb_interface *intf)
+{
+        struct sr_data *data = (struct sr_data *)&dev->data;
+        u16 led01_mux, led23_mux;
+        int ret, embd_phy;
+        u32 phyid;
+        u16 rx_ctl;
+        data->eeprom_len = SR9800_EEPROM_LEN;
+        usbnet_get_endpoints(dev, intf);
+        /* LED Setting Rule :
+         * AABB:CCDD
+         * AA : MFA0(LED0)
+         * BB : MFA1(LED1)
+         * CC : MFA2(LED2), Reserved for SR9800
+         * DD : MFA3(LED3), Reserved for SR9800
+         */
+        led01_mux = (SR_LED_MUX_LINK_ACTIVE << 8) | SR_LED_MUX_LINK;
+        led23_mux = (SR_LED_MUX_LINK_ACTIVE << 8) | SR_LED_MUX_TX_ACTIVE;
+        ret = sr_write_cmd(dev, SR_CMD_LED_MUX, led01_mux, led23_mux, 0, NULL);
+        if (ret < 0) {
+                        netdev_err(dev->net, "set LINK LED failed : %d\n", ret);
+                        goto out;
+        }
+        /* Get the MAC address */
+        ret = sr_read_cmd(dev, SR_CMD_READ_NODE_ID, 0, 0, ETH_ALEN,
+                          dev->net->dev_addr);
+        if (ret < 0) {
+                netdev_dbg(dev->net, "Failed to read MAC address: %d\n", ret);
+                return ret;
+        }
+        netdev_dbg(dev->net, "mac addr : %pM\n", dev->net->dev_addr);
+        /* Initialize MII structure */
+        dev->mii.dev = dev->net;
+        dev->mii.mdio_read = sr_mdio_read;
+        dev->mii.mdio_write = sr_mdio_write;
+        dev->mii.phy_id_mask = 0x1f;
+        dev->mii.reg_num_mask = 0x1f;
+        dev->mii.phy_id = sr_get_phy_addr(dev);
+        dev->net->netdev_ops = &sr9800_netdev_ops;
+        dev->net->ethtool_ops = &sr9800_ethtool_ops;
+        embd_phy = ((dev->mii.phy_id & 0x1f) == 0x10 ? 1 : 0);
+        /* Reset the PHY to normal operation mode */
+        ret = sr_write_cmd(dev, SR_CMD_SW_PHY_SELECT, embd_phy, 0, 0, NULL);
+        if (ret < 0) {
+                netdev_dbg(dev->net, "Select PHY #1 failed: %d\n", ret);
+                return ret;
+        }
+        /* Init PHY routine */
+        ret = sr9800_phy_powerup(dev);
+        if (ret < 0)
+                goto out;
+        rx_ctl = sr_read_rx_ctl(dev);
+        netdev_dbg(dev->net, "RX_CTL is 0x%04x after software reset\n", rx_ctl);
+        ret = sr_write_rx_ctl(dev, 0x0000);
+        if (ret < 0)
+                goto out;
+        rx_ctl = sr_read_rx_ctl(dev);
+        netdev_dbg(dev->net, "RX_CTL is 0x%04x setting to 0x0000\n", rx_ctl);
+        /* Read PHYID register *AFTER* the PHY was reset properly */
+        phyid = sr_get_phyid(dev);
+        netdev_dbg(dev->net, "PHYID=0x%08x\n", phyid);
+        /* medium mode setting */
+        ret = sr9800_set_default_mode(dev);
+        if (ret < 0)
+                goto out;
+        if (dev->udev->speed == USB_SPEED_HIGH) {
+                ret = sr_write_cmd(dev, SR_CMD_BULKIN_SIZE,
+                        SR9800_BULKIN_SIZE[SR9800_MAX_BULKIN_4K].byte_cnt,
+                        SR9800_BULKIN_SIZE[SR9800_MAX_BULKIN_4K].threshold,
+                        0, NULL);
+                if (ret < 0) {
+                        netdev_err(dev->net, "Reset RX_CTL failed: %d\n", ret);
+                        goto out;
+                }
+                dev->rx_urb_size =
+                        SR9800_BULKIN_SIZE[SR9800_MAX_BULKIN_4K].size;
+        } else {
+                ret = sr_write_cmd(dev, SR_CMD_BULKIN_SIZE,
+                        SR9800_BULKIN_SIZE[SR9800_MAX_BULKIN_2K].byte_cnt,
+                        SR9800_BULKIN_SIZE[SR9800_MAX_BULKIN_2K].threshold,
+                        0, NULL);
+                if (ret < 0) {
+                        netdev_err(dev->net, "Reset RX_CTL failed: %d\n", ret);
+                        goto out;
+                }
+                dev->rx_urb_size =
+                        SR9800_BULKIN_SIZE[SR9800_MAX_BULKIN_2K].size;
+        }
+        netdev_dbg(dev->net, "%s : setting rx_urb_size with : %zu\n", __func__,
+                   dev->rx_urb_size);
+        return 0;
+out:
+        return ret;
+}
+static const struct driver_info sr9800_driver_info = {
+        .description    = "CoreChip SR9800 USB 2.0 Ethernet",
+        .bind           = sr9800_bind,
+        .status         = sr_status,
+        .link_reset     = sr9800_link_reset,
+        .reset          = sr9800_reset,
+        .flags          = DRIVER_FLAG,
+        .rx_fixup       = sr_rx_fixup,
+        .tx_fixup       = sr_tx_fixup,
+};
+static const struct usb_device_id       products[] = {
+        {
+                USB_DEVICE(0x0fe6, 0x9800),     /* SR9800 Device  */
+                .driver_info = (unsigned long) &sr9800_driver_info,
+        },
+        {},             /* END */
+};
+MODULE_DEVICE_TABLE(usb, products);
+static struct usb_driver sr_driver = {
+        .name           = DRIVER_NAME,
+        .id_table       = products,
+        .probe          = usbnet_probe,
+        .suspend        = usbnet_suspend,
+        .resume         = usbnet_resume,
+        .disconnect     = usbnet_disconnect,
+        .supports_autosuspend = 1,
+};
+module_usb_driver(sr_driver);
+MODULE_AUTHOR("Liu Junliang <liujunliang_ljl@163.com");
+MODULE_VERSION(DRIVER_VERSION);
+MODULE_DESCRIPTION("SR9800 USB 2.0 USB2NET Dev : http://www.corechip-sz.com");
+MODULE_LICENSE("GPL");
diff --git a/drivers/net/usb/sr9800.h b/drivers/net/usb/sr9800.h
new file mode 100644
index 000000000000..18f670251275
--- /dev/null
+++ b/drivers/net/usb/sr9800.h
@@ -0,0 +1,202 @@
+/* CoreChip-sz SR9800 one chip USB 2.0 Ethernet Devices
+ *
+ * Author : Liu Junliang <liujunliang_ljl@163.com>
+ *
+ * This file is licensed under the terms of the GNU General Public License
+ * version 2.  This program is licensed "as is" without any warranty of any
+ * kind, whether express or implied.
+ */
+#ifndef _SR9800_H
+#define _SR9800_H
+/* SR9800 spec. command table on Linux Platform */
+/* command : Software Station Management Control Reg */
+#define SR_CMD_SET_SW_MII               0x06
+/* command : PHY Read Reg */
+#define SR_CMD_READ_MII_REG             0x07
+/* command : PHY Write Reg */
+#define SR_CMD_WRITE_MII_REG            0x08
+/* command : Hardware Station Management Control Reg */
+#define SR_CMD_SET_HW_MII               0x0a
+/* command : SROM Read Reg */
+#define SR_CMD_READ_EEPROM              0x0b
+/* command : SROM Write Reg */
+#define SR_CMD_WRITE_EEPROM             0x0c
+/* command : SROM Write Enable Reg */
+#define SR_CMD_WRITE_ENABLE             0x0d
+/* command : SROM Write Disable Reg */
+#define SR_CMD_WRITE_DISABLE            0x0e
+/* command : RX Control Read Reg */
+#define SR_CMD_READ_RX_CTL              0x0f
+#define         SR_RX_CTL_PRO                   (1 << 0)
+#define         SR_RX_CTL_AMALL                 (1 << 1)
+#define         SR_RX_CTL_SEP                   (1 << 2)
+#define         SR_RX_CTL_AB                    (1 << 3)
+#define         SR_RX_CTL_AM                    (1 << 4)
+#define         SR_RX_CTL_AP                    (1 << 5)
+#define         SR_RX_CTL_ARP                   (1 << 6)
+#define         SR_RX_CTL_SO                    (1 << 7)
+#define         SR_RX_CTL_RH1M                  (1 << 8)
+#define         SR_RX_CTL_RH2M                  (1 << 9)
+#define         SR_RX_CTL_RH3M                  (1 << 10)
+/* command : RX Control Write Reg */
+#define SR_CMD_WRITE_RX_CTL             0x10
+/* command : IPG0/IPG1/IPG2 Control Read Reg */
+#define SR_CMD_READ_IPG012              0x11
+/* command : IPG0/IPG1/IPG2 Control Write Reg */
+#define SR_CMD_WRITE_IPG012             0x12
+/* command : Node ID Read Reg */
+#define SR_CMD_READ_NODE_ID             0x13
+/* command : Node ID Write Reg */
+#define SR_CMD_WRITE_NODE_ID            0x14
+/* command : Multicast Filter Array Read Reg */
+#define SR_CMD_READ_MULTI_FILTER        0x15
+/* command : Multicast Filter Array Write Reg */
+#define SR_CMD_WRITE_MULTI_FILTER       0x16
+/* command : Eth/HomePNA PHY Address Reg */
+#define SR_CMD_READ_PHY_ID              0x19
+/* command : Medium Status Read Reg */
+#define SR_CMD_READ_MEDIUM_STATUS       0x1a
+#define         SR_MONITOR_LINK                 (1 << 1)
+#define         SR_MONITOR_MAGIC                (1 << 2)
+#define         SR_MONITOR_HSFS                 (1 << 4)
+/* command : Medium Status Write Reg */
+#define SR_CMD_WRITE_MEDIUM_MODE        0x1b
+#define         SR_MEDIUM_GM                    (1 << 0)
+#define         SR_MEDIUM_FD                    (1 << 1)
+#define         SR_MEDIUM_AC                    (1 << 2)
+#define         SR_MEDIUM_ENCK                  (1 << 3)
+#define         SR_MEDIUM_RFC                   (1 << 4)
+#define         SR_MEDIUM_TFC                   (1 << 5)
+#define         SR_MEDIUM_JFE                   (1 << 6)
+#define         SR_MEDIUM_PF                    (1 << 7)
+#define         SR_MEDIUM_RE                    (1 << 8)
+#define         SR_MEDIUM_PS                    (1 << 9)
+#define         SR_MEDIUM_RSV                   (1 << 10)
+#define         SR_MEDIUM_SBP                   (1 << 11)
+#define         SR_MEDIUM_SM                    (1 << 12)
+/* command : Monitor Mode Status Read Reg */
+#define SR_CMD_READ_MONITOR_MODE        0x1c
+/* command : Monitor Mode Status Write Reg */
+#define SR_CMD_WRITE_MONITOR_MODE       0x1d
+/* command : GPIO Status Read Reg */
+#define SR_CMD_READ_GPIOS               0x1e
+#define         SR_GPIO_GPO0EN          (1 << 0) /* GPIO0 Output enable */
+#define         SR_GPIO_GPO_0           (1 << 1) /* GPIO0 Output value */
+#define         SR_GPIO_GPO1EN          (1 << 2) /* GPIO1 Output enable */
+#define         SR_GPIO_GPO_1           (1 << 3) /* GPIO1 Output value */
+#define         SR_GPIO_GPO2EN          (1 << 4) /* GPIO2 Output enable */
+#define         SR_GPIO_GPO_2           (1 << 5) /* GPIO2 Output value */
+#define         SR_GPIO_RESERVED        (1 << 6) /* Reserved */
+#define         SR_GPIO_RSE             (1 << 7) /* Reload serial EEPROM */
+/* command : GPIO Status Write Reg */
+#define SR_CMD_WRITE_GPIOS              0x1f
+/* command : Eth PHY Power and Reset Control Reg */
+#define SR_CMD_SW_RESET                 0x20
+#define         SR_SWRESET_CLEAR                0x00
+#define         SR_SWRESET_RR                   (1 << 0)
+#define         SR_SWRESET_RT                   (1 << 1)
+#define         SR_SWRESET_PRTE                 (1 << 2)
+#define         SR_SWRESET_PRL                  (1 << 3)
+#define         SR_SWRESET_BZ                   (1 << 4)
+#define         SR_SWRESET_IPRL                 (1 << 5)
+#define         SR_SWRESET_IPPD                 (1 << 6)
+/* command : Software Interface Selection Status Read Reg */
+#define SR_CMD_SW_PHY_STATUS            0x21
+/* command : Software Interface Selection Status Write Reg */
+#define SR_CMD_SW_PHY_SELECT            0x22
+/* command : BULK in Buffer Size Reg */
+#define SR_CMD_BULKIN_SIZE              0x2A
+/* command : LED_MUX Control Reg */
+#define SR_CMD_LED_MUX                  0x70
+#define         SR_LED_MUX_TX_ACTIVE            (1 << 0)
+#define         SR_LED_MUX_RX_ACTIVE            (1 << 1)
+#define         SR_LED_MUX_COLLISION            (1 << 2)
+#define         SR_LED_MUX_DUP_COL              (1 << 3)
+#define         SR_LED_MUX_DUP                  (1 << 4)
+#define         SR_LED_MUX_SPEED                (1 << 5)
+#define         SR_LED_MUX_LINK_ACTIVE          (1 << 6)
+#define         SR_LED_MUX_LINK                 (1 << 7)
+/* Register Access Flags */
+#define SR_REQ_RD_REG   (USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE)
+#define SR_REQ_WR_REG   (USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE)
+/* Multicast Filter Array size & Max Number */
+#define SR_MCAST_FILTER_SIZE            8
+#define SR_MAX_MCAST                    64
+/* IPG0/1/2 Default Value */
+#define SR9800_IPG0_DEFAULT             0x15
+#define SR9800_IPG1_DEFAULT             0x0c
+#define SR9800_IPG2_DEFAULT             0x12
+/* Medium Status Default Mode */
+#define SR9800_MEDIUM_DEFAULT   \
+        (SR_MEDIUM_FD | SR_MEDIUM_RFC | \
+         SR_MEDIUM_TFC | SR_MEDIUM_PS | \
+         SR_MEDIUM_AC | SR_MEDIUM_RE)
+/* RX Control Default Setting */
+#define SR_DEFAULT_RX_CTL       \
+        (SR_RX_CTL_SO | SR_RX_CTL_AB | SR_RX_CTL_RH1M)
+/* EEPROM Magic Number & EEPROM Size */
+#define SR_EEPROM_MAGIC                 0xdeadbeef
+#define SR9800_EEPROM_LEN               0xff
+/* SR9800 Driver Version and Driver Name */
+#define DRIVER_VERSION                  "11-Nov-2013"
+#define DRIVER_NAME                     "CoreChips"
+#define DRIVER_FLAG             \
+        (FLAG_ETHER | FLAG_FRAMING_AX | FLAG_LINK_INTR |  FLAG_MULTI_PACKET)
+/* SR9800 BULKIN Buffer Size */
+#define SR9800_MAX_BULKIN_2K            0
+#define SR9800_MAX_BULKIN_4K            1
+#define SR9800_MAX_BULKIN_6K            2
+#define SR9800_MAX_BULKIN_8K            3
+#define SR9800_MAX_BULKIN_16K           4
+#define SR9800_MAX_BULKIN_20K           5
+#define SR9800_MAX_BULKIN_24K           6
+#define SR9800_MAX_BULKIN_32K           7
+struct {unsigned short size, byte_cnt, threshold; } SR9800_BULKIN_SIZE[] = {
+        /* 2k */
+        {2048, 0x8000, 0x8001},
+        /* 4k */
+        {4096, 0x8100, 0x8147},
+        /* 6k */
+        {6144, 0x8200, 0x81EB},
+        /* 8k */
+        {8192, 0x8300, 0x83D7},
+        /* 16 */
+        {16384, 0x8400, 0x851E},
+        /* 20k */
+        {20480, 0x8500, 0x8666},
+        /* 24k */
+        {24576, 0x8600, 0x87AE},
+        /* 32k */
+        {32768, 0x8700, 0x8A3D},
+};
+/* This structure cannot exceed sizeof(unsigned long [5]) AKA 20 bytes */
+struct sr_data {
+        u8 multi_filter[SR_MCAST_FILTER_SIZE];
+        u8 mac_addr[ETH_ALEN];
+        u8 phymode;
+        u8 ledmode;
+        u8 eeprom_len;
+};
+struct sr9800_int_data {
+        __le16 res1;
+        u8 link;
+        __le16 res2;
+        u8 status;
+        __le16 res3;
+} __packed;
+#endif  /* _SR9800_H */
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index 4671da755e7b..dd10d5817d2a 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -542,17 +542,19 @@ static inline void rx_process (struct usbnet *dev, struct sk_buff *skb)
        }
        // else network stack removes extra byte if we forced a short packet
-        if (skb->len) {
+        /* all data was already cloned from skb inside the driver */
-                /* all data was already cloned from skb inside the driver */
+        if (dev->driver_info->flags & FLAG_MULTI_PACKET)
-                if (dev->driver_info->flags & FLAG_MULTI_PACKET)
+                goto done;
-                        dev_kfree_skb_any(skb);
-                else
+        if (skb->len < ETH_HLEN) {
-                        usbnet_skb_return(dev, skb);
+                dev->net->stats.rx_errors++;
+                dev->net->stats.rx_length_errors++;
+                netif_dbg(dev, rx_err, dev->net, "rx length %d\n", skb->len);
+        } else {
+                usbnet_skb_return(dev, skb);
                return;
        }
-        netif_dbg(dev, rx_err, dev->net, "drop\n");
-        dev->net->stats.rx_errors++;
 done:
        skb_queue_tail(&dev->done, skb);
 }
@@ -574,13 +576,6 @@ static void rx_complete (struct urb *urb)
        switch (urb_status) {
        /* success */
        case 0:
-                if (skb->len < dev->net->hard_header_len) {
-                        state = rx_cleanup;
-                        dev->net->stats.rx_errors++;
-                        dev->net->stats.rx_length_errors++;
-                        netif_dbg(dev, rx_err, dev->net,
-                                  "rx length %d\n", skb->len);
-                }
                break;
        /* stalls need manual reset. this is rare ... except that
diff --git a/drivers/net/veth.c b/drivers/net/veth.c
index 2ec2041b62d4..5b374370f71c 100644
--- a/drivers/net/veth.c
+++ b/drivers/net/veth.c
@@ -285,7 +285,8 @@ static void veth_setup(struct net_device *dev)
        dev->ethtool_ops = &veth_ethtool_ops;
        dev->features |= NETIF_F_LLTX;
        dev->features |= VETH_FEATURES;
-        dev->vlan_features = dev->features;
+        dev->vlan_features = dev->features &
+                             ~(NETIF_F_HW_VLAN_CTAG_TX | NETIF_F_HW_VLAN_STAG_TX);
        dev->destructor = veth_dev_free;
        dev->hw_features = VETH_FEATURES;
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index d75f8edf4fb3..5632a99cbbd2 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -1711,7 +1711,8 @@ static int virtnet_probe(struct virtio_device *vdev)
        /* If we can receive ANY GSO packets, we must allocate large ones. */
        if (virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_TSO4) ||
            virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_TSO6) ||
-            virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_ECN))
+            virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_ECN) ||
+            virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_UFO))
                vi->big_packets = true;
        if (virtio_has_feature(vdev, VIRTIO_NET_F_MRG_RXBUF))
diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
index 3be786faaaec..0fa3b44f7342 100644
--- a/drivers/net/vmxnet3/vmxnet3_drv.c
+++ b/drivers/net/vmxnet3/vmxnet3_drv.c
@@ -1762,11 +1762,20 @@ vmxnet3_netpoll(struct net_device *netdev)
 {
        struct vmxnet3_adapter *adapter = netdev_priv(netdev);
-        if (adapter->intr.mask_mode == VMXNET3_IMM_ACTIVE)
+        switch (adapter->intr.type) {
-                vmxnet3_disable_all_intrs(adapter);
+#ifdef CONFIG_PCI_MSI
+        case VMXNET3_IT_MSIX: {
-        vmxnet3_do_poll(adapter, adapter->rx_queue[0].rx_ring[0].size);
+                int i;
-        vmxnet3_enable_all_intrs(adapter);
+                for (i = 0; i < adapter->num_rx_queues; i++)
+                        vmxnet3_msix_rx(0, &adapter->rx_queue[i]);
+                break;
+        }
+#endif
+        case VMXNET3_IT_MSI:
+        default:
+                vmxnet3_intr(0, adapter->netdev);
+                break;
+        }
 }
 #endif  /* CONFIG_NET_POLL_CONTROLLER */
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index 026a313c2d2d..1236812c7be6 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -469,7 +469,6 @@ static inline struct hlist_head *vxlan_fdb_head(struct vxlan_dev *vxlan,
 /* Look up Ethernet address in forwarding table */
 static struct vxlan_fdb *__vxlan_find_mac(struct vxlan_dev *vxlan,
                                        const u8 *mac)
 {
        struct hlist_head *head = vxlan_fdb_head(vxlan, mac);
        struct vxlan_fdb *f;
@@ -596,10 +595,8 @@ static struct sk_buff **vxlan_gro_receive(struct sk_buff **head, struct sk_buff
                        NAPI_GRO_CB(p)->same_flow = 0;
                        continue;
                }
-                goto found;
        }
-found:
        type = eh->h_proto;
        rcu_read_lock();
@@ -1321,6 +1318,9 @@ static int arp_reduce(struct net_device *dev, struct sk_buff *skb)
                neigh_release(n);
+                if (reply == NULL)
+                        goto out;
                skb_reset_mac_header(reply);
                __skb_pull(reply, skb_network_offset(reply));
                reply->ip_summed = CHECKSUM_UNNECESSARY;
@@ -1342,15 +1342,103 @@ out:
 }
 #if IS_ENABLED(CONFIG_IPV6)
+static struct sk_buff *vxlan_na_create(struct sk_buff *request,
+        struct neighbour *n, bool isrouter)
+{
+        struct net_device *dev = request->dev;
+        struct sk_buff *reply;
+        struct nd_msg *ns, *na;
+        struct ipv6hdr *pip6;
+        u8 *daddr;
+        int na_olen = 8; /* opt hdr + ETH_ALEN for target */
+        int ns_olen;
+        int i, len;
+        if (dev == NULL)
+                return NULL;
+        len = LL_RESERVED_SPACE(dev) + sizeof(struct ipv6hdr) +
+                sizeof(*na) + na_olen + dev->needed_tailroom;
+        reply = alloc_skb(len, GFP_ATOMIC);
+        if (reply == NULL)
+                return NULL;
+        reply->protocol = htons(ETH_P_IPV6);
+        reply->dev = dev;
+        skb_reserve(reply, LL_RESERVED_SPACE(request->dev));
+        skb_push(reply, sizeof(struct ethhdr));
+        skb_set_mac_header(reply, 0);
+        ns = (struct nd_msg *)skb_transport_header(request);
+        daddr = eth_hdr(request)->h_source;
+        ns_olen = request->len - skb_transport_offset(request) - sizeof(*ns);
+        for (i = 0; i < ns_olen-1; i += (ns->opt[i+1]<<3)) {
+                if (ns->opt[i] == ND_OPT_SOURCE_LL_ADDR) {
+                        daddr = ns->opt + i + sizeof(struct nd_opt_hdr);
+                        break;
+                }
+        }
+        /* Ethernet header */
+        ether_addr_copy(eth_hdr(reply)->h_dest, daddr);
+        ether_addr_copy(eth_hdr(reply)->h_source, n->ha);
+        eth_hdr(reply)->h_proto = htons(ETH_P_IPV6);
+        reply->protocol = htons(ETH_P_IPV6);
+        skb_pull(reply, sizeof(struct ethhdr));
+        skb_set_network_header(reply, 0);
+        skb_put(reply, sizeof(struct ipv6hdr));
+        /* IPv6 header */
+        pip6 = ipv6_hdr(reply);
+        memset(pip6, 0, sizeof(struct ipv6hdr));
+        pip6->version = 6;
+        pip6->priority = ipv6_hdr(request)->priority;
+        pip6->nexthdr = IPPROTO_ICMPV6;
+        pip6->hop_limit = 255;
+        pip6->daddr = ipv6_hdr(request)->saddr;
+        pip6->saddr = *(struct in6_addr *)n->primary_key;
+        skb_pull(reply, sizeof(struct ipv6hdr));
+        skb_set_transport_header(reply, 0);
+        na = (struct nd_msg *)skb_put(reply, sizeof(*na) + na_olen);
+        /* Neighbor Advertisement */
+        memset(na, 0, sizeof(*na)+na_olen);
+        na->icmph.icmp6_type = NDISC_NEIGHBOUR_ADVERTISEMENT;
+        na->icmph.icmp6_router = isrouter;
+        na->icmph.icmp6_override = 1;
+        na->icmph.icmp6_solicited = 1;
+        na->target = ns->target;
+        ether_addr_copy(&na->opt[2], n->ha);
+        na->opt[0] = ND_OPT_TARGET_LL_ADDR;
+        na->opt[1] = na_olen >> 3;
+        na->icmph.icmp6_cksum = csum_ipv6_magic(&pip6->saddr,
+                &pip6->daddr, sizeof(*na)+na_olen, IPPROTO_ICMPV6,
+                csum_partial(na, sizeof(*na)+na_olen, 0));
+        pip6->payload_len = htons(sizeof(*na)+na_olen);
+        skb_push(reply, sizeof(struct ipv6hdr));
+        reply->ip_summed = CHECKSUM_UNNECESSARY;
+        return reply;
+}
 static int neigh_reduce(struct net_device *dev, struct sk_buff *skb)
 {
        struct vxlan_dev *vxlan = netdev_priv(dev);
-        struct neighbour *n;
+        struct nd_msg *msg;
-        union vxlan_addr ipa;
        const struct ipv6hdr *iphdr;
        const struct in6_addr *saddr, *daddr;
-        struct nd_msg *msg;
+        struct neighbour *n;
-        struct inet6_dev *in6_dev = NULL;
+        struct inet6_dev *in6_dev;
        in6_dev = __in6_dev_get(dev);
        if (!in6_dev)
@@ -1363,19 +1451,20 @@ static int neigh_reduce(struct net_device *dev, struct sk_buff *skb)
        saddr = &iphdr->saddr;
        daddr = &iphdr->daddr;
-        if (ipv6_addr_loopback(daddr) ||
-            ipv6_addr_is_multicast(daddr))
-                goto out;
        msg = (struct nd_msg *)skb_transport_header(skb);
        if (msg->icmph.icmp6_code != 0 ||
            msg->icmph.icmp6_type != NDISC_NEIGHBOUR_SOLICITATION)
                goto out;
-        n = neigh_lookup(ipv6_stub->nd_tbl, daddr, dev);
+        if (ipv6_addr_loopback(daddr) ||
+            ipv6_addr_is_multicast(&msg->target))
+                goto out;
+        n = neigh_lookup(ipv6_stub->nd_tbl, &msg->target, dev);
        if (n) {
                struct vxlan_fdb *f;
+                struct sk_buff *reply;
                if (!(n->nud_state & NUD_CONNECTED)) {
                        neigh_release(n);
@@ -1389,13 +1478,23 @@ static int neigh_reduce(struct net_device *dev, struct sk_buff *skb)
                        goto out;
                }
-                ipv6_stub->ndisc_send_na(dev, n, saddr, &msg->target,
+                reply = vxlan_na_create(skb, n,
-                                         !!in6_dev->cnf.forwarding,
+                                        !!(f ? f->flags & NTF_ROUTER : 0));
-                                         true, false, false);
                neigh_release(n);
+                if (reply == NULL)
+                        goto out;
+                if (netif_rx_ni(reply) == NET_RX_DROP)
+                        dev->stats.rx_dropped++;
        } else if (vxlan->flags & VXLAN_F_L3MISS) {
-                ipa.sin6.sin6_addr = *daddr;
+                union vxlan_addr ipa = {
-                ipa.sa.sa_family = AF_INET6;
+                        .sin6.sin6_addr = msg->target,
+                        .sa.sa_family = AF_INET6,
+                };
                vxlan_ip_miss(dev, &ipa);
        }
diff --git a/drivers/net/wan/dlci.c b/drivers/net/wan/dlci.c
index 0d1c7592efa0..19f7cb2cdef3 100644
--- a/drivers/net/wan/dlci.c
+++ b/drivers/net/wan/dlci.c
@@ -71,12 +71,9 @@ static int dlci_header(struct sk_buff *skb, struct net_device *dev,
                       const void *saddr, unsigned len)
 {
        struct frhdr            hdr;
-        struct dlci_local       *dlp;
        unsigned int            hlen;
        char                    *dest;
-        dlp = netdev_priv(dev);
        hdr.control = FRAD_I_UI;
        switch (type)
        {
@@ -107,11 +104,9 @@ static int dlci_header(struct sk_buff *skb, struct net_device *dev,
 static void dlci_receive(struct sk_buff *skb, struct net_device *dev)
 {
-        struct dlci_local *dlp;
        struct frhdr            *hdr;
        int                                     process, header;
-        dlp = netdev_priv(dev);
        if (!pskb_may_pull(skb, sizeof(*hdr))) {
                netdev_notice(dev, "invalid data no header\n");
                dev->stats.rx_errors++;
diff --git a/drivers/net/wireless/ath/ar5523/ar5523.c b/drivers/net/wireless/ath/ar5523/ar5523.c
index 8aa20df55e50..507d9a9ee69a 100644
--- a/drivers/net/wireless/ath/ar5523/ar5523.c
+++ b/drivers/net/wireless/ath/ar5523/ar5523.c
@@ -1764,7 +1764,7 @@ static struct usb_device_id ar5523_id_table[] = {
        AR5523_DEVICE_UG(0x07d1, 0x3a07),       /* D-Link / WUA-2340 rev A1 */
        AR5523_DEVICE_UG(0x1690, 0x0712),       /* Gigaset / AR5523 */
        AR5523_DEVICE_UG(0x1690, 0x0710),       /* Gigaset / SMCWUSBTG */
-        AR5523_DEVICE_UG(0x129b, 0x160c),       /* Gigaset / USB stick 108
+        AR5523_DEVICE_UG(0x129b, 0x160b),       /* Gigaset / USB stick 108
                                                   (CyberTAN Technology) */
        AR5523_DEVICE_UG(0x16ab, 0x7801),       /* Globalsun / AR5523_1 */
        AR5523_DEVICE_UX(0x16ab, 0x7811),       /* Globalsun / AR5523_2 */
diff --git a/drivers/net/wireless/ath/ath5k/phy.c b/drivers/net/wireless/ath/ath5k/phy.c
index d6bc7cb61bfb..1a2973b7acf2 100644
--- a/drivers/net/wireless/ath/ath5k/phy.c
+++ b/drivers/net/wireless/ath/ath5k/phy.c
@@ -110,7 +110,7 @@ ath5k_hw_radio_revision(struct ath5k_hw *ah, enum ieee80211_band band)
                ath5k_hw_reg_write(ah, 0x00010000, AR5K_PHY(0x20));
        if (ah->ah_version == AR5K_AR5210) {
-                srev = ath5k_hw_reg_read(ah, AR5K_PHY(256) >> 28) & 0xf;
+                srev = (ath5k_hw_reg_read(ah, AR5K_PHY(256)) >> 28) & 0xf;
                ret = (u16)ath5k_hw_bitswap(srev, 4) + 1;
        } else {
                srev = (ath5k_hw_reg_read(ah, AR5K_PHY(0x100)) >> 24) & 0xff;
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
index 25243cbc07f0..b8daff78b9d1 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
@@ -5065,6 +5065,10 @@ static u16 ar9003_hw_get_max_edge_power(struct ar9300_eeprom *eep,
                        break;
                }
        }
+        if (is2GHz && !twiceMaxEdgePower)
+                twiceMaxEdgePower = 60;
        return twiceMaxEdgePower;
 }
diff --git a/drivers/net/wireless/ath/ath9k/ar9462_2p0_initvals.h b/drivers/net/wireless/ath/ath9k/ar9462_2p0_initvals.h
index 1cc13569b17b..1b6b4d0cfa97 100644
--- a/drivers/net/wireless/ath/ath9k/ar9462_2p0_initvals.h
+++ b/drivers/net/wireless/ath/ath9k/ar9462_2p0_initvals.h
@@ -57,7 +57,7 @@ static const u32 ar9462_2p0_baseband_postamble[][5] = {
        {0x00009e14, 0x37b95d5e, 0x37b9605e, 0x3236605e, 0x32365a5e},
        {0x00009e18, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
        {0x00009e1c, 0x0001cf9c, 0x0001cf9c, 0x00021f9c, 0x00021f9c},
-        {0x00009e20, 0x000003b5, 0x000003b5, 0x000003ce, 0x000003ce},
+        {0x00009e20, 0x000003a5, 0x000003a5, 0x000003a5, 0x000003a5},
        {0x00009e2c, 0x0000001c, 0x0000001c, 0x00000021, 0x00000021},
        {0x00009e3c, 0xcf946220, 0xcf946220, 0xcfd5c782, 0xcfd5c282},
        {0x00009e44, 0x62321e27, 0x62321e27, 0xfe291e27, 0xfe291e27},
@@ -96,7 +96,7 @@ static const u32 ar9462_2p0_baseband_postamble[][5] = {
        {0x0000ae04, 0x001c0000, 0x001c0000, 0x001c0000, 0x00100000},
        {0x0000ae18, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
        {0x0000ae1c, 0x0000019c, 0x0000019c, 0x0000019c, 0x0000019c},
-        {0x0000ae20, 0x000001b5, 0x000001b5, 0x000001ce, 0x000001ce},
+        {0x0000ae20, 0x000001a6, 0x000001a6, 0x000001aa, 0x000001aa},
        {0x0000b284, 0x00000000, 0x00000000, 0x00000550, 0x00000550},
 };
diff --git a/drivers/net/wireless/ath/ath9k/htc.h b/drivers/net/wireless/ath/ath9k/htc.h
index 58da3468d1f0..99a203174f45 100644
--- a/drivers/net/wireless/ath/ath9k/htc.h
+++ b/drivers/net/wireless/ath/ath9k/htc.h
@@ -262,6 +262,8 @@ enum tid_aggr_state {
 struct ath9k_htc_sta {
        u8 index;
        enum tid_aggr_state tid_state[ATH9K_HTC_MAX_TID];
+        struct work_struct rc_update_work;
+        struct ath9k_htc_priv *htc_priv;
 };
 #define ATH9K_HTC_RXBUF 256
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
index f4e1de20d99c..c57d6b859c04 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
@@ -34,6 +34,10 @@ static int ath9k_htc_btcoex_enable;
 module_param_named(btcoex_enable, ath9k_htc_btcoex_enable, int, 0444);
 MODULE_PARM_DESC(btcoex_enable, "Enable wifi-BT coexistence");
+static int ath9k_ps_enable;
+module_param_named(ps_enable, ath9k_ps_enable, int, 0444);
+MODULE_PARM_DESC(ps_enable, "Enable WLAN PowerSave");
 #define CHAN2G(_freq, _idx)  { \
        .center_freq = (_freq), \
        .hw_value = (_idx), \
@@ -725,12 +729,14 @@ static void ath9k_set_hw_capab(struct ath9k_htc_priv *priv,
                IEEE80211_HW_SPECTRUM_MGMT |
                IEEE80211_HW_HAS_RATE_CONTROL |
                IEEE80211_HW_RX_INCLUDES_FCS |
-                IEEE80211_HW_SUPPORTS_PS |
                IEEE80211_HW_PS_NULLFUNC_STACK |
                IEEE80211_HW_REPORTS_TX_ACK_STATUS |
                IEEE80211_HW_MFP_CAPABLE |
                IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING;
+        if (ath9k_ps_enable)
+                hw->flags |= IEEE80211_HW_SUPPORTS_PS;
        hw->wiphy->interface_modes =
                BIT(NL80211_IFTYPE_STATION) |
                BIT(NL80211_IFTYPE_ADHOC) |
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_main.c b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
index 608d739d1378..c9254a61ca52 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_main.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
@@ -1270,18 +1270,50 @@ static void ath9k_htc_configure_filter(struct ieee80211_hw *hw,
        mutex_unlock(&priv->mutex);
 }
+static void ath9k_htc_sta_rc_update_work(struct work_struct *work)
+{
+        struct ath9k_htc_sta *ista =
+            container_of(work, struct ath9k_htc_sta, rc_update_work);
+        struct ieee80211_sta *sta =
+            container_of((void *)ista, struct ieee80211_sta, drv_priv);
+        struct ath9k_htc_priv *priv = ista->htc_priv;
+        struct ath_common *common = ath9k_hw_common(priv->ah);
+        struct ath9k_htc_target_rate trate;
+        mutex_lock(&priv->mutex);
+        ath9k_htc_ps_wakeup(priv);
+        memset(&trate, 0, sizeof(struct ath9k_htc_target_rate));
+        ath9k_htc_setup_rate(priv, sta, &trate);
+        if (!ath9k_htc_send_rate_cmd(priv, &trate))
+                ath_dbg(common, CONFIG,
+                        "Supported rates for sta: %pM updated, rate caps: 0x%X\n",
+                        sta->addr, be32_to_cpu(trate.capflags));
+        else
+                ath_dbg(common, CONFIG,
+                        "Unable to update supported rates for sta: %pM\n",
+                        sta->addr);
+        ath9k_htc_ps_restore(priv);
+        mutex_unlock(&priv->mutex);
+}
 static int ath9k_htc_sta_add(struct ieee80211_hw *hw,
                             struct ieee80211_vif *vif,
                             struct ieee80211_sta *sta)
 {
        struct ath9k_htc_priv *priv = hw->priv;
+        struct ath9k_htc_sta *ista = (struct ath9k_htc_sta *) sta->drv_priv;
        int ret;
        mutex_lock(&priv->mutex);
        ath9k_htc_ps_wakeup(priv);
        ret = ath9k_htc_add_station(priv, vif, sta);
-        if (!ret)
+        if (!ret) {
+                INIT_WORK(&ista->rc_update_work, ath9k_htc_sta_rc_update_work);
+                ista->htc_priv = priv;
                ath9k_htc_init_rate(priv, sta);
+        }
        ath9k_htc_ps_restore(priv);
        mutex_unlock(&priv->mutex);
@@ -1293,12 +1325,13 @@ static int ath9k_htc_sta_remove(struct ieee80211_hw *hw,
                                struct ieee80211_sta *sta)
 {
        struct ath9k_htc_priv *priv = hw->priv;
-        struct ath9k_htc_sta *ista;
+        struct ath9k_htc_sta *ista = (struct ath9k_htc_sta *) sta->drv_priv;
        int ret;
+        cancel_work_sync(&ista->rc_update_work);
        mutex_lock(&priv->mutex);
        ath9k_htc_ps_wakeup(priv);
-        ista = (struct ath9k_htc_sta *) sta->drv_priv;
        htc_sta_drain(priv->htc, ista->index);
        ret = ath9k_htc_remove_station(priv, vif, sta);
        ath9k_htc_ps_restore(priv);
@@ -1311,28 +1344,12 @@ static void ath9k_htc_sta_rc_update(struct ieee80211_hw *hw,
                                    struct ieee80211_vif *vif,
                                    struct ieee80211_sta *sta, u32 changed)
 {
-        struct ath9k_htc_priv *priv = hw->priv;
+        struct ath9k_htc_sta *ista = (struct ath9k_htc_sta *) sta->drv_priv;
-        struct ath_common *common = ath9k_hw_common(priv->ah);
-        struct ath9k_htc_target_rate trate;
-        mutex_lock(&priv->mutex);
-        ath9k_htc_ps_wakeup(priv);
-        if (changed & IEEE80211_RC_SUPP_RATES_CHANGED) {
+        if (!(changed & IEEE80211_RC_SUPP_RATES_CHANGED))
-                memset(&trate, 0, sizeof(struct ath9k_htc_target_rate));
+                return;
-                ath9k_htc_setup_rate(priv, sta, &trate);
-                if (!ath9k_htc_send_rate_cmd(priv, &trate))
-                        ath_dbg(common, CONFIG,
-                                "Supported rates for sta: %pM updated, rate caps: 0x%X\n",
-                                sta->addr, be32_to_cpu(trate.capflags));
-                else
-                        ath_dbg(common, CONFIG,
-                                "Unable to update supported rates for sta: %pM\n",
-                                sta->addr);
-        }
-        ath9k_htc_ps_restore(priv);
+        schedule_work(&ista->rc_update_work);
-        mutex_unlock(&priv->mutex);
 }
 static int ath9k_htc_conf_tx(struct ieee80211_hw *hw,
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index fbf43c05713f..9078a6c5a74e 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -1316,7 +1316,7 @@ static bool ath9k_hw_set_reset(struct ath_hw *ah, int type)
        if (AR_SREV_9300_20_OR_LATER(ah))
                udelay(50);
        else if (AR_SREV_9100(ah))
-                udelay(10000);
+                mdelay(10);
        else
                udelay(100);
@@ -1534,7 +1534,7 @@ EXPORT_SYMBOL(ath9k_hw_check_nav);
 bool ath9k_hw_check_alive(struct ath_hw *ah)
 {
        int count = 50;
-        u32 reg;
+        u32 reg, last_val;
        if (AR_SREV_9300(ah))
                return !ath9k_hw_detect_mac_hang(ah);
@@ -1542,9 +1542,14 @@ bool ath9k_hw_check_alive(struct ath_hw *ah)
        if (AR_SREV_9285_12_OR_LATER(ah))
                return true;
+        last_val = REG_READ(ah, AR_OBS_BUS_1);
        do {
                reg = REG_READ(ah, AR_OBS_BUS_1);
+                if (reg != last_val)
+                        return true;
+                udelay(1);
+                last_val = reg;
                if ((reg & 0x7E7FFFEF) == 0x00702400)
                        continue;
@@ -2051,9 +2056,8 @@ static bool ath9k_hw_set_power_awake(struct ath_hw *ah)
        REG_SET_BIT(ah, AR_RTC_FORCE_WAKE,
                    AR_RTC_FORCE_WAKE_EN);
        if (AR_SREV_9100(ah))
-                udelay(10000);
+                mdelay(10);
        else
                udelay(50);
diff --git a/drivers/net/wireless/ath/ath9k/init.c b/drivers/net/wireless/ath/ath9k/init.c
index c36de303c8f3..1fc2e5a26b52 100644
--- a/drivers/net/wireless/ath/ath9k/init.c
+++ b/drivers/net/wireless/ath/ath9k/init.c
@@ -57,6 +57,10 @@ static int ath9k_bt_ant_diversity;
 module_param_named(bt_ant_diversity, ath9k_bt_ant_diversity, int, 0444);
 MODULE_PARM_DESC(bt_ant_diversity, "Enable WLAN/BT RX antenna diversity");
+static int ath9k_ps_enable;
+module_param_named(ps_enable, ath9k_ps_enable, int, 0444);
+MODULE_PARM_DESC(ps_enable, "Enable WLAN PowerSave");
 bool is_ath9k_unloaded;
 /* We use the hw_value as an index into our private channel structure */
@@ -903,13 +907,15 @@ static void ath9k_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw)
        hw->flags = IEEE80211_HW_RX_INCLUDES_FCS |
                IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING |
                IEEE80211_HW_SIGNAL_DBM |
-                IEEE80211_HW_SUPPORTS_PS |
                IEEE80211_HW_PS_NULLFUNC_STACK |
                IEEE80211_HW_SPECTRUM_MGMT |
                IEEE80211_HW_REPORTS_TX_ACK_STATUS |
                IEEE80211_HW_SUPPORTS_RC_TABLE |
                IEEE80211_HW_SUPPORTS_HT_CCK_RATES;
+        if (ath9k_ps_enable)
+                hw->flags |= IEEE80211_HW_SUPPORTS_PS;
        if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_HT) {
                hw->flags |= IEEE80211_HW_AMPDU_AGGREGATION;
diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c
index a0ebdd000fc2..82e340d3ec60 100644
--- a/drivers/net/wireless/ath/ath9k/recv.c
+++ b/drivers/net/wireless/ath/ath9k/recv.c
@@ -732,11 +732,18 @@ static struct ath_rxbuf *ath_get_next_rx_buf(struct ath_softc *sc,
                        return NULL;
                /*
-                 * mark descriptor as zero-length and set the 'more'
+                 * Re-check previous descriptor, in case it has been filled
-                 * flag to ensure that both buffers get discarded
+                 * in the mean time.
                 */
-                rs->rs_datalen = 0;
+                ret = ath9k_hw_rxprocdesc(ah, ds, rs);
-                rs->rs_more = true;
+                if (ret == -EINPROGRESS) {
+                        /*
+                         * mark descriptor as zero-length and set the 'more'
+                         * flag to ensure that both buffers get discarded
+                         */
+                        rs->rs_datalen = 0;
+                        rs->rs_more = true;
+                }
        }
        list_del(&bf->list);
@@ -985,32 +992,32 @@ static int ath9k_rx_skb_preprocess(struct ath_softc *sc,
        struct ath_common *common = ath9k_hw_common(ah);
        struct ieee80211_hdr *hdr;
        bool discard_current = sc->rx.discard_next;
-        int ret = 0;
        /*
         * Discard corrupt descriptors which are marked in
         * ath_get_next_rx_buf().
         */
-        sc->rx.discard_next = rx_stats->rs_more;
        if (discard_current)
-                return -EINVAL;
+                goto corrupt;
+        sc->rx.discard_next = false;
        /*
         * Discard zero-length packets.
         */
        if (!rx_stats->rs_datalen) {
                RX_STAT_INC(rx_len_err);
-                return -EINVAL;
+                goto corrupt;
        }
-        /*
+        /*
-         * rs_status follows rs_datalen so if rs_datalen is too large
+         * rs_status follows rs_datalen so if rs_datalen is too large
-         * we can take a hint that hardware corrupted it, so ignore
+         * we can take a hint that hardware corrupted it, so ignore
-         * those frames.
+         * those frames.
-         */
+         */
        if (rx_stats->rs_datalen > (common->rx_bufsize - ah->caps.rx_status_len)) {
                RX_STAT_INC(rx_len_err);
-                return -EINVAL;
+                goto corrupt;
        }
        /* Only use status info from the last fragment */
@@ -1024,10 +1031,8 @@ static int ath9k_rx_skb_preprocess(struct ath_softc *sc,
         * This is different from the other corrupt descriptor
         * condition handled above.
         */
-        if (rx_stats->rs_status & ATH9K_RXERR_CORRUPT_DESC) {
+        if (rx_stats->rs_status & ATH9K_RXERR_CORRUPT_DESC)
-                ret = -EINVAL;
+                goto corrupt;
-                goto exit;
-        }
        hdr = (struct ieee80211_hdr *) (skb->data + ah->caps.rx_status_len);
@@ -1043,18 +1048,15 @@ static int ath9k_rx_skb_preprocess(struct ath_softc *sc,
                if (ath_process_fft(sc, hdr, rx_stats, rx_status->mactime))
                        RX_STAT_INC(rx_spectral);
-                ret = -EINVAL;
+                return -EINVAL;
-                goto exit;
        }
        /*
         * everything but the rate is checked here, the rate check is done
         * separately to avoid doing two lookups for a rate for each frame.
         */
-        if (!ath9k_rx_accept(common, hdr, rx_status, rx_stats, decrypt_error)) {
+        if (!ath9k_rx_accept(common, hdr, rx_status, rx_stats, decrypt_error))
-                ret = -EINVAL;
+                return -EINVAL;
-                goto exit;
-        }
        if (ath_is_mybeacon(common, hdr)) {
                RX_STAT_INC(rx_beacons);
@@ -1064,15 +1066,11 @@ static int ath9k_rx_skb_preprocess(struct ath_softc *sc,
        /*
         * This shouldn't happen, but have a safety check anyway.
         */
-        if (WARN_ON(!ah->curchan)) {
+        if (WARN_ON(!ah->curchan))
-                ret = -EINVAL;
+                return -EINVAL;
-                goto exit;
-        }
-        if (ath9k_process_rate(common, hw, rx_stats, rx_status)) {
+        if (ath9k_process_rate(common, hw, rx_stats, rx_status))
-                ret =-EINVAL;
+                return -EINVAL;
-                goto exit;
-        }
        ath9k_process_rssi(common, hw, rx_stats, rx_status);
@@ -1087,9 +1085,11 @@ static int ath9k_rx_skb_preprocess(struct ath_softc *sc,
                sc->rx.num_pkts++;
 #endif
-exit:
+        return 0;
-        sc->rx.discard_next = false;
-        return ret;
+corrupt:
+        sc->rx.discard_next = rx_stats->rs_more;
+        return -EINVAL;
 }
 static void ath9k_rx_skb_postprocess(struct ath_common *common,
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index 0a75e2f68c9d..55897d508a76 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -1444,14 +1444,16 @@ void ath_tx_aggr_sleep(struct ieee80211_sta *sta, struct ath_softc *sc,
        for (tidno = 0, tid = &an->tid[tidno];
             tidno < IEEE80211_NUM_TIDS; tidno++, tid++) {
-                if (!tid->sched)
-                        continue;
                ac = tid->ac;
                txq = ac->txq;
                ath_txq_lock(sc, txq);
+                if (!tid->sched) {
+                        ath_txq_unlock(sc, txq);
+                        continue;
+                }
                buffered = ath_tid_has_buffered(tid);
                tid->sched = false;
@@ -2061,7 +2063,7 @@ static struct ath_buf *ath_tx_setup_buffer(struct ath_softc *sc,
        ATH_TXBUF_RESET(bf);
-        if (tid) {
+        if (tid && ieee80211_is_data_present(hdr->frame_control)) {
                fragno = le16_to_cpu(hdr->seq_ctrl) & IEEE80211_SCTL_FRAG;
                seqno = tid->seq_next;
                hdr->seq_ctrl = cpu_to_le16(tid->seq_next << IEEE80211_SEQ_SEQ_SHIFT);
@@ -2184,14 +2186,15 @@ int ath_tx_start(struct ieee80211_hw *hw, struct sk_buff *skb,
                txq->stopped = true;
        }
+        if (txctl->an && ieee80211_is_data_present(hdr->frame_control))
+                tid = ath_get_skb_tid(sc, txctl->an, skb);
        if (info->flags & IEEE80211_TX_CTL_PS_RESPONSE) {
                ath_txq_unlock(sc, txq);
                txq = sc->tx.uapsdq;
                ath_txq_lock(sc, txq);
        } else if (txctl->an &&
                   ieee80211_is_data_present(hdr->frame_control)) {
-                tid = ath_get_skb_tid(sc, txctl->an, skb);
                WARN_ON(tid->ac->txq != txctl->txq);
                if (info->flags & IEEE80211_TX_CTL_CLEAR_PS_FILT)
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
index 3e991897d7ca..ddaa9efd053d 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
@@ -457,7 +457,6 @@ struct brcmf_sdio {
        u8 tx_hdrlen;           /* sdio bus header length for tx packet */
        bool txglom;            /* host tx glomming enable flag */
-        struct sk_buff *txglom_sgpad;   /* scatter-gather padding buffer */
        u16 head_align;         /* buffer pointer alignment */
        u16 sgentry_align;      /* scatter-gather buffer alignment */
 };
@@ -1944,19 +1943,21 @@ static int brcmf_sdio_txpkt_prep_sg(struct brcmf_sdio *bus,
        if (lastfrm && chain_pad)
                tail_pad += blksize - chain_pad;
        if (skb_tailroom(pkt) < tail_pad && pkt->len > blksize) {
-                pkt_pad = bus->txglom_sgpad;
+                pkt_pad = brcmu_pkt_buf_get_skb(tail_pad + tail_chop +
-                if (pkt_pad == NULL)
+                                                bus->head_align);
-                          brcmu_pkt_buf_get_skb(tail_pad + tail_chop);
                if (pkt_pad == NULL)
                        return -ENOMEM;
                ret = brcmf_sdio_txpkt_hdalign(bus, pkt_pad);
-                if (unlikely(ret < 0))
+                if (unlikely(ret < 0)) {
+                        kfree_skb(pkt_pad);
                        return ret;
+                }
                memcpy(pkt_pad->data,
                       pkt->data + pkt->len - tail_chop,
                       tail_chop);
                *(u32 *)(pkt_pad->cb) = ALIGN_SKB_FLAG + tail_chop;
                skb_trim(pkt, pkt->len - tail_chop);
+                skb_trim(pkt_pad, tail_pad + tail_chop);
                __skb_queue_after(pktq, pkt, pkt_pad);
        } else {
                ntail = pkt->data_len + tail_pad -
@@ -2011,7 +2012,7 @@ brcmf_sdio_txpkt_prep(struct brcmf_sdio *bus, struct sk_buff_head *pktq,
                        return ret;
                head_pad = (u16)ret;
                if (head_pad)
-                        memset(pkt_next->data, 0, head_pad + bus->tx_hdrlen);
+                        memset(pkt_next->data + bus->tx_hdrlen, 0, head_pad);
                total_len += pkt_next->len;
@@ -3486,10 +3487,6 @@ static int brcmf_sdio_bus_preinit(struct device *dev)
                bus->txglom = false;
                value = 1;
                pad_size = bus->sdiodev->func[2]->cur_blksize << 1;
-                bus->txglom_sgpad = brcmu_pkt_buf_get_skb(pad_size);
-                if (!bus->txglom_sgpad)
-                        brcmf_err("allocating txglom padding skb failed, reduced performance\n");
                err = brcmf_iovar_data_set(bus->sdiodev->dev, "bus:rxglom",
                                           &value, sizeof(u32));
                if (err < 0) {
@@ -4053,7 +4050,6 @@ void brcmf_sdio_remove(struct brcmf_sdio *bus)
                        brcmf_sdio_chip_detach(&bus->ci);
                }
-                brcmu_pkt_buf_free_skb(bus->txglom_sgpad);
                kfree(bus->rxbuf);
                kfree(bus->hdrbuf);
                kfree(bus);
diff --git a/drivers/net/wireless/hostap/hostap_ap.c b/drivers/net/wireless/hostap/hostap_ap.c
index d36e252d2ccb..596525528f50 100644
--- a/drivers/net/wireless/hostap/hostap_ap.c
+++ b/drivers/net/wireless/hostap/hostap_ap.c
@@ -147,7 +147,7 @@ static void ap_free_sta(struct ap_data *ap, struct sta_info *sta)
        if (!sta->ap && sta->u.sta.challenge)
                kfree(sta->u.sta.challenge);
-        del_timer(&sta->timer);
+        del_timer_sync(&sta->timer);
 #endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
        kfree(sta);
diff --git a/drivers/net/wireless/hostap/hostap_proc.c b/drivers/net/wireless/hostap/hostap_proc.c
index aa7ad3a7a69b..4e5c0f8c9496 100644
--- a/drivers/net/wireless/hostap/hostap_proc.c
+++ b/drivers/net/wireless/hostap/hostap_proc.c
@@ -496,7 +496,7 @@ void hostap_init_proc(local_info_t *local)
 void hostap_remove_proc(local_info_t *local)
 {
-        remove_proc_subtree(local->ddev->name, hostap_proc);
+        proc_remove(local->proc);
 }
diff --git a/drivers/net/wireless/iwlwifi/dvm/mac80211.c b/drivers/net/wireless/iwlwifi/dvm/mac80211.c
index c24d1d3d55f6..73086c1629ca 100644
--- a/drivers/net/wireless/iwlwifi/dvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/dvm/mac80211.c
@@ -696,6 +696,24 @@ static int iwlagn_mac_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
        return ret;
 }
+static inline bool iwl_enable_rx_ampdu(const struct iwl_cfg *cfg)
+{
+        if (iwlwifi_mod_params.disable_11n & IWL_DISABLE_HT_RXAGG)
+                return false;
+        return true;
+}
+static inline bool iwl_enable_tx_ampdu(const struct iwl_cfg *cfg)
+{
+        if (iwlwifi_mod_params.disable_11n & IWL_DISABLE_HT_TXAGG)
+                return false;
+        if (iwlwifi_mod_params.disable_11n & IWL_ENABLE_HT_TXAGG)
+                return true;
+        /* disabled by default */
+        return false;
+}
 static int iwlagn_mac_ampdu_action(struct ieee80211_hw *hw,
                                   struct ieee80211_vif *vif,
                                   enum ieee80211_ampdu_mlme_action action,
@@ -717,7 +735,7 @@ static int iwlagn_mac_ampdu_action(struct ieee80211_hw *hw,
        switch (action) {
        case IEEE80211_AMPDU_RX_START:
-                if (iwlwifi_mod_params.disable_11n & IWL_DISABLE_HT_RXAGG)
+                if (!iwl_enable_rx_ampdu(priv->cfg))
                        break;
                IWL_DEBUG_HT(priv, "start Rx\n");
                ret = iwl_sta_rx_agg_start(priv, sta, tid, *ssn);
@@ -729,7 +747,7 @@ static int iwlagn_mac_ampdu_action(struct ieee80211_hw *hw,
        case IEEE80211_AMPDU_TX_START:
                if (!priv->trans->ops->txq_enable)
                        break;
-                if (iwlwifi_mod_params.disable_11n & IWL_DISABLE_HT_TXAGG)
+                if (!iwl_enable_tx_ampdu(priv->cfg))
                        break;
                IWL_DEBUG_HT(priv, "start Tx\n");
                ret = iwlagn_tx_agg_start(priv, vif, sta, tid, ssn);
diff --git a/drivers/net/wireless/iwlwifi/dvm/sta.c b/drivers/net/wireless/iwlwifi/dvm/sta.c
index c0d070c5df5e..9cdd91cdf661 100644
--- a/drivers/net/wireless/iwlwifi/dvm/sta.c
+++ b/drivers/net/wireless/iwlwifi/dvm/sta.c
@@ -590,6 +590,7 @@ void iwl_deactivate_station(struct iwl_priv *priv, const u8 sta_id,
                        sizeof(priv->tid_data[sta_id][tid]));
        priv->stations[sta_id].used &= ~IWL_STA_DRIVER_ACTIVE;
+        priv->stations[sta_id].used &= ~IWL_STA_UCODE_INPROGRESS;
        priv->num_stations--;
diff --git a/drivers/net/wireless/iwlwifi/dvm/tx.c b/drivers/net/wireless/iwlwifi/dvm/tx.c
index a6839dfcb82d..398dd096674c 100644
--- a/drivers/net/wireless/iwlwifi/dvm/tx.c
+++ b/drivers/net/wireless/iwlwifi/dvm/tx.c
@@ -1291,8 +1291,6 @@ int iwlagn_rx_reply_compressed_ba(struct iwl_priv *priv,
        struct iwl_compressed_ba_resp *ba_resp = (void *)pkt->data;
        struct iwl_ht_agg *agg;
        struct sk_buff_head reclaimed_skbs;
-        struct ieee80211_tx_info *info;
-        struct ieee80211_hdr *hdr;
        struct sk_buff *skb;
        int sta_id;
        int tid;
@@ -1379,22 +1377,28 @@ int iwlagn_rx_reply_compressed_ba(struct iwl_priv *priv,
        freed = 0;
        skb_queue_walk(&reclaimed_skbs, skb) {
-                hdr = (struct ieee80211_hdr *)skb->data;
+                struct ieee80211_hdr *hdr = (void *)skb->data;
+                struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
                if (ieee80211_is_data_qos(hdr->frame_control))
                        freed++;
                else
                        WARN_ON_ONCE(1);
-                info = IEEE80211_SKB_CB(skb);
                iwl_trans_free_tx_cmd(priv->trans, info->driver_data[1]);
+                memset(&info->status, 0, sizeof(info->status));
+                /* Packet was transmitted successfully, failures come as single
+                 * frames because before failing a frame the firmware transmits
+                 * it without aggregation at least once.
+                 */
+                info->flags |= IEEE80211_TX_STAT_ACK;
                if (freed == 1) {
                        /* this is the first skb we deliver in this batch */
                        /* put the rate scaling data there */
                        info = IEEE80211_SKB_CB(skb);
                        memset(&info->status, 0, sizeof(info->status));
-                        info->flags |= IEEE80211_TX_STAT_ACK;
                        info->flags |= IEEE80211_TX_STAT_AMPDU;
                        info->status.ampdu_ack_len = ba_resp->txed_2_done;
                        info->status.ampdu_len = ba_resp->txed;
diff --git a/drivers/net/wireless/iwlwifi/iwl-drv.c b/drivers/net/wireless/iwlwifi/iwl-drv.c
index c3728163be46..75103554cd63 100644
--- a/drivers/net/wireless/iwlwifi/iwl-drv.c
+++ b/drivers/net/wireless/iwlwifi/iwl-drv.c
@@ -1286,7 +1286,7 @@ module_param_named(swcrypto, iwlwifi_mod_params.sw_crypto, int, S_IRUGO);
 MODULE_PARM_DESC(swcrypto, "using crypto in software (default 0 [hardware])");
 module_param_named(11n_disable, iwlwifi_mod_params.disable_11n, uint, S_IRUGO);
 MODULE_PARM_DESC(11n_disable,
-        "disable 11n functionality, bitmap: 1: full, 2: agg TX, 4: agg RX");
+        "disable 11n functionality, bitmap: 1: full, 2: disable agg TX, 4: disable agg RX, 8 enable agg TX");
 module_param_named(amsdu_size_8K, iwlwifi_mod_params.amsdu_size_8K,
                   int, S_IRUGO);
 MODULE_PARM_DESC(amsdu_size_8K, "enable 8K amsdu size (default 0)");
diff --git a/drivers/net/wireless/iwlwifi/iwl-modparams.h b/drivers/net/wireless/iwlwifi/iwl-modparams.h
index 0a84ade7edac..b29075c3da8e 100644
--- a/drivers/net/wireless/iwlwifi/iwl-modparams.h
+++ b/drivers/net/wireless/iwlwifi/iwl-modparams.h
@@ -79,9 +79,12 @@ enum iwl_power_level {
        IWL_POWER_NUM
 };
-#define IWL_DISABLE_HT_ALL      BIT(0)
+enum iwl_disable_11n {
-#define IWL_DISABLE_HT_TXAGG    BIT(1)
+        IWL_DISABLE_HT_ALL       = BIT(0),
-#define IWL_DISABLE_HT_RXAGG    BIT(2)
+        IWL_DISABLE_HT_TXAGG     = BIT(1),
+        IWL_DISABLE_HT_RXAGG     = BIT(2),
+        IWL_ENABLE_HT_TXAGG      = BIT(3),
+};
 /**
 * struct iwl_mod_params
@@ -90,7 +93,7 @@ enum iwl_power_level {
 *
 * @sw_crypto: using hardware encryption, default = 0
 * @disable_11n: disable 11n capabilities, default = 0,
- *      use IWL_DISABLE_HT_* constants
+ *      use IWL_[DIS,EN]ABLE_HT_* constants
 * @amsdu_size_8K: enable 8K amsdu size, default = 0
 * @restart_fw: restart firmware, default = 1
 * @wd_disable: enable stuck queue check, default = 0
diff --git a/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c b/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c
index f06f4cbe1317..725e954d8475 100644
--- a/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c
+++ b/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c
@@ -182,6 +182,11 @@ static int iwl_init_channel_map(struct device *dev, const struct iwl_cfg *cfg,
        for (ch_idx = 0; ch_idx < IWL_NUM_CHANNELS; ch_idx++) {
                ch_flags = __le16_to_cpup(nvm_ch_flags + ch_idx);
+                if (ch_idx >= NUM_2GHZ_CHANNELS &&
+                    !data->sku_cap_band_52GHz_enable)
+                        ch_flags &= ~NVM_CHANNEL_VALID;
                if (!(ch_flags & NVM_CHANNEL_VALID)) {
                        IWL_DEBUG_EEPROM(dev,
                                         "Ch. %d Flags %x [%sGHz] - No traffic\n",
diff --git a/drivers/net/wireless/iwlwifi/mvm/bt-coex.c b/drivers/net/wireless/iwlwifi/mvm/bt-coex.c
index 76cde6ce6551..18a895a949d4 100644
--- a/drivers/net/wireless/iwlwifi/mvm/bt-coex.c
+++ b/drivers/net/wireless/iwlwifi/mvm/bt-coex.c
@@ -872,8 +872,11 @@ void iwl_mvm_bt_rssi_event(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
        lockdep_assert_held(&mvm->mutex);
-        /* Rssi update while not associated ?! */
+        /*
-        if (WARN_ON_ONCE(mvmvif->ap_sta_id == IWL_MVM_STATION_COUNT))
+         * Rssi update while not associated - can happen since the statistics
+         * are handled asynchronously
+         */
+        if (mvmvif->ap_sta_id == IWL_MVM_STATION_COUNT)
                return;
        /* No BT - reports should be disabled */
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h b/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h
index 73cbba7424f2..9426905de6b2 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h
@@ -504,6 +504,7 @@ struct iwl_scan_offload_profile {
 * @match_notify:       clients waiting for match found notification
 * @pass_match:         clients waiting for the results
 * @active_clients:     active clients bitmap - enum scan_framework_client
+ * @any_beacon_notify:  clients waiting for match notification without match
 */
 struct iwl_scan_offload_profile_cfg {
        struct iwl_scan_offload_profile profiles[IWL_SCAN_MAX_PROFILES];
@@ -512,7 +513,8 @@ struct iwl_scan_offload_profile_cfg {
        u8 match_notify;
        u8 pass_match;
        u8 active_clients;
-        u8 reserved[3];
+        u8 any_beacon_notify;
+        u8 reserved[2];
 } __packed;
 /**
diff --git a/drivers/net/wireless/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
index c49b5073c251..c35b8661b395 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
@@ -246,7 +246,7 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
        else
                hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
-        if (mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_SCHED_SCAN) {
+        if (0 && mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_SCHED_SCAN) {
                hw->wiphy->flags |= WIPHY_FLAG_SUPPORTS_SCHED_SCAN;
                hw->wiphy->max_sched_scan_ssids = PROBE_OPTION_MAX;
                hw->wiphy->max_match_sets = IWL_SCAN_MAX_PROFILES;
@@ -328,6 +328,24 @@ static void iwl_mvm_mac_tx(struct ieee80211_hw *hw,
        ieee80211_free_txskb(hw, skb);
 }
+static inline bool iwl_enable_rx_ampdu(const struct iwl_cfg *cfg)
+{
+        if (iwlwifi_mod_params.disable_11n & IWL_DISABLE_HT_RXAGG)
+                return false;
+        return true;
+}
+static inline bool iwl_enable_tx_ampdu(const struct iwl_cfg *cfg)
+{
+        if (iwlwifi_mod_params.disable_11n & IWL_DISABLE_HT_TXAGG)
+                return false;
+        if (iwlwifi_mod_params.disable_11n & IWL_ENABLE_HT_TXAGG)
+                return true;
+        /* enabled by default */
+        return true;
+}
 static int iwl_mvm_mac_ampdu_action(struct ieee80211_hw *hw,
                                    struct ieee80211_vif *vif,
                                    enum ieee80211_ampdu_mlme_action action,
@@ -347,7 +365,7 @@ static int iwl_mvm_mac_ampdu_action(struct ieee80211_hw *hw,
        switch (action) {
        case IEEE80211_AMPDU_RX_START:
-                if (iwlwifi_mod_params.disable_11n & IWL_DISABLE_HT_RXAGG) {
+                if (!iwl_enable_rx_ampdu(mvm->cfg)) {
                        ret = -EINVAL;
                        break;
                }
@@ -357,7 +375,7 @@ static int iwl_mvm_mac_ampdu_action(struct ieee80211_hw *hw,
                ret = iwl_mvm_sta_rx_agg(mvm, sta, tid, 0, false);
                break;
        case IEEE80211_AMPDU_TX_START:
-                if (iwlwifi_mod_params.disable_11n & IWL_DISABLE_HT_TXAGG) {
+                if (!iwl_enable_tx_ampdu(mvm->cfg)) {
                        ret = -EINVAL;
                        break;
                }
diff --git a/drivers/net/wireless/iwlwifi/mvm/mvm.h b/drivers/net/wireless/iwlwifi/mvm/mvm.h
index e4ead86f06d6..2b0ba1fc3c82 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mvm.h
+++ b/drivers/net/wireless/iwlwifi/mvm/mvm.h
@@ -152,7 +152,7 @@ enum iwl_power_scheme {
        IWL_POWER_SCHEME_LP
 };
-#define IWL_CONN_MAX_LISTEN_INTERVAL    70
+#define IWL_CONN_MAX_LISTEN_INTERVAL    10
 #define IWL_UAPSD_AC_INFO               (IEEE80211_WMM_IE_STA_QOSINFO_AC_VO |\
                                         IEEE80211_WMM_IE_STA_QOSINFO_AC_VI |\
                                         IEEE80211_WMM_IE_STA_QOSINFO_AC_BK |\
diff --git a/drivers/net/wireless/iwlwifi/mvm/scan.c b/drivers/net/wireless/iwlwifi/mvm/scan.c
index 0e0007960612..742afc429c94 100644
--- a/drivers/net/wireless/iwlwifi/mvm/scan.c
+++ b/drivers/net/wireless/iwlwifi/mvm/scan.c
@@ -344,7 +344,8 @@ int iwl_mvm_scan_request(struct iwl_mvm *mvm,
        iwl_mvm_scan_fill_ssids(cmd, req, basic_ssid ? 1 : 0);
-        cmd->tx_cmd.tx_flags = cpu_to_le32(TX_CMD_FLG_SEQ_CTL);
+        cmd->tx_cmd.tx_flags = cpu_to_le32(TX_CMD_FLG_SEQ_CTL |
+                                           TX_CMD_FLG_BT_DIS);
        cmd->tx_cmd.sta_id = mvm->aux_sta.sta_id;
        cmd->tx_cmd.life_time = cpu_to_le32(TX_CMD_LIFE_TIME_INFINITE);
        cmd->tx_cmd.rate_n_flags =
@@ -807,6 +808,8 @@ int iwl_mvm_config_sched_scan_profiles(struct iwl_mvm *mvm,
        profile_cfg->active_clients = SCAN_CLIENT_SCHED_SCAN;
        profile_cfg->pass_match = SCAN_CLIENT_SCHED_SCAN;
        profile_cfg->match_notify = SCAN_CLIENT_SCHED_SCAN;
+        if (!req->n_match_sets || !req->match_sets[0].ssid.ssid_len)
+                profile_cfg->any_beacon_notify = SCAN_CLIENT_SCHED_SCAN;
        for (i = 0; i < req->n_match_sets; i++) {
                profile = &profile_cfg->profiles[i];
diff --git a/drivers/net/wireless/iwlwifi/mvm/sta.c b/drivers/net/wireless/iwlwifi/mvm/sta.c
index ec1812133235..3397f59cd4e4 100644
--- a/drivers/net/wireless/iwlwifi/mvm/sta.c
+++ b/drivers/net/wireless/iwlwifi/mvm/sta.c
@@ -652,7 +652,7 @@ int iwl_mvm_send_bcast_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
 {
        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
        static const u8 _baddr[] = {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF};
-        static const u8 *baddr = _baddr;
+        const u8 *baddr = _baddr;
        lockdep_assert_held(&mvm->mutex);
diff --git a/drivers/net/wireless/iwlwifi/mvm/tx.c b/drivers/net/wireless/iwlwifi/mvm/tx.c
index 90378c217bc7..76ee486039d7 100644
--- a/drivers/net/wireless/iwlwifi/mvm/tx.c
+++ b/drivers/net/wireless/iwlwifi/mvm/tx.c
@@ -659,8 +659,14 @@ static void iwl_mvm_rx_tx_cmd_single(struct iwl_mvm *mvm,
        rcu_read_lock();
        sta = rcu_dereference(mvm->fw_id_to_mac_id[sta_id]);
+        /*
+         * sta can't be NULL otherwise it'd mean that the sta has been freed in
+         * the firmware while we still have packets for it in the Tx queues.
+         */
+        if (WARN_ON_ONCE(!sta))
+                goto out;
-        if (!IS_ERR_OR_NULL(sta)) {
+        if (!IS_ERR(sta)) {
                mvmsta = iwl_mvm_sta_from_mac80211(sta);
                if (tid != IWL_TID_NON_QOS) {
@@ -675,7 +681,6 @@ static void iwl_mvm_rx_tx_cmd_single(struct iwl_mvm *mvm,
                        spin_unlock_bh(&mvmsta->lock);
                }
        } else {
-                sta = NULL;
                mvmsta = NULL;
        }
@@ -683,42 +688,38 @@ static void iwl_mvm_rx_tx_cmd_single(struct iwl_mvm *mvm,
         * If the txq is not an AMPDU queue, there is no chance we freed
         * several skbs. Check that out...
         */
-        if (txq_id < mvm->first_agg_queue && !WARN_ON(skb_freed > 1) &&
+        if (txq_id >= mvm->first_agg_queue)
-            atomic_sub_and_test(skb_freed, &mvm->pending_frames[sta_id])) {
+                goto out;
-                if (mvmsta) {
-                        /*
+        /* We can't free more than one frame at once on a shared queue */
-                         * If there are no pending frames for this STA, notify
+        WARN_ON(skb_freed > 1);
-                         * mac80211 that this station can go to sleep in its
-                         * STA table.
+        /* If we have still frames from this STA nothing to do here */
-                         */
+        if (!atomic_sub_and_test(skb_freed, &mvm->pending_frames[sta_id]))
-                        if (mvmsta->vif->type == NL80211_IFTYPE_AP)
+                goto out;
-                                ieee80211_sta_block_awake(mvm->hw, sta, false);
-                        /*
+        if (mvmsta && mvmsta->vif->type == NL80211_IFTYPE_AP) {
-                         * We might very well have taken mvmsta pointer while
+                /*
-                         * the station was being removed. The remove flow might
+                 * If there are no pending frames for this STA, notify
-                         * have seen a pending_frame (because we didn't take
+                 * mac80211 that this station can go to sleep in its
-                         * the lock) even if now the queues are drained. So make
+                 * STA table.
-                         * really sure now that this the station is not being
+                 * If mvmsta is not NULL, sta is valid.
-                         * removed. If it is, run the drain worker to remove it.
+                 */
-                         */
+                ieee80211_sta_block_awake(mvm->hw, sta, false);
-                        spin_lock_bh(&mvmsta->lock);
-                        sta = rcu_dereference(mvm->fw_id_to_mac_id[sta_id]);
-                        if (!sta || PTR_ERR(sta) == -EBUSY) {
-                                /*
-                                 * Station disappeared in the meantime:
-                                 * so we are draining.
-                                 */
-                                set_bit(sta_id, mvm->sta_drained);
-                                schedule_work(&mvm->sta_drained_wk);
-                        }
-                        spin_unlock_bh(&mvmsta->lock);
-                } else if (!mvmsta && PTR_ERR(sta) == -EBUSY) {
-                        /* Tx response without STA, so we are draining */
-                        set_bit(sta_id, mvm->sta_drained);
-                        schedule_work(&mvm->sta_drained_wk);
-                }
        }
+        if (PTR_ERR(sta) == -EBUSY || PTR_ERR(sta) == -ENOENT) {
+                /*
+                 * We are draining and this was the last packet - pre_rcu_remove
+                 * has been called already. We might be after the
+                 * synchronize_net already.
+                 * Don't rely on iwl_mvm_rm_sta to see the empty Tx queues.
+                 */
+                set_bit(sta_id, mvm->sta_drained);
+                schedule_work(&mvm->sta_drained_wk);
+        }
+out:
        rcu_read_unlock();
 }
@@ -821,16 +822,12 @@ int iwl_mvm_rx_ba_notif(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb,
        struct iwl_mvm_ba_notif *ba_notif = (void *)pkt->data;
        struct sk_buff_head reclaimed_skbs;
        struct iwl_mvm_tid_data *tid_data;
-        struct ieee80211_tx_info *info;
        struct ieee80211_sta *sta;
        struct iwl_mvm_sta *mvmsta;
-        struct ieee80211_hdr *hdr;
        struct sk_buff *skb;
        int sta_id, tid, freed;
        /* "flow" corresponds to Tx queue */
        u16 scd_flow = le16_to_cpu(ba_notif->scd_flow);
        /* "ssn" is start of block-ack Tx window, corresponds to index
         * (in Tx queue's circular buffer) of first TFD/frame in window */
        u16 ba_resp_scd_ssn = le16_to_cpu(ba_notif->scd_ssn);
@@ -887,22 +884,26 @@ int iwl_mvm_rx_ba_notif(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb,
        freed = 0;
        skb_queue_walk(&reclaimed_skbs, skb) {
-                hdr = (struct ieee80211_hdr *)skb->data;
+                struct ieee80211_hdr *hdr = (void *)skb->data;
+                struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
                if (ieee80211_is_data_qos(hdr->frame_control))
                        freed++;
                else
                        WARN_ON_ONCE(1);
-                info = IEEE80211_SKB_CB(skb);
                iwl_trans_free_tx_cmd(mvm->trans, info->driver_data[1]);
+                memset(&info->status, 0, sizeof(info->status));
+                /* Packet was transmitted successfully, failures come as single
+                 * frames because before failing a frame the firmware transmits
+                 * it without aggregation at least once.
+                 */
+                info->flags |= IEEE80211_TX_STAT_ACK;
                if (freed == 1) {
                        /* this is the first skb we deliver in this batch */
                        /* put the rate scaling data there */
-                        info = IEEE80211_SKB_CB(skb);
-                        memset(&info->status, 0, sizeof(info->status));
-                        info->flags |= IEEE80211_TX_STAT_ACK;
                        info->flags |= IEEE80211_TX_STAT_AMPDU;
                        info->status.ampdu_ack_len = ba_notif->txed_2_done;
                        info->status.ampdu_len = ba_notif->txed;
diff --git a/drivers/net/wireless/iwlwifi/mvm/utils.c b/drivers/net/wireless/iwlwifi/mvm/utils.c
index a4a5e25623c3..86989df69356 100644
--- a/drivers/net/wireless/iwlwifi/mvm/utils.c
+++ b/drivers/net/wireless/iwlwifi/mvm/utils.c
@@ -411,6 +411,8 @@ void iwl_mvm_dump_nic_error_log(struct iwl_mvm *mvm)
                        mvm->status, table.valid);
        }
+        IWL_ERR(mvm, "Loaded firmware version: %s\n", mvm->fw->fw_version);
        trace_iwlwifi_dev_ucode_error(trans->dev, table.error_id, table.tsf_low,
                                      table.data1, table.data2, table.data3,
                                      table.blink1, table.blink2, table.ilink1,
diff --git a/drivers/net/wireless/iwlwifi/pcie/drv.c b/drivers/net/wireless/iwlwifi/pcie/drv.c
index 3040924f5f3c..3872ead75488 100644
--- a/drivers/net/wireless/iwlwifi/pcie/drv.c
+++ b/drivers/net/wireless/iwlwifi/pcie/drv.c
@@ -359,20 +359,24 @@ static DEFINE_PCI_DEVICE_TABLE(iwl_hw_card_ids) = {
 /* 7265 Series */
        {IWL_PCI_DEVICE(0x095A, 0x5010, iwl7265_2ac_cfg)},
        {IWL_PCI_DEVICE(0x095A, 0x5110, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x5100, iwl7265_2ac_cfg)},
        {IWL_PCI_DEVICE(0x095B, 0x5310, iwl7265_2ac_cfg)},
-        {IWL_PCI_DEVICE(0x095B, 0x5302, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095B, 0x5302, iwl7265_n_cfg)},
        {IWL_PCI_DEVICE(0x095B, 0x5210, iwl7265_2ac_cfg)},
        {IWL_PCI_DEVICE(0x095A, 0x5012, iwl7265_2ac_cfg)},
-        {IWL_PCI_DEVICE(0x095A, 0x500A, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x5412, iwl7265_2ac_cfg)},
        {IWL_PCI_DEVICE(0x095A, 0x5410, iwl7265_2ac_cfg)},
        {IWL_PCI_DEVICE(0x095A, 0x5400, iwl7265_2ac_cfg)},
        {IWL_PCI_DEVICE(0x095A, 0x1010, iwl7265_2ac_cfg)},
        {IWL_PCI_DEVICE(0x095A, 0x5000, iwl7265_2n_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x500A, iwl7265_2n_cfg)},
        {IWL_PCI_DEVICE(0x095B, 0x5200, iwl7265_2n_cfg)},
        {IWL_PCI_DEVICE(0x095A, 0x5002, iwl7265_n_cfg)},
        {IWL_PCI_DEVICE(0x095B, 0x5202, iwl7265_n_cfg)},
        {IWL_PCI_DEVICE(0x095A, 0x9010, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x9012, iwl7265_2ac_cfg)},
        {IWL_PCI_DEVICE(0x095A, 0x9110, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x9112, iwl7265_2ac_cfg)},
        {IWL_PCI_DEVICE(0x095A, 0x9210, iwl7265_2ac_cfg)},
        {IWL_PCI_DEVICE(0x095A, 0x9510, iwl7265_2ac_cfg)},
        {IWL_PCI_DEVICE(0x095A, 0x9310, iwl7265_2ac_cfg)},
diff --git a/drivers/net/wireless/libertas/cfg.c b/drivers/net/wireless/libertas/cfg.c
index 32f75007a825..cb6d189bc3e6 100644
--- a/drivers/net/wireless/libertas/cfg.c
+++ b/drivers/net/wireless/libertas/cfg.c
@@ -621,7 +621,7 @@ static int lbs_ret_scan(struct lbs_private *priv, unsigned long dummy,
                        id = *pos++;
                        elen = *pos++;
                        left -= 2;
-                        if (elen > left || elen == 0) {
+                        if (elen > left) {
                                lbs_deb_scan("scan response: invalid IE fmt\n");
                                goto done;
                        }
diff --git a/drivers/net/wireless/mwifiex/11ac.c b/drivers/net/wireless/mwifiex/11ac.c
index 5e0eec4d71c7..5d9a8084665d 100644
--- a/drivers/net/wireless/mwifiex/11ac.c
+++ b/drivers/net/wireless/mwifiex/11ac.c
@@ -189,8 +189,7 @@ int mwifiex_cmd_append_11ac_tlv(struct mwifiex_private *priv,
                vht_cap->header.len  =
                                cpu_to_le16(sizeof(struct ieee80211_vht_cap));
                memcpy((u8 *)vht_cap + sizeof(struct mwifiex_ie_types_header),
-                       (u8 *)bss_desc->bcn_vht_cap +
+                       (u8 *)bss_desc->bcn_vht_cap,
-                       sizeof(struct ieee_types_header),
                       le16_to_cpu(vht_cap->header.len));
                mwifiex_fill_vht_cap_tlv(priv, vht_cap, bss_desc->bss_band);
diff --git a/drivers/net/wireless/mwifiex/11n.c b/drivers/net/wireless/mwifiex/11n.c
index 6261f8c53d44..7db1a89fdd95 100644
--- a/drivers/net/wireless/mwifiex/11n.c
+++ b/drivers/net/wireless/mwifiex/11n.c
@@ -308,8 +308,7 @@ mwifiex_cmd_append_11n_tlv(struct mwifiex_private *priv,
                ht_cap->header.len =
                                cpu_to_le16(sizeof(struct ieee80211_ht_cap));
                memcpy((u8 *) ht_cap + sizeof(struct mwifiex_ie_types_header),
-                       (u8 *) bss_desc->bcn_ht_cap +
+                       (u8 *)bss_desc->bcn_ht_cap,
-                       sizeof(struct ieee_types_header),
                       le16_to_cpu(ht_cap->header.len));
                mwifiex_fill_cap_info(priv, radio_type, ht_cap);
diff --git a/drivers/net/wireless/mwifiex/main.c b/drivers/net/wireless/mwifiex/main.c
index 4d79761b9c87..9d3d2758ec35 100644
--- a/drivers/net/wireless/mwifiex/main.c
+++ b/drivers/net/wireless/mwifiex/main.c
@@ -748,7 +748,7 @@ static struct net_device_stats *mwifiex_get_stats(struct net_device *dev)
 static u16
 mwifiex_netdev_select_wmm_queue(struct net_device *dev, struct sk_buff *skb,
-                                void *accel_priv)
+                                void *accel_priv, select_queue_fallback_t fallback)
 {
        skb->priority = cfg80211_classify8021d(skb, NULL);
        return mwifiex_1d_to_wmm_queue[skb->priority];
diff --git a/drivers/net/wireless/mwifiex/pcie.c b/drivers/net/wireless/mwifiex/pcie.c
index 03688aa14e8a..7fe7b53fb17a 100644
--- a/drivers/net/wireless/mwifiex/pcie.c
+++ b/drivers/net/wireless/mwifiex/pcie.c
@@ -1211,6 +1211,12 @@ static int mwifiex_pcie_process_recv_data(struct mwifiex_adapter *adapter)
                rd_index = card->rxbd_rdptr & reg->rx_mask;
                skb_data = card->rx_buf_list[rd_index];
+                /* If skb allocation was failed earlier for Rx packet,
+                 * rx_buf_list[rd_index] would have been left with a NULL.
+                 */
+                if (!skb_data)
+                        return -ENOMEM;
                MWIFIEX_SKB_PACB(skb_data, &buf_pa);
                pci_unmap_single(card->dev, buf_pa, MWIFIEX_RX_DATA_BUF_SIZE,
                                 PCI_DMA_FROMDEVICE);
@@ -1525,6 +1531,14 @@ static int mwifiex_pcie_process_cmd_complete(struct mwifiex_adapter *adapter)
                if (adapter->ps_state == PS_STATE_SLEEP_CFM) {
                        mwifiex_process_sleep_confirm_resp(adapter, skb->data,
                                                           skb->len);
+                        mwifiex_pcie_enable_host_int(adapter);
+                        if (mwifiex_write_reg(adapter,
+                                              PCIE_CPU_INT_EVENT,
+                                              CPU_INTR_SLEEP_CFM_DONE)) {
+                                dev_warn(adapter->dev,
+                                         "Write register failed\n");
+                                return -1;
+                        }
                        while (reg->sleep_cookie && (count++ < 10) &&
                               mwifiex_pcie_ok_to_access_hw(adapter))
                                usleep_range(50, 60);
@@ -1993,23 +2007,9 @@ static void mwifiex_interrupt_status(struct mwifiex_adapter *adapter)
                adapter->int_status |= pcie_ireg;
                spin_unlock_irqrestore(&adapter->int_lock, flags);
-                if (pcie_ireg & HOST_INTR_CMD_DONE) {
+                if (!adapter->pps_uapsd_mode &&
-                        if ((adapter->ps_state == PS_STATE_SLEEP_CFM) ||
+                    adapter->ps_state == PS_STATE_SLEEP &&
-                            (adapter->ps_state == PS_STATE_SLEEP)) {
+                    mwifiex_pcie_ok_to_access_hw(adapter)) {
-                                mwifiex_pcie_enable_host_int(adapter);
-                                if (mwifiex_write_reg(adapter,
-                                                      PCIE_CPU_INT_EVENT,
-                                                      CPU_INTR_SLEEP_CFM_DONE)
-                                                      ) {
-                                        dev_warn(adapter->dev,
-                                                 "Write register failed\n");
-                                        return;
-                                }
-                        }
-                } else if (!adapter->pps_uapsd_mode &&
-                           adapter->ps_state == PS_STATE_SLEEP &&
-                           mwifiex_pcie_ok_to_access_hw(adapter)) {
                                /* Potentially for PCIe we could get other
                                 * interrupts like shared. Don't change power
                                 * state until cookie is set */
diff --git a/drivers/net/wireless/mwifiex/scan.c b/drivers/net/wireless/mwifiex/scan.c
index 0a8a26e10f01..668547c2de84 100644
--- a/drivers/net/wireless/mwifiex/scan.c
+++ b/drivers/net/wireless/mwifiex/scan.c
@@ -2101,12 +2101,12 @@ mwifiex_save_curr_bcn(struct mwifiex_private *priv)
                         curr_bss->ht_info_offset);
        if (curr_bss->bcn_vht_cap)
-                curr_bss->bcn_ht_cap = (void *)(curr_bss->beacon_buf +
+                curr_bss->bcn_vht_cap = (void *)(curr_bss->beacon_buf +
-                                                curr_bss->vht_cap_offset);
+                                                 curr_bss->vht_cap_offset);
        if (curr_bss->bcn_vht_oper)
-                curr_bss->bcn_ht_oper = (void *)(curr_bss->beacon_buf +
+                curr_bss->bcn_vht_oper = (void *)(curr_bss->beacon_buf +
-                                                 curr_bss->vht_info_offset);
+                                                  curr_bss->vht_info_offset);
        if (curr_bss->bcn_bss_co_2040)
                curr_bss->bcn_bss_co_2040 =
diff --git a/drivers/net/wireless/mwifiex/usb.c b/drivers/net/wireless/mwifiex/usb.c
index e8ebbd4bc3cd..208748804a55 100644
--- a/drivers/net/wireless/mwifiex/usb.c
+++ b/drivers/net/wireless/mwifiex/usb.c
@@ -22,8 +22,6 @@
 #define USB_VERSION     "1.0"
-static const char usbdriver_name[] = "usb8xxx";
 static struct mwifiex_if_ops usb_ops;
 static struct semaphore add_remove_card_sem;
 static struct usb_card_rec *usb_card;
@@ -527,13 +525,6 @@ static int mwifiex_usb_resume(struct usb_interface *intf)
                                                   MWIFIEX_BSS_ROLE_ANY),
                                  MWIFIEX_ASYNC_CMD);
-#ifdef CONFIG_PM
-        /* Resume handler may be called due to remote wakeup,
-         * force to exit suspend anyway
-         */
-        usb_disable_autosuspend(card->udev);
-#endif /* CONFIG_PM */
        return 0;
 }
@@ -567,13 +558,12 @@ static void mwifiex_usb_disconnect(struct usb_interface *intf)
 }
 static struct usb_driver mwifiex_usb_driver = {
-        .name = usbdriver_name,
+        .name = "mwifiex_usb",
        .probe = mwifiex_usb_probe,
        .disconnect = mwifiex_usb_disconnect,
        .id_table = mwifiex_usb_table,
        .suspend = mwifiex_usb_suspend,
        .resume = mwifiex_usb_resume,
-        .supports_autosuspend = 1,
 };
 static int mwifiex_usb_tx_init(struct mwifiex_adapter *adapter)
diff --git a/drivers/net/wireless/mwifiex/wmm.c b/drivers/net/wireless/mwifiex/wmm.c
index 13eaeed03898..981cf6e7c73b 100644
--- a/drivers/net/wireless/mwifiex/wmm.c
+++ b/drivers/net/wireless/mwifiex/wmm.c
@@ -559,7 +559,8 @@ mwifiex_clean_txrx(struct mwifiex_private *priv)
        mwifiex_wmm_delete_all_ralist(priv);
        memcpy(tos_to_tid, ac_to_tid, sizeof(tos_to_tid));
-        if (priv->adapter->if_ops.clean_pcie_ring)
+        if (priv->adapter->if_ops.clean_pcie_ring &&
+            !priv->adapter->surprise_removed)
                priv->adapter->if_ops.clean_pcie_ring(priv->adapter);
        spin_unlock_irqrestore(&priv->wmm.ra_list_spinlock, flags);
 }
diff --git a/drivers/net/wireless/rt2x00/rt2500pci.c b/drivers/net/wireless/rt2x00/rt2500pci.c
index abc5f56f29fe..2f1cd929c6f6 100644
--- a/drivers/net/wireless/rt2x00/rt2500pci.c
+++ b/drivers/net/wireless/rt2x00/rt2500pci.c
@@ -1877,6 +1877,11 @@ static int rt2500pci_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
                                                   EEPROM_MAC_ADDR_0));
        /*
+         * Disable powersaving as default.
+         */
+        rt2x00dev->hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
+        /*
         * Initialize hw_mode information.
         */
        spec->supported_bands = SUPPORT_BAND_2GHZ;
diff --git a/drivers/net/wireless/rt2x00/rt2500usb.c b/drivers/net/wireless/rt2x00/rt2500usb.c
index 9f16824cd1bc..d849d590de25 100644
--- a/drivers/net/wireless/rt2x00/rt2500usb.c
+++ b/drivers/net/wireless/rt2x00/rt2500usb.c
@@ -1706,6 +1706,11 @@ static int rt2500usb_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
            IEEE80211_HW_SUPPORTS_PS |
            IEEE80211_HW_PS_NULLFUNC_STACK;
+        /*
+         * Disable powersaving as default.
+         */
+        rt2x00dev->hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
        SET_IEEE80211_DEV(rt2x00dev->hw, rt2x00dev->dev);
        SET_IEEE80211_PERM_ADDR(rt2x00dev->hw,
                                rt2x00_eeprom_addr(rt2x00dev,
diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c b/drivers/net/wireless/rt2x00/rt2800lib.c
index b8f5b06006c4..41d4a8167dc3 100644
--- a/drivers/net/wireless/rt2x00/rt2800lib.c
+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
@@ -5460,14 +5460,15 @@ static void rt2800_init_bbp_53xx(struct rt2x00_dev *rt2x00dev)
        rt2800_bbp_write(rt2x00dev, 68, 0x0b);
-        rt2800_bbp_write(rt2x00dev, 69, 0x0d);
+        rt2800_bbp_write(rt2x00dev, 69, 0x12);
-        rt2800_bbp_write(rt2x00dev, 70, 0x06);
        rt2800_bbp_write(rt2x00dev, 73, 0x13);
        rt2800_bbp_write(rt2x00dev, 75, 0x46);
        rt2800_bbp_write(rt2x00dev, 76, 0x28);
        rt2800_bbp_write(rt2x00dev, 77, 0x59);
+        rt2800_bbp_write(rt2x00dev, 70, 0x0a);
        rt2800_bbp_write(rt2x00dev, 79, 0x13);
        rt2800_bbp_write(rt2x00dev, 80, 0x05);
        rt2800_bbp_write(rt2x00dev, 81, 0x33);
@@ -5510,7 +5511,6 @@ static void rt2800_init_bbp_53xx(struct rt2x00_dev *rt2x00dev)
        if (rt2x00_rt(rt2x00dev, RT5392)) {
                rt2800_bbp_write(rt2x00dev, 134, 0xd0);
                rt2800_bbp_write(rt2x00dev, 135, 0xf6);
-                rt2800_bbp_write(rt2x00dev, 148, 0x84);
        }
        rt2800_disable_unused_dac_adc(rt2x00dev);
@@ -7458,10 +7458,9 @@ static int rt2800_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
        u32 reg;
        /*
-         * Disable powersaving as default on PCI devices.
+         * Disable powersaving as default.
         */
-        if (rt2x00_is_pci(rt2x00dev) || rt2x00_is_soc(rt2x00dev))
+        rt2x00dev->hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
-                rt2x00dev->hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
        /*
         * Initialize all hw fields.
diff --git a/drivers/net/wireless/rtl818x/rtl8180/dev.c b/drivers/net/wireless/rtl818x/rtl8180/dev.c
index 8ec17aad0e52..3867d1470b36 100644
--- a/drivers/net/wireless/rtl818x/rtl8180/dev.c
+++ b/drivers/net/wireless/rtl818x/rtl8180/dev.c
@@ -107,6 +107,7 @@ static void rtl8180_handle_rx(struct ieee80211_hw *dev)
        struct rtl8180_priv *priv = dev->priv;
        unsigned int count = 32;
        u8 signal, agc, sq;
+        dma_addr_t mapping;
        while (count--) {
                struct rtl8180_rx_desc *entry = &priv->rx_ring[priv->rx_idx];
@@ -128,6 +129,17 @@ static void rtl8180_handle_rx(struct ieee80211_hw *dev)
                        if (unlikely(!new_skb))
                                goto done;
+                        mapping = pci_map_single(priv->pdev,
+                                               skb_tail_pointer(new_skb),
+                                               MAX_RX_SIZE, PCI_DMA_FROMDEVICE);
+                        if (pci_dma_mapping_error(priv->pdev, mapping)) {
+                                kfree_skb(new_skb);
+                                dev_err(&priv->pdev->dev, "RX DMA map error\n");
+                                goto done;
+                        }
                        pci_unmap_single(priv->pdev,
                                         *((dma_addr_t *)skb->cb),
                                         MAX_RX_SIZE, PCI_DMA_FROMDEVICE);
@@ -158,9 +170,7 @@ static void rtl8180_handle_rx(struct ieee80211_hw *dev)
                        skb = new_skb;
                        priv->rx_buf[priv->rx_idx] = skb;
-                        *((dma_addr_t *) skb->cb) =
+                        *((dma_addr_t *) skb->cb) = mapping;
-                                pci_map_single(priv->pdev, skb_tail_pointer(skb),
-                                               MAX_RX_SIZE, PCI_DMA_FROMDEVICE);
                }
        done:
@@ -266,6 +276,13 @@ static void rtl8180_tx(struct ieee80211_hw *dev,
        mapping = pci_map_single(priv->pdev, skb->data,
                                 skb->len, PCI_DMA_TODEVICE);
+        if (pci_dma_mapping_error(priv->pdev, mapping)) {
+                kfree_skb(skb);
+                dev_err(&priv->pdev->dev, "TX DMA mapping error\n");
+                return;
+        }
        tx_flags = RTL818X_TX_DESC_FLAG_OWN | RTL818X_TX_DESC_FLAG_FS |
                   RTL818X_TX_DESC_FLAG_LS |
                   (ieee80211_get_tx_rate(dev, info)->hw_value << 24) |
diff --git a/drivers/net/wireless/rtl818x/rtl8187/rtl8187.h b/drivers/net/wireless/rtl818x/rtl8187/rtl8187.h
index 56aee067f324..a6ad79f61bf9 100644
--- a/drivers/net/wireless/rtl818x/rtl8187/rtl8187.h
+++ b/drivers/net/wireless/rtl818x/rtl8187/rtl8187.h
@@ -15,6 +15,8 @@
 #ifndef RTL8187_H
 #define RTL8187_H
+#include <linux/cache.h>
 #include "rtl818x.h"
 #include "leds.h"
@@ -139,7 +141,10 @@ struct rtl8187_priv {
        u8 aifsn[4];
        u8 rfkill_mask;
        struct {
-                __le64 buf;
+                union {
+                        __le64 buf;
+                        u8 dummy1[L1_CACHE_BYTES];
+                } ____cacheline_aligned;
                struct sk_buff_head queue;
        } b_tx_status; /* This queue is used by both -b and non-b devices */
        struct mutex io_mutex;
@@ -147,7 +152,8 @@ struct rtl8187_priv {
                u8 bits8;
                __le16 bits16;
                __le32 bits32;
-        } *io_dmabuf;
+                u8 dummy2[L1_CACHE_BYTES];
+        } *io_dmabuf ____cacheline_aligned;
        bool rfkill_off;
        u16 seqno;
 };
diff --git a/drivers/net/wireless/rtlwifi/ps.c b/drivers/net/wireless/rtlwifi/ps.c
index deedae3c5449..d1c0191a195b 100644
--- a/drivers/net/wireless/rtlwifi/ps.c
+++ b/drivers/net/wireless/rtlwifi/ps.c
@@ -48,7 +48,7 @@ bool rtl_ps_enable_nic(struct ieee80211_hw *hw)
        /*<2> Enable Adapter */
        if (rtlpriv->cfg->ops->hw_init(hw))
-                return 1;
+                return false;
        RT_CLEAR_PS_LEVEL(ppsc, RT_RF_OFF_LEVL_HALT_NIC);
        /*<3> Enable Interrupt */
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c b/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c
index a82b30a1996c..2eb0b38384dd 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c
@@ -937,14 +937,26 @@ int rtl92ce_hw_init(struct ieee80211_hw *hw)
        bool is92c;
        int err;
        u8 tmp_u1b;
+        unsigned long flags;
        rtlpci->being_init_adapter = true;
+        /* Since this function can take a very long time (up to 350 ms)
+         * and can be called with irqs disabled, reenable the irqs
+         * to let the other devices continue being serviced.
+         *
+         * It is safe doing so since our own interrupts will only be enabled
+         * in a subsequent step.
+         */
+        local_save_flags(flags);
+        local_irq_enable();
        rtlpriv->intf_ops->disable_aspm(hw);
        rtstatus = _rtl92ce_init_mac(hw);
        if (!rtstatus) {
                RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG, "Init MAC failed\n");
                err = 1;
-                return err;
+                goto exit;
        }
        err = rtl92c_download_fw(hw);
@@ -952,7 +964,7 @@ int rtl92ce_hw_init(struct ieee80211_hw *hw)
                RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING,
                         "Failed to download FW. Init HW without FW now..\n");
                err = 1;
-                return err;
+                goto exit;
        }
        rtlhal->last_hmeboxnum = 0;
@@ -1032,6 +1044,8 @@ int rtl92ce_hw_init(struct ieee80211_hw *hw)
                RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE, "under 1.5V\n");
        }
        rtl92c_dm_init(hw);
+exit:
+        local_irq_restore(flags);
        rtlpci->being_init_adapter = false;
        return err;
 }
diff --git a/drivers/net/wireless/ti/wl1251/rx.c b/drivers/net/wireless/ti/wl1251/rx.c
index 123c4bb50e0a..cde0eaf99714 100644
--- a/drivers/net/wireless/ti/wl1251/rx.c
+++ b/drivers/net/wireless/ti/wl1251/rx.c
@@ -180,7 +180,7 @@ static void wl1251_rx_body(struct wl1251 *wl,
        wl1251_mem_read(wl, rx_packet_ring_addr, rx_buffer, length);
        /* The actual length doesn't include the target's alignment */
-        skb->len = desc->length  - PLCP_HEADER_LENGTH;
+        skb_trim(skb, desc->length - PLCP_HEADER_LENGTH);
        fc = (u16 *)skb->data;
diff --git a/drivers/net/xen-netback/common.h b/drivers/net/xen-netback/common.h
index 4c76bcb9a879..ae413a2cbee7 100644
--- a/drivers/net/xen-netback/common.h
+++ b/drivers/net/xen-netback/common.h
@@ -143,11 +143,7 @@ struct xenvif {
        char rx_irq_name[IFNAMSIZ+4]; /* DEVNAME-rx */
        struct xen_netif_rx_back_ring rx;
        struct sk_buff_head rx_queue;
-        bool rx_queue_stopped;
+        RING_IDX rx_last_skb_slots;
-        /* Set when the RX interrupt is triggered by the frontend.
-         * The worker thread may need to wake the queue.
-         */
-        bool rx_event;
        /* This array is allocated seperately as it is large */
        struct gnttab_copy *grant_copy_op;
diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
index b9de31ea7fc4..301cc037fda8 100644
--- a/drivers/net/xen-netback/interface.c
+++ b/drivers/net/xen-netback/interface.c
@@ -100,7 +100,6 @@ static irqreturn_t xenvif_rx_interrupt(int irq, void *dev_id)
 {
        struct xenvif *vif = dev_id;
-        vif->rx_event = true;
        xenvif_kick_thread(vif);
        return IRQ_HANDLED;
@@ -133,8 +132,7 @@ static int xenvif_start_xmit(struct sk_buff *skb, struct net_device *dev)
        /* If the skb is GSO then we'll also need an extra slot for the
         * metadata.
         */
-        if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV4 ||
+        if (skb_is_gso(skb))
-            skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6)
                min_slots_needed++;
        /* If the skb can't possibly fit in the remaining slots
diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
index 6b62c3eb8e18..438d0c09b7e6 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -240,7 +240,7 @@ static void xenvif_gop_frag_copy(struct xenvif *vif, struct sk_buff *skb,
        struct gnttab_copy *copy_gop;
        struct xenvif_rx_meta *meta;
        unsigned long bytes;
-        int gso_type;
+        int gso_type = XEN_NETIF_GSO_TYPE_NONE;
        /* Data must not cross a page boundary. */
        BUG_ON(size + offset > PAGE_SIZE<<compound_order(page));
@@ -299,12 +299,12 @@ static void xenvif_gop_frag_copy(struct xenvif *vif, struct sk_buff *skb,
                }
                /* Leave a gap for the GSO descriptor. */
-                if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV4)
+                if (skb_is_gso(skb)) {
-                        gso_type = XEN_NETIF_GSO_TYPE_TCPV4;
+                        if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV4)
-                else if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6)
+                                gso_type = XEN_NETIF_GSO_TYPE_TCPV4;
-                        gso_type = XEN_NETIF_GSO_TYPE_TCPV6;
+                        else if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6)
-                else
+                                gso_type = XEN_NETIF_GSO_TYPE_TCPV6;
-                        gso_type = XEN_NETIF_GSO_TYPE_NONE;
+                }
                if (*head && ((1 << gso_type) & vif->gso_mask))
                        vif->rx.req_cons++;
@@ -338,19 +338,15 @@ static int xenvif_gop_skb(struct sk_buff *skb,
        int head = 1;
        int old_meta_prod;
        int gso_type;
-        int gso_size;
        old_meta_prod = npo->meta_prod;
-        if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV4) {
+        gso_type = XEN_NETIF_GSO_TYPE_NONE;
-                gso_type = XEN_NETIF_GSO_TYPE_TCPV4;
+        if (skb_is_gso(skb)) {
-                gso_size = skb_shinfo(skb)->gso_size;
+                if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV4)
-        } else if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6) {
+                        gso_type = XEN_NETIF_GSO_TYPE_TCPV4;
-                gso_type = XEN_NETIF_GSO_TYPE_TCPV6;
+                else if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6)
-                gso_size = skb_shinfo(skb)->gso_size;
+                        gso_type = XEN_NETIF_GSO_TYPE_TCPV6;
-        } else {
-                gso_type = XEN_NETIF_GSO_TYPE_NONE;
-                gso_size = 0;
        }
        /* Set up a GSO prefix descriptor, if necessary */
@@ -358,7 +354,7 @@ static int xenvif_gop_skb(struct sk_buff *skb,
                req = RING_GET_REQUEST(&vif->rx, vif->rx.req_cons++);
                meta = npo->meta + npo->meta_prod++;
                meta->gso_type = gso_type;
-                meta->gso_size = gso_size;
+                meta->gso_size = skb_shinfo(skb)->gso_size;
                meta->size = 0;
                meta->id = req->id;
        }
@@ -368,7 +364,7 @@ static int xenvif_gop_skb(struct sk_buff *skb,
        if ((1 << gso_type) & vif->gso_mask) {
                meta->gso_type = gso_type;
-                meta->gso_size = gso_size;
+                meta->gso_size = skb_shinfo(skb)->gso_size;
        } else {
                meta->gso_type = XEN_NETIF_GSO_TYPE_NONE;
                meta->gso_size = 0;
@@ -476,7 +472,6 @@ static void xenvif_rx_action(struct xenvif *vif)
        unsigned long offset;
        struct skb_cb_overlay *sco;
        bool need_to_notify = false;
-        bool ring_full = false;
        struct netrx_pending_operations npo = {
                .copy  = vif->grant_copy_op,
@@ -486,7 +481,7 @@ static void xenvif_rx_action(struct xenvif *vif)
        skb_queue_head_init(&rxq);
        while ((skb = skb_dequeue(&vif->rx_queue)) != NULL) {
-                int max_slots_needed;
+                RING_IDX max_slots_needed;
                int i;
                /* We need a cheap worse case estimate for the number of
@@ -501,17 +496,19 @@ static void xenvif_rx_action(struct xenvif *vif)
                        size = skb_frag_size(&skb_shinfo(skb)->frags[i]);
                        max_slots_needed += DIV_ROUND_UP(size, PAGE_SIZE);
                }
-                if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV4 ||
+                if (skb_is_gso(skb) &&
-                    skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6)
+                   (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV4 ||
+                    skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6))
                        max_slots_needed++;
                /* If the skb may not fit then bail out now */
                if (!xenvif_rx_ring_slots_available(vif, max_slots_needed)) {
                        skb_queue_head(&vif->rx_queue, skb);
                        need_to_notify = true;
-                        ring_full = true;
+                        vif->rx_last_skb_slots = max_slots_needed;
                        break;
-                }
+                } else
+                        vif->rx_last_skb_slots = 0;
                sco = (struct skb_cb_overlay *)skb->cb;
                sco->meta_slots_used = xenvif_gop_skb(skb, &npo);
@@ -522,8 +519,6 @@ static void xenvif_rx_action(struct xenvif *vif)
        BUG_ON(npo.meta_prod > ARRAY_SIZE(vif->meta));
-        vif->rx_queue_stopped = !npo.copy_prod && ring_full;
        if (!npo.copy_prod)
                goto done;
@@ -1473,8 +1468,8 @@ static struct xen_netif_rx_response *make_rx_response(struct xenvif *vif,
 static inline int rx_work_todo(struct xenvif *vif)
 {
-        return (!skb_queue_empty(&vif->rx_queue) && !vif->rx_queue_stopped) ||
+        return !skb_queue_empty(&vif->rx_queue) &&
-                vif->rx_event;
+               xenvif_rx_ring_slots_available(vif, vif->rx_last_skb_slots);
 }
 static inline int tx_work_todo(struct xenvif *vif)
@@ -1560,8 +1555,6 @@ int xenvif_kthread(void *data)
                if (!skb_queue_empty(&vif->rx_queue))
                        xenvif_rx_action(vif);
-                vif->rx_event = false;
                if (skb_queue_empty(&vif->rx_queue) &&
                    netif_queue_stopped(vif->dev))
                        xenvif_start_queue(vif);
diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
index ff04d4f95baa..e30d80033cbc 100644
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -907,6 +907,7 @@ static int handle_incoming_queue(struct net_device *dev,
                /* Ethernet work: Delayed to here as it peeks the header. */
                skb->protocol = eth_type_trans(skb, dev);
+                skb_reset_network_header(skb);
                if (checksum_setup(dev, skb)) {
                        kfree_skb(skb);
@@ -1832,7 +1833,6 @@ static void netback_changed(struct xenbus_device *dev,
        case XenbusStateReconfiguring:
        case XenbusStateReconfigured:
        case XenbusStateUnknown:
-        case XenbusStateClosed:
                break;
        case XenbusStateInitWait:
@@ -1847,6 +1847,10 @@ static void netback_changed(struct xenbus_device *dev,
                netdev_notify_peers(netdev);
                break;
+        case XenbusStateClosed:
+                if (dev->state == XenbusStateClosed)
+                        break;
+                /* Missed the backend's CLOSING state -- fallthrough */
        case XenbusStateClosing:
                xenbus_frontend_closed(dev);
                break;