47 files changed, 336 insertions, 174 deletions
diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
index b5a7513df4e..5f6509a5f64 100644
--- a/drivers/net/Kconfig
+++ b/drivers/net/Kconfig
@@ -1732,6 +1732,7 @@ config KS8842
 config KS8851
       tristate "Micrel KS8851 SPI"
       depends on SPI
+       select MII
       help
         SPI driver for Micrel KS8851 SPI attached network chip.
diff --git a/drivers/net/arm/at91_ether.c b/drivers/net/arm/at91_ether.c
index 2e7419a6119..5041d10bae9 100644
--- a/drivers/net/arm/at91_ether.c
+++ b/drivers/net/arm/at91_ether.c
@@ -1228,7 +1228,6 @@ static int at91ether_resume(struct platform_device *pdev)
 #endif
 static struct platform_driver at91ether_driver = {
-        .probe          = at91ether_probe,
        .remove         = __devexit_p(at91ether_remove),
        .suspend        = at91ether_suspend,
        .resume         = at91ether_resume,
@@ -1240,7 +1239,7 @@ static struct platform_driver at91ether_driver = {
 static int __init at91ether_init(void)
 {
-        return platform_driver_register(&at91ether_driver);
+        return platform_driver_probe(&at91ether_driver, at91ether_probe);
 }
 static void __exit at91ether_exit(void)
diff --git a/drivers/net/at1700.c b/drivers/net/at1700.c
index 18b566ad4fd..cf30e278f18 100644
--- a/drivers/net/at1700.c
+++ b/drivers/net/at1700.c
@@ -318,7 +318,7 @@ static int __init at1700_probe1(struct net_device *dev, int ioaddr)
                                pos3 = mca_read_stored_pos( slot, 3 );
                                pos4 = mca_read_stored_pos( slot, 4 );
-                                for (l_i = 0; l_i < 0x09; l_i++)
+                                for (l_i = 0; l_i < 8; l_i++)
                                        if (( pos3 & 0x07) == at1700_ioaddr_pattern[l_i])
                                                break;
                                ioaddr = at1700_mca_probe_list[l_i];
diff --git a/drivers/net/benet/be_main.c b/drivers/net/benet/be_main.c
index c43f6a11929..dea3155688b 100644
--- a/drivers/net/benet/be_main.c
+++ b/drivers/net/benet/be_main.c
@@ -667,7 +667,7 @@ static void skb_fill_rx_data(struct be_adapter *adapter,
        struct be_queue_info *rxq = &adapter->rx_obj.q;
        struct be_rx_page_info *page_info;
        u16 rxq_idx, i, num_rcvd, j;
-        u32 pktsize, hdr_len, curr_frag_len;
+        u32 pktsize, hdr_len, curr_frag_len, size;
        u8 *start;
        rxq_idx = AMAP_GET_BITS(struct amap_eth_rx_compl, fragndx, rxcp);
@@ -708,12 +708,13 @@ static void skb_fill_rx_data(struct be_adapter *adapter,
        }
        /* More frags present for this completion */
-        pktsize -= curr_frag_len; /* account for above copied frag */
+        size = pktsize;
        for (i = 1, j = 0; i < num_rcvd; i++) {
+                size -= curr_frag_len;
                index_inc(&rxq_idx, rxq->len);
                page_info = get_rx_page_info(adapter, rxq_idx);
-                curr_frag_len = min(pktsize, rx_frag_size);
+                curr_frag_len = min(size, rx_frag_size);
                /* Coalesce all frags from the same physical page in one slot */
                if (page_info->page_offset == 0) {
@@ -731,7 +732,6 @@ static void skb_fill_rx_data(struct be_adapter *adapter,
                skb_shinfo(skb)->frags[j].size += curr_frag_len;
                skb->len += curr_frag_len;
                skb->data_len += curr_frag_len;
-                pktsize -= curr_frag_len;
                memset(page_info, 0, sizeof(*page_info));
        }
diff --git a/drivers/net/cnic.c b/drivers/net/cnic.c
index 4d1515f45ba..4869d77cbe9 100644
--- a/drivers/net/cnic.c
+++ b/drivers/net/cnic.c
@@ -227,7 +227,7 @@ static int cnic_send_nlmsg(struct cnic_local *cp, u32 type,
        }
        rcu_read_lock();
-        ulp_ops = rcu_dereference(cp->ulp_ops[CNIC_ULP_ISCSI]);
+        ulp_ops = rcu_dereference(cnic_ulp_tbl[CNIC_ULP_ISCSI]);
        if (ulp_ops)
                ulp_ops->iscsi_nl_send_msg(cp->dev, msg_type, buf, len);
        rcu_read_unlock();
@@ -319,6 +319,20 @@ static int cnic_abort_prep(struct cnic_sock *csk)
        return 0;
 }
+static void cnic_uio_stop(void)
+{
+        struct cnic_dev *dev;
+        read_lock(&cnic_dev_lock);
+        list_for_each_entry(dev, &cnic_dev_list, list) {
+                struct cnic_local *cp = dev->cnic_priv;
+                if (cp->cnic_uinfo)
+                        cnic_send_nlmsg(cp, ISCSI_KEVENT_IF_DOWN, NULL);
+        }
+        read_unlock(&cnic_dev_lock);
+}
 int cnic_register_driver(int ulp_type, struct cnic_ulp_ops *ulp_ops)
 {
        struct cnic_dev *dev;
@@ -390,6 +404,9 @@ int cnic_unregister_driver(int ulp_type)
        }
        read_unlock(&cnic_dev_lock);
+        if (ulp_type == CNIC_ULP_ISCSI)
+                cnic_uio_stop();
        rcu_assign_pointer(cnic_ulp_tbl[ulp_type], NULL);
        mutex_unlock(&cnic_lock);
@@ -632,7 +649,6 @@ static void cnic_free_resc(struct cnic_dev *dev)
        int i = 0;
        if (cp->cnic_uinfo) {
-                cnic_send_nlmsg(cp, ISCSI_KEVENT_IF_DOWN, NULL);
                while (cp->uio_dev != -1 && i < 15) {
                        msleep(100);
                        i++;
@@ -1057,6 +1073,9 @@ static void cnic_ulp_stop(struct cnic_dev *dev)
        struct cnic_local *cp = dev->cnic_priv;
        int if_type;
+        if (cp->cnic_uinfo)
+                cnic_send_nlmsg(cp, ISCSI_KEVENT_IF_DOWN, NULL);
        rcu_read_lock();
        for (if_type = 0; if_type < MAX_CNIC_ULP_TYPE; if_type++) {
                struct cnic_ulp_ops *ulp_ops;
diff --git a/drivers/net/eepro.c b/drivers/net/eepro.c
index cc2ab6412c7..4f700348534 100644
--- a/drivers/net/eepro.c
+++ b/drivers/net/eepro.c
@@ -1784,7 +1784,7 @@ int __init init_module(void)
                printk(KERN_INFO "eepro_init_module: Auto-detecting boards (May God protect us...)\n");
        }
-        for (i = 0; io[i] != -1 && i < MAX_EEPRO; i++) {
+        for (i = 0; i < MAX_EEPRO && io[i] != -1; i++) {
                dev = alloc_etherdev(sizeof(struct eepro_local));
                if (!dev)
                        break;
diff --git a/drivers/net/fealnx.c b/drivers/net/fealnx.c
index 48385c42ab5..160655d2458 100644
--- a/drivers/net/fealnx.c
+++ b/drivers/net/fealnx.c
@@ -584,7 +584,8 @@ static int __devinit fealnx_init_one(struct pci_dev *pdev,
        if (np->flags == HAS_MII_XCVR) {
                int phy, phy_idx = 0;
-                for (phy = 1; phy < 32 && phy_idx < 4; phy++) {
+                for (phy = 1; phy < 32 && phy_idx < ARRAY_SIZE(np->phys);
+                               phy++) {
                        int mii_status = mdio_read(dev, phy, 1);
                        if (mii_status != 0xffff && mii_status != 0x0000) {
diff --git a/drivers/net/fs_enet/fs_enet-main.c b/drivers/net/fs_enet/fs_enet-main.c
index b892c3ad9a7..2bc2d2b2064 100644
--- a/drivers/net/fs_enet/fs_enet-main.c
+++ b/drivers/net/fs_enet/fs_enet-main.c
@@ -754,17 +754,16 @@ static int fs_init_phy(struct net_device *dev)
        fep->oldlink = 0;
        fep->oldspeed = 0;
        fep->oldduplex = -1;
-        if(fep->fpi->phy_node)
-                phydev = of_phy_connect(dev, fep->fpi->phy_node,
+        phydev = of_phy_connect(dev, fep->fpi->phy_node, &fs_adjust_link, 0,
-                                        &fs_adjust_link, 0,
+                                PHY_INTERFACE_MODE_MII);
-                                        PHY_INTERFACE_MODE_MII);
+        if (!phydev) {
-        else {
+                phydev = of_phy_connect_fixed_link(dev, &fs_adjust_link,
-                printk("No phy bus ID specified in BSP code\n");
+                                                   PHY_INTERFACE_MODE_MII);
-                return -EINVAL;
        }
-        if (IS_ERR(phydev)) {
+        if (!phydev) {
-                printk(KERN_ERR "%s: Could not attach to PHY\n", dev->name);
+                dev_err(&dev->dev, "Could not attach to PHY\n");
-                return PTR_ERR(phydev);
+                return -ENODEV;
        }
        fep->phydev = phydev;
@@ -1005,6 +1004,7 @@ static int __devinit fs_enet_probe(struct of_device *ofdev,
                goto out_free_fpi;
        }
+        SET_NETDEV_DEV(ndev, &ofdev->dev);
        dev_set_drvdata(&ofdev->dev, ndev);
        fep = netdev_priv(ndev);
diff --git a/drivers/net/gianfar.c b/drivers/net/gianfar.c
index 43d813ed9f4..f8ffcbf0bc3 100644
--- a/drivers/net/gianfar.c
+++ b/drivers/net/gianfar.c
@@ -264,15 +264,6 @@ static int gfar_of_init(struct net_device *dev)
                priv->device_flags |= FSL_GIANFAR_DEV_HAS_MAGIC_PACKET;
        priv->phy_node = of_parse_phandle(np, "phy-handle", 0);
-        if (!priv->phy_node) {
-                u32 *fixed_link;
-                fixed_link = (u32 *)of_get_property(np, "fixed-link", NULL);
-                if (!fixed_link) {
-                        err = -ENODEV;
-                        goto err_out;
-                }
-        }
        /* Find the TBI PHY.  If it's not there, we don't support SGMII */
        priv->tbi_node = of_parse_phandle(np, "tbi-handle", 0);
@@ -659,13 +650,14 @@ static int init_phy(struct net_device *dev)
        interface = gfar_get_interface(dev);
-        if (priv->phy_node) {
+        priv->phydev = of_phy_connect(dev, priv->phy_node, &adjust_link, 0,
-                priv->phydev = of_phy_connect(dev, priv->phy_node, &adjust_link,
+                                      interface);
-                                              0, interface);
+        if (!priv->phydev)
-                if (!priv->phydev) {
+                priv->phydev = of_phy_connect_fixed_link(dev, &adjust_link,
-                        dev_err(&dev->dev, "error: Could not attach to PHY\n");
+                                                         interface);
-                        return -ENODEV;
+        if (!priv->phydev) {
-                }
+                dev_err(&dev->dev, "could not attach to PHY\n");
+                return -ENODEV;
        }
        if (interface == PHY_INTERFACE_MODE_SGMII)
diff --git a/drivers/net/ixgbe/ixgbe.h b/drivers/net/ixgbe/ixgbe.h
index cd22323cfd2..1b12c7ba275 100644
--- a/drivers/net/ixgbe/ixgbe.h
+++ b/drivers/net/ixgbe/ixgbe.h
@@ -327,6 +327,7 @@ struct ixgbe_adapter {
 #define IXGBE_FLAG_IN_SFP_MOD_TASK              (u32)(1 << 25)
 #define IXGBE_FLAG_FDIR_HASH_CAPABLE            (u32)(1 << 26)
 #define IXGBE_FLAG_FDIR_PERFECT_CAPABLE         (u32)(1 << 27)
+#define IXGBE_FLAG_FCOE_CAPABLE                 (u32)(1 << 28)
 #define IXGBE_FLAG_FCOE_ENABLED                 (u32)(1 << 29)
        u32 flags2;
diff --git a/drivers/net/ixgbe/ixgbe_dcb_nl.c b/drivers/net/ixgbe/ixgbe_dcb_nl.c
index da2c8514b8d..1c726573290 100644
--- a/drivers/net/ixgbe/ixgbe_dcb_nl.c
+++ b/drivers/net/ixgbe/ixgbe_dcb_nl.c
@@ -139,6 +139,18 @@ static u8 ixgbe_dcbnl_set_state(struct net_device *netdev, u8 state)
                        adapter->flags &= ~IXGBE_FLAG_FDIR_PERFECT_CAPABLE;
                }
                adapter->flags |= IXGBE_FLAG_DCB_ENABLED;
+#ifdef IXGBE_FCOE
+                /* Turn on FCoE offload */
+                if ((adapter->flags & IXGBE_FLAG_FCOE_CAPABLE) &&
+                    (!(adapter->flags & IXGBE_FLAG_FCOE_ENABLED))) {
+                        adapter->flags |= IXGBE_FLAG_FCOE_ENABLED;
+                        adapter->ring_feature[RING_F_FCOE].indices =
+                                IXGBE_FCRETA_SIZE;
+                        netdev->features |= NETIF_F_FCOE_CRC;
+                        netdev->features |= NETIF_F_FSO;
+                        netdev->fcoe_ddp_xid = IXGBE_FCOE_DDP_MAX - 1;
+                }
+#endif /* IXGBE_FCOE */
                ixgbe_init_interrupt_scheme(adapter);
                if (netif_running(netdev))
                        netdev->netdev_ops->ndo_open(netdev);
@@ -156,6 +168,18 @@ static u8 ixgbe_dcbnl_set_state(struct net_device *netdev, u8 state)
                        adapter->flags |= IXGBE_FLAG_RSS_ENABLED;
                        if (adapter->hw.mac.type == ixgbe_mac_82599EB)
                                adapter->flags |= IXGBE_FLAG_FDIR_HASH_CAPABLE;
+#ifdef IXGBE_FCOE
+                        /* Turn off FCoE offload */
+                        if (adapter->flags & (IXGBE_FLAG_FCOE_CAPABLE |
+                             IXGBE_FLAG_FCOE_ENABLED)) {
+                                adapter->flags &= ~IXGBE_FLAG_FCOE_ENABLED;
+                                adapter->ring_feature[RING_F_FCOE].indices = 0;
+                                netdev->features &= ~NETIF_F_FCOE_CRC;
+                                netdev->features &= ~NETIF_F_FSO;
+                                netdev->fcoe_ddp_xid = 0;
+                        }
+#endif /* IXGBE_FCOE */
                        ixgbe_init_interrupt_scheme(adapter);
                        if (netif_running(netdev))
                                netdev->netdev_ops->ndo_open(netdev);
diff --git a/drivers/net/ixgbe/ixgbe_main.c b/drivers/net/ixgbe/ixgbe_main.c
index e3442f47f93..200454f30f6 100644
--- a/drivers/net/ixgbe/ixgbe_main.c
+++ b/drivers/net/ixgbe/ixgbe_main.c
@@ -34,6 +34,7 @@
 #include <linux/in.h>
 #include <linux/ip.h>
 #include <linux/tcp.h>
+#include <linux/pkt_sched.h>
 #include <linux/ipv6.h>
 #include <net/checksum.h>
 #include <net/ip6_checksum.h>
@@ -510,8 +511,11 @@ static void ixgbe_receive_skb(struct ixgbe_q_vector *q_vector,
 * @skb: skb currently being received and modified
 **/
 static inline void ixgbe_rx_checksum(struct ixgbe_adapter *adapter,
-                                     u32 status_err, struct sk_buff *skb)
+                                     union ixgbe_adv_rx_desc *rx_desc,
+                                     struct sk_buff *skb)
 {
+        u32 status_err = le32_to_cpu(rx_desc->wb.upper.status_error);
        skb->ip_summed = CHECKSUM_NONE;
        /* Rx csum disabled */
@@ -529,6 +533,16 @@ static inline void ixgbe_rx_checksum(struct ixgbe_adapter *adapter,
                return;
        if (status_err & IXGBE_RXDADV_ERR_TCPE) {
+                u16 pkt_info = rx_desc->wb.lower.lo_dword.hs_rss.pkt_info;
+                /*
+                 * 82599 errata, UDP frames with a 0 checksum can be marked as
+                 * checksum errors.
+                 */
+                if ((pkt_info & IXGBE_RXDADV_PKTTYPE_UDP) &&
+                    (adapter->hw.mac.type == ixgbe_mac_82599EB))
+                        return;
                adapter->hw_csum_rx_error++;
                return;
        }
@@ -802,7 +816,7 @@ static bool ixgbe_clean_rx_irq(struct ixgbe_q_vector *q_vector,
                        goto next_desc;
                }
-                ixgbe_rx_checksum(adapter, staterr, skb);
+                ixgbe_rx_checksum(adapter, rx_desc, skb);
                /* probably a little skewed due to removing CRC */
                total_rx_bytes += skb->len;
@@ -3806,8 +3820,9 @@ static int __devinit ixgbe_sw_init(struct ixgbe_adapter *adapter)
                adapter->atr_sample_rate = 20;
                adapter->fdir_pballoc = 0;
 #ifdef IXGBE_FCOE
-                adapter->flags |= IXGBE_FLAG_FCOE_ENABLED;
+                adapter->flags |= IXGBE_FLAG_FCOE_CAPABLE;
-                adapter->ring_feature[RING_F_FCOE].indices = IXGBE_FCRETA_SIZE;
+                adapter->flags &= ~IXGBE_FLAG_FCOE_ENABLED;
+                adapter->ring_feature[RING_F_FCOE].indices = 0;
 #endif /* IXGBE_FCOE */
        }
@@ -5125,9 +5140,6 @@ static int ixgbe_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
        int count = 0;
        unsigned int f;
-        r_idx = skb->queue_mapping;
-        tx_ring = &adapter->tx_ring[r_idx];
        if (adapter->vlgrp && vlan_tx_tag_present(skb)) {
                tx_flags |= vlan_tx_tag_get(skb);
                if (adapter->flags & IXGBE_FLAG_DCB_ENABLED) {
@@ -5137,11 +5149,19 @@ static int ixgbe_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
                tx_flags <<= IXGBE_TX_FLAGS_VLAN_SHIFT;
                tx_flags |= IXGBE_TX_FLAGS_VLAN;
        } else if (adapter->flags & IXGBE_FLAG_DCB_ENABLED) {
-                tx_flags |= (skb->queue_mapping << 13);
+                if (skb->priority != TC_PRIO_CONTROL) {
-                tx_flags <<= IXGBE_TX_FLAGS_VLAN_SHIFT;
+                        tx_flags |= (skb->queue_mapping << 13);
-                tx_flags |= IXGBE_TX_FLAGS_VLAN;
+                        tx_flags <<= IXGBE_TX_FLAGS_VLAN_SHIFT;
+                        tx_flags |= IXGBE_TX_FLAGS_VLAN;
+                } else {
+                        skb->queue_mapping =
+                                adapter->ring_feature[RING_F_DCB].indices-1;
+                }
        }
+        r_idx = skb->queue_mapping;
+        tx_ring = &adapter->tx_ring[r_idx];
        if ((adapter->flags & IXGBE_FLAG_FCOE_ENABLED) &&
            (skb->protocol == htons(ETH_P_FCOE)))
                tx_flags |= IXGBE_TX_FLAGS_FCOE;
@@ -5580,16 +5600,11 @@ static int __devinit ixgbe_probe(struct pci_dev *pdev,
 #endif
 #ifdef IXGBE_FCOE
-        if (adapter->flags & IXGBE_FLAG_FCOE_ENABLED) {
+        if (adapter->flags & IXGBE_FLAG_FCOE_CAPABLE) {
                if (hw->mac.ops.get_device_caps) {
                        hw->mac.ops.get_device_caps(hw, &device_caps);
-                        if (!(device_caps & IXGBE_DEVICE_CAPS_FCOE_OFFLOADS)) {
+                        if (device_caps & IXGBE_DEVICE_CAPS_FCOE_OFFLOADS)
-                                netdev->features |= NETIF_F_FCOE_CRC;
+                                adapter->flags &= ~IXGBE_FLAG_FCOE_CAPABLE;
-                                netdev->features |= NETIF_F_FSO;
-                                netdev->fcoe_ddp_xid = IXGBE_FCOE_DDP_MAX - 1;
-                        } else {
-                                adapter->flags &= ~IXGBE_FLAG_FCOE_ENABLED;
-                        }
                }
        }
 #endif /* IXGBE_FCOE */
@@ -5638,7 +5653,6 @@ static int __devinit ixgbe_probe(struct pci_dev *pdev,
                adapter->wol = 0;
                break;
        }
-        device_init_wakeup(&adapter->pdev->dev, true);
        device_set_wakeup_enable(&adapter->pdev->dev, adapter->wol);
        /* pick up the PCI bus settings for reporting later */
diff --git a/drivers/net/netxen/netxen_nic_init.c b/drivers/net/netxen/netxen_nic_init.c
index 5d3343ef3d8..7acf204e38c 100644
--- a/drivers/net/netxen/netxen_nic_init.c
+++ b/drivers/net/netxen/netxen_nic_init.c
@@ -184,6 +184,13 @@ void netxen_free_sw_resources(struct netxen_adapter *adapter)
        kfree(recv_ctx->rds_rings);
 skip_rds:
+        if (recv_ctx->sds_rings == NULL)
+                goto skip_sds;
+        for(ring = 0; ring < adapter->max_sds_rings; ring++)
+                recv_ctx->sds_rings[ring].consumer = 0;
+skip_sds:
        if (adapter->tx_ring == NULL)
                return;
diff --git a/drivers/net/phy/mdio-gpio.c b/drivers/net/phy/mdio-gpio.c
index 33984b73723..22cdd451fb8 100644
--- a/drivers/net/phy/mdio-gpio.c
+++ b/drivers/net/phy/mdio-gpio.c
@@ -30,6 +30,7 @@
 #ifdef CONFIG_OF_GPIO
 #include <linux/of_gpio.h>
+#include <linux/of_mdio.h>
 #include <linux/of_platform.h>
 #endif
@@ -81,13 +82,12 @@ static struct mdiobb_ops mdio_gpio_ops = {
        .get_mdio_data = mdio_get,
 };
-static int __devinit mdio_gpio_bus_init(struct device *dev,
+static struct mii_bus * __devinit mdio_gpio_bus_init(struct device *dev,
                                        struct mdio_gpio_platform_data *pdata,
                                        int bus_id)
 {
        struct mii_bus *new_bus;
        struct mdio_gpio_info *bitbang;
-        int ret = -ENOMEM;
        int i;
        bitbang = kzalloc(sizeof(*bitbang), GFP_KERNEL);
@@ -104,8 +104,6 @@ static int __devinit mdio_gpio_bus_init(struct device *dev,
        new_bus->name = "GPIO Bitbanged MDIO",
-        ret = -ENODEV;
        new_bus->phy_mask = pdata->phy_mask;
        new_bus->irq = pdata->irqs;
        new_bus->parent = dev;
@@ -129,15 +127,8 @@ static int __devinit mdio_gpio_bus_init(struct device *dev,
        dev_set_drvdata(dev, new_bus);
-        ret = mdiobus_register(new_bus);
+        return new_bus;
-        if (ret)
-                goto out_free_all;
-        return 0;
-out_free_all:
-        dev_set_drvdata(dev, NULL);
-        gpio_free(bitbang->mdio);
 out_free_mdc:
        gpio_free(bitbang->mdc);
 out_free_bus:
@@ -145,30 +136,47 @@ out_free_bus:
 out_free_bitbang:
        kfree(bitbang);
 out:
-        return ret;
+        return NULL;
 }
-static void __devexit mdio_gpio_bus_destroy(struct device *dev)
+static void __devinit mdio_gpio_bus_deinit(struct device *dev)
 {
        struct mii_bus *bus = dev_get_drvdata(dev);
        struct mdio_gpio_info *bitbang = bus->priv;
-        mdiobus_unregister(bus);
-        free_mdio_bitbang(bus);
        dev_set_drvdata(dev, NULL);
-        gpio_free(bitbang->mdc);
        gpio_free(bitbang->mdio);
+        gpio_free(bitbang->mdc);
+        free_mdio_bitbang(bus);
        kfree(bitbang);
 }
+static void __devexit mdio_gpio_bus_destroy(struct device *dev)
+{
+        struct mii_bus *bus = dev_get_drvdata(dev);
+        mdiobus_unregister(bus);
+        mdio_gpio_bus_deinit(dev);
+}
 static int __devinit mdio_gpio_probe(struct platform_device *pdev)
 {
        struct mdio_gpio_platform_data *pdata = pdev->dev.platform_data;
+        struct mii_bus *new_bus;
+        int ret;
        if (!pdata)
                return -ENODEV;
-        return mdio_gpio_bus_init(&pdev->dev, pdata, pdev->id);
+        new_bus = mdio_gpio_bus_init(&pdev->dev, pdata, pdev->id);
+        if (!new_bus)
+                return -ENODEV;
+        ret = mdiobus_register(new_bus);
+        if (ret)
+                mdio_gpio_bus_deinit(&pdev->dev);
+        return ret;
 }
 static int __devexit mdio_gpio_remove(struct platform_device *pdev)
@@ -179,29 +187,12 @@ static int __devexit mdio_gpio_remove(struct platform_device *pdev)
 }
 #ifdef CONFIG_OF_GPIO
-static void __devinit add_phy(struct mdio_gpio_platform_data *pdata,
-                              struct device_node *np)
-{
-        const u32 *data;
-        int len, id, irq;
-        data = of_get_property(np, "reg", &len);
-        if (!data || len != 4)
-                return;
-        id = *data;
-        pdata->phy_mask &= ~(1 << id);
-        irq = of_irq_to_resource(np, 0, NULL);
-        if (irq)
-                pdata->irqs[id] = irq;
-}
 static int __devinit mdio_ofgpio_probe(struct of_device *ofdev,
                                        const struct of_device_id *match)
 {
-        struct device_node *np = NULL;
        struct mdio_gpio_platform_data *pdata;
+        struct mii_bus *new_bus;
        int ret;
        pdata = kzalloc(sizeof(*pdata), GFP_KERNEL);
@@ -215,14 +206,18 @@ static int __devinit mdio_ofgpio_probe(struct of_device *ofdev,
        ret = of_get_gpio(ofdev->node, 1);
        if (ret < 0)
-                goto out_free;
+                goto out_free;
        pdata->mdio = ret;
-        while ((np = of_get_next_child(ofdev->node, np)))
+        new_bus = mdio_gpio_bus_init(&ofdev->dev, pdata, pdata->mdc);
-                if (!strcmp(np->type, "ethernet-phy"))
+        if (!new_bus)
-                        add_phy(pdata, np);
+                return -ENODEV;
-        return mdio_gpio_bus_init(&ofdev->dev, pdata, pdata->mdc);
+        ret = of_mdiobus_register(new_bus, ofdev->node);
+        if (ret)
+                mdio_gpio_bus_deinit(&ofdev->dev);
+        return ret;
 out_free:
        kfree(pdata);
diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
index 4b53b58d75f..b82780d805f 100644
--- a/drivers/net/r8169.c
+++ b/drivers/net/r8169.c
@@ -2060,8 +2060,6 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
                }
        }
-        pci_set_master(pdev);
        /* ioremap MMIO region */
        ioaddr = ioremap(pci_resource_start(pdev, region), R8169_REGS_SIZE);
        if (!ioaddr) {
@@ -2089,6 +2087,8 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
        RTL_W16(IntrStatus, 0xffff);
+        pci_set_master(pdev);
        /* Identify chip attached to board */
        rtl8169_get_mac_version(tp, ioaddr);
@@ -3874,6 +3874,15 @@ static void rtl_shutdown(struct pci_dev *pdev)
        spin_unlock_irq(&tp->lock);
        if (system_state == SYSTEM_POWER_OFF) {
+                /* WoL fails with some 8168 when the receiver is disabled. */
+                if (tp->features & RTL_FEATURE_WOL) {
+                        pci_clear_master(pdev);
+                        RTL_W8(ChipCmd, CmdRxEnb);
+                        /* PCI commit */
+                        RTL_R8(ChipCmd);
+                }
                pci_wake_from_d3(pdev, true);
                pci_set_power_state(pdev, PCI_D3hot);
        }
diff --git a/drivers/net/skge.c b/drivers/net/skge.c
index 60d502eef4f..543af2044f4 100644
--- a/drivers/net/skge.c
+++ b/drivers/net/skge.c
@@ -3854,8 +3854,10 @@ static struct net_device *skge_devinit(struct skge_hw *hw, int port,
        skge->speed = -1;
        skge->advertising = skge_supported_modes(hw);
-        if (device_may_wakeup(&hw->pdev->dev))
+        if (device_can_wakeup(&hw->pdev->dev)) {
                skge->wol = wol_supported(hw) & WAKE_MAGIC;
+                device_set_wakeup_enable(&hw->pdev->dev, skge->wol);
+        }
        hw->dev[port] = dev;
diff --git a/drivers/net/smc91x.h b/drivers/net/smc91x.h
index f1f773b17fe..57a159fac99 100644
--- a/drivers/net/smc91x.h
+++ b/drivers/net/smc91x.h
@@ -186,7 +186,8 @@ static inline void SMC_outw(u16 val, void __iomem *ioaddr, int reg)
 #define SMC_outsb(a, r, p, l)   writesb((a) + (r), p, (l))
 #define SMC_IRQ_FLAGS           (-1)    /* from resource */
-#elif   defined(CONFIG_MACH_LOGICPD_PXA270)
+#elif   defined(CONFIG_MACH_LOGICPD_PXA270) \
+        || defined(CONFIG_MACH_NOMADIK_8815NHK)
 #define SMC_CAN_USE_8BIT        0
 #define SMC_CAN_USE_16BIT       1
diff --git a/drivers/net/tokenring/ibmtr.c b/drivers/net/tokenring/ibmtr.c
index 9d896116cf7..08a6c41c159 100644
--- a/drivers/net/tokenring/ibmtr.c
+++ b/drivers/net/tokenring/ibmtr.c
@@ -1912,7 +1912,7 @@ static int __init ibmtr_init(void)
        find_turbo_adapters(io);
-        for (i = 0; io[i] && (i < IBMTR_MAX_ADAPTERS); i++) {
+        for (i = 0; i < IBMTR_MAX_ADAPTERS && io[i]; i++) {
                struct net_device *dev;
                irq[i] = 0;
                mem[i] = 0;
diff --git a/drivers/net/ucc_geth.c b/drivers/net/ucc_geth.c
index 40c6eba775c..3b957e6412e 100644
--- a/drivers/net/ucc_geth.c
+++ b/drivers/net/ucc_geth.c
@@ -1590,13 +1590,13 @@ static int init_phy(struct net_device *dev)
        priv->oldspeed = 0;
        priv->oldduplex = -1;
-        if (!ug_info->phy_node)
-                return 0;
        phydev = of_phy_connect(dev, ug_info->phy_node, &adjust_link, 0,
                                priv->phy_interface);
+        if (!phydev)
+                phydev = of_phy_connect_fixed_link(dev, &adjust_link,
+                                                   priv->phy_interface);
        if (!phydev) {
-                printk("%s: Could not attach to PHY\n", dev->name);
+                dev_err(&dev->dev, "Could not attach to PHY\n");
                return -ENODEV;
        }
@@ -3608,9 +3608,7 @@ static int ucc_geth_probe(struct of_device* ofdev, const struct of_device_id *ma
        struct ucc_geth_private *ugeth = NULL;
        struct ucc_geth_info *ug_info;
        struct resource res;
-        struct device_node *phy;
        int err, ucc_num, max_speed = 0;
-        const u32 *fixed_link;
        const unsigned int *prop;
        const char *sprop;
        const void *mac_addr;
@@ -3708,15 +3706,8 @@ static int ucc_geth_probe(struct of_device* ofdev, const struct of_device_id *ma
        ug_info->uf_info.regs = res.start;
        ug_info->uf_info.irq = irq_of_parse_and_map(np, 0);
-        fixed_link = of_get_property(np, "fixed-link", NULL);
-        if (fixed_link) {
+        ug_info->phy_node = of_parse_phandle(np, "phy-handle", 0);
-                phy = NULL;
-        } else {
-                phy = of_parse_phandle(np, "phy-handle", 0);
-                if (phy == NULL)
-                        return -ENODEV;
-        }
-        ug_info->phy_node = phy;
        /* Find the TBI PHY node.  If it's not there, we don't support SGMII */
        ug_info->tbi_node = of_parse_phandle(np, "tbi-handle", 0);
@@ -3725,7 +3716,7 @@ static int ucc_geth_probe(struct of_device* ofdev, const struct of_device_id *ma
        prop = of_get_property(np, "phy-connection-type", NULL);
        if (!prop) {
                /* handle interface property present in old trees */
-                prop = of_get_property(phy, "interface", NULL);
+                prop = of_get_property(ug_info->phy_node, "interface", NULL);
                if (prop != NULL) {
                        phy_interface = enet_to_phy_interface[*prop];
                        max_speed = enet_to_speed[*prop];
diff --git a/drivers/net/wireless/ath/ath5k/base.c b/drivers/net/wireless/ath/ath5k/base.c
index ea045151f95..029c1bc7468 100644
--- a/drivers/net/wireless/ath/ath5k/base.c
+++ b/drivers/net/wireless/ath/ath5k/base.c
@@ -2970,6 +2970,9 @@ ath5k_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
        if (modparam_nohwcrypt)
                return -EOPNOTSUPP;
+        if (sc->opmode == NL80211_IFTYPE_AP)
+                return -EOPNOTSUPP;
        switch (key->alg) {
        case ALG_WEP:
        case ALG_TKIP:
diff --git a/drivers/net/wireless/ath/ath9k/ani.c b/drivers/net/wireless/ath/ath9k/ani.c
index 1aeafb511dd..aad259b4c19 100644
--- a/drivers/net/wireless/ath/ath9k/ani.c
+++ b/drivers/net/wireless/ath/ath9k/ani.c
@@ -478,6 +478,18 @@ void ath9k_ani_reset(struct ath_hw *ah)
                        "Reset ANI state opmode %u\n", ah->opmode);
                ah->stats.ast_ani_reset++;
+                if (ah->opmode == NL80211_IFTYPE_AP) {
+                        /*
+                         * ath9k_hw_ani_control() will only process items set on
+                         * ah->ani_function
+                         */
+                        if (IS_CHAN_2GHZ(chan))
+                                ah->ani_function = (ATH9K_ANI_SPUR_IMMUNITY_LEVEL |
+                                                    ATH9K_ANI_FIRSTEP_LEVEL);
+                        else
+                                ah->ani_function = 0;
+                }
                ath9k_hw_ani_control(ah, ATH9K_ANI_NOISE_IMMUNITY_LEVEL, 0);
                ath9k_hw_ani_control(ah, ATH9K_ANI_SPUR_IMMUNITY_LEVEL, 0);
                ath9k_hw_ani_control(ah, ATH9K_ANI_FIRSTEP_LEVEL, 0);
diff --git a/drivers/net/wireless/ath/regd.c b/drivers/net/wireless/ath/regd.c
index eef370bd121..bf3d25ba7be 100644
--- a/drivers/net/wireless/ath/regd.c
+++ b/drivers/net/wireless/ath/regd.c
@@ -474,6 +474,21 @@ ath_regd_init_wiphy(struct ath_regulatory *reg,
        return 0;
 }
+/*
+ * Some users have reported their EEPROM programmed with
+ * 0x8000 set, this is not a supported regulatory domain
+ * but since we have more than one user with it we need
+ * a solution for them. We default to 0x64, which is the
+ * default Atheros world regulatory domain.
+ */
+static void ath_regd_sanitize(struct ath_regulatory *reg)
+{
+        if (reg->current_rd != COUNTRY_ERD_FLAG)
+                return;
+        printk(KERN_DEBUG "ath: EEPROM regdomain sanitized\n");
+        reg->current_rd = 0x64;
+}
 int
 ath_regd_init(struct ath_regulatory *reg,
              struct wiphy *wiphy,
@@ -486,6 +501,8 @@ ath_regd_init(struct ath_regulatory *reg,
        if (!reg)
                return -EINVAL;
+        ath_regd_sanitize(reg);
        printk(KERN_DEBUG "ath: EEPROM regdomain: 0x%0x\n", reg->current_rd);
        if (!ath_regd_is_eeprom_valid(reg)) {
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index 6d1519e1f01..355f50ea7fe 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -2675,12 +2675,10 @@ static ssize_t show_power_level(struct device *d,
                                struct device_attribute *attr, char *buf)
 {
        struct iwl_priv *priv = dev_get_drvdata(d);
-        int mode = priv->power_data.user_power_setting;
        int level = priv->power_data.power_mode;
        char *p = buf;
-        p += sprintf(p, "INDEX:%d\t", level);
+        p += sprintf(p, "%d\n", level);
-        p += sprintf(p, "USER:%d\n", mode);
        return p - buf + 1;
 }
diff --git a/drivers/net/wireless/iwlwifi/iwl-tx.c b/drivers/net/wireless/iwlwifi/iwl-tx.c
index 85ae7a62109..9bbeec9427f 100644
--- a/drivers/net/wireless/iwlwifi/iwl-tx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-tx.c
@@ -872,7 +872,8 @@ int iwl_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
        iwl_print_hex_dump(priv, IWL_DL_TX, (u8 *)tx_cmd->hdr, hdr_len);
        /* Set up entry for this TFD in Tx byte-count array */
-        priv->cfg->ops->lib->txq_update_byte_cnt_tbl(priv, txq,
+        if (info->flags & IEEE80211_TX_CTL_AMPDU)
+                priv->cfg->ops->lib->txq_update_byte_cnt_tbl(priv, txq,
                                                     le16_to_cpu(tx_cmd->len));
        pci_dma_sync_single_for_device(priv->pci_dev, txcmd_phys,
diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
index cb9bd4c8f25..956798f2c80 100644
--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -3643,12 +3643,10 @@ static ssize_t show_power_level(struct device *d,
                                struct device_attribute *attr, char *buf)
 {
        struct iwl_priv *priv = dev_get_drvdata(d);
-        int mode = priv->power_data.user_power_setting;
        int level = priv->power_data.power_mode;
        char *p = buf;
-        p += sprintf(p, "INDEX:%d\t", level);
+        p += sprintf(p, "%d\n", level);
-        p += sprintf(p, "USER:%d\n", mode);
        return p - buf + 1;
 }
diff --git a/drivers/net/wireless/iwmc3200wifi/netdev.c b/drivers/net/wireless/iwmc3200wifi/netdev.c
index aaa20c6885c..aea5ccf24cc 100644
--- a/drivers/net/wireless/iwmc3200wifi/netdev.c
+++ b/drivers/net/wireless/iwmc3200wifi/netdev.c
@@ -151,8 +151,8 @@ void iwm_if_free(struct iwm_priv *iwm)
                return;
        free_netdev(iwm_to_ndev(iwm));
-        iwm_wdev_free(iwm);
        iwm_priv_deinit(iwm);
+        iwm_wdev_free(iwm);
 }
 int iwm_if_add(struct iwm_priv *iwm)
diff --git a/drivers/net/wireless/libertas/cmd.c b/drivers/net/wireless/libertas/cmd.c
index 01db705a38e..685098148e1 100644
--- a/drivers/net/wireless/libertas/cmd.c
+++ b/drivers/net/wireless/libertas/cmd.c
@@ -135,8 +135,14 @@ int lbs_update_hw_spec(struct lbs_private *priv)
        /* Clamp region code to 8-bit since FW spec indicates that it should
         * only ever be 8-bit, even though the field size is 16-bit.  Some firmware
         * returns non-zero high 8 bits here.
+         *
+         * Firmware version 4.0.102 used in CF8381 has region code shifted.  We
+         * need to check for this problem and handle it properly.
         */
-        priv->regioncode = le16_to_cpu(cmd.regioncode) & 0xFF;
+        if (MRVL_FW_MAJOR_REV(priv->fwrelease) == MRVL_FW_V4)
+                priv->regioncode = (le16_to_cpu(cmd.regioncode) >> 8) & 0xFF;
+        else
+                priv->regioncode = le16_to_cpu(cmd.regioncode) & 0xFF;
        for (i = 0; i < MRVDRV_MAX_REGION_CODE; i++) {
                /* use the region code to search for the index */
diff --git a/drivers/net/wireless/libertas/defs.h b/drivers/net/wireless/libertas/defs.h
index 48da157d6cd..72f3479a4d7 100644
--- a/drivers/net/wireless/libertas/defs.h
+++ b/drivers/net/wireless/libertas/defs.h
@@ -234,6 +234,8 @@ static inline void lbs_deb_hex(unsigned int grp, const char *prompt, u8 *buf, in
 /** Mesh enable bit in FW capability */
 #define MESH_CAPINFO_ENABLE_MASK                        (1<<16)
+/** FW definition from Marvell v4 */
+#define MRVL_FW_V4                                      (0x04)
 /** FW definition from Marvell v5 */
 #define MRVL_FW_V5                                      (0x05)
 /** FW definition from Marvell v10 */
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index a111bda392e..7916ca3f84c 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -709,7 +709,7 @@ static const struct ieee80211_ops mac80211_hwsim_ops =
 static void mac80211_hwsim_free(void)
 {
        struct list_head tmplist, *i, *tmp;
-        struct mac80211_hwsim_data *data;
+        struct mac80211_hwsim_data *data, *tmpdata;
        INIT_LIST_HEAD(&tmplist);
@@ -718,7 +718,7 @@ static void mac80211_hwsim_free(void)
                list_move(i, &tmplist);
        spin_unlock_bh(&hwsim_radio_lock);
-        list_for_each_entry(data, &tmplist, list) {
+        list_for_each_entry_safe(data, tmpdata, &tmplist, list) {
                debugfs_remove(data->debugfs_group);
                debugfs_remove(data->debugfs_ps);
                debugfs_remove(data->debugfs);
@@ -1167,8 +1167,8 @@ static void __exit exit_mac80211_hwsim(void)
 {
        printk(KERN_DEBUG "mac80211_hwsim: unregister radios\n");
-        unregister_netdev(hwsim_mon);
        mac80211_hwsim_free();
+        unregister_netdev(hwsim_mon);
 }
diff --git a/drivers/net/wireless/p54/p54spi.c b/drivers/net/wireless/p54/p54spi.c
index 83116baeb11..72c7dbd39d0 100644
--- a/drivers/net/wireless/p54/p54spi.c
+++ b/drivers/net/wireless/p54/p54spi.c
@@ -635,7 +635,7 @@ static int __devinit p54spi_probe(struct spi_device *spi)
        hw = p54_init_common(sizeof(*priv));
        if (!hw) {
-                dev_err(&priv->spi->dev, "could not alloc ieee80211_hw");
+                dev_err(&spi->dev, "could not alloc ieee80211_hw");
                return -ENOMEM;
        }
diff --git a/drivers/net/wireless/rt2x00/rt2500usb.c b/drivers/net/wireless/rt2x00/rt2500usb.c
index 66daf68ff0e..ce75426764a 100644
--- a/drivers/net/wireless/rt2x00/rt2500usb.c
+++ b/drivers/net/wireless/rt2x00/rt2500usb.c
@@ -1550,7 +1550,9 @@ static int rt2500usb_init_eeprom(struct rt2x00_dev *rt2x00dev)
        rt2500usb_register_read(rt2x00dev, MAC_CSR0, &reg);
        rt2x00_set_chip(rt2x00dev, RT2570, value, reg);
-        if (!rt2x00_check_rev(&rt2x00dev->chip, 0x000ffff0, 0)) {
+        if (!rt2x00_check_rev(&rt2x00dev->chip, 0x000ffff0, 0) ||
+            rt2x00_check_rev(&rt2x00dev->chip, 0x0000000f, 0)) {
                ERROR(rt2x00dev, "Invalid RT chipset detected.\n");
                return -ENODEV;
        }
diff --git a/drivers/net/wireless/rtl818x/rtl8187_leds.c b/drivers/net/wireless/rtl818x/rtl8187_leds.c
index b4425359224..cf9f899fe0e 100644
--- a/drivers/net/wireless/rtl818x/rtl8187_leds.c
+++ b/drivers/net/wireless/rtl818x/rtl8187_leds.c
@@ -208,11 +208,12 @@ void rtl8187_leds_exit(struct ieee80211_hw *dev)
 {
        struct rtl8187_priv *priv = dev->priv;
-        rtl8187_unregister_led(&priv->led_tx);
        /* turn the LED off before exiting */
        queue_delayed_work(dev->workqueue, &priv->led_off, 0);
        cancel_delayed_work_sync(&priv->led_off);
+        cancel_delayed_work_sync(&priv->led_on);
        rtl8187_unregister_led(&priv->led_rx);
+        rtl8187_unregister_led(&priv->led_tx);
 }
 #endif /* def CONFIG_RTL8187_LED */
diff --git a/drivers/of/of_mdio.c b/drivers/of/of_mdio.c
index aee967d7f76..bacaa536fd5 100644
--- a/drivers/of/of_mdio.c
+++ b/drivers/of/of_mdio.c
@@ -9,6 +9,10 @@
 * out of the OpenFirmware device tree and using it to populate an mii_bus.
 */
+#include <linux/kernel.h>
+#include <linux/device.h>
+#include <linux/netdevice.h>
+#include <linux/err.h>
 #include <linux/phy.h>
 #include <linux/of.h>
 #include <linux/of_mdio.h>
@@ -137,3 +141,41 @@ struct phy_device *of_phy_connect(struct net_device *dev,
        return phy_connect_direct(dev, phy, hndlr, flags, iface) ? NULL : phy;
 }
 EXPORT_SYMBOL(of_phy_connect);
+/**
+ * of_phy_connect_fixed_link - Parse fixed-link property and return a dummy phy
+ * @dev: pointer to net_device claiming the phy
+ * @hndlr: Link state callback for the network device
+ * @iface: PHY data interface type
+ *
+ * This function is a temporary stop-gap and will be removed soon.  It is
+ * only to support the fs_enet, ucc_geth and gianfar Ethernet drivers.  Do
+ * not call this function from new drivers.
+ */
+struct phy_device *of_phy_connect_fixed_link(struct net_device *dev,
+                                             void (*hndlr)(struct net_device *),
+                                             phy_interface_t iface)
+{
+        struct device_node *net_np;
+        char bus_id[MII_BUS_ID_SIZE + 3];
+        struct phy_device *phy;
+        const u32 *phy_id;
+        int sz;
+        if (!dev->dev.parent)
+                return NULL;
+        net_np = dev_archdata_get_node(&dev->dev.parent->archdata);
+        if (!net_np)
+                return NULL;
+        phy_id = of_get_property(net_np, "fixed-link", &sz);
+        if (!phy_id || sz < sizeof(*phy_id))
+                return NULL;
+        sprintf(bus_id, PHY_ID_FMT, "0", phy_id[0]);
+        phy = phy_connect(dev, bus_id, hndlr, 0, iface);
+        return IS_ERR(phy) ? NULL : phy;
+}
+EXPORT_SYMBOL(of_phy_connect_fixed_link);
diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c
index be2fd6f9163..fb45f5ee8df 100644
--- a/drivers/platform/x86/acer-wmi.c
+++ b/drivers/platform/x86/acer-wmi.c
@@ -973,7 +973,7 @@ static int acer_rfkill_set(void *data, bool blocked)
 {
        acpi_status status;
        u32 cap = (unsigned long)data;
-        status = set_u32(!!blocked, cap);
+        status = set_u32(!blocked, cap);
        if (ACPI_FAILURE(status))
                return -ENODEV;
        return 0;
diff --git a/include/linux/of_mdio.h b/include/linux/of_mdio.h
index c9663c69030..53b94e025c7 100644
--- a/include/linux/of_mdio.h
+++ b/include/linux/of_mdio.h
@@ -18,5 +18,8 @@ extern struct phy_device *of_phy_connect(struct net_device *dev,
                                         struct device_node *phy_np,
                                         void (*hndlr)(struct net_device *),
                                         u32 flags, phy_interface_t iface);
+extern struct phy_device *of_phy_connect_fixed_link(struct net_device *dev,
+                                         void (*hndlr)(struct net_device *),
+                                         phy_interface_t iface);
 #endif /* __LINUX_OF_MDIO_H */
diff --git a/include/linux/rfkill.h b/include/linux/rfkill.h
index 2ce29831feb..278777fa8a3 100644
--- a/include/linux/rfkill.h
+++ b/include/linux/rfkill.h
@@ -224,7 +224,7 @@ void rfkill_destroy(struct rfkill *rfkill);
 * should be blocked) so that drivers need not keep track of the soft
 * block state -- which they might not be able to.
 */
-bool __must_check rfkill_set_hw_state(struct rfkill *rfkill, bool blocked);
+bool rfkill_set_hw_state(struct rfkill *rfkill, bool blocked);
 /**
 * rfkill_set_sw_state - Set the internal rfkill software block state
diff --git a/include/net/rose.h b/include/net/rose.h
index cbd5364b2c8..5ba9f02731e 100644
--- a/include/net/rose.h
+++ b/include/net/rose.h
@@ -156,7 +156,7 @@ extern int  sysctl_rose_maximum_vcs;
 extern int  sysctl_rose_window_size;
 extern int  rosecmp(rose_address *, rose_address *);
 extern int  rosecmpm(rose_address *, rose_address *, unsigned short);
-extern const char *rose2asc(const rose_address *);
+extern char *rose2asc(char *buf, const rose_address *);
 extern struct sock *rose_find_socket(unsigned int, struct rose_neigh *);
 extern void rose_kill_by_neigh(struct rose_neigh *);
 extern unsigned int rose_new_lci(struct rose_neigh *);
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index 8a96672e2c5..eb404dc3ed6 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -424,7 +424,7 @@ int br_add_if(struct net_bridge *br, struct net_device *dev)
 err2:
        br_fdb_delete_by_port(br, p, 1);
 err1:
-        kobject_del(&p->kobj);
+        kobject_put(&p->kobj);
 err0:
        dev_set_promiscuity(dev, -1);
 put_back:
diff --git a/net/irda/irttp.c b/net/irda/irttp.c
index ecf4eb2717c..9cb79f95bf6 100644
--- a/net/irda/irttp.c
+++ b/net/irda/irttp.c
@@ -1453,6 +1453,7 @@ struct tsap_cb *irttp_dup(struct tsap_cb *orig, void *instance)
        }
        /* Dup */
        memcpy(new, orig, sizeof(struct tsap_cb));
+        spin_lock_init(&new->lock);
        /* We don't need the old instance any more */
        spin_unlock_irqrestore(&irttp->tsaps->hb_spinlock, flags);
diff --git a/net/mac80211/Kconfig b/net/mac80211/Kconfig
index ba2643a43c7..7836ee92898 100644
--- a/net/mac80211/Kconfig
+++ b/net/mac80211/Kconfig
@@ -83,6 +83,7 @@ endmenu
 config MAC80211_MESH
        bool "Enable mac80211 mesh networking (pre-802.11s) support"
        depends on MAC80211 && EXPERIMENTAL
+        depends on BROKEN
        ---help---
         This options enables support of Draft 802.11s mesh networking.
         The implementation is based on Draft 1.08 of the Mesh Networking
diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c
index 3c72557df45..479597e8858 100644
--- a/net/mac80211/mesh_pathtbl.c
+++ b/net/mac80211/mesh_pathtbl.c
@@ -175,6 +175,8 @@ int mesh_path_add(u8 *dst, struct ieee80211_sub_if_data *sdata)
        int err = 0;
        u32 hash_idx;
+        might_sleep();
        if (memcmp(dst, sdata->dev->dev_addr, ETH_ALEN) == 0)
                /* never add ourselves as neighbours */
                return -ENOTSUPP;
@@ -265,6 +267,7 @@ int mpp_path_add(u8 *dst, u8 *mpp, struct ieee80211_sub_if_data *sdata)
        int err = 0;
        u32 hash_idx;
+        might_sleep();
        if (memcmp(dst, sdata->dev->dev_addr, ETH_ALEN) == 0)
                /* never add ourselves as neighbours */
@@ -491,8 +494,10 @@ void mesh_path_tx_pending(struct mesh_path *mpath)
 * @skb: frame to discard
 * @sdata: network subif the frame was to be sent through
 *
- * If the frame was beign forwarded from another MP, a PERR frame will be sent
+ * If the frame was being forwarded from another MP, a PERR frame will be sent
- * to the precursor.
+ * to the precursor.  The precursor's address (i.e. the previous hop) was saved
+ * in addr1 of the frame-to-be-forwarded, and would only be overwritten once
+ * the destination is successfully resolved.
 *
 * Locking: the function must me called within a rcu_read_lock region
 */
@@ -507,7 +512,7 @@ void mesh_path_discard_frame(struct sk_buff *skb,
                u8 *ra, *da;
                da = hdr->addr3;
-                ra = hdr->addr2;
+                ra = hdr->addr1;
                mpath = mesh_path_lookup(da, sdata);
                if (mpath)
                        dsn = ++mpath->dsn;
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index d238a8939a0..3a8922cd103 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -1455,7 +1455,7 @@ int ieee80211_master_start_xmit(struct sk_buff *skb, struct net_device *dev)
                monitor_iface = UNKNOWN_ADDRESS;
                len_rthdr = ieee80211_get_radiotap_len(skb->data);
-                hdr = (struct ieee80211_hdr *)skb->data + len_rthdr;
+                hdr = (struct ieee80211_hdr *)(skb->data + len_rthdr);
                hdrlen = ieee80211_hdrlen(hdr->frame_control);
                /* check the header is complete in the frame */
diff --git a/net/rfkill/core.c b/net/rfkill/core.c
index 79693fe2001..2fc4a1724eb 100644
--- a/net/rfkill/core.c
+++ b/net/rfkill/core.c
@@ -549,6 +549,10 @@ void rfkill_set_states(struct rfkill *rfkill, bool sw, bool hw)
        swprev = !!(rfkill->state & RFKILL_BLOCK_SW);
        hwprev = !!(rfkill->state & RFKILL_BLOCK_HW);
        __rfkill_set_sw_state(rfkill, sw);
+        if (hw)
+                rfkill->state |= RFKILL_BLOCK_HW;
+        else
+                rfkill->state &= ~RFKILL_BLOCK_HW;
        spin_unlock_irqrestore(&rfkill->lock, flags);
@@ -648,15 +652,26 @@ static ssize_t rfkill_state_store(struct device *dev,
                                  struct device_attribute *attr,
                                  const char *buf, size_t count)
 {
-        /*
+        struct rfkill *rfkill = to_rfkill(dev);
-         * The intention was that userspace can only take control over
+        unsigned long state;
-         * a given device when/if rfkill-input doesn't control it due
+        int err;
-         * to user_claim. Since user_claim is currently unsupported,
-         * we never support changing the state from userspace -- this
+        if (!capable(CAP_NET_ADMIN))
-         * can be implemented again later.
+                return -EPERM;
-         */
+        err = strict_strtoul(buf, 0, &state);
+        if (err)
+                return err;
+        if (state != RFKILL_USER_STATE_SOFT_BLOCKED &&
+            state != RFKILL_USER_STATE_UNBLOCKED)
+                return -EINVAL;
+        mutex_lock(&rfkill_global_mutex);
+        rfkill_set_block(rfkill, state == RFKILL_USER_STATE_SOFT_BLOCKED);
+        mutex_unlock(&rfkill_global_mutex);
-        return -EPERM;
+        return err ?: count;
 }
 static ssize_t rfkill_claim_show(struct device *dev,
diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index 6bd8e93869e..f0a76f6bca7 100644
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -92,23 +92,21 @@ static void rose_set_lockdep_key(struct net_device *dev)
 /*
 *      Convert a ROSE address into text.
 */
-const char *rose2asc(const rose_address *addr)
+char *rose2asc(char *buf, const rose_address *addr)
 {
-        static char buffer[11];
        if (addr->rose_addr[0] == 0x00 && addr->rose_addr[1] == 0x00 &&
            addr->rose_addr[2] == 0x00 && addr->rose_addr[3] == 0x00 &&
            addr->rose_addr[4] == 0x00) {
-                strcpy(buffer, "*");
+                strcpy(buf, "*");
        } else {
-                sprintf(buffer, "%02X%02X%02X%02X%02X", addr->rose_addr[0] & 0xFF,
+                sprintf(buf, "%02X%02X%02X%02X%02X", addr->rose_addr[0] & 0xFF,
                                                addr->rose_addr[1] & 0xFF,
                                                addr->rose_addr[2] & 0xFF,
                                                addr->rose_addr[3] & 0xFF,
                                                addr->rose_addr[4] & 0xFF);
        }
-        return buffer;
+        return buf;
 }
 /*
@@ -1437,7 +1435,7 @@ static void rose_info_stop(struct seq_file *seq, void *v)
 static int rose_info_show(struct seq_file *seq, void *v)
 {
-        char buf[11];
+        char buf[11], rsbuf[11];
        if (v == SEQ_START_TOKEN)
                seq_puts(seq,
@@ -1455,8 +1453,8 @@ static int rose_info_show(struct seq_file *seq, void *v)
                        devname = dev->name;
                seq_printf(seq, "%-10s %-9s ",
-                        rose2asc(&rose->dest_addr),
+                           rose2asc(rsbuf, &rose->dest_addr),
-                        ax2asc(buf, &rose->dest_call));
+                           ax2asc(buf, &rose->dest_call));
                if (ax25cmp(&rose->source_call, &null_ax25_address) == 0)
                        callsign = "??????-?";
@@ -1465,7 +1463,7 @@ static int rose_info_show(struct seq_file *seq, void *v)
                seq_printf(seq,
                           "%-10s %-9s %-5s %3.3X %05d  %d  %d  %d  %d %3lu %3lu %3lu %3lu %3lu %3lu/%03lu %5d %5d %ld\n",
-                        rose2asc(&rose->source_addr),
+                        rose2asc(rsbuf, &rose->source_addr),
                        callsign,
                        devname,
                        rose->lci & 0x0FFF,
diff --git a/net/rose/rose_route.c b/net/rose/rose_route.c
index a81066a1010..9478d9b3d97 100644
--- a/net/rose/rose_route.c
+++ b/net/rose/rose_route.c
@@ -1104,6 +1104,7 @@ static void rose_node_stop(struct seq_file *seq, void *v)
 static int rose_node_show(struct seq_file *seq, void *v)
 {
+        char rsbuf[11];
        int i;
        if (v == SEQ_START_TOKEN)
@@ -1112,13 +1113,13 @@ static int rose_node_show(struct seq_file *seq, void *v)
                const struct rose_node *rose_node = v;
                /* if (rose_node->loopback) {
                        seq_printf(seq, "%-10s %04d 1 loopback\n",
-                                rose2asc(&rose_node->address),
+                                   rose2asc(rsbuf, &rose_node->address),
-                                rose_node->mask);
+                                   rose_node->mask);
                } else { */
                        seq_printf(seq, "%-10s %04d %d",
-                                rose2asc(&rose_node->address),
+                                   rose2asc(rsbuf, &rose_node->address),
-                                rose_node->mask,
+                                   rose_node->mask,
-                                rose_node->count);
+                                   rose_node->count);
                        for (i = 0; i < rose_node->count; i++)
                                seq_printf(seq, " %05d",
@@ -1267,7 +1268,7 @@ static void rose_route_stop(struct seq_file *seq, void *v)
 static int rose_route_show(struct seq_file *seq, void *v)
 {
-        char buf[11];
+        char buf[11], rsbuf[11];
        if (v == SEQ_START_TOKEN)
                seq_puts(seq,
@@ -1279,7 +1280,7 @@ static int rose_route_show(struct seq_file *seq, void *v)
                        seq_printf(seq,
                                   "%3.3X  %-10s  %-9s  %05d      ",
                                   rose_route->lci1,
-                                   rose2asc(&rose_route->src_addr),
+                                   rose2asc(rsbuf, &rose_route->src_addr),
                                   ax2asc(buf, &rose_route->src_call),
                                   rose_route->neigh1->number);
                else
@@ -1289,10 +1290,10 @@ static int rose_route_show(struct seq_file *seq, void *v)
                if (rose_route->neigh2)
                        seq_printf(seq,
                                   "%3.3X  %-10s  %-9s  %05d\n",
-                                rose_route->lci2,
+                                   rose_route->lci2,
-                                rose2asc(&rose_route->dest_addr),
+                                   rose2asc(rsbuf, &rose_route->dest_addr),
-                                ax2asc(buf, &rose_route->dest_call),
+                                   ax2asc(buf, &rose_route->dest_call),
-                                rose_route->neigh2->number);
+                                   rose_route->neigh2->number);
                 else
                         seq_puts(seq,
                                  "000  *           *          00000\n");
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 43bdb1372ca..634496b3ed7 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -997,7 +997,7 @@ static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
        if (IS_ERR(hdr)) {
                err = PTR_ERR(hdr);
-                goto out;
+                goto free_msg;
        }
        cookie.msg = msg;
@@ -1011,7 +1011,7 @@ static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
                                &cookie, get_key_callback);
        if (err)
-                goto out;
+                goto free_msg;
        if (cookie.error)
                goto nla_put_failure;
@@ -1022,6 +1022,7 @@ static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
 nla_put_failure:
        err = -ENOBUFS;
+ free_msg:
        nlmsg_free(msg);
 out:
        cfg80211_put_dev(drv);
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index f8e71b30000..9271118e1fc 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -35,8 +35,6 @@ void cfg80211_scan_done(struct cfg80211_scan_request *request, bool aborted)
        else
                nl80211_send_scan_done(wiphy_to_dev(request->wiphy), dev);
-        wiphy_to_dev(request->wiphy)->scan_req = NULL;
 #ifdef CONFIG_WIRELESS_EXT
        if (!aborted) {
                memset(&wrqu, 0, sizeof(wrqu));
@@ -48,6 +46,7 @@ void cfg80211_scan_done(struct cfg80211_scan_request *request, bool aborted)
        dev_put(dev);
 out:
+        wiphy_to_dev(request->wiphy)->scan_req = NULL;
        kfree(request);
 }
 EXPORT_SYMBOL(cfg80211_scan_done);