Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

1) VETH_INFO_PEER netlink attribute needs to have it's size validated,
   from Thomas Graf.

2) 'poll' module option of bnx2x driver crashes the machine, just remove
   it.  From Michal Schmidt.

3) ks8851_mll driver reads the irq number from two places, but only
   initializes one of them, oops.  Use only one location and fix this
   problem, from Jan Weitzel.

4) Fix buffer overrun and unicast sterring bugs in mellanox mlx4 driver,
   from Eugenia Emantayev.

5) Swapped kcalloc() args in RxRPC and mlx4, from Axel Lin.

6) PHY MDIO device name regression fixes from Florian Fainelli.

7) If the wake event IRQ line is different from the netdevice one, we
   have to properly route it to the stmmac interrupt handler.  From
   Francesco Virlinzi.

8) Fix rwlock lock initialization ordering bug in mac80211, from
   Mohammed Shafi Shajakhan.

9) TCP lost_cnt can get out of sync, and in fact go negative, in certain
   circumstances.  Fix the way we specify what sequence range to operate
   on in tcp_sacktag_one() to fix this bug.  From Neal Cardwell.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (27 commits)
  net/ethernet: ks8851_mll fix irq handling
  veth: Enforce minimum size of VETH_INFO_PEER
  stmmac: update the driver version to Feb 2012 (v2)
  stmmac: move hw init in the probe (v2)
  stmmac: request_irq when use an ext wake irq line (v2)
  stmmac: do not discard frame on dribbling bit assert
  ipheth: Add iPhone 4S
  mlx4: add unicast steering entries to resource_tracker
  mlx4: fix QP tree trashing
  mlx4: fix buffer overrun
  3c59x: shorten timer period for slave devices
  netpoll: netpoll_poll_dev() should access dev->flags
  RxRPC: Fix kcalloc parameters swapped
  bnx2x: remove the 'poll' module option
  tcp: fix tcp_shifted_skb() adjustment of lost_cnt_hint for FACK
  ks8851: Fix NOHZ local_softirq_pending 08 warning
  bnx2x: fix bnx2x_storm_stats_update() on big endian
  ixp4xx-eth: fix PHY name to match MDIO bus name
  octeon: fix PHY name to match MDIO bus name
  fec: fix PHY name to match fixed MDIO bus name
  ...

27 files changed, 212 insertions, 191 deletions

diff --git a/drivers/net/ethernet/3com/3c59x.c b/drivers/net/ethernet/3com/3c59x.c
index 8153a3e0a1a4..f9b74c0a8492 100644
--- a/drivers/net/ethernet/3com/3c59x.c
+++ b/drivers/net/ethernet/3com/3c59x.c
@@ -1842,7 +1842,7 @@ vortex_timer(unsigned long data)
                 ok = 1;
         }
 
-        if (!netif_carrier_ok(dev))
+        if (dev->flags & IFF_SLAVE || !netif_carrier_ok(dev))
                 next_tick = 5*HZ;
 
         if (vp->medialock)
diff --git a/drivers/net/ethernet/broadcom/bcm63xx_enet.c b/drivers/net/ethernet/broadcom/bcm63xx_enet.c
index 986019b2c849..c7ca7ec065ee 100644
--- a/drivers/net/ethernet/broadcom/bcm63xx_enet.c
+++ b/drivers/net/ethernet/broadcom/bcm63xx_enet.c
@@ -797,7 +797,7 @@ static int bcm_enet_open(struct net_device *dev)
         if (priv->has_phy) {
                 /* connect to PHY */
                 snprintf(phy_id, sizeof(phy_id), PHY_ID_FMT,
-                         priv->mac_id ? "1" : "0", priv->phy_id);
+                         priv->mii_bus->id, priv->phy_id);
 
                 phydev = phy_connect(dev, phy_id, bcm_enet_adjust_phy_link, 0,
                                      PHY_INTERFACE_MODE_MII);
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index 1e3f978ee6da..254521319150 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -117,10 +117,6 @@ static int dropless_fc;
 module_param(dropless_fc, int, 0);
 MODULE_PARM_DESC(dropless_fc, " Pause on exhausted host ring");
 
-static int poll;
-module_param(poll, int, 0);
-MODULE_PARM_DESC(poll, " Use polling (for debug)");
-
 static int mrrs = -1;
 module_param(mrrs, int, 0);
 MODULE_PARM_DESC(mrrs, " Force Max Read Req Size (0..3) (for debug)");
@@ -4834,20 +4830,11 @@ void bnx2x_drv_pulse(struct bnx2x *bp)
 
 static void bnx2x_timer(unsigned long data)
 {
-        u8 cos;
         struct bnx2x *bp = (struct bnx2x *) data;
 
         if (!netif_running(bp->dev))
                 return;
 
-        if (poll) {
-                struct bnx2x_fastpath *fp = &bp->fp[0];
-
-                for_each_cos_in_tx_queue(fp, cos)
-                        bnx2x_tx_int(bp, &fp->txdata[cos]);
-                bnx2x_rx_int(fp, 1000);
-        }
-
         if (!BP_NOMCP(bp)) {
                 int mb_idx = BP_FW_MB_IDX(bp);
                 u32 drv_pulse;
@@ -10063,7 +10050,6 @@ static void __devinit bnx2x_set_modes_bitmap(struct bnx2x *bp)
 static int __devinit bnx2x_init_bp(struct bnx2x *bp)
 {
         int func;
-        int timer_interval;
         int rc;
 
         mutex_init(&bp->port.phy_mutex);
@@ -10139,8 +10125,7 @@ static int __devinit bnx2x_init_bp(struct bnx2x *bp)
         bp->tx_ticks = (50 / BNX2X_BTR) * BNX2X_BTR;
         bp->rx_ticks = (25 / BNX2X_BTR) * BNX2X_BTR;
 
-        timer_interval = (CHIP_REV_IS_SLOW(bp) ? 5*HZ : HZ);
-        bp->current_interval = (poll ? poll : timer_interval);
+        bp->current_interval = CHIP_REV_IS_SLOW(bp) ? 5*HZ : HZ;
 
         init_timer(&bp->timer);
         bp->timer.expires = jiffies + bp->current_interval;
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c
index bc0121ac291e..1adef266fcd5 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c
@@ -1081,17 +1081,17 @@ static int bnx2x_storm_stats_update(struct bnx2x *bp)
                estats->rx_stat_ifhcinbadoctets_lo);
 
         ADD_64(fstats->total_bytes_received_hi,
-               tfunc->rcv_error_bytes.hi,
+               le32_to_cpu(tfunc->rcv_error_bytes.hi),
                fstats->total_bytes_received_lo,
-               tfunc->rcv_error_bytes.lo);
+               le32_to_cpu(tfunc->rcv_error_bytes.lo));
 
         memcpy(estats, &(fstats->total_bytes_received_hi),
                sizeof(struct host_func_stats) - 2*sizeof(u32));
 
         ADD_64(estats->error_bytes_received_hi,
-               tfunc->rcv_error_bytes.hi,
+               le32_to_cpu(tfunc->rcv_error_bytes.hi),
                estats->error_bytes_received_lo,
-               tfunc->rcv_error_bytes.lo);
+               le32_to_cpu(tfunc->rcv_error_bytes.lo));
 
         ADD_64(estats->etherstatsoverrsizepkts_hi,
                estats->rx_stat_dot3statsframestoolong_hi,
diff --git a/drivers/net/ethernet/freescale/fec.c b/drivers/net/ethernet/freescale/fec.c
index 1c7aad8fa19c..e92ef1bd732a 100644
--- a/drivers/net/ethernet/freescale/fec.c
+++ b/drivers/net/ethernet/freescale/fec.c
@@ -986,7 +986,7 @@ static int fec_enet_mii_probe(struct net_device *ndev)
                 printk(KERN_INFO
                         "%s: no PHY, assuming direct connection to switch\n",
                         ndev->name);
-                strncpy(mdio_bus_id, "0", MII_BUS_ID_SIZE);
+                strncpy(mdio_bus_id, "fixed-0", MII_BUS_ID_SIZE);
                 phy_id = 0;
         }
 
diff --git a/drivers/net/ethernet/mellanox/mlx4/eq.c b/drivers/net/ethernet/mellanox/mlx4/eq.c
index 55d7bd4e210a..8fa41f3082cf 100644
--- a/drivers/net/ethernet/mellanox/mlx4/eq.c
+++ b/drivers/net/ethernet/mellanox/mlx4/eq.c
@@ -815,8 +815,9 @@ int mlx4_init_eq_table(struct mlx4_dev *dev)
         int err;
         int i;
 
-        priv->eq_table.uar_map = kcalloc(sizeof *priv->eq_table.uar_map,
-                                         mlx4_num_eq_uar(dev), GFP_KERNEL);
+        priv->eq_table.uar_map = kcalloc(mlx4_num_eq_uar(dev),
+                                         sizeof *priv->eq_table.uar_map,
+                                         GFP_KERNEL);
         if (!priv->eq_table.uar_map) {
                 err = -ENOMEM;
                 goto err_out_free;
diff --git a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
index dcd819bfb2f0..bfdb7af19e49 100644
--- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
+++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
@@ -73,6 +73,7 @@ struct res_gid {
         struct list_head        list;
         u8                      gid[16];
         enum mlx4_protocol      prot;
+        enum mlx4_steer_type    steer;
 };
 
 enum res_qp_states {
@@ -374,6 +375,7 @@ static struct res_common *alloc_qp_tr(int id)
 
         ret->com.res_id = id;
         ret->com.state = RES_QP_RESERVED;
+        ret->local_qpn = id;
         INIT_LIST_HEAD(&ret->mcg_list);
         spin_lock_init(&ret->mcg_spl);
 
@@ -2479,7 +2481,8 @@ static struct res_gid *find_gid(struct mlx4_dev *dev, int slave,
 }
 
 static int add_mcg_res(struct mlx4_dev *dev, int slave, struct res_qp *rqp,
-                       u8 *gid, enum mlx4_protocol prot)
+                       u8 *gid, enum mlx4_protocol prot,
+                       enum mlx4_steer_type steer)
 {
         struct res_gid *res;
         int err;
@@ -2495,6 +2498,7 @@ static int add_mcg_res(struct mlx4_dev *dev, int slave, struct res_qp *rqp,
         } else {
                 memcpy(res->gid, gid, 16);
                 res->prot = prot;
+                res->steer = steer;
                 list_add_tail(&res->list, &rqp->mcg_list);
                 err = 0;
         }
@@ -2504,14 +2508,15 @@ static int add_mcg_res(struct mlx4_dev *dev, int slave, struct res_qp *rqp,
 }
 
 static int rem_mcg_res(struct mlx4_dev *dev, int slave, struct res_qp *rqp,
-                       u8 *gid, enum mlx4_protocol prot)
+                       u8 *gid, enum mlx4_protocol prot,
+                       enum mlx4_steer_type steer)
 {
         struct res_gid *res;
         int err;
 
         spin_lock_irq(&rqp->mcg_spl);
         res = find_gid(dev, slave, rqp, gid);
-        if (!res || res->prot != prot)
+        if (!res || res->prot != prot || res->steer != steer)
                 err = -EINVAL;
         else {
                 list_del(&res->list);
@@ -2538,7 +2543,7 @@ int mlx4_QP_ATTACH_wrapper(struct mlx4_dev *dev, int slave,
         int attach = vhcr->op_modifier;
         int block_loopback = vhcr->in_modifier >> 31;
         u8 steer_type_mask = 2;
-        enum mlx4_steer_type type = gid[7] & steer_type_mask;
+        enum mlx4_steer_type type = (gid[7] & steer_type_mask) >> 1;
 
         qpn = vhcr->in_modifier & 0xffffff;
         err = get_res(dev, slave, qpn, RES_QP, &rqp);
@@ -2547,7 +2552,7 @@ int mlx4_QP_ATTACH_wrapper(struct mlx4_dev *dev, int slave,
 
         qp.qpn = qpn;
         if (attach) {
-                err = add_mcg_res(dev, slave, rqp, gid, prot);
+                err = add_mcg_res(dev, slave, rqp, gid, prot, type);
                 if (err)
                         goto ex_put;
 
@@ -2556,7 +2561,7 @@ int mlx4_QP_ATTACH_wrapper(struct mlx4_dev *dev, int slave,
                 if (err)
                         goto ex_rem;
         } else {
-                err = rem_mcg_res(dev, slave, rqp, gid, prot);
+                err = rem_mcg_res(dev, slave, rqp, gid, prot, type);
                 if (err)
                         goto ex_put;
                 err = mlx4_qp_detach_common(dev, &qp, gid, prot, type);
@@ -2567,7 +2572,7 @@ int mlx4_QP_ATTACH_wrapper(struct mlx4_dev *dev, int slave,
 
 ex_rem:
         /* ignore error return below, already in error */
-        err1 = rem_mcg_res(dev, slave, rqp, gid, prot);
+        err1 = rem_mcg_res(dev, slave, rqp, gid, prot, type);
 ex_put:
         put_res(dev, slave, qpn, RES_QP);
 
@@ -2606,7 +2611,7 @@ static void detach_qp(struct mlx4_dev *dev, int slave, struct res_qp *rqp)
         list_for_each_entry_safe(rgid, tmp, &rqp->mcg_list, list) {
                 qp.qpn = rqp->local_qpn;
                 err = mlx4_qp_detach_common(dev, &qp, rgid->gid, rgid->prot,
-                                            MLX4_MC_STEER);
+                                            rgid->steer);
                 list_del(&rgid->list);
                 kfree(rgid);
         }
diff --git a/drivers/net/ethernet/micrel/ks8851.c b/drivers/net/ethernet/micrel/ks8851.c
index 6b35e7da9a9c..0c3e4005224d 100644
--- a/drivers/net/ethernet/micrel/ks8851.c
+++ b/drivers/net/ethernet/micrel/ks8851.c
@@ -583,7 +583,7 @@ static void ks8851_rx_pkts(struct ks8851_net *ks)
                                         ks8851_dbg_dumpkkt(ks, rxpkt);
 
                                 skb->protocol = eth_type_trans(skb, ks->netdev);
-                                netif_rx(skb);
+                                netif_rx_ni(skb);
 
                                 ks->netdev->stats.rx_packets++;
                                 ks->netdev->stats.rx_bytes += rxlen;
diff --git a/drivers/net/ethernet/micrel/ks8851_mll.c b/drivers/net/ethernet/micrel/ks8851_mll.c
index e58e78e5c930..231176fcd2ba 100644
--- a/drivers/net/ethernet/micrel/ks8851_mll.c
+++ b/drivers/net/ethernet/micrel/ks8851_mll.c
@@ -394,7 +394,6 @@ union ks_tx_hdr {
  * @msg_enable  : The message flags controlling driver output (see ethtool).
  * @frame_cnt   : number of frames received.
  * @bus_width   : i/o bus width.
- * @irq         : irq number assigned to this device.
  * @rc_rxqcr    : Cached copy of KS_RXQCR.
  * @rc_txcr     : Cached copy of KS_TXCR.
  * @rc_ier      : Cached copy of KS_IER.
@@ -441,7 +440,6 @@ struct ks_net {
         u32                     msg_enable;
         u32                     frame_cnt;
         int                     bus_width;
-        int                     irq;
 
         u16                     rc_rxqcr;
         u16                     rc_txcr;
@@ -907,10 +905,10 @@ static int ks_net_open(struct net_device *netdev)
         netif_dbg(ks, ifup, ks->netdev, "%s - entry\n", __func__);
 
         /* reset the HW */
-        err = request_irq(ks->irq, ks_irq, KS_INT_FLAGS, DRV_NAME, netdev);
+        err = request_irq(netdev->irq, ks_irq, KS_INT_FLAGS, DRV_NAME, netdev);
 
         if (err) {
-                pr_err("Failed to request IRQ: %d: %d\n", ks->irq, err);
+                pr_err("Failed to request IRQ: %d: %d\n", netdev->irq, err);
                 return err;
         }
 
@@ -955,7 +953,7 @@ static int ks_net_stop(struct net_device *netdev)
 
         /* set powermode to soft power down to save power */
         ks_set_powermode(ks, PMECR_PM_SOFTDOWN);
-        free_irq(ks->irq, netdev);
+        free_irq(netdev->irq, netdev);
         mutex_unlock(&ks->lock);
         return 0;
 }
@@ -1545,10 +1543,10 @@ static int __devinit ks8851_probe(struct platform_device *pdev)
         if (!ks->hw_addr_cmd)
                 goto err_ioremap1;
 
-        ks->irq = platform_get_irq(pdev, 0);
+        netdev->irq = platform_get_irq(pdev, 0);
 
-        if (ks->irq < 0) {
-                err = ks->irq;
+        if (netdev->irq < 0) {
+                err = netdev->irq;
                 goto err_get_irq;
         }
 
diff --git a/drivers/net/ethernet/octeon/octeon_mgmt.c b/drivers/net/ethernet/octeon/octeon_mgmt.c
index 212f43b308a3..cd827ff4a021 100644
--- a/drivers/net/ethernet/octeon/octeon_mgmt.c
+++ b/drivers/net/ethernet/octeon/octeon_mgmt.c
@@ -670,7 +670,7 @@ static void octeon_mgmt_adjust_link(struct net_device *netdev)
 static int octeon_mgmt_init_phy(struct net_device *netdev)
 {
         struct octeon_mgmt *p = netdev_priv(netdev);
-        char phy_id[20];
+        char phy_id[MII_BUS_ID_SIZE + 3];
 
         if (octeon_is_simulation()) {
                 /* No PHYs in the simulator. */
@@ -678,7 +678,7 @@ static int octeon_mgmt_init_phy(struct net_device *netdev)
                 return 0;
         }
 
-        snprintf(phy_id, sizeof(phy_id), PHY_ID_FMT, "0", p->port);
+        snprintf(phy_id, sizeof(phy_id), PHY_ID_FMT, "mdio-octeon-0", p->port);
 
         p->phydev = phy_connect(netdev, phy_id, octeon_mgmt_adjust_link, 0,
                                 PHY_INTERFACE_MODE_MII);
diff --git a/drivers/net/ethernet/stmicro/stmmac/common.h b/drivers/net/ethernet/stmicro/stmmac/common.h
index d0b814ef0675..0319d640f728 100644
--- a/drivers/net/ethernet/stmicro/stmmac/common.h
+++ b/drivers/net/ethernet/stmicro/stmmac/common.h
@@ -67,6 +67,7 @@ struct stmmac_extra_stats {
         unsigned long ipc_csum_error;
         unsigned long rx_collision;
         unsigned long rx_crc;
+        unsigned long dribbling_bit;
         unsigned long rx_length;
         unsigned long rx_mii;
         unsigned long rx_multicast;
diff --git a/drivers/net/ethernet/stmicro/stmmac/enh_desc.c b/drivers/net/ethernet/stmicro/stmmac/enh_desc.c
index d87976364ec5..ad1b627f8ec2 100644
--- a/drivers/net/ethernet/stmicro/stmmac/enh_desc.c
+++ b/drivers/net/ethernet/stmicro/stmmac/enh_desc.c
@@ -201,7 +201,7 @@ static int enh_desc_get_rx_status(void *data, struct stmmac_extra_stats *x,
 
         if (unlikely(p->des01.erx.dribbling)) {
                 CHIP_DBG(KERN_ERR "GMAC RX: dribbling error\n");
-                ret = discard_frame;
+                x->dribbling_bit++;
         }
         if (unlikely(p->des01.erx.sa_filter_fail)) {
                 CHIP_DBG(KERN_ERR "GMAC RX : Source Address filter fail\n");
diff --git a/drivers/net/ethernet/stmicro/stmmac/norm_desc.c b/drivers/net/ethernet/stmicro/stmmac/norm_desc.c
index fda5d2b31d3a..25953bb45a73 100644
--- a/drivers/net/ethernet/stmicro/stmmac/norm_desc.c
+++ b/drivers/net/ethernet/stmicro/stmmac/norm_desc.c
@@ -104,7 +104,7 @@ static int ndesc_get_rx_status(void *data, struct stmmac_extra_stats *x,
                 ret = discard_frame;
         }
         if (unlikely(p->des01.rx.dribbling))
-                ret = discard_frame;
+                x->dribbling_bit++;
 
         if (unlikely(p->des01.rx.length_error)) {
                 x->rx_length++;
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac.h b/drivers/net/ethernet/stmicro/stmmac/stmmac.h
index 120740020e2c..b4b095fdcf29 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac.h
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac.h
@@ -21,7 +21,7 @@
 *******************************************************************************/
 
 #define STMMAC_RESOURCE_NAME   "stmmaceth"
-#define DRV_MODULE_VERSION      "Dec_2011"
+#define DRV_MODULE_VERSION      "Feb_2012"
 #include <linux/stmmac.h>
 #include <linux/phy.h>
 #include "common.h"
@@ -97,4 +97,5 @@ int stmmac_resume(struct net_device *ndev);
 int stmmac_suspend(struct net_device *ndev);
 int stmmac_dvr_remove(struct net_device *ndev);
 struct stmmac_priv *stmmac_dvr_probe(struct device *device,
-                                struct plat_stmmacenet_data *plat_dat);
+                                     struct plat_stmmacenet_data *plat_dat,
+                                     void __iomem *addr);
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c
index 9573303a706b..f98e1511660f 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c
@@ -47,23 +47,25 @@ struct stmmac_stats {
         offsetof(struct stmmac_priv, xstats.m)}
 
 static const struct stmmac_stats stmmac_gstrings_stats[] = {
+        /* Transmit errors */
         STMMAC_STAT(tx_underflow),
         STMMAC_STAT(tx_carrier),
         STMMAC_STAT(tx_losscarrier),
         STMMAC_STAT(vlan_tag),
         STMMAC_STAT(tx_deferred),
         STMMAC_STAT(tx_vlan),
-        STMMAC_STAT(rx_vlan),
         STMMAC_STAT(tx_jabber),
         STMMAC_STAT(tx_frame_flushed),
         STMMAC_STAT(tx_payload_error),
         STMMAC_STAT(tx_ip_header_error),
+        /* Receive errors */
         STMMAC_STAT(rx_desc),
         STMMAC_STAT(sa_filter_fail),
         STMMAC_STAT(overflow_error),
         STMMAC_STAT(ipc_csum_error),
         STMMAC_STAT(rx_collision),
         STMMAC_STAT(rx_crc),
+        STMMAC_STAT(dribbling_bit),
         STMMAC_STAT(rx_length),
         STMMAC_STAT(rx_mii),
         STMMAC_STAT(rx_multicast),
@@ -73,6 +75,8 @@ static const struct stmmac_stats stmmac_gstrings_stats[] = {
         STMMAC_STAT(sa_rx_filter_fail),
         STMMAC_STAT(rx_missed_cntr),
         STMMAC_STAT(rx_overflow_cntr),
+        STMMAC_STAT(rx_vlan),
+        /* Tx/Rx IRQ errors */
         STMMAC_STAT(tx_undeflow_irq),
         STMMAC_STAT(tx_process_stopped_irq),
         STMMAC_STAT(tx_jabber_irq),
@@ -82,6 +86,7 @@ static const struct stmmac_stats stmmac_gstrings_stats[] = {
         STMMAC_STAT(rx_watchdog_irq),
         STMMAC_STAT(tx_early_irq),
         STMMAC_STAT(fatal_bus_error_irq),
+        /* Extra info */
         STMMAC_STAT(threshold),
         STMMAC_STAT(tx_pkt_n),
         STMMAC_STAT(rx_pkt_n),
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 96fa2da30763..6ee593a55a64 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -241,7 +241,7 @@ static void stmmac_adjust_link(struct net_device *dev)
                         case 1000:
                                 if (likely(priv->plat->has_gmac))
                                         ctrl &= ~priv->hw->link.port;
-                                stmmac_hw_fix_mac_speed(priv);
+                                        stmmac_hw_fix_mac_speed(priv);
                                 break;
                         case 100:
                         case 10:
@@ -785,7 +785,7 @@ static u32 stmmac_get_synopsys_id(struct stmmac_priv *priv)
                 u32 uid = ((hwid & 0x0000ff00) >> 8);
                 u32 synid = (hwid & 0x000000ff);
 
-                pr_info("STMMAC - user ID: 0x%x, Synopsys ID: 0x%x\n",
+                pr_info("stmmac - user ID: 0x%x, Synopsys ID: 0x%x\n",
                         uid, synid);
 
                 return synid;
@@ -869,38 +869,6 @@ static int stmmac_get_hw_features(struct stmmac_priv *priv)
         return hw_cap;
 }
 
-/**
- * stmmac_mac_device_setup
- * @dev : device pointer
- * Description: this is to attach the GMAC or MAC 10/100
- * main core structures that will be completed during the
- * open step.
- */
-static int stmmac_mac_device_setup(struct net_device *dev)
-{
-        struct stmmac_priv *priv = netdev_priv(dev);
-
-        struct mac_device_info *device;
-
-        if (priv->plat->has_gmac)
-                device = dwmac1000_setup(priv->ioaddr);
-        else
-                device = dwmac100_setup(priv->ioaddr);
-
-        if (!device)
-                return -ENOMEM;
-
-        priv->hw = device;
-        priv->hw->ring = &ring_mode_ops;
-
-        if (device_can_wakeup(priv->device)) {
-                priv->wolopts = WAKE_MAGIC; /* Magic Frame as default */
-                enable_irq_wake(priv->wol_irq);
-        }
-
-        return 0;
-}
-
 static void stmmac_check_ether_addr(struct stmmac_priv *priv)
 {
         /* verify if the MAC address is valid, in case of failures it
@@ -930,20 +898,8 @@ static int stmmac_open(struct net_device *dev)
         struct stmmac_priv *priv = netdev_priv(dev);
         int ret;
 
-        /* MAC HW device setup */
-        ret = stmmac_mac_device_setup(dev);
-        if (ret < 0)
-                return ret;
-
         stmmac_check_ether_addr(priv);
 
-        stmmac_verify_args();
-
-        /* Override with kernel parameters if supplied XXX CRS XXX
-         * this needs to have multiple instances */
-        if ((phyaddr >= 0) && (phyaddr <= 31))
-                priv->plat->phy_addr = phyaddr;
-
         /* MDIO bus Registration */
         ret = stmmac_mdio_register(dev);
         if (ret < 0) {
@@ -976,44 +932,6 @@ static int stmmac_open(struct net_device *dev)
                 goto open_error;
         }
 
-        stmmac_get_synopsys_id(priv);
-
-        priv->hw_cap_support = stmmac_get_hw_features(priv);
-
-        if (priv->hw_cap_support) {
-                pr_info(" Support DMA HW capability register");
-
-                /* We can override some gmac/dma configuration fields: e.g.
-                 * enh_desc, tx_coe (e.g. that are passed through the
-                 * platform) with the values from the HW capability
-                 * register (if supported).
-                 */
-                priv->plat->enh_desc = priv->dma_cap.enh_desc;
-                priv->plat->tx_coe = priv->dma_cap.tx_coe;
-                priv->plat->pmt = priv->dma_cap.pmt_remote_wake_up;
-
-                /* By default disable wol on magic frame if not supported */
-                if (!priv->dma_cap.pmt_magic_frame)
-                        priv->wolopts &= ~WAKE_MAGIC;
-
-        } else
-                pr_info(" No HW DMA feature register supported");
-
-        /* Select the enhnaced/normal descriptor structures */
-        stmmac_selec_desc_mode(priv);
-
-        /* PMT module is not integrated in all the MAC devices. */
-        if (priv->plat->pmt) {
-                pr_info(" Remote wake-up capable\n");
-                device_set_wakeup_capable(priv->device, 1);
-        }
-
-        priv->rx_coe = priv->hw->mac->rx_coe(priv->ioaddr);
-        if (priv->rx_coe)
-                pr_info(" Checksum Offload Engine supported\n");
-        if (priv->plat->tx_coe)
-                pr_info(" Checksum insertion supported\n");
-
         /* Create and initialize the TX/RX descriptors chains. */
         priv->dma_tx_size = STMMAC_ALIGN(dma_txsize);
         priv->dma_rx_size = STMMAC_ALIGN(dma_rxsize);
@@ -1030,14 +948,14 @@ static int stmmac_open(struct net_device *dev)
 
         /* Copy the MAC addr into the HW  */
         priv->hw->mac->set_umac_addr(priv->ioaddr, dev->dev_addr, 0);
+
         /* If required, perform hw setup of the bus. */
         if (priv->plat->bus_setup)
                 priv->plat->bus_setup(priv->ioaddr);
+
         /* Initialize the MAC Core */
         priv->hw->mac->core_init(priv->ioaddr);
 
-        netdev_update_features(dev);
-
         /* Request the IRQ lines */
         ret = request_irq(dev->irq, stmmac_interrupt,
                          IRQF_SHARED, dev->name, dev);
@@ -1047,6 +965,17 @@ static int stmmac_open(struct net_device *dev)
                 goto open_error;
         }
 
+        /* Request the Wake IRQ in case of another line is used for WoL */
+        if (priv->wol_irq != dev->irq) {
+                ret = request_irq(priv->wol_irq, stmmac_interrupt,
+                                  IRQF_SHARED, dev->name, dev);
+                if (unlikely(ret < 0)) {
+                        pr_err("%s: ERROR: allocating the ext WoL IRQ %d "
+                               "(error: %d)\n", __func__, priv->wol_irq, ret);
+                        goto open_error_wolirq;
+                }
+        }
+
         /* Enable the MAC Rx/Tx */
         stmmac_set_mac(priv->ioaddr, true);
 
@@ -1062,7 +991,7 @@ static int stmmac_open(struct net_device *dev)
 #ifdef CONFIG_STMMAC_DEBUG_FS
         ret = stmmac_init_fs(dev);
         if (ret < 0)
-                pr_warning("\tFailed debugFS registration");
+                pr_warning("%s: failed debugFS registration\n", __func__);
 #endif
         /* Start the ball rolling... */
         DBG(probe, DEBUG, "%s: DMA RX/TX processes started...\n", dev->name);
@@ -1072,6 +1001,7 @@ static int stmmac_open(struct net_device *dev)
 #ifdef CONFIG_STMMAC_TIMER
         priv->tm->timer_start(tmrate);
 #endif
+
         /* Dump DMA/MAC registers */
         if (netif_msg_hw(priv)) {
                 priv->hw->mac->dump_regs(priv->ioaddr);
@@ -1087,6 +1017,9 @@ static int stmmac_open(struct net_device *dev)
 
         return 0;
 
+open_error_wolirq:
+        free_irq(dev->irq, dev);
+
 open_error:
 #ifdef CONFIG_STMMAC_TIMER
         kfree(priv->tm);
@@ -1127,6 +1060,8 @@ static int stmmac_release(struct net_device *dev)
 
         /* Free the IRQ lines */
         free_irq(dev->irq, dev);
+        if (priv->wol_irq != dev->irq)
+                free_irq(priv->wol_irq, dev);
 
         /* Stop TX/RX DMA and clear the descriptors */
         priv->hw->dma->stop_tx(priv->ioaddr);
@@ -1789,13 +1724,77 @@ static const struct net_device_ops stmmac_netdev_ops = {
 };
 
 /**
+ *  stmmac_hw_init - Init the MAC device
+ *  @priv : pointer to the private device structure.
+ *  Description: this function detects which MAC device
+ *  (GMAC/MAC10-100) has to attached, checks the HW capability
+ *  (if supported) and sets the driver's features (for example
+ *  to use the ring or chaine mode or support the normal/enh
+ *  descriptor structure).
+ */
+static int stmmac_hw_init(struct stmmac_priv *priv)
+{
+        int ret = 0;
+        struct mac_device_info *mac;
+
+        /* Identify the MAC HW device */
+        if (priv->plat->has_gmac)
+                mac = dwmac1000_setup(priv->ioaddr);
+        else
+                mac = dwmac100_setup(priv->ioaddr);
+        if (!mac)
+                return -ENOMEM;
+
+        priv->hw = mac;
+
+        /* To use the chained or ring mode */
+        priv->hw->ring = &ring_mode_ops;
+
+        /* Get and dump the chip ID */
+        stmmac_get_synopsys_id(priv);
+
+        /* Get the HW capability (new GMAC newer than 3.50a) */
+        priv->hw_cap_support = stmmac_get_hw_features(priv);
+        if (priv->hw_cap_support) {
+                pr_info(" DMA HW capability register supported");
+
+                /* We can override some gmac/dma configuration fields: e.g.
+                 * enh_desc, tx_coe (e.g. that are passed through the
+                 * platform) with the values from the HW capability
+                 * register (if supported).
+                 */
+                priv->plat->enh_desc = priv->dma_cap.enh_desc;
+                priv->plat->tx_coe = priv->dma_cap.tx_coe;
+                priv->plat->pmt = priv->dma_cap.pmt_remote_wake_up;
+        } else
+                pr_info(" No HW DMA feature register supported");
+
+        /* Select the enhnaced/normal descriptor structures */
+        stmmac_selec_desc_mode(priv);
+
+        priv->rx_coe = priv->hw->mac->rx_coe(priv->ioaddr);
+        if (priv->rx_coe)
+                pr_info(" RX Checksum Offload Engine supported\n");
+        if (priv->plat->tx_coe)
+                pr_info(" TX Checksum insertion supported\n");
+
+        if (priv->plat->pmt) {
+                pr_info(" Wake-Up On Lan supported\n");
+                device_set_wakeup_capable(priv->device, 1);
+        }
+
+        return ret;
+}
+
+/**
  * stmmac_dvr_probe
  * @device: device pointer
  * Description: this is the main probe function used to
  * call the alloc_etherdev, allocate the priv structure.
  */
 struct stmmac_priv *stmmac_dvr_probe(struct device *device,
-                                        struct plat_stmmacenet_data *plat_dat)
+                                     struct plat_stmmacenet_data *plat_dat,
+                                     void __iomem *addr)
 {
         int ret = 0;
         struct net_device *ndev = NULL;
@@ -1815,10 +1814,27 @@ struct stmmac_priv *stmmac_dvr_probe(struct device *device,
 
         ether_setup(ndev);
 
-        ndev->netdev_ops = &stmmac_netdev_ops;
         stmmac_set_ethtool_ops(ndev);
+        priv->pause = pause;
+        priv->plat = plat_dat;
+        priv->ioaddr = addr;
+        priv->dev->base_addr = (unsigned long)addr;
+
+        /* Verify driver arguments */
+        stmmac_verify_args();
+
+        /* Override with kernel parameters if supplied XXX CRS XXX
+         * this needs to have multiple instances */
+        if ((phyaddr >= 0) && (phyaddr <= 31))
+                priv->plat->phy_addr = phyaddr;
+
+        /* Init MAC and get the capabilities */
+        stmmac_hw_init(priv);
+
+        ndev->netdev_ops = &stmmac_netdev_ops;
 
-        ndev->hw_features = NETIF_F_SG | NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM;
+        ndev->hw_features = NETIF_F_SG | NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
+                            NETIF_F_RXCSUM;
         ndev->features |= ndev->hw_features | NETIF_F_HIGHDMA;
         ndev->watchdog_timeo = msecs_to_jiffies(watchdog);
 #ifdef STMMAC_VLAN_TAG_USED
@@ -1830,8 +1846,6 @@ struct stmmac_priv *stmmac_dvr_probe(struct device *device,
         if (flow_ctrl)
                 priv->flow_ctrl = FLOW_AUTO;    /* RX/TX pause on */
 
-        priv->pause = pause;
-        priv->plat = plat_dat;
         netif_napi_add(ndev, &priv->napi, stmmac_poll, 64);
 
         spin_lock_init(&priv->lock);
@@ -1839,15 +1853,10 @@ struct stmmac_priv *stmmac_dvr_probe(struct device *device,
 
         ret = register_netdev(ndev);
         if (ret) {
-                pr_err("%s: ERROR %i registering the device\n",
-                       __func__, ret);
+                pr_err("%s: ERROR %i registering the device\n", __func__, ret);
                 goto error;
         }
 
-        DBG(probe, DEBUG, "%s: Scatter/Gather: %s - HW checksums: %s\n",
-            ndev->name, (ndev->features & NETIF_F_SG) ? "on" : "off",
-            (ndev->features & NETIF_F_IP_CSUM) ? "on" : "off");
-
         return priv;
 
 error:
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c
index c796de9eed72..50ad5b80cfaf 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c
@@ -96,13 +96,11 @@ static int __devinit stmmac_pci_probe(struct pci_dev *pdev,
 
         stmmac_default_data();
 
-        priv = stmmac_dvr_probe(&(pdev->dev), &plat_dat);
+        priv = stmmac_dvr_probe(&(pdev->dev), &plat_dat, addr);
         if (!priv) {
-                pr_err("%s: main drivr probe failed", __func__);
+                pr_err("%s: main driver probe failed", __func__);
                 goto err_out;
         }
-        priv->ioaddr = addr;
-        priv->dev->base_addr = (unsigned long)addr;
         priv->dev->irq = pdev->irq;
         priv->wol_irq = pdev->irq;
 
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
index 1ac83243649a..3aad9810237c 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
@@ -59,16 +59,20 @@ static int stmmac_pltfr_probe(struct platform_device *pdev)
                 goto out_release_region;
         }
         plat_dat = pdev->dev.platform_data;
-        priv = stmmac_dvr_probe(&(pdev->dev), plat_dat);
+
+        /* Custom initialisation (if needed)*/
+        if (plat_dat->init) {
+                ret = plat_dat->init(pdev);
+                if (unlikely(ret))
+                        goto out_unmap;
+        }
+
+        priv = stmmac_dvr_probe(&(pdev->dev), plat_dat, addr);
         if (!priv) {
-                pr_err("%s: main drivr probe failed", __func__);
+                pr_err("%s: main driver probe failed", __func__);
                 goto out_unmap;
         }
 
-        priv->ioaddr = addr;
-        /* Set the I/O base addr */
-        priv->dev->base_addr = (unsigned long)addr;
-
         /* Get the MAC information */
         priv->dev->irq = platform_get_irq_byname(pdev, "macirq");
         if (priv->dev->irq == -ENXIO) {
@@ -92,13 +96,6 @@ static int stmmac_pltfr_probe(struct platform_device *pdev)
 
         platform_set_drvdata(pdev, priv->dev);
 
-        /* Custom initialisation */
-        if (priv->plat->init) {
-                ret = priv->plat->init(pdev);
-                if (unlikely(ret))
-                        goto out_unmap;
-        }
-
         pr_debug("STMMAC platform driver registration completed");
 
         return 0;
diff --git a/drivers/net/ethernet/ti/cpmac.c b/drivers/net/ethernet/ti/cpmac.c
index 4d9a28ffd3c3..cbc8df78d84b 100644
--- a/drivers/net/ethernet/ti/cpmac.c
+++ b/drivers/net/ethernet/ti/cpmac.c
@@ -1122,7 +1122,7 @@ static int __devinit cpmac_probe(struct platform_device *pdev)
         pdata = pdev->dev.platform_data;
 
         if (external_switch || dumb_switch) {
-                strncpy(mdio_bus_id, "0", MII_BUS_ID_SIZE); /* fixed phys bus */
+                strncpy(mdio_bus_id, "fixed-0", MII_BUS_ID_SIZE); /* fixed phys bus */
                 phy_id = pdev->id;
         } else {
                 for (phy_id = 0; phy_id < PHY_MAX_ADDR; phy_id++) {
@@ -1138,7 +1138,7 @@ static int __devinit cpmac_probe(struct platform_device *pdev)
         if (phy_id == PHY_MAX_ADDR) {
                 dev_err(&pdev->dev, "no PHY present, falling back "
                                         "to switch on MDIO bus 0\n");
-                strncpy(mdio_bus_id, "0", MII_BUS_ID_SIZE); /* fixed phys bus */
+                strncpy(mdio_bus_id, "fixed-0", MII_BUS_ID_SIZE); /* fixed phys bus */
                 phy_id = pdev->id;
         }
 
diff --git a/drivers/net/ethernet/xscale/ixp4xx_eth.c b/drivers/net/ethernet/xscale/ixp4xx_eth.c
index 72a854f05bb8..41a8b5a9849e 100644
--- a/drivers/net/ethernet/xscale/ixp4xx_eth.c
+++ b/drivers/net/ethernet/xscale/ixp4xx_eth.c
@@ -1416,7 +1416,8 @@ static int __devinit eth_init_one(struct platform_device *pdev)
         __raw_writel(DEFAULT_CORE_CNTRL, &port->regs->core_control);
         udelay(50);
 
-        snprintf(phy_id, MII_BUS_ID_SIZE + 3, PHY_ID_FMT, "0", plat->phy);
+        snprintf(phy_id, MII_BUS_ID_SIZE + 3, PHY_ID_FMT,
+                mdio_bus->id, plat->phy);
         port->phydev = phy_connect(dev, phy_id, &ixp4xx_adjust_link, 0,
                                    PHY_INTERFACE_MODE_MII);
         if (IS_ERR(port->phydev)) {
diff --git a/drivers/net/usb/ipheth.c b/drivers/net/usb/ipheth.c
index e84662db51cc..dd78c4cbd459 100644
--- a/drivers/net/usb/ipheth.c
+++ b/drivers/net/usb/ipheth.c
@@ -60,6 +60,7 @@
 #define USB_PRODUCT_IPHONE_3GS  0x1294
 #define USB_PRODUCT_IPHONE_4    0x1297
 #define USB_PRODUCT_IPHONE_4_VZW 0x129c
+#define USB_PRODUCT_IPHONE_4S   0x12a0
 
 #define IPHETH_USBINTF_CLASS    255
 #define IPHETH_USBINTF_SUBCLASS 253
@@ -103,6 +104,10 @@ static struct usb_device_id ipheth_table[] = {
                 USB_VENDOR_APPLE, USB_PRODUCT_IPHONE_4_VZW,
                 IPHETH_USBINTF_CLASS, IPHETH_USBINTF_SUBCLASS,
                 IPHETH_USBINTF_PROTO) },
+        { USB_DEVICE_AND_INTERFACE_INFO(
+                USB_VENDOR_APPLE, USB_PRODUCT_IPHONE_4S,
+                IPHETH_USBINTF_CLASS, IPHETH_USBINTF_SUBCLASS,
+                IPHETH_USBINTF_PROTO) },
         { }
 };
 MODULE_DEVICE_TABLE(usb, ipheth_table);
diff --git a/drivers/net/veth.c b/drivers/net/veth.c
index 49f4667e1fa3..4a3402898f2a 100644
--- a/drivers/net/veth.c
+++ b/drivers/net/veth.c
@@ -422,7 +422,9 @@ static void veth_dellink(struct net_device *dev, struct list_head *head)
         unregister_netdevice_queue(peer, head);
 }
 
-static const struct nla_policy veth_policy[VETH_INFO_MAX + 1];
+static const struct nla_policy veth_policy[VETH_INFO_MAX + 1] = {
+        [VETH_INFO_PEER]        = { .len = sizeof(struct ifinfomsg) },
+};
 
 static struct rtnl_link_ops veth_link_ops = {
         .kind           = DRV_NAME,
diff --git a/drivers/net/wireless/rtlwifi/pci.c b/drivers/net/wireless/rtlwifi/pci.c
index 39e0907a3c4e..9245d882c06a 100644
--- a/drivers/net/wireless/rtlwifi/pci.c
+++ b/drivers/net/wireless/rtlwifi/pci.c
@@ -1501,7 +1501,7 @@ static int rtl_pci_init(struct ieee80211_hw *hw, struct pci_dev *pdev)
                 return err;
         }
 
-        return 1;
+        return 0;
 }
 
 static int rtl_pci_start(struct ieee80211_hw *hw)
@@ -1870,7 +1870,7 @@ int __devinit rtl_pci_probe(struct pci_dev *pdev,
         }
 
         /* Init PCI sw */
-        err = !rtl_pci_init(hw, pdev);
+        err = rtl_pci_init(hw, pdev);
         if (err) {
                 RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
                          ("Failed to init PCI.\n"));
diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index 556b08298669..ddefc513b44a 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -194,7 +194,7 @@ static void netpoll_poll_dev(struct net_device *dev)
 
         poll_napi(dev);
 
-        if (dev->priv_flags & IFF_SLAVE) {
+        if (dev->flags & IFF_SLAVE) {
                 if (dev->npinfo) {
                         struct net_device *bond_dev = dev->master;
                         struct sk_buff *skb;
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 976034f82320..53c8ce4046b2 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -1307,25 +1307,26 @@ static int tcp_match_skb_to_sack(struct sock *sk, struct sk_buff *skb,
         return in_sack;
 }
 
-static u8 tcp_sacktag_one(const struct sk_buff *skb, struct sock *sk,
-                          struct tcp_sacktag_state *state,
+/* Mark the given newly-SACKed range as such, adjusting counters and hints. */
+static u8 tcp_sacktag_one(struct sock *sk,
+                          struct tcp_sacktag_state *state, u8 sacked,
+                          u32 start_seq, u32 end_seq,
                           int dup_sack, int pcount)
 {
         struct tcp_sock *tp = tcp_sk(sk);
-        u8 sacked = TCP_SKB_CB(skb)->sacked;
         int fack_count = state->fack_count;
 
         /* Account D-SACK for retransmitted packet. */
         if (dup_sack && (sacked & TCPCB_RETRANS)) {
                 if (tp->undo_marker && tp->undo_retrans &&
-                    after(TCP_SKB_CB(skb)->end_seq, tp->undo_marker))
+                    after(end_seq, tp->undo_marker))
                         tp->undo_retrans--;
                 if (sacked & TCPCB_SACKED_ACKED)
                         state->reord = min(fack_count, state->reord);
         }
 
         /* Nothing to do; acked frame is about to be dropped (was ACKed). */
-        if (!after(TCP_SKB_CB(skb)->end_seq, tp->snd_una))
+        if (!after(end_seq, tp->snd_una))
                 return sacked;
 
         if (!(sacked & TCPCB_SACKED_ACKED)) {
@@ -1344,13 +1345,13 @@ static u8 tcp_sacktag_one(const struct sk_buff *skb, struct sock *sk,
                                 /* New sack for not retransmitted frame,
                                  * which was in hole. It is reordering.
                                  */
-                                if (before(TCP_SKB_CB(skb)->seq,
+                                if (before(start_seq,
                                            tcp_highest_sack_seq(tp)))
                                         state->reord = min(fack_count,
                                                            state->reord);
 
                                 /* SACK enhanced F-RTO (RFC4138; Appendix B) */
-                                if (!after(TCP_SKB_CB(skb)->end_seq, tp->frto_highmark))
+                                if (!after(end_seq, tp->frto_highmark))
                                         state->flag |= FLAG_ONLY_ORIG_SACKED;
                         }
 
@@ -1368,8 +1369,7 @@ static u8 tcp_sacktag_one(const struct sk_buff *skb, struct sock *sk,
 
                 /* Lost marker hint past SACKed? Tweak RFC3517 cnt */
                 if (!tcp_is_fack(tp) && (tp->lost_skb_hint != NULL) &&
-                    before(TCP_SKB_CB(skb)->seq,
-                           TCP_SKB_CB(tp->lost_skb_hint)->seq))
+                    before(start_seq, TCP_SKB_CB(tp->lost_skb_hint)->seq))
                         tp->lost_cnt_hint += pcount;
 
                 if (fack_count > tp->fackets_out)
@@ -1388,6 +1388,9 @@ static u8 tcp_sacktag_one(const struct sk_buff *skb, struct sock *sk,
         return sacked;
 }
 
+/* Shift newly-SACKed bytes from this skb to the immediately previous
+ * already-SACKed sk_buff. Mark the newly-SACKed bytes as such.
+ */
 static int tcp_shifted_skb(struct sock *sk, struct sk_buff *skb,
                            struct tcp_sacktag_state *state,
                            unsigned int pcount, int shifted, int mss,
@@ -1395,10 +1398,13 @@ static int tcp_shifted_skb(struct sock *sk, struct sk_buff *skb,
 {
         struct tcp_sock *tp = tcp_sk(sk);
         struct sk_buff *prev = tcp_write_queue_prev(sk, skb);
+        u32 start_seq = TCP_SKB_CB(skb)->seq;   /* start of newly-SACKed */
+        u32 end_seq = start_seq + shifted;      /* end of newly-SACKed */
 
         BUG_ON(!pcount);
 
-        if (skb == tp->lost_skb_hint)
+        /* Adjust hint for FACK. Non-FACK is handled in tcp_sacktag_one(). */
+        if (tcp_is_fack(tp) && (skb == tp->lost_skb_hint))
                 tp->lost_cnt_hint += pcount;
 
         TCP_SKB_CB(prev)->end_seq += shifted;
@@ -1424,8 +1430,11 @@ static int tcp_shifted_skb(struct sock *sk, struct sk_buff *skb,
                 skb_shinfo(skb)->gso_type = 0;
         }
 
-        /* We discard results */
-        tcp_sacktag_one(skb, sk, state, dup_sack, pcount);
+        /* Adjust counters and hints for the newly sacked sequence range but
+         * discard the return value since prev is already marked.
+         */
+        tcp_sacktag_one(sk, state, TCP_SKB_CB(skb)->sacked,
+                        start_seq, end_seq, dup_sack, pcount);
 
         /* Difference in this won't matter, both ACKed by the same cumul. ACK */
         TCP_SKB_CB(prev)->sacked |= (TCP_SKB_CB(skb)->sacked & TCPCB_EVER_RETRANS);
@@ -1664,10 +1673,14 @@ static struct sk_buff *tcp_sacktag_walk(struct sk_buff *skb, struct sock *sk,
                         break;
 
                 if (in_sack) {
-                        TCP_SKB_CB(skb)->sacked = tcp_sacktag_one(skb, sk,
-                                                                  state,
-                                                                  dup_sack,
-                                                                  tcp_skb_pcount(skb));
+                        TCP_SKB_CB(skb)->sacked =
+                                tcp_sacktag_one(sk,
+                                                state,
+                                                TCP_SKB_CB(skb)->sacked,
+                                                TCP_SKB_CB(skb)->seq,
+                                                TCP_SKB_CB(skb)->end_seq,
+                                                dup_sack,
+                                                tcp_skb_pcount(skb));
 
                         if (!before(TCP_SKB_CB(skb)->seq,
                                     tcp_highest_sack_seq(tp)))
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 0a0d94ad9b08..b142bd4c2390 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -910,6 +910,8 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
                 wiphy_debug(local->hw.wiphy, "Failed to initialize wep: %d\n",
                             result);
 
+        ieee80211_led_init(local);
+
         rtnl_lock();
 
         result = ieee80211_init_rate_ctrl_alg(local,
@@ -931,8 +933,6 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
 
         rtnl_unlock();
 
-        ieee80211_led_init(local);
-
         local->network_latency_notifier.notifier_call =
                 ieee80211_max_network_latency;
         result = pm_qos_add_notifier(PM_QOS_NETWORK_LATENCY,
diff --git a/net/rxrpc/ar-key.c b/net/rxrpc/ar-key.c
index 4cba13e46ffd..ae3a035f5390 100644
--- a/net/rxrpc/ar-key.c
+++ b/net/rxrpc/ar-key.c
@@ -232,7 +232,7 @@ static int rxrpc_krb5_decode_principal(struct krb5_principal *princ,
         if (toklen <= (n_parts + 1) * 4)
                 return -EINVAL;
 
-        princ->name_parts = kcalloc(sizeof(char *), n_parts, GFP_KERNEL);
+        princ->name_parts = kcalloc(n_parts, sizeof(char *), GFP_KERNEL);
         if (!princ->name_parts)
                 return -ENOMEM;
 
@@ -355,7 +355,7 @@ static int rxrpc_krb5_decode_tagged_array(struct krb5_tagged_data **_td,
 
                 _debug("n_elem %d", n_elem);
 
-                td = kcalloc(sizeof(struct krb5_tagged_data), n_elem,
+                td = kcalloc(n_elem, sizeof(struct krb5_tagged_data),
                              GFP_KERNEL);
                 if (!td)
                         return -ENOMEM;