Merge branch 'sh/stable-updates'

64 files changed, 492 insertions, 254 deletions

diff --git a/drivers/net/3c515.c b/drivers/net/3c515.c
index 3e00fa8ea65f..4a7c32895be5 100644
--- a/drivers/net/3c515.c
+++ b/drivers/net/3c515.c
@@ -832,7 +832,9 @@ static int corkscrew_open(struct net_device *dev)
                         skb_reserve(skb, 2);    /* Align IP on 16 byte boundaries */
                         vp->rx_ring[i].addr = isa_virt_to_bus(skb->data);
                 }
-                vp->rx_ring[i - 1].next = isa_virt_to_bus(&vp->rx_ring[0]);     /* Wrap the ring. */
+                if (i != 0)
+                        vp->rx_ring[i - 1].next =
+                                isa_virt_to_bus(&vp->rx_ring[0]);       /* Wrap the ring. */
                 outl(isa_virt_to_bus(&vp->rx_ring[0]), ioaddr + UpListPtr);
         }
         if (vp->full_bus_master_tx) {   /* Boomerang bus master Tx. */
diff --git a/drivers/net/3c59x.c b/drivers/net/3c59x.c
index c34aee91250b..c20416850948 100644
--- a/drivers/net/3c59x.c
+++ b/drivers/net/3c59x.c
@@ -2721,13 +2721,15 @@ dump_tx_ring(struct net_device *dev)
                                    &vp->tx_ring[vp->dirty_tx % TX_RING_SIZE]);
                         issue_and_wait(dev, DownStall);
                         for (i = 0; i < TX_RING_SIZE; i++) {
-                                pr_err("  %d: @%p  length %8.8x status %8.8x\n", i,
-                                           &vp->tx_ring[i],
+                                unsigned int length;
+
 #if DO_ZEROCOPY
-                                           le32_to_cpu(vp->tx_ring[i].frag[0].length),
+                                length = le32_to_cpu(vp->tx_ring[i].frag[0].length);
 #else
-                                           le32_to_cpu(vp->tx_ring[i].length),
+                                length = le32_to_cpu(vp->tx_ring[i].length);
 #endif
+                                pr_err("  %d: @%p  length %8.8x status %8.8x\n",
+                                           i, &vp->tx_ring[i], length,
                                            le32_to_cpu(vp->tx_ring[i].status));
                         }
                         if (!stalled)
diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
index b5a7513df4eb..5f6509a5f640 100644
--- a/drivers/net/Kconfig
+++ b/drivers/net/Kconfig
@@ -1732,6 +1732,7 @@ config KS8842
 config KS8851
        tristate "Micrel KS8851 SPI"
        depends on SPI
+       select MII
        help
          SPI driver for Micrel KS8851 SPI attached network chip.
 
diff --git a/drivers/net/arm/at91_ether.c b/drivers/net/arm/at91_ether.c
index 2e7419a61191..5041d10bae9d 100644
--- a/drivers/net/arm/at91_ether.c
+++ b/drivers/net/arm/at91_ether.c
@@ -1228,7 +1228,6 @@ static int at91ether_resume(struct platform_device *pdev)
 #endif
 
 static struct platform_driver at91ether_driver = {
-        .probe          = at91ether_probe,
         .remove         = __devexit_p(at91ether_remove),
         .suspend        = at91ether_suspend,
         .resume         = at91ether_resume,
@@ -1240,7 +1239,7 @@ static struct platform_driver at91ether_driver = {
 
 static int __init at91ether_init(void)
 {
-        return platform_driver_register(&at91ether_driver);
+        return platform_driver_probe(&at91ether_driver, at91ether_probe);
 }
 
 static void __exit at91ether_exit(void)
diff --git a/drivers/net/at1700.c b/drivers/net/at1700.c
index 18b566ad4fd1..cf30e278f182 100644
--- a/drivers/net/at1700.c
+++ b/drivers/net/at1700.c
@@ -318,7 +318,7 @@ static int __init at1700_probe1(struct net_device *dev, int ioaddr)
                                 pos3 = mca_read_stored_pos( slot, 3 );
                                 pos4 = mca_read_stored_pos( slot, 4 );
 
-                                for (l_i = 0; l_i < 0x09; l_i++)
+                                for (l_i = 0; l_i < 8; l_i++)
                                         if (( pos3 & 0x07) == at1700_ioaddr_pattern[l_i])
                                                 break;
                                 ioaddr = at1700_mca_probe_list[l_i];
diff --git a/drivers/net/benet/be_main.c b/drivers/net/benet/be_main.c
index c43f6a119295..dea3155688bb 100644
--- a/drivers/net/benet/be_main.c
+++ b/drivers/net/benet/be_main.c
@@ -667,7 +667,7 @@ static void skb_fill_rx_data(struct be_adapter *adapter,
         struct be_queue_info *rxq = &adapter->rx_obj.q;
         struct be_rx_page_info *page_info;
         u16 rxq_idx, i, num_rcvd, j;
-        u32 pktsize, hdr_len, curr_frag_len;
+        u32 pktsize, hdr_len, curr_frag_len, size;
         u8 *start;
 
         rxq_idx = AMAP_GET_BITS(struct amap_eth_rx_compl, fragndx, rxcp);
@@ -708,12 +708,13 @@ static void skb_fill_rx_data(struct be_adapter *adapter,
         }
 
         /* More frags present for this completion */
-        pktsize -= curr_frag_len; /* account for above copied frag */
+        size = pktsize;
         for (i = 1, j = 0; i < num_rcvd; i++) {
+                size -= curr_frag_len;
                 index_inc(&rxq_idx, rxq->len);
                 page_info = get_rx_page_info(adapter, rxq_idx);
 
-                curr_frag_len = min(pktsize, rx_frag_size);
+                curr_frag_len = min(size, rx_frag_size);
 
                 /* Coalesce all frags from the same physical page in one slot */
                 if (page_info->page_offset == 0) {
@@ -731,7 +732,6 @@ static void skb_fill_rx_data(struct be_adapter *adapter,
                 skb_shinfo(skb)->frags[j].size += curr_frag_len;
                 skb->len += curr_frag_len;
                 skb->data_len += curr_frag_len;
-                pktsize -= curr_frag_len;
 
                 memset(page_info, 0, sizeof(*page_info));
         }
diff --git a/drivers/net/cnic.c b/drivers/net/cnic.c
index 4d1515f45ba2..4869d77cbe91 100644
--- a/drivers/net/cnic.c
+++ b/drivers/net/cnic.c
@@ -227,7 +227,7 @@ static int cnic_send_nlmsg(struct cnic_local *cp, u32 type,
         }
 
         rcu_read_lock();
-        ulp_ops = rcu_dereference(cp->ulp_ops[CNIC_ULP_ISCSI]);
+        ulp_ops = rcu_dereference(cnic_ulp_tbl[CNIC_ULP_ISCSI]);
         if (ulp_ops)
                 ulp_ops->iscsi_nl_send_msg(cp->dev, msg_type, buf, len);
         rcu_read_unlock();
@@ -319,6 +319,20 @@ static int cnic_abort_prep(struct cnic_sock *csk)
         return 0;
 }
 
+static void cnic_uio_stop(void)
+{
+        struct cnic_dev *dev;
+
+        read_lock(&cnic_dev_lock);
+        list_for_each_entry(dev, &cnic_dev_list, list) {
+                struct cnic_local *cp = dev->cnic_priv;
+
+                if (cp->cnic_uinfo)
+                        cnic_send_nlmsg(cp, ISCSI_KEVENT_IF_DOWN, NULL);
+        }
+        read_unlock(&cnic_dev_lock);
+}
+
 int cnic_register_driver(int ulp_type, struct cnic_ulp_ops *ulp_ops)
 {
         struct cnic_dev *dev;
@@ -390,6 +404,9 @@ int cnic_unregister_driver(int ulp_type)
         }
         read_unlock(&cnic_dev_lock);
 
+        if (ulp_type == CNIC_ULP_ISCSI)
+                cnic_uio_stop();
+
         rcu_assign_pointer(cnic_ulp_tbl[ulp_type], NULL);
 
         mutex_unlock(&cnic_lock);
@@ -632,7 +649,6 @@ static void cnic_free_resc(struct cnic_dev *dev)
         int i = 0;
 
         if (cp->cnic_uinfo) {
-                cnic_send_nlmsg(cp, ISCSI_KEVENT_IF_DOWN, NULL);
                 while (cp->uio_dev != -1 && i < 15) {
                         msleep(100);
                         i++;
@@ -1057,6 +1073,9 @@ static void cnic_ulp_stop(struct cnic_dev *dev)
         struct cnic_local *cp = dev->cnic_priv;
         int if_type;
 
+        if (cp->cnic_uinfo)
+                cnic_send_nlmsg(cp, ISCSI_KEVENT_IF_DOWN, NULL);
+
         rcu_read_lock();
         for (if_type = 0; if_type < MAX_CNIC_ULP_TYPE; if_type++) {
                 struct cnic_ulp_ops *ulp_ops;
diff --git a/drivers/net/eepro.c b/drivers/net/eepro.c
index cc2ab6412c73..4f7003485348 100644
--- a/drivers/net/eepro.c
+++ b/drivers/net/eepro.c
@@ -1784,7 +1784,7 @@ int __init init_module(void)
                 printk(KERN_INFO "eepro_init_module: Auto-detecting boards (May God protect us...)\n");
         }
 
-        for (i = 0; io[i] != -1 && i < MAX_EEPRO; i++) {
+        for (i = 0; i < MAX_EEPRO && io[i] != -1; i++) {
                 dev = alloc_etherdev(sizeof(struct eepro_local));
                 if (!dev)
                         break;
diff --git a/drivers/net/eexpress.c b/drivers/net/eexpress.c
index 1686dca28748..1f016d66684a 100644
--- a/drivers/net/eexpress.c
+++ b/drivers/net/eexpress.c
@@ -1474,13 +1474,13 @@ static void eexp_hw_init586(struct net_device *dev)
         outw(0x0000, ioaddr + 0x800c);
         outw(0x0000, ioaddr + 0x800e);
 
-        for (i = 0; i < (sizeof(start_code)); i+=32) {
+        for (i = 0; i < ARRAY_SIZE(start_code) * 2; i+=32) {
                 int j;
                 outw(i, ioaddr + SM_PTR);
-                for (j = 0; j < 16; j+=2)
+                for (j = 0; j < 16 && (i+j)/2 < ARRAY_SIZE(start_code); j+=2)
                         outw(start_code[(i+j)/2],
                              ioaddr+0x4000+j);
-                for (j = 0; j < 16; j+=2)
+                for (j = 0; j < 16 && (i+j+16)/2 < ARRAY_SIZE(start_code); j+=2)
                         outw(start_code[(i+j+16)/2],
                              ioaddr+0x8000+j);
         }
diff --git a/drivers/net/ehea/ehea.h b/drivers/net/ehea/ehea.h
index 78952f8324e2..fa311a950996 100644
--- a/drivers/net/ehea/ehea.h
+++ b/drivers/net/ehea/ehea.h
@@ -40,7 +40,7 @@
 #include <asm/io.h>
 
 #define DRV_NAME        "ehea"
-#define DRV_VERSION     "EHEA_0101"
+#define DRV_VERSION     "EHEA_0102"
 
 /* eHEA capability flags */
 #define DLPAR_PORT_ADD_REM 1
diff --git a/drivers/net/ehea/ehea_main.c b/drivers/net/ehea/ehea_main.c
index e8d46cc1bec2..977c3d358279 100644
--- a/drivers/net/ehea/ehea_main.c
+++ b/drivers/net/ehea/ehea_main.c
@@ -1545,6 +1545,9 @@ static int ehea_clean_portres(struct ehea_port *port, struct ehea_port_res *pr)
 {
         int ret, i;
 
+        if (pr->qp)
+                netif_napi_del(&pr->napi);
+
         ret = ehea_destroy_qp(pr->qp);
 
         if (!ret) {
diff --git a/drivers/net/fealnx.c b/drivers/net/fealnx.c
index 48385c42ab57..160655d24581 100644
--- a/drivers/net/fealnx.c
+++ b/drivers/net/fealnx.c
@@ -584,7 +584,8 @@ static int __devinit fealnx_init_one(struct pci_dev *pdev,
         if (np->flags == HAS_MII_XCVR) {
                 int phy, phy_idx = 0;
 
-                for (phy = 1; phy < 32 && phy_idx < 4; phy++) {
+                for (phy = 1; phy < 32 && phy_idx < ARRAY_SIZE(np->phys);
+                               phy++) {
                         int mii_status = mdio_read(dev, phy, 1);
 
                         if (mii_status != 0xffff && mii_status != 0x0000) {
diff --git a/drivers/net/fs_enet/fs_enet-main.c b/drivers/net/fs_enet/fs_enet-main.c
index b892c3ad9a74..2bc2d2b20644 100644
--- a/drivers/net/fs_enet/fs_enet-main.c
+++ b/drivers/net/fs_enet/fs_enet-main.c
@@ -754,17 +754,16 @@ static int fs_init_phy(struct net_device *dev)
         fep->oldlink = 0;
         fep->oldspeed = 0;
         fep->oldduplex = -1;
-        if(fep->fpi->phy_node)
-                phydev = of_phy_connect(dev, fep->fpi->phy_node,
-                                        &fs_adjust_link, 0,
-                                        PHY_INTERFACE_MODE_MII);
-        else {
-                printk("No phy bus ID specified in BSP code\n");
-                return -EINVAL;
+
+        phydev = of_phy_connect(dev, fep->fpi->phy_node, &fs_adjust_link, 0,
+                                PHY_INTERFACE_MODE_MII);
+        if (!phydev) {
+                phydev = of_phy_connect_fixed_link(dev, &fs_adjust_link,
+                                                   PHY_INTERFACE_MODE_MII);
         }
-        if (IS_ERR(phydev)) {
-                printk(KERN_ERR "%s: Could not attach to PHY\n", dev->name);
-                return PTR_ERR(phydev);
+        if (!phydev) {
+                dev_err(&dev->dev, "Could not attach to PHY\n");
+                return -ENODEV;
         }
 
         fep->phydev = phydev;
@@ -1005,6 +1004,7 @@ static int __devinit fs_enet_probe(struct of_device *ofdev,
                 goto out_free_fpi;
         }
 
+        SET_NETDEV_DEV(ndev, &ofdev->dev);
         dev_set_drvdata(&ofdev->dev, ndev);
 
         fep = netdev_priv(ndev);
diff --git a/drivers/net/gianfar.c b/drivers/net/gianfar.c
index 43d813ed9f45..f8ffcbf0bc39 100644
--- a/drivers/net/gianfar.c
+++ b/drivers/net/gianfar.c
@@ -264,15 +264,6 @@ static int gfar_of_init(struct net_device *dev)
                 priv->device_flags |= FSL_GIANFAR_DEV_HAS_MAGIC_PACKET;
 
         priv->phy_node = of_parse_phandle(np, "phy-handle", 0);
-        if (!priv->phy_node) {
-                u32 *fixed_link;
-
-                fixed_link = (u32 *)of_get_property(np, "fixed-link", NULL);
-                if (!fixed_link) {
-                        err = -ENODEV;
-                        goto err_out;
-                }
-        }
 
         /* Find the TBI PHY.  If it's not there, we don't support SGMII */
         priv->tbi_node = of_parse_phandle(np, "tbi-handle", 0);
@@ -659,13 +650,14 @@ static int init_phy(struct net_device *dev)
 
         interface = gfar_get_interface(dev);
 
-        if (priv->phy_node) {
-                priv->phydev = of_phy_connect(dev, priv->phy_node, &adjust_link,
-                                              0, interface);
-                if (!priv->phydev) {
-                        dev_err(&dev->dev, "error: Could not attach to PHY\n");
-                        return -ENODEV;
-                }
+        priv->phydev = of_phy_connect(dev, priv->phy_node, &adjust_link, 0,
+                                      interface);
+        if (!priv->phydev)
+                priv->phydev = of_phy_connect_fixed_link(dev, &adjust_link,
+                                                         interface);
+        if (!priv->phydev) {
+                dev_err(&dev->dev, "could not attach to PHY\n");
+                return -ENODEV;
         }
 
         if (interface == PHY_INTERFACE_MODE_SGMII)
diff --git a/drivers/net/gianfar_ethtool.c b/drivers/net/gianfar_ethtool.c
index dbf06e9313cc..2234118eedbb 100644
--- a/drivers/net/gianfar_ethtool.c
+++ b/drivers/net/gianfar_ethtool.c
@@ -366,9 +366,8 @@ static int gfar_scoalesce(struct net_device *dev, struct ethtool_coalesce *cvals
                 return -EINVAL;
         }
 
-        priv->rxic = mk_ic_value(
-                gfar_usecs2ticks(priv, cvals->rx_coalesce_usecs),
-                cvals->rx_max_coalesced_frames);
+        priv->rxic = mk_ic_value(cvals->rx_max_coalesced_frames,
+                gfar_usecs2ticks(priv, cvals->rx_coalesce_usecs));
 
         /* Set up tx coalescing */
         if ((cvals->tx_coalesce_usecs == 0) ||
@@ -390,9 +389,8 @@ static int gfar_scoalesce(struct net_device *dev, struct ethtool_coalesce *cvals
                 return -EINVAL;
         }
 
-        priv->txic = mk_ic_value(
-                gfar_usecs2ticks(priv, cvals->tx_coalesce_usecs),
-                cvals->tx_max_coalesced_frames);
+        priv->txic = mk_ic_value(cvals->tx_max_coalesced_frames,
+                gfar_usecs2ticks(priv, cvals->tx_coalesce_usecs));
 
         gfar_write(&priv->regs->rxic, 0);
         if (priv->rxcoalescing)
diff --git a/drivers/net/igbvf/vf.c b/drivers/net/igbvf/vf.c
index 2a4faf9ade69..a9a61efa964c 100644
--- a/drivers/net/igbvf/vf.c
+++ b/drivers/net/igbvf/vf.c
@@ -274,6 +274,8 @@ static s32 e1000_set_vfta_vf(struct e1000_hw *hw, u16 vid, bool set)
 
         err = mbx->ops.read_posted(hw, msgbuf, 2);
 
+        msgbuf[0] &= ~E1000_VT_MSGTYPE_CTS;
+
         /* if nacked the vlan was rejected */
         if (!err && (msgbuf[0] == (E1000_VF_SET_VLAN | E1000_VT_MSGTYPE_NACK)))
                 err = -E1000_ERR_MAC_INIT;
@@ -317,6 +319,8 @@ static void e1000_rar_set_vf(struct e1000_hw *hw, u8 * addr, u32 index)
         if (!ret_val)
                 ret_val = mbx->ops.read_posted(hw, msgbuf, 3);
 
+        msgbuf[0] &= ~E1000_VT_MSGTYPE_CTS;
+
         /* if nacked the address was rejected, use "perm_addr" */
         if (!ret_val &&
             (msgbuf[0] == (E1000_VF_SET_MAC_ADDR | E1000_VT_MSGTYPE_NACK)))
diff --git a/drivers/net/ixgbe/ixgbe.h b/drivers/net/ixgbe/ixgbe.h
index cd22323cfd22..e11d83d5852b 100644
--- a/drivers/net/ixgbe/ixgbe.h
+++ b/drivers/net/ixgbe/ixgbe.h
@@ -96,6 +96,8 @@
 #define IXGBE_TX_FLAGS_VLAN_PRIO_MASK   0x0000e000
 #define IXGBE_TX_FLAGS_VLAN_SHIFT       16
 
+#define IXGBE_MAX_RSC_INT_RATE          162760
+
 /* wrapper around a pointer to a socket buffer,
  * so a DMA handle can be stored along with the buffer */
 struct ixgbe_tx_buffer {
@@ -327,6 +329,7 @@ struct ixgbe_adapter {
 #define IXGBE_FLAG_IN_SFP_MOD_TASK              (u32)(1 << 25)
 #define IXGBE_FLAG_FDIR_HASH_CAPABLE            (u32)(1 << 26)
 #define IXGBE_FLAG_FDIR_PERFECT_CAPABLE         (u32)(1 << 27)
+#define IXGBE_FLAG_FCOE_CAPABLE                 (u32)(1 << 28)
 #define IXGBE_FLAG_FCOE_ENABLED                 (u32)(1 << 29)
 
         u32 flags2;
diff --git a/drivers/net/ixgbe/ixgbe_82598.c b/drivers/net/ixgbe/ixgbe_82598.c
index b9923047ce11..522c03bc1dad 100644
--- a/drivers/net/ixgbe/ixgbe_82598.c
+++ b/drivers/net/ixgbe/ixgbe_82598.c
@@ -50,6 +50,51 @@ static s32 ixgbe_read_i2c_eeprom_82598(struct ixgbe_hw *hw, u8 byte_offset,
                                        u8 *eeprom_data);
 
 /**
+ *  ixgbe_set_pcie_completion_timeout - set pci-e completion timeout
+ *  @hw: pointer to the HW structure
+ *
+ *  The defaults for 82598 should be in the range of 50us to 50ms,
+ *  however the hardware default for these parts is 500us to 1ms which is less
+ *  than the 10ms recommended by the pci-e spec.  To address this we need to
+ *  increase the value to either 10ms to 250ms for capability version 1 config,
+ *  or 16ms to 55ms for version 2.
+ **/
+void ixgbe_set_pcie_completion_timeout(struct ixgbe_hw *hw)
+{
+        struct ixgbe_adapter *adapter = hw->back;
+        u32 gcr = IXGBE_READ_REG(hw, IXGBE_GCR);
+        u16 pcie_devctl2;
+
+        /* only take action if timeout value is defaulted to 0 */
+        if (gcr & IXGBE_GCR_CMPL_TMOUT_MASK)
+                goto out;
+
+        /*
+         * if capababilities version is type 1 we can write the
+         * timeout of 10ms to 250ms through the GCR register
+         */
+        if (!(gcr & IXGBE_GCR_CAP_VER2)) {
+                gcr |= IXGBE_GCR_CMPL_TMOUT_10ms;
+                goto out;
+        }
+
+        /*
+         * for version 2 capabilities we need to write the config space
+         * directly in order to set the completion timeout value for
+         * 16ms to 55ms
+         */
+        pci_read_config_word(adapter->pdev,
+                             IXGBE_PCI_DEVICE_CONTROL2, &pcie_devctl2);
+        pcie_devctl2 |= IXGBE_PCI_DEVICE_CONTROL2_16ms;
+        pci_write_config_word(adapter->pdev,
+                              IXGBE_PCI_DEVICE_CONTROL2, pcie_devctl2);
+out:
+        /* disable completion timeout resend */
+        gcr &= ~IXGBE_GCR_CMPL_TMOUT_RESEND;
+        IXGBE_WRITE_REG(hw, IXGBE_GCR, gcr);
+}
+
+/**
  *  ixgbe_get_pcie_msix_count_82598 - Gets MSI-X vector count
  *  @hw: pointer to hardware structure
  *
@@ -153,6 +198,26 @@ out:
 }
 
 /**
+ *  ixgbe_start_hw_82598 - Prepare hardware for Tx/Rx
+ *  @hw: pointer to hardware structure
+ *
+ *  Starts the hardware using the generic start_hw function.
+ *  Then set pcie completion timeout
+ **/
+s32 ixgbe_start_hw_82598(struct ixgbe_hw *hw)
+{
+        s32 ret_val = 0;
+
+        ret_val = ixgbe_start_hw_generic(hw);
+
+        /* set the completion timeout for interface */
+        if (ret_val == 0)
+                ixgbe_set_pcie_completion_timeout(hw);
+
+        return ret_val;
+}
+
+/**
  *  ixgbe_get_link_capabilities_82598 - Determines link capabilities
  *  @hw: pointer to hardware structure
  *  @speed: pointer to link speed
@@ -1085,7 +1150,7 @@ out:
 static struct ixgbe_mac_operations mac_ops_82598 = {
         .init_hw                = &ixgbe_init_hw_generic,
         .reset_hw               = &ixgbe_reset_hw_82598,
-        .start_hw               = &ixgbe_start_hw_generic,
+        .start_hw               = &ixgbe_start_hw_82598,
         .clear_hw_cntrs         = &ixgbe_clear_hw_cntrs_generic,
         .get_media_type         = &ixgbe_get_media_type_82598,
         .get_supported_physical_layer = &ixgbe_get_supported_physical_layer_82598,
diff --git a/drivers/net/ixgbe/ixgbe_dcb_nl.c b/drivers/net/ixgbe/ixgbe_dcb_nl.c
index da2c8514b8d0..1c7265732900 100644
--- a/drivers/net/ixgbe/ixgbe_dcb_nl.c
+++ b/drivers/net/ixgbe/ixgbe_dcb_nl.c
@@ -139,6 +139,18 @@ static u8 ixgbe_dcbnl_set_state(struct net_device *netdev, u8 state)
                         adapter->flags &= ~IXGBE_FLAG_FDIR_PERFECT_CAPABLE;
                 }
                 adapter->flags |= IXGBE_FLAG_DCB_ENABLED;
+#ifdef IXGBE_FCOE
+                /* Turn on FCoE offload */
+                if ((adapter->flags & IXGBE_FLAG_FCOE_CAPABLE) &&
+                    (!(adapter->flags & IXGBE_FLAG_FCOE_ENABLED))) {
+                        adapter->flags |= IXGBE_FLAG_FCOE_ENABLED;
+                        adapter->ring_feature[RING_F_FCOE].indices =
+                                IXGBE_FCRETA_SIZE;
+                        netdev->features |= NETIF_F_FCOE_CRC;
+                        netdev->features |= NETIF_F_FSO;
+                        netdev->fcoe_ddp_xid = IXGBE_FCOE_DDP_MAX - 1;
+                }
+#endif /* IXGBE_FCOE */
                 ixgbe_init_interrupt_scheme(adapter);
                 if (netif_running(netdev))
                         netdev->netdev_ops->ndo_open(netdev);
@@ -156,6 +168,18 @@ static u8 ixgbe_dcbnl_set_state(struct net_device *netdev, u8 state)
                         adapter->flags |= IXGBE_FLAG_RSS_ENABLED;
                         if (adapter->hw.mac.type == ixgbe_mac_82599EB)
                                 adapter->flags |= IXGBE_FLAG_FDIR_HASH_CAPABLE;
+
+#ifdef IXGBE_FCOE
+                        /* Turn off FCoE offload */
+                        if (adapter->flags & (IXGBE_FLAG_FCOE_CAPABLE |
+                             IXGBE_FLAG_FCOE_ENABLED)) {
+                                adapter->flags &= ~IXGBE_FLAG_FCOE_ENABLED;
+                                adapter->ring_feature[RING_F_FCOE].indices = 0;
+                                netdev->features &= ~NETIF_F_FCOE_CRC;
+                                netdev->features &= ~NETIF_F_FSO;
+                                netdev->fcoe_ddp_xid = 0;
+                        }
+#endif /* IXGBE_FCOE */
                         ixgbe_init_interrupt_scheme(adapter);
                         if (netif_running(netdev))
                                 netdev->netdev_ops->ndo_open(netdev);
diff --git a/drivers/net/ixgbe/ixgbe_ethtool.c b/drivers/net/ixgbe/ixgbe_ethtool.c
index 2a978008fd6e..79144e950a34 100644
--- a/drivers/net/ixgbe/ixgbe_ethtool.c
+++ b/drivers/net/ixgbe/ixgbe_ethtool.c
@@ -1975,7 +1975,10 @@ static int ixgbe_set_coalesce(struct net_device *netdev,
                  * any other value means disable eitr, which is best
                  * served by setting the interrupt rate very high
                  */
-                adapter->eitr_param = IXGBE_MAX_INT_RATE;
+                if (adapter->flags2 & IXGBE_FLAG2_RSC_ENABLED)
+                        adapter->eitr_param = IXGBE_MAX_RSC_INT_RATE;
+                else
+                        adapter->eitr_param = IXGBE_MAX_INT_RATE;
                 adapter->itr_setting = 0;
         }
 
@@ -1999,13 +2002,13 @@ static int ixgbe_set_flags(struct net_device *netdev, u32 data)
 
         ethtool_op_set_flags(netdev, data);
 
-        if (!(adapter->flags & IXGBE_FLAG2_RSC_CAPABLE))
+        if (!(adapter->flags2 & IXGBE_FLAG2_RSC_CAPABLE))
                 return 0;
 
         /* if state changes we need to update adapter->flags and reset */
         if ((!!(data & ETH_FLAG_LRO)) != 
-            (!!(adapter->flags & IXGBE_FLAG2_RSC_ENABLED))) {
-                adapter->flags ^= IXGBE_FLAG2_RSC_ENABLED;
+            (!!(adapter->flags2 & IXGBE_FLAG2_RSC_ENABLED))) {
+                adapter->flags2 ^= IXGBE_FLAG2_RSC_ENABLED;
                 if (netif_running(netdev))
                         ixgbe_reinit_locked(adapter);
                 else
diff --git a/drivers/net/ixgbe/ixgbe_main.c b/drivers/net/ixgbe/ixgbe_main.c
index e3442f47f932..110c65ab5cb5 100644
--- a/drivers/net/ixgbe/ixgbe_main.c
+++ b/drivers/net/ixgbe/ixgbe_main.c
@@ -34,6 +34,7 @@
 #include <linux/in.h>
 #include <linux/ip.h>
 #include <linux/tcp.h>
+#include <linux/pkt_sched.h>
 #include <linux/ipv6.h>
 #include <net/checksum.h>
 #include <net/ip6_checksum.h>
@@ -510,8 +511,11 @@ static void ixgbe_receive_skb(struct ixgbe_q_vector *q_vector,
  * @skb: skb currently being received and modified
  **/
 static inline void ixgbe_rx_checksum(struct ixgbe_adapter *adapter,
-                                     u32 status_err, struct sk_buff *skb)
+                                     union ixgbe_adv_rx_desc *rx_desc,
+                                     struct sk_buff *skb)
 {
+        u32 status_err = le32_to_cpu(rx_desc->wb.upper.status_error);
+
         skb->ip_summed = CHECKSUM_NONE;
 
         /* Rx csum disabled */
@@ -529,6 +533,16 @@ static inline void ixgbe_rx_checksum(struct ixgbe_adapter *adapter,
                 return;
 
         if (status_err & IXGBE_RXDADV_ERR_TCPE) {
+                u16 pkt_info = rx_desc->wb.lower.lo_dword.hs_rss.pkt_info;
+
+                /*
+                 * 82599 errata, UDP frames with a 0 checksum can be marked as
+                 * checksum errors.
+                 */
+                if ((pkt_info & IXGBE_RXDADV_PKTTYPE_UDP) &&
+                    (adapter->hw.mac.type == ixgbe_mac_82599EB))
+                        return;
+
                 adapter->hw_csum_rx_error++;
                 return;
         }
@@ -766,7 +780,7 @@ static bool ixgbe_clean_rx_irq(struct ixgbe_q_vector *q_vector,
                 prefetch(next_rxd);
                 cleaned_count++;
 
-                if (adapter->flags & IXGBE_FLAG2_RSC_CAPABLE)
+                if (adapter->flags2 & IXGBE_FLAG2_RSC_CAPABLE)
                         rsc_count = ixgbe_get_rsc_count(rx_desc);
 
                 if (rsc_count) {
@@ -802,7 +816,7 @@ static bool ixgbe_clean_rx_irq(struct ixgbe_q_vector *q_vector,
                         goto next_desc;
                 }
 
-                ixgbe_rx_checksum(adapter, staterr, skb);
+                ixgbe_rx_checksum(adapter, rx_desc, skb);
 
                 /* probably a little skewed due to removing CRC */
                 total_rx_bytes += skb->len;
@@ -2022,7 +2036,7 @@ static void ixgbe_configure_rx(struct ixgbe_adapter *adapter)
                         IXGBE_WRITE_REG(hw, IXGBE_PSRTYPE(0), psrtype);
                 }
         } else {
-                if (!(adapter->flags & IXGBE_FLAG2_RSC_ENABLED) &&
+                if (!(adapter->flags2 & IXGBE_FLAG2_RSC_ENABLED) &&
                     (netdev->mtu <= ETH_DATA_LEN))
                         rx_buf_len = MAXIMUM_ETHERNET_VLAN_SIZE;
                 else
@@ -2151,7 +2165,7 @@ static void ixgbe_configure_rx(struct ixgbe_adapter *adapter)
                 IXGBE_WRITE_REG(hw, IXGBE_RDRXCTL, rdrxctl);
         }
 
-        if (adapter->flags & IXGBE_FLAG2_RSC_ENABLED) {
+        if (adapter->flags2 & IXGBE_FLAG2_RSC_ENABLED) {
                 /* Enable 82599 HW-RSC */
                 for (i = 0; i < adapter->num_rx_queues; i++) {
                         j = adapter->rx_ring[i].reg_idx;
@@ -3798,16 +3812,17 @@ static int __devinit ixgbe_sw_init(struct ixgbe_adapter *adapter)
                 adapter->max_msix_q_vectors = MAX_MSIX_Q_VECTORS_82598;
         } else if (hw->mac.type == ixgbe_mac_82599EB) {
                 adapter->max_msix_q_vectors = MAX_MSIX_Q_VECTORS_82599;
-                adapter->flags |= IXGBE_FLAG2_RSC_CAPABLE;
-                adapter->flags |= IXGBE_FLAG2_RSC_ENABLED;
+                adapter->flags2 |= IXGBE_FLAG2_RSC_CAPABLE;
+                adapter->flags2 |= IXGBE_FLAG2_RSC_ENABLED;
                 adapter->flags |= IXGBE_FLAG_FDIR_HASH_CAPABLE;
                 adapter->ring_feature[RING_F_FDIR].indices =
                                                          IXGBE_MAX_FDIR_INDICES;
                 adapter->atr_sample_rate = 20;
                 adapter->fdir_pballoc = 0;
 #ifdef IXGBE_FCOE
-                adapter->flags |= IXGBE_FLAG_FCOE_ENABLED;
-                adapter->ring_feature[RING_F_FCOE].indices = IXGBE_FCRETA_SIZE;
+                adapter->flags |= IXGBE_FLAG_FCOE_CAPABLE;
+                adapter->flags &= ~IXGBE_FLAG_FCOE_ENABLED;
+                adapter->ring_feature[RING_F_FCOE].indices = 0;
 #endif /* IXGBE_FCOE */
         }
 
@@ -5125,9 +5140,6 @@ static int ixgbe_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
         int count = 0;
         unsigned int f;
 
-        r_idx = skb->queue_mapping;
-        tx_ring = &adapter->tx_ring[r_idx];
-
         if (adapter->vlgrp && vlan_tx_tag_present(skb)) {
                 tx_flags |= vlan_tx_tag_get(skb);
                 if (adapter->flags & IXGBE_FLAG_DCB_ENABLED) {
@@ -5137,11 +5149,19 @@ static int ixgbe_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
                 tx_flags <<= IXGBE_TX_FLAGS_VLAN_SHIFT;
                 tx_flags |= IXGBE_TX_FLAGS_VLAN;
         } else if (adapter->flags & IXGBE_FLAG_DCB_ENABLED) {
-                tx_flags |= (skb->queue_mapping << 13);
-                tx_flags <<= IXGBE_TX_FLAGS_VLAN_SHIFT;
-                tx_flags |= IXGBE_TX_FLAGS_VLAN;
+                if (skb->priority != TC_PRIO_CONTROL) {
+                        tx_flags |= (skb->queue_mapping << 13);
+                        tx_flags <<= IXGBE_TX_FLAGS_VLAN_SHIFT;
+                        tx_flags |= IXGBE_TX_FLAGS_VLAN;
+                } else {
+                        skb->queue_mapping =
+                                adapter->ring_feature[RING_F_DCB].indices-1;
+                }
         }
 
+        r_idx = skb->queue_mapping;
+        tx_ring = &adapter->tx_ring[r_idx];
+
         if ((adapter->flags & IXGBE_FLAG_FCOE_ENABLED) &&
             (skb->protocol == htons(ETH_P_FCOE)))
                 tx_flags |= IXGBE_TX_FLAGS_FCOE;
@@ -5340,12 +5360,19 @@ static int ixgbe_del_sanmac_netdev(struct net_device *dev)
 static void ixgbe_netpoll(struct net_device *netdev)
 {
         struct ixgbe_adapter *adapter = netdev_priv(netdev);
+        int i;
 
-        disable_irq(adapter->pdev->irq);
         adapter->flags |= IXGBE_FLAG_IN_NETPOLL;
-        ixgbe_intr(adapter->pdev->irq, netdev);
+        if (adapter->flags & IXGBE_FLAG_MSIX_ENABLED) {
+                int num_q_vectors = adapter->num_msix_vectors - NON_Q_VECTORS;
+                for (i = 0; i < num_q_vectors; i++) {
+                        struct ixgbe_q_vector *q_vector = adapter->q_vector[i];
+                        ixgbe_msix_clean_many(0, q_vector);
+                }
+        } else {
+                ixgbe_intr(adapter->pdev->irq, netdev);
+        }
         adapter->flags &= ~IXGBE_FLAG_IN_NETPOLL;
-        enable_irq(adapter->pdev->irq);
 }
 #endif
 
@@ -5580,23 +5607,18 @@ static int __devinit ixgbe_probe(struct pci_dev *pdev,
 #endif
 
 #ifdef IXGBE_FCOE
-        if (adapter->flags & IXGBE_FLAG_FCOE_ENABLED) {
+        if (adapter->flags & IXGBE_FLAG_FCOE_CAPABLE) {
                 if (hw->mac.ops.get_device_caps) {
                         hw->mac.ops.get_device_caps(hw, &device_caps);
-                        if (!(device_caps & IXGBE_DEVICE_CAPS_FCOE_OFFLOADS)) {
-                                netdev->features |= NETIF_F_FCOE_CRC;
-                                netdev->features |= NETIF_F_FSO;
-                                netdev->fcoe_ddp_xid = IXGBE_FCOE_DDP_MAX - 1;
-                        } else {
-                                adapter->flags &= ~IXGBE_FLAG_FCOE_ENABLED;
-                        }
+                        if (device_caps & IXGBE_DEVICE_CAPS_FCOE_OFFLOADS)
+                                adapter->flags &= ~IXGBE_FLAG_FCOE_CAPABLE;
                 }
         }
 #endif /* IXGBE_FCOE */
         if (pci_using_dac)
                 netdev->features |= NETIF_F_HIGHDMA;
 
-        if (adapter->flags & IXGBE_FLAG2_RSC_ENABLED)
+        if (adapter->flags2 & IXGBE_FLAG2_RSC_ENABLED)
                 netdev->features |= NETIF_F_LRO;
 
         /* make sure the EEPROM is good */
@@ -5638,7 +5660,6 @@ static int __devinit ixgbe_probe(struct pci_dev *pdev,
                 adapter->wol = 0;
                 break;
         }
-        device_init_wakeup(&adapter->pdev->dev, true);
         device_set_wakeup_enable(&adapter->pdev->dev, adapter->wol);
 
         /* pick up the PCI bus settings for reporting later */
diff --git a/drivers/net/ixgbe/ixgbe_type.h b/drivers/net/ixgbe/ixgbe_type.h
index fa87309dc087..be90eb4575f6 100644
--- a/drivers/net/ixgbe/ixgbe_type.h
+++ b/drivers/net/ixgbe/ixgbe_type.h
@@ -718,6 +718,12 @@
 #define IXGBE_ECC_STATUS_82599  0x110E0
 #define IXGBE_BAR_CTRL_82599    0x110F4
 
+/* PCI Express Control */
+#define IXGBE_GCR_CMPL_TMOUT_MASK       0x0000F000
+#define IXGBE_GCR_CMPL_TMOUT_10ms       0x00001000
+#define IXGBE_GCR_CMPL_TMOUT_RESEND     0x00010000
+#define IXGBE_GCR_CAP_VER2              0x00040000
+
 /* Time Sync Registers */
 #define IXGBE_TSYNCRXCTL 0x05188 /* Rx Time Sync Control register - RW */
 #define IXGBE_TSYNCTXCTL 0x08C00 /* Tx Time Sync Control register - RW */
@@ -1521,6 +1527,7 @@
 
 /* PCI Bus Info */
 #define IXGBE_PCI_LINK_STATUS     0xB2
+#define IXGBE_PCI_DEVICE_CONTROL2 0xC8
 #define IXGBE_PCI_LINK_WIDTH      0x3F0
 #define IXGBE_PCI_LINK_WIDTH_1    0x10
 #define IXGBE_PCI_LINK_WIDTH_2    0x20
@@ -1531,6 +1538,7 @@
 #define IXGBE_PCI_LINK_SPEED_5000 0x2
 #define IXGBE_PCI_HEADER_TYPE_REGISTER  0x0E
 #define IXGBE_PCI_HEADER_TYPE_MULTIFUNC 0x80
+#define IXGBE_PCI_DEVICE_CONTROL2_16ms  0x0005
 
 /* Number of 100 microseconds we wait for PCI Express master disable */
 #define IXGBE_PCI_MASTER_DISABLE_TIMEOUT 800
diff --git a/drivers/net/mlx4/en_tx.c b/drivers/net/mlx4/en_tx.c
index 08c43f2ae72b..5a88b3f57693 100644
--- a/drivers/net/mlx4/en_tx.c
+++ b/drivers/net/mlx4/en_tx.c
@@ -249,6 +249,7 @@ static u32 mlx4_en_free_tx_desc(struct mlx4_en_priv *priv,
                                 pci_unmap_page(mdev->pdev,
                                         (dma_addr_t) be64_to_cpu(data->addr),
                                          frag->size, PCI_DMA_TODEVICE);
+                                ++data;
                         }
                 }
                 /* Stamp the freed descriptor */
diff --git a/drivers/net/netxen/netxen_nic_init.c b/drivers/net/netxen/netxen_nic_init.c
index 5d3343ef3d86..7acf204e38c9 100644
--- a/drivers/net/netxen/netxen_nic_init.c
+++ b/drivers/net/netxen/netxen_nic_init.c
@@ -184,6 +184,13 @@ void netxen_free_sw_resources(struct netxen_adapter *adapter)
         kfree(recv_ctx->rds_rings);
 
 skip_rds:
+        if (recv_ctx->sds_rings == NULL)
+                goto skip_sds;
+
+        for(ring = 0; ring < adapter->max_sds_rings; ring++)
+                recv_ctx->sds_rings[ring].consumer = 0;
+
+skip_sds:
         if (adapter->tx_ring == NULL)
                 return;
 
diff --git a/drivers/net/netxen/netxen_nic_main.c b/drivers/net/netxen/netxen_nic_main.c
index 637ac8b89bac..3cd8cfcf627b 100644
--- a/drivers/net/netxen/netxen_nic_main.c
+++ b/drivers/net/netxen/netxen_nic_main.c
@@ -221,7 +221,7 @@ netxen_napi_disable(struct netxen_adapter *adapter)
         }
 }
 
-static int nx_set_dma_mask(struct netxen_adapter *adapter, uint8_t revision_id)
+static int nx_set_dma_mask(struct netxen_adapter *adapter)
 {
         struct pci_dev *pdev = adapter->pdev;
         uint64_t mask, cmask;
@@ -229,19 +229,17 @@ static int nx_set_dma_mask(struct netxen_adapter *adapter, uint8_t revision_id)
         adapter->pci_using_dac = 0;
 
         mask = DMA_BIT_MASK(32);
-        /*
-         * Consistent DMA mask is set to 32 bit because it cannot be set to
-         * 35 bits. For P3 also leave it at 32 bits for now. Only the rings
-         * come off this pool.
-         */
         cmask = DMA_BIT_MASK(32);
 
+        if (NX_IS_REVISION_P2(adapter->ahw.revision_id)) {
 #ifndef CONFIG_IA64
-        if (revision_id >= NX_P3_B0)
-                mask = DMA_BIT_MASK(39);
-        else if (revision_id == NX_P2_C1)
                 mask = DMA_BIT_MASK(35);
 #endif
+        } else {
+                mask = DMA_BIT_MASK(39);
+                cmask = mask;
+        }
+
         if (pci_set_dma_mask(pdev, mask) == 0 &&
                 pci_set_consistent_dma_mask(pdev, cmask) == 0) {
                 adapter->pci_using_dac = 1;
@@ -256,7 +254,7 @@ static int
 nx_update_dma_mask(struct netxen_adapter *adapter)
 {
         int change, shift, err;
-        uint64_t mask, old_mask;
+        uint64_t mask, old_mask, old_cmask;
         struct pci_dev *pdev = adapter->pdev;
 
         change = 0;
@@ -272,14 +270,29 @@ nx_update_dma_mask(struct netxen_adapter *adapter)
 
         if (change) {
                 old_mask = pdev->dma_mask;
+                old_cmask = pdev->dev.coherent_dma_mask;
+
                 mask = (1ULL<<(32+shift)) - 1;
 
                 err = pci_set_dma_mask(pdev, mask);
                 if (err)
-                        return pci_set_dma_mask(pdev, old_mask);
+                        goto err_out;
+
+                if (NX_IS_REVISION_P3(adapter->ahw.revision_id)) {
+
+                        err = pci_set_consistent_dma_mask(pdev, mask);
+                        if (err)
+                                goto err_out;
+                }
+                dev_info(&pdev->dev, "using %d-bit dma mask\n", 32+shift);
         }
 
         return 0;
+
+err_out:
+        pci_set_dma_mask(pdev, old_mask);
+        pci_set_consistent_dma_mask(pdev, old_cmask);
+        return err;
 }
 
 static void netxen_check_options(struct netxen_adapter *adapter)
@@ -1006,7 +1019,7 @@ netxen_nic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         revision_id = pdev->revision;
         adapter->ahw.revision_id = revision_id;
 
-        err = nx_set_dma_mask(adapter, revision_id);
+        err = nx_set_dma_mask(adapter);
         if (err)
                 goto err_out_free_netdev;
 
diff --git a/drivers/net/pcnet32.c b/drivers/net/pcnet32.c
index 28368157dac4..a646a445fda9 100644
--- a/drivers/net/pcnet32.c
+++ b/drivers/net/pcnet32.c
@@ -1611,8 +1611,11 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
                 if (pcnet32_dwio_read_csr(ioaddr, 0) == 4
                     && pcnet32_dwio_check(ioaddr)) {
                         a = &pcnet32_dwio;
-                } else
+                } else {
+                        if (pcnet32_debug & NETIF_MSG_PROBE)
+                                printk(KERN_ERR PFX "No access methods\n");
                         goto err_release_region;
+                }
         }
 
         chip_version =
@@ -1719,7 +1722,9 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
                 ret = -ENOMEM;
                 goto err_release_region;
         }
-        SET_NETDEV_DEV(dev, &pdev->dev);
+
+        if (pdev)
+                SET_NETDEV_DEV(dev, &pdev->dev);
 
         if (pcnet32_debug & NETIF_MSG_PROBE)
                 printk(KERN_INFO PFX "%s at %#3lx,", chipname, ioaddr);
@@ -1818,7 +1823,6 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
 
         spin_lock_init(&lp->lock);
 
-        SET_NETDEV_DEV(dev, &pdev->dev);
         lp->name = chipname;
         lp->shared_irq = shared;
         lp->tx_ring_size = TX_RING_SIZE;        /* default tx ring size */
@@ -1852,12 +1856,6 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
             ((cards_found >= MAX_UNITS) || full_duplex[cards_found]))
                 lp->options |= PCNET32_PORT_FD;
 
-        if (!a) {
-                if (pcnet32_debug & NETIF_MSG_PROBE)
-                        printk(KERN_ERR PFX "No access methods\n");
-                ret = -ENODEV;
-                goto err_free_consistent;
-        }
         lp->a = *a;
 
         /* prior to register_netdev, dev->name is not yet correct */
@@ -1973,14 +1971,13 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
 
         return 0;
 
-      err_free_ring:
+err_free_ring:
         pcnet32_free_ring(dev);
-      err_free_consistent:
         pci_free_consistent(lp->pci_dev, sizeof(*lp->init_block),
                             lp->init_block, lp->init_dma_addr);
-      err_free_netdev:
+err_free_netdev:
         free_netdev(dev);
-      err_release_region:
+err_release_region:
         release_region(ioaddr, PCNET32_TOTAL_SIZE);
         return ret;
 }
@@ -2089,6 +2086,7 @@ static void pcnet32_free_ring(struct net_device *dev)
 static int pcnet32_open(struct net_device *dev)
 {
         struct pcnet32_private *lp = netdev_priv(dev);
+        struct pci_dev *pdev = lp->pci_dev;
         unsigned long ioaddr = dev->base_addr;
         u16 val;
         int i;
@@ -2149,9 +2147,9 @@ static int pcnet32_open(struct net_device *dev)
         lp->a.write_csr(ioaddr, 124, val);
 
         /* Allied Telesyn AT 2700/2701 FX are 100Mbit only and do not negotiate */
-        if (lp->pci_dev->subsystem_vendor == PCI_VENDOR_ID_AT &&
-            (lp->pci_dev->subsystem_device == PCI_SUBDEVICE_ID_AT_2700FX ||
-             lp->pci_dev->subsystem_device == PCI_SUBDEVICE_ID_AT_2701FX)) {
+        if (pdev && pdev->subsystem_vendor == PCI_VENDOR_ID_AT &&
+            (pdev->subsystem_device == PCI_SUBDEVICE_ID_AT_2700FX ||
+             pdev->subsystem_device == PCI_SUBDEVICE_ID_AT_2701FX)) {
                 if (lp->options & PCNET32_PORT_ASEL) {
                         lp->options = PCNET32_PORT_FD | PCNET32_PORT_100;
                         if (netif_msg_link(lp))
diff --git a/drivers/net/phy/mdio-gpio.c b/drivers/net/phy/mdio-gpio.c
index 33984b737233..22cdd451fb82 100644
--- a/drivers/net/phy/mdio-gpio.c
+++ b/drivers/net/phy/mdio-gpio.c
@@ -30,6 +30,7 @@
 
 #ifdef CONFIG_OF_GPIO
 #include <linux/of_gpio.h>
+#include <linux/of_mdio.h>
 #include <linux/of_platform.h>
 #endif
 
@@ -81,13 +82,12 @@ static struct mdiobb_ops mdio_gpio_ops = {
         .get_mdio_data = mdio_get,
 };
 
-static int __devinit mdio_gpio_bus_init(struct device *dev,
+static struct mii_bus * __devinit mdio_gpio_bus_init(struct device *dev,
                                         struct mdio_gpio_platform_data *pdata,
                                         int bus_id)
 {
         struct mii_bus *new_bus;
         struct mdio_gpio_info *bitbang;
-        int ret = -ENOMEM;
         int i;
 
         bitbang = kzalloc(sizeof(*bitbang), GFP_KERNEL);
@@ -104,8 +104,6 @@ static int __devinit mdio_gpio_bus_init(struct device *dev,
 
         new_bus->name = "GPIO Bitbanged MDIO",
 
-        ret = -ENODEV;
-
         new_bus->phy_mask = pdata->phy_mask;
         new_bus->irq = pdata->irqs;
         new_bus->parent = dev;
@@ -129,15 +127,8 @@ static int __devinit mdio_gpio_bus_init(struct device *dev,
 
         dev_set_drvdata(dev, new_bus);
 
-        ret = mdiobus_register(new_bus);
-        if (ret)
-                goto out_free_all;
-
-        return 0;
+        return new_bus;
 
-out_free_all:
-        dev_set_drvdata(dev, NULL);
-        gpio_free(bitbang->mdio);
 out_free_mdc:
         gpio_free(bitbang->mdc);
 out_free_bus:
@@ -145,30 +136,47 @@ out_free_bus:
 out_free_bitbang:
         kfree(bitbang);
 out:
-        return ret;
+        return NULL;
 }
 
-static void __devexit mdio_gpio_bus_destroy(struct device *dev)
+static void __devinit mdio_gpio_bus_deinit(struct device *dev)
 {
         struct mii_bus *bus = dev_get_drvdata(dev);
         struct mdio_gpio_info *bitbang = bus->priv;
 
-        mdiobus_unregister(bus);
-        free_mdio_bitbang(bus);
         dev_set_drvdata(dev, NULL);
-        gpio_free(bitbang->mdc);
         gpio_free(bitbang->mdio);
+        gpio_free(bitbang->mdc);
+        free_mdio_bitbang(bus);
         kfree(bitbang);
 }
 
+static void __devexit mdio_gpio_bus_destroy(struct device *dev)
+{
+        struct mii_bus *bus = dev_get_drvdata(dev);
+
+        mdiobus_unregister(bus);
+        mdio_gpio_bus_deinit(dev);
+}
+
 static int __devinit mdio_gpio_probe(struct platform_device *pdev)
 {
         struct mdio_gpio_platform_data *pdata = pdev->dev.platform_data;
+        struct mii_bus *new_bus;
+        int ret;
 
         if (!pdata)
                 return -ENODEV;
 
-        return mdio_gpio_bus_init(&pdev->dev, pdata, pdev->id);
+        new_bus = mdio_gpio_bus_init(&pdev->dev, pdata, pdev->id);
+        if (!new_bus)
+                return -ENODEV;
+
+        ret = mdiobus_register(new_bus);
+        if (ret)
+                mdio_gpio_bus_deinit(&pdev->dev);
+
+        return ret;
 }
 
 static int __devexit mdio_gpio_remove(struct platform_device *pdev)
@@ -179,29 +187,12 @@ static int __devexit mdio_gpio_remove(struct platform_device *pdev)
 }
 
 #ifdef CONFIG_OF_GPIO
-static void __devinit add_phy(struct mdio_gpio_platform_data *pdata,
-                              struct device_node *np)
-{
-        const u32 *data;
-        int len, id, irq;
-
-        data = of_get_property(np, "reg", &len);
-        if (!data || len != 4)
-                return;
-
-        id = *data;
-        pdata->phy_mask &= ~(1 << id);
-
-        irq = of_irq_to_resource(np, 0, NULL);
-        if (irq)
-                pdata->irqs[id] = irq;
-}
 
 static int __devinit mdio_ofgpio_probe(struct of_device *ofdev,
                                         const struct of_device_id *match)
 {
-        struct device_node *np = NULL;
         struct mdio_gpio_platform_data *pdata;
+        struct mii_bus *new_bus;
         int ret;
 
         pdata = kzalloc(sizeof(*pdata), GFP_KERNEL);
@@ -215,14 +206,18 @@ static int __devinit mdio_ofgpio_probe(struct of_device *ofdev,
 
         ret = of_get_gpio(ofdev->node, 1);
         if (ret < 0)
-                goto out_free;
+                goto out_free;
         pdata->mdio = ret;
 
-        while ((np = of_get_next_child(ofdev->node, np)))
-                if (!strcmp(np->type, "ethernet-phy"))
-                        add_phy(pdata, np);
+        new_bus = mdio_gpio_bus_init(&ofdev->dev, pdata, pdata->mdc);
+        if (!new_bus)
+                return -ENODEV;
 
-        return mdio_gpio_bus_init(&ofdev->dev, pdata, pdata->mdc);
+        ret = of_mdiobus_register(new_bus, ofdev->node);
+        if (ret)
+                mdio_gpio_bus_deinit(&ofdev->dev);
+
+        return ret;
 
 out_free:
         kfree(pdata);
diff --git a/drivers/net/ppp_generic.c b/drivers/net/ppp_generic.c
index 639d11bc444e..cd37d739ac74 100644
--- a/drivers/net/ppp_generic.c
+++ b/drivers/net/ppp_generic.c
@@ -1384,7 +1384,7 @@ static int ppp_mp_explode(struct ppp *ppp, struct sk_buff *skb)
 
         /* create a     fragment for each channel */
         bits = B;
-        while (nfree > 0 &&     len     > 0) {
+        while (len      > 0) {
                 list = list->next;
                 if (list ==     &ppp->channels) {
                         i =     0;
@@ -1431,29 +1431,31 @@ static int ppp_mp_explode(struct ppp *ppp, struct sk_buff *skb)
                 *otherwise divide it according to the speed
                 *of the channel we are going to transmit on
                 */
-                if (pch->speed == 0) {
-                        flen = totlen/nfree     ;
-                        if (nbigger > 0) {
-                                flen++;
-                                nbigger--;
-                        }
-                } else {
-                        flen = (((totfree - nzero)*(totlen + hdrlen*totfree)) /
-                                ((totspeed*totfree)/pch->speed)) - hdrlen;
-                        if (nbigger > 0) {
-                                flen += ((totfree - nzero)*pch->speed)/totspeed;
-                                nbigger -= ((totfree - nzero)*pch->speed)/
+                if (nfree > 0) {
+                        if (pch->speed == 0) {
+                                flen = totlen/nfree     ;
+                                if (nbigger > 0) {
+                                        flen++;
+                                        nbigger--;
+                                }
+                        } else {
+                                flen = (((totfree - nzero)*(totlen + hdrlen*totfree)) /
+                                        ((totspeed*totfree)/pch->speed)) - hdrlen;
+                                if (nbigger > 0) {
+                                        flen += ((totfree - nzero)*pch->speed)/totspeed;
+                                        nbigger -= ((totfree - nzero)*pch->speed)/
                                                         totspeed;
+                                }
                         }
+                        nfree--;
                 }
-                nfree--;
 
                 /*
                  *check if we are on the last channel or
                  *we exceded the lenght of the data     to
                  *fragment
                  */
-                if ((nfree == 0) || (flen > len))
+                if ((nfree <= 0) || (flen > len))
                         flen = len;
                 /*
                  *it is not worth to tx on slow channels:
@@ -1467,7 +1469,7 @@ static int ppp_mp_explode(struct ppp *ppp, struct sk_buff *skb)
                         continue;
                 }
 
-                mtu     = pch->chan->mtu + 2 - hdrlen;
+                mtu     = pch->chan->mtu - hdrlen;
                 if (mtu < 4)
                         mtu     = 4;
                 if (flen > mtu)
diff --git a/drivers/net/pppoe.c b/drivers/net/pppoe.c
index f0031f1f97e5..5f2090233d7b 100644
--- a/drivers/net/pppoe.c
+++ b/drivers/net/pppoe.c
@@ -1063,6 +1063,7 @@ static void *pppoe_seq_next(struct seq_file *seq, void *v, loff_t *pos)
         else {
                 int hash = hash_item(po->pppoe_pa.sid, po->pppoe_pa.remote);
 
+                po = NULL;
                 while (++hash < PPPOE_HASH_SIZE) {
                         po = pn->hash_table[hash];
                         if (po)
diff --git a/drivers/net/pppol2tp.c b/drivers/net/pppol2tp.c
index e7935d09c896..e0f9219a0aea 100644
--- a/drivers/net/pppol2tp.c
+++ b/drivers/net/pppol2tp.c
@@ -2680,6 +2680,7 @@ out_unregister_pppol2tp_proto:
 static void __exit pppol2tp_exit(void)
 {
         unregister_pppox_proto(PX_PROTO_OL2TP);
+        unregister_pernet_gen_device(pppol2tp_net_id, &pppol2tp_net_ops);
         proto_unregister(&pppol2tp_sk_proto);
 }
 
diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
index 4b53b58d75fc..b82780d805f5 100644
--- a/drivers/net/r8169.c
+++ b/drivers/net/r8169.c
@@ -2060,8 +2060,6 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
                 }
         }
 
-        pci_set_master(pdev);
-
         /* ioremap MMIO region */
         ioaddr = ioremap(pci_resource_start(pdev, region), R8169_REGS_SIZE);
         if (!ioaddr) {
@@ -2089,6 +2087,8 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
 
         RTL_W16(IntrStatus, 0xffff);
 
+        pci_set_master(pdev);
+
         /* Identify chip attached to board */
         rtl8169_get_mac_version(tp, ioaddr);
 
@@ -3874,6 +3874,15 @@ static void rtl_shutdown(struct pci_dev *pdev)
         spin_unlock_irq(&tp->lock);
 
         if (system_state == SYSTEM_POWER_OFF) {
+                /* WoL fails with some 8168 when the receiver is disabled. */
+                if (tp->features & RTL_FEATURE_WOL) {
+                        pci_clear_master(pdev);
+
+                        RTL_W8(ChipCmd, CmdRxEnb);
+                        /* PCI commit */
+                        RTL_R8(ChipCmd);
+                }
+
                 pci_wake_from_d3(pdev, true);
                 pci_set_power_state(pdev, PCI_D3hot);
         }
diff --git a/drivers/net/s6gmac.c b/drivers/net/s6gmac.c
index 5345e47b35ac..4525cbe8dd69 100644
--- a/drivers/net/s6gmac.c
+++ b/drivers/net/s6gmac.c
@@ -793,7 +793,7 @@ static inline int s6gmac_phy_start(struct net_device *dev)
         struct s6gmac *pd = netdev_priv(dev);
         int i = 0;
         struct phy_device *p = NULL;
-        while ((!(p = pd->mii.bus->phy_map[i])) && (i < PHY_MAX_ADDR))
+        while ((i < PHY_MAX_ADDR) && (!(p = pd->mii.bus->phy_map[i])))
                 i++;
         p = phy_connect(dev, dev_name(&p->dev), &s6gmac_adjust_link, 0,
                         PHY_INTERFACE_MODE_RGMII);
diff --git a/drivers/net/skge.c b/drivers/net/skge.c
index 60d502eef4fc..543af2044f40 100644
--- a/drivers/net/skge.c
+++ b/drivers/net/skge.c
@@ -3854,8 +3854,10 @@ static struct net_device *skge_devinit(struct skge_hw *hw, int port,
         skge->speed = -1;
         skge->advertising = skge_supported_modes(hw);
 
-        if (device_may_wakeup(&hw->pdev->dev))
+        if (device_can_wakeup(&hw->pdev->dev)) {
                 skge->wol = wol_supported(hw) & WAKE_MAGIC;
+                device_set_wakeup_enable(&hw->pdev->dev, skge->wol);
+        }
 
         hw->dev[port] = dev;
 
diff --git a/drivers/net/sky2.c b/drivers/net/sky2.c
index 3550c5dcd93c..0a551d8f5d95 100644
--- a/drivers/net/sky2.c
+++ b/drivers/net/sky2.c
@@ -1488,6 +1488,8 @@ static int sky2_up(struct net_device *dev)
         sky2_set_vlan_mode(hw, port, sky2->vlgrp != NULL);
 #endif
 
+        sky2->restarting = 0;
+
         err = sky2_rx_start(sky2);
         if (err)
                 goto err_out;
@@ -1500,6 +1502,9 @@ static int sky2_up(struct net_device *dev)
 
         sky2_set_multicast(dev);
 
+        /* wake queue incase we are restarting */
+        netif_wake_queue(dev);
+
         if (netif_msg_ifup(sky2))
                 printk(KERN_INFO PFX "%s: enabling interface\n", dev->name);
         return 0;
@@ -1533,6 +1538,8 @@ static inline int tx_dist(unsigned tail, unsigned head)
 /* Number of list elements available for next tx */
 static inline int tx_avail(const struct sky2_port *sky2)
 {
+        if (unlikely(sky2->restarting))
+                return 0;
         return sky2->tx_pending - tx_dist(sky2->tx_cons, sky2->tx_prod);
 }
 
@@ -1818,6 +1825,10 @@ static int sky2_down(struct net_device *dev)
         if (netif_msg_ifdown(sky2))
                 printk(KERN_INFO PFX "%s: disabling interface\n", dev->name);
 
+        /* explicitly shut off tx incase we're restarting */
+        sky2->restarting = 1;
+        netif_tx_disable(dev);
+
         /* Force flow control off */
         sky2_write8(hw, SK_REG(port, GMAC_CTRL), GMC_PAUSE_OFF);
 
@@ -2359,7 +2370,7 @@ static inline void sky2_tx_done(struct net_device *dev, u16 last)
 {
         struct sky2_port *sky2 = netdev_priv(dev);
 
-        if (netif_running(dev)) {
+        if (likely(netif_running(dev) && !sky2->restarting)) {
                 netif_tx_lock(dev);
                 sky2_tx_complete(sky2, last);
                 netif_tx_unlock(dev);
@@ -4283,6 +4294,7 @@ static __devinit struct net_device *sky2_init_netdev(struct sky2_hw *hw,
         spin_lock_init(&sky2->phy_lock);
         sky2->tx_pending = TX_DEF_PENDING;
         sky2->rx_pending = RX_DEF_PENDING;
+        sky2->restarting = 0;
 
         hw->dev[port] = dev;
 
diff --git a/drivers/net/sky2.h b/drivers/net/sky2.h
index b5549c9e5107..4486b066b43f 100644
--- a/drivers/net/sky2.h
+++ b/drivers/net/sky2.h
@@ -2051,6 +2051,7 @@ struct sky2_port {
         u8                   duplex;    /* DUPLEX_HALF, DUPLEX_FULL */
         u8                   rx_csum;
         u8                   wol;
+        u8                   restarting;
         enum flow_control    flow_mode;
         enum flow_control    flow_status;
 
diff --git a/drivers/net/smc91x.h b/drivers/net/smc91x.h
index f1f773b17fe1..57a159fac99f 100644
--- a/drivers/net/smc91x.h
+++ b/drivers/net/smc91x.h
@@ -186,7 +186,8 @@ static inline void SMC_outw(u16 val, void __iomem *ioaddr, int reg)
 #define SMC_outsb(a, r, p, l)   writesb((a) + (r), p, (l))
 #define SMC_IRQ_FLAGS           (-1)    /* from resource */
 
-#elif   defined(CONFIG_MACH_LOGICPD_PXA270)
+#elif   defined(CONFIG_MACH_LOGICPD_PXA270) \
+        || defined(CONFIG_MACH_NOMADIK_8815NHK)
 
 #define SMC_CAN_USE_8BIT        0
 #define SMC_CAN_USE_16BIT       1
diff --git a/drivers/net/tokenring/ibmtr.c b/drivers/net/tokenring/ibmtr.c
index 9d896116cf76..08a6c41c1599 100644
--- a/drivers/net/tokenring/ibmtr.c
+++ b/drivers/net/tokenring/ibmtr.c
@@ -1912,7 +1912,7 @@ static int __init ibmtr_init(void)
 
         find_turbo_adapters(io);
 
-        for (i = 0; io[i] && (i < IBMTR_MAX_ADAPTERS); i++) {
+        for (i = 0; i < IBMTR_MAX_ADAPTERS && io[i]; i++) {
                 struct net_device *dev;
                 irq[i] = 0;
                 mem[i] = 0;
diff --git a/drivers/net/tulip/de4x5.c b/drivers/net/tulip/de4x5.c
index eb72d2e9ab3d..acfdccd44567 100644
--- a/drivers/net/tulip/de4x5.c
+++ b/drivers/net/tulip/de4x5.c
@@ -5059,7 +5059,7 @@ mii_get_phy(struct net_device *dev)
         if ((id == 0) || (id == 65535)) continue;  /* Valid ID? */
         for (j=0; j<limit; j++) {                  /* Search PHY table */
             if (id != phy_info[j].id) continue;    /* ID match? */
-            for (k=0; lp->phy[k].id && (k < DE4X5_MAX_PHY); k++);
+            for (k=0; k < DE4X5_MAX_PHY && lp->phy[k].id; k++);
             if (k < DE4X5_MAX_PHY) {
                 memcpy((char *)&lp->phy[k],
                        (char *)&phy_info[j], sizeof(struct phy_table));
@@ -5072,7 +5072,7 @@ mii_get_phy(struct net_device *dev)
             break;
         }
         if ((j == limit) && (i < DE4X5_MAX_MII)) {
-            for (k=0; lp->phy[k].id && (k < DE4X5_MAX_PHY); k++);
+            for (k=0; k < DE4X5_MAX_PHY && lp->phy[k].id; k++);
             lp->phy[k].addr = i;
             lp->phy[k].id = id;
             lp->phy[k].spd.reg = GENERIC_REG;      /* ANLPA register         */
@@ -5091,7 +5091,7 @@ mii_get_phy(struct net_device *dev)
   purgatory:
     lp->active = 0;
     if (lp->phy[0].id) {                           /* Reset the PHY devices */
-        for (k=0; lp->phy[k].id && (k < DE4X5_MAX_PHY); k++) { /*For each PHY*/
+        for (k=0; k < DE4X5_MAX_PHY && lp->phy[k].id; k++) { /*For each PHY*/
             mii_wr(MII_CR_RST, MII_CR, lp->phy[k].addr, DE4X5_MII);
             while (mii_rd(MII_CR, lp->phy[k].addr, DE4X5_MII) & MII_CR_RST);
 
diff --git a/drivers/net/ucc_geth.c b/drivers/net/ucc_geth.c
index 40c6eba775ce..3b957e6412ee 100644
--- a/drivers/net/ucc_geth.c
+++ b/drivers/net/ucc_geth.c
@@ -1590,13 +1590,13 @@ static int init_phy(struct net_device *dev)
         priv->oldspeed = 0;
         priv->oldduplex = -1;
 
-        if (!ug_info->phy_node)
-                return 0;
-
         phydev = of_phy_connect(dev, ug_info->phy_node, &adjust_link, 0,
                                 priv->phy_interface);
+        if (!phydev)
+                phydev = of_phy_connect_fixed_link(dev, &adjust_link,
+                                                   priv->phy_interface);
         if (!phydev) {
-                printk("%s: Could not attach to PHY\n", dev->name);
+                dev_err(&dev->dev, "Could not attach to PHY\n");
                 return -ENODEV;
         }
 
@@ -3608,9 +3608,7 @@ static int ucc_geth_probe(struct of_device* ofdev, const struct of_device_id *ma
         struct ucc_geth_private *ugeth = NULL;
         struct ucc_geth_info *ug_info;
         struct resource res;
-        struct device_node *phy;
         int err, ucc_num, max_speed = 0;
-        const u32 *fixed_link;
         const unsigned int *prop;
         const char *sprop;
         const void *mac_addr;
@@ -3708,15 +3706,8 @@ static int ucc_geth_probe(struct of_device* ofdev, const struct of_device_id *ma
 
         ug_info->uf_info.regs = res.start;
         ug_info->uf_info.irq = irq_of_parse_and_map(np, 0);
-        fixed_link = of_get_property(np, "fixed-link", NULL);
-        if (fixed_link) {
-                phy = NULL;
-        } else {
-                phy = of_parse_phandle(np, "phy-handle", 0);
-                if (phy == NULL)
-                        return -ENODEV;
-        }
-        ug_info->phy_node = phy;
+
+        ug_info->phy_node = of_parse_phandle(np, "phy-handle", 0);
 
         /* Find the TBI PHY node.  If it's not there, we don't support SGMII */
         ug_info->tbi_node = of_parse_phandle(np, "tbi-handle", 0);
@@ -3725,7 +3716,7 @@ static int ucc_geth_probe(struct of_device* ofdev, const struct of_device_id *ma
         prop = of_get_property(np, "phy-connection-type", NULL);
         if (!prop) {
                 /* handle interface property present in old trees */
-                prop = of_get_property(phy, "interface", NULL);
+                prop = of_get_property(ug_info->phy_node, "interface", NULL);
                 if (prop != NULL) {
                         phy_interface = enet_to_phy_interface[*prop];
                         max_speed = enet_to_speed[*prop];
diff --git a/drivers/net/wireless/airo.c b/drivers/net/wireless/airo.c
index c70604f0329e..8ce5e4cee168 100644
--- a/drivers/net/wireless/airo.c
+++ b/drivers/net/wireless/airo.c
@@ -5918,20 +5918,19 @@ static int airo_set_essid(struct net_device *dev,
         readSsidRid(local, &SSID_rid);
 
         /* Check if we asked for `any' */
-        if(dwrq->flags == 0) {
+        if (dwrq->flags == 0) {
                 /* Just send an empty SSID list */
                 memset(&SSID_rid, 0, sizeof(SSID_rid));
         } else {
-                int     index = (dwrq->flags & IW_ENCODE_INDEX) - 1;
+                unsigned index = (dwrq->flags & IW_ENCODE_INDEX) - 1;
 
                 /* Check the size of the string */
-                if(dwrq->length > IW_ESSID_MAX_SIZE) {
+                if (dwrq->length > IW_ESSID_MAX_SIZE)
                         return -E2BIG ;
-                }
+
                 /* Check if index is valid */
-                if((index < 0) || (index >= 4)) {
+                if (index >= ARRAY_SIZE(SSID_rid.ssids))
                         return -EINVAL;
-                }
 
                 /* Set the SSID */
                 memset(SSID_rid.ssids[index].ssid, 0,
@@ -6819,7 +6818,7 @@ static int airo_set_txpow(struct net_device *dev,
                 return -EINVAL;
         }
         clear_bit (FLAG_RADIO_OFF, &local->flags);
-        for (i = 0; cap_rid.txPowerLevels[i] && (i < 8); i++)
+        for (i = 0; i < 8 && cap_rid.txPowerLevels[i]; i++)
                 if (v == cap_rid.txPowerLevels[i]) {
                         readConfigRid(local, 1);
                         local->config.txPower = v;
diff --git a/drivers/net/wireless/ath/ath5k/base.c b/drivers/net/wireless/ath/ath5k/base.c
index ea045151f953..029c1bc7468f 100644
--- a/drivers/net/wireless/ath/ath5k/base.c
+++ b/drivers/net/wireless/ath/ath5k/base.c
@@ -2970,6 +2970,9 @@ ath5k_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
         if (modparam_nohwcrypt)
                 return -EOPNOTSUPP;
 
+        if (sc->opmode == NL80211_IFTYPE_AP)
+                return -EOPNOTSUPP;
+
         switch (key->alg) {
         case ALG_WEP:
         case ALG_TKIP:
diff --git a/drivers/net/wireless/ath/ath9k/ani.c b/drivers/net/wireless/ath/ath9k/ani.c
index 1aeafb511ddd..aad259b4c197 100644
--- a/drivers/net/wireless/ath/ath9k/ani.c
+++ b/drivers/net/wireless/ath/ath9k/ani.c
@@ -478,6 +478,18 @@ void ath9k_ani_reset(struct ath_hw *ah)
                         "Reset ANI state opmode %u\n", ah->opmode);
                 ah->stats.ast_ani_reset++;
 
+                if (ah->opmode == NL80211_IFTYPE_AP) {
+                        /*
+                         * ath9k_hw_ani_control() will only process items set on
+                         * ah->ani_function
+                         */
+                        if (IS_CHAN_2GHZ(chan))
+                                ah->ani_function = (ATH9K_ANI_SPUR_IMMUNITY_LEVEL |
+                                                    ATH9K_ANI_FIRSTEP_LEVEL);
+                        else
+                                ah->ani_function = 0;
+                }
+
                 ath9k_hw_ani_control(ah, ATH9K_ANI_NOISE_IMMUNITY_LEVEL, 0);
                 ath9k_hw_ani_control(ah, ATH9K_ANI_SPUR_IMMUNITY_LEVEL, 0);
                 ath9k_hw_ani_control(ah, ATH9K_ANI_FIRSTEP_LEVEL, 0);
diff --git a/drivers/net/wireless/ath/ath9k/eeprom.c b/drivers/net/wireless/ath/ath9k/eeprom.c
index a2fda702b620..ce0e86c36a82 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom.c
@@ -460,7 +460,7 @@ static int ath9k_hw_4k_check_eeprom(struct ath_hw *ah)
                 integer = swab32(eep->modalHeader.antCtrlCommon);
                 eep->modalHeader.antCtrlCommon = integer;
 
-                for (i = 0; i < AR5416_MAX_CHAINS; i++) {
+                for (i = 0; i < AR5416_EEP4K_MAX_CHAINS; i++) {
                         integer = swab32(eep->modalHeader.antCtrlChain[i]);
                         eep->modalHeader.antCtrlChain[i] = integer;
                 }
@@ -914,7 +914,7 @@ static void ath9k_hw_set_4k_power_per_rate_table(struct ath_hw *ah,
                         ctlMode, numCtlModes, isHt40CtlMode,
                         (pCtlMode[ctlMode] & EXT_ADDITIVE));
 
-                for (i = 0; (i < AR5416_NUM_CTLS) &&
+                for (i = 0; (i < AR5416_EEP4K_NUM_CTLS) &&
                                 pEepData->ctlIndex[i]; i++) {
                         DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
                                 "  LOOP-Ctlidx %d: cfgCtl 0x%2.2x "
diff --git a/drivers/net/wireless/ath/regd.c b/drivers/net/wireless/ath/regd.c
index eef370bd1211..bf3d25ba7be1 100644
--- a/drivers/net/wireless/ath/regd.c
+++ b/drivers/net/wireless/ath/regd.c
@@ -474,6 +474,21 @@ ath_regd_init_wiphy(struct ath_regulatory *reg,
         return 0;
 }
 
+/*
+ * Some users have reported their EEPROM programmed with
+ * 0x8000 set, this is not a supported regulatory domain
+ * but since we have more than one user with it we need
+ * a solution for them. We default to 0x64, which is the
+ * default Atheros world regulatory domain.
+ */
+static void ath_regd_sanitize(struct ath_regulatory *reg)
+{
+        if (reg->current_rd != COUNTRY_ERD_FLAG)
+                return;
+        printk(KERN_DEBUG "ath: EEPROM regdomain sanitized\n");
+        reg->current_rd = 0x64;
+}
+
 int
 ath_regd_init(struct ath_regulatory *reg,
               struct wiphy *wiphy,
@@ -486,6 +501,8 @@ ath_regd_init(struct ath_regulatory *reg,
         if (!reg)
                 return -EINVAL;
 
+        ath_regd_sanitize(reg);
+
         printk(KERN_DEBUG "ath: EEPROM regdomain: 0x%0x\n", reg->current_rd);
 
         if (!ath_regd_is_eeprom_valid(reg)) {
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945.h b/drivers/net/wireless/iwlwifi/iwl-3945.h
index fbb3a573463e..2de6471d4be9 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945.h
+++ b/drivers/net/wireless/iwlwifi/iwl-3945.h
@@ -112,7 +112,7 @@ enum iwl3945_antenna {
 #define IWL_TX_FIFO_NONE        7
 
 /* Minimum number of queues. MAX_NUM is defined in hw specific files */
-#define IWL_MIN_NUM_QUEUES      4
+#define IWL39_MIN_NUM_QUEUES    4
 
 #define IEEE80211_DATA_LEN              2304
 #define IEEE80211_4ADDR_LEN             30
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index 6d1519e1f011..355f50ea7fef 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -2675,12 +2675,10 @@ static ssize_t show_power_level(struct device *d,
                                 struct device_attribute *attr, char *buf)
 {
         struct iwl_priv *priv = dev_get_drvdata(d);
-        int mode = priv->power_data.user_power_setting;
         int level = priv->power_data.power_mode;
         char *p = buf;
 
-        p += sprintf(p, "INDEX:%d\t", level);
-        p += sprintf(p, "USER:%d\n", mode);
+        p += sprintf(p, "%d\n", level);
         return p - buf + 1;
 }
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.c b/drivers/net/wireless/iwlwifi/iwl-core.c
index 6ab07165ea28..18b135f510e5 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.c
+++ b/drivers/net/wireless/iwlwifi/iwl-core.c
@@ -1332,6 +1332,9 @@ int iwl_setup_mac(struct iwl_priv *priv)
 
         hw->wiphy->custom_regulatory = true;
 
+        /* Firmware does not support this */
+        hw->wiphy->disable_beacon_hints = true;
+
         hw->wiphy->max_scan_ssids = PROBE_OPTION_MAX;
         /* we create the 802.11 header and a zero-length SSID element */
         hw->wiphy->max_scan_ie_len = IWL_MAX_PROBE_REQUEST - 24 - 2;
diff --git a/drivers/net/wireless/iwlwifi/iwl-debugfs.c b/drivers/net/wireless/iwlwifi/iwl-debugfs.c
index 11e08c068917..ca00cc8ad4c7 100644
--- a/drivers/net/wireless/iwlwifi/iwl-debugfs.c
+++ b/drivers/net/wireless/iwlwifi/iwl-debugfs.c
@@ -308,18 +308,18 @@ static ssize_t iwl_dbgfs_nvm_read(struct file *file,
                 return -ENODATA;
         }
 
+        ptr = priv->eeprom;
+        if (!ptr) {
+                IWL_ERR(priv, "Invalid EEPROM/OTP memory\n");
+                return -ENOMEM;
+        }
+
         /* 4 characters for byte 0xYY */
         buf = kzalloc(buf_size, GFP_KERNEL);
         if (!buf) {
                 IWL_ERR(priv, "Can not allocate Buffer\n");
                 return -ENOMEM;
         }
-
-        ptr = priv->eeprom;
-        if (!ptr) {
-                IWL_ERR(priv, "Invalid EEPROM/OTP memory\n");
-                return -ENOMEM;
-        }
         pos += scnprintf(buf + pos, buf_size - pos, "NVM Type: %s\n",
                         (priv->nvm_device_type == NVM_DEVICE_TYPE_OTP)
                         ? "OTP" : "EEPROM");
diff --git a/drivers/net/wireless/iwlwifi/iwl-dev.h b/drivers/net/wireless/iwlwifi/iwl-dev.h
index e2d620f0b6e8..650e20af20fa 100644
--- a/drivers/net/wireless/iwlwifi/iwl-dev.h
+++ b/drivers/net/wireless/iwlwifi/iwl-dev.h
@@ -258,8 +258,10 @@ struct iwl_channel_info {
 #define IWL_TX_FIFO_HCCA_2      6
 #define IWL_TX_FIFO_NONE        7
 
-/* Minimum number of queues. MAX_NUM is defined in hw specific files */
-#define IWL_MIN_NUM_QUEUES      4
+/* Minimum number of queues. MAX_NUM is defined in hw specific files.
+ * Set the minimum to accommodate the 4 standard TX queues, 1 command
+ * queue, 2 (unused) HCCA queues, and 4 HT queues (one for each AC) */
+#define IWL_MIN_NUM_QUEUES      10
 
 /* Power management (not Tx power) structures */
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-sta.c b/drivers/net/wireless/iwlwifi/iwl-sta.c
index 2addf735b193..ffd5c61a7553 100644
--- a/drivers/net/wireless/iwlwifi/iwl-sta.c
+++ b/drivers/net/wireless/iwlwifi/iwl-sta.c
@@ -566,6 +566,8 @@ int iwl_remove_default_wep_key(struct iwl_priv *priv,
         unsigned long flags;
 
         spin_lock_irqsave(&priv->sta_lock, flags);
+        IWL_DEBUG_WEP(priv, "Removing default WEP key: idx=%d\n",
+                      keyconf->keyidx);
 
         if (!test_and_clear_bit(keyconf->keyidx, &priv->ucode_key_table))
                 IWL_ERR(priv, "index %d not used in uCode key table.\n",
@@ -573,6 +575,11 @@ int iwl_remove_default_wep_key(struct iwl_priv *priv,
 
         priv->default_wep_key--;
         memset(&priv->wep_keys[keyconf->keyidx], 0, sizeof(priv->wep_keys[0]));
+        if (iwl_is_rfkill(priv)) {
+                IWL_DEBUG_WEP(priv, "Not sending REPLY_WEPKEY command due to RFKILL.\n");
+                spin_unlock_irqrestore(&priv->sta_lock, flags);
+                return 0;
+        }
         ret = iwl_send_static_wepkey_cmd(priv, 1);
         IWL_DEBUG_WEP(priv, "Remove default WEP key: idx=%d ret=%d\n",
                       keyconf->keyidx, ret);
@@ -853,6 +860,11 @@ int iwl_remove_dynamic_key(struct iwl_priv *priv,
         priv->stations[sta_id].sta.sta.modify_mask = STA_MODIFY_KEY_MASK;
         priv->stations[sta_id].sta.mode = STA_CONTROL_MODIFY_MSK;
 
+        if (iwl_is_rfkill(priv)) {
+                IWL_DEBUG_WEP(priv, "Not sending REPLY_ADD_STA command because RFKILL enabled. \n");
+                spin_unlock_irqrestore(&priv->sta_lock, flags);
+                return 0;
+        }
         ret =  iwl_send_add_sta(priv, &priv->stations[sta_id].sta, CMD_ASYNC);
         spin_unlock_irqrestore(&priv->sta_lock, flags);
         return ret;
diff --git a/drivers/net/wireless/iwlwifi/iwl-tx.c b/drivers/net/wireless/iwlwifi/iwl-tx.c
index 85ae7a62109c..2e89040e63be 100644
--- a/drivers/net/wireless/iwlwifi/iwl-tx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-tx.c
@@ -720,8 +720,6 @@ int iwl_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
                 goto drop_unlock;
         }
 
-        spin_unlock_irqrestore(&priv->lock, flags);
-
         hdr_len = ieee80211_hdrlen(fc);
 
         /* Find (or create) index into station table for destination station */
@@ -729,7 +727,7 @@ int iwl_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
         if (sta_id == IWL_INVALID_STATION) {
                 IWL_DEBUG_DROP(priv, "Dropping - INVALID STATION: %pM\n",
                                hdr->addr1);
-                goto drop;
+                goto drop_unlock;
         }
 
         IWL_DEBUG_TX(priv, "station Id %d\n", sta_id);
@@ -750,14 +748,17 @@ int iwl_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
                         txq_id = priv->stations[sta_id].tid[tid].agg.txq_id;
                         swq_id = iwl_virtual_agg_queue_num(swq_id, txq_id);
                 }
-                priv->stations[sta_id].tid[tid].tfds_in_queue++;
         }
 
         txq = &priv->txq[txq_id];
         q = &txq->q;
         txq->swq_id = swq_id;
 
-        spin_lock_irqsave(&priv->lock, flags);
+        if (unlikely(iwl_queue_space(q) < q->high_mark))
+                goto drop_unlock;
+
+        if (ieee80211_is_data_qos(fc))
+                priv->stations[sta_id].tid[tid].tfds_in_queue++;
 
         /* Set up driver data for this TFD */
         memset(&(txq->txb[q->write_ptr]), 0, sizeof(struct iwl_tx_info));
@@ -872,7 +873,8 @@ int iwl_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
         iwl_print_hex_dump(priv, IWL_DL_TX, (u8 *)tx_cmd->hdr, hdr_len);
 
         /* Set up entry for this TFD in Tx byte-count array */
-        priv->cfg->ops->lib->txq_update_byte_cnt_tbl(priv, txq,
+        if (info->flags & IEEE80211_TX_CTL_AMPDU)
+                priv->cfg->ops->lib->txq_update_byte_cnt_tbl(priv, txq,
                                                      le16_to_cpu(tx_cmd->len));
 
         pci_dma_sync_single_for_device(priv->pci_dev, txcmd_phys,
@@ -901,7 +903,6 @@ int iwl_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
 
 drop_unlock:
         spin_unlock_irqrestore(&priv->lock, flags);
-drop:
         return -1;
 }
 EXPORT_SYMBOL(iwl_tx_skb);
@@ -1170,6 +1171,8 @@ int iwl_tx_agg_start(struct iwl_priv *priv, const u8 *ra, u16 tid, u16 *ssn)
                 IWL_ERR(priv, "Start AGG on invalid station\n");
                 return -ENXIO;
         }
+        if (unlikely(tid >= MAX_TID_COUNT))
+                return -EINVAL;
 
         if (priv->stations[sta_id].tid[tid].agg.state != IWL_AGG_OFF) {
                 IWL_ERR(priv, "Start AGG when state is not IWL_AGG_OFF !\n");
diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
index cb9bd4c8f25e..523843369ca2 100644
--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -3643,12 +3643,10 @@ static ssize_t show_power_level(struct device *d,
                                 struct device_attribute *attr, char *buf)
 {
         struct iwl_priv *priv = dev_get_drvdata(d);
-        int mode = priv->power_data.user_power_setting;
         int level = priv->power_data.power_mode;
         char *p = buf;
 
-        p += sprintf(p, "INDEX:%d\t", level);
-        p += sprintf(p, "USER:%d\n", mode);
+        p += sprintf(p, "%d\n", level);
         return p - buf + 1;
 }
 
@@ -3970,6 +3968,9 @@ static int iwl3945_setup_mac(struct iwl_priv *priv)
 
         hw->wiphy->custom_regulatory = true;
 
+        /* Firmware does not support this */
+        hw->wiphy->disable_beacon_hints = true;
+
         hw->wiphy->max_scan_ssids = PROBE_OPTION_MAX_3945;
         /* we create the 802.11 header and a zero-length SSID element */
         hw->wiphy->max_scan_ie_len = IWL_MAX_PROBE_REQUEST - 24 - 2;
@@ -4020,10 +4021,10 @@ static int iwl3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *e
         SET_IEEE80211_DEV(hw, &pdev->dev);
 
         if ((iwl3945_mod_params.num_of_queues > IWL39_MAX_NUM_QUEUES) ||
-             (iwl3945_mod_params.num_of_queues < IWL_MIN_NUM_QUEUES)) {
+             (iwl3945_mod_params.num_of_queues < IWL39_MIN_NUM_QUEUES)) {
                 IWL_ERR(priv,
                         "invalid queues_num, should be between %d and %d\n",
-                        IWL_MIN_NUM_QUEUES, IWL39_MAX_NUM_QUEUES);
+                        IWL39_MIN_NUM_QUEUES, IWL39_MAX_NUM_QUEUES);
                 err = -EINVAL;
                 goto out_ieee80211_free_hw;
         }
diff --git a/drivers/net/wireless/iwmc3200wifi/commands.c b/drivers/net/wireless/iwmc3200wifi/commands.c
index 834a7f544e5d..e2334d123599 100644
--- a/drivers/net/wireless/iwmc3200wifi/commands.c
+++ b/drivers/net/wireless/iwmc3200wifi/commands.c
@@ -220,6 +220,7 @@ int iwm_store_rxiq_calib_result(struct iwm_priv *iwm)
         eeprom_rxiq = iwm_eeprom_access(iwm, IWM_EEPROM_CALIB_RXIQ);
         if (IS_ERR(eeprom_rxiq)) {
                 IWM_ERR(iwm, "Couldn't access EEPROM RX IQ entry\n");
+                kfree(rxiq);
                 return PTR_ERR(eeprom_rxiq);
         }
 
diff --git a/drivers/net/wireless/iwmc3200wifi/netdev.c b/drivers/net/wireless/iwmc3200wifi/netdev.c
index aaa20c6885c8..bf294e41753b 100644
--- a/drivers/net/wireless/iwmc3200wifi/netdev.c
+++ b/drivers/net/wireless/iwmc3200wifi/netdev.c
@@ -106,10 +106,8 @@ void *iwm_if_alloc(int sizeof_bus, struct device *dev,
         int ret = 0;
 
         wdev = iwm_wdev_alloc(sizeof_bus, dev);
-        if (!wdev) {
-                dev_err(dev, "no memory for wireless device instance\n");
-                return ERR_PTR(-ENOMEM);
-        }
+        if (IS_ERR(wdev))
+                return wdev;
 
         iwm = wdev_to_iwm(wdev);
         iwm->bus_ops = if_ops;
@@ -151,8 +149,8 @@ void iwm_if_free(struct iwm_priv *iwm)
                 return;
 
         free_netdev(iwm_to_ndev(iwm));
-        iwm_wdev_free(iwm);
         iwm_priv_deinit(iwm);
+        iwm_wdev_free(iwm);
 }
 
 int iwm_if_add(struct iwm_priv *iwm)
diff --git a/drivers/net/wireless/libertas/11d.c b/drivers/net/wireless/libertas/11d.c
index 9a5408e7d94a..5c6968101f0d 100644
--- a/drivers/net/wireless/libertas/11d.c
+++ b/drivers/net/wireless/libertas/11d.c
@@ -47,7 +47,7 @@ static u8 lbs_region_2_code(u8 *region)
 {
         u8 i;
 
-        for (i = 0; region[i] && i < COUNTRY_CODE_LEN; i++)
+        for (i = 0; i < COUNTRY_CODE_LEN && region[i]; i++)
                 region[i] = toupper(region[i]);
 
         for (i = 0; i < ARRAY_SIZE(region_code_mapping); i++) {
diff --git a/drivers/net/wireless/libertas/assoc.c b/drivers/net/wireless/libertas/assoc.c
index b9b374119033..d6997371c27e 100644
--- a/drivers/net/wireless/libertas/assoc.c
+++ b/drivers/net/wireless/libertas/assoc.c
@@ -1,6 +1,7 @@
 /* Copyright (C) 2006, Red Hat, Inc. */
 
 #include <linux/types.h>
+#include <linux/kernel.h>
 #include <linux/etherdevice.h>
 #include <linux/ieee80211.h>
 #include <linux/if_arp.h>
@@ -43,21 +44,21 @@ static int get_common_rates(struct lbs_private *priv,
         u16 *rates_size)
 {
         u8 *card_rates = lbs_bg_rates;
-        size_t num_card_rates = sizeof(lbs_bg_rates);
         int ret = 0, i, j;
-        u8 tmp[30];
+        u8 tmp[(ARRAY_SIZE(lbs_bg_rates) - 1) * (*rates_size - 1)];
         size_t tmp_size = 0;
 
         /* For each rate in card_rates that exists in rate1, copy to tmp */
-        for (i = 0; card_rates[i] && (i < num_card_rates); i++) {
-                for (j = 0; rates[j] && (j < *rates_size); j++) {
+        for (i = 0; i < ARRAY_SIZE(lbs_bg_rates) && card_rates[i]; i++) {
+                for (j = 0; j < *rates_size && rates[j]; j++) {
                         if (rates[j] == card_rates[i])
                                 tmp[tmp_size++] = card_rates[i];
                 }
         }
 
         lbs_deb_hex(LBS_DEB_JOIN, "AP rates    ", rates, *rates_size);
-        lbs_deb_hex(LBS_DEB_JOIN, "card rates  ", card_rates, num_card_rates);
+        lbs_deb_hex(LBS_DEB_JOIN, "card rates  ", card_rates,
+                        ARRAY_SIZE(lbs_bg_rates));
         lbs_deb_hex(LBS_DEB_JOIN, "common rates", tmp, tmp_size);
         lbs_deb_join("TX data rate 0x%02x\n", priv->cur_rate);
 
@@ -69,10 +70,7 @@ static int get_common_rates(struct lbs_private *priv,
                 lbs_pr_alert("Previously set fixed data rate %#x isn't "
                        "compatible with the network.\n", priv->cur_rate);
                 ret = -1;
-                goto done;
         }
-        ret = 0;
-
 done:
         memset(rates, 0, *rates_size);
         *rates_size = min_t(int, tmp_size, *rates_size);
@@ -322,7 +320,7 @@ static int lbs_associate(struct lbs_private *priv,
         rates = (struct mrvl_ie_rates_param_set *) pos;
         rates->header.type = cpu_to_le16(TLV_TYPE_RATES);
         memcpy(&rates->rates, &bss->rates, MAX_RATES);
-        tmplen = MAX_RATES;
+        tmplen = min_t(u16, ARRAY_SIZE(rates->rates), MAX_RATES);
         if (get_common_rates(priv, rates->rates, &tmplen)) {
                 ret = -1;
                 goto done;
@@ -598,7 +596,7 @@ static int lbs_adhoc_join(struct lbs_private *priv,
 
         /* Copy Data rates from the rates recorded in scan response */
         memset(cmd.bss.rates, 0, sizeof(cmd.bss.rates));
-        ratesize = min_t(u16, sizeof(cmd.bss.rates), MAX_RATES);
+        ratesize = min_t(u16, ARRAY_SIZE(cmd.bss.rates), MAX_RATES);
         memcpy(cmd.bss.rates, bss->rates, ratesize);
         if (get_common_rates(priv, cmd.bss.rates, &ratesize)) {
                 lbs_deb_join("ADHOC_JOIN: get_common_rates returned error.\n");
diff --git a/drivers/net/wireless/libertas/cmd.c b/drivers/net/wireless/libertas/cmd.c
index 01db705a38ec..685098148e10 100644
--- a/drivers/net/wireless/libertas/cmd.c
+++ b/drivers/net/wireless/libertas/cmd.c
@@ -135,8 +135,14 @@ int lbs_update_hw_spec(struct lbs_private *priv)
         /* Clamp region code to 8-bit since FW spec indicates that it should
          * only ever be 8-bit, even though the field size is 16-bit.  Some firmware
          * returns non-zero high 8 bits here.
+         *
+         * Firmware version 4.0.102 used in CF8381 has region code shifted.  We
+         * need to check for this problem and handle it properly.
          */
-        priv->regioncode = le16_to_cpu(cmd.regioncode) & 0xFF;
+        if (MRVL_FW_MAJOR_REV(priv->fwrelease) == MRVL_FW_V4)
+                priv->regioncode = (le16_to_cpu(cmd.regioncode) >> 8) & 0xFF;
+        else
+                priv->regioncode = le16_to_cpu(cmd.regioncode) & 0xFF;
 
         for (i = 0; i < MRVDRV_MAX_REGION_CODE; i++) {
                 /* use the region code to search for the index */
diff --git a/drivers/net/wireless/libertas/defs.h b/drivers/net/wireless/libertas/defs.h
index 48da157d6cda..72f3479a4d70 100644
--- a/drivers/net/wireless/libertas/defs.h
+++ b/drivers/net/wireless/libertas/defs.h
@@ -234,6 +234,8 @@ static inline void lbs_deb_hex(unsigned int grp, const char *prompt, u8 *buf, in
 /** Mesh enable bit in FW capability */
 #define MESH_CAPINFO_ENABLE_MASK                        (1<<16)
 
+/** FW definition from Marvell v4 */
+#define MRVL_FW_V4                                      (0x04)
 /** FW definition from Marvell v5 */
 #define MRVL_FW_V5                                      (0x05)
 /** FW definition from Marvell v10 */
diff --git a/drivers/net/wireless/libertas/scan.c b/drivers/net/wireless/libertas/scan.c
index 601b54249677..6c95af3023cc 100644
--- a/drivers/net/wireless/libertas/scan.c
+++ b/drivers/net/wireless/libertas/scan.c
@@ -5,6 +5,7 @@
   *  for sending scan commands to the firmware.
   */
 #include <linux/types.h>
+#include <linux/kernel.h>
 #include <linux/etherdevice.h>
 #include <linux/if_arp.h>
 #include <asm/unaligned.h>
@@ -876,7 +877,7 @@ static inline char *lbs_translate_scan(struct lbs_private *priv,
         iwe.u.bitrate.disabled = 0;
         iwe.u.bitrate.value = 0;
 
-        for (j = 0; bss->rates[j] && (j < sizeof(bss->rates)); j++) {
+        for (j = 0; j < ARRAY_SIZE(bss->rates) && bss->rates[j]; j++) {
                 /* Bit rate given in 500 kb/s units */
                 iwe.u.bitrate.value = bss->rates[j] * 500000;
                 current_val = iwe_stream_add_value(info, start, current_val,
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index a111bda392e2..7916ca3f84c8 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -709,7 +709,7 @@ static const struct ieee80211_ops mac80211_hwsim_ops =
 static void mac80211_hwsim_free(void)
 {
         struct list_head tmplist, *i, *tmp;
-        struct mac80211_hwsim_data *data;
+        struct mac80211_hwsim_data *data, *tmpdata;
 
         INIT_LIST_HEAD(&tmplist);
 
@@ -718,7 +718,7 @@ static void mac80211_hwsim_free(void)
                 list_move(i, &tmplist);
         spin_unlock_bh(&hwsim_radio_lock);
 
-        list_for_each_entry(data, &tmplist, list) {
+        list_for_each_entry_safe(data, tmpdata, &tmplist, list) {
                 debugfs_remove(data->debugfs_group);
                 debugfs_remove(data->debugfs_ps);
                 debugfs_remove(data->debugfs);
@@ -1167,8 +1167,8 @@ static void __exit exit_mac80211_hwsim(void)
 {
         printk(KERN_DEBUG "mac80211_hwsim: unregister radios\n");
 
-        unregister_netdev(hwsim_mon);
         mac80211_hwsim_free();
+        unregister_netdev(hwsim_mon);
 }
 
 
diff --git a/drivers/net/wireless/p54/p54spi.c b/drivers/net/wireless/p54/p54spi.c
index 83116baeb110..72c7dbd39d0a 100644
--- a/drivers/net/wireless/p54/p54spi.c
+++ b/drivers/net/wireless/p54/p54spi.c
@@ -635,7 +635,7 @@ static int __devinit p54spi_probe(struct spi_device *spi)
 
         hw = p54_init_common(sizeof(*priv));
         if (!hw) {
-                dev_err(&priv->spi->dev, "could not alloc ieee80211_hw");
+                dev_err(&spi->dev, "could not alloc ieee80211_hw");
                 return -ENOMEM;
         }
 
diff --git a/drivers/net/wireless/rt2x00/rt2500usb.c b/drivers/net/wireless/rt2x00/rt2500usb.c
index 66daf68ff0ee..ce75426764a1 100644
--- a/drivers/net/wireless/rt2x00/rt2500usb.c
+++ b/drivers/net/wireless/rt2x00/rt2500usb.c
@@ -1550,7 +1550,9 @@ static int rt2500usb_init_eeprom(struct rt2x00_dev *rt2x00dev)
         rt2500usb_register_read(rt2x00dev, MAC_CSR0, &reg);
         rt2x00_set_chip(rt2x00dev, RT2570, value, reg);
 
-        if (!rt2x00_check_rev(&rt2x00dev->chip, 0x000ffff0, 0)) {
+        if (!rt2x00_check_rev(&rt2x00dev->chip, 0x000ffff0, 0) ||
+            rt2x00_check_rev(&rt2x00dev->chip, 0x0000000f, 0)) {
+
                 ERROR(rt2x00dev, "Invalid RT chipset detected.\n");
                 return -ENODEV;
         }
diff --git a/drivers/net/wireless/rtl818x/rtl8187_leds.c b/drivers/net/wireless/rtl818x/rtl8187_leds.c
index b44253592243..cf9f899fe0e6 100644
--- a/drivers/net/wireless/rtl818x/rtl8187_leds.c
+++ b/drivers/net/wireless/rtl818x/rtl8187_leds.c
@@ -208,11 +208,12 @@ void rtl8187_leds_exit(struct ieee80211_hw *dev)
 {
         struct rtl8187_priv *priv = dev->priv;
 
-        rtl8187_unregister_led(&priv->led_tx);
         /* turn the LED off before exiting */
         queue_delayed_work(dev->workqueue, &priv->led_off, 0);
         cancel_delayed_work_sync(&priv->led_off);
+        cancel_delayed_work_sync(&priv->led_on);
         rtl8187_unregister_led(&priv->led_rx);
+        rtl8187_unregister_led(&priv->led_tx);
 }
 #endif /* def CONFIG_RTL8187_LED */
 
diff --git a/drivers/net/wireless/zd1211rw/zd_mac.c b/drivers/net/wireless/zd1211rw/zd_mac.c
index 40b07b988224..3bd3c779fff3 100644
--- a/drivers/net/wireless/zd1211rw/zd_mac.c
+++ b/drivers/net/wireless/zd1211rw/zd_mac.c
@@ -698,7 +698,7 @@ int zd_mac_rx(struct ieee80211_hw *hw, const u8 *buffer, unsigned int length)
                         && !mac->pass_ctrl)
                 return 0;
 
-        fc = *(__le16 *)buffer;
+        fc = get_unaligned((__le16*)buffer);
         need_padding = ieee80211_is_data_qos(fc) ^ ieee80211_has_a4(fc);
 
         skb = dev_alloc_skb(length + (need_padding ? 2 : 0));