Merge branch 'imx-features-for-arnd' of git://git.pengutronix.de/git/imx/linux-2.6 into imx/devel

Conflicts:
	arch/arm/mach-mx5/clock-mx51-mx53.c
	arch/arm/mach-mx5/devices-imx53.h

85 files changed, 1213 insertions, 674 deletions

diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
index 8d0314dbd946..a44874e24f2a 100644
--- a/drivers/net/Kconfig
+++ b/drivers/net/Kconfig
@@ -2535,7 +2535,7 @@ config S6GMAC
 source "drivers/net/stmmac/Kconfig"
 
 config PCH_GBE
-        tristate "Intel EG20T PCH / OKI SEMICONDUCTOR ML7223 IOH GbE"
+        tristate "Intel EG20T PCH/OKI SEMICONDUCTOR IOH(ML7223/ML7831) GbE"
         depends on PCI
         select MII
         ---help---
@@ -2548,10 +2548,11 @@ config PCH_GBE
           This driver enables Gigabit Ethernet function.
 
           This driver also can be used for OKI SEMICONDUCTOR IOH(Input/
-          Output Hub), ML7223.
-          ML7223 IOH is for MP(Media Phone) use.
-          ML7223 is companion chip for Intel Atom E6xx series.
-          ML7223 is completely compatible for Intel EG20T PCH.
+          Output Hub), ML7223/ML7831.
+          ML7223 IOH is for MP(Media Phone) use. ML7831 IOH is for general
+          purpose use.
+          ML7223/ML7831 is companion chip for Intel Atom E6xx series.
+          ML7223/ML7831 is completely compatible for Intel EG20T PCH.
 
 config FTGMAC100
         tristate "Faraday FTGMAC100 Gigabit Ethernet support"
diff --git a/drivers/net/arm/am79c961a.c b/drivers/net/arm/am79c961a.c
index 52fe21e1e2cd..3b1416e3d217 100644
--- a/drivers/net/arm/am79c961a.c
+++ b/drivers/net/arm/am79c961a.c
@@ -308,8 +308,11 @@ static void am79c961_timer(unsigned long data)
         struct net_device *dev = (struct net_device *)data;
         struct dev_priv *priv = netdev_priv(dev);
         unsigned int lnkstat, carrier;
+        unsigned long flags;
 
+        spin_lock_irqsave(&priv->chip_lock, flags);
         lnkstat = read_ireg(dev->base_addr, ISALED0) & ISALED0_LNKST;
+        spin_unlock_irqrestore(&priv->chip_lock, flags);
         carrier = netif_carrier_ok(dev);
 
         if (lnkstat && !carrier) {
diff --git a/drivers/net/bnx2x/bnx2x.h b/drivers/net/bnx2x/bnx2x.h
index c423504a755f..e46df5331c55 100644
--- a/drivers/net/bnx2x/bnx2x.h
+++ b/drivers/net/bnx2x/bnx2x.h
@@ -315,6 +315,14 @@ union db_prod {
         u32             raw;
 };
 
+/* dropless fc FW/HW related params */
+#define BRB_SIZE(bp)            (CHIP_IS_E3(bp) ? 1024 : 512)
+#define MAX_AGG_QS(bp)          (CHIP_IS_E1(bp) ? \
+                                        ETH_MAX_AGGREGATION_QUEUES_E1 :\
+                                        ETH_MAX_AGGREGATION_QUEUES_E1H_E2)
+#define FW_DROP_LEVEL(bp)       (3 + MAX_SPQ_PENDING + MAX_AGG_QS(bp))
+#define FW_PREFETCH_CNT         16
+#define DROPLESS_FC_HEADROOM    100
 
 /* MC hsi */
 #define BCM_PAGE_SHIFT          12
@@ -331,15 +339,35 @@ union db_prod {
 /* SGE ring related macros */
 #define NUM_RX_SGE_PAGES        2
 #define RX_SGE_CNT              (BCM_PAGE_SIZE / sizeof(struct eth_rx_sge))
-#define MAX_RX_SGE_CNT          (RX_SGE_CNT - 2)
+#define NEXT_PAGE_SGE_DESC_CNT  2
+#define MAX_RX_SGE_CNT          (RX_SGE_CNT - NEXT_PAGE_SGE_DESC_CNT)
 /* RX_SGE_CNT is promised to be a power of 2 */
 #define RX_SGE_MASK             (RX_SGE_CNT - 1)
 #define NUM_RX_SGE              (RX_SGE_CNT * NUM_RX_SGE_PAGES)
 #define MAX_RX_SGE              (NUM_RX_SGE - 1)
 #define NEXT_SGE_IDX(x)         ((((x) & RX_SGE_MASK) == \
-                                  (MAX_RX_SGE_CNT - 1)) ? (x) + 3 : (x) + 1)
+                                  (MAX_RX_SGE_CNT - 1)) ? \
+                                        (x) + 1 + NEXT_PAGE_SGE_DESC_CNT : \
+                                        (x) + 1)
 #define RX_SGE(x)               ((x) & MAX_RX_SGE)
 
+/*
+ * Number of required  SGEs is the sum of two:
+ * 1. Number of possible opened aggregations (next packet for
+ *    these aggregations will probably consume SGE immidiatelly)
+ * 2. Rest of BRB blocks divided by 2 (block will consume new SGE only
+ *    after placement on BD for new TPA aggregation)
+ *
+ * Takes into account NEXT_PAGE_SGE_DESC_CNT "next" elements on each page
+ */
+#define NUM_SGE_REQ             (MAX_AGG_QS(bp) + \
+                                        (BRB_SIZE(bp) - MAX_AGG_QS(bp)) / 2)
+#define NUM_SGE_PG_REQ          ((NUM_SGE_REQ + MAX_RX_SGE_CNT - 1) / \
+                                                MAX_RX_SGE_CNT)
+#define SGE_TH_LO(bp)           (NUM_SGE_REQ + \
+                                 NUM_SGE_PG_REQ * NEXT_PAGE_SGE_DESC_CNT)
+#define SGE_TH_HI(bp)           (SGE_TH_LO(bp) + DROPLESS_FC_HEADROOM)
+
 /* Manipulate a bit vector defined as an array of u64 */
 
 /* Number of bits in one sge_mask array element */
@@ -551,24 +579,43 @@ struct bnx2x_fastpath {
 
 #define NUM_TX_RINGS            16
 #define TX_DESC_CNT             (BCM_PAGE_SIZE / sizeof(union eth_tx_bd_types))
-#define MAX_TX_DESC_CNT         (TX_DESC_CNT - 1)
+#define NEXT_PAGE_TX_DESC_CNT   1
+#define MAX_TX_DESC_CNT         (TX_DESC_CNT - NEXT_PAGE_TX_DESC_CNT)
 #define NUM_TX_BD               (TX_DESC_CNT * NUM_TX_RINGS)
 #define MAX_TX_BD               (NUM_TX_BD - 1)
 #define MAX_TX_AVAIL            (MAX_TX_DESC_CNT * NUM_TX_RINGS - 2)
 #define NEXT_TX_IDX(x)          ((((x) & MAX_TX_DESC_CNT) == \
-                                  (MAX_TX_DESC_CNT - 1)) ? (x) + 2 : (x) + 1)
+                                  (MAX_TX_DESC_CNT - 1)) ? \
+                                        (x) + 1 + NEXT_PAGE_TX_DESC_CNT : \
+                                        (x) + 1)
 #define TX_BD(x)                ((x) & MAX_TX_BD)
 #define TX_BD_POFF(x)           ((x) & MAX_TX_DESC_CNT)
 
 /* The RX BD ring is special, each bd is 8 bytes but the last one is 16 */
 #define NUM_RX_RINGS            8
 #define RX_DESC_CNT             (BCM_PAGE_SIZE / sizeof(struct eth_rx_bd))
-#define MAX_RX_DESC_CNT         (RX_DESC_CNT - 2)
+#define NEXT_PAGE_RX_DESC_CNT   2
+#define MAX_RX_DESC_CNT         (RX_DESC_CNT - NEXT_PAGE_RX_DESC_CNT)
 #define RX_DESC_MASK            (RX_DESC_CNT - 1)
 #define NUM_RX_BD               (RX_DESC_CNT * NUM_RX_RINGS)
 #define MAX_RX_BD               (NUM_RX_BD - 1)
 #define MAX_RX_AVAIL            (MAX_RX_DESC_CNT * NUM_RX_RINGS - 2)
-#define MIN_RX_AVAIL            128
+
+/* dropless fc calculations for BDs
+ *
+ * Number of BDs should as number of buffers in BRB:
+ * Low threshold takes into account NEXT_PAGE_RX_DESC_CNT
+ * "next" elements on each page
+ */
+#define NUM_BD_REQ              BRB_SIZE(bp)
+#define NUM_BD_PG_REQ           ((NUM_BD_REQ + MAX_RX_DESC_CNT - 1) / \
+                                              MAX_RX_DESC_CNT)
+#define BD_TH_LO(bp)            (NUM_BD_REQ + \
+                                 NUM_BD_PG_REQ * NEXT_PAGE_RX_DESC_CNT + \
+                                 FW_DROP_LEVEL(bp))
+#define BD_TH_HI(bp)            (BD_TH_LO(bp) + DROPLESS_FC_HEADROOM)
+
+#define MIN_RX_AVAIL            ((bp)->dropless_fc ? BD_TH_HI(bp) + 128 : 128)
 
 #define MIN_RX_SIZE_TPA_HW      (CHIP_IS_E1(bp) ? \
                                         ETH_MIN_RX_CQES_WITH_TPA_E1 : \
@@ -579,7 +626,9 @@ struct bnx2x_fastpath {
                                                                 MIN_RX_AVAIL))
 
 #define NEXT_RX_IDX(x)          ((((x) & RX_DESC_MASK) == \
-                                  (MAX_RX_DESC_CNT - 1)) ? (x) + 3 : (x) + 1)
+                                  (MAX_RX_DESC_CNT - 1)) ? \
+                                        (x) + 1 + NEXT_PAGE_RX_DESC_CNT : \
+                                        (x) + 1)
 #define RX_BD(x)                ((x) & MAX_RX_BD)
 
 /*
@@ -589,14 +638,31 @@ struct bnx2x_fastpath {
 #define CQE_BD_REL      (sizeof(union eth_rx_cqe) / sizeof(struct eth_rx_bd))
 #define NUM_RCQ_RINGS           (NUM_RX_RINGS * CQE_BD_REL)
 #define RCQ_DESC_CNT            (BCM_PAGE_SIZE / sizeof(union eth_rx_cqe))
-#define MAX_RCQ_DESC_CNT        (RCQ_DESC_CNT - 1)
+#define NEXT_PAGE_RCQ_DESC_CNT  1
+#define MAX_RCQ_DESC_CNT        (RCQ_DESC_CNT - NEXT_PAGE_RCQ_DESC_CNT)
 #define NUM_RCQ_BD              (RCQ_DESC_CNT * NUM_RCQ_RINGS)
 #define MAX_RCQ_BD              (NUM_RCQ_BD - 1)
 #define MAX_RCQ_AVAIL           (MAX_RCQ_DESC_CNT * NUM_RCQ_RINGS - 2)
 #define NEXT_RCQ_IDX(x)         ((((x) & MAX_RCQ_DESC_CNT) == \
-                                  (MAX_RCQ_DESC_CNT - 1)) ? (x) + 2 : (x) + 1)
+                                  (MAX_RCQ_DESC_CNT - 1)) ? \
+                                        (x) + 1 + NEXT_PAGE_RCQ_DESC_CNT : \
+                                        (x) + 1)
 #define RCQ_BD(x)               ((x) & MAX_RCQ_BD)
 
+/* dropless fc calculations for RCQs
+ *
+ * Number of RCQs should be as number of buffers in BRB:
+ * Low threshold takes into account NEXT_PAGE_RCQ_DESC_CNT
+ * "next" elements on each page
+ */
+#define NUM_RCQ_REQ             BRB_SIZE(bp)
+#define NUM_RCQ_PG_REQ          ((NUM_BD_REQ + MAX_RCQ_DESC_CNT - 1) / \
+                                              MAX_RCQ_DESC_CNT)
+#define RCQ_TH_LO(bp)           (NUM_RCQ_REQ + \
+                                 NUM_RCQ_PG_REQ * NEXT_PAGE_RCQ_DESC_CNT + \
+                                 FW_DROP_LEVEL(bp))
+#define RCQ_TH_HI(bp)           (RCQ_TH_LO(bp) + DROPLESS_FC_HEADROOM)
+
 
 /* This is needed for determining of last_max */
 #define SUB_S16(a, b)           (s16)((s16)(a) - (s16)(b))
@@ -685,24 +751,17 @@ struct bnx2x_fastpath {
 #define FP_CSB_FUNC_OFF \
                         offsetof(struct cstorm_status_block_c, func)
 
-#define HC_INDEX_TOE_RX_CQ_CONS         0 /* Formerly Ustorm TOE CQ index */
-                                          /* (HC_INDEX_U_TOE_RX_CQ_CONS)  */
-#define HC_INDEX_ETH_RX_CQ_CONS         1 /* Formerly Ustorm ETH CQ index */
-                                          /* (HC_INDEX_U_ETH_RX_CQ_CONS)  */
-#define HC_INDEX_ETH_RX_BD_CONS         2 /* Formerly Ustorm ETH BD index */
-                                          /* (HC_INDEX_U_ETH_RX_BD_CONS)  */
-
-#define HC_INDEX_TOE_TX_CQ_CONS         4 /* Formerly Cstorm TOE CQ index   */
-                                          /* (HC_INDEX_C_TOE_TX_CQ_CONS)    */
-#define HC_INDEX_ETH_TX_CQ_CONS_COS0    5 /* Formerly Cstorm ETH CQ index   */
-                                          /* (HC_INDEX_C_ETH_TX_CQ_CONS)    */
-#define HC_INDEX_ETH_TX_CQ_CONS_COS1    6 /* Formerly Cstorm ETH CQ index   */
-                                          /* (HC_INDEX_C_ETH_TX_CQ_CONS)    */
-#define HC_INDEX_ETH_TX_CQ_CONS_COS2    7 /* Formerly Cstorm ETH CQ index   */
-                                          /* (HC_INDEX_C_ETH_TX_CQ_CONS)    */
+#define HC_INDEX_ETH_RX_CQ_CONS         1
 
-#define HC_INDEX_ETH_FIRST_TX_CQ_CONS   HC_INDEX_ETH_TX_CQ_CONS_COS0
+#define HC_INDEX_OOO_TX_CQ_CONS         4
 
+#define HC_INDEX_ETH_TX_CQ_CONS_COS0    5
+
+#define HC_INDEX_ETH_TX_CQ_CONS_COS1    6
+
+#define HC_INDEX_ETH_TX_CQ_CONS_COS2    7
+
+#define HC_INDEX_ETH_FIRST_TX_CQ_CONS   HC_INDEX_ETH_TX_CQ_CONS_COS0
 
 #define BNX2X_RX_SB_INDEX \
         (&fp->sb_index_values[HC_INDEX_ETH_RX_CQ_CONS])
@@ -1100,11 +1159,12 @@ struct bnx2x {
 #define BP_PORT(bp)                     (bp->pfid & 1)
 #define BP_FUNC(bp)                     (bp->pfid)
 #define BP_ABS_FUNC(bp)                 (bp->pf_num)
-#define BP_E1HVN(bp)                    (bp->pfid >> 1)
-#define BP_VN(bp)                       (BP_E1HVN(bp)) /*remove when approved*/
-#define BP_L_ID(bp)                     (BP_E1HVN(bp) << 2)
-#define BP_FW_MB_IDX(bp)                (BP_PORT(bp) +\
-          BP_VN(bp) * ((CHIP_IS_E1x(bp) || (CHIP_MODE_IS_4_PORT(bp))) ? 2  : 1))
+#define BP_VN(bp)                       ((bp)->pfid >> 1)
+#define BP_MAX_VN_NUM(bp)               (CHIP_MODE_IS_4_PORT(bp) ? 2 : 4)
+#define BP_L_ID(bp)                     (BP_VN(bp) << 2)
+#define BP_FW_MB_IDX_VN(bp, vn)         (BP_PORT(bp) +\
+          (vn) * ((CHIP_IS_E1x(bp) || (CHIP_MODE_IS_4_PORT(bp))) ? 2  : 1))
+#define BP_FW_MB_IDX(bp)                BP_FW_MB_IDX_VN(bp, BP_VN(bp))
 
         struct net_device       *dev;
         struct pci_dev          *pdev;
@@ -1767,7 +1827,7 @@ static inline u32 reg_poll(struct bnx2x *bp, u32 reg, u32 expected, int ms,
 
 #define MAX_DMAE_C_PER_PORT             8
 #define INIT_DMAE_C(bp)                 (BP_PORT(bp) * MAX_DMAE_C_PER_PORT + \
-                                         BP_E1HVN(bp))
+                                         BP_VN(bp))
 #define PMF_DMAE_C(bp)                  (BP_PORT(bp) * MAX_DMAE_C_PER_PORT + \
                                          E1HVN_MAX)
 
@@ -1793,7 +1853,7 @@ static inline u32 reg_poll(struct bnx2x *bp, u32 reg, u32 expected, int ms,
 
 /* must be used on a CID before placing it on a HW ring */
 #define HW_CID(bp, x)                   ((BP_PORT(bp) << 23) | \
-                                         (BP_E1HVN(bp) << BNX2X_SWCID_SHIFT) | \
+                                         (BP_VN(bp) << BNX2X_SWCID_SHIFT) | \
                                          (x))
 
 #define SP_DESC_CNT             (BCM_PAGE_SIZE / sizeof(struct eth_spe))
diff --git a/drivers/net/bnx2x/bnx2x_cmn.c b/drivers/net/bnx2x/bnx2x_cmn.c
index 37e5790681ad..c4cbf9736414 100644
--- a/drivers/net/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/bnx2x/bnx2x_cmn.c
@@ -987,8 +987,6 @@ void __bnx2x_link_report(struct bnx2x *bp)
 void bnx2x_init_rx_rings(struct bnx2x *bp)
 {
         int func = BP_FUNC(bp);
-        int max_agg_queues = CHIP_IS_E1(bp) ? ETH_MAX_AGGREGATION_QUEUES_E1 :
-                                              ETH_MAX_AGGREGATION_QUEUES_E1H_E2;
         u16 ring_prod;
         int i, j;
 
@@ -1001,7 +999,7 @@ void bnx2x_init_rx_rings(struct bnx2x *bp)
 
                 if (!fp->disable_tpa) {
                         /* Fill the per-aggregtion pool */
-                        for (i = 0; i < max_agg_queues; i++) {
+                        for (i = 0; i < MAX_AGG_QS(bp); i++) {
                                 struct bnx2x_agg_info *tpa_info =
                                         &fp->tpa_info[i];
                                 struct sw_rx_bd *first_buf =
@@ -1041,7 +1039,7 @@ void bnx2x_init_rx_rings(struct bnx2x *bp)
                                         bnx2x_free_rx_sge_range(bp, fp,
                                                                 ring_prod);
                                         bnx2x_free_tpa_pool(bp, fp,
-                                                            max_agg_queues);
+                                                            MAX_AGG_QS(bp));
                                         fp->disable_tpa = 1;
                                         ring_prod = 0;
                                         break;
@@ -1137,9 +1135,7 @@ static void bnx2x_free_rx_skbs(struct bnx2x *bp)
                 bnx2x_free_rx_bds(fp);
 
                 if (!fp->disable_tpa)
-                        bnx2x_free_tpa_pool(bp, fp, CHIP_IS_E1(bp) ?
-                                            ETH_MAX_AGGREGATION_QUEUES_E1 :
-                                            ETH_MAX_AGGREGATION_QUEUES_E1H_E2);
+                        bnx2x_free_tpa_pool(bp, fp, MAX_AGG_QS(bp));
         }
 }
 
@@ -3095,15 +3091,20 @@ static int bnx2x_alloc_fp_mem_at(struct bnx2x *bp, int index)
         struct bnx2x_fastpath *fp = &bp->fp[index];
         int ring_size = 0;
         u8 cos;
+        int rx_ring_size = 0;
 
         /* if rx_ring_size specified - use it */
-        int rx_ring_size = bp->rx_ring_size ? bp->rx_ring_size :
-                           MAX_RX_AVAIL/BNX2X_NUM_RX_QUEUES(bp);
+        if (!bp->rx_ring_size) {
 
-        /* allocate at least number of buffers required by FW */
-        rx_ring_size = max_t(int, bp->disable_tpa ? MIN_RX_SIZE_NONTPA :
-                                                    MIN_RX_SIZE_TPA,
-                                  rx_ring_size);
+                rx_ring_size = MAX_RX_AVAIL/BNX2X_NUM_RX_QUEUES(bp);
+
+                /* allocate at least number of buffers required by FW */
+                rx_ring_size = max_t(int, bp->disable_tpa ? MIN_RX_SIZE_NONTPA :
+                                     MIN_RX_SIZE_TPA, rx_ring_size);
+
+                bp->rx_ring_size = rx_ring_size;
+        } else
+                rx_ring_size = bp->rx_ring_size;
 
         /* Common */
         sb = &bnx2x_fp(bp, index, status_blk);
diff --git a/drivers/net/bnx2x/bnx2x_dcb.c b/drivers/net/bnx2x/bnx2x_dcb.c
index a1e004a82f7a..0b4acf67e0c6 100644
--- a/drivers/net/bnx2x/bnx2x_dcb.c
+++ b/drivers/net/bnx2x/bnx2x_dcb.c
@@ -2120,6 +2120,7 @@ static u8 bnx2x_dcbnl_get_cap(struct net_device *netdev, int capid, u8 *cap)
                         break;
                 case DCB_CAP_ATTR_DCBX:
                         *cap = BNX2X_DCBX_CAPS;
+                        break;
                 default:
                         rval = -EINVAL;
                         break;
diff --git a/drivers/net/bnx2x/bnx2x_ethtool.c b/drivers/net/bnx2x/bnx2x_ethtool.c
index 221863059dae..cf3e47914dd7 100644
--- a/drivers/net/bnx2x/bnx2x_ethtool.c
+++ b/drivers/net/bnx2x/bnx2x_ethtool.c
@@ -363,13 +363,50 @@ static int bnx2x_set_settings(struct net_device *dev, struct ethtool_cmd *cmd)
                 }
 
                 /* advertise the requested speed and duplex if supported */
-                cmd->advertising &= bp->port.supported[cfg_idx];
+                if (cmd->advertising & ~(bp->port.supported[cfg_idx])) {
+                        DP(NETIF_MSG_LINK, "Advertisement parameters "
+                                           "are not supported\n");
+                        return -EINVAL;
+                }
 
                 bp->link_params.req_line_speed[cfg_idx] = SPEED_AUTO_NEG;
-                bp->link_params.req_duplex[cfg_idx] = DUPLEX_FULL;
-                bp->port.advertising[cfg_idx] |= (ADVERTISED_Autoneg |
+                bp->link_params.req_duplex[cfg_idx] = cmd->duplex;
+                bp->port.advertising[cfg_idx] = (ADVERTISED_Autoneg |
                                          cmd->advertising);
+                if (cmd->advertising) {
+
+                        bp->link_params.speed_cap_mask[cfg_idx] = 0;
+                        if (cmd->advertising & ADVERTISED_10baseT_Half) {
+                                bp->link_params.speed_cap_mask[cfg_idx] |=
+                                PORT_HW_CFG_SPEED_CAPABILITY_D0_10M_HALF;
+                        }
+                        if (cmd->advertising & ADVERTISED_10baseT_Full)
+                                bp->link_params.speed_cap_mask[cfg_idx] |=
+                                PORT_HW_CFG_SPEED_CAPABILITY_D0_10M_FULL;
 
+                        if (cmd->advertising & ADVERTISED_100baseT_Full)
+                                bp->link_params.speed_cap_mask[cfg_idx] |=
+                                PORT_HW_CFG_SPEED_CAPABILITY_D0_100M_FULL;
+
+                        if (cmd->advertising & ADVERTISED_100baseT_Half) {
+                                bp->link_params.speed_cap_mask[cfg_idx] |=
+                                     PORT_HW_CFG_SPEED_CAPABILITY_D0_100M_HALF;
+                        }
+                        if (cmd->advertising & ADVERTISED_1000baseT_Half) {
+                                bp->link_params.speed_cap_mask[cfg_idx] |=
+                                        PORT_HW_CFG_SPEED_CAPABILITY_D0_1G;
+                        }
+                        if (cmd->advertising & (ADVERTISED_1000baseT_Full |
+                                                ADVERTISED_1000baseKX_Full))
+                                bp->link_params.speed_cap_mask[cfg_idx] |=
+                                        PORT_HW_CFG_SPEED_CAPABILITY_D0_1G;
+
+                        if (cmd->advertising & (ADVERTISED_10000baseT_Full |
+                                                ADVERTISED_10000baseKX4_Full |
+                                                ADVERTISED_10000baseKR_Full))
+                                bp->link_params.speed_cap_mask[cfg_idx] |=
+                                        PORT_HW_CFG_SPEED_CAPABILITY_D0_10G;
+                }
         } else { /* forced speed */
                 /* advertise the requested speed and duplex if supported */
                 switch (speed) {
@@ -1310,10 +1347,7 @@ static void bnx2x_get_ringparam(struct net_device *dev,
         if (bp->rx_ring_size)
                 ering->rx_pending = bp->rx_ring_size;
         else
-                if (bp->state == BNX2X_STATE_OPEN && bp->num_queues)
-                        ering->rx_pending = MAX_RX_AVAIL/bp->num_queues;
-                else
-                        ering->rx_pending = MAX_RX_AVAIL;
+                ering->rx_pending = MAX_RX_AVAIL;
 
         ering->rx_mini_pending = 0;
         ering->rx_jumbo_pending = 0;
diff --git a/drivers/net/bnx2x/bnx2x_link.c b/drivers/net/bnx2x/bnx2x_link.c
index d45b1555a602..ba15bdc5a1a9 100644
--- a/drivers/net/bnx2x/bnx2x_link.c
+++ b/drivers/net/bnx2x/bnx2x_link.c
@@ -778,9 +778,9 @@ static int bnx2x_ets_e3b0_set_cos_bw(struct bnx2x *bp,
 {
         u32 nig_reg_adress_crd_weight = 0;
         u32 pbf_reg_adress_crd_weight = 0;
-        /* Calculate and set BW for this COS*/
-        const u32 cos_bw_nig = (bw * min_w_val_nig) / total_bw;
-        const u32 cos_bw_pbf = (bw * min_w_val_pbf) / total_bw;
+        /* Calculate and set BW for this COS - use 1 instead of 0 for BW */
+        const u32 cos_bw_nig = ((bw ? bw : 1) * min_w_val_nig) / total_bw;
+        const u32 cos_bw_pbf = ((bw ? bw : 1) * min_w_val_pbf) / total_bw;
 
         switch (cos_entry) {
         case 0:
@@ -852,18 +852,12 @@ static int bnx2x_ets_e3b0_get_total_bw(
         /* Calculate total BW requested */
         for (cos_idx = 0; cos_idx < ets_params->num_of_cos; cos_idx++) {
                 if (bnx2x_cos_state_bw == ets_params->cos[cos_idx].state) {
-
-                        if (0 == ets_params->cos[cos_idx].params.bw_params.bw) {
-                                DP(NETIF_MSG_LINK, "bnx2x_ets_E3B0_config BW"
-                                                   "was set to 0\n");
-                        return -EINVAL;
+                        *total_bw +=
+                                ets_params->cos[cos_idx].params.bw_params.bw;
                 }
-                *total_bw +=
-                    ets_params->cos[cos_idx].params.bw_params.bw;
-            }
         }
 
-        /*Check taotl BW is valid */
+        /* Check total BW is valid */
         if ((100 != *total_bw) || (0 == *total_bw)) {
                 if (0 == *total_bw) {
                         DP(NETIF_MSG_LINK, "bnx2x_ets_E3B0_config toatl BW"
@@ -1726,7 +1720,7 @@ static int bnx2x_xmac_enable(struct link_params *params,
 
         /* Check loopback mode */
         if (lb)
-                val |= XMAC_CTRL_REG_CORE_LOCAL_LPBK;
+                val |= XMAC_CTRL_REG_LINE_LOCAL_LPBK;
         REG_WR(bp, xmac_base + XMAC_REG_CTRL, val);
         bnx2x_set_xumac_nig(params,
                             ((vars->flow_ctrl & BNX2X_FLOW_CTRL_TX) != 0), 1);
@@ -3630,6 +3624,12 @@ static void bnx2x_warpcore_enable_AN_KR(struct bnx2x_phy *phy,
         bnx2x_cl45_write(bp, phy, MDIO_AN_DEVAD,
                          MDIO_WC_REG_AN_IEEE1BLK_AN_ADVERTISEMENT1, val16);
 
+        /* Advertised and set FEC (Forward Error Correction) */
+        bnx2x_cl45_write(bp, phy, MDIO_AN_DEVAD,
+                         MDIO_WC_REG_AN_IEEE1BLK_AN_ADVERTISEMENT2,
+                         (MDIO_WC_REG_AN_IEEE1BLK_AN_ADV2_FEC_ABILITY |
+                          MDIO_WC_REG_AN_IEEE1BLK_AN_ADV2_FEC_REQ));
+
         /* Enable CL37 BAM */
         if (REG_RD(bp, params->shmem_base +
                    offsetof(struct shmem_region, dev_info.
@@ -5924,7 +5924,7 @@ int bnx2x_set_led(struct link_params *params,
                                         (tmp | EMAC_LED_OVERRIDE));
                                 /*
                                  * return here without enabling traffic
-                                 * LED blink andsetting rate in ON mode.
+                                 * LED blink and setting rate in ON mode.
                                  * In oper mode, enabling LED blink
                                  * and setting rate is needed.
                                  */
@@ -5936,7 +5936,11 @@ int bnx2x_set_led(struct link_params *params,
                          * This is a work-around for HW issue found when link
                          * is up in CL73
                          */
-                        REG_WR(bp, NIG_REG_LED_10G_P0 + port*4, 1);
+                        if ((!CHIP_IS_E3(bp)) ||
+                            (CHIP_IS_E3(bp) &&
+                             mode == LED_MODE_ON))
+                                REG_WR(bp, NIG_REG_LED_10G_P0 + port*4, 1);
+
                         if (CHIP_IS_E1x(bp) ||
                             CHIP_IS_E2(bp) ||
                             (mode == LED_MODE_ON))
@@ -10638,8 +10642,7 @@ static struct bnx2x_phy phy_warpcore = {
         .type           = PORT_HW_CFG_XGXS_EXT_PHY_TYPE_DIRECT,
         .addr           = 0xff,
         .def_md_devad   = 0,
-        .flags          = (FLAGS_HW_LOCK_REQUIRED |
-                           FLAGS_TX_ERROR_CHECK),
+        .flags          = FLAGS_HW_LOCK_REQUIRED,
         .rx_preemphasis = {0xffff, 0xffff, 0xffff, 0xffff},
         .tx_preemphasis = {0xffff, 0xffff, 0xffff, 0xffff},
         .mdio_ctrl      = 0,
@@ -10765,8 +10768,7 @@ static struct bnx2x_phy phy_8706 = {
         .type           = PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8706,
         .addr           = 0xff,
         .def_md_devad   = 0,
-        .flags          = (FLAGS_INIT_XGXS_FIRST |
-                           FLAGS_TX_ERROR_CHECK),
+        .flags          = FLAGS_INIT_XGXS_FIRST,
         .rx_preemphasis = {0xffff, 0xffff, 0xffff, 0xffff},
         .tx_preemphasis = {0xffff, 0xffff, 0xffff, 0xffff},
         .mdio_ctrl      = 0,
@@ -10797,8 +10799,7 @@ static struct bnx2x_phy phy_8726 = {
         .addr           = 0xff,
         .def_md_devad   = 0,
         .flags          = (FLAGS_HW_LOCK_REQUIRED |
-                           FLAGS_INIT_XGXS_FIRST |
-                           FLAGS_TX_ERROR_CHECK),
+                           FLAGS_INIT_XGXS_FIRST),
         .rx_preemphasis = {0xffff, 0xffff, 0xffff, 0xffff},
         .tx_preemphasis = {0xffff, 0xffff, 0xffff, 0xffff},
         .mdio_ctrl      = 0,
@@ -10829,8 +10830,7 @@ static struct bnx2x_phy phy_8727 = {
         .type           = PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8727,
         .addr           = 0xff,
         .def_md_devad   = 0,
-        .flags          = (FLAGS_FAN_FAILURE_DET_REQ |
-                           FLAGS_TX_ERROR_CHECK),
+        .flags          = FLAGS_FAN_FAILURE_DET_REQ,
         .rx_preemphasis = {0xffff, 0xffff, 0xffff, 0xffff},
         .tx_preemphasis = {0xffff, 0xffff, 0xffff, 0xffff},
         .mdio_ctrl      = 0,
diff --git a/drivers/net/bnx2x/bnx2x_main.c b/drivers/net/bnx2x/bnx2x_main.c
index f74582a22c68..15f800085bb2 100644
--- a/drivers/net/bnx2x/bnx2x_main.c
+++ b/drivers/net/bnx2x/bnx2x_main.c
@@ -407,8 +407,8 @@ u32 bnx2x_dmae_opcode(struct bnx2x *bp, u8 src_type, u8 dst_type,
         opcode |= (DMAE_CMD_SRC_RESET | DMAE_CMD_DST_RESET);
 
         opcode |= (BP_PORT(bp) ? DMAE_CMD_PORT_1 : DMAE_CMD_PORT_0);
-        opcode |= ((BP_E1HVN(bp) << DMAE_CMD_E1HVN_SHIFT) |
-                   (BP_E1HVN(bp) << DMAE_COMMAND_DST_VN_SHIFT));
+        opcode |= ((BP_VN(bp) << DMAE_CMD_E1HVN_SHIFT) |
+                   (BP_VN(bp) << DMAE_COMMAND_DST_VN_SHIFT));
         opcode |= (DMAE_COM_SET_ERR << DMAE_COMMAND_ERR_POLICY_SHIFT);
 
 #ifdef __BIG_ENDIAN
@@ -1419,7 +1419,7 @@ static void bnx2x_hc_int_enable(struct bnx2x *bp)
         if (!CHIP_IS_E1(bp)) {
                 /* init leading/trailing edge */
                 if (IS_MF(bp)) {
-                        val = (0xee0f | (1 << (BP_E1HVN(bp) + 4)));
+                        val = (0xee0f | (1 << (BP_VN(bp) + 4)));
                         if (bp->port.pmf)
                                 /* enable nig and gpio3 attention */
                                 val |= 0x1100;
@@ -1471,7 +1471,7 @@ static void bnx2x_igu_int_enable(struct bnx2x *bp)
 
         /* init leading/trailing edge */
         if (IS_MF(bp)) {
-                val = (0xee0f | (1 << (BP_E1HVN(bp) + 4)));
+                val = (0xee0f | (1 << (BP_VN(bp) + 4)));
                 if (bp->port.pmf)
                         /* enable nig and gpio3 attention */
                         val |= 0x1100;
@@ -2287,7 +2287,7 @@ static void bnx2x_calc_vn_weight_sum(struct bnx2x *bp)
         int vn;
 
         bp->vn_weight_sum = 0;
-        for (vn = VN_0; vn < E1HVN_MAX; vn++) {
+        for (vn = VN_0; vn < BP_MAX_VN_NUM(bp); vn++) {
                 u32 vn_cfg = bp->mf_config[vn];
                 u32 vn_min_rate = ((vn_cfg & FUNC_MF_CFG_MIN_BW_MASK) >>
                                    FUNC_MF_CFG_MIN_BW_SHIFT) * 100;
@@ -2320,12 +2320,18 @@ static void bnx2x_calc_vn_weight_sum(struct bnx2x *bp)
                                         CMNG_FLAGS_PER_PORT_FAIRNESS_VN;
 }
 
+/* returns func by VN for current port */
+static inline int func_by_vn(struct bnx2x *bp, int vn)
+{
+        return 2 * vn + BP_PORT(bp);
+}
+
 static void bnx2x_init_vn_minmax(struct bnx2x *bp, int vn)
 {
         struct rate_shaping_vars_per_vn m_rs_vn;
         struct fairness_vars_per_vn m_fair_vn;
         u32 vn_cfg = bp->mf_config[vn];
-        int func = 2*vn + BP_PORT(bp);
+        int func = func_by_vn(bp, vn);
         u16 vn_min_rate, vn_max_rate;
         int i;
 
@@ -2422,7 +2428,7 @@ void bnx2x_read_mf_cfg(struct bnx2x *bp)
          *
          *      and there are 2 functions per port
          */
-        for (vn = VN_0; vn < E1HVN_MAX; vn++) {
+        for (vn = VN_0; vn < BP_MAX_VN_NUM(bp); vn++) {
                 int /*abs*/func = n * (2 * vn + BP_PORT(bp)) + BP_PATH(bp);
 
                 if (func >= E1H_FUNC_MAX)
@@ -2454,7 +2460,7 @@ static void bnx2x_cmng_fns_init(struct bnx2x *bp, u8 read_cfg, u8 cmng_type)
 
                 /* calculate and set min-max rate for each vn */
                 if (bp->port.pmf)
-                        for (vn = VN_0; vn < E1HVN_MAX; vn++)
+                        for (vn = VN_0; vn < BP_MAX_VN_NUM(bp); vn++)
                                 bnx2x_init_vn_minmax(bp, vn);
 
                 /* always enable rate shaping and fairness */
@@ -2473,16 +2479,15 @@ static void bnx2x_cmng_fns_init(struct bnx2x *bp, u8 read_cfg, u8 cmng_type)
 
 static inline void bnx2x_link_sync_notify(struct bnx2x *bp)
 {
-        int port = BP_PORT(bp);
         int func;
         int vn;
 
         /* Set the attention towards other drivers on the same port */
-        for (vn = VN_0; vn < E1HVN_MAX; vn++) {
-                if (vn == BP_E1HVN(bp))
+        for (vn = VN_0; vn < BP_MAX_VN_NUM(bp); vn++) {
+                if (vn == BP_VN(bp))
                         continue;
 
-                func = ((vn << 1) | port);
+                func = func_by_vn(bp, vn);
                 REG_WR(bp, MISC_REG_AEU_GENERAL_ATTN_0 +
                        (LINK_SYNC_ATTENTION_BIT_FUNC_0 + func)*4, 1);
         }
@@ -2577,7 +2582,7 @@ static void bnx2x_pmf_update(struct bnx2x *bp)
         bnx2x_dcbx_pmf_update(bp);
 
         /* enable nig attention */
-        val = (0xff0f | (1 << (BP_E1HVN(bp) + 4)));
+        val = (0xff0f | (1 << (BP_VN(bp) + 4)));
         if (bp->common.int_block == INT_BLOCK_HC) {
                 REG_WR(bp, HC_REG_TRAILING_EDGE_0 + port*8, val);
                 REG_WR(bp, HC_REG_LEADING_EDGE_0 + port*8, val);
@@ -2756,8 +2761,14 @@ static void bnx2x_pf_rx_q_prep(struct bnx2x *bp,
         u16 tpa_agg_size = 0;
 
         if (!fp->disable_tpa) {
-                pause->sge_th_hi = 250;
-                pause->sge_th_lo = 150;
+                pause->sge_th_lo = SGE_TH_LO(bp);
+                pause->sge_th_hi = SGE_TH_HI(bp);
+
+                /* validate SGE ring has enough to cross high threshold */
+                WARN_ON(bp->dropless_fc &&
+                                pause->sge_th_hi + FW_PREFETCH_CNT >
+                                MAX_RX_SGE_CNT * NUM_RX_SGE_PAGES);
+
                 tpa_agg_size = min_t(u32,
                         (min_t(u32, 8, MAX_SKB_FRAGS) *
                         SGE_PAGE_SIZE * PAGES_PER_SGE), 0xffff);
@@ -2771,10 +2782,21 @@ static void bnx2x_pf_rx_q_prep(struct bnx2x *bp,
 
         /* pause - not for e1 */
         if (!CHIP_IS_E1(bp)) {
-                pause->bd_th_hi = 350;
-                pause->bd_th_lo = 250;
-                pause->rcq_th_hi = 350;
-                pause->rcq_th_lo = 250;
+                pause->bd_th_lo = BD_TH_LO(bp);
+                pause->bd_th_hi = BD_TH_HI(bp);
+
+                pause->rcq_th_lo = RCQ_TH_LO(bp);
+                pause->rcq_th_hi = RCQ_TH_HI(bp);
+                /*
+                 * validate that rings have enough entries to cross
+                 * high thresholds
+                 */
+                WARN_ON(bp->dropless_fc &&
+                                pause->bd_th_hi + FW_PREFETCH_CNT >
+                                bp->rx_ring_size);
+                WARN_ON(bp->dropless_fc &&
+                                pause->rcq_th_hi + FW_PREFETCH_CNT >
+                                NUM_RCQ_RINGS * MAX_RCQ_DESC_CNT);
 
                 pause->pri_map = 1;
         }
@@ -2802,9 +2824,7 @@ static void bnx2x_pf_rx_q_prep(struct bnx2x *bp,
          * For PF Clients it should be the maximum avaliable number.
          * VF driver(s) may want to define it to a smaller value.
          */
-        rxq_init->max_tpa_queues =
-                (CHIP_IS_E1(bp) ? ETH_MAX_AGGREGATION_QUEUES_E1 :
-                ETH_MAX_AGGREGATION_QUEUES_E1H_E2);
+        rxq_init->max_tpa_queues = MAX_AGG_QS(bp);
 
         rxq_init->cache_line_log = BNX2X_RX_ALIGN_SHIFT;
         rxq_init->fw_sb_id = fp->fw_sb_id;
@@ -4808,6 +4828,37 @@ void bnx2x_setup_ndsb_state_machine(struct hc_status_block_sm *hc_sm,
         hc_sm->time_to_expire = 0xFFFFFFFF;
 }
 
+
+/* allocates state machine ids. */
+static inline
+void bnx2x_map_sb_state_machines(struct hc_index_data *index_data)
+{
+        /* zero out state machine indices */
+        /* rx indices */
+        index_data[HC_INDEX_ETH_RX_CQ_CONS].flags &= ~HC_INDEX_DATA_SM_ID;
+
+        /* tx indices */
+        index_data[HC_INDEX_OOO_TX_CQ_CONS].flags &= ~HC_INDEX_DATA_SM_ID;
+        index_data[HC_INDEX_ETH_TX_CQ_CONS_COS0].flags &= ~HC_INDEX_DATA_SM_ID;
+        index_data[HC_INDEX_ETH_TX_CQ_CONS_COS1].flags &= ~HC_INDEX_DATA_SM_ID;
+        index_data[HC_INDEX_ETH_TX_CQ_CONS_COS2].flags &= ~HC_INDEX_DATA_SM_ID;
+
+        /* map indices */
+        /* rx indices */
+        index_data[HC_INDEX_ETH_RX_CQ_CONS].flags |=
+                SM_RX_ID << HC_INDEX_DATA_SM_ID_SHIFT;
+
+        /* tx indices */
+        index_data[HC_INDEX_OOO_TX_CQ_CONS].flags |=
+                SM_TX_ID << HC_INDEX_DATA_SM_ID_SHIFT;
+        index_data[HC_INDEX_ETH_TX_CQ_CONS_COS0].flags |=
+                SM_TX_ID << HC_INDEX_DATA_SM_ID_SHIFT;
+        index_data[HC_INDEX_ETH_TX_CQ_CONS_COS1].flags |=
+                SM_TX_ID << HC_INDEX_DATA_SM_ID_SHIFT;
+        index_data[HC_INDEX_ETH_TX_CQ_CONS_COS2].flags |=
+                SM_TX_ID << HC_INDEX_DATA_SM_ID_SHIFT;
+}
+
 static void bnx2x_init_sb(struct bnx2x *bp, dma_addr_t mapping, int vfid,
                           u8 vf_valid, int fw_sb_id, int igu_sb_id)
 {
@@ -4839,6 +4890,7 @@ static void bnx2x_init_sb(struct bnx2x *bp, dma_addr_t mapping, int vfid,
                 hc_sm_p = sb_data_e2.common.state_machine;
                 sb_data_p = (u32 *)&sb_data_e2;
                 data_size = sizeof(struct hc_status_block_data_e2)/sizeof(u32);
+                bnx2x_map_sb_state_machines(sb_data_e2.index_data);
         } else {
                 memset(&sb_data_e1x, 0,
                        sizeof(struct hc_status_block_data_e1x));
@@ -4853,6 +4905,7 @@ static void bnx2x_init_sb(struct bnx2x *bp, dma_addr_t mapping, int vfid,
                 hc_sm_p = sb_data_e1x.common.state_machine;
                 sb_data_p = (u32 *)&sb_data_e1x;
                 data_size = sizeof(struct hc_status_block_data_e1x)/sizeof(u32);
+                bnx2x_map_sb_state_machines(sb_data_e1x.index_data);
         }
 
         bnx2x_setup_ndsb_state_machine(&hc_sm_p[SM_RX_ID],
@@ -4890,7 +4943,7 @@ static void bnx2x_init_def_sb(struct bnx2x *bp)
         int igu_seg_id;
         int port = BP_PORT(bp);
         int func = BP_FUNC(bp);
-        int reg_offset;
+        int reg_offset, reg_offset_en5;
         u64 section;
         int index;
         struct hc_sp_status_block_data sp_sb_data;
@@ -4913,6 +4966,8 @@ static void bnx2x_init_def_sb(struct bnx2x *bp)
 
         reg_offset = (port ? MISC_REG_AEU_ENABLE1_FUNC_1_OUT_0 :
                              MISC_REG_AEU_ENABLE1_FUNC_0_OUT_0);
+        reg_offset_en5 = (port ? MISC_REG_AEU_ENABLE5_FUNC_1_OUT_0 :
+                                 MISC_REG_AEU_ENABLE5_FUNC_0_OUT_0);
         for (index = 0; index < MAX_DYNAMIC_ATTN_GRPS; index++) {
                 int sindex;
                 /* take care of sig[0]..sig[4] */
@@ -4927,7 +4982,7 @@ static void bnx2x_init_def_sb(struct bnx2x *bp)
                          * and not 16 between the different groups
                          */
                         bp->attn_group[index].sig[4] = REG_RD(bp,
-                                        reg_offset + 0x10 + 0x4*index);
+                                        reg_offset_en5 + 0x4*index);
                 else
                         bp->attn_group[index].sig[4] = 0;
         }
@@ -5802,7 +5857,7 @@ static int bnx2x_init_hw_common(struct bnx2x *bp)
          * take the UNDI lock to protect undi_unload flow from accessing
          * registers while we're resetting the chip
          */
-        bnx2x_acquire_hw_lock(bp, HW_LOCK_RESOURCE_UNDI);
+        bnx2x_acquire_hw_lock(bp, HW_LOCK_RESOURCE_RESET);
 
         bnx2x_reset_common(bp);
         REG_WR(bp, GRCBASE_MISC + MISC_REGISTERS_RESET_REG_1_SET, 0xffffffff);
@@ -5814,7 +5869,7 @@ static int bnx2x_init_hw_common(struct bnx2x *bp)
         }
         REG_WR(bp, GRCBASE_MISC + MISC_REGISTERS_RESET_REG_2_SET, val);
 
-        bnx2x_release_hw_lock(bp, HW_LOCK_RESOURCE_UNDI);
+        bnx2x_release_hw_lock(bp, HW_LOCK_RESOURCE_RESET);
 
         bnx2x_init_block(bp, BLOCK_MISC, PHASE_COMMON);
 
@@ -6671,12 +6726,16 @@ static int bnx2x_init_hw_func(struct bnx2x *bp)
                         if (CHIP_MODE_IS_4_PORT(bp))
                                 dsb_idx = BP_FUNC(bp);
                         else
-                                dsb_idx = BP_E1HVN(bp);
+                                dsb_idx = BP_VN(bp);
 
                         prod_offset = (CHIP_INT_MODE_IS_BC(bp) ?
                                        IGU_BC_BASE_DSB_PROD + dsb_idx :
                                        IGU_NORM_BASE_DSB_PROD + dsb_idx);
 
+                        /*
+                         * igu prods come in chunks of E1HVN_MAX (4) -
+                         * does not matters what is the current chip mode
+                         */
                         for (i = 0; i < (num_segs * E1HVN_MAX);
                              i += E1HVN_MAX) {
                                 addr = IGU_REG_PROD_CONS_MEMORY +
@@ -7568,9 +7627,12 @@ u32 bnx2x_send_unload_req(struct bnx2x *bp, int unload_mode)
                 u32 emac_base = port ? GRCBASE_EMAC1 : GRCBASE_EMAC0;
                 u8 *mac_addr = bp->dev->dev_addr;
                 u32 val;
+                u16 pmc;
+
                 /* The mac address is written to entries 1-4 to
-                   preserve entry 0 which is used by the PMF */
-                u8 entry = (BP_E1HVN(bp) + 1)*8;
+                 * preserve entry 0 which is used by the PMF
+                 */
+                u8 entry = (BP_VN(bp) + 1)*8;
 
                 val = (mac_addr[0] << 8) | mac_addr[1];
                 EMAC_WR(bp, EMAC_REG_EMAC_MAC_MATCH + entry, val);
@@ -7579,6 +7641,11 @@ u32 bnx2x_send_unload_req(struct bnx2x *bp, int unload_mode)
                       (mac_addr[4] << 8) | mac_addr[5];
                 EMAC_WR(bp, EMAC_REG_EMAC_MAC_MATCH + entry + 4, val);
 
+                /* Enable the PME and clear the status */
+                pci_read_config_word(bp->pdev, bp->pm_cap + PCI_PM_CTRL, &pmc);
+                pmc |= PCI_PM_CTRL_PME_ENABLE | PCI_PM_CTRL_PME_STATUS;
+                pci_write_config_word(bp->pdev, bp->pm_cap + PCI_PM_CTRL, pmc);
+
                 reset_code = DRV_MSG_CODE_UNLOAD_REQ_WOL_EN;
 
         } else
@@ -8546,10 +8613,12 @@ static void __devinit bnx2x_undi_unload(struct bnx2x *bp)
         /* Check if there is any driver already loaded */
         val = REG_RD(bp, MISC_REG_UNPREPARED);
         if (val == 0x1) {
-                /* Check if it is the UNDI driver
+
+                bnx2x_acquire_hw_lock(bp, HW_LOCK_RESOURCE_RESET);
+                /*
+                 * Check if it is the UNDI driver
                  * UNDI driver initializes CID offset for normal bell to 0x7
                  */
-                bnx2x_acquire_hw_lock(bp, HW_LOCK_RESOURCE_UNDI);
                 val = REG_RD(bp, DORQ_REG_NORM_CID_OFST);
                 if (val == 0x7) {
                         u32 reset_code = DRV_MSG_CODE_UNLOAD_REQ_WOL_DIS;
@@ -8587,9 +8656,6 @@ static void __devinit bnx2x_undi_unload(struct bnx2x *bp)
                                 bnx2x_fw_command(bp, reset_code, 0);
                         }
 
-                        /* now it's safe to release the lock */
-                        bnx2x_release_hw_lock(bp, HW_LOCK_RESOURCE_UNDI);
-
                         bnx2x_undi_int_disable(bp);
                         port = BP_PORT(bp);
 
@@ -8639,8 +8705,10 @@ static void __devinit bnx2x_undi_unload(struct bnx2x *bp)
                         bp->fw_seq =
                               (SHMEM_RD(bp, func_mb[bp->pf_num].drv_mb_header) &
                                 DRV_MSG_SEQ_NUMBER_MASK);
-                } else
-                        bnx2x_release_hw_lock(bp, HW_LOCK_RESOURCE_UNDI);
+                }
+
+                /* now it's safe to release the lock */
+                bnx2x_release_hw_lock(bp, HW_LOCK_RESOURCE_RESET);
         }
 }
 
@@ -8777,13 +8845,13 @@ static void __devinit bnx2x_get_common_hwinfo(struct bnx2x *bp)
 static void __devinit bnx2x_get_igu_cam_info(struct bnx2x *bp)
 {
         int pfid = BP_FUNC(bp);
-        int vn = BP_E1HVN(bp);
         int igu_sb_id;
         u32 val;
         u8 fid, igu_sb_cnt = 0;
 
         bp->igu_base_sb = 0xff;
         if (CHIP_INT_MODE_IS_BC(bp)) {
+                int vn = BP_VN(bp);
                 igu_sb_cnt = bp->igu_sb_cnt;
                 bp->igu_base_sb = (CHIP_MODE_IS_4_PORT(bp) ? pfid : vn) *
                         FP_SB_MAX_E1x;
@@ -9416,6 +9484,10 @@ static int __devinit bnx2x_get_hwinfo(struct bnx2x *bp)
                 bp->igu_base_sb = 0;
         } else {
                 bp->common.int_block = INT_BLOCK_IGU;
+
+                /* do not allow device reset during IGU info preocessing */
+                bnx2x_acquire_hw_lock(bp, HW_LOCK_RESOURCE_RESET);
+
                 val = REG_RD(bp, IGU_REG_BLOCK_CONFIGURATION);
 
                 if (val & IGU_BLOCK_CONFIGURATION_REG_BACKWARD_COMP_EN) {
@@ -9447,6 +9519,7 @@ static int __devinit bnx2x_get_hwinfo(struct bnx2x *bp)
 
                 bnx2x_get_igu_cam_info(bp);
 
+                bnx2x_release_hw_lock(bp, HW_LOCK_RESOURCE_RESET);
         }
 
         /*
@@ -9473,7 +9546,7 @@ static int __devinit bnx2x_get_hwinfo(struct bnx2x *bp)
 
         bp->mf_ov = 0;
         bp->mf_mode = 0;
-        vn = BP_E1HVN(bp);
+        vn = BP_VN(bp);
 
         if (!CHIP_IS_E1(bp) && !BP_NOMCP(bp)) {
                 BNX2X_DEV_INFO("shmem2base 0x%x, size %d, mfcfg offset %d\n",
@@ -9593,13 +9666,6 @@ static int __devinit bnx2x_get_hwinfo(struct bnx2x *bp)
         /* port info */
         bnx2x_get_port_hwinfo(bp);
 
-        if (!BP_NOMCP(bp)) {
-                bp->fw_seq =
-                        (SHMEM_RD(bp, func_mb[BP_FW_MB_IDX(bp)].drv_mb_header) &
-                         DRV_MSG_SEQ_NUMBER_MASK);
-                BNX2X_DEV_INFO("fw_seq 0x%08x\n", bp->fw_seq);
-        }
-
         /* Get MAC addresses */
         bnx2x_get_mac_hwinfo(bp);
 
@@ -9765,6 +9831,14 @@ static int __devinit bnx2x_init_bp(struct bnx2x *bp)
         if (!BP_NOMCP(bp))
                 bnx2x_undi_unload(bp);
 
+        /* init fw_seq after undi_unload! */
+        if (!BP_NOMCP(bp)) {
+                bp->fw_seq =
+                        (SHMEM_RD(bp, func_mb[BP_FW_MB_IDX(bp)].drv_mb_header) &
+                         DRV_MSG_SEQ_NUMBER_MASK);
+                BNX2X_DEV_INFO("fw_seq 0x%08x\n", bp->fw_seq);
+        }
+
         if (CHIP_REV_IS_FPGA(bp))
                 dev_err(&bp->pdev->dev, "FPGA detected\n");
 
@@ -10259,17 +10333,21 @@ static int __devinit bnx2x_init_dev(struct pci_dev *pdev,
         /* clean indirect addresses */
         pci_write_config_dword(bp->pdev, PCICFG_GRC_ADDRESS,
                                PCICFG_VENDOR_ID_OFFSET);
-        /* Clean the following indirect addresses for all functions since it
+        /*
+         * Clean the following indirect addresses for all functions since it
          * is not used by the driver.
          */
         REG_WR(bp, PXP2_REG_PGL_ADDR_88_F0, 0);
         REG_WR(bp, PXP2_REG_PGL_ADDR_8C_F0, 0);
         REG_WR(bp, PXP2_REG_PGL_ADDR_90_F0, 0);
         REG_WR(bp, PXP2_REG_PGL_ADDR_94_F0, 0);
-        REG_WR(bp, PXP2_REG_PGL_ADDR_88_F1, 0);
-        REG_WR(bp, PXP2_REG_PGL_ADDR_8C_F1, 0);
-        REG_WR(bp, PXP2_REG_PGL_ADDR_90_F1, 0);
-        REG_WR(bp, PXP2_REG_PGL_ADDR_94_F1, 0);
+
+        if (CHIP_IS_E1x(bp)) {
+                REG_WR(bp, PXP2_REG_PGL_ADDR_88_F1, 0);
+                REG_WR(bp, PXP2_REG_PGL_ADDR_8C_F1, 0);
+                REG_WR(bp, PXP2_REG_PGL_ADDR_90_F1, 0);
+                REG_WR(bp, PXP2_REG_PGL_ADDR_94_F1, 0);
+        }
 
         /*
          * Enable internal target-read (in case we are probed after PF FLR).
diff --git a/drivers/net/bnx2x/bnx2x_reg.h b/drivers/net/bnx2x/bnx2x_reg.h
index 40266c14e6dc..fc7bd0f23c0b 100644
--- a/drivers/net/bnx2x/bnx2x_reg.h
+++ b/drivers/net/bnx2x/bnx2x_reg.h
@@ -1384,6 +1384,18 @@
    Latched ump_tx_parity; [31] MCP Latched scpad_parity; */
 #define MISC_REG_AEU_ENABLE4_PXP_0                               0xa108
 #define MISC_REG_AEU_ENABLE4_PXP_1                               0xa1a8
+/* [RW 32] fifth 32b for enabling the output for function 0 output0. Mapped
+ * as follows: [0] PGLUE config_space; [1] PGLUE misc_flr; [2] PGLUE B RBC
+ * attention [3] PGLUE B RBC parity; [4] ATC attention; [5] ATC parity; [6]
+ * mstat0 attention; [7] mstat0 parity; [8] mstat1 attention; [9] mstat1
+ * parity; [31-10] Reserved; */
+#define MISC_REG_AEU_ENABLE5_FUNC_0_OUT_0                        0xa688
+/* [RW 32] Fifth 32b for enabling the output for function 1 output0. Mapped
+ * as follows: [0] PGLUE config_space; [1] PGLUE misc_flr; [2] PGLUE B RBC
+ * attention [3] PGLUE B RBC parity; [4] ATC attention; [5] ATC parity; [6]
+ * mstat0 attention; [7] mstat0 parity; [8] mstat1 attention; [9] mstat1
+ * parity; [31-10] Reserved; */
+#define MISC_REG_AEU_ENABLE5_FUNC_1_OUT_0                        0xa6b0
 /* [RW 1] set/clr general attention 0; this will set/clr bit 94 in the aeu
    128 bit vector */
 #define MISC_REG_AEU_GENERAL_ATTN_0                              0xa000
@@ -5320,7 +5332,7 @@
 #define XCM_REG_XX_OVFL_EVNT_ID                                  0x20058
 #define XMAC_CLEAR_RX_LSS_STATUS_REG_CLEAR_LOCAL_FAULT_STATUS    (0x1<<0)
 #define XMAC_CLEAR_RX_LSS_STATUS_REG_CLEAR_REMOTE_FAULT_STATUS   (0x1<<1)
-#define XMAC_CTRL_REG_CORE_LOCAL_LPBK                            (0x1<<3)
+#define XMAC_CTRL_REG_LINE_LOCAL_LPBK                            (0x1<<2)
 #define XMAC_CTRL_REG_RX_EN                                      (0x1<<1)
 #define XMAC_CTRL_REG_SOFT_RESET                                 (0x1<<6)
 #define XMAC_CTRL_REG_TX_EN                                      (0x1<<0)
@@ -5766,7 +5778,7 @@
 #define HW_LOCK_RESOURCE_RECOVERY_LEADER_0                       8
 #define HW_LOCK_RESOURCE_RECOVERY_LEADER_1                       9
 #define HW_LOCK_RESOURCE_SPIO                                    2
-#define HW_LOCK_RESOURCE_UNDI                                    5
+#define HW_LOCK_RESOURCE_RESET                                   5
 #define AEU_INPUTS_ATTN_BITS_ATC_HW_INTERRUPT                    (0x1<<4)
 #define AEU_INPUTS_ATTN_BITS_ATC_PARITY_ERROR                    (0x1<<5)
 #define AEU_INPUTS_ATTN_BITS_BRB_PARITY_ERROR                    (0x1<<18)
@@ -6853,6 +6865,9 @@ Theotherbitsarereservedandshouldbezero*/
 #define MDIO_WC_REG_IEEE0BLK_AUTONEGNP                  0x7
 #define MDIO_WC_REG_AN_IEEE1BLK_AN_ADVERTISEMENT0       0x10
 #define MDIO_WC_REG_AN_IEEE1BLK_AN_ADVERTISEMENT1       0x11
+#define MDIO_WC_REG_AN_IEEE1BLK_AN_ADVERTISEMENT2       0x12
+#define MDIO_WC_REG_AN_IEEE1BLK_AN_ADV2_FEC_ABILITY     0x4000
+#define MDIO_WC_REG_AN_IEEE1BLK_AN_ADV2_FEC_REQ         0x8000
 #define MDIO_WC_REG_PMD_IEEE9BLK_TENGBASE_KR_PMD_CONTROL_REGISTER_150  0x96
 #define MDIO_WC_REG_XGXSBLK0_XGXSCONTROL                0x8000
 #define MDIO_WC_REG_XGXSBLK0_MISCCONTROL1               0x800e
diff --git a/drivers/net/bnx2x/bnx2x_stats.c b/drivers/net/bnx2x/bnx2x_stats.c
index 771f6803b238..9908f2bbcf73 100644
--- a/drivers/net/bnx2x/bnx2x_stats.c
+++ b/drivers/net/bnx2x/bnx2x_stats.c
@@ -710,7 +710,8 @@ static int bnx2x_hw_stats_update(struct bnx2x *bp)
                 break;
 
         case MAC_TYPE_NONE: /* unreached */
-                BNX2X_ERR("stats updated by DMAE but no MAC active\n");
+                DP(BNX2X_MSG_STATS,
+                   "stats updated by DMAE but no MAC active\n");
                 return -1;
 
         default: /* unreached */
@@ -1391,7 +1392,7 @@ static void bnx2x_port_stats_base_init(struct bnx2x *bp)
 
 static void bnx2x_func_stats_base_init(struct bnx2x *bp)
 {
-        int vn, vn_max = IS_MF(bp) ? E1HVN_MAX : E1VN_MAX;
+        int vn, vn_max = IS_MF(bp) ? BP_MAX_VN_NUM(bp) : E1VN_MAX;
         u32 func_stx;
 
         /* sanity */
@@ -1404,7 +1405,7 @@ static void bnx2x_func_stats_base_init(struct bnx2x *bp)
         func_stx = bp->func_stx;
 
         for (vn = VN_0; vn < vn_max; vn++) {
-                int mb_idx = CHIP_IS_E1x(bp) ? 2*vn + BP_PORT(bp) : vn;
+                int mb_idx = BP_FW_MB_IDX_VN(bp, vn);
 
                 bp->func_stx = SHMEM_RD(bp, func_mb[mb_idx].fw_mb_param);
                 bnx2x_func_stats_init(bp);
diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c
index a047eb973e3b..47b928ed08f8 100644
--- a/drivers/net/bonding/bond_3ad.c
+++ b/drivers/net/bonding/bond_3ad.c
@@ -2168,7 +2168,8 @@ void bond_3ad_state_machine_handler(struct work_struct *work)
         }
 
 re_arm:
-        queue_delayed_work(bond->wq, &bond->ad_work, ad_delta_in_ticks);
+        if (!bond->kill_timers)
+                queue_delayed_work(bond->wq, &bond->ad_work, ad_delta_in_ticks);
 out:
         read_unlock(&bond->lock);
 }
diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c
index 7f8b20a34ee3..d4fbd2e62616 100644
--- a/drivers/net/bonding/bond_alb.c
+++ b/drivers/net/bonding/bond_alb.c
@@ -1440,7 +1440,8 @@ void bond_alb_monitor(struct work_struct *work)
         }
 
 re_arm:
-        queue_delayed_work(bond->wq, &bond->alb_work, alb_delta_in_ticks);
+        if (!bond->kill_timers)
+                queue_delayed_work(bond->wq, &bond->alb_work, alb_delta_in_ticks);
 out:
         read_unlock(&bond->lock);
 }
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 38a83acd502e..6d79b78cfc75 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -777,6 +777,9 @@ static void bond_resend_igmp_join_requests(struct bonding *bond)
 
         read_lock(&bond->lock);
 
+        if (bond->kill_timers)
+                goto out;
+
         /* rejoin all groups on bond device */
         __bond_resend_igmp_join_requests(bond->dev);
 
@@ -790,9 +793,9 @@ static void bond_resend_igmp_join_requests(struct bonding *bond)
                         __bond_resend_igmp_join_requests(vlan_dev);
         }
 
-        if (--bond->igmp_retrans > 0)
+        if ((--bond->igmp_retrans > 0) && !bond->kill_timers)
                 queue_delayed_work(bond->wq, &bond->mcast_work, HZ/5);
-
+out:
         read_unlock(&bond->lock);
 }
 
@@ -2538,7 +2541,7 @@ void bond_mii_monitor(struct work_struct *work)
         }
 
 re_arm:
-        if (bond->params.miimon)
+        if (bond->params.miimon && !bond->kill_timers)
                 queue_delayed_work(bond->wq, &bond->mii_work,
                                    msecs_to_jiffies(bond->params.miimon));
 out:
@@ -2886,7 +2889,7 @@ void bond_loadbalance_arp_mon(struct work_struct *work)
         }
 
 re_arm:
-        if (bond->params.arp_interval)
+        if (bond->params.arp_interval && !bond->kill_timers)
                 queue_delayed_work(bond->wq, &bond->arp_work, delta_in_ticks);
 out:
         read_unlock(&bond->lock);
@@ -3154,7 +3157,7 @@ void bond_activebackup_arp_mon(struct work_struct *work)
         bond_ab_arp_probe(bond);
 
 re_arm:
-        if (bond->params.arp_interval)
+        if (bond->params.arp_interval && !bond->kill_timers)
                 queue_delayed_work(bond->wq, &bond->arp_work, delta_in_ticks);
 out:
         read_unlock(&bond->lock);
@@ -3419,9 +3422,27 @@ static int bond_xmit_hash_policy_l2(struct sk_buff *skb, int count)
 static int bond_open(struct net_device *bond_dev)
 {
         struct bonding *bond = netdev_priv(bond_dev);
+        struct slave *slave;
+        int i;
 
         bond->kill_timers = 0;
 
+        /* reset slave->backup and slave->inactive */
+        read_lock(&bond->lock);
+        if (bond->slave_cnt > 0) {
+                read_lock(&bond->curr_slave_lock);
+                bond_for_each_slave(bond, slave, i) {
+                        if ((bond->params.mode == BOND_MODE_ACTIVEBACKUP)
+                                && (slave != bond->curr_active_slave)) {
+                                bond_set_slave_inactive_flags(slave);
+                        } else {
+                                bond_set_slave_active_flags(slave);
+                        }
+                }
+                read_unlock(&bond->curr_slave_lock);
+        }
+        read_unlock(&bond->lock);
+
         INIT_DELAYED_WORK(&bond->mcast_work, bond_resend_igmp_join_requests_delayed);
 
         if (bond_is_lb(bond)) {
diff --git a/drivers/net/can/sja1000/plx_pci.c b/drivers/net/can/sja1000/plx_pci.c
index 231385b8e08f..c7f3d4ea1167 100644
--- a/drivers/net/can/sja1000/plx_pci.c
+++ b/drivers/net/can/sja1000/plx_pci.c
@@ -408,7 +408,7 @@ static void plx_pci_del_card(struct pci_dev *pdev)
         struct sja1000_priv *priv;
         int i = 0;
 
-        for (i = 0; i < card->channels; i++) {
+        for (i = 0; i < PLX_PCI_MAX_CHAN; i++) {
                 dev = card->net_dev[i];
                 if (!dev)
                         continue;
@@ -536,7 +536,6 @@ static int __devinit plx_pci_add_card(struct pci_dev *pdev,
                         if (err) {
                                 dev_err(&pdev->dev, "Registering device failed "
                                         "(err=%d)\n", err);
-                                free_sja1000dev(dev);
                                 goto failure_cleanup;
                         }
 
@@ -549,6 +548,7 @@ static int __devinit plx_pci_add_card(struct pci_dev *pdev,
                         dev_err(&pdev->dev, "Channel #%d not detected\n",
                                 i + 1);
                         free_sja1000dev(dev);
+                        card->net_dev[i] = NULL;
                 }
         }
 
diff --git a/drivers/net/can/ti_hecc.c b/drivers/net/can/ti_hecc.c
index f7bbde9eb2cb..2adc294f512a 100644
--- a/drivers/net/can/ti_hecc.c
+++ b/drivers/net/can/ti_hecc.c
@@ -46,6 +46,7 @@
 #include <linux/skbuff.h>
 #include <linux/platform_device.h>
 #include <linux/clk.h>
+#include <linux/io.h>
 
 #include <linux/can/dev.h>
 #include <linux/can/error.h>
@@ -503,9 +504,9 @@ static netdev_tx_t ti_hecc_xmit(struct sk_buff *skb, struct net_device *ndev)
         spin_unlock_irqrestore(&priv->mbx_lock, flags);
 
         /* Prepare mailbox for transmission */
+        data = cf->can_dlc | (get_tx_head_prio(priv) << 8);
         if (cf->can_id & CAN_RTR_FLAG) /* Remote transmission request */
                 data |= HECC_CANMCF_RTR;
-        data |= get_tx_head_prio(priv) << 8;
         hecc_write_mbx(priv, mbxno, HECC_CANMCF, data);
 
         if (cf->can_id & CAN_EFF_FLAG) /* Extended frame format */
@@ -923,6 +924,7 @@ static int ti_hecc_probe(struct platform_device *pdev)
         priv->can.do_get_state = ti_hecc_get_state;
         priv->can.ctrlmode_supported = CAN_CTRLMODE_3_SAMPLES;
 
+        spin_lock_init(&priv->mbx_lock);
         ndev->irq = irq->start;
         ndev->flags |= IFF_ECHO;
         platform_set_drvdata(pdev, ndev);
diff --git a/drivers/net/cassini.c b/drivers/net/cassini.c
index 646c86bcc545..fdb7a1756409 100644
--- a/drivers/net/cassini.c
+++ b/drivers/net/cassini.c
@@ -2452,14 +2452,13 @@ static irqreturn_t cas_interruptN(int irq, void *dev_id)
         struct net_device *dev = dev_id;
         struct cas *cp = netdev_priv(dev);
         unsigned long flags;
-        int ring;
+        int ring = (irq == cp->pci_irq_INTC) ? 2 : 3;
         u32 status = readl(cp->regs + REG_PLUS_INTRN_STATUS(ring));
 
         /* check for shared irq */
         if (status == 0)
                 return IRQ_NONE;
 
-        ring = (irq == cp->pci_irq_INTC) ? 2 : 3;
         spin_lock_irqsave(&cp->lock, flags);
         if (status & INTR_RX_DONE_ALT) { /* handle rx separately */
 #ifdef USE_NAPI
diff --git a/drivers/net/cxgb3/cxgb3_offload.c b/drivers/net/cxgb3/cxgb3_offload.c
index 805076c54f1b..da5a5d9b8aff 100644
--- a/drivers/net/cxgb3/cxgb3_offload.c
+++ b/drivers/net/cxgb3/cxgb3_offload.c
@@ -1146,12 +1146,14 @@ static void cxgb_redirect(struct dst_entry *old, struct dst_entry *new)
                 if (te && te->ctx && te->client && te->client->redirect) {
                         update_tcb = te->client->redirect(te->ctx, old, new, e);
                         if (update_tcb) {
+                                rcu_read_lock();
                                 l2t_hold(L2DATA(tdev), e);
+                                rcu_read_unlock();
                                 set_l2t_ix(tdev, tid, e);
                         }
                 }
         }
-        l2t_release(L2DATA(tdev), e);
+        l2t_release(tdev, e);
 }
 
 /*
@@ -1264,7 +1266,7 @@ int cxgb3_offload_activate(struct adapter *adapter)
                 goto out_free;
 
         err = -ENOMEM;
-        L2DATA(dev) = t3_init_l2t(l2t_capacity);
+        RCU_INIT_POINTER(dev->l2opt, t3_init_l2t(l2t_capacity));
         if (!L2DATA(dev))
                 goto out_free;
 
@@ -1298,16 +1300,24 @@ int cxgb3_offload_activate(struct adapter *adapter)
 
 out_free_l2t:
         t3_free_l2t(L2DATA(dev));
-        L2DATA(dev) = NULL;
+        rcu_assign_pointer(dev->l2opt, NULL);
 out_free:
         kfree(t);
         return err;
 }
 
+static void clean_l2_data(struct rcu_head *head)
+{
+        struct l2t_data *d = container_of(head, struct l2t_data, rcu_head);
+        t3_free_l2t(d);
+}
+
+
 void cxgb3_offload_deactivate(struct adapter *adapter)
 {
         struct t3cdev *tdev = &adapter->tdev;
         struct t3c_data *t = T3C_DATA(tdev);
+        struct l2t_data *d;
 
         remove_adapter(adapter);
         if (list_empty(&adapter_list))
@@ -1315,8 +1325,11 @@ void cxgb3_offload_deactivate(struct adapter *adapter)
 
         free_tid_maps(&t->tid_maps);
         T3C_DATA(tdev) = NULL;
-        t3_free_l2t(L2DATA(tdev));
-        L2DATA(tdev) = NULL;
+        rcu_read_lock();
+        d = L2DATA(tdev);
+        rcu_read_unlock();
+        rcu_assign_pointer(tdev->l2opt, NULL);
+        call_rcu(&d->rcu_head, clean_l2_data);
         if (t->nofail_skb)
                 kfree_skb(t->nofail_skb);
         kfree(t);
diff --git a/drivers/net/cxgb3/l2t.c b/drivers/net/cxgb3/l2t.c
index f452c4003253..41540978a173 100644
--- a/drivers/net/cxgb3/l2t.c
+++ b/drivers/net/cxgb3/l2t.c
@@ -300,14 +300,21 @@ static inline void reuse_entry(struct l2t_entry *e, struct neighbour *neigh)
 struct l2t_entry *t3_l2t_get(struct t3cdev *cdev, struct neighbour *neigh,
                              struct net_device *dev)
 {
-        struct l2t_entry *e;
-        struct l2t_data *d = L2DATA(cdev);
+        struct l2t_entry *e = NULL;
+        struct l2t_data *d;
+        int hash;
         u32 addr = *(u32 *) neigh->primary_key;
         int ifidx = neigh->dev->ifindex;
-        int hash = arp_hash(addr, ifidx, d);
         struct port_info *p = netdev_priv(dev);
         int smt_idx = p->port_id;
 
+        rcu_read_lock();
+        d = L2DATA(cdev);
+        if (!d)
+                goto done_rcu;
+
+        hash = arp_hash(addr, ifidx, d);
+
         write_lock_bh(&d->lock);
         for (e = d->l2tab[hash].first; e; e = e->next)
                 if (e->addr == addr && e->ifindex == ifidx &&
@@ -338,6 +345,8 @@ struct l2t_entry *t3_l2t_get(struct t3cdev *cdev, struct neighbour *neigh,
         }
 done:
         write_unlock_bh(&d->lock);
+done_rcu:
+        rcu_read_unlock();
         return e;
 }
 
diff --git a/drivers/net/cxgb3/l2t.h b/drivers/net/cxgb3/l2t.h
index 7a12d52ed4fc..c5f54796e2cb 100644
--- a/drivers/net/cxgb3/l2t.h
+++ b/drivers/net/cxgb3/l2t.h
@@ -76,6 +76,7 @@ struct l2t_data {
         atomic_t nfree;         /* number of free entries */
         rwlock_t lock;
         struct l2t_entry l2tab[0];
+        struct rcu_head rcu_head;       /* to handle rcu cleanup */
 };
 
 typedef void (*arp_failure_handler_func)(struct t3cdev * dev,
@@ -99,7 +100,7 @@ static inline void set_arp_failure_handler(struct sk_buff *skb,
 /*
  * Getting to the L2 data from an offload device.
  */
-#define L2DATA(dev) ((dev)->l2opt)
+#define L2DATA(cdev) (rcu_dereference((cdev)->l2opt))
 
 #define W_TCB_L2T_IX    0
 #define S_TCB_L2T_IX    7
@@ -126,15 +127,22 @@ static inline int l2t_send(struct t3cdev *dev, struct sk_buff *skb,
         return t3_l2t_send_slow(dev, skb, e);
 }
 
-static inline void l2t_release(struct l2t_data *d, struct l2t_entry *e)
+static inline void l2t_release(struct t3cdev *t, struct l2t_entry *e)
 {
-        if (atomic_dec_and_test(&e->refcnt))
+        struct l2t_data *d;
+
+        rcu_read_lock();
+        d = L2DATA(t);
+
+        if (atomic_dec_and_test(&e->refcnt) && d)
                 t3_l2e_free(d, e);
+
+        rcu_read_unlock();
 }
 
 static inline void l2t_hold(struct l2t_data *d, struct l2t_entry *e)
 {
-        if (atomic_add_return(1, &e->refcnt) == 1)      /* 0 -> 1 transition */
+        if (d && atomic_add_return(1, &e->refcnt) == 1) /* 0 -> 1 transition */
                 atomic_dec(&d->nfree);
 }
 
diff --git a/drivers/net/cxgb4/cxgb4_main.c b/drivers/net/cxgb4/cxgb4_main.c
index c9957b7f17b5..b4efa292fd6f 100644
--- a/drivers/net/cxgb4/cxgb4_main.c
+++ b/drivers/net/cxgb4/cxgb4_main.c
@@ -3712,6 +3712,9 @@ static int __devinit init_one(struct pci_dev *pdev,
                 setup_debugfs(adapter);
         }
 
+        /* PCIe EEH recovery on powerpc platforms needs fundamental reset */
+        pdev->needs_freset = 1;
+
         if (is_offload(adapter))
                 attach_ulds(adapter);
 
diff --git a/drivers/net/e1000/e1000_hw.c b/drivers/net/e1000/e1000_hw.c
index 8545c7aa93eb..a5a89ecb6f36 100644
--- a/drivers/net/e1000/e1000_hw.c
+++ b/drivers/net/e1000/e1000_hw.c
@@ -4026,6 +4026,12 @@ s32 e1000_validate_eeprom_checksum(struct e1000_hw *hw)
                 checksum += eeprom_data;
         }
 
+#ifdef CONFIG_PARISC
+        /* This is a signature and not a checksum on HP c8000 */
+        if ((hw->subsystem_vendor_id == 0x103C) && (eeprom_data == 0x16d6))
+                return E1000_SUCCESS;
+
+#endif
         if (checksum == (u16) EEPROM_SUM)
                 return E1000_SUCCESS;
         else {
diff --git a/drivers/net/e1000e/e1000.h b/drivers/net/e1000e/e1000.h
index 35916f485028..8533ad7f3559 100644
--- a/drivers/net/e1000e/e1000.h
+++ b/drivers/net/e1000e/e1000.h
@@ -155,6 +155,9 @@ struct e1000_info;
 #define HV_M_STATUS_SPEED_1000            0x0200
 #define HV_M_STATUS_LINK_UP               0x0040
 
+#define E1000_ICH_FWSM_PCIM2PCI         0x01000000 /* ME PCIm-to-PCI active */
+#define E1000_ICH_FWSM_PCIM2PCI_COUNT   2000
+
 /* Time to wait before putting the device into D3 if there's no link (in ms). */
 #define LINK_TIMEOUT            100
 
@@ -454,6 +457,7 @@ struct e1000_info {
 #define FLAG2_DISABLE_AIM                 (1 << 8)
 #define FLAG2_CHECK_PHY_HANG              (1 << 9)
 #define FLAG2_NO_DISABLE_RX               (1 << 10)
+#define FLAG2_PCIM2PCI_ARBITER_WA         (1 << 11)
 
 #define E1000_RX_DESC_PS(R, i)      \
         (&(((union e1000_rx_desc_packet_split *)((R).desc))[i]))
diff --git a/drivers/net/e1000e/ich8lan.c b/drivers/net/e1000e/ich8lan.c
index 4e36978b8fd8..54add27c8f76 100644
--- a/drivers/net/e1000e/ich8lan.c
+++ b/drivers/net/e1000e/ich8lan.c
@@ -137,8 +137,9 @@
 #define HV_PM_CTRL              PHY_REG(770, 17)
 
 /* PHY Low Power Idle Control */
-#define I82579_LPI_CTRL                 PHY_REG(772, 20)
-#define I82579_LPI_CTRL_ENABLE_MASK     0x6000
+#define I82579_LPI_CTRL                         PHY_REG(772, 20)
+#define I82579_LPI_CTRL_ENABLE_MASK             0x6000
+#define I82579_LPI_CTRL_FORCE_PLL_LOCK_COUNT    0x80
 
 /* EMI Registers */
 #define I82579_EMI_ADDR         0x10
@@ -163,6 +164,11 @@
 #define HV_KMRN_MODE_CTRL      PHY_REG(769, 16)
 #define HV_KMRN_MDIO_SLOW      0x0400
 
+/* KMRN FIFO Control and Status */
+#define HV_KMRN_FIFO_CTRLSTA                  PHY_REG(770, 16)
+#define HV_KMRN_FIFO_CTRLSTA_PREAMBLE_MASK    0x7000
+#define HV_KMRN_FIFO_CTRLSTA_PREAMBLE_SHIFT   12
+
 /* ICH GbE Flash Hardware Sequencing Flash Status Register bit breakdown */
 /* Offset 04h HSFSTS */
 union ich8_hws_flash_status {
@@ -657,6 +663,7 @@ static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw)
         struct e1000_mac_info *mac = &hw->mac;
         s32 ret_val;
         bool link;
+        u16 phy_reg;
 
         /*
          * We only want to go out to the PHY registers to see if Auto-Neg
@@ -689,16 +696,35 @@ static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw)
 
         mac->get_link_status = false;
 
-        if (hw->phy.type == e1000_phy_82578) {
-                ret_val = e1000_link_stall_workaround_hv(hw);
-                if (ret_val)
-                        goto out;
-        }
-
-        if (hw->mac.type == e1000_pch2lan) {
+        switch (hw->mac.type) {
+        case e1000_pch2lan:
                 ret_val = e1000_k1_workaround_lv(hw);
                 if (ret_val)
                         goto out;
+                /* fall-thru */
+        case e1000_pchlan:
+                if (hw->phy.type == e1000_phy_82578) {
+                        ret_val = e1000_link_stall_workaround_hv(hw);
+                        if (ret_val)
+                                goto out;
+                }
+
+                /*
+                 * Workaround for PCHx parts in half-duplex:
+                 * Set the number of preambles removed from the packet
+                 * when it is passed from the PHY to the MAC to prevent
+                 * the MAC from misinterpreting the packet type.
+                 */
+                e1e_rphy(hw, HV_KMRN_FIFO_CTRLSTA, &phy_reg);
+                phy_reg &= ~HV_KMRN_FIFO_CTRLSTA_PREAMBLE_MASK;
+
+                if ((er32(STATUS) & E1000_STATUS_FD) != E1000_STATUS_FD)
+                        phy_reg |= (1 << HV_KMRN_FIFO_CTRLSTA_PREAMBLE_SHIFT);
+
+                e1e_wphy(hw, HV_KMRN_FIFO_CTRLSTA, phy_reg);
+                break;
+        default:
+                break;
         }
 
         /*
@@ -788,6 +814,11 @@ static s32 e1000_get_variants_ich8lan(struct e1000_adapter *adapter)
             (adapter->hw.phy.type == e1000_phy_igp_3))
                 adapter->flags |= FLAG_LSC_GIG_SPEED_DROP;
 
+        /* Enable workaround for 82579 w/ ME enabled */
+        if ((adapter->hw.mac.type == e1000_pch2lan) &&
+            (er32(FWSM) & E1000_ICH_FWSM_FW_VALID))
+                adapter->flags2 |= FLAG2_PCIM2PCI_ARBITER_WA;
+
         /* Disable EEE by default until IEEE802.3az spec is finalized */
         if (adapter->flags2 & FLAG2_HAS_EEE)
                 adapter->hw.dev_spec.ich8lan.eee_disable = true;
@@ -1355,7 +1386,7 @@ static s32 e1000_hv_phy_workarounds_ich8lan(struct e1000_hw *hw)
                         return ret_val;
 
                 /* Preamble tuning for SSC */
-                ret_val = e1e_wphy(hw, PHY_REG(770, 16), 0xA204);
+                ret_val = e1e_wphy(hw, HV_KMRN_FIFO_CTRLSTA, 0xA204);
                 if (ret_val)
                         return ret_val;
         }
@@ -1645,6 +1676,7 @@ static s32 e1000_k1_workaround_lv(struct e1000_hw *hw)
         s32 ret_val = 0;
         u16 status_reg = 0;
         u32 mac_reg;
+        u16 phy_reg;
 
         if (hw->mac.type != e1000_pch2lan)
                 goto out;
@@ -1659,12 +1691,19 @@ static s32 e1000_k1_workaround_lv(struct e1000_hw *hw)
                 mac_reg = er32(FEXTNVM4);
                 mac_reg &= ~E1000_FEXTNVM4_BEACON_DURATION_MASK;
 
-                if (status_reg & HV_M_STATUS_SPEED_1000)
+                ret_val = e1e_rphy(hw, I82579_LPI_CTRL, &phy_reg);
+                if (ret_val)
+                        goto out;
+
+                if (status_reg & HV_M_STATUS_SPEED_1000) {
                         mac_reg |= E1000_FEXTNVM4_BEACON_DURATION_8USEC;
-                else
+                        phy_reg &= ~I82579_LPI_CTRL_FORCE_PLL_LOCK_COUNT;
+                } else {
                         mac_reg |= E1000_FEXTNVM4_BEACON_DURATION_16USEC;
-
+                        phy_reg |= I82579_LPI_CTRL_FORCE_PLL_LOCK_COUNT;
+                }
                 ew32(FEXTNVM4, mac_reg);
+                ret_val = e1e_wphy(hw, I82579_LPI_CTRL, phy_reg);
         }
 
 out:
diff --git a/drivers/net/e1000e/netdev.c b/drivers/net/e1000e/netdev.c
index 362f70382cdd..2198e615f241 100644
--- a/drivers/net/e1000e/netdev.c
+++ b/drivers/net/e1000e/netdev.c
@@ -519,6 +519,63 @@ static void e1000_rx_checksum(struct e1000_adapter *adapter, u32 status_err,
 }
 
 /**
+ * e1000e_update_tail_wa - helper function for e1000e_update_[rt]dt_wa()
+ * @hw: pointer to the HW structure
+ * @tail: address of tail descriptor register
+ * @i: value to write to tail descriptor register
+ *
+ * When updating the tail register, the ME could be accessing Host CSR
+ * registers at the same time.  Normally, this is handled in h/w by an
+ * arbiter but on some parts there is a bug that acknowledges Host accesses
+ * later than it should which could result in the descriptor register to
+ * have an incorrect value.  Workaround this by checking the FWSM register
+ * which has bit 24 set while ME is accessing Host CSR registers, wait
+ * if it is set and try again a number of times.
+ **/
+static inline s32 e1000e_update_tail_wa(struct e1000_hw *hw, u8 __iomem * tail,
+                                        unsigned int i)
+{
+        unsigned int j = 0;
+
+        while ((j++ < E1000_ICH_FWSM_PCIM2PCI_COUNT) &&
+               (er32(FWSM) & E1000_ICH_FWSM_PCIM2PCI))
+                udelay(50);
+
+        writel(i, tail);
+
+        if ((j == E1000_ICH_FWSM_PCIM2PCI_COUNT) && (i != readl(tail)))
+                return E1000_ERR_SWFW_SYNC;
+
+        return 0;
+}
+
+static void e1000e_update_rdt_wa(struct e1000_adapter *adapter, unsigned int i)
+{
+        u8 __iomem *tail = (adapter->hw.hw_addr + adapter->rx_ring->tail);
+        struct e1000_hw *hw = &adapter->hw;
+
+        if (e1000e_update_tail_wa(hw, tail, i)) {
+                u32 rctl = er32(RCTL);
+                ew32(RCTL, rctl & ~E1000_RCTL_EN);
+                e_err("ME firmware caused invalid RDT - resetting\n");
+                schedule_work(&adapter->reset_task);
+        }
+}
+
+static void e1000e_update_tdt_wa(struct e1000_adapter *adapter, unsigned int i)
+{
+        u8 __iomem *tail = (adapter->hw.hw_addr + adapter->tx_ring->tail);
+        struct e1000_hw *hw = &adapter->hw;
+
+        if (e1000e_update_tail_wa(hw, tail, i)) {
+                u32 tctl = er32(TCTL);
+                ew32(TCTL, tctl & ~E1000_TCTL_EN);
+                e_err("ME firmware caused invalid TDT - resetting\n");
+                schedule_work(&adapter->reset_task);
+        }
+}
+
+/**
  * e1000_alloc_rx_buffers - Replace used receive buffers; legacy & extended
  * @adapter: address of board private structure
  **/
@@ -573,7 +630,10 @@ map_skb:
                          * such as IA-64).
                          */
                         wmb();
-                        writel(i, adapter->hw.hw_addr + rx_ring->tail);
+                        if (adapter->flags2 & FLAG2_PCIM2PCI_ARBITER_WA)
+                                e1000e_update_rdt_wa(adapter, i);
+                        else
+                                writel(i, adapter->hw.hw_addr + rx_ring->tail);
                 }
                 i++;
                 if (i == rx_ring->count)
@@ -673,7 +733,11 @@ static void e1000_alloc_rx_buffers_ps(struct e1000_adapter *adapter,
                          * such as IA-64).
                          */
                         wmb();
-                        writel(i << 1, adapter->hw.hw_addr + rx_ring->tail);
+                        if (adapter->flags2 & FLAG2_PCIM2PCI_ARBITER_WA)
+                                e1000e_update_rdt_wa(adapter, i << 1);
+                        else
+                                writel(i << 1,
+                                       adapter->hw.hw_addr + rx_ring->tail);
                 }
 
                 i++;
@@ -756,7 +820,10 @@ check_page:
                  * applicable for weak-ordered memory model archs,
                  * such as IA-64). */
                 wmb();
-                writel(i, adapter->hw.hw_addr + rx_ring->tail);
+                if (adapter->flags2 & FLAG2_PCIM2PCI_ARBITER_WA)
+                        e1000e_update_rdt_wa(adapter, i);
+                else
+                        writel(i, adapter->hw.hw_addr + rx_ring->tail);
         }
 }
 
@@ -4689,7 +4756,12 @@ static void e1000_tx_queue(struct e1000_adapter *adapter,
         wmb();
 
         tx_ring->next_to_use = i;
-        writel(i, adapter->hw.hw_addr + tx_ring->tail);
+
+        if (adapter->flags2 & FLAG2_PCIM2PCI_ARBITER_WA)
+                e1000e_update_tdt_wa(adapter, i);
+        else
+                writel(i, adapter->hw.hw_addr + tx_ring->tail);
+
         /*
          * we need this if more than one processor can write to our tail
          * at a time, it synchronizes IO on IA64/Altix systems
diff --git a/drivers/net/forcedeth.c b/drivers/net/forcedeth.c
index e55df308a3af..6d5fbd4d4256 100644
--- a/drivers/net/forcedeth.c
+++ b/drivers/net/forcedeth.c
@@ -5615,7 +5615,8 @@ static int __devinit nv_probe(struct pci_dev *pci_dev, const struct pci_device_i
                 goto out_error;
         }
 
-        nv_vlan_mode(dev, dev->features);
+        if (id->driver_data & DEV_HAS_VLAN)
+                nv_vlan_mode(dev, dev->features);
 
         netif_carrier_off(dev);
 
diff --git a/drivers/net/gianfar.c b/drivers/net/gianfar.c
index 2659daad783d..31d5c574e5a9 100644
--- a/drivers/net/gianfar.c
+++ b/drivers/net/gianfar.c
@@ -2710,8 +2710,13 @@ static int gfar_process_frame(struct net_device *dev, struct sk_buff *skb,
         /* Tell the skb what kind of packet this is */
         skb->protocol = eth_type_trans(skb, dev);
 
-        /* Set vlan tag */
-        if (fcb->flags & RXFCB_VLN)
+        /*
+         * There's need to check for NETIF_F_HW_VLAN_RX here.
+         * Even if vlan rx accel is disabled, on some chips
+         * RXFCB_VLN is pseudo randomly set.
+         */
+        if (dev->features & NETIF_F_HW_VLAN_RX &&
+            fcb->flags & RXFCB_VLN)
                 __vlan_hwaccel_put_tag(skb, fcb->vlctl);
 
         /* Send the packet up the stack */
diff --git a/drivers/net/gianfar_ethtool.c b/drivers/net/gianfar_ethtool.c
index 6e350692d118..0caf3c323ec0 100644
--- a/drivers/net/gianfar_ethtool.c
+++ b/drivers/net/gianfar_ethtool.c
@@ -686,10 +686,21 @@ static int gfar_ethflow_to_filer_table(struct gfar_private *priv, u64 ethflow, u
 {
         unsigned int last_rule_idx = priv->cur_filer_idx;
         unsigned int cmp_rqfpr;
-        unsigned int local_rqfpr[MAX_FILER_IDX + 1];
-        unsigned int local_rqfcr[MAX_FILER_IDX + 1];
+        unsigned int *local_rqfpr;
+        unsigned int *local_rqfcr;
         int i = 0x0, k = 0x0;
         int j = MAX_FILER_IDX, l = 0x0;
+        int ret = 1;
+
+        local_rqfpr = kmalloc(sizeof(unsigned int) * (MAX_FILER_IDX + 1),
+                GFP_KERNEL);
+        local_rqfcr = kmalloc(sizeof(unsigned int) * (MAX_FILER_IDX + 1),
+                GFP_KERNEL);
+        if (!local_rqfpr || !local_rqfcr) {
+                pr_err("Out of memory\n");
+                ret = 0;
+                goto err;
+        }
 
         switch (class) {
         case TCP_V4_FLOW:
@@ -706,7 +717,8 @@ static int gfar_ethflow_to_filer_table(struct gfar_private *priv, u64 ethflow, u
                 break;
         default:
                 pr_err("Right now this class is not supported\n");
-                return 0;
+                ret = 0;
+                goto err;
         }
 
         for (i = 0; i < MAX_FILER_IDX + 1; i++) {
@@ -721,7 +733,8 @@ static int gfar_ethflow_to_filer_table(struct gfar_private *priv, u64 ethflow, u
 
         if (i == MAX_FILER_IDX + 1) {
                 pr_err("No parse rule found, can't create hash rules\n");
-                return 0;
+                ret = 0;
+                goto err;
         }
 
         /* If a match was found, then it begins the starting of a cluster rule
@@ -765,7 +778,10 @@ static int gfar_ethflow_to_filer_table(struct gfar_private *priv, u64 ethflow, u
                 priv->cur_filer_idx = priv->cur_filer_idx - 1;
         }
 
-        return 1;
+err:
+        kfree(local_rqfcr);
+        kfree(local_rqfpr);
+        return ret;
 }
 
 static int gfar_set_hash_opts(struct gfar_private *priv, struct ethtool_rxnfc *cmd)
@@ -1653,10 +1669,10 @@ static int gfar_get_cls_all(struct gfar_private *priv,
         u32 i = 0;
 
         list_for_each_entry(comp, &priv->rx_list.list, list) {
-                if (i <= cmd->rule_cnt) {
-                        rule_locs[i] = comp->fs.location;
-                        i++;
-                }
+                if (i == cmd->rule_cnt)
+                        return -EMSGSIZE;
+                rule_locs[i] = comp->fs.location;
+                i++;
         }
 
         cmd->data = MAX_FILER_IDX;
diff --git a/drivers/net/greth.c b/drivers/net/greth.c
index 16ce45c11934..52a39000c42c 100644
--- a/drivers/net/greth.c
+++ b/drivers/net/greth.c
@@ -428,6 +428,7 @@ greth_start_xmit(struct sk_buff *skb, struct net_device *dev)
         dma_sync_single_for_device(greth->dev, dma_addr, skb->len, DMA_TO_DEVICE);
 
         status = GRETH_BD_EN | GRETH_BD_IE | (skb->len & GRETH_BD_LEN);
+        greth->tx_bufs_length[greth->tx_next] = skb->len & GRETH_BD_LEN;
 
         /* Wrap around descriptor ring */
         if (greth->tx_next == GRETH_TXBD_NUM_MASK) {
@@ -490,7 +491,8 @@ greth_start_xmit_gbit(struct sk_buff *skb, struct net_device *dev)
         if (nr_frags != 0)
                 status = GRETH_TXBD_MORE;
 
-        status |= GRETH_TXBD_CSALL;
+        if (skb->ip_summed == CHECKSUM_PARTIAL)
+                status |= GRETH_TXBD_CSALL;
         status |= skb_headlen(skb) & GRETH_BD_LEN;
         if (greth->tx_next == GRETH_TXBD_NUM_MASK)
                 status |= GRETH_BD_WR;
@@ -513,7 +515,9 @@ greth_start_xmit_gbit(struct sk_buff *skb, struct net_device *dev)
                 greth->tx_skbuff[curr_tx] = NULL;
                 bdp = greth->tx_bd_base + curr_tx;
 
-                status = GRETH_TXBD_CSALL | GRETH_BD_EN;
+                status = GRETH_BD_EN;
+                if (skb->ip_summed == CHECKSUM_PARTIAL)
+                        status |= GRETH_TXBD_CSALL;
                 status |= frag->size & GRETH_BD_LEN;
 
                 /* Wrap around descriptor ring */
@@ -641,6 +645,7 @@ static void greth_clean_tx(struct net_device *dev)
                                 dev->stats.tx_fifo_errors++;
                 }
                 dev->stats.tx_packets++;
+                dev->stats.tx_bytes += greth->tx_bufs_length[greth->tx_last];
                 greth->tx_last = NEXT_TX(greth->tx_last);
                 greth->tx_free++;
         }
@@ -695,6 +700,7 @@ static void greth_clean_tx_gbit(struct net_device *dev)
                 greth->tx_skbuff[greth->tx_last] = NULL;
 
                 greth_update_tx_stats(dev, stat);
+                dev->stats.tx_bytes += skb->len;
 
                 bdp = greth->tx_bd_base + greth->tx_last;
 
@@ -796,6 +802,7 @@ static int greth_rx(struct net_device *dev, int limit)
                                 memcpy(skb_put(skb, pkt_len), phys_to_virt(dma_addr), pkt_len);
 
                                 skb->protocol = eth_type_trans(skb, dev);
+                                dev->stats.rx_bytes += pkt_len;
                                 dev->stats.rx_packets++;
                                 netif_receive_skb(skb);
                         }
@@ -910,6 +917,7 @@ static int greth_rx_gbit(struct net_device *dev, int limit)
 
                                 skb->protocol = eth_type_trans(skb, dev);
                                 dev->stats.rx_packets++;
+                                dev->stats.rx_bytes += pkt_len;
                                 netif_receive_skb(skb);
 
                                 greth->rx_skbuff[greth->rx_cur] = newskb;
diff --git a/drivers/net/greth.h b/drivers/net/greth.h
index 9a0040dee4da..232a622a85b7 100644
--- a/drivers/net/greth.h
+++ b/drivers/net/greth.h
@@ -103,6 +103,7 @@ struct greth_private {
 
         unsigned char *tx_bufs[GRETH_TXBD_NUM];
         unsigned char *rx_bufs[GRETH_RXBD_NUM];
+        u16 tx_bufs_length[GRETH_TXBD_NUM];
 
         u16 tx_next;
         u16 tx_last;
diff --git a/drivers/net/ibmveth.c b/drivers/net/ibmveth.c
index ba99af05bf62..d393f1e764ed 100644
--- a/drivers/net/ibmveth.c
+++ b/drivers/net/ibmveth.c
@@ -395,7 +395,7 @@ static inline struct sk_buff *ibmveth_rxq_get_buffer(struct ibmveth_adapter *ada
 }
 
 /* recycle the current buffer on the rx queue */
-static void ibmveth_rxq_recycle_buffer(struct ibmveth_adapter *adapter)
+static int ibmveth_rxq_recycle_buffer(struct ibmveth_adapter *adapter)
 {
         u32 q_index = adapter->rx_queue.index;
         u64 correlator = adapter->rx_queue.queue_addr[q_index].correlator;
@@ -403,6 +403,7 @@ static void ibmveth_rxq_recycle_buffer(struct ibmveth_adapter *adapter)
         unsigned int index = correlator & 0xffffffffUL;
         union ibmveth_buf_desc desc;
         unsigned long lpar_rc;
+        int ret = 1;
 
         BUG_ON(pool >= IBMVETH_NUM_BUFF_POOLS);
         BUG_ON(index >= adapter->rx_buff_pool[pool].size);
@@ -410,7 +411,7 @@ static void ibmveth_rxq_recycle_buffer(struct ibmveth_adapter *adapter)
         if (!adapter->rx_buff_pool[pool].active) {
                 ibmveth_rxq_harvest_buffer(adapter);
                 ibmveth_free_buffer_pool(adapter, &adapter->rx_buff_pool[pool]);
-                return;
+                goto out;
         }
 
         desc.fields.flags_len = IBMVETH_BUF_VALID |
@@ -423,12 +424,16 @@ static void ibmveth_rxq_recycle_buffer(struct ibmveth_adapter *adapter)
                 netdev_dbg(adapter->netdev, "h_add_logical_lan_buffer failed "
                            "during recycle rc=%ld", lpar_rc);
                 ibmveth_remove_buffer_from_pool(adapter, adapter->rx_queue.queue_addr[adapter->rx_queue.index].correlator);
+                ret = 0;
         }
 
         if (++adapter->rx_queue.index == adapter->rx_queue.num_slots) {
                 adapter->rx_queue.index = 0;
                 adapter->rx_queue.toggle = !adapter->rx_queue.toggle;
         }
+
+out:
+        return ret;
 }
 
 static void ibmveth_rxq_harvest_buffer(struct ibmveth_adapter *adapter)
@@ -631,8 +636,8 @@ static int ibmveth_open(struct net_device *netdev)
                 netdev_err(netdev, "unable to request irq 0x%x, rc %d\n",
                            netdev->irq, rc);
                 do {
-                        rc = h_free_logical_lan(adapter->vdev->unit_address);
-                } while (H_IS_LONG_BUSY(rc) || (rc == H_BUSY));
+                        lpar_rc = h_free_logical_lan(adapter->vdev->unit_address);
+                } while (H_IS_LONG_BUSY(lpar_rc) || (lpar_rc == H_BUSY));
 
                 goto err_out;
         }
@@ -752,7 +757,7 @@ static int ibmveth_set_csum_offload(struct net_device *dev, u32 data)
         struct ibmveth_adapter *adapter = netdev_priv(dev);
         unsigned long set_attr, clr_attr, ret_attr;
         unsigned long set_attr6, clr_attr6;
-        long ret, ret6;
+        long ret, ret4, ret6;
         int rc1 = 0, rc2 = 0;
         int restart = 0;
 
@@ -765,6 +770,8 @@ static int ibmveth_set_csum_offload(struct net_device *dev, u32 data)
 
         set_attr = 0;
         clr_attr = 0;
+        set_attr6 = 0;
+        clr_attr6 = 0;
 
         if (data) {
                 set_attr = IBMVETH_ILLAN_IPV4_TCP_CSUM;
@@ -779,16 +786,20 @@ static int ibmveth_set_csum_offload(struct net_device *dev, u32 data)
         if (ret == H_SUCCESS && !(ret_attr & IBMVETH_ILLAN_ACTIVE_TRUNK) &&
             !(ret_attr & IBMVETH_ILLAN_TRUNK_PRI_MASK) &&
             (ret_attr & IBMVETH_ILLAN_PADDED_PKT_CSUM)) {
-                ret = h_illan_attributes(adapter->vdev->unit_address, clr_attr,
+                ret4 = h_illan_attributes(adapter->vdev->unit_address, clr_attr,
                                          set_attr, &ret_attr);
 
-                if (ret != H_SUCCESS) {
+                if (ret4 != H_SUCCESS) {
                         netdev_err(dev, "unable to change IPv4 checksum "
                                         "offload settings. %d rc=%ld\n",
-                                        data, ret);
+                                        data, ret4);
+
+                        h_illan_attributes(adapter->vdev->unit_address,
+                                           set_attr, clr_attr, &ret_attr);
+
+                        if (data == 1)
+                                dev->features &= ~NETIF_F_IP_CSUM;
 
-                        ret = h_illan_attributes(adapter->vdev->unit_address,
-                                                 set_attr, clr_attr, &ret_attr);
                 } else {
                         adapter->fw_ipv4_csum_support = data;
                 }
@@ -799,15 +810,18 @@ static int ibmveth_set_csum_offload(struct net_device *dev, u32 data)
                 if (ret6 != H_SUCCESS) {
                         netdev_err(dev, "unable to change IPv6 checksum "
                                         "offload settings. %d rc=%ld\n",
-                                        data, ret);
+                                        data, ret6);
+
+                        h_illan_attributes(adapter->vdev->unit_address,
+                                           set_attr6, clr_attr6, &ret_attr);
+
+                        if (data == 1)
+                                dev->features &= ~NETIF_F_IPV6_CSUM;
 
-                        ret = h_illan_attributes(adapter->vdev->unit_address,
-                                                 set_attr6, clr_attr6,
-                                                 &ret_attr);
                 } else
                         adapter->fw_ipv6_csum_support = data;
 
-                if (ret != H_SUCCESS || ret6 != H_SUCCESS)
+                if (ret4 == H_SUCCESS || ret6 == H_SUCCESS)
                         adapter->rx_csum = data;
                 else
                         rc1 = -EIO;
@@ -925,6 +939,7 @@ static netdev_tx_t ibmveth_start_xmit(struct sk_buff *skb,
         union ibmveth_buf_desc descs[6];
         int last, i;
         int force_bounce = 0;
+        dma_addr_t dma_addr;
 
         /*
          * veth handles a maximum of 6 segments including the header, so
@@ -989,17 +1004,16 @@ retry_bounce:
         }
 
         /* Map the header */
-        descs[0].fields.address = dma_map_single(&adapter->vdev->dev, skb->data,
-                                                 skb_headlen(skb),
-                                                 DMA_TO_DEVICE);
-        if (dma_mapping_error(&adapter->vdev->dev, descs[0].fields.address))
+        dma_addr = dma_map_single(&adapter->vdev->dev, skb->data,
+                                  skb_headlen(skb), DMA_TO_DEVICE);
+        if (dma_mapping_error(&adapter->vdev->dev, dma_addr))
                 goto map_failed;
 
         descs[0].fields.flags_len = desc_flags | skb_headlen(skb);
+        descs[0].fields.address = dma_addr;
 
         /* Map the frags */
         for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
-                unsigned long dma_addr;
                 skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
 
                 dma_addr = dma_map_page(&adapter->vdev->dev, frag->page,
@@ -1021,7 +1035,12 @@ retry_bounce:
                 netdev->stats.tx_bytes += skb->len;
         }
 
-        for (i = 0; i < skb_shinfo(skb)->nr_frags + 1; i++)
+        dma_unmap_single(&adapter->vdev->dev,
+                         descs[0].fields.address,
+                         descs[0].fields.flags_len & IBMVETH_BUF_LEN_MASK,
+                         DMA_TO_DEVICE);
+
+        for (i = 1; i < skb_shinfo(skb)->nr_frags + 1; i++)
                 dma_unmap_page(&adapter->vdev->dev, descs[i].fields.address,
                                descs[i].fields.flags_len & IBMVETH_BUF_LEN_MASK,
                                DMA_TO_DEVICE);
@@ -1084,8 +1103,9 @@ restart_poll:
                                 if (rx_flush)
                                         ibmveth_flush_buffer(skb->data,
                                                 length + offset);
+                                if (!ibmveth_rxq_recycle_buffer(adapter))
+                                        kfree_skb(skb);
                                 skb = new_skb;
-                                ibmveth_rxq_recycle_buffer(adapter);
                         } else {
                                 ibmveth_rxq_harvest_buffer(adapter);
                                 skb_reserve(skb, offset);
diff --git a/drivers/net/ixgbe/ixgbe_main.c b/drivers/net/ixgbe/ixgbe_main.c
index e86297b32733..e1fcc9589278 100644
--- a/drivers/net/ixgbe/ixgbe_main.c
+++ b/drivers/net/ixgbe/ixgbe_main.c
@@ -1321,8 +1321,8 @@ static void ixgbe_clean_rx_irq(struct ixgbe_q_vector *q_vector,
                 if (ring_is_rsc_enabled(rx_ring))
                         pkt_is_rsc = ixgbe_get_rsc_state(rx_desc);
 
-                /* if this is a skb from previous receive DMA will be 0 */
-                if (rx_buffer_info->dma) {
+                /* linear means we are building an skb from multiple pages */
+                if (!skb_is_nonlinear(skb)) {
                         u16 hlen;
                         if (pkt_is_rsc &&
                             !(staterr & IXGBE_RXD_STAT_EOP) &&
@@ -1459,8 +1459,10 @@ static void ixgbe_clean_rx_irq(struct ixgbe_q_vector *q_vector,
                 if (ixgbe_rx_is_fcoe(adapter, rx_desc)) {
                         ddp_bytes = ixgbe_fcoe_ddp(adapter, rx_desc, skb,
                                                    staterr);
-                        if (!ddp_bytes)
+                        if (!ddp_bytes) {
+                                dev_kfree_skb_any(skb);
                                 goto next_desc;
+                        }
                 }
 #endif /* IXGBE_FCOE */
                 ixgbe_receive_skb(q_vector, skb, staterr, rx_ring, rx_desc);
diff --git a/drivers/net/netconsole.c b/drivers/net/netconsole.c
index dfc82720065a..ed2a3977c6e7 100644
--- a/drivers/net/netconsole.c
+++ b/drivers/net/netconsole.c
@@ -799,5 +799,11 @@ static void __exit cleanup_netconsole(void)
         }
 }
 
-module_init(init_netconsole);
+/*
+ * Use late_initcall to ensure netconsole is
+ * initialized after network device driver if built-in.
+ *
+ * late_initcall() and module_init() are identical if built as module.
+ */
+late_initcall(init_netconsole);
 module_exit(cleanup_netconsole);
diff --git a/drivers/net/pch_gbe/pch_gbe.h b/drivers/net/pch_gbe/pch_gbe.h
index 59fac77d0dbb..a09a07197eb5 100644
--- a/drivers/net/pch_gbe/pch_gbe.h
+++ b/drivers/net/pch_gbe/pch_gbe.h
@@ -127,8 +127,8 @@ struct pch_gbe_regs {
 
 /* Reset */
 #define PCH_GBE_ALL_RST         0x80000000  /* All reset */
-#define PCH_GBE_TX_RST          0x40000000  /* TX MAC, TX FIFO, TX DMA reset */
-#define PCH_GBE_RX_RST          0x04000000  /* RX MAC, RX FIFO, RX DMA reset */
+#define PCH_GBE_TX_RST          0x00008000  /* TX MAC, TX FIFO, TX DMA reset */
+#define PCH_GBE_RX_RST          0x00004000  /* RX MAC, RX FIFO, RX DMA reset */
 
 /* TCP/IP Accelerator Control */
 #define PCH_GBE_EX_LIST_EN      0x00000008  /* External List Enable */
@@ -276,6 +276,9 @@ struct pch_gbe_regs {
 #define PCH_GBE_RX_DMA_EN       0x00000002   /* Enables Receive DMA */
 #define PCH_GBE_TX_DMA_EN       0x00000001   /* Enables Transmission DMA */
 
+/* RX DMA STATUS */
+#define PCH_GBE_IDLE_CHECK       0xFFFFFFFE
+
 /* Wake On LAN Status */
 #define PCH_GBE_WLS_BR          0x00000008 /* Broadcas Address */
 #define PCH_GBE_WLS_MLT         0x00000004 /* Multicast Address */
@@ -471,6 +474,7 @@ struct pch_gbe_tx_desc {
 struct pch_gbe_buffer {
         struct sk_buff *skb;
         dma_addr_t dma;
+        unsigned char *rx_buffer;
         unsigned long time_stamp;
         u16 length;
         bool mapped;
@@ -511,6 +515,9 @@ struct pch_gbe_tx_ring {
 struct pch_gbe_rx_ring {
         struct pch_gbe_rx_desc *desc;
         dma_addr_t dma;
+        unsigned char *rx_buff_pool;
+        dma_addr_t rx_buff_pool_logic;
+        unsigned int rx_buff_pool_size;
         unsigned int size;
         unsigned int count;
         unsigned int next_to_use;
@@ -622,6 +629,7 @@ struct pch_gbe_adapter {
         unsigned long rx_buffer_len;
         unsigned long tx_queue_len;
         bool have_msi;
+        bool rx_stop_flag;
 };
 
 extern const char pch_driver_version[];
diff --git a/drivers/net/pch_gbe/pch_gbe_main.c b/drivers/net/pch_gbe/pch_gbe_main.c
index eac3c5ca9731..b8b4ba27b0e7 100644
--- a/drivers/net/pch_gbe/pch_gbe_main.c
+++ b/drivers/net/pch_gbe/pch_gbe_main.c
@@ -20,7 +20,6 @@
 
 #include "pch_gbe.h"
 #include "pch_gbe_api.h"
-#include <linux/prefetch.h>
 
 #define DRV_VERSION     "1.00"
 const char pch_driver_version[] = DRV_VERSION;
@@ -34,11 +33,15 @@ const char pch_driver_version[] = DRV_VERSION;
 #define PCH_GBE_WATCHDOG_PERIOD         (1 * HZ)        /* watchdog time */
 #define PCH_GBE_COPYBREAK_DEFAULT       256
 #define PCH_GBE_PCI_BAR                 1
+#define PCH_GBE_RESERVE_MEMORY          0x200000        /* 2MB */
 
 /* Macros for ML7223 */
 #define PCI_VENDOR_ID_ROHM                      0x10db
 #define PCI_DEVICE_ID_ROHM_ML7223_GBE           0x8013
 
+/* Macros for ML7831 */
+#define PCI_DEVICE_ID_ROHM_ML7831_GBE           0x8802
+
 #define PCH_GBE_TX_WEIGHT         64
 #define PCH_GBE_RX_WEIGHT         64
 #define PCH_GBE_RX_BUFFER_WRITE   16
@@ -52,6 +55,7 @@ const char pch_driver_version[] = DRV_VERSION;
         )
 
 /* Ethertype field values */
+#define PCH_GBE_MAX_RX_BUFFER_SIZE      0x2880
 #define PCH_GBE_MAX_JUMBO_FRAME_SIZE    10318
 #define PCH_GBE_FRAME_SIZE_2048         2048
 #define PCH_GBE_FRAME_SIZE_4096         4096
@@ -83,10 +87,12 @@ const char pch_driver_version[] = DRV_VERSION;
 #define PCH_GBE_INT_ENABLE_MASK ( \
         PCH_GBE_INT_RX_DMA_CMPLT |    \
         PCH_GBE_INT_RX_DSC_EMP   |    \
+        PCH_GBE_INT_RX_FIFO_ERR  |    \
         PCH_GBE_INT_WOL_DET      |    \
         PCH_GBE_INT_TX_CMPLT          \
         )
 
+#define PCH_GBE_INT_DISABLE_ALL         0
 
 static unsigned int copybreak __read_mostly = PCH_GBE_COPYBREAK_DEFAULT;
 
@@ -138,6 +144,27 @@ static void pch_gbe_wait_clr_bit(void *reg, u32 bit)
         if (!tmp)
                 pr_err("Error: busy bit is not cleared\n");
 }
+
+/**
+ * pch_gbe_wait_clr_bit_irq - Wait to clear a bit for interrupt context
+ * @reg:        Pointer of register
+ * @busy:       Busy bit
+ */
+static int pch_gbe_wait_clr_bit_irq(void *reg, u32 bit)
+{
+        u32 tmp;
+        int ret = -1;
+        /* wait busy */
+        tmp = 20;
+        while ((ioread32(reg) & bit) && --tmp)
+                udelay(5);
+        if (!tmp)
+                pr_err("Error: busy bit is not cleared\n");
+        else
+                ret = 0;
+        return ret;
+}
+
 /**
  * pch_gbe_mac_mar_set - Set MAC address register
  * @hw:     Pointer to the HW structure
@@ -189,6 +216,17 @@ static void pch_gbe_mac_reset_hw(struct pch_gbe_hw *hw)
         return;
 }
 
+static void pch_gbe_mac_reset_rx(struct pch_gbe_hw *hw)
+{
+        /* Read the MAC address. and store to the private data */
+        pch_gbe_mac_read_mac_addr(hw);
+        iowrite32(PCH_GBE_RX_RST, &hw->reg->RESET);
+        pch_gbe_wait_clr_bit_irq(&hw->reg->RESET, PCH_GBE_RX_RST);
+        /* Setup the MAC address */
+        pch_gbe_mac_mar_set(hw, hw->mac.addr, 0);
+        return;
+}
+
 /**
  * pch_gbe_mac_init_rx_addrs - Initialize receive address's
  * @hw: Pointer to the HW structure
@@ -671,13 +709,8 @@ static void pch_gbe_setup_rctl(struct pch_gbe_adapter *adapter)
 
         tcpip = ioread32(&hw->reg->TCPIP_ACC);
 
-        if (netdev->features & NETIF_F_RXCSUM) {
-                tcpip &= ~PCH_GBE_RX_TCPIPACC_OFF;
-                tcpip |= PCH_GBE_RX_TCPIPACC_EN;
-        } else {
-                tcpip |= PCH_GBE_RX_TCPIPACC_OFF;
-                tcpip &= ~PCH_GBE_RX_TCPIPACC_EN;
-        }
+        tcpip |= PCH_GBE_RX_TCPIPACC_OFF;
+        tcpip &= ~PCH_GBE_RX_TCPIPACC_EN;
         iowrite32(tcpip, &hw->reg->TCPIP_ACC);
         return;
 }
@@ -717,13 +750,6 @@ static void pch_gbe_configure_rx(struct pch_gbe_adapter *adapter)
         iowrite32(rdba, &hw->reg->RX_DSC_BASE);
         iowrite32(rdlen, &hw->reg->RX_DSC_SIZE);
         iowrite32((rdba + rdlen), &hw->reg->RX_DSC_SW_P);
-
-        /* Enables Receive DMA */
-        rxdma = ioread32(&hw->reg->DMA_CTRL);
-        rxdma |= PCH_GBE_RX_DMA_EN;
-        iowrite32(rxdma, &hw->reg->DMA_CTRL);
-        /* Enables Receive */
-        iowrite32(PCH_GBE_MRE_MAC_RX_EN, &hw->reg->MAC_RX_EN);
 }
 
 /**
@@ -1097,6 +1123,48 @@ void pch_gbe_update_stats(struct pch_gbe_adapter *adapter)
         spin_unlock_irqrestore(&adapter->stats_lock, flags);
 }
 
+static void pch_gbe_stop_receive(struct pch_gbe_adapter *adapter)
+{
+        struct pch_gbe_hw *hw = &adapter->hw;
+        u32 rxdma;
+        u16 value;
+        int ret;
+
+        /* Disable Receive DMA */
+        rxdma = ioread32(&hw->reg->DMA_CTRL);
+        rxdma &= ~PCH_GBE_RX_DMA_EN;
+        iowrite32(rxdma, &hw->reg->DMA_CTRL);
+        /* Wait Rx DMA BUS is IDLE */
+        ret = pch_gbe_wait_clr_bit_irq(&hw->reg->RX_DMA_ST, PCH_GBE_IDLE_CHECK);
+        if (ret) {
+                /* Disable Bus master */
+                pci_read_config_word(adapter->pdev, PCI_COMMAND, &value);
+                value &= ~PCI_COMMAND_MASTER;
+                pci_write_config_word(adapter->pdev, PCI_COMMAND, value);
+                /* Stop Receive */
+                pch_gbe_mac_reset_rx(hw);
+                /* Enable Bus master */
+                value |= PCI_COMMAND_MASTER;
+                pci_write_config_word(adapter->pdev, PCI_COMMAND, value);
+        } else {
+                /* Stop Receive */
+                pch_gbe_mac_reset_rx(hw);
+        }
+}
+
+static void pch_gbe_start_receive(struct pch_gbe_hw *hw)
+{
+        u32 rxdma;
+
+        /* Enables Receive DMA */
+        rxdma = ioread32(&hw->reg->DMA_CTRL);
+        rxdma |= PCH_GBE_RX_DMA_EN;
+        iowrite32(rxdma, &hw->reg->DMA_CTRL);
+        /* Enables Receive */
+        iowrite32(PCH_GBE_MRE_MAC_RX_EN, &hw->reg->MAC_RX_EN);
+        return;
+}
+
 /**
  * pch_gbe_intr - Interrupt Handler
  * @irq:   Interrupt number
@@ -1123,7 +1191,17 @@ static irqreturn_t pch_gbe_intr(int irq, void *data)
         if (int_st & PCH_GBE_INT_RX_FRAME_ERR)
                 adapter->stats.intr_rx_frame_err_count++;
         if (int_st & PCH_GBE_INT_RX_FIFO_ERR)
-                adapter->stats.intr_rx_fifo_err_count++;
+                if (!adapter->rx_stop_flag) {
+                        adapter->stats.intr_rx_fifo_err_count++;
+                        pr_debug("Rx fifo over run\n");
+                        adapter->rx_stop_flag = true;
+                        int_en = ioread32(&hw->reg->INT_EN);
+                        iowrite32((int_en & ~PCH_GBE_INT_RX_FIFO_ERR),
+                                  &hw->reg->INT_EN);
+                        pch_gbe_stop_receive(adapter);
+                        int_st |= ioread32(&hw->reg->INT_ST);
+                        int_st = int_st & ioread32(&hw->reg->INT_EN);
+                }
         if (int_st & PCH_GBE_INT_RX_DMA_ERR)
                 adapter->stats.intr_rx_dma_err_count++;
         if (int_st & PCH_GBE_INT_TX_FIFO_ERR)
@@ -1135,21 +1213,18 @@ static irqreturn_t pch_gbe_intr(int irq, void *data)
         /* When Rx descriptor is empty  */
         if ((int_st & PCH_GBE_INT_RX_DSC_EMP)) {
                 adapter->stats.intr_rx_dsc_empty_count++;
-                pr_err("Rx descriptor is empty\n");
+                pr_debug("Rx descriptor is empty\n");
                 int_en = ioread32(&hw->reg->INT_EN);
                 iowrite32((int_en & ~PCH_GBE_INT_RX_DSC_EMP), &hw->reg->INT_EN);
                 if (hw->mac.tx_fc_enable) {
                         /* Set Pause packet */
                         pch_gbe_mac_set_pause_packet(hw);
                 }
-                if ((int_en & (PCH_GBE_INT_RX_DMA_CMPLT | PCH_GBE_INT_TX_CMPLT))
-                    == 0) {
-                        return IRQ_HANDLED;
-                }
         }
 
         /* When request status is Receive interruption */
-        if ((int_st & (PCH_GBE_INT_RX_DMA_CMPLT | PCH_GBE_INT_TX_CMPLT))) {
+        if ((int_st & (PCH_GBE_INT_RX_DMA_CMPLT | PCH_GBE_INT_TX_CMPLT)) ||
+            (adapter->rx_stop_flag == true)) {
                 if (likely(napi_schedule_prep(&adapter->napi))) {
                         /* Enable only Rx Descriptor empty */
                         atomic_inc(&adapter->irq_sem);
@@ -1185,29 +1260,23 @@ pch_gbe_alloc_rx_buffers(struct pch_gbe_adapter *adapter,
         unsigned int i;
         unsigned int bufsz;
 
-        bufsz = adapter->rx_buffer_len + PCH_GBE_DMA_ALIGN;
+        bufsz = adapter->rx_buffer_len + NET_IP_ALIGN;
         i = rx_ring->next_to_use;
 
         while ((cleaned_count--)) {
                 buffer_info = &rx_ring->buffer_info[i];
-                skb = buffer_info->skb;
-                if (skb) {
-                        skb_trim(skb, 0);
-                } else {
-                        skb = netdev_alloc_skb(netdev, bufsz);
-                        if (unlikely(!skb)) {
-                                /* Better luck next round */
-                                adapter->stats.rx_alloc_buff_failed++;
-                                break;
-                        }
-                        /* 64byte align */
-                        skb_reserve(skb, PCH_GBE_DMA_ALIGN);
-
-                        buffer_info->skb = skb;
-                        buffer_info->length = adapter->rx_buffer_len;
+                skb = netdev_alloc_skb(netdev, bufsz);
+                if (unlikely(!skb)) {
+                        /* Better luck next round */
+                        adapter->stats.rx_alloc_buff_failed++;
+                        break;
                 }
+                /* align */
+                skb_reserve(skb, NET_IP_ALIGN);
+                buffer_info->skb = skb;
+
                 buffer_info->dma = dma_map_single(&pdev->dev,
-                                                  skb->data,
+                                                  buffer_info->rx_buffer,
                                                   buffer_info->length,
                                                   DMA_FROM_DEVICE);
                 if (dma_mapping_error(&adapter->pdev->dev, buffer_info->dma)) {
@@ -1240,6 +1309,36 @@ pch_gbe_alloc_rx_buffers(struct pch_gbe_adapter *adapter,
         return;
 }
 
+static int
+pch_gbe_alloc_rx_buffers_pool(struct pch_gbe_adapter *adapter,
+                         struct pch_gbe_rx_ring *rx_ring, int cleaned_count)
+{
+        struct pci_dev *pdev = adapter->pdev;
+        struct pch_gbe_buffer *buffer_info;
+        unsigned int i;
+        unsigned int bufsz;
+        unsigned int size;
+
+        bufsz = adapter->rx_buffer_len;
+
+        size = rx_ring->count * bufsz + PCH_GBE_RESERVE_MEMORY;
+        rx_ring->rx_buff_pool = dma_alloc_coherent(&pdev->dev, size,
+                                                &rx_ring->rx_buff_pool_logic,
+                                                GFP_KERNEL);
+        if (!rx_ring->rx_buff_pool) {
+                pr_err("Unable to allocate memory for the receive poll buffer\n");
+                return -ENOMEM;
+        }
+        memset(rx_ring->rx_buff_pool, 0, size);
+        rx_ring->rx_buff_pool_size = size;
+        for (i = 0; i < rx_ring->count; i++) {
+                buffer_info = &rx_ring->buffer_info[i];
+                buffer_info->rx_buffer = rx_ring->rx_buff_pool + bufsz * i;
+                buffer_info->length = bufsz;
+        }
+        return 0;
+}
+
 /**
  * pch_gbe_alloc_tx_buffers - Allocate transmit buffers
  * @adapter:   Board private structure
@@ -1285,7 +1384,7 @@ pch_gbe_clean_tx(struct pch_gbe_adapter *adapter,
         struct sk_buff *skb;
         unsigned int i;
         unsigned int cleaned_count = 0;
-        bool cleaned = false;
+        bool cleaned = true;
 
         pr_debug("next_to_clean : %d\n", tx_ring->next_to_clean);
 
@@ -1296,7 +1395,6 @@ pch_gbe_clean_tx(struct pch_gbe_adapter *adapter,
 
         while ((tx_desc->gbec_status & DSC_INIT16) == 0x0000) {
                 pr_debug("gbec_status:0x%04x\n", tx_desc->gbec_status);
-                cleaned = true;
                 buffer_info = &tx_ring->buffer_info[i];
                 skb = buffer_info->skb;
 
@@ -1339,8 +1437,10 @@ pch_gbe_clean_tx(struct pch_gbe_adapter *adapter,
                 tx_desc = PCH_GBE_TX_DESC(*tx_ring, i);
 
                 /* weight of a sort for tx, to avoid endless transmit cleanup */
-                if (cleaned_count++ == PCH_GBE_TX_WEIGHT)
+                if (cleaned_count++ == PCH_GBE_TX_WEIGHT) {
+                        cleaned = false;
                         break;
+                }
         }
         pr_debug("called pch_gbe_unmap_and_free_tx_resource() %d count\n",
                  cleaned_count);
@@ -1380,7 +1480,7 @@ pch_gbe_clean_rx(struct pch_gbe_adapter *adapter,
         unsigned int i;
         unsigned int cleaned_count = 0;
         bool cleaned = false;
-        struct sk_buff *skb, *new_skb;
+        struct sk_buff *skb;
         u8 dma_status;
         u16 gbec_status;
         u32 tcp_ip_status;
@@ -1401,13 +1501,12 @@ pch_gbe_clean_rx(struct pch_gbe_adapter *adapter,
                 rx_desc->gbec_status = DSC_INIT16;
                 buffer_info = &rx_ring->buffer_info[i];
                 skb = buffer_info->skb;
+                buffer_info->skb = NULL;
 
                 /* unmap dma */
                 dma_unmap_single(&pdev->dev, buffer_info->dma,
                                    buffer_info->length, DMA_FROM_DEVICE);
                 buffer_info->mapped = false;
-                /* Prefetch the packet */
-                prefetch(skb->data);
 
                 pr_debug("RxDecNo = 0x%04x  Status[DMA:0x%02x GBE:0x%04x "
                          "TCP:0x%08x]  BufInf = 0x%p\n",
@@ -1427,70 +1526,16 @@ pch_gbe_clean_rx(struct pch_gbe_adapter *adapter,
                         pr_err("Receive CRC Error\n");
                 } else {
                         /* get receive length */
-                        /* length convert[-3] */
-                        length = (rx_desc->rx_words_eob) - 3;
-
-                        /* Decide the data conversion method */
-                        if (!(netdev->features & NETIF_F_RXCSUM)) {
-                                /* [Header:14][payload] */
-                                if (NET_IP_ALIGN) {
-                                        /* Because alignment differs,
-                                         * the new_skb is newly allocated,
-                                         * and data is copied to new_skb.*/
-                                        new_skb = netdev_alloc_skb(netdev,
-                                                         length + NET_IP_ALIGN);
-                                        if (!new_skb) {
-                                                /* dorrop error */
-                                                pr_err("New skb allocation "
-                                                        "Error\n");
-                                                goto dorrop;
-                                        }
-                                        skb_reserve(new_skb, NET_IP_ALIGN);
-                                        memcpy(new_skb->data, skb->data,
-                                               length);
-                                        skb = new_skb;
-                                } else {
-                                        /* DMA buffer is used as SKB as it is.*/
-                                        buffer_info->skb = NULL;
-                                }
-                        } else {
-                                /* [Header:14][padding:2][payload] */
-                                /* The length includes padding length */
-                                length = length - PCH_GBE_DMA_PADDING;
-                                if ((length < copybreak) ||
-                                    (NET_IP_ALIGN != PCH_GBE_DMA_PADDING)) {
-                                        /* Because alignment differs,
-                                         * the new_skb is newly allocated,
-                                         * and data is copied to new_skb.
-                                         * Padding data is deleted
-                                         * at the time of a copy.*/
-                                        new_skb = netdev_alloc_skb(netdev,
-                                                         length + NET_IP_ALIGN);
-                                        if (!new_skb) {
-                                                /* dorrop error */
-                                                pr_err("New skb allocation "
-                                                        "Error\n");
-                                                goto dorrop;
-                                        }
-                                        skb_reserve(new_skb, NET_IP_ALIGN);
-                                        memcpy(new_skb->data, skb->data,
-                                               ETH_HLEN);
-                                        memcpy(&new_skb->data[ETH_HLEN],
-                                               &skb->data[ETH_HLEN +
-                                               PCH_GBE_DMA_PADDING],
-                                               length - ETH_HLEN);
-                                        skb = new_skb;
-                                } else {
-                                        /* Padding data is deleted
-                                         * by moving header data.*/
-                                        memmove(&skb->data[PCH_GBE_DMA_PADDING],
-                                                &skb->data[0], ETH_HLEN);
-                                        skb_reserve(skb, NET_IP_ALIGN);
-                                        buffer_info->skb = NULL;
-                                }
-                        }
-                        /* The length includes FCS length */
-                        length = length - ETH_FCS_LEN;
+                        /* length convert[-3], length includes FCS length */
+                        length = (rx_desc->rx_words_eob) - 3 - ETH_FCS_LEN;
+                        if (rx_desc->rx_words_eob & 0x02)
+                                length = length - 4;
+                        /*
+                         * buffer_info->rx_buffer: [Header:14][payload]
+                         * skb->data: [Reserve:2][Header:14][payload]
+                         */
+                        memcpy(skb->data, buffer_info->rx_buffer, length);
+
                         /* update status of driver */
                         adapter->stats.rx_bytes += length;
                         adapter->stats.rx_packets++;
@@ -1509,7 +1554,6 @@ pch_gbe_clean_rx(struct pch_gbe_adapter *adapter,
                         pr_debug("Receive skb->ip_summed: %d length: %d\n",
                                  skb->ip_summed, length);
                 }
-dorrop:
                 /* return some buffers to hardware, one at a time is too slow */
                 if (unlikely(cleaned_count >= PCH_GBE_RX_BUFFER_WRITE)) {
                         pch_gbe_alloc_rx_buffers(adapter, rx_ring,
@@ -1714,9 +1758,15 @@ int pch_gbe_up(struct pch_gbe_adapter *adapter)
                 pr_err("Error: can't bring device up\n");
                 return err;
         }
+        err = pch_gbe_alloc_rx_buffers_pool(adapter, rx_ring, rx_ring->count);
+        if (err) {
+                pr_err("Error: can't bring device up\n");
+                return err;
+        }
         pch_gbe_alloc_tx_buffers(adapter, tx_ring);
         pch_gbe_alloc_rx_buffers(adapter, rx_ring, rx_ring->count);
         adapter->tx_queue_len = netdev->tx_queue_len;
+        pch_gbe_start_receive(&adapter->hw);
 
         mod_timer(&adapter->watchdog_timer, jiffies);
 
@@ -1734,6 +1784,7 @@ int pch_gbe_up(struct pch_gbe_adapter *adapter)
 void pch_gbe_down(struct pch_gbe_adapter *adapter)
 {
         struct net_device *netdev = adapter->netdev;
+        struct pch_gbe_rx_ring *rx_ring = adapter->rx_ring;
 
         /* signal that we're down so the interrupt handler does not
          * reschedule our watchdog timer */
@@ -1752,6 +1803,12 @@ void pch_gbe_down(struct pch_gbe_adapter *adapter)
         pch_gbe_reset(adapter);
         pch_gbe_clean_tx_ring(adapter, adapter->tx_ring);
         pch_gbe_clean_rx_ring(adapter, adapter->rx_ring);
+
+        pci_free_consistent(adapter->pdev, rx_ring->rx_buff_pool_size,
+                            rx_ring->rx_buff_pool, rx_ring->rx_buff_pool_logic);
+        rx_ring->rx_buff_pool_logic = 0;
+        rx_ring->rx_buff_pool_size = 0;
+        rx_ring->rx_buff_pool = NULL;
 }
 
 /**
@@ -2004,6 +2061,8 @@ static int pch_gbe_change_mtu(struct net_device *netdev, int new_mtu)
 {
         struct pch_gbe_adapter *adapter = netdev_priv(netdev);
         int max_frame;
+        unsigned long old_rx_buffer_len = adapter->rx_buffer_len;
+        int err;
 
         max_frame = new_mtu + ETH_HLEN + ETH_FCS_LEN;
         if ((max_frame < ETH_ZLEN + ETH_FCS_LEN) ||
@@ -2018,14 +2077,24 @@ static int pch_gbe_change_mtu(struct net_device *netdev, int new_mtu)
         else if (max_frame <= PCH_GBE_FRAME_SIZE_8192)
                 adapter->rx_buffer_len = PCH_GBE_FRAME_SIZE_8192;
         else
-                adapter->rx_buffer_len = PCH_GBE_MAX_JUMBO_FRAME_SIZE;
-        netdev->mtu = new_mtu;
-        adapter->hw.mac.max_frame_size = max_frame;
+                adapter->rx_buffer_len = PCH_GBE_MAX_RX_BUFFER_SIZE;
 
-        if (netif_running(netdev))
-                pch_gbe_reinit_locked(adapter);
-        else
+        if (netif_running(netdev)) {
+                pch_gbe_down(adapter);
+                err = pch_gbe_up(adapter);
+                if (err) {
+                        adapter->rx_buffer_len = old_rx_buffer_len;
+                        pch_gbe_up(adapter);
+                        return -ENOMEM;
+                } else {
+                        netdev->mtu = new_mtu;
+                        adapter->hw.mac.max_frame_size = max_frame;
+                }
+        } else {
                 pch_gbe_reset(adapter);
+                netdev->mtu = new_mtu;
+                adapter->hw.mac.max_frame_size = max_frame;
+        }
 
         pr_debug("max_frame : %d  rx_buffer_len : %d  mtu : %d  max_frame_size : %d\n",
                  max_frame, (u32) adapter->rx_buffer_len, netdev->mtu,
@@ -2099,33 +2168,39 @@ static int pch_gbe_napi_poll(struct napi_struct *napi, int budget)
 {
         struct pch_gbe_adapter *adapter =
             container_of(napi, struct pch_gbe_adapter, napi);
-        struct net_device *netdev = adapter->netdev;
         int work_done = 0;
         bool poll_end_flag = false;
         bool cleaned = false;
+        u32 int_en;
 
         pr_debug("budget : %d\n", budget);
 
-        /* Keep link state information with original netdev */
-        if (!netif_carrier_ok(netdev)) {
-                poll_end_flag = true;
-        } else {
-                cleaned = pch_gbe_clean_tx(adapter, adapter->tx_ring);
-                pch_gbe_clean_rx(adapter, adapter->rx_ring, &work_done, budget);
+        pch_gbe_clean_rx(adapter, adapter->rx_ring, &work_done, budget);
+        cleaned = pch_gbe_clean_tx(adapter, adapter->tx_ring);
 
-                if (cleaned)
-                        work_done = budget;
-                /* If no Tx and not enough Rx work done,
-                 * exit the polling mode
-                 */
-                if ((work_done < budget) || !netif_running(netdev))
-                        poll_end_flag = true;
-        }
+        if (!cleaned)
+                work_done = budget;
+        /* If no Tx and not enough Rx work done,
+         * exit the polling mode
+         */
+        if (work_done < budget)
+                poll_end_flag = true;
 
         if (poll_end_flag) {
                 napi_complete(napi);
+                if (adapter->rx_stop_flag) {
+                        adapter->rx_stop_flag = false;
+                        pch_gbe_start_receive(&adapter->hw);
+                }
                 pch_gbe_irq_enable(adapter);
-        }
+        } else
+                if (adapter->rx_stop_flag) {
+                        adapter->rx_stop_flag = false;
+                        pch_gbe_start_receive(&adapter->hw);
+                        int_en = ioread32(&adapter->hw.reg->INT_EN);
+                        iowrite32((int_en | PCH_GBE_INT_RX_FIFO_ERR),
+                                &adapter->hw.reg->INT_EN);
+                }
 
         pr_debug("poll_end_flag : %d  work_done : %d  budget : %d\n",
                  poll_end_flag, work_done, budget);
@@ -2452,6 +2527,13 @@ static DEFINE_PCI_DEVICE_TABLE(pch_gbe_pcidev_id) = {
          .class = (PCI_CLASS_NETWORK_ETHERNET << 8),
          .class_mask = (0xFFFF00)
          },
+        {.vendor = PCI_VENDOR_ID_ROHM,
+         .device = PCI_DEVICE_ID_ROHM_ML7831_GBE,
+         .subvendor = PCI_ANY_ID,
+         .subdevice = PCI_ANY_ID,
+         .class = (PCI_CLASS_NETWORK_ETHERNET << 8),
+         .class_mask = (0xFFFF00)
+         },
         /* required last entry */
         {0}
 };
diff --git a/drivers/net/phy/dp83640.c b/drivers/net/phy/dp83640.c
index cb6e0b486b1e..edd7304773eb 100644
--- a/drivers/net/phy/dp83640.c
+++ b/drivers/net/phy/dp83640.c
@@ -589,7 +589,7 @@ static void decode_rxts(struct dp83640_private *dp83640,
         prune_rx_ts(dp83640);
 
         if (list_empty(&dp83640->rxpool)) {
-                pr_warning("dp83640: rx timestamp pool is empty\n");
+                pr_debug("dp83640: rx timestamp pool is empty\n");
                 goto out;
         }
         rxts = list_first_entry(&dp83640->rxpool, struct rxts, list);
@@ -612,7 +612,7 @@ static void decode_txts(struct dp83640_private *dp83640,
         skb = skb_dequeue(&dp83640->tx_queue);
 
         if (!skb) {
-                pr_warning("dp83640: have timestamp but tx_queue empty\n");
+                pr_debug("dp83640: have timestamp but tx_queue empty\n");
                 return;
         }
         ns = phy2txts(phy_txts);
diff --git a/drivers/net/phy/national.c b/drivers/net/phy/national.c
index 0620ba963508..04bb8fcc0cb5 100644
--- a/drivers/net/phy/national.c
+++ b/drivers/net/phy/national.c
@@ -25,8 +25,9 @@
 /* DP83865 phy identifier values */
 #define DP83865_PHY_ID  0x20005c7a
 
-#define DP83865_INT_MASK_REG 0x15
-#define DP83865_INT_MASK_STATUS 0x14
+#define DP83865_INT_STATUS      0x14
+#define DP83865_INT_MASK        0x15
+#define DP83865_INT_CLEAR       0x17
 
 #define DP83865_INT_REMOTE_FAULT 0x0008
 #define DP83865_INT_ANE_COMPLETED 0x0010
@@ -68,21 +69,25 @@ static int ns_config_intr(struct phy_device *phydev)
         int err;
 
         if (phydev->interrupts == PHY_INTERRUPT_ENABLED)
-                err = phy_write(phydev, DP83865_INT_MASK_REG,
+                err = phy_write(phydev, DP83865_INT_MASK,
                                 DP83865_INT_MASK_DEFAULT);
         else
-                err = phy_write(phydev, DP83865_INT_MASK_REG, 0);
+                err = phy_write(phydev, DP83865_INT_MASK, 0);
 
         return err;
 }
 
 static int ns_ack_interrupt(struct phy_device *phydev)
 {
-        int ret = phy_read(phydev, DP83865_INT_MASK_STATUS);
+        int ret = phy_read(phydev, DP83865_INT_STATUS);
         if (ret < 0)
                 return ret;
 
-        return 0;
+        /* Clear the interrupt status bit by writing a “1”
+         * to the corresponding bit in INT_CLEAR (2:0 are reserved) */
+        ret = phy_write(phydev, DP83865_INT_CLEAR, ret & ~0x7);
+
+        return ret;
 }
 
 static void ns_giga_speed_fallback(struct phy_device *phydev, int mode)
diff --git a/drivers/net/ppp_generic.c b/drivers/net/ppp_generic.c
index 10e5d985afa3..edfa15d2e795 100644
--- a/drivers/net/ppp_generic.c
+++ b/drivers/net/ppp_generic.c
@@ -1465,7 +1465,12 @@ static int ppp_mp_explode(struct ppp *ppp, struct sk_buff *skb)
                         continue;
                 }
 
-                mtu = pch->chan->mtu - hdrlen;
+                /*
+                 * hdrlen includes the 2-byte PPP protocol field, but the
+                 * MTU counts only the payload excluding the protocol field.
+                 * (RFC1661 Section 2)
+                 */
+                mtu = pch->chan->mtu - (hdrlen - 2);
                 if (mtu < 4)
                         mtu = 4;
                 if (flen > mtu)
diff --git a/drivers/net/pxa168_eth.c b/drivers/net/pxa168_eth.c
index 1a3033d8e7ed..d17d0624c5e6 100644
--- a/drivers/net/pxa168_eth.c
+++ b/drivers/net/pxa168_eth.c
@@ -40,6 +40,7 @@
 #include <linux/clk.h>
 #include <linux/phy.h>
 #include <linux/io.h>
+#include <linux/interrupt.h>
 #include <linux/types.h>
 #include <asm/pgtable.h>
 #include <asm/system.h>
diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
index 02339b3352e7..c23667017922 100644
--- a/drivers/net/r8169.c
+++ b/drivers/net/r8169.c
@@ -407,6 +407,7 @@ enum rtl_register_content {
         RxOK            = 0x0001,
 
         /* RxStatusDesc */
+        RxBOVF  = (1 << 24),
         RxFOVF  = (1 << 23),
         RxRWT   = (1 << 22),
         RxRES   = (1 << 21),
@@ -682,6 +683,7 @@ struct rtl8169_private {
         struct mii_if_info mii;
         struct rtl8169_counters counters;
         u32 saved_wolopts;
+        u32 opts1_mask;
 
         struct rtl_fw {
                 const struct firmware *fw;
@@ -710,6 +712,7 @@ MODULE_FIRMWARE(FIRMWARE_8168D_1);
 MODULE_FIRMWARE(FIRMWARE_8168D_2);
 MODULE_FIRMWARE(FIRMWARE_8168E_1);
 MODULE_FIRMWARE(FIRMWARE_8168E_2);
+MODULE_FIRMWARE(FIRMWARE_8168E_3);
 MODULE_FIRMWARE(FIRMWARE_8105E_1);
 
 static int rtl8169_open(struct net_device *dev);
@@ -3077,6 +3080,14 @@ static void rtl8169_phy_reset(struct net_device *dev,
         netif_err(tp, link, dev, "PHY reset failed\n");
 }
 
+static bool rtl_tbi_enabled(struct rtl8169_private *tp)
+{
+        void __iomem *ioaddr = tp->mmio_addr;
+
+        return (tp->mac_version == RTL_GIGA_MAC_VER_01) &&
+            (RTL_R8(PHYstatus) & TBI_Enable);
+}
+
 static void rtl8169_init_phy(struct net_device *dev, struct rtl8169_private *tp)
 {
         void __iomem *ioaddr = tp->mmio_addr;
@@ -3109,7 +3120,7 @@ static void rtl8169_init_phy(struct net_device *dev, struct rtl8169_private *tp)
                            ADVERTISED_1000baseT_Half |
                            ADVERTISED_1000baseT_Full : 0));
 
-        if (RTL_R8(PHYstatus) & TBI_Enable)
+        if (rtl_tbi_enabled(tp))
                 netif_info(tp, link, dev, "TBI auto-negotiating\n");
 }
 
@@ -3319,9 +3330,16 @@ static void r810x_phy_power_up(struct rtl8169_private *tp)
 
 static void r810x_pll_power_down(struct rtl8169_private *tp)
 {
+        void __iomem *ioaddr = tp->mmio_addr;
+
         if (__rtl8169_get_wol(tp) & WAKE_ANY) {
                 rtl_writephy(tp, 0x1f, 0x0000);
                 rtl_writephy(tp, MII_BMCR, 0x0000);
+
+                if (tp->mac_version == RTL_GIGA_MAC_VER_29 ||
+                    tp->mac_version == RTL_GIGA_MAC_VER_30)
+                        RTL_W32(RxConfig, RTL_R32(RxConfig) | AcceptBroadcast |
+                                AcceptMulticast | AcceptMyPhys);
                 return;
         }
 
@@ -3417,7 +3435,8 @@ static void r8168_pll_power_down(struct rtl8169_private *tp)
                 rtl_writephy(tp, MII_BMCR, 0x0000);
 
                 if (tp->mac_version == RTL_GIGA_MAC_VER_32 ||
-                    tp->mac_version == RTL_GIGA_MAC_VER_33)
+                    tp->mac_version == RTL_GIGA_MAC_VER_33 ||
+                    tp->mac_version == RTL_GIGA_MAC_VER_34)
                         RTL_W32(RxConfig, RTL_R32(RxConfig) | AcceptBroadcast |
                                 AcceptMulticast | AcceptMyPhys);
                 return;
@@ -3727,8 +3746,7 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         tp->features |= rtl_try_msi(pdev, ioaddr, cfg);
         RTL_W8(Cfg9346, Cfg9346_Lock);
 
-        if ((tp->mac_version <= RTL_GIGA_MAC_VER_06) &&
-            (RTL_R8(PHYstatus) & TBI_Enable)) {
+        if (rtl_tbi_enabled(tp)) {
                 tp->set_speed = rtl8169_set_speed_tbi;
                 tp->get_settings = rtl8169_gset_tbi;
                 tp->phy_reset_enable = rtl8169_tbi_reset_enable;
@@ -3777,6 +3795,9 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         tp->intr_event = cfg->intr_event;
         tp->napi_event = cfg->napi_event;
 
+        tp->opts1_mask = (tp->mac_version != RTL_GIGA_MAC_VER_01) ?
+                ~(RxBOVF | RxFOVF) : ~0;
+
         init_timer(&tp->timer);
         tp->timer.data = (unsigned long) dev;
         tp->timer.function = rtl8169_phy_timer;
@@ -3988,6 +4009,7 @@ static void rtl8169_hw_reset(struct rtl8169_private *tp)
                 while (RTL_R8(TxPoll) & NPQ)
                         udelay(20);
         } else if (tp->mac_version == RTL_GIGA_MAC_VER_34) {
+                RTL_W8(ChipCmd, RTL_R8(ChipCmd) | StopReq);
                 while (!(RTL_R32(TxConfig) & TXCFG_EMPTY))
                         udelay(100);
         } else {
@@ -5314,7 +5336,7 @@ static int rtl8169_rx_interrupt(struct net_device *dev,
                 u32 status;
 
                 rmb();
-                status = le32_to_cpu(desc->opts1);
+                status = le32_to_cpu(desc->opts1) & tp->opts1_mask;
 
                 if (status & DescOwn)
                         break;
diff --git a/drivers/net/rionet.c b/drivers/net/rionet.c
index 86ac38c96bcf..3bb131137033 100644
--- a/drivers/net/rionet.c
+++ b/drivers/net/rionet.c
@@ -80,13 +80,13 @@ static int rionet_capable = 1;
  */
 static struct rio_dev **rionet_active;
 
-#define is_rionet_capable(pef, src_ops, dst_ops)                \
-                        ((pef & RIO_PEF_INB_MBOX) &&            \
-                         (pef & RIO_PEF_INB_DOORBELL) &&        \
+#define is_rionet_capable(src_ops, dst_ops)                     \
+                        ((src_ops & RIO_SRC_OPS_DATA_MSG) &&    \
+                         (dst_ops & RIO_DST_OPS_DATA_MSG) &&    \
                          (src_ops & RIO_SRC_OPS_DOORBELL) &&    \
                          (dst_ops & RIO_DST_OPS_DOORBELL))
 #define dev_rionet_capable(dev) \
-        is_rionet_capable(dev->pef, dev->src_ops, dev->dst_ops)
+        is_rionet_capable(dev->src_ops, dev->dst_ops)
 
 #define RIONET_MAC_MATCH(x)     (*(u32 *)x == 0x00010001)
 #define RIONET_GET_DESTID(x)    (*(u16 *)(x + 4))
@@ -282,7 +282,6 @@ static int rionet_open(struct net_device *ndev)
 {
         int i, rc = 0;
         struct rionet_peer *peer, *tmp;
-        u32 pwdcsr;
         struct rionet_private *rnet = netdev_priv(ndev);
 
         if (netif_msg_ifup(rnet))
@@ -332,13 +331,8 @@ static int rionet_open(struct net_device *ndev)
                         continue;
                 }
 
-                /*
-                 * If device has initialized inbound doorbells,
-                 * send a join message
-                 */
-                rio_read_config_32(peer->rdev, RIO_WRITE_PORT_CSR, &pwdcsr);
-                if (pwdcsr & RIO_DOORBELL_AVAIL)
-                        rio_send_doorbell(peer->rdev, RIONET_DOORBELL_JOIN);
+                /* Send a join message */
+                rio_send_doorbell(peer->rdev, RIONET_DOORBELL_JOIN);
         }
 
       out:
@@ -492,7 +486,7 @@ static int rionet_setup_netdev(struct rio_mport *mport, struct net_device *ndev)
 static int rionet_probe(struct rio_dev *rdev, const struct rio_device_id *id)
 {
         int rc = -ENODEV;
-        u32 lpef, lsrc_ops, ldst_ops;
+        u32 lsrc_ops, ldst_ops;
         struct rionet_peer *peer;
         struct net_device *ndev = NULL;
 
@@ -515,12 +509,11 @@ static int rionet_probe(struct rio_dev *rdev, const struct rio_device_id *id)
          * on later probes
          */
         if (!rionet_check) {
-                rio_local_read_config_32(rdev->net->hport, RIO_PEF_CAR, &lpef);
                 rio_local_read_config_32(rdev->net->hport, RIO_SRC_OPS_CAR,
                                          &lsrc_ops);
                 rio_local_read_config_32(rdev->net->hport, RIO_DST_OPS_CAR,
                                          &ldst_ops);
-                if (!is_rionet_capable(lpef, lsrc_ops, ldst_ops)) {
+                if (!is_rionet_capable(lsrc_ops, ldst_ops)) {
                         printk(KERN_ERR
                                "%s: local device is not network capable\n",
                                DRV_NAME);
diff --git a/drivers/net/sfc/efx.c b/drivers/net/sfc/efx.c
index faca764aa21b..b59abc706d93 100644
--- a/drivers/net/sfc/efx.c
+++ b/drivers/net/sfc/efx.c
@@ -1050,7 +1050,6 @@ static int efx_init_io(struct efx_nic *efx)
 {
         struct pci_dev *pci_dev = efx->pci_dev;
         dma_addr_t dma_mask = efx->type->max_dma_mask;
-        bool use_wc;
         int rc;
 
         netif_dbg(efx, probe, efx->net_dev, "initialising I/O\n");
@@ -1101,21 +1100,8 @@ static int efx_init_io(struct efx_nic *efx)
                 rc = -EIO;
                 goto fail3;
         }
-
-        /* bug22643: If SR-IOV is enabled then tx push over a write combined
-         * mapping is unsafe. We need to disable write combining in this case.
-         * MSI is unsupported when SR-IOV is enabled, and the firmware will
-         * have removed the MSI capability. So write combining is safe if
-         * there is an MSI capability.
-         */
-        use_wc = (!EFX_WORKAROUND_22643(efx) ||
-                  pci_find_capability(pci_dev, PCI_CAP_ID_MSI));
-        if (use_wc)
-                efx->membase = ioremap_wc(efx->membase_phys,
-                                          efx->type->mem_map_size);
-        else
-                efx->membase = ioremap_nocache(efx->membase_phys,
-                                               efx->type->mem_map_size);
+        efx->membase = ioremap_nocache(efx->membase_phys,
+                                       efx->type->mem_map_size);
         if (!efx->membase) {
                 netif_err(efx, probe, efx->net_dev,
                           "could not map memory BAR at %llx+%x\n",
diff --git a/drivers/net/sfc/io.h b/drivers/net/sfc/io.h
index cc978803d484..751d1ec112cc 100644
--- a/drivers/net/sfc/io.h
+++ b/drivers/net/sfc/io.h
@@ -103,7 +103,6 @@ static inline void efx_writeo(struct efx_nic *efx, efx_oword_t *value,
         _efx_writed(efx, value->u32[2], reg + 8);
         _efx_writed(efx, value->u32[3], reg + 12);
 #endif
-        wmb();
         mmiowb();
         spin_unlock_irqrestore(&efx->biu_lock, flags);
 }
@@ -126,7 +125,6 @@ static inline void efx_sram_writeq(struct efx_nic *efx, void __iomem *membase,
         __raw_writel((__force u32)value->u32[0], membase + addr);
         __raw_writel((__force u32)value->u32[1], membase + addr + 4);
 #endif
-        wmb();
         mmiowb();
         spin_unlock_irqrestore(&efx->biu_lock, flags);
 }
@@ -141,7 +139,6 @@ static inline void efx_writed(struct efx_nic *efx, efx_dword_t *value,
 
         /* No lock required */
         _efx_writed(efx, value->u32[0], reg);
-        wmb();
 }
 
 /* Read a 128-bit CSR, locking as appropriate. */
@@ -152,7 +149,6 @@ static inline void efx_reado(struct efx_nic *efx, efx_oword_t *value,
 
         spin_lock_irqsave(&efx->biu_lock, flags);
         value->u32[0] = _efx_readd(efx, reg + 0);
-        rmb();
         value->u32[1] = _efx_readd(efx, reg + 4);
         value->u32[2] = _efx_readd(efx, reg + 8);
         value->u32[3] = _efx_readd(efx, reg + 12);
@@ -175,7 +171,6 @@ static inline void efx_sram_readq(struct efx_nic *efx, void __iomem *membase,
         value->u64[0] = (__force __le64)__raw_readq(membase + addr);
 #else
         value->u32[0] = (__force __le32)__raw_readl(membase + addr);
-        rmb();
         value->u32[1] = (__force __le32)__raw_readl(membase + addr + 4);
 #endif
         spin_unlock_irqrestore(&efx->biu_lock, flags);
@@ -249,7 +244,6 @@ static inline void _efx_writeo_page(struct efx_nic *efx, efx_oword_t *value,
         _efx_writed(efx, value->u32[2], reg + 8);
         _efx_writed(efx, value->u32[3], reg + 12);
 #endif
-        wmb();
 }
 #define efx_writeo_page(efx, value, reg, page)                          \
         _efx_writeo_page(efx, value,                                    \
diff --git a/drivers/net/sfc/mcdi.c b/drivers/net/sfc/mcdi.c
index 3dd45ed61f0a..81a425397468 100644
--- a/drivers/net/sfc/mcdi.c
+++ b/drivers/net/sfc/mcdi.c
@@ -50,20 +50,6 @@ static inline struct efx_mcdi_iface *efx_mcdi(struct efx_nic *efx)
         return &nic_data->mcdi;
 }
 
-static inline void
-efx_mcdi_readd(struct efx_nic *efx, efx_dword_t *value, unsigned reg)
-{
-        struct siena_nic_data *nic_data = efx->nic_data;
-        value->u32[0] = (__force __le32)__raw_readl(nic_data->mcdi_smem + reg);
-}
-
-static inline void
-efx_mcdi_writed(struct efx_nic *efx, const efx_dword_t *value, unsigned reg)
-{
-        struct siena_nic_data *nic_data = efx->nic_data;
-        __raw_writel((__force u32)value->u32[0], nic_data->mcdi_smem + reg);
-}
-
 void efx_mcdi_init(struct efx_nic *efx)
 {
         struct efx_mcdi_iface *mcdi;
@@ -84,8 +70,8 @@ static void efx_mcdi_copyin(struct efx_nic *efx, unsigned cmd,
                             const u8 *inbuf, size_t inlen)
 {
         struct efx_mcdi_iface *mcdi = efx_mcdi(efx);
-        unsigned pdu = MCDI_PDU(efx);
-        unsigned doorbell = MCDI_DOORBELL(efx);
+        unsigned pdu = FR_CZ_MC_TREG_SMEM + MCDI_PDU(efx);
+        unsigned doorbell = FR_CZ_MC_TREG_SMEM + MCDI_DOORBELL(efx);
         unsigned int i;
         efx_dword_t hdr;
         u32 xflags, seqno;
@@ -106,28 +92,29 @@ static void efx_mcdi_copyin(struct efx_nic *efx, unsigned cmd,
                              MCDI_HEADER_SEQ, seqno,
                              MCDI_HEADER_XFLAGS, xflags);
 
-        efx_mcdi_writed(efx, &hdr, pdu);
+        efx_writed(efx, &hdr, pdu);
 
         for (i = 0; i < inlen; i += 4)
-                efx_mcdi_writed(efx, (const efx_dword_t *)(inbuf + i),
-                                pdu + 4 + i);
+                _efx_writed(efx, *((__le32 *)(inbuf + i)), pdu + 4 + i);
+
+        /* Ensure the payload is written out before the header */
+        wmb();
 
         /* ring the doorbell with a distinctive value */
-        EFX_POPULATE_DWORD_1(hdr, EFX_DWORD_0, 0x45789abc);
-        efx_mcdi_writed(efx, &hdr, doorbell);
+        _efx_writed(efx, (__force __le32) 0x45789abc, doorbell);
 }
 
 static void efx_mcdi_copyout(struct efx_nic *efx, u8 *outbuf, size_t outlen)
 {
         struct efx_mcdi_iface *mcdi = efx_mcdi(efx);
-        unsigned int pdu = MCDI_PDU(efx);
+        unsigned int pdu = FR_CZ_MC_TREG_SMEM + MCDI_PDU(efx);
         int i;
 
         BUG_ON(atomic_read(&mcdi->state) == MCDI_STATE_QUIESCENT);
         BUG_ON(outlen & 3 || outlen >= 0x100);
 
         for (i = 0; i < outlen; i += 4)
-                efx_mcdi_readd(efx, (efx_dword_t *)(outbuf + i), pdu + 4 + i);
+                *((__le32 *)(outbuf + i)) = _efx_readd(efx, pdu + 4 + i);
 }
 
 static int efx_mcdi_poll(struct efx_nic *efx)
@@ -135,7 +122,7 @@ static int efx_mcdi_poll(struct efx_nic *efx)
         struct efx_mcdi_iface *mcdi = efx_mcdi(efx);
         unsigned int time, finish;
         unsigned int respseq, respcmd, error;
-        unsigned int pdu = MCDI_PDU(efx);
+        unsigned int pdu = FR_CZ_MC_TREG_SMEM + MCDI_PDU(efx);
         unsigned int rc, spins;
         efx_dword_t reg;
 
@@ -161,7 +148,8 @@ static int efx_mcdi_poll(struct efx_nic *efx)
 
                 time = get_seconds();
 
-                efx_mcdi_readd(efx, &reg, pdu);
+                rmb();
+                efx_readd(efx, &reg, pdu);
 
                 /* All 1's indicates that shared memory is in reset (and is
                  * not a valid header). Wait for it to come out reset before
@@ -188,7 +176,7 @@ static int efx_mcdi_poll(struct efx_nic *efx)
                           respseq, mcdi->seqno);
                 rc = EIO;
         } else if (error) {
-                efx_mcdi_readd(efx, &reg, pdu + 4);
+                efx_readd(efx, &reg, pdu + 4);
                 switch (EFX_DWORD_FIELD(reg, EFX_DWORD_0)) {
 #define TRANSLATE_ERROR(name)                                   \
                 case MC_CMD_ERR_ ## name:                       \
@@ -222,21 +210,21 @@ out:
 /* Test and clear MC-rebooted flag for this port/function */
 int efx_mcdi_poll_reboot(struct efx_nic *efx)
 {
-        unsigned int addr = MCDI_REBOOT_FLAG(efx);
+        unsigned int addr = FR_CZ_MC_TREG_SMEM + MCDI_REBOOT_FLAG(efx);
         efx_dword_t reg;
         uint32_t value;
 
         if (efx_nic_rev(efx) < EFX_REV_SIENA_A0)
                 return false;
 
-        efx_mcdi_readd(efx, &reg, addr);
+        efx_readd(efx, &reg, addr);
         value = EFX_DWORD_FIELD(reg, EFX_DWORD_0);
 
         if (value == 0)
                 return 0;
 
         EFX_ZERO_DWORD(reg);
-        efx_mcdi_writed(efx, &reg, addr);
+        efx_writed(efx, &reg, addr);
 
         if (value == MC_STATUS_DWORD_ASSERT)
                 return -EINTR;
diff --git a/drivers/net/sfc/nic.c b/drivers/net/sfc/nic.c
index bafa23a6874c..3edfbaf5f022 100644
--- a/drivers/net/sfc/nic.c
+++ b/drivers/net/sfc/nic.c
@@ -1936,13 +1936,6 @@ void efx_nic_get_regs(struct efx_nic *efx, void *buf)
 
                 size = min_t(size_t, table->step, 16);
 
-                if (table->offset >= efx->type->mem_map_size) {
-                        /* No longer mapped; return dummy data */
-                        memcpy(buf, "\xde\xc0\xad\xde", 4);
-                        buf += table->rows * size;
-                        continue;
-                }
-
                 for (i = 0; i < table->rows; i++) {
                         switch (table->step) {
                         case 4: /* 32-bit register or SRAM */
diff --git a/drivers/net/sfc/nic.h b/drivers/net/sfc/nic.h
index 4bd1f2839dfe..7443f99c977f 100644
--- a/drivers/net/sfc/nic.h
+++ b/drivers/net/sfc/nic.h
@@ -143,12 +143,10 @@ static inline struct falcon_board *falcon_board(struct efx_nic *efx)
 /**
  * struct siena_nic_data - Siena NIC state
  * @mcdi: Management-Controller-to-Driver Interface
- * @mcdi_smem: MCDI shared memory mapping. The mapping is always uncacheable.
  * @wol_filter_id: Wake-on-LAN packet filter id
  */
 struct siena_nic_data {
         struct efx_mcdi_iface mcdi;
-        void __iomem *mcdi_smem;
         int wol_filter_id;
 };
 
diff --git a/drivers/net/sfc/siena.c b/drivers/net/sfc/siena.c
index 5735e84c69de..2c3bd93fab54 100644
--- a/drivers/net/sfc/siena.c
+++ b/drivers/net/sfc/siena.c
@@ -250,26 +250,12 @@ static int siena_probe_nic(struct efx_nic *efx)
         efx_reado(efx, &reg, FR_AZ_CS_DEBUG);
         efx->net_dev->dev_id = EFX_OWORD_FIELD(reg, FRF_CZ_CS_PORT_NUM) - 1;
 
-        /* Initialise MCDI */
-        nic_data->mcdi_smem = ioremap_nocache(efx->membase_phys +
-                                              FR_CZ_MC_TREG_SMEM,
-                                              FR_CZ_MC_TREG_SMEM_STEP *
-                                              FR_CZ_MC_TREG_SMEM_ROWS);
-        if (!nic_data->mcdi_smem) {
-                netif_err(efx, probe, efx->net_dev,
-                          "could not map MCDI at %llx+%x\n",
-                          (unsigned long long)efx->membase_phys +
-                          FR_CZ_MC_TREG_SMEM,
-                          FR_CZ_MC_TREG_SMEM_STEP * FR_CZ_MC_TREG_SMEM_ROWS);
-                rc = -ENOMEM;
-                goto fail1;
-        }
         efx_mcdi_init(efx);
 
         /* Recover from a failed assertion before probing */
         rc = efx_mcdi_handle_assertion(efx);
         if (rc)
-                goto fail2;
+                goto fail1;
 
         /* Let the BMC know that the driver is now in charge of link and
          * filter settings. We must do this before we reset the NIC */
@@ -324,7 +310,6 @@ fail4:
 fail3:
         efx_mcdi_drv_attach(efx, false, NULL);
 fail2:
-        iounmap(nic_data->mcdi_smem);
 fail1:
         kfree(efx->nic_data);
         return rc;
@@ -404,8 +389,6 @@ static int siena_init_nic(struct efx_nic *efx)
 
 static void siena_remove_nic(struct efx_nic *efx)
 {
-        struct siena_nic_data *nic_data = efx->nic_data;
-
         efx_nic_free_buffer(efx, &efx->irq_status);
 
         siena_reset_hw(efx, RESET_TYPE_ALL);
@@ -415,8 +398,7 @@ static void siena_remove_nic(struct efx_nic *efx)
                 efx_mcdi_drv_attach(efx, false, NULL);
 
         /* Tear down the private nic state */
-        iounmap(nic_data->mcdi_smem);
-        kfree(nic_data);
+        kfree(efx->nic_data);
         efx->nic_data = NULL;
 }
 
@@ -656,7 +638,8 @@ const struct efx_nic_type siena_a0_nic_type = {
         .default_mac_ops = &efx_mcdi_mac_operations,
 
         .revision = EFX_REV_SIENA_A0,
-        .mem_map_size = FR_CZ_MC_TREG_SMEM, /* MC_TREG_SMEM mapped separately */
+        .mem_map_size = (FR_CZ_MC_TREG_SMEM +
+                         FR_CZ_MC_TREG_SMEM_STEP * FR_CZ_MC_TREG_SMEM_ROWS),
         .txd_ptr_tbl_base = FR_BZ_TX_DESC_PTR_TBL,
         .rxd_ptr_tbl_base = FR_BZ_RX_DESC_PTR_TBL,
         .buf_tbl_base = FR_BZ_BUF_FULL_TBL,
diff --git a/drivers/net/sfc/workarounds.h b/drivers/net/sfc/workarounds.h
index 99ff11400cef..e4dd3a7f304b 100644
--- a/drivers/net/sfc/workarounds.h
+++ b/drivers/net/sfc/workarounds.h
@@ -38,8 +38,6 @@
 #define EFX_WORKAROUND_15783 EFX_WORKAROUND_ALWAYS
 /* Legacy interrupt storm when interrupt fifo fills */
 #define EFX_WORKAROUND_17213 EFX_WORKAROUND_SIENA
-/* Write combining and sriov=enabled are incompatible */
-#define EFX_WORKAROUND_22643 EFX_WORKAROUND_SIENA
 
 /* Spurious parity errors in TSORT buffers */
 #define EFX_WORKAROUND_5129 EFX_WORKAROUND_FALCON_A
diff --git a/drivers/net/sh_eth.c b/drivers/net/sh_eth.c
index ad35c210b839..1c1666e99106 100644
--- a/drivers/net/sh_eth.c
+++ b/drivers/net/sh_eth.c
@@ -21,6 +21,7 @@
  */
 
 #include <linux/init.h>
+#include <linux/interrupt.h>
 #include <linux/dma-mapping.h>
 #include <linux/etherdevice.h>
 #include <linux/delay.h>
@@ -30,6 +31,7 @@
 #include <linux/phy.h>
 #include <linux/cache.h>
 #include <linux/io.h>
+#include <linux/interrupt.h>
 #include <linux/pm_runtime.h>
 #include <linux/slab.h>
 #include <linux/ethtool.h>
diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
index dc3fbf61910b..4a1374df6084 100644
--- a/drivers/net/tg3.c
+++ b/drivers/net/tg3.c
@@ -6234,12 +6234,10 @@ static netdev_tx_t tg3_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 }
         }
 
-#ifdef BCM_KERNEL_SUPPORTS_8021Q
         if (vlan_tx_tag_present(skb)) {
                 base_flags |= TXD_FLAG_VLAN;
                 vlan = vlan_tx_tag_get(skb);
         }
-#endif
 
         if (tg3_flag(tp, USE_JUMBO_BDFLAG) &&
             !mss && skb->len > VLAN_ETH_FRAME_LEN)
diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
index a03336e086d5..f06fb78383a1 100644
--- a/drivers/net/usb/cdc_ncm.c
+++ b/drivers/net/usb/cdc_ncm.c
@@ -228,23 +228,40 @@ static u8 cdc_ncm_setup(struct cdc_ncm_ctx *ctx)
         if (ctx->rx_max != le32_to_cpu(ctx->ncm_parm.dwNtbInMaxSize)) {
 
                 if (flags & USB_CDC_NCM_NCAP_NTB_INPUT_SIZE) {
-                        struct usb_cdc_ncm_ndp_input_size ndp_in_sz;
+                        struct usb_cdc_ncm_ndp_input_size *ndp_in_sz;
+
+                        ndp_in_sz = kzalloc(sizeof(*ndp_in_sz), GFP_KERNEL);
+                        if (!ndp_in_sz) {
+                                err = -ENOMEM;
+                                goto size_err;
+                        }
+
                         err = usb_control_msg(ctx->udev,
                                         usb_sndctrlpipe(ctx->udev, 0),
                                         USB_CDC_SET_NTB_INPUT_SIZE,
                                         USB_TYPE_CLASS | USB_DIR_OUT
                                          | USB_RECIP_INTERFACE,
-                                        0, iface_no, &ndp_in_sz, 8, 1000);
+                                        0, iface_no, ndp_in_sz, 8, 1000);
+                        kfree(ndp_in_sz);
                 } else {
-                        __le32 dwNtbInMaxSize = cpu_to_le32(ctx->rx_max);
+                        __le32 *dwNtbInMaxSize;
+                        dwNtbInMaxSize = kzalloc(sizeof(*dwNtbInMaxSize),
+                                        GFP_KERNEL);
+                        if (!dwNtbInMaxSize) {
+                                err = -ENOMEM;
+                                goto size_err;
+                        }
+                        *dwNtbInMaxSize = cpu_to_le32(ctx->rx_max);
+
                         err = usb_control_msg(ctx->udev,
                                         usb_sndctrlpipe(ctx->udev, 0),
                                         USB_CDC_SET_NTB_INPUT_SIZE,
                                         USB_TYPE_CLASS | USB_DIR_OUT
                                          | USB_RECIP_INTERFACE,
-                                        0, iface_no, &dwNtbInMaxSize, 4, 1000);
+                                        0, iface_no, dwNtbInMaxSize, 4, 1000);
+                        kfree(dwNtbInMaxSize);
                 }
-
+size_err:
                 if (err < 0)
                         pr_debug("Setting NTB Input Size failed\n");
         }
@@ -325,19 +342,29 @@ static u8 cdc_ncm_setup(struct cdc_ncm_ctx *ctx)
 
         /* set Max Datagram Size (MTU) */
         if (flags & USB_CDC_NCM_NCAP_MAX_DATAGRAM_SIZE) {
-                __le16 max_datagram_size;
+                __le16 *max_datagram_size;
                 u16 eth_max_sz = le16_to_cpu(ctx->ether_desc->wMaxSegmentSize);
+
+                max_datagram_size = kzalloc(sizeof(*max_datagram_size),
+                                GFP_KERNEL);
+                if (!max_datagram_size) {
+                        err = -ENOMEM;
+                        goto max_dgram_err;
+                }
+
                 err = usb_control_msg(ctx->udev, usb_rcvctrlpipe(ctx->udev, 0),
                                 USB_CDC_GET_MAX_DATAGRAM_SIZE,
                                 USB_TYPE_CLASS | USB_DIR_IN
                                  | USB_RECIP_INTERFACE,
-                                0, iface_no, &max_datagram_size,
+                                0, iface_no, max_datagram_size,
                                 2, 1000);
                 if (err < 0) {
                         pr_debug("GET_MAX_DATAGRAM_SIZE failed, use size=%u\n",
                                                 CDC_NCM_MIN_DATAGRAM_SIZE);
+                        kfree(max_datagram_size);
                 } else {
-                        ctx->max_datagram_size = le16_to_cpu(max_datagram_size);
+                        ctx->max_datagram_size =
+                                le16_to_cpu(*max_datagram_size);
                         /* Check Eth descriptor value */
                         if (eth_max_sz < CDC_NCM_MAX_DATAGRAM_SIZE) {
                                 if (ctx->max_datagram_size > eth_max_sz)
@@ -360,8 +387,10 @@ static u8 cdc_ncm_setup(struct cdc_ncm_ctx *ctx)
                                                 USB_TYPE_CLASS | USB_DIR_OUT
                                                  | USB_RECIP_INTERFACE,
                                                 0,
-                                                iface_no, &max_datagram_size,
+                                                iface_no, max_datagram_size,
                                                 2, 1000);
+                        kfree(max_datagram_size);
+max_dgram_err:
                         if (err < 0)
                                 pr_debug("SET_MAX_DATAGRAM_SIZE failed\n");
                 }
diff --git a/drivers/net/usb/ipheth.c b/drivers/net/usb/ipheth.c
index 15772b1b6a91..13c1f044b40d 100644
--- a/drivers/net/usb/ipheth.c
+++ b/drivers/net/usb/ipheth.c
@@ -59,6 +59,7 @@
 #define USB_PRODUCT_IPHONE_3G   0x1292
 #define USB_PRODUCT_IPHONE_3GS  0x1294
 #define USB_PRODUCT_IPHONE_4    0x1297
+#define USB_PRODUCT_IPHONE_4_VZW 0x129c
 
 #define IPHETH_USBINTF_CLASS    255
 #define IPHETH_USBINTF_SUBCLASS 253
@@ -98,6 +99,10 @@ static struct usb_device_id ipheth_table[] = {
                 USB_VENDOR_APPLE, USB_PRODUCT_IPHONE_4,
                 IPHETH_USBINTF_CLASS, IPHETH_USBINTF_SUBCLASS,
                 IPHETH_USBINTF_PROTO) },
+        { USB_DEVICE_AND_INTERFACE_INFO(
+                USB_VENDOR_APPLE, USB_PRODUCT_IPHONE_4_VZW,
+                IPHETH_USBINTF_CLASS, IPHETH_USBINTF_SUBCLASS,
+                IPHETH_USBINTF_PROTO) },
         { }
 };
 MODULE_DEVICE_TABLE(usb, ipheth_table);
diff --git a/drivers/net/via-velocity.c b/drivers/net/via-velocity.c
index deb1eca13c9f..7c5336c5c37f 100644
--- a/drivers/net/via-velocity.c
+++ b/drivers/net/via-velocity.c
@@ -515,10 +515,6 @@ static void velocity_init_cam_filter(struct velocity_info *vptr)
         mac_set_cam_mask(regs, vptr->mCAMmask);
 
         /* Enable VCAMs */
-
-        if (test_bit(0, vptr->active_vlans))
-                WORD_REG_BITS_ON(MCFG_RTGOPT, &regs->MCFG);
-
         for_each_set_bit(vid, vptr->active_vlans, VLAN_N_VID) {
                 mac_set_vlan_cam(regs, i, (u8 *) &vid);
                 vptr->vCAMmask[i / 8] |= 0x1 << (i % 8);
diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
index 1cbacb389652..0959583feb27 100644
--- a/drivers/net/vmxnet3/vmxnet3_drv.c
+++ b/drivers/net/vmxnet3/vmxnet3_drv.c
@@ -1929,14 +1929,17 @@ static void
 vmxnet3_vlan_rx_add_vid(struct net_device *netdev, u16 vid)
 {
         struct vmxnet3_adapter *adapter = netdev_priv(netdev);
-        u32 *vfTable = adapter->shared->devRead.rxFilterConf.vfTable;
-        unsigned long flags;
 
-        VMXNET3_SET_VFTABLE_ENTRY(vfTable, vid);
-        spin_lock_irqsave(&adapter->cmd_lock, flags);
-        VMXNET3_WRITE_BAR1_REG(adapter, VMXNET3_REG_CMD,
-                               VMXNET3_CMD_UPDATE_VLAN_FILTERS);
-        spin_unlock_irqrestore(&adapter->cmd_lock, flags);
+        if (!(netdev->flags & IFF_PROMISC)) {
+                u32 *vfTable = adapter->shared->devRead.rxFilterConf.vfTable;
+                unsigned long flags;
+
+                VMXNET3_SET_VFTABLE_ENTRY(vfTable, vid);
+                spin_lock_irqsave(&adapter->cmd_lock, flags);
+                VMXNET3_WRITE_BAR1_REG(adapter, VMXNET3_REG_CMD,
+                                       VMXNET3_CMD_UPDATE_VLAN_FILTERS);
+                spin_unlock_irqrestore(&adapter->cmd_lock, flags);
+        }
 
         set_bit(vid, adapter->active_vlans);
 }
@@ -1946,14 +1949,17 @@ static void
 vmxnet3_vlan_rx_kill_vid(struct net_device *netdev, u16 vid)
 {
         struct vmxnet3_adapter *adapter = netdev_priv(netdev);
-        u32 *vfTable = adapter->shared->devRead.rxFilterConf.vfTable;
-        unsigned long flags;
 
-        VMXNET3_CLEAR_VFTABLE_ENTRY(vfTable, vid);
-        spin_lock_irqsave(&adapter->cmd_lock, flags);
-        VMXNET3_WRITE_BAR1_REG(adapter, VMXNET3_REG_CMD,
-                               VMXNET3_CMD_UPDATE_VLAN_FILTERS);
-        spin_unlock_irqrestore(&adapter->cmd_lock, flags);
+        if (!(netdev->flags & IFF_PROMISC)) {
+                u32 *vfTable = adapter->shared->devRead.rxFilterConf.vfTable;
+                unsigned long flags;
+
+                VMXNET3_CLEAR_VFTABLE_ENTRY(vfTable, vid);
+                spin_lock_irqsave(&adapter->cmd_lock, flags);
+                VMXNET3_WRITE_BAR1_REG(adapter, VMXNET3_REG_CMD,
+                                       VMXNET3_CMD_UPDATE_VLAN_FILTERS);
+                spin_unlock_irqrestore(&adapter->cmd_lock, flags);
+        }
 
         clear_bit(vid, adapter->active_vlans);
 }
diff --git a/drivers/net/wireless/ath/ath9k/ar9002_calib.c b/drivers/net/wireless/ath/ath9k/ar9002_calib.c
index 2d4c0910295b..2d394af82171 100644
--- a/drivers/net/wireless/ath/ath9k/ar9002_calib.c
+++ b/drivers/net/wireless/ath/ath9k/ar9002_calib.c
@@ -41,7 +41,8 @@ static bool ar9002_hw_is_cal_supported(struct ath_hw *ah,
         case ADC_DC_CAL:
                 /* Run ADC Gain Cal for non-CCK & non 2GHz-HT20 only */
                 if (!IS_CHAN_B(chan) &&
-                    !(IS_CHAN_2GHZ(chan) && IS_CHAN_HT20(chan)))
+                    !((IS_CHAN_2GHZ(chan) || IS_CHAN_A_FAST_CLOCK(ah, chan)) &&
+                      IS_CHAN_HT20(chan)))
                         supported = true;
                 break;
         }
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h b/drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h
index 2339728a7306..3e69c631ebb4 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h
+++ b/drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h
@@ -1514,7 +1514,7 @@ static const u32 ar9300_2p2_mac_core[][2] = {
         {0x00008258, 0x00000000},
         {0x0000825c, 0x40000000},
         {0x00008260, 0x00080922},
-        {0x00008264, 0x9bc00010},
+        {0x00008264, 0x9d400010},
         {0x00008268, 0xffffffff},
         {0x0000826c, 0x0000ffff},
         {0x00008270, 0x00000000},
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
index c34bef1bf2b0..1b9400371eaf 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
@@ -69,7 +69,7 @@ static int ar9003_hw_power_interpolate(int32_t x,
 static const struct ar9300_eeprom ar9300_default = {
         .eepromVersion = 2,
         .templateVersion = 2,
-        .macAddr = {1, 2, 3, 4, 5, 6},
+        .macAddr = {0, 2, 3, 4, 5, 6},
         .custData = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
                      0, 0, 0, 0, 0, 0, 0, 0, 0, 0},
         .baseEepHeader = {
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.c b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
index 1baca8e4715d..fcafec0605f4 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
@@ -671,7 +671,7 @@ static int ar9003_hw_process_ini(struct ath_hw *ah,
                 REG_WRITE_ARRAY(&ah->iniModesAdditional,
                                 modesIndex, regWrites);
 
-        if (AR_SREV_9300(ah))
+        if (AR_SREV_9330(ah))
                 REG_WRITE_ARRAY(&ah->iniModesAdditional, 1, regWrites);
 
         if (AR_SREV_9340(ah) && !ah->is_clk_25mhz)
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index 9098aaad97a9..722967b86cf1 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -2283,7 +2283,11 @@ static void ath9k_set_coverage_class(struct ieee80211_hw *hw, u8 coverage_class)
 
         mutex_lock(&sc->mutex);
         ah->coverage_class = coverage_class;
+
+        ath9k_ps_wakeup(sc);
         ath9k_hw_init_global_settings(ah);
+        ath9k_ps_restore(sc);
+
         mutex_unlock(&sc->mutex);
 }
 
@@ -2299,6 +2303,12 @@ static void ath9k_flush(struct ieee80211_hw *hw, bool drop)
         mutex_lock(&sc->mutex);
         cancel_delayed_work_sync(&sc->tx_complete_work);
 
+        if (ah->ah_flags & AH_UNPLUGGED) {
+                ath_dbg(common, ATH_DBG_ANY, "Device has been unplugged!\n");
+                mutex_unlock(&sc->mutex);
+                return;
+        }
+
         if (sc->sc_flags & SC_OP_INVALID) {
                 ath_dbg(common, ATH_DBG_ANY, "Device not present\n");
                 mutex_unlock(&sc->mutex);
diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c
index 9a4850154fb2..4c21f8cbdeb5 100644
--- a/drivers/net/wireless/ath/ath9k/recv.c
+++ b/drivers/net/wireless/ath/ath9k/recv.c
@@ -205,14 +205,22 @@ static void ath_rx_remove_buffer(struct ath_softc *sc,
 
 static void ath_rx_edma_cleanup(struct ath_softc *sc)
 {
+        struct ath_hw *ah = sc->sc_ah;
+        struct ath_common *common = ath9k_hw_common(ah);
         struct ath_buf *bf;
 
         ath_rx_remove_buffer(sc, ATH9K_RX_QUEUE_LP);
         ath_rx_remove_buffer(sc, ATH9K_RX_QUEUE_HP);
 
         list_for_each_entry(bf, &sc->rx.rxbuf, list) {
-                if (bf->bf_mpdu)
+                if (bf->bf_mpdu) {
+                        dma_unmap_single(sc->dev, bf->bf_buf_addr,
+                                        common->rx_bufsize,
+                                        DMA_BIDIRECTIONAL);
                         dev_kfree_skb_any(bf->bf_mpdu);
+                        bf->bf_buf_addr = 0;
+                        bf->bf_mpdu = NULL;
+                }
         }
 
         INIT_LIST_HEAD(&sc->rx.rxbuf);
diff --git a/drivers/net/wireless/ath/carl9170/main.c b/drivers/net/wireless/ath/carl9170/main.c
index 0122930b14c7..0474e6638d21 100644
--- a/drivers/net/wireless/ath/carl9170/main.c
+++ b/drivers/net/wireless/ath/carl9170/main.c
@@ -1066,8 +1066,10 @@ static int carl9170_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
          * the high througput speed in 802.11n networks.
          */
 
-        if (!is_main_vif(ar, vif))
+        if (!is_main_vif(ar, vif)) {
+                mutex_lock(&ar->mutex);
                 goto err_softw;
+        }
 
         /*
          * While the hardware supports *catch-all* key, for offloading
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index 26f1ab840cc7..e293a7921bf0 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -1632,7 +1632,8 @@ static void handle_irq_beacon(struct b43_wldev *dev)
         u32 cmd, beacon0_valid, beacon1_valid;
 
         if (!b43_is_mode(wl, NL80211_IFTYPE_AP) &&
-            !b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT))
+            !b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT) &&
+            !b43_is_mode(wl, NL80211_IFTYPE_ADHOC))
                 return;
 
         /* This is the bottom half of the asynchronous beacon update. */
diff --git a/drivers/net/wireless/ipw2x00/ipw2100.c b/drivers/net/wireless/ipw2x00/ipw2100.c
index 3774dd034746..ef9ad79d1bfd 100644
--- a/drivers/net/wireless/ipw2x00/ipw2100.c
+++ b/drivers/net/wireless/ipw2x00/ipw2100.c
@@ -1903,15 +1903,17 @@ static void ipw2100_down(struct ipw2100_priv *priv)
 static int ipw2100_net_init(struct net_device *dev)
 {
         struct ipw2100_priv *priv = libipw_priv(dev);
+
+        return ipw2100_up(priv, 1);
+}
+
+static int ipw2100_wdev_init(struct net_device *dev)
+{
+        struct ipw2100_priv *priv = libipw_priv(dev);
         const struct libipw_geo *geo = libipw_get_geo(priv->ieee);
         struct wireless_dev *wdev = &priv->ieee->wdev;
-        int ret;
         int i;
 
-        ret = ipw2100_up(priv, 1);
-        if (ret)
-                return ret;
-
         memcpy(wdev->wiphy->perm_addr, priv->mac_addr, ETH_ALEN);
 
         /* fill-out priv->ieee->bg_band */
@@ -6350,9 +6352,13 @@ static int ipw2100_pci_init_one(struct pci_dev *pci_dev,
                        "Error calling register_netdev.\n");
                 goto fail;
         }
+        registered = 1;
+
+        err = ipw2100_wdev_init(dev);
+        if (err)
+                goto fail;
 
         mutex_lock(&priv->action_mutex);
-        registered = 1;
 
         IPW_DEBUG_INFO("%s: Bound to %s\n", dev->name, pci_name(pci_dev));
 
@@ -6389,7 +6395,8 @@ static int ipw2100_pci_init_one(struct pci_dev *pci_dev,
 
       fail_unlock:
         mutex_unlock(&priv->action_mutex);
-
+        wiphy_unregister(priv->ieee->wdev.wiphy);
+        kfree(priv->ieee->bg_band.channels);
       fail:
         if (dev) {
                 if (registered)
diff --git a/drivers/net/wireless/ipw2x00/ipw2200.c b/drivers/net/wireless/ipw2x00/ipw2200.c
index 87813c33bdc2..4ffebede5e03 100644
--- a/drivers/net/wireless/ipw2x00/ipw2200.c
+++ b/drivers/net/wireless/ipw2x00/ipw2200.c
@@ -11425,16 +11425,23 @@ static void ipw_bg_down(struct work_struct *work)
 /* Called by register_netdev() */
 static int ipw_net_init(struct net_device *dev)
 {
+        int rc = 0;
+        struct ipw_priv *priv = libipw_priv(dev);
+
+        mutex_lock(&priv->mutex);
+        if (ipw_up(priv))
+                rc = -EIO;
+        mutex_unlock(&priv->mutex);
+
+        return rc;
+}
+
+static int ipw_wdev_init(struct net_device *dev)
+{
         int i, rc = 0;
         struct ipw_priv *priv = libipw_priv(dev);
         const struct libipw_geo *geo = libipw_get_geo(priv->ieee);
         struct wireless_dev *wdev = &priv->ieee->wdev;
-        mutex_lock(&priv->mutex);
-
-        if (ipw_up(priv)) {
-                rc = -EIO;
-                goto out;
-        }
 
         memcpy(wdev->wiphy->perm_addr, priv->mac_addr, ETH_ALEN);
 
@@ -11519,13 +11526,9 @@ static int ipw_net_init(struct net_device *dev)
         set_wiphy_dev(wdev->wiphy, &priv->pci_dev->dev);
 
         /* With that information in place, we can now register the wiphy... */
-        if (wiphy_register(wdev->wiphy)) {
+        if (wiphy_register(wdev->wiphy))
                 rc = -EIO;
-                goto out;
-        }
-
 out:
-        mutex_unlock(&priv->mutex);
         return rc;
 }
 
@@ -11832,14 +11835,22 @@ static int __devinit ipw_pci_probe(struct pci_dev *pdev,
                 goto out_remove_sysfs;
         }
 
+        err = ipw_wdev_init(net_dev);
+        if (err) {
+                IPW_ERROR("failed to register wireless device\n");
+                goto out_unregister_netdev;
+        }
+
 #ifdef CONFIG_IPW2200_PROMISCUOUS
         if (rtap_iface) {
                 err = ipw_prom_alloc(priv);
                 if (err) {
                         IPW_ERROR("Failed to register promiscuous network "
                                   "device (error %d).\n", err);
-                        unregister_netdev(priv->net_dev);
-                        goto out_remove_sysfs;
+                        wiphy_unregister(priv->ieee->wdev.wiphy);
+                        kfree(priv->ieee->a_band.channels);
+                        kfree(priv->ieee->bg_band.channels);
+                        goto out_unregister_netdev;
                 }
         }
 #endif
@@ -11851,6 +11862,8 @@ static int __devinit ipw_pci_probe(struct pci_dev *pdev,
 
         return 0;
 
+      out_unregister_netdev:
+        unregister_netdev(priv->net_dev);
       out_remove_sysfs:
         sysfs_remove_group(&pdev->dev.kobj, &ipw_attribute_group);
       out_release_irq:
diff --git a/drivers/net/wireless/iwlegacy/iwl-3945-rs.c b/drivers/net/wireless/iwlegacy/iwl-3945-rs.c
index 977bd2477c6a..164bcae821f8 100644
--- a/drivers/net/wireless/iwlegacy/iwl-3945-rs.c
+++ b/drivers/net/wireless/iwlegacy/iwl-3945-rs.c
@@ -822,12 +822,15 @@ static void iwl3945_rs_get_rate(void *priv_r, struct ieee80211_sta *sta,
 
  out:
 
-        rs_sta->last_txrate_idx = index;
-        if (sband->band == IEEE80211_BAND_5GHZ)
-                info->control.rates[0].idx = rs_sta->last_txrate_idx -
-                                IWL_FIRST_OFDM_RATE;
-        else
+        if (sband->band == IEEE80211_BAND_5GHZ) {
+                if (WARN_ON_ONCE(index < IWL_FIRST_OFDM_RATE))
+                        index = IWL_FIRST_OFDM_RATE;
+                rs_sta->last_txrate_idx = index;
+                info->control.rates[0].idx = index - IWL_FIRST_OFDM_RATE;
+        } else {
+                rs_sta->last_txrate_idx = index;
                 info->control.rates[0].idx = rs_sta->last_txrate_idx;
+        }
 
         IWL_DEBUG_RATE(priv, "leave: %d\n", index);
 }
diff --git a/drivers/net/wireless/iwlegacy/iwl-core.c b/drivers/net/wireless/iwlegacy/iwl-core.c
index 35cd2537e7fd..e5971fe9d169 100644
--- a/drivers/net/wireless/iwlegacy/iwl-core.c
+++ b/drivers/net/wireless/iwlegacy/iwl-core.c
@@ -937,7 +937,7 @@ void iwl_legacy_irq_handle_error(struct iwl_priv *priv)
                                         &priv->contexts[IWL_RXON_CTX_BSS]);
 #endif
 
-        wake_up_interruptible(&priv->wait_command_queue);
+        wake_up(&priv->wait_command_queue);
 
         /* Keep the restart process from trying to send host
          * commands by clearing the INIT status bit */
@@ -1746,7 +1746,7 @@ int iwl_legacy_force_reset(struct iwl_priv *priv, bool external)
 
         /* Set the FW error flag -- cleared on iwl_down */
         set_bit(STATUS_FW_ERROR, &priv->status);
-        wake_up_interruptible(&priv->wait_command_queue);
+        wake_up(&priv->wait_command_queue);
         /*
          * Keep the restart process from trying to send host
          * commands by clearing the INIT status bit
diff --git a/drivers/net/wireless/iwlegacy/iwl-hcmd.c b/drivers/net/wireless/iwlegacy/iwl-hcmd.c
index 62b4b09122cb..ce1fc9feb61f 100644
--- a/drivers/net/wireless/iwlegacy/iwl-hcmd.c
+++ b/drivers/net/wireless/iwlegacy/iwl-hcmd.c
@@ -167,7 +167,7 @@ int iwl_legacy_send_cmd_sync(struct iwl_priv *priv, struct iwl_host_cmd *cmd)
                 goto out;
         }
 
-        ret = wait_event_interruptible_timeout(priv->wait_command_queue,
+        ret = wait_event_timeout(priv->wait_command_queue,
                         !test_bit(STATUS_HCMD_ACTIVE, &priv->status),
                         HOST_COMPLETE_TIMEOUT);
         if (!ret) {
diff --git a/drivers/net/wireless/iwlegacy/iwl-tx.c b/drivers/net/wireless/iwlegacy/iwl-tx.c
index 4fff995c6f3e..ef9e268bf8a0 100644
--- a/drivers/net/wireless/iwlegacy/iwl-tx.c
+++ b/drivers/net/wireless/iwlegacy/iwl-tx.c
@@ -625,6 +625,8 @@ iwl_legacy_tx_cmd_complete(struct iwl_priv *priv, struct iwl_rx_mem_buffer *rxb)
         cmd = txq->cmd[cmd_index];
         meta = &txq->meta[cmd_index];
 
+        txq->time_stamp = jiffies;
+
         pci_unmap_single(priv->pci_dev,
                          dma_unmap_addr(meta, mapping),
                          dma_unmap_len(meta, len),
@@ -645,7 +647,7 @@ iwl_legacy_tx_cmd_complete(struct iwl_priv *priv, struct iwl_rx_mem_buffer *rxb)
                 clear_bit(STATUS_HCMD_ACTIVE, &priv->status);
                 IWL_DEBUG_INFO(priv, "Clearing HCMD_ACTIVE for command %s\n",
                                iwl_legacy_get_cmd_string(cmd->hdr.cmd));
-                wake_up_interruptible(&priv->wait_command_queue);
+                wake_up(&priv->wait_command_queue);
         }
 
         /* Mark as unmapped */
diff --git a/drivers/net/wireless/iwlegacy/iwl3945-base.c b/drivers/net/wireless/iwlegacy/iwl3945-base.c
index 795826a014ed..66ee15629a76 100644
--- a/drivers/net/wireless/iwlegacy/iwl3945-base.c
+++ b/drivers/net/wireless/iwlegacy/iwl3945-base.c
@@ -841,7 +841,7 @@ static void iwl3945_rx_card_state_notif(struct iwl_priv *priv,
                 wiphy_rfkill_set_hw_state(priv->hw->wiphy,
                                 test_bit(STATUS_RF_KILL_HW, &priv->status));
         else
-                wake_up_interruptible(&priv->wait_command_queue);
+                wake_up(&priv->wait_command_queue);
 }
 
 /**
@@ -2269,7 +2269,7 @@ static void iwl3945_alive_start(struct iwl_priv *priv)
         iwl3945_reg_txpower_periodic(priv);
 
         IWL_DEBUG_INFO(priv, "ALIVE processing complete.\n");
-        wake_up_interruptible(&priv->wait_command_queue);
+        wake_up(&priv->wait_command_queue);
 
         return;
 
@@ -2300,7 +2300,7 @@ static void __iwl3945_down(struct iwl_priv *priv)
         iwl_legacy_clear_driver_stations(priv);
 
         /* Unblock any waiting calls */
-        wake_up_interruptible_all(&priv->wait_command_queue);
+        wake_up_all(&priv->wait_command_queue);
 
         /* Wipe out the EXIT_PENDING status bit if we are not actually
          * exiting the module */
@@ -2853,7 +2853,7 @@ static int iwl3945_mac_start(struct ieee80211_hw *hw)
 
         /* Wait for START_ALIVE from ucode. Otherwise callbacks from
          * mac80211 will not be run successfully. */
-        ret = wait_event_interruptible_timeout(priv->wait_command_queue,
+        ret = wait_event_timeout(priv->wait_command_queue,
                         test_bit(STATUS_READY, &priv->status),
                         UCODE_READY_TIMEOUT);
         if (!ret) {
diff --git a/drivers/net/wireless/iwlegacy/iwl4965-base.c b/drivers/net/wireless/iwlegacy/iwl4965-base.c
index 14334668034e..aa0c2539761e 100644
--- a/drivers/net/wireless/iwlegacy/iwl4965-base.c
+++ b/drivers/net/wireless/iwlegacy/iwl4965-base.c
@@ -576,7 +576,7 @@ static void iwl4965_rx_card_state_notif(struct iwl_priv *priv,
                 wiphy_rfkill_set_hw_state(priv->hw->wiphy,
                         test_bit(STATUS_RF_KILL_HW, &priv->status));
         else
-                wake_up_interruptible(&priv->wait_command_queue);
+                wake_up(&priv->wait_command_queue);
 }
 
 /**
@@ -926,7 +926,7 @@ static void iwl4965_irq_tasklet(struct iwl_priv *priv)
                 handled |= CSR_INT_BIT_FH_TX;
                 /* Wake up uCode load routine, now that load is complete */
                 priv->ucode_write_complete = 1;
-                wake_up_interruptible(&priv->wait_command_queue);
+                wake_up(&priv->wait_command_queue);
         }
 
         if (inta & ~handled) {
@@ -1795,7 +1795,7 @@ static void iwl4965_alive_start(struct iwl_priv *priv)
         iwl4965_rf_kill_ct_config(priv);
 
         IWL_DEBUG_INFO(priv, "ALIVE processing complete.\n");
-        wake_up_interruptible(&priv->wait_command_queue);
+        wake_up(&priv->wait_command_queue);
 
         iwl_legacy_power_update_mode(priv, true);
         IWL_DEBUG_INFO(priv, "Updated power mode\n");
@@ -1828,7 +1828,7 @@ static void __iwl4965_down(struct iwl_priv *priv)
         iwl_legacy_clear_driver_stations(priv);
 
         /* Unblock any waiting calls */
-        wake_up_interruptible_all(&priv->wait_command_queue);
+        wake_up_all(&priv->wait_command_queue);
 
         /* Wipe out the EXIT_PENDING status bit if we are not actually
          * exiting the module */
@@ -2266,7 +2266,7 @@ int iwl4965_mac_start(struct ieee80211_hw *hw)
 
         /* Wait for START_ALIVE from Run Time ucode. Otherwise callbacks from
          * mac80211 will not be run successfully. */
-        ret = wait_event_interruptible_timeout(priv->wait_command_queue,
+        ret = wait_event_timeout(priv->wait_command_queue,
                         test_bit(STATUS_READY, &priv->status),
                         UCODE_READY_TIMEOUT);
         if (!ret) {
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-ucode.c b/drivers/net/wireless/iwlwifi/iwl-agn-ucode.c
index a895a099d086..56211006a182 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-ucode.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-ucode.c
@@ -167,7 +167,7 @@ static int iwlagn_set_temperature_offset_calib(struct iwl_priv *priv)
 
         memset(&cmd, 0, sizeof(cmd));
         iwl_set_calib_hdr(&cmd.hdr, IWL_PHY_CALIBRATE_TEMP_OFFSET_CMD);
-        memcpy(&cmd.radio_sensor_offset, offset_calib, sizeof(offset_calib));
+        memcpy(&cmd.radio_sensor_offset, offset_calib, sizeof(*offset_calib));
         if (!(cmd.radio_sensor_offset))
                 cmd.radio_sensor_offset = DEFAULT_RADIO_SENSOR_OFFSET;
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index b0ae4de7f083..f9c3cd95d614 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -2140,7 +2140,12 @@ static int iwl_mac_setup_register(struct iwl_priv *priv,
                     IEEE80211_HW_SPECTRUM_MGMT |
                     IEEE80211_HW_REPORTS_TX_ACK_STATUS;
 
+        /*
+         * Including the following line will crash some AP's.  This
+         * workaround removes the stimulus which causes the crash until
+         * the AP software can be fixed.
         hw->max_tx_aggregation_subframes = LINK_QUAL_AGG_FRAME_LIMIT_DEF;
+         */
 
         hw->flags |= IEEE80211_HW_SUPPORTS_PS |
                      IEEE80211_HW_SUPPORTS_DYNAMIC_PS;
diff --git a/drivers/net/wireless/iwlwifi/iwl-pci.c b/drivers/net/wireless/iwlwifi/iwl-pci.c
index 69d4ec467dca..2fdbffa079c1 100644
--- a/drivers/net/wireless/iwlwifi/iwl-pci.c
+++ b/drivers/net/wireless/iwlwifi/iwl-pci.c
@@ -478,27 +478,22 @@ out_no_pci:
         return err;
 }
 
-static void iwl_pci_down(struct iwl_bus *bus)
-{
-        struct iwl_pci_bus *pci_bus = (struct iwl_pci_bus *) bus->bus_specific;
-
-        pci_disable_msi(pci_bus->pci_dev);
-        pci_iounmap(pci_bus->pci_dev, pci_bus->hw_base);
-        pci_release_regions(pci_bus->pci_dev);
-        pci_disable_device(pci_bus->pci_dev);
-        pci_set_drvdata(pci_bus->pci_dev, NULL);
-
-        kfree(bus);
-}
-
 static void __devexit iwl_pci_remove(struct pci_dev *pdev)
 {
         struct iwl_priv *priv = pci_get_drvdata(pdev);
-        void *bus_specific = priv->bus->bus_specific;
+        struct iwl_bus *bus = priv->bus;
+        struct iwl_pci_bus *pci_bus = IWL_BUS_GET_PCI_BUS(bus);
+        struct pci_dev *pci_dev = IWL_BUS_GET_PCI_DEV(bus);
 
         iwl_remove(priv);
 
-        iwl_pci_down(bus_specific);
+        pci_disable_msi(pci_dev);
+        pci_iounmap(pci_dev, pci_bus->hw_base);
+        pci_release_regions(pci_dev);
+        pci_disable_device(pci_dev);
+        pci_set_drvdata(pci_dev, NULL);
+
+        kfree(bus);
 }
 
 #ifdef CONFIG_PM
diff --git a/drivers/net/wireless/iwlwifi/iwl-scan.c b/drivers/net/wireless/iwlwifi/iwl-scan.c
index dd6937e97055..77e528f5db88 100644
--- a/drivers/net/wireless/iwlwifi/iwl-scan.c
+++ b/drivers/net/wireless/iwlwifi/iwl-scan.c
@@ -405,31 +405,33 @@ int iwl_mac_hw_scan(struct ieee80211_hw *hw,
 
         mutex_lock(&priv->mutex);
 
-        if (test_bit(STATUS_SCANNING, &priv->status) &&
-            priv->scan_type != IWL_SCAN_NORMAL) {
-                IWL_DEBUG_SCAN(priv, "Scan already in progress.\n");
-                ret = -EAGAIN;
-                goto out_unlock;
-        }
-
-        /* mac80211 will only ask for one band at a time */
-        priv->scan_request = req;
-        priv->scan_vif = vif;
-
         /*
          * If an internal scan is in progress, just set
          * up the scan_request as per above.
          */
         if (priv->scan_type != IWL_SCAN_NORMAL) {
-                IWL_DEBUG_SCAN(priv, "SCAN request during internal scan\n");
+                IWL_DEBUG_SCAN(priv,
+                               "SCAN request during internal scan - defer\n");
+                priv->scan_request = req;
+                priv->scan_vif = vif;
                 ret = 0;
-        } else
+        } else {
+                priv->scan_request = req;
+                priv->scan_vif = vif;
+                /*
+                 * mac80211 will only ask for one band at a time
+                 * so using channels[0] here is ok
+                 */
                 ret = iwl_scan_initiate(priv, vif, IWL_SCAN_NORMAL,
                                         req->channels[0]->band);
+                if (ret) {
+                        priv->scan_request = NULL;
+                        priv->scan_vif = NULL;
+                }
+        }
 
         IWL_DEBUG_MAC80211(priv, "leave\n");
 
-out_unlock:
         mutex_unlock(&priv->mutex);
 
         return ret;
diff --git a/drivers/net/wireless/iwlwifi/iwl-trans-tx-pcie.c b/drivers/net/wireless/iwlwifi/iwl-trans-tx-pcie.c
index a6b2b1db0b1d..222d410c586e 100644
--- a/drivers/net/wireless/iwlwifi/iwl-trans-tx-pcie.c
+++ b/drivers/net/wireless/iwlwifi/iwl-trans-tx-pcie.c
@@ -771,6 +771,8 @@ void iwl_tx_cmd_complete(struct iwl_priv *priv, struct iwl_rx_mem_buffer *rxb)
         cmd = txq->cmd[cmd_index];
         meta = &txq->meta[cmd_index];
 
+        txq->time_stamp = jiffies;
+
         iwlagn_unmap_tfd(priv, meta, &txq->tfds[index], DMA_BIDIRECTIONAL);
 
         /* Input error checking is done when commands are added to queue. */
diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c b/drivers/net/wireless/rt2x00/rt2800lib.c
index ef67f6786a84..0019dfd8fb01 100644
--- a/drivers/net/wireless/rt2x00/rt2800lib.c
+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
@@ -3697,14 +3697,15 @@ static void rt2800_efuse_read(struct rt2x00_dev *rt2x00dev, unsigned int i)
         rt2800_regbusy_read(rt2x00dev, EFUSE_CTRL, EFUSE_CTRL_KICK, &reg);
 
         /* Apparently the data is read from end to start */
-        rt2800_register_read_lock(rt2x00dev, EFUSE_DATA3,
-                                        (u32 *)&rt2x00dev->eeprom[i]);
-        rt2800_register_read_lock(rt2x00dev, EFUSE_DATA2,
-                                        (u32 *)&rt2x00dev->eeprom[i + 2]);
-        rt2800_register_read_lock(rt2x00dev, EFUSE_DATA1,
-                                        (u32 *)&rt2x00dev->eeprom[i + 4]);
-        rt2800_register_read_lock(rt2x00dev, EFUSE_DATA0,
-                                        (u32 *)&rt2x00dev->eeprom[i + 6]);
+        rt2800_register_read_lock(rt2x00dev, EFUSE_DATA3, &reg);
+        /* The returned value is in CPU order, but eeprom is le */
+        rt2x00dev->eeprom[i] = cpu_to_le32(reg);
+        rt2800_register_read_lock(rt2x00dev, EFUSE_DATA2, &reg);
+        *(u32 *)&rt2x00dev->eeprom[i + 2] = cpu_to_le32(reg);
+        rt2800_register_read_lock(rt2x00dev, EFUSE_DATA1, &reg);
+        *(u32 *)&rt2x00dev->eeprom[i + 4] = cpu_to_le32(reg);
+        rt2800_register_read_lock(rt2x00dev, EFUSE_DATA0, &reg);
+        *(u32 *)&rt2x00dev->eeprom[i + 6] = cpu_to_le32(reg);
 
         mutex_unlock(&rt2x00dev->csr_mutex);
 }
@@ -3870,19 +3871,23 @@ int rt2800_init_eeprom(struct rt2x00_dev *rt2x00dev)
                 return -ENODEV;
         }
 
-        if (!rt2x00_rf(rt2x00dev, RF2820) &&
-            !rt2x00_rf(rt2x00dev, RF2850) &&
-            !rt2x00_rf(rt2x00dev, RF2720) &&
-            !rt2x00_rf(rt2x00dev, RF2750) &&
-            !rt2x00_rf(rt2x00dev, RF3020) &&
-            !rt2x00_rf(rt2x00dev, RF2020) &&
-            !rt2x00_rf(rt2x00dev, RF3021) &&
-            !rt2x00_rf(rt2x00dev, RF3022) &&
-            !rt2x00_rf(rt2x00dev, RF3052) &&
-            !rt2x00_rf(rt2x00dev, RF3320) &&
-            !rt2x00_rf(rt2x00dev, RF5370) &&
-            !rt2x00_rf(rt2x00dev, RF5390)) {
-                ERROR(rt2x00dev, "Invalid RF chipset detected.\n");
+        switch (rt2x00dev->chip.rf) {
+        case RF2820:
+        case RF2850:
+        case RF2720:
+        case RF2750:
+        case RF3020:
+        case RF2020:
+        case RF3021:
+        case RF3022:
+        case RF3052:
+        case RF3320:
+        case RF5370:
+        case RF5390:
+                break;
+        default:
+                ERROR(rt2x00dev, "Invalid RF chipset 0x%x detected.\n",
+                      rt2x00dev->chip.rf);
                 return -ENODEV;
         }
 
diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c
index 939563162fb3..dbf501ca317f 100644
--- a/drivers/net/wireless/rt2x00/rt2800usb.c
+++ b/drivers/net/wireless/rt2x00/rt2800usb.c
@@ -464,6 +464,15 @@ static bool rt2800usb_txdone_entry_check(struct queue_entry *entry, u32 reg)
         int wcid, ack, pid;
         int tx_wcid, tx_ack, tx_pid;
 
+        if (test_bit(ENTRY_OWNER_DEVICE_DATA, &entry->flags) ||
+            !test_bit(ENTRY_DATA_STATUS_PENDING, &entry->flags)) {
+                WARNING(entry->queue->rt2x00dev,
+                        "Data pending for entry %u in queue %u\n",
+                        entry->entry_idx, entry->queue->qid);
+                cond_resched();
+                return false;
+        }
+
         wcid    = rt2x00_get_field32(reg, TX_STA_FIFO_WCID);
         ack     = rt2x00_get_field32(reg, TX_STA_FIFO_TX_ACK_REQUIRED);
         pid     = rt2x00_get_field32(reg, TX_STA_FIFO_PID_TYPE);
@@ -529,12 +538,11 @@ static void rt2800usb_txdone(struct rt2x00_dev *rt2x00dev)
                         entry = rt2x00queue_get_entry(queue, Q_INDEX_DONE);
                         if (rt2800usb_txdone_entry_check(entry, reg))
                                 break;
+                        entry = NULL;
                 }
 
-                if (!entry || rt2x00queue_empty(queue))
-                        break;
-
-                rt2800_txdone_entry(entry, reg);
+                if (entry)
+                        rt2800_txdone_entry(entry, reg);
         }
 }
 
@@ -558,8 +566,10 @@ static void rt2800usb_work_txdone(struct work_struct *work)
                 while (!rt2x00queue_empty(queue)) {
                         entry = rt2x00queue_get_entry(queue, Q_INDEX_DONE);
 
-                        if (test_bit(ENTRY_OWNER_DEVICE_DATA, &entry->flags))
+                        if (test_bit(ENTRY_OWNER_DEVICE_DATA, &entry->flags) ||
+                            !test_bit(ENTRY_DATA_STATUS_PENDING, &entry->flags))
                                 break;
+
                         if (test_bit(ENTRY_DATA_IO_FAILED, &entry->flags))
                                 rt2x00lib_txdone_noinfo(entry, TXDONE_FAILURE);
                         else if (rt2x00queue_status_timeout(entry))
diff --git a/drivers/net/wireless/rt2x00/rt2x00usb.c b/drivers/net/wireless/rt2x00/rt2x00usb.c
index b6b4542c2460..1e31050dafc9 100644
--- a/drivers/net/wireless/rt2x00/rt2x00usb.c
+++ b/drivers/net/wireless/rt2x00/rt2x00usb.c
@@ -262,23 +262,20 @@ static void rt2x00usb_interrupt_txdone(struct urb *urb)
         struct queue_entry *entry = (struct queue_entry *)urb->context;
         struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
 
-        if (!test_and_clear_bit(ENTRY_OWNER_DEVICE_DATA, &entry->flags))
+        if (!test_bit(ENTRY_OWNER_DEVICE_DATA, &entry->flags))
                 return;
-
-        if (rt2x00dev->ops->lib->tx_dma_done)
-                rt2x00dev->ops->lib->tx_dma_done(entry);
-
-        /*
-         * Report the frame as DMA done
-         */
-        rt2x00lib_dmadone(entry);
-
         /*
          * Check if the frame was correctly uploaded
          */
         if (urb->status)
                 set_bit(ENTRY_DATA_IO_FAILED, &entry->flags);
+        /*
+         * Report the frame as DMA done
+         */
+        rt2x00lib_dmadone(entry);
 
+        if (rt2x00dev->ops->lib->tx_dma_done)
+                rt2x00dev->ops->lib->tx_dma_done(entry);
         /*
          * Schedule the delayed work for reading the TX status
          * from the device.
@@ -874,18 +871,8 @@ int rt2x00usb_suspend(struct usb_interface *usb_intf, pm_message_t state)
 {
         struct ieee80211_hw *hw = usb_get_intfdata(usb_intf);
         struct rt2x00_dev *rt2x00dev = hw->priv;
-        int retval;
-
-        retval = rt2x00lib_suspend(rt2x00dev, state);
-        if (retval)
-                return retval;
 
-        /*
-         * Decrease usbdev refcount.
-         */
-        usb_put_dev(interface_to_usbdev(usb_intf));
-
-        return 0;
+        return rt2x00lib_suspend(rt2x00dev, state);
 }
 EXPORT_SYMBOL_GPL(rt2x00usb_suspend);
 
@@ -894,8 +881,6 @@ int rt2x00usb_resume(struct usb_interface *usb_intf)
         struct ieee80211_hw *hw = usb_get_intfdata(usb_intf);
         struct rt2x00_dev *rt2x00dev = hw->priv;
 
-        usb_get_dev(interface_to_usbdev(usb_intf));
-
         return rt2x00lib_resume(rt2x00dev);
 }
 EXPORT_SYMBOL_GPL(rt2x00usb_resume);
diff --git a/drivers/net/wireless/rtlwifi/core.c b/drivers/net/wireless/rtlwifi/core.c
index 1bdc1aa305c0..04c4e9eb6ee6 100644
--- a/drivers/net/wireless/rtlwifi/core.c
+++ b/drivers/net/wireless/rtlwifi/core.c
@@ -610,6 +610,11 @@ static void rtl_op_bss_info_changed(struct ieee80211_hw *hw,
 
                         mac->link_state = MAC80211_NOLINK;
                         memset(mac->bssid, 0, 6);
+
+                        /* reset sec info */
+                        rtl_cam_reset_sec_info(hw);
+
+                        rtl_cam_reset_all_entry(hw);
                         mac->vendor = PEER_UNKNOWN;
 
                         RT_TRACE(rtlpriv, COMP_MAC80211, DBG_DMESG,
@@ -1063,6 +1068,9 @@ static int rtl_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
                  *or clear all entry here.
                  */
                 rtl_cam_delete_one_entry(hw, mac_addr, key_idx);
+
+                rtl_cam_reset_sec_info(hw);
+
                 break;
         default:
                 RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c b/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c
index 906e7aa55bc3..3e52a5496224 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c
@@ -549,15 +549,16 @@ void rtl92cu_tx_fill_desc(struct ieee80211_hw *hw,
                                (tcb_desc->rts_use_shortpreamble ? 1 : 0)
                                : (tcb_desc->rts_use_shortgi ? 1 : 0)));
         if (mac->bw_40) {
-                if (tcb_desc->packet_bw) {
+                if (rate_flag & IEEE80211_TX_RC_DUP_DATA) {
                         SET_TX_DESC_DATA_BW(txdesc, 1);
                         SET_TX_DESC_DATA_SC(txdesc, 3);
+                } else if(rate_flag & IEEE80211_TX_RC_40_MHZ_WIDTH){
+                        SET_TX_DESC_DATA_BW(txdesc, 1);
+                        SET_TX_DESC_DATA_SC(txdesc, mac->cur_40_prime_sc);
                 } else {
                         SET_TX_DESC_DATA_BW(txdesc, 0);
-                                if (rate_flag & IEEE80211_TX_RC_DUP_DATA)
-                                        SET_TX_DESC_DATA_SC(txdesc,
-                                                          mac->cur_40_prime_sc);
-                        }
+                        SET_TX_DESC_DATA_SC(txdesc, 0);
+                }
         } else {
                 SET_TX_DESC_DATA_BW(txdesc, 0);
                 SET_TX_DESC_DATA_SC(txdesc, 0);
diff --git a/drivers/net/wireless/rtlwifi/usb.c b/drivers/net/wireless/rtlwifi/usb.c
index 8b1cef0ffde6..4bf3cf457ef0 100644
--- a/drivers/net/wireless/rtlwifi/usb.c
+++ b/drivers/net/wireless/rtlwifi/usb.c
@@ -863,6 +863,7 @@ static void _rtl_usb_tx_preprocess(struct ieee80211_hw *hw, struct sk_buff *skb,
         u8 tid = 0;
         u16 seq_number = 0;
 
+        memset(&tcb_desc, 0, sizeof(struct rtl_tcb_desc));
         if (ieee80211_is_auth(fc)) {
                 RT_TRACE(rtlpriv, COMP_SEND, DBG_DMESG, ("MAC80211_LINKING\n"));
                 rtl_ips_nic_on(hw);
diff --git a/drivers/net/wireless/wl12xx/acx.c b/drivers/net/wireless/wl12xx/acx.c
index 7e33f1f4f3d4..34f6ab53e519 100644
--- a/drivers/net/wireless/wl12xx/acx.c
+++ b/drivers/net/wireless/wl12xx/acx.c
@@ -77,8 +77,6 @@ int wl1271_acx_sleep_auth(struct wl1271 *wl, u8 sleep_auth)
         auth->sleep_auth = sleep_auth;
 
         ret = wl1271_cmd_configure(wl, ACX_SLEEP_AUTH, auth, sizeof(*auth));
-        if (ret < 0)
-                return ret;
 
 out:
         kfree(auth);
@@ -624,10 +622,8 @@ int wl1271_acx_cca_threshold(struct wl1271 *wl)
 
         ret = wl1271_cmd_configure(wl, ACX_CCA_THRESHOLD,
                                    detection, sizeof(*detection));
-        if (ret < 0) {
+        if (ret < 0)
                 wl1271_warning("failed to set cca threshold: %d", ret);
-                return ret;
-        }
 
 out:
         kfree(detection);
diff --git a/drivers/net/wireless/wl12xx/main.c b/drivers/net/wireless/wl12xx/main.c
index e58c22d21e39..b70ae40ad660 100644
--- a/drivers/net/wireless/wl12xx/main.c
+++ b/drivers/net/wireless/wl12xx/main.c
@@ -4283,6 +4283,7 @@ int wl1271_init_ieee80211(struct wl1271 *wl)
         wl->hw->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
                 BIT(NL80211_IFTYPE_ADHOC) | BIT(NL80211_IFTYPE_AP);
         wl->hw->wiphy->max_scan_ssids = 1;
+        wl->hw->wiphy->max_sched_scan_ssids = 1;
         /*
          * Maximum length of elements in scanning probe request templates
          * should be the maximum length possible for a template, without
diff --git a/drivers/net/wireless/wl12xx/sdio.c b/drivers/net/wireless/wl12xx/sdio.c
index 5cf18c2c23f0..fb1fd5af75ea 100644
--- a/drivers/net/wireless/wl12xx/sdio.c
+++ b/drivers/net/wireless/wl12xx/sdio.c
@@ -164,7 +164,7 @@ static int wl1271_sdio_power_on(struct wl1271 *wl)
         /* If enabled, tell runtime PM not to power off the card */
         if (pm_runtime_enabled(&func->dev)) {
                 ret = pm_runtime_get_sync(&func->dev);
-                if (ret)
+                if (ret < 0)
                         goto out;
         } else {
                 /* Runtime PM is disabled: power up the card manually */
diff --git a/drivers/net/wireless/wl12xx/testmode.c b/drivers/net/wireless/wl12xx/testmode.c
index 5d5e1ef87206..4ae8effaee22 100644
--- a/drivers/net/wireless/wl12xx/testmode.c
+++ b/drivers/net/wireless/wl12xx/testmode.c
@@ -36,7 +36,6 @@ enum wl1271_tm_commands {
         WL1271_TM_CMD_TEST,
         WL1271_TM_CMD_INTERROGATE,
         WL1271_TM_CMD_CONFIGURE,
-        WL1271_TM_CMD_NVS_PUSH,
         WL1271_TM_CMD_SET_PLT_MODE,
         WL1271_TM_CMD_RECOVER,
 
@@ -139,12 +138,15 @@ static int wl1271_tm_cmd_interrogate(struct wl1271 *wl, struct nlattr *tb[])
 
         if (ret < 0) {
                 wl1271_warning("testmode cmd interrogate failed: %d", ret);
+                kfree(cmd);
                 return ret;
         }
 
         skb = cfg80211_testmode_alloc_reply_skb(wl->hw->wiphy, sizeof(*cmd));
-        if (!skb)
+        if (!skb) {
+                kfree(cmd);
                 return -ENOMEM;
+        }
 
         NLA_PUT(skb, WL1271_TM_ATTR_DATA, sizeof(*cmd), cmd);
 
@@ -187,48 +189,6 @@ static int wl1271_tm_cmd_configure(struct wl1271 *wl, struct nlattr *tb[])
         return 0;
 }
 
-static int wl1271_tm_cmd_nvs_push(struct wl1271 *wl, struct nlattr *tb[])
-{
-        int ret = 0;
-        size_t len;
-        void *buf;
-
-        wl1271_debug(DEBUG_TESTMODE, "testmode cmd nvs push");
-
-        if (!tb[WL1271_TM_ATTR_DATA])
-                return -EINVAL;
-
-        buf = nla_data(tb[WL1271_TM_ATTR_DATA]);
-        len = nla_len(tb[WL1271_TM_ATTR_DATA]);
-
-        mutex_lock(&wl->mutex);
-
-        kfree(wl->nvs);
-
-        if ((wl->chip.id == CHIP_ID_1283_PG20) &&
-            (len != sizeof(struct wl128x_nvs_file)))
-                return -EINVAL;
-        else if (len != sizeof(struct wl1271_nvs_file))
-                return -EINVAL;
-
-        wl->nvs = kzalloc(len, GFP_KERNEL);
-        if (!wl->nvs) {
-                wl1271_error("could not allocate memory for the nvs file");
-                ret = -ENOMEM;
-                goto out;
-        }
-
-        memcpy(wl->nvs, buf, len);
-        wl->nvs_len = len;
-
-        wl1271_debug(DEBUG_TESTMODE, "testmode pushed nvs");
-
-out:
-        mutex_unlock(&wl->mutex);
-
-        return ret;
-}
-
 static int wl1271_tm_cmd_set_plt_mode(struct wl1271 *wl, struct nlattr *tb[])
 {
         u32 val;
@@ -285,8 +245,6 @@ int wl1271_tm_cmd(struct ieee80211_hw *hw, void *data, int len)
                 return wl1271_tm_cmd_interrogate(wl, tb);
         case WL1271_TM_CMD_CONFIGURE:
                 return wl1271_tm_cmd_configure(wl, tb);
-        case WL1271_TM_CMD_NVS_PUSH:
-                return wl1271_tm_cmd_nvs_push(wl, tb);
         case WL1271_TM_CMD_SET_PLT_MODE:
                 return wl1271_tm_cmd_set_plt_mode(wl, tb);
         case WL1271_TM_CMD_RECOVER:
diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
index 0ca86f9ec4ed..182562952c79 100644
--- a/drivers/net/xen-netback/interface.c
+++ b/drivers/net/xen-netback/interface.c
@@ -327,12 +327,12 @@ int xenvif_connect(struct xenvif *vif, unsigned long tx_ring_ref,
         xenvif_get(vif);
 
         rtnl_lock();
-        if (netif_running(vif->dev))
-                xenvif_up(vif);
         if (!vif->can_sg && vif->dev->mtu > ETH_DATA_LEN)
                 dev_set_mtu(vif->dev, ETH_DATA_LEN);
         netdev_update_features(vif->dev);
         netif_carrier_on(vif->dev);
+        if (netif_running(vif->dev))
+                xenvif_up(vif);
         rtnl_unlock();
 
         return 0;