Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (63 commits)
  drivers/net/usb/asix.c: Fix pointer cast.
  be2net: Bug fix to avoid disabling bottom half during firmware upgrade.
  proc_dointvec: write a single value
  hso: add support for new products
  Phonet: fix potential use-after-free in pep_sock_close()
  ath9k: remove VEOL support for ad-hoc
  ath9k: change beacon allocation to prefer the first beacon slot
  sock.h: fix kernel-doc warning
  cls_cgroup: Fix build error when built-in
  macvlan: do proper cleanup in macvlan_common_newlink() V2
  be2net: Bug fix in init code in probe
  net/dccp: expansion of error code size
  ath9k: Fix rx of mcast/bcast frames in PS mode with auto sleep
  wireless: fix sta_info.h kernel-doc warnings
  wireless: fix mac80211.h kernel-doc warnings
  iwlwifi: testing the wrong variable in iwl_add_bssid_station()
  ath9k_htc: rare leak in ath9k_hif_usb_alloc_tx_urbs()
  ath9k_htc: dereferencing before check in hif_usb_tx_cb()
  rt2x00: Fix rt2800usb TX descriptor writing.
  rt2x00: Fix failed SLEEP->AWAKE and AWAKE->SLEEP transitions.
  ...

43 files changed, 341 insertions, 150 deletions

diff --git a/drivers/isdn/capi/kcapi.c b/drivers/isdn/capi/kcapi.c
index bd00dceacaf0..bde3c88b8b27 100644
--- a/drivers/isdn/capi/kcapi.c
+++ b/drivers/isdn/capi/kcapi.c
@@ -1147,6 +1147,12 @@ load_unlock_out:
                 if (ctr->state == CAPI_CTR_DETECTED)
                         goto reset_unlock_out;
 
+                if (ctr->reset_ctr == NULL) {
+                        printk(KERN_DEBUG "kcapi: reset: no reset function\n");
+                        retval = -ESRCH;
+                        goto reset_unlock_out;
+                }
+
                 ctr->reset_ctr(ctr);
 
                 retval = wait_on_ctr_state(ctr, CAPI_CTR_DETECTED);
diff --git a/drivers/isdn/gigaset/capi.c b/drivers/isdn/gigaset/capi.c
index ac4cfeed3946..8f78f15c8ef7 100644
--- a/drivers/isdn/gigaset/capi.c
+++ b/drivers/isdn/gigaset/capi.c
@@ -922,30 +922,6 @@ void gigaset_isdn_stop(struct cardstate *cs)
  */
 
 /*
- * load firmware
- */
-static int gigaset_load_firmware(struct capi_ctr *ctr, capiloaddata *data)
-{
-        struct cardstate *cs = ctr->driverdata;
-
-        /* AVM specific operation, not needed for Gigaset -- ignore */
-        dev_notice(cs->dev, "load_firmware ignored\n");
-
-        return 0;
-}
-
-/*
- * reset (deactivate) controller
- */
-static void gigaset_reset_ctr(struct capi_ctr *ctr)
-{
-        struct cardstate *cs = ctr->driverdata;
-
-        /* AVM specific operation, not needed for Gigaset -- ignore */
-        dev_notice(cs->dev, "reset_ctr ignored\n");
-}
-
-/*
  * register CAPI application
  */
 static void gigaset_register_appl(struct capi_ctr *ctr, u16 appl,
@@ -2202,8 +2178,8 @@ int gigaset_isdn_regdev(struct cardstate *cs, const char *isdnid)
         iif->ctr.driverdata    = cs;
         strncpy(iif->ctr.name, isdnid, sizeof(iif->ctr.name));
         iif->ctr.driver_name   = "gigaset";
-        iif->ctr.load_firmware = gigaset_load_firmware;
-        iif->ctr.reset_ctr     = gigaset_reset_ctr;
+        iif->ctr.load_firmware = NULL;
+        iif->ctr.reset_ctr     = NULL;
         iif->ctr.register_appl = gigaset_register_appl;
         iif->ctr.release_appl  = gigaset_release_appl;
         iif->ctr.send_message  = gigaset_send_message;
diff --git a/drivers/net/benet/be.h b/drivers/net/benet/be.h
index 373c1a563474..b46be490cd2a 100644
--- a/drivers/net/benet/be.h
+++ b/drivers/net/benet/be.h
@@ -283,6 +283,8 @@ struct be_adapter {
         u8 port_type;
         u8 transceiver;
         u8 generation;          /* BladeEngine ASIC generation */
+        u32 flash_status;
+        struct completion flash_compl;
 
         bool sriov_enabled;
         u32 vf_if_handle[BE_MAX_VF];
diff --git a/drivers/net/benet/be_cmds.c b/drivers/net/benet/be_cmds.c
index e79bf8b9af3b..c911bfb55b19 100644
--- a/drivers/net/benet/be_cmds.c
+++ b/drivers/net/benet/be_cmds.c
@@ -59,6 +59,13 @@ static int be_mcc_compl_process(struct be_adapter *adapter,
 
         compl_status = (compl->status >> CQE_STATUS_COMPL_SHIFT) &
                                 CQE_STATUS_COMPL_MASK;
+
+        if ((compl->tag0 == OPCODE_COMMON_WRITE_FLASHROM) &&
+                (compl->tag1 == CMD_SUBSYSTEM_COMMON)) {
+                adapter->flash_status = compl_status;
+                complete(&adapter->flash_compl);
+        }
+
         if (compl_status == MCC_STATUS_SUCCESS) {
                 if (compl->tag0 == OPCODE_ETH_GET_STATISTICS) {
                         struct be_cmd_resp_get_stats *resp =
@@ -1417,6 +1424,7 @@ int be_cmd_write_flashrom(struct be_adapter *adapter, struct be_dma_mem *cmd,
         int status;
 
         spin_lock_bh(&adapter->mcc_lock);
+        adapter->flash_status = 0;
 
         wrb = wrb_from_mccq(adapter);
         if (!wrb) {
@@ -1428,6 +1436,7 @@ int be_cmd_write_flashrom(struct be_adapter *adapter, struct be_dma_mem *cmd,
 
         be_wrb_hdr_prepare(wrb, cmd->size, false, 1,
                         OPCODE_COMMON_WRITE_FLASHROM);
+        wrb->tag1 = CMD_SUBSYSTEM_COMMON;
 
         be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
                 OPCODE_COMMON_WRITE_FLASHROM, cmd->size);
@@ -1439,10 +1448,16 @@ int be_cmd_write_flashrom(struct be_adapter *adapter, struct be_dma_mem *cmd,
         req->params.op_code = cpu_to_le32(flash_opcode);
         req->params.data_buf_size = cpu_to_le32(buf_size);
 
-        status = be_mcc_notify_wait(adapter);
+        be_mcc_notify(adapter);
+        spin_unlock_bh(&adapter->mcc_lock);
+
+        if (!wait_for_completion_timeout(&adapter->flash_compl,
+                        msecs_to_jiffies(12000)))
+                status = -1;
+        else
+                status = adapter->flash_status;
 
 err:
-        spin_unlock_bh(&adapter->mcc_lock);
         return status;
 }
 
diff --git a/drivers/net/benet/be_main.c b/drivers/net/benet/be_main.c
index 058d7f95f5ae..aa065c71ddd8 100644
--- a/drivers/net/benet/be_main.c
+++ b/drivers/net/benet/be_main.c
@@ -2319,6 +2319,7 @@ static int be_ctrl_init(struct be_adapter *adapter)
         spin_lock_init(&adapter->mcc_lock);
         spin_lock_init(&adapter->mcc_cq_lock);
 
+        init_completion(&adapter->flash_compl);
         pci_save_state(adapter->pdev);
         return 0;
 
@@ -2487,10 +2488,6 @@ static int __devinit be_probe(struct pci_dev *pdev,
                 status = be_cmd_POST(adapter);
                 if (status)
                         goto ctrl_clean;
-
-                status = be_cmd_reset_function(adapter);
-                if (status)
-                        goto ctrl_clean;
         }
 
         /* tell fw we're ready to fire cmds */
@@ -2498,6 +2495,12 @@ static int __devinit be_probe(struct pci_dev *pdev,
         if (status)
                 goto ctrl_clean;
 
+        if (be_physfn(adapter)) {
+                status = be_cmd_reset_function(adapter);
+                if (status)
+                        goto ctrl_clean;
+        }
+
         status = be_stats_init(adapter);
         if (status)
                 goto ctrl_clean;
diff --git a/drivers/net/bfin_mac.c b/drivers/net/bfin_mac.c
index 39a54bad397f..368f33313fb6 100644
--- a/drivers/net/bfin_mac.c
+++ b/drivers/net/bfin_mac.c
@@ -1626,6 +1626,7 @@ static int __devinit bfin_mii_bus_probe(struct platform_device *pdev)
         return 0;
 
 out_err_mdiobus_register:
+        kfree(miibus->irq);
         mdiobus_free(miibus);
 out_err_alloc:
         peripheral_free_list(pin_req);
@@ -1638,6 +1639,7 @@ static int __devexit bfin_mii_bus_remove(struct platform_device *pdev)
         struct mii_bus *miibus = platform_get_drvdata(pdev);
         platform_set_drvdata(pdev, NULL);
         mdiobus_unregister(miibus);
+        kfree(miibus->irq);
         mdiobus_free(miibus);
         peripheral_free_list(pin_req);
         return 0;
diff --git a/drivers/net/can/sja1000/sja1000.c b/drivers/net/can/sja1000/sja1000.c
index 85f7cbfe8e5f..0a8de01d52f7 100644
--- a/drivers/net/can/sja1000/sja1000.c
+++ b/drivers/net/can/sja1000/sja1000.c
@@ -599,6 +599,8 @@ struct net_device *alloc_sja1000dev(int sizeof_priv)
         priv->can.ctrlmode_supported = CAN_CTRLMODE_3_SAMPLES |
                 CAN_CTRLMODE_BERR_REPORTING;
 
+        spin_lock_init(&priv->cmdreg_lock);
+
         if (sizeof_priv)
                 priv->priv = (void *)priv + sizeof(struct sja1000_priv);
 
diff --git a/drivers/net/enic/enic_main.c b/drivers/net/enic/enic_main.c
index e125113759a5..6586b5c7e4b6 100644
--- a/drivers/net/enic/enic_main.c
+++ b/drivers/net/enic/enic_main.c
@@ -1034,9 +1034,10 @@ static int enic_set_port_profile(struct enic *enic, u8 request, u8 *mac,
 {
         struct vic_provinfo *vp;
         u8 oui[3] = VIC_PROVINFO_CISCO_OUI;
-        unsigned short *uuid;
+        u8 *uuid;
         char uuid_str[38];
-        static char *uuid_fmt = "%04X%04X-%04X-%04X-%04X-%04X%04X%04X";
+        static char *uuid_fmt = "%02X%02X%02X%02X-%02X%02X-%02X%02X-"
+                "%02X%02X-%02X%02X%02X%02X%0X%02X";
         int err;
 
         if (!name)
@@ -1058,20 +1059,24 @@ static int enic_set_port_profile(struct enic *enic, u8 request, u8 *mac,
                 ETH_ALEN, mac);
 
         if (instance_uuid) {
-                uuid = (unsigned short *)instance_uuid;
+                uuid = instance_uuid;
                 sprintf(uuid_str, uuid_fmt,
-                        uuid[0], uuid[1], uuid[2], uuid[3],
-                        uuid[4], uuid[5], uuid[6], uuid[7]);
+                        uuid[0],  uuid[1],  uuid[2],  uuid[3],
+                        uuid[4],  uuid[5],  uuid[6],  uuid[7],
+                        uuid[8],  uuid[9],  uuid[10], uuid[11],
+                        uuid[12], uuid[13], uuid[14], uuid[15]);
                 vic_provinfo_add_tlv(vp,
                         VIC_LINUX_PROV_TLV_CLIENT_UUID_STR,
                         sizeof(uuid_str), uuid_str);
         }
 
         if (host_uuid) {
-                uuid = (unsigned short *)host_uuid;
+                uuid = host_uuid;
                 sprintf(uuid_str, uuid_fmt,
-                        uuid[0], uuid[1], uuid[2], uuid[3],
-                        uuid[4], uuid[5], uuid[6], uuid[7]);
+                        uuid[0],  uuid[1],  uuid[2],  uuid[3],
+                        uuid[4],  uuid[5],  uuid[6],  uuid[7],
+                        uuid[8],  uuid[9],  uuid[10], uuid[11],
+                        uuid[12], uuid[13], uuid[14], uuid[15]);
                 vic_provinfo_add_tlv(vp,
                         VIC_LINUX_PROV_TLV_HOST_UUID_STR,
                         sizeof(uuid_str), uuid_str);
@@ -1127,6 +1132,14 @@ static int enic_set_vf_port(struct net_device *netdev, int vf,
         switch (request) {
         case PORT_REQUEST_ASSOCIATE:
 
+                /* If the interface mac addr hasn't been assigned,
+                 * assign a random mac addr before setting port-
+                 * profile.
+                 */
+
+                if (is_zero_ether_addr(netdev->dev_addr))
+                        random_ether_addr(netdev->dev_addr);
+
                 if (port[IFLA_PORT_PROFILE])
                         name = nla_data(port[IFLA_PORT_PROFILE]);
 
diff --git a/drivers/net/ethoc.c b/drivers/net/ethoc.c
index 14cbde5cf68e..6ed2df14ec84 100644
--- a/drivers/net/ethoc.c
+++ b/drivers/net/ethoc.c
@@ -174,6 +174,7 @@ MODULE_PARM_DESC(buffer_size, "DMA buffer allocation size");
  * @iobase:     pointer to I/O memory region
  * @membase:    pointer to buffer memory region
  * @dma_alloc:  dma allocated buffer size
+ * @io_region_size:     I/O memory region size
  * @num_tx:     number of send buffers
  * @cur_tx:     last send buffer written
  * @dty_tx:     last buffer actually sent
@@ -193,6 +194,7 @@ struct ethoc {
         void __iomem *iobase;
         void __iomem *membase;
         int dma_alloc;
+        resource_size_t io_region_size;
 
         unsigned int num_tx;
         unsigned int cur_tx;
@@ -943,6 +945,7 @@ static int ethoc_probe(struct platform_device *pdev)
         priv = netdev_priv(netdev);
         priv->netdev = netdev;
         priv->dma_alloc = 0;
+        priv->io_region_size = mmio->end - mmio->start + 1;
 
         priv->iobase = devm_ioremap_nocache(&pdev->dev, netdev->base_addr,
                         resource_size(mmio));
@@ -1047,20 +1050,34 @@ static int ethoc_probe(struct platform_device *pdev)
         ret = register_netdev(netdev);
         if (ret < 0) {
                 dev_err(&netdev->dev, "failed to register interface\n");
-                goto error;
+                goto error2;
         }
 
         goto out;
 
+error2:
+        netif_napi_del(&priv->napi);
 error:
         mdiobus_unregister(priv->mdio);
 free_mdio:
         kfree(priv->mdio->irq);
         mdiobus_free(priv->mdio);
 free:
-        if (priv->dma_alloc)
-                dma_free_coherent(NULL, priv->dma_alloc, priv->membase,
-                        netdev->mem_start);
+        if (priv) {
+                if (priv->dma_alloc)
+                        dma_free_coherent(NULL, priv->dma_alloc, priv->membase,
+                                          netdev->mem_start);
+                else if (priv->membase)
+                        devm_iounmap(&pdev->dev, priv->membase);
+                if (priv->iobase)
+                        devm_iounmap(&pdev->dev, priv->iobase);
+        }
+        if (mem)
+                devm_release_mem_region(&pdev->dev, mem->start,
+                                        mem->end - mem->start + 1);
+        if (mmio)
+                devm_release_mem_region(&pdev->dev, mmio->start,
+                                        mmio->end - mmio->start + 1);
         free_netdev(netdev);
 out:
         return ret;
@@ -1078,6 +1095,7 @@ static int ethoc_remove(struct platform_device *pdev)
         platform_set_drvdata(pdev, NULL);
 
         if (netdev) {
+                netif_napi_del(&priv->napi);
                 phy_disconnect(priv->phy);
                 priv->phy = NULL;
 
@@ -1089,6 +1107,14 @@ static int ethoc_remove(struct platform_device *pdev)
                 if (priv->dma_alloc)
                         dma_free_coherent(NULL, priv->dma_alloc, priv->membase,
                                 netdev->mem_start);
+                else {
+                        devm_iounmap(&pdev->dev, priv->membase);
+                        devm_release_mem_region(&pdev->dev, netdev->mem_start,
+                                netdev->mem_end - netdev->mem_start + 1);
+                }
+                devm_iounmap(&pdev->dev, priv->iobase);
+                devm_release_mem_region(&pdev->dev, netdev->base_addr,
+                        priv->io_region_size);
                 unregister_netdev(netdev);
                 free_netdev(netdev);
         }
diff --git a/drivers/net/fec.c b/drivers/net/fec.c
index 42d9ac9ba395..326465ffbb23 100644
--- a/drivers/net/fec.c
+++ b/drivers/net/fec.c
@@ -41,6 +41,7 @@
 #include <linux/clk.h>
 #include <linux/platform_device.h>
 #include <linux/phy.h>
+#include <linux/fec.h>
 
 #include <asm/cacheflush.h>
 
@@ -182,6 +183,7 @@ struct fec_enet_private {
         struct  phy_device *phy_dev;
         int     mii_timeout;
         uint    phy_speed;
+        phy_interface_t phy_interface;
         int     index;
         int     link;
         int     full_duplex;
@@ -1191,6 +1193,21 @@ fec_restart(struct net_device *dev, int duplex)
         /* Set MII speed */
         writel(fep->phy_speed, fep->hwp + FEC_MII_SPEED);
 
+#ifdef FEC_MIIGSK_ENR
+        if (fep->phy_interface == PHY_INTERFACE_MODE_RMII) {
+                /* disable the gasket and wait */
+                writel(0, fep->hwp + FEC_MIIGSK_ENR);
+                while (readl(fep->hwp + FEC_MIIGSK_ENR) & 4)
+                        udelay(1);
+
+                /* configure the gasket: RMII, 50 MHz, no loopback, no echo */
+                writel(1, fep->hwp + FEC_MIIGSK_CFGR);
+
+                /* re-enable the gasket */
+                writel(2, fep->hwp + FEC_MIIGSK_ENR);
+        }
+#endif
+
         /* And last, enable the transmit and receive processing */
         writel(2, fep->hwp + FEC_ECNTRL);
         writel(0, fep->hwp + FEC_R_DES_ACTIVE);
@@ -1226,6 +1243,7 @@ static int __devinit
 fec_probe(struct platform_device *pdev)
 {
         struct fec_enet_private *fep;
+        struct fec_platform_data *pdata;
         struct net_device *ndev;
         int i, irq, ret = 0;
         struct resource *r;
@@ -1259,6 +1277,10 @@ fec_probe(struct platform_device *pdev)
 
         platform_set_drvdata(pdev, ndev);
 
+        pdata = pdev->dev.platform_data;
+        if (pdata)
+                fep->phy_interface = pdata->phy;
+
         /* This device has up to three irqs on some platforms */
         for (i = 0; i < 3; i++) {
                 irq = platform_get_irq(pdev, i);
diff --git a/drivers/net/fec.h b/drivers/net/fec.h
index cc47f3f057c7..2c48b25668d5 100644
--- a/drivers/net/fec.h
+++ b/drivers/net/fec.h
@@ -43,6 +43,8 @@
 #define FEC_R_DES_START         0x180 /* Receive descriptor ring */
 #define FEC_X_DES_START         0x184 /* Transmit descriptor ring */
 #define FEC_R_BUFF_SIZE         0x188 /* Maximum receive buff size */
+#define FEC_MIIGSK_CFGR         0x300 /* MIIGSK Configuration reg */
+#define FEC_MIIGSK_ENR          0x308 /* MIIGSK Enable reg */
 
 #else
 
diff --git a/drivers/net/irda/bfin_sir.c b/drivers/net/irda/bfin_sir.c
index 911c082cee5a..f940dfa1f7f8 100644
--- a/drivers/net/irda/bfin_sir.c
+++ b/drivers/net/irda/bfin_sir.c
@@ -107,8 +107,12 @@ static int bfin_sir_set_speed(struct bfin_sir_port *port, int speed)
         case 57600:
         case 115200:
 
-                quot = (port->clk + (8 * speed)) / (16 * speed)\
-                                                - ANOMALY_05000230;
+                /*
+                 * IRDA is not affected by anomaly 05000230, so there is no
+                 * need to tweak the divisor like he UART driver (which will
+                 * slightly speed up the baud rate on us).
+                 */
+                quot = (port->clk + (8 * speed)) / (16 * speed);
 
                 do {
                         udelay(utime);
diff --git a/drivers/net/ixgbe/ixgbe.h b/drivers/net/ixgbe/ixgbe.h
index d0ea3d6dea95..ffae480587ae 100644
--- a/drivers/net/ixgbe/ixgbe.h
+++ b/drivers/net/ixgbe/ixgbe.h
@@ -360,6 +360,7 @@ struct ixgbe_adapter {
         u32 flags2;
 #define IXGBE_FLAG2_RSC_CAPABLE                 (u32)(1)
 #define IXGBE_FLAG2_RSC_ENABLED                 (u32)(1 << 1)
+#define IXGBE_FLAG2_TEMP_SENSOR_CAPABLE         (u32)(1 << 2)
 /* default to trying for four seconds */
 #define IXGBE_TRY_LINK_TIMEOUT (4 * HZ)
 
@@ -407,6 +408,8 @@ struct ixgbe_adapter {
         u16 eeprom_version;
 
         int node;
+        struct work_struct check_overtemp_task;
+        u32 interrupt_event;
 
         /* SR-IOV */
         DECLARE_BITMAP(active_vfs, IXGBE_MAX_VF_FUNCTIONS);
diff --git a/drivers/net/ixgbe/ixgbe_82598.c b/drivers/net/ixgbe/ixgbe_82598.c
index f2b7ff44215b..9c02d6014cc4 100644
--- a/drivers/net/ixgbe/ixgbe_82598.c
+++ b/drivers/net/ixgbe/ixgbe_82598.c
@@ -1236,6 +1236,7 @@ static struct ixgbe_phy_operations phy_ops_82598 = {
         .setup_link             = &ixgbe_setup_phy_link_generic,
         .setup_link_speed       = &ixgbe_setup_phy_link_speed_generic,
         .read_i2c_eeprom        = &ixgbe_read_i2c_eeprom_82598,
+        .check_overtemp   = &ixgbe_tn_check_overtemp,
 };
 
 struct ixgbe_info ixgbe_82598_info = {
diff --git a/drivers/net/ixgbe/ixgbe_82599.c b/drivers/net/ixgbe/ixgbe_82599.c
index e9706eb8e4ff..a4e2901f2f08 100644
--- a/drivers/net/ixgbe/ixgbe_82599.c
+++ b/drivers/net/ixgbe/ixgbe_82599.c
@@ -2395,6 +2395,7 @@ static struct ixgbe_phy_operations phy_ops_82599 = {
         .write_i2c_byte         = &ixgbe_write_i2c_byte_generic,
         .read_i2c_eeprom        = &ixgbe_read_i2c_eeprom_generic,
         .write_i2c_eeprom       = &ixgbe_write_i2c_eeprom_generic,
+        .check_overtemp         = &ixgbe_tn_check_overtemp,
 };
 
 struct ixgbe_info ixgbe_82599_info = {
diff --git a/drivers/net/ixgbe/ixgbe_main.c b/drivers/net/ixgbe/ixgbe_main.c
index 9551cbb7bf01..d571d101de08 100644
--- a/drivers/net/ixgbe/ixgbe_main.c
+++ b/drivers/net/ixgbe/ixgbe_main.c
@@ -108,6 +108,8 @@ static DEFINE_PCI_DEVICE_TABLE(ixgbe_pci_tbl) = {
          board_82599 },
         {PCI_VDEVICE(INTEL, IXGBE_DEV_ID_82599_CX4),
          board_82599 },
+        {PCI_VDEVICE(INTEL, IXGBE_DEV_ID_82599_T3_LOM),
+         board_82599 },
         {PCI_VDEVICE(INTEL, IXGBE_DEV_ID_82599_COMBO_BACKPLANE),
          board_82599 },
 
@@ -1618,6 +1620,48 @@ static void ixgbe_set_itr_msix(struct ixgbe_q_vector *q_vector)
         }
 }
 
+/**
+ * ixgbe_check_overtemp_task - worker thread to check over tempurature
+ * @work: pointer to work_struct containing our data
+ **/
+static void ixgbe_check_overtemp_task(struct work_struct *work)
+{
+        struct ixgbe_adapter *adapter = container_of(work,
+                                                     struct ixgbe_adapter,
+                                                     check_overtemp_task);
+        struct ixgbe_hw *hw = &adapter->hw;
+        u32 eicr = adapter->interrupt_event;
+
+        if (adapter->flags2 & IXGBE_FLAG2_TEMP_SENSOR_CAPABLE) {
+                switch (hw->device_id) {
+                case IXGBE_DEV_ID_82599_T3_LOM: {
+                        u32 autoneg;
+                        bool link_up = false;
+
+                        if (hw->mac.ops.check_link)
+                                hw->mac.ops.check_link(hw, &autoneg, &link_up, false);
+
+                        if (((eicr & IXGBE_EICR_GPI_SDP0) && (!link_up)) ||
+                            (eicr & IXGBE_EICR_LSC))
+                                /* Check if this is due to overtemp */
+                                if (hw->phy.ops.check_overtemp(hw) == IXGBE_ERR_OVERTEMP)
+                                        break;
+                        }
+                        return;
+                default:
+                        if (!(eicr & IXGBE_EICR_GPI_SDP0))
+                                return;
+                        break;
+                }
+                DPRINTK(DRV, ERR, "Network adapter has been stopped because it "
+                        "has over heated. Restart the computer. If the problem "
+                        "persists, power off the system and replace the "
+                        "adapter\n");
+                /* write to clear the interrupt */
+                IXGBE_WRITE_REG(hw, IXGBE_EICR, IXGBE_EICR_GPI_SDP0);
+        }
+}
+
 static void ixgbe_check_fan_failure(struct ixgbe_adapter *adapter, u32 eicr)
 {
         struct ixgbe_hw *hw = &adapter->hw;
@@ -1689,6 +1733,10 @@ static irqreturn_t ixgbe_msix_lsc(int irq, void *data)
 
         if (hw->mac.type == ixgbe_mac_82599EB) {
                 ixgbe_check_sfp_event(adapter, eicr);
+                adapter->interrupt_event = eicr;
+                if ((adapter->flags2 & IXGBE_FLAG2_TEMP_SENSOR_CAPABLE) &&
+                    ((eicr & IXGBE_EICR_GPI_SDP0) || (eicr & IXGBE_EICR_LSC)))
+                        schedule_work(&adapter->check_overtemp_task);
 
                 /* Handle Flow Director Full threshold interrupt */
                 if (eicr & IXGBE_EICR_FLOW_DIR) {
@@ -2190,6 +2238,8 @@ static inline void ixgbe_irq_enable(struct ixgbe_adapter *adapter)
         u32 mask;
 
         mask = (IXGBE_EIMS_ENABLE_MASK & ~IXGBE_EIMS_RTX_QUEUE);
+        if (adapter->flags2 & IXGBE_FLAG2_TEMP_SENSOR_CAPABLE)
+                mask |= IXGBE_EIMS_GPI_SDP0;
         if (adapter->flags & IXGBE_FLAG_FAN_FAIL_CAPABLE)
                 mask |= IXGBE_EIMS_GPI_SDP1;
         if (adapter->hw.mac.type == ixgbe_mac_82599EB) {
@@ -2250,6 +2300,9 @@ static irqreturn_t ixgbe_intr(int irq, void *data)
                 ixgbe_check_sfp_event(adapter, eicr);
 
         ixgbe_check_fan_failure(adapter, eicr);
+        if ((adapter->flags2 & IXGBE_FLAG2_TEMP_SENSOR_CAPABLE) &&
+            ((eicr & IXGBE_EICR_GPI_SDP0) || (eicr & IXGBE_EICR_LSC)))
+                schedule_work(&adapter->check_overtemp_task);
 
         if (napi_schedule_prep(&(q_vector->napi))) {
                 adapter->tx_ring[0]->total_packets = 0;
@@ -3265,6 +3318,13 @@ static int ixgbe_up_complete(struct ixgbe_adapter *adapter)
                 IXGBE_WRITE_REG(hw, IXGBE_EIAM, IXGBE_EICS_RTX_QUEUE);
         }
 
+        /* Enable Thermal over heat sensor interrupt */
+        if (adapter->flags2 & IXGBE_FLAG2_TEMP_SENSOR_CAPABLE) {
+                gpie = IXGBE_READ_REG(hw, IXGBE_GPIE);
+                gpie |= IXGBE_SDP0_GPIEN;
+                IXGBE_WRITE_REG(hw, IXGBE_GPIE, gpie);
+        }
+
         /* Enable fan failure interrupt if media type is copper */
         if (adapter->flags & IXGBE_FLAG_FAN_FAIL_CAPABLE) {
                 gpie = IXGBE_READ_REG(hw, IXGBE_GPIE);
@@ -3666,6 +3726,9 @@ void ixgbe_down(struct ixgbe_adapter *adapter)
             adapter->flags & IXGBE_FLAG_FDIR_PERFECT_CAPABLE)
                 cancel_work_sync(&adapter->fdir_reinit_task);
 
+        if (adapter->flags2 & IXGBE_FLAG2_TEMP_SENSOR_CAPABLE)
+                cancel_work_sync(&adapter->check_overtemp_task);
+
         /* disable transmits in the hardware now that interrupts are off */
         for (i = 0; i < adapter->num_tx_queues; i++) {
                 j = adapter->tx_ring[i]->reg_idx;
@@ -4645,6 +4708,8 @@ static int __devinit ixgbe_sw_init(struct ixgbe_adapter *adapter)
                 adapter->max_msix_q_vectors = MAX_MSIX_Q_VECTORS_82599;
                 adapter->flags2 |= IXGBE_FLAG2_RSC_CAPABLE;
                 adapter->flags2 |= IXGBE_FLAG2_RSC_ENABLED;
+                if (hw->device_id == IXGBE_DEV_ID_82599_T3_LOM)
+                        adapter->flags2 |= IXGBE_FLAG2_TEMP_SENSOR_CAPABLE;
                 if (dev->features & NETIF_F_NTUPLE) {
                         /* Flow Director perfect filter enabled */
                         adapter->flags |= IXGBE_FLAG_FDIR_PERFECT_CAPABLE;
@@ -6561,7 +6626,9 @@ static int __devinit ixgbe_probe(struct pci_dev *pdev,
         }
 
         /* reset_hw fills in the perm_addr as well */
+        hw->phy.reset_if_overtemp = true;
         err = hw->mac.ops.reset_hw(hw);
+        hw->phy.reset_if_overtemp = false;
         if (err == IXGBE_ERR_SFP_NOT_PRESENT &&
             hw->mac.type == ixgbe_mac_82598EB) {
                 /*
@@ -6730,6 +6797,8 @@ static int __devinit ixgbe_probe(struct pci_dev *pdev,
             adapter->flags & IXGBE_FLAG_FDIR_PERFECT_CAPABLE)
                 INIT_WORK(&adapter->fdir_reinit_task, ixgbe_fdir_reinit_task);
 
+        if (adapter->flags2 & IXGBE_FLAG2_TEMP_SENSOR_CAPABLE)
+                INIT_WORK(&adapter->check_overtemp_task, ixgbe_check_overtemp_task);
 #ifdef CONFIG_IXGBE_DCA
         if (dca_add_requester(&pdev->dev) == 0) {
                 adapter->flags |= IXGBE_FLAG_DCA_ENABLED;
diff --git a/drivers/net/ixgbe/ixgbe_phy.c b/drivers/net/ixgbe/ixgbe_phy.c
index 22d21af14783..09e1911ff510 100644
--- a/drivers/net/ixgbe/ixgbe_phy.c
+++ b/drivers/net/ixgbe/ixgbe_phy.c
@@ -135,6 +135,11 @@ static enum ixgbe_phy_type ixgbe_get_phy_type_from_id(u32 phy_id)
  **/
 s32 ixgbe_reset_phy_generic(struct ixgbe_hw *hw)
 {
+        /* Don't reset PHY if it's shut down due to overtemp. */
+        if (!hw->phy.reset_if_overtemp &&
+            (IXGBE_ERR_OVERTEMP == hw->phy.ops.check_overtemp(hw)))
+                return 0;
+
         /*
          * Perform soft PHY reset to the PHY_XS.
          * This will cause a soft reset to the PHY
@@ -1345,3 +1350,28 @@ s32 ixgbe_get_phy_firmware_version_tnx(struct ixgbe_hw *hw,
         return status;
 }
 
+/**
+ *  ixgbe_tn_check_overtemp - Checks if an overtemp occured.
+ *  @hw: pointer to hardware structure
+ *
+ *  Checks if the LASI temp alarm status was triggered due to overtemp
+ **/
+s32 ixgbe_tn_check_overtemp(struct ixgbe_hw *hw)
+{
+        s32 status = 0;
+        u16 phy_data = 0;
+
+        if (hw->device_id != IXGBE_DEV_ID_82599_T3_LOM)
+                goto out;
+
+        /* Check that the LASI temp alarm status was triggered */
+        hw->phy.ops.read_reg(hw, IXGBE_TN_LASI_STATUS_REG,
+                             MDIO_MMD_PMAPMD, &phy_data);
+
+        if (!(phy_data & IXGBE_TN_LASI_STATUS_TEMP_ALARM))
+                goto out;
+
+        status = IXGBE_ERR_OVERTEMP;
+out:
+        return status;
+}
diff --git a/drivers/net/ixgbe/ixgbe_phy.h b/drivers/net/ixgbe/ixgbe_phy.h
index c9c545941407..ef4ba834c593 100644
--- a/drivers/net/ixgbe/ixgbe_phy.h
+++ b/drivers/net/ixgbe/ixgbe_phy.h
@@ -80,6 +80,8 @@
 #define IXGBE_I2C_T_SU_STO  4
 #define IXGBE_I2C_T_BUF     5
 
+#define IXGBE_TN_LASI_STATUS_REG        0x9005
+#define IXGBE_TN_LASI_STATUS_TEMP_ALARM 0x0008
 
 s32 ixgbe_init_phy_ops_generic(struct ixgbe_hw *hw);
 s32 ixgbe_identify_phy_generic(struct ixgbe_hw *hw);
@@ -106,6 +108,7 @@ s32 ixgbe_identify_sfp_module_generic(struct ixgbe_hw *hw);
 s32 ixgbe_get_sfp_init_sequence_offsets(struct ixgbe_hw *hw,
                                         u16 *list_offset,
                                         u16 *data_offset);
+s32 ixgbe_tn_check_overtemp(struct ixgbe_hw *hw);
 s32 ixgbe_read_i2c_byte_generic(struct ixgbe_hw *hw, u8 byte_offset,
                                 u8 dev_addr, u8 *data);
 s32 ixgbe_write_i2c_byte_generic(struct ixgbe_hw *hw, u8 byte_offset,
diff --git a/drivers/net/ixgbe/ixgbe_type.h b/drivers/net/ixgbe/ixgbe_type.h
index 39b9be897439..2eb6e151016c 100644
--- a/drivers/net/ixgbe/ixgbe_type.h
+++ b/drivers/net/ixgbe/ixgbe_type.h
@@ -51,6 +51,7 @@
 #define IXGBE_DEV_ID_82599_KX4           0x10F7
 #define IXGBE_DEV_ID_82599_KX4_MEZZ      0x1514
 #define IXGBE_DEV_ID_82599_KR            0x1517
+#define IXGBE_DEV_ID_82599_T3_LOM        0x151C
 #define IXGBE_DEV_ID_82599_CX4           0x10F9
 #define IXGBE_DEV_ID_82599_SFP           0x10FB
 #define IXGBE_DEV_ID_82599_SFP_EM        0x1507
@@ -2470,6 +2471,7 @@ struct ixgbe_phy_operations {
         s32 (*write_i2c_byte)(struct ixgbe_hw *, u8, u8, u8);
         s32 (*read_i2c_eeprom)(struct ixgbe_hw *, u8 , u8 *);
         s32 (*write_i2c_eeprom)(struct ixgbe_hw *, u8, u8);
+        s32 (*check_overtemp)(struct ixgbe_hw *);
 };
 
 struct ixgbe_eeprom_info {
@@ -2518,6 +2520,7 @@ struct ixgbe_phy_info {
         enum ixgbe_smart_speed          smart_speed;
         bool                            smart_speed_active;
         bool                            multispeed_fiber;
+        bool                            reset_if_overtemp;
 };
 
 #include "ixgbe_mbx.h"
@@ -2605,6 +2608,7 @@ struct ixgbe_info {
 #define IXGBE_ERR_FDIR_REINIT_FAILED            -23
 #define IXGBE_ERR_EEPROM_VERSION                -24
 #define IXGBE_ERR_NO_SPACE                      -25
+#define IXGBE_ERR_OVERTEMP                      -26
 #define IXGBE_NOT_IMPLEMENTED                   0x7FFFFFFF
 
 #endif /* _IXGBE_TYPE_H_ */
diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
index 4e238afab4a3..87e8d4cb4057 100644
--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
@@ -634,11 +634,18 @@ int macvlan_common_newlink(struct net *src_net, struct net_device *dev,
 
         err = register_netdevice(dev);
         if (err < 0)
-                return err;
+                goto destroy_port;
 
         list_add_tail(&vlan->list, &port->vlans);
         netif_stacked_transfer_operstate(lowerdev, dev);
+
         return 0;
+
+destroy_port:
+        if (list_empty(&port->vlans))
+                macvlan_port_destroy(lowerdev);
+
+        return err;
 }
 EXPORT_SYMBOL_GPL(macvlan_common_newlink);
 
diff --git a/drivers/net/pppoe.c b/drivers/net/pppoe.c
index b1b93ff2351f..805b64d1e893 100644
--- a/drivers/net/pppoe.c
+++ b/drivers/net/pppoe.c
@@ -289,6 +289,7 @@ static void pppoe_flush_dev(struct net_device *dev)
         struct pppoe_net *pn;
         int i;
 
+        pn = pppoe_pernet(dev_net(dev));
         write_lock_bh(&pn->hash_lock);
         for (i = 0; i < PPPOE_HASH_SIZE; i++) {
                 struct pppox_sock *po = pn->hash_table[i];
diff --git a/drivers/net/sh_eth.c b/drivers/net/sh_eth.c
index 586ed0915a29..501a55ffce57 100644
--- a/drivers/net/sh_eth.c
+++ b/drivers/net/sh_eth.c
@@ -1294,6 +1294,9 @@ static int sh_mdio_release(struct net_device *ndev)
         /* remove mdio bus info from net_device */
         dev_set_drvdata(&ndev->dev, NULL);
 
+        /* free interrupts memory */
+        kfree(bus->irq);
+
         /* free bitbang info */
         free_mdio_bitbang(bus);
 
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 005cad689578..6ad6fe706312 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -526,6 +526,8 @@ static inline struct sk_buff *tun_alloc_skb(struct tun_struct *tun,
         struct sk_buff *skb;
         int err;
 
+        sock_update_classid(sk);
+
         /* Under a page?  Don't bother with paged skb. */
         if (prepad + len < PAGE_SIZE || !linear)
                 linear = len;
diff --git a/drivers/net/usb/asix.c b/drivers/net/usb/asix.c
index 31b73310ec77..1f802e90474c 100644
--- a/drivers/net/usb/asix.c
+++ b/drivers/net/usb/asix.c
@@ -322,7 +322,7 @@ static int asix_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
                 size = (u16) (header & 0x0000ffff);
 
                 if ((skb->len) - ((size + 1) & 0xfffe) == 0) {
-                        u8 alignment = (u32)skb->data & 0x3;
+                        u8 alignment = (unsigned long)skb->data & 0x3;
                         if (alignment != 0x2) {
                                 /*
                                  * not 16bit aligned so use the room provided by
@@ -351,7 +351,7 @@ static int asix_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
                 }
                 ax_skb = skb_clone(skb, GFP_ATOMIC);
                 if (ax_skb) {
-                        u8 alignment = (u32)packet & 0x3;
+                        u8 alignment = (unsigned long)packet & 0x3;
                         ax_skb->len = size;
 
                         if (alignment != 0x2) {
diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
index 9964df199511..0a3c41faea9c 100644
--- a/drivers/net/usb/hso.c
+++ b/drivers/net/usb/hso.c
@@ -475,6 +475,9 @@ static const struct usb_device_id hso_ids[] = {
         {USB_DEVICE(0x0af0, 0x8302)},
         {USB_DEVICE(0x0af0, 0x8304)},
         {USB_DEVICE(0x0af0, 0x8400)},
+        {USB_DEVICE(0x0af0, 0x8600)},
+        {USB_DEVICE(0x0af0, 0x8800)},
+        {USB_DEVICE(0x0af0, 0x8900)},
         {USB_DEVICE(0x0af0, 0xd035)},
         {USB_DEVICE(0x0af0, 0xd055)},
         {USB_DEVICE(0x0af0, 0xd155)},
diff --git a/drivers/net/wimax/i2400m/rx.c b/drivers/net/wimax/i2400m/rx.c
index 6537593fae66..8cc9e319f435 100644
--- a/drivers/net/wimax/i2400m/rx.c
+++ b/drivers/net/wimax/i2400m/rx.c
@@ -1027,12 +1027,12 @@ void i2400m_rx_edata(struct i2400m *i2400m, struct sk_buff *skb_rx,
                 ro_sn = (reorder >> I2400M_RO_SN_SHIFT) & I2400M_RO_SN;
 
                 spin_lock_irqsave(&i2400m->rx_lock, flags);
-                roq = &i2400m->rx_roq[ro_cin];
-                if (roq == NULL) {
+                if (i2400m->rx_roq == NULL) {
                         kfree_skb(skb); /* rx_roq is already destroyed */
                         spin_unlock_irqrestore(&i2400m->rx_lock, flags);
                         goto error;
                 }
+                roq = &i2400m->rx_roq[ro_cin];
                 kref_get(&i2400m->rx_roq_refcount);
                 spin_unlock_irqrestore(&i2400m->rx_lock, flags);
 
diff --git a/drivers/net/wireless/ath/ath5k/base.c b/drivers/net/wireless/ath/ath5k/base.c
index 5f04cf38a5bc..cc6d41dec332 100644
--- a/drivers/net/wireless/ath/ath5k/base.c
+++ b/drivers/net/wireless/ath/ath5k/base.c
@@ -1214,6 +1214,7 @@ ath5k_rxbuf_setup(struct ath5k_softc *sc, struct ath5k_buf *bf)
         struct ath5k_hw *ah = sc->ah;
         struct sk_buff *skb = bf->skb;
         struct ath5k_desc *ds;
+        int ret;
 
         if (!skb) {
                 skb = ath5k_rx_skb_alloc(sc, &bf->skbaddr);
@@ -1240,9 +1241,9 @@ ath5k_rxbuf_setup(struct ath5k_softc *sc, struct ath5k_buf *bf)
         ds = bf->desc;
         ds->ds_link = bf->daddr;        /* link to self */
         ds->ds_data = bf->skbaddr;
-        ah->ah_setup_rx_desc(ah, ds,
-                skb_tailroom(skb),      /* buffer size */
-                0);
+        ret = ah->ah_setup_rx_desc(ah, ds, ah->common.rx_bufsize, 0);
+        if (ret)
+                return ret;
 
         if (sc->rxlink != NULL)
                 *sc->rxlink = bf->daddr;
diff --git a/drivers/net/wireless/ath/ath9k/beacon.c b/drivers/net/wireless/ath/ath9k/beacon.c
index c8a4558f79ba..f43d85a302c4 100644
--- a/drivers/net/wireless/ath/ath9k/beacon.c
+++ b/drivers/net/wireless/ath/ath9k/beacon.c
@@ -76,22 +76,13 @@ static void ath_beacon_setup(struct ath_softc *sc, struct ath_vif *avp,
         ds = bf->bf_desc;
         flags = ATH9K_TXDESC_NOACK;
 
-        if (((sc->sc_ah->opmode == NL80211_IFTYPE_ADHOC) ||
-             (sc->sc_ah->opmode == NL80211_IFTYPE_MESH_POINT)) &&
-            (ah->caps.hw_caps & ATH9K_HW_CAP_VEOL)) {
-                ds->ds_link = bf->bf_daddr; /* self-linked */
-                flags |= ATH9K_TXDESC_VEOL;
-                /* Let hardware handle antenna switching. */
-                antenna = 0;
-        } else {
-                ds->ds_link = 0;
-                /*
-                 * Switch antenna every beacon.
-                 * Should only switch every beacon period, not for every SWBA
-                 * XXX assumes two antennae
-                 */
-                antenna = ((sc->beacon.ast_be_xmit / sc->nbcnvifs) & 1 ? 2 : 1);
-        }
+        ds->ds_link = 0;
+        /*
+         * Switch antenna every beacon.
+         * Should only switch every beacon period, not for every SWBA
+         * XXX assumes two antennae
+         */
+        antenna = ((sc->beacon.ast_be_xmit / sc->nbcnvifs) & 1 ? 2 : 1);
 
         sband = &sc->sbands[common->hw->conf.channel->band];
         rate = sband->bitrates[rateidx].hw_value;
@@ -215,36 +206,6 @@ static struct ath_buf *ath_beacon_generate(struct ieee80211_hw *hw,
         return bf;
 }
 
-/*
- * Startup beacon transmission for adhoc mode when they are sent entirely
- * by the hardware using the self-linked descriptor + veol trick.
-*/
-static void ath_beacon_start_adhoc(struct ath_softc *sc,
-                                   struct ieee80211_vif *vif)
-{
-        struct ath_hw *ah = sc->sc_ah;
-        struct ath_common *common = ath9k_hw_common(ah);
-        struct ath_buf *bf;
-        struct ath_vif *avp;
-        struct sk_buff *skb;
-
-        avp = (void *)vif->drv_priv;
-
-        if (avp->av_bcbuf == NULL)
-                return;
-
-        bf = avp->av_bcbuf;
-        skb = bf->bf_mpdu;
-
-        ath_beacon_setup(sc, avp, bf, 0);
-
-        /* NB: caller is known to have already stopped tx dma */
-        ath9k_hw_puttxbuf(ah, sc->beacon.beaconq, bf->bf_daddr);
-        ath9k_hw_txstart(ah, sc->beacon.beaconq);
-        ath_print(common, ATH_DBG_BEACON, "TXDP%u = %llx (%p)\n",
-                  sc->beacon.beaconq, ito64(bf->bf_daddr), bf->bf_desc);
-}
-
 int ath_beacon_alloc(struct ath_wiphy *aphy, struct ieee80211_vif *vif)
 {
         struct ath_softc *sc = aphy->sc;
@@ -265,7 +226,8 @@ int ath_beacon_alloc(struct ath_wiphy *aphy, struct ieee80211_vif *vif)
                 list_del(&avp->av_bcbuf->list);
 
                 if (sc->sc_ah->opmode == NL80211_IFTYPE_AP ||
-                    !(sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_VEOL)) {
+                    sc->sc_ah->opmode == NL80211_IFTYPE_ADHOC ||
+                    sc->sc_ah->opmode == NL80211_IFTYPE_MESH_POINT) {
                         int slot;
                         /*
                          * Assign the vif to a beacon xmit slot. As
@@ -274,17 +236,11 @@ int ath_beacon_alloc(struct ath_wiphy *aphy, struct ieee80211_vif *vif)
                         avp->av_bslot = 0;
                         for (slot = 0; slot < ATH_BCBUF; slot++)
                                 if (sc->beacon.bslot[slot] == NULL) {
-                                        /*
-                                         * XXX hack, space out slots to better
-                                         * deal with misses
-                                         */
-                                        if (slot+1 < ATH_BCBUF &&
-                                            sc->beacon.bslot[slot+1] == NULL) {
-                                                avp->av_bslot = slot+1;
-                                                break;
-                                        }
                                         avp->av_bslot = slot;
+
                                         /* NB: keep looking for a double slot */
+                                        if (slot == 0 || !sc->beacon.bslot[slot-1])
+                                                break;
                                 }
                         BUG_ON(sc->beacon.bslot[avp->av_bslot] != NULL);
                         sc->beacon.bslot[avp->av_bslot] = vif;
@@ -721,8 +677,7 @@ static void ath_beacon_config_adhoc(struct ath_softc *sc,
          * self-linked tx descriptor and let the hardware deal with things.
          */
         intval |= ATH9K_BEACON_ENA;
-        if (!(ah->caps.hw_caps & ATH9K_HW_CAP_VEOL))
-                ah->imask |= ATH9K_INT_SWBA;
+        ah->imask |= ATH9K_INT_SWBA;
 
         ath_beaconq_config(sc);
 
@@ -732,10 +687,6 @@ static void ath_beacon_config_adhoc(struct ath_softc *sc,
         ath9k_beacon_init(sc, nexttbtt, intval);
         sc->beacon.bmisscnt = 0;
         ath9k_hw_set_interrupts(ah, ah->imask);
-
-        /* FIXME: Handle properly when vif is NULL */
-        if (vif && ah->caps.hw_caps & ATH9K_HW_CAP_VEOL)
-                ath_beacon_start_adhoc(sc, vif);
 }
 
 void ath_beacon_config(struct ath_softc *sc, struct ieee80211_vif *vif)
diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c
index 46dc41a16faa..77b359162d6c 100644
--- a/drivers/net/wireless/ath/ath9k/hif_usb.c
+++ b/drivers/net/wireless/ath/ath9k/hif_usb.c
@@ -107,12 +107,14 @@ static inline void ath9k_skb_queue_purge(struct hif_device_usb *hif_dev,
 static void hif_usb_tx_cb(struct urb *urb)
 {
         struct tx_buf *tx_buf = (struct tx_buf *) urb->context;
-        struct hif_device_usb *hif_dev = tx_buf->hif_dev;
+        struct hif_device_usb *hif_dev;
         struct sk_buff *skb;
 
-        if (!hif_dev || !tx_buf)
+        if (!tx_buf || !tx_buf->hif_dev)
                 return;
 
+        hif_dev = tx_buf->hif_dev;
+
         switch (urb->status) {
         case 0:
                 break;
@@ -607,6 +609,10 @@ static int ath9k_hif_usb_alloc_tx_urbs(struct hif_device_usb *hif_dev)
 
         return 0;
 err:
+        if (tx_buf) {
+                kfree(tx_buf->buf);
+                kfree(tx_buf);
+        }
         ath9k_hif_usb_dealloc_tx_urbs(hif_dev);
         return -ENOMEM;
 }
diff --git a/drivers/net/wireless/ath/ath9k/htc.h b/drivers/net/wireless/ath/ath9k/htc.h
index ad556aa8da39..c251603ab032 100644
--- a/drivers/net/wireless/ath/ath9k/htc.h
+++ b/drivers/net/wireless/ath/ath9k/htc.h
@@ -23,6 +23,7 @@
 #include <linux/skbuff.h>
 #include <linux/netdevice.h>
 #include <linux/leds.h>
+#include <linux/slab.h>
 #include <net/mac80211.h>
 
 #include "common.h"
diff --git a/drivers/net/wireless/ath/ath9k/pci.c b/drivers/net/wireless/ath/ath9k/pci.c
index 257b10ba6f57..1ec836cf1c0d 100644
--- a/drivers/net/wireless/ath/ath9k/pci.c
+++ b/drivers/net/wireless/ath/ath9k/pci.c
@@ -28,7 +28,6 @@ static DEFINE_PCI_DEVICE_TABLE(ath_pci_id_table) = {
         { PCI_VDEVICE(ATHEROS, 0x002C) }, /* PCI-E 802.11n bonded out */
         { PCI_VDEVICE(ATHEROS, 0x002D) }, /* PCI   */
         { PCI_VDEVICE(ATHEROS, 0x002E) }, /* PCI-E */
-        { PCI_VDEVICE(ATHEROS, 0x0030) }, /* PCI-E  AR9300 */
         { 0 }
 };
 
diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c
index ba139132c85f..ca6065b71b46 100644
--- a/drivers/net/wireless/ath/ath9k/recv.c
+++ b/drivers/net/wireless/ath/ath9k/recv.c
@@ -19,6 +19,12 @@
 
 #define SKB_CB_ATHBUF(__skb)    (*((struct ath_buf **)__skb->cb))
 
+static inline bool ath9k_check_auto_sleep(struct ath_softc *sc)
+{
+        return sc->ps_enabled &&
+               (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_AUTOSLEEP);
+}
+
 static struct ieee80211_hw * ath_get_virt_hw(struct ath_softc *sc,
                                              struct ieee80211_hdr *hdr)
 {
@@ -616,8 +622,8 @@ static void ath_rx_ps(struct ath_softc *sc, struct sk_buff *skb)
         hdr = (struct ieee80211_hdr *)skb->data;
 
         /* Process Beacon and CAB receive in PS state */
-        if ((sc->ps_flags & PS_WAIT_FOR_BEACON) &&
-            ieee80211_is_beacon(hdr->frame_control))
+        if (((sc->ps_flags & PS_WAIT_FOR_BEACON) || ath9k_check_auto_sleep(sc))
+            && ieee80211_is_beacon(hdr->frame_control))
                 ath_rx_ps_beacon(sc, skb);
         else if ((sc->ps_flags & PS_WAIT_FOR_CAB) &&
                  (ieee80211_is_data(hdr->frame_control) ||
@@ -932,9 +938,10 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush, bool hp)
                         sc->rx.rxotherant = 0;
                 }
 
-                if (unlikely(sc->ps_flags & (PS_WAIT_FOR_BEACON |
-                                             PS_WAIT_FOR_CAB |
-                                             PS_WAIT_FOR_PSPOLL_DATA)))
+                if (unlikely(ath9k_check_auto_sleep(sc) ||
+                             (sc->ps_flags & (PS_WAIT_FOR_BEACON |
+                                              PS_WAIT_FOR_CAB |
+                                              PS_WAIT_FOR_PSPOLL_DATA))))
                         ath_rx_ps(sc, skb);
 
                 ath_rx_send_to_mac80211(hw, sc, skb, rxs);
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-ict.c b/drivers/net/wireless/iwlwifi/iwl-agn-ict.c
index a273e373b7b0..c92b2c0cbd91 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-ict.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-ict.c
@@ -30,6 +30,7 @@
 #include <linux/module.h>
 #include <linux/etherdevice.h>
 #include <linux/sched.h>
+#include <linux/gfp.h>
 #include <net/mac80211.h>
 
 #include "iwl-dev.h"
diff --git a/drivers/net/wireless/iwlwifi/iwl-scan.c b/drivers/net/wireless/iwlwifi/iwl-scan.c
index 107e173112f6..5d3f51ff2f0d 100644
--- a/drivers/net/wireless/iwlwifi/iwl-scan.c
+++ b/drivers/net/wireless/iwlwifi/iwl-scan.c
@@ -376,6 +376,11 @@ void iwl_bg_start_internal_scan(struct work_struct *work)
 
         mutex_lock(&priv->mutex);
 
+        if (priv->is_internal_short_scan == true) {
+                IWL_DEBUG_SCAN(priv, "Internal scan already in progress\n");
+                goto unlock;
+        }
+
         if (!iwl_is_ready_rf(priv)) {
                 IWL_DEBUG_SCAN(priv, "not ready or exit pending\n");
                 goto unlock;
@@ -497,17 +502,27 @@ void iwl_bg_scan_completed(struct work_struct *work)
 {
         struct iwl_priv *priv =
             container_of(work, struct iwl_priv, scan_completed);
+        bool internal = false;
 
         IWL_DEBUG_SCAN(priv, "SCAN complete scan\n");
 
         cancel_delayed_work(&priv->scan_check);
 
-        if (!priv->is_internal_short_scan)
-                ieee80211_scan_completed(priv->hw, false);
-        else {
+        mutex_lock(&priv->mutex);
+        if (priv->is_internal_short_scan) {
                 priv->is_internal_short_scan = false;
                 IWL_DEBUG_SCAN(priv, "internal short scan completed\n");
+                internal = true;
         }
+        mutex_unlock(&priv->mutex);
+
+        /*
+         * Do not hold mutex here since this will cause mac80211 to call
+         * into driver again into functions that will attempt to take
+         * mutex.
+         */
+        if (!internal)
+                ieee80211_scan_completed(priv->hw, false);
 
         if (test_bit(STATUS_EXIT_PENDING, &priv->status))
                 return;
diff --git a/drivers/net/wireless/iwlwifi/iwl-sta.c b/drivers/net/wireless/iwlwifi/iwl-sta.c
index 85ed235ac901..83a26361a9b5 100644
--- a/drivers/net/wireless/iwlwifi/iwl-sta.c
+++ b/drivers/net/wireless/iwlwifi/iwl-sta.c
@@ -431,7 +431,7 @@ int iwl_add_bssid_station(struct iwl_priv *priv, const u8 *addr, bool init_rs,
         struct iwl_link_quality_cmd *link_cmd;
         unsigned long flags;
 
-        if (*sta_id_r)
+        if (sta_id_r)
                 *sta_id_r = IWL_INVALID_STATION;
 
         ret = iwl_add_station_common(priv, addr, 0, NULL, &sta_id);
diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c
index 2d2890878dea..4bd61ee627c0 100644
--- a/drivers/net/wireless/rndis_wlan.c
+++ b/drivers/net/wireless/rndis_wlan.c
@@ -2572,14 +2572,18 @@ static void rndis_wlan_do_link_up_work(struct usbnet *usbdev)
 
 static void rndis_wlan_do_link_down_work(struct usbnet *usbdev)
 {
-        union iwreq_data evt;
+        struct rndis_wlan_private *priv = get_rndis_wlan_priv(usbdev);
 
-        netif_carrier_off(usbdev->net);
+        if (priv->connected) {
+                priv->connected = false;
+                memset(priv->bssid, 0, ETH_ALEN);
+
+                deauthenticate(usbdev);
 
-        evt.data.flags = 0;
-        evt.data.length = 0;
-        memset(evt.ap_addr.sa_data, 0, ETH_ALEN);
-        wireless_send_event(usbdev->net, SIOCGIWAP, &evt, NULL);
+                cfg80211_disconnected(usbdev->net, 0, NULL, 0, GFP_KERNEL);
+        }
+
+        netif_carrier_off(usbdev->net);
 }
 
 static void rndis_wlan_worker(struct work_struct *work)
diff --git a/drivers/net/wireless/rt2x00/rt2400pci.c b/drivers/net/wireless/rt2x00/rt2400pci.c
index 4ba7b038928f..ad2c98af7e9d 100644
--- a/drivers/net/wireless/rt2x00/rt2400pci.c
+++ b/drivers/net/wireless/rt2x00/rt2400pci.c
@@ -926,7 +926,7 @@ static void rt2400pci_disable_radio(struct rt2x00_dev *rt2x00dev)
 static int rt2400pci_set_state(struct rt2x00_dev *rt2x00dev,
                                enum dev_state state)
 {
-        u32 reg;
+        u32 reg, reg2;
         unsigned int i;
         char put_to_sleep;
         char bbp_state;
@@ -947,11 +947,12 @@ static int rt2400pci_set_state(struct rt2x00_dev *rt2x00dev,
          * device has entered the correct state.
          */
         for (i = 0; i < REGISTER_BUSY_COUNT; i++) {
-                rt2x00pci_register_read(rt2x00dev, PWRCSR1, &reg);
-                bbp_state = rt2x00_get_field32(reg, PWRCSR1_BBP_CURR_STATE);
-                rf_state = rt2x00_get_field32(reg, PWRCSR1_RF_CURR_STATE);
+                rt2x00pci_register_read(rt2x00dev, PWRCSR1, &reg2);
+                bbp_state = rt2x00_get_field32(reg2, PWRCSR1_BBP_CURR_STATE);
+                rf_state = rt2x00_get_field32(reg2, PWRCSR1_RF_CURR_STATE);
                 if (bbp_state == state && rf_state == state)
                         return 0;
+                rt2x00pci_register_write(rt2x00dev, PWRCSR1, reg);
                 msleep(10);
         }
 
diff --git a/drivers/net/wireless/rt2x00/rt2500pci.c b/drivers/net/wireless/rt2x00/rt2500pci.c
index 89d132d4af12..41da3d218c65 100644
--- a/drivers/net/wireless/rt2x00/rt2500pci.c
+++ b/drivers/net/wireless/rt2x00/rt2500pci.c
@@ -1084,7 +1084,7 @@ static void rt2500pci_disable_radio(struct rt2x00_dev *rt2x00dev)
 static int rt2500pci_set_state(struct rt2x00_dev *rt2x00dev,
                                enum dev_state state)
 {
-        u32 reg;
+        u32 reg, reg2;
         unsigned int i;
         char put_to_sleep;
         char bbp_state;
@@ -1105,11 +1105,12 @@ static int rt2500pci_set_state(struct rt2x00_dev *rt2x00dev,
          * device has entered the correct state.
          */
         for (i = 0; i < REGISTER_BUSY_COUNT; i++) {
-                rt2x00pci_register_read(rt2x00dev, PWRCSR1, &reg);
-                bbp_state = rt2x00_get_field32(reg, PWRCSR1_BBP_CURR_STATE);
-                rf_state = rt2x00_get_field32(reg, PWRCSR1_RF_CURR_STATE);
+                rt2x00pci_register_read(rt2x00dev, PWRCSR1, &reg2);
+                bbp_state = rt2x00_get_field32(reg2, PWRCSR1_BBP_CURR_STATE);
+                rf_state = rt2x00_get_field32(reg2, PWRCSR1_RF_CURR_STATE);
                 if (bbp_state == state && rf_state == state)
                         return 0;
+                rt2x00pci_register_write(rt2x00dev, PWRCSR1, reg);
                 msleep(10);
         }
 
diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c
index 0f8b84b7224c..699161327d65 100644
--- a/drivers/net/wireless/rt2x00/rt2800usb.c
+++ b/drivers/net/wireless/rt2x00/rt2800usb.c
@@ -413,7 +413,7 @@ static void rt2800usb_write_tx_desc(struct rt2x00_dev *rt2x00dev,
          */
         rt2x00_desc_read(txi, 0, &word);
         rt2x00_set_field32(&word, TXINFO_W0_USB_DMA_TX_PKT_LEN,
-                           skb->len + TXWI_DESC_SIZE);
+                           skb->len - TXINFO_DESC_SIZE);
         rt2x00_set_field32(&word, TXINFO_W0_WIV,
                            !test_bit(ENTRY_TXD_ENCRYPT_IV, &txdesc->flags));
         rt2x00_set_field32(&word, TXINFO_W0_QSEL, 2);
diff --git a/drivers/net/wireless/rt2x00/rt2x00pci.c b/drivers/net/wireless/rt2x00/rt2x00pci.c
index a016f7ccde29..f71eee67f977 100644
--- a/drivers/net/wireless/rt2x00/rt2x00pci.c
+++ b/drivers/net/wireless/rt2x00/rt2x00pci.c
@@ -206,7 +206,7 @@ void rt2x00pci_uninitialize(struct rt2x00_dev *rt2x00dev)
         /*
          * Free irq line.
          */
-        free_irq(to_pci_dev(rt2x00dev->dev)->irq, rt2x00dev);
+        free_irq(rt2x00dev->irq, rt2x00dev);
 
         /*
          * Free DMA
diff --git a/drivers/net/wireless/rt2x00/rt61pci.c b/drivers/net/wireless/rt2x00/rt61pci.c
index 2e3076f67535..6a74baf4e934 100644
--- a/drivers/net/wireless/rt2x00/rt61pci.c
+++ b/drivers/net/wireless/rt2x00/rt61pci.c
@@ -1689,7 +1689,7 @@ static void rt61pci_disable_radio(struct rt2x00_dev *rt2x00dev)
 
 static int rt61pci_set_state(struct rt2x00_dev *rt2x00dev, enum dev_state state)
 {
-        u32 reg;
+        u32 reg, reg2;
         unsigned int i;
         char put_to_sleep;
 
@@ -1706,10 +1706,11 @@ static int rt61pci_set_state(struct rt2x00_dev *rt2x00dev, enum dev_state state)
          * device has entered the correct state.
          */
         for (i = 0; i < REGISTER_BUSY_COUNT; i++) {
-                rt2x00pci_register_read(rt2x00dev, MAC_CSR12, &reg);
-                state = rt2x00_get_field32(reg, MAC_CSR12_BBP_CURRENT_STATE);
+                rt2x00pci_register_read(rt2x00dev, MAC_CSR12, &reg2);
+                state = rt2x00_get_field32(reg2, MAC_CSR12_BBP_CURRENT_STATE);
                 if (state == !put_to_sleep)
                         return 0;
+                rt2x00pci_register_write(rt2x00dev, MAC_CSR12, reg);
                 msleep(10);
         }
 
diff --git a/drivers/net/wireless/rt2x00/rt73usb.c b/drivers/net/wireless/rt2x00/rt73usb.c
index e35bd19c3c5a..6e0d82efe924 100644
--- a/drivers/net/wireless/rt2x00/rt73usb.c
+++ b/drivers/net/wireless/rt2x00/rt73usb.c
@@ -1366,7 +1366,7 @@ static void rt73usb_disable_radio(struct rt2x00_dev *rt2x00dev)
 
 static int rt73usb_set_state(struct rt2x00_dev *rt2x00dev, enum dev_state state)
 {
-        u32 reg;
+        u32 reg, reg2;
         unsigned int i;
         char put_to_sleep;
 
@@ -1383,10 +1383,11 @@ static int rt73usb_set_state(struct rt2x00_dev *rt2x00dev, enum dev_state state)
          * device has entered the correct state.
          */
         for (i = 0; i < REGISTER_BUSY_COUNT; i++) {
-                rt2x00usb_register_read(rt2x00dev, MAC_CSR12, &reg);
-                state = rt2x00_get_field32(reg, MAC_CSR12_BBP_CURRENT_STATE);
+                rt2x00usb_register_read(rt2x00dev, MAC_CSR12, &reg2);
+                state = rt2x00_get_field32(reg2, MAC_CSR12_BBP_CURRENT_STATE);
                 if (state == !put_to_sleep)
                         return 0;
+                rt2x00usb_register_write(rt2x00dev, MAC_CSR12, reg);
                 msleep(10);
         }
 
diff --git a/drivers/net/wireless/wl12xx/wl1271_rx.c b/drivers/net/wireless/wl12xx/wl1271_rx.c
index 57f4bfd959c8..b98fb643fab0 100644
--- a/drivers/net/wireless/wl12xx/wl1271_rx.c
+++ b/drivers/net/wireless/wl12xx/wl1271_rx.c
@@ -113,6 +113,8 @@ static void wl1271_rx_handle_data(struct wl1271 *wl, u32 length)
         wl1271_debug(DEBUG_RX, "rx skb 0x%p: %d B %s", skb, skb->len,
                      beacon ? "beacon" : "");
 
+        skb_trim(skb, skb->len - desc->pad_len);
+
         memcpy(IEEE80211_SKB_RXCB(skb), &rx_status, sizeof(rx_status));
         ieee80211_rx_ni(wl->hw, skb);
 }