43 files changed, 325 insertions, 267 deletions

diff --git a/MAINTAINERS b/MAINTAINERS
index 6388a96dc1c4..4c5eac0e51d1 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1032,6 +1032,7 @@ F:	arch/arm/include/asm/hardware/ioc.h
 F:      arch/arm/include/asm/hardware/iomd.h
 F:      arch/arm/include/asm/hardware/memc.h
 F:      arch/arm/mach-rpc/
+F:      drivers/net/ethernet/8390/etherh.c
 F:      drivers/net/ethernet/i825xx/ether1*
 F:      drivers/net/ethernet/seeq/ether3*
 F:      drivers/scsi/arm/
@@ -5470,7 +5471,7 @@ S:	Maintained
 F:      drivers/net/ethernet/rdc/r6040.c
 
 RDS - RELIABLE DATAGRAM SOCKETS
-M:      Andy Grover <andy.grover@oracle.com>
+M:      Venkat Venkatsubra <venkat.x.venkatsubra@oracle.com>
 L:      rds-devel@oss.oracle.com (moderated for non-subscribers)
 S:      Supported
 F:      net/rds/
diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
index db7cb8111fbe..106beb194f3c 100644
--- a/drivers/bluetooth/ath3k.c
+++ b/drivers/bluetooth/ath3k.c
@@ -105,7 +105,7 @@ static int ath3k_load_firmware(struct usb_device *udev,
 
         pipe = usb_sndctrlpipe(udev, 0);
 
-        send_buf = kmalloc(BULK_SIZE, GFP_ATOMIC);
+        send_buf = kmalloc(BULK_SIZE, GFP_KERNEL);
         if (!send_buf) {
                 BT_ERR("Can't allocate memory chunk for firmware");
                 return -ENOMEM;
@@ -176,7 +176,7 @@ static int ath3k_load_fwfile(struct usb_device *udev,
 
         count = firmware->size;
 
-        send_buf = kmalloc(BULK_SIZE, GFP_ATOMIC);
+        send_buf = kmalloc(BULK_SIZE, GFP_KERNEL);
         if (!send_buf) {
                 BT_ERR("Can't allocate memory chunk for firmware");
                 return -ENOMEM;
diff --git a/drivers/bluetooth/bcm203x.c b/drivers/bluetooth/bcm203x.c
index 8b1b643a519b..54952ab800b8 100644
--- a/drivers/bluetooth/bcm203x.c
+++ b/drivers/bluetooth/bcm203x.c
@@ -24,6 +24,7 @@
 
 #include <linux/module.h>
 
+#include <linux/atomic.h>
 #include <linux/kernel.h>
 #include <linux/init.h>
 #include <linux/slab.h>
@@ -65,6 +66,7 @@ struct bcm203x_data {
         unsigned long           state;
 
         struct work_struct      work;
+        atomic_t                shutdown;
 
         struct urb              *urb;
         unsigned char           *buffer;
@@ -97,6 +99,7 @@ static void bcm203x_complete(struct urb *urb)
 
                 data->state = BCM203X_SELECT_MEMORY;
 
+                /* use workqueue to have a small delay */
                 schedule_work(&data->work);
                 break;
 
@@ -155,7 +158,10 @@ static void bcm203x_work(struct work_struct *work)
         struct bcm203x_data *data =
                 container_of(work, struct bcm203x_data, work);
 
-        if (usb_submit_urb(data->urb, GFP_ATOMIC) < 0)
+        if (atomic_read(&data->shutdown))
+                return;
+
+        if (usb_submit_urb(data->urb, GFP_KERNEL) < 0)
                 BT_ERR("Can't submit URB");
 }
 
@@ -243,6 +249,7 @@ static int bcm203x_probe(struct usb_interface *intf, const struct usb_device_id
 
         usb_set_intfdata(intf, data);
 
+        /* use workqueue to have a small delay */
         schedule_work(&data->work);
 
         return 0;
@@ -254,6 +261,9 @@ static void bcm203x_disconnect(struct usb_interface *intf)
 
         BT_DBG("intf %p", intf);
 
+        atomic_inc(&data->shutdown);
+        cancel_work_sync(&data->work);
+
         usb_kill_urb(data->urb);
 
         usb_set_intfdata(intf, NULL);
diff --git a/drivers/bluetooth/bfusb.c b/drivers/bluetooth/bfusb.c
index 005919ab043c..61b591470a90 100644
--- a/drivers/bluetooth/bfusb.c
+++ b/drivers/bluetooth/bfusb.c
@@ -568,22 +568,23 @@ static int bfusb_load_firmware(struct bfusb_data *data,
 
         BT_INFO("BlueFRITZ! USB loading firmware");
 
+        buf = kmalloc(BFUSB_MAX_BLOCK_SIZE + 3, GFP_KERNEL);
+        if (!buf) {
+                BT_ERR("Can't allocate memory chunk for firmware");
+                return -ENOMEM;
+        }
+
         pipe = usb_sndctrlpipe(data->udev, 0);
 
         if (usb_control_msg(data->udev, pipe, USB_REQ_SET_CONFIGURATION,
                                 0, 1, 0, NULL, 0, USB_CTRL_SET_TIMEOUT) < 0) {
                 BT_ERR("Can't change to loading configuration");
+                kfree(buf);
                 return -EBUSY;
         }
 
         data->udev->toggle[0] = data->udev->toggle[1] = 0;
 
-        buf = kmalloc(BFUSB_MAX_BLOCK_SIZE + 3, GFP_ATOMIC);
-        if (!buf) {
-                BT_ERR("Can't allocate memory chunk for firmware");
-                return -ENOMEM;
-        }
-
         pipe = usb_sndbulkpipe(data->udev, data->bulk_out_ep);
 
         while (count) {
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index b2b9109b6712..b0c577256487 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -560,8 +560,8 @@ static int bond_update_speed_duplex(struct slave *slave)
         u32 slave_speed;
         int res;
 
-        slave->speed = -1;
-        slave->duplex = -1;
+        slave->speed = SPEED_UNKNOWN;
+        slave->duplex = DUPLEX_UNKNOWN;
 
         res = __ethtool_get_settings(slave_dev, &ecmd);
         if (res < 0)
diff --git a/drivers/net/bonding/bond_procfs.c b/drivers/net/bonding/bond_procfs.c
index 2acf0b080169..ad284baafe87 100644
--- a/drivers/net/bonding/bond_procfs.c
+++ b/drivers/net/bonding/bond_procfs.c
@@ -158,12 +158,12 @@ static void bond_info_show_slave(struct seq_file *seq,
         seq_printf(seq, "\nSlave Interface: %s\n", slave->dev->name);
         seq_printf(seq, "MII Status: %s\n",
                    (slave->link == BOND_LINK_UP) ?  "up" : "down");
-        if (slave->speed == -1)
+        if (slave->speed == SPEED_UNKNOWN)
                 seq_printf(seq, "Speed: %s\n", "Unknown");
         else
                 seq_printf(seq, "Speed: %d Mbps\n", slave->speed);
 
-        if (slave->duplex == -1)
+        if (slave->duplex == DUPLEX_UNKNOWN)
                 seq_printf(seq, "Duplex: %s\n", "Unknown");
         else
                 seq_printf(seq, "Duplex: %s\n", slave->duplex ? "full" : "half");
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index 161cbbb4814a..bf4074167d6a 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -89,10 +89,10 @@ static inline void _tg3_flag_clear(enum TG3_FLAGS flag, unsigned long *bits)
 
 #define DRV_MODULE_NAME         "tg3"
 #define TG3_MAJ_NUM                     3
-#define TG3_MIN_NUM                     120
+#define TG3_MIN_NUM                     121
 #define DRV_MODULE_VERSION      \
         __stringify(TG3_MAJ_NUM) "." __stringify(TG3_MIN_NUM)
-#define DRV_MODULE_RELDATE      "August 18, 2011"
+#define DRV_MODULE_RELDATE      "November 2, 2011"
 
 #define RESET_KIND_SHUTDOWN     0
 #define RESET_KIND_INIT         1
@@ -628,19 +628,23 @@ static void tg3_ape_lock_init(struct tg3 *tp)
                 regbase = TG3_APE_PER_LOCK_GRANT;
 
         /* Make sure the driver hasn't any stale locks. */
-        for (i = 0; i < 8; i++) {
-                if (i == TG3_APE_LOCK_GPIO)
-                        continue;
-                tg3_ape_write32(tp, regbase + 4 * i, APE_LOCK_GRANT_DRIVER);
+        for (i = TG3_APE_LOCK_PHY0; i <= TG3_APE_LOCK_GPIO; i++) {
+                switch (i) {
+                case TG3_APE_LOCK_PHY0:
+                case TG3_APE_LOCK_PHY1:
+                case TG3_APE_LOCK_PHY2:
+                case TG3_APE_LOCK_PHY3:
+                        bit = APE_LOCK_GRANT_DRIVER;
+                        break;
+                default:
+                        if (!tp->pci_fn)
+                                bit = APE_LOCK_GRANT_DRIVER;
+                        else
+                                bit = 1 << tp->pci_fn;
+                }
+                tg3_ape_write32(tp, regbase + 4 * i, bit);
         }
 
-        /* Clear the correct bit of the GPIO lock too. */
-        if (!tp->pci_fn)
-                bit = APE_LOCK_GRANT_DRIVER;
-        else
-                bit = 1 << tp->pci_fn;
-
-        tg3_ape_write32(tp, regbase + 4 * TG3_APE_LOCK_GPIO, bit);
 }
 
 static int tg3_ape_lock(struct tg3 *tp, int locknum)
@@ -658,6 +662,10 @@ static int tg3_ape_lock(struct tg3 *tp, int locknum)
                         return 0;
         case TG3_APE_LOCK_GRC:
         case TG3_APE_LOCK_MEM:
+                if (!tp->pci_fn)
+                        bit = APE_LOCK_REQ_DRIVER;
+                else
+                        bit = 1 << tp->pci_fn;
                 break;
         default:
                 return -EINVAL;
@@ -673,11 +681,6 @@ static int tg3_ape_lock(struct tg3 *tp, int locknum)
 
         off = 4 * locknum;
 
-        if (locknum != TG3_APE_LOCK_GPIO || !tp->pci_fn)
-                bit = APE_LOCK_REQ_DRIVER;
-        else
-                bit = 1 << tp->pci_fn;
-
         tg3_ape_write32(tp, req + off, bit);
 
         /* Wait for up to 1 millisecond to acquire lock. */
@@ -710,6 +713,10 @@ static void tg3_ape_unlock(struct tg3 *tp, int locknum)
                         return;
         case TG3_APE_LOCK_GRC:
         case TG3_APE_LOCK_MEM:
+                if (!tp->pci_fn)
+                        bit = APE_LOCK_GRANT_DRIVER;
+                else
+                        bit = 1 << tp->pci_fn;
                 break;
         default:
                 return;
@@ -720,11 +727,6 @@ static void tg3_ape_unlock(struct tg3 *tp, int locknum)
         else
                 gnt = TG3_APE_PER_LOCK_GRANT;
 
-        if (locknum != TG3_APE_LOCK_GPIO || !tp->pci_fn)
-                bit = APE_LOCK_GRANT_DRIVER;
-        else
-                bit = 1 << tp->pci_fn;
-
         tg3_ape_write32(tp, gnt + 4 * locknum, bit);
 }
 
@@ -5927,6 +5929,18 @@ static int tg3_poll_work(struct tg3_napi *tnapi, int work_done, int budget)
         return work_done;
 }
 
+static inline void tg3_reset_task_schedule(struct tg3 *tp)
+{
+        if (!test_and_set_bit(TG3_FLAG_RESET_TASK_PENDING, tp->tg3_flags))
+                schedule_work(&tp->reset_task);
+}
+
+static inline void tg3_reset_task_cancel(struct tg3 *tp)
+{
+        cancel_work_sync(&tp->reset_task);
+        tg3_flag_clear(tp, RESET_TASK_PENDING);
+}
+
 static int tg3_poll_msix(struct napi_struct *napi, int budget)
 {
         struct tg3_napi *tnapi = container_of(napi, struct tg3_napi, napi);
@@ -5967,7 +5981,7 @@ static int tg3_poll_msix(struct napi_struct *napi, int budget)
 tx_recovery:
         /* work_done is guaranteed to be less than budget. */
         napi_complete(napi);
-        schedule_work(&tp->reset_task);
+        tg3_reset_task_schedule(tp);
         return work_done;
 }
 
@@ -6002,7 +6016,7 @@ static void tg3_process_error(struct tg3 *tp)
         tg3_dump_state(tp);
 
         tg3_flag_set(tp, ERROR_PROCESSED);
-        schedule_work(&tp->reset_task);
+        tg3_reset_task_schedule(tp);
 }
 
 static int tg3_poll(struct napi_struct *napi, int budget)
@@ -6049,7 +6063,7 @@ static int tg3_poll(struct napi_struct *napi, int budget)
 tx_recovery:
         /* work_done is guaranteed to be less than budget. */
         napi_complete(napi);
-        schedule_work(&tp->reset_task);
+        tg3_reset_task_schedule(tp);
         return work_done;
 }
 
@@ -6338,11 +6352,11 @@ static void tg3_reset_task(struct work_struct *work)
 {
         struct tg3 *tp = container_of(work, struct tg3, reset_task);
         int err;
-        unsigned int restart_timer;
 
         tg3_full_lock(tp, 0);
 
         if (!netif_running(tp->dev)) {
+                tg3_flag_clear(tp, RESET_TASK_PENDING);
                 tg3_full_unlock(tp);
                 return;
         }
@@ -6355,9 +6369,6 @@ static void tg3_reset_task(struct work_struct *work)
 
         tg3_full_lock(tp, 1);
 
-        restart_timer = tg3_flag(tp, RESTART_TIMER);
-        tg3_flag_clear(tp, RESTART_TIMER);
-
         if (tg3_flag(tp, TX_RECOVERY_PENDING)) {
                 tp->write32_tx_mbox = tg3_write32_tx_mbox;
                 tp->write32_rx_mbox = tg3_write_flush_reg32;
@@ -6372,14 +6383,13 @@ static void tg3_reset_task(struct work_struct *work)
 
         tg3_netif_start(tp);
 
-        if (restart_timer)
-                mod_timer(&tp->timer, jiffies + 1);
-
 out:
         tg3_full_unlock(tp);
 
         if (!err)
                 tg3_phy_start(tp);
+
+        tg3_flag_clear(tp, RESET_TASK_PENDING);
 }
 
 static void tg3_tx_timeout(struct net_device *dev)
@@ -6391,7 +6401,7 @@ static void tg3_tx_timeout(struct net_device *dev)
                 tg3_dump_state(tp);
         }
 
-        schedule_work(&tp->reset_task);
+        tg3_reset_task_schedule(tp);
 }
 
 /* Test for DMA buffers crossing any 4GB boundaries: 4G, 8G, etc */
@@ -6442,31 +6452,26 @@ static bool tg3_tx_frag_set(struct tg3_napi *tnapi, u32 *entry, u32 *budget,
                 hwbug = 1;
 
         if (tg3_flag(tp, 4K_FIFO_LIMIT)) {
+                u32 prvidx = *entry;
                 u32 tmp_flag = flags & ~TXD_FLAG_END;
-                while (len > TG3_TX_BD_DMA_MAX) {
+                while (len > TG3_TX_BD_DMA_MAX && *budget) {
                         u32 frag_len = TG3_TX_BD_DMA_MAX;
                         len -= TG3_TX_BD_DMA_MAX;
 
-                        if (len) {
-                                tnapi->tx_buffers[*entry].fragmented = true;
-                                /* Avoid the 8byte DMA problem */
-                                if (len <= 8) {
-                                        len += TG3_TX_BD_DMA_MAX / 2;
-                                        frag_len = TG3_TX_BD_DMA_MAX / 2;
-                                }
-                        } else
-                                tmp_flag = flags;
-
-                        if (*budget) {
-                                tg3_tx_set_bd(&tnapi->tx_ring[*entry], map,
-                                              frag_len, tmp_flag, mss, vlan);
-                                (*budget)--;
-                                *entry = NEXT_TX(*entry);
-                        } else {
-                                hwbug = 1;
-                                break;
+                        /* Avoid the 8byte DMA problem */
+                        if (len <= 8) {
+                                len += TG3_TX_BD_DMA_MAX / 2;
+                                frag_len = TG3_TX_BD_DMA_MAX / 2;
                         }
 
+                        tnapi->tx_buffers[*entry].fragmented = true;
+
+                        tg3_tx_set_bd(&tnapi->tx_ring[*entry], map,
+                                      frag_len, tmp_flag, mss, vlan);
+                        *budget -= 1;
+                        prvidx = *entry;
+                        *entry = NEXT_TX(*entry);
+
                         map += frag_len;
                 }
 
@@ -6474,10 +6479,11 @@ static bool tg3_tx_frag_set(struct tg3_napi *tnapi, u32 *entry, u32 *budget,
                         if (*budget) {
                                 tg3_tx_set_bd(&tnapi->tx_ring[*entry], map,
                                               len, flags, mss, vlan);
-                                (*budget)--;
+                                *budget -= 1;
                                 *entry = NEXT_TX(*entry);
                         } else {
                                 hwbug = 1;
+                                tnapi->tx_buffers[prvidx].fragmented = false;
                         }
                 }
         } else {
@@ -6509,7 +6515,7 @@ static void tg3_tx_skb_unmap(struct tg3_napi *tnapi, u32 entry, int last)
                 txb = &tnapi->tx_buffers[entry];
         }
 
-        for (i = 0; i < last; i++) {
+        for (i = 0; i <= last; i++) {
                 const skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
 
                 entry = NEXT_TX(entry);
@@ -6559,6 +6565,8 @@ static int tigon3_dma_hwbug_workaround(struct tg3_napi *tnapi,
                         dev_kfree_skb(new_skb);
                         ret = -1;
                 } else {
+                        u32 save_entry = *entry;
+
                         base_flags |= TXD_FLAG_END;
 
                         tnapi->tx_buffers[*entry].skb = new_skb;
@@ -6568,7 +6576,7 @@ static int tigon3_dma_hwbug_workaround(struct tg3_napi *tnapi,
                         if (tg3_tx_frag_set(tnapi, entry, budget, new_addr,
                                             new_skb->len, base_flags,
                                             mss, vlan)) {
-                                tg3_tx_skb_unmap(tnapi, *entry, 0);
+                                tg3_tx_skb_unmap(tnapi, save_entry, -1);
                                 dev_kfree_skb(new_skb);
                                 ret = -1;
                         }
@@ -6758,11 +6766,10 @@ static netdev_tx_t tg3_start_xmit(struct sk_buff *skb, struct net_device *dev)
 
         if (tg3_tx_frag_set(tnapi, &entry, &budget, mapping, len, base_flags |
                           ((skb_shinfo(skb)->nr_frags == 0) ? TXD_FLAG_END : 0),
-                            mss, vlan))
+                            mss, vlan)) {
                 would_hit_hwbug = 1;
-
         /* Now loop through additional data fragments, and queue them. */
-        if (skb_shinfo(skb)->nr_frags > 0) {
+        } else if (skb_shinfo(skb)->nr_frags > 0) {
                 u32 tmp_mss = mss;
 
                 if (!tg3_flag(tp, HW_TSO_1) &&
@@ -6784,11 +6791,14 @@ static netdev_tx_t tg3_start_xmit(struct sk_buff *skb, struct net_device *dev)
                         if (dma_mapping_error(&tp->pdev->dev, mapping))
                                 goto dma_error;
 
-                        if (tg3_tx_frag_set(tnapi, &entry, &budget, mapping,
+                        if (!budget ||
+                            tg3_tx_frag_set(tnapi, &entry, &budget, mapping,
                                             len, base_flags |
                                             ((i == last) ? TXD_FLAG_END : 0),
-                                            tmp_mss, vlan))
+                                            tmp_mss, vlan)) {
                                 would_hit_hwbug = 1;
+                                break;
+                        }
                 }
         }
 
@@ -6828,7 +6838,7 @@ static netdev_tx_t tg3_start_xmit(struct sk_buff *skb, struct net_device *dev)
         return NETDEV_TX_OK;
 
 dma_error:
-        tg3_tx_skb_unmap(tnapi, tnapi->tx_prod, i);
+        tg3_tx_skb_unmap(tnapi, tnapi->tx_prod, --i);
         tnapi->tx_buffers[tnapi->tx_prod].skb = NULL;
 drop:
         dev_kfree_skb(skb);
@@ -7281,7 +7291,8 @@ static void tg3_free_rings(struct tg3 *tp)
                         if (!skb)
                                 continue;
 
-                        tg3_tx_skb_unmap(tnapi, i, skb_shinfo(skb)->nr_frags);
+                        tg3_tx_skb_unmap(tnapi, i,
+                                         skb_shinfo(skb)->nr_frags - 1);
 
                         dev_kfree_skb_any(skb);
                 }
@@ -9200,7 +9211,7 @@ static void tg3_timer(unsigned long __opaque)
 {
         struct tg3 *tp = (struct tg3 *) __opaque;
 
-        if (tp->irq_sync)
+        if (tp->irq_sync || tg3_flag(tp, RESET_TASK_PENDING))
                 goto restart_timer;
 
         spin_lock(&tp->lock);
@@ -9223,10 +9234,9 @@ static void tg3_timer(unsigned long __opaque)
                 }
 
                 if (!(tr32(WDMAC_MODE) & WDMAC_MODE_ENABLE)) {
-                        tg3_flag_set(tp, RESTART_TIMER);
                         spin_unlock(&tp->lock);
-                        schedule_work(&tp->reset_task);
-                        return;
+                        tg3_reset_task_schedule(tp);
+                        goto restart_timer;
                 }
         }
 
@@ -9674,15 +9684,14 @@ static int tg3_open(struct net_device *dev)
                 struct tg3_napi *tnapi = &tp->napi[i];
                 err = tg3_request_irq(tp, i);
                 if (err) {
-                        for (i--; i >= 0; i--)
+                        for (i--; i >= 0; i--) {
+                                tnapi = &tp->napi[i];
                                 free_irq(tnapi->irq_vec, tnapi);
-                        break;
+                        }
+                        goto err_out2;
                 }
         }
 
-        if (err)
-                goto err_out2;
-
         tg3_full_lock(tp, 0);
 
         err = tg3_init_hw(tp, 1);
@@ -9783,7 +9792,7 @@ static int tg3_close(struct net_device *dev)
         struct tg3 *tp = netdev_priv(dev);
 
         tg3_napi_disable(tp);
-        cancel_work_sync(&tp->reset_task);
+        tg3_reset_task_cancel(tp);
 
         netif_tx_stop_all_queues(dev);
 
@@ -11520,7 +11529,7 @@ static int tg3_run_loopback(struct tg3 *tp, u32 pktsz, bool tso_loopback)
                         break;
         }
 
-        tg3_tx_skb_unmap(tnapi, tnapi->tx_prod - 1, 0);
+        tg3_tx_skb_unmap(tnapi, tnapi->tx_prod - 1, -1);
         dev_kfree_skb(skb);
 
         if (tx_idx != tnapi->tx_prod)
@@ -14228,12 +14237,30 @@ static int __devinit tg3_get_invariants(struct tg3 *tp)
         val = tr32(MEMARB_MODE);
         tw32(MEMARB_MODE, val | MEMARB_MODE_ENABLE);
 
-        if (tg3_flag(tp, PCIX_MODE)) {
-                pci_read_config_dword(tp->pdev,
-                                      tp->pcix_cap + PCI_X_STATUS, &val);
-                tp->pci_fn = val & 0x7;
-        } else {
-                tp->pci_fn = PCI_FUNC(tp->pdev->devfn) & 3;
+        tp->pci_fn = PCI_FUNC(tp->pdev->devfn) & 3;
+        if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5704 ||
+            tg3_flag(tp, 5780_CLASS)) {
+                if (tg3_flag(tp, PCIX_MODE)) {
+                        pci_read_config_dword(tp->pdev,
+                                              tp->pcix_cap + PCI_X_STATUS,
+                                              &val);
+                        tp->pci_fn = val & 0x7;
+                }
+        } else if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5717) {
+                tg3_read_mem(tp, NIC_SRAM_CPMU_STATUS, &val);
+                if ((val & NIC_SRAM_CPMUSTAT_SIG_MSK) ==
+                    NIC_SRAM_CPMUSTAT_SIG) {
+                        tp->pci_fn = val & TG3_CPMU_STATUS_FMSK_5717;
+                        tp->pci_fn = tp->pci_fn ? 1 : 0;
+                }
+        } else if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5719 ||
+                   GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5720) {
+                tg3_read_mem(tp, NIC_SRAM_CPMU_STATUS, &val);
+                if ((val & NIC_SRAM_CPMUSTAT_SIG_MSK) ==
+                    NIC_SRAM_CPMUSTAT_SIG) {
+                        tp->pci_fn = (val & TG3_CPMU_STATUS_FMSK_5719) >>
+                                     TG3_CPMU_STATUS_FSHFT_5719;
+                }
         }
 
         /* Get eeprom hw config before calling tg3_set_power_state().
@@ -15665,7 +15692,7 @@ static void __devexit tg3_remove_one(struct pci_dev *pdev)
                 if (tp->fw)
                         release_firmware(tp->fw);
 
-                cancel_work_sync(&tp->reset_task);
+                tg3_reset_task_cancel(tp);
 
                 if (tg3_flag(tp, USE_PHYLIB)) {
                         tg3_phy_fini(tp);
@@ -15699,7 +15726,7 @@ static int tg3_suspend(struct device *device)
         if (!netif_running(dev))
                 return 0;
 
-        flush_work_sync(&tp->reset_task);
+        tg3_reset_task_cancel(tp);
         tg3_phy_stop(tp);
         tg3_netif_stop(tp);
 
@@ -15812,12 +15839,10 @@ static pci_ers_result_t tg3_io_error_detected(struct pci_dev *pdev,
         tg3_netif_stop(tp);
 
         del_timer_sync(&tp->timer);
-        tg3_flag_clear(tp, RESTART_TIMER);
 
         /* Want to make sure that the reset task doesn't run */
-        cancel_work_sync(&tp->reset_task);
+        tg3_reset_task_cancel(tp);
         tg3_flag_clear(tp, TX_RECOVERY_PENDING);
-        tg3_flag_clear(tp, RESTART_TIMER);
 
         netif_device_detach(netdev);
 
diff --git a/drivers/net/ethernet/broadcom/tg3.h b/drivers/net/ethernet/broadcom/tg3.h
index f32f288134c7..94b4bd049a33 100644
--- a/drivers/net/ethernet/broadcom/tg3.h
+++ b/drivers/net/ethernet/broadcom/tg3.h
@@ -1095,6 +1095,11 @@
 #define TG3_CPMU_CLCK_ORIDE             0x00003624
 #define  CPMU_CLCK_ORIDE_MAC_ORIDE_EN    0x80000000
 
+#define TG3_CPMU_STATUS                 0x0000362c
+#define  TG3_CPMU_STATUS_FMSK_5717       0x20000000
+#define  TG3_CPMU_STATUS_FMSK_5719       0xc0000000
+#define  TG3_CPMU_STATUS_FSHFT_5719      30
+
 #define TG3_CPMU_CLCK_STAT              0x00003630
 #define  CPMU_CLCK_STAT_MAC_CLCK_MASK    0x001f0000
 #define  CPMU_CLCK_STAT_MAC_CLCK_62_5    0x00000000
@@ -2128,6 +2133,10 @@
 #define  NIC_SRAM_RGMII_EXT_IBND_RX_EN   0x00000008
 #define  NIC_SRAM_RGMII_EXT_IBND_TX_EN   0x00000010
 
+#define NIC_SRAM_CPMU_STATUS            0x00000e00
+#define  NIC_SRAM_CPMUSTAT_SIG          0x0000362c
+#define  NIC_SRAM_CPMUSTAT_SIG_MSK      0x0000ffff
+
 #define NIC_SRAM_RX_MINI_BUFFER_DESC    0x00001000
 
 #define NIC_SRAM_DMA_DESC_POOL_BASE     0x00002000
@@ -2344,9 +2353,13 @@
 #define  APE_PER_LOCK_GRANT_DRIVER       0x00001000
 
 /* APE convenience enumerations. */
-#define TG3_APE_LOCK_GRC                1
-#define TG3_APE_LOCK_MEM                4
-#define TG3_APE_LOCK_GPIO               7
+#define TG3_APE_LOCK_PHY0               0
+#define TG3_APE_LOCK_GRC                1
+#define TG3_APE_LOCK_PHY1               2
+#define TG3_APE_LOCK_PHY2               3
+#define TG3_APE_LOCK_MEM                4
+#define TG3_APE_LOCK_PHY3               5
+#define TG3_APE_LOCK_GPIO               7
 
 #define TG3_EEPROM_SB_F1R2_MBA_OFF      0x10
 
@@ -2866,7 +2879,6 @@ enum TG3_FLAGS {
         TG3_FLAG_JUMBO_CAPABLE,
         TG3_FLAG_CHIP_RESETTING,
         TG3_FLAG_INIT_COMPLETE,
-        TG3_FLAG_RESTART_TIMER,
         TG3_FLAG_TSO_BUG,
         TG3_FLAG_IS_5788,
         TG3_FLAG_MAX_RXPEND_64,
@@ -2909,6 +2921,7 @@ enum TG3_FLAGS {
         TG3_FLAG_APE_HAS_NCSI,
         TG3_FLAG_5717_PLUS,
         TG3_FLAG_4K_FIFO_LIMIT,
+        TG3_FLAG_RESET_TASK_PENDING,
 
         /* Add new flags before this comment and TG3_FLAG_NUMBER_OF_FLAGS */
         TG3_FLAG_NUMBER_OF_FLAGS,       /* Last entry in enum TG3_FLAGS */
diff --git a/drivers/net/ethernet/freescale/Kconfig b/drivers/net/ethernet/freescale/Kconfig
index 1cf671643d1f..c520cfd3b298 100644
--- a/drivers/net/ethernet/freescale/Kconfig
+++ b/drivers/net/ethernet/freescale/Kconfig
@@ -7,8 +7,7 @@ config NET_VENDOR_FREESCALE
         default y
         depends on FSL_SOC || QUICC_ENGINE || CPM1 || CPM2 || PPC_MPC512x || \
                    M523x || M527x || M5272 || M528x || M520x || M532x || \
-                   ARCH_MXC || ARCH_MXS || \
-                   (PPC_MPC52xx && PPC_BESTCOMM)
+                   ARCH_MXC || ARCH_MXS || (PPC_MPC52xx && PPC_BESTCOMM)
         ---help---
           If you have a network (Ethernet) card belonging to this class, say Y
           and read the Ethernet-HOWTO, available from
diff --git a/drivers/net/ethernet/intel/Kconfig b/drivers/net/ethernet/intel/Kconfig
index 61029dc7fa6f..76213162fbe3 100644
--- a/drivers/net/ethernet/intel/Kconfig
+++ b/drivers/net/ethernet/intel/Kconfig
@@ -5,7 +5,11 @@
 config NET_VENDOR_INTEL
         bool "Intel devices"
         default y
-        depends on PCI || PCI_MSI
+        depends on PCI || PCI_MSI || ISA || ISA_DMA_API || ARM || \
+                   ARCH_ACORN || MCA || MCA_LEGACY || SNI_RM || SUN3 || \
+                   GSC || BVME6000 || MVME16x || ARCH_ENP2611 || \
+                   (ARM && ARCH_IXP4XX && IXP4XX_NPE && IXP4XX_QMGR) || \
+                   EXPERIMENTAL
         ---help---
           If you have a network (Ethernet) card belonging to this class, say Y
           and read the Ethernet-HOWTO, available from
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c
index db95731863d7..00fcd39ad666 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c
@@ -442,12 +442,14 @@ static int ixgbe_set_vf_macvlan(struct ixgbe_adapter *adapter,
 
 int ixgbe_check_vf_assignment(struct ixgbe_adapter *adapter)
 {
+#ifdef CONFIG_PCI_IOV
         int i;
         for (i = 0; i < adapter->num_vfs; i++) {
                 if (adapter->vfinfo[i].vfdev->dev_flags &
                                 PCI_DEV_FLAGS_ASSIGNED)
                         return true;
         }
+#endif
         return false;
 }
 
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.h b/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.h
index 4a5d8897faab..df04f1a3857c 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.h
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.h
@@ -42,11 +42,11 @@ int ixgbe_ndo_set_vf_spoofchk(struct net_device *netdev, int vf, bool setting);
 int ixgbe_ndo_get_vf_config(struct net_device *netdev,
                             int vf, struct ifla_vf_info *ivi);
 void ixgbe_check_vf_rate_limit(struct ixgbe_adapter *adapter);
-#ifdef CONFIG_PCI_IOV
 void ixgbe_disable_sriov(struct ixgbe_adapter *adapter);
+int ixgbe_check_vf_assignment(struct ixgbe_adapter *adapter);
+#ifdef CONFIG_PCI_IOV
 void ixgbe_enable_sriov(struct ixgbe_adapter *adapter,
                         const struct ixgbe_info *ii);
-int ixgbe_check_vf_assignment(struct ixgbe_adapter *adapter);
 #endif
 
 
diff --git a/drivers/net/ethernet/marvell/sky2.c b/drivers/net/ethernet/marvell/sky2.c
index cbd026f3bc57..fdc6c394c683 100644
--- a/drivers/net/ethernet/marvell/sky2.c
+++ b/drivers/net/ethernet/marvell/sky2.c
@@ -366,17 +366,6 @@ static void sky2_phy_init(struct sky2_hw *hw, unsigned port)
                                 gm_phy_write(hw, port, PHY_MARV_FE_SPEC_2, spec);
                         }
                 } else {
-                        if (hw->chip_id >= CHIP_ID_YUKON_OPT) {
-                                u16 ctrl2 = gm_phy_read(hw, port, PHY_MARV_EXT_CTRL_2);
-
-                                /* enable PHY Reverse Auto-Negotiation */
-                                ctrl2 |= 1u << 13;
-
-                                /* Write PHY changes (SW-reset must follow) */
-                                gm_phy_write(hw, port, PHY_MARV_EXT_CTRL_2, ctrl2);
-                        }
-
-
                         /* disable energy detect */
                         ctrl &= ~PHY_M_PC_EN_DET_MSK;
 
diff --git a/drivers/net/ethernet/natsemi/Kconfig b/drivers/net/ethernet/natsemi/Kconfig
index 4a6b9fd073b6..eb836f770f50 100644
--- a/drivers/net/ethernet/natsemi/Kconfig
+++ b/drivers/net/ethernet/natsemi/Kconfig
@@ -5,7 +5,10 @@
 config NET_VENDOR_NATSEMI
         bool "National Semi-conductor devices"
         default y
-        depends on MCA || MAC || MACH_JAZZ || PCI || XTENSA_PLATFORM_XT2000
+        depends on AMIGA_PCMCIA || ARM || EISA || EXPERIMENTAL || H8300 || \
+                   ISA || M32R || MAC || MACH_JAZZ || MACH_TX49XX || MCA || \
+                   MCA_LEGACY || MIPS || PCI || PCMCIA || SUPERH || \
+                   XTENSA_PLATFORM_XT2000 || ZORRO
         ---help---
           If you have a network (Ethernet) card belonging to this class, say Y
           and read the Ethernet-HOWTO, available from
diff --git a/drivers/net/ethernet/nvidia/forcedeth.c b/drivers/net/ethernet/nvidia/forcedeth.c
index 1e37eb98c4e2..1dca57013cb2 100644
--- a/drivers/net/ethernet/nvidia/forcedeth.c
+++ b/drivers/net/ethernet/nvidia/forcedeth.c
@@ -1682,6 +1682,7 @@ static void nv_get_hw_stats(struct net_device *dev)
                 np->estats.tx_pause += readl(base + NvRegTxPause);
                 np->estats.rx_pause += readl(base + NvRegRxPause);
                 np->estats.rx_drop_frame += readl(base + NvRegRxDropFrame);
+                np->estats.rx_errors_total += np->estats.rx_drop_frame;
         }
 
         if (np->driver_data & DEV_HAS_STATISTICS_V3) {
@@ -1706,11 +1707,14 @@ static struct net_device_stats *nv_get_stats(struct net_device *dev)
                 nv_get_hw_stats(dev);
 
                 /* copy to net_device stats */
+                dev->stats.tx_packets = np->estats.tx_packets;
+                dev->stats.rx_bytes = np->estats.rx_bytes;
                 dev->stats.tx_bytes = np->estats.tx_bytes;
                 dev->stats.tx_fifo_errors = np->estats.tx_fifo_errors;
                 dev->stats.tx_carrier_errors = np->estats.tx_carrier_errors;
                 dev->stats.rx_crc_errors = np->estats.rx_crc_errors;
                 dev->stats.rx_over_errors = np->estats.rx_over_errors;
+                dev->stats.rx_fifo_errors = np->estats.rx_drop_frame;
                 dev->stats.rx_errors = np->estats.rx_errors_total;
                 dev->stats.tx_errors = np->estats.tx_errors_total;
         }
@@ -2099,10 +2103,10 @@ static netdev_tx_t nv_start_xmit(struct sk_buff *skb, struct net_device *dev)
 
         /* add fragments to entries count */
         for (i = 0; i < fragments; i++) {
-                u32 size = skb_frag_size(&skb_shinfo(skb)->frags[i]);
+                u32 frag_size = skb_frag_size(&skb_shinfo(skb)->frags[i]);
 
-                entries += (size >> NV_TX2_TSO_MAX_SHIFT) +
-                           ((size & (NV_TX2_TSO_MAX_SIZE-1)) ? 1 : 0);
+                entries += (frag_size >> NV_TX2_TSO_MAX_SHIFT) +
+                           ((frag_size & (NV_TX2_TSO_MAX_SIZE-1)) ? 1 : 0);
         }
 
         spin_lock_irqsave(&np->lock, flags);
@@ -2141,13 +2145,13 @@ static netdev_tx_t nv_start_xmit(struct sk_buff *skb, struct net_device *dev)
         /* setup the fragments */
         for (i = 0; i < fragments; i++) {
                 const skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
-                u32 size = skb_frag_size(frag);
+                u32 frag_size = skb_frag_size(frag);
                 offset = 0;
 
                 do {
                         prev_tx = put_tx;
                         prev_tx_ctx = np->put_tx_ctx;
-                        bcnt = (size > NV_TX2_TSO_MAX_SIZE) ? NV_TX2_TSO_MAX_SIZE : size;
+                        bcnt = (frag_size > NV_TX2_TSO_MAX_SIZE) ? NV_TX2_TSO_MAX_SIZE : frag_size;
                         np->put_tx_ctx->dma = skb_frag_dma_map(
                                                         &np->pci_dev->dev,
                                                         frag, offset,
@@ -2159,12 +2163,12 @@ static netdev_tx_t nv_start_xmit(struct sk_buff *skb, struct net_device *dev)
                         put_tx->flaglen = cpu_to_le32((bcnt-1) | tx_flags);
 
                         offset += bcnt;
-                        size -= bcnt;
+                        frag_size -= bcnt;
                         if (unlikely(put_tx++ == np->last_tx.orig))
                                 put_tx = np->first_tx.orig;
                         if (unlikely(np->put_tx_ctx++ == np->last_tx_ctx))
                                 np->put_tx_ctx = np->first_tx_ctx;
-                } while (size);
+                } while (frag_size);
         }
 
         /* set last fragment flag  */
@@ -2213,10 +2217,10 @@ static netdev_tx_t nv_start_xmit_optimized(struct sk_buff *skb,
 
         /* add fragments to entries count */
         for (i = 0; i < fragments; i++) {
-                u32 size = skb_frag_size(&skb_shinfo(skb)->frags[i]);
+                u32 frag_size = skb_frag_size(&skb_shinfo(skb)->frags[i]);
 
-                entries += (size >> NV_TX2_TSO_MAX_SHIFT) +
-                           ((size & (NV_TX2_TSO_MAX_SIZE-1)) ? 1 : 0);
+                entries += (frag_size >> NV_TX2_TSO_MAX_SHIFT) +
+                           ((frag_size & (NV_TX2_TSO_MAX_SIZE-1)) ? 1 : 0);
         }
 
         spin_lock_irqsave(&np->lock, flags);
@@ -2257,13 +2261,13 @@ static netdev_tx_t nv_start_xmit_optimized(struct sk_buff *skb,
         /* setup the fragments */
         for (i = 0; i < fragments; i++) {
                 skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
-                u32 size = skb_frag_size(frag);
+                u32 frag_size = skb_frag_size(frag);
                 offset = 0;
 
                 do {
                         prev_tx = put_tx;
                         prev_tx_ctx = np->put_tx_ctx;
-                        bcnt = (size > NV_TX2_TSO_MAX_SIZE) ? NV_TX2_TSO_MAX_SIZE : size;
+                        bcnt = (frag_size > NV_TX2_TSO_MAX_SIZE) ? NV_TX2_TSO_MAX_SIZE : frag_size;
                         np->put_tx_ctx->dma = skb_frag_dma_map(
                                                         &np->pci_dev->dev,
                                                         frag, offset,
@@ -2276,12 +2280,12 @@ static netdev_tx_t nv_start_xmit_optimized(struct sk_buff *skb,
                         put_tx->flaglen = cpu_to_le32((bcnt-1) | tx_flags);
 
                         offset += bcnt;
-                        size -= bcnt;
+                        frag_size -= bcnt;
                         if (unlikely(put_tx++ == np->last_tx.ex))
                                 put_tx = np->first_tx.ex;
                         if (unlikely(np->put_tx_ctx++ == np->last_tx_ctx))
                                 np->put_tx_ctx = np->first_tx_ctx;
-                } while (size);
+                } while (frag_size);
         }
 
         /* set last fragment flag  */
@@ -2374,16 +2378,8 @@ static int nv_tx_done(struct net_device *dev, int limit)
                 if (np->desc_ver == DESC_VER_1) {
                         if (flags & NV_TX_LASTPACKET) {
                                 if (flags & NV_TX_ERROR) {
-                                        if (flags & NV_TX_UNDERFLOW)
-                                                dev->stats.tx_fifo_errors++;
-                                        if (flags & NV_TX_CARRIERLOST)
-                                                dev->stats.tx_carrier_errors++;
                                         if ((flags & NV_TX_RETRYERROR) && !(flags & NV_TX_RETRYCOUNT_MASK))
                                                 nv_legacybackoff_reseed(dev);
-                                        dev->stats.tx_errors++;
-                                } else {
-                                        dev->stats.tx_packets++;
-                                        dev->stats.tx_bytes += np->get_tx_ctx->skb->len;
                                 }
                                 dev_kfree_skb_any(np->get_tx_ctx->skb);
                                 np->get_tx_ctx->skb = NULL;
@@ -2392,16 +2388,8 @@ static int nv_tx_done(struct net_device *dev, int limit)
                 } else {
                         if (flags & NV_TX2_LASTPACKET) {
                                 if (flags & NV_TX2_ERROR) {
-                                        if (flags & NV_TX2_UNDERFLOW)
-                                                dev->stats.tx_fifo_errors++;
-                                        if (flags & NV_TX2_CARRIERLOST)
-                                                dev->stats.tx_carrier_errors++;
                                         if ((flags & NV_TX2_RETRYERROR) && !(flags & NV_TX2_RETRYCOUNT_MASK))
                                                 nv_legacybackoff_reseed(dev);
-                                        dev->stats.tx_errors++;
-                                } else {
-                                        dev->stats.tx_packets++;
-                                        dev->stats.tx_bytes += np->get_tx_ctx->skb->len;
                                 }
                                 dev_kfree_skb_any(np->get_tx_ctx->skb);
                                 np->get_tx_ctx->skb = NULL;
@@ -2434,9 +2422,7 @@ static int nv_tx_done_optimized(struct net_device *dev, int limit)
                 nv_unmap_txskb(np, np->get_tx_ctx);
 
                 if (flags & NV_TX2_LASTPACKET) {
-                        if (!(flags & NV_TX2_ERROR))
-                                dev->stats.tx_packets++;
-                        else {
+                        if (flags & NV_TX2_ERROR) {
                                 if ((flags & NV_TX2_RETRYERROR) && !(flags & NV_TX2_RETRYCOUNT_MASK)) {
                                         if (np->driver_data & DEV_HAS_GEAR_MODE)
                                                 nv_gear_backoff_reseed(dev);
@@ -2636,7 +2622,6 @@ static int nv_rx_process(struct net_device *dev, int limit)
                                         if ((flags & NV_RX_ERROR_MASK) == NV_RX_ERROR4) {
                                                 len = nv_getlen(dev, skb->data, len);
                                                 if (len < 0) {
-                                                        dev->stats.rx_errors++;
                                                         dev_kfree_skb(skb);
                                                         goto next_pkt;
                                                 }
@@ -2650,11 +2635,6 @@ static int nv_rx_process(struct net_device *dev, int limit)
                                         else {
                                                 if (flags & NV_RX_MISSEDFRAME)
                                                         dev->stats.rx_missed_errors++;
-                                                if (flags & NV_RX_CRCERR)
-                                                        dev->stats.rx_crc_errors++;
-                                                if (flags & NV_RX_OVERFLOW)
-                                                        dev->stats.rx_over_errors++;
-                                                dev->stats.rx_errors++;
                                                 dev_kfree_skb(skb);
                                                 goto next_pkt;
                                         }
@@ -2670,7 +2650,6 @@ static int nv_rx_process(struct net_device *dev, int limit)
                                         if ((flags & NV_RX2_ERROR_MASK) == NV_RX2_ERROR4) {
                                                 len = nv_getlen(dev, skb->data, len);
                                                 if (len < 0) {
-                                                        dev->stats.rx_errors++;
                                                         dev_kfree_skb(skb);
                                                         goto next_pkt;
                                                 }
@@ -2682,11 +2661,6 @@ static int nv_rx_process(struct net_device *dev, int limit)
                                         }
                                         /* the rest are hard errors */
                                         else {
-                                                if (flags & NV_RX2_CRCERR)
-                                                        dev->stats.rx_crc_errors++;
-                                                if (flags & NV_RX2_OVERFLOW)
-                                                        dev->stats.rx_over_errors++;
-                                                dev->stats.rx_errors++;
                                                 dev_kfree_skb(skb);
                                                 goto next_pkt;
                                         }
@@ -2704,7 +2678,6 @@ static int nv_rx_process(struct net_device *dev, int limit)
                 skb->protocol = eth_type_trans(skb, dev);
                 napi_gro_receive(&np->napi, skb);
                 dev->stats.rx_packets++;
-                dev->stats.rx_bytes += len;
 next_pkt:
                 if (unlikely(np->get_rx.orig++ == np->last_rx.orig))
                         np->get_rx.orig = np->first_rx.orig;
@@ -2787,9 +2760,7 @@ static int nv_rx_process_optimized(struct net_device *dev, int limit)
                                 __vlan_hwaccel_put_tag(skb, vid);
                         }
                         napi_gro_receive(&np->napi, skb);
-
                         dev->stats.rx_packets++;
-                        dev->stats.rx_bytes += len;
                 } else {
                         dev_kfree_skb(skb);
                 }
@@ -2962,11 +2933,11 @@ static void nv_set_multicast(struct net_device *dev)
                                 struct netdev_hw_addr *ha;
 
                                 netdev_for_each_mc_addr(ha, dev) {
-                                        unsigned char *addr = ha->addr;
+                                        unsigned char *hw_addr = ha->addr;
                                         u32 a, b;
 
-                                        a = le32_to_cpu(*(__le32 *) addr);
-                                        b = le16_to_cpu(*(__le16 *) (&addr[4]));
+                                        a = le32_to_cpu(*(__le32 *) hw_addr);
+                                        b = le16_to_cpu(*(__le16 *) (&hw_addr[4]));
                                         alwaysOn[0] &= a;
                                         alwaysOff[0] &= ~a;
                                         alwaysOn[1] &= b;
@@ -3398,7 +3369,8 @@ static irqreturn_t nv_nic_irq_tx(int foo, void *data)
 
         for (i = 0;; i++) {
                 events = readl(base + NvRegMSIXIrqStatus) & NVREG_IRQ_TX_ALL;
-                writel(NVREG_IRQ_TX_ALL, base + NvRegMSIXIrqStatus);
+                writel(events, base + NvRegMSIXIrqStatus);
+                netdev_dbg(dev, "tx irq events: %08x\n", events);
                 if (!(events & np->irqmask))
                         break;
 
@@ -3509,7 +3481,8 @@ static irqreturn_t nv_nic_irq_rx(int foo, void *data)
 
         for (i = 0;; i++) {
                 events = readl(base + NvRegMSIXIrqStatus) & NVREG_IRQ_RX_ALL;
-                writel(NVREG_IRQ_RX_ALL, base + NvRegMSIXIrqStatus);
+                writel(events, base + NvRegMSIXIrqStatus);
+                netdev_dbg(dev, "rx irq events: %08x\n", events);
                 if (!(events & np->irqmask))
                         break;
 
@@ -3553,7 +3526,8 @@ static irqreturn_t nv_nic_irq_other(int foo, void *data)
 
         for (i = 0;; i++) {
                 events = readl(base + NvRegMSIXIrqStatus) & NVREG_IRQ_OTHER;
-                writel(NVREG_IRQ_OTHER, base + NvRegMSIXIrqStatus);
+                writel(events, base + NvRegMSIXIrqStatus);
+                netdev_dbg(dev, "irq events: %08x\n", events);
                 if (!(events & np->irqmask))
                         break;
 
@@ -3617,10 +3591,10 @@ static irqreturn_t nv_nic_irq_test(int foo, void *data)
 
         if (!(np->msi_flags & NV_MSI_X_ENABLED)) {
                 events = readl(base + NvRegIrqStatus) & NVREG_IRQSTAT_MASK;
-                writel(NVREG_IRQ_TIMER, base + NvRegIrqStatus);
+                writel(events & NVREG_IRQ_TIMER, base + NvRegIrqStatus);
         } else {
                 events = readl(base + NvRegMSIXIrqStatus) & NVREG_IRQSTAT_MASK;
-                writel(NVREG_IRQ_TIMER, base + NvRegMSIXIrqStatus);
+                writel(events & NVREG_IRQ_TIMER, base + NvRegMSIXIrqStatus);
         }
         pci_push(base);
         if (!(events & NVREG_IRQ_TIMER))
@@ -4566,7 +4540,7 @@ static void nv_get_ethtool_stats(struct net_device *dev, struct ethtool_stats *e
         struct fe_priv *np = netdev_priv(dev);
 
         /* update stats */
-        nv_do_stats_poll((unsigned long)dev);
+        nv_get_hw_stats(dev);
 
         memcpy(buffer, &np->estats, nv_get_sset_count(dev, ETH_SS_STATS)*sizeof(u64));
 }
diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
index a3ce3d4561ed..74134970b709 100644
--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
@@ -192,6 +192,13 @@ static rx_handler_result_t macvlan_handle_frame(struct sk_buff **pskb)
                          */
                         macvlan_broadcast(skb, port, src->dev,
                                           MACVLAN_MODE_VEPA);
+                else {
+                        /* forward to original port. */
+                        vlan = src;
+                        ret = macvlan_broadcast_one(skb, vlan, eth, 0);
+                        goto out;
+                }
+
                 return RX_HANDLER_PASS;
         }
 
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index 7d6082160bcc..fae0fbd8bc88 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -1057,7 +1057,8 @@ netdev_tx_t usbnet_start_xmit (struct sk_buff *skb,
         unsigned long           flags;
         int retval;
 
-        skb_tx_timestamp(skb);
+        if (skb)
+                skb_tx_timestamp(skb);
 
         // some devices want funky USB-level framing, for
         // win32 driver (usually) and/or hardware quirks
diff --git a/drivers/net/wireless/ath/ath9k/ar9002_calib.c b/drivers/net/wireless/ath/ath9k/ar9002_calib.c
index e0ab0657cc3a..88279e325dca 100644
--- a/drivers/net/wireless/ath/ath9k/ar9002_calib.c
+++ b/drivers/net/wireless/ath/ath9k/ar9002_calib.c
@@ -868,10 +868,6 @@ static bool ar9002_hw_init_cal(struct ath_hw *ah, struct ath9k_channel *chan)
         /* Do PA Calibration */
         ar9002_hw_pa_cal(ah, true);
 
-        /* Do NF Calibration after DC offset and other calibrations */
-        ath9k_hw_loadnf(ah, chan);
-        ath9k_hw_start_nfcal(ah, true);
-
         if (ah->caldata)
                 ah->caldata->nfcal_pending = true;
 
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_calib.c b/drivers/net/wireless/ath/ath9k/ar9003_calib.c
index 16851cb109a6..12a730dcb500 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_calib.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_calib.c
@@ -908,12 +908,15 @@ static bool ar9003_hw_rtt_restore(struct ath_hw *ah, struct ath9k_channel *chan)
         int i;
         bool restore;
 
-        if (!(ah->caps.hw_caps & ATH9K_HW_CAP_RTT) || !ah->caldata)
+        if (!ah->caldata)
                 return false;
 
         hist = &ah->caldata->rtt_hist;
+        if (!hist->num_readings)
+                return false;
+
         ar9003_hw_rtt_enable(ah);
-        ar9003_hw_rtt_set_mask(ah, 0x10);
+        ar9003_hw_rtt_set_mask(ah, 0x00);
         for (i = 0; i < AR9300_MAX_CHAINS; i++) {
                 if (!(ah->rxchainmask & (1 << i)))
                         continue;
@@ -1070,6 +1073,7 @@ skip_tx_iqcal:
                 if (is_reusable && (hist->num_readings < RTT_HIST_MAX)) {
                         u32 *table;
 
+                        hist->num_readings++;
                         for (i = 0; i < AR9300_MAX_CHAINS; i++) {
                                 if (!(ah->rxchainmask & (1 << i)))
                                         continue;
@@ -1081,9 +1085,6 @@ skip_tx_iqcal:
                 ar9003_hw_rtt_disable(ah);
         }
 
-        ath9k_hw_loadnf(ah, chan);
-        ath9k_hw_start_nfcal(ah, true);
-
         /* Initialize list pointers */
         ah->cal_list = ah->cal_list_last = ah->cal_list_curr = NULL;
         ah->supp_cals = IQ_MISMATCH_CAL;
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.h b/drivers/net/wireless/ath/ath9k/ar9003_phy.h
index 2f4023e66081..4114fe752c6b 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.h
+++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.h
@@ -572,14 +572,14 @@
 
 #define AR_PHY_TXGAIN_TABLE      (AR_SM_BASE + 0x300)
 
-#define AR_PHY_TX_IQCAL_CONTROL_0   (AR_SM_BASE + AR_SREV_9485(ah) ? \
-                                                 0x3c4 : 0x444)
-#define AR_PHY_TX_IQCAL_CONTROL_1   (AR_SM_BASE + AR_SREV_9485(ah) ? \
-                                                 0x3c8 : 0x448)
-#define AR_PHY_TX_IQCAL_START       (AR_SM_BASE + AR_SREV_9485(ah) ? \
-                                                 0x3c4 : 0x440)
-#define AR_PHY_TX_IQCAL_STATUS_B0   (AR_SM_BASE + AR_SREV_9485(ah) ? \
-                                                 0x3f0 : 0x48c)
+#define AR_PHY_TX_IQCAL_CONTROL_0   (AR_SM_BASE + (AR_SREV_9485(ah) ? \
+                                                 0x3c4 : 0x444))
+#define AR_PHY_TX_IQCAL_CONTROL_1   (AR_SM_BASE + (AR_SREV_9485(ah) ? \
+                                                 0x3c8 : 0x448))
+#define AR_PHY_TX_IQCAL_START       (AR_SM_BASE + (AR_SREV_9485(ah) ? \
+                                                 0x3c4 : 0x440))
+#define AR_PHY_TX_IQCAL_STATUS_B0   (AR_SM_BASE + (AR_SREV_9485(ah) ? \
+                                                 0x3f0 : 0x48c))
 #define AR_PHY_TX_IQCAL_CORR_COEFF_B0(_i)    (AR_SM_BASE + \
                                              (AR_SREV_9485(ah) ? \
                                               0x3d0 : 0x450) + ((_i) << 2))
@@ -651,7 +651,7 @@
 #define AR_SWITCH_TABLE_ALL_S (0)
 
 #define AR_PHY_65NM_CH0_THERM       (AR_SREV_9300(ah) ? 0x16290 :\
-                                        (AR_SREV_9485(ah) ? 0x1628c : 0x16294))
+                                        (AR_SREV_9462(ah) ? 0x16294 : 0x1628c))
 
 #define AR_PHY_65NM_CH0_THERM_LOCAL   0x80000000
 #define AR_PHY_65NM_CH0_THERM_LOCAL_S 31
@@ -668,12 +668,12 @@
 #define AR_PHY_65NM_CH2_RXTX2       0x16904
 
 #define AR_CH0_TOP2             (AR_SREV_9300(ah) ? 0x1628c : \
-                                        (AR_SREV_9485(ah) ? 0x16284 : 0x16290))
+                                        (AR_SREV_9462(ah) ? 0x16290 : 0x16284))
 #define AR_CH0_TOP2_XPABIASLVL          0xf000
 #define AR_CH0_TOP2_XPABIASLVL_S        12
 
 #define AR_CH0_XTAL             (AR_SREV_9300(ah) ? 0x16294 : \
-                                        (AR_SREV_9485(ah) ? 0x16290 : 0x16298))
+                                        (AR_SREV_9462(ah) ? 0x16298 : 0x16290))
 #define AR_CH0_XTAL_CAPINDAC    0x7f000000
 #define AR_CH0_XTAL_CAPINDAC_S  24
 #define AR_CH0_XTAL_CAPOUTDAC   0x00fe0000
@@ -908,8 +908,8 @@
 #define AR_PHY_TPC_5_B1         (AR_SM1_BASE + 0x208)
 #define AR_PHY_TPC_6_B1         (AR_SM1_BASE + 0x20c)
 #define AR_PHY_TPC_11_B1        (AR_SM1_BASE + 0x220)
-#define AR_PHY_PDADC_TAB_1      (AR_SM1_BASE + (AR_SREV_AR9300(ah) ? \
-                                        0x240 : 0x280))
+#define AR_PHY_PDADC_TAB_1      (AR_SM1_BASE + (AR_SREV_AR9462(ah) ? \
+                                        0x280 : 0x240))
 #define AR_PHY_TPC_19_B1        (AR_SM1_BASE + 0x240)
 #define AR_PHY_TPC_19_B1_ALPHA_THERM            0xff
 #define AR_PHY_TPC_19_B1_ALPHA_THERM_S          0
@@ -931,10 +931,10 @@
 #define AR_PHY_AIC_SRAM_ADDR_B1 (AR_SM1_BASE + 0x5f0)
 #define AR_PHY_AIC_SRAM_DATA_B1 (AR_SM1_BASE + 0x5f4)
 
-#define AR_PHY_RTT_TABLE_SW_INTF_B(i)   (0x384 + (i) ? \
-                                        AR_SM1_BASE : AR_SM_BASE)
-#define AR_PHY_RTT_TABLE_SW_INTF_1_B(i) (0x388 + (i) ? \
-                                        AR_SM1_BASE : AR_SM_BASE)
+#define AR_PHY_RTT_TABLE_SW_INTF_B(i)   (0x384 + ((i) ? \
+                                        AR_SM1_BASE : AR_SM_BASE))
+#define AR_PHY_RTT_TABLE_SW_INTF_1_B(i) (0x388 + ((i) ? \
+                                        AR_SM1_BASE : AR_SM_BASE))
 /*
  * Channel 2 Register Map
  */
diff --git a/drivers/net/wireless/ath/ath9k/ar9485_initvals.h b/drivers/net/wireless/ath/ath9k/ar9485_initvals.h
index 611ea6ce8508..d16d029f81a9 100644
--- a/drivers/net/wireless/ath/ath9k/ar9485_initvals.h
+++ b/drivers/net/wireless/ath/ath9k/ar9485_initvals.h
@@ -521,7 +521,7 @@ static const u32 ar9485_1_1_radio_postamble[][2] = {
         {0x000160ac, 0x24611800},
         {0x000160b0, 0x03284f3e},
         {0x0001610c, 0x00170000},
-        {0x00016140, 0x10804008},
+        {0x00016140, 0x50804008},
 };
 
 static const u32 ar9485_1_1_mac_postamble[][5] = {
@@ -603,7 +603,7 @@ static const u32 ar9485_1_1_radio_core[][2] = {
 
 static const u32 ar9485_1_1_pcie_phy_pll_on_clkreq_enable_L1[][2] = {
         /* Addr        allmodes */
-        {0x00018c00, 0x10052e5e},
+        {0x00018c00, 0x18052e5e},
         {0x00018c04, 0x000801d8},
         {0x00018c08, 0x0000080c},
 };
@@ -776,7 +776,7 @@ static const u32 ar9485_modes_green_ob_db_tx_gain_1_1[][5] = {
 
 static const u32 ar9485_1_1_pcie_phy_clkreq_disable_L1[][2] = {
         /* Addr        allmodes */
-        {0x00018c00, 0x10013e5e},
+        {0x00018c00, 0x18013e5e},
         {0x00018c04, 0x000801d8},
         {0x00018c08, 0x0000080c},
 };
@@ -882,7 +882,7 @@ static const u32 ar9485_fast_clock_1_1_baseband_postamble[][3] = {
 
 static const u32 ar9485_1_1_pcie_phy_pll_on_clkreq_disable_L1[][2] = {
         /* Addr        allmodes  */
-        {0x00018c00, 0x10012e5e},
+        {0x00018c00, 0x18012e5e},
         {0x00018c04, 0x000801d8},
         {0x00018c08, 0x0000080c},
 };
@@ -1021,7 +1021,7 @@ static const u32 ar9485_common_rx_gain_1_1[][2] = {
 
 static const u32 ar9485_1_1_pcie_phy_clkreq_enable_L1[][2] = {
         /* Addr        allmodes */
-        {0x00018c00, 0x10053e5e},
+        {0x00018c00, 0x18053e5e},
         {0x00018c04, 0x000801d8},
         {0x00018c08, 0x0000080c},
 };
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index 4952ad8c4e8c..2f91acccb7db 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -1725,6 +1725,9 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
         if (!ath9k_hw_init_cal(ah, chan))
                 return -EIO;
 
+        ath9k_hw_loadnf(ah, chan);
+        ath9k_hw_start_nfcal(ah, true);
+
         ENABLE_REGWRITE_BUFFER(ah);
 
         ath9k_hw_restore_chainmask(ah);
diff --git a/drivers/net/wireless/ath/carl9170/tx.c b/drivers/net/wireless/ath/carl9170/tx.c
index d20946939cd8..59472e1605cd 100644
--- a/drivers/net/wireless/ath/carl9170/tx.c
+++ b/drivers/net/wireless/ath/carl9170/tx.c
@@ -296,7 +296,8 @@ static void carl9170_tx_release(struct kref *ref)
                         super = (void *)skb->data;
                         txinfo->status.ampdu_len = super->s.rix;
                         txinfo->status.ampdu_ack_len = super->s.cnt;
-                } else if (txinfo->flags & IEEE80211_TX_STAT_ACK) {
+                } else if ((txinfo->flags & IEEE80211_TX_STAT_ACK) &&
+                           !(txinfo->flags & IEEE80211_TX_CTL_REQ_TX_STATUS)) {
                         /*
                          * drop redundant tx_status reports:
                          *
@@ -308,15 +309,17 @@ static void carl9170_tx_release(struct kref *ref)
                          *
                          * 3. minstrel_ht is picky, it only accepts
                          *    reports of frames with the TX_STATUS_AMPDU flag.
+                         *
+                         * 4. mac80211 is not particularly interested in
+                         *    feedback either [CTL_REQ_TX_STATUS not set]
                          */
 
                         dev_kfree_skb_any(skb);
                         return;
                 } else {
                         /*
-                         * Frame has failed, but we want to keep it in
-                         * case it was lost due to a power-state
-                         * transition.
+                         * Either the frame transmission has failed or
+                         * mac80211 requested tx status.
                          */
                 }
         }
diff --git a/drivers/net/wireless/b43/xmit.c b/drivers/net/wireless/b43/xmit.c
index c73e8600d218..58ea0e5fabfd 100644
--- a/drivers/net/wireless/b43/xmit.c
+++ b/drivers/net/wireless/b43/xmit.c
@@ -827,7 +827,6 @@ void b43_rx(struct b43_wldev *dev, struct sk_buff *skb, const void *_rxhdr)
 #endif
         return;
 drop:
-        b43dbg(dev->wl, "RX: Packet dropped\n");
         dev_kfree_skb_any(skb);
 }
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.c b/drivers/net/wireless/iwlwifi/iwl-core.c
index b247a56d5135..001fdf140abb 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.c
+++ b/drivers/net/wireless/iwlwifi/iwl-core.c
@@ -1755,16 +1755,6 @@ static inline int iwl_check_stuck_queue(struct iwl_priv *priv, int txq)
 {
         if (iwl_trans_check_stuck_queue(trans(priv), txq)) {
                 int ret;
-                if (txq == priv->shrd->cmd_queue) {
-                        /*
-                         * validate command queue still working
-                         * by sending "ECHO" command
-                         */
-                        if (!iwl_cmd_echo_test(priv))
-                                return 0;
-                        else
-                                IWL_DEBUG_HC(priv, "echo testing fail\n");
-                }
                 ret = iwl_force_reset(priv, IWL_FW_RESET, false);
                 return (ret == -EAGAIN) ? 0 : 1;
         }
diff --git a/drivers/net/wireless/iwlwifi/iwl-pci.c b/drivers/net/wireless/iwlwifi/iwl-pci.c
index f0c623ade3ff..1800029911ad 100644
--- a/drivers/net/wireless/iwlwifi/iwl-pci.c
+++ b/drivers/net/wireless/iwlwifi/iwl-pci.c
@@ -446,10 +446,9 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         pci_write_config_byte(pdev, PCI_CFG_RETRY_TIMEOUT, 0x00);
 
         err = pci_enable_msi(pdev);
-        if (err) {
-                dev_printk(KERN_ERR, &pdev->dev, "pci_enable_msi failed");
-                goto out_iounmap;
-        }
+        if (err)
+                dev_printk(KERN_ERR, &pdev->dev,
+                        "pci_enable_msi failed(0X%x)", err);
 
         /* TODO: Move this away, not needed if not MSI */
         /* enable rfkill interrupt: hw bug w/a */
@@ -470,7 +469,6 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 
 out_disable_msi:
         pci_disable_msi(pdev);
-out_iounmap:
         pci_iounmap(pdev, pci_bus->hw_base);
 out_pci_release_regions:
         pci_set_drvdata(pdev, NULL);
diff --git a/drivers/net/wireless/iwlwifi/iwl-trans-pcie.c b/drivers/net/wireless/iwlwifi/iwl-trans-pcie.c
index 8e8c75c997ee..da3411057afc 100644
--- a/drivers/net/wireless/iwlwifi/iwl-trans-pcie.c
+++ b/drivers/net/wireless/iwlwifi/iwl-trans-pcie.c
@@ -407,6 +407,7 @@ static void iwl_tx_queue_unmap(struct iwl_trans *trans, int txq_id)
         struct iwl_queue *q = &txq->q;
         enum dma_data_direction dma_dir;
         unsigned long flags;
+        spinlock_t *lock;
 
         if (!q->n_bd)
                 return;
@@ -414,19 +415,22 @@ static void iwl_tx_queue_unmap(struct iwl_trans *trans, int txq_id)
         /* In the command queue, all the TBs are mapped as BIDI
          * so unmap them as such.
          */
-        if (txq_id == trans->shrd->cmd_queue)
+        if (txq_id == trans->shrd->cmd_queue) {
                 dma_dir = DMA_BIDIRECTIONAL;
-        else
+                lock = &trans->hcmd_lock;
+        } else {
                 dma_dir = DMA_TO_DEVICE;
+                lock = &trans->shrd->sta_lock;
+        }
 
-        spin_lock_irqsave(&trans->shrd->sta_lock, flags);
+        spin_lock_irqsave(lock, flags);
         while (q->write_ptr != q->read_ptr) {
                 /* The read_ptr needs to bound by q->n_window */
                 iwlagn_txq_free_tfd(trans, txq, get_cmd_index(q, q->read_ptr),
                                     dma_dir);
                 q->read_ptr = iwl_queue_inc_wrap(q->read_ptr, q->n_bd);
         }
-        spin_unlock_irqrestore(&trans->shrd->sta_lock, flags);
+        spin_unlock_irqrestore(lock, flags);
 }
 
 /**
diff --git a/drivers/net/wireless/libertas/cfg.c b/drivers/net/wireless/libertas/cfg.c
index ff6378276ff0..4fcd653bddc4 100644
--- a/drivers/net/wireless/libertas/cfg.c
+++ b/drivers/net/wireless/libertas/cfg.c
@@ -728,15 +728,9 @@ static void lbs_scan_worker(struct work_struct *work)
                 le16_to_cpu(scan_cmd->hdr.size),
                 lbs_ret_scan, 0);
 
-        if (priv->scan_channel >= priv->scan_req->n_channels) {
+        if (priv->scan_channel >= priv->scan_req->n_channels)
                 /* Mark scan done */
-                if (priv->internal_scan)
-                        kfree(priv->scan_req);
-                else
-                        cfg80211_scan_done(priv->scan_req, false);
-
-                priv->scan_req = NULL;
-        }
+                lbs_scan_done(priv);
 
         /* Restart network */
         if (carrier)
@@ -774,6 +768,21 @@ static void _internal_start_scan(struct lbs_private *priv, bool internal,
         lbs_deb_leave(LBS_DEB_CFG80211);
 }
 
+/*
+ * Clean up priv->scan_req.  Should be used to handle the allocation details.
+ */
+void lbs_scan_done(struct lbs_private *priv)
+{
+        WARN_ON(!priv->scan_req);
+
+        if (priv->internal_scan)
+                kfree(priv->scan_req);
+        else
+                cfg80211_scan_done(priv->scan_req, false);
+
+        priv->scan_req = NULL;
+}
+
 static int lbs_cfg_scan(struct wiphy *wiphy,
         struct net_device *dev,
         struct cfg80211_scan_request *request)
diff --git a/drivers/net/wireless/libertas/cfg.h b/drivers/net/wireless/libertas/cfg.h
index a02ee151710e..558168ce634d 100644
--- a/drivers/net/wireless/libertas/cfg.h
+++ b/drivers/net/wireless/libertas/cfg.h
@@ -16,6 +16,7 @@ int lbs_reg_notifier(struct wiphy *wiphy,
 void lbs_send_disconnect_notification(struct lbs_private *priv);
 void lbs_send_mic_failureevent(struct lbs_private *priv, u32 event);
 
+void lbs_scan_done(struct lbs_private *priv);
 void lbs_scan_deinit(struct lbs_private *priv);
 int lbs_disconnect(struct lbs_private *priv, u16 reason);
 
diff --git a/drivers/net/wireless/libertas/main.c b/drivers/net/wireless/libertas/main.c
index 4ae99a40dbf7..957681dede17 100644
--- a/drivers/net/wireless/libertas/main.c
+++ b/drivers/net/wireless/libertas/main.c
@@ -255,10 +255,8 @@ static int lbs_eth_stop(struct net_device *dev)
 
         lbs_update_mcast(priv);
         cancel_delayed_work_sync(&priv->scan_work);
-        if (priv->scan_req) {
-                cfg80211_scan_done(priv->scan_req, false);
-                priv->scan_req = NULL;
-        }
+        if (priv->scan_req)
+                lbs_scan_done(priv);
 
         netif_carrier_off(priv->dev);
 
diff --git a/include/linux/ethtool.h b/include/linux/ethtool.h
index 45f00b61c096..de33de1e2052 100644
--- a/include/linux/ethtool.h
+++ b/include/linux/ethtool.h
@@ -1097,10 +1097,12 @@ struct ethtool_ops {
 #define SPEED_1000              1000
 #define SPEED_2500              2500
 #define SPEED_10000             10000
+#define SPEED_UNKNOWN           -1
 
 /* Duplex, half or full. */
 #define DUPLEX_HALF             0x00
 #define DUPLEX_FULL             0x01
+#define DUPLEX_UNKNOWN          0xff
 
 /* Which connector port. */
 #define PORT_TP                 0x00
diff --git a/include/net/bluetooth/rfcomm.h b/include/net/bluetooth/rfcomm.h
index d5eee2093b1e..e2e3ecad1008 100644
--- a/include/net/bluetooth/rfcomm.h
+++ b/include/net/bluetooth/rfcomm.h
@@ -211,6 +211,7 @@ struct rfcomm_dlc {
 #define RFCOMM_AUTH_ACCEPT  6
 #define RFCOMM_AUTH_REJECT  7
 #define RFCOMM_DEFER_SETUP  8
+#define RFCOMM_ENC_DROP     9
 
 /* Scheduling flags and events */
 #define RFCOMM_SCHED_WAKEUP 31
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index dc1123aa8181..72eddd1b410b 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -3567,8 +3567,9 @@ rate_lowest_index(struct ieee80211_supported_band *sband,
                         return i;
 
         /* warn when we cannot find a rate. */
-        WARN_ON(1);
+        WARN_ON_ONCE(1);
 
+        /* and return 0 (the lowest index) */
         return 0;
 }
 
diff --git a/include/net/netlink.h b/include/net/netlink.h
index 98c185441bee..cb1f3504687f 100644
--- a/include/net/netlink.h
+++ b/include/net/netlink.h
@@ -192,8 +192,15 @@ enum {
  *    NLA_NUL_STRING       Maximum length of string (excluding NUL)
  *    NLA_FLAG             Unused
  *    NLA_BINARY           Maximum length of attribute payload
- *    NLA_NESTED_COMPAT    Exact length of structure payload
- *    All other            Exact length of attribute payload
+ *    NLA_NESTED           Don't use `len' field -- length verification is
+ *                         done by checking len of nested header (or empty)
+ *    NLA_NESTED_COMPAT    Minimum length of structure payload
+ *    NLA_U8, NLA_U16,
+ *    NLA_U32, NLA_U64,
+ *    NLA_MSECS            Leaving the length field zero will verify the
+ *                         given type fits, using it verifies minimum length
+ *                         just like "All other"
+ *    All other            Minimum length of attribute payload
  *
  * Example:
  * static const struct nla_policy my_policy[ATTR_MAX+1] = {
diff --git a/lib/nlattr.c b/lib/nlattr.c
index ac09f2226dc7..a8408b6cacdf 100644
--- a/lib/nlattr.c
+++ b/lib/nlattr.c
@@ -20,6 +20,7 @@ static const u16 nla_attr_minlen[NLA_TYPE_MAX+1] = {
         [NLA_U16]       = sizeof(u16),
         [NLA_U32]       = sizeof(u32),
         [NLA_U64]       = sizeof(u64),
+        [NLA_MSECS]     = sizeof(u64),
         [NLA_NESTED]    = NLA_HDRLEN,
 };
 
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index b84458dcc226..be84ae33ae36 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -613,7 +613,7 @@ static int hci_dev_do_close(struct hci_dev *hdev)
         if (!test_bit(HCI_RAW, &hdev->flags)) {
                 set_bit(HCI_INIT, &hdev->flags);
                 __hci_request(hdev, hci_reset_req, 0,
-                                        msecs_to_jiffies(250));
+                                        msecs_to_jiffies(HCI_INIT_TIMEOUT));
                 clear_bit(HCI_INIT, &hdev->flags);
         }
 
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index 940858a48cbd..2c7634296866 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -148,8 +148,6 @@ static int read_index_list(struct sock *sk)
 
                 hci_del_off_timer(d);
 
-                set_bit(HCI_MGMT, &d->flags);
-
                 if (test_bit(HCI_SETUP, &d->flags))
                         continue;
 
diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index 38b618c96de6..4e32e18211f9 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -1802,6 +1802,11 @@ static inline void rfcomm_process_dlcs(struct rfcomm_session *s)
                         continue;
                 }
 
+                if (test_bit(RFCOMM_ENC_DROP, &d->flags)) {
+                        __rfcomm_dlc_close(d, ECONNREFUSED);
+                        continue;
+                }
+
                 if (test_and_clear_bit(RFCOMM_AUTH_ACCEPT, &d->flags)) {
                         rfcomm_dlc_clear_timer(d);
                         if (d->out) {
@@ -2077,7 +2082,7 @@ static void rfcomm_security_cfm(struct hci_conn *conn, u8 status, u8 encrypt)
                 if (test_and_clear_bit(RFCOMM_SEC_PENDING, &d->flags)) {
                         rfcomm_dlc_clear_timer(d);
                         if (status || encrypt == 0x00) {
-                                __rfcomm_dlc_close(d, ECONNREFUSED);
+                                set_bit(RFCOMM_ENC_DROP, &d->flags);
                                 continue;
                         }
                 }
@@ -2088,7 +2093,7 @@ static void rfcomm_security_cfm(struct hci_conn *conn, u8 status, u8 encrypt)
                                 rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
                                 continue;
                         } else if (d->sec_level == BT_SECURITY_HIGH) {
-                                __rfcomm_dlc_close(d, ECONNREFUSED);
+                                set_bit(RFCOMM_ENC_DROP, &d->flags);
                                 continue;
                         }
                 }
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index ebd7fb101fbf..d06c65fa5526 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -832,6 +832,12 @@ static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev,
         if (is_multicast_ether_addr(mac))
                 return -EINVAL;
 
+        /* Only TDLS-supporting stations can add TDLS peers */
+        if ((params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) &&
+            !((wiphy->flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
+              sdata->vif.type == NL80211_IFTYPE_STATION))
+                return -ENOTSUPP;
+
         sta = sta_info_alloc(sdata, mac, GFP_KERNEL);
         if (!sta)
                 return -ENOMEM;
@@ -841,12 +847,6 @@ static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev,
 
         sta_apply_parameters(local, sta, params);
 
-        /* Only TDLS-supporting stations can add TDLS peers */
-        if (test_sta_flag(sta, WLAN_STA_TDLS_PEER) &&
-            !((wiphy->flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
-              sdata->vif.type == NL80211_IFTYPE_STATION))
-                return -ENOTSUPP;
-
         rate_control_rate_init(sta);
 
         layer2_update = sdata->vif.type == NL80211_IFTYPE_AP_VLAN ||
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 4c3d1f591bec..ea10a51babda 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -389,6 +389,7 @@ struct ieee80211_if_managed {
 
         unsigned long timers_running; /* used for quiesce/restart */
         bool powersave; /* powersave requested for this iface */
+        bool broken_ap; /* AP is broken -- turn off powersave */
         enum ieee80211_smps_mode req_smps, /* requested smps mode */
                                  ap_smps, /* smps mode AP thinks we're in */
                                  driver_smps_mode; /* smps mode request */
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 96f9fae32495..72c8bea81a6c 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -639,6 +639,9 @@ static bool ieee80211_powersave_allowed(struct ieee80211_sub_if_data *sdata)
         if (!mgd->powersave)
                 return false;
 
+        if (mgd->broken_ap)
+                return false;
+
         if (!mgd->associated)
                 return false;
 
@@ -1491,10 +1494,21 @@ static bool ieee80211_assoc_success(struct ieee80211_work *wk,
         capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
 
         if ((aid & (BIT(15) | BIT(14))) != (BIT(15) | BIT(14)))
-                printk(KERN_DEBUG "%s: invalid aid value %d; bits 15:14 not "
-                       "set\n", sdata->name, aid);
+                printk(KERN_DEBUG
+                       "%s: invalid AID value 0x%x; bits 15:14 not set\n",
+                       sdata->name, aid);
         aid &= ~(BIT(15) | BIT(14));
 
+        ifmgd->broken_ap = false;
+
+        if (aid == 0 || aid > IEEE80211_MAX_AID) {
+                printk(KERN_DEBUG
+                       "%s: invalid AID value %d (out of range), turn off PS\n",
+                       sdata->name, aid);
+                aid = 0;
+                ifmgd->broken_ap = true;
+        }
+
         pos = mgmt->u.assoc_resp.variable;
         ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems);
 
diff --git a/net/mac80211/work.c b/net/mac80211/work.c
index 94472eb34d76..6c53b6d1002b 100644
--- a/net/mac80211/work.c
+++ b/net/mac80211/work.c
@@ -1084,14 +1084,13 @@ static void ieee80211_work_work(struct work_struct *work)
                         continue;
                 if (wk->chan != local->tmp_channel)
                         continue;
-                if (ieee80211_work_ct_coexists(wk->chan_type,
-                                               local->tmp_channel_type))
+                if (!ieee80211_work_ct_coexists(wk->chan_type,
+                                                local->tmp_channel_type))
                         continue;
                 remain_off_channel = true;
         }
 
         if (!remain_off_channel && local->tmp_channel) {
-                bool on_oper_chan = ieee80211_cfg_on_oper_channel(local);
                 local->tmp_channel = NULL;
                 /* If tmp_channel wasn't operating channel, then
                  * we need to go back on-channel.
@@ -1101,7 +1100,7 @@ static void ieee80211_work_work(struct work_struct *work)
                  * we still need to do a hardware config.  Currently,
                  * we cannot be here while scanning, however.
                  */
-                if (ieee80211_cfg_on_oper_channel(local) && !on_oper_chan)
+                if (!ieee80211_cfg_on_oper_channel(local))
                         ieee80211_hw_config(local, 0);
 
                 /* At the least, we need to disable offchannel_ps,
diff --git a/net/wanrouter/wanproc.c b/net/wanrouter/wanproc.c
index f346395314ba..c43612ee96bb 100644
--- a/net/wanrouter/wanproc.c
+++ b/net/wanrouter/wanproc.c
@@ -81,7 +81,6 @@ static struct proc_dir_entry *proc_router;
  *      Iterator
  */
 static void *r_start(struct seq_file *m, loff_t *pos)
-        __acquires(kernel_lock)
 {
         struct wan_device *wandev;
         loff_t l = *pos;
@@ -103,7 +102,6 @@ static void *r_next(struct seq_file *m, void *v, loff_t *pos)
 }
 
 static void r_stop(struct seq_file *m, void *v)
-        __releases(kernel_lock)
 {
         mutex_unlock(&config_mutex);
 }