85 files changed, 1213 insertions, 674 deletions
diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
index 8d0314dbd946..a44874e24f2a 100644
--- a/drivers/net/Kconfig
+++ b/drivers/net/Kconfig
@@ -2535,7 +2535,7 @@ config S6GMAC
 source "drivers/net/stmmac/Kconfig"
 config PCH_GBE
-        tristate "Intel EG20T PCH / OKI SEMICONDUCTOR ML7223 IOH GbE"
+        tristate "Intel EG20T PCH/OKI SEMICONDUCTOR IOH(ML7223/ML7831) GbE"
        depends on PCI
        select MII
        ---help---
@@ -2548,10 +2548,11 @@ config PCH_GBE
          This driver enables Gigabit Ethernet function.
          This driver also can be used for OKI SEMICONDUCTOR IOH(Input/
-          Output Hub), ML7223.
+          Output Hub), ML7223/ML7831.
-          ML7223 IOH is for MP(Media Phone) use.
+          ML7223 IOH is for MP(Media Phone) use. ML7831 IOH is for general
-          ML7223 is companion chip for Intel Atom E6xx series.
+          purpose use.
-          ML7223 is completely compatible for Intel EG20T PCH.
+          ML7223/ML7831 is companion chip for Intel Atom E6xx series.
+          ML7223/ML7831 is completely compatible for Intel EG20T PCH.
 config FTGMAC100
        tristate "Faraday FTGMAC100 Gigabit Ethernet support"
diff --git a/drivers/net/arm/am79c961a.c b/drivers/net/arm/am79c961a.c
index 52fe21e1e2cd..3b1416e3d217 100644
--- a/drivers/net/arm/am79c961a.c
+++ b/drivers/net/arm/am79c961a.c
@@ -308,8 +308,11 @@ static void am79c961_timer(unsigned long data)
        struct net_device *dev = (struct net_device *)data;
        struct dev_priv *priv = netdev_priv(dev);
        unsigned int lnkstat, carrier;
+        unsigned long flags;
+        spin_lock_irqsave(&priv->chip_lock, flags);
        lnkstat = read_ireg(dev->base_addr, ISALED0) & ISALED0_LNKST;
+        spin_unlock_irqrestore(&priv->chip_lock, flags);
        carrier = netif_carrier_ok(dev);
        if (lnkstat && !carrier) {
diff --git a/drivers/net/bnx2x/bnx2x.h b/drivers/net/bnx2x/bnx2x.h
index c423504a755f..e46df5331c55 100644
--- a/drivers/net/bnx2x/bnx2x.h
+++ b/drivers/net/bnx2x/bnx2x.h
@@ -315,6 +315,14 @@ union db_prod {
        u32             raw;
 };
+/* dropless fc FW/HW related params */
+#define BRB_SIZE(bp)            (CHIP_IS_E3(bp) ? 1024 : 512)
+#define MAX_AGG_QS(bp)          (CHIP_IS_E1(bp) ? \
+                                        ETH_MAX_AGGREGATION_QUEUES_E1 :\
+                                        ETH_MAX_AGGREGATION_QUEUES_E1H_E2)
+#define FW_DROP_LEVEL(bp)       (3 + MAX_SPQ_PENDING + MAX_AGG_QS(bp))
+#define FW_PREFETCH_CNT         16
+#define DROPLESS_FC_HEADROOM    100
 /* MC hsi */
 #define BCM_PAGE_SHIFT          12
@@ -331,15 +339,35 @@ union db_prod {
 /* SGE ring related macros */
 #define NUM_RX_SGE_PAGES        2
 #define RX_SGE_CNT              (BCM_PAGE_SIZE / sizeof(struct eth_rx_sge))
-#define MAX_RX_SGE_CNT          (RX_SGE_CNT - 2)
+#define NEXT_PAGE_SGE_DESC_CNT  2
+#define MAX_RX_SGE_CNT          (RX_SGE_CNT - NEXT_PAGE_SGE_DESC_CNT)
 /* RX_SGE_CNT is promised to be a power of 2 */
 #define RX_SGE_MASK             (RX_SGE_CNT - 1)
 #define NUM_RX_SGE              (RX_SGE_CNT * NUM_RX_SGE_PAGES)
 #define MAX_RX_SGE              (NUM_RX_SGE - 1)
 #define NEXT_SGE_IDX(x)         ((((x) & RX_SGE_MASK) == \
-                                  (MAX_RX_SGE_CNT - 1)) ? (x) + 3 : (x) + 1)
+                                  (MAX_RX_SGE_CNT - 1)) ? \
+                                        (x) + 1 + NEXT_PAGE_SGE_DESC_CNT : \
+                                        (x) + 1)
 #define RX_SGE(x)               ((x) & MAX_RX_SGE)
+/*
+ * Number of required  SGEs is the sum of two:
+ * 1. Number of possible opened aggregations (next packet for
+ *    these aggregations will probably consume SGE immidiatelly)
+ * 2. Rest of BRB blocks divided by 2 (block will consume new SGE only
+ *    after placement on BD for new TPA aggregation)
+ *
+ * Takes into account NEXT_PAGE_SGE_DESC_CNT "next" elements on each page
+ */
+#define NUM_SGE_REQ             (MAX_AGG_QS(bp) + \
+                                        (BRB_SIZE(bp) - MAX_AGG_QS(bp)) / 2)
+#define NUM_SGE_PG_REQ          ((NUM_SGE_REQ + MAX_RX_SGE_CNT - 1) / \
+                                                MAX_RX_SGE_CNT)
+#define SGE_TH_LO(bp)           (NUM_SGE_REQ + \
+                                 NUM_SGE_PG_REQ * NEXT_PAGE_SGE_DESC_CNT)
+#define SGE_TH_HI(bp)           (SGE_TH_LO(bp) + DROPLESS_FC_HEADROOM)
 /* Manipulate a bit vector defined as an array of u64 */
 /* Number of bits in one sge_mask array element */
@@ -551,24 +579,43 @@ struct bnx2x_fastpath {
 #define NUM_TX_RINGS            16
 #define TX_DESC_CNT             (BCM_PAGE_SIZE / sizeof(union eth_tx_bd_types))
-#define MAX_TX_DESC_CNT         (TX_DESC_CNT - 1)
+#define NEXT_PAGE_TX_DESC_CNT   1
+#define MAX_TX_DESC_CNT         (TX_DESC_CNT - NEXT_PAGE_TX_DESC_CNT)
 #define NUM_TX_BD               (TX_DESC_CNT * NUM_TX_RINGS)
 #define MAX_TX_BD               (NUM_TX_BD - 1)
 #define MAX_TX_AVAIL            (MAX_TX_DESC_CNT * NUM_TX_RINGS - 2)
 #define NEXT_TX_IDX(x)          ((((x) & MAX_TX_DESC_CNT) == \
-                                  (MAX_TX_DESC_CNT - 1)) ? (x) + 2 : (x) + 1)
+                                  (MAX_TX_DESC_CNT - 1)) ? \
+                                        (x) + 1 + NEXT_PAGE_TX_DESC_CNT : \
+                                        (x) + 1)
 #define TX_BD(x)                ((x) & MAX_TX_BD)
 #define TX_BD_POFF(x)           ((x) & MAX_TX_DESC_CNT)
 /* The RX BD ring is special, each bd is 8 bytes but the last one is 16 */
 #define NUM_RX_RINGS            8
 #define RX_DESC_CNT             (BCM_PAGE_SIZE / sizeof(struct eth_rx_bd))
-#define MAX_RX_DESC_CNT         (RX_DESC_CNT - 2)
+#define NEXT_PAGE_RX_DESC_CNT   2
+#define MAX_RX_DESC_CNT         (RX_DESC_CNT - NEXT_PAGE_RX_DESC_CNT)
 #define RX_DESC_MASK            (RX_DESC_CNT - 1)
 #define NUM_RX_BD               (RX_DESC_CNT * NUM_RX_RINGS)
 #define MAX_RX_BD               (NUM_RX_BD - 1)
 #define MAX_RX_AVAIL            (MAX_RX_DESC_CNT * NUM_RX_RINGS - 2)
-#define MIN_RX_AVAIL            128
+/* dropless fc calculations for BDs
+ *
+ * Number of BDs should as number of buffers in BRB:
+ * Low threshold takes into account NEXT_PAGE_RX_DESC_CNT
+ * "next" elements on each page
+ */
+#define NUM_BD_REQ              BRB_SIZE(bp)
+#define NUM_BD_PG_REQ           ((NUM_BD_REQ + MAX_RX_DESC_CNT - 1) / \
+                                              MAX_RX_DESC_CNT)
+#define BD_TH_LO(bp)            (NUM_BD_REQ + \
+                                 NUM_BD_PG_REQ * NEXT_PAGE_RX_DESC_CNT + \
+                                 FW_DROP_LEVEL(bp))
+#define BD_TH_HI(bp)            (BD_TH_LO(bp) + DROPLESS_FC_HEADROOM)
+#define MIN_RX_AVAIL            ((bp)->dropless_fc ? BD_TH_HI(bp) + 128 : 128)
 #define MIN_RX_SIZE_TPA_HW      (CHIP_IS_E1(bp) ? \
                                        ETH_MIN_RX_CQES_WITH_TPA_E1 : \
@@ -579,7 +626,9 @@ struct bnx2x_fastpath {
                                                                MIN_RX_AVAIL))
 #define NEXT_RX_IDX(x)          ((((x) & RX_DESC_MASK) == \
-                                  (MAX_RX_DESC_CNT - 1)) ? (x) + 3 : (x) + 1)
+                                  (MAX_RX_DESC_CNT - 1)) ? \
+                                        (x) + 1 + NEXT_PAGE_RX_DESC_CNT : \
+                                        (x) + 1)
 #define RX_BD(x)                ((x) & MAX_RX_BD)
 /*
@@ -589,14 +638,31 @@ struct bnx2x_fastpath {
 #define CQE_BD_REL      (sizeof(union eth_rx_cqe) / sizeof(struct eth_rx_bd))
 #define NUM_RCQ_RINGS           (NUM_RX_RINGS * CQE_BD_REL)
 #define RCQ_DESC_CNT            (BCM_PAGE_SIZE / sizeof(union eth_rx_cqe))
-#define MAX_RCQ_DESC_CNT        (RCQ_DESC_CNT - 1)
+#define NEXT_PAGE_RCQ_DESC_CNT  1
+#define MAX_RCQ_DESC_CNT        (RCQ_DESC_CNT - NEXT_PAGE_RCQ_DESC_CNT)
 #define NUM_RCQ_BD              (RCQ_DESC_CNT * NUM_RCQ_RINGS)
 #define MAX_RCQ_BD              (NUM_RCQ_BD - 1)
 #define MAX_RCQ_AVAIL           (MAX_RCQ_DESC_CNT * NUM_RCQ_RINGS - 2)
 #define NEXT_RCQ_IDX(x)         ((((x) & MAX_RCQ_DESC_CNT) == \
-                                  (MAX_RCQ_DESC_CNT - 1)) ? (x) + 2 : (x) + 1)
+                                  (MAX_RCQ_DESC_CNT - 1)) ? \
+                                        (x) + 1 + NEXT_PAGE_RCQ_DESC_CNT : \
+                                        (x) + 1)
 #define RCQ_BD(x)               ((x) & MAX_RCQ_BD)
+/* dropless fc calculations for RCQs
+ *
+ * Number of RCQs should be as number of buffers in BRB:
+ * Low threshold takes into account NEXT_PAGE_RCQ_DESC_CNT
+ * "next" elements on each page
+ */
+#define NUM_RCQ_REQ             BRB_SIZE(bp)
+#define NUM_RCQ_PG_REQ          ((NUM_BD_REQ + MAX_RCQ_DESC_CNT - 1) / \
+                                              MAX_RCQ_DESC_CNT)
+#define RCQ_TH_LO(bp)           (NUM_RCQ_REQ + \
+                                 NUM_RCQ_PG_REQ * NEXT_PAGE_RCQ_DESC_CNT + \
+                                 FW_DROP_LEVEL(bp))
+#define RCQ_TH_HI(bp)           (RCQ_TH_LO(bp) + DROPLESS_FC_HEADROOM)
 /* This is needed for determining of last_max */
 #define SUB_S16(a, b)           (s16)((s16)(a) - (s16)(b))
@@ -685,24 +751,17 @@ struct bnx2x_fastpath {
 #define FP_CSB_FUNC_OFF \
                        offsetof(struct cstorm_status_block_c, func)
-#define HC_INDEX_TOE_RX_CQ_CONS         0 /* Formerly Ustorm TOE CQ index */
+#define HC_INDEX_ETH_RX_CQ_CONS         1
-                                          /* (HC_INDEX_U_TOE_RX_CQ_CONS)  */
-#define HC_INDEX_ETH_RX_CQ_CONS         1 /* Formerly Ustorm ETH CQ index */
-                                          /* (HC_INDEX_U_ETH_RX_CQ_CONS)  */
-#define HC_INDEX_ETH_RX_BD_CONS         2 /* Formerly Ustorm ETH BD index */
-                                          /* (HC_INDEX_U_ETH_RX_BD_CONS)  */
-#define HC_INDEX_TOE_TX_CQ_CONS         4 /* Formerly Cstorm TOE CQ index   */
-                                          /* (HC_INDEX_C_TOE_TX_CQ_CONS)    */
-#define HC_INDEX_ETH_TX_CQ_CONS_COS0    5 /* Formerly Cstorm ETH CQ index   */
-                                          /* (HC_INDEX_C_ETH_TX_CQ_CONS)    */
-#define HC_INDEX_ETH_TX_CQ_CONS_COS1    6 /* Formerly Cstorm ETH CQ index   */
-                                          /* (HC_INDEX_C_ETH_TX_CQ_CONS)    */
-#define HC_INDEX_ETH_TX_CQ_CONS_COS2    7 /* Formerly Cstorm ETH CQ index   */
-                                          /* (HC_INDEX_C_ETH_TX_CQ_CONS)    */
-#define HC_INDEX_ETH_FIRST_TX_CQ_CONS   HC_INDEX_ETH_TX_CQ_CONS_COS0
+#define HC_INDEX_OOO_TX_CQ_CONS         4
+#define HC_INDEX_ETH_TX_CQ_CONS_COS0    5
+#define HC_INDEX_ETH_TX_CQ_CONS_COS1    6
+#define HC_INDEX_ETH_TX_CQ_CONS_COS2    7
+#define HC_INDEX_ETH_FIRST_TX_CQ_CONS   HC_INDEX_ETH_TX_CQ_CONS_COS0
 #define BNX2X_RX_SB_INDEX \
        (&fp->sb_index_values[HC_INDEX_ETH_RX_CQ_CONS])
@@ -1100,11 +1159,12 @@ struct bnx2x {
 #define BP_PORT(bp)                     (bp->pfid & 1)
 #define BP_FUNC(bp)                     (bp->pfid)
 #define BP_ABS_FUNC(bp)                 (bp->pf_num)
-#define BP_E1HVN(bp)                    (bp->pfid >> 1)
+#define BP_VN(bp)                       ((bp)->pfid >> 1)
-#define BP_VN(bp)                       (BP_E1HVN(bp)) /*remove when approved*/
+#define BP_MAX_VN_NUM(bp)               (CHIP_MODE_IS_4_PORT(bp) ? 2 : 4)
-#define BP_L_ID(bp)                     (BP_E1HVN(bp) << 2)
+#define BP_L_ID(bp)                     (BP_VN(bp) << 2)
-#define BP_FW_MB_IDX(bp)                (BP_PORT(bp) +\
+#define BP_FW_MB_IDX_VN(bp, vn)         (BP_PORT(bp) +\
-          BP_VN(bp) * ((CHIP_IS_E1x(bp) || (CHIP_MODE_IS_4_PORT(bp))) ? 2  : 1))
+          (vn) * ((CHIP_IS_E1x(bp) || (CHIP_MODE_IS_4_PORT(bp))) ? 2  : 1))
+#define BP_FW_MB_IDX(bp)                BP_FW_MB_IDX_VN(bp, BP_VN(bp))
        struct net_device       *dev;
        struct pci_dev          *pdev;
@@ -1767,7 +1827,7 @@ static inline u32 reg_poll(struct bnx2x *bp, u32 reg, u32 expected, int ms,
 #define MAX_DMAE_C_PER_PORT             8
 #define INIT_DMAE_C(bp)                 (BP_PORT(bp) * MAX_DMAE_C_PER_PORT + \
-                                         BP_E1HVN(bp))
+                                         BP_VN(bp))
 #define PMF_DMAE_C(bp)                  (BP_PORT(bp) * MAX_DMAE_C_PER_PORT + \
                                         E1HVN_MAX)
@@ -1793,7 +1853,7 @@ static inline u32 reg_poll(struct bnx2x *bp, u32 reg, u32 expected, int ms,
 /* must be used on a CID before placing it on a HW ring */
 #define HW_CID(bp, x)                   ((BP_PORT(bp) << 23) | \
-                                         (BP_E1HVN(bp) << BNX2X_SWCID_SHIFT) | \
+                                         (BP_VN(bp) << BNX2X_SWCID_SHIFT) | \
                                         (x))
 #define SP_DESC_CNT             (BCM_PAGE_SIZE / sizeof(struct eth_spe))
diff --git a/drivers/net/bnx2x/bnx2x_cmn.c b/drivers/net/bnx2x/bnx2x_cmn.c
index 37e5790681ad..c4cbf9736414 100644
--- a/drivers/net/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/bnx2x/bnx2x_cmn.c
@@ -987,8 +987,6 @@ void __bnx2x_link_report(struct bnx2x *bp)
 void bnx2x_init_rx_rings(struct bnx2x *bp)
 {
        int func = BP_FUNC(bp);
-        int max_agg_queues = CHIP_IS_E1(bp) ? ETH_MAX_AGGREGATION_QUEUES_E1 :
-                                              ETH_MAX_AGGREGATION_QUEUES_E1H_E2;
        u16 ring_prod;
        int i, j;
@@ -1001,7 +999,7 @@ void bnx2x_init_rx_rings(struct bnx2x *bp)
                if (!fp->disable_tpa) {
                        /* Fill the per-aggregtion pool */
-                        for (i = 0; i < max_agg_queues; i++) {
+                        for (i = 0; i < MAX_AGG_QS(bp); i++) {
                                struct bnx2x_agg_info *tpa_info =
                                        &fp->tpa_info[i];
                                struct sw_rx_bd *first_buf =
@@ -1041,7 +1039,7 @@ void bnx2x_init_rx_rings(struct bnx2x *bp)
                                        bnx2x_free_rx_sge_range(bp, fp,
                                                                ring_prod);
                                        bnx2x_free_tpa_pool(bp, fp,
-                                                            max_agg_queues);
+                                                            MAX_AGG_QS(bp));
                                        fp->disable_tpa = 1;
                                        ring_prod = 0;
                                        break;
@@ -1137,9 +1135,7 @@ static void bnx2x_free_rx_skbs(struct bnx2x *bp)
                bnx2x_free_rx_bds(fp);
                if (!fp->disable_tpa)
-                        bnx2x_free_tpa_pool(bp, fp, CHIP_IS_E1(bp) ?
+                        bnx2x_free_tpa_pool(bp, fp, MAX_AGG_QS(bp));
-                                            ETH_MAX_AGGREGATION_QUEUES_E1 :
-                                            ETH_MAX_AGGREGATION_QUEUES_E1H_E2);
        }
 }
@@ -3095,15 +3091,20 @@ static int bnx2x_alloc_fp_mem_at(struct bnx2x *bp, int index)
        struct bnx2x_fastpath *fp = &bp->fp[index];
        int ring_size = 0;
        u8 cos;
+        int rx_ring_size = 0;
        /* if rx_ring_size specified - use it */
-        int rx_ring_size = bp->rx_ring_size ? bp->rx_ring_size :
+        if (!bp->rx_ring_size) {
-                           MAX_RX_AVAIL/BNX2X_NUM_RX_QUEUES(bp);
-        /* allocate at least number of buffers required by FW */
+                rx_ring_size = MAX_RX_AVAIL/BNX2X_NUM_RX_QUEUES(bp);
-        rx_ring_size = max_t(int, bp->disable_tpa ? MIN_RX_SIZE_NONTPA :
-                                                    MIN_RX_SIZE_TPA,
+                /* allocate at least number of buffers required by FW */
-                                  rx_ring_size);
+                rx_ring_size = max_t(int, bp->disable_tpa ? MIN_RX_SIZE_NONTPA :
+                                     MIN_RX_SIZE_TPA, rx_ring_size);
+                bp->rx_ring_size = rx_ring_size;
+        } else
+                rx_ring_size = bp->rx_ring_size;
        /* Common */
        sb = &bnx2x_fp(bp, index, status_blk);
diff --git a/drivers/net/bnx2x/bnx2x_dcb.c b/drivers/net/bnx2x/bnx2x_dcb.c
index a1e004a82f7a..0b4acf67e0c6 100644
--- a/drivers/net/bnx2x/bnx2x_dcb.c
+++ b/drivers/net/bnx2x/bnx2x_dcb.c
@@ -2120,6 +2120,7 @@ static u8 bnx2x_dcbnl_get_cap(struct net_device *netdev, int capid, u8 *cap)
                        break;
                case DCB_CAP_ATTR_DCBX:
                        *cap = BNX2X_DCBX_CAPS;
+                        break;
                default:
                        rval = -EINVAL;
                        break;
diff --git a/drivers/net/bnx2x/bnx2x_ethtool.c b/drivers/net/bnx2x/bnx2x_ethtool.c
index 221863059dae..cf3e47914dd7 100644
--- a/drivers/net/bnx2x/bnx2x_ethtool.c
+++ b/drivers/net/bnx2x/bnx2x_ethtool.c
@@ -363,13 +363,50 @@ static int bnx2x_set_settings(struct net_device *dev, struct ethtool_cmd *cmd)
                }
                /* advertise the requested speed and duplex if supported */
-                cmd->advertising &= bp->port.supported[cfg_idx];
+                if (cmd->advertising & ~(bp->port.supported[cfg_idx])) {
+                        DP(NETIF_MSG_LINK, "Advertisement parameters "
+                                           "are not supported\n");
+                        return -EINVAL;
+                }
                bp->link_params.req_line_speed[cfg_idx] = SPEED_AUTO_NEG;
-                bp->link_params.req_duplex[cfg_idx] = DUPLEX_FULL;
+                bp->link_params.req_duplex[cfg_idx] = cmd->duplex;
-                bp->port.advertising[cfg_idx] |= (ADVERTISED_Autoneg |
+                bp->port.advertising[cfg_idx] = (ADVERTISED_Autoneg |
                                         cmd->advertising);
+                if (cmd->advertising) {
+                        bp->link_params.speed_cap_mask[cfg_idx] = 0;
+                        if (cmd->advertising & ADVERTISED_10baseT_Half) {
+                                bp->link_params.speed_cap_mask[cfg_idx] |=
+                                PORT_HW_CFG_SPEED_CAPABILITY_D0_10M_HALF;
+                        }
+                        if (cmd->advertising & ADVERTISED_10baseT_Full)
+                                bp->link_params.speed_cap_mask[cfg_idx] |=
+                                PORT_HW_CFG_SPEED_CAPABILITY_D0_10M_FULL;
+                        if (cmd->advertising & ADVERTISED_100baseT_Full)
+                                bp->link_params.speed_cap_mask[cfg_idx] |=
+                                PORT_HW_CFG_SPEED_CAPABILITY_D0_100M_FULL;
+                        if (cmd->advertising & ADVERTISED_100baseT_Half) {
+                                bp->link_params.speed_cap_mask[cfg_idx] |=
+                                     PORT_HW_CFG_SPEED_CAPABILITY_D0_100M_HALF;
+                        }
+                        if (cmd->advertising & ADVERTISED_1000baseT_Half) {
+                                bp->link_params.speed_cap_mask[cfg_idx] |=
+                                        PORT_HW_CFG_SPEED_CAPABILITY_D0_1G;
+                        }
+                        if (cmd->advertising & (ADVERTISED_1000baseT_Full |
+                                                ADVERTISED_1000baseKX_Full))
+                                bp->link_params.speed_cap_mask[cfg_idx] |=
+                                        PORT_HW_CFG_SPEED_CAPABILITY_D0_1G;
+                        if (cmd->advertising & (ADVERTISED_10000baseT_Full |
+                                                ADVERTISED_10000baseKX4_Full |
+                                                ADVERTISED_10000baseKR_Full))
+                                bp->link_params.speed_cap_mask[cfg_idx] |=
+                                        PORT_HW_CFG_SPEED_CAPABILITY_D0_10G;
+                }
        } else { /* forced speed */
                /* advertise the requested speed and duplex if supported */
                switch (speed) {
@@ -1310,10 +1347,7 @@ static void bnx2x_get_ringparam(struct net_device *dev,
        if (bp->rx_ring_size)
                ering->rx_pending = bp->rx_ring_size;
        else
-                if (bp->state == BNX2X_STATE_OPEN && bp->num_queues)
+                ering->rx_pending = MAX_RX_AVAIL;
-                        ering->rx_pending = MAX_RX_AVAIL/bp->num_queues;
-                else
-                        ering->rx_pending = MAX_RX_AVAIL;
        ering->rx_mini_pending = 0;
        ering->rx_jumbo_pending = 0;
diff --git a/drivers/net/bnx2x/bnx2x_link.c b/drivers/net/bnx2x/bnx2x_link.c
index d45b1555a602..ba15bdc5a1a9 100644
--- a/drivers/net/bnx2x/bnx2x_link.c
+++ b/drivers/net/bnx2x/bnx2x_link.c
@@ -778,9 +778,9 @@ static int bnx2x_ets_e3b0_set_cos_bw(struct bnx2x *bp,
 {
        u32 nig_reg_adress_crd_weight = 0;
        u32 pbf_reg_adress_crd_weight = 0;
-        /* Calculate and set BW for this COS*/
+        /* Calculate and set BW for this COS - use 1 instead of 0 for BW */
-        const u32 cos_bw_nig = (bw * min_w_val_nig) / total_bw;
+        const u32 cos_bw_nig = ((bw ? bw : 1) * min_w_val_nig) / total_bw;
-        const u32 cos_bw_pbf = (bw * min_w_val_pbf) / total_bw;
+        const u32 cos_bw_pbf = ((bw ? bw : 1) * min_w_val_pbf) / total_bw;
        switch (cos_entry) {
        case 0:
@@ -852,18 +852,12 @@ static int bnx2x_ets_e3b0_get_total_bw(
        /* Calculate total BW requested */
        for (cos_idx = 0; cos_idx < ets_params->num_of_cos; cos_idx++) {
                if (bnx2x_cos_state_bw == ets_params->cos[cos_idx].state) {
+                        *total_bw +=
-                        if (0 == ets_params->cos[cos_idx].params.bw_params.bw) {
+                                ets_params->cos[cos_idx].params.bw_params.bw;
-                                DP(NETIF_MSG_LINK, "bnx2x_ets_E3B0_config BW"
-                                                   "was set to 0\n");
-                        return -EINVAL;
                }
-                *total_bw +=
-                    ets_params->cos[cos_idx].params.bw_params.bw;
-            }
        }
-        /*Check taotl BW is valid */
+        /* Check total BW is valid */
        if ((100 != *total_bw) || (0 == *total_bw)) {
                if (0 == *total_bw) {
                        DP(NETIF_MSG_LINK, "bnx2x_ets_E3B0_config toatl BW"
@@ -1726,7 +1720,7 @@ static int bnx2x_xmac_enable(struct link_params *params,
        /* Check loopback mode */
        if (lb)
-                val |= XMAC_CTRL_REG_CORE_LOCAL_LPBK;
+                val |= XMAC_CTRL_REG_LINE_LOCAL_LPBK;
        REG_WR(bp, xmac_base + XMAC_REG_CTRL, val);
        bnx2x_set_xumac_nig(params,
                            ((vars->flow_ctrl & BNX2X_FLOW_CTRL_TX) != 0), 1);
@@ -3630,6 +3624,12 @@ static void bnx2x_warpcore_enable_AN_KR(struct bnx2x_phy *phy,
        bnx2x_cl45_write(bp, phy, MDIO_AN_DEVAD,
                         MDIO_WC_REG_AN_IEEE1BLK_AN_ADVERTISEMENT1, val16);
+        /* Advertised and set FEC (Forward Error Correction) */
+        bnx2x_cl45_write(bp, phy, MDIO_AN_DEVAD,
+                         MDIO_WC_REG_AN_IEEE1BLK_AN_ADVERTISEMENT2,
+                         (MDIO_WC_REG_AN_IEEE1BLK_AN_ADV2_FEC_ABILITY |
+                          MDIO_WC_REG_AN_IEEE1BLK_AN_ADV2_FEC_REQ));
        /* Enable CL37 BAM */
        if (REG_RD(bp, params->shmem_base +
                   offsetof(struct shmem_region, dev_info.
@@ -5924,7 +5924,7 @@ int bnx2x_set_led(struct link_params *params,
                                        (tmp | EMAC_LED_OVERRIDE));
                                /*
                                 * return here without enabling traffic
-                                 * LED blink andsetting rate in ON mode.
+                                 * LED blink and setting rate in ON mode.
                                 * In oper mode, enabling LED blink
                                 * and setting rate is needed.
                                 */
@@ -5936,7 +5936,11 @@ int bnx2x_set_led(struct link_params *params,
                         * This is a work-around for HW issue found when link
                         * is up in CL73
                         */
-                        REG_WR(bp, NIG_REG_LED_10G_P0 + port*4, 1);
+                        if ((!CHIP_IS_E3(bp)) ||
+                            (CHIP_IS_E3(bp) &&
+                             mode == LED_MODE_ON))
+                                REG_WR(bp, NIG_REG_LED_10G_P0 + port*4, 1);
                        if (CHIP_IS_E1x(bp) ||
                            CHIP_IS_E2(bp) ||
                            (mode == LED_MODE_ON))
@@ -10638,8 +10642,7 @@ static struct bnx2x_phy phy_warpcore = {
        .type           = PORT_HW_CFG_XGXS_EXT_PHY_TYPE_DIRECT,
        .addr           = 0xff,
        .def_md_devad   = 0,
-        .flags          = (FLAGS_HW_LOCK_REQUIRED |
+        .flags          = FLAGS_HW_LOCK_REQUIRED,
-                           FLAGS_TX_ERROR_CHECK),
        .rx_preemphasis = {0xffff, 0xffff, 0xffff, 0xffff},
        .tx_preemphasis = {0xffff, 0xffff, 0xffff, 0xffff},
        .mdio_ctrl      = 0,
@@ -10765,8 +10768,7 @@ static struct bnx2x_phy phy_8706 = {
        .type           = PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8706,
        .addr           = 0xff,
        .def_md_devad   = 0,
-        .flags          = (FLAGS_INIT_XGXS_FIRST |
+        .flags          = FLAGS_INIT_XGXS_FIRST,
-                           FLAGS_TX_ERROR_CHECK),
        .rx_preemphasis = {0xffff, 0xffff, 0xffff, 0xffff},
        .tx_preemphasis = {0xffff, 0xffff, 0xffff, 0xffff},
        .mdio_ctrl      = 0,
@@ -10797,8 +10799,7 @@ static struct bnx2x_phy phy_8726 = {
        .addr           = 0xff,
        .def_md_devad   = 0,
        .flags          = (FLAGS_HW_LOCK_REQUIRED |
-                           FLAGS_INIT_XGXS_FIRST |
+                           FLAGS_INIT_XGXS_FIRST),
-                           FLAGS_TX_ERROR_CHECK),
        .rx_preemphasis = {0xffff, 0xffff, 0xffff, 0xffff},
        .tx_preemphasis = {0xffff, 0xffff, 0xffff, 0xffff},
        .mdio_ctrl      = 0,
@@ -10829,8 +10830,7 @@ static struct bnx2x_phy phy_8727 = {
        .type           = PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM8727,
        .addr           = 0xff,
        .def_md_devad   = 0,
-        .flags          = (FLAGS_FAN_FAILURE_DET_REQ |
+        .flags          = FLAGS_FAN_FAILURE_DET_REQ,
-                           FLAGS_TX_ERROR_CHECK),
        .rx_preemphasis = {0xffff, 0xffff, 0xffff, 0xffff},
        .tx_preemphasis = {0xffff, 0xffff, 0xffff, 0xffff},
        .mdio_ctrl      = 0,
diff --git a/drivers/net/bnx2x/bnx2x_main.c b/drivers/net/bnx2x/bnx2x_main.c
index f74582a22c68..15f800085bb2 100644
--- a/drivers/net/bnx2x/bnx2x_main.c
+++ b/drivers/net/bnx2x/bnx2x_main.c
@@ -407,8 +407,8 @@ u32 bnx2x_dmae_opcode(struct bnx2x *bp, u8 src_type, u8 dst_type,
        opcode |= (DMAE_CMD_SRC_RESET | DMAE_CMD_DST_RESET);
        opcode |= (BP_PORT(bp) ? DMAE_CMD_PORT_1 : DMAE_CMD_PORT_0);
-        opcode |= ((BP_E1HVN(bp) << DMAE_CMD_E1HVN_SHIFT) |
+        opcode |= ((BP_VN(bp) << DMAE_CMD_E1HVN_SHIFT) |
-                   (BP_E1HVN(bp) << DMAE_COMMAND_DST_VN_SHIFT));
+                   (BP_VN(bp) << DMAE_COMMAND_DST_VN_SHIFT));
        opcode |= (DMAE_COM_SET_ERR << DMAE_COMMAND_ERR_POLICY_SHIFT);
 #ifdef __BIG_ENDIAN
@@ -1419,7 +1419,7 @@ static void bnx2x_hc_int_enable(struct bnx2x *bp)
        if (!CHIP_IS_E1(bp)) {
                /* init leading/trailing edge */
                if (IS_MF(bp)) {
-                        val = (0xee0f | (1 << (BP_E1HVN(bp) + 4)));
+                        val = (0xee0f | (1 << (BP_VN(bp) + 4)));
                        if (bp->port.pmf)
                                /* enable nig and gpio3 attention */
                                val |= 0x1100;
@@ -1471,7 +1471,7 @@ static void bnx2x_igu_int_enable(struct bnx2x *bp)
        /* init leading/trailing edge */
        if (IS_MF(bp)) {
-                val = (0xee0f | (1 << (BP_E1HVN(bp) + 4)));
+                val = (0xee0f | (1 << (BP_VN(bp) + 4)));
                if (bp->port.pmf)
                        /* enable nig and gpio3 attention */
                        val |= 0x1100;
@@ -2287,7 +2287,7 @@ static void bnx2x_calc_vn_weight_sum(struct bnx2x *bp)
        int vn;
        bp->vn_weight_sum = 0;
-        for (vn = VN_0; vn < E1HVN_MAX; vn++) {
+        for (vn = VN_0; vn < BP_MAX_VN_NUM(bp); vn++) {
                u32 vn_cfg = bp->mf_config[vn];
                u32 vn_min_rate = ((vn_cfg & FUNC_MF_CFG_MIN_BW_MASK) >>
                                   FUNC_MF_CFG_MIN_BW_SHIFT) * 100;
@@ -2320,12 +2320,18 @@ static void bnx2x_calc_vn_weight_sum(struct bnx2x *bp)
                                        CMNG_FLAGS_PER_PORT_FAIRNESS_VN;
 }
+/* returns func by VN for current port */
+static inline int func_by_vn(struct bnx2x *bp, int vn)
+{
+        return 2 * vn + BP_PORT(bp);
+}
 static void bnx2x_init_vn_minmax(struct bnx2x *bp, int vn)
 {
        struct rate_shaping_vars_per_vn m_rs_vn;
        struct fairness_vars_per_vn m_fair_vn;
        u32 vn_cfg = bp->mf_config[vn];
-        int func = 2*vn + BP_PORT(bp);
+        int func = func_by_vn(bp, vn);
        u16 vn_min_rate, vn_max_rate;
        int i;
@@ -2422,7 +2428,7 @@ void bnx2x_read_mf_cfg(struct bnx2x *bp)
         *
         *      and there are 2 functions per port
         */
-        for (vn = VN_0; vn < E1HVN_MAX; vn++) {
+        for (vn = VN_0; vn < BP_MAX_VN_NUM(bp); vn++) {
                int /*abs*/func = n * (2 * vn + BP_PORT(bp)) + BP_PATH(bp);
                if (func >= E1H_FUNC_MAX)
@@ -2454,7 +2460,7 @@ static void bnx2x_cmng_fns_init(struct bnx2x *bp, u8 read_cfg, u8 cmng_type)
                /* calculate and set min-max rate for each vn */
                if (bp->port.pmf)
-                        for (vn = VN_0; vn < E1HVN_MAX; vn++)
+                        for (vn = VN_0; vn < BP_MAX_VN_NUM(bp); vn++)
                                bnx2x_init_vn_minmax(bp, vn);
                /* always enable rate shaping and fairness */
@@ -2473,16 +2479,15 @@ static void bnx2x_cmng_fns_init(struct bnx2x *bp, u8 read_cfg, u8 cmng_type)
 static inline void bnx2x_link_sync_notify(struct bnx2x *bp)
 {
-        int port = BP_PORT(bp);
        int func;
        int vn;
        /* Set the attention towards other drivers on the same port */
-        for (vn = VN_0; vn < E1HVN_MAX; vn++) {
+        for (vn = VN_0; vn < BP_MAX_VN_NUM(bp); vn++) {
-                if (vn == BP_E1HVN(bp))
+                if (vn == BP_VN(bp))
                        continue;
-                func = ((vn << 1) | port);
+                func = func_by_vn(bp, vn);
                REG_WR(bp, MISC_REG_AEU_GENERAL_ATTN_0 +
                       (LINK_SYNC_ATTENTION_BIT_FUNC_0 + func)*4, 1);
        }
@@ -2577,7 +2582,7 @@ static void bnx2x_pmf_update(struct bnx2x *bp)
        bnx2x_dcbx_pmf_update(bp);
        /* enable nig attention */
-        val = (0xff0f | (1 << (BP_E1HVN(bp) + 4)));
+        val = (0xff0f | (1 << (BP_VN(bp) + 4)));
        if (bp->common.int_block == INT_BLOCK_HC) {
                REG_WR(bp, HC_REG_TRAILING_EDGE_0 + port*8, val);
                REG_WR(bp, HC_REG_LEADING_EDGE_0 + port*8, val);
@@ -2756,8 +2761,14 @@ static void bnx2x_pf_rx_q_prep(struct bnx2x *bp,
        u16 tpa_agg_size = 0;
        if (!fp->disable_tpa) {
-                pause->sge_th_hi = 250;
+                pause->sge_th_lo = SGE_TH_LO(bp);
-                pause->sge_th_lo = 150;
+                pause->sge_th_hi = SGE_TH_HI(bp);
+                /* validate SGE ring has enough to cross high threshold */
+                WARN_ON(bp->dropless_fc &&
+                                pause->sge_th_hi + FW_PREFETCH_CNT >
+                                MAX_RX_SGE_CNT * NUM_RX_SGE_PAGES);
                tpa_agg_size = min_t(u32,
                        (min_t(u32, 8, MAX_SKB_FRAGS) *
                        SGE_PAGE_SIZE * PAGES_PER_SGE), 0xffff);
@@ -2771,10 +2782,21 @@ static void bnx2x_pf_rx_q_prep(struct bnx2x *bp,
        /* pause - not for e1 */
        if (!CHIP_IS_E1(bp)) {
-                pause->bd_th_hi = 350;
+                pause->bd_th_lo = BD_TH_LO(bp);
-                pause->bd_th_lo = 250;
+                pause->bd_th_hi = BD_TH_HI(bp);
-                pause->rcq_th_hi = 350;
-                pause->rcq_th_lo = 250;
+                pause->rcq_th_lo = RCQ_TH_LO(bp);
+                pause->rcq_th_hi = RCQ_TH_HI(bp);
+                /*
+                 * validate that rings have enough entries to cross
+                 * high thresholds
+                 */
+                WARN_ON(bp->dropless_fc &&
+                                pause->bd_th_hi + FW_PREFETCH_CNT >
+                                bp->rx_ring_size);
+                WARN_ON(bp->dropless_fc &&
+                                pause->rcq_th_hi + FW_PREFETCH_CNT >
+                                NUM_RCQ_RINGS * MAX_RCQ_DESC_CNT);
                pause->pri_map = 1;
        }
@@ -2802,9 +2824,7 @@ static void bnx2x_pf_rx_q_prep(struct bnx2x *bp,
         * For PF Clients it should be the maximum avaliable number.
         * VF driver(s) may want to define it to a smaller value.
         */
-        rxq_init->max_tpa_queues =
+        rxq_init->max_tpa_queues = MAX_AGG_QS(bp);
-                (CHIP_IS_E1(bp) ? ETH_MAX_AGGREGATION_QUEUES_E1 :
-                ETH_MAX_AGGREGATION_QUEUES_E1H_E2);
        rxq_init->cache_line_log = BNX2X_RX_ALIGN_SHIFT;
        rxq_init->fw_sb_id = fp->fw_sb_id;
@@ -4808,6 +4828,37 @@ void bnx2x_setup_ndsb_state_machine(struct hc_status_block_sm *hc_sm,
        hc_sm->time_to_expire = 0xFFFFFFFF;
 }
+/* allocates state machine ids. */
+static inline
+void bnx2x_map_sb_state_machines(struct hc_index_data *index_data)
+{
+        /* zero out state machine indices */
+        /* rx indices */
+        index_data[HC_INDEX_ETH_RX_CQ_CONS].flags &= ~HC_INDEX_DATA_SM_ID;
+        /* tx indices */
+        index_data[HC_INDEX_OOO_TX_CQ_CONS].flags &= ~HC_INDEX_DATA_SM_ID;
+        index_data[HC_INDEX_ETH_TX_CQ_CONS_COS0].flags &= ~HC_INDEX_DATA_SM_ID;
+        index_data[HC_INDEX_ETH_TX_CQ_CONS_COS1].flags &= ~HC_INDEX_DATA_SM_ID;
+        index_data[HC_INDEX_ETH_TX_CQ_CONS_COS2].flags &= ~HC_INDEX_DATA_SM_ID;
+        /* map indices */
+        /* rx indices */
+        index_data[HC_INDEX_ETH_RX_CQ_CONS].flags |=
+                SM_RX_ID << HC_INDEX_DATA_SM_ID_SHIFT;
+        /* tx indices */
+        index_data[HC_INDEX_OOO_TX_CQ_CONS].flags |=
+                SM_TX_ID << HC_INDEX_DATA_SM_ID_SHIFT;
+        index_data[HC_INDEX_ETH_TX_CQ_CONS_COS0].flags |=
+                SM_TX_ID << HC_INDEX_DATA_SM_ID_SHIFT;
+        index_data[HC_INDEX_ETH_TX_CQ_CONS_COS1].flags |=
+                SM_TX_ID << HC_INDEX_DATA_SM_ID_SHIFT;
+        index_data[HC_INDEX_ETH_TX_CQ_CONS_COS2].flags |=
+                SM_TX_ID << HC_INDEX_DATA_SM_ID_SHIFT;
+}
 static void bnx2x_init_sb(struct bnx2x *bp, dma_addr_t mapping, int vfid,
                          u8 vf_valid, int fw_sb_id, int igu_sb_id)
 {
@@ -4839,6 +4890,7 @@ static void bnx2x_init_sb(struct bnx2x *bp, dma_addr_t mapping, int vfid,
                hc_sm_p = sb_data_e2.common.state_machine;
                sb_data_p = (u32 *)&sb_data_e2;
                data_size = sizeof(struct hc_status_block_data_e2)/sizeof(u32);
+                bnx2x_map_sb_state_machines(sb_data_e2.index_data);
        } else {
                memset(&sb_data_e1x, 0,
                       sizeof(struct hc_status_block_data_e1x));
@@ -4853,6 +4905,7 @@ static void bnx2x_init_sb(struct bnx2x *bp, dma_addr_t mapping, int vfid,
                hc_sm_p = sb_data_e1x.common.state_machine;
                sb_data_p = (u32 *)&sb_data_e1x;
                data_size = sizeof(struct hc_status_block_data_e1x)/sizeof(u32);
+                bnx2x_map_sb_state_machines(sb_data_e1x.index_data);
        }
        bnx2x_setup_ndsb_state_machine(&hc_sm_p[SM_RX_ID],
@@ -4890,7 +4943,7 @@ static void bnx2x_init_def_sb(struct bnx2x *bp)
        int igu_seg_id;
        int port = BP_PORT(bp);
        int func = BP_FUNC(bp);
-        int reg_offset;
+        int reg_offset, reg_offset_en5;
        u64 section;
        int index;
        struct hc_sp_status_block_data sp_sb_data;
@@ -4913,6 +4966,8 @@ static void bnx2x_init_def_sb(struct bnx2x *bp)
        reg_offset = (port ? MISC_REG_AEU_ENABLE1_FUNC_1_OUT_0 :
                             MISC_REG_AEU_ENABLE1_FUNC_0_OUT_0);
+        reg_offset_en5 = (port ? MISC_REG_AEU_ENABLE5_FUNC_1_OUT_0 :
+                                 MISC_REG_AEU_ENABLE5_FUNC_0_OUT_0);
        for (index = 0; index < MAX_DYNAMIC_ATTN_GRPS; index++) {
                int sindex;
                /* take care of sig[0]..sig[4] */
@@ -4927,7 +4982,7 @@ static void bnx2x_init_def_sb(struct bnx2x *bp)
                         * and not 16 between the different groups
                         */
                        bp->attn_group[index].sig[4] = REG_RD(bp,
-                                        reg_offset + 0x10 + 0x4*index);
+                                        reg_offset_en5 + 0x4*index);
                else
                        bp->attn_group[index].sig[4] = 0;
        }
@@ -5802,7 +5857,7 @@ static int bnx2x_init_hw_common(struct bnx2x *bp)
         * take the UNDI lock to protect undi_unload flow from accessing
         * registers while we're resetting the chip
         */
-        bnx2x_acquire_hw_lock(bp, HW_LOCK_RESOURCE_UNDI);
+        bnx2x_acquire_hw_lock(bp, HW_LOCK_RESOURCE_RESET);
        bnx2x_reset_common(bp);
        REG_WR(bp, GRCBASE_MISC + MISC_REGISTERS_RESET_REG_1_SET, 0xffffffff);
@@ -5814,7 +5869,7 @@ static int bnx2x_init_hw_common(struct bnx2x *bp)
        }
        REG_WR(bp, GRCBASE_MISC + MISC_REGISTERS_RESET_REG_2_SET, val);
-        bnx2x_release_hw_lock(bp, HW_LOCK_RESOURCE_UNDI);
+        bnx2x_release_hw_lock(bp, HW_LOCK_RESOURCE_RESET);
        bnx2x_init_block(bp, BLOCK_MISC, PHASE_COMMON);
@@ -6671,12 +6726,16 @@ static int bnx2x_init_hw_func(struct bnx2x *bp)
                        if (CHIP_MODE_IS_4_PORT(bp))
                                dsb_idx = BP_FUNC(bp);
                        else
-                                dsb_idx = BP_E1HVN(bp);
+                                dsb_idx = BP_VN(bp);
                        prod_offset = (CHIP_INT_MODE_IS_BC(bp) ?
                                       IGU_BC_BASE_DSB_PROD + dsb_idx :
                                       IGU_NORM_BASE_DSB_PROD + dsb_idx);
+                        /*
+                         * igu prods come in chunks of E1HVN_MAX (4) -
+                         * does not matters what is the current chip mode
+                         */
                        for (i = 0; i < (num_segs * E1HVN_MAX);
                             i += E1HVN_MAX) {
                                addr = IGU_REG_PROD_CONS_MEMORY +
@@ -7568,9 +7627,12 @@ u32 bnx2x_send_unload_req(struct bnx2x *bp, int unload_mode)
                u32 emac_base = port ? GRCBASE_EMAC1 : GRCBASE_EMAC0;
                u8 *mac_addr = bp->dev->dev_addr;
                u32 val;
+                u16 pmc;
                /* The mac address is written to entries 1-4 to
-                   preserve entry 0 which is used by the PMF */
+                 * preserve entry 0 which is used by the PMF
-                u8 entry = (BP_E1HVN(bp) + 1)*8;
+                 */
+                u8 entry = (BP_VN(bp) + 1)*8;
                val = (mac_addr[0] << 8) | mac_addr[1];
                EMAC_WR(bp, EMAC_REG_EMAC_MAC_MATCH + entry, val);
@@ -7579,6 +7641,11 @@ u32 bnx2x_send_unload_req(struct bnx2x *bp, int unload_mode)
                      (mac_addr[4] << 8) | mac_addr[5];
                EMAC_WR(bp, EMAC_REG_EMAC_MAC_MATCH + entry + 4, val);
+                /* Enable the PME and clear the status */
+                pci_read_config_word(bp->pdev, bp->pm_cap + PCI_PM_CTRL, &pmc);
+                pmc |= PCI_PM_CTRL_PME_ENABLE | PCI_PM_CTRL_PME_STATUS;
+                pci_write_config_word(bp->pdev, bp->pm_cap + PCI_PM_CTRL, pmc);
                reset_code = DRV_MSG_CODE_UNLOAD_REQ_WOL_EN;
        } else
@@ -8546,10 +8613,12 @@ static void __devinit bnx2x_undi_unload(struct bnx2x *bp)
        /* Check if there is any driver already loaded */
        val = REG_RD(bp, MISC_REG_UNPREPARED);
        if (val == 0x1) {
-                /* Check if it is the UNDI driver
+                bnx2x_acquire_hw_lock(bp, HW_LOCK_RESOURCE_RESET);
+                /*
+                 * Check if it is the UNDI driver
                 * UNDI driver initializes CID offset for normal bell to 0x7
                 */
-                bnx2x_acquire_hw_lock(bp, HW_LOCK_RESOURCE_UNDI);
                val = REG_RD(bp, DORQ_REG_NORM_CID_OFST);
                if (val == 0x7) {
                        u32 reset_code = DRV_MSG_CODE_UNLOAD_REQ_WOL_DIS;
@@ -8587,9 +8656,6 @@ static void __devinit bnx2x_undi_unload(struct bnx2x *bp)
                                bnx2x_fw_command(bp, reset_code, 0);
                        }
-                        /* now it's safe to release the lock */
-                        bnx2x_release_hw_lock(bp, HW_LOCK_RESOURCE_UNDI);
                        bnx2x_undi_int_disable(bp);
                        port = BP_PORT(bp);
@@ -8639,8 +8705,10 @@ static void __devinit bnx2x_undi_unload(struct bnx2x *bp)
                        bp->fw_seq =
                              (SHMEM_RD(bp, func_mb[bp->pf_num].drv_mb_header) &
                                DRV_MSG_SEQ_NUMBER_MASK);
-                } else
+                }
-                        bnx2x_release_hw_lock(bp, HW_LOCK_RESOURCE_UNDI);
+                /* now it's safe to release the lock */
+                bnx2x_release_hw_lock(bp, HW_LOCK_RESOURCE_RESET);
        }
 }
@@ -8777,13 +8845,13 @@ static void __devinit bnx2x_get_common_hwinfo(struct bnx2x *bp)
 static void __devinit bnx2x_get_igu_cam_info(struct bnx2x *bp)
 {
        int pfid = BP_FUNC(bp);
-        int vn = BP_E1HVN(bp);
        int igu_sb_id;
        u32 val;
        u8 fid, igu_sb_cnt = 0;
        bp->igu_base_sb = 0xff;
        if (CHIP_INT_MODE_IS_BC(bp)) {
+                int vn = BP_VN(bp);
                igu_sb_cnt = bp->igu_sb_cnt;
                bp->igu_base_sb = (CHIP_MODE_IS_4_PORT(bp) ? pfid : vn) *
                        FP_SB_MAX_E1x;
@@ -9416,6 +9484,10 @@ static int __devinit bnx2x_get_hwinfo(struct bnx2x *bp)
                bp->igu_base_sb = 0;
        } else {
                bp->common.int_block = INT_BLOCK_IGU;
+                /* do not allow device reset during IGU info preocessing */
+                bnx2x_acquire_hw_lock(bp, HW_LOCK_RESOURCE_RESET);
                val = REG_RD(bp, IGU_REG_BLOCK_CONFIGURATION);
                if (val & IGU_BLOCK_CONFIGURATION_REG_BACKWARD_COMP_EN) {
@@ -9447,6 +9519,7 @@ static int __devinit bnx2x_get_hwinfo(struct bnx2x *bp)
                bnx2x_get_igu_cam_info(bp);
+                bnx2x_release_hw_lock(bp, HW_LOCK_RESOURCE_RESET);
        }
        /*
@@ -9473,7 +9546,7 @@ static int __devinit bnx2x_get_hwinfo(struct bnx2x *bp)
        bp->mf_ov = 0;
        bp->mf_mode = 0;
-        vn = BP_E1HVN(bp);
+        vn = BP_VN(bp);
        if (!CHIP_IS_E1(bp) && !BP_NOMCP(bp)) {
                BNX2X_DEV_INFO("shmem2base 0x%x, size %d, mfcfg offset %d\n",
@@ -9593,13 +9666,6 @@ static int __devinit bnx2x_get_hwinfo(struct bnx2x *bp)
        /* port info */
        bnx2x_get_port_hwinfo(bp);
-        if (!BP_NOMCP(bp)) {
-                bp->fw_seq =
-                        (SHMEM_RD(bp, func_mb[BP_FW_MB_IDX(bp)].drv_mb_header) &
-                         DRV_MSG_SEQ_NUMBER_MASK);
-                BNX2X_DEV_INFO("fw_seq 0x%08x\n", bp->fw_seq);
-        }
        /* Get MAC addresses */
        bnx2x_get_mac_hwinfo(bp);
@@ -9765,6 +9831,14 @@ static int __devinit bnx2x_init_bp(struct bnx2x *bp)
        if (!BP_NOMCP(bp))
                bnx2x_undi_unload(bp);
+        /* init fw_seq after undi_unload! */
+        if (!BP_NOMCP(bp)) {
+                bp->fw_seq =
+                        (SHMEM_RD(bp, func_mb[BP_FW_MB_IDX(bp)].drv_mb_header) &
+                         DRV_MSG_SEQ_NUMBER_MASK);
+                BNX2X_DEV_INFO("fw_seq 0x%08x\n", bp->fw_seq);
+        }
        if (CHIP_REV_IS_FPGA(bp))
                dev_err(&bp->pdev->dev, "FPGA detected\n");
@@ -10259,17 +10333,21 @@ static int __devinit bnx2x_init_dev(struct pci_dev *pdev,
        /* clean indirect addresses */
        pci_write_config_dword(bp->pdev, PCICFG_GRC_ADDRESS,
                               PCICFG_VENDOR_ID_OFFSET);
-        /* Clean the following indirect addresses for all functions since it
+        /*
+         * Clean the following indirect addresses for all functions since it
         * is not used by the driver.
         */
        REG_WR(bp, PXP2_REG_PGL_ADDR_88_F0, 0);
        REG_WR(bp, PXP2_REG_PGL_ADDR_8C_F0, 0);
        REG_WR(bp, PXP2_REG_PGL_ADDR_90_F0, 0);
        REG_WR(bp, PXP2_REG_PGL_ADDR_94_F0, 0);
-        REG_WR(bp, PXP2_REG_PGL_ADDR_88_F1, 0);
-        REG_WR(bp, PXP2_REG_PGL_ADDR_8C_F1, 0);
+        if (CHIP_IS_E1x(bp)) {
-        REG_WR(bp, PXP2_REG_PGL_ADDR_90_F1, 0);
+                REG_WR(bp, PXP2_REG_PGL_ADDR_88_F1, 0);
-        REG_WR(bp, PXP2_REG_PGL_ADDR_94_F1, 0);
+                REG_WR(bp, PXP2_REG_PGL_ADDR_8C_F1, 0);
+                REG_WR(bp, PXP2_REG_PGL_ADDR_90_F1, 0);
+                REG_WR(bp, PXP2_REG_PGL_ADDR_94_F1, 0);
+        }
        /*
         * Enable internal target-read (in case we are probed after PF FLR).
diff --git a/drivers/net/bnx2x/bnx2x_reg.h b/drivers/net/bnx2x/bnx2x_reg.h
index 40266c14e6dc..fc7bd0f23c0b 100644
--- a/drivers/net/bnx2x/bnx2x_reg.h
+++ b/drivers/net/bnx2x/bnx2x_reg.h
@@ -1384,6 +1384,18 @@
   Latched ump_tx_parity; [31] MCP Latched scpad_parity; */
 #define MISC_REG_AEU_ENABLE4_PXP_0                               0xa108
 #define MISC_REG_AEU_ENABLE4_PXP_1                               0xa1a8
+/* [RW 32] fifth 32b for enabling the output for function 0 output0. Mapped
+ * as follows: [0] PGLUE config_space; [1] PGLUE misc_flr; [2] PGLUE B RBC
+ * attention [3] PGLUE B RBC parity; [4] ATC attention; [5] ATC parity; [6]
+ * mstat0 attention; [7] mstat0 parity; [8] mstat1 attention; [9] mstat1
+ * parity; [31-10] Reserved; */
+#define MISC_REG_AEU_ENABLE5_FUNC_0_OUT_0                        0xa688
+/* [RW 32] Fifth 32b for enabling the output for function 1 output0. Mapped
+ * as follows: [0] PGLUE config_space; [1] PGLUE misc_flr; [2] PGLUE B RBC
+ * attention [3] PGLUE B RBC parity; [4] ATC attention; [5] ATC parity; [6]
+ * mstat0 attention; [7] mstat0 parity; [8] mstat1 attention; [9] mstat1
+ * parity; [31-10] Reserved; */
+#define MISC_REG_AEU_ENABLE5_FUNC_1_OUT_0                        0xa6b0
 /* [RW 1] set/clr general attention 0; this will set/clr bit 94 in the aeu
   128 bit vector */
 #define MISC_REG_AEU_GENERAL_ATTN_0                              0xa000
@@ -5320,7 +5332,7 @@
 #define XCM_REG_XX_OVFL_EVNT_ID                                  0x20058
 #define XMAC_CLEAR_RX_LSS_STATUS_REG_CLEAR_LOCAL_FAULT_STATUS    (0x1<<0)
 #define XMAC_CLEAR_RX_LSS_STATUS_REG_CLEAR_REMOTE_FAULT_STATUS   (0x1<<1)
-#define XMAC_CTRL_REG_CORE_LOCAL_LPBK                            (0x1<<3)
+#define XMAC_CTRL_REG_LINE_LOCAL_LPBK                            (0x1<<2)
 #define XMAC_CTRL_REG_RX_EN                                      (0x1<<1)
 #define XMAC_CTRL_REG_SOFT_RESET                                 (0x1<<6)
 #define XMAC_CTRL_REG_TX_EN                                      (0x1<<0)
@@ -5766,7 +5778,7 @@
 #define HW_LOCK_RESOURCE_RECOVERY_LEADER_0                       8
 #define HW_LOCK_RESOURCE_RECOVERY_LEADER_1                       9
 #define HW_LOCK_RESOURCE_SPIO                                    2
-#define HW_LOCK_RESOURCE_UNDI                                    5
+#define HW_LOCK_RESOURCE_RESET                                   5
 #define AEU_INPUTS_ATTN_BITS_ATC_HW_INTERRUPT                    (0x1<<4)
 #define AEU_INPUTS_ATTN_BITS_ATC_PARITY_ERROR                    (0x1<<5)
 #define AEU_INPUTS_ATTN_BITS_BRB_PARITY_ERROR                    (0x1<<18)
@@ -6853,6 +6865,9 @@ Theotherbitsarereservedandshouldbezero*/
 #define MDIO_WC_REG_IEEE0BLK_AUTONEGNP                  0x7
 #define MDIO_WC_REG_AN_IEEE1BLK_AN_ADVERTISEMENT0       0x10
 #define MDIO_WC_REG_AN_IEEE1BLK_AN_ADVERTISEMENT1       0x11
+#define MDIO_WC_REG_AN_IEEE1BLK_AN_ADVERTISEMENT2       0x12
+#define MDIO_WC_REG_AN_IEEE1BLK_AN_ADV2_FEC_ABILITY     0x4000
+#define MDIO_WC_REG_AN_IEEE1BLK_AN_ADV2_FEC_REQ         0x8000
 #define MDIO_WC_REG_PMD_IEEE9BLK_TENGBASE_KR_PMD_CONTROL_REGISTER_150  0x96
 #define MDIO_WC_REG_XGXSBLK0_XGXSCONTROL                0x8000
 #define MDIO_WC_REG_XGXSBLK0_MISCCONTROL1               0x800e
diff --git a/drivers/net/bnx2x/bnx2x_stats.c b/drivers/net/bnx2x/bnx2x_stats.c
index 771f6803b238..9908f2bbcf73 100644
--- a/drivers/net/bnx2x/bnx2x_stats.c
+++ b/drivers/net/bnx2x/bnx2x_stats.c
@@ -710,7 +710,8 @@ static int bnx2x_hw_stats_update(struct bnx2x *bp)
                break;
        case MAC_TYPE_NONE: /* unreached */
-                BNX2X_ERR("stats updated by DMAE but no MAC active\n");
+                DP(BNX2X_MSG_STATS,
+                   "stats updated by DMAE but no MAC active\n");
                return -1;
        default: /* unreached */
@@ -1391,7 +1392,7 @@ static void bnx2x_port_stats_base_init(struct bnx2x *bp)
 static void bnx2x_func_stats_base_init(struct bnx2x *bp)
 {
-        int vn, vn_max = IS_MF(bp) ? E1HVN_MAX : E1VN_MAX;
+        int vn, vn_max = IS_MF(bp) ? BP_MAX_VN_NUM(bp) : E1VN_MAX;
        u32 func_stx;
        /* sanity */
@@ -1404,7 +1405,7 @@ static void bnx2x_func_stats_base_init(struct bnx2x *bp)
        func_stx = bp->func_stx;
        for (vn = VN_0; vn < vn_max; vn++) {
-                int mb_idx = CHIP_IS_E1x(bp) ? 2*vn + BP_PORT(bp) : vn;
+                int mb_idx = BP_FW_MB_IDX_VN(bp, vn);
                bp->func_stx = SHMEM_RD(bp, func_mb[mb_idx].fw_mb_param);
                bnx2x_func_stats_init(bp);
diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c
index a047eb973e3b..47b928ed08f8 100644
--- a/drivers/net/bonding/bond_3ad.c
+++ b/drivers/net/bonding/bond_3ad.c
@@ -2168,7 +2168,8 @@ void bond_3ad_state_machine_handler(struct work_struct *work)
        }
 re_arm:
-        queue_delayed_work(bond->wq, &bond->ad_work, ad_delta_in_ticks);
+        if (!bond->kill_timers)
+                queue_delayed_work(bond->wq, &bond->ad_work, ad_delta_in_ticks);
 out:
        read_unlock(&bond->lock);
 }
diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c
index 7f8b20a34ee3..d4fbd2e62616 100644
--- a/drivers/net/bonding/bond_alb.c
+++ b/drivers/net/bonding/bond_alb.c
@@ -1440,7 +1440,8 @@ void bond_alb_monitor(struct work_struct *work)
        }
 re_arm:
-        queue_delayed_work(bond->wq, &bond->alb_work, alb_delta_in_ticks);
+        if (!bond->kill_timers)
+                queue_delayed_work(bond->wq, &bond->alb_work, alb_delta_in_ticks);
 out:
        read_unlock(&bond->lock);
 }
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 38a83acd502e..6d79b78cfc75 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -777,6 +777,9 @@ static void bond_resend_igmp_join_requests(struct bonding *bond)
        read_lock(&bond->lock);
+        if (bond->kill_timers)
+                goto out;
        /* rejoin all groups on bond device */
        __bond_resend_igmp_join_requests(bond->dev);
@@ -790,9 +793,9 @@ static void bond_resend_igmp_join_requests(struct bonding *bond)
                        __bond_resend_igmp_join_requests(vlan_dev);
        }
-        if (--bond->igmp_retrans > 0)
+        if ((--bond->igmp_retrans > 0) && !bond->kill_timers)
                queue_delayed_work(bond->wq, &bond->mcast_work, HZ/5);
+out:
        read_unlock(&bond->lock);
 }
@@ -2538,7 +2541,7 @@ void bond_mii_monitor(struct work_struct *work)
        }
 re_arm:
-        if (bond->params.miimon)
+        if (bond->params.miimon && !bond->kill_timers)
                queue_delayed_work(bond->wq, &bond->mii_work,
                                   msecs_to_jiffies(bond->params.miimon));
 out:
@@ -2886,7 +2889,7 @@ void bond_loadbalance_arp_mon(struct work_struct *work)
        }
 re_arm:
-        if (bond->params.arp_interval)
+        if (bond->params.arp_interval && !bond->kill_timers)
                queue_delayed_work(bond->wq, &bond->arp_work, delta_in_ticks);
 out:
        read_unlock(&bond->lock);
@@ -3154,7 +3157,7 @@ void bond_activebackup_arp_mon(struct work_struct *work)
        bond_ab_arp_probe(bond);
 re_arm:
-        if (bond->params.arp_interval)
+        if (bond->params.arp_interval && !bond->kill_timers)
                queue_delayed_work(bond->wq, &bond->arp_work, delta_in_ticks);
 out:
        read_unlock(&bond->lock);
@@ -3419,9 +3422,27 @@ static int bond_xmit_hash_policy_l2(struct sk_buff *skb, int count)
 static int bond_open(struct net_device *bond_dev)
 {
        struct bonding *bond = netdev_priv(bond_dev);
+        struct slave *slave;
+        int i;
        bond->kill_timers = 0;
+        /* reset slave->backup and slave->inactive */
+        read_lock(&bond->lock);
+        if (bond->slave_cnt > 0) {
+                read_lock(&bond->curr_slave_lock);
+                bond_for_each_slave(bond, slave, i) {
+                        if ((bond->params.mode == BOND_MODE_ACTIVEBACKUP)
+                                && (slave != bond->curr_active_slave)) {
+                                bond_set_slave_inactive_flags(slave);
+                        } else {
+                                bond_set_slave_active_flags(slave);
+                        }
+                }
+                read_unlock(&bond->curr_slave_lock);
+        }
+        read_unlock(&bond->lock);
        INIT_DELAYED_WORK(&bond->mcast_work, bond_resend_igmp_join_requests_delayed);
        if (bond_is_lb(bond)) {
diff --git a/drivers/net/can/sja1000/plx_pci.c b/drivers/net/can/sja1000/plx_pci.c
index 231385b8e08f..c7f3d4ea1167 100644
--- a/drivers/net/can/sja1000/plx_pci.c
+++ b/drivers/net/can/sja1000/plx_pci.c
@@ -408,7 +408,7 @@ static void plx_pci_del_card(struct pci_dev *pdev)
        struct sja1000_priv *priv;
        int i = 0;
-        for (i = 0; i < card->channels; i++) {
+        for (i = 0; i < PLX_PCI_MAX_CHAN; i++) {
                dev = card->net_dev[i];
                if (!dev)
                        continue;
@@ -536,7 +536,6 @@ static int __devinit plx_pci_add_card(struct pci_dev *pdev,
                        if (err) {
                                dev_err(&pdev->dev, "Registering device failed "
                                        "(err=%d)\n", err);
-                                free_sja1000dev(dev);
                                goto failure_cleanup;
                        }
@@ -549,6 +548,7 @@ static int __devinit plx_pci_add_card(struct pci_dev *pdev,
                        dev_err(&pdev->dev, "Channel #%d not detected\n",
                                i + 1);
                        free_sja1000dev(dev);
+                        card->net_dev[i] = NULL;
                }
        }
diff --git a/drivers/net/can/ti_hecc.c b/drivers/net/can/ti_hecc.c
index f7bbde9eb2cb..2adc294f512a 100644
--- a/drivers/net/can/ti_hecc.c
+++ b/drivers/net/can/ti_hecc.c
@@ -46,6 +46,7 @@
 #include <linux/skbuff.h>
 #include <linux/platform_device.h>
 #include <linux/clk.h>
+#include <linux/io.h>
 #include <linux/can/dev.h>
 #include <linux/can/error.h>
@@ -503,9 +504,9 @@ static netdev_tx_t ti_hecc_xmit(struct sk_buff *skb, struct net_device *ndev)
        spin_unlock_irqrestore(&priv->mbx_lock, flags);
        /* Prepare mailbox for transmission */
+        data = cf->can_dlc | (get_tx_head_prio(priv) << 8);
        if (cf->can_id & CAN_RTR_FLAG) /* Remote transmission request */
                data |= HECC_CANMCF_RTR;
-        data |= get_tx_head_prio(priv) << 8;
        hecc_write_mbx(priv, mbxno, HECC_CANMCF, data);
        if (cf->can_id & CAN_EFF_FLAG) /* Extended frame format */
@@ -923,6 +924,7 @@ static int ti_hecc_probe(struct platform_device *pdev)
        priv->can.do_get_state = ti_hecc_get_state;
        priv->can.ctrlmode_supported = CAN_CTRLMODE_3_SAMPLES;
+        spin_lock_init(&priv->mbx_lock);
        ndev->irq = irq->start;
        ndev->flags |= IFF_ECHO;
        platform_set_drvdata(pdev, ndev);
diff --git a/drivers/net/cassini.c b/drivers/net/cassini.c
index 646c86bcc545..fdb7a1756409 100644
--- a/drivers/net/cassini.c
+++ b/drivers/net/cassini.c
@@ -2452,14 +2452,13 @@ static irqreturn_t cas_interruptN(int irq, void *dev_id)
        struct net_device *dev = dev_id;
        struct cas *cp = netdev_priv(dev);
        unsigned long flags;
-        int ring;
+        int ring = (irq == cp->pci_irq_INTC) ? 2 : 3;
        u32 status = readl(cp->regs + REG_PLUS_INTRN_STATUS(ring));
        /* check for shared irq */
        if (status == 0)
                return IRQ_NONE;
-        ring = (irq == cp->pci_irq_INTC) ? 2 : 3;
        spin_lock_irqsave(&cp->lock, flags);
        if (status & INTR_RX_DONE_ALT) { /* handle rx separately */
 #ifdef USE_NAPI
diff --git a/drivers/net/cxgb3/cxgb3_offload.c b/drivers/net/cxgb3/cxgb3_offload.c
index 805076c54f1b..da5a5d9b8aff 100644
--- a/drivers/net/cxgb3/cxgb3_offload.c
+++ b/drivers/net/cxgb3/cxgb3_offload.c
@@ -1146,12 +1146,14 @@ static void cxgb_redirect(struct dst_entry *old, struct dst_entry *new)
                if (te && te->ctx && te->client && te->client->redirect) {
                        update_tcb = te->client->redirect(te->ctx, old, new, e);
                        if (update_tcb) {
+                                rcu_read_lock();
                                l2t_hold(L2DATA(tdev), e);
+                                rcu_read_unlock();
                                set_l2t_ix(tdev, tid, e);
                        }
                }
        }
-        l2t_release(L2DATA(tdev), e);
+        l2t_release(tdev, e);
 }
 /*
@@ -1264,7 +1266,7 @@ int cxgb3_offload_activate(struct adapter *adapter)
                goto out_free;
        err = -ENOMEM;
-        L2DATA(dev) = t3_init_l2t(l2t_capacity);
+        RCU_INIT_POINTER(dev->l2opt, t3_init_l2t(l2t_capacity));
        if (!L2DATA(dev))
                goto out_free;
@@ -1298,16 +1300,24 @@ int cxgb3_offload_activate(struct adapter *adapter)
 out_free_l2t:
        t3_free_l2t(L2DATA(dev));
-        L2DATA(dev) = NULL;
+        rcu_assign_pointer(dev->l2opt, NULL);
 out_free:
        kfree(t);
        return err;
 }
+static void clean_l2_data(struct rcu_head *head)
+{
+        struct l2t_data *d = container_of(head, struct l2t_data, rcu_head);
+        t3_free_l2t(d);
+}
 void cxgb3_offload_deactivate(struct adapter *adapter)
 {
        struct t3cdev *tdev = &adapter->tdev;
        struct t3c_data *t = T3C_DATA(tdev);
+        struct l2t_data *d;
        remove_adapter(adapter);
        if (list_empty(&adapter_list))
@@ -1315,8 +1325,11 @@ void cxgb3_offload_deactivate(struct adapter *adapter)
        free_tid_maps(&t->tid_maps);
        T3C_DATA(tdev) = NULL;
-        t3_free_l2t(L2DATA(tdev));
+        rcu_read_lock();
-        L2DATA(tdev) = NULL;
+        d = L2DATA(tdev);
+        rcu_read_unlock();
+        rcu_assign_pointer(tdev->l2opt, NULL);
+        call_rcu(&d->rcu_head, clean_l2_data);
        if (t->nofail_skb)
                kfree_skb(t->nofail_skb);
        kfree(t);
diff --git a/drivers/net/cxgb3/l2t.c b/drivers/net/cxgb3/l2t.c
index f452c4003253..41540978a173 100644
--- a/drivers/net/cxgb3/l2t.c
+++ b/drivers/net/cxgb3/l2t.c
@@ -300,14 +300,21 @@ static inline void reuse_entry(struct l2t_entry *e, struct neighbour *neigh)
 struct l2t_entry *t3_l2t_get(struct t3cdev *cdev, struct neighbour *neigh,
                             struct net_device *dev)
 {
-        struct l2t_entry *e;
+        struct l2t_entry *e = NULL;
-        struct l2t_data *d = L2DATA(cdev);
+        struct l2t_data *d;
+        int hash;
        u32 addr = *(u32 *) neigh->primary_key;
        int ifidx = neigh->dev->ifindex;
-        int hash = arp_hash(addr, ifidx, d);
        struct port_info *p = netdev_priv(dev);
        int smt_idx = p->port_id;
+        rcu_read_lock();
+        d = L2DATA(cdev);
+        if (!d)
+                goto done_rcu;
+        hash = arp_hash(addr, ifidx, d);
        write_lock_bh(&d->lock);
        for (e = d->l2tab[hash].first; e; e = e->next)
                if (e->addr == addr && e->ifindex == ifidx &&
@@ -338,6 +345,8 @@ struct l2t_entry *t3_l2t_get(struct t3cdev *cdev, struct neighbour *neigh,
        }
 done:
        write_unlock_bh(&d->lock);
+done_rcu:
+        rcu_read_unlock();
        return e;
 }
diff --git a/drivers/net/cxgb3/l2t.h b/drivers/net/cxgb3/l2t.h
index 7a12d52ed4fc..c5f54796e2cb 100644
--- a/drivers/net/cxgb3/l2t.h
+++ b/drivers/net/cxgb3/l2t.h
@@ -76,6 +76,7 @@ struct l2t_data {
        atomic_t nfree;         /* number of free entries */
        rwlock_t lock;
        struct l2t_entry l2tab[0];
+        struct rcu_head rcu_head;       /* to handle rcu cleanup */
 };
 typedef void (*arp_failure_handler_func)(struct t3cdev * dev,
@@ -99,7 +100,7 @@ static inline void set_arp_failure_handler(struct sk_buff *skb,
 /*
 * Getting to the L2 data from an offload device.
 */
-#define L2DATA(dev) ((dev)->l2opt)
+#define L2DATA(cdev) (rcu_dereference((cdev)->l2opt))
 #define W_TCB_L2T_IX    0
 #define S_TCB_L2T_IX    7
@@ -126,15 +127,22 @@ static inline int l2t_send(struct t3cdev *dev, struct sk_buff *skb,
        return t3_l2t_send_slow(dev, skb, e);
 }
-static inline void l2t_release(struct l2t_data *d, struct l2t_entry *e)
+static inline void l2t_release(struct t3cdev *t, struct l2t_entry *e)
 {
-        if (atomic_dec_and_test(&e->refcnt))
+        struct l2t_data *d;
+        rcu_read_lock();
+        d = L2DATA(t);
+        if (atomic_dec_and_test(&e->refcnt) && d)
                t3_l2e_free(d, e);
+        rcu_read_unlock();
 }
 static inline void l2t_hold(struct l2t_data *d, struct l2t_entry *e)
 {
-        if (atomic_add_return(1, &e->refcnt) == 1)      /* 0 -> 1 transition */
+        if (d && atomic_add_return(1, &e->refcnt) == 1) /* 0 -> 1 transition */
                atomic_dec(&d->nfree);
 }
diff --git a/drivers/net/cxgb4/cxgb4_main.c b/drivers/net/cxgb4/cxgb4_main.c
index c9957b7f17b5..b4efa292fd6f 100644
--- a/drivers/net/cxgb4/cxgb4_main.c
+++ b/drivers/net/cxgb4/cxgb4_main.c
@@ -3712,6 +3712,9 @@ static int __devinit init_one(struct pci_dev *pdev,
                setup_debugfs(adapter);
        }
+        /* PCIe EEH recovery on powerpc platforms needs fundamental reset */
+        pdev->needs_freset = 1;
        if (is_offload(adapter))
                attach_ulds(adapter);
diff --git a/drivers/net/e1000/e1000_hw.c b/drivers/net/e1000/e1000_hw.c
index 8545c7aa93eb..a5a89ecb6f36 100644
--- a/drivers/net/e1000/e1000_hw.c
+++ b/drivers/net/e1000/e1000_hw.c
@@ -4026,6 +4026,12 @@ s32 e1000_validate_eeprom_checksum(struct e1000_hw *hw)
                checksum += eeprom_data;
        }
+#ifdef CONFIG_PARISC
+        /* This is a signature and not a checksum on HP c8000 */
+        if ((hw->subsystem_vendor_id == 0x103C) && (eeprom_data == 0x16d6))
+                return E1000_SUCCESS;
+#endif
        if (checksum == (u16) EEPROM_SUM)
                return E1000_SUCCESS;
        else {
diff --git a/drivers/net/e1000e/e1000.h b/drivers/net/e1000e/e1000.h
index 35916f485028..8533ad7f3559 100644
--- a/drivers/net/e1000e/e1000.h
+++ b/drivers/net/e1000e/e1000.h
@@ -155,6 +155,9 @@ struct e1000_info;
 #define HV_M_STATUS_SPEED_1000            0x0200
 #define HV_M_STATUS_LINK_UP               0x0040
+#define E1000_ICH_FWSM_PCIM2PCI         0x01000000 /* ME PCIm-to-PCI active */
+#define E1000_ICH_FWSM_PCIM2PCI_COUNT   2000
 /* Time to wait before putting the device into D3 if there's no link (in ms). */
 #define LINK_TIMEOUT            100
@@ -454,6 +457,7 @@ struct e1000_info {
 #define FLAG2_DISABLE_AIM                 (1 << 8)
 #define FLAG2_CHECK_PHY_HANG              (1 << 9)
 #define FLAG2_NO_DISABLE_RX               (1 << 10)
+#define FLAG2_PCIM2PCI_ARBITER_WA         (1 << 11)
 #define E1000_RX_DESC_PS(R, i)      \
        (&(((union e1000_rx_desc_packet_split *)((R).desc))[i]))
diff --git a/drivers/net/e1000e/ich8lan.c b/drivers/net/e1000e/ich8lan.c
index 4e36978b8fd8..54add27c8f76 100644
--- a/drivers/net/e1000e/ich8lan.c
+++ b/drivers/net/e1000e/ich8lan.c
@@ -137,8 +137,9 @@
 #define HV_PM_CTRL              PHY_REG(770, 17)
 /* PHY Low Power Idle Control */
-#define I82579_LPI_CTRL                 PHY_REG(772, 20)
+#define I82579_LPI_CTRL                         PHY_REG(772, 20)
-#define I82579_LPI_CTRL_ENABLE_MASK     0x6000
+#define I82579_LPI_CTRL_ENABLE_MASK             0x6000
+#define I82579_LPI_CTRL_FORCE_PLL_LOCK_COUNT    0x80
 /* EMI Registers */
 #define I82579_EMI_ADDR         0x10
@@ -163,6 +164,11 @@
 #define HV_KMRN_MODE_CTRL      PHY_REG(769, 16)
 #define HV_KMRN_MDIO_SLOW      0x0400
+/* KMRN FIFO Control and Status */
+#define HV_KMRN_FIFO_CTRLSTA                  PHY_REG(770, 16)
+#define HV_KMRN_FIFO_CTRLSTA_PREAMBLE_MASK    0x7000
+#define HV_KMRN_FIFO_CTRLSTA_PREAMBLE_SHIFT   12
 /* ICH GbE Flash Hardware Sequencing Flash Status Register bit breakdown */
 /* Offset 04h HSFSTS */
 union ich8_hws_flash_status {
@@ -657,6 +663,7 @@ static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw)
        struct e1000_mac_info *mac = &hw->mac;
        s32 ret_val;
        bool link;
+        u16 phy_reg;
        /*
         * We only want to go out to the PHY registers to see if Auto-Neg
@@ -689,16 +696,35 @@ static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw)
        mac->get_link_status = false;
-        if (hw->phy.type == e1000_phy_82578) {
+        switch (hw->mac.type) {
-                ret_val = e1000_link_stall_workaround_hv(hw);
+        case e1000_pch2lan:
-                if (ret_val)
-                        goto out;
-        }
-        if (hw->mac.type == e1000_pch2lan) {
                ret_val = e1000_k1_workaround_lv(hw);
                if (ret_val)
                        goto out;
+                /* fall-thru */
+        case e1000_pchlan:
+                if (hw->phy.type == e1000_phy_82578) {
+                        ret_val = e1000_link_stall_workaround_hv(hw);
+                        if (ret_val)
+                                goto out;
+                }
+                /*
+                 * Workaround for PCHx parts in half-duplex:
+                 * Set the number of preambles removed from the packet
+                 * when it is passed from the PHY to the MAC to prevent
+                 * the MAC from misinterpreting the packet type.
+                 */
+                e1e_rphy(hw, HV_KMRN_FIFO_CTRLSTA, &phy_reg);
+                phy_reg &= ~HV_KMRN_FIFO_CTRLSTA_PREAMBLE_MASK;
+                if ((er32(STATUS) & E1000_STATUS_FD) != E1000_STATUS_FD)
+                        phy_reg |= (1 << HV_KMRN_FIFO_CTRLSTA_PREAMBLE_SHIFT);
+                e1e_wphy(hw, HV_KMRN_FIFO_CTRLSTA, phy_reg);
+                break;
+        default:
+                break;
        }
        /*
@@ -788,6 +814,11 @@ static s32 e1000_get_variants_ich8lan(struct e1000_adapter *adapter)
            (adapter->hw.phy.type == e1000_phy_igp_3))
                adapter->flags |= FLAG_LSC_GIG_SPEED_DROP;
+        /* Enable workaround for 82579 w/ ME enabled */
+        if ((adapter->hw.mac.type == e1000_pch2lan) &&
+            (er32(FWSM) & E1000_ICH_FWSM_FW_VALID))
+                adapter->flags2 |= FLAG2_PCIM2PCI_ARBITER_WA;
        /* Disable EEE by default until IEEE802.3az spec is finalized */
        if (adapter->flags2 & FLAG2_HAS_EEE)
                adapter->hw.dev_spec.ich8lan.eee_disable = true;
@@ -1355,7 +1386,7 @@ static s32 e1000_hv_phy_workarounds_ich8lan(struct e1000_hw *hw)
                        return ret_val;
                /* Preamble tuning for SSC */
-                ret_val = e1e_wphy(hw, PHY_REG(770, 16), 0xA204);
+                ret_val = e1e_wphy(hw, HV_KMRN_FIFO_CTRLSTA, 0xA204);
                if (ret_val)
                        return ret_val;
        }
@@ -1645,6 +1676,7 @@ static s32 e1000_k1_workaround_lv(struct e1000_hw *hw)
        s32 ret_val = 0;
        u16 status_reg = 0;
        u32 mac_reg;
+        u16 phy_reg;
        if (hw->mac.type != e1000_pch2lan)
                goto out;
@@ -1659,12 +1691,19 @@ static s32 e1000_k1_workaround_lv(struct e1000_hw *hw)
                mac_reg = er32(FEXTNVM4);
                mac_reg &= ~E1000_FEXTNVM4_BEACON_DURATION_MASK;
-                if (status_reg & HV_M_STATUS_SPEED_1000)
+                ret_val = e1e_rphy(hw, I82579_LPI_CTRL, &phy_reg);
+                if (ret_val)
+                        goto out;
+                if (status_reg & HV_M_STATUS_SPEED_1000) {
                        mac_reg |= E1000_FEXTNVM4_BEACON_DURATION_8USEC;
-                else
+                        phy_reg &= ~I82579_LPI_CTRL_FORCE_PLL_LOCK_COUNT;
+                } else {
                        mac_reg |= E1000_FEXTNVM4_BEACON_DURATION_16USEC;
+                        phy_reg |= I82579_LPI_CTRL_FORCE_PLL_LOCK_COUNT;
+                }
                ew32(FEXTNVM4, mac_reg);
+                ret_val = e1e_wphy(hw, I82579_LPI_CTRL, phy_reg);
        }
 out:
diff --git a/drivers/net/e1000e/netdev.c b/drivers/net/e1000e/netdev.c
index 362f70382cdd..2198e615f241 100644
--- a/drivers/net/e1000e/netdev.c
+++ b/drivers/net/e1000e/netdev.c
@@ -519,6 +519,63 @@ static void e1000_rx_checksum(struct e1000_adapter *adapter, u32 status_err,
 }
 /**
+ * e1000e_update_tail_wa - helper function for e1000e_update_[rt]dt_wa()
+ * @hw: pointer to the HW structure
+ * @tail: address of tail descriptor register
+ * @i: value to write to tail descriptor register
+ *
+ * When updating the tail register, the ME could be accessing Host CSR
+ * registers at the same time.  Normally, this is handled in h/w by an
+ * arbiter but on some parts there is a bug that acknowledges Host accesses
+ * later than it should which could result in the descriptor register to
+ * have an incorrect value.  Workaround this by checking the FWSM register
+ * which has bit 24 set while ME is accessing Host CSR registers, wait
+ * if it is set and try again a number of times.
+ **/
+static inline s32 e1000e_update_tail_wa(struct e1000_hw *hw, u8 __iomem * tail,
+                                        unsigned int i)
+{
+        unsigned int j = 0;
+        while ((j++ < E1000_ICH_FWSM_PCIM2PCI_COUNT) &&
+               (er32(FWSM) & E1000_ICH_FWSM_PCIM2PCI))
+                udelay(50);
+        writel(i, tail);
+        if ((j == E1000_ICH_FWSM_PCIM2PCI_COUNT) && (i != readl(tail)))
+                return E1000_ERR_SWFW_SYNC;
+        return 0;
+}
+static void e1000e_update_rdt_wa(struct e1000_adapter *adapter, unsigned int i)
+{
+        u8 __iomem *tail = (adapter->hw.hw_addr + adapter->rx_ring->tail);
+        struct e1000_hw *hw = &adapter->hw;
+        if (e1000e_update_tail_wa(hw, tail, i)) {
+                u32 rctl = er32(RCTL);
+                ew32(RCTL, rctl & ~E1000_RCTL_EN);
+                e_err("ME firmware caused invalid RDT - resetting\n");
+                schedule_work(&adapter->reset_task);
+        }
+}
+static void e1000e_update_tdt_wa(struct e1000_adapter *adapter, unsigned int i)
+{
+        u8 __iomem *tail = (adapter->hw.hw_addr + adapter->tx_ring->tail);
+        struct e1000_hw *hw = &adapter->hw;
+        if (e1000e_update_tail_wa(hw, tail, i)) {
+                u32 tctl = er32(TCTL);
+                ew32(TCTL, tctl & ~E1000_TCTL_EN);
+                e_err("ME firmware caused invalid TDT - resetting\n");
+                schedule_work(&adapter->reset_task);
+        }
+}
+/**
 * e1000_alloc_rx_buffers - Replace used receive buffers; legacy & extended
 * @adapter: address of board private structure
 **/
@@ -573,7 +630,10 @@ map_skb:
                         * such as IA-64).
                         */
                        wmb();
-                        writel(i, adapter->hw.hw_addr + rx_ring->tail);
+                        if (adapter->flags2 & FLAG2_PCIM2PCI_ARBITER_WA)
+                                e1000e_update_rdt_wa(adapter, i);
+                        else
+                                writel(i, adapter->hw.hw_addr + rx_ring->tail);
                }
                i++;
                if (i == rx_ring->count)
@@ -673,7 +733,11 @@ static void e1000_alloc_rx_buffers_ps(struct e1000_adapter *adapter,
                         * such as IA-64).
                         */
                        wmb();
-                        writel(i << 1, adapter->hw.hw_addr + rx_ring->tail);
+                        if (adapter->flags2 & FLAG2_PCIM2PCI_ARBITER_WA)
+                                e1000e_update_rdt_wa(adapter, i << 1);
+                        else
+                                writel(i << 1,
+                                       adapter->hw.hw_addr + rx_ring->tail);
                }
                i++;
@@ -756,7 +820,10 @@ check_page:
                 * applicable for weak-ordered memory model archs,
                 * such as IA-64). */
                wmb();
-                writel(i, adapter->hw.hw_addr + rx_ring->tail);
+                if (adapter->flags2 & FLAG2_PCIM2PCI_ARBITER_WA)
+                        e1000e_update_rdt_wa(adapter, i);
+                else
+                        writel(i, adapter->hw.hw_addr + rx_ring->tail);
        }
 }
@@ -4689,7 +4756,12 @@ static void e1000_tx_queue(struct e1000_adapter *adapter,
        wmb();
        tx_ring->next_to_use = i;
-        writel(i, adapter->hw.hw_addr + tx_ring->tail);
+        if (adapter->flags2 & FLAG2_PCIM2PCI_ARBITER_WA)
+                e1000e_update_tdt_wa(adapter, i);
+        else
+                writel(i, adapter->hw.hw_addr + tx_ring->tail);
        /*
         * we need this if more than one processor can write to our tail
         * at a time, it synchronizes IO on IA64/Altix systems
diff --git a/drivers/net/forcedeth.c b/drivers/net/forcedeth.c
index e55df308a3af..6d5fbd4d4256 100644
--- a/drivers/net/forcedeth.c
+++ b/drivers/net/forcedeth.c
@@ -5615,7 +5615,8 @@ static int __devinit nv_probe(struct pci_dev *pci_dev, const struct pci_device_i
                goto out_error;
        }
-        nv_vlan_mode(dev, dev->features);
+        if (id->driver_data & DEV_HAS_VLAN)
+                nv_vlan_mode(dev, dev->features);
        netif_carrier_off(dev);
diff --git a/drivers/net/gianfar.c b/drivers/net/gianfar.c
index 2659daad783d..31d5c574e5a9 100644
--- a/drivers/net/gianfar.c
+++ b/drivers/net/gianfar.c
@@ -2710,8 +2710,13 @@ static int gfar_process_frame(struct net_device *dev, struct sk_buff *skb,
        /* Tell the skb what kind of packet this is */
        skb->protocol = eth_type_trans(skb, dev);
-        /* Set vlan tag */
+        /*
-        if (fcb->flags & RXFCB_VLN)
+         * There's need to check for NETIF_F_HW_VLAN_RX here.
+         * Even if vlan rx accel is disabled, on some chips
+         * RXFCB_VLN is pseudo randomly set.
+         */
+        if (dev->features & NETIF_F_HW_VLAN_RX &&
+            fcb->flags & RXFCB_VLN)
                __vlan_hwaccel_put_tag(skb, fcb->vlctl);
        /* Send the packet up the stack */
diff --git a/drivers/net/gianfar_ethtool.c b/drivers/net/gianfar_ethtool.c
index 6e350692d118..0caf3c323ec0 100644
--- a/drivers/net/gianfar_ethtool.c
+++ b/drivers/net/gianfar_ethtool.c
@@ -686,10 +686,21 @@ static int gfar_ethflow_to_filer_table(struct gfar_private *priv, u64 ethflow, u
 {
        unsigned int last_rule_idx = priv->cur_filer_idx;
        unsigned int cmp_rqfpr;
-        unsigned int local_rqfpr[MAX_FILER_IDX + 1];
+        unsigned int *local_rqfpr;
-        unsigned int local_rqfcr[MAX_FILER_IDX + 1];
+        unsigned int *local_rqfcr;
        int i = 0x0, k = 0x0;
        int j = MAX_FILER_IDX, l = 0x0;
+        int ret = 1;
+        local_rqfpr = kmalloc(sizeof(unsigned int) * (MAX_FILER_IDX + 1),
+                GFP_KERNEL);
+        local_rqfcr = kmalloc(sizeof(unsigned int) * (MAX_FILER_IDX + 1),
+                GFP_KERNEL);
+        if (!local_rqfpr || !local_rqfcr) {
+                pr_err("Out of memory\n");
+                ret = 0;
+                goto err;
+        }
        switch (class) {
        case TCP_V4_FLOW:
@@ -706,7 +717,8 @@ static int gfar_ethflow_to_filer_table(struct gfar_private *priv, u64 ethflow, u
                break;
        default:
                pr_err("Right now this class is not supported\n");
-                return 0;
+                ret = 0;
+                goto err;
        }
        for (i = 0; i < MAX_FILER_IDX + 1; i++) {
@@ -721,7 +733,8 @@ static int gfar_ethflow_to_filer_table(struct gfar_private *priv, u64 ethflow, u
        if (i == MAX_FILER_IDX + 1) {
                pr_err("No parse rule found, can't create hash rules\n");
-                return 0;
+                ret = 0;
+                goto err;
        }
        /* If a match was found, then it begins the starting of a cluster rule
@@ -765,7 +778,10 @@ static int gfar_ethflow_to_filer_table(struct gfar_private *priv, u64 ethflow, u
                priv->cur_filer_idx = priv->cur_filer_idx - 1;
        }
-        return 1;
+err:
+        kfree(local_rqfcr);
+        kfree(local_rqfpr);
+        return ret;
 }
 static int gfar_set_hash_opts(struct gfar_private *priv, struct ethtool_rxnfc *cmd)
@@ -1653,10 +1669,10 @@ static int gfar_get_cls_all(struct gfar_private *priv,
        u32 i = 0;
        list_for_each_entry(comp, &priv->rx_list.list, list) {
-                if (i <= cmd->rule_cnt) {
+                if (i == cmd->rule_cnt)
-                        rule_locs[i] = comp->fs.location;
+                        return -EMSGSIZE;
-                        i++;
+                rule_locs[i] = comp->fs.location;
-                }
+                i++;
        }
        cmd->data = MAX_FILER_IDX;
diff --git a/drivers/net/greth.c b/drivers/net/greth.c
index 16ce45c11934..52a39000c42c 100644
--- a/drivers/net/greth.c
+++ b/drivers/net/greth.c
@@ -428,6 +428,7 @@ greth_start_xmit(struct sk_buff *skb, struct net_device *dev)
        dma_sync_single_for_device(greth->dev, dma_addr, skb->len, DMA_TO_DEVICE);
        status = GRETH_BD_EN | GRETH_BD_IE | (skb->len & GRETH_BD_LEN);
+        greth->tx_bufs_length[greth->tx_next] = skb->len & GRETH_BD_LEN;
        /* Wrap around descriptor ring */
        if (greth->tx_next == GRETH_TXBD_NUM_MASK) {
@@ -490,7 +491,8 @@ greth_start_xmit_gbit(struct sk_buff *skb, struct net_device *dev)
        if (nr_frags != 0)
                status = GRETH_TXBD_MORE;
-        status |= GRETH_TXBD_CSALL;
+        if (skb->ip_summed == CHECKSUM_PARTIAL)
+                status |= GRETH_TXBD_CSALL;
        status |= skb_headlen(skb) & GRETH_BD_LEN;
        if (greth->tx_next == GRETH_TXBD_NUM_MASK)
                status |= GRETH_BD_WR;
@@ -513,7 +515,9 @@ greth_start_xmit_gbit(struct sk_buff *skb, struct net_device *dev)
                greth->tx_skbuff[curr_tx] = NULL;
                bdp = greth->tx_bd_base + curr_tx;
-                status = GRETH_TXBD_CSALL | GRETH_BD_EN;
+                status = GRETH_BD_EN;
+                if (skb->ip_summed == CHECKSUM_PARTIAL)
+                        status |= GRETH_TXBD_CSALL;
                status |= frag->size & GRETH_BD_LEN;
                /* Wrap around descriptor ring */
@@ -641,6 +645,7 @@ static void greth_clean_tx(struct net_device *dev)
                                dev->stats.tx_fifo_errors++;
                }
                dev->stats.tx_packets++;
+                dev->stats.tx_bytes += greth->tx_bufs_length[greth->tx_last];
                greth->tx_last = NEXT_TX(greth->tx_last);
                greth->tx_free++;
        }
@@ -695,6 +700,7 @@ static void greth_clean_tx_gbit(struct net_device *dev)
                greth->tx_skbuff[greth->tx_last] = NULL;
                greth_update_tx_stats(dev, stat);
+                dev->stats.tx_bytes += skb->len;
                bdp = greth->tx_bd_base + greth->tx_last;
@@ -796,6 +802,7 @@ static int greth_rx(struct net_device *dev, int limit)
                                memcpy(skb_put(skb, pkt_len), phys_to_virt(dma_addr), pkt_len);
                                skb->protocol = eth_type_trans(skb, dev);
+                                dev->stats.rx_bytes += pkt_len;
                                dev->stats.rx_packets++;
                                netif_receive_skb(skb);
                        }
@@ -910,6 +917,7 @@ static int greth_rx_gbit(struct net_device *dev, int limit)
                                skb->protocol = eth_type_trans(skb, dev);
                                dev->stats.rx_packets++;
+                                dev->stats.rx_bytes += pkt_len;
                                netif_receive_skb(skb);
                                greth->rx_skbuff[greth->rx_cur] = newskb;
diff --git a/drivers/net/greth.h b/drivers/net/greth.h
index 9a0040dee4da..232a622a85b7 100644
--- a/drivers/net/greth.h
+++ b/drivers/net/greth.h
@@ -103,6 +103,7 @@ struct greth_private {
        unsigned char *tx_bufs[GRETH_TXBD_NUM];
        unsigned char *rx_bufs[GRETH_RXBD_NUM];
+        u16 tx_bufs_length[GRETH_TXBD_NUM];
        u16 tx_next;
        u16 tx_last;
diff --git a/drivers/net/ibmveth.c b/drivers/net/ibmveth.c
index ba99af05bf62..d393f1e764ed 100644
--- a/drivers/net/ibmveth.c
+++ b/drivers/net/ibmveth.c
@@ -395,7 +395,7 @@ static inline struct sk_buff *ibmveth_rxq_get_buffer(struct ibmveth_adapter *ada
 }
 /* recycle the current buffer on the rx queue */
-static void ibmveth_rxq_recycle_buffer(struct ibmveth_adapter *adapter)
+static int ibmveth_rxq_recycle_buffer(struct ibmveth_adapter *adapter)
 {
        u32 q_index = adapter->rx_queue.index;
        u64 correlator = adapter->rx_queue.queue_addr[q_index].correlator;
@@ -403,6 +403,7 @@ static void ibmveth_rxq_recycle_buffer(struct ibmveth_adapter *adapter)
        unsigned int index = correlator & 0xffffffffUL;
        union ibmveth_buf_desc desc;
        unsigned long lpar_rc;
+        int ret = 1;
        BUG_ON(pool >= IBMVETH_NUM_BUFF_POOLS);
        BUG_ON(index >= adapter->rx_buff_pool[pool].size);
@@ -410,7 +411,7 @@ static void ibmveth_rxq_recycle_buffer(struct ibmveth_adapter *adapter)
        if (!adapter->rx_buff_pool[pool].active) {
                ibmveth_rxq_harvest_buffer(adapter);
                ibmveth_free_buffer_pool(adapter, &adapter->rx_buff_pool[pool]);
-                return;
+                goto out;
        }
        desc.fields.flags_len = IBMVETH_BUF_VALID |
@@ -423,12 +424,16 @@ static void ibmveth_rxq_recycle_buffer(struct ibmveth_adapter *adapter)
                netdev_dbg(adapter->netdev, "h_add_logical_lan_buffer failed "
                           "during recycle rc=%ld", lpar_rc);
                ibmveth_remove_buffer_from_pool(adapter, adapter->rx_queue.queue_addr[adapter->rx_queue.index].correlator);
+                ret = 0;
        }
        if (++adapter->rx_queue.index == adapter->rx_queue.num_slots) {
                adapter->rx_queue.index = 0;
                adapter->rx_queue.toggle = !adapter->rx_queue.toggle;
        }
+out:
+        return ret;
 }
 static void ibmveth_rxq_harvest_buffer(struct ibmveth_adapter *adapter)
@@ -631,8 +636,8 @@ static int ibmveth_open(struct net_device *netdev)
                netdev_err(netdev, "unable to request irq 0x%x, rc %d\n",
                           netdev->irq, rc);
                do {
-                        rc = h_free_logical_lan(adapter->vdev->unit_address);
+                        lpar_rc = h_free_logical_lan(adapter->vdev->unit_address);
-                } while (H_IS_LONG_BUSY(rc) || (rc == H_BUSY));
+                } while (H_IS_LONG_BUSY(lpar_rc) || (lpar_rc == H_BUSY));
                goto err_out;
        }
@@ -752,7 +757,7 @@ static int ibmveth_set_csum_offload(struct net_device *dev, u32 data)
        struct ibmveth_adapter *adapter = netdev_priv(dev);
        unsigned long set_attr, clr_attr, ret_attr;
        unsigned long set_attr6, clr_attr6;
-        long ret, ret6;
+        long ret, ret4, ret6;
        int rc1 = 0, rc2 = 0;
        int restart = 0;
@@ -765,6 +770,8 @@ static int ibmveth_set_csum_offload(struct net_device *dev, u32 data)
        set_attr = 0;
        clr_attr = 0;
+        set_attr6 = 0;
+        clr_attr6 = 0;
        if (data) {
                set_attr = IBMVETH_ILLAN_IPV4_TCP_CSUM;
@@ -779,16 +786,20 @@ static int ibmveth_set_csum_offload(struct net_device *dev, u32 data)
        if (ret == H_SUCCESS && !(ret_attr & IBMVETH_ILLAN_ACTIVE_TRUNK) &&
            !(ret_attr & IBMVETH_ILLAN_TRUNK_PRI_MASK) &&
            (ret_attr & IBMVETH_ILLAN_PADDED_PKT_CSUM)) {
-                ret = h_illan_attributes(adapter->vdev->unit_address, clr_attr,
+                ret4 = h_illan_attributes(adapter->vdev->unit_address, clr_attr,
                                         set_attr, &ret_attr);
-                if (ret != H_SUCCESS) {
+                if (ret4 != H_SUCCESS) {
                        netdev_err(dev, "unable to change IPv4 checksum "
                                        "offload settings. %d rc=%ld\n",
-                                        data, ret);
+                                        data, ret4);
+                        h_illan_attributes(adapter->vdev->unit_address,
+                                           set_attr, clr_attr, &ret_attr);
+                        if (data == 1)
+                                dev->features &= ~NETIF_F_IP_CSUM;
-                        ret = h_illan_attributes(adapter->vdev->unit_address,
-                                                 set_attr, clr_attr, &ret_attr);
                } else {
                        adapter->fw_ipv4_csum_support = data;
                }
@@ -799,15 +810,18 @@ static int ibmveth_set_csum_offload(struct net_device *dev, u32 data)
                if (ret6 != H_SUCCESS) {
                        netdev_err(dev, "unable to change IPv6 checksum "
                                        "offload settings. %d rc=%ld\n",
-                                        data, ret);
+                                        data, ret6);
+                        h_illan_attributes(adapter->vdev->unit_address,
+                                           set_attr6, clr_attr6, &ret_attr);
+                        if (data == 1)
+                                dev->features &= ~NETIF_F_IPV6_CSUM;
-                        ret = h_illan_attributes(adapter->vdev->unit_address,
-                                                 set_attr6, clr_attr6,
-                                                 &ret_attr);
                } else
                        adapter->fw_ipv6_csum_support = data;
-                if (ret != H_SUCCESS || ret6 != H_SUCCESS)
+                if (ret4 == H_SUCCESS || ret6 == H_SUCCESS)
                        adapter->rx_csum = data;
                else
                        rc1 = -EIO;
@@ -925,6 +939,7 @@ static netdev_tx_t ibmveth_start_xmit(struct sk_buff *skb,
        union ibmveth_buf_desc descs[6];
        int last, i;
        int force_bounce = 0;
+        dma_addr_t dma_addr;
        /*
         * veth handles a maximum of 6 segments including the header, so
@@ -989,17 +1004,16 @@ retry_bounce:
        }
        /* Map the header */
-        descs[0].fields.address = dma_map_single(&adapter->vdev->dev, skb->data,
+        dma_addr = dma_map_single(&adapter->vdev->dev, skb->data,
-                                                 skb_headlen(skb),
+                                  skb_headlen(skb), DMA_TO_DEVICE);
-                                                 DMA_TO_DEVICE);
+        if (dma_mapping_error(&adapter->vdev->dev, dma_addr))
-        if (dma_mapping_error(&adapter->vdev->dev, descs[0].fields.address))
                goto map_failed;
        descs[0].fields.flags_len = desc_flags | skb_headlen(skb);
+        descs[0].fields.address = dma_addr;
        /* Map the frags */
        for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
-                unsigned long dma_addr;
                skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
                dma_addr = dma_map_page(&adapter->vdev->dev, frag->page,
@@ -1021,7 +1035,12 @@ retry_bounce:
                netdev->stats.tx_bytes += skb->len;
        }
-        for (i = 0; i < skb_shinfo(skb)->nr_frags + 1; i++)
+        dma_unmap_single(&adapter->vdev->dev,
+                         descs[0].fields.address,
+                         descs[0].fields.flags_len & IBMVETH_BUF_LEN_MASK,
+                         DMA_TO_DEVICE);
+        for (i = 1; i < skb_shinfo(skb)->nr_frags + 1; i++)
                dma_unmap_page(&adapter->vdev->dev, descs[i].fields.address,
                               descs[i].fields.flags_len & IBMVETH_BUF_LEN_MASK,
                               DMA_TO_DEVICE);
@@ -1084,8 +1103,9 @@ restart_poll:
                                if (rx_flush)
                                        ibmveth_flush_buffer(skb->data,
                                                length + offset);
+                                if (!ibmveth_rxq_recycle_buffer(adapter))
+                                        kfree_skb(skb);
                                skb = new_skb;
-                                ibmveth_rxq_recycle_buffer(adapter);
                        } else {
                                ibmveth_rxq_harvest_buffer(adapter);
                                skb_reserve(skb, offset);
diff --git a/drivers/net/ixgbe/ixgbe_main.c b/drivers/net/ixgbe/ixgbe_main.c
index e86297b32733..e1fcc9589278 100644
--- a/drivers/net/ixgbe/ixgbe_main.c
+++ b/drivers/net/ixgbe/ixgbe_main.c
@@ -1321,8 +1321,8 @@ static void ixgbe_clean_rx_irq(struct ixgbe_q_vector *q_vector,
                if (ring_is_rsc_enabled(rx_ring))
                        pkt_is_rsc = ixgbe_get_rsc_state(rx_desc);
-                /* if this is a skb from previous receive DMA will be 0 */
+                /* linear means we are building an skb from multiple pages */
-                if (rx_buffer_info->dma) {
+                if (!skb_is_nonlinear(skb)) {
                        u16 hlen;
                        if (pkt_is_rsc &&
                            !(staterr & IXGBE_RXD_STAT_EOP) &&
@@ -1459,8 +1459,10 @@ static void ixgbe_clean_rx_irq(struct ixgbe_q_vector *q_vector,
                if (ixgbe_rx_is_fcoe(adapter, rx_desc)) {
                        ddp_bytes = ixgbe_fcoe_ddp(adapter, rx_desc, skb,
                                                   staterr);
-                        if (!ddp_bytes)
+                        if (!ddp_bytes) {
+                                dev_kfree_skb_any(skb);
                                goto next_desc;
+                        }
                }
 #endif /* IXGBE_FCOE */
                ixgbe_receive_skb(q_vector, skb, staterr, rx_ring, rx_desc);
diff --git a/drivers/net/netconsole.c b/drivers/net/netconsole.c
index dfc82720065a..ed2a3977c6e7 100644
--- a/drivers/net/netconsole.c
+++ b/drivers/net/netconsole.c
@@ -799,5 +799,11 @@ static void __exit cleanup_netconsole(void)
        }
 }
-module_init(init_netconsole);
+/*
+ * Use late_initcall to ensure netconsole is
+ * initialized after network device driver if built-in.
+ *
+ * late_initcall() and module_init() are identical if built as module.
+ */
+late_initcall(init_netconsole);
 module_exit(cleanup_netconsole);
diff --git a/drivers/net/pch_gbe/pch_gbe.h b/drivers/net/pch_gbe/pch_gbe.h
index 59fac77d0dbb..a09a07197eb5 100644
--- a/drivers/net/pch_gbe/pch_gbe.h
+++ b/drivers/net/pch_gbe/pch_gbe.h
@@ -127,8 +127,8 @@ struct pch_gbe_regs {
 /* Reset */
 #define PCH_GBE_ALL_RST         0x80000000  /* All reset */
-#define PCH_GBE_TX_RST          0x40000000  /* TX MAC, TX FIFO, TX DMA reset */
+#define PCH_GBE_TX_RST          0x00008000  /* TX MAC, TX FIFO, TX DMA reset */
-#define PCH_GBE_RX_RST          0x04000000  /* RX MAC, RX FIFO, RX DMA reset */
+#define PCH_GBE_RX_RST          0x00004000  /* RX MAC, RX FIFO, RX DMA reset */
 /* TCP/IP Accelerator Control */
 #define PCH_GBE_EX_LIST_EN      0x00000008  /* External List Enable */
@@ -276,6 +276,9 @@ struct pch_gbe_regs {
 #define PCH_GBE_RX_DMA_EN       0x00000002   /* Enables Receive DMA */
 #define PCH_GBE_TX_DMA_EN       0x00000001   /* Enables Transmission DMA */
+/* RX DMA STATUS */
+#define PCH_GBE_IDLE_CHECK       0xFFFFFFFE
 /* Wake On LAN Status */
 #define PCH_GBE_WLS_BR          0x00000008 /* Broadcas Address */
 #define PCH_GBE_WLS_MLT         0x00000004 /* Multicast Address */
@@ -471,6 +474,7 @@ struct pch_gbe_tx_desc {
 struct pch_gbe_buffer {
        struct sk_buff *skb;
        dma_addr_t dma;
+        unsigned char *rx_buffer;
        unsigned long time_stamp;
        u16 length;
        bool mapped;
@@ -511,6 +515,9 @@ struct pch_gbe_tx_ring {
 struct pch_gbe_rx_ring {
        struct pch_gbe_rx_desc *desc;
        dma_addr_t dma;
+        unsigned char *rx_buff_pool;
+        dma_addr_t rx_buff_pool_logic;
+        unsigned int rx_buff_pool_size;
        unsigned int size;
        unsigned int count;
        unsigned int next_to_use;
@@ -622,6 +629,7 @@ struct pch_gbe_adapter {
        unsigned long rx_buffer_len;
        unsigned long tx_queue_len;
        bool have_msi;
+        bool rx_stop_flag;
 };
 extern const char pch_driver_version[];
diff --git a/drivers/net/pch_gbe/pch_gbe_main.c b/drivers/net/pch_gbe/pch_gbe_main.c
index eac3c5ca9731..b8b4ba27b0e7 100644
--- a/drivers/net/pch_gbe/pch_gbe_main.c
+++ b/drivers/net/pch_gbe/pch_gbe_main.c
@@ -20,7 +20,6 @@
 #include "pch_gbe.h"
 #include "pch_gbe_api.h"
-#include <linux/prefetch.h>
 #define DRV_VERSION     "1.00"
 const char pch_driver_version[] = DRV_VERSION;
@@ -34,11 +33,15 @@ const char pch_driver_version[] = DRV_VERSION;
 #define PCH_GBE_WATCHDOG_PERIOD         (1 * HZ)        /* watchdog time */
 #define PCH_GBE_COPYBREAK_DEFAULT       256
 #define PCH_GBE_PCI_BAR                 1
+#define PCH_GBE_RESERVE_MEMORY          0x200000        /* 2MB */
 /* Macros for ML7223 */
 #define PCI_VENDOR_ID_ROHM                      0x10db
 #define PCI_DEVICE_ID_ROHM_ML7223_GBE           0x8013
+/* Macros for ML7831 */
+#define PCI_DEVICE_ID_ROHM_ML7831_GBE           0x8802
 #define PCH_GBE_TX_WEIGHT         64
 #define PCH_GBE_RX_WEIGHT         64
 #define PCH_GBE_RX_BUFFER_WRITE   16
@@ -52,6 +55,7 @@ const char pch_driver_version[] = DRV_VERSION;
        )
 /* Ethertype field values */
+#define PCH_GBE_MAX_RX_BUFFER_SIZE      0x2880
 #define PCH_GBE_MAX_JUMBO_FRAME_SIZE    10318
 #define PCH_GBE_FRAME_SIZE_2048         2048
 #define PCH_GBE_FRAME_SIZE_4096         4096
@@ -83,10 +87,12 @@ const char pch_driver_version[] = DRV_VERSION;
 #define PCH_GBE_INT_ENABLE_MASK ( \
        PCH_GBE_INT_RX_DMA_CMPLT |    \
        PCH_GBE_INT_RX_DSC_EMP   |    \
+        PCH_GBE_INT_RX_FIFO_ERR  |    \
        PCH_GBE_INT_WOL_DET      |    \
        PCH_GBE_INT_TX_CMPLT          \
        )
+#define PCH_GBE_INT_DISABLE_ALL         0
 static unsigned int copybreak __read_mostly = PCH_GBE_COPYBREAK_DEFAULT;
@@ -138,6 +144,27 @@ static void pch_gbe_wait_clr_bit(void *reg, u32 bit)
        if (!tmp)
                pr_err("Error: busy bit is not cleared\n");
 }
+/**
+ * pch_gbe_wait_clr_bit_irq - Wait to clear a bit for interrupt context
+ * @reg:        Pointer of register
+ * @busy:       Busy bit
+ */
+static int pch_gbe_wait_clr_bit_irq(void *reg, u32 bit)
+{
+        u32 tmp;
+        int ret = -1;
+        /* wait busy */
+        tmp = 20;
+        while ((ioread32(reg) & bit) && --tmp)
+                udelay(5);
+        if (!tmp)
+                pr_err("Error: busy bit is not cleared\n");
+        else
+                ret = 0;
+        return ret;
+}
 /**
 * pch_gbe_mac_mar_set - Set MAC address register
 * @hw:     Pointer to the HW structure
@@ -189,6 +216,17 @@ static void pch_gbe_mac_reset_hw(struct pch_gbe_hw *hw)
        return;
 }
+static void pch_gbe_mac_reset_rx(struct pch_gbe_hw *hw)
+{
+        /* Read the MAC address. and store to the private data */
+        pch_gbe_mac_read_mac_addr(hw);
+        iowrite32(PCH_GBE_RX_RST, &hw->reg->RESET);
+        pch_gbe_wait_clr_bit_irq(&hw->reg->RESET, PCH_GBE_RX_RST);
+        /* Setup the MAC address */
+        pch_gbe_mac_mar_set(hw, hw->mac.addr, 0);
+        return;
+}
 /**
 * pch_gbe_mac_init_rx_addrs - Initialize receive address's
 * @hw: Pointer to the HW structure
@@ -671,13 +709,8 @@ static void pch_gbe_setup_rctl(struct pch_gbe_adapter *adapter)
        tcpip = ioread32(&hw->reg->TCPIP_ACC);
-        if (netdev->features & NETIF_F_RXCSUM) {
+        tcpip |= PCH_GBE_RX_TCPIPACC_OFF;
-                tcpip &= ~PCH_GBE_RX_TCPIPACC_OFF;
+        tcpip &= ~PCH_GBE_RX_TCPIPACC_EN;
-                tcpip |= PCH_GBE_RX_TCPIPACC_EN;
-        } else {
-                tcpip |= PCH_GBE_RX_TCPIPACC_OFF;
-                tcpip &= ~PCH_GBE_RX_TCPIPACC_EN;
-        }
        iowrite32(tcpip, &hw->reg->TCPIP_ACC);
        return;
 }
@@ -717,13 +750,6 @@ static void pch_gbe_configure_rx(struct pch_gbe_adapter *adapter)
        iowrite32(rdba, &hw->reg->RX_DSC_BASE);
        iowrite32(rdlen, &hw->reg->RX_DSC_SIZE);
        iowrite32((rdba + rdlen), &hw->reg->RX_DSC_SW_P);
-        /* Enables Receive DMA */
-        rxdma = ioread32(&hw->reg->DMA_CTRL);
-        rxdma |= PCH_GBE_RX_DMA_EN;
-        iowrite32(rxdma, &hw->reg->DMA_CTRL);
-        /* Enables Receive */
-        iowrite32(PCH_GBE_MRE_MAC_RX_EN, &hw->reg->MAC_RX_EN);
 }
 /**
@@ -1097,6 +1123,48 @@ void pch_gbe_update_stats(struct pch_gbe_adapter *adapter)
        spin_unlock_irqrestore(&adapter->stats_lock, flags);
 }
+static void pch_gbe_stop_receive(struct pch_gbe_adapter *adapter)
+{
+        struct pch_gbe_hw *hw = &adapter->hw;
+        u32 rxdma;
+        u16 value;
+        int ret;
+        /* Disable Receive DMA */
+        rxdma = ioread32(&hw->reg->DMA_CTRL);
+        rxdma &= ~PCH_GBE_RX_DMA_EN;
+        iowrite32(rxdma, &hw->reg->DMA_CTRL);
+        /* Wait Rx DMA BUS is IDLE */
+        ret = pch_gbe_wait_clr_bit_irq(&hw->reg->RX_DMA_ST, PCH_GBE_IDLE_CHECK);
+        if (ret) {
+                /* Disable Bus master */
+                pci_read_config_word(adapter->pdev, PCI_COMMAND, &value);
+                value &= ~PCI_COMMAND_MASTER;
+                pci_write_config_word(adapter->pdev, PCI_COMMAND, value);
+                /* Stop Receive */
+                pch_gbe_mac_reset_rx(hw);
+                /* Enable Bus master */
+                value |= PCI_COMMAND_MASTER;
+                pci_write_config_word(adapter->pdev, PCI_COMMAND, value);
+        } else {
+                /* Stop Receive */
+                pch_gbe_mac_reset_rx(hw);
+        }
+}
+static void pch_gbe_start_receive(struct pch_gbe_hw *hw)
+{
+        u32 rxdma;
+        /* Enables Receive DMA */
+        rxdma = ioread32(&hw->reg->DMA_CTRL);
+        rxdma |= PCH_GBE_RX_DMA_EN;
+        iowrite32(rxdma, &hw->reg->DMA_CTRL);
+        /* Enables Receive */
+        iowrite32(PCH_GBE_MRE_MAC_RX_EN, &hw->reg->MAC_RX_EN);
+        return;
+}
 /**
 * pch_gbe_intr - Interrupt Handler
 * @irq:   Interrupt number
@@ -1123,7 +1191,17 @@ static irqreturn_t pch_gbe_intr(int irq, void *data)
        if (int_st & PCH_GBE_INT_RX_FRAME_ERR)
                adapter->stats.intr_rx_frame_err_count++;
        if (int_st & PCH_GBE_INT_RX_FIFO_ERR)
-                adapter->stats.intr_rx_fifo_err_count++;
+                if (!adapter->rx_stop_flag) {
+                        adapter->stats.intr_rx_fifo_err_count++;
+                        pr_debug("Rx fifo over run\n");
+                        adapter->rx_stop_flag = true;
+                        int_en = ioread32(&hw->reg->INT_EN);
+                        iowrite32((int_en & ~PCH_GBE_INT_RX_FIFO_ERR),
+                                  &hw->reg->INT_EN);
+                        pch_gbe_stop_receive(adapter);
+                        int_st |= ioread32(&hw->reg->INT_ST);
+                        int_st = int_st & ioread32(&hw->reg->INT_EN);
+                }
        if (int_st & PCH_GBE_INT_RX_DMA_ERR)
                adapter->stats.intr_rx_dma_err_count++;
        if (int_st & PCH_GBE_INT_TX_FIFO_ERR)
@@ -1135,21 +1213,18 @@ static irqreturn_t pch_gbe_intr(int irq, void *data)
        /* When Rx descriptor is empty  */
        if ((int_st & PCH_GBE_INT_RX_DSC_EMP)) {
                adapter->stats.intr_rx_dsc_empty_count++;
-                pr_err("Rx descriptor is empty\n");
+                pr_debug("Rx descriptor is empty\n");
                int_en = ioread32(&hw->reg->INT_EN);
                iowrite32((int_en & ~PCH_GBE_INT_RX_DSC_EMP), &hw->reg->INT_EN);
                if (hw->mac.tx_fc_enable) {
                        /* Set Pause packet */
                        pch_gbe_mac_set_pause_packet(hw);
                }
-                if ((int_en & (PCH_GBE_INT_RX_DMA_CMPLT | PCH_GBE_INT_TX_CMPLT))
-                    == 0) {
-                        return IRQ_HANDLED;
-                }
        }
        /* When request status is Receive interruption */
-        if ((int_st & (PCH_GBE_INT_RX_DMA_CMPLT | PCH_GBE_INT_TX_CMPLT))) {
+        if ((int_st & (PCH_GBE_INT_RX_DMA_CMPLT | PCH_GBE_INT_TX_CMPLT)) ||
+            (adapter->rx_stop_flag == true)) {
                if (likely(napi_schedule_prep(&adapter->napi))) {
                        /* Enable only Rx Descriptor empty */
                        atomic_inc(&adapter->irq_sem);
@@ -1185,29 +1260,23 @@ pch_gbe_alloc_rx_buffers(struct pch_gbe_adapter *adapter,
        unsigned int i;
        unsigned int bufsz;
-        bufsz = adapter->rx_buffer_len + PCH_GBE_DMA_ALIGN;
+        bufsz = adapter->rx_buffer_len + NET_IP_ALIGN;
        i = rx_ring->next_to_use;
        while ((cleaned_count--)) {
                buffer_info = &rx_ring->buffer_info[i];
-                skb = buffer_info->skb;
+                skb = netdev_alloc_skb(netdev, bufsz);
-                if (skb) {
+                if (unlikely(!skb)) {
-                        skb_trim(skb, 0);
+                        /* Better luck next round */
-                } else {
+                        adapter->stats.rx_alloc_buff_failed++;
-                        skb = netdev_alloc_skb(netdev, bufsz);
+                        break;
-                        if (unlikely(!skb)) {
-                                /* Better luck next round */
-                                adapter->stats.rx_alloc_buff_failed++;
-                                break;
-                        }
-                        /* 64byte align */
-                        skb_reserve(skb, PCH_GBE_DMA_ALIGN);
-                        buffer_info->skb = skb;
-                        buffer_info->length = adapter->rx_buffer_len;
                }
+                /* align */
+                skb_reserve(skb, NET_IP_ALIGN);
+                buffer_info->skb = skb;
                buffer_info->dma = dma_map_single(&pdev->dev,
-                                                  skb->data,
+                                                  buffer_info->rx_buffer,
                                                  buffer_info->length,
                                                  DMA_FROM_DEVICE);
                if (dma_mapping_error(&adapter->pdev->dev, buffer_info->dma)) {
@@ -1240,6 +1309,36 @@ pch_gbe_alloc_rx_buffers(struct pch_gbe_adapter *adapter,
        return;
 }
+static int
+pch_gbe_alloc_rx_buffers_pool(struct pch_gbe_adapter *adapter,
+                         struct pch_gbe_rx_ring *rx_ring, int cleaned_count)
+{
+        struct pci_dev *pdev = adapter->pdev;
+        struct pch_gbe_buffer *buffer_info;
+        unsigned int i;
+        unsigned int bufsz;
+        unsigned int size;
+        bufsz = adapter->rx_buffer_len;
+        size = rx_ring->count * bufsz + PCH_GBE_RESERVE_MEMORY;
+        rx_ring->rx_buff_pool = dma_alloc_coherent(&pdev->dev, size,
+                                                &rx_ring->rx_buff_pool_logic,
+                                                GFP_KERNEL);
+        if (!rx_ring->rx_buff_pool) {
+                pr_err("Unable to allocate memory for the receive poll buffer\n");
+                return -ENOMEM;
+        }
+        memset(rx_ring->rx_buff_pool, 0, size);
+        rx_ring->rx_buff_pool_size = size;
+        for (i = 0; i < rx_ring->count; i++) {
+                buffer_info = &rx_ring->buffer_info[i];
+                buffer_info->rx_buffer = rx_ring->rx_buff_pool + bufsz * i;
+                buffer_info->length = bufsz;
+        }
+        return 0;
+}
 /**
 * pch_gbe_alloc_tx_buffers - Allocate transmit buffers
 * @adapter:   Board private structure
@@ -1285,7 +1384,7 @@ pch_gbe_clean_tx(struct pch_gbe_adapter *adapter,
        struct sk_buff *skb;
        unsigned int i;
        unsigned int cleaned_count = 0;
-        bool cleaned = false;
+        bool cleaned = true;
        pr_debug("next_to_clean : %d\n", tx_ring->next_to_clean);
@@ -1296,7 +1395,6 @@ pch_gbe_clean_tx(struct pch_gbe_adapter *adapter,
        while ((tx_desc->gbec_status & DSC_INIT16) == 0x0000) {
                pr_debug("gbec_status:0x%04x\n", tx_desc->gbec_status);
-                cleaned = true;
                buffer_info = &tx_ring->buffer_info[i];
                skb = buffer_info->skb;
@@ -1339,8 +1437,10 @@ pch_gbe_clean_tx(struct pch_gbe_adapter *adapter,
                tx_desc = PCH_GBE_TX_DESC(*tx_ring, i);
                /* weight of a sort for tx, to avoid endless transmit cleanup */
-                if (cleaned_count++ == PCH_GBE_TX_WEIGHT)
+                if (cleaned_count++ == PCH_GBE_TX_WEIGHT) {
+                        cleaned = false;
                        break;
+                }
        }
        pr_debug("called pch_gbe_unmap_and_free_tx_resource() %d count\n",
                 cleaned_count);
@@ -1380,7 +1480,7 @@ pch_gbe_clean_rx(struct pch_gbe_adapter *adapter,
        unsigned int i;
        unsigned int cleaned_count = 0;
        bool cleaned = false;
-        struct sk_buff *skb, *new_skb;
+        struct sk_buff *skb;
        u8 dma_status;
        u16 gbec_status;
        u32 tcp_ip_status;
@@ -1401,13 +1501,12 @@ pch_gbe_clean_rx(struct pch_gbe_adapter *adapter,
                rx_desc->gbec_status = DSC_INIT16;
                buffer_info = &rx_ring->buffer_info[i];
                skb = buffer_info->skb;
+                buffer_info->skb = NULL;
                /* unmap dma */
                dma_unmap_single(&pdev->dev, buffer_info->dma,
                                   buffer_info->length, DMA_FROM_DEVICE);
                buffer_info->mapped = false;
-                /* Prefetch the packet */
-                prefetch(skb->data);
                pr_debug("RxDecNo = 0x%04x  Status[DMA:0x%02x GBE:0x%04x "
                         "TCP:0x%08x]  BufInf = 0x%p\n",
@@ -1427,70 +1526,16 @@ pch_gbe_clean_rx(struct pch_gbe_adapter *adapter,
                        pr_err("Receive CRC Error\n");
                } else {
                        /* get receive length */
-                        /* length convert[-3] */
+                        /* length convert[-3], length includes FCS length */
-                        length = (rx_desc->rx_words_eob) - 3;
+                        length = (rx_desc->rx_words_eob) - 3 - ETH_FCS_LEN;
+                        if (rx_desc->rx_words_eob & 0x02)
-                        /* Decide the data conversion method */
+                                length = length - 4;
-                        if (!(netdev->features & NETIF_F_RXCSUM)) {
+                        /*
-                                /* [Header:14][payload] */
+                         * buffer_info->rx_buffer: [Header:14][payload]
-                                if (NET_IP_ALIGN) {
+                         * skb->data: [Reserve:2][Header:14][payload]
-                                        /* Because alignment differs,
+                         */
-                                         * the new_skb is newly allocated,
+                        memcpy(skb->data, buffer_info->rx_buffer, length);
-                                         * and data is copied to new_skb.*/
-                                        new_skb = netdev_alloc_skb(netdev,
-                                                         length + NET_IP_ALIGN);
-                                        if (!new_skb) {
-                                                /* dorrop error */
-                                                pr_err("New skb allocation "
-                                                        "Error\n");
-                                                goto dorrop;
-                                        }
-                                        skb_reserve(new_skb, NET_IP_ALIGN);
-                                        memcpy(new_skb->data, skb->data,
-                                               length);
-                                        skb = new_skb;
-                                } else {
-                                        /* DMA buffer is used as SKB as it is.*/
-                                        buffer_info->skb = NULL;
-                                }
-                        } else {
-                                /* [Header:14][padding:2][payload] */
-                                /* The length includes padding length */
-                                length = length - PCH_GBE_DMA_PADDING;
-                                if ((length < copybreak) ||
-                                    (NET_IP_ALIGN != PCH_GBE_DMA_PADDING)) {
-                                        /* Because alignment differs,
-                                         * the new_skb is newly allocated,
-                                         * and data is copied to new_skb.
-                                         * Padding data is deleted
-                                         * at the time of a copy.*/
-                                        new_skb = netdev_alloc_skb(netdev,
-                                                         length + NET_IP_ALIGN);
-                                        if (!new_skb) {
-                                                /* dorrop error */
-                                                pr_err("New skb allocation "
-                                                        "Error\n");
-                                                goto dorrop;
-                                        }
-                                        skb_reserve(new_skb, NET_IP_ALIGN);
-                                        memcpy(new_skb->data, skb->data,
-                                               ETH_HLEN);
-                                        memcpy(&new_skb->data[ETH_HLEN],
-                                               &skb->data[ETH_HLEN +
-                                               PCH_GBE_DMA_PADDING],
-                                               length - ETH_HLEN);
-                                        skb = new_skb;
-                                } else {
-                                        /* Padding data is deleted
-                                         * by moving header data.*/
-                                        memmove(&skb->data[PCH_GBE_DMA_PADDING],
-                                                &skb->data[0], ETH_HLEN);
-                                        skb_reserve(skb, NET_IP_ALIGN);
-                                        buffer_info->skb = NULL;
-                                }
-                        }
-                        /* The length includes FCS length */
-                        length = length - ETH_FCS_LEN;
                        /* update status of driver */
                        adapter->stats.rx_bytes += length;
                        adapter->stats.rx_packets++;
@@ -1509,7 +1554,6 @@ pch_gbe_clean_rx(struct pch_gbe_adapter *adapter,
                        pr_debug("Receive skb->ip_summed: %d length: %d\n",
                                 skb->ip_summed, length);
                }
-dorrop:
                /* return some buffers to hardware, one at a time is too slow */
                if (unlikely(cleaned_count >= PCH_GBE_RX_BUFFER_WRITE)) {
                        pch_gbe_alloc_rx_buffers(adapter, rx_ring,
@@ -1714,9 +1758,15 @@ int pch_gbe_up(struct pch_gbe_adapter *adapter)
                pr_err("Error: can't bring device up\n");
                return err;
        }
+        err = pch_gbe_alloc_rx_buffers_pool(adapter, rx_ring, rx_ring->count);
+        if (err) {
+                pr_err("Error: can't bring device up\n");
+                return err;
+        }
        pch_gbe_alloc_tx_buffers(adapter, tx_ring);
        pch_gbe_alloc_rx_buffers(adapter, rx_ring, rx_ring->count);
        adapter->tx_queue_len = netdev->tx_queue_len;
+        pch_gbe_start_receive(&adapter->hw);
        mod_timer(&adapter->watchdog_timer, jiffies);
@@ -1734,6 +1784,7 @@ int pch_gbe_up(struct pch_gbe_adapter *adapter)
 void pch_gbe_down(struct pch_gbe_adapter *adapter)
 {
        struct net_device *netdev = adapter->netdev;
+        struct pch_gbe_rx_ring *rx_ring = adapter->rx_ring;
        /* signal that we're down so the interrupt handler does not
         * reschedule our watchdog timer */
@@ -1752,6 +1803,12 @@ void pch_gbe_down(struct pch_gbe_adapter *adapter)
        pch_gbe_reset(adapter);
        pch_gbe_clean_tx_ring(adapter, adapter->tx_ring);
        pch_gbe_clean_rx_ring(adapter, adapter->rx_ring);
+        pci_free_consistent(adapter->pdev, rx_ring->rx_buff_pool_size,
+                            rx_ring->rx_buff_pool, rx_ring->rx_buff_pool_logic);
+        rx_ring->rx_buff_pool_logic = 0;
+        rx_ring->rx_buff_pool_size = 0;
+        rx_ring->rx_buff_pool = NULL;
 }
 /**
@@ -2004,6 +2061,8 @@ static int pch_gbe_change_mtu(struct net_device *netdev, int new_mtu)
 {
        struct pch_gbe_adapter *adapter = netdev_priv(netdev);
        int max_frame;
+        unsigned long old_rx_buffer_len = adapter->rx_buffer_len;
+        int err;
        max_frame = new_mtu + ETH_HLEN + ETH_FCS_LEN;
        if ((max_frame < ETH_ZLEN + ETH_FCS_LEN) ||
@@ -2018,14 +2077,24 @@ static int pch_gbe_change_mtu(struct net_device *netdev, int new_mtu)
        else if (max_frame <= PCH_GBE_FRAME_SIZE_8192)
                adapter->rx_buffer_len = PCH_GBE_FRAME_SIZE_8192;
        else
-                adapter->rx_buffer_len = PCH_GBE_MAX_JUMBO_FRAME_SIZE;
+                adapter->rx_buffer_len = PCH_GBE_MAX_RX_BUFFER_SIZE;
-        netdev->mtu = new_mtu;
-        adapter->hw.mac.max_frame_size = max_frame;
-        if (netif_running(netdev))
+        if (netif_running(netdev)) {
-                pch_gbe_reinit_locked(adapter);
+                pch_gbe_down(adapter);
-        else
+                err = pch_gbe_up(adapter);
+                if (err) {
+                        adapter->rx_buffer_len = old_rx_buffer_len;
+                        pch_gbe_up(adapter);
+                        return -ENOMEM;
+                } else {
+                        netdev->mtu = new_mtu;
+                        adapter->hw.mac.max_frame_size = max_frame;
+                }
+        } else {
                pch_gbe_reset(adapter);
+                netdev->mtu = new_mtu;
+                adapter->hw.mac.max_frame_size = max_frame;
+        }
        pr_debug("max_frame : %d  rx_buffer_len : %d  mtu : %d  max_frame_size : %d\n",
                 max_frame, (u32) adapter->rx_buffer_len, netdev->mtu,
@@ -2099,33 +2168,39 @@ static int pch_gbe_napi_poll(struct napi_struct *napi, int budget)
 {
        struct pch_gbe_adapter *adapter =
            container_of(napi, struct pch_gbe_adapter, napi);
-        struct net_device *netdev = adapter->netdev;
        int work_done = 0;
        bool poll_end_flag = false;
        bool cleaned = false;
+        u32 int_en;
        pr_debug("budget : %d\n", budget);
-        /* Keep link state information with original netdev */
+        pch_gbe_clean_rx(adapter, adapter->rx_ring, &work_done, budget);
-        if (!netif_carrier_ok(netdev)) {
+        cleaned = pch_gbe_clean_tx(adapter, adapter->tx_ring);
-                poll_end_flag = true;
-        } else {
-                cleaned = pch_gbe_clean_tx(adapter, adapter->tx_ring);
-                pch_gbe_clean_rx(adapter, adapter->rx_ring, &work_done, budget);
-                if (cleaned)
+        if (!cleaned)
-                        work_done = budget;
+                work_done = budget;
-                /* If no Tx and not enough Rx work done,
+        /* If no Tx and not enough Rx work done,
-                 * exit the polling mode
+         * exit the polling mode
-                 */
+         */
-                if ((work_done < budget) || !netif_running(netdev))
+        if (work_done < budget)
-                        poll_end_flag = true;
+                poll_end_flag = true;
-        }
        if (poll_end_flag) {
                napi_complete(napi);
+                if (adapter->rx_stop_flag) {
+                        adapter->rx_stop_flag = false;
+                        pch_gbe_start_receive(&adapter->hw);
+                }
                pch_gbe_irq_enable(adapter);
-        }
+        } else
+                if (adapter->rx_stop_flag) {
+                        adapter->rx_stop_flag = false;
+                        pch_gbe_start_receive(&adapter->hw);
+                        int_en = ioread32(&adapter->hw.reg->INT_EN);
+                        iowrite32((int_en | PCH_GBE_INT_RX_FIFO_ERR),
+                                &adapter->hw.reg->INT_EN);
+                }
        pr_debug("poll_end_flag : %d  work_done : %d  budget : %d\n",
                 poll_end_flag, work_done, budget);
@@ -2452,6 +2527,13 @@ static DEFINE_PCI_DEVICE_TABLE(pch_gbe_pcidev_id) = {
         .class = (PCI_CLASS_NETWORK_ETHERNET << 8),
         .class_mask = (0xFFFF00)
         },
+        {.vendor = PCI_VENDOR_ID_ROHM,
+         .device = PCI_DEVICE_ID_ROHM_ML7831_GBE,
+         .subvendor = PCI_ANY_ID,
+         .subdevice = PCI_ANY_ID,
+         .class = (PCI_CLASS_NETWORK_ETHERNET << 8),
+         .class_mask = (0xFFFF00)
+         },
        /* required last entry */
        {0}
 };
diff --git a/drivers/net/phy/dp83640.c b/drivers/net/phy/dp83640.c
index cb6e0b486b1e..edd7304773eb 100644
--- a/drivers/net/phy/dp83640.c
+++ b/drivers/net/phy/dp83640.c
@@ -589,7 +589,7 @@ static void decode_rxts(struct dp83640_private *dp83640,
        prune_rx_ts(dp83640);
        if (list_empty(&dp83640->rxpool)) {
-                pr_warning("dp83640: rx timestamp pool is empty\n");
+                pr_debug("dp83640: rx timestamp pool is empty\n");
                goto out;
        }
        rxts = list_first_entry(&dp83640->rxpool, struct rxts, list);
@@ -612,7 +612,7 @@ static void decode_txts(struct dp83640_private *dp83640,
        skb = skb_dequeue(&dp83640->tx_queue);
        if (!skb) {
-                pr_warning("dp83640: have timestamp but tx_queue empty\n");
+                pr_debug("dp83640: have timestamp but tx_queue empty\n");
                return;
        }
        ns = phy2txts(phy_txts);
diff --git a/drivers/net/phy/national.c b/drivers/net/phy/national.c
index 0620ba963508..04bb8fcc0cb5 100644
--- a/drivers/net/phy/national.c
+++ b/drivers/net/phy/national.c
@@ -25,8 +25,9 @@
 /* DP83865 phy identifier values */
 #define DP83865_PHY_ID  0x20005c7a
-#define DP83865_INT_MASK_REG 0x15
+#define DP83865_INT_STATUS      0x14
-#define DP83865_INT_MASK_STATUS 0x14
+#define DP83865_INT_MASK        0x15
+#define DP83865_INT_CLEAR       0x17
 #define DP83865_INT_REMOTE_FAULT 0x0008
 #define DP83865_INT_ANE_COMPLETED 0x0010
@@ -68,21 +69,25 @@ static int ns_config_intr(struct phy_device *phydev)
        int err;
        if (phydev->interrupts == PHY_INTERRUPT_ENABLED)
-                err = phy_write(phydev, DP83865_INT_MASK_REG,
+                err = phy_write(phydev, DP83865_INT_MASK,
                                DP83865_INT_MASK_DEFAULT);
        else
-                err = phy_write(phydev, DP83865_INT_MASK_REG, 0);
+                err = phy_write(phydev, DP83865_INT_MASK, 0);
        return err;
 }
 static int ns_ack_interrupt(struct phy_device *phydev)
 {
-        int ret = phy_read(phydev, DP83865_INT_MASK_STATUS);
+        int ret = phy_read(phydev, DP83865_INT_STATUS);
        if (ret < 0)
                return ret;
-        return 0;
+        /* Clear the interrupt status bit by writing a “1”
+         * to the corresponding bit in INT_CLEAR (2:0 are reserved) */
+        ret = phy_write(phydev, DP83865_INT_CLEAR, ret & ~0x7);
+        return ret;
 }
 static void ns_giga_speed_fallback(struct phy_device *phydev, int mode)
diff --git a/drivers/net/ppp_generic.c b/drivers/net/ppp_generic.c
index 10e5d985afa3..edfa15d2e795 100644
--- a/drivers/net/ppp_generic.c
+++ b/drivers/net/ppp_generic.c
@@ -1465,7 +1465,12 @@ static int ppp_mp_explode(struct ppp *ppp, struct sk_buff *skb)
                        continue;
                }
-                mtu = pch->chan->mtu - hdrlen;
+                /*
+                 * hdrlen includes the 2-byte PPP protocol field, but the
+                 * MTU counts only the payload excluding the protocol field.
+                 * (RFC1661 Section 2)
+                 */
+                mtu = pch->chan->mtu - (hdrlen - 2);
                if (mtu < 4)
                        mtu = 4;
                if (flen > mtu)
diff --git a/drivers/net/pxa168_eth.c b/drivers/net/pxa168_eth.c
index 1a3033d8e7ed..d17d0624c5e6 100644
--- a/drivers/net/pxa168_eth.c
+++ b/drivers/net/pxa168_eth.c
@@ -40,6 +40,7 @@
 #include <linux/clk.h>
 #include <linux/phy.h>
 #include <linux/io.h>
+#include <linux/interrupt.h>
 #include <linux/types.h>
 #include <asm/pgtable.h>
 #include <asm/system.h>
diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
index 02339b3352e7..c23667017922 100644
--- a/drivers/net/r8169.c
+++ b/drivers/net/r8169.c
@@ -407,6 +407,7 @@ enum rtl_register_content {
        RxOK            = 0x0001,
        /* RxStatusDesc */
+        RxBOVF  = (1 << 24),
        RxFOVF  = (1 << 23),
        RxRWT   = (1 << 22),
        RxRES   = (1 << 21),
@@ -682,6 +683,7 @@ struct rtl8169_private {
        struct mii_if_info mii;
        struct rtl8169_counters counters;
        u32 saved_wolopts;
+        u32 opts1_mask;
        struct rtl_fw {
                const struct firmware *fw;
@@ -710,6 +712,7 @@ MODULE_FIRMWARE(FIRMWARE_8168D_1);
 MODULE_FIRMWARE(FIRMWARE_8168D_2);
 MODULE_FIRMWARE(FIRMWARE_8168E_1);
 MODULE_FIRMWARE(FIRMWARE_8168E_2);
+MODULE_FIRMWARE(FIRMWARE_8168E_3);
 MODULE_FIRMWARE(FIRMWARE_8105E_1);
 static int rtl8169_open(struct net_device *dev);
@@ -3077,6 +3080,14 @@ static void rtl8169_phy_reset(struct net_device *dev,
        netif_err(tp, link, dev, "PHY reset failed\n");
 }
+static bool rtl_tbi_enabled(struct rtl8169_private *tp)
+{
+        void __iomem *ioaddr = tp->mmio_addr;
+        return (tp->mac_version == RTL_GIGA_MAC_VER_01) &&
+            (RTL_R8(PHYstatus) & TBI_Enable);
+}
 static void rtl8169_init_phy(struct net_device *dev, struct rtl8169_private *tp)
 {
        void __iomem *ioaddr = tp->mmio_addr;
@@ -3109,7 +3120,7 @@ static void rtl8169_init_phy(struct net_device *dev, struct rtl8169_private *tp)
                           ADVERTISED_1000baseT_Half |
                           ADVERTISED_1000baseT_Full : 0));
-        if (RTL_R8(PHYstatus) & TBI_Enable)
+        if (rtl_tbi_enabled(tp))
                netif_info(tp, link, dev, "TBI auto-negotiating\n");
 }
@@ -3319,9 +3330,16 @@ static void r810x_phy_power_up(struct rtl8169_private *tp)
 static void r810x_pll_power_down(struct rtl8169_private *tp)
 {
+        void __iomem *ioaddr = tp->mmio_addr;
        if (__rtl8169_get_wol(tp) & WAKE_ANY) {
                rtl_writephy(tp, 0x1f, 0x0000);
                rtl_writephy(tp, MII_BMCR, 0x0000);
+                if (tp->mac_version == RTL_GIGA_MAC_VER_29 ||
+                    tp->mac_version == RTL_GIGA_MAC_VER_30)
+                        RTL_W32(RxConfig, RTL_R32(RxConfig) | AcceptBroadcast |
+                                AcceptMulticast | AcceptMyPhys);
                return;
        }
@@ -3417,7 +3435,8 @@ static void r8168_pll_power_down(struct rtl8169_private *tp)
                rtl_writephy(tp, MII_BMCR, 0x0000);
                if (tp->mac_version == RTL_GIGA_MAC_VER_32 ||
-                    tp->mac_version == RTL_GIGA_MAC_VER_33)
+                    tp->mac_version == RTL_GIGA_MAC_VER_33 ||
+                    tp->mac_version == RTL_GIGA_MAC_VER_34)
                        RTL_W32(RxConfig, RTL_R32(RxConfig) | AcceptBroadcast |
                                AcceptMulticast | AcceptMyPhys);
                return;
@@ -3727,8 +3746,7 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
        tp->features |= rtl_try_msi(pdev, ioaddr, cfg);
        RTL_W8(Cfg9346, Cfg9346_Lock);
-        if ((tp->mac_version <= RTL_GIGA_MAC_VER_06) &&
+        if (rtl_tbi_enabled(tp)) {
-            (RTL_R8(PHYstatus) & TBI_Enable)) {
                tp->set_speed = rtl8169_set_speed_tbi;
                tp->get_settings = rtl8169_gset_tbi;
                tp->phy_reset_enable = rtl8169_tbi_reset_enable;
@@ -3777,6 +3795,9 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
        tp->intr_event = cfg->intr_event;
        tp->napi_event = cfg->napi_event;
+        tp->opts1_mask = (tp->mac_version != RTL_GIGA_MAC_VER_01) ?
+                ~(RxBOVF | RxFOVF) : ~0;
        init_timer(&tp->timer);
        tp->timer.data = (unsigned long) dev;
        tp->timer.function = rtl8169_phy_timer;
@@ -3988,6 +4009,7 @@ static void rtl8169_hw_reset(struct rtl8169_private *tp)
                while (RTL_R8(TxPoll) & NPQ)
                        udelay(20);
        } else if (tp->mac_version == RTL_GIGA_MAC_VER_34) {
+                RTL_W8(ChipCmd, RTL_R8(ChipCmd) | StopReq);
                while (!(RTL_R32(TxConfig) & TXCFG_EMPTY))
                        udelay(100);
        } else {
@@ -5314,7 +5336,7 @@ static int rtl8169_rx_interrupt(struct net_device *dev,
                u32 status;
                rmb();
-                status = le32_to_cpu(desc->opts1);
+                status = le32_to_cpu(desc->opts1) & tp->opts1_mask;
                if (status & DescOwn)
                        break;
diff --git a/drivers/net/rionet.c b/drivers/net/rionet.c
index 86ac38c96bcf..3bb131137033 100644
--- a/drivers/net/rionet.c
+++ b/drivers/net/rionet.c
@@ -80,13 +80,13 @@ static int rionet_capable = 1;
 */
 static struct rio_dev **rionet_active;
-#define is_rionet_capable(pef, src_ops, dst_ops)                \
+#define is_rionet_capable(src_ops, dst_ops)                     \
-                        ((pef & RIO_PEF_INB_MBOX) &&            \
+                        ((src_ops & RIO_SRC_OPS_DATA_MSG) &&    \
-                         (pef & RIO_PEF_INB_DOORBELL) &&        \
+                         (dst_ops & RIO_DST_OPS_DATA_MSG) &&    \
                         (src_ops & RIO_SRC_OPS_DOORBELL) &&    \
                         (dst_ops & RIO_DST_OPS_DOORBELL))
 #define dev_rionet_capable(dev) \
-        is_rionet_capable(dev->pef, dev->src_ops, dev->dst_ops)
+        is_rionet_capable(dev->src_ops, dev->dst_ops)
 #define RIONET_MAC_MATCH(x)     (*(u32 *)x == 0x00010001)
 #define RIONET_GET_DESTID(x)    (*(u16 *)(x + 4))
@@ -282,7 +282,6 @@ static int rionet_open(struct net_device *ndev)
 {
        int i, rc = 0;
        struct rionet_peer *peer, *tmp;
-        u32 pwdcsr;
        struct rionet_private *rnet = netdev_priv(ndev);
        if (netif_msg_ifup(rnet))
@@ -332,13 +331,8 @@ static int rionet_open(struct net_device *ndev)
                        continue;
                }
-                /*
+                /* Send a join message */
-                 * If device has initialized inbound doorbells,
+                rio_send_doorbell(peer->rdev, RIONET_DOORBELL_JOIN);
-                 * send a join message
-                 */
-                rio_read_config_32(peer->rdev, RIO_WRITE_PORT_CSR, &pwdcsr);
-                if (pwdcsr & RIO_DOORBELL_AVAIL)
-                        rio_send_doorbell(peer->rdev, RIONET_DOORBELL_JOIN);
        }
      out:
@@ -492,7 +486,7 @@ static int rionet_setup_netdev(struct rio_mport *mport, struct net_device *ndev)
 static int rionet_probe(struct rio_dev *rdev, const struct rio_device_id *id)
 {
        int rc = -ENODEV;
-        u32 lpef, lsrc_ops, ldst_ops;
+        u32 lsrc_ops, ldst_ops;
        struct rionet_peer *peer;
        struct net_device *ndev = NULL;
@@ -515,12 +509,11 @@ static int rionet_probe(struct rio_dev *rdev, const struct rio_device_id *id)
         * on later probes
         */
        if (!rionet_check) {
-                rio_local_read_config_32(rdev->net->hport, RIO_PEF_CAR, &lpef);
                rio_local_read_config_32(rdev->net->hport, RIO_SRC_OPS_CAR,
                                         &lsrc_ops);
                rio_local_read_config_32(rdev->net->hport, RIO_DST_OPS_CAR,
                                         &ldst_ops);
-                if (!is_rionet_capable(lpef, lsrc_ops, ldst_ops)) {
+                if (!is_rionet_capable(lsrc_ops, ldst_ops)) {
                        printk(KERN_ERR
                               "%s: local device is not network capable\n",
                               DRV_NAME);
diff --git a/drivers/net/sfc/efx.c b/drivers/net/sfc/efx.c
index faca764aa21b..b59abc706d93 100644
--- a/drivers/net/sfc/efx.c
+++ b/drivers/net/sfc/efx.c
@@ -1050,7 +1050,6 @@ static int efx_init_io(struct efx_nic *efx)
 {
        struct pci_dev *pci_dev = efx->pci_dev;
        dma_addr_t dma_mask = efx->type->max_dma_mask;
-        bool use_wc;
        int rc;
        netif_dbg(efx, probe, efx->net_dev, "initialising I/O\n");
@@ -1101,21 +1100,8 @@ static int efx_init_io(struct efx_nic *efx)
                rc = -EIO;
                goto fail3;
        }
+        efx->membase = ioremap_nocache(efx->membase_phys,
-        /* bug22643: If SR-IOV is enabled then tx push over a write combined
+                                       efx->type->mem_map_size);
-         * mapping is unsafe. We need to disable write combining in this case.
-         * MSI is unsupported when SR-IOV is enabled, and the firmware will
-         * have removed the MSI capability. So write combining is safe if
-         * there is an MSI capability.
-         */
-        use_wc = (!EFX_WORKAROUND_22643(efx) ||
-                  pci_find_capability(pci_dev, PCI_CAP_ID_MSI));
-        if (use_wc)
-                efx->membase = ioremap_wc(efx->membase_phys,
-                                          efx->type->mem_map_size);
-        else
-                efx->membase = ioremap_nocache(efx->membase_phys,
-                                               efx->type->mem_map_size);
        if (!efx->membase) {
                netif_err(efx, probe, efx->net_dev,
                          "could not map memory BAR at %llx+%x\n",
diff --git a/drivers/net/sfc/io.h b/drivers/net/sfc/io.h
index cc978803d484..751d1ec112cc 100644
--- a/drivers/net/sfc/io.h
+++ b/drivers/net/sfc/io.h
@@ -103,7 +103,6 @@ static inline void efx_writeo(struct efx_nic *efx, efx_oword_t *value,
        _efx_writed(efx, value->u32[2], reg + 8);
        _efx_writed(efx, value->u32[3], reg + 12);
 #endif
-        wmb();
        mmiowb();
        spin_unlock_irqrestore(&efx->biu_lock, flags);
 }
@@ -126,7 +125,6 @@ static inline void efx_sram_writeq(struct efx_nic *efx, void __iomem *membase,
        __raw_writel((__force u32)value->u32[0], membase + addr);
        __raw_writel((__force u32)value->u32[1], membase + addr + 4);
 #endif
-        wmb();
        mmiowb();
        spin_unlock_irqrestore(&efx->biu_lock, flags);
 }
@@ -141,7 +139,6 @@ static inline void efx_writed(struct efx_nic *efx, efx_dword_t *value,
        /* No lock required */
        _efx_writed(efx, value->u32[0], reg);
-        wmb();
 }
 /* Read a 128-bit CSR, locking as appropriate. */
@@ -152,7 +149,6 @@ static inline void efx_reado(struct efx_nic *efx, efx_oword_t *value,
        spin_lock_irqsave(&efx->biu_lock, flags);
        value->u32[0] = _efx_readd(efx, reg + 0);
-        rmb();
        value->u32[1] = _efx_readd(efx, reg + 4);
        value->u32[2] = _efx_readd(efx, reg + 8);
        value->u32[3] = _efx_readd(efx, reg + 12);
@@ -175,7 +171,6 @@ static inline void efx_sram_readq(struct efx_nic *efx, void __iomem *membase,
        value->u64[0] = (__force __le64)__raw_readq(membase + addr);
 #else
        value->u32[0] = (__force __le32)__raw_readl(membase + addr);
-        rmb();
        value->u32[1] = (__force __le32)__raw_readl(membase + addr + 4);
 #endif
        spin_unlock_irqrestore(&efx->biu_lock, flags);
@@ -249,7 +244,6 @@ static inline void _efx_writeo_page(struct efx_nic *efx, efx_oword_t *value,
        _efx_writed(efx, value->u32[2], reg + 8);
        _efx_writed(efx, value->u32[3], reg + 12);
 #endif
-        wmb();
 }
 #define efx_writeo_page(efx, value, reg, page)                          \
        _efx_writeo_page(efx, value,                                    \
diff --git a/drivers/net/sfc/mcdi.c b/drivers/net/sfc/mcdi.c
index 3dd45ed61f0a..81a425397468 100644
--- a/drivers/net/sfc/mcdi.c
+++ b/drivers/net/sfc/mcdi.c
@@ -50,20 +50,6 @@ static inline struct efx_mcdi_iface *efx_mcdi(struct efx_nic *efx)
        return &nic_data->mcdi;
 }
-static inline void
-efx_mcdi_readd(struct efx_nic *efx, efx_dword_t *value, unsigned reg)
-{
-        struct siena_nic_data *nic_data = efx->nic_data;
-        value->u32[0] = (__force __le32)__raw_readl(nic_data->mcdi_smem + reg);
-}
-static inline void
-efx_mcdi_writed(struct efx_nic *efx, const efx_dword_t *value, unsigned reg)
-{
-        struct siena_nic_data *nic_data = efx->nic_data;
-        __raw_writel((__force u32)value->u32[0], nic_data->mcdi_smem + reg);
-}
 void efx_mcdi_init(struct efx_nic *efx)
 {
        struct efx_mcdi_iface *mcdi;
@@ -84,8 +70,8 @@ static void efx_mcdi_copyin(struct efx_nic *efx, unsigned cmd,
                            const u8 *inbuf, size_t inlen)
 {
        struct efx_mcdi_iface *mcdi = efx_mcdi(efx);
-        unsigned pdu = MCDI_PDU(efx);
+        unsigned pdu = FR_CZ_MC_TREG_SMEM + MCDI_PDU(efx);
-        unsigned doorbell = MCDI_DOORBELL(efx);
+        unsigned doorbell = FR_CZ_MC_TREG_SMEM + MCDI_DOORBELL(efx);
        unsigned int i;
        efx_dword_t hdr;
        u32 xflags, seqno;
@@ -106,28 +92,29 @@ static void efx_mcdi_copyin(struct efx_nic *efx, unsigned cmd,
                             MCDI_HEADER_SEQ, seqno,
                             MCDI_HEADER_XFLAGS, xflags);
-        efx_mcdi_writed(efx, &hdr, pdu);
+        efx_writed(efx, &hdr, pdu);
        for (i = 0; i < inlen; i += 4)
-                efx_mcdi_writed(efx, (const efx_dword_t *)(inbuf + i),
+                _efx_writed(efx, *((__le32 *)(inbuf + i)), pdu + 4 + i);
-                                pdu + 4 + i);
+        /* Ensure the payload is written out before the header */
+        wmb();
        /* ring the doorbell with a distinctive value */
-        EFX_POPULATE_DWORD_1(hdr, EFX_DWORD_0, 0x45789abc);
+        _efx_writed(efx, (__force __le32) 0x45789abc, doorbell);
-        efx_mcdi_writed(efx, &hdr, doorbell);
 }
 static void efx_mcdi_copyout(struct efx_nic *efx, u8 *outbuf, size_t outlen)
 {
        struct efx_mcdi_iface *mcdi = efx_mcdi(efx);
-        unsigned int pdu = MCDI_PDU(efx);
+        unsigned int pdu = FR_CZ_MC_TREG_SMEM + MCDI_PDU(efx);
        int i;
        BUG_ON(atomic_read(&mcdi->state) == MCDI_STATE_QUIESCENT);
        BUG_ON(outlen & 3 || outlen >= 0x100);
        for (i = 0; i < outlen; i += 4)
-                efx_mcdi_readd(efx, (efx_dword_t *)(outbuf + i), pdu + 4 + i);
+                *((__le32 *)(outbuf + i)) = _efx_readd(efx, pdu + 4 + i);
 }
 static int efx_mcdi_poll(struct efx_nic *efx)
@@ -135,7 +122,7 @@ static int efx_mcdi_poll(struct efx_nic *efx)
        struct efx_mcdi_iface *mcdi = efx_mcdi(efx);
        unsigned int time, finish;
        unsigned int respseq, respcmd, error;
-        unsigned int pdu = MCDI_PDU(efx);
+        unsigned int pdu = FR_CZ_MC_TREG_SMEM + MCDI_PDU(efx);
        unsigned int rc, spins;
        efx_dword_t reg;
@@ -161,7 +148,8 @@ static int efx_mcdi_poll(struct efx_nic *efx)
                time = get_seconds();
-                efx_mcdi_readd(efx, &reg, pdu);
+                rmb();
+                efx_readd(efx, &reg, pdu);
                /* All 1's indicates that shared memory is in reset (and is
                 * not a valid header). Wait for it to come out reset before
@@ -188,7 +176,7 @@ static int efx_mcdi_poll(struct efx_nic *efx)
                          respseq, mcdi->seqno);
                rc = EIO;
        } else if (error) {
-                efx_mcdi_readd(efx, &reg, pdu + 4);
+                efx_readd(efx, &reg, pdu + 4);
                switch (EFX_DWORD_FIELD(reg, EFX_DWORD_0)) {
 #define TRANSLATE_ERROR(name)                                   \
                case MC_CMD_ERR_ ## name:                       \
@@ -222,21 +210,21 @@ out:
 /* Test and clear MC-rebooted flag for this port/function */
 int efx_mcdi_poll_reboot(struct efx_nic *efx)
 {
-        unsigned int addr = MCDI_REBOOT_FLAG(efx);
+        unsigned int addr = FR_CZ_MC_TREG_SMEM + MCDI_REBOOT_FLAG(efx);
        efx_dword_t reg;
        uint32_t value;
        if (efx_nic_rev(efx) < EFX_REV_SIENA_A0)
                return false;
-        efx_mcdi_readd(efx, &reg, addr);
+        efx_readd(efx, &reg, addr);
        value = EFX_DWORD_FIELD(reg, EFX_DWORD_0);
        if (value == 0)
                return 0;
        EFX_ZERO_DWORD(reg);
-        efx_mcdi_writed(efx, &reg, addr);
+        efx_writed(efx, &reg, addr);
        if (value == MC_STATUS_DWORD_ASSERT)
                return -EINTR;
diff --git a/drivers/net/sfc/nic.c b/drivers/net/sfc/nic.c
index bafa23a6874c..3edfbaf5f022 100644
--- a/drivers/net/sfc/nic.c
+++ b/drivers/net/sfc/nic.c
@@ -1936,13 +1936,6 @@ void efx_nic_get_regs(struct efx_nic *efx, void *buf)
                size = min_t(size_t, table->step, 16);
-                if (table->offset >= efx->type->mem_map_size) {
-                        /* No longer mapped; return dummy data */
-                        memcpy(buf, "\xde\xc0\xad\xde", 4);
-                        buf += table->rows * size;
-                        continue;
-                }
                for (i = 0; i < table->rows; i++) {
                        switch (table->step) {
                        case 4: /* 32-bit register or SRAM */
diff --git a/drivers/net/sfc/nic.h b/drivers/net/sfc/nic.h
index 4bd1f2839dfe..7443f99c977f 100644
--- a/drivers/net/sfc/nic.h
+++ b/drivers/net/sfc/nic.h
@@ -143,12 +143,10 @@ static inline struct falcon_board *falcon_board(struct efx_nic *efx)
 /**
 * struct siena_nic_data - Siena NIC state
 * @mcdi: Management-Controller-to-Driver Interface
- * @mcdi_smem: MCDI shared memory mapping. The mapping is always uncacheable.
 * @wol_filter_id: Wake-on-LAN packet filter id
 */
 struct siena_nic_data {
        struct efx_mcdi_iface mcdi;
-        void __iomem *mcdi_smem;
        int wol_filter_id;
 };
diff --git a/drivers/net/sfc/siena.c b/drivers/net/sfc/siena.c
index 5735e84c69de..2c3bd93fab54 100644
--- a/drivers/net/sfc/siena.c
+++ b/drivers/net/sfc/siena.c
@@ -250,26 +250,12 @@ static int siena_probe_nic(struct efx_nic *efx)
        efx_reado(efx, &reg, FR_AZ_CS_DEBUG);
        efx->net_dev->dev_id = EFX_OWORD_FIELD(reg, FRF_CZ_CS_PORT_NUM) - 1;
-        /* Initialise MCDI */
-        nic_data->mcdi_smem = ioremap_nocache(efx->membase_phys +
-                                              FR_CZ_MC_TREG_SMEM,
-                                              FR_CZ_MC_TREG_SMEM_STEP *
-                                              FR_CZ_MC_TREG_SMEM_ROWS);
-        if (!nic_data->mcdi_smem) {
-                netif_err(efx, probe, efx->net_dev,
-                          "could not map MCDI at %llx+%x\n",
-                          (unsigned long long)efx->membase_phys +
-                          FR_CZ_MC_TREG_SMEM,
-                          FR_CZ_MC_TREG_SMEM_STEP * FR_CZ_MC_TREG_SMEM_ROWS);
-                rc = -ENOMEM;
-                goto fail1;
-        }
        efx_mcdi_init(efx);
        /* Recover from a failed assertion before probing */
        rc = efx_mcdi_handle_assertion(efx);
        if (rc)
-                goto fail2;
+                goto fail1;
        /* Let the BMC know that the driver is now in charge of link and
         * filter settings. We must do this before we reset the NIC */
@@ -324,7 +310,6 @@ fail4:
 fail3:
        efx_mcdi_drv_attach(efx, false, NULL);
 fail2:
-        iounmap(nic_data->mcdi_smem);
 fail1:
        kfree(efx->nic_data);
        return rc;
@@ -404,8 +389,6 @@ static int siena_init_nic(struct efx_nic *efx)
 static void siena_remove_nic(struct efx_nic *efx)
 {
-        struct siena_nic_data *nic_data = efx->nic_data;
        efx_nic_free_buffer(efx, &efx->irq_status);
        siena_reset_hw(efx, RESET_TYPE_ALL);
@@ -415,8 +398,7 @@ static void siena_remove_nic(struct efx_nic *efx)
                efx_mcdi_drv_attach(efx, false, NULL);
        /* Tear down the private nic state */
-        iounmap(nic_data->mcdi_smem);
+        kfree(efx->nic_data);
-        kfree(nic_data);
        efx->nic_data = NULL;
 }
@@ -656,7 +638,8 @@ const struct efx_nic_type siena_a0_nic_type = {
        .default_mac_ops = &efx_mcdi_mac_operations,
        .revision = EFX_REV_SIENA_A0,
-        .mem_map_size = FR_CZ_MC_TREG_SMEM, /* MC_TREG_SMEM mapped separately */
+        .mem_map_size = (FR_CZ_MC_TREG_SMEM +
+                         FR_CZ_MC_TREG_SMEM_STEP * FR_CZ_MC_TREG_SMEM_ROWS),
        .txd_ptr_tbl_base = FR_BZ_TX_DESC_PTR_TBL,
        .rxd_ptr_tbl_base = FR_BZ_RX_DESC_PTR_TBL,
        .buf_tbl_base = FR_BZ_BUF_FULL_TBL,
diff --git a/drivers/net/sfc/workarounds.h b/drivers/net/sfc/workarounds.h
index 99ff11400cef..e4dd3a7f304b 100644
--- a/drivers/net/sfc/workarounds.h
+++ b/drivers/net/sfc/workarounds.h
@@ -38,8 +38,6 @@
 #define EFX_WORKAROUND_15783 EFX_WORKAROUND_ALWAYS
 /* Legacy interrupt storm when interrupt fifo fills */
 #define EFX_WORKAROUND_17213 EFX_WORKAROUND_SIENA
-/* Write combining and sriov=enabled are incompatible */
-#define EFX_WORKAROUND_22643 EFX_WORKAROUND_SIENA
 /* Spurious parity errors in TSORT buffers */
 #define EFX_WORKAROUND_5129 EFX_WORKAROUND_FALCON_A
diff --git a/drivers/net/sh_eth.c b/drivers/net/sh_eth.c
index ad35c210b839..1c1666e99106 100644
--- a/drivers/net/sh_eth.c
+++ b/drivers/net/sh_eth.c
@@ -21,6 +21,7 @@
 */
 #include <linux/init.h>
+#include <linux/interrupt.h>
 #include <linux/dma-mapping.h>
 #include <linux/etherdevice.h>
 #include <linux/delay.h>
@@ -30,6 +31,7 @@
 #include <linux/phy.h>
 #include <linux/cache.h>
 #include <linux/io.h>
+#include <linux/interrupt.h>
 #include <linux/pm_runtime.h>
 #include <linux/slab.h>
 #include <linux/ethtool.h>
diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
index dc3fbf61910b..4a1374df6084 100644
--- a/drivers/net/tg3.c
+++ b/drivers/net/tg3.c
@@ -6234,12 +6234,10 @@ static netdev_tx_t tg3_start_xmit(struct sk_buff *skb, struct net_device *dev)
                }
        }
-#ifdef BCM_KERNEL_SUPPORTS_8021Q
        if (vlan_tx_tag_present(skb)) {
                base_flags |= TXD_FLAG_VLAN;
                vlan = vlan_tx_tag_get(skb);
        }
-#endif
        if (tg3_flag(tp, USE_JUMBO_BDFLAG) &&
            !mss && skb->len > VLAN_ETH_FRAME_LEN)
diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
index a03336e086d5..f06fb78383a1 100644
--- a/drivers/net/usb/cdc_ncm.c
+++ b/drivers/net/usb/cdc_ncm.c
@@ -228,23 +228,40 @@ static u8 cdc_ncm_setup(struct cdc_ncm_ctx *ctx)
        if (ctx->rx_max != le32_to_cpu(ctx->ncm_parm.dwNtbInMaxSize)) {
                if (flags & USB_CDC_NCM_NCAP_NTB_INPUT_SIZE) {
-                        struct usb_cdc_ncm_ndp_input_size ndp_in_sz;
+                        struct usb_cdc_ncm_ndp_input_size *ndp_in_sz;
+                        ndp_in_sz = kzalloc(sizeof(*ndp_in_sz), GFP_KERNEL);
+                        if (!ndp_in_sz) {
+                                err = -ENOMEM;
+                                goto size_err;
+                        }
                        err = usb_control_msg(ctx->udev,
                                        usb_sndctrlpipe(ctx->udev, 0),
                                        USB_CDC_SET_NTB_INPUT_SIZE,
                                        USB_TYPE_CLASS | USB_DIR_OUT
                                         | USB_RECIP_INTERFACE,
-                                        0, iface_no, &ndp_in_sz, 8, 1000);
+                                        0, iface_no, ndp_in_sz, 8, 1000);
+                        kfree(ndp_in_sz);
                } else {
-                        __le32 dwNtbInMaxSize = cpu_to_le32(ctx->rx_max);
+                        __le32 *dwNtbInMaxSize;
+                        dwNtbInMaxSize = kzalloc(sizeof(*dwNtbInMaxSize),
+                                        GFP_KERNEL);
+                        if (!dwNtbInMaxSize) {
+                                err = -ENOMEM;
+                                goto size_err;
+                        }
+                        *dwNtbInMaxSize = cpu_to_le32(ctx->rx_max);
                        err = usb_control_msg(ctx->udev,
                                        usb_sndctrlpipe(ctx->udev, 0),
                                        USB_CDC_SET_NTB_INPUT_SIZE,
                                        USB_TYPE_CLASS | USB_DIR_OUT
                                         | USB_RECIP_INTERFACE,
-                                        0, iface_no, &dwNtbInMaxSize, 4, 1000);
+                                        0, iface_no, dwNtbInMaxSize, 4, 1000);
+                        kfree(dwNtbInMaxSize);
                }
+size_err:
                if (err < 0)
                        pr_debug("Setting NTB Input Size failed\n");
        }
@@ -325,19 +342,29 @@ static u8 cdc_ncm_setup(struct cdc_ncm_ctx *ctx)
        /* set Max Datagram Size (MTU) */
        if (flags & USB_CDC_NCM_NCAP_MAX_DATAGRAM_SIZE) {
-                __le16 max_datagram_size;
+                __le16 *max_datagram_size;
                u16 eth_max_sz = le16_to_cpu(ctx->ether_desc->wMaxSegmentSize);
+                max_datagram_size = kzalloc(sizeof(*max_datagram_size),
+                                GFP_KERNEL);
+                if (!max_datagram_size) {
+                        err = -ENOMEM;
+                        goto max_dgram_err;
+                }
                err = usb_control_msg(ctx->udev, usb_rcvctrlpipe(ctx->udev, 0),
                                USB_CDC_GET_MAX_DATAGRAM_SIZE,
                                USB_TYPE_CLASS | USB_DIR_IN
                                 | USB_RECIP_INTERFACE,
-                                0, iface_no, &max_datagram_size,
+                                0, iface_no, max_datagram_size,
                                2, 1000);
                if (err < 0) {
                        pr_debug("GET_MAX_DATAGRAM_SIZE failed, use size=%u\n",
                                                CDC_NCM_MIN_DATAGRAM_SIZE);
+                        kfree(max_datagram_size);
                } else {
-                        ctx->max_datagram_size = le16_to_cpu(max_datagram_size);
+                        ctx->max_datagram_size =
+                                le16_to_cpu(*max_datagram_size);
                        /* Check Eth descriptor value */
                        if (eth_max_sz < CDC_NCM_MAX_DATAGRAM_SIZE) {
                                if (ctx->max_datagram_size > eth_max_sz)
@@ -360,8 +387,10 @@ static u8 cdc_ncm_setup(struct cdc_ncm_ctx *ctx)
                                                USB_TYPE_CLASS | USB_DIR_OUT
                                                 | USB_RECIP_INTERFACE,
                                                0,
-                                                iface_no, &max_datagram_size,
+                                                iface_no, max_datagram_size,
                                                2, 1000);
+                        kfree(max_datagram_size);
+max_dgram_err:
                        if (err < 0)
                                pr_debug("SET_MAX_DATAGRAM_SIZE failed\n");
                }
diff --git a/drivers/net/usb/ipheth.c b/drivers/net/usb/ipheth.c
index 15772b1b6a91..13c1f044b40d 100644
--- a/drivers/net/usb/ipheth.c
+++ b/drivers/net/usb/ipheth.c
@@ -59,6 +59,7 @@
 #define USB_PRODUCT_IPHONE_3G   0x1292
 #define USB_PRODUCT_IPHONE_3GS  0x1294
 #define USB_PRODUCT_IPHONE_4    0x1297
+#define USB_PRODUCT_IPHONE_4_VZW 0x129c
 #define IPHETH_USBINTF_CLASS    255
 #define IPHETH_USBINTF_SUBCLASS 253
@@ -98,6 +99,10 @@ static struct usb_device_id ipheth_table[] = {
                USB_VENDOR_APPLE, USB_PRODUCT_IPHONE_4,
                IPHETH_USBINTF_CLASS, IPHETH_USBINTF_SUBCLASS,
                IPHETH_USBINTF_PROTO) },
+        { USB_DEVICE_AND_INTERFACE_INFO(
+                USB_VENDOR_APPLE, USB_PRODUCT_IPHONE_4_VZW,
+                IPHETH_USBINTF_CLASS, IPHETH_USBINTF_SUBCLASS,
+                IPHETH_USBINTF_PROTO) },
        { }
 };
 MODULE_DEVICE_TABLE(usb, ipheth_table);
diff --git a/drivers/net/via-velocity.c b/drivers/net/via-velocity.c
index deb1eca13c9f..7c5336c5c37f 100644
--- a/drivers/net/via-velocity.c
+++ b/drivers/net/via-velocity.c
@@ -515,10 +515,6 @@ static void velocity_init_cam_filter(struct velocity_info *vptr)
        mac_set_cam_mask(regs, vptr->mCAMmask);
        /* Enable VCAMs */
-        if (test_bit(0, vptr->active_vlans))
-                WORD_REG_BITS_ON(MCFG_RTGOPT, &regs->MCFG);
        for_each_set_bit(vid, vptr->active_vlans, VLAN_N_VID) {
                mac_set_vlan_cam(regs, i, (u8 *) &vid);
                vptr->vCAMmask[i / 8] |= 0x1 << (i % 8);
diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
index 1cbacb389652..0959583feb27 100644
--- a/drivers/net/vmxnet3/vmxnet3_drv.c
+++ b/drivers/net/vmxnet3/vmxnet3_drv.c
@@ -1929,14 +1929,17 @@ static void
 vmxnet3_vlan_rx_add_vid(struct net_device *netdev, u16 vid)
 {
        struct vmxnet3_adapter *adapter = netdev_priv(netdev);
-        u32 *vfTable = adapter->shared->devRead.rxFilterConf.vfTable;
-        unsigned long flags;
-        VMXNET3_SET_VFTABLE_ENTRY(vfTable, vid);
+        if (!(netdev->flags & IFF_PROMISC)) {
-        spin_lock_irqsave(&adapter->cmd_lock, flags);
+                u32 *vfTable = adapter->shared->devRead.rxFilterConf.vfTable;
-        VMXNET3_WRITE_BAR1_REG(adapter, VMXNET3_REG_CMD,
+                unsigned long flags;
-                               VMXNET3_CMD_UPDATE_VLAN_FILTERS);
-        spin_unlock_irqrestore(&adapter->cmd_lock, flags);
+                VMXNET3_SET_VFTABLE_ENTRY(vfTable, vid);
+                spin_lock_irqsave(&adapter->cmd_lock, flags);
+                VMXNET3_WRITE_BAR1_REG(adapter, VMXNET3_REG_CMD,
+                                       VMXNET3_CMD_UPDATE_VLAN_FILTERS);
+                spin_unlock_irqrestore(&adapter->cmd_lock, flags);
+        }
        set_bit(vid, adapter->active_vlans);
 }
@@ -1946,14 +1949,17 @@ static void
 vmxnet3_vlan_rx_kill_vid(struct net_device *netdev, u16 vid)
 {
        struct vmxnet3_adapter *adapter = netdev_priv(netdev);
-        u32 *vfTable = adapter->shared->devRead.rxFilterConf.vfTable;
-        unsigned long flags;
-        VMXNET3_CLEAR_VFTABLE_ENTRY(vfTable, vid);
+        if (!(netdev->flags & IFF_PROMISC)) {
-        spin_lock_irqsave(&adapter->cmd_lock, flags);
+                u32 *vfTable = adapter->shared->devRead.rxFilterConf.vfTable;
-        VMXNET3_WRITE_BAR1_REG(adapter, VMXNET3_REG_CMD,
+                unsigned long flags;
-                               VMXNET3_CMD_UPDATE_VLAN_FILTERS);
-        spin_unlock_irqrestore(&adapter->cmd_lock, flags);
+                VMXNET3_CLEAR_VFTABLE_ENTRY(vfTable, vid);
+                spin_lock_irqsave(&adapter->cmd_lock, flags);
+                VMXNET3_WRITE_BAR1_REG(adapter, VMXNET3_REG_CMD,
+                                       VMXNET3_CMD_UPDATE_VLAN_FILTERS);
+                spin_unlock_irqrestore(&adapter->cmd_lock, flags);
+        }
        clear_bit(vid, adapter->active_vlans);
 }
diff --git a/drivers/net/wireless/ath/ath9k/ar9002_calib.c b/drivers/net/wireless/ath/ath9k/ar9002_calib.c
index 2d4c0910295b..2d394af82171 100644
--- a/drivers/net/wireless/ath/ath9k/ar9002_calib.c
+++ b/drivers/net/wireless/ath/ath9k/ar9002_calib.c
@@ -41,7 +41,8 @@ static bool ar9002_hw_is_cal_supported(struct ath_hw *ah,
        case ADC_DC_CAL:
                /* Run ADC Gain Cal for non-CCK & non 2GHz-HT20 only */
                if (!IS_CHAN_B(chan) &&
-                    !(IS_CHAN_2GHZ(chan) && IS_CHAN_HT20(chan)))
+                    !((IS_CHAN_2GHZ(chan) || IS_CHAN_A_FAST_CLOCK(ah, chan)) &&
+                      IS_CHAN_HT20(chan)))
                        supported = true;
                break;
        }
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h b/drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h
index 2339728a7306..3e69c631ebb4 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h
+++ b/drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h
@@ -1514,7 +1514,7 @@ static const u32 ar9300_2p2_mac_core[][2] = {
        {0x00008258, 0x00000000},
        {0x0000825c, 0x40000000},
        {0x00008260, 0x00080922},
-        {0x00008264, 0x9bc00010},
+        {0x00008264, 0x9d400010},
        {0x00008268, 0xffffffff},
        {0x0000826c, 0x0000ffff},
        {0x00008270, 0x00000000},
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
index c34bef1bf2b0..1b9400371eaf 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
@@ -69,7 +69,7 @@ static int ar9003_hw_power_interpolate(int32_t x,
 static const struct ar9300_eeprom ar9300_default = {
        .eepromVersion = 2,
        .templateVersion = 2,
-        .macAddr = {1, 2, 3, 4, 5, 6},
+        .macAddr = {0, 2, 3, 4, 5, 6},
        .custData = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
                     0, 0, 0, 0, 0, 0, 0, 0, 0, 0},
        .baseEepHeader = {
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.c b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
index 1baca8e4715d..fcafec0605f4 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
@@ -671,7 +671,7 @@ static int ar9003_hw_process_ini(struct ath_hw *ah,
                REG_WRITE_ARRAY(&ah->iniModesAdditional,
                                modesIndex, regWrites);
-        if (AR_SREV_9300(ah))
+        if (AR_SREV_9330(ah))
                REG_WRITE_ARRAY(&ah->iniModesAdditional, 1, regWrites);
        if (AR_SREV_9340(ah) && !ah->is_clk_25mhz)
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index 9098aaad97a9..722967b86cf1 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -2283,7 +2283,11 @@ static void ath9k_set_coverage_class(struct ieee80211_hw *hw, u8 coverage_class)
        mutex_lock(&sc->mutex);
        ah->coverage_class = coverage_class;
+        ath9k_ps_wakeup(sc);
        ath9k_hw_init_global_settings(ah);
+        ath9k_ps_restore(sc);
        mutex_unlock(&sc->mutex);
 }
@@ -2299,6 +2303,12 @@ static void ath9k_flush(struct ieee80211_hw *hw, bool drop)
        mutex_lock(&sc->mutex);
        cancel_delayed_work_sync(&sc->tx_complete_work);
+        if (ah->ah_flags & AH_UNPLUGGED) {
+                ath_dbg(common, ATH_DBG_ANY, "Device has been unplugged!\n");
+                mutex_unlock(&sc->mutex);
+                return;
+        }
        if (sc->sc_flags & SC_OP_INVALID) {
                ath_dbg(common, ATH_DBG_ANY, "Device not present\n");
                mutex_unlock(&sc->mutex);
diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c
index 9a4850154fb2..4c21f8cbdeb5 100644
--- a/drivers/net/wireless/ath/ath9k/recv.c
+++ b/drivers/net/wireless/ath/ath9k/recv.c
@@ -205,14 +205,22 @@ static void ath_rx_remove_buffer(struct ath_softc *sc,
 static void ath_rx_edma_cleanup(struct ath_softc *sc)
 {
+        struct ath_hw *ah = sc->sc_ah;
+        struct ath_common *common = ath9k_hw_common(ah);
        struct ath_buf *bf;
        ath_rx_remove_buffer(sc, ATH9K_RX_QUEUE_LP);
        ath_rx_remove_buffer(sc, ATH9K_RX_QUEUE_HP);
        list_for_each_entry(bf, &sc->rx.rxbuf, list) {
-                if (bf->bf_mpdu)
+                if (bf->bf_mpdu) {
+                        dma_unmap_single(sc->dev, bf->bf_buf_addr,
+                                        common->rx_bufsize,
+                                        DMA_BIDIRECTIONAL);
                        dev_kfree_skb_any(bf->bf_mpdu);
+                        bf->bf_buf_addr = 0;
+                        bf->bf_mpdu = NULL;
+                }
        }
        INIT_LIST_HEAD(&sc->rx.rxbuf);
diff --git a/drivers/net/wireless/ath/carl9170/main.c b/drivers/net/wireless/ath/carl9170/main.c
index 0122930b14c7..0474e6638d21 100644
--- a/drivers/net/wireless/ath/carl9170/main.c
+++ b/drivers/net/wireless/ath/carl9170/main.c
@@ -1066,8 +1066,10 @@ static int carl9170_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
         * the high througput speed in 802.11n networks.
         */
-        if (!is_main_vif(ar, vif))
+        if (!is_main_vif(ar, vif)) {
+                mutex_lock(&ar->mutex);
                goto err_softw;
+        }
        /*
         * While the hardware supports *catch-all* key, for offloading
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index 26f1ab840cc7..e293a7921bf0 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -1632,7 +1632,8 @@ static void handle_irq_beacon(struct b43_wldev *dev)
        u32 cmd, beacon0_valid, beacon1_valid;
        if (!b43_is_mode(wl, NL80211_IFTYPE_AP) &&
-            !b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT))
+            !b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT) &&
+            !b43_is_mode(wl, NL80211_IFTYPE_ADHOC))
                return;
        /* This is the bottom half of the asynchronous beacon update. */
diff --git a/drivers/net/wireless/ipw2x00/ipw2100.c b/drivers/net/wireless/ipw2x00/ipw2100.c
index 3774dd034746..ef9ad79d1bfd 100644
--- a/drivers/net/wireless/ipw2x00/ipw2100.c
+++ b/drivers/net/wireless/ipw2x00/ipw2100.c
@@ -1903,15 +1903,17 @@ static void ipw2100_down(struct ipw2100_priv *priv)
 static int ipw2100_net_init(struct net_device *dev)
 {
        struct ipw2100_priv *priv = libipw_priv(dev);
+        return ipw2100_up(priv, 1);
+}
+static int ipw2100_wdev_init(struct net_device *dev)
+{
+        struct ipw2100_priv *priv = libipw_priv(dev);
        const struct libipw_geo *geo = libipw_get_geo(priv->ieee);
        struct wireless_dev *wdev = &priv->ieee->wdev;
-        int ret;
        int i;
-        ret = ipw2100_up(priv, 1);
-        if (ret)
-                return ret;
        memcpy(wdev->wiphy->perm_addr, priv->mac_addr, ETH_ALEN);
        /* fill-out priv->ieee->bg_band */
@@ -6350,9 +6352,13 @@ static int ipw2100_pci_init_one(struct pci_dev *pci_dev,
                       "Error calling register_netdev.\n");
                goto fail;
        }
+        registered = 1;
+        err = ipw2100_wdev_init(dev);
+        if (err)
+                goto fail;
        mutex_lock(&priv->action_mutex);
-        registered = 1;
        IPW_DEBUG_INFO("%s: Bound to %s\n", dev->name, pci_name(pci_dev));
@@ -6389,7 +6395,8 @@ static int ipw2100_pci_init_one(struct pci_dev *pci_dev,
      fail_unlock:
        mutex_unlock(&priv->action_mutex);
+        wiphy_unregister(priv->ieee->wdev.wiphy);
+        kfree(priv->ieee->bg_band.channels);
      fail:
        if (dev) {
                if (registered)
diff --git a/drivers/net/wireless/ipw2x00/ipw2200.c b/drivers/net/wireless/ipw2x00/ipw2200.c
index 87813c33bdc2..4ffebede5e03 100644
--- a/drivers/net/wireless/ipw2x00/ipw2200.c
+++ b/drivers/net/wireless/ipw2x00/ipw2200.c
@@ -11425,16 +11425,23 @@ static void ipw_bg_down(struct work_struct *work)
 /* Called by register_netdev() */
 static int ipw_net_init(struct net_device *dev)
 {
+        int rc = 0;
+        struct ipw_priv *priv = libipw_priv(dev);
+        mutex_lock(&priv->mutex);
+        if (ipw_up(priv))
+                rc = -EIO;
+        mutex_unlock(&priv->mutex);
+        return rc;
+}
+static int ipw_wdev_init(struct net_device *dev)
+{
        int i, rc = 0;
        struct ipw_priv *priv = libipw_priv(dev);
        const struct libipw_geo *geo = libipw_get_geo(priv->ieee);
        struct wireless_dev *wdev = &priv->ieee->wdev;
-        mutex_lock(&priv->mutex);
-        if (ipw_up(priv)) {
-                rc = -EIO;
-                goto out;
-        }
        memcpy(wdev->wiphy->perm_addr, priv->mac_addr, ETH_ALEN);
@@ -11519,13 +11526,9 @@ static int ipw_net_init(struct net_device *dev)
        set_wiphy_dev(wdev->wiphy, &priv->pci_dev->dev);
        /* With that information in place, we can now register the wiphy... */
-        if (wiphy_register(wdev->wiphy)) {
+        if (wiphy_register(wdev->wiphy))
                rc = -EIO;
-                goto out;
-        }
 out:
-        mutex_unlock(&priv->mutex);
        return rc;
 }
@@ -11832,14 +11835,22 @@ static int __devinit ipw_pci_probe(struct pci_dev *pdev,
                goto out_remove_sysfs;
        }
+        err = ipw_wdev_init(net_dev);
+        if (err) {
+                IPW_ERROR("failed to register wireless device\n");
+                goto out_unregister_netdev;
+        }
 #ifdef CONFIG_IPW2200_PROMISCUOUS
        if (rtap_iface) {
                err = ipw_prom_alloc(priv);
                if (err) {
                        IPW_ERROR("Failed to register promiscuous network "
                                  "device (error %d).\n", err);
-                        unregister_netdev(priv->net_dev);
+                        wiphy_unregister(priv->ieee->wdev.wiphy);
-                        goto out_remove_sysfs;
+                        kfree(priv->ieee->a_band.channels);
+                        kfree(priv->ieee->bg_band.channels);
+                        goto out_unregister_netdev;
                }
        }
 #endif
@@ -11851,6 +11862,8 @@ static int __devinit ipw_pci_probe(struct pci_dev *pdev,
        return 0;
+      out_unregister_netdev:
+        unregister_netdev(priv->net_dev);
      out_remove_sysfs:
        sysfs_remove_group(&pdev->dev.kobj, &ipw_attribute_group);
      out_release_irq:
diff --git a/drivers/net/wireless/iwlegacy/iwl-3945-rs.c b/drivers/net/wireless/iwlegacy/iwl-3945-rs.c
index 977bd2477c6a..164bcae821f8 100644
--- a/drivers/net/wireless/iwlegacy/iwl-3945-rs.c
+++ b/drivers/net/wireless/iwlegacy/iwl-3945-rs.c
@@ -822,12 +822,15 @@ static void iwl3945_rs_get_rate(void *priv_r, struct ieee80211_sta *sta,
 out:
-        rs_sta->last_txrate_idx = index;
+        if (sband->band == IEEE80211_BAND_5GHZ) {
-        if (sband->band == IEEE80211_BAND_5GHZ)
+                if (WARN_ON_ONCE(index < IWL_FIRST_OFDM_RATE))
-                info->control.rates[0].idx = rs_sta->last_txrate_idx -
+                        index = IWL_FIRST_OFDM_RATE;
-                                IWL_FIRST_OFDM_RATE;
+                rs_sta->last_txrate_idx = index;
-        else
+                info->control.rates[0].idx = index - IWL_FIRST_OFDM_RATE;
+        } else {
+                rs_sta->last_txrate_idx = index;
                info->control.rates[0].idx = rs_sta->last_txrate_idx;
+        }
        IWL_DEBUG_RATE(priv, "leave: %d\n", index);
 }
diff --git a/drivers/net/wireless/iwlegacy/iwl-core.c b/drivers/net/wireless/iwlegacy/iwl-core.c
index 35cd2537e7fd..e5971fe9d169 100644
--- a/drivers/net/wireless/iwlegacy/iwl-core.c
+++ b/drivers/net/wireless/iwlegacy/iwl-core.c
@@ -937,7 +937,7 @@ void iwl_legacy_irq_handle_error(struct iwl_priv *priv)
                                        &priv->contexts[IWL_RXON_CTX_BSS]);
 #endif
-        wake_up_interruptible(&priv->wait_command_queue);
+        wake_up(&priv->wait_command_queue);
        /* Keep the restart process from trying to send host
         * commands by clearing the INIT status bit */
@@ -1746,7 +1746,7 @@ int iwl_legacy_force_reset(struct iwl_priv *priv, bool external)
        /* Set the FW error flag -- cleared on iwl_down */
        set_bit(STATUS_FW_ERROR, &priv->status);
-        wake_up_interruptible(&priv->wait_command_queue);
+        wake_up(&priv->wait_command_queue);
        /*
         * Keep the restart process from trying to send host
         * commands by clearing the INIT status bit
diff --git a/drivers/net/wireless/iwlegacy/iwl-hcmd.c b/drivers/net/wireless/iwlegacy/iwl-hcmd.c
index 62b4b09122cb..ce1fc9feb61f 100644
--- a/drivers/net/wireless/iwlegacy/iwl-hcmd.c
+++ b/drivers/net/wireless/iwlegacy/iwl-hcmd.c
@@ -167,7 +167,7 @@ int iwl_legacy_send_cmd_sync(struct iwl_priv *priv, struct iwl_host_cmd *cmd)
                goto out;
        }
-        ret = wait_event_interruptible_timeout(priv->wait_command_queue,
+        ret = wait_event_timeout(priv->wait_command_queue,
                        !test_bit(STATUS_HCMD_ACTIVE, &priv->status),
                        HOST_COMPLETE_TIMEOUT);
        if (!ret) {
diff --git a/drivers/net/wireless/iwlegacy/iwl-tx.c b/drivers/net/wireless/iwlegacy/iwl-tx.c
index 4fff995c6f3e..ef9e268bf8a0 100644
--- a/drivers/net/wireless/iwlegacy/iwl-tx.c
+++ b/drivers/net/wireless/iwlegacy/iwl-tx.c
@@ -625,6 +625,8 @@ iwl_legacy_tx_cmd_complete(struct iwl_priv *priv, struct iwl_rx_mem_buffer *rxb)
        cmd = txq->cmd[cmd_index];
        meta = &txq->meta[cmd_index];
+        txq->time_stamp = jiffies;
        pci_unmap_single(priv->pci_dev,
                         dma_unmap_addr(meta, mapping),
                         dma_unmap_len(meta, len),
@@ -645,7 +647,7 @@ iwl_legacy_tx_cmd_complete(struct iwl_priv *priv, struct iwl_rx_mem_buffer *rxb)
                clear_bit(STATUS_HCMD_ACTIVE, &priv->status);
                IWL_DEBUG_INFO(priv, "Clearing HCMD_ACTIVE for command %s\n",
                               iwl_legacy_get_cmd_string(cmd->hdr.cmd));
-                wake_up_interruptible(&priv->wait_command_queue);
+                wake_up(&priv->wait_command_queue);
        }
        /* Mark as unmapped */
diff --git a/drivers/net/wireless/iwlegacy/iwl3945-base.c b/drivers/net/wireless/iwlegacy/iwl3945-base.c
index 795826a014ed..66ee15629a76 100644
--- a/drivers/net/wireless/iwlegacy/iwl3945-base.c
+++ b/drivers/net/wireless/iwlegacy/iwl3945-base.c
@@ -841,7 +841,7 @@ static void iwl3945_rx_card_state_notif(struct iwl_priv *priv,
                wiphy_rfkill_set_hw_state(priv->hw->wiphy,
                                test_bit(STATUS_RF_KILL_HW, &priv->status));
        else
-                wake_up_interruptible(&priv->wait_command_queue);
+                wake_up(&priv->wait_command_queue);
 }
 /**
@@ -2269,7 +2269,7 @@ static void iwl3945_alive_start(struct iwl_priv *priv)
        iwl3945_reg_txpower_periodic(priv);
        IWL_DEBUG_INFO(priv, "ALIVE processing complete.\n");
-        wake_up_interruptible(&priv->wait_command_queue);
+        wake_up(&priv->wait_command_queue);
        return;
@@ -2300,7 +2300,7 @@ static void __iwl3945_down(struct iwl_priv *priv)
        iwl_legacy_clear_driver_stations(priv);
        /* Unblock any waiting calls */
-        wake_up_interruptible_all(&priv->wait_command_queue);
+        wake_up_all(&priv->wait_command_queue);
        /* Wipe out the EXIT_PENDING status bit if we are not actually
         * exiting the module */
@@ -2853,7 +2853,7 @@ static int iwl3945_mac_start(struct ieee80211_hw *hw)
        /* Wait for START_ALIVE from ucode. Otherwise callbacks from
         * mac80211 will not be run successfully. */
-        ret = wait_event_interruptible_timeout(priv->wait_command_queue,
+        ret = wait_event_timeout(priv->wait_command_queue,
                        test_bit(STATUS_READY, &priv->status),
                        UCODE_READY_TIMEOUT);
        if (!ret) {
diff --git a/drivers/net/wireless/iwlegacy/iwl4965-base.c b/drivers/net/wireless/iwlegacy/iwl4965-base.c
index 14334668034e..aa0c2539761e 100644
--- a/drivers/net/wireless/iwlegacy/iwl4965-base.c
+++ b/drivers/net/wireless/iwlegacy/iwl4965-base.c
@@ -576,7 +576,7 @@ static void iwl4965_rx_card_state_notif(struct iwl_priv *priv,
                wiphy_rfkill_set_hw_state(priv->hw->wiphy,
                        test_bit(STATUS_RF_KILL_HW, &priv->status));
        else
-                wake_up_interruptible(&priv->wait_command_queue);
+                wake_up(&priv->wait_command_queue);
 }
 /**
@@ -926,7 +926,7 @@ static void iwl4965_irq_tasklet(struct iwl_priv *priv)
                handled |= CSR_INT_BIT_FH_TX;
                /* Wake up uCode load routine, now that load is complete */
                priv->ucode_write_complete = 1;
-                wake_up_interruptible(&priv->wait_command_queue);
+                wake_up(&priv->wait_command_queue);
        }
        if (inta & ~handled) {
@@ -1795,7 +1795,7 @@ static void iwl4965_alive_start(struct iwl_priv *priv)
        iwl4965_rf_kill_ct_config(priv);
        IWL_DEBUG_INFO(priv, "ALIVE processing complete.\n");
-        wake_up_interruptible(&priv->wait_command_queue);
+        wake_up(&priv->wait_command_queue);
        iwl_legacy_power_update_mode(priv, true);
        IWL_DEBUG_INFO(priv, "Updated power mode\n");
@@ -1828,7 +1828,7 @@ static void __iwl4965_down(struct iwl_priv *priv)
        iwl_legacy_clear_driver_stations(priv);
        /* Unblock any waiting calls */
-        wake_up_interruptible_all(&priv->wait_command_queue);
+        wake_up_all(&priv->wait_command_queue);
        /* Wipe out the EXIT_PENDING status bit if we are not actually
         * exiting the module */
@@ -2266,7 +2266,7 @@ int iwl4965_mac_start(struct ieee80211_hw *hw)
        /* Wait for START_ALIVE from Run Time ucode. Otherwise callbacks from
         * mac80211 will not be run successfully. */
-        ret = wait_event_interruptible_timeout(priv->wait_command_queue,
+        ret = wait_event_timeout(priv->wait_command_queue,
                        test_bit(STATUS_READY, &priv->status),
                        UCODE_READY_TIMEOUT);
        if (!ret) {
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-ucode.c b/drivers/net/wireless/iwlwifi/iwl-agn-ucode.c
index a895a099d086..56211006a182 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-ucode.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-ucode.c
@@ -167,7 +167,7 @@ static int iwlagn_set_temperature_offset_calib(struct iwl_priv *priv)
        memset(&cmd, 0, sizeof(cmd));
        iwl_set_calib_hdr(&cmd.hdr, IWL_PHY_CALIBRATE_TEMP_OFFSET_CMD);
-        memcpy(&cmd.radio_sensor_offset, offset_calib, sizeof(offset_calib));
+        memcpy(&cmd.radio_sensor_offset, offset_calib, sizeof(*offset_calib));
        if (!(cmd.radio_sensor_offset))
                cmd.radio_sensor_offset = DEFAULT_RADIO_SENSOR_OFFSET;
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index b0ae4de7f083..f9c3cd95d614 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -2140,7 +2140,12 @@ static int iwl_mac_setup_register(struct iwl_priv *priv,
                    IEEE80211_HW_SPECTRUM_MGMT |
                    IEEE80211_HW_REPORTS_TX_ACK_STATUS;
+        /*
+         * Including the following line will crash some AP's.  This
+         * workaround removes the stimulus which causes the crash until
+         * the AP software can be fixed.
        hw->max_tx_aggregation_subframes = LINK_QUAL_AGG_FRAME_LIMIT_DEF;
+         */
        hw->flags |= IEEE80211_HW_SUPPORTS_PS |
                     IEEE80211_HW_SUPPORTS_DYNAMIC_PS;
diff --git a/drivers/net/wireless/iwlwifi/iwl-pci.c b/drivers/net/wireless/iwlwifi/iwl-pci.c
index 69d4ec467dca..2fdbffa079c1 100644
--- a/drivers/net/wireless/iwlwifi/iwl-pci.c
+++ b/drivers/net/wireless/iwlwifi/iwl-pci.c
@@ -478,27 +478,22 @@ out_no_pci:
        return err;
 }
-static void iwl_pci_down(struct iwl_bus *bus)
-{
-        struct iwl_pci_bus *pci_bus = (struct iwl_pci_bus *) bus->bus_specific;
-        pci_disable_msi(pci_bus->pci_dev);
-        pci_iounmap(pci_bus->pci_dev, pci_bus->hw_base);
-        pci_release_regions(pci_bus->pci_dev);
-        pci_disable_device(pci_bus->pci_dev);
-        pci_set_drvdata(pci_bus->pci_dev, NULL);
-        kfree(bus);
-}
 static void __devexit iwl_pci_remove(struct pci_dev *pdev)
 {
        struct iwl_priv *priv = pci_get_drvdata(pdev);
-        void *bus_specific = priv->bus->bus_specific;
+        struct iwl_bus *bus = priv->bus;
+        struct iwl_pci_bus *pci_bus = IWL_BUS_GET_PCI_BUS(bus);
+        struct pci_dev *pci_dev = IWL_BUS_GET_PCI_DEV(bus);
        iwl_remove(priv);
-        iwl_pci_down(bus_specific);
+        pci_disable_msi(pci_dev);
+        pci_iounmap(pci_dev, pci_bus->hw_base);
+        pci_release_regions(pci_dev);
+        pci_disable_device(pci_dev);
+        pci_set_drvdata(pci_dev, NULL);
+        kfree(bus);
 }
 #ifdef CONFIG_PM
diff --git a/drivers/net/wireless/iwlwifi/iwl-scan.c b/drivers/net/wireless/iwlwifi/iwl-scan.c
index dd6937e97055..77e528f5db88 100644
--- a/drivers/net/wireless/iwlwifi/iwl-scan.c
+++ b/drivers/net/wireless/iwlwifi/iwl-scan.c
@@ -405,31 +405,33 @@ int iwl_mac_hw_scan(struct ieee80211_hw *hw,
        mutex_lock(&priv->mutex);
-        if (test_bit(STATUS_SCANNING, &priv->status) &&
-            priv->scan_type != IWL_SCAN_NORMAL) {
-                IWL_DEBUG_SCAN(priv, "Scan already in progress.\n");
-                ret = -EAGAIN;
-                goto out_unlock;
-        }
-        /* mac80211 will only ask for one band at a time */
-        priv->scan_request = req;
-        priv->scan_vif = vif;
        /*
         * If an internal scan is in progress, just set
         * up the scan_request as per above.
         */
        if (priv->scan_type != IWL_SCAN_NORMAL) {
-                IWL_DEBUG_SCAN(priv, "SCAN request during internal scan\n");
+                IWL_DEBUG_SCAN(priv,
+                               "SCAN request during internal scan - defer\n");
+                priv->scan_request = req;
+                priv->scan_vif = vif;
                ret = 0;
-        } else
+        } else {
+                priv->scan_request = req;
+                priv->scan_vif = vif;
+                /*
+                 * mac80211 will only ask for one band at a time
+                 * so using channels[0] here is ok
+                 */
                ret = iwl_scan_initiate(priv, vif, IWL_SCAN_NORMAL,
                                        req->channels[0]->band);
+                if (ret) {
+                        priv->scan_request = NULL;
+                        priv->scan_vif = NULL;
+                }
+        }
        IWL_DEBUG_MAC80211(priv, "leave\n");
-out_unlock:
        mutex_unlock(&priv->mutex);
        return ret;
diff --git a/drivers/net/wireless/iwlwifi/iwl-trans-tx-pcie.c b/drivers/net/wireless/iwlwifi/iwl-trans-tx-pcie.c
index a6b2b1db0b1d..222d410c586e 100644
--- a/drivers/net/wireless/iwlwifi/iwl-trans-tx-pcie.c
+++ b/drivers/net/wireless/iwlwifi/iwl-trans-tx-pcie.c
@@ -771,6 +771,8 @@ void iwl_tx_cmd_complete(struct iwl_priv *priv, struct iwl_rx_mem_buffer *rxb)
        cmd = txq->cmd[cmd_index];
        meta = &txq->meta[cmd_index];
+        txq->time_stamp = jiffies;
        iwlagn_unmap_tfd(priv, meta, &txq->tfds[index], DMA_BIDIRECTIONAL);
        /* Input error checking is done when commands are added to queue. */
diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c b/drivers/net/wireless/rt2x00/rt2800lib.c
index ef67f6786a84..0019dfd8fb01 100644
--- a/drivers/net/wireless/rt2x00/rt2800lib.c
+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
@@ -3697,14 +3697,15 @@ static void rt2800_efuse_read(struct rt2x00_dev *rt2x00dev, unsigned int i)
        rt2800_regbusy_read(rt2x00dev, EFUSE_CTRL, EFUSE_CTRL_KICK, &reg);
        /* Apparently the data is read from end to start */
-        rt2800_register_read_lock(rt2x00dev, EFUSE_DATA3,
+        rt2800_register_read_lock(rt2x00dev, EFUSE_DATA3, &reg);
-                                        (u32 *)&rt2x00dev->eeprom[i]);
+        /* The returned value is in CPU order, but eeprom is le */
-        rt2800_register_read_lock(rt2x00dev, EFUSE_DATA2,
+        rt2x00dev->eeprom[i] = cpu_to_le32(reg);
-                                        (u32 *)&rt2x00dev->eeprom[i + 2]);
+        rt2800_register_read_lock(rt2x00dev, EFUSE_DATA2, &reg);
-        rt2800_register_read_lock(rt2x00dev, EFUSE_DATA1,
+        *(u32 *)&rt2x00dev->eeprom[i + 2] = cpu_to_le32(reg);
-                                        (u32 *)&rt2x00dev->eeprom[i + 4]);
+        rt2800_register_read_lock(rt2x00dev, EFUSE_DATA1, &reg);
-        rt2800_register_read_lock(rt2x00dev, EFUSE_DATA0,
+        *(u32 *)&rt2x00dev->eeprom[i + 4] = cpu_to_le32(reg);
-                                        (u32 *)&rt2x00dev->eeprom[i + 6]);
+        rt2800_register_read_lock(rt2x00dev, EFUSE_DATA0, &reg);
+        *(u32 *)&rt2x00dev->eeprom[i + 6] = cpu_to_le32(reg);
        mutex_unlock(&rt2x00dev->csr_mutex);
 }
@@ -3870,19 +3871,23 @@ int rt2800_init_eeprom(struct rt2x00_dev *rt2x00dev)
                return -ENODEV;
        }
-        if (!rt2x00_rf(rt2x00dev, RF2820) &&
+        switch (rt2x00dev->chip.rf) {
-            !rt2x00_rf(rt2x00dev, RF2850) &&
+        case RF2820:
-            !rt2x00_rf(rt2x00dev, RF2720) &&
+        case RF2850:
-            !rt2x00_rf(rt2x00dev, RF2750) &&
+        case RF2720:
-            !rt2x00_rf(rt2x00dev, RF3020) &&
+        case RF2750:
-            !rt2x00_rf(rt2x00dev, RF2020) &&
+        case RF3020:
-            !rt2x00_rf(rt2x00dev, RF3021) &&
+        case RF2020:
-            !rt2x00_rf(rt2x00dev, RF3022) &&
+        case RF3021:
-            !rt2x00_rf(rt2x00dev, RF3052) &&
+        case RF3022:
-            !rt2x00_rf(rt2x00dev, RF3320) &&
+        case RF3052:
-            !rt2x00_rf(rt2x00dev, RF5370) &&
+        case RF3320:
-            !rt2x00_rf(rt2x00dev, RF5390)) {
+        case RF5370:
-                ERROR(rt2x00dev, "Invalid RF chipset detected.\n");
+        case RF5390:
+                break;
+        default:
+                ERROR(rt2x00dev, "Invalid RF chipset 0x%x detected.\n",
+                      rt2x00dev->chip.rf);
                return -ENODEV;
        }
diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c
index 939563162fb3..dbf501ca317f 100644
--- a/drivers/net/wireless/rt2x00/rt2800usb.c
+++ b/drivers/net/wireless/rt2x00/rt2800usb.c
@@ -464,6 +464,15 @@ static bool rt2800usb_txdone_entry_check(struct queue_entry *entry, u32 reg)
        int wcid, ack, pid;
        int tx_wcid, tx_ack, tx_pid;
+        if (test_bit(ENTRY_OWNER_DEVICE_DATA, &entry->flags) ||
+            !test_bit(ENTRY_DATA_STATUS_PENDING, &entry->flags)) {
+                WARNING(entry->queue->rt2x00dev,
+                        "Data pending for entry %u in queue %u\n",
+                        entry->entry_idx, entry->queue->qid);
+                cond_resched();
+                return false;
+        }
        wcid    = rt2x00_get_field32(reg, TX_STA_FIFO_WCID);
        ack     = rt2x00_get_field32(reg, TX_STA_FIFO_TX_ACK_REQUIRED);
        pid     = rt2x00_get_field32(reg, TX_STA_FIFO_PID_TYPE);
@@ -529,12 +538,11 @@ static void rt2800usb_txdone(struct rt2x00_dev *rt2x00dev)
                        entry = rt2x00queue_get_entry(queue, Q_INDEX_DONE);
                        if (rt2800usb_txdone_entry_check(entry, reg))
                                break;
+                        entry = NULL;
                }
-                if (!entry || rt2x00queue_empty(queue))
+                if (entry)
-                        break;
+                        rt2800_txdone_entry(entry, reg);
-                rt2800_txdone_entry(entry, reg);
        }
 }
@@ -558,8 +566,10 @@ static void rt2800usb_work_txdone(struct work_struct *work)
                while (!rt2x00queue_empty(queue)) {
                        entry = rt2x00queue_get_entry(queue, Q_INDEX_DONE);
-                        if (test_bit(ENTRY_OWNER_DEVICE_DATA, &entry->flags))
+                        if (test_bit(ENTRY_OWNER_DEVICE_DATA, &entry->flags) ||
+                            !test_bit(ENTRY_DATA_STATUS_PENDING, &entry->flags))
                                break;
                        if (test_bit(ENTRY_DATA_IO_FAILED, &entry->flags))
                                rt2x00lib_txdone_noinfo(entry, TXDONE_FAILURE);
                        else if (rt2x00queue_status_timeout(entry))
diff --git a/drivers/net/wireless/rt2x00/rt2x00usb.c b/drivers/net/wireless/rt2x00/rt2x00usb.c
index b6b4542c2460..1e31050dafc9 100644
--- a/drivers/net/wireless/rt2x00/rt2x00usb.c
+++ b/drivers/net/wireless/rt2x00/rt2x00usb.c
@@ -262,23 +262,20 @@ static void rt2x00usb_interrupt_txdone(struct urb *urb)
        struct queue_entry *entry = (struct queue_entry *)urb->context;
        struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
-        if (!test_and_clear_bit(ENTRY_OWNER_DEVICE_DATA, &entry->flags))
+        if (!test_bit(ENTRY_OWNER_DEVICE_DATA, &entry->flags))
                return;
-        if (rt2x00dev->ops->lib->tx_dma_done)
-                rt2x00dev->ops->lib->tx_dma_done(entry);
-        /*
-         * Report the frame as DMA done
-         */
-        rt2x00lib_dmadone(entry);
        /*
         * Check if the frame was correctly uploaded
         */
        if (urb->status)
                set_bit(ENTRY_DATA_IO_FAILED, &entry->flags);
+        /*
+         * Report the frame as DMA done
+         */
+        rt2x00lib_dmadone(entry);
+        if (rt2x00dev->ops->lib->tx_dma_done)
+                rt2x00dev->ops->lib->tx_dma_done(entry);
        /*
         * Schedule the delayed work for reading the TX status
         * from the device.
@@ -874,18 +871,8 @@ int rt2x00usb_suspend(struct usb_interface *usb_intf, pm_message_t state)
 {
        struct ieee80211_hw *hw = usb_get_intfdata(usb_intf);
        struct rt2x00_dev *rt2x00dev = hw->priv;
-        int retval;
-        retval = rt2x00lib_suspend(rt2x00dev, state);
-        if (retval)
-                return retval;
-        /*
+        return rt2x00lib_suspend(rt2x00dev, state);
-         * Decrease usbdev refcount.
-         */
-        usb_put_dev(interface_to_usbdev(usb_intf));
-        return 0;
 }
 EXPORT_SYMBOL_GPL(rt2x00usb_suspend);
@@ -894,8 +881,6 @@ int rt2x00usb_resume(struct usb_interface *usb_intf)
        struct ieee80211_hw *hw = usb_get_intfdata(usb_intf);
        struct rt2x00_dev *rt2x00dev = hw->priv;
-        usb_get_dev(interface_to_usbdev(usb_intf));
        return rt2x00lib_resume(rt2x00dev);
 }
 EXPORT_SYMBOL_GPL(rt2x00usb_resume);
diff --git a/drivers/net/wireless/rtlwifi/core.c b/drivers/net/wireless/rtlwifi/core.c
index 1bdc1aa305c0..04c4e9eb6ee6 100644
--- a/drivers/net/wireless/rtlwifi/core.c
+++ b/drivers/net/wireless/rtlwifi/core.c
@@ -610,6 +610,11 @@ static void rtl_op_bss_info_changed(struct ieee80211_hw *hw,
                        mac->link_state = MAC80211_NOLINK;
                        memset(mac->bssid, 0, 6);
+                        /* reset sec info */
+                        rtl_cam_reset_sec_info(hw);
+                        rtl_cam_reset_all_entry(hw);
                        mac->vendor = PEER_UNKNOWN;
                        RT_TRACE(rtlpriv, COMP_MAC80211, DBG_DMESG,
@@ -1063,6 +1068,9 @@ static int rtl_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
                 *or clear all entry here.
                 */
                rtl_cam_delete_one_entry(hw, mac_addr, key_idx);
+                rtl_cam_reset_sec_info(hw);
                break;
        default:
                RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c b/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c
index 906e7aa55bc3..3e52a5496224 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c
@@ -549,15 +549,16 @@ void rtl92cu_tx_fill_desc(struct ieee80211_hw *hw,
                               (tcb_desc->rts_use_shortpreamble ? 1 : 0)
                               : (tcb_desc->rts_use_shortgi ? 1 : 0)));
        if (mac->bw_40) {
-                if (tcb_desc->packet_bw) {
+                if (rate_flag & IEEE80211_TX_RC_DUP_DATA) {
                        SET_TX_DESC_DATA_BW(txdesc, 1);
                        SET_TX_DESC_DATA_SC(txdesc, 3);
+                } else if(rate_flag & IEEE80211_TX_RC_40_MHZ_WIDTH){
+                        SET_TX_DESC_DATA_BW(txdesc, 1);
+                        SET_TX_DESC_DATA_SC(txdesc, mac->cur_40_prime_sc);
                } else {
                        SET_TX_DESC_DATA_BW(txdesc, 0);
-                                if (rate_flag & IEEE80211_TX_RC_DUP_DATA)
+                        SET_TX_DESC_DATA_SC(txdesc, 0);
-                                        SET_TX_DESC_DATA_SC(txdesc,
+                }
-                                                          mac->cur_40_prime_sc);
-                        }
        } else {
                SET_TX_DESC_DATA_BW(txdesc, 0);
                SET_TX_DESC_DATA_SC(txdesc, 0);
diff --git a/drivers/net/wireless/rtlwifi/usb.c b/drivers/net/wireless/rtlwifi/usb.c
index 8b1cef0ffde6..4bf3cf457ef0 100644
--- a/drivers/net/wireless/rtlwifi/usb.c
+++ b/drivers/net/wireless/rtlwifi/usb.c
@@ -863,6 +863,7 @@ static void _rtl_usb_tx_preprocess(struct ieee80211_hw *hw, struct sk_buff *skb,
        u8 tid = 0;
        u16 seq_number = 0;
+        memset(&tcb_desc, 0, sizeof(struct rtl_tcb_desc));
        if (ieee80211_is_auth(fc)) {
                RT_TRACE(rtlpriv, COMP_SEND, DBG_DMESG, ("MAC80211_LINKING\n"));
                rtl_ips_nic_on(hw);
diff --git a/drivers/net/wireless/wl12xx/acx.c b/drivers/net/wireless/wl12xx/acx.c
index 7e33f1f4f3d4..34f6ab53e519 100644
--- a/drivers/net/wireless/wl12xx/acx.c
+++ b/drivers/net/wireless/wl12xx/acx.c
@@ -77,8 +77,6 @@ int wl1271_acx_sleep_auth(struct wl1271 *wl, u8 sleep_auth)
        auth->sleep_auth = sleep_auth;
        ret = wl1271_cmd_configure(wl, ACX_SLEEP_AUTH, auth, sizeof(*auth));
-        if (ret < 0)
-                return ret;
 out:
        kfree(auth);
@@ -624,10 +622,8 @@ int wl1271_acx_cca_threshold(struct wl1271 *wl)
        ret = wl1271_cmd_configure(wl, ACX_CCA_THRESHOLD,
                                   detection, sizeof(*detection));
-        if (ret < 0) {
+        if (ret < 0)
                wl1271_warning("failed to set cca threshold: %d", ret);
-                return ret;
-        }
 out:
        kfree(detection);
diff --git a/drivers/net/wireless/wl12xx/main.c b/drivers/net/wireless/wl12xx/main.c
index e58c22d21e39..b70ae40ad660 100644
--- a/drivers/net/wireless/wl12xx/main.c
+++ b/drivers/net/wireless/wl12xx/main.c
@@ -4283,6 +4283,7 @@ int wl1271_init_ieee80211(struct wl1271 *wl)
        wl->hw->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
                BIT(NL80211_IFTYPE_ADHOC) | BIT(NL80211_IFTYPE_AP);
        wl->hw->wiphy->max_scan_ssids = 1;
+        wl->hw->wiphy->max_sched_scan_ssids = 1;
        /*
         * Maximum length of elements in scanning probe request templates
         * should be the maximum length possible for a template, without
diff --git a/drivers/net/wireless/wl12xx/sdio.c b/drivers/net/wireless/wl12xx/sdio.c
index 5cf18c2c23f0..fb1fd5af75ea 100644
--- a/drivers/net/wireless/wl12xx/sdio.c
+++ b/drivers/net/wireless/wl12xx/sdio.c
@@ -164,7 +164,7 @@ static int wl1271_sdio_power_on(struct wl1271 *wl)
        /* If enabled, tell runtime PM not to power off the card */
        if (pm_runtime_enabled(&func->dev)) {
                ret = pm_runtime_get_sync(&func->dev);
-                if (ret)
+                if (ret < 0)
                        goto out;
        } else {
                /* Runtime PM is disabled: power up the card manually */
diff --git a/drivers/net/wireless/wl12xx/testmode.c b/drivers/net/wireless/wl12xx/testmode.c
index 5d5e1ef87206..4ae8effaee22 100644
--- a/drivers/net/wireless/wl12xx/testmode.c
+++ b/drivers/net/wireless/wl12xx/testmode.c
@@ -36,7 +36,6 @@ enum wl1271_tm_commands {
        WL1271_TM_CMD_TEST,
        WL1271_TM_CMD_INTERROGATE,
        WL1271_TM_CMD_CONFIGURE,
-        WL1271_TM_CMD_NVS_PUSH,
        WL1271_TM_CMD_SET_PLT_MODE,
        WL1271_TM_CMD_RECOVER,
@@ -139,12 +138,15 @@ static int wl1271_tm_cmd_interrogate(struct wl1271 *wl, struct nlattr *tb[])
        if (ret < 0) {
                wl1271_warning("testmode cmd interrogate failed: %d", ret);
+                kfree(cmd);
                return ret;
        }
        skb = cfg80211_testmode_alloc_reply_skb(wl->hw->wiphy, sizeof(*cmd));
-        if (!skb)
+        if (!skb) {
+                kfree(cmd);
                return -ENOMEM;
+        }
        NLA_PUT(skb, WL1271_TM_ATTR_DATA, sizeof(*cmd), cmd);
@@ -187,48 +189,6 @@ static int wl1271_tm_cmd_configure(struct wl1271 *wl, struct nlattr *tb[])
        return 0;
 }
-static int wl1271_tm_cmd_nvs_push(struct wl1271 *wl, struct nlattr *tb[])
-{
-        int ret = 0;
-        size_t len;
-        void *buf;
-        wl1271_debug(DEBUG_TESTMODE, "testmode cmd nvs push");
-        if (!tb[WL1271_TM_ATTR_DATA])
-                return -EINVAL;
-        buf = nla_data(tb[WL1271_TM_ATTR_DATA]);
-        len = nla_len(tb[WL1271_TM_ATTR_DATA]);
-        mutex_lock(&wl->mutex);
-        kfree(wl->nvs);
-        if ((wl->chip.id == CHIP_ID_1283_PG20) &&
-            (len != sizeof(struct wl128x_nvs_file)))
-                return -EINVAL;
-        else if (len != sizeof(struct wl1271_nvs_file))
-                return -EINVAL;
-        wl->nvs = kzalloc(len, GFP_KERNEL);
-        if (!wl->nvs) {
-                wl1271_error("could not allocate memory for the nvs file");
-                ret = -ENOMEM;
-                goto out;
-        }
-        memcpy(wl->nvs, buf, len);
-        wl->nvs_len = len;
-        wl1271_debug(DEBUG_TESTMODE, "testmode pushed nvs");
-out:
-        mutex_unlock(&wl->mutex);
-        return ret;
-}
 static int wl1271_tm_cmd_set_plt_mode(struct wl1271 *wl, struct nlattr *tb[])
 {
        u32 val;
@@ -285,8 +245,6 @@ int wl1271_tm_cmd(struct ieee80211_hw *hw, void *data, int len)
                return wl1271_tm_cmd_interrogate(wl, tb);
        case WL1271_TM_CMD_CONFIGURE:
                return wl1271_tm_cmd_configure(wl, tb);
-        case WL1271_TM_CMD_NVS_PUSH:
-                return wl1271_tm_cmd_nvs_push(wl, tb);
        case WL1271_TM_CMD_SET_PLT_MODE:
                return wl1271_tm_cmd_set_plt_mode(wl, tb);
        case WL1271_TM_CMD_RECOVER:
diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
index 0ca86f9ec4ed..182562952c79 100644
--- a/drivers/net/xen-netback/interface.c
+++ b/drivers/net/xen-netback/interface.c
@@ -327,12 +327,12 @@ int xenvif_connect(struct xenvif *vif, unsigned long tx_ring_ref,
        xenvif_get(vif);
        rtnl_lock();
-        if (netif_running(vif->dev))
-                xenvif_up(vif);
        if (!vif->can_sg && vif->dev->mtu > ETH_DATA_LEN)
                dev_set_mtu(vif->dev, ETH_DATA_LEN);
        netdev_update_features(vif->dev);
        netif_carrier_on(vif->dev);
+        if (netif_running(vif->dev))
+                xenvif_up(vif);
        rtnl_unlock();
        return 0;