144 files changed, 2360 insertions, 1325 deletions
diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c
index 187b1b7772ef..4ced59436558 100644
--- a/drivers/net/bonding/bond_3ad.c
+++ b/drivers/net/bonding/bond_3ad.c
@@ -2201,20 +2201,25 @@ void bond_3ad_adapter_speed_changed(struct slave *slave)
        port = &(SLAVE_AD_INFO(slave).port);
-        // if slave is null, the whole port is not initialized
+        /* if slave is null, the whole port is not initialized */
        if (!port->slave) {
                pr_warning("Warning: %s: speed changed for uninitialized port on %s\n",
                           slave->bond->dev->name, slave->dev->name);
                return;
        }
+        __get_state_machine_lock(port);
        port->actor_admin_port_key &= ~AD_SPEED_KEY_BITS;
        port->actor_oper_port_key = port->actor_admin_port_key |=
                (__get_link_speed(port) << 1);
        pr_debug("Port %d changed speed\n", port->actor_port_number);
-        // there is no need to reselect a new aggregator, just signal the
+        /* there is no need to reselect a new aggregator, just signal the
-        // state machines to reinitialize
+         * state machines to reinitialize
+         */
        port->sm_vars |= AD_PORT_BEGIN;
+        __release_state_machine_lock(port);
 }
 /**
@@ -2229,20 +2234,25 @@ void bond_3ad_adapter_duplex_changed(struct slave *slave)
        port = &(SLAVE_AD_INFO(slave).port);
-        // if slave is null, the whole port is not initialized
+        /* if slave is null, the whole port is not initialized */
        if (!port->slave) {
                pr_warning("%s: Warning: duplex changed for uninitialized port on %s\n",
                           slave->bond->dev->name, slave->dev->name);
                return;
        }
+        __get_state_machine_lock(port);
        port->actor_admin_port_key &= ~AD_DUPLEX_KEY_BITS;
        port->actor_oper_port_key = port->actor_admin_port_key |=
                __get_duplex(port);
        pr_debug("Port %d changed duplex\n", port->actor_port_number);
-        // there is no need to reselect a new aggregator, just signal the
+        /* there is no need to reselect a new aggregator, just signal the
-        // state machines to reinitialize
+         * state machines to reinitialize
+         */
        port->sm_vars |= AD_PORT_BEGIN;
+        __release_state_machine_lock(port);
 }
 /**
@@ -2258,15 +2268,21 @@ void bond_3ad_handle_link_change(struct slave *slave, char link)
        port = &(SLAVE_AD_INFO(slave).port);
-        // if slave is null, the whole port is not initialized
+        /* if slave is null, the whole port is not initialized */
        if (!port->slave) {
                pr_warning("Warning: %s: link status changed for uninitialized port on %s\n",
                           slave->bond->dev->name, slave->dev->name);
                return;
        }
-        // on link down we are zeroing duplex and speed since some of the adaptors(ce1000.lan) report full duplex/speed instead of N/A(duplex) / 0(speed)
+        __get_state_machine_lock(port);
-        // on link up we are forcing recheck on the duplex and speed since some of he adaptors(ce1000.lan) report
+        /* on link down we are zeroing duplex and speed since
+         * some of the adaptors(ce1000.lan) report full duplex/speed
+         * instead of N/A(duplex) / 0(speed).
+         *
+         * on link up we are forcing recheck on the duplex and speed since
+         * some of he adaptors(ce1000.lan) report.
+         */
        if (link == BOND_LINK_UP) {
                port->is_enabled = true;
                port->actor_admin_port_key &= ~AD_DUPLEX_KEY_BITS;
@@ -2282,10 +2298,15 @@ void bond_3ad_handle_link_change(struct slave *slave, char link)
                port->actor_oper_port_key = (port->actor_admin_port_key &=
                                             ~AD_SPEED_KEY_BITS);
        }
-        //BOND_PRINT_DBG(("Port %d changed link status to %s", port->actor_port_number, ((link == BOND_LINK_UP)?"UP":"DOWN")));
+        pr_debug("Port %d changed link status to %s",
-        // there is no need to reselect a new aggregator, just signal the
+                port->actor_port_number,
-        // state machines to reinitialize
+                (link == BOND_LINK_UP) ? "UP" : "DOWN");
+        /* there is no need to reselect a new aggregator, just signal the
+         * state machines to reinitialize
+         */
        port->sm_vars |= AD_PORT_BEGIN;
+        __release_state_machine_lock(port);
 }
 /*
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 4dd5ee2a34cc..4b8c58b0ec24 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -3732,7 +3732,8 @@ static inline int bond_slave_override(struct bonding *bond,
 }
-static u16 bond_select_queue(struct net_device *dev, struct sk_buff *skb)
+static u16 bond_select_queue(struct net_device *dev, struct sk_buff *skb,
+                             void *accel_priv)
 {
        /*
         * This helper function exists to help dev_pick_tx get the correct
@@ -4110,7 +4111,7 @@ static int bond_check_params(struct bond_params *params)
                if (!miimon) {
                        pr_warning("Warning: miimon must be specified, otherwise bonding will not detect link failure, speed and duplex which are essential for 802.3ad operation\n");
                        pr_warning("Forcing miimon to 100msec\n");
-                        miimon = 100;
+                        miimon = BOND_DEFAULT_MIIMON;
                }
        }
@@ -4147,7 +4148,7 @@ static int bond_check_params(struct bond_params *params)
                if (!miimon) {
                        pr_warning("Warning: miimon must be specified, otherwise bonding will not detect link failure and link speed which are essential for TLB/ALB load balancing\n");
                        pr_warning("Forcing miimon to 100msec\n");
-                        miimon = 100;
+                        miimon = BOND_DEFAULT_MIIMON;
                }
        }
@@ -4199,9 +4200,9 @@ static int bond_check_params(struct bond_params *params)
             (arp_ip_count < BOND_MAX_ARP_TARGETS) && arp_ip_target[i]; i++) {
                /* not complete check, but should be good enough to
                   catch mistakes */
-                __be32 ip = in_aton(arp_ip_target[i]);
+                __be32 ip;
-                if (!isdigit(arp_ip_target[i][0]) || ip == 0 ||
+                if (!in4_pton(arp_ip_target[i], -1, (u8 *)&ip, -1, NULL) ||
-                    ip == htonl(INADDR_BROADCAST)) {
+                    IS_IP_TARGET_UNUSABLE_ADDRESS(ip)) {
                        pr_warning("Warning: bad arp_ip_target module parameter (%s), ARP monitoring will not be performed\n",
                                   arp_ip_target[i]);
                        arp_interval = 0;
diff --git a/drivers/net/bonding/bond_options.c b/drivers/net/bonding/bond_options.c
index 9a5223c7b4d1..ea6f640782b7 100644
--- a/drivers/net/bonding/bond_options.c
+++ b/drivers/net/bonding/bond_options.c
@@ -45,10 +45,15 @@ int bond_option_mode_set(struct bonding *bond, int mode)
                return -EPERM;
        }
-        if (BOND_MODE_IS_LB(mode) && bond->params.arp_interval) {
+        if (BOND_NO_USES_ARP(mode) && bond->params.arp_interval) {
-                pr_err("%s: %s mode is incompatible with arp monitoring.\n",
+                pr_info("%s: %s mode is incompatible with arp monitoring, start mii monitoring\n",
-                       bond->dev->name, bond_mode_tbl[mode].modename);
+                        bond->dev->name, bond_mode_tbl[mode].modename);
-                return -EINVAL;
+                /* disable arp monitoring */
+                bond->params.arp_interval = 0;
+                /* set miimon to default value */
+                bond->params.miimon = BOND_DEFAULT_MIIMON;
+                pr_info("%s: Setting MII monitoring interval to %d.\n",
+                        bond->dev->name, bond->params.miimon);
        }
        /* don't cache arp_validate between modes */
diff --git a/drivers/net/bonding/bond_sysfs.c b/drivers/net/bonding/bond_sysfs.c
index 0ec2a7e8c8a9..0ae580bbc5db 100644
--- a/drivers/net/bonding/bond_sysfs.c
+++ b/drivers/net/bonding/bond_sysfs.c
@@ -523,9 +523,7 @@ static ssize_t bonding_store_arp_interval(struct device *d,
                ret = -EINVAL;
                goto out;
        }
-        if (bond->params.mode == BOND_MODE_ALB ||
+        if (BOND_NO_USES_ARP(bond->params.mode)) {
-            bond->params.mode == BOND_MODE_TLB ||
-            bond->params.mode == BOND_MODE_8023AD) {
                pr_info("%s: ARP monitoring cannot be used with ALB/TLB/802.3ad. Only MII monitoring is supported on %s.\n",
                        bond->dev->name, bond->dev->name);
                ret = -EINVAL;
@@ -1637,12 +1635,12 @@ static ssize_t bonding_show_packets_per_slave(struct device *d,
                                              char *buf)
 {
        struct bonding *bond = to_bond(d);
-        int packets_per_slave = bond->params.packets_per_slave;
+        unsigned int packets_per_slave = bond->params.packets_per_slave;
        if (packets_per_slave > 1)
                packets_per_slave = reciprocal_value(packets_per_slave);
-        return sprintf(buf, "%d\n", packets_per_slave);
+        return sprintf(buf, "%u\n", packets_per_slave);
 }
 static ssize_t bonding_store_packets_per_slave(struct device *d,
diff --git a/drivers/net/bonding/bonding.h b/drivers/net/bonding/bonding.h
index ca31286aa028..a9f4f9f4d8ce 100644
--- a/drivers/net/bonding/bonding.h
+++ b/drivers/net/bonding/bonding.h
@@ -35,6 +35,8 @@
 #define BOND_MAX_ARP_TARGETS    16
+#define BOND_DEFAULT_MIIMON     100
 #define IS_UP(dev)                                         \
              ((((dev)->flags & IFF_UP) == IFF_UP)      && \
               netif_running(dev)                       && \
@@ -55,6 +57,11 @@
                 ((mode) == BOND_MODE_TLB)          ||  \
                 ((mode) == BOND_MODE_ALB))
+#define BOND_NO_USES_ARP(mode)                          \
+                (((mode) == BOND_MODE_8023AD)   ||      \
+                 ((mode) == BOND_MODE_TLB)      ||      \
+                 ((mode) == BOND_MODE_ALB))
 #define TX_QUEUE_OVERRIDE(mode)                         \
                        (((mode) == BOND_MODE_ACTIVEBACKUP) ||  \
                         ((mode) == BOND_MODE_ROUNDROBIN))
diff --git a/drivers/net/can/c_can/c_can.c b/drivers/net/can/c_can/c_can.c
index e3fc07cf2f62..77061eebb034 100644
--- a/drivers/net/can/c_can/c_can.c
+++ b/drivers/net/can/c_can/c_can.c
@@ -712,22 +712,31 @@ static int c_can_set_mode(struct net_device *dev, enum can_mode mode)
        return 0;
 }
-static int c_can_get_berr_counter(const struct net_device *dev,
+static int __c_can_get_berr_counter(const struct net_device *dev,
-                                        struct can_berr_counter *bec)
+                                    struct can_berr_counter *bec)
 {
        unsigned int reg_err_counter;
        struct c_can_priv *priv = netdev_priv(dev);
-        c_can_pm_runtime_get_sync(priv);
        reg_err_counter = priv->read_reg(priv, C_CAN_ERR_CNT_REG);
        bec->rxerr = (reg_err_counter & ERR_CNT_REC_MASK) >>
                                ERR_CNT_REC_SHIFT;
        bec->txerr = reg_err_counter & ERR_CNT_TEC_MASK;
+        return 0;
+}
+static int c_can_get_berr_counter(const struct net_device *dev,
+                                  struct can_berr_counter *bec)
+{
+        struct c_can_priv *priv = netdev_priv(dev);
+        int err;
+        c_can_pm_runtime_get_sync(priv);
+        err = __c_can_get_berr_counter(dev, bec);
        c_can_pm_runtime_put_sync(priv);
-        return 0;
+        return err;
 }
 /*
@@ -754,6 +763,7 @@ static void c_can_do_tx(struct net_device *dev)
                if (!(val & (1 << (msg_obj_no - 1)))) {
                        can_get_echo_skb(dev,
                                        msg_obj_no - C_CAN_MSG_OBJ_TX_FIRST);
+                        c_can_object_get(dev, 0, msg_obj_no, IF_COMM_ALL);
                        stats->tx_bytes += priv->read_reg(priv,
                                        C_CAN_IFACE(MSGCTRL_REG, 0))
                                        & IF_MCONT_DLC_MASK;
@@ -872,7 +882,7 @@ static int c_can_handle_state_change(struct net_device *dev,
        if (unlikely(!skb))
                return 0;
-        c_can_get_berr_counter(dev, &bec);
+        __c_can_get_berr_counter(dev, &bec);
        reg_err_counter = priv->read_reg(priv, C_CAN_ERR_CNT_REG);
        rx_err_passive = (reg_err_counter & ERR_CNT_RP_MASK) >>
                                ERR_CNT_RP_SHIFT;
diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
index ae08cf129ebb..aaed97bee471 100644
--- a/drivers/net/can/flexcan.c
+++ b/drivers/net/can/flexcan.c
@@ -1020,13 +1020,13 @@ static int flexcan_probe(struct platform_device *pdev)
                        dev_err(&pdev->dev, "no ipg clock defined\n");
                        return PTR_ERR(clk_ipg);
                }
-                clock_freq = clk_get_rate(clk_ipg);
                clk_per = devm_clk_get(&pdev->dev, "per");
                if (IS_ERR(clk_per)) {
                        dev_err(&pdev->dev, "no per clock defined\n");
                        return PTR_ERR(clk_per);
                }
+                clock_freq = clk_get_rate(clk_per);
        }
        mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
diff --git a/drivers/net/can/sja1000/sja1000.c b/drivers/net/can/sja1000/sja1000.c
index 7164a999f50f..f17c3018b7c7 100644
--- a/drivers/net/can/sja1000/sja1000.c
+++ b/drivers/net/can/sja1000/sja1000.c
@@ -494,20 +494,20 @@ irqreturn_t sja1000_interrupt(int irq, void *dev_id)
        uint8_t isrc, status;
        int n = 0;
-        /* Shared interrupts and IRQ off? */
-        if (priv->read_reg(priv, SJA1000_IER) == IRQ_OFF)
-                return IRQ_NONE;
        if (priv->pre_irq)
                priv->pre_irq(priv);
+        /* Shared interrupts and IRQ off? */
+        if (priv->read_reg(priv, SJA1000_IER) == IRQ_OFF)
+                goto out;
        while ((isrc = priv->read_reg(priv, SJA1000_IR)) &&
               (n < SJA1000_MAX_IRQ)) {
-                n++;
                status = priv->read_reg(priv, SJA1000_SR);
                /* check for absent controller due to hw unplug */
                if (status == 0xFF && sja1000_is_absent(priv))
-                        return IRQ_NONE;
+                        goto out;
                if (isrc & IRQ_WUI)
                        netdev_warn(dev, "wakeup interrupt\n");
@@ -535,7 +535,7 @@ irqreturn_t sja1000_interrupt(int irq, void *dev_id)
                                status = priv->read_reg(priv, SJA1000_SR);
                                /* check for absent controller */
                                if (status == 0xFF && sja1000_is_absent(priv))
-                                        return IRQ_NONE;
+                                        goto out;
                        }
                }
                if (isrc & (IRQ_DOI | IRQ_EI | IRQ_BEI | IRQ_EPI | IRQ_ALI)) {
@@ -543,8 +543,9 @@ irqreturn_t sja1000_interrupt(int irq, void *dev_id)
                        if (sja1000_err(dev, isrc, status))
                                break;
                }
+                n++;
        }
+out:
        if (priv->post_irq)
                priv->post_irq(priv);
diff --git a/drivers/net/can/usb/ems_usb.c b/drivers/net/can/usb/ems_usb.c
index 5f9a7ad9b964..8aeec0b4601a 100644
--- a/drivers/net/can/usb/ems_usb.c
+++ b/drivers/net/can/usb/ems_usb.c
@@ -625,6 +625,7 @@ static int ems_usb_start(struct ems_usb *dev)
                        usb_unanchor_urb(urb);
                        usb_free_coherent(dev->udev, RX_BUFFER_SIZE, buf,
                                          urb->transfer_dma);
+                        usb_free_urb(urb);
                        break;
                }
@@ -798,8 +799,8 @@ static netdev_tx_t ems_usb_start_xmit(struct sk_buff *skb, struct net_device *ne
         * allowed (MAX_TX_URBS).
         */
        if (!context) {
-                usb_unanchor_urb(urb);
                usb_free_coherent(dev->udev, size, buf, urb->transfer_dma);
+                usb_free_urb(urb);
                netdev_warn(netdev, "couldn't find free context\n");
diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_pro.c b/drivers/net/can/usb/peak_usb/pcan_usb_pro.c
index 8ee9d1556e6e..263dd921edc4 100644
--- a/drivers/net/can/usb/peak_usb/pcan_usb_pro.c
+++ b/drivers/net/can/usb/peak_usb/pcan_usb_pro.c
@@ -927,6 +927,9 @@ static int pcan_usb_pro_init(struct peak_usb_device *dev)
        /* set LED in default state (end of init phase) */
        pcan_usb_pro_set_led(dev, 0, 1);
+        kfree(bi);
+        kfree(fi);
        return 0;
 err_out:
diff --git a/drivers/net/ethernet/allwinner/sun4i-emac.c b/drivers/net/ethernet/allwinner/sun4i-emac.c
index 50b853a79d77..46dfb1378c17 100644
--- a/drivers/net/ethernet/allwinner/sun4i-emac.c
+++ b/drivers/net/ethernet/allwinner/sun4i-emac.c
@@ -717,8 +717,7 @@ static int emac_open(struct net_device *dev)
        if (netif_msg_ifup(db))
                dev_dbg(db->dev, "enabling %s\n", dev->name);
-        if (devm_request_irq(db->dev, dev->irq, &emac_interrupt,
+        if (request_irq(dev->irq, &emac_interrupt, 0, dev->name, dev))
-                             0, dev->name, dev))
                return -EAGAIN;
        /* Initialize EMAC board */
@@ -774,6 +773,8 @@ static int emac_stop(struct net_device *ndev)
        emac_shutdown(ndev);
+        free_irq(ndev->irq, ndev);
        return 0;
 }
diff --git a/drivers/net/ethernet/arc/emac_main.c b/drivers/net/ethernet/arc/emac_main.c
index b2ffad1304d2..248baf6273fb 100644
--- a/drivers/net/ethernet/arc/emac_main.c
+++ b/drivers/net/ethernet/arc/emac_main.c
@@ -565,6 +565,8 @@ static int arc_emac_tx(struct sk_buff *skb, struct net_device *ndev)
        /* Make sure pointer to data buffer is set */
        wmb();
+        skb_tx_timestamp(skb);
        *info = cpu_to_le32(FOR_EMAC | FIRST_OR_LAST_MASK | len);
        /* Increment index to point to the next BD */
@@ -579,8 +581,6 @@ static int arc_emac_tx(struct sk_buff *skb, struct net_device *ndev)
        arc_reg_set(priv, R_STATUS, TXPL_MASK);
-        skb_tx_timestamp(skb);
        return NETDEV_TX_OK;
 }
diff --git a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
index a36a760ada28..29801750f239 100644
--- a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
+++ b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
@@ -145,9 +145,11 @@ static void atl1c_reset_pcie(struct atl1c_hw *hw, u32 flag)
         * Mask some pcie error bits
         */
        pos = pci_find_ext_capability(pdev, PCI_EXT_CAP_ID_ERR);
-        pci_read_config_dword(pdev, pos + PCI_ERR_UNCOR_SEVER, &data);
+        if (pos) {
-        data &= ~(PCI_ERR_UNC_DLP | PCI_ERR_UNC_FCP);
+                pci_read_config_dword(pdev, pos + PCI_ERR_UNCOR_SEVER, &data);
-        pci_write_config_dword(pdev, pos + PCI_ERR_UNCOR_SEVER, data);
+                data &= ~(PCI_ERR_UNC_DLP | PCI_ERR_UNC_FCP);
+                pci_write_config_dword(pdev, pos + PCI_ERR_UNCOR_SEVER, data);
+        }
        /* clear error status */
        pcie_capability_write_word(pdev, PCI_EXP_DEVSTA,
                        PCI_EXP_DEVSTA_NFED |
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
index a1f66e2c9a86..ec6119089b82 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
@@ -520,10 +520,12 @@ struct bnx2x_fastpath {
 #define BNX2X_FP_STATE_IDLE                   0
 #define BNX2X_FP_STATE_NAPI             (1 << 0)    /* NAPI owns this FP */
 #define BNX2X_FP_STATE_POLL             (1 << 1)    /* poll owns this FP */
-#define BNX2X_FP_STATE_NAPI_YIELD       (1 << 2)    /* NAPI yielded this FP */
+#define BNX2X_FP_STATE_DISABLED         (1 << 2)
-#define BNX2X_FP_STATE_POLL_YIELD       (1 << 3)    /* poll yielded this FP */
+#define BNX2X_FP_STATE_NAPI_YIELD       (1 << 3)    /* NAPI yielded this FP */
+#define BNX2X_FP_STATE_POLL_YIELD       (1 << 4)    /* poll yielded this FP */
+#define BNX2X_FP_OWNED  (BNX2X_FP_STATE_NAPI | BNX2X_FP_STATE_POLL)
 #define BNX2X_FP_YIELD  (BNX2X_FP_STATE_NAPI_YIELD | BNX2X_FP_STATE_POLL_YIELD)
-#define BNX2X_FP_LOCKED (BNX2X_FP_STATE_NAPI | BNX2X_FP_STATE_POLL)
+#define BNX2X_FP_LOCKED (BNX2X_FP_OWNED | BNX2X_FP_STATE_DISABLED)
 #define BNX2X_FP_USER_PEND (BNX2X_FP_STATE_POLL | BNX2X_FP_STATE_POLL_YIELD)
        /* protect state */
        spinlock_t lock;
@@ -613,7 +615,7 @@ static inline bool bnx2x_fp_lock_napi(struct bnx2x_fastpath *fp)
 {
        bool rc = true;
-        spin_lock(&fp->lock);
+        spin_lock_bh(&fp->lock);
        if (fp->state & BNX2X_FP_LOCKED) {
                WARN_ON(fp->state & BNX2X_FP_STATE_NAPI);
                fp->state |= BNX2X_FP_STATE_NAPI_YIELD;
@@ -622,7 +624,7 @@ static inline bool bnx2x_fp_lock_napi(struct bnx2x_fastpath *fp)
                /* we don't care if someone yielded */
                fp->state = BNX2X_FP_STATE_NAPI;
        }
-        spin_unlock(&fp->lock);
+        spin_unlock_bh(&fp->lock);
        return rc;
 }
@@ -631,14 +633,16 @@ static inline bool bnx2x_fp_unlock_napi(struct bnx2x_fastpath *fp)
 {
        bool rc = false;
-        spin_lock(&fp->lock);
+        spin_lock_bh(&fp->lock);
        WARN_ON(fp->state &
                (BNX2X_FP_STATE_POLL | BNX2X_FP_STATE_NAPI_YIELD));
        if (fp->state & BNX2X_FP_STATE_POLL_YIELD)
                rc = true;
-        fp->state = BNX2X_FP_STATE_IDLE;
-        spin_unlock(&fp->lock);
+        /* state ==> idle, unless currently disabled */
+        fp->state &= BNX2X_FP_STATE_DISABLED;
+        spin_unlock_bh(&fp->lock);
        return rc;
 }
@@ -669,7 +673,9 @@ static inline bool bnx2x_fp_unlock_poll(struct bnx2x_fastpath *fp)
        if (fp->state & BNX2X_FP_STATE_POLL_YIELD)
                rc = true;
-        fp->state = BNX2X_FP_STATE_IDLE;
+        /* state ==> idle, unless currently disabled */
+        fp->state &= BNX2X_FP_STATE_DISABLED;
        spin_unlock_bh(&fp->lock);
        return rc;
 }
@@ -677,9 +683,23 @@ static inline bool bnx2x_fp_unlock_poll(struct bnx2x_fastpath *fp)
 /* true if a socket is polling, even if it did not get the lock */
 static inline bool bnx2x_fp_ll_polling(struct bnx2x_fastpath *fp)
 {
-        WARN_ON(!(fp->state & BNX2X_FP_LOCKED));
+        WARN_ON(!(fp->state & BNX2X_FP_OWNED));
        return fp->state & BNX2X_FP_USER_PEND;
 }
+/* false if fp is currently owned */
+static inline bool bnx2x_fp_ll_disable(struct bnx2x_fastpath *fp)
+{
+        int rc = true;
+        spin_lock_bh(&fp->lock);
+        if (fp->state & BNX2X_FP_OWNED)
+                rc = false;
+        fp->state |= BNX2X_FP_STATE_DISABLED;
+        spin_unlock_bh(&fp->lock);
+        return rc;
+}
 #else
 static inline void bnx2x_fp_init_lock(struct bnx2x_fastpath *fp)
 {
@@ -709,6 +729,10 @@ static inline bool bnx2x_fp_ll_polling(struct bnx2x_fastpath *fp)
 {
        return false;
 }
+static inline bool bnx2x_fp_ll_disable(struct bnx2x_fastpath *fp)
+{
+        return true;
+}
 #endif /* CONFIG_NET_RX_BUSY_POLL */
 /* Use 2500 as a mini-jumbo MTU for FCoE */
@@ -1250,7 +1274,10 @@ struct bnx2x_slowpath {
         * Therefore, if they would have been defined in the same union,
         * data can get corrupted.
         */
-        struct afex_vif_list_ramrod_data func_afex_rdata;
+        union {
+                struct afex_vif_list_ramrod_data        viflist_data;
+                struct function_update_data             func_update;
+        } func_afex_rdata;
        /* used by dmae command executer */
        struct dmae_command             dmae[MAX_DMAE_C];
@@ -2499,4 +2526,6 @@ void bnx2x_set_local_cmng(struct bnx2x *bp);
 #define MCPR_SCRATCH_BASE(bp) \
        (CHIP_IS_E1x(bp) ? MCP_REG_MCPR_SCRATCH : MCP_A_REG_MCPR_SCRATCH)
+#define E1H_MAX_MF_SB_COUNT (HC_SB_MAX_SB_E1X/(E1HVN_MAX * PORT_MAX))
 #endif /* bnx2x.h */
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
index ec96130533cc..bf811565ee24 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
@@ -160,6 +160,7 @@ static u16 bnx2x_free_tx_pkt(struct bnx2x *bp, struct bnx2x_fp_txdata *txdata,
        struct sk_buff *skb = tx_buf->skb;
        u16 bd_idx = TX_BD(tx_buf->first_bd), new_cons;
        int nbd;
+        u16 split_bd_len = 0;
        /* prefetch skb end pointer to speedup dev_kfree_skb() */
        prefetch(&skb->end);
@@ -167,10 +168,7 @@ static u16 bnx2x_free_tx_pkt(struct bnx2x *bp, struct bnx2x_fp_txdata *txdata,
        DP(NETIF_MSG_TX_DONE, "fp[%d]: pkt_idx %d  buff @(%p)->skb %p\n",
           txdata->txq_index, idx, tx_buf, skb);
-        /* unmap first bd */
        tx_start_bd = &txdata->tx_desc_ring[bd_idx].start_bd;
-        dma_unmap_single(&bp->pdev->dev, BD_UNMAP_ADDR(tx_start_bd),
-                         BD_UNMAP_LEN(tx_start_bd), DMA_TO_DEVICE);
        nbd = le16_to_cpu(tx_start_bd->nbd) - 1;
 #ifdef BNX2X_STOP_ON_ERROR
@@ -188,12 +186,19 @@ static u16 bnx2x_free_tx_pkt(struct bnx2x *bp, struct bnx2x_fp_txdata *txdata,
        --nbd;
        bd_idx = TX_BD(NEXT_TX_IDX(bd_idx));
-        /* ...and the TSO split header bd since they have no mapping */
+        /* TSO headers+data bds share a common mapping. See bnx2x_tx_split() */
        if (tx_buf->flags & BNX2X_TSO_SPLIT_BD) {
+                tx_data_bd = &txdata->tx_desc_ring[bd_idx].reg_bd;
+                split_bd_len = BD_UNMAP_LEN(tx_data_bd);
                --nbd;
                bd_idx = TX_BD(NEXT_TX_IDX(bd_idx));
        }
+        /* unmap first bd */
+        dma_unmap_single(&bp->pdev->dev, BD_UNMAP_ADDR(tx_start_bd),
+                         BD_UNMAP_LEN(tx_start_bd) + split_bd_len,
+                         DMA_TO_DEVICE);
        /* now free frags */
        while (nbd > 0) {
@@ -1790,26 +1795,22 @@ static void bnx2x_napi_disable_cnic(struct bnx2x *bp)
 {
        int i;
-        local_bh_disable();
        for_each_rx_queue_cnic(bp, i) {
                napi_disable(&bnx2x_fp(bp, i, napi));
-                while (!bnx2x_fp_lock_napi(&bp->fp[i]))
+                while (!bnx2x_fp_ll_disable(&bp->fp[i]))
-                        mdelay(1);
+                        usleep_range(1000, 2000);
        }
-        local_bh_enable();
 }
 static void bnx2x_napi_disable(struct bnx2x *bp)
 {
        int i;
-        local_bh_disable();
        for_each_eth_queue(bp, i) {
                napi_disable(&bnx2x_fp(bp, i, napi));
-                while (!bnx2x_fp_lock_napi(&bp->fp[i]))
+                while (!bnx2x_fp_ll_disable(&bp->fp[i]))
-                        mdelay(1);
+                        usleep_range(1000, 2000);
        }
-        local_bh_enable();
 }
 void bnx2x_netif_start(struct bnx2x *bp)
@@ -1832,7 +1833,8 @@ void bnx2x_netif_stop(struct bnx2x *bp, int disable_hw)
                bnx2x_napi_disable_cnic(bp);
 }
-u16 bnx2x_select_queue(struct net_device *dev, struct sk_buff *skb)
+u16 bnx2x_select_queue(struct net_device *dev, struct sk_buff *skb,
+                       void *accel_priv)
 {
        struct bnx2x *bp = netdev_priv(dev);
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h
index da8fcaa74495..41f3ca5ad972 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h
@@ -524,7 +524,8 @@ int bnx2x_set_vf_mac(struct net_device *dev, int queue, u8 *mac);
 int bnx2x_set_vf_vlan(struct net_device *netdev, int vf, u16 vlan, u8 qos);
 /* select_queue callback */
-u16 bnx2x_select_queue(struct net_device *dev, struct sk_buff *skb);
+u16 bnx2x_select_queue(struct net_device *dev, struct sk_buff *skb,
+                       void *accel_priv);
 static inline void bnx2x_update_rx_prod(struct bnx2x *bp,
                                        struct bnx2x_fastpath *fp,
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
index 20dcc02431ca..11fc79585491 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
@@ -3865,6 +3865,19 @@ static void bnx2x_warpcore_enable_AN_KR(struct bnx2x_phy *phy,
                bnx2x_warpcore_enable_AN_KR2(phy, params, vars);
        } else {
+                /* Enable Auto-Detect to support 1G over CL37 as well */
+                bnx2x_cl45_write(bp, phy, MDIO_WC_DEVAD,
+                                 MDIO_WC_REG_SERDESDIGITAL_CONTROL1000X1, 0x10);
+                /* Force cl48 sync_status LOW to avoid getting stuck in CL73
+                 * parallel-detect loop when CL73 and CL37 are enabled.
+                 */
+                CL22_WR_OVER_CL45(bp, phy, MDIO_REG_BANK_AER_BLOCK,
+                                  MDIO_AER_BLOCK_AER_REG, 0);
+                bnx2x_cl45_write(bp, phy, MDIO_WC_DEVAD,
+                                 MDIO_WC_REG_RXB_ANA_RX_CONTROL_PCI, 0x0800);
+                bnx2x_set_aer_mmd(params, phy);
                bnx2x_disable_kr2(params, vars, phy);
        }
@@ -8120,17 +8133,20 @@ static int bnx2x_get_edc_mode(struct bnx2x_phy *phy,
                                *edc_mode = EDC_MODE_ACTIVE_DAC;
                        else
                                check_limiting_mode = 1;
-                } else if (copper_module_type &
+                } else {
-                        SFP_EEPROM_FC_TX_TECH_BITMASK_COPPER_PASSIVE) {
+                        *edc_mode = EDC_MODE_PASSIVE_DAC;
+                        /* Even in case PASSIVE_DAC indication is not set,
+                         * treat it as a passive DAC cable, since some cables
+                         * don't have this indication.
+                         */
+                        if (copper_module_type &
+                            SFP_EEPROM_FC_TX_TECH_BITMASK_COPPER_PASSIVE) {
                                DP(NETIF_MSG_LINK,
                                   "Passive Copper cable detected\n");
-                                *edc_mode =
+                        } else {
-                                      EDC_MODE_PASSIVE_DAC;
+                                DP(NETIF_MSG_LINK,
-                } else {
+                                   "Unknown copper-cable-type\n");
-                        DP(NETIF_MSG_LINK,
+                        }
-                           "Unknown copper-cable-type 0x%x !!!\n",
-                           copper_module_type);
-                        return -EINVAL;
                }
                break;
        }
@@ -10825,9 +10841,9 @@ static int bnx2x_54618se_config_init(struct bnx2x_phy *phy,
                           (1<<11));
        if (((phy->req_line_speed == SPEED_AUTO_NEG) &&
-                        (phy->speed_cap_mask &
+             (phy->speed_cap_mask &
-                        PORT_HW_CFG_SPEED_CAPABILITY_D0_1G)) ||
+              PORT_HW_CFG_SPEED_CAPABILITY_D0_1G)) ||
-                        (phy->req_line_speed == SPEED_1000)) {
+            (phy->req_line_speed == SPEED_1000)) {
                an_1000_val |= (1<<8);
                autoneg_val |= (1<<9 | 1<<12);
                if (phy->req_duplex == DUPLEX_FULL)
@@ -10843,30 +10859,32 @@ static int bnx2x_54618se_config_init(struct bnx2x_phy *phy,
                        0x09,
                        &an_1000_val);
-        /* Set 100 speed advertisement */
+        /* Advertise 10/100 link speed */
-        if (((phy->req_line_speed == SPEED_AUTO_NEG) &&
+        if (phy->req_line_speed == SPEED_AUTO_NEG) {
-                        (phy->speed_cap_mask &
+                if (phy->speed_cap_mask &
-                        (PORT_HW_CFG_SPEED_CAPABILITY_D0_100M_FULL |
+                    PORT_HW_CFG_SPEED_CAPABILITY_D0_10M_HALF) {
-                        PORT_HW_CFG_SPEED_CAPABILITY_D0_100M_HALF)))) {
+                        an_10_100_val |= (1<<5);
-                an_10_100_val |= (1<<7);
+                        autoneg_val |= (1<<9 | 1<<12);
-                /* Enable autoneg and restart autoneg for legacy speeds */
+                        DP(NETIF_MSG_LINK, "Advertising 10M-HD\n");
-                autoneg_val |= (1<<9 | 1<<12);
+                }
+                if (phy->speed_cap_mask &
-                if (phy->req_duplex == DUPLEX_FULL)
+                    PORT_HW_CFG_SPEED_CAPABILITY_D0_10M_FULL) {
-                        an_10_100_val |= (1<<8);
-                DP(NETIF_MSG_LINK, "Advertising 100M\n");
-        }
-        /* Set 10 speed advertisement */
-        if (((phy->req_line_speed == SPEED_AUTO_NEG) &&
-                        (phy->speed_cap_mask &
-                        (PORT_HW_CFG_SPEED_CAPABILITY_D0_10M_FULL |
-                        PORT_HW_CFG_SPEED_CAPABILITY_D0_10M_HALF)))) {
-                an_10_100_val |= (1<<5);
-                autoneg_val |= (1<<9 | 1<<12);
-                if (phy->req_duplex == DUPLEX_FULL)
                        an_10_100_val |= (1<<6);
-                DP(NETIF_MSG_LINK, "Advertising 10M\n");
+                        autoneg_val |= (1<<9 | 1<<12);
+                        DP(NETIF_MSG_LINK, "Advertising 10M-FD\n");
+                }
+                if (phy->speed_cap_mask &
+                    PORT_HW_CFG_SPEED_CAPABILITY_D0_100M_HALF) {
+                        an_10_100_val |= (1<<7);
+                        autoneg_val |= (1<<9 | 1<<12);
+                        DP(NETIF_MSG_LINK, "Advertising 100M-HD\n");
+                }
+                if (phy->speed_cap_mask &
+                    PORT_HW_CFG_SPEED_CAPABILITY_D0_100M_FULL) {
+                        an_10_100_val |= (1<<8);
+                        autoneg_val |= (1<<9 | 1<<12);
+                        DP(NETIF_MSG_LINK, "Advertising 100M-FD\n");
+                }
        }
        /* Only 10/100 are allowed to work in FORCE mode */
@@ -13342,6 +13360,10 @@ static u8 bnx2x_analyze_link_error(struct link_params *params,
        DP(NETIF_MSG_LINK, "Link changed:[%x %x]->%x\n", vars->link_up,
           old_status, status);
+        /* Do not touch the link in case physical link down */
+        if ((vars->phy_flags & PHY_PHYSICAL_LINK_FLAG) == 0)
+                return 1;
        /* a. Update shmem->link_status accordingly
         * b. Update link_vars->link_up
         */
@@ -13550,7 +13572,7 @@ static void bnx2x_check_kr2_wa(struct link_params *params,
         */
        not_kr2_device = (((base_page & 0x8000) == 0) ||
                          (((base_page & 0x8000) &&
-                            ((next_page & 0xe0) == 0x2))));
+                            ((next_page & 0xe0) == 0x20))));
        /* In case KR2 is already disabled, check if we need to re-enable it */
        if (!(vars->link_attr_sync & LINK_ATTR_SYNC_KR2_ENABLE)) {
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index 814d0eca9b33..8b3107b2fcc1 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -11447,9 +11447,9 @@ static int bnx2x_get_hwinfo(struct bnx2x *bp)
                }
        }
-        /* adjust igu_sb_cnt to MF for E1x */
+        /* adjust igu_sb_cnt to MF for E1H */
-        if (CHIP_IS_E1x(bp) && IS_MF(bp))
+        if (CHIP_IS_E1H(bp) && IS_MF(bp))
-                bp->igu_sb_cnt /= E1HVN_MAX;
+                bp->igu_sb_cnt = min_t(u8, bp->igu_sb_cnt, E1H_MAX_MF_SB_COUNT);
        /* port info */
        bnx2x_get_port_hwinfo(bp);
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_reg.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_reg.h
index 3efbb35267c8..14ffb6e56e59 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_reg.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_reg.h
@@ -7179,6 +7179,7 @@ Theotherbitsarereservedandshouldbezero*/
 #define MDIO_WC_REG_RX1_PCI_CTRL                        0x80ca
 #define MDIO_WC_REG_RX2_PCI_CTRL                        0x80da
 #define MDIO_WC_REG_RX3_PCI_CTRL                        0x80ea
+#define MDIO_WC_REG_RXB_ANA_RX_CONTROL_PCI              0x80fa
 #define MDIO_WC_REG_XGXSBLK2_UNICORE_MODE_10G           0x8104
 #define MDIO_WC_REG_XGXS_STATUS3                        0x8129
 #define MDIO_WC_REG_PAR_DET_10G_STATUS                  0x8130
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c
index 32c92abf5094..18438a504d57 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c
@@ -2038,6 +2038,7 @@ static int bnx2x_vlan_mac_del_all(struct bnx2x *bp,
        struct bnx2x_vlan_mac_ramrod_params p;
        struct bnx2x_exe_queue_obj *exeq = &o->exe_queue;
        struct bnx2x_exeq_elem *exeq_pos, *exeq_pos_n;
+        unsigned long flags;
        int read_lock;
        int rc = 0;
@@ -2046,8 +2047,9 @@ static int bnx2x_vlan_mac_del_all(struct bnx2x *bp,
        spin_lock_bh(&exeq->lock);
        list_for_each_entry_safe(exeq_pos, exeq_pos_n, &exeq->exe_queue, link) {
-                if (exeq_pos->cmd_data.vlan_mac.vlan_mac_flags ==
+                flags = exeq_pos->cmd_data.vlan_mac.vlan_mac_flags;
-                    *vlan_mac_flags) {
+                if (BNX2X_VLAN_MAC_CMP_FLAGS(flags) ==
+                    BNX2X_VLAN_MAC_CMP_FLAGS(*vlan_mac_flags)) {
                        rc = exeq->remove(bp, exeq->owner, exeq_pos);
                        if (rc) {
                                BNX2X_ERR("Failed to remove command\n");
@@ -2080,7 +2082,9 @@ static int bnx2x_vlan_mac_del_all(struct bnx2x *bp,
                return read_lock;
        list_for_each_entry(pos, &o->head, link) {
-                if (pos->vlan_mac_flags == *vlan_mac_flags) {
+                flags = pos->vlan_mac_flags;
+                if (BNX2X_VLAN_MAC_CMP_FLAGS(flags) ==
+                    BNX2X_VLAN_MAC_CMP_FLAGS(*vlan_mac_flags)) {
                        p.user_req.vlan_mac_flags = pos->vlan_mac_flags;
                        memcpy(&p.user_req.u, &pos->u, sizeof(pos->u));
                        rc = bnx2x_config_vlan_mac(bp, &p);
@@ -4382,8 +4386,11 @@ int bnx2x_config_rss(struct bnx2x *bp,
        struct bnx2x_raw_obj *r = &o->raw;
        /* Do nothing if only driver cleanup was requested */
-        if (test_bit(RAMROD_DRV_CLR_ONLY, &p->ramrod_flags))
+        if (test_bit(RAMROD_DRV_CLR_ONLY, &p->ramrod_flags)) {
+                DP(BNX2X_MSG_SP, "Not configuring RSS ramrod_flags=%lx\n",
+                   p->ramrod_flags);
                return 0;
+        }
        r->set_pending(r);
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.h
index 658f4e33abf9..6a53c15c85a3 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.h
@@ -266,6 +266,13 @@ enum {
        BNX2X_DONT_CONSUME_CAM_CREDIT,
        BNX2X_DONT_CONSUME_CAM_CREDIT_DEST,
 };
+/* When looking for matching filters, some flags are not interesting */
+#define BNX2X_VLAN_MAC_CMP_MASK (1 << BNX2X_UC_LIST_MAC | \
+                                 1 << BNX2X_ETH_MAC | \
+                                 1 << BNX2X_ISCSI_ETH_MAC | \
+                                 1 << BNX2X_NETQ_ETH_MAC)
+#define BNX2X_VLAN_MAC_CMP_FLAGS(flags) \
+        ((flags) & BNX2X_VLAN_MAC_CMP_MASK)
 struct bnx2x_vlan_mac_ramrod_params {
        /* Object to run the command from */
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
index 0216d592d0ce..e7845e5be1c7 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
@@ -1209,6 +1209,11 @@ static void bnx2x_vfop_rxmode(struct bnx2x *bp, struct bnx2x_virtf *vf)
                /* next state */
                vfop->state = BNX2X_VFOP_RXMODE_DONE;
+                /* record the accept flags in vfdb so hypervisor can modify them
+                 * if necessary
+                 */
+                bnx2x_vfq(vf, ramrod->cl_id - vf->igu_base_id, accept_flags) =
+                        ramrod->rx_accept_flags;
                vfop->rc = bnx2x_config_rx_mode(bp, ramrod);
                bnx2x_vfop_finalize(vf, vfop->rc, VFOP_DONE);
 op_err:
@@ -1224,39 +1229,43 @@ op_pending:
        return;
 }
+static void bnx2x_vf_prep_rx_mode(struct bnx2x *bp, u8 qid,
+                                  struct bnx2x_rx_mode_ramrod_params *ramrod,
+                                  struct bnx2x_virtf *vf,
+                                  unsigned long accept_flags)
+{
+        struct bnx2x_vf_queue *vfq = vfq_get(vf, qid);
+        memset(ramrod, 0, sizeof(*ramrod));
+        ramrod->cid = vfq->cid;
+        ramrod->cl_id = vfq_cl_id(vf, vfq);
+        ramrod->rx_mode_obj = &bp->rx_mode_obj;
+        ramrod->func_id = FW_VF_HANDLE(vf->abs_vfid);
+        ramrod->rx_accept_flags = accept_flags;
+        ramrod->tx_accept_flags = accept_flags;
+        ramrod->pstate = &vf->filter_state;
+        ramrod->state = BNX2X_FILTER_RX_MODE_PENDING;
+        set_bit(BNX2X_FILTER_RX_MODE_PENDING, &vf->filter_state);
+        set_bit(RAMROD_RX, &ramrod->ramrod_flags);
+        set_bit(RAMROD_TX, &ramrod->ramrod_flags);
+        ramrod->rdata = bnx2x_vf_sp(bp, vf, rx_mode_rdata.e2);
+        ramrod->rdata_mapping = bnx2x_vf_sp_map(bp, vf, rx_mode_rdata.e2);
+}
 int bnx2x_vfop_rxmode_cmd(struct bnx2x *bp,
                          struct bnx2x_virtf *vf,
                          struct bnx2x_vfop_cmd *cmd,
                          int qid, unsigned long accept_flags)
 {
-        struct bnx2x_vf_queue *vfq = vfq_get(vf, qid);
        struct bnx2x_vfop *vfop = bnx2x_vfop_add(bp, vf);
        if (vfop) {
                struct bnx2x_rx_mode_ramrod_params *ramrod =
                        &vf->op_params.rx_mode;
-                memset(ramrod, 0, sizeof(*ramrod));
+                bnx2x_vf_prep_rx_mode(bp, qid, ramrod, vf, accept_flags);
-                /* Prepare ramrod parameters */
-                ramrod->cid = vfq->cid;
-                ramrod->cl_id = vfq_cl_id(vf, vfq);
-                ramrod->rx_mode_obj = &bp->rx_mode_obj;
-                ramrod->func_id = FW_VF_HANDLE(vf->abs_vfid);
-                ramrod->rx_accept_flags = accept_flags;
-                ramrod->tx_accept_flags = accept_flags;
-                ramrod->pstate = &vf->filter_state;
-                ramrod->state = BNX2X_FILTER_RX_MODE_PENDING;
-                set_bit(BNX2X_FILTER_RX_MODE_PENDING, &vf->filter_state);
-                set_bit(RAMROD_RX, &ramrod->ramrod_flags);
-                set_bit(RAMROD_TX, &ramrod->ramrod_flags);
-                ramrod->rdata =
-                        bnx2x_vf_sp(bp, vf, rx_mode_rdata.e2);
-                ramrod->rdata_mapping =
-                        bnx2x_vf_sp_map(bp, vf, rx_mode_rdata.e2);
                bnx2x_vfop_opset(BNX2X_VFOP_RXMODE_CONFIG,
                                 bnx2x_vfop_rxmode, cmd->done);
@@ -3114,6 +3123,11 @@ int bnx2x_sriov_configure(struct pci_dev *dev, int num_vfs_param)
 {
        struct bnx2x *bp = netdev_priv(pci_get_drvdata(dev));
+        if (!IS_SRIOV(bp)) {
+                BNX2X_ERR("failed to configure SR-IOV since vfdb was not allocated. Check dmesg for errors in probe stage\n");
+                return -EINVAL;
+        }
        DP(BNX2X_MSG_IOV, "bnx2x_sriov_configure called with %d, BNX2X_NR_VIRTFN(bp) was %d\n",
           num_vfs_param, BNX2X_NR_VIRTFN(bp));
@@ -3197,13 +3211,16 @@ int bnx2x_enable_sriov(struct bnx2x *bp)
                bnx2x_iov_static_resc(bp, vf);
        }
-        /* prepare msix vectors in VF configuration space */
+        /* prepare msix vectors in VF configuration space - the value in the
+         * PCI configuration space should be the index of the last entry,
+         * namely one less than the actual size of the table
+         */
        for (vf_idx = first_vf; vf_idx < first_vf + req_vfs; vf_idx++) {
                bnx2x_pretend_func(bp, HW_VF_HANDLE(bp, vf_idx));
                REG_WR(bp, PCICFG_OFFSET + GRC_CONFIG_REG_VF_MSIX_CONTROL,
-                       num_vf_queues);
+                       num_vf_queues - 1);
                DP(BNX2X_MSG_IOV, "set msix vec num in VF %d cfg space to %d\n",
-                   vf_idx, num_vf_queues);
+                   vf_idx, num_vf_queues - 1);
        }
        bnx2x_pretend_func(bp, BP_ABS_FUNC(bp));
@@ -3431,10 +3448,18 @@ out:
 int bnx2x_set_vf_vlan(struct net_device *dev, int vfidx, u16 vlan, u8 qos)
 {
+        struct bnx2x_queue_state_params q_params = {NULL};
+        struct bnx2x_vlan_mac_ramrod_params ramrod_param;
+        struct bnx2x_queue_update_params *update_params;
+        struct pf_vf_bulletin_content *bulletin = NULL;
+        struct bnx2x_rx_mode_ramrod_params rx_ramrod;
        struct bnx2x *bp = netdev_priv(dev);
-        int rc, q_logical_state;
+        struct bnx2x_vlan_mac_obj *vlan_obj;
+        unsigned long vlan_mac_flags = 0;
+        unsigned long ramrod_flags = 0;
        struct bnx2x_virtf *vf = NULL;
-        struct pf_vf_bulletin_content *bulletin = NULL;
+        unsigned long accept_flags;
+        int rc;
        /* sanity and init */
        rc = bnx2x_vf_ndo_prep(bp, vfidx, &vf, &bulletin);
@@ -3452,104 +3477,118 @@ int bnx2x_set_vf_vlan(struct net_device *dev, int vfidx, u16 vlan, u8 qos)
        /* update PF's copy of the VF's bulletin. No point in posting the vlan
         * to the VF since it doesn't have anything to do with it. But it useful
         * to store it here in case the VF is not up yet and we can only
-         * configure the vlan later when it does.
+         * configure the vlan later when it does. Treat vlan id 0 as remove the
+         * Host tag.
         */
-        bulletin->valid_bitmap |= 1 << VLAN_VALID;
+        if (vlan > 0)
+                bulletin->valid_bitmap |= 1 << VLAN_VALID;
+        else
+                bulletin->valid_bitmap &= ~(1 << VLAN_VALID);
        bulletin->vlan = vlan;
        /* is vf initialized and queue set up? */
-        q_logical_state =
+        if (vf->state != VF_ENABLED ||
-                bnx2x_get_q_logical_state(bp, &bnx2x_leading_vfq(vf, sp_obj));
+            bnx2x_get_q_logical_state(bp, &bnx2x_leading_vfq(vf, sp_obj)) !=
-        if (vf->state == VF_ENABLED &&
+            BNX2X_Q_LOGICAL_STATE_ACTIVE)
-            q_logical_state == BNX2X_Q_LOGICAL_STATE_ACTIVE) {
+                return rc;
-                /* configure the vlan in device on this vf's queue */
-                unsigned long ramrod_flags = 0;
-                unsigned long vlan_mac_flags = 0;
-                struct bnx2x_vlan_mac_obj *vlan_obj =
-                        &bnx2x_leading_vfq(vf, vlan_obj);
-                struct bnx2x_vlan_mac_ramrod_params ramrod_param;
-                struct bnx2x_queue_state_params q_params = {NULL};
-                struct bnx2x_queue_update_params *update_params;
-                rc = validate_vlan_mac(bp, &bnx2x_leading_vfq(vf, mac_obj));
+        /* configure the vlan in device on this vf's queue */
-                if (rc)
+        vlan_obj = &bnx2x_leading_vfq(vf, vlan_obj);
-                        return rc;
+        rc = validate_vlan_mac(bp, &bnx2x_leading_vfq(vf, mac_obj));
-                memset(&ramrod_param, 0, sizeof(ramrod_param));
+        if (rc)
+                return rc;
-                /* must lock vfpf channel to protect against vf flows */
+        /* must lock vfpf channel to protect against vf flows */
-                bnx2x_lock_vf_pf_channel(bp, vf, CHANNEL_TLV_PF_SET_VLAN);
+        bnx2x_lock_vf_pf_channel(bp, vf, CHANNEL_TLV_PF_SET_VLAN);
-                /* remove existing vlans */
+        /* remove existing vlans */
-                __set_bit(RAMROD_COMP_WAIT, &ramrod_flags);
+        __set_bit(RAMROD_COMP_WAIT, &ramrod_flags);
-                rc = vlan_obj->delete_all(bp, vlan_obj, &vlan_mac_flags,
+        rc = vlan_obj->delete_all(bp, vlan_obj, &vlan_mac_flags,
-                                          &ramrod_flags);
+                                  &ramrod_flags);
-                if (rc) {
+        if (rc) {
-                        BNX2X_ERR("failed to delete vlans\n");
+                BNX2X_ERR("failed to delete vlans\n");
-                        rc = -EINVAL;
+                rc = -EINVAL;
-                        goto out;
+                goto out;
-                }
+        }
+        /* need to remove/add the VF's accept_any_vlan bit */
+        accept_flags = bnx2x_leading_vfq(vf, accept_flags);
+        if (vlan)
+                clear_bit(BNX2X_ACCEPT_ANY_VLAN, &accept_flags);
+        else
+                set_bit(BNX2X_ACCEPT_ANY_VLAN, &accept_flags);
+        bnx2x_vf_prep_rx_mode(bp, LEADING_IDX, &rx_ramrod, vf,
+                              accept_flags);
+        bnx2x_leading_vfq(vf, accept_flags) = accept_flags;
+        bnx2x_config_rx_mode(bp, &rx_ramrod);
+        /* configure the new vlan to device */
+        memset(&ramrod_param, 0, sizeof(ramrod_param));
+        __set_bit(RAMROD_COMP_WAIT, &ramrod_flags);
+        ramrod_param.vlan_mac_obj = vlan_obj;
+        ramrod_param.ramrod_flags = ramrod_flags;
+        set_bit(BNX2X_DONT_CONSUME_CAM_CREDIT,
+                &ramrod_param.user_req.vlan_mac_flags);
+        ramrod_param.user_req.u.vlan.vlan = vlan;
+        ramrod_param.user_req.cmd = BNX2X_VLAN_MAC_ADD;
+        rc = bnx2x_config_vlan_mac(bp, &ramrod_param);
+        if (rc) {
+                BNX2X_ERR("failed to configure vlan\n");
+                rc =  -EINVAL;
+                goto out;
+        }
-                /* send queue update ramrod to configure default vlan and silent
+        /* send queue update ramrod to configure default vlan and silent
-                 * vlan removal
+         * vlan removal
+         */
+        __set_bit(RAMROD_COMP_WAIT, &q_params.ramrod_flags);
+        q_params.cmd = BNX2X_Q_CMD_UPDATE;
+        q_params.q_obj = &bnx2x_leading_vfq(vf, sp_obj);
+        update_params = &q_params.params.update;
+        __set_bit(BNX2X_Q_UPDATE_DEF_VLAN_EN_CHNG,
+                  &update_params->update_flags);
+        __set_bit(BNX2X_Q_UPDATE_SILENT_VLAN_REM_CHNG,
+                  &update_params->update_flags);
+        if (vlan == 0) {
+                /* if vlan is 0 then we want to leave the VF traffic
+                 * untagged, and leave the incoming traffic untouched
+                 * (i.e. do not remove any vlan tags).
+                 */
+                __clear_bit(BNX2X_Q_UPDATE_DEF_VLAN_EN,
+                            &update_params->update_flags);
+                __clear_bit(BNX2X_Q_UPDATE_SILENT_VLAN_REM,
+                            &update_params->update_flags);
+        } else {
+                /* configure default vlan to vf queue and set silent
+                 * vlan removal (the vf remains unaware of this vlan).
                 */
-                __set_bit(RAMROD_COMP_WAIT, &q_params.ramrod_flags);
+                __set_bit(BNX2X_Q_UPDATE_DEF_VLAN_EN,
-                q_params.cmd = BNX2X_Q_CMD_UPDATE;
-                q_params.q_obj = &bnx2x_leading_vfq(vf, sp_obj);
-                update_params = &q_params.params.update;
-                __set_bit(BNX2X_Q_UPDATE_DEF_VLAN_EN_CHNG,
                          &update_params->update_flags);
-                __set_bit(BNX2X_Q_UPDATE_SILENT_VLAN_REM_CHNG,
+                __set_bit(BNX2X_Q_UPDATE_SILENT_VLAN_REM,
                          &update_params->update_flags);
+                update_params->def_vlan = vlan;
+                update_params->silent_removal_value =
+                        vlan & VLAN_VID_MASK;
+                update_params->silent_removal_mask = VLAN_VID_MASK;
+        }
-                if (vlan == 0) {
+        /* Update the Queue state */
-                        /* if vlan is 0 then we want to leave the VF traffic
+        rc = bnx2x_queue_state_change(bp, &q_params);
-                         * untagged, and leave the incoming traffic untouched
+        if (rc) {
-                         * (i.e. do not remove any vlan tags).
+                BNX2X_ERR("Failed to configure default VLAN\n");
-                         */
+                goto out;
-                        __clear_bit(BNX2X_Q_UPDATE_DEF_VLAN_EN,
+        }
-                                    &update_params->update_flags);
-                        __clear_bit(BNX2X_Q_UPDATE_SILENT_VLAN_REM,
-                                    &update_params->update_flags);
-                } else {
-                        /* configure the new vlan to device */
-                        __set_bit(RAMROD_COMP_WAIT, &ramrod_flags);
-                        ramrod_param.vlan_mac_obj = vlan_obj;
-                        ramrod_param.ramrod_flags = ramrod_flags;
-                        ramrod_param.user_req.u.vlan.vlan = vlan;
-                        ramrod_param.user_req.cmd = BNX2X_VLAN_MAC_ADD;
-                        rc = bnx2x_config_vlan_mac(bp, &ramrod_param);
-                        if (rc) {
-                                BNX2X_ERR("failed to configure vlan\n");
-                                rc =  -EINVAL;
-                                goto out;
-                        }
-                        /* configure default vlan to vf queue and set silent
-                         * vlan removal (the vf remains unaware of this vlan).
-                         */
-                        update_params = &q_params.params.update;
-                        __set_bit(BNX2X_Q_UPDATE_DEF_VLAN_EN,
-                                  &update_params->update_flags);
-                        __set_bit(BNX2X_Q_UPDATE_SILENT_VLAN_REM,
-                                  &update_params->update_flags);
-                        update_params->def_vlan = vlan;
-                }
-                /* Update the Queue state */
-                rc = bnx2x_queue_state_change(bp, &q_params);
-                if (rc) {
-                        BNX2X_ERR("Failed to configure default VLAN\n");
-                        goto out;
-                }
-                /* clear the flag indicating that this VF needs its vlan
+        /* clear the flag indicating that this VF needs its vlan
-                 * (will only be set if the HV configured the Vlan before vf was
+         * (will only be set if the HV configured the Vlan before vf was
-                 * up and we were called because the VF came up later
+         * up and we were called because the VF came up later
-                 */
+         */
 out:
-                vf->cfg_flags &= ~VF_CFG_VLAN;
+        vf->cfg_flags &= ~VF_CFG_VLAN;
-                bnx2x_unlock_vf_pf_channel(bp, vf, CHANNEL_TLV_PF_SET_VLAN);
+        bnx2x_unlock_vf_pf_channel(bp, vf, CHANNEL_TLV_PF_SET_VLAN);
-        }
        return rc;
 }
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h
index 1ff6a9366629..8c213fa52174 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h
@@ -74,6 +74,7 @@ struct bnx2x_vf_queue {
        /* VLANs object */
        struct bnx2x_vlan_mac_obj       vlan_obj;
        atomic_t vlan_count;            /* 0 means vlan-0 is set  ~ untagged */
+        unsigned long accept_flags;     /* last accept flags configured */
        /* Queue Slow-path State object */
        struct bnx2x_queue_sp_obj       sp_obj;
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c
index efa8a151d789..0756d7dabdd5 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c
@@ -208,7 +208,7 @@ static int bnx2x_get_vf_id(struct bnx2x *bp, u32 *vf_id)
                return -EINVAL;
        }
-        BNX2X_ERR("valid ME register value: 0x%08x\n", me_reg);
+        DP(BNX2X_MSG_IOV, "valid ME register value: 0x%08x\n", me_reg);
        *vf_id = (me_reg & ME_REG_VF_NUM_MASK) >> ME_REG_VF_NUM_SHIFT;
@@ -1598,6 +1598,8 @@ static void bnx2x_vfop_mbx_qfilters(struct bnx2x *bp, struct bnx2x_virtf *vf)
                if (msg->flags & VFPF_SET_Q_FILTERS_RX_MASK_CHANGED) {
                        unsigned long accept = 0;
+                        struct pf_vf_bulletin_content *bulletin =
+                                BP_VF_BULLETIN(bp, vf->index);
                        /* covert VF-PF if mask to bnx2x accept flags */
                        if (msg->rx_mask & VFPF_RX_MASK_ACCEPT_MATCHED_UNICAST)
@@ -1617,9 +1619,11 @@ static void bnx2x_vfop_mbx_qfilters(struct bnx2x *bp, struct bnx2x_virtf *vf)
                                __set_bit(BNX2X_ACCEPT_BROADCAST, &accept);
                        /* A packet arriving the vf's mac should be accepted
-                         * with any vlan
+                         * with any vlan, unless a vlan has already been
+                         * configured.
                         */
-                        __set_bit(BNX2X_ACCEPT_ANY_VLAN, &accept);
+                        if (!(bulletin->valid_bitmap & (1 << VLAN_VALID)))
+                                __set_bit(BNX2X_ACCEPT_ANY_VLAN, &accept);
                        /* set rx-mode */
                        rc = bnx2x_vfop_rxmode_cmd(bp, vf, &cmd,
@@ -1710,6 +1714,21 @@ static void bnx2x_vf_mbx_set_q_filters(struct bnx2x *bp,
                        goto response;
                }
        }
+        /* if vlan was set by hypervisor we don't allow guest to config vlan */
+        if (bulletin->valid_bitmap & 1 << VLAN_VALID) {
+                int i;
+                /* search for vlan filters */
+                for (i = 0; i < filters->n_mac_vlan_filters; i++) {
+                        if (filters->filters[i].flags &
+                            VFPF_Q_FILTER_VLAN_TAG_VALID) {
+                                BNX2X_ERR("VF[%d] attempted to configure vlan but one was already set by Hypervisor. Aborting request\n",
+                                          vf->abs_vfid);
+                                vf->op_rc = -EPERM;
+                                goto response;
+                        }
+                }
+        }
        /* verify vf_qid */
        if (filters->vf_qid > vf_rxq_count(vf))
@@ -1805,6 +1824,9 @@ static void bnx2x_vf_mbx_update_rss(struct bnx2x *bp, struct bnx2x_virtf *vf,
        vf_op_params->rss_result_mask = rss_tlv->rss_result_mask;
        /* flags handled individually for backward/forward compatability */
+        vf_op_params->rss_flags = 0;
+        vf_op_params->ramrod_flags = 0;
        if (rss_tlv->rss_flags & VFPF_RSS_MODE_DISABLED)
                __set_bit(BNX2X_RSS_MODE_DISABLED, &vf_op_params->rss_flags);
        if (rss_tlv->rss_flags & VFPF_RSS_MODE_REGULAR)
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index a9e068423ba0..15a66e4b1f57 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -7622,7 +7622,7 @@ static inline int tg3_4g_overflow_test(dma_addr_t mapping, int len)
 {
        u32 base = (u32) mapping & 0xffffffff;
-        return (base > 0xffffdcc0) && (base + len + 8 < base);
+        return base + len + 8 < base;
 }
 /* Test for TSO DMA buffers that cross into regions which are within MSS bytes
@@ -8932,6 +8932,9 @@ static int tg3_chip_reset(struct tg3 *tp)
        void (*write_op)(struct tg3 *, u32, u32);
        int i, err;
+        if (!pci_device_is_present(tp->pdev))
+                return -ENODEV;
        tg3_nvram_lock(tp);
        tg3_ape_lock(tp, TG3_APE_LOCK_GRC);
@@ -10629,10 +10632,8 @@ static void tg3_sd_scan_scratchpad(struct tg3 *tp, struct tg3_ocir *ocir)
 static ssize_t tg3_show_temp(struct device *dev,
                             struct device_attribute *devattr, char *buf)
 {
-        struct pci_dev *pdev = to_pci_dev(dev);
-        struct net_device *netdev = pci_get_drvdata(pdev);
-        struct tg3 *tp = netdev_priv(netdev);
        struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr);
+        struct tg3 *tp = dev_get_drvdata(dev);
        u32 temperature;
        spin_lock_bh(&tp->lock);
@@ -10650,29 +10651,25 @@ static SENSOR_DEVICE_ATTR(temp1_crit, S_IRUGO, tg3_show_temp, NULL,
 static SENSOR_DEVICE_ATTR(temp1_max, S_IRUGO, tg3_show_temp, NULL,
                          TG3_TEMP_MAX_OFFSET);
-static struct attribute *tg3_attributes[] = {
+static struct attribute *tg3_attrs[] = {
        &sensor_dev_attr_temp1_input.dev_attr.attr,
        &sensor_dev_attr_temp1_crit.dev_attr.attr,
        &sensor_dev_attr_temp1_max.dev_attr.attr,
        NULL
 };
+ATTRIBUTE_GROUPS(tg3);
-static const struct attribute_group tg3_group = {
-        .attrs = tg3_attributes,
-};
 static void tg3_hwmon_close(struct tg3 *tp)
 {
        if (tp->hwmon_dev) {
                hwmon_device_unregister(tp->hwmon_dev);
                tp->hwmon_dev = NULL;
-                sysfs_remove_group(&tp->pdev->dev.kobj, &tg3_group);
        }
 }
 static void tg3_hwmon_open(struct tg3 *tp)
 {
-        int i, err;
+        int i;
        u32 size = 0;
        struct pci_dev *pdev = tp->pdev;
        struct tg3_ocir ocirs[TG3_SD_NUM_RECS];
@@ -10690,18 +10687,11 @@ static void tg3_hwmon_open(struct tg3 *tp)
        if (!size)
                return;
-        /* Register hwmon sysfs hooks */
+        tp->hwmon_dev = hwmon_device_register_with_groups(&pdev->dev, "tg3",
-        err = sysfs_create_group(&pdev->dev.kobj, &tg3_group);
+                                                          tp, tg3_groups);
-        if (err) {
-                dev_err(&pdev->dev, "Cannot create sysfs group, aborting\n");
-                return;
-        }
-        tp->hwmon_dev = hwmon_device_register(&pdev->dev);
        if (IS_ERR(tp->hwmon_dev)) {
                tp->hwmon_dev = NULL;
                dev_err(&pdev->dev, "Cannot register hwmon device, aborting\n");
-                sysfs_remove_group(&pdev->dev.kobj, &tg3_group);
        }
 }
@@ -11594,10 +11584,11 @@ static int tg3_close(struct net_device *dev)
        memset(&tp->net_stats_prev, 0, sizeof(tp->net_stats_prev));
        memset(&tp->estats_prev, 0, sizeof(tp->estats_prev));
-        tg3_power_down_prepare(tp);
+        if (pci_device_is_present(tp->pdev)) {
+                tg3_power_down_prepare(tp);
-        tg3_carrier_off(tp);
+                tg3_carrier_off(tp);
+        }
        return 0;
 }
@@ -16512,6 +16503,9 @@ static int tg3_get_invariants(struct tg3 *tp, const struct pci_device_id *ent)
        /* Clear this out for sanity. */
        tw32(TG3PCI_MEM_WIN_BASE_ADDR, 0);
+        /* Clear TG3PCI_REG_BASE_ADDR to prevent hangs. */
+        tw32(TG3PCI_REG_BASE_ADDR, 0);
        pci_read_config_dword(tp->pdev, TG3PCI_PCISTATE,
                              &pci_state_reg);
        if ((pci_state_reg & PCISTATE_CONV_PCI_MODE) == 0 &&
@@ -17739,10 +17733,12 @@ static int tg3_suspend(struct device *device)
        struct pci_dev *pdev = to_pci_dev(device);
        struct net_device *dev = pci_get_drvdata(pdev);
        struct tg3 *tp = netdev_priv(dev);
-        int err;
+        int err = 0;
+        rtnl_lock();
        if (!netif_running(dev))
-                return 0;
+                goto unlock;
        tg3_reset_task_cancel(tp);
        tg3_phy_stop(tp);
@@ -17784,6 +17780,8 @@ out:
                        tg3_phy_start(tp);
        }
+unlock:
+        rtnl_unlock();
        return err;
 }
@@ -17792,10 +17790,12 @@ static int tg3_resume(struct device *device)
        struct pci_dev *pdev = to_pci_dev(device);
        struct net_device *dev = pci_get_drvdata(pdev);
        struct tg3 *tp = netdev_priv(dev);
-        int err;
+        int err = 0;
+        rtnl_lock();
        if (!netif_running(dev))
-                return 0;
+                goto unlock;
        netif_device_attach(dev);
@@ -17819,6 +17819,8 @@ out:
        if (!err)
                tg3_phy_start(tp);
+unlock:
+        rtnl_unlock();
        return err;
 }
 #endif /* CONFIG_PM_SLEEP */
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h b/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
index ecd2fb3ef695..56e0415f8cdf 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
@@ -49,13 +49,15 @@
 #include <asm/io.h>
 #include "cxgb4_uld.h"
-#define FW_VERSION_MAJOR 1
+#define T4FW_VERSION_MAJOR 0x01
-#define FW_VERSION_MINOR 4
+#define T4FW_VERSION_MINOR 0x06
-#define FW_VERSION_MICRO 0
+#define T4FW_VERSION_MICRO 0x18
+#define T4FW_VERSION_BUILD 0x00
-#define FW_VERSION_MAJOR_T5 0
+#define T5FW_VERSION_MAJOR 0x01
-#define FW_VERSION_MINOR_T5 0
+#define T5FW_VERSION_MINOR 0x08
-#define FW_VERSION_MICRO_T5 0
+#define T5FW_VERSION_MICRO 0x1C
+#define T5FW_VERSION_BUILD 0x00
 #define CH_WARN(adap, fmt, ...) dev_warn(adap->pdev_dev, fmt, ## __VA_ARGS__)
@@ -226,6 +228,25 @@ struct tp_params {
        uint32_t dack_re;            /* DACK timer resolution */
        unsigned short tx_modq[NCHAN];  /* channel to modulation queue map */
+        u32 vlan_pri_map;               /* cached TP_VLAN_PRI_MAP */
+        u32 ingress_config;             /* cached TP_INGRESS_CONFIG */
+        /* TP_VLAN_PRI_MAP Compressed Filter Tuple field offsets.  This is a
+         * subset of the set of fields which may be present in the Compressed
+         * Filter Tuple portion of filters and TCP TCB connections.  The
+         * fields which are present are controlled by the TP_VLAN_PRI_MAP.
+         * Since a variable number of fields may or may not be present, their
+         * shifted field positions within the Compressed Filter Tuple may
+         * vary, or not even be present if the field isn't selected in
+         * TP_VLAN_PRI_MAP.  Since some of these fields are needed in various
+         * places we store their offsets here, or a -1 if the field isn't
+         * present.
+         */
+        int vlan_shift;
+        int vnic_shift;
+        int port_shift;
+        int protocol_shift;
 };
 struct vpd_params {
@@ -240,6 +261,26 @@ struct pci_params {
        unsigned char width;
 };
+#define CHELSIO_CHIP_CODE(version, revision) (((version) << 4) | (revision))
+#define CHELSIO_CHIP_FPGA          0x100
+#define CHELSIO_CHIP_VERSION(code) (((code) >> 4) & 0xf)
+#define CHELSIO_CHIP_RELEASE(code) ((code) & 0xf)
+#define CHELSIO_T4              0x4
+#define CHELSIO_T5              0x5
+enum chip_type {
+        T4_A1 = CHELSIO_CHIP_CODE(CHELSIO_T4, 1),
+        T4_A2 = CHELSIO_CHIP_CODE(CHELSIO_T4, 2),
+        T4_FIRST_REV    = T4_A1,
+        T4_LAST_REV     = T4_A2,
+        T5_A0 = CHELSIO_CHIP_CODE(CHELSIO_T5, 0),
+        T5_A1 = CHELSIO_CHIP_CODE(CHELSIO_T5, 1),
+        T5_FIRST_REV    = T5_A0,
+        T5_LAST_REV     = T5_A1,
+};
 struct adapter_params {
        struct tp_params  tp;
        struct vpd_params vpd;
@@ -259,7 +300,7 @@ struct adapter_params {
        unsigned char nports;             /* # of ethernet ports */
        unsigned char portvec;
-        unsigned char rev;                /* chip revision */
+        enum chip_type chip;               /* chip code */
        unsigned char offload;
        unsigned char bypass;
@@ -267,6 +308,23 @@ struct adapter_params {
        unsigned int ofldq_wr_cred;
 };
+#include "t4fw_api.h"
+#define FW_VERSION(chip) ( \
+                FW_HDR_FW_VER_MAJOR_GET(chip##FW_VERSION_MAJOR) | \
+                FW_HDR_FW_VER_MINOR_GET(chip##FW_VERSION_MINOR) | \
+                FW_HDR_FW_VER_MICRO_GET(chip##FW_VERSION_MICRO) | \
+                FW_HDR_FW_VER_BUILD_GET(chip##FW_VERSION_BUILD))
+#define FW_INTFVER(chip, intf) (FW_HDR_INTFVER_##intf)
+struct fw_info {
+        u8 chip;
+        char *fs_name;
+        char *fw_mod_name;
+        struct fw_hdr fw_hdr;
+};
 struct trace_params {
        u32 data[TRACE_LEN / 4];
        u32 mask[TRACE_LEN / 4];
@@ -512,25 +570,6 @@ struct sge {
 struct l2t_data;
-#define CHELSIO_CHIP_CODE(version, revision) (((version) << 4) | (revision))
-#define CHELSIO_CHIP_VERSION(code) ((code) >> 4)
-#define CHELSIO_CHIP_RELEASE(code) ((code) & 0xf)
-#define CHELSIO_T4              0x4
-#define CHELSIO_T5              0x5
-enum chip_type {
-        T4_A1 = CHELSIO_CHIP_CODE(CHELSIO_T4, 0),
-        T4_A2 = CHELSIO_CHIP_CODE(CHELSIO_T4, 1),
-        T4_A3 = CHELSIO_CHIP_CODE(CHELSIO_T4, 2),
-        T4_FIRST_REV    = T4_A1,
-        T4_LAST_REV     = T4_A3,
-        T5_A1 = CHELSIO_CHIP_CODE(CHELSIO_T5, 0),
-        T5_FIRST_REV    = T5_A1,
-        T5_LAST_REV     = T5_A1,
-};
 #ifdef CONFIG_PCI_IOV
 /* T4 supports SRIOV on PF0-3 and T5 on PF0-7.  However, the Serial
@@ -715,12 +754,12 @@ enum {
 static inline int is_t5(enum chip_type chip)
 {
-        return (chip >= T5_FIRST_REV && chip <= T5_LAST_REV);
+        return CHELSIO_CHIP_VERSION(chip) == CHELSIO_T5;
 }
 static inline int is_t4(enum chip_type chip)
 {
-        return (chip >= T4_FIRST_REV && chip <= T4_LAST_REV);
+        return CHELSIO_CHIP_VERSION(chip) == CHELSIO_T4;
 }
 static inline u32 t4_read_reg(struct adapter *adap, u32 reg_addr)
@@ -900,8 +939,14 @@ int get_vpd_params(struct adapter *adapter, struct vpd_params *p);
 int t4_load_fw(struct adapter *adapter, const u8 *fw_data, unsigned int size);
 unsigned int t4_flash_cfg_addr(struct adapter *adapter);
 int t4_load_cfg(struct adapter *adapter, const u8 *cfg_data, unsigned int size);
-int t4_check_fw_version(struct adapter *adapter);
+int t4_get_fw_version(struct adapter *adapter, u32 *vers);
+int t4_get_tp_version(struct adapter *adapter, u32 *vers);
+int t4_prep_fw(struct adapter *adap, struct fw_info *fw_info,
+               const u8 *fw_data, unsigned int fw_size,
+               struct fw_hdr *card_fw, enum dev_state state, int *reset);
 int t4_prep_adapter(struct adapter *adapter);
+int t4_init_tp_params(struct adapter *adap);
+int t4_filter_field_shift(const struct adapter *adap, int filter_sel);
 int t4_port_init(struct adapter *adap, int mbox, int pf, int vf);
 void t4_fatal_err(struct adapter *adapter);
 int t4_config_rss_range(struct adapter *adapter, int mbox, unsigned int viid,
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
index 8b929eeecd2d..fff02ed1295e 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
@@ -276,9 +276,9 @@ static DEFINE_PCI_DEVICE_TABLE(cxgb4_pci_tbl) = {
        { 0, }
 };
-#define FW_FNAME "cxgb4/t4fw.bin"
+#define FW4_FNAME "cxgb4/t4fw.bin"
 #define FW5_FNAME "cxgb4/t5fw.bin"
-#define FW_CFNAME "cxgb4/t4-config.txt"
+#define FW4_CFNAME "cxgb4/t4-config.txt"
 #define FW5_CFNAME "cxgb4/t5-config.txt"
 MODULE_DESCRIPTION(DRV_DESC);
@@ -286,7 +286,7 @@ MODULE_AUTHOR("Chelsio Communications");
 MODULE_LICENSE("Dual BSD/GPL");
 MODULE_VERSION(DRV_VERSION);
 MODULE_DEVICE_TABLE(pci, cxgb4_pci_tbl);
-MODULE_FIRMWARE(FW_FNAME);
+MODULE_FIRMWARE(FW4_FNAME);
 MODULE_FIRMWARE(FW5_FNAME);
 /*
@@ -1071,72 +1071,6 @@ freeout:	t4_free_sge_resources(adap);
 }
 /*
- * Returns 0 if new FW was successfully loaded, a positive errno if a load was
- * started but failed, and a negative errno if flash load couldn't start.
- */
-static int upgrade_fw(struct adapter *adap)
-{
-        int ret;
-        u32 vers, exp_major;
-        const struct fw_hdr *hdr;
-        const struct firmware *fw;
-        struct device *dev = adap->pdev_dev;
-        char *fw_file_name;
-        switch (CHELSIO_CHIP_VERSION(adap->chip)) {
-        case CHELSIO_T4:
-                fw_file_name = FW_FNAME;
-                exp_major = FW_VERSION_MAJOR;
-                break;
-        case CHELSIO_T5:
-                fw_file_name = FW5_FNAME;
-                exp_major = FW_VERSION_MAJOR_T5;
-                break;
-        default:
-                dev_err(dev, "Unsupported chip type, %x\n", adap->chip);
-                return -EINVAL;
-        }
-        ret = request_firmware(&fw, fw_file_name, dev);
-        if (ret < 0) {
-                dev_err(dev, "unable to load firmware image %s, error %d\n",
-                        fw_file_name, ret);
-                return ret;
-        }
-        hdr = (const struct fw_hdr *)fw->data;
-        vers = ntohl(hdr->fw_ver);
-        if (FW_HDR_FW_VER_MAJOR_GET(vers) != exp_major) {
-                ret = -EINVAL;              /* wrong major version, won't do */
-                goto out;
-        }
-        /*
-         * If the flash FW is unusable or we found something newer, load it.
-         */
-        if (FW_HDR_FW_VER_MAJOR_GET(adap->params.fw_vers) != exp_major ||
-            vers > adap->params.fw_vers) {
-                dev_info(dev, "upgrading firmware ...\n");
-                ret = t4_fw_upgrade(adap, adap->mbox, fw->data, fw->size,
-                                    /*force=*/false);
-                if (!ret)
-                        dev_info(dev,
-                                 "firmware upgraded to version %pI4 from %s\n",
-                                 &hdr->fw_ver, fw_file_name);
-                else
-                        dev_err(dev, "firmware upgrade failed! err=%d\n", -ret);
-        } else {
-                /*
-                 * Tell our caller that we didn't upgrade the firmware.
-                 */
-                ret = -EINVAL;
-        }
-out:    release_firmware(fw);
-        return ret;
-}
-/*
 * Allocate a chunk of memory using kmalloc or, if that fails, vmalloc.
 * The allocated memory is cleared.
 */
@@ -1415,7 +1349,7 @@ static int get_sset_count(struct net_device *dev, int sset)
 static int get_regs_len(struct net_device *dev)
 {
        struct adapter *adap = netdev2adap(dev);
-        if (is_t4(adap->chip))
+        if (is_t4(adap->params.chip))
                return T4_REGMAP_SIZE;
        else
                return T5_REGMAP_SIZE;
@@ -1499,7 +1433,7 @@ static void get_stats(struct net_device *dev, struct ethtool_stats *stats,
        data += sizeof(struct port_stats) / sizeof(u64);
        collect_sge_port_stats(adapter, pi, (struct queue_port_stats *)data);
        data += sizeof(struct queue_port_stats) / sizeof(u64);
-        if (!is_t4(adapter->chip)) {
+        if (!is_t4(adapter->params.chip)) {
                t4_write_reg(adapter, SGE_STAT_CFG, STATSOURCE_T5(7));
                val1 = t4_read_reg(adapter, SGE_STAT_TOTAL);
                val2 = t4_read_reg(adapter, SGE_STAT_MATCH);
@@ -1521,8 +1455,8 @@ static void get_stats(struct net_device *dev, struct ethtool_stats *stats,
 */
 static inline unsigned int mk_adap_vers(const struct adapter *ap)
 {
-        return CHELSIO_CHIP_VERSION(ap->chip) |
+        return CHELSIO_CHIP_VERSION(ap->params.chip) |
-                (CHELSIO_CHIP_RELEASE(ap->chip) << 10) | (1 << 16);
+                (CHELSIO_CHIP_RELEASE(ap->params.chip) << 10) | (1 << 16);
 }
 static void reg_block_dump(struct adapter *ap, void *buf, unsigned int start,
@@ -2189,7 +2123,7 @@ static void get_regs(struct net_device *dev, struct ethtool_regs *regs,
        static const unsigned int *reg_ranges;
        int arr_size = 0, buf_size = 0;
-        if (is_t4(ap->chip)) {
+        if (is_t4(ap->params.chip)) {
                reg_ranges = &t4_reg_ranges[0];
                arr_size = ARRAY_SIZE(t4_reg_ranges);
                buf_size = T4_REGMAP_SIZE;
@@ -2967,7 +2901,7 @@ static int setup_debugfs(struct adapter *adap)
                size = t4_read_reg(adap, MA_EDRAM1_BAR);
                add_debugfs_mem(adap, "edc1", MEM_EDC1, EDRAM_SIZE_GET(size));
        }
-        if (is_t4(adap->chip)) {
+        if (is_t4(adap->params.chip)) {
                size = t4_read_reg(adap, MA_EXT_MEMORY_BAR);
                if (i & EXT_MEM_ENABLE)
                        add_debugfs_mem(adap, "mc", MEM_MC,
@@ -3052,7 +2986,14 @@ int cxgb4_alloc_stid(struct tid_info *t, int family, void *data)
        if (stid >= 0) {
                t->stid_tab[stid].data = data;
                stid += t->stid_base;
-                t->stids_in_use++;
+                /* IPv6 requires max of 520 bits or 16 cells in TCAM
+                 * This is equivalent to 4 TIDs. With CLIP enabled it
+                 * needs 2 TIDs.
+                 */
+                if (family == PF_INET)
+                        t->stids_in_use++;
+                else
+                        t->stids_in_use += 4;
        }
        spin_unlock_bh(&t->stid_lock);
        return stid;
@@ -3078,7 +3019,8 @@ int cxgb4_alloc_sftid(struct tid_info *t, int family, void *data)
        }
        if (stid >= 0) {
                t->stid_tab[stid].data = data;
-                stid += t->stid_base;
+                stid -= t->nstids;
+                stid += t->sftid_base;
                t->stids_in_use++;
        }
        spin_unlock_bh(&t->stid_lock);
@@ -3090,14 +3032,24 @@ EXPORT_SYMBOL(cxgb4_alloc_sftid);
 */
 void cxgb4_free_stid(struct tid_info *t, unsigned int stid, int family)
 {
-        stid -= t->stid_base;
+        /* Is it a server filter TID? */
+        if (t->nsftids && (stid >= t->sftid_base)) {
+                stid -= t->sftid_base;
+                stid += t->nstids;
+        } else {
+                stid -= t->stid_base;
+        }
        spin_lock_bh(&t->stid_lock);
        if (family == PF_INET)
                __clear_bit(stid, t->stid_bmap);
        else
                bitmap_release_region(t->stid_bmap, stid, 2);
        t->stid_tab[stid].data = NULL;
-        t->stids_in_use--;
+        if (family == PF_INET)
+                t->stids_in_use--;
+        else
+                t->stids_in_use -= 4;
        spin_unlock_bh(&t->stid_lock);
 }
 EXPORT_SYMBOL(cxgb4_free_stid);
@@ -3200,6 +3152,7 @@ static int tid_init(struct tid_info *t)
        size_t size;
        unsigned int stid_bmap_size;
        unsigned int natids = t->natids;
+        struct adapter *adap = container_of(t, struct adapter, tids);
        stid_bmap_size = BITS_TO_LONGS(t->nstids + t->nsftids);
        size = t->ntids * sizeof(*t->tid_tab) +
@@ -3233,6 +3186,11 @@ static int tid_init(struct tid_info *t)
                t->afree = t->atid_tab;
        }
        bitmap_zero(t->stid_bmap, t->nstids + t->nsftids);
+        /* Reserve stid 0 for T4/T5 adapters */
+        if (!t->stid_base &&
+            (is_t4(adap->params.chip) || is_t5(adap->params.chip)))
+                __set_bit(0, t->stid_bmap);
        return 0;
 }
@@ -3419,7 +3377,7 @@ unsigned int cxgb4_dbfifo_count(const struct net_device *dev, int lpfifo)
        v1 = t4_read_reg(adap, A_SGE_DBFIFO_STATUS);
        v2 = t4_read_reg(adap, SGE_DBFIFO_STATUS2);
-        if (is_t4(adap->chip)) {
+        if (is_t4(adap->params.chip)) {
                lp_count = G_LP_COUNT(v1);
                hp_count = G_HP_COUNT(v1);
        } else {
@@ -3588,7 +3546,7 @@ static void drain_db_fifo(struct adapter *adap, int usecs)
        do {
                v1 = t4_read_reg(adap, A_SGE_DBFIFO_STATUS);
                v2 = t4_read_reg(adap, SGE_DBFIFO_STATUS2);
-                if (is_t4(adap->chip)) {
+                if (is_t4(adap->params.chip)) {
                        lp_count = G_LP_COUNT(v1);
                        hp_count = G_HP_COUNT(v1);
                } else {
@@ -3708,7 +3666,7 @@ static void process_db_drop(struct work_struct *work)
        adap = container_of(work, struct adapter, db_drop_task);
-        if (is_t4(adap->chip)) {
+        if (is_t4(adap->params.chip)) {
                disable_dbs(adap);
                notify_rdma_uld(adap, CXGB4_CONTROL_DB_DROP);
                drain_db_fifo(adap, 1);
@@ -3753,7 +3711,7 @@ static void process_db_drop(struct work_struct *work)
 void t4_db_full(struct adapter *adap)
 {
-        if (is_t4(adap->chip)) {
+        if (is_t4(adap->params.chip)) {
                t4_set_reg_field(adap, SGE_INT_ENABLE3,
                                 DBFIFO_HP_INT | DBFIFO_LP_INT, 0);
                queue_work(workq, &adap->db_full_task);
@@ -3762,7 +3720,7 @@ void t4_db_full(struct adapter *adap)
 void t4_db_dropped(struct adapter *adap)
 {
-        if (is_t4(adap->chip))
+        if (is_t4(adap->params.chip))
                queue_work(workq, &adap->db_drop_task);
 }
@@ -3789,7 +3747,7 @@ static void uld_attach(struct adapter *adap, unsigned int uld)
        lli.nchan = adap->params.nports;
        lli.nports = adap->params.nports;
        lli.wr_cred = adap->params.ofldq_wr_cred;
-        lli.adapter_type = adap->params.rev;
+        lli.adapter_type = adap->params.chip;
        lli.iscsi_iolen = MAXRXDATA_GET(t4_read_reg(adap, TP_PARA_REG2));
        lli.udb_density = 1 << QUEUESPERPAGEPF0_GET(
                        t4_read_reg(adap, SGE_EGRESS_QUEUES_PER_PAGE_PF) >>
@@ -3797,7 +3755,7 @@ static void uld_attach(struct adapter *adap, unsigned int uld)
        lli.ucq_density = 1 << QUEUESPERPAGEPF0_GET(
                        t4_read_reg(adap, SGE_INGRESS_QUEUES_PER_PAGE_PF) >>
                        (adap->fn * 4));
-        lli.filt_mode = adap->filter_mode;
+        lli.filt_mode = adap->params.tp.vlan_pri_map;
        /* MODQ_REQ_MAP sets queues 0-3 to chan 0-3 */
        for (i = 0; i < NCHAN; i++)
                lli.tx_modq[i] = i;
@@ -4245,7 +4203,7 @@ int cxgb4_create_server_filter(const struct net_device *dev, unsigned int stid,
        adap = netdev2adap(dev);
        /* Adjust stid to correct filter index */
-        stid -= adap->tids.nstids;
+        stid -= adap->tids.sftid_base;
        stid += adap->tids.nftids;
        /* Check to make sure the filter requested is writable ...
@@ -4271,12 +4229,17 @@ int cxgb4_create_server_filter(const struct net_device *dev, unsigned int stid,
                        f->fs.val.lip[i] = val[i];
                        f->fs.mask.lip[i] = ~0;
                }
-                if (adap->filter_mode & F_PORT) {
+                if (adap->params.tp.vlan_pri_map & F_PORT) {
                        f->fs.val.iport = port;
                        f->fs.mask.iport = mask;
                }
        }
+        if (adap->params.tp.vlan_pri_map & F_PROTOCOL) {
+                f->fs.val.proto = IPPROTO_TCP;
+                f->fs.mask.proto = ~0;
+        }
        f->fs.dirsteer = 1;
        f->fs.iq = queue;
        /* Mark filter as locked */
@@ -4303,7 +4266,7 @@ int cxgb4_remove_server_filter(const struct net_device *dev, unsigned int stid,
        adap = netdev2adap(dev);
        /* Adjust stid to correct filter index */
-        stid -= adap->tids.nstids;
+        stid -= adap->tids.sftid_base;
        stid += adap->tids.nftids;
        f = &adap->tids.ftid_tab[stid];
@@ -4483,7 +4446,7 @@ static void setup_memwin(struct adapter *adap)
        u32 bar0, mem_win0_base, mem_win1_base, mem_win2_base;
        bar0 = pci_resource_start(adap->pdev, 0);  /* truncation intentional */
-        if (is_t4(adap->chip)) {
+        if (is_t4(adap->params.chip)) {
                mem_win0_base = bar0 + MEMWIN0_BASE;
                mem_win1_base = bar0 + MEMWIN1_BASE;
                mem_win2_base = bar0 + MEMWIN2_BASE;
@@ -4668,8 +4631,10 @@ static int adap_init0_config(struct adapter *adapter, int reset)
        const struct firmware *cf;
        unsigned long mtype = 0, maddr = 0;
        u32 finiver, finicsum, cfcsum;
-        int ret, using_flash;
+        int ret;
+        int config_issued = 0;
        char *fw_config_file, fw_config_file_path[256];
+        char *config_name = NULL;
        /*
         * Reset device if necessary.
@@ -4686,9 +4651,9 @@ static int adap_init0_config(struct adapter *adapter, int reset)
         * then use that.  Otherwise, use the configuration file stored
         * in the adapter flash ...
         */
-        switch (CHELSIO_CHIP_VERSION(adapter->chip)) {
+        switch (CHELSIO_CHIP_VERSION(adapter->params.chip)) {
        case CHELSIO_T4:
-                fw_config_file = FW_CFNAME;
+                fw_config_file = FW4_CFNAME;
                break;
        case CHELSIO_T5:
                fw_config_file = FW5_CFNAME;
@@ -4702,13 +4667,16 @@ static int adap_init0_config(struct adapter *adapter, int reset)
        ret = request_firmware(&cf, fw_config_file, adapter->pdev_dev);
        if (ret < 0) {
-                using_flash = 1;
+                config_name = "On FLASH";
                mtype = FW_MEMTYPE_CF_FLASH;
                maddr = t4_flash_cfg_addr(adapter);
        } else {
                u32 params[7], val[7];
-                using_flash = 0;
+                sprintf(fw_config_file_path,
+                        "/lib/firmware/%s", fw_config_file);
+                config_name = fw_config_file_path;
                if (cf->size >= FLASH_CFG_MAX_SIZE)
                        ret = -ENOMEM;
                else {
@@ -4776,6 +4744,26 @@ static int adap_init0_config(struct adapter *adapter, int reset)
                      FW_LEN16(caps_cmd));
        ret = t4_wr_mbox(adapter, adapter->mbox, &caps_cmd, sizeof(caps_cmd),
                         &caps_cmd);
+        /* If the CAPS_CONFIG failed with an ENOENT (for a Firmware
+         * Configuration File in FLASH), our last gasp effort is to use the
+         * Firmware Configuration File which is embedded in the firmware.  A
+         * very few early versions of the firmware didn't have one embedded
+         * but we can ignore those.
+         */
+        if (ret == -ENOENT) {
+                memset(&caps_cmd, 0, sizeof(caps_cmd));
+                caps_cmd.op_to_write =
+                        htonl(FW_CMD_OP(FW_CAPS_CONFIG_CMD) |
+                                        FW_CMD_REQUEST |
+                                        FW_CMD_READ);
+                caps_cmd.cfvalid_to_len16 = htonl(FW_LEN16(caps_cmd));
+                ret = t4_wr_mbox(adapter, adapter->mbox, &caps_cmd,
+                                sizeof(caps_cmd), &caps_cmd);
+                config_name = "Firmware Default";
+        }
+        config_issued = 1;
        if (ret < 0)
                goto bye;
@@ -4816,7 +4804,6 @@ static int adap_init0_config(struct adapter *adapter, int reset)
        if (ret < 0)
                goto bye;
-        sprintf(fw_config_file_path, "/lib/firmware/%s", fw_config_file);
        /*
         * Return successfully and note that we're operating with parameters
         * not supplied by the driver, rather than from hard-wired
@@ -4824,11 +4811,8 @@ static int adap_init0_config(struct adapter *adapter, int reset)
         */
        adapter->flags |= USING_SOFT_PARAMS;
        dev_info(adapter->pdev_dev, "Successfully configured using Firmware "\
-                 "Configuration File %s, version %#x, computed checksum %#x\n",
+                 "Configuration File \"%s\", version %#x, computed checksum %#x\n",
-                 (using_flash
+                 config_name, finiver, cfcsum);
-                  ? "in device FLASH"
-                  : fw_config_file_path),
-                 finiver, cfcsum);
        return 0;
        /*
@@ -4837,9 +4821,9 @@ static int adap_init0_config(struct adapter *adapter, int reset)
         * want to issue a warning since this is fairly common.)
         */
 bye:
-        if (ret != -ENOENT)
+        if (config_issued && ret != -ENOENT)
-                dev_warn(adapter->pdev_dev, "Configuration file error %d\n",
+                dev_warn(adapter->pdev_dev, "\"%s\" configuration file error %d\n",
-                         -ret);
+                         config_name, -ret);
        return ret;
 }
@@ -5086,6 +5070,47 @@ bye:
        return ret;
 }
+static struct fw_info fw_info_array[] = {
+        {
+                .chip = CHELSIO_T4,
+                .fs_name = FW4_CFNAME,
+                .fw_mod_name = FW4_FNAME,
+                .fw_hdr = {
+                        .chip = FW_HDR_CHIP_T4,
+                        .fw_ver = __cpu_to_be32(FW_VERSION(T4)),
+                        .intfver_nic = FW_INTFVER(T4, NIC),
+                        .intfver_vnic = FW_INTFVER(T4, VNIC),
+                        .intfver_ri = FW_INTFVER(T4, RI),
+                        .intfver_iscsi = FW_INTFVER(T4, ISCSI),
+                        .intfver_fcoe = FW_INTFVER(T4, FCOE),
+                },
+        }, {
+                .chip = CHELSIO_T5,
+                .fs_name = FW5_CFNAME,
+                .fw_mod_name = FW5_FNAME,
+                .fw_hdr = {
+                        .chip = FW_HDR_CHIP_T5,
+                        .fw_ver = __cpu_to_be32(FW_VERSION(T5)),
+                        .intfver_nic = FW_INTFVER(T5, NIC),
+                        .intfver_vnic = FW_INTFVER(T5, VNIC),
+                        .intfver_ri = FW_INTFVER(T5, RI),
+                        .intfver_iscsi = FW_INTFVER(T5, ISCSI),
+                        .intfver_fcoe = FW_INTFVER(T5, FCOE),
+                },
+        }
+};
+static struct fw_info *find_fw_info(int chip)
+{
+        int i;
+        for (i = 0; i < ARRAY_SIZE(fw_info_array); i++) {
+                if (fw_info_array[i].chip == chip)
+                        return &fw_info_array[i];
+        }
+        return NULL;
+}
 /*
 * Phase 0 of initialization: contact FW, obtain config, perform basic init.
 */
@@ -5096,7 +5121,7 @@ static int adap_init0(struct adapter *adap)
        enum dev_state state;
        u32 params[7], val[7];
        struct fw_caps_config_cmd caps_cmd;
-        int reset = 1, j;
+        int reset = 1;
        /*
         * Contact FW, advertising Master capability (and potentially forcing
@@ -5123,44 +5148,54 @@ static int adap_init0(struct adapter *adap)
         * later reporting and B. to warn if the currently loaded firmware
         * is excessively mismatched relative to the driver.)
         */
-        ret = t4_check_fw_version(adap);
+        t4_get_fw_version(adap, &adap->params.fw_vers);
+        t4_get_tp_version(adap, &adap->params.tp_vers);
-        /* The error code -EFAULT is returned by t4_check_fw_version() if
-         * firmware on adapter < supported firmware. If firmware on adapter
-         * is too old (not supported by driver) and we're the MASTER_PF set
-         * adapter state to DEV_STATE_UNINIT to force firmware upgrade
-         * and reinitialization.
-         */
-        if ((adap->flags & MASTER_PF) && ret == -EFAULT)
-                state = DEV_STATE_UNINIT;
        if ((adap->flags & MASTER_PF) && state != DEV_STATE_INIT) {
-                if (ret == -EINVAL || ret == -EFAULT || ret > 0) {
+                struct fw_info *fw_info;
-                        if (upgrade_fw(adap) >= 0) {
+                struct fw_hdr *card_fw;
-                                /*
+                const struct firmware *fw;
-                                 * Note that the chip was reset as part of the
+                const u8 *fw_data = NULL;
-                                 * firmware upgrade so we don't reset it again
+                unsigned int fw_size = 0;
-                                 * below and grab the new firmware version.
-                                 */
+                /* This is the firmware whose headers the driver was compiled
-                                reset = 0;
+                 * against
-                                ret = t4_check_fw_version(adap);
+                 */
-                        } else
+                fw_info = find_fw_info(CHELSIO_CHIP_VERSION(adap->params.chip));
-                                if (ret == -EFAULT) {
+                if (fw_info == NULL) {
-                                        /*
+                        dev_err(adap->pdev_dev,
-                                         * Firmware is old but still might
+                                "unable to get firmware info for chip %d.\n",
-                                         * work if we force reinitialization
+                                CHELSIO_CHIP_VERSION(adap->params.chip));
-                                         * of the adapter. Ignoring FW upgrade
+                        return -EINVAL;
-                                         * failure.
-                                         */
-                                        dev_warn(adap->pdev_dev,
-                                                 "Ignoring firmware upgrade "
-                                                 "failure, and forcing driver "
-                                                 "to reinitialize the "
-                                                 "adapter.\n");
-                                        ret = 0;
-                                }
                }
+                /* allocate memory to read the header of the firmware on the
+                 * card
+                 */
+                card_fw = t4_alloc_mem(sizeof(*card_fw));
+                /* Get FW from from /lib/firmware/ */
+                ret = request_firmware(&fw, fw_info->fw_mod_name,
+                                       adap->pdev_dev);
+                if (ret < 0) {
+                        dev_err(adap->pdev_dev,
+                                "unable to load firmware image %s, error %d\n",
+                                fw_info->fw_mod_name, ret);
+                } else {
+                        fw_data = fw->data;
+                        fw_size = fw->size;
+                }
+                /* upgrade FW logic */
+                ret = t4_prep_fw(adap, fw_info, fw_data, fw_size, card_fw,
+                                 state, &reset);
+                /* Cleaning up */
+                if (fw != NULL)
+                        release_firmware(fw);
+                t4_free_mem(card_fw);
                if (ret < 0)
-                        return ret;
+                        goto bye;
        }
        /*
@@ -5245,7 +5280,7 @@ static int adap_init0(struct adapter *adap)
                                if (ret == -ENOENT) {
                                        dev_info(adap->pdev_dev,
                                            "No Configuration File present "
-                                            "on adapter.  Using hard-wired "
+                                            "on adapter. Using hard-wired "
                                            "configuration parameters.\n");
                                        ret = adap_init0_no_config(adap, reset);
                                }
@@ -5428,21 +5463,11 @@ static int adap_init0(struct adapter *adap)
        /*
         * These are finalized by FW initialization, load their values now.
         */
-        v = t4_read_reg(adap, TP_TIMER_RESOLUTION);
-        adap->params.tp.tre = TIMERRESOLUTION_GET(v);
-        adap->params.tp.dack_re = DELAYEDACKRESOLUTION_GET(v);
        t4_read_mtu_tbl(adap, adap->params.mtus, NULL);
        t4_load_mtus(adap, adap->params.mtus, adap->params.a_wnd,
                     adap->params.b_wnd);
-        /* MODQ_REQ_MAP defaults to setting queues 0-3 to chan 0-3 */
+        t4_init_tp_params(adap);
-        for (j = 0; j < NCHAN; j++)
-                adap->params.tp.tx_modq[j] = j;
-        t4_read_indirect(adap, TP_PIO_ADDR, TP_PIO_DATA,
-                         &adap->filter_mode, 1,
-                         TP_VLAN_PRI_MAP);
        adap->flags |= FW_OK;
        return 0;
@@ -5787,7 +5812,7 @@ static void print_port_info(const struct net_device *dev)
        netdev_info(dev, "Chelsio %s rev %d %s %sNIC PCIe x%d%s%s\n",
                    adap->params.vpd.id,
-                    CHELSIO_CHIP_RELEASE(adap->params.rev), buf,
+                    CHELSIO_CHIP_RELEASE(adap->params.chip), buf,
                    is_offload(adap) ? "R" : "", adap->params.pci.width, spd,
                    (adap->flags & USING_MSIX) ? " MSI-X" :
                    (adap->flags & USING_MSI) ? " MSI" : "");
@@ -5910,7 +5935,7 @@ static int init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
        if (err)
                goto out_unmap_bar0;
-        if (!is_t4(adapter->chip)) {
+        if (!is_t4(adapter->params.chip)) {
                s_qpp = QUEUESPERPAGEPF1 * adapter->fn;
                qpp = 1 << QUEUESPERPAGEPF0_GET(t4_read_reg(adapter,
                      SGE_EGRESS_QUEUES_PER_PAGE_PF) >> s_qpp);
@@ -6064,7 +6089,7 @@ sriov:
 out_free_dev:
        free_some_resources(adapter);
 out_unmap_bar:
-        if (!is_t4(adapter->chip))
+        if (!is_t4(adapter->params.chip))
                iounmap(adapter->bar2);
 out_unmap_bar0:
        iounmap(adapter->regs);
@@ -6116,7 +6141,7 @@ static void remove_one(struct pci_dev *pdev)
                free_some_resources(adapter);
                iounmap(adapter->regs);
-                if (!is_t4(adapter->chip))
+                if (!is_t4(adapter->params.chip))
                        iounmap(adapter->bar2);
                kfree(adapter);
                pci_disable_pcie_error_reporting(pdev);
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.h b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.h
index 6f21f2451c30..4dd0a82533e4 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.h
@@ -131,7 +131,14 @@ static inline void *lookup_atid(const struct tid_info *t, unsigned int atid)
 static inline void *lookup_stid(const struct tid_info *t, unsigned int stid)
 {
-        stid -= t->stid_base;
+        /* Is it a server filter TID? */
+        if (t->nsftids && (stid >= t->sftid_base)) {
+                stid -= t->sftid_base;
+                stid += t->nstids;
+        } else {
+                stid -= t->stid_base;
+        }
        return stid < (t->nstids + t->nsftids) ? t->stid_tab[stid].data : NULL;
 }
diff --git a/drivers/net/ethernet/chelsio/cxgb4/l2t.c b/drivers/net/ethernet/chelsio/cxgb4/l2t.c
index 29878098101e..cb05be905def 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/l2t.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/l2t.c
@@ -45,6 +45,7 @@
 #include "l2t.h"
 #include "t4_msg.h"
 #include "t4fw_api.h"
+#include "t4_regs.h"
 #define VLAN_NONE 0xfff
@@ -411,6 +412,40 @@ done:
 }
 EXPORT_SYMBOL(cxgb4_l2t_get);
+u64 cxgb4_select_ntuple(struct net_device *dev,
+                        const struct l2t_entry *l2t)
+{
+        struct adapter *adap = netdev2adap(dev);
+        struct tp_params *tp = &adap->params.tp;
+        u64 ntuple = 0;
+        /* Initialize each of the fields which we care about which are present
+         * in the Compressed Filter Tuple.
+         */
+        if (tp->vlan_shift >= 0 && l2t->vlan != VLAN_NONE)
+                ntuple |= (F_FT_VLAN_VLD | l2t->vlan) << tp->vlan_shift;
+        if (tp->port_shift >= 0)
+                ntuple |= (u64)l2t->lport << tp->port_shift;
+        if (tp->protocol_shift >= 0)
+                ntuple |= (u64)IPPROTO_TCP << tp->protocol_shift;
+        if (tp->vnic_shift >= 0) {
+                u32 viid = cxgb4_port_viid(dev);
+                u32 vf = FW_VIID_VIN_GET(viid);
+                u32 pf = FW_VIID_PFN_GET(viid);
+                u32 vld = FW_VIID_VIVLD_GET(viid);
+                ntuple |= (u64)(V_FT_VNID_ID_VF(vf) |
+                                V_FT_VNID_ID_PF(pf) |
+                                V_FT_VNID_ID_VLD(vld)) << tp->vnic_shift;
+        }
+        return ntuple;
+}
+EXPORT_SYMBOL(cxgb4_select_ntuple);
 /*
 * Called when address resolution fails for an L2T entry to handle packets
 * on the arpq head.  If a packet specifies a failure handler it is invoked,
diff --git a/drivers/net/ethernet/chelsio/cxgb4/l2t.h b/drivers/net/ethernet/chelsio/cxgb4/l2t.h
index 108c0f1fce1c..85eb5c71358d 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/l2t.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/l2t.h
@@ -98,7 +98,8 @@ int cxgb4_l2t_send(struct net_device *dev, struct sk_buff *skb,
 struct l2t_entry *cxgb4_l2t_get(struct l2t_data *d, struct neighbour *neigh,
                                const struct net_device *physdev,
                                unsigned int priority);
+u64 cxgb4_select_ntuple(struct net_device *dev,
+                        const struct l2t_entry *l2t);
 void t4_l2t_update(struct adapter *adap, struct neighbour *neigh);
 struct l2t_entry *t4_l2t_alloc_switching(struct l2t_data *d);
 int t4_l2t_set_switching(struct adapter *adap, struct l2t_entry *e, u16 vlan,
diff --git a/drivers/net/ethernet/chelsio/cxgb4/sge.c b/drivers/net/ethernet/chelsio/cxgb4/sge.c
index ac311f5f3eb9..cc3511a5cd0c 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/sge.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/sge.c
@@ -509,7 +509,7 @@ static inline void ring_fl_db(struct adapter *adap, struct sge_fl *q)
        u32 val;
        if (q->pend_cred >= 8) {
                val = PIDX(q->pend_cred / 8);
-                if (!is_t4(adap->chip))
+                if (!is_t4(adap->params.chip))
                        val |= DBTYPE(1);
                wmb();
                t4_write_reg(adap, MYPF_REG(SGE_PF_KDOORBELL), DBPRIO(1) |
@@ -847,7 +847,7 @@ static inline void ring_tx_db(struct adapter *adap, struct sge_txq *q, int n)
        wmb();            /* write descriptors before telling HW */
        spin_lock(&q->db_lock);
        if (!q->db_disabled) {
-                if (is_t4(adap->chip)) {
+                if (is_t4(adap->params.chip)) {
                        t4_write_reg(adap, MYPF_REG(SGE_PF_KDOORBELL),
                                     QID(q->cntxt_id) | PIDX(n));
                } else {
@@ -1596,7 +1596,7 @@ static noinline int handle_trace_pkt(struct adapter *adap,
                return 0;
        }
-        if (is_t4(adap->chip))
+        if (is_t4(adap->params.chip))
                __skb_pull(skb, sizeof(struct cpl_trace_pkt));
        else
                __skb_pull(skb, sizeof(struct cpl_t5_trace_pkt));
@@ -1661,7 +1661,7 @@ int t4_ethrx_handler(struct sge_rspq *q, const __be64 *rsp,
        const struct cpl_rx_pkt *pkt;
        struct sge_eth_rxq *rxq = container_of(q, struct sge_eth_rxq, rspq);
        struct sge *s = &q->adap->sge;
-        int cpl_trace_pkt = is_t4(q->adap->chip) ?
+        int cpl_trace_pkt = is_t4(q->adap->params.chip) ?
                            CPL_TRACE_PKT : CPL_TRACE_PKT_T5;
        if (unlikely(*(u8 *)rsp == cpl_trace_pkt))
@@ -2182,7 +2182,7 @@ err:
 static void init_txq(struct adapter *adap, struct sge_txq *q, unsigned int id)
 {
        q->cntxt_id = id;
-        if (!is_t4(adap->chip)) {
+        if (!is_t4(adap->params.chip)) {
                unsigned int s_qpp;
                unsigned short udb_density;
                unsigned long qpshift;
@@ -2581,7 +2581,7 @@ static int t4_sge_init_soft(struct adapter *adap)
        #undef READ_FL_BUF
        if (fl_small_pg != PAGE_SIZE ||
-            (fl_large_pg != 0 && (fl_large_pg <= fl_small_pg ||
+            (fl_large_pg != 0 && (fl_large_pg < fl_small_pg ||
                                  (fl_large_pg & (fl_large_pg-1)) != 0))) {
                dev_err(adap->pdev_dev, "bad SGE FL page buffer sizes [%d, %d]\n",
                        fl_small_pg, fl_large_pg);
@@ -2641,7 +2641,7 @@ static int t4_sge_init_hard(struct adapter *adap)
         * Set up to drop DOORBELL writes when the DOORBELL FIFO overflows
         * and generate an interrupt when this occurs so we can recover.
         */
-        if (is_t4(adap->chip)) {
+        if (is_t4(adap->params.chip)) {
                t4_set_reg_field(adap, A_SGE_DBFIFO_STATUS,
                                 V_HP_INT_THRESH(M_HP_INT_THRESH) |
                                 V_LP_INT_THRESH(M_LP_INT_THRESH),
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
index 4cbb2f9850be..e1413eacdbd2 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
@@ -296,7 +296,7 @@ int t4_mc_read(struct adapter *adap, int idx, u32 addr, __be32 *data, u64 *ecc)
        u32 mc_bist_cmd, mc_bist_cmd_addr, mc_bist_cmd_len;
        u32 mc_bist_status_rdata, mc_bist_data_pattern;
-        if (is_t4(adap->chip)) {
+        if (is_t4(adap->params.chip)) {
                mc_bist_cmd = MC_BIST_CMD;
                mc_bist_cmd_addr = MC_BIST_CMD_ADDR;
                mc_bist_cmd_len = MC_BIST_CMD_LEN;
@@ -349,7 +349,7 @@ int t4_edc_read(struct adapter *adap, int idx, u32 addr, __be32 *data, u64 *ecc)
        u32 edc_bist_cmd, edc_bist_cmd_addr, edc_bist_cmd_len;
        u32 edc_bist_cmd_data_pattern, edc_bist_status_rdata;
-        if (is_t4(adap->chip)) {
+        if (is_t4(adap->params.chip)) {
                edc_bist_cmd = EDC_REG(EDC_BIST_CMD, idx);
                edc_bist_cmd_addr = EDC_REG(EDC_BIST_CMD_ADDR, idx);
                edc_bist_cmd_len = EDC_REG(EDC_BIST_CMD_LEN, idx);
@@ -402,7 +402,7 @@ int t4_edc_read(struct adapter *adap, int idx, u32 addr, __be32 *data, u64 *ecc)
 static int t4_mem_win_rw(struct adapter *adap, u32 addr, __be32 *data, int dir)
 {
        int i;
-        u32 win_pf = is_t4(adap->chip) ? 0 : V_PFNUM(adap->fn);
+        u32 win_pf = is_t4(adap->params.chip) ? 0 : V_PFNUM(adap->fn);
        /*
         * Setup offset into PCIE memory window.  Address must be a
@@ -863,104 +863,169 @@ unlock:
 }
 /**
- *      get_fw_version - read the firmware version
+ *      t4_get_fw_version - read the firmware version
 *      @adapter: the adapter
 *      @vers: where to place the version
 *
 *      Reads the FW version from flash.
 */
-static int get_fw_version(struct adapter *adapter, u32 *vers)
+int t4_get_fw_version(struct adapter *adapter, u32 *vers)
 {
-        return t4_read_flash(adapter, adapter->params.sf_fw_start +
+        return t4_read_flash(adapter, FLASH_FW_START +
-                             offsetof(struct fw_hdr, fw_ver), 1, vers, 0);
+                             offsetof(struct fw_hdr, fw_ver), 1,
+                             vers, 0);
 }
 /**
- *      get_tp_version - read the TP microcode version
+ *      t4_get_tp_version - read the TP microcode version
 *      @adapter: the adapter
 *      @vers: where to place the version
 *
 *      Reads the TP microcode version from flash.
 */
-static int get_tp_version(struct adapter *adapter, u32 *vers)
+int t4_get_tp_version(struct adapter *adapter, u32 *vers)
 {
-        return t4_read_flash(adapter, adapter->params.sf_fw_start +
+        return t4_read_flash(adapter, FLASH_FW_START +
                             offsetof(struct fw_hdr, tp_microcode_ver),
                             1, vers, 0);
 }
-/**
+/* Is the given firmware API compatible with the one the driver was compiled
- *      t4_check_fw_version - check if the FW is compatible with this driver
+ * with?
- *      @adapter: the adapter
- *
- *      Checks if an adapter's FW is compatible with the driver.  Returns 0
- *      if there's exact match, a negative error if the version could not be
- *      read or there's a major version mismatch, and a positive value if the
- *      expected major version is found but there's a minor version mismatch.
 */
-int t4_check_fw_version(struct adapter *adapter)
+static int fw_compatible(const struct fw_hdr *hdr1, const struct fw_hdr *hdr2)
 {
-        u32 api_vers[2];
-        int ret, major, minor, micro;
-        int exp_major, exp_minor, exp_micro;
-        ret = get_fw_version(adapter, &adapter->params.fw_vers);
+        /* short circuit if it's the exact same firmware version */
-        if (!ret)
+        if (hdr1->chip == hdr2->chip && hdr1->fw_ver == hdr2->fw_ver)
-                ret = get_tp_version(adapter, &adapter->params.tp_vers);
+                return 1;
-        if (!ret)
-                ret = t4_read_flash(adapter, adapter->params.sf_fw_start +
-                                    offsetof(struct fw_hdr, intfver_nic),
-                                    2, api_vers, 1);
-        if (ret)
-                return ret;
-        major = FW_HDR_FW_VER_MAJOR_GET(adapter->params.fw_vers);
+#define SAME_INTF(x) (hdr1->intfver_##x == hdr2->intfver_##x)
-        minor = FW_HDR_FW_VER_MINOR_GET(adapter->params.fw_vers);
+        if (hdr1->chip == hdr2->chip && SAME_INTF(nic) && SAME_INTF(vnic) &&
-        micro = FW_HDR_FW_VER_MICRO_GET(adapter->params.fw_vers);
+            SAME_INTF(ri) && SAME_INTF(iscsi) && SAME_INTF(fcoe))
+                return 1;
+#undef SAME_INTF
-        switch (CHELSIO_CHIP_VERSION(adapter->chip)) {
+        return 0;
-        case CHELSIO_T4:
+}
-                exp_major = FW_VERSION_MAJOR;
-                exp_minor = FW_VERSION_MINOR;
-                exp_micro = FW_VERSION_MICRO;
-                break;
-        case CHELSIO_T5:
-                exp_major = FW_VERSION_MAJOR_T5;
-                exp_minor = FW_VERSION_MINOR_T5;
-                exp_micro = FW_VERSION_MICRO_T5;
-                break;
-        default:
-                dev_err(adapter->pdev_dev, "Unsupported chip type, %x\n",
-                        adapter->chip);
-                return -EINVAL;
-        }
-        memcpy(adapter->params.api_vers, api_vers,
+/* The firmware in the filesystem is usable, but should it be installed?
-               sizeof(adapter->params.api_vers));
+ * This routine explains itself in detail if it indicates the filesystem
+ * firmware should be installed.
+ */
+static int should_install_fs_fw(struct adapter *adap, int card_fw_usable,
+                                int k, int c)
+{
+        const char *reason;
-        if (major < exp_major || (major == exp_major && minor < exp_minor) ||
+        if (!card_fw_usable) {
-            (major == exp_major && minor == exp_minor && micro < exp_micro)) {
+                reason = "incompatible or unusable";
-                dev_err(adapter->pdev_dev,
+                goto install;
-                        "Card has firmware version %u.%u.%u, minimum "
-                        "supported firmware is %u.%u.%u.\n", major, minor,
-                        micro, exp_major, exp_minor, exp_micro);
-                return -EFAULT;
        }
-        if (major != exp_major) {            /* major mismatch - fail */
+        if (k > c) {
-                dev_err(adapter->pdev_dev,
+                reason = "older than the version supported with this driver";
-                        "card FW has major version %u, driver wants %u\n",
+                goto install;
-                        major, exp_major);
-                return -EINVAL;
        }
-        if (minor == exp_minor && micro == exp_micro)
+        return 0;
-                return 0;                                   /* perfect match */
+install:
+        dev_err(adap->pdev_dev, "firmware on card (%u.%u.%u.%u) is %s, "
+                "installing firmware %u.%u.%u.%u on card.\n",
+                FW_HDR_FW_VER_MAJOR_GET(c), FW_HDR_FW_VER_MINOR_GET(c),
+                FW_HDR_FW_VER_MICRO_GET(c), FW_HDR_FW_VER_BUILD_GET(c), reason,
+                FW_HDR_FW_VER_MAJOR_GET(k), FW_HDR_FW_VER_MINOR_GET(k),
+                FW_HDR_FW_VER_MICRO_GET(k), FW_HDR_FW_VER_BUILD_GET(k));
-        /* Minor/micro version mismatch.  Report it but often it's OK. */
        return 1;
 }
+int t4_prep_fw(struct adapter *adap, struct fw_info *fw_info,
+               const u8 *fw_data, unsigned int fw_size,
+               struct fw_hdr *card_fw, enum dev_state state,
+               int *reset)
+{
+        int ret, card_fw_usable, fs_fw_usable;
+        const struct fw_hdr *fs_fw;
+        const struct fw_hdr *drv_fw;
+        drv_fw = &fw_info->fw_hdr;
+        /* Read the header of the firmware on the card */
+        ret = -t4_read_flash(adap, FLASH_FW_START,
+                            sizeof(*card_fw) / sizeof(uint32_t),
+                            (uint32_t *)card_fw, 1);
+        if (ret == 0) {
+                card_fw_usable = fw_compatible(drv_fw, (const void *)card_fw);
+        } else {
+                dev_err(adap->pdev_dev,
+                        "Unable to read card's firmware header: %d\n", ret);
+                card_fw_usable = 0;
+        }
+        if (fw_data != NULL) {
+                fs_fw = (const void *)fw_data;
+                fs_fw_usable = fw_compatible(drv_fw, fs_fw);
+        } else {
+                fs_fw = NULL;
+                fs_fw_usable = 0;
+        }
+        if (card_fw_usable && card_fw->fw_ver == drv_fw->fw_ver &&
+            (!fs_fw_usable || fs_fw->fw_ver == drv_fw->fw_ver)) {
+                /* Common case: the firmware on the card is an exact match and
+                 * the filesystem one is an exact match too, or the filesystem
+                 * one is absent/incompatible.
+                 */
+        } else if (fs_fw_usable && state == DEV_STATE_UNINIT &&
+                   should_install_fs_fw(adap, card_fw_usable,
+                                        be32_to_cpu(fs_fw->fw_ver),
+                                        be32_to_cpu(card_fw->fw_ver))) {
+                ret = -t4_fw_upgrade(adap, adap->mbox, fw_data,
+                                     fw_size, 0);
+                if (ret != 0) {
+                        dev_err(adap->pdev_dev,
+                                "failed to install firmware: %d\n", ret);
+                        goto bye;
+                }
+                /* Installed successfully, update the cached header too. */
+                memcpy(card_fw, fs_fw, sizeof(*card_fw));
+                card_fw_usable = 1;
+                *reset = 0;     /* already reset as part of load_fw */
+        }
+        if (!card_fw_usable) {
+                uint32_t d, c, k;
+                d = be32_to_cpu(drv_fw->fw_ver);
+                c = be32_to_cpu(card_fw->fw_ver);
+                k = fs_fw ? be32_to_cpu(fs_fw->fw_ver) : 0;
+                dev_err(adap->pdev_dev, "Cannot find a usable firmware: "
+                        "chip state %d, "
+                        "driver compiled with %d.%d.%d.%d, "
+                        "card has %d.%d.%d.%d, filesystem has %d.%d.%d.%d\n",
+                        state,
+                        FW_HDR_FW_VER_MAJOR_GET(d), FW_HDR_FW_VER_MINOR_GET(d),
+                        FW_HDR_FW_VER_MICRO_GET(d), FW_HDR_FW_VER_BUILD_GET(d),
+                        FW_HDR_FW_VER_MAJOR_GET(c), FW_HDR_FW_VER_MINOR_GET(c),
+                        FW_HDR_FW_VER_MICRO_GET(c), FW_HDR_FW_VER_BUILD_GET(c),
+                        FW_HDR_FW_VER_MAJOR_GET(k), FW_HDR_FW_VER_MINOR_GET(k),
+                        FW_HDR_FW_VER_MICRO_GET(k), FW_HDR_FW_VER_BUILD_GET(k));
+                ret = EINVAL;
+                goto bye;
+        }
+        /* We're using whatever's on the card and it's known to be good. */
+        adap->params.fw_vers = be32_to_cpu(card_fw->fw_ver);
+        adap->params.tp_vers = be32_to_cpu(card_fw->tp_microcode_ver);
+bye:
+        return ret;
+}
 /**
 *      t4_flash_erase_sectors - erase a range of flash sectors
 *      @adapter: the adapter
@@ -1368,7 +1433,7 @@ static void pcie_intr_handler(struct adapter *adapter)
                                    PCIE_CORE_UTL_PCI_EXPRESS_PORT_STATUS,
                                    pcie_port_intr_info) +
              t4_handle_intr_status(adapter, PCIE_INT_CAUSE,
-                                    is_t4(adapter->chip) ?
+                                    is_t4(adapter->params.chip) ?
                                    pcie_intr_info : t5_pcie_intr_info);
        if (fat)
@@ -1782,7 +1847,7 @@ static void xgmac_intr_handler(struct adapter *adap, int port)
 {
        u32 v, int_cause_reg;
-        if (is_t4(adap->chip))
+        if (is_t4(adap->params.chip))
                int_cause_reg = PORT_REG(port, XGMAC_PORT_INT_CAUSE);
        else
                int_cause_reg = T5_PORT_REG(port, MAC_PORT_INT_CAUSE);
@@ -2250,7 +2315,7 @@ void t4_get_port_stats(struct adapter *adap, int idx, struct port_stats *p)
 #define GET_STAT(name) \
        t4_read_reg64(adap, \
-        (is_t4(adap->chip) ? PORT_REG(idx, MPS_PORT_STAT_##name##_L) : \
+        (is_t4(adap->params.chip) ? PORT_REG(idx, MPS_PORT_STAT_##name##_L) : \
        T5_PORT_REG(idx, MPS_PORT_STAT_##name##_L)))
 #define GET_STAT_COM(name) t4_read_reg64(adap, MPS_STAT_##name##_L)
@@ -2332,7 +2397,7 @@ void t4_wol_magic_enable(struct adapter *adap, unsigned int port,
 {
        u32 mag_id_reg_l, mag_id_reg_h, port_cfg_reg;
-        if (is_t4(adap->chip)) {
+        if (is_t4(adap->params.chip)) {
                mag_id_reg_l = PORT_REG(port, XGMAC_PORT_MAGIC_MACID_LO);
                mag_id_reg_h = PORT_REG(port, XGMAC_PORT_MAGIC_MACID_HI);
                port_cfg_reg = PORT_REG(port, XGMAC_PORT_CFG2);
@@ -2374,7 +2439,7 @@ int t4_wol_pat_enable(struct adapter *adap, unsigned int port, unsigned int map,
        int i;
        u32 port_cfg_reg;
-        if (is_t4(adap->chip))
+        if (is_t4(adap->params.chip))
                port_cfg_reg = PORT_REG(port, XGMAC_PORT_CFG2);
        else
                port_cfg_reg = T5_PORT_REG(port, MAC_PORT_CFG2);
@@ -2387,7 +2452,7 @@ int t4_wol_pat_enable(struct adapter *adap, unsigned int port, unsigned int map,
                return -EINVAL;
 #define EPIO_REG(name) \
-        (is_t4(adap->chip) ? PORT_REG(port, XGMAC_PORT_EPIO_##name) : \
+        (is_t4(adap->params.chip) ? PORT_REG(port, XGMAC_PORT_EPIO_##name) : \
        T5_PORT_REG(port, MAC_PORT_EPIO_##name))
        t4_write_reg(adap, EPIO_REG(DATA1), mask0 >> 32);
@@ -2474,7 +2539,7 @@ int t4_fwaddrspace_write(struct adapter *adap, unsigned int mbox,
 int t4_mem_win_read_len(struct adapter *adap, u32 addr, __be32 *data, int len)
 {
        int i, off;
-        u32 win_pf = is_t4(adap->chip) ? 0 : V_PFNUM(adap->fn);
+        u32 win_pf = is_t4(adap->params.chip) ? 0 : V_PFNUM(adap->fn);
        /* Align on a 2KB boundary.
         */
@@ -3306,7 +3371,7 @@ int t4_alloc_mac_filt(struct adapter *adap, unsigned int mbox,
        int i, ret;
        struct fw_vi_mac_cmd c;
        struct fw_vi_mac_exact *p;
-        unsigned int max_naddr = is_t4(adap->chip) ?
+        unsigned int max_naddr = is_t4(adap->params.chip) ?
                                       NUM_MPS_CLS_SRAM_L_INSTANCES :
                                       NUM_MPS_T5_CLS_SRAM_L_INSTANCES;
@@ -3368,7 +3433,7 @@ int t4_change_mac(struct adapter *adap, unsigned int mbox, unsigned int viid,
        int ret, mode;
        struct fw_vi_mac_cmd c;
        struct fw_vi_mac_exact *p = c.u.exact;
-        unsigned int max_mac_addr = is_t4(adap->chip) ?
+        unsigned int max_mac_addr = is_t4(adap->params.chip) ?
                                    NUM_MPS_CLS_SRAM_L_INSTANCES :
                                    NUM_MPS_T5_CLS_SRAM_L_INSTANCES;
@@ -3699,13 +3764,14 @@ int t4_prep_adapter(struct adapter *adapter)
 {
        int ret, ver;
        uint16_t device_id;
+        u32 pl_rev;
        ret = t4_wait_dev_ready(adapter);
        if (ret < 0)
                return ret;
        get_pci_mode(adapter, &adapter->params.pci);
-        adapter->params.rev = t4_read_reg(adapter, PL_REV);
+        pl_rev = G_REV(t4_read_reg(adapter, PL_REV));
        ret = get_flash_params(adapter);
        if (ret < 0) {
@@ -3717,14 +3783,13 @@ int t4_prep_adapter(struct adapter *adapter)
         */
        pci_read_config_word(adapter->pdev, PCI_DEVICE_ID, &device_id);
        ver = device_id >> 12;
+        adapter->params.chip = 0;
        switch (ver) {
        case CHELSIO_T4:
-                adapter->chip = CHELSIO_CHIP_CODE(CHELSIO_T4,
+                adapter->params.chip |= CHELSIO_CHIP_CODE(CHELSIO_T4, pl_rev);
-                                                  adapter->params.rev);
                break;
        case CHELSIO_T5:
-                adapter->chip = CHELSIO_CHIP_CODE(CHELSIO_T5,
+                adapter->params.chip |= CHELSIO_CHIP_CODE(CHELSIO_T5, pl_rev);
-                                                  adapter->params.rev);
                break;
        default:
                dev_err(adapter->pdev_dev, "Device %d is not supported\n",
@@ -3732,9 +3797,6 @@ int t4_prep_adapter(struct adapter *adapter)
                return -EINVAL;
        }
-        /* Reassign the updated revision field */
-        adapter->params.rev = adapter->chip;
        init_cong_ctrl(adapter->params.a_wnd, adapter->params.b_wnd);
        /*
@@ -3746,6 +3808,109 @@ int t4_prep_adapter(struct adapter *adapter)
        return 0;
 }
+/**
+ *      t4_init_tp_params - initialize adap->params.tp
+ *      @adap: the adapter
+ *
+ *      Initialize various fields of the adapter's TP Parameters structure.
+ */
+int t4_init_tp_params(struct adapter *adap)
+{
+        int chan;
+        u32 v;
+        v = t4_read_reg(adap, TP_TIMER_RESOLUTION);
+        adap->params.tp.tre = TIMERRESOLUTION_GET(v);
+        adap->params.tp.dack_re = DELAYEDACKRESOLUTION_GET(v);
+        /* MODQ_REQ_MAP defaults to setting queues 0-3 to chan 0-3 */
+        for (chan = 0; chan < NCHAN; chan++)
+                adap->params.tp.tx_modq[chan] = chan;
+        /* Cache the adapter's Compressed Filter Mode and global Incress
+         * Configuration.
+         */
+        t4_read_indirect(adap, TP_PIO_ADDR, TP_PIO_DATA,
+                         &adap->params.tp.vlan_pri_map, 1,
+                         TP_VLAN_PRI_MAP);
+        t4_read_indirect(adap, TP_PIO_ADDR, TP_PIO_DATA,
+                         &adap->params.tp.ingress_config, 1,
+                         TP_INGRESS_CONFIG);
+        /* Now that we have TP_VLAN_PRI_MAP cached, we can calculate the field
+         * shift positions of several elements of the Compressed Filter Tuple
+         * for this adapter which we need frequently ...
+         */
+        adap->params.tp.vlan_shift = t4_filter_field_shift(adap, F_VLAN);
+        adap->params.tp.vnic_shift = t4_filter_field_shift(adap, F_VNIC_ID);
+        adap->params.tp.port_shift = t4_filter_field_shift(adap, F_PORT);
+        adap->params.tp.protocol_shift = t4_filter_field_shift(adap,
+                                                               F_PROTOCOL);
+        /* If TP_INGRESS_CONFIG.VNID == 0, then TP_VLAN_PRI_MAP.VNIC_ID
+         * represents the presense of an Outer VLAN instead of a VNIC ID.
+         */
+        if ((adap->params.tp.ingress_config & F_VNIC) == 0)
+                adap->params.tp.vnic_shift = -1;
+        return 0;
+}
+/**
+ *      t4_filter_field_shift - calculate filter field shift
+ *      @adap: the adapter
+ *      @filter_sel: the desired field (from TP_VLAN_PRI_MAP bits)
+ *
+ *      Return the shift position of a filter field within the Compressed
+ *      Filter Tuple.  The filter field is specified via its selection bit
+ *      within TP_VLAN_PRI_MAL (filter mode).  E.g. F_VLAN.
+ */
+int t4_filter_field_shift(const struct adapter *adap, int filter_sel)
+{
+        unsigned int filter_mode = adap->params.tp.vlan_pri_map;
+        unsigned int sel;
+        int field_shift;
+        if ((filter_mode & filter_sel) == 0)
+                return -1;
+        for (sel = 1, field_shift = 0; sel < filter_sel; sel <<= 1) {
+                switch (filter_mode & sel) {
+                case F_FCOE:
+                        field_shift += W_FT_FCOE;
+                        break;
+                case F_PORT:
+                        field_shift += W_FT_PORT;
+                        break;
+                case F_VNIC_ID:
+                        field_shift += W_FT_VNIC_ID;
+                        break;
+                case F_VLAN:
+                        field_shift += W_FT_VLAN;
+                        break;
+                case F_TOS:
+                        field_shift += W_FT_TOS;
+                        break;
+                case F_PROTOCOL:
+                        field_shift += W_FT_PROTOCOL;
+                        break;
+                case F_ETHERTYPE:
+                        field_shift += W_FT_ETHERTYPE;
+                        break;
+                case F_MACMATCH:
+                        field_shift += W_FT_MACMATCH;
+                        break;
+                case F_MPSHITTYPE:
+                        field_shift += W_FT_MPSHITTYPE;
+                        break;
+                case F_FRAGMENTATION:
+                        field_shift += W_FT_FRAGMENTATION;
+                        break;
+                }
+        }
+        return field_shift;
+}
 int t4_port_init(struct adapter *adap, int mbox, int pf, int vf)
 {
        u8 addr[6];
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_regs.h b/drivers/net/ethernet/chelsio/cxgb4/t4_regs.h
index ef146c0ba481..4082522d8140 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4_regs.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4_regs.h
@@ -1092,6 +1092,11 @@
 #define PL_REV 0x1943c
+#define S_REV    0
+#define M_REV    0xfU
+#define V_REV(x) ((x) << S_REV)
+#define G_REV(x) (((x) >> S_REV) & M_REV)
 #define LE_DB_CONFIG 0x19c04
 #define  HASHEN 0x00100000U
@@ -1166,10 +1171,50 @@
 #define A_TP_TX_SCHED_PCMD 0x25
+#define S_VNIC    11
+#define V_VNIC(x) ((x) << S_VNIC)
+#define F_VNIC    V_VNIC(1U)
+#define S_FRAGMENTATION    9
+#define V_FRAGMENTATION(x) ((x) << S_FRAGMENTATION)
+#define F_FRAGMENTATION    V_FRAGMENTATION(1U)
+#define S_MPSHITTYPE    8
+#define V_MPSHITTYPE(x) ((x) << S_MPSHITTYPE)
+#define F_MPSHITTYPE    V_MPSHITTYPE(1U)
+#define S_MACMATCH    7
+#define V_MACMATCH(x) ((x) << S_MACMATCH)
+#define F_MACMATCH    V_MACMATCH(1U)
+#define S_ETHERTYPE    6
+#define V_ETHERTYPE(x) ((x) << S_ETHERTYPE)
+#define F_ETHERTYPE    V_ETHERTYPE(1U)
+#define S_PROTOCOL    5
+#define V_PROTOCOL(x) ((x) << S_PROTOCOL)
+#define F_PROTOCOL    V_PROTOCOL(1U)
+#define S_TOS    4
+#define V_TOS(x) ((x) << S_TOS)
+#define F_TOS    V_TOS(1U)
+#define S_VLAN    3
+#define V_VLAN(x) ((x) << S_VLAN)
+#define F_VLAN    V_VLAN(1U)
+#define S_VNIC_ID    2
+#define V_VNIC_ID(x) ((x) << S_VNIC_ID)
+#define F_VNIC_ID    V_VNIC_ID(1U)
 #define S_PORT    1
 #define V_PORT(x) ((x) << S_PORT)
 #define F_PORT    V_PORT(1U)
+#define S_FCOE    0
+#define V_FCOE(x) ((x) << S_FCOE)
+#define F_FCOE    V_FCOE(1U)
 #define NUM_MPS_CLS_SRAM_L_INSTANCES 336
 #define NUM_MPS_T5_CLS_SRAM_L_INSTANCES 512
@@ -1199,4 +1244,46 @@
 #define EDC_STRIDE_T5 (EDC_T51_BASE_ADDR - EDC_T50_BASE_ADDR)
 #define EDC_REG_T5(reg, idx) (reg + EDC_STRIDE_T5 * idx)
+#define A_PL_VF_REV 0x4
+#define A_PL_VF_WHOAMI 0x0
+#define A_PL_VF_REVISION 0x8
+#define S_CHIPID    4
+#define M_CHIPID    0xfU
+#define V_CHIPID(x) ((x) << S_CHIPID)
+#define G_CHIPID(x) (((x) >> S_CHIPID) & M_CHIPID)
+/* TP_VLAN_PRI_MAP controls which subset of fields will be present in the
+ * Compressed Filter Tuple for LE filters.  Each bit set in TP_VLAN_PRI_MAP
+ * selects for a particular field being present.  These fields, when present
+ * in the Compressed Filter Tuple, have the following widths in bits.
+ */
+#define W_FT_FCOE                       1
+#define W_FT_PORT                       3
+#define W_FT_VNIC_ID                    17
+#define W_FT_VLAN                       17
+#define W_FT_TOS                        8
+#define W_FT_PROTOCOL                   8
+#define W_FT_ETHERTYPE                  16
+#define W_FT_MACMATCH                   9
+#define W_FT_MPSHITTYPE                 3
+#define W_FT_FRAGMENTATION              1
+/* Some of the Compressed Filter Tuple fields have internal structure.  These
+ * bit shifts/masks describe those structures.  All shifts are relative to the
+ * base position of the fields within the Compressed Filter Tuple
+ */
+#define S_FT_VLAN_VLD                   16
+#define V_FT_VLAN_VLD(x)                ((x) << S_FT_VLAN_VLD)
+#define F_FT_VLAN_VLD                   V_FT_VLAN_VLD(1U)
+#define S_FT_VNID_ID_VF                 0
+#define V_FT_VNID_ID_VF(x)              ((x) << S_FT_VNID_ID_VF)
+#define S_FT_VNID_ID_PF                 7
+#define V_FT_VNID_ID_PF(x)              ((x) << S_FT_VNID_ID_PF)
+#define S_FT_VNID_ID_VLD                16
+#define V_FT_VNID_ID_VLD(x)             ((x) << S_FT_VNID_ID_VLD)
 #endif /* __T4_REGS_H */
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4fw_api.h b/drivers/net/ethernet/chelsio/cxgb4/t4fw_api.h
index 6f77ac487743..74fea74ce0aa 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4fw_api.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4fw_api.h
@@ -2157,7 +2157,7 @@ struct fw_debug_cmd {
 struct fw_hdr {
        u8 ver;
-        u8 reserved1;
+        u8 chip;                        /* terminator chip type */
        __be16  len512;                 /* bin length in units of 512-bytes */
        __be32  fw_ver;                 /* firmware version */
        __be32  tp_microcode_ver;
@@ -2176,6 +2176,11 @@ struct fw_hdr {
        __be32  reserved6[23];
 };
+enum fw_hdr_chip {
+        FW_HDR_CHIP_T4,
+        FW_HDR_CHIP_T5
+};
 #define FW_HDR_FW_VER_MAJOR_GET(x) (((x) >> 24) & 0xff)
 #define FW_HDR_FW_VER_MINOR_GET(x) (((x) >> 16) & 0xff)
 #define FW_HDR_FW_VER_MICRO_GET(x) (((x) >> 8) & 0xff)
diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/adapter.h b/drivers/net/ethernet/chelsio/cxgb4vf/adapter.h
index be5c7ef6ca93..68eaa9c88c7d 100644
--- a/drivers/net/ethernet/chelsio/cxgb4vf/adapter.h
+++ b/drivers/net/ethernet/chelsio/cxgb4vf/adapter.h
@@ -344,7 +344,6 @@ struct adapter {
        unsigned long registered_device_map;
        unsigned long open_device_map;
        unsigned long flags;
-        enum chip_type chip;
        struct adapter_params params;
        /* queue and interrupt resources */
diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c b/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c
index 5f90ec5f7519..0899c0983594 100644
--- a/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c
@@ -1064,7 +1064,7 @@ static inline unsigned int mk_adap_vers(const struct adapter *adapter)
        /*
         * Chip version 4, revision 0x3f (cxgb4vf).
         */
-        return CHELSIO_CHIP_VERSION(adapter->chip) | (0x3f << 10);
+        return CHELSIO_CHIP_VERSION(adapter->params.chip) | (0x3f << 10);
 }
 /*
@@ -1551,9 +1551,13 @@ static void cxgb4vf_get_regs(struct net_device *dev,
        reg_block_dump(adapter, regbuf,
                       T4VF_MPS_BASE_ADDR + T4VF_MOD_MAP_MPS_FIRST,
                       T4VF_MPS_BASE_ADDR + T4VF_MOD_MAP_MPS_LAST);
+        /* T5 adds new registers in the PL Register map.
+         */
        reg_block_dump(adapter, regbuf,
                       T4VF_PL_BASE_ADDR + T4VF_MOD_MAP_PL_FIRST,
-                       T4VF_PL_BASE_ADDR + T4VF_MOD_MAP_PL_LAST);
+                       T4VF_PL_BASE_ADDR + (is_t4(adapter->params.chip)
+                       ? A_PL_VF_WHOAMI : A_PL_VF_REVISION));
        reg_block_dump(adapter, regbuf,
                       T4VF_CIM_BASE_ADDR + T4VF_MOD_MAP_CIM_FIRST,
                       T4VF_CIM_BASE_ADDR + T4VF_MOD_MAP_CIM_LAST);
@@ -2087,6 +2091,7 @@ static int adap_init0(struct adapter *adapter)
        unsigned int ethqsets;
        int err;
        u32 param, val = 0;
+        unsigned int chipid;
        /*
         * Wait for the device to become ready before proceeding ...
@@ -2114,12 +2119,14 @@ static int adap_init0(struct adapter *adapter)
                return err;
        }
+        adapter->params.chip = 0;
        switch (adapter->pdev->device >> 12) {
        case CHELSIO_T4:
-                adapter->chip = CHELSIO_CHIP_CODE(CHELSIO_T4, 0);
+                adapter->params.chip = CHELSIO_CHIP_CODE(CHELSIO_T4, 0);
                break;
        case CHELSIO_T5:
-                adapter->chip = CHELSIO_CHIP_CODE(CHELSIO_T5, 0);
+                chipid = G_REV(t4_read_reg(adapter, A_PL_VF_REV));
+                adapter->params.chip |= CHELSIO_CHIP_CODE(CHELSIO_T5, chipid);
                break;
        }
diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/sge.c b/drivers/net/ethernet/chelsio/cxgb4vf/sge.c
index 8475c4cda9e4..0a89963c48ce 100644
--- a/drivers/net/ethernet/chelsio/cxgb4vf/sge.c
+++ b/drivers/net/ethernet/chelsio/cxgb4vf/sge.c
@@ -537,7 +537,7 @@ static inline void ring_fl_db(struct adapter *adapter, struct sge_fl *fl)
         */
        if (fl->pend_cred >= FL_PER_EQ_UNIT) {
                val = PIDX(fl->pend_cred / FL_PER_EQ_UNIT);
-                if (!is_t4(adapter->chip))
+                if (!is_t4(adapter->params.chip))
                        val |= DBTYPE(1);
                wmb();
                t4_write_reg(adapter, T4VF_SGE_BASE_ADDR + SGE_VF_KDOORBELL,
diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_common.h b/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_common.h
index 53cbfed21d0b..61362450d05b 100644
--- a/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_common.h
+++ b/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_common.h
@@ -39,21 +39,28 @@
 #include "../cxgb4/t4fw_api.h"
 #define CHELSIO_CHIP_CODE(version, revision) (((version) << 4) | (revision))
-#define CHELSIO_CHIP_VERSION(code) ((code) >> 4)
+#define CHELSIO_CHIP_VERSION(code) (((code) >> 4) & 0xf)
 #define CHELSIO_CHIP_RELEASE(code) ((code) & 0xf)
+/* All T4 and later chips have their PCI-E Device IDs encoded as 0xVFPP where:
+ *
+ *   V  = "4" for T4; "5" for T5, etc. or
+ *      = "a" for T4 FPGA; "b" for T4 FPGA, etc.
+ *   F  = "0" for PF 0..3; "4".."7" for PF4..7; and "8" for VFs
+ *   PP = adapter product designation
+ */
 #define CHELSIO_T4              0x4
 #define CHELSIO_T5              0x5
 enum chip_type {
-        T4_A1 = CHELSIO_CHIP_CODE(CHELSIO_T4, 0),
+        T4_A1 = CHELSIO_CHIP_CODE(CHELSIO_T4, 1),
-        T4_A2 = CHELSIO_CHIP_CODE(CHELSIO_T4, 1),
+        T4_A2 = CHELSIO_CHIP_CODE(CHELSIO_T4, 2),
-        T4_A3 = CHELSIO_CHIP_CODE(CHELSIO_T4, 2),
        T4_FIRST_REV    = T4_A1,
-        T4_LAST_REV     = T4_A3,
+        T4_LAST_REV     = T4_A2,
-        T5_A1 = CHELSIO_CHIP_CODE(CHELSIO_T5, 0),
+        T5_A0 = CHELSIO_CHIP_CODE(CHELSIO_T5, 0),
-        T5_FIRST_REV    = T5_A1,
+        T5_A1 = CHELSIO_CHIP_CODE(CHELSIO_T5, 1),
+        T5_FIRST_REV    = T5_A0,
        T5_LAST_REV     = T5_A1,
 };
@@ -203,6 +210,7 @@ struct adapter_params {
        struct vpd_params vpd;          /* Vital Product Data */
        struct rss_params rss;          /* Receive Side Scaling */
        struct vf_resources vfres;      /* Virtual Function Resource limits */
+        enum chip_type chip;            /* chip code */
        u8 nports;                      /* # of Ethernet "ports" */
 };
@@ -253,7 +261,7 @@ static inline int t4vf_wr_mbox_ns(struct adapter *adapter, const void *cmd,
 static inline int is_t4(enum chip_type chip)
 {
-        return (chip >= T4_FIRST_REV && chip <= T4_LAST_REV);
+        return CHELSIO_CHIP_VERSION(chip) == CHELSIO_T4;
 }
 int t4vf_wait_dev_ready(struct adapter *);
diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_hw.c b/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_hw.c
index 9f96dc3bb112..d958c44341b5 100644
--- a/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_hw.c
+++ b/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_hw.c
@@ -1027,7 +1027,7 @@ int t4vf_alloc_mac_filt(struct adapter *adapter, unsigned int viid, bool free,
        unsigned nfilters = 0;
        unsigned int rem = naddr;
        struct fw_vi_mac_cmd cmd, rpl;
-        unsigned int max_naddr = is_t4(adapter->chip) ?
+        unsigned int max_naddr = is_t4(adapter->params.chip) ?
                                 NUM_MPS_CLS_SRAM_L_INSTANCES :
                                 NUM_MPS_T5_CLS_SRAM_L_INSTANCES;
@@ -1121,7 +1121,7 @@ int t4vf_change_mac(struct adapter *adapter, unsigned int viid,
        struct fw_vi_mac_exact *p = &cmd.u.exact[0];
        size_t len16 = DIV_ROUND_UP(offsetof(struct fw_vi_mac_cmd,
                                             u.exact[1]), 16);
-        unsigned int max_naddr = is_t4(adapter->chip) ?
+        unsigned int max_naddr = is_t4(adapter->params.chip) ?
                                 NUM_MPS_CLS_SRAM_L_INSTANCES :
                                 NUM_MPS_T5_CLS_SRAM_L_INSTANCES;
diff --git a/drivers/net/ethernet/emulex/benet/be.h b/drivers/net/ethernet/emulex/benet/be.h
index f4825db5d179..4ccaf9af6fc9 100644
--- a/drivers/net/ethernet/emulex/benet/be.h
+++ b/drivers/net/ethernet/emulex/benet/be.h
@@ -104,6 +104,7 @@ static inline char *nic_name(struct pci_dev *pdev)
 #define BE3_MAX_RSS_QS          16
 #define BE3_MAX_TX_QS           16
 #define BE3_MAX_EVT_QS          16
+#define BE3_SRIOV_MAX_EVT_QS    8
 #define MAX_RX_QS               32
 #define MAX_EVT_QS              32
@@ -480,7 +481,7 @@ struct be_adapter {
        struct list_head entry;
        u32 flash_status;
-        struct completion flash_compl;
+        struct completion et_cmd_compl;
        struct be_resources res;        /* resources available for the func */
        u16 num_vfs;                    /* Number of VFs provisioned by PF */
@@ -503,6 +504,7 @@ struct be_adapter {
 };
 #define be_physfn(adapter)              (!adapter->virtfn)
+#define be_virtfn(adapter)              (adapter->virtfn)
 #define sriov_enabled(adapter)          (adapter->num_vfs > 0)
 #define sriov_want(adapter)             (be_physfn(adapter) &&  \
                                         (num_vfs || pci_num_vf(adapter->pdev)))
diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.c b/drivers/net/ethernet/emulex/benet/be_cmds.c
index dbcd5262c016..94c35c8d799d 100644
--- a/drivers/net/ethernet/emulex/benet/be_cmds.c
+++ b/drivers/net/ethernet/emulex/benet/be_cmds.c
@@ -141,11 +141,17 @@ static int be_mcc_compl_process(struct be_adapter *adapter,
                subsystem = resp_hdr->subsystem;
        }
+        if (opcode == OPCODE_LOWLEVEL_LOOPBACK_TEST &&
+            subsystem == CMD_SUBSYSTEM_LOWLEVEL) {
+                complete(&adapter->et_cmd_compl);
+                return 0;
+        }
        if (((opcode == OPCODE_COMMON_WRITE_FLASHROM) ||
             (opcode == OPCODE_COMMON_WRITE_OBJECT)) &&
            (subsystem == CMD_SUBSYSTEM_COMMON)) {
                adapter->flash_status = compl_status;
-                complete(&adapter->flash_compl);
+                complete(&adapter->et_cmd_compl);
        }
        if (compl_status == MCC_STATUS_SUCCESS) {
@@ -1032,6 +1038,13 @@ int be_cmd_cq_create(struct be_adapter *adapter, struct be_queue_info *cq,
        } else {
                req->hdr.version = 2;
                req->page_size = 1; /* 1 for 4K */
+                /* coalesce-wm field in this cmd is not relevant to Lancer.
+                 * Lancer uses COMMON_MODIFY_CQ to set this field
+                 */
+                if (!lancer_chip(adapter))
+                        AMAP_SET_BITS(struct amap_cq_context_v2, coalescwm,
+                                      ctxt, coalesce_wm);
                AMAP_SET_BITS(struct amap_cq_context_v2, nodelay, ctxt,
                                                                no_delay);
                AMAP_SET_BITS(struct amap_cq_context_v2, count, ctxt,
@@ -2010,6 +2023,9 @@ int be_cmd_rss_config(struct be_adapter *adapter, u8 *rsstable,
                        0x3ea83c02, 0x4a110304};
        int status;
+        if (!(be_if_cap_flags(adapter) & BE_IF_FLAGS_RSS))
+                return 0;
        if (mutex_lock_interruptible(&adapter->mbox_lock))
                return -1;
@@ -2153,7 +2169,7 @@ int lancer_cmd_write_object(struct be_adapter *adapter, struct be_dma_mem *cmd,
        be_mcc_notify(adapter);
        spin_unlock_bh(&adapter->mcc_lock);
-        if (!wait_for_completion_timeout(&adapter->flash_compl,
+        if (!wait_for_completion_timeout(&adapter->et_cmd_compl,
                                         msecs_to_jiffies(60000)))
                status = -1;
        else
@@ -2248,8 +2264,8 @@ int be_cmd_write_flashrom(struct be_adapter *adapter, struct be_dma_mem *cmd,
        be_mcc_notify(adapter);
        spin_unlock_bh(&adapter->mcc_lock);
-        if (!wait_for_completion_timeout(&adapter->flash_compl,
+        if (!wait_for_completion_timeout(&adapter->et_cmd_compl,
-                        msecs_to_jiffies(40000)))
+                                         msecs_to_jiffies(40000)))
                status = -1;
        else
                status = adapter->flash_status;
@@ -2360,6 +2376,7 @@ int be_cmd_loopback_test(struct be_adapter *adapter, u32 port_num,
 {
        struct be_mcc_wrb *wrb;
        struct be_cmd_req_loopback_test *req;
+        struct be_cmd_resp_loopback_test *resp;
        int status;
        spin_lock_bh(&adapter->mcc_lock);
@@ -2374,8 +2391,8 @@ int be_cmd_loopback_test(struct be_adapter *adapter, u32 port_num,
        be_wrb_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_LOWLEVEL,
                        OPCODE_LOWLEVEL_LOOPBACK_TEST, sizeof(*req), wrb, NULL);
-        req->hdr.timeout = cpu_to_le32(4);
+        req->hdr.timeout = cpu_to_le32(15);
        req->pattern = cpu_to_le64(pattern);
        req->src_port = cpu_to_le32(port_num);
        req->dest_port = cpu_to_le32(port_num);
@@ -2383,12 +2400,15 @@ int be_cmd_loopback_test(struct be_adapter *adapter, u32 port_num,
        req->num_pkts = cpu_to_le32(num_pkts);
        req->loopback_type = cpu_to_le32(loopback_type);
-        status = be_mcc_notify_wait(adapter);
+        be_mcc_notify(adapter);
-        if (!status) {
-                struct be_cmd_resp_loopback_test *resp = embedded_payload(wrb);
+        spin_unlock_bh(&adapter->mcc_lock);
-                status = le32_to_cpu(resp->status);
-        }
+        wait_for_completion(&adapter->et_cmd_compl);
+        resp = embedded_payload(wrb);
+        status = le32_to_cpu(resp->status);
+        return status;
 err:
        spin_unlock_bh(&adapter->mcc_lock);
        return status;
diff --git a/drivers/net/ethernet/emulex/benet/be_hw.h b/drivers/net/ethernet/emulex/benet/be_hw.h
index 3e2162121601..dc88782185f2 100644
--- a/drivers/net/ethernet/emulex/benet/be_hw.h
+++ b/drivers/net/ethernet/emulex/benet/be_hw.h
@@ -64,6 +64,9 @@
 #define SLIPORT_ERROR_NO_RESOURCE1      0x2
 #define SLIPORT_ERROR_NO_RESOURCE2      0x9
+#define SLIPORT_ERROR_FW_RESET1         0x2
+#define SLIPORT_ERROR_FW_RESET2         0x0
 /********* Memory BAR register ************/
 #define PCICFG_MEMBAR_CTRL_INT_CTRL_OFFSET      0xfc
 /* Host Interrupt Enable, if set interrupts are enabled although "PCI Interrupt
diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
index abde97471636..bf40fdaecfa3 100644
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -2464,8 +2464,16 @@ void be_detect_error(struct be_adapter *adapter)
         */
        if (sliport_status & SLIPORT_STATUS_ERR_MASK) {
                adapter->hw_error = true;
-                dev_err(&adapter->pdev->dev,
+                /* Do not log error messages if its a FW reset */
-                        "Error detected in the card\n");
+                if (sliport_err1 == SLIPORT_ERROR_FW_RESET1 &&
+                    sliport_err2 == SLIPORT_ERROR_FW_RESET2) {
+                        dev_info(&adapter->pdev->dev,
+                                 "Firmware update in progress\n");
+                        return;
+                } else {
+                        dev_err(&adapter->pdev->dev,
+                                "Error detected in the card\n");
+                }
        }
        if (sliport_status & SLIPORT_STATUS_ERR_MASK) {
@@ -2658,8 +2666,8 @@ static int be_close(struct net_device *netdev)
        be_roce_dev_close(adapter);
-        for_all_evt_queues(adapter, eqo, i) {
+        if (adapter->flags & BE_FLAGS_NAPI_ENABLED) {
-                if (adapter->flags & BE_FLAGS_NAPI_ENABLED) {
+                for_all_evt_queues(adapter, eqo, i) {
                        napi_disable(&eqo->napi);
                        be_disable_busy_poll(eqo);
                }
@@ -2736,13 +2744,16 @@ static int be_rx_qs_create(struct be_adapter *adapter)
                if (!BEx_chip(adapter))
                        adapter->rss_flags |= RSS_ENABLE_UDP_IPV4 |
                                                RSS_ENABLE_UDP_IPV6;
+        } else {
+                /* Disable RSS, if only default RX Q is created */
+                adapter->rss_flags = RSS_ENABLE_NONE;
+        }
-                rc = be_cmd_rss_config(adapter, rsstable, adapter->rss_flags,
+        rc = be_cmd_rss_config(adapter, rsstable, adapter->rss_flags,
-                                       128);
+                               128);
-                if (rc) {
+        if (rc) {
-                        adapter->rss_flags = 0;
+                adapter->rss_flags = RSS_ENABLE_NONE;
-                        return rc;
+                return rc;
-                }
        }
        /* First time posting */
@@ -2932,28 +2943,35 @@ static void be_cancel_worker(struct be_adapter *adapter)
        }
 }
-static int be_clear(struct be_adapter *adapter)
+static void be_mac_clear(struct be_adapter *adapter)
 {
        int i;
+        if (adapter->pmac_id) {
+                for (i = 0; i < (adapter->uc_macs + 1); i++)
+                        be_cmd_pmac_del(adapter, adapter->if_handle,
+                                        adapter->pmac_id[i], 0);
+                adapter->uc_macs = 0;
+                kfree(adapter->pmac_id);
+                adapter->pmac_id = NULL;
+        }
+}
+static int be_clear(struct be_adapter *adapter)
+{
        be_cancel_worker(adapter);
        if (sriov_enabled(adapter))
                be_vf_clear(adapter);
        /* delete the primary mac along with the uc-mac list */
-        for (i = 0; i < (adapter->uc_macs + 1); i++)
+        be_mac_clear(adapter);
-                be_cmd_pmac_del(adapter, adapter->if_handle,
-                                adapter->pmac_id[i], 0);
-        adapter->uc_macs = 0;
        be_cmd_if_destroy(adapter, adapter->if_handle,  0);
        be_clear_queues(adapter);
-        kfree(adapter->pmac_id);
-        adapter->pmac_id = NULL;
        be_msix_disable(adapter);
        return 0;
 }
@@ -3109,11 +3127,11 @@ static void BEx_get_resources(struct be_adapter *adapter,
 {
        struct pci_dev *pdev = adapter->pdev;
        bool use_sriov = false;
+        int max_vfs;
-        if (BE3_chip(adapter) && sriov_want(adapter)) {
+        max_vfs = pci_sriov_get_totalvfs(pdev);
-                int max_vfs;
-                max_vfs = pci_sriov_get_totalvfs(pdev);
+        if (BE3_chip(adapter) && sriov_want(adapter)) {
                res->max_vfs = max_vfs > 0 ? min(MAX_VFS, max_vfs) : 0;
                use_sriov = res->max_vfs;
        }
@@ -3144,7 +3162,11 @@ static void BEx_get_resources(struct be_adapter *adapter,
                                           BE3_MAX_RSS_QS : BE2_MAX_RSS_QS;
        res->max_rx_qs = res->max_rss_qs + 1;
-        res->max_evt_qs = be_physfn(adapter) ? BE3_MAX_EVT_QS : 1;
+        if (be_physfn(adapter))
+                res->max_evt_qs = (max_vfs > 0) ?
+                                        BE3_SRIOV_MAX_EVT_QS : BE3_MAX_EVT_QS;
+        else
+                res->max_evt_qs = 1;
        res->if_cap_flags = BE_IF_CAP_FLAGS_WANT;
        if (!(adapter->function_caps & BE_FUNCTION_CAPS_RSS))
@@ -3253,12 +3275,10 @@ static int be_mac_setup(struct be_adapter *adapter)
                memcpy(mac, adapter->netdev->dev_addr, ETH_ALEN);
        }
-        /* On BE3 VFs this cmd may fail due to lack of privilege.
+        /* For BE3-R VFs, the PF programs the initial MAC address */
-         * Ignore the failure as in this case pmac_id is fetched
+        if (!(BEx_chip(adapter) && be_virtfn(adapter)))
-         * in the IFACE_CREATE cmd.
+                be_cmd_pmac_add(adapter, mac, adapter->if_handle,
-         */
+                                &adapter->pmac_id[0], 0);
-        be_cmd_pmac_add(adapter, mac, adapter->if_handle,
-                        &adapter->pmac_id[0], 0);
        return 0;
 }
@@ -3814,6 +3834,8 @@ static int lancer_fw_download(struct be_adapter *adapter,
        }
        if (change_status == LANCER_FW_RESET_NEEDED) {
+                dev_info(&adapter->pdev->dev,
+                         "Resetting adapter to activate new FW\n");
                status = lancer_physdev_ctrl(adapter,
                                             PHYSDEV_CONTROL_FW_RESET_MASK);
                if (status) {
@@ -4190,7 +4212,7 @@ static int be_ctrl_init(struct be_adapter *adapter)
        spin_lock_init(&adapter->mcc_lock);
        spin_lock_init(&adapter->mcc_cq_lock);
-        init_completion(&adapter->flash_compl);
+        init_completion(&adapter->et_cmd_compl);
        pci_save_state(adapter->pdev);
        return 0;
@@ -4365,13 +4387,13 @@ static int lancer_recover_func(struct be_adapter *adapter)
                        goto err;
        }
-        dev_err(dev, "Error recovery successful\n");
+        dev_err(dev, "Adapter recovery successful\n");
        return 0;
 err:
        if (status == -EAGAIN)
                dev_err(dev, "Waiting for resource provisioning\n");
        else
-                dev_err(dev, "Error recovery failed\n");
+                dev_err(dev, "Adapter recovery failed\n");
        return status;
 }
@@ -4599,6 +4621,7 @@ static int be_suspend(struct pci_dev *pdev, pm_message_t state)
        if (adapter->wol)
                be_setup_wol(adapter, true);
+        be_intr_set(adapter, false);
        cancel_delayed_work_sync(&adapter->func_recovery_work);
        netif_device_detach(netdev);
@@ -4634,6 +4657,7 @@ static int be_resume(struct pci_dev *pdev)
        if (status)
                return status;
+        be_intr_set(adapter, true);
        /* tell fw we're ready to fire cmds */
        status = be_cmd_fw_init(adapter);
        if (status)
diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index 4cbebf3d80eb..50bb71c663e2 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -98,10 +98,6 @@ static void set_multicast_list(struct net_device *ndev);
 * detected as not set during a prior frame transmission, then the
 * ENET_TDAR[TDAR] bit is cleared at a later time, even if additional TxBDs
 * were added to the ring and the ENET_TDAR[TDAR] bit is set. This results in
- * If the ready bit in the transmit buffer descriptor (TxBD[R]) is previously
- * detected as not set during a prior frame transmission, then the
- * ENET_TDAR[TDAR] bit is cleared at a later time, even if additional TxBDs
- * were added to the ring and the ENET_TDAR[TDAR] bit is set. This results in
 * frames not being transmitted until there is a 0-to-1 transition on
 * ENET_TDAR[TDAR].
 */
@@ -385,7 +381,7 @@ fec_enet_start_xmit(struct sk_buff *skb, struct net_device *ndev)
         * data.
         */
        bdp->cbd_bufaddr = dma_map_single(&fep->pdev->dev, bufaddr,
-                        FEC_ENET_TX_FRSIZE, DMA_TO_DEVICE);
+                        skb->len, DMA_TO_DEVICE);
        if (dma_mapping_error(&fep->pdev->dev, bdp->cbd_bufaddr)) {
                bdp->cbd_bufaddr = 0;
                fep->tx_skbuff[index] = NULL;
@@ -432,6 +428,8 @@ fec_enet_start_xmit(struct sk_buff *skb, struct net_device *ndev)
        /* If this was the last BD in the ring, start at the beginning again. */
        bdp = fec_enet_get_nextdesc(bdp, fep);
+        skb_tx_timestamp(skb);
        fep->cur_tx = bdp;
        if (fep->cur_tx == fep->dirty_tx)
@@ -440,8 +438,6 @@ fec_enet_start_xmit(struct sk_buff *skb, struct net_device *ndev)
        /* Trigger transmission start */
        writel(0, fep->hwp + FEC_X_DES_ACTIVE);
-        skb_tx_timestamp(skb);
        return NETDEV_TX_OK;
 }
@@ -779,11 +775,10 @@ fec_enet_tx(struct net_device *ndev)
                else
                        index = bdp - fep->tx_bd_base;
-                dma_unmap_single(&fep->pdev->dev, bdp->cbd_bufaddr,
-                                FEC_ENET_TX_FRSIZE, DMA_TO_DEVICE);
-                bdp->cbd_bufaddr = 0;
                skb = fep->tx_skbuff[index];
+                dma_unmap_single(&fep->pdev->dev, bdp->cbd_bufaddr, skb->len,
+                                DMA_TO_DEVICE);
+                bdp->cbd_bufaddr = 0;
                /* Check for errors. */
                if (status & (BD_ENET_TX_HB | BD_ENET_TX_LC |
diff --git a/drivers/net/ethernet/ibm/ehea/ehea_main.c b/drivers/net/ethernet/ibm/ehea/ehea_main.c
index 2d1c6bdd3618..7628e0fd8455 100644
--- a/drivers/net/ethernet/ibm/ehea/ehea_main.c
+++ b/drivers/net/ethernet/ibm/ehea/ehea_main.c
@@ -3033,7 +3033,7 @@ static struct ehea_port *ehea_setup_single_port(struct ehea_adapter *adapter,
        dev->hw_features = NETIF_F_SG | NETIF_F_TSO |
                      NETIF_F_IP_CSUM | NETIF_F_HW_VLAN_CTAG_TX;
-        dev->features = NETIF_F_SG | NETIF_F_FRAGLIST | NETIF_F_TSO |
+        dev->features = NETIF_F_SG | NETIF_F_TSO |
                      NETIF_F_HIGHDMA | NETIF_F_IP_CSUM |
                      NETIF_F_HW_VLAN_CTAG_TX | NETIF_F_HW_VLAN_CTAG_RX |
                      NETIF_F_HW_VLAN_CTAG_FILTER | NETIF_F_RXCSUM;
diff --git a/drivers/net/ethernet/intel/e1000/e1000.h b/drivers/net/ethernet/intel/e1000/e1000.h
index 58c147271a36..f9313b36c887 100644
--- a/drivers/net/ethernet/intel/e1000/e1000.h
+++ b/drivers/net/ethernet/intel/e1000/e1000.h
@@ -83,6 +83,11 @@ struct e1000_adapter;
 #define E1000_MAX_INTR                  10
+/*
+ * Count for polling __E1000_RESET condition every 10-20msec.
+ */
+#define E1000_CHECK_RESET_COUNT 50
 /* TX/RX descriptor defines */
 #define E1000_DEFAULT_TXD               256
 #define E1000_MAX_TXD                   256
@@ -312,8 +317,6 @@ struct e1000_adapter {
        struct delayed_work watchdog_task;
        struct delayed_work fifo_stall_task;
        struct delayed_work phy_info_task;
-        struct mutex mutex;
 };
 enum e1000_state_t {
diff --git a/drivers/net/ethernet/intel/e1000/e1000_main.c b/drivers/net/ethernet/intel/e1000/e1000_main.c
index e38622825fa7..46e6544ed1b7 100644
--- a/drivers/net/ethernet/intel/e1000/e1000_main.c
+++ b/drivers/net/ethernet/intel/e1000/e1000_main.c
@@ -494,13 +494,20 @@ static void e1000_down_and_stop(struct e1000_adapter *adapter)
 {
        set_bit(__E1000_DOWN, &adapter->flags);
-        /* Only kill reset task if adapter is not resetting */
-        if (!test_bit(__E1000_RESETTING, &adapter->flags))
-                cancel_work_sync(&adapter->reset_task);
        cancel_delayed_work_sync(&adapter->watchdog_task);
+        /*
+         * Since the watchdog task can reschedule other tasks, we should cancel
+         * it first, otherwise we can run into the situation when a work is
+         * still running after the adapter has been turned down.
+         */
        cancel_delayed_work_sync(&adapter->phy_info_task);
        cancel_delayed_work_sync(&adapter->fifo_stall_task);
+        /* Only kill reset task if adapter is not resetting */
+        if (!test_bit(__E1000_RESETTING, &adapter->flags))
+                cancel_work_sync(&adapter->reset_task);
 }
 void e1000_down(struct e1000_adapter *adapter)
@@ -544,21 +551,8 @@ void e1000_down(struct e1000_adapter *adapter)
        e1000_clean_all_rx_rings(adapter);
 }
-static void e1000_reinit_safe(struct e1000_adapter *adapter)
-{
-        while (test_and_set_bit(__E1000_RESETTING, &adapter->flags))
-                msleep(1);
-        mutex_lock(&adapter->mutex);
-        e1000_down(adapter);
-        e1000_up(adapter);
-        mutex_unlock(&adapter->mutex);
-        clear_bit(__E1000_RESETTING, &adapter->flags);
-}
 void e1000_reinit_locked(struct e1000_adapter *adapter)
 {
-        /* if rtnl_lock is not held the call path is bogus */
-        ASSERT_RTNL();
        WARN_ON(in_interrupt());
        while (test_and_set_bit(__E1000_RESETTING, &adapter->flags))
                msleep(1);
@@ -1316,7 +1310,6 @@ static int e1000_sw_init(struct e1000_adapter *adapter)
        e1000_irq_disable(adapter);
        spin_lock_init(&adapter->stats_lock);
-        mutex_init(&adapter->mutex);
        set_bit(__E1000_DOWN, &adapter->flags);
@@ -1440,6 +1433,10 @@ static int e1000_close(struct net_device *netdev)
 {
        struct e1000_adapter *adapter = netdev_priv(netdev);
        struct e1000_hw *hw = &adapter->hw;
+        int count = E1000_CHECK_RESET_COUNT;
+        while (test_bit(__E1000_RESETTING, &adapter->flags) && count--)
+                usleep_range(10000, 20000);
        WARN_ON(test_bit(__E1000_RESETTING, &adapter->flags));
        e1000_down(adapter);
@@ -2325,11 +2322,8 @@ static void e1000_update_phy_info_task(struct work_struct *work)
        struct e1000_adapter *adapter = container_of(work,
                                                     struct e1000_adapter,
                                                     phy_info_task.work);
-        if (test_bit(__E1000_DOWN, &adapter->flags))
-                return;
-        mutex_lock(&adapter->mutex);
        e1000_phy_get_info(&adapter->hw, &adapter->phy_info);
-        mutex_unlock(&adapter->mutex);
 }
 /**
@@ -2345,9 +2339,6 @@ static void e1000_82547_tx_fifo_stall_task(struct work_struct *work)
        struct net_device *netdev = adapter->netdev;
        u32 tctl;
-        if (test_bit(__E1000_DOWN, &adapter->flags))
-                return;
-        mutex_lock(&adapter->mutex);
        if (atomic_read(&adapter->tx_fifo_stall)) {
                if ((er32(TDT) == er32(TDH)) &&
                   (er32(TDFT) == er32(TDFH)) &&
@@ -2368,7 +2359,6 @@ static void e1000_82547_tx_fifo_stall_task(struct work_struct *work)
                        schedule_delayed_work(&adapter->fifo_stall_task, 1);
                }
        }
-        mutex_unlock(&adapter->mutex);
 }
 bool e1000_has_link(struct e1000_adapter *adapter)
@@ -2422,10 +2412,6 @@ static void e1000_watchdog(struct work_struct *work)
        struct e1000_tx_ring *txdr = adapter->tx_ring;
        u32 link, tctl;
-        if (test_bit(__E1000_DOWN, &adapter->flags))
-                return;
-        mutex_lock(&adapter->mutex);
        link = e1000_has_link(adapter);
        if ((netif_carrier_ok(netdev)) && link)
                goto link_up;
@@ -2516,7 +2502,7 @@ link_up:
                        adapter->tx_timeout_count++;
                        schedule_work(&adapter->reset_task);
                        /* exit immediately since reset is imminent */
-                        goto unlock;
+                        return;
                }
        }
@@ -2544,9 +2530,6 @@ link_up:
        /* Reschedule the task */
        if (!test_bit(__E1000_DOWN, &adapter->flags))
                schedule_delayed_work(&adapter->watchdog_task, 2 * HZ);
-unlock:
-        mutex_unlock(&adapter->mutex);
 }
 enum latency_range {
@@ -3495,10 +3478,8 @@ static void e1000_reset_task(struct work_struct *work)
        struct e1000_adapter *adapter =
                container_of(work, struct e1000_adapter, reset_task);
-        if (test_bit(__E1000_DOWN, &adapter->flags))
-                return;
        e_err(drv, "Reset adapter\n");
-        e1000_reinit_safe(adapter);
+        e1000_reinit_locked(adapter);
 }
 /**
@@ -4963,6 +4944,11 @@ static int __e1000_shutdown(struct pci_dev *pdev, bool *enable_wake)
        netif_device_detach(netdev);
        if (netif_running(netdev)) {
+                int count = E1000_CHECK_RESET_COUNT;
+                while (test_bit(__E1000_RESETTING, &adapter->flags) && count--)
+                        usleep_range(10000, 20000);
                WARN_ON(test_bit(__E1000_RESETTING, &adapter->flags));
                e1000_down(adapter);
        }
diff --git a/drivers/net/ethernet/intel/e1000e/80003es2lan.c b/drivers/net/ethernet/intel/e1000e/80003es2lan.c
index 895450e9bb3c..ff2d806eaef7 100644
--- a/drivers/net/ethernet/intel/e1000e/80003es2lan.c
+++ b/drivers/net/ethernet/intel/e1000e/80003es2lan.c
@@ -718,8 +718,11 @@ static s32 e1000_reset_hw_80003es2lan(struct e1000_hw *hw)
        e1000_release_phy_80003es2lan(hw);
        /* Disable IBIST slave mode (far-end loopback) */
-        e1000_read_kmrn_reg_80003es2lan(hw, E1000_KMRNCTRLSTA_INBAND_PARAM,
+        ret_val =
-                                        &kum_reg_data);
+            e1000_read_kmrn_reg_80003es2lan(hw, E1000_KMRNCTRLSTA_INBAND_PARAM,
+                                            &kum_reg_data);
+        if (ret_val)
+                return ret_val;
        kum_reg_data |= E1000_KMRNCTRLSTA_IBIST_DISABLE;
        e1000_write_kmrn_reg_80003es2lan(hw, E1000_KMRNCTRLSTA_INBAND_PARAM,
                                         kum_reg_data);
diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c
index 8d3945ab7334..c30d41d6e426 100644
--- a/drivers/net/ethernet/intel/e1000e/netdev.c
+++ b/drivers/net/ethernet/intel/e1000e/netdev.c
@@ -6174,7 +6174,7 @@ static int __e1000_resume(struct pci_dev *pdev)
        return 0;
 }
-#ifdef CONFIG_PM_SLEEP
+#ifdef CONFIG_PM
 static int e1000_suspend(struct device *dev)
 {
        struct pci_dev *pdev = to_pci_dev(dev);
@@ -6193,7 +6193,7 @@ static int e1000_resume(struct device *dev)
        return __e1000_resume(pdev);
 }
-#endif /* CONFIG_PM_SLEEP */
+#endif /* CONFIG_PM */
 #ifdef CONFIG_PM_RUNTIME
 static int e1000_runtime_suspend(struct device *dev)
diff --git a/drivers/net/ethernet/intel/e1000e/phy.c b/drivers/net/ethernet/intel/e1000e/phy.c
index da2be59505c0..20e71f4ca426 100644
--- a/drivers/net/ethernet/intel/e1000e/phy.c
+++ b/drivers/net/ethernet/intel/e1000e/phy.c
@@ -1757,19 +1757,23 @@ s32 e1000e_phy_has_link_generic(struct e1000_hw *hw, u32 iterations,
                 * it across the board.
                 */
                ret_val = e1e_rphy(hw, MII_BMSR, &phy_status);
-                if (ret_val)
+                if (ret_val) {
                        /* If the first read fails, another entity may have
                         * ownership of the resources, wait and try again to
                         * see if they have relinquished the resources yet.
                         */
-                        udelay(usec_interval);
+                        if (usec_interval >= 1000)
+                                msleep(usec_interval / 1000);
+                        else
+                                udelay(usec_interval);
+                }
                ret_val = e1e_rphy(hw, MII_BMSR, &phy_status);
                if (ret_val)
                        break;
                if (phy_status & BMSR_LSTATUS)
                        break;
                if (usec_interval >= 1000)
-                        mdelay(usec_interval / 1000);
+                        msleep(usec_interval / 1000);
                else
                        udelay(usec_interval);
        }
diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
index be15938ba213..12b0932204ba 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
@@ -354,6 +354,9 @@ static struct rtnl_link_stats64 *i40e_get_netdev_stats_struct(
        struct rtnl_link_stats64 *vsi_stats = i40e_get_vsi_stats_struct(vsi);
        int i;
+        if (!vsi->tx_rings)
+                return stats;
        rcu_read_lock();
        for (i = 0; i < vsi->num_queue_pairs; i++) {
                struct i40e_ring *tx_ring, *rx_ring;
diff --git a/drivers/net/ethernet/intel/igb/e1000_phy.c b/drivers/net/ethernet/intel/igb/e1000_phy.c
index c4c4fe332c7e..ad2b74d95138 100644
--- a/drivers/net/ethernet/intel/igb/e1000_phy.c
+++ b/drivers/net/ethernet/intel/igb/e1000_phy.c
@@ -1728,7 +1728,10 @@ s32 igb_phy_has_link(struct e1000_hw *hw, u32 iterations,
                         * ownership of the resources, wait and try again to
                         * see if they have relinquished the resources yet.
                         */
-                        udelay(usec_interval);
+                        if (usec_interval >= 1000)
+                                mdelay(usec_interval/1000);
+                        else
+                                udelay(usec_interval);
                }
                ret_val = hw->phy.ops.read_reg(hw, PHY_STATUS, &phy_status);
                if (ret_val)
diff --git a/drivers/net/ethernet/intel/igb/igb_ethtool.c b/drivers/net/ethernet/intel/igb/igb_ethtool.c
index b0f3666b1d7f..c3143da497c8 100644
--- a/drivers/net/ethernet/intel/igb/igb_ethtool.c
+++ b/drivers/net/ethernet/intel/igb/igb_ethtool.c
@@ -2062,14 +2062,15 @@ static void igb_get_wol(struct net_device *netdev, struct ethtool_wolinfo *wol)
 {
        struct igb_adapter *adapter = netdev_priv(netdev);
-        wol->supported = WAKE_UCAST | WAKE_MCAST |
-                         WAKE_BCAST | WAKE_MAGIC |
-                         WAKE_PHY;
        wol->wolopts = 0;
        if (!(adapter->flags & IGB_FLAG_WOL_SUPPORTED))
                return;
+        wol->supported = WAKE_UCAST | WAKE_MCAST |
+                         WAKE_BCAST | WAKE_MAGIC |
+                         WAKE_PHY;
        /* apply any specific unsupported masks here */
        switch (adapter->hw.device_id) {
        default:
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
index 0c55079ebee3..5bcc870f8367 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
@@ -4251,8 +4251,8 @@ static void ixgbe_disable_fwd_ring(struct ixgbe_fwd_adapter *vadapter,
        rx_ring->l2_accel_priv = NULL;
 }
-int ixgbe_fwd_ring_down(struct net_device *vdev,
+static int ixgbe_fwd_ring_down(struct net_device *vdev,
-                        struct ixgbe_fwd_adapter *accel)
+                               struct ixgbe_fwd_adapter *accel)
 {
        struct ixgbe_adapter *adapter = accel->real_adapter;
        unsigned int rxbase = accel->rx_base_queue;
@@ -6827,12 +6827,20 @@ static inline int ixgbe_maybe_stop_tx(struct ixgbe_ring *tx_ring, u16 size)
        return __ixgbe_maybe_stop_tx(tx_ring, size);
 }
-#ifdef IXGBE_FCOE
+static u16 ixgbe_select_queue(struct net_device *dev, struct sk_buff *skb,
-static u16 ixgbe_select_queue(struct net_device *dev, struct sk_buff *skb)
+                              void *accel_priv)
 {
+        struct ixgbe_fwd_adapter *fwd_adapter = accel_priv;
+#ifdef IXGBE_FCOE
        struct ixgbe_adapter *adapter;
        struct ixgbe_ring_feature *f;
        int txq;
+#endif
+        if (fwd_adapter)
+                return skb->queue_mapping + fwd_adapter->tx_base_queue;
+#ifdef IXGBE_FCOE
        /*
         * only execute the code below if protocol is FCoE
@@ -6858,9 +6866,11 @@ static u16 ixgbe_select_queue(struct net_device *dev, struct sk_buff *skb)
                txq -= f->indices;
        return txq + f->offset;
+#else
+        return __netdev_pick_tx(dev, skb);
+#endif
 }
-#endif
 netdev_tx_t ixgbe_xmit_frame_ring(struct sk_buff *skb,
                          struct ixgbe_adapter *adapter,
                          struct ixgbe_ring *tx_ring)
@@ -7629,27 +7639,11 @@ static void ixgbe_fwd_del(struct net_device *pdev, void *priv)
        kfree(fwd_adapter);
 }
-static netdev_tx_t ixgbe_fwd_xmit(struct sk_buff *skb,
-                                  struct net_device *dev,
-                                  void *priv)
-{
-        struct ixgbe_fwd_adapter *fwd_adapter = priv;
-        unsigned int queue;
-        struct ixgbe_ring *tx_ring;
-        queue = skb->queue_mapping + fwd_adapter->tx_base_queue;
-        tx_ring = fwd_adapter->real_adapter->tx_ring[queue];
-        return __ixgbe_xmit_frame(skb, dev, tx_ring);
-}
 static const struct net_device_ops ixgbe_netdev_ops = {
        .ndo_open               = ixgbe_open,
        .ndo_stop               = ixgbe_close,
        .ndo_start_xmit         = ixgbe_xmit_frame,
-#ifdef IXGBE_FCOE
        .ndo_select_queue       = ixgbe_select_queue,
-#endif
        .ndo_set_rx_mode        = ixgbe_set_rx_mode,
        .ndo_validate_addr      = eth_validate_addr,
        .ndo_set_mac_address    = ixgbe_set_mac,
@@ -7689,7 +7683,6 @@ static const struct net_device_ops ixgbe_netdev_ops = {
        .ndo_bridge_getlink     = ixgbe_ndo_bridge_getlink,
        .ndo_dfwd_add_station   = ixgbe_fwd_add,
        .ndo_dfwd_del_station   = ixgbe_fwd_del,
-        .ndo_dfwd_start_xmit    = ixgbe_fwd_xmit,
 };
 /**
@@ -7986,10 +7979,9 @@ skip_sriov:
                           NETIF_F_TSO |
                           NETIF_F_TSO6 |
                           NETIF_F_RXHASH |
-                           NETIF_F_RXCSUM |
+                           NETIF_F_RXCSUM;
-                           NETIF_F_HW_L2FW_DOFFLOAD;
-        netdev->hw_features = netdev->features;
+        netdev->hw_features = netdev->features | NETIF_F_HW_L2FW_DOFFLOAD;
        switch (adapter->hw.mac.type) {
        case ixgbe_mac_82599EB:
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c
index e4c676006be9..39217e5ff7dc 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c
@@ -46,6 +46,7 @@ static bool ixgbe_get_i2c_data(u32 *i2cctl);
 static void ixgbe_i2c_bus_clear(struct ixgbe_hw *hw);
 static enum ixgbe_phy_type ixgbe_get_phy_type_from_id(u32 phy_id);
 static s32 ixgbe_get_phy_id(struct ixgbe_hw *hw);
+static s32 ixgbe_identify_qsfp_module_generic(struct ixgbe_hw *hw);
 /**
 *  ixgbe_identify_phy_generic - Get physical layer module
@@ -1164,7 +1165,7 @@ err_read_i2c_eeprom:
 *
 * Searches for and identifies the QSFP module and assigns appropriate PHY type
 **/
-s32 ixgbe_identify_qsfp_module_generic(struct ixgbe_hw *hw)
+static s32 ixgbe_identify_qsfp_module_generic(struct ixgbe_hw *hw)
 {
        struct ixgbe_adapter *adapter = hw->back;
        s32 status = IXGBE_ERR_PHY_ADDR_INVALID;
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.h b/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.h
index aae900a256da..fffcbdd2bf0e 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.h
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.h
@@ -145,7 +145,6 @@ s32 ixgbe_get_phy_firmware_version_generic(struct ixgbe_hw *hw,
 s32 ixgbe_reset_phy_nl(struct ixgbe_hw *hw);
 s32 ixgbe_identify_module_generic(struct ixgbe_hw *hw);
 s32 ixgbe_identify_sfp_module_generic(struct ixgbe_hw *hw);
-s32 ixgbe_identify_qsfp_module_generic(struct ixgbe_hw *hw);
 s32 ixgbe_get_sfp_init_sequence_offsets(struct ixgbe_hw *hw,
                                        u16 *list_offset,
                                        u16 *data_offset);
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c
index d6f0c0d8cf11..72084f70adbb 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c
@@ -291,7 +291,9 @@ static int ixgbe_pci_sriov_disable(struct pci_dev *dev)
 {
        struct ixgbe_adapter *adapter = pci_get_drvdata(dev);
        int err;
+#ifdef CONFIG_PCI_IOV
        u32 current_flags = adapter->flags;
+#endif
        err = ixgbe_disable_sriov(adapter);
diff --git a/drivers/net/ethernet/lantiq_etop.c b/drivers/net/ethernet/lantiq_etop.c
index 6a6c1f76d8e0..ec94a20d7099 100644
--- a/drivers/net/ethernet/lantiq_etop.c
+++ b/drivers/net/ethernet/lantiq_etop.c
@@ -619,7 +619,8 @@ ltq_etop_set_multicast_list(struct net_device *dev)
 }
 static u16
-ltq_etop_select_queue(struct net_device *dev, struct sk_buff *skb)
+ltq_etop_select_queue(struct net_device *dev, struct sk_buff *skb,
+                      void *accel_priv)
 {
        /* we are currently only using the first queue */
        return 0;
diff --git a/drivers/net/ethernet/marvell/mvmdio.c b/drivers/net/ethernet/marvell/mvmdio.c
index 7354960b583b..c4eeb69a5bee 100644
--- a/drivers/net/ethernet/marvell/mvmdio.c
+++ b/drivers/net/ethernet/marvell/mvmdio.c
@@ -92,6 +92,12 @@ static int orion_mdio_wait_ready(struct mii_bus *bus)
                        if (time_is_before_jiffies(end))
                                ++timedout;
                } else {
+                        /* wait_event_timeout does not guarantee a delay of at
+                         * least one whole jiffie, so timeout must be no less
+                         * than two.
+                         */
+                        if (timeout < 2)
+                                timeout = 2;
                        wait_event_timeout(dev->smi_busy_wait,
                                           orion_mdio_smi_is_done(dev),
                                           timeout);
diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
index b8e232b4ea2d..d5f0d72e5e33 100644
--- a/drivers/net/ethernet/marvell/mvneta.c
+++ b/drivers/net/ethernet/marvell/mvneta.c
@@ -1378,7 +1378,7 @@ static void mvneta_rxq_drop_pkts(struct mvneta_port *pp,
                dev_kfree_skb_any(skb);
                dma_unmap_single(pp->dev->dev.parent, rx_desc->buf_phys_addr,
-                                 rx_desc->data_size, DMA_FROM_DEVICE);
+                                 MVNETA_RX_BUF_SIZE(pp->pkt_size), DMA_FROM_DEVICE);
        }
        if (rx_done)
@@ -1424,7 +1424,7 @@ static int mvneta_rx(struct mvneta_port *pp, int rx_todo,
                }
                dma_unmap_single(pp->dev->dev.parent, rx_desc->buf_phys_addr,
-                                 rx_desc->data_size, DMA_FROM_DEVICE);
+                                 MVNETA_RX_BUF_SIZE(pp->pkt_size), DMA_FROM_DEVICE);
                rx_bytes = rx_desc->data_size -
                        (ETH_FCS_LEN + MVNETA_MH_SIZE);
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_selftest.c b/drivers/net/ethernet/mellanox/mlx4/en_selftest.c
index 40626690e8a8..c11d063473e5 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_selftest.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_selftest.c
@@ -140,7 +140,6 @@ void mlx4_en_ex_selftest(struct net_device *dev, u32 *flags, u64 *buf)
 {
        struct mlx4_en_priv *priv = netdev_priv(dev);
        struct mlx4_en_dev *mdev = priv->mdev;
-        struct mlx4_en_tx_ring *tx_ring;
        int i, carrier_ok;
        memset(buf, 0, sizeof(u64) * MLX4_EN_NUM_SELF_TEST);
@@ -150,16 +149,10 @@ void mlx4_en_ex_selftest(struct net_device *dev, u32 *flags, u64 *buf)
                carrier_ok = netif_carrier_ok(dev);
                netif_carrier_off(dev);
-retry_tx:
                /* Wait until all tx queues are empty.
                 * there should not be any additional incoming traffic
                 * since we turned the carrier off */
                msleep(200);
-                for (i = 0; i < priv->tx_ring_num && carrier_ok; i++) {
-                        tx_ring = priv->tx_ring[i];
-                        if (tx_ring->prod != (tx_ring->cons + tx_ring->last_nr_txbb))
-                                goto retry_tx;
-                }
                if (priv->mdev->dev->caps.flags &
                                        MLX4_DEV_CAP_FLAG_UC_LOOPBACK) {
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_tx.c b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
index f54ebd5a1702..a7fcd593b2db 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_tx.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
@@ -592,7 +592,8 @@ static void build_inline_wqe(struct mlx4_en_tx_desc *tx_desc, struct sk_buff *sk
        }
 }
-u16 mlx4_en_select_queue(struct net_device *dev, struct sk_buff *skb)
+u16 mlx4_en_select_queue(struct net_device *dev, struct sk_buff *skb,
+                         void *accel_priv)
 {
        struct mlx4_en_priv *priv = netdev_priv(dev);
        u16 rings_p_up = priv->num_tx_rings_p_up;
diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
index 5789ea2c934d..01fc6515384d 100644
--- a/drivers/net/ethernet/mellanox/mlx4/main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/main.c
@@ -2635,6 +2635,8 @@ static int __init mlx4_init(void)
                return -ENOMEM;
        ret = pci_register_driver(&mlx4_driver);
+        if (ret < 0)
+                destroy_workqueue(mlx4_wq);
        return ret < 0 ? ret : 0;
 }
diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
index f3758de59c05..d5758adceaa2 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
+++ b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
@@ -714,7 +714,8 @@ int mlx4_en_set_cq_moder(struct mlx4_en_priv *priv, struct mlx4_en_cq *cq);
 int mlx4_en_arm_cq(struct mlx4_en_priv *priv, struct mlx4_en_cq *cq);
 void mlx4_en_tx_irq(struct mlx4_cq *mcq);
-u16 mlx4_en_select_queue(struct net_device *dev, struct sk_buff *skb);
+u16 mlx4_en_select_queue(struct net_device *dev, struct sk_buff *skb,
+                         void *accel_priv);
 netdev_tx_t mlx4_en_xmit(struct sk_buff *skb, struct net_device *dev);
 int mlx4_en_create_tx_ring(struct mlx4_en_priv *priv,
diff --git a/drivers/net/ethernet/nvidia/forcedeth.c b/drivers/net/ethernet/nvidia/forcedeth.c
index 2d045be4b5cf..1e8b9514718b 100644
--- a/drivers/net/ethernet/nvidia/forcedeth.c
+++ b/drivers/net/ethernet/nvidia/forcedeth.c
@@ -5150,8 +5150,10 @@ static void nv_self_test(struct net_device *dev, struct ethtool_test *test, u64
 {
        struct fe_priv *np = netdev_priv(dev);
        u8 __iomem *base = get_hwbase(dev);
-        int result;
+        int result, count;
-        memset(buffer, 0, nv_get_sset_count(dev, ETH_SS_TEST)*sizeof(u64));
+        count = nv_get_sset_count(dev, ETH_SS_TEST);
+        memset(buffer, 0, count * sizeof(u64));
        if (!nv_link_test(dev)) {
                test->flags |= ETH_TEST_FL_FAILED;
@@ -5195,7 +5197,7 @@ static void nv_self_test(struct net_device *dev, struct ethtool_test *test, u64
                        return;
                }
-                if (!nv_loopback_test(dev)) {
+                if (count > NV_TEST_COUNT_BASE && !nv_loopback_test(dev)) {
                        test->flags |= ETH_TEST_FL_FAILED;
                        buffer[3] = 1;
                }
diff --git a/drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c b/drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c
index 7692dfd4f262..cc68657f0536 100644
--- a/drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c
+++ b/drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c
@@ -1604,13 +1604,13 @@ netxen_process_lro(struct netxen_adapter *adapter,
        u32 seq_number;
        u8 vhdr_len = 0;
-        if (unlikely(ring > adapter->max_rds_rings))
+        if (unlikely(ring >= adapter->max_rds_rings))
                return NULL;
        rds_ring = &recv_ctx->rds_rings[ring];
        index = netxen_get_lro_sts_refhandle(sts_data0);
-        if (unlikely(index > rds_ring->num_desc))
+        if (unlikely(index >= rds_ring->num_desc))
                return NULL;
        buffer = &rds_ring->rx_buf_arr[index];
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
index 631ea0ac1cd8..f2a7c7166e24 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
@@ -487,6 +487,7 @@ struct qlcnic_hardware_context {
        struct qlcnic_mailbox *mailbox;
        u8 extend_lb_time;
        u8 phys_port_id[ETH_ALEN];
+        u8 lb_mode;
 };
 struct qlcnic_adapter_stats {
@@ -578,6 +579,8 @@ struct qlcnic_host_tx_ring {
        dma_addr_t phys_addr;
        dma_addr_t hw_cons_phys_addr;
        struct netdev_queue *txq;
+        /* Lock to protect Tx descriptors cleanup */
+        spinlock_t tx_clean_lock;
 } ____cacheline_internodealigned_in_smp;
 /*
@@ -808,6 +811,7 @@ struct qlcnic_mac_list_s {
 #define QLCNIC_ILB_MODE         0x1
 #define QLCNIC_ELB_MODE         0x2
+#define QLCNIC_LB_MODE_MASK     0x3
 #define QLCNIC_LINKEVENT        0x1
 #define QLCNIC_LB_RESPONSE      0x2
@@ -1093,7 +1097,6 @@ struct qlcnic_adapter {
        struct qlcnic_filter_hash rx_fhash;
        struct list_head vf_mc_list;
-        spinlock_t tx_clean_lock;
        spinlock_t mac_learn_lock;
        /* spinlock for catching rcv filters for eswitch traffic */
        spinlock_t rx_mac_learn_lock;
@@ -1708,6 +1711,7 @@ int qlcnic_83xx_init_mailbox_work(struct qlcnic_adapter *);
 void qlcnic_83xx_detach_mailbox_work(struct qlcnic_adapter *);
 void qlcnic_83xx_reinit_mbx_work(struct qlcnic_mailbox *mbx);
 void qlcnic_83xx_free_mailbox(struct qlcnic_mailbox *mbx);
+void qlcnic_update_stats(struct qlcnic_adapter *);
 /* Adapter hardware abstraction */
 struct qlcnic_hardware_ops {
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
index b1cb0ffb15c7..f776f99f7915 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
@@ -447,8 +447,9 @@ irqreturn_t qlcnic_83xx_intr(int irq, void *data)
        qlcnic_83xx_poll_process_aen(adapter);
-        if (ahw->diag_test == QLCNIC_INTERRUPT_TEST) {
+        if (ahw->diag_test) {
-                ahw->diag_cnt++;
+                if (ahw->diag_test == QLCNIC_INTERRUPT_TEST)
+                        ahw->diag_cnt++;
                qlcnic_83xx_enable_legacy_msix_mbx_intr(adapter);
                return IRQ_HANDLED;
        }
@@ -1345,11 +1346,6 @@ static int qlcnic_83xx_diag_alloc_res(struct net_device *netdev, int test,
        }
        if (adapter->ahw->diag_test == QLCNIC_LOOPBACK_TEST) {
-                /* disable and free mailbox interrupt */
-                if (!(adapter->flags & QLCNIC_MSIX_ENABLED)) {
-                        qlcnic_83xx_enable_mbx_poll(adapter);
-                        qlcnic_83xx_free_mbx_intr(adapter);
-                }
                adapter->ahw->loopback_state = 0;
                adapter->ahw->hw_ops->setup_link_event(adapter, 1);
        }
@@ -1363,33 +1359,20 @@ static void qlcnic_83xx_diag_free_res(struct net_device *netdev,
 {
        struct qlcnic_adapter *adapter = netdev_priv(netdev);
        struct qlcnic_host_sds_ring *sds_ring;
-        int ring, err;
+        int ring;
        clear_bit(__QLCNIC_DEV_UP, &adapter->state);
        if (adapter->ahw->diag_test == QLCNIC_INTERRUPT_TEST) {
                for (ring = 0; ring < adapter->drv_sds_rings; ring++) {
                        sds_ring = &adapter->recv_ctx->sds_rings[ring];
-                        qlcnic_83xx_disable_intr(adapter, sds_ring);
+                        if (adapter->flags & QLCNIC_MSIX_ENABLED)
-                        if (!(adapter->flags & QLCNIC_MSIX_ENABLED))
+                                qlcnic_83xx_disable_intr(adapter, sds_ring);
-                                qlcnic_83xx_enable_mbx_poll(adapter);
                }
        }
        qlcnic_fw_destroy_ctx(adapter);
        qlcnic_detach(adapter);
-        if (adapter->ahw->diag_test == QLCNIC_LOOPBACK_TEST) {
-                if (!(adapter->flags & QLCNIC_MSIX_ENABLED)) {
-                        err = qlcnic_83xx_setup_mbx_intr(adapter);
-                        qlcnic_83xx_disable_mbx_poll(adapter);
-                        if (err) {
-                                dev_err(&adapter->pdev->dev,
-                                        "%s: failed to setup mbx interrupt\n",
-                                        __func__);
-                                goto out;
-                        }
-                }
-        }
        adapter->ahw->diag_test = 0;
        adapter->drv_sds_rings = drv_sds_rings;
@@ -1399,9 +1382,6 @@ static void qlcnic_83xx_diag_free_res(struct net_device *netdev,
        if (netif_running(netdev))
                __qlcnic_up(adapter, netdev);
-        if (adapter->ahw->diag_test == QLCNIC_INTERRUPT_TEST &&
-            !(adapter->flags & QLCNIC_MSIX_ENABLED))
-                qlcnic_83xx_disable_mbx_poll(adapter);
 out:
        netif_device_attach(netdev);
 }
@@ -1704,12 +1684,6 @@ int qlcnic_83xx_loopback_test(struct net_device *netdev, u8 mode)
                }
        } while ((adapter->ahw->linkup && ahw->has_link_events) != 1);
-        /* Make sure carrier is off and queue is stopped during loopback */
-        if (netif_running(netdev)) {
-                netif_carrier_off(netdev);
-                netif_tx_stop_all_queues(netdev);
-        }
        ret = qlcnic_do_lb_test(adapter, mode);
        qlcnic_83xx_clear_lb_mode(adapter, mode);
@@ -2141,6 +2115,7 @@ static void qlcnic_83xx_handle_link_aen(struct qlcnic_adapter *adapter,
        ahw->link_autoneg = MSB(MSW(data[3]));
        ahw->module_type = MSB(LSW(data[3]));
        ahw->has_link_events = 1;
+        ahw->lb_mode = data[4] & QLCNIC_LB_MODE_MASK;
        qlcnic_advert_link_change(adapter, link_status);
 }
@@ -3754,6 +3729,19 @@ static void qlcnic_83xx_decode_mbx_rsp(struct qlcnic_adapter *adapter,
        return;
 }
+static inline void qlcnic_dump_mailbox_registers(struct qlcnic_adapter *adapter)
+{
+        struct qlcnic_hardware_context *ahw = adapter->ahw;
+        u32 offset;
+        offset = QLCRDX(ahw, QLCNIC_DEF_INT_MASK);
+        dev_info(&adapter->pdev->dev, "Mbx interrupt mask=0x%x, Mbx interrupt enable=0x%x, Host mbx control=0x%x, Fw mbx control=0x%x",
+                 readl(ahw->pci_base0 + offset),
+                 QLCRDX(ahw, QLCNIC_MBX_INTR_ENBL),
+                 QLCRDX(ahw, QLCNIC_HOST_MBX_CTRL),
+                 QLCRDX(ahw, QLCNIC_FW_MBX_CTRL));
+}
 static void qlcnic_83xx_mailbox_worker(struct work_struct *work)
 {
        struct qlcnic_mailbox *mbx = container_of(work, struct qlcnic_mailbox,
@@ -3798,6 +3786,8 @@ static void qlcnic_83xx_mailbox_worker(struct work_struct *work)
                                __func__, cmd->cmd_op, cmd->type, ahw->pci_func,
                                ahw->op_mode);
                        clear_bit(QLC_83XX_MBX_READY, &mbx->status);
+                        qlcnic_dump_mailbox_registers(adapter);
+                        qlcnic_83xx_get_mbx_data(adapter, cmd);
                        qlcnic_dump_mbx(adapter, cmd);
                        qlcnic_83xx_idc_request_reset(adapter,
                                                      QLCNIC_FORCE_FW_DUMP_KEY);
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.h
index 4cae6caa6bfa..a6a33508e401 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.h
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.h
@@ -662,4 +662,5 @@ pci_ers_result_t qlcnic_83xx_io_error_detected(struct pci_dev *,
                                               pci_channel_state_t);
 pci_ers_result_t qlcnic_83xx_io_slot_reset(struct pci_dev *);
 void qlcnic_83xx_io_resume(struct pci_dev *);
+void qlcnic_83xx_stop_hw(struct qlcnic_adapter *);
 #endif
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
index 89208e5b25d6..918e18ddf038 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
@@ -740,6 +740,7 @@ static int qlcnic_83xx_idc_unknown_state(struct qlcnic_adapter *adapter)
        adapter->ahw->idc.err_code = -EIO;
        dev_err(&adapter->pdev->dev,
                "%s: Device in unknown state\n", __func__);
+        clear_bit(__QLCNIC_RESETTING, &adapter->state);
        return 0;
 }
@@ -818,7 +819,6 @@ static int qlcnic_83xx_idc_ready_state(struct qlcnic_adapter *adapter)
        struct qlcnic_hardware_context *ahw = adapter->ahw;
        struct qlcnic_mailbox *mbx = ahw->mailbox;
        int ret = 0;
-        u32 owner;
        u32 val;
        /* Perform NIC configuration based ready state entry actions */
@@ -848,9 +848,9 @@ static int qlcnic_83xx_idc_ready_state(struct qlcnic_adapter *adapter)
                        set_bit(__QLCNIC_RESETTING, &adapter->state);
                        qlcnic_83xx_idc_enter_need_reset_state(adapter, 1);
                }  else {
-                        owner = qlcnic_83xx_idc_find_reset_owner_id(adapter);
+                        netdev_info(adapter->netdev, "%s: Auto firmware recovery is disabled\n",
-                        if (ahw->pci_func == owner)
+                                    __func__);
-                                qlcnic_dump_fw(adapter);
+                        qlcnic_83xx_idc_enter_failed_state(adapter, 1);
                }
                return -EIO;
        }
@@ -948,13 +948,26 @@ static int qlcnic_83xx_idc_need_quiesce_state(struct qlcnic_adapter *adapter)
        return 0;
 }
-static int qlcnic_83xx_idc_failed_state(struct qlcnic_adapter *adapter)
+static void qlcnic_83xx_idc_failed_state(struct qlcnic_adapter *adapter)
 {
-        dev_err(&adapter->pdev->dev, "%s: please restart!!\n", __func__);
+        struct qlcnic_hardware_context *ahw = adapter->ahw;
+        u32 val, owner;
+        val = QLCRDX(adapter->ahw, QLC_83XX_IDC_CTRL);
+        if (val & QLC_83XX_IDC_DISABLE_FW_RESET_RECOVERY) {
+                owner = qlcnic_83xx_idc_find_reset_owner_id(adapter);
+                if (ahw->pci_func == owner) {
+                        qlcnic_83xx_stop_hw(adapter);
+                        qlcnic_dump_fw(adapter);
+                }
+        }
+        netdev_warn(adapter->netdev, "%s: Reboot will be required to recover the adapter!!\n",
+                    __func__);
        clear_bit(__QLCNIC_RESETTING, &adapter->state);
-        adapter->ahw->idc.err_code = -EIO;
+        ahw->idc.err_code = -EIO;
-        return 0;
+        return;
 }
 static int qlcnic_83xx_idc_quiesce_state(struct qlcnic_adapter *adapter)
@@ -1063,12 +1076,6 @@ void qlcnic_83xx_idc_poll_dev_state(struct work_struct *work)
        adapter->ahw->idc.prev_state = adapter->ahw->idc.curr_state;
        qlcnic_83xx_periodic_tasks(adapter);
-        /* Do not reschedule if firmaware is in hanged state and auto
-         * recovery is disabled
-         */
-        if ((adapter->flags & QLCNIC_FW_HANG) && !qlcnic_auto_fw_reset)
-                return;
        /* Re-schedule the function */
        if (test_bit(QLC_83XX_MODULE_LOADED, &adapter->ahw->idc.status))
                qlcnic_schedule_work(adapter, qlcnic_83xx_idc_poll_dev_state,
@@ -1219,10 +1226,10 @@ void qlcnic_83xx_idc_request_reset(struct qlcnic_adapter *adapter, u32 key)
        }
        val = QLCRDX(adapter->ahw, QLC_83XX_IDC_CTRL);
-        if ((val & QLC_83XX_IDC_DISABLE_FW_RESET_RECOVERY) ||
+        if (val & QLC_83XX_IDC_DISABLE_FW_RESET_RECOVERY) {
-            !qlcnic_auto_fw_reset) {
+                netdev_info(adapter->netdev, "%s: Auto firmware recovery is disabled\n",
-                dev_err(&adapter->pdev->dev,
+                            __func__);
-                        "%s:failed, device in non reset mode\n", __func__);
+                qlcnic_83xx_idc_enter_failed_state(adapter, 0);
                qlcnic_83xx_unlock_driver(adapter);
                return;
        }
@@ -1254,24 +1261,24 @@ static int qlcnic_83xx_copy_bootloader(struct qlcnic_adapter *adapter)
        if (size & 0xF)
                size = (size + 16) & ~0xF;
-        p_cache = kzalloc(size, GFP_KERNEL);
+        p_cache = vzalloc(size);
        if (p_cache == NULL)
                return -ENOMEM;
        ret = qlcnic_83xx_lockless_flash_read32(adapter, src, p_cache,
                                                size / sizeof(u32));
        if (ret) {
-                kfree(p_cache);
+                vfree(p_cache);
                return ret;
        }
        /* 16 byte write to MS memory */
        ret = qlcnic_83xx_ms_mem_write128(adapter, dest, (u32 *)p_cache,
                                          size / 16);
        if (ret) {
-                kfree(p_cache);
+                vfree(p_cache);
                return ret;
        }
-        kfree(p_cache);
+        vfree(p_cache);
        return ret;
 }
@@ -1939,7 +1946,7 @@ static void qlcnic_83xx_exec_template_cmd(struct qlcnic_adapter *p_dev,
        p_dev->ahw->reset.seq_index = index;
 }
-static void qlcnic_83xx_stop_hw(struct qlcnic_adapter *p_dev)
+void qlcnic_83xx_stop_hw(struct qlcnic_adapter *p_dev)
 {
        p_dev->ahw->reset.seq_index = 0;
@@ -1994,6 +2001,14 @@ static int qlcnic_83xx_restart_hw(struct qlcnic_adapter *adapter)
        val = QLCRDX(adapter->ahw, QLC_83XX_IDC_CTRL);
        if (!(val & QLC_83XX_IDC_GRACEFULL_RESET))
                qlcnic_dump_fw(adapter);
+        if (val & QLC_83XX_IDC_DISABLE_FW_RESET_RECOVERY) {
+                netdev_info(adapter->netdev, "%s: Auto firmware recovery is disabled\n",
+                            __func__);
+                qlcnic_83xx_idc_enter_failed_state(adapter, 1);
+                return err;
+        }
        qlcnic_83xx_init_hw(adapter);
        if (qlcnic_83xx_copy_bootloader(adapter))
@@ -2073,8 +2088,8 @@ int qlcnic_83xx_configure_opmode(struct qlcnic_adapter *adapter)
                ahw->nic_mode = QLCNIC_DEFAULT_MODE;
                adapter->nic_ops->init_driver = qlcnic_83xx_init_default_driver;
                ahw->idc.state_entry = qlcnic_83xx_idc_ready_state_entry;
-                adapter->max_sds_rings = ahw->max_rx_ques;
+                adapter->max_sds_rings = QLCNIC_MAX_SDS_RINGS;
-                adapter->max_tx_rings = ahw->max_tx_ques;
+                adapter->max_tx_rings = QLCNIC_MAX_TX_RINGS;
        } else {
                return -EIO;
        }
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
index b36c02fafcfd..6b08194aa0d4 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
@@ -167,27 +167,35 @@ static const char qlcnic_gstrings_test[][ETH_GSTRING_LEN] = {
 #define QLCNIC_TEST_LEN ARRAY_SIZE(qlcnic_gstrings_test)
-static inline int qlcnic_82xx_statistics(void)
+static inline int qlcnic_82xx_statistics(struct qlcnic_adapter *adapter)
 {
-        return ARRAY_SIZE(qlcnic_device_gstrings_stats) +
+        return ARRAY_SIZE(qlcnic_gstrings_stats) +
-               ARRAY_SIZE(qlcnic_83xx_mac_stats_strings);
+               ARRAY_SIZE(qlcnic_83xx_mac_stats_strings) +
+               QLCNIC_TX_STATS_LEN * adapter->drv_tx_rings;
 }
-static inline int qlcnic_83xx_statistics(void)
+static inline int qlcnic_83xx_statistics(struct qlcnic_adapter *adapter)
 {
-        return ARRAY_SIZE(qlcnic_83xx_tx_stats_strings) +
+        return ARRAY_SIZE(qlcnic_gstrings_stats) +
+               ARRAY_SIZE(qlcnic_83xx_tx_stats_strings) +
               ARRAY_SIZE(qlcnic_83xx_mac_stats_strings) +
-               ARRAY_SIZE(qlcnic_83xx_rx_stats_strings);
+               ARRAY_SIZE(qlcnic_83xx_rx_stats_strings) +
+               QLCNIC_TX_STATS_LEN * adapter->drv_tx_rings;
 }
 static int qlcnic_dev_statistics_len(struct qlcnic_adapter *adapter)
 {
-        if (qlcnic_82xx_check(adapter))
+        int len = -1;
-                return qlcnic_82xx_statistics();
-        else if (qlcnic_83xx_check(adapter))
+        if (qlcnic_82xx_check(adapter)) {
-                return qlcnic_83xx_statistics();
+                len = qlcnic_82xx_statistics(adapter);
-        else
+                if (adapter->flags & QLCNIC_ESWITCH_ENABLED)
-                return -1;
+                        len += ARRAY_SIZE(qlcnic_device_gstrings_stats);
+        } else if (qlcnic_83xx_check(adapter)) {
+                len = qlcnic_83xx_statistics(adapter);
+        }
+        return len;
 }
 #define QLCNIC_TX_INTR_NOT_CONFIGURED   0X78563412
@@ -667,30 +675,25 @@ qlcnic_set_ringparam(struct net_device *dev,
 static int qlcnic_validate_ring_count(struct qlcnic_adapter *adapter,
                                      u8 rx_ring, u8 tx_ring)
 {
+        if (rx_ring == 0 || tx_ring == 0)
+                return -EINVAL;
        if (rx_ring != 0) {
                if (rx_ring > adapter->max_sds_rings) {
-                        netdev_err(adapter->netdev, "Invalid ring count, SDS ring count %d should not be greater than max %d driver sds rings.\n",
+                        netdev_err(adapter->netdev,
+                                   "Invalid ring count, SDS ring count %d should not be greater than max %d driver sds rings.\n",
                                   rx_ring, adapter->max_sds_rings);
                        return -EINVAL;
                }
        }
         if (tx_ring != 0) {
-                if (qlcnic_82xx_check(adapter) &&
+                if (tx_ring > adapter->max_tx_rings) {
-                    (tx_ring > adapter->max_tx_rings)) {
                        netdev_err(adapter->netdev,
                                   "Invalid ring count, Tx ring count %d should not be greater than max %d driver Tx rings.\n",
                                   tx_ring, adapter->max_tx_rings);
                        return -EINVAL;
                }
-                if (qlcnic_83xx_check(adapter) &&
-                    (tx_ring > QLCNIC_SINGLE_RING)) {
-                        netdev_err(adapter->netdev,
-                                   "Invalid ring count, Tx ring count %d should not be greater than %d driver Tx rings.\n",
-                                   tx_ring, QLCNIC_SINGLE_RING);
-                         return -EINVAL;
-                }
        }
        return 0;
@@ -925,18 +928,13 @@ static int qlcnic_eeprom_test(struct net_device *dev)
 static int qlcnic_get_sset_count(struct net_device *dev, int sset)
 {
-        int len;
        struct qlcnic_adapter *adapter = netdev_priv(dev);
        switch (sset) {
        case ETH_SS_TEST:
                return QLCNIC_TEST_LEN;
        case ETH_SS_STATS:
-                len = qlcnic_dev_statistics_len(adapter) + QLCNIC_STATS_LEN;
+                return qlcnic_dev_statistics_len(adapter);
-                if ((adapter->flags & QLCNIC_ESWITCH_ENABLED) ||
-                    qlcnic_83xx_check(adapter))
-                        return len;
-                return qlcnic_82xx_statistics();
        default:
                return -EOPNOTSUPP;
        }
@@ -948,6 +946,7 @@ static int qlcnic_irq_test(struct net_device *netdev)
        struct qlcnic_hardware_context *ahw = adapter->ahw;
        struct qlcnic_cmd_args cmd;
        int ret, drv_sds_rings = adapter->drv_sds_rings;
+        int drv_tx_rings = adapter->drv_tx_rings;
        if (qlcnic_83xx_check(adapter))
                return qlcnic_83xx_interrupt_test(netdev);
@@ -980,6 +979,7 @@ free_diag_res:
 clear_diag_irq:
        adapter->drv_sds_rings = drv_sds_rings;
+        adapter->drv_tx_rings = drv_tx_rings;
        clear_bit(__QLCNIC_RESETTING, &adapter->state);
        return ret;
@@ -1270,7 +1270,7 @@ static u64 *qlcnic_fill_stats(u64 *data, void *stats, int type)
        return data;
 }
-static void qlcnic_update_stats(struct qlcnic_adapter *adapter)
+void qlcnic_update_stats(struct qlcnic_adapter *adapter)
 {
        struct qlcnic_host_tx_ring *tx_ring;
        int ring;
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_init.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_init.c
index e9c21e5d0ca9..c4262c23ed7c 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_init.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_init.c
@@ -134,6 +134,8 @@ void qlcnic_release_tx_buffers(struct qlcnic_adapter *adapter,
        struct qlcnic_skb_frag *buffrag;
        int i, j;
+        spin_lock(&tx_ring->tx_clean_lock);
        cmd_buf = tx_ring->cmd_buf_arr;
        for (i = 0; i < tx_ring->num_desc; i++) {
                buffrag = cmd_buf->frag_array;
@@ -157,6 +159,8 @@ void qlcnic_release_tx_buffers(struct qlcnic_adapter *adapter,
                }
                cmd_buf++;
        }
+        spin_unlock(&tx_ring->tx_clean_lock);
 }
 void qlcnic_free_sw_resources(struct qlcnic_adapter *adapter)
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c
index 0149c9495347..ad1531ae3aa8 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c
@@ -687,17 +687,15 @@ void qlcnic_advert_link_change(struct qlcnic_adapter *adapter, int linkup)
        if (adapter->ahw->linkup && !linkup) {
                netdev_info(netdev, "NIC Link is down\n");
                adapter->ahw->linkup = 0;
-                if (netif_running(netdev)) {
+                netif_carrier_off(netdev);
-                        netif_carrier_off(netdev);
-                        netif_tx_stop_all_queues(netdev);
-                }
        } else if (!adapter->ahw->linkup && linkup) {
+                /* Do not advertise Link up if the port is in loopback mode */
+                if (qlcnic_83xx_check(adapter) && adapter->ahw->lb_mode)
+                        return;
                netdev_info(netdev, "NIC Link is up\n");
                adapter->ahw->linkup = 1;
-                if (netif_running(netdev)) {
+                netif_carrier_on(netdev);
-                        netif_carrier_on(netdev);
-                        netif_wake_queue(netdev);
-                }
        }
 }
@@ -784,7 +782,7 @@ static int qlcnic_process_cmd_ring(struct qlcnic_adapter *adapter,
        struct net_device *netdev = adapter->netdev;
        struct qlcnic_skb_frag *frag;
-        if (!spin_trylock(&adapter->tx_clean_lock))
+        if (!spin_trylock(&tx_ring->tx_clean_lock))
                return 1;
        sw_consumer = tx_ring->sw_consumer;
@@ -813,8 +811,9 @@ static int qlcnic_process_cmd_ring(struct qlcnic_adapter *adapter,
                        break;
        }
+        tx_ring->sw_consumer = sw_consumer;
        if (count && netif_running(netdev)) {
-                tx_ring->sw_consumer = sw_consumer;
                smp_mb();
                if (netif_tx_queue_stopped(tx_ring->txq) &&
                    netif_carrier_ok(netdev)) {
@@ -840,7 +839,8 @@ static int qlcnic_process_cmd_ring(struct qlcnic_adapter *adapter,
         */
        hw_consumer = le32_to_cpu(*(tx_ring->hw_consumer));
        done = (sw_consumer == hw_consumer);
-        spin_unlock(&adapter->tx_clean_lock);
+        spin_unlock(&tx_ring->tx_clean_lock);
        return done;
 }
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
index 05c1eef8df13..550791b8fbae 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
@@ -1178,6 +1178,7 @@ qlcnic_initialize_nic(struct qlcnic_adapter *adapter)
        } else {
                adapter->ahw->nic_mode = QLCNIC_DEFAULT_MODE;
                adapter->max_tx_rings = QLCNIC_MAX_HW_TX_RINGS;
+                adapter->max_sds_rings = QLCNIC_MAX_SDS_RINGS;
                adapter->flags &= ~QLCNIC_ESWITCH_ENABLED;
        }
@@ -1755,7 +1756,6 @@ void __qlcnic_down(struct qlcnic_adapter *adapter, struct net_device *netdev)
        if (qlcnic_sriov_vf_check(adapter))
                qlcnic_sriov_cleanup_async_list(&adapter->ahw->sriov->bc);
        smp_mb();
-        spin_lock(&adapter->tx_clean_lock);
        netif_carrier_off(netdev);
        adapter->ahw->linkup = 0;
        netif_tx_disable(netdev);
@@ -1776,7 +1776,6 @@ void __qlcnic_down(struct qlcnic_adapter *adapter, struct net_device *netdev)
        for (ring = 0; ring < adapter->drv_tx_rings; ring++)
                qlcnic_release_tx_buffers(adapter, &adapter->tx_ring[ring]);
-        spin_unlock(&adapter->tx_clean_lock);
 }
 /* Usage: During suspend and firmware recovery module */
@@ -1940,7 +1939,6 @@ int qlcnic_diag_alloc_res(struct net_device *netdev, int test)
        qlcnic_detach(adapter);
        adapter->drv_sds_rings = QLCNIC_SINGLE_RING;
-        adapter->drv_tx_rings = QLCNIC_SINGLE_RING;
        adapter->ahw->diag_test = test;
        adapter->ahw->linkup = 0;
@@ -2172,6 +2170,7 @@ int qlcnic_alloc_tx_rings(struct qlcnic_adapter *adapter,
                }
                memset(cmd_buf_arr, 0, TX_BUFF_RINGSIZE(tx_ring));
                tx_ring->cmd_buf_arr = cmd_buf_arr;
+                spin_lock_init(&tx_ring->tx_clean_lock);
        }
        if (qlcnic_83xx_check(adapter) ||
@@ -2299,7 +2298,6 @@ qlcnic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
        rwlock_init(&adapter->ahw->crb_lock);
        mutex_init(&adapter->ahw->mem_lock);
-        spin_lock_init(&adapter->tx_clean_lock);
        INIT_LIST_HEAD(&adapter->mac_list);
        qlcnic_register_dcb(adapter);
@@ -2782,6 +2780,9 @@ static struct net_device_stats *qlcnic_get_stats(struct net_device *netdev)
        struct qlcnic_adapter *adapter = netdev_priv(netdev);
        struct net_device_stats *stats = &netdev->stats;
+        if (test_bit(__QLCNIC_DEV_UP, &adapter->state))
+                qlcnic_update_stats(adapter);
        stats->rx_packets = adapter->stats.rx_pkts + adapter->stats.lro_pkts;
        stats->tx_packets = adapter->stats.xmitfinished;
        stats->rx_bytes = adapter->stats.rxbytes + adapter->stats.lrobytes;
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c
index 686f460b1502..024f8161d2fe 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c
@@ -75,7 +75,6 @@ static int qlcnic_sriov_pf_cal_res_limit(struct qlcnic_adapter *adapter,
        num_vfs = sriov->num_vfs;
        max = num_vfs + 1;
        info->bit_offsets = 0xffff;
-        info->max_tx_ques = res->num_tx_queues / max;
        info->max_rx_mcast_mac_filters = res->num_rx_mcast_mac_filters;
        num_vf_macs = QLCNIC_SRIOV_VF_MAX_MAC;
@@ -86,6 +85,7 @@ static int qlcnic_sriov_pf_cal_res_limit(struct qlcnic_adapter *adapter,
                info->max_tx_mac_filters = temp;
                info->min_tx_bw = 0;
                info->max_tx_bw = MAX_BW;
+                info->max_tx_ques = res->num_tx_queues - sriov->num_vfs;
        } else {
                id = qlcnic_sriov_func_to_index(adapter, func);
                if (id < 0)
@@ -95,6 +95,7 @@ static int qlcnic_sriov_pf_cal_res_limit(struct qlcnic_adapter *adapter,
                info->max_tx_bw = vp->max_tx_bw;
                info->max_rx_ucast_mac_filters = num_vf_macs;
                info->max_tx_mac_filters = num_vf_macs;
+                info->max_tx_ques = QLCNIC_SINGLE_RING;
        }
        info->max_rx_ip_addr = res->num_destip / max;
diff --git a/drivers/net/ethernet/qlogic/qlge/qlge.h b/drivers/net/ethernet/qlogic/qlge/qlge.h
index 0c9c4e895595..03517478e589 100644
--- a/drivers/net/ethernet/qlogic/qlge/qlge.h
+++ b/drivers/net/ethernet/qlogic/qlge/qlge.h
@@ -18,7 +18,7 @@
 */
 #define DRV_NAME        "qlge"
 #define DRV_STRING      "QLogic 10 Gigabit PCI-E Ethernet Driver "
-#define DRV_VERSION     "1.00.00.33"
+#define DRV_VERSION     "1.00.00.34"
 #define WQ_ADDR_ALIGN   0x3     /* 4 byte alignment */
diff --git a/drivers/net/ethernet/qlogic/qlge/qlge_ethtool.c b/drivers/net/ethernet/qlogic/qlge/qlge_ethtool.c
index 0780e039b271..8dee1beb9854 100644
--- a/drivers/net/ethernet/qlogic/qlge/qlge_ethtool.c
+++ b/drivers/net/ethernet/qlogic/qlge/qlge_ethtool.c
@@ -181,6 +181,7 @@ static const char ql_gstrings_test[][ETH_GSTRING_LEN] = {
 };
 #define QLGE_TEST_LEN (sizeof(ql_gstrings_test) / ETH_GSTRING_LEN)
 #define QLGE_STATS_LEN ARRAY_SIZE(ql_gstrings_stats)
+#define QLGE_RCV_MAC_ERR_STATS  7
 static int ql_update_ring_coalescing(struct ql_adapter *qdev)
 {
@@ -280,6 +281,9 @@ static void ql_update_stats(struct ql_adapter *qdev)
                iter++;
        }
+        /* Update receive mac error statistics */
+        iter += QLGE_RCV_MAC_ERR_STATS;
        /*
         * Get Per-priority TX pause frame counter statistics.
         */
diff --git a/drivers/net/ethernet/qlogic/qlge/qlge_main.c b/drivers/net/ethernet/qlogic/qlge/qlge_main.c
index a245dc18d769..449f506d2e8f 100644
--- a/drivers/net/ethernet/qlogic/qlge/qlge_main.c
+++ b/drivers/net/ethernet/qlogic/qlge/qlge_main.c
@@ -2376,14 +2376,6 @@ static netdev_features_t qlge_fix_features(struct net_device *ndev,
        netdev_features_t features)
 {
        int err;
-        /*
-         * Since there is no support for separate rx/tx vlan accel
-         * enable/disable make sure tx flag is always in same state as rx.
-         */
-        if (features & NETIF_F_HW_VLAN_CTAG_RX)
-                features |= NETIF_F_HW_VLAN_CTAG_TX;
-        else
-                features &= ~NETIF_F_HW_VLAN_CTAG_TX;
        /* Update the behavior of vlan accel in the adapter */
        err = qlge_update_hw_vlan_features(ndev, features);
diff --git a/drivers/net/ethernet/realtek/8139cp.c b/drivers/net/ethernet/realtek/8139cp.c
index f2a2128165dd..737c1a881f78 100644
--- a/drivers/net/ethernet/realtek/8139cp.c
+++ b/drivers/net/ethernet/realtek/8139cp.c
@@ -678,9 +678,6 @@ static void cp_tx (struct cp_private *cp)
                                 le32_to_cpu(txd->opts1) & 0xffff,
                                 PCI_DMA_TODEVICE);
-                bytes_compl += skb->len;
-                pkts_compl++;
                if (status & LastFrag) {
                        if (status & (TxError | TxFIFOUnder)) {
                                netif_dbg(cp, tx_err, cp->dev,
@@ -702,6 +699,8 @@ static void cp_tx (struct cp_private *cp)
                                netif_dbg(cp, tx_done, cp->dev,
                                          "tx done, slot %d\n", tx_tail);
                        }
+                        bytes_compl += skb->len;
+                        pkts_compl++;
                        dev_kfree_skb_irq(skb);
                }
diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
index 799387570766..c737f0ea5de7 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -3465,6 +3465,11 @@ static void rtl8168g_1_hw_phy_config(struct rtl8169_private *tp)
        rtl_writephy(tp, 0x14, 0x9065);
        rtl_writephy(tp, 0x14, 0x1065);
+        /* Check ALDPS bit, disable it if enabled */
+        rtl_writephy(tp, 0x1f, 0x0a43);
+        if (rtl_readphy(tp, 0x10) & 0x0004)
+                rtl_w1w0_phy(tp, 0x10, 0x0000, 0x0004);
        rtl_writephy(tp, 0x1f, 0x0000);
 }
diff --git a/drivers/net/ethernet/sfc/efx.c b/drivers/net/ethernet/sfc/efx.c
index 2e27837ce6a2..fd844b53e385 100644
--- a/drivers/net/ethernet/sfc/efx.c
+++ b/drivers/net/ethernet/sfc/efx.c
@@ -585,7 +585,7 @@ static void efx_start_datapath(struct efx_nic *efx)
                           EFX_MAX_FRAME_LEN(efx->net_dev->mtu) +
                           efx->type->rx_buffer_padding);
        rx_buf_len = (sizeof(struct efx_rx_page_state) +
-                      NET_IP_ALIGN + efx->rx_dma_len);
+                      efx->rx_ip_align + efx->rx_dma_len);
        if (rx_buf_len <= PAGE_SIZE) {
                efx->rx_scatter = efx->type->always_rx_scatter;
                efx->rx_buffer_order = 0;
@@ -645,6 +645,8 @@ static void efx_start_datapath(struct efx_nic *efx)
                WARN_ON(channel->rx_pkt_n_frags);
        }
+        efx_ptp_start_datapath(efx);
        if (netif_device_present(efx->net_dev))
                netif_tx_wake_all_queues(efx->net_dev);
 }
@@ -659,6 +661,8 @@ static void efx_stop_datapath(struct efx_nic *efx)
        EFX_ASSERT_RESET_SERIALISED(efx);
        BUG_ON(efx->port_enabled);
+        efx_ptp_stop_datapath(efx);
        /* Stop RX refill */
        efx_for_each_channel(channel, efx) {
                efx_for_each_channel_rx_queue(rx_queue, channel)
@@ -2540,6 +2544,8 @@ static int efx_init_struct(struct efx_nic *efx,
        efx->net_dev = net_dev;
        efx->rx_prefix_size = efx->type->rx_prefix_size;
+        efx->rx_ip_align =
+                NET_IP_ALIGN ? (efx->rx_prefix_size + NET_IP_ALIGN) % 4 : 0;
        efx->rx_packet_hash_offset =
                efx->type->rx_hash_offset - efx->type->rx_prefix_size;
        spin_lock_init(&efx->stats_lock);
diff --git a/drivers/net/ethernet/sfc/mcdi.c b/drivers/net/ethernet/sfc/mcdi.c
index 366c8e3e3784..4b0bd8a1514d 100644
--- a/drivers/net/ethernet/sfc/mcdi.c
+++ b/drivers/net/ethernet/sfc/mcdi.c
@@ -50,6 +50,7 @@ struct efx_mcdi_async_param {
 static void efx_mcdi_timeout_async(unsigned long context);
 static int efx_mcdi_drv_attach(struct efx_nic *efx, bool driver_operating,
                               bool *was_attached_out);
+static bool efx_mcdi_poll_once(struct efx_nic *efx);
 static inline struct efx_mcdi_iface *efx_mcdi(struct efx_nic *efx)
 {
@@ -237,6 +238,21 @@ static void efx_mcdi_read_response_header(struct efx_nic *efx)
        }
 }
+static bool efx_mcdi_poll_once(struct efx_nic *efx)
+{
+        struct efx_mcdi_iface *mcdi = efx_mcdi(efx);
+        rmb();
+        if (!efx->type->mcdi_poll_response(efx))
+                return false;
+        spin_lock_bh(&mcdi->iface_lock);
+        efx_mcdi_read_response_header(efx);
+        spin_unlock_bh(&mcdi->iface_lock);
+        return true;
+}
 static int efx_mcdi_poll(struct efx_nic *efx)
 {
        struct efx_mcdi_iface *mcdi = efx_mcdi(efx);
@@ -272,18 +288,13 @@ static int efx_mcdi_poll(struct efx_nic *efx)
                time = jiffies;
-                rmb();
+                if (efx_mcdi_poll_once(efx))
-                if (efx->type->mcdi_poll_response(efx))
                        break;
                if (time_after(time, finish))
                        return -ETIMEDOUT;
        }
-        spin_lock_bh(&mcdi->iface_lock);
-        efx_mcdi_read_response_header(efx);
-        spin_unlock_bh(&mcdi->iface_lock);
        /* Return rc=0 like wait_event_timeout() */
        return 0;
 }
@@ -619,6 +630,16 @@ int efx_mcdi_rpc_finish(struct efx_nic *efx, unsigned cmd, size_t inlen,
                rc = efx_mcdi_await_completion(efx);
        if (rc != 0) {
+                netif_err(efx, hw, efx->net_dev,
+                          "MC command 0x%x inlen %d mode %d timed out\n",
+                          cmd, (int)inlen, mcdi->mode);
+                if (mcdi->mode == MCDI_MODE_EVENTS && efx_mcdi_poll_once(efx)) {
+                        netif_err(efx, hw, efx->net_dev,
+                                  "MCDI request was completed without an event\n");
+                        rc = 0;
+                }
                /* Close the race with efx_mcdi_ev_cpl() executing just too late
                 * and completing a request we've just cancelled, by ensuring
                 * that the seqno check therein fails.
@@ -627,11 +648,9 @@ int efx_mcdi_rpc_finish(struct efx_nic *efx, unsigned cmd, size_t inlen,
                ++mcdi->seqno;
                ++mcdi->credits;
                spin_unlock_bh(&mcdi->iface_lock);
+        }
-                netif_err(efx, hw, efx->net_dev,
+        if (rc == 0) {
-                          "MC command 0x%x inlen %d mode %d timed out\n",
-                          cmd, (int)inlen, mcdi->mode);
-        } else {
                size_t hdr_len, data_len;
                /* At the very least we need a memory barrier here to ensure
diff --git a/drivers/net/ethernet/sfc/mcdi.h b/drivers/net/ethernet/sfc/mcdi.h
index 656a3277c2b2..15816cacb548 100644
--- a/drivers/net/ethernet/sfc/mcdi.h
+++ b/drivers/net/ethernet/sfc/mcdi.h
@@ -75,6 +75,8 @@ struct efx_mcdi_mon {
        unsigned long last_update;
        struct device *device;
        struct efx_mcdi_mon_attribute *attrs;
+        struct attribute_group group;
+        const struct attribute_group *groups[2];
        unsigned int n_attrs;
 };
diff --git a/drivers/net/ethernet/sfc/mcdi_mon.c b/drivers/net/ethernet/sfc/mcdi_mon.c
index 4cc5d95b2a5a..d72ad4fc3617 100644
--- a/drivers/net/ethernet/sfc/mcdi_mon.c
+++ b/drivers/net/ethernet/sfc/mcdi_mon.c
@@ -139,17 +139,10 @@ static int efx_mcdi_mon_update(struct efx_nic *efx)
        return rc;
 }
-static ssize_t efx_mcdi_mon_show_name(struct device *dev,
-                                      struct device_attribute *attr,
-                                      char *buf)
-{
-        return sprintf(buf, "%s\n", KBUILD_MODNAME);
-}
 static int efx_mcdi_mon_get_entry(struct device *dev, unsigned int index,
                                  efx_dword_t *entry)
 {
-        struct efx_nic *efx = dev_get_drvdata(dev);
+        struct efx_nic *efx = dev_get_drvdata(dev->parent);
        struct efx_mcdi_mon *hwmon = efx_mcdi_mon(efx);
        int rc;
@@ -263,7 +256,7 @@ static ssize_t efx_mcdi_mon_show_label(struct device *dev,
                       efx_mcdi_sensor_type[mon_attr->type].label);
 }
-static int
+static void
 efx_mcdi_mon_add_attr(struct efx_nic *efx, const char *name,
                      ssize_t (*reader)(struct device *,
                                        struct device_attribute *, char *),
@@ -272,7 +265,6 @@ efx_mcdi_mon_add_attr(struct efx_nic *efx, const char *name,
 {
        struct efx_mcdi_mon *hwmon = efx_mcdi_mon(efx);
        struct efx_mcdi_mon_attribute *attr = &hwmon->attrs[hwmon->n_attrs];
-        int rc;
        strlcpy(attr->name, name, sizeof(attr->name));
        attr->index = index;
@@ -286,10 +278,7 @@ efx_mcdi_mon_add_attr(struct efx_nic *efx, const char *name,
        attr->dev_attr.attr.name = attr->name;
        attr->dev_attr.attr.mode = S_IRUGO;
        attr->dev_attr.show = reader;
-        rc = device_create_file(&efx->pci_dev->dev, &attr->dev_attr);
+        hwmon->group.attrs[hwmon->n_attrs++] = &attr->dev_attr.attr;
-        if (rc == 0)
-                ++hwmon->n_attrs;
-        return rc;
 }
 int efx_mcdi_mon_probe(struct efx_nic *efx)
@@ -338,26 +327,22 @@ int efx_mcdi_mon_probe(struct efx_nic *efx)
        efx_mcdi_mon_update(efx);
        /* Allocate space for the maximum possible number of
-         * attributes for this set of sensors: name of the driver plus
+         * attributes for this set of sensors:
         * value, min, max, crit, alarm and label for each sensor.
         */
-        n_attrs = 1 + 6 * n_sensors;
+        n_attrs = 6 * n_sensors;
        hwmon->attrs = kcalloc(n_attrs, sizeof(*hwmon->attrs), GFP_KERNEL);
        if (!hwmon->attrs) {
                rc = -ENOMEM;
                goto fail;
        }
+        hwmon->group.attrs = kcalloc(n_attrs + 1, sizeof(struct attribute *),
-        hwmon->device = hwmon_device_register(&efx->pci_dev->dev);
+                                     GFP_KERNEL);
-        if (IS_ERR(hwmon->device)) {
+        if (!hwmon->group.attrs) {
-                rc = PTR_ERR(hwmon->device);
+                rc = -ENOMEM;
                goto fail;
        }
-        rc = efx_mcdi_mon_add_attr(efx, "name", efx_mcdi_mon_show_name, 0, 0, 0);
-        if (rc)
-                goto fail;
        for (i = 0, j = -1, type = -1; ; i++) {
                enum efx_hwmon_type hwmon_type;
                const char *hwmon_prefix;
@@ -372,7 +357,7 @@ int efx_mcdi_mon_probe(struct efx_nic *efx)
                                page = type / 32;
                                j = -1;
                                if (page == n_pages)
-                                        return 0;
+                                        goto hwmon_register;
                                MCDI_SET_DWORD(inbuf, SENSOR_INFO_EXT_IN_PAGE,
                                               page);
@@ -453,28 +438,22 @@ int efx_mcdi_mon_probe(struct efx_nic *efx)
                if (min1 != max1) {
                        snprintf(name, sizeof(name), "%s%u_input",
                                 hwmon_prefix, hwmon_index);
-                        rc = efx_mcdi_mon_add_attr(
+                        efx_mcdi_mon_add_attr(
                                efx, name, efx_mcdi_mon_show_value, i, type, 0);
-                        if (rc)
-                                goto fail;
                        if (hwmon_type != EFX_HWMON_POWER) {
                                snprintf(name, sizeof(name), "%s%u_min",
                                         hwmon_prefix, hwmon_index);
-                                rc = efx_mcdi_mon_add_attr(
+                                efx_mcdi_mon_add_attr(
                                        efx, name, efx_mcdi_mon_show_limit,
                                        i, type, min1);
-                                if (rc)
-                                        goto fail;
                        }
                        snprintf(name, sizeof(name), "%s%u_max",
                                 hwmon_prefix, hwmon_index);
-                        rc = efx_mcdi_mon_add_attr(
+                        efx_mcdi_mon_add_attr(
                                efx, name, efx_mcdi_mon_show_limit,
                                i, type, max1);
-                        if (rc)
-                                goto fail;
                        if (min2 != max2) {
                                /* Assume max2 is critical value.
@@ -482,32 +461,38 @@ int efx_mcdi_mon_probe(struct efx_nic *efx)
                                 */
                                snprintf(name, sizeof(name), "%s%u_crit",
                                         hwmon_prefix, hwmon_index);
-                                rc = efx_mcdi_mon_add_attr(
+                                efx_mcdi_mon_add_attr(
                                        efx, name, efx_mcdi_mon_show_limit,
                                        i, type, max2);
-                                if (rc)
-                                        goto fail;
                        }
                }
                snprintf(name, sizeof(name), "%s%u_alarm",
                         hwmon_prefix, hwmon_index);
-                rc = efx_mcdi_mon_add_attr(
+                efx_mcdi_mon_add_attr(
                        efx, name, efx_mcdi_mon_show_alarm, i, type, 0);
-                if (rc)
-                        goto fail;
                if (type < ARRAY_SIZE(efx_mcdi_sensor_type) &&
                    efx_mcdi_sensor_type[type].label) {
                        snprintf(name, sizeof(name), "%s%u_label",
                                 hwmon_prefix, hwmon_index);
-                        rc = efx_mcdi_mon_add_attr(
+                        efx_mcdi_mon_add_attr(
                                efx, name, efx_mcdi_mon_show_label, i, type, 0);
-                        if (rc)
-                                goto fail;
                }
        }
+hwmon_register:
+        hwmon->groups[0] = &hwmon->group;
+        hwmon->device = hwmon_device_register_with_groups(&efx->pci_dev->dev,
+                                                          KBUILD_MODNAME, NULL,
+                                                          hwmon->groups);
+        if (IS_ERR(hwmon->device)) {
+                rc = PTR_ERR(hwmon->device);
+                goto fail;
+        }
+        return 0;
 fail:
        efx_mcdi_mon_remove(efx);
        return rc;
@@ -516,14 +501,11 @@ fail:
 void efx_mcdi_mon_remove(struct efx_nic *efx)
 {
        struct efx_mcdi_mon *hwmon = efx_mcdi_mon(efx);
-        unsigned int i;
-        for (i = 0; i < hwmon->n_attrs; i++)
-                device_remove_file(&efx->pci_dev->dev,
-                                   &hwmon->attrs[i].dev_attr);
-        kfree(hwmon->attrs);
        if (hwmon->device)
                hwmon_device_unregister(hwmon->device);
+        kfree(hwmon->attrs);
+        kfree(hwmon->group.attrs);
        efx_nic_free_buffer(efx, &hwmon->dma_buf);
 }
diff --git a/drivers/net/ethernet/sfc/net_driver.h b/drivers/net/ethernet/sfc/net_driver.h
index b14a717ac3e8..542a0d252ae0 100644
--- a/drivers/net/ethernet/sfc/net_driver.h
+++ b/drivers/net/ethernet/sfc/net_driver.h
@@ -683,6 +683,8 @@ struct vfdi_status;
 * @n_channels: Number of channels in use
 * @n_rx_channels: Number of channels used for RX (= number of RX queues)
 * @n_tx_channels: Number of channels used for TX
+ * @rx_ip_align: RX DMA address offset to have IP header aligned in
+ *      in accordance with NET_IP_ALIGN
 * @rx_dma_len: Current maximum RX DMA length
 * @rx_buffer_order: Order (log2) of number of pages for each RX buffer
 * @rx_buffer_truesize: Amortised allocation size of an RX buffer,
@@ -816,6 +818,7 @@ struct efx_nic {
        unsigned rss_spread;
        unsigned tx_channel_offset;
        unsigned n_tx_channels;
+        unsigned int rx_ip_align;
        unsigned int rx_dma_len;
        unsigned int rx_buffer_order;
        unsigned int rx_buffer_truesize;
diff --git a/drivers/net/ethernet/sfc/nic.h b/drivers/net/ethernet/sfc/nic.h
index 11b6112d9249..91c63ec79c5f 100644
--- a/drivers/net/ethernet/sfc/nic.h
+++ b/drivers/net/ethernet/sfc/nic.h
@@ -560,6 +560,8 @@ void efx_ptp_get_ts_info(struct efx_nic *efx, struct ethtool_ts_info *ts_info);
 bool efx_ptp_is_ptp_tx(struct efx_nic *efx, struct sk_buff *skb);
 int efx_ptp_tx(struct efx_nic *efx, struct sk_buff *skb);
 void efx_ptp_event(struct efx_nic *efx, efx_qword_t *ev);
+void efx_ptp_start_datapath(struct efx_nic *efx);
+void efx_ptp_stop_datapath(struct efx_nic *efx);
 extern const struct efx_nic_type falcon_a1_nic_type;
 extern const struct efx_nic_type falcon_b0_nic_type;
diff --git a/drivers/net/ethernet/sfc/ptp.c b/drivers/net/ethernet/sfc/ptp.c
index 03acf57df045..3dd39dcfe36b 100644
--- a/drivers/net/ethernet/sfc/ptp.c
+++ b/drivers/net/ethernet/sfc/ptp.c
@@ -220,6 +220,7 @@ struct efx_ptp_timeset {
 * @evt_list: List of MC receive events awaiting packets
 * @evt_free_list: List of free events
 * @evt_lock: Lock for manipulating evt_list and evt_free_list
+ * @evt_overflow: Boolean indicating that event list has overflowed
 * @rx_evts: Instantiated events (on evt_list and evt_free_list)
 * @workwq: Work queue for processing pending PTP operations
 * @work: Work task
@@ -270,6 +271,7 @@ struct efx_ptp_data {
        struct list_head evt_list;
        struct list_head evt_free_list;
        spinlock_t evt_lock;
+        bool evt_overflow;
        struct efx_ptp_event_rx rx_evts[MAX_RECEIVE_EVENTS];
        struct workqueue_struct *workwq;
        struct work_struct work;
@@ -635,6 +637,11 @@ static void efx_ptp_drop_time_expired_events(struct efx_nic *efx)
                        }
                }
        }
+        /* If the event overflow flag is set and the event list is now empty
+         * clear the flag to re-enable the overflow warning message.
+         */
+        if (ptp->evt_overflow && list_empty(&ptp->evt_list))
+                ptp->evt_overflow = false;
        spin_unlock_bh(&ptp->evt_lock);
 }
@@ -676,6 +683,11 @@ static enum ptp_packet_state efx_ptp_match_rx(struct efx_nic *efx,
                        break;
                }
        }
+        /* If the event overflow flag is set and the event list is now empty
+         * clear the flag to re-enable the overflow warning message.
+         */
+        if (ptp->evt_overflow && list_empty(&ptp->evt_list))
+                ptp->evt_overflow = false;
        spin_unlock_bh(&ptp->evt_lock);
        return rc;
@@ -705,8 +717,9 @@ static bool efx_ptp_process_events(struct efx_nic *efx, struct sk_buff_head *q)
                        __skb_queue_tail(q, skb);
                } else if (time_after(jiffies, match->expiry)) {
                        match->state = PTP_PACKET_STATE_TIMED_OUT;
-                        netif_warn(efx, rx_err, efx->net_dev,
+                        if (net_ratelimit())
-                                   "PTP packet - no timestamp seen\n");
+                                netif_warn(efx, rx_err, efx->net_dev,
+                                           "PTP packet - no timestamp seen\n");
                        __skb_queue_tail(q, skb);
                } else {
                        /* Replace unprocessed entry and stop */
@@ -788,9 +801,14 @@ fail:
 static int efx_ptp_stop(struct efx_nic *efx)
 {
        struct efx_ptp_data *ptp = efx->ptp_data;
-        int rc = efx_ptp_disable(efx);
        struct list_head *cursor;
        struct list_head *next;
+        int rc;
+        if (ptp == NULL)
+                return 0;
+        rc = efx_ptp_disable(efx);
        if (ptp->rxfilter_installed) {
                efx_filter_remove_id_safe(efx, EFX_FILTER_PRI_REQUIRED,
@@ -809,11 +827,19 @@ static int efx_ptp_stop(struct efx_nic *efx)
        list_for_each_safe(cursor, next, &efx->ptp_data->evt_list) {
                list_move(cursor, &efx->ptp_data->evt_free_list);
        }
+        ptp->evt_overflow = false;
        spin_unlock_bh(&efx->ptp_data->evt_lock);
        return rc;
 }
+static int efx_ptp_restart(struct efx_nic *efx)
+{
+        if (efx->ptp_data && efx->ptp_data->enabled)
+                return efx_ptp_start(efx);
+        return 0;
+}
 static void efx_ptp_pps_worker(struct work_struct *work)
 {
        struct efx_ptp_data *ptp =
@@ -901,6 +927,7 @@ static int efx_ptp_probe_channel(struct efx_channel *channel)
        spin_lock_init(&ptp->evt_lock);
        for (pos = 0; pos < MAX_RECEIVE_EVENTS; pos++)
                list_add(&ptp->rx_evts[pos].link, &ptp->evt_free_list);
+        ptp->evt_overflow = false;
        ptp->phc_clock_info.owner = THIS_MODULE;
        snprintf(ptp->phc_clock_info.name,
@@ -989,7 +1016,11 @@ bool efx_ptp_is_ptp_tx(struct efx_nic *efx, struct sk_buff *skb)
                skb->len >= PTP_MIN_LENGTH &&
                skb->len <= MC_CMD_PTP_IN_TRANSMIT_PACKET_MAXNUM &&
                likely(skb->protocol == htons(ETH_P_IP)) &&
+                skb_transport_header_was_set(skb) &&
+                skb_network_header_len(skb) >= sizeof(struct iphdr) &&
                ip_hdr(skb)->protocol == IPPROTO_UDP &&
+                skb_headlen(skb) >=
+                skb_transport_offset(skb) + sizeof(struct udphdr) &&
                udp_hdr(skb)->dest == htons(PTP_EVENT_PORT);
 }
@@ -1106,7 +1137,7 @@ static int efx_ptp_change_mode(struct efx_nic *efx, bool enable_wanted,
 {
        if ((enable_wanted != efx->ptp_data->enabled) ||
            (enable_wanted && (efx->ptp_data->mode != new_mode))) {
-                int rc;
+                int rc = 0;
                if (enable_wanted) {
                        /* Change of mode requires disable */
@@ -1123,7 +1154,8 @@ static int efx_ptp_change_mode(struct efx_nic *efx, bool enable_wanted,
                         * succeed.
                         */
                        efx->ptp_data->mode = new_mode;
-                        rc = efx_ptp_start(efx);
+                        if (netif_running(efx->net_dev))
+                                rc = efx_ptp_start(efx);
                        if (rc == 0) {
                                rc = efx_ptp_synchronize(efx,
                                                         PTP_SYNC_ATTEMPTS * 2);
@@ -1295,8 +1327,13 @@ static void ptp_event_rx(struct efx_nic *efx, struct efx_ptp_data *ptp)
                list_add_tail(&evt->link, &ptp->evt_list);
                queue_work(ptp->workwq, &ptp->work);
-        } else {
+        } else if (!ptp->evt_overflow) {
-                netif_err(efx, rx_err, efx->net_dev, "No free PTP event");
+                /* Log a warning message and set the event overflow flag.
+                 * The message won't be logged again until the event queue
+                 * becomes empty.
+                 */
+                netif_err(efx, rx_err, efx->net_dev, "PTP event queue overflow\n");
+                ptp->evt_overflow = true;
        }
        spin_unlock_bh(&ptp->evt_lock);
 }
@@ -1389,7 +1426,7 @@ static int efx_phc_adjfreq(struct ptp_clock_info *ptp, s32 delta)
        if (rc != 0)
                return rc;
-        ptp_data->current_adjfreq = delta;
+        ptp_data->current_adjfreq = adjustment_ns;
        return 0;
 }
@@ -1404,7 +1441,7 @@ static int efx_phc_adjtime(struct ptp_clock_info *ptp, s64 delta)
        MCDI_SET_DWORD(inbuf, PTP_IN_OP, MC_CMD_PTP_OP_ADJUST);
        MCDI_SET_DWORD(inbuf, PTP_IN_PERIPH_ID, 0);
-        MCDI_SET_QWORD(inbuf, PTP_IN_ADJUST_FREQ, 0);
+        MCDI_SET_QWORD(inbuf, PTP_IN_ADJUST_FREQ, ptp_data->current_adjfreq);
        MCDI_SET_DWORD(inbuf, PTP_IN_ADJUST_SECONDS, (u32)delta_ts.tv_sec);
        MCDI_SET_DWORD(inbuf, PTP_IN_ADJUST_NANOSECONDS, (u32)delta_ts.tv_nsec);
        return efx_mcdi_rpc(efx, MC_CMD_PTP, inbuf, sizeof(inbuf),
@@ -1491,3 +1528,14 @@ void efx_ptp_probe(struct efx_nic *efx)
                efx->extra_channel_type[EFX_EXTRA_CHANNEL_PTP] =
                        &efx_ptp_channel_type;
 }
+void efx_ptp_start_datapath(struct efx_nic *efx)
+{
+        if (efx_ptp_restart(efx))
+                netif_err(efx, drv, efx->net_dev, "Failed to restart PTP.\n");
+}
+void efx_ptp_stop_datapath(struct efx_nic *efx)
+{
+        efx_ptp_stop(efx);
+}
diff --git a/drivers/net/ethernet/sfc/rx.c b/drivers/net/ethernet/sfc/rx.c
index 8f09e686fc23..42488df1f4ec 100644
--- a/drivers/net/ethernet/sfc/rx.c
+++ b/drivers/net/ethernet/sfc/rx.c
@@ -94,7 +94,7 @@ static inline void efx_sync_rx_buffer(struct efx_nic *efx,
 void efx_rx_config_page_split(struct efx_nic *efx)
 {
-        efx->rx_page_buf_step = ALIGN(efx->rx_dma_len + NET_IP_ALIGN,
+        efx->rx_page_buf_step = ALIGN(efx->rx_dma_len + efx->rx_ip_align,
                                      EFX_RX_BUF_ALIGNMENT);
        efx->rx_bufs_per_page = efx->rx_buffer_order ? 1 :
                ((PAGE_SIZE - sizeof(struct efx_rx_page_state)) /
@@ -189,9 +189,9 @@ static int efx_init_rx_buffers(struct efx_rx_queue *rx_queue)
                do {
                        index = rx_queue->added_count & rx_queue->ptr_mask;
                        rx_buf = efx_rx_buffer(rx_queue, index);
-                        rx_buf->dma_addr = dma_addr + NET_IP_ALIGN;
+                        rx_buf->dma_addr = dma_addr + efx->rx_ip_align;
                        rx_buf->page = page;
-                        rx_buf->page_offset = page_offset + NET_IP_ALIGN;
+                        rx_buf->page_offset = page_offset + efx->rx_ip_align;
                        rx_buf->len = efx->rx_dma_len;
                        rx_buf->flags = 0;
                        ++rx_queue->added_count;
diff --git a/drivers/net/ethernet/smsc/smc91x.c b/drivers/net/ethernet/smsc/smc91x.c
index 0c9b5d94154f..8bf29eb4a5a0 100644
--- a/drivers/net/ethernet/smsc/smc91x.c
+++ b/drivers/net/ethernet/smsc/smc91x.c
@@ -82,6 +82,7 @@ static const char version[] =
 #include <linux/mii.h>
 #include <linux/workqueue.h>
 #include <linux/of.h>
+#include <linux/of_device.h>
 #include <linux/netdevice.h>
 #include <linux/etherdevice.h>
@@ -2184,6 +2185,15 @@ static void smc_release_datacs(struct platform_device *pdev, struct net_device *
        }
 }
+#if IS_BUILTIN(CONFIG_OF)
+static const struct of_device_id smc91x_match[] = {
+        { .compatible = "smsc,lan91c94", },
+        { .compatible = "smsc,lan91c111", },
+        {},
+};
+MODULE_DEVICE_TABLE(of, smc91x_match);
+#endif
 /*
 * smc_init(void)
 *   Input parameters:
@@ -2198,6 +2208,7 @@ static void smc_release_datacs(struct platform_device *pdev, struct net_device *
 static int smc_drv_probe(struct platform_device *pdev)
 {
        struct smc91x_platdata *pd = dev_get_platdata(&pdev->dev);
+        const struct of_device_id *match = NULL;
        struct smc_local *lp;
        struct net_device *ndev;
        struct resource *res, *ires;
@@ -2217,11 +2228,34 @@ static int smc_drv_probe(struct platform_device *pdev)
         */
        lp = netdev_priv(ndev);
+        lp->cfg.flags = 0;
        if (pd) {
                memcpy(&lp->cfg, pd, sizeof(lp->cfg));
                lp->io_shift = SMC91X_IO_SHIFT(lp->cfg.flags);
-        } else {
+        }
+#if IS_BUILTIN(CONFIG_OF)
+        match = of_match_device(of_match_ptr(smc91x_match), &pdev->dev);
+        if (match) {
+                struct device_node *np = pdev->dev.of_node;
+                u32 val;
+                /* Combination of IO widths supported, default to 16-bit */
+                if (!of_property_read_u32(np, "reg-io-width", &val)) {
+                        if (val & 1)
+                                lp->cfg.flags |= SMC91X_USE_8BIT;
+                        if ((val == 0) || (val & 2))
+                                lp->cfg.flags |= SMC91X_USE_16BIT;
+                        if (val & 4)
+                                lp->cfg.flags |= SMC91X_USE_32BIT;
+                } else {
+                        lp->cfg.flags |= SMC91X_USE_16BIT;
+                }
+        }
+#endif
+        if (!pd && !match) {
                lp->cfg.flags |= (SMC_CAN_USE_8BIT)  ? SMC91X_USE_8BIT  : 0;
                lp->cfg.flags |= (SMC_CAN_USE_16BIT) ? SMC91X_USE_16BIT : 0;
                lp->cfg.flags |= (SMC_CAN_USE_32BIT) ? SMC91X_USE_32BIT : 0;
@@ -2370,15 +2404,6 @@ static int smc_drv_resume(struct device *dev)
        return 0;
 }
-#ifdef CONFIG_OF
-static const struct of_device_id smc91x_match[] = {
-        { .compatible = "smsc,lan91c94", },
-        { .compatible = "smsc,lan91c111", },
-        {},
-};
-MODULE_DEVICE_TABLE(of, smc91x_match);
-#endif
 static struct dev_pm_ops smc_drv_pm_ops = {
        .suspend        = smc_drv_suspend,
        .resume         = smc_drv_resume,
diff --git a/drivers/net/ethernet/smsc/smc91x.h b/drivers/net/ethernet/smsc/smc91x.h
index c9d4c872e81d..749654b976bc 100644
--- a/drivers/net/ethernet/smsc/smc91x.h
+++ b/drivers/net/ethernet/smsc/smc91x.h
@@ -46,7 +46,8 @@
    defined(CONFIG_MACH_LITTLETON) ||\
    defined(CONFIG_MACH_ZYLONITE2) ||\
    defined(CONFIG_ARCH_VIPER) ||\
-    defined(CONFIG_MACH_STARGATE2)
+    defined(CONFIG_MACH_STARGATE2) ||\
+    defined(CONFIG_ARCH_VERSATILE)
 #include <asm/mach-types.h>
@@ -154,6 +155,8 @@ static inline void SMC_outw(u16 val, void __iomem *ioaddr, int reg)
 #define SMC_outl(v, a, r)       writel(v, (a) + (r))
 #define SMC_insl(a, r, p, l)    readsl((a) + (r), p, l)
 #define SMC_outsl(a, r, p, l)   writesl((a) + (r), p, l)
+#define SMC_insw(a, r, p, l)    readsw((a) + (r), p, l)
+#define SMC_outsw(a, r, p, l)   writesw((a) + (r), p, l)
 #define SMC_IRQ_FLAGS           (-1)    /* from resource */
 /* We actually can't write halfwords properly if not word aligned */
@@ -206,23 +209,6 @@ SMC_outw(u16 val, void __iomem *ioaddr, int reg)
 #define RPC_LSA_DEFAULT         RPC_LED_TX_RX
 #define RPC_LSB_DEFAULT         RPC_LED_100_10
-#elif   defined(CONFIG_ARCH_VERSATILE)
-#define SMC_CAN_USE_8BIT        1
-#define SMC_CAN_USE_16BIT       1
-#define SMC_CAN_USE_32BIT       1
-#define SMC_NOWAIT              1
-#define SMC_inb(a, r)           readb((a) + (r))
-#define SMC_inw(a, r)           readw((a) + (r))
-#define SMC_inl(a, r)           readl((a) + (r))
-#define SMC_outb(v, a, r)       writeb(v, (a) + (r))
-#define SMC_outw(v, a, r)       writew(v, (a) + (r))
-#define SMC_outl(v, a, r)       writel(v, (a) + (r))
-#define SMC_insl(a, r, p, l)    readsl((a) + (r), p, l)
-#define SMC_outsl(a, r, p, l)   writesl((a) + (r), p, l)
-#define SMC_IRQ_FLAGS           (-1)    /* from resource */
 #elif defined(CONFIG_MN10300)
 /*
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 8a7a23a84ac5..797b56a0efc4 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -622,17 +622,15 @@ static int stmmac_init_ptp(struct stmmac_priv *priv)
        if (!(priv->dma_cap.time_stamp || priv->dma_cap.atime_stamp))
                return -EOPNOTSUPP;
-        if (netif_msg_hw(priv)) {
+        priv->adv_ts = 0;
-                if (priv->dma_cap.time_stamp) {
+        if (priv->dma_cap.atime_stamp && priv->extend_desc)
-                        pr_debug("IEEE 1588-2002 Time Stamp supported\n");
+                priv->adv_ts = 1;
-                        priv->adv_ts = 0;
-                }
+        if (netif_msg_hw(priv) && priv->dma_cap.time_stamp)
-                if (priv->dma_cap.atime_stamp && priv->extend_desc) {
+                pr_debug("IEEE 1588-2002 Time Stamp supported\n");
-                        pr_debug
-                            ("IEEE 1588-2008 Advanced Time Stamp supported\n");
+        if (netif_msg_hw(priv) && priv->adv_ts)
-                        priv->adv_ts = 1;
+                pr_debug("IEEE 1588-2008 Advanced Time Stamp supported\n");
-                }
-        }
        priv->hw->ptp = &stmmac_ptp;
        priv->hwts_tx_en = 0;
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c
index b8b0eeed0f92..7680581ebe12 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c
@@ -56,7 +56,7 @@ static int stmmac_adjust_freq(struct ptp_clock_info *ptp, s32 ppb)
        priv->hw->ptp->config_addend(priv->ioaddr, addend);
-        spin_unlock_irqrestore(&priv->lock, flags);
+        spin_unlock_irqrestore(&priv->ptp_lock, flags);
        return 0;
 }
@@ -91,7 +91,7 @@ static int stmmac_adjust_time(struct ptp_clock_info *ptp, s64 delta)
        priv->hw->ptp->adjust_systime(priv->ioaddr, sec, nsec, neg_adj);
-        spin_unlock_irqrestore(&priv->lock, flags);
+        spin_unlock_irqrestore(&priv->ptp_lock, flags);
        return 0;
 }
diff --git a/drivers/net/ethernet/tehuti/tehuti.c b/drivers/net/ethernet/tehuti/tehuti.c
index dd0dd6279b4e..4f1d2549130e 100644
--- a/drivers/net/ethernet/tehuti/tehuti.c
+++ b/drivers/net/ethernet/tehuti/tehuti.c
@@ -2019,7 +2019,6 @@ bdx_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
                ndev->features = NETIF_F_IP_CSUM | NETIF_F_SG | NETIF_F_TSO
                    | NETIF_F_HW_VLAN_CTAG_TX | NETIF_F_HW_VLAN_CTAG_RX |
                    NETIF_F_HW_VLAN_CTAG_FILTER | NETIF_F_RXCSUM
-                    /*| NETIF_F_FRAGLIST */
                    ;
                ndev->hw_features = NETIF_F_IP_CSUM | NETIF_F_SG |
                        NETIF_F_TSO | NETIF_F_HW_VLAN_CTAG_TX;
diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
index 7536a4c01293..5330fd298705 100644
--- a/drivers/net/ethernet/ti/cpsw.c
+++ b/drivers/net/ethernet/ti/cpsw.c
@@ -740,6 +740,8 @@ static void _cpsw_adjust_link(struct cpsw_slave *slave,
                /* set speed_in input in case RMII mode is used in 100Mbps */
                if (phy->speed == 100)
                        mac_control |= BIT(15);
+                else if (phy->speed == 10)
+                        mac_control |= BIT(18); /* In Band mode */
                *link = true;
        } else {
@@ -1151,6 +1153,12 @@ static int cpsw_ndo_open(struct net_device *ndev)
                 * receive descs
                 */
                cpsw_info(priv, ifup, "submitted %d rx descriptors\n", i);
+                if (cpts_register(&priv->pdev->dev, priv->cpts,
+                                  priv->data.cpts_clock_mult,
+                                  priv->data.cpts_clock_shift))
+                        dev_err(priv->dev, "error registering cpts device\n");
        }
        /* Enable Interrupt pacing if configured */
@@ -1197,6 +1205,7 @@ static int cpsw_ndo_stop(struct net_device *ndev)
        netif_carrier_off(priv->ndev);
        if (cpsw_common_res_usage_state(priv) <= 1) {
+                cpts_unregister(priv->cpts);
                cpsw_intr_disable(priv);
                cpdma_ctlr_int_ctrl(priv->dma, false);
                cpdma_ctlr_stop(priv->dma);
@@ -1816,6 +1825,8 @@ static int cpsw_probe_dt(struct cpsw_platform_data *data,
                }
                i++;
+                if (i == data->slaves)
+                        break;
        }
        return 0;
@@ -1983,9 +1994,15 @@ static int cpsw_probe(struct platform_device *pdev)
                goto clean_runtime_disable_ret;
        }
        priv->regs = ss_regs;
-        priv->version = __raw_readl(&priv->regs->id_ver);
        priv->host_port = HOST_PORT_NUM;
+        /* Need to enable clocks with runtime PM api to access module
+         * registers
+         */
+        pm_runtime_get_sync(&pdev->dev);
+        priv->version = readl(&priv->regs->id_ver);
+        pm_runtime_put_sync(&pdev->dev);
        res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
        priv->wr_regs = devm_ioremap_resource(&pdev->dev, res);
        if (IS_ERR(priv->wr_regs)) {
@@ -2091,7 +2108,7 @@ static int cpsw_probe(struct platform_device *pdev)
        while ((res = platform_get_resource(priv->pdev, IORESOURCE_IRQ, k))) {
                for (i = res->start; i <= res->end; i++) {
                        if (devm_request_irq(&pdev->dev, i, cpsw_interrupt, 0,
-                                             dev_name(priv->dev), priv)) {
+                                             dev_name(&pdev->dev), priv)) {
                                dev_err(priv->dev, "error attaching irq\n");
                                goto clean_ale_ret;
                        }
@@ -2155,8 +2172,6 @@ static int cpsw_remove(struct platform_device *pdev)
                unregister_netdev(cpsw_get_slave_ndev(priv, 1));
        unregister_netdev(ndev);
-        cpts_unregister(priv->cpts);
        cpsw_ale_destroy(priv->ale);
        cpdma_chan_destroy(priv->txch);
        cpdma_chan_destroy(priv->rxch);
diff --git a/drivers/net/ethernet/ti/davinci_emac.c b/drivers/net/ethernet/ti/davinci_emac.c
index 41ba974bf37c..cd9b164a0434 100644
--- a/drivers/net/ethernet/ti/davinci_emac.c
+++ b/drivers/net/ethernet/ti/davinci_emac.c
@@ -61,6 +61,7 @@
 #include <linux/davinci_emac.h>
 #include <linux/of.h>
 #include <linux/of_address.h>
+#include <linux/of_device.h>
 #include <linux/of_irq.h>
 #include <linux/of_net.h>
@@ -1752,10 +1753,14 @@ static const struct net_device_ops emac_netdev_ops = {
 #endif
 };
+static const struct of_device_id davinci_emac_of_match[];
 static struct emac_platform_data *
 davinci_emac_of_get_pdata(struct platform_device *pdev, struct emac_priv *priv)
 {
        struct device_node *np;
+        const struct of_device_id *match;
+        const struct emac_platform_data *auxdata;
        struct emac_platform_data *pdata = NULL;
        const u8 *mac_addr;
@@ -1793,7 +1798,20 @@ davinci_emac_of_get_pdata(struct platform_device *pdev, struct emac_priv *priv)
        priv->phy_node = of_parse_phandle(np, "phy-handle", 0);
        if (!priv->phy_node)
-                pdata->phy_id = "";
+                pdata->phy_id = NULL;
+        auxdata = pdev->dev.platform_data;
+        if (auxdata) {
+                pdata->interrupt_enable = auxdata->interrupt_enable;
+                pdata->interrupt_disable = auxdata->interrupt_disable;
+        }
+        match = of_match_device(davinci_emac_of_match, &pdev->dev);
+        if (match && match->data) {
+                auxdata = match->data;
+                pdata->version = auxdata->version;
+                pdata->hw_ram_addr = auxdata->hw_ram_addr;
+        }
        pdev->dev.platform_data = pdata;
@@ -2020,8 +2038,14 @@ static const struct dev_pm_ops davinci_emac_pm_ops = {
 };
 #if IS_ENABLED(CONFIG_OF)
+static const struct emac_platform_data am3517_emac_data = {
+        .version                = EMAC_VERSION_2,
+        .hw_ram_addr            = 0x01e20000,
+};
 static const struct of_device_id davinci_emac_of_match[] = {
        {.compatible = "ti,davinci-dm6467-emac", },
+        {.compatible = "ti,am3517-emac", .data = &am3517_emac_data, },
        {},
 };
 MODULE_DEVICE_TABLE(of, davinci_emac_of_match);
diff --git a/drivers/net/ethernet/tile/tilegx.c b/drivers/net/ethernet/tile/tilegx.c
index 628b736e5ae7..0e9fb3301b11 100644
--- a/drivers/net/ethernet/tile/tilegx.c
+++ b/drivers/net/ethernet/tile/tilegx.c
@@ -2080,7 +2080,8 @@ static int tile_net_tx(struct sk_buff *skb, struct net_device *dev)
 }
 /* Return subqueue id on this core (one per core). */
-static u16 tile_net_select_queue(struct net_device *dev, struct sk_buff *skb)
+static u16 tile_net_select_queue(struct net_device *dev, struct sk_buff *skb,
+                                 void *accel_priv)
 {
        return smp_processor_id();
 }
diff --git a/drivers/net/ethernet/via/via-velocity.c b/drivers/net/ethernet/via/via-velocity.c
index d022bf936572..ad61d26a44f3 100644
--- a/drivers/net/ethernet/via/via-velocity.c
+++ b/drivers/net/ethernet/via/via-velocity.c
@@ -2172,16 +2172,13 @@ static int velocity_poll(struct napi_struct *napi, int budget)
        unsigned int rx_done;
        unsigned long flags;
-        spin_lock_irqsave(&vptr->lock, flags);
        /*
         * Do rx and tx twice for performance (taken from the VIA
         * out-of-tree driver).
         */
-        rx_done = velocity_rx_srv(vptr, budget / 2);
+        rx_done = velocity_rx_srv(vptr, budget);
-        velocity_tx_srv(vptr);
+        spin_lock_irqsave(&vptr->lock, flags);
-        rx_done += velocity_rx_srv(vptr, budget - rx_done);
        velocity_tx_srv(vptr);
        /* If budget not fully consumed, exit the polling mode */
        if (rx_done < budget) {
                napi_complete(napi);
@@ -2342,6 +2339,8 @@ static int velocity_change_mtu(struct net_device *dev, int new_mtu)
                if (ret < 0)
                        goto out_free_tmp_vptr_1;
+                napi_disable(&vptr->napi);
                spin_lock_irqsave(&vptr->lock, flags);
                netif_stop_queue(dev);
@@ -2362,6 +2361,8 @@ static int velocity_change_mtu(struct net_device *dev, int new_mtu)
                velocity_give_many_rx_descs(vptr);
+                napi_enable(&vptr->napi);
                mac_enable_int(vptr->mac_regs);
                netif_start_queue(dev);
diff --git a/drivers/net/ethernet/xilinx/ll_temac_main.c b/drivers/net/ethernet/xilinx/ll_temac_main.c
index 1f2364126323..2166e879a096 100644
--- a/drivers/net/ethernet/xilinx/ll_temac_main.c
+++ b/drivers/net/ethernet/xilinx/ll_temac_main.c
@@ -1017,7 +1017,7 @@ static int temac_of_probe(struct platform_device *op)
        platform_set_drvdata(op, ndev);
        SET_NETDEV_DEV(ndev, &op->dev);
        ndev->flags &= ~IFF_MULTICAST;  /* clear multicast */
-        ndev->features = NETIF_F_SG | NETIF_F_FRAGLIST;
+        ndev->features = NETIF_F_SG;
        ndev->netdev_ops = &temac_netdev_ops;
        ndev->ethtool_ops = &temac_ethtool_ops;
 #if 0
diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
index b2ff038d6d20..f9293da19e26 100644
--- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
+++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
@@ -1486,7 +1486,7 @@ static int axienet_of_probe(struct platform_device *op)
        SET_NETDEV_DEV(ndev, &op->dev);
        ndev->flags &= ~IFF_MULTICAST;  /* clear multicast */
-        ndev->features = NETIF_F_SG | NETIF_F_FRAGLIST;
+        ndev->features = NETIF_F_SG;
        ndev->netdev_ops = &axienet_netdev_ops;
        ndev->ethtool_ops = &axienet_ethtool_ops;
diff --git a/drivers/net/ethernet/xilinx/xilinx_emaclite.c b/drivers/net/ethernet/xilinx/xilinx_emaclite.c
index 74234a51c851..fefb8cd5eb65 100644
--- a/drivers/net/ethernet/xilinx/xilinx_emaclite.c
+++ b/drivers/net/ethernet/xilinx/xilinx_emaclite.c
@@ -163,26 +163,9 @@ static void xemaclite_enable_interrupts(struct net_local *drvdata)
        __raw_writel(reg_data | XEL_TSR_XMIT_IE_MASK,
                     drvdata->base_addr + XEL_TSR_OFFSET);
-        /* Enable the Tx interrupts for the second Buffer if
-         * configured in HW */
-        if (drvdata->tx_ping_pong != 0) {
-                reg_data = __raw_readl(drvdata->base_addr +
-                                   XEL_BUFFER_OFFSET + XEL_TSR_OFFSET);
-                __raw_writel(reg_data | XEL_TSR_XMIT_IE_MASK,
-                             drvdata->base_addr + XEL_BUFFER_OFFSET +
-                             XEL_TSR_OFFSET);
-        }
        /* Enable the Rx interrupts for the first buffer */
        __raw_writel(XEL_RSR_RECV_IE_MASK, drvdata->base_addr + XEL_RSR_OFFSET);
-        /* Enable the Rx interrupts for the second Buffer if
-         * configured in HW */
-        if (drvdata->rx_ping_pong != 0) {
-                __raw_writel(XEL_RSR_RECV_IE_MASK, drvdata->base_addr +
-                             XEL_BUFFER_OFFSET + XEL_RSR_OFFSET);
-        }
        /* Enable the Global Interrupt Enable */
        __raw_writel(XEL_GIER_GIE_MASK, drvdata->base_addr + XEL_GIER_OFFSET);
 }
@@ -206,31 +189,10 @@ static void xemaclite_disable_interrupts(struct net_local *drvdata)
        __raw_writel(reg_data & (~XEL_TSR_XMIT_IE_MASK),
                     drvdata->base_addr + XEL_TSR_OFFSET);
-        /* Disable the Tx interrupts for the second Buffer
-         * if configured in HW */
-        if (drvdata->tx_ping_pong != 0) {
-                reg_data = __raw_readl(drvdata->base_addr + XEL_BUFFER_OFFSET +
-                                   XEL_TSR_OFFSET);
-                __raw_writel(reg_data & (~XEL_TSR_XMIT_IE_MASK),
-                             drvdata->base_addr + XEL_BUFFER_OFFSET +
-                             XEL_TSR_OFFSET);
-        }
        /* Disable the Rx interrupts for the first buffer */
        reg_data = __raw_readl(drvdata->base_addr + XEL_RSR_OFFSET);
        __raw_writel(reg_data & (~XEL_RSR_RECV_IE_MASK),
                     drvdata->base_addr + XEL_RSR_OFFSET);
-        /* Disable the Rx interrupts for the second buffer
-         * if configured in HW */
-        if (drvdata->rx_ping_pong != 0) {
-                reg_data = __raw_readl(drvdata->base_addr + XEL_BUFFER_OFFSET +
-                                   XEL_RSR_OFFSET);
-                __raw_writel(reg_data & (~XEL_RSR_RECV_IE_MASK),
-                             drvdata->base_addr + XEL_BUFFER_OFFSET +
-                             XEL_RSR_OFFSET);
-        }
 }
 /**
@@ -258,6 +220,13 @@ static void xemaclite_aligned_write(void *src_ptr, u32 *dest_ptr,
                *to_u16_ptr++ = *from_u16_ptr++;
                *to_u16_ptr++ = *from_u16_ptr++;
+                /* This barrier resolves occasional issues seen around
+                 * cases where the data is not properly flushed out
+                 * from the processor store buffers to the destination
+                 * memory locations.
+                 */
+                wmb();
                /* Output a word */
                *to_u32_ptr++ = align_buffer;
        }
@@ -273,6 +242,12 @@ static void xemaclite_aligned_write(void *src_ptr, u32 *dest_ptr,
                for (; length > 0; length--)
                        *to_u8_ptr++ = *from_u8_ptr++;
+                /* This barrier resolves occasional issues seen around
+                 * cases where the data is not properly flushed out
+                 * from the processor store buffers to the destination
+                 * memory locations.
+                 */
+                wmb();
                *to_u32_ptr = align_buffer;
        }
 }
diff --git a/drivers/net/hamradio/hdlcdrv.c b/drivers/net/hamradio/hdlcdrv.c
index 3169252613fa..5d78c1d08abd 100644
--- a/drivers/net/hamradio/hdlcdrv.c
+++ b/drivers/net/hamradio/hdlcdrv.c
@@ -571,6 +571,8 @@ static int hdlcdrv_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
        case HDLCDRVCTL_CALIBRATE:
                if(!capable(CAP_SYS_RAWIO))
                        return -EPERM;
+                if (bi.data.calibrate > INT_MAX / s->par.bitrate)
+                        return -EINVAL;
                s->hdlctx.calibrate = bi.data.calibrate * s->par.bitrate / 16;
                return 0;
diff --git a/drivers/net/hamradio/yam.c b/drivers/net/hamradio/yam.c
index 1971411574db..61dd2447e1bb 100644
--- a/drivers/net/hamradio/yam.c
+++ b/drivers/net/hamradio/yam.c
@@ -1057,6 +1057,7 @@ static int yam_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
                break;
        case SIOCYAMGCFG:
+                memset(&yi, 0, sizeof(yi));
                yi.cfg.mask = 0xffffffff;
                yi.cfg.iobase = yp->iobase;
                yi.cfg.irq = yp->irq;
diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
index 524f713f6017..71baeb3ed905 100644
--- a/drivers/net/hyperv/netvsc_drv.c
+++ b/drivers/net/hyperv/netvsc_drv.c
@@ -261,9 +261,7 @@ int netvsc_recv_callback(struct hv_device *device_obj,
        struct sk_buff *skb;
        net = ((struct netvsc_device *)hv_get_drvdata(device_obj))->ndev;
-        if (!net) {
+        if (!net || net->reg_state != NETREG_REGISTERED) {
-                netdev_err(net, "got receive callback but net device"
-                        " not initialized yet\n");
                packet->status = NVSP_STAT_FAIL;
                return 0;
        }
@@ -327,7 +325,6 @@ static int netvsc_change_mtu(struct net_device *ndev, int mtu)
                return -EINVAL;
        nvdev->start_remove = true;
-        cancel_delayed_work_sync(&ndevctx->dwork);
        cancel_work_sync(&ndevctx->work);
        netif_tx_disable(ndev);
        rndis_filter_device_remove(hdev);
@@ -436,19 +433,11 @@ static int netvsc_probe(struct hv_device *dev,
        SET_ETHTOOL_OPS(net, &ethtool_ops);
        SET_NETDEV_DEV(net, &dev->device);
-        ret = register_netdev(net);
-        if (ret != 0) {
-                pr_err("Unable to register netdev.\n");
-                free_netdev(net);
-                goto out;
-        }
        /* Notify the netvsc driver of the new device */
        device_info.ring_size = ring_size;
        ret = rndis_filter_device_add(dev, &device_info);
        if (ret != 0) {
                netdev_err(net, "unable to add netvsc device (ret %d)\n", ret);
-                unregister_netdev(net);
                free_netdev(net);
                hv_set_drvdata(dev, NULL);
                return ret;
@@ -457,7 +446,13 @@ static int netvsc_probe(struct hv_device *dev,
        netif_carrier_on(net);
-out:
+        ret = register_netdev(net);
+        if (ret != 0) {
+                pr_err("Unable to register netdev.\n");
+                rndis_filter_device_remove(dev);
+                free_netdev(net);
+        }
        return ret;
 }
diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
index acf93798dc67..bc8faaec33f5 100644
--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
@@ -299,7 +299,7 @@ netdev_tx_t macvlan_start_xmit(struct sk_buff *skb,
        if (vlan->fwd_priv) {
                skb->dev = vlan->lowerdev;
-                ret = dev_hard_start_xmit(skb, skb->dev, NULL, vlan->fwd_priv);
+                ret = dev_queue_xmit_accel(skb, vlan->fwd_priv);
        } else {
                ret = macvlan_queue_xmit(skb, dev);
        }
@@ -338,6 +338,8 @@ static const struct header_ops macvlan_hard_header_ops = {
        .cache_update   = eth_header_cache_update,
 };
+static struct rtnl_link_ops macvlan_link_ops;
 static int macvlan_open(struct net_device *dev)
 {
        struct macvlan_dev *vlan = netdev_priv(dev);
@@ -353,7 +355,8 @@ static int macvlan_open(struct net_device *dev)
                goto hash_add;
        }
-        if (lowerdev->features & NETIF_F_HW_L2FW_DOFFLOAD) {
+        if (lowerdev->features & NETIF_F_HW_L2FW_DOFFLOAD &&
+            dev->rtnl_link_ops == &macvlan_link_ops) {
                vlan->fwd_priv =
                      lowerdev->netdev_ops->ndo_dfwd_add_station(lowerdev, dev);
@@ -362,10 +365,8 @@ static int macvlan_open(struct net_device *dev)
                 */
                if (IS_ERR_OR_NULL(vlan->fwd_priv)) {
                        vlan->fwd_priv = NULL;
-                } else {
+                } else
-                        dev->features &= ~NETIF_F_LLTX;
                        return 0;
-                }
        }
        err = -EBUSY;
@@ -690,8 +691,18 @@ static netdev_features_t macvlan_fix_features(struct net_device *dev,
                                              netdev_features_t features)
 {
        struct macvlan_dev *vlan = netdev_priv(dev);
+        netdev_features_t mask;
+        features |= NETIF_F_ALL_FOR_ALL;
+        features &= (vlan->set_features | ~MACVLAN_FEATURES);
+        mask = features;
+        features = netdev_increment_features(vlan->lowerdev->features,
+                                             features,
+                                             mask);
+        features |= NETIF_F_LLTX;
-        return features & (vlan->set_features | ~MACVLAN_FEATURES);
+        return features;
 }
 static const struct ethtool_ops macvlan_ethtool_ops = {
@@ -1019,9 +1030,8 @@ static int macvlan_device_event(struct notifier_block *unused,
                break;
        case NETDEV_FEAT_CHANGE:
                list_for_each_entry(vlan, &port->vlans, list) {
-                        vlan->dev->features = dev->features & MACVLAN_FEATURES;
                        vlan->dev->gso_max_size = dev->gso_max_size;
-                        netdev_features_change(vlan->dev);
+                        netdev_update_features(vlan->dev);
                }
                break;
        case NETDEV_UNREGISTER:
diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c
index dc76670c2f2a..2a89da080317 100644
--- a/drivers/net/macvtap.c
+++ b/drivers/net/macvtap.c
@@ -744,7 +744,7 @@ err:
        rcu_read_lock();
        vlan = rcu_dereference(q->vlan);
        if (vlan)
-                vlan->dev->stats.tx_dropped++;
+                this_cpu_inc(vlan->pcpu_stats->tx_dropped);
        rcu_read_unlock();
        return err;
@@ -767,11 +767,10 @@ static ssize_t macvtap_put_user(struct macvtap_queue *q,
                                const struct sk_buff *skb,
                                const struct iovec *iv, int len)
 {
-        struct macvlan_dev *vlan;
        int ret;
        int vnet_hdr_len = 0;
        int vlan_offset = 0;
-        int copied;
+        int copied, total;
        if (q->flags & IFF_VNET_HDR) {
                struct virtio_net_hdr vnet_hdr;
@@ -786,7 +785,8 @@ static ssize_t macvtap_put_user(struct macvtap_queue *q,
                if (memcpy_toiovecend(iv, (void *)&vnet_hdr, 0, sizeof(vnet_hdr)))
                        return -EFAULT;
        }
-        copied = vnet_hdr_len;
+        total = copied = vnet_hdr_len;
+        total += skb->len;
        if (!vlan_tx_tag_present(skb))
                len = min_t(int, skb->len, len);
@@ -801,6 +801,7 @@ static ssize_t macvtap_put_user(struct macvtap_queue *q,
                vlan_offset = offsetof(struct vlan_ethhdr, h_vlan_proto);
                len = min_t(int, skb->len + VLAN_HLEN, len);
+                total += VLAN_HLEN;
                copy = min_t(int, vlan_offset, len);
                ret = skb_copy_datagram_const_iovec(skb, 0, iv, copied, copy);
@@ -818,19 +819,9 @@ static ssize_t macvtap_put_user(struct macvtap_queue *q,
        }
        ret = skb_copy_datagram_const_iovec(skb, vlan_offset, iv, copied, len);
-        copied += len;
 done:
-        rcu_read_lock();
+        return ret ? ret : total;
-        vlan = rcu_dereference(q->vlan);
-        if (vlan) {
-                preempt_disable();
-                macvlan_count_rx(vlan, copied - vnet_hdr_len, ret == 0, 0);
-                preempt_enable();
-        }
-        rcu_read_unlock();
-        return ret ? ret : copied;
 }
 static ssize_t macvtap_do_read(struct macvtap_queue *q, struct kiocb *iocb,
@@ -885,7 +876,9 @@ static ssize_t macvtap_aio_read(struct kiocb *iocb, const struct iovec *iv,
        }
        ret = macvtap_do_read(q, iocb, iv, len, file->f_flags & O_NONBLOCK);
-        ret = min_t(ssize_t, ret, len); /* XXX copied from tun.c. Why? */
+        ret = min_t(ssize_t, ret, len);
+        if (ret > 0)
+                iocb->ki_pos = ret;
 out:
        return ret;
 }
diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c
index 3ae28f420868..26fa05a472b4 100644
--- a/drivers/net/phy/micrel.c
+++ b/drivers/net/phy/micrel.c
@@ -336,6 +336,21 @@ static struct phy_driver ksphy_driver[] = {
        .resume         = genphy_resume,
        .driver         = { .owner = THIS_MODULE,},
 }, {
+        .phy_id         = PHY_ID_KSZ8041RNLI,
+        .phy_id_mask    = 0x00fffff0,
+        .name           = "Micrel KSZ8041RNLI",
+        .features       = PHY_BASIC_FEATURES |
+                          SUPPORTED_Pause | SUPPORTED_Asym_Pause,
+        .flags          = PHY_HAS_MAGICANEG | PHY_HAS_INTERRUPT,
+        .config_init    = kszphy_config_init,
+        .config_aneg    = genphy_config_aneg,
+        .read_status    = genphy_read_status,
+        .ack_interrupt  = kszphy_ack_interrupt,
+        .config_intr    = kszphy_config_intr,
+        .suspend        = genphy_suspend,
+        .resume         = genphy_resume,
+        .driver         = { .owner = THIS_MODULE,},
+}, {
        .phy_id         = PHY_ID_KSZ8051,
        .phy_id_mask    = 0x00fffff0,
        .name           = "Micrel KSZ8051",
diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
index 36c6994436b7..98434b84f041 100644
--- a/drivers/net/phy/phy.c
+++ b/drivers/net/phy/phy.c
@@ -565,10 +565,8 @@ int phy_start_interrupts(struct phy_device *phydev)
        int err = 0;
        atomic_set(&phydev->irq_disable, 0);
-        if (request_irq(phydev->irq, phy_interrupt,
+        if (request_irq(phydev->irq, phy_interrupt, 0, "phy_interrupt",
-                                IRQF_SHARED,
+                        phydev) < 0) {
-                                "phy_interrupt",
-                                phydev) < 0) {
                pr_warn("%s: Can't get IRQ %d (PHY)\n",
                        phydev->bus->name, phydev->irq);
                phydev->irq = PHY_POLL;
diff --git a/drivers/net/phy/vitesse.c b/drivers/net/phy/vitesse.c
index 508e4359338b..14372c65a7e8 100644
--- a/drivers/net/phy/vitesse.c
+++ b/drivers/net/phy/vitesse.c
@@ -64,6 +64,7 @@
 #define PHY_ID_VSC8234                  0x000fc620
 #define PHY_ID_VSC8244                  0x000fc6c0
+#define PHY_ID_VSC8514                  0x00070670
 #define PHY_ID_VSC8574                  0x000704a0
 #define PHY_ID_VSC8662                  0x00070660
 #define PHY_ID_VSC8221                  0x000fc550
@@ -131,6 +132,7 @@ static int vsc82xx_config_intr(struct phy_device *phydev)
                err = phy_write(phydev, MII_VSC8244_IMASK,
                        (phydev->drv->phy_id == PHY_ID_VSC8234 ||
                         phydev->drv->phy_id == PHY_ID_VSC8244 ||
+                         phydev->drv->phy_id == PHY_ID_VSC8514 ||
                         phydev->drv->phy_id == PHY_ID_VSC8574) ?
                                MII_VSC8244_IMASK_MASK :
                                MII_VSC8221_IMASK_MASK);
@@ -246,6 +248,18 @@ static struct phy_driver vsc82xx_driver[] = {
        .config_intr    = &vsc82xx_config_intr,
        .driver         = { .owner = THIS_MODULE,},
 }, {
+        .phy_id         = PHY_ID_VSC8514,
+        .name           = "Vitesse VSC8514",
+        .phy_id_mask    = 0x000ffff0,
+        .features       = PHY_GBIT_FEATURES,
+        .flags          = PHY_HAS_INTERRUPT,
+        .config_init    = &vsc824x_config_init,
+        .config_aneg    = &vsc82x4_config_aneg,
+        .read_status    = &genphy_read_status,
+        .ack_interrupt  = &vsc824x_ack_interrupt,
+        .config_intr    = &vsc82xx_config_intr,
+        .driver         = { .owner = THIS_MODULE,},
+}, {
        .phy_id         = PHY_ID_VSC8574,
        .name           = "Vitesse VSC8574",
        .phy_id_mask    = 0x000ffff0,
@@ -315,6 +329,7 @@ module_exit(vsc82xx_exit);
 static struct mdio_device_id __maybe_unused vitesse_tbl[] = {
        { PHY_ID_VSC8234, 0x000ffff0 },
        { PHY_ID_VSC8244, 0x000fffc0 },
+        { PHY_ID_VSC8514, 0x000ffff0 },
        { PHY_ID_VSC8574, 0x000ffff0 },
        { PHY_ID_VSC8662, 0x000ffff0 },
        { PHY_ID_VSC8221, 0x000ffff0 },
diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
index 34b0de09d881..b75ae5bde673 100644
--- a/drivers/net/team/team.c
+++ b/drivers/net/team/team.c
@@ -1366,6 +1366,8 @@ static int team_user_linkup_option_get(struct team *team,
        return 0;
 }
+static void __team_carrier_check(struct team *team);
 static int team_user_linkup_option_set(struct team *team,
                                       struct team_gsetter_ctx *ctx)
 {
@@ -1373,6 +1375,7 @@ static int team_user_linkup_option_set(struct team *team,
        port->user.linkup = ctx->data.bool_val;
        team_refresh_port_linkup(port);
+        __team_carrier_check(port->team);
        return 0;
 }
@@ -1392,6 +1395,7 @@ static int team_user_linkup_en_option_set(struct team *team,
        port->user.linkup_enabled = ctx->data.bool_val;
        team_refresh_port_linkup(port);
+        __team_carrier_check(port->team);
        return 0;
 }
@@ -1643,7 +1647,8 @@ static netdev_tx_t team_xmit(struct sk_buff *skb, struct net_device *dev)
        return NETDEV_TX_OK;
 }
-static u16 team_select_queue(struct net_device *dev, struct sk_buff *skb)
+static u16 team_select_queue(struct net_device *dev, struct sk_buff *skb,
+                             void *accel_priv)
 {
        /*
         * This helper function exists to help dev_pick_tx get the correct
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 782e38bfc1ee..ecec8029c5e8 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -348,7 +348,8 @@ unlock:
 * different rxq no. here. If we could not get rxhash, then we would
 * hope the rxq no. may help here.
 */
-static u16 tun_select_queue(struct net_device *dev, struct sk_buff *skb)
+static u16 tun_select_queue(struct net_device *dev, struct sk_buff *skb,
+                            void *accel_priv)
 {
        struct tun_struct *tun = netdev_priv(dev);
        struct tun_flow_entry *e;
@@ -1184,7 +1185,7 @@ static ssize_t tun_put_user(struct tun_struct *tun,
 {
        struct tun_pi pi = { 0, skb->protocol };
        ssize_t total = 0;
-        int vlan_offset = 0;
+        int vlan_offset = 0, copied;
        if (!(tun->flags & TUN_NO_PI)) {
                if ((len -= sizeof(pi)) < 0)
@@ -1248,6 +1249,8 @@ static ssize_t tun_put_user(struct tun_struct *tun,
                total += tun->vnet_hdr_sz;
        }
+        copied = total;
+        total += skb->len;
        if (!vlan_tx_tag_present(skb)) {
                len = min_t(int, skb->len, len);
        } else {
@@ -1262,24 +1265,24 @@ static ssize_t tun_put_user(struct tun_struct *tun,
                vlan_offset = offsetof(struct vlan_ethhdr, h_vlan_proto);
                len = min_t(int, skb->len + VLAN_HLEN, len);
+                total += VLAN_HLEN;
                copy = min_t(int, vlan_offset, len);
-                ret = skb_copy_datagram_const_iovec(skb, 0, iv, total, copy);
+                ret = skb_copy_datagram_const_iovec(skb, 0, iv, copied, copy);
                len -= copy;
-                total += copy;
+                copied += copy;
                if (ret || !len)
                        goto done;
                copy = min_t(int, sizeof(veth), len);
-                ret = memcpy_toiovecend(iv, (void *)&veth, total, copy);
+                ret = memcpy_toiovecend(iv, (void *)&veth, copied, copy);
                len -= copy;
-                total += copy;
+                copied += copy;
                if (ret || !len)
                        goto done;
        }
-        skb_copy_datagram_const_iovec(skb, vlan_offset, iv, total, len);
+        skb_copy_datagram_const_iovec(skb, vlan_offset, iv, copied, len);
-        total += len;
 done:
        tun->dev->stats.tx_packets++;
@@ -1356,6 +1359,8 @@ static ssize_t tun_chr_aio_read(struct kiocb *iocb, const struct iovec *iv,
        ret = tun_do_read(tun, tfile, iocb, iv, len,
                          file->f_flags & O_NONBLOCK);
        ret = min_t(ssize_t, ret, len);
+        if (ret > 0)
+                iocb->ki_pos = ret;
 out:
        tun_put(tun);
        return ret;
diff --git a/drivers/net/usb/Kconfig b/drivers/net/usb/Kconfig
index 85e4a01670f0..47b0f732b0b1 100644
--- a/drivers/net/usb/Kconfig
+++ b/drivers/net/usb/Kconfig
@@ -276,12 +276,12 @@ config USB_NET_CDC_MBIM
          module will be called cdc_mbim.
 config USB_NET_DM9601
-        tristate "Davicom DM9601 based USB 1.1 10/100 ethernet devices"
+        tristate "Davicom DM96xx based USB 10/100 ethernet devices"
        depends on USB_USBNET
        select CRC32
        help
-          This option adds support for Davicom DM9601 based USB 1.1
+          This option adds support for Davicom DM9601/DM9620/DM9621A
-          10/100 Ethernet adapters.
+          based USB 10/100 Ethernet adapters.
 config USB_NET_SR9700
        tristate "CoreChip-sz SR9700 based USB 1.1 10/100 ethernet devices"
diff --git a/drivers/net/usb/dm9601.c b/drivers/net/usb/dm9601.c
index c6867f926cff..14aa48fa8d7e 100644
--- a/drivers/net/usb/dm9601.c
+++ b/drivers/net/usb/dm9601.c
@@ -1,5 +1,5 @@
 /*
- * Davicom DM9601 USB 1.1 10/100Mbps ethernet devices
+ * Davicom DM96xx USB 10/100Mbps ethernet devices
 *
 * Peter Korsgaard <jacmet@sunsite.dk>
 *
@@ -364,7 +364,12 @@ static int dm9601_bind(struct usbnet *dev, struct usb_interface *intf)
        dev->net->ethtool_ops = &dm9601_ethtool_ops;
        dev->net->hard_header_len += DM_TX_OVERHEAD;
        dev->hard_mtu = dev->net->mtu + dev->net->hard_header_len;
-        dev->rx_urb_size = dev->net->mtu + ETH_HLEN + DM_RX_OVERHEAD;
+        /* dm9620/21a require room for 4 byte padding, even in dm9601
+         * mode, so we need +1 to be able to receive full size
+         * ethernet frames.
+         */
+        dev->rx_urb_size = dev->net->mtu + ETH_HLEN + DM_RX_OVERHEAD + 1;
        dev->mii.dev = dev->net;
        dev->mii.mdio_read = dm9601_mdio_read;
@@ -468,7 +473,7 @@ static int dm9601_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
 static struct sk_buff *dm9601_tx_fixup(struct usbnet *dev, struct sk_buff *skb,
                                       gfp_t flags)
 {
-        int len;
+        int len, pad;
        /* format:
           b1: packet length low
@@ -476,12 +481,23 @@ static struct sk_buff *dm9601_tx_fixup(struct usbnet *dev, struct sk_buff *skb,
           b3..n: packet data
        */
-        len = skb->len;
+        len = skb->len + DM_TX_OVERHEAD;
+        /* workaround for dm962x errata with tx fifo getting out of
+         * sync if a USB bulk transfer retry happens right after a
+         * packet with odd / maxpacket length by adding up to 3 bytes
+         * padding.
+         */
+        while ((len & 1) || !(len % dev->maxpacket))
+                len++;
-        if (skb_headroom(skb) < DM_TX_OVERHEAD) {
+        len -= DM_TX_OVERHEAD; /* hw header doesn't count as part of length */
+        pad = len - skb->len;
+        if (skb_headroom(skb) < DM_TX_OVERHEAD || skb_tailroom(skb) < pad) {
                struct sk_buff *skb2;
-                skb2 = skb_copy_expand(skb, DM_TX_OVERHEAD, 0, flags);
+                skb2 = skb_copy_expand(skb, DM_TX_OVERHEAD, pad, flags);
                dev_kfree_skb_any(skb);
                skb = skb2;
                if (!skb)
@@ -490,10 +506,10 @@ static struct sk_buff *dm9601_tx_fixup(struct usbnet *dev, struct sk_buff *skb,
        __skb_push(skb, DM_TX_OVERHEAD);
-        /* usbnet adds padding if length is a multiple of packet size
+        if (pad) {
-           if so, adjust length value in header */
+                memset(skb->data + skb->len, 0, pad);
-        if ((skb->len % dev->maxpacket) == 0)
+                __skb_put(skb, pad);
-                len++;
+        }
        skb->data[0] = len;
        skb->data[1] = len >> 8;
@@ -543,7 +559,7 @@ static int dm9601_link_reset(struct usbnet *dev)
 }
 static const struct driver_info dm9601_info = {
-        .description    = "Davicom DM9601 USB Ethernet",
+        .description    = "Davicom DM96xx USB 10/100 Ethernet",
        .flags          = FLAG_ETHER | FLAG_LINK_INTR,
        .bind           = dm9601_bind,
        .rx_fixup       = dm9601_rx_fixup,
@@ -594,6 +610,10 @@ static const struct usb_device_id products[] = {
         USB_DEVICE(0x0a46, 0x9620),    /* DM9620 USB to Fast Ethernet Adapter */
         .driver_info = (unsigned long)&dm9601_info,
         },
+        {
+         USB_DEVICE(0x0a46, 0x9621),    /* DM9621A USB to Fast Ethernet Adapter */
+         .driver_info = (unsigned long)&dm9601_info,
+        },
        {},                     // END
 };
@@ -612,5 +632,5 @@ static struct usb_driver dm9601_driver = {
 module_usb_driver(dm9601_driver);
 MODULE_AUTHOR("Peter Korsgaard <jacmet@sunsite.dk>");
-MODULE_DESCRIPTION("Davicom DM9601 USB 1.1 ethernet devices");
+MODULE_DESCRIPTION("Davicom DM96xx USB 10/100 ethernet devices");
 MODULE_LICENSE("GPL");
diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
index 86292e6aaf49..1a482344b3f5 100644
--- a/drivers/net/usb/hso.c
+++ b/drivers/net/usb/hso.c
@@ -185,7 +185,6 @@ enum rx_ctrl_state{
 #define BM_REQUEST_TYPE (0xa1)
 #define B_NOTIFICATION  (0x20)
 #define W_VALUE         (0x0)
-#define W_INDEX         (0x2)
 #define W_LENGTH        (0x2)
 #define B_OVERRUN       (0x1<<6)
@@ -1487,6 +1486,7 @@ static void tiocmget_intr_callback(struct urb *urb)
        struct uart_icount *icount;
        struct hso_serial_state_notification *serial_state_notification;
        struct usb_device *usb;
+        int if_num;
        /* Sanity checks */
        if (!serial)
@@ -1495,15 +1495,24 @@ static void tiocmget_intr_callback(struct urb *urb)
                handle_usb_error(status, __func__, serial->parent);
                return;
        }
+        /* tiocmget is only supported on HSO_PORT_MODEM */
        tiocmget = serial->tiocmget;
        if (!tiocmget)
                return;
+        BUG_ON((serial->parent->port_spec & HSO_PORT_MASK) != HSO_PORT_MODEM);
        usb = serial->parent->usb;
+        if_num = serial->parent->interface->altsetting->desc.bInterfaceNumber;
+        /* wIndex should be the USB interface number of the port to which the
+         * notification applies, which should always be the Modem port.
+         */
        serial_state_notification = &tiocmget->serial_state_notification;
        if (serial_state_notification->bmRequestType != BM_REQUEST_TYPE ||
            serial_state_notification->bNotification != B_NOTIFICATION ||
            le16_to_cpu(serial_state_notification->wValue) != W_VALUE ||
-            le16_to_cpu(serial_state_notification->wIndex) != W_INDEX ||
+            le16_to_cpu(serial_state_notification->wIndex) != if_num ||
            le16_to_cpu(serial_state_notification->wLength) != W_LENGTH) {
                dev_warn(&usb->dev,
                         "hso received invalid serial state notification\n");
diff --git a/drivers/net/usb/mcs7830.c b/drivers/net/usb/mcs7830.c
index 03832d3780aa..f54637828574 100644
--- a/drivers/net/usb/mcs7830.c
+++ b/drivers/net/usb/mcs7830.c
@@ -117,7 +117,6 @@ enum {
 struct mcs7830_data {
        u8 multi_filter[8];
        u8 config;
-        u8 link_counter;
 };
 static const char driver_name[] = "MOSCHIP usb-ethernet driver";
@@ -561,26 +560,16 @@ static void mcs7830_status(struct usbnet *dev, struct urb *urb)
 {
        u8 *buf = urb->transfer_buffer;
        bool link, link_changed;
-        struct mcs7830_data *data = mcs7830_get_data(dev);
        if (urb->actual_length < 16)
                return;
-        link = !(buf[1] & 0x20);
+        link = !(buf[1] == 0x20);
        link_changed = netif_carrier_ok(dev->net) != link;
        if (link_changed) {
-                data->link_counter++;
+                usbnet_link_change(dev, link, 0);
-                /*
+                netdev_dbg(dev->net, "Link Status is: %d\n", link);
-                   track link state 20 times to guard against erroneous
+        }
-                   link state changes reported sometimes by the chip
-                 */
-                if (data->link_counter > 20) {
-                        data->link_counter = 0;
-                        usbnet_link_change(dev, link, 0);
-                        netdev_dbg(dev->net, "Link Status is: %d\n", link);
-                }
-        } else
-                data->link_counter = 0;
 }
 static const struct driver_info moschip_info = {
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 7bab4de658a9..5d776447d9c3 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -299,35 +299,76 @@ static struct sk_buff *page_to_skb(struct receive_queue *rq,
        return skb;
 }
-static int receive_mergeable(struct receive_queue *rq, struct sk_buff *head_skb)
+static struct sk_buff *receive_small(void *buf, unsigned int len)
 {
-        struct skb_vnet_hdr *hdr = skb_vnet_hdr(head_skb);
+        struct sk_buff * skb = buf;
+        len -= sizeof(struct virtio_net_hdr);
+        skb_trim(skb, len);
+        return skb;
+}
+static struct sk_buff *receive_big(struct net_device *dev,
+                                   struct receive_queue *rq,
+                                   void *buf,
+                                   unsigned int len)
+{
+        struct page *page = buf;
+        struct sk_buff *skb = page_to_skb(rq, page, 0, len, PAGE_SIZE);
+        if (unlikely(!skb))
+                goto err;
+        return skb;
+err:
+        dev->stats.rx_dropped++;
+        give_pages(rq, page);
+        return NULL;
+}
+static struct sk_buff *receive_mergeable(struct net_device *dev,
+                                         struct receive_queue *rq,
+                                         void *buf,
+                                         unsigned int len)
+{
+        struct skb_vnet_hdr *hdr = buf;
+        int num_buf = hdr->mhdr.num_buffers;
+        struct page *page = virt_to_head_page(buf);
+        int offset = buf - page_address(page);
+        struct sk_buff *head_skb = page_to_skb(rq, page, offset, len,
+                                               MERGE_BUFFER_LEN);
        struct sk_buff *curr_skb = head_skb;
-        char *buf;
-        struct page *page;
-        int num_buf, len, offset;
-        num_buf = hdr->mhdr.num_buffers;
+        if (unlikely(!curr_skb))
+                goto err_skb;
        while (--num_buf) {
-                int num_skb_frags = skb_shinfo(curr_skb)->nr_frags;
+                int num_skb_frags;
                buf = virtqueue_get_buf(rq->vq, &len);
                if (unlikely(!buf)) {
-                        pr_debug("%s: rx error: %d buffers missing\n",
+                        pr_debug("%s: rx error: %d buffers out of %d missing\n",
-                                 head_skb->dev->name, hdr->mhdr.num_buffers);
+                                 dev->name, num_buf, hdr->mhdr.num_buffers);
-                        head_skb->dev->stats.rx_length_errors++;
+                        dev->stats.rx_length_errors++;
-                        return -EINVAL;
+                        goto err_buf;
                }
                if (unlikely(len > MERGE_BUFFER_LEN)) {
                        pr_debug("%s: rx error: merge buffer too long\n",
-                                 head_skb->dev->name);
+                                 dev->name);
                        len = MERGE_BUFFER_LEN;
                }
+                page = virt_to_head_page(buf);
+                --rq->num;
+                num_skb_frags = skb_shinfo(curr_skb)->nr_frags;
                if (unlikely(num_skb_frags == MAX_SKB_FRAGS)) {
                        struct sk_buff *nskb = alloc_skb(0, GFP_ATOMIC);
-                        if (unlikely(!nskb)) {
-                                head_skb->dev->stats.rx_dropped++;
+                        if (unlikely(!nskb))
-                                return -ENOMEM;
+                                goto err_skb;
-                        }
                        if (curr_skb == head_skb)
                                skb_shinfo(curr_skb)->frag_list = nskb;
                        else
@@ -341,8 +382,7 @@ static int receive_mergeable(struct receive_queue *rq, struct sk_buff *head_skb)
                        head_skb->len += len;
                        head_skb->truesize += MERGE_BUFFER_LEN;
                }
-                page = virt_to_head_page(buf);
+                offset = buf - page_address(page);
-                offset = buf - (char *)page_address(page);
                if (skb_can_coalesce(curr_skb, num_skb_frags, page, offset)) {
                        put_page(page);
                        skb_coalesce_rx_frag(curr_skb, num_skb_frags - 1,
@@ -351,9 +391,28 @@ static int receive_mergeable(struct receive_queue *rq, struct sk_buff *head_skb)
                        skb_add_rx_frag(curr_skb, num_skb_frags, page,
                                        offset, len, MERGE_BUFFER_LEN);
                }
+        }
+        return head_skb;
+err_skb:
+        put_page(page);
+        while (--num_buf) {
+                buf = virtqueue_get_buf(rq->vq, &len);
+                if (unlikely(!buf)) {
+                        pr_debug("%s: rx error: %d buffers missing\n",
+                                 dev->name, num_buf);
+                        dev->stats.rx_length_errors++;
+                        break;
+                }
+                page = virt_to_head_page(buf);
+                put_page(page);
                --rq->num;
        }
-        return 0;
+err_buf:
+        dev->stats.rx_dropped++;
+        dev_kfree_skb(head_skb);
+        return NULL;
 }
 static void receive_buf(struct receive_queue *rq, void *buf, unsigned int len)
@@ -362,48 +421,29 @@ static void receive_buf(struct receive_queue *rq, void *buf, unsigned int len)
        struct net_device *dev = vi->dev;
        struct virtnet_stats *stats = this_cpu_ptr(vi->stats);
        struct sk_buff *skb;
-        struct page *page;
        struct skb_vnet_hdr *hdr;
        if (unlikely(len < sizeof(struct virtio_net_hdr) + ETH_HLEN)) {
                pr_debug("%s: short packet %i\n", dev->name, len);
                dev->stats.rx_length_errors++;
-                if (vi->big_packets)
+                if (vi->mergeable_rx_bufs)
-                        give_pages(rq, buf);
-                else if (vi->mergeable_rx_bufs)
                        put_page(virt_to_head_page(buf));
+                else if (vi->big_packets)
+                        give_pages(rq, buf);
                else
                        dev_kfree_skb(buf);
                return;
        }
-        if (!vi->mergeable_rx_bufs && !vi->big_packets) {
+        if (vi->mergeable_rx_bufs)
-                skb = buf;
+                skb = receive_mergeable(dev, rq, buf, len);
-                len -= sizeof(struct virtio_net_hdr);
+        else if (vi->big_packets)
-                skb_trim(skb, len);
+                skb = receive_big(dev, rq, buf, len);
-        } else if (vi->mergeable_rx_bufs) {
+        else
-                struct page *page = virt_to_head_page(buf);
+                skb = receive_small(buf, len);
-                skb = page_to_skb(rq, page,
-                                  (char *)buf - (char *)page_address(page),
+        if (unlikely(!skb))
-                                  len, MERGE_BUFFER_LEN);
+                return;
-                if (unlikely(!skb)) {
-                        dev->stats.rx_dropped++;
-                        put_page(page);
-                        return;
-                }
-                if (receive_mergeable(rq, skb)) {
-                        dev_kfree_skb(skb);
-                        return;
-                }
-        } else {
-                page = buf;
-                skb = page_to_skb(rq, page, 0, len, PAGE_SIZE);
-                if (unlikely(!skb)) {
-                        dev->stats.rx_dropped++;
-                        give_pages(rq, page);
-                        return;
-                }
-        }
        hdr = skb_vnet_hdr(skb);
@@ -1084,7 +1124,7 @@ static void virtnet_set_rx_mode(struct net_device *dev)
        if (!virtnet_send_command(vi, VIRTIO_NET_CTRL_MAC,
                                  VIRTIO_NET_CTRL_MAC_TABLE_SET,
                                  sg, NULL))
-                dev_warn(&dev->dev, "Failed to set MAC fitler table.\n");
+                dev_warn(&dev->dev, "Failed to set MAC filter table.\n");
        kfree(buf);
 }
@@ -1327,6 +1367,11 @@ static void virtnet_config_changed(struct virtio_device *vdev)
 static void virtnet_free_queues(struct virtnet_info *vi)
 {
+        int i;
+        for (i = 0; i < vi->max_queue_pairs; i++)
+                netif_napi_del(&vi->rq[i].napi);
        kfree(vi->rq);
        kfree(vi->sq);
 }
@@ -1356,10 +1401,10 @@ static void free_unused_bufs(struct virtnet_info *vi)
                struct virtqueue *vq = vi->rq[i].vq;
                while ((buf = virtqueue_detach_unused_buf(vq)) != NULL) {
-                        if (vi->big_packets)
+                        if (vi->mergeable_rx_bufs)
-                                give_pages(&vi->rq[i], buf);
-                        else if (vi->mergeable_rx_bufs)
                                put_page(virt_to_head_page(buf));
+                        else if (vi->big_packets)
+                                give_pages(&vi->rq[i], buf);
                        else
                                dev_kfree_skb(buf);
                        --vi->rq[i].num;
@@ -1752,16 +1797,17 @@ static int virtnet_restore(struct virtio_device *vdev)
        if (err)
                return err;
-        if (netif_running(vi->dev))
+        if (netif_running(vi->dev)) {
+                for (i = 0; i < vi->curr_queue_pairs; i++)
+                        if (!try_fill_recv(&vi->rq[i], GFP_KERNEL))
+                                schedule_delayed_work(&vi->refill, 0);
                for (i = 0; i < vi->max_queue_pairs; i++)
                        virtnet_napi_enable(&vi->rq[i]);
+        }
        netif_device_attach(vi->dev);
-        for (i = 0; i < vi->curr_queue_pairs; i++)
-                if (!try_fill_recv(&vi->rq[i], GFP_KERNEL))
-                        schedule_delayed_work(&vi->refill, 0);
        mutex_lock(&vi->config_lock);
        vi->config_enable = true;
        mutex_unlock(&vi->config_lock);
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index 0358c07f7669..ed384fee76ac 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -1668,7 +1668,7 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
                        netdev_dbg(dev, "circular route to %pI4\n",
                                   &dst->sin.sin_addr.s_addr);
                        dev->stats.collisions++;
-                        goto tx_error;
+                        goto rt_tx_error;
                }
                /* Bypass encapsulation if the destination is local */
@@ -2440,7 +2440,8 @@ static int vxlan_newlink(struct net *net, struct net_device *dev,
                /* update header length based on lower device */
                dev->hard_header_len = lowerdev->hard_header_len +
                                       (use_ipv6 ? VXLAN6_HEADROOM : VXLAN_HEADROOM);
-        }
+        } else if (use_ipv6)
+                vxlan->flags |= VXLAN_F_IPV6;
        if (data[IFLA_VXLAN_TOS])
                vxlan->tos  = nla_get_u8(data[IFLA_VXLAN_TOS]);
diff --git a/drivers/net/wireless/ath/ath9k/ar9002_mac.c b/drivers/net/wireless/ath/ath9k/ar9002_mac.c
index 8d78253c26ce..a366d6b4626f 100644
--- a/drivers/net/wireless/ath/ath9k/ar9002_mac.c
+++ b/drivers/net/wireless/ath/ath9k/ar9002_mac.c
@@ -76,9 +76,16 @@ static bool ar9002_hw_get_isr(struct ath_hw *ah, enum ath9k_int *masked)
                                mask2 |= ATH9K_INT_CST;
                        if (isr2 & AR_ISR_S2_TSFOOR)
                                mask2 |= ATH9K_INT_TSFOOR;
+                        if (!(pCap->hw_caps & ATH9K_HW_CAP_RAC_SUPPORTED)) {
+                                REG_WRITE(ah, AR_ISR_S2, isr2);
+                                isr &= ~AR_ISR_BCNMISC;
+                        }
                }
-                isr = REG_READ(ah, AR_ISR_RAC);
+                if (pCap->hw_caps & ATH9K_HW_CAP_RAC_SUPPORTED)
+                        isr = REG_READ(ah, AR_ISR_RAC);
                if (isr == 0xffffffff) {
                        *masked = 0;
                        return false;
@@ -97,11 +104,23 @@ static bool ar9002_hw_get_isr(struct ath_hw *ah, enum ath9k_int *masked)
                        *masked |= ATH9K_INT_TX;
-                        s0_s = REG_READ(ah, AR_ISR_S0_S);
+                        if (pCap->hw_caps & ATH9K_HW_CAP_RAC_SUPPORTED) {
+                                s0_s = REG_READ(ah, AR_ISR_S0_S);
+                                s1_s = REG_READ(ah, AR_ISR_S1_S);
+                        } else {
+                                s0_s = REG_READ(ah, AR_ISR_S0);
+                                REG_WRITE(ah, AR_ISR_S0, s0_s);
+                                s1_s = REG_READ(ah, AR_ISR_S1);
+                                REG_WRITE(ah, AR_ISR_S1, s1_s);
+                                isr &= ~(AR_ISR_TXOK |
+                                         AR_ISR_TXDESC |
+                                         AR_ISR_TXERR |
+                                         AR_ISR_TXEOL);
+                        }
                        ah->intr_txqs |= MS(s0_s, AR_ISR_S0_QCU_TXOK);
                        ah->intr_txqs |= MS(s0_s, AR_ISR_S0_QCU_TXDESC);
-                        s1_s = REG_READ(ah, AR_ISR_S1_S);
                        ah->intr_txqs |= MS(s1_s, AR_ISR_S1_QCU_TXERR);
                        ah->intr_txqs |= MS(s1_s, AR_ISR_S1_QCU_TXEOL);
                }
@@ -114,13 +133,15 @@ static bool ar9002_hw_get_isr(struct ath_hw *ah, enum ath9k_int *masked)
                *masked |= mask2;
        }
-        if (AR_SREV_9100(ah))
+        if (!AR_SREV_9100(ah) && (isr & AR_ISR_GENTMR)) {
-                return true;
-        if (isr & AR_ISR_GENTMR) {
                u32 s5_s;
-                s5_s = REG_READ(ah, AR_ISR_S5_S);
+                if (pCap->hw_caps & ATH9K_HW_CAP_RAC_SUPPORTED) {
+                        s5_s = REG_READ(ah, AR_ISR_S5_S);
+                } else {
+                        s5_s = REG_READ(ah, AR_ISR_S5);
+                }
                ah->intr_gen_timer_trigger =
                                MS(s5_s, AR_ISR_S5_GENTIMER_TRIG);
@@ -133,8 +154,21 @@ static bool ar9002_hw_get_isr(struct ath_hw *ah, enum ath9k_int *masked)
                if ((s5_s & AR_ISR_S5_TIM_TIMER) &&
                    !(pCap->hw_caps & ATH9K_HW_CAP_AUTOSLEEP))
                        *masked |= ATH9K_INT_TIM_TIMER;
+                if (!(pCap->hw_caps & ATH9K_HW_CAP_RAC_SUPPORTED)) {
+                        REG_WRITE(ah, AR_ISR_S5, s5_s);
+                        isr &= ~AR_ISR_GENTMR;
+                }
        }
+        if (!(pCap->hw_caps & ATH9K_HW_CAP_RAC_SUPPORTED)) {
+                REG_WRITE(ah, AR_ISR, isr);
+                REG_READ(ah, AR_ISR);
+        }
+        if (AR_SREV_9100(ah))
+                return true;
        if (sync_cause) {
                ath9k_debug_sync_cause(common, sync_cause);
                fatal_int =
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
index 1ec52356b5a1..130657db5c43 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
@@ -3984,18 +3984,20 @@ static void ar9003_hw_quick_drop_apply(struct ath_hw *ah, u16 freq)
        int quick_drop;
        s32 t[3], f[3] = {5180, 5500, 5785};
-        if (!(pBase->miscConfiguration & BIT(1)))
+        if (!(pBase->miscConfiguration & BIT(4)))
                return;
-        if (freq < 4000)
+        if (AR_SREV_9300(ah) || AR_SREV_9580(ah) || AR_SREV_9340(ah)) {
-                quick_drop = eep->modalHeader2G.quick_drop;
+                if (freq < 4000) {
-        else {
+                        quick_drop = eep->modalHeader2G.quick_drop;
-                t[0] = eep->base_ext1.quick_drop_low;
+                } else {
-                t[1] = eep->modalHeader5G.quick_drop;
+                        t[0] = eep->base_ext1.quick_drop_low;
-                t[2] = eep->base_ext1.quick_drop_high;
+                        t[1] = eep->modalHeader5G.quick_drop;
-                quick_drop = ar9003_hw_power_interpolate(freq, f, t, 3);
+                        t[2] = eep->base_ext1.quick_drop_high;
+                        quick_drop = ar9003_hw_power_interpolate(freq, f, t, 3);
+                }
+                REG_RMW_FIELD(ah, AR_PHY_AGC, AR_PHY_AGC_QUICK_DROP, quick_drop);
        }
-        REG_RMW_FIELD(ah, AR_PHY_AGC, AR_PHY_AGC_QUICK_DROP, quick_drop);
 }
 static void ar9003_hw_txend_to_xpa_off_apply(struct ath_hw *ah, bool is2ghz)
@@ -4035,7 +4037,7 @@ static void ar9003_hw_xlna_bias_strength_apply(struct ath_hw *ah, bool is2ghz)
        struct ar9300_eeprom *eep = &ah->eeprom.ar9300_eep;
        u8 bias;
-        if (!(eep->baseEepHeader.featureEnable & 0x40))
+        if (!(eep->baseEepHeader.miscConfiguration & 0x40))
                return;
        if (!AR_SREV_9300(ah))
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_main.c b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
index 9a2657fdd9cc..608d739d1378 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_main.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
@@ -127,21 +127,26 @@ static void ath9k_htc_bssid_iter(void *data, u8 *mac, struct ieee80211_vif *vif)
        struct ath9k_vif_iter_data *iter_data = data;
        int i;
-        for (i = 0; i < ETH_ALEN; i++)
+        if (iter_data->hw_macaddr != NULL) {
-                iter_data->mask[i] &= ~(iter_data->hw_macaddr[i] ^ mac[i]);
+                for (i = 0; i < ETH_ALEN; i++)
+                        iter_data->mask[i] &= ~(iter_data->hw_macaddr[i] ^ mac[i]);
+        } else {
+                iter_data->hw_macaddr = mac;
+        }
 }
-static void ath9k_htc_set_bssid_mask(struct ath9k_htc_priv *priv,
+static void ath9k_htc_set_mac_bssid_mask(struct ath9k_htc_priv *priv,
                                     struct ieee80211_vif *vif)
 {
        struct ath_common *common = ath9k_hw_common(priv->ah);
        struct ath9k_vif_iter_data iter_data;
        /*
-         * Use the hardware MAC address as reference, the hardware uses it
+         * Pick the MAC address of the first interface as the new hardware
-         * together with the BSSID mask when matching addresses.
+         * MAC address. The hardware will use it together with the BSSID mask
+         * when matching addresses.
         */
-        iter_data.hw_macaddr = common->macaddr;
+        iter_data.hw_macaddr = NULL;
        memset(&iter_data.mask, 0xff, ETH_ALEN);
        if (vif)
@@ -153,6 +158,10 @@ static void ath9k_htc_set_bssid_mask(struct ath9k_htc_priv *priv,
                ath9k_htc_bssid_iter, &iter_data);
        memcpy(common->bssidmask, iter_data.mask, ETH_ALEN);
+        if (iter_data.hw_macaddr)
+                memcpy(common->macaddr, iter_data.hw_macaddr, ETH_ALEN);
        ath_hw_setbssidmask(common);
 }
@@ -1063,7 +1072,7 @@ static int ath9k_htc_add_interface(struct ieee80211_hw *hw,
                goto out;
        }
-        ath9k_htc_set_bssid_mask(priv, vif);
+        ath9k_htc_set_mac_bssid_mask(priv, vif);
        priv->vif_slot |= (1 << avp->index);
        priv->nvifs++;
@@ -1128,7 +1137,7 @@ static void ath9k_htc_remove_interface(struct ieee80211_hw *hw,
        ath9k_htc_set_opmode(priv);
-        ath9k_htc_set_bssid_mask(priv, vif);
+        ath9k_htc_set_mac_bssid_mask(priv, vif);
        /*
         * Stop ANI only if there are no associated station interfaces.
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index 54b04155e43b..8918035da3a3 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -146,10 +146,9 @@ static void ath9k_hw_set_clockrate(struct ath_hw *ah)
        else
                clockrate = ATH9K_CLOCK_RATE_5GHZ_OFDM;
-        if (IS_CHAN_HT40(chan))
+        if (chan) {
-                clockrate *= 2;
+                if (IS_CHAN_HT40(chan))
+                        clockrate *= 2;
-        if (ah->curchan) {
                if (IS_CHAN_HALF_RATE(chan))
                        clockrate /= 2;
                if (IS_CHAN_QUARTER_RATE(chan))
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index 74f452c7b166..21aa09e0e825 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -965,8 +965,9 @@ void ath9k_calculate_iter_data(struct ieee80211_hw *hw,
        struct ath_common *common = ath9k_hw_common(ah);
        /*
-         * Use the hardware MAC address as reference, the hardware uses it
+         * Pick the MAC address of the first interface as the new hardware
-         * together with the BSSID mask when matching addresses.
+         * MAC address. The hardware will use it together with the BSSID mask
+         * when matching addresses.
         */
        memset(iter_data, 0, sizeof(*iter_data));
        memset(&iter_data->mask, 0xff, ETH_ALEN);
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index 09cdbcd09739..b5a19e098f2d 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -1276,6 +1276,10 @@ static void ath_tx_fill_desc(struct ath_softc *sc, struct ath_buf *bf,
                                if (!rts_thresh || (len > rts_thresh))
                                        rts = true;
                        }
+                        if (!aggr)
+                                len = fi->framelen;
                        ath_buf_set_rate(sc, bf, &info, len, rts);
                }
diff --git a/drivers/net/wireless/ath/wcn36xx/smd.c b/drivers/net/wireless/ath/wcn36xx/smd.c
index de9eb2cfbf4b..366339421d4f 100644
--- a/drivers/net/wireless/ath/wcn36xx/smd.c
+++ b/drivers/net/wireless/ath/wcn36xx/smd.c
@@ -2041,13 +2041,20 @@ static void wcn36xx_smd_rsp_process(struct wcn36xx *wcn, void *buf, size_t len)
        case WCN36XX_HAL_DELETE_STA_CONTEXT_IND:
                mutex_lock(&wcn->hal_ind_mutex);
                msg_ind = kmalloc(sizeof(*msg_ind), GFP_KERNEL);
-                msg_ind->msg_len = len;
+                if (msg_ind) {
-                msg_ind->msg = kmalloc(len, GFP_KERNEL);
+                        msg_ind->msg_len = len;
-                memcpy(msg_ind->msg, buf, len);
+                        msg_ind->msg = kmalloc(len, GFP_KERNEL);
-                list_add_tail(&msg_ind->list, &wcn->hal_ind_queue);
+                        memcpy(msg_ind->msg, buf, len);
-                queue_work(wcn->hal_ind_wq, &wcn->hal_ind_work);
+                        list_add_tail(&msg_ind->list, &wcn->hal_ind_queue);
-                wcn36xx_dbg(WCN36XX_DBG_HAL, "indication arrived\n");
+                        queue_work(wcn->hal_ind_wq, &wcn->hal_ind_work);
+                        wcn36xx_dbg(WCN36XX_DBG_HAL, "indication arrived\n");
+                }
                mutex_unlock(&wcn->hal_ind_mutex);
+                if (msg_ind)
+                        break;
+                /* FIXME: Do something smarter then just printing an error. */
+                wcn36xx_err("Run out of memory while handling SMD_EVENT (%d)\n",
+                            msg_header->msg_type);
                break;
        default:
                wcn36xx_err("SMD_EVENT (%d) not supported\n",
diff --git a/drivers/net/wireless/brcm80211/Kconfig b/drivers/net/wireless/brcm80211/Kconfig
index b00a7e92225f..54e36fcb3954 100644
--- a/drivers/net/wireless/brcm80211/Kconfig
+++ b/drivers/net/wireless/brcm80211/Kconfig
@@ -5,6 +5,8 @@ config BRCMSMAC
        tristate "Broadcom IEEE802.11n PCIe SoftMAC WLAN driver"
        depends on MAC80211
        depends on BCMA
+        select NEW_LEDS if BCMA_DRIVER_GPIO
+        select LEDS_CLASS if BCMA_DRIVER_GPIO
        select BRCMUTIL
        select FW_LOADER
        select CRC_CCITT
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh_sdmmc.c b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh_sdmmc.c
index 905704e335d7..abc9ceca70f3 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh_sdmmc.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh_sdmmc.c
@@ -109,6 +109,8 @@ static inline int brcmf_sdioh_f0_write_byte(struct brcmf_sdio_dev *sdiodev,
                                        brcmf_err("Disable F2 failed:%d\n",
                                                  err_ret);
                        }
+                } else {
+                        err_ret = -ENOENT;
                }
        } else if ((regaddr == SDIO_CCCR_ABORT) ||
                   (regaddr == SDIO_CCCR_IENx)) {
diff --git a/drivers/net/wireless/iwlwifi/iwl-7000.c b/drivers/net/wireless/iwlwifi/iwl-7000.c
index 85879dbaa402..3c34a72a5d64 100644
--- a/drivers/net/wireless/iwlwifi/iwl-7000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-7000.c
@@ -67,8 +67,8 @@
 #include "iwl-agn-hw.h"
 /* Highest firmware API version supported */
-#define IWL7260_UCODE_API_MAX   7
+#define IWL7260_UCODE_API_MAX   8
-#define IWL3160_UCODE_API_MAX   7
+#define IWL3160_UCODE_API_MAX   8
 /* Oldest version we won't warn about */
 #define IWL7260_UCODE_API_OK    7
@@ -130,6 +130,7 @@ const struct iwl_cfg iwl7260_2ac_cfg = {
        .ht_params = &iwl7000_ht_params,
        .nvm_ver = IWL7260_NVM_VERSION,
        .nvm_calib_ver = IWL7260_TX_POWER_VERSION,
+        .host_interrupt_operation_mode = true,
 };
 const struct iwl_cfg iwl7260_2ac_cfg_high_temp = {
@@ -140,6 +141,7 @@ const struct iwl_cfg iwl7260_2ac_cfg_high_temp = {
        .nvm_ver = IWL7260_NVM_VERSION,
        .nvm_calib_ver = IWL7260_TX_POWER_VERSION,
        .high_temp = true,
+        .host_interrupt_operation_mode = true,
 };
 const struct iwl_cfg iwl7260_2n_cfg = {
@@ -149,6 +151,7 @@ const struct iwl_cfg iwl7260_2n_cfg = {
        .ht_params = &iwl7000_ht_params,
        .nvm_ver = IWL7260_NVM_VERSION,
        .nvm_calib_ver = IWL7260_TX_POWER_VERSION,
+        .host_interrupt_operation_mode = true,
 };
 const struct iwl_cfg iwl7260_n_cfg = {
@@ -158,6 +161,7 @@ const struct iwl_cfg iwl7260_n_cfg = {
        .ht_params = &iwl7000_ht_params,
        .nvm_ver = IWL7260_NVM_VERSION,
        .nvm_calib_ver = IWL7260_TX_POWER_VERSION,
+        .host_interrupt_operation_mode = true,
 };
 const struct iwl_cfg iwl3160_2ac_cfg = {
@@ -167,6 +171,7 @@ const struct iwl_cfg iwl3160_2ac_cfg = {
        .ht_params = &iwl7000_ht_params,
        .nvm_ver = IWL3160_NVM_VERSION,
        .nvm_calib_ver = IWL3160_TX_POWER_VERSION,
+        .host_interrupt_operation_mode = true,
 };
 const struct iwl_cfg iwl3160_2n_cfg = {
@@ -176,6 +181,7 @@ const struct iwl_cfg iwl3160_2n_cfg = {
        .ht_params = &iwl7000_ht_params,
        .nvm_ver = IWL3160_NVM_VERSION,
        .nvm_calib_ver = IWL3160_TX_POWER_VERSION,
+        .host_interrupt_operation_mode = true,
 };
 const struct iwl_cfg iwl3160_n_cfg = {
@@ -185,6 +191,7 @@ const struct iwl_cfg iwl3160_n_cfg = {
        .ht_params = &iwl7000_ht_params,
        .nvm_ver = IWL3160_NVM_VERSION,
        .nvm_calib_ver = IWL3160_TX_POWER_VERSION,
+        .host_interrupt_operation_mode = true,
 };
 const struct iwl_cfg iwl7265_2ac_cfg = {
@@ -196,5 +203,23 @@ const struct iwl_cfg iwl7265_2ac_cfg = {
        .nvm_calib_ver = IWL7265_TX_POWER_VERSION,
 };
+const struct iwl_cfg iwl7265_2n_cfg = {
+        .name = "Intel(R) Dual Band Wireless N 7265",
+        .fw_name_pre = IWL7265_FW_PRE,
+        IWL_DEVICE_7000,
+        .ht_params = &iwl7000_ht_params,
+        .nvm_ver = IWL7265_NVM_VERSION,
+        .nvm_calib_ver = IWL7265_TX_POWER_VERSION,
+};
+const struct iwl_cfg iwl7265_n_cfg = {
+        .name = "Intel(R) Wireless N 7265",
+        .fw_name_pre = IWL7265_FW_PRE,
+        IWL_DEVICE_7000,
+        .ht_params = &iwl7000_ht_params,
+        .nvm_ver = IWL7265_NVM_VERSION,
+        .nvm_calib_ver = IWL7265_TX_POWER_VERSION,
+};
 MODULE_FIRMWARE(IWL7260_MODULE_FIRMWARE(IWL7260_UCODE_API_OK));
 MODULE_FIRMWARE(IWL3160_MODULE_FIRMWARE(IWL3160_UCODE_API_OK));
diff --git a/drivers/net/wireless/iwlwifi/iwl-config.h b/drivers/net/wireless/iwlwifi/iwl-config.h
index 18f232e8e812..03fd9aa8bfda 100644
--- a/drivers/net/wireless/iwlwifi/iwl-config.h
+++ b/drivers/net/wireless/iwlwifi/iwl-config.h
@@ -207,6 +207,8 @@ struct iwl_eeprom_params {
 * @rx_with_siso_diversity: 1x1 device with rx antenna diversity
 * @internal_wimax_coex: internal wifi/wimax combo device
 * @high_temp: Is this NIC is designated to be in high temperature.
+ * @host_interrupt_operation_mode: device needs host interrupt operation
+ *      mode set
 *
 * We enable the driver to be backward compatible wrt. hardware features.
 * API differences in uCode shouldn't be handled here but through TLVs
@@ -235,6 +237,7 @@ struct iwl_cfg {
        enum iwl_led_mode led_mode;
        const bool rx_with_siso_diversity;
        const bool internal_wimax_coex;
+        const bool host_interrupt_operation_mode;
        bool high_temp;
 };
@@ -294,6 +297,8 @@ extern const struct iwl_cfg iwl3160_2ac_cfg;
 extern const struct iwl_cfg iwl3160_2n_cfg;
 extern const struct iwl_cfg iwl3160_n_cfg;
 extern const struct iwl_cfg iwl7265_2ac_cfg;
+extern const struct iwl_cfg iwl7265_2n_cfg;
+extern const struct iwl_cfg iwl7265_n_cfg;
 #endif /* CONFIG_IWLMVM */
 #endif /* __IWL_CONFIG_H__ */
diff --git a/drivers/net/wireless/iwlwifi/iwl-csr.h b/drivers/net/wireless/iwlwifi/iwl-csr.h
index 54a4fdc631b7..da4eca8b3007 100644
--- a/drivers/net/wireless/iwlwifi/iwl-csr.h
+++ b/drivers/net/wireless/iwlwifi/iwl-csr.h
@@ -495,14 +495,11 @@ enum secure_load_status_reg {
 * the CSR_INT_COALESCING is an 8 bit register in 32-usec unit
 *
 * default interrupt coalescing timer is 64 x 32 = 2048 usecs
- * default interrupt coalescing calibration timer is 16 x 32 = 512 usecs
 */
 #define IWL_HOST_INT_TIMEOUT_MAX        (0xFF)
 #define IWL_HOST_INT_TIMEOUT_DEF        (0x40)
 #define IWL_HOST_INT_TIMEOUT_MIN        (0x0)
-#define IWL_HOST_INT_CALIB_TIMEOUT_MAX  (0xFF)
+#define IWL_HOST_INT_OPER_MODE          BIT(31)
-#define IWL_HOST_INT_CALIB_TIMEOUT_DEF  (0x10)
-#define IWL_HOST_INT_CALIB_TIMEOUT_MIN  (0x0)
 /*****************************************************************************
 *                        7000/3000 series SHR DTS addresses                 *
diff --git a/drivers/net/wireless/iwlwifi/mvm/bt-coex.c b/drivers/net/wireless/iwlwifi/mvm/bt-coex.c
index 5d066cbc5ac7..75b72a956552 100644
--- a/drivers/net/wireless/iwlwifi/mvm/bt-coex.c
+++ b/drivers/net/wireless/iwlwifi/mvm/bt-coex.c
@@ -391,7 +391,6 @@ int iwl_send_bt_init_conf(struct iwl_mvm *mvm)
                                            BT_VALID_LUT |
                                            BT_VALID_WIFI_RX_SW_PRIO_BOOST |
                                            BT_VALID_WIFI_TX_SW_PRIO_BOOST |
-                                            BT_VALID_MULTI_PRIO_LUT |
                                            BT_VALID_CORUN_LUT_20 |
                                            BT_VALID_CORUN_LUT_40 |
                                            BT_VALID_ANT_ISOLATION |
@@ -842,6 +841,11 @@ static void iwl_mvm_bt_rssi_iterator(void *_data, u8 *mac,
        sta = rcu_dereference_protected(mvm->fw_id_to_mac_id[mvmvif->ap_sta_id],
                                        lockdep_is_held(&mvm->mutex));
+        /* This can happen if the station has been removed right now */
+        if (IS_ERR_OR_NULL(sta))
+                return;
        mvmsta = (void *)sta->drv_priv;
        data->num_bss_ifaces++;
diff --git a/drivers/net/wireless/iwlwifi/mvm/d3.c b/drivers/net/wireless/iwlwifi/mvm/d3.c
index 6f45966817bb..b9b81e881dd0 100644
--- a/drivers/net/wireless/iwlwifi/mvm/d3.c
+++ b/drivers/net/wireless/iwlwifi/mvm/d3.c
@@ -895,7 +895,7 @@ static int iwl_mvm_get_last_nonqos_seq(struct iwl_mvm *mvm,
                /* new API returns next, not last-used seqno */
                if (mvm->fw->ucode_capa.flags &
                                IWL_UCODE_TLV_FLAGS_D3_CONTINUITY_API)
-                        err -= 0x10;
+                        err = (u16) (err - 0x10);
        }
        iwl_free_resp(&cmd);
@@ -1549,7 +1549,7 @@ static bool iwl_mvm_setup_connection_keep(struct iwl_mvm *mvm,
        if (gtkdata.unhandled_cipher)
                return false;
        if (!gtkdata.num_keys)
-                return true;
+                goto out;
        if (!gtkdata.last_gtk)
                return false;
@@ -1600,6 +1600,7 @@ static bool iwl_mvm_setup_connection_keep(struct iwl_mvm *mvm,
                                           (void *)&replay_ctr, GFP_KERNEL);
        }
+out:
        mvmvif->seqno_valid = true;
        /* +0x10 because the set API expects next-to-use, not last-used */
        mvmvif->seqno = le16_to_cpu(status->non_qos_seq_ctr) + 0x10;
diff --git a/drivers/net/wireless/iwlwifi/mvm/debugfs.c b/drivers/net/wireless/iwlwifi/mvm/debugfs.c
index 9864d713eb2c..a8fe6b41f9a3 100644
--- a/drivers/net/wireless/iwlwifi/mvm/debugfs.c
+++ b/drivers/net/wireless/iwlwifi/mvm/debugfs.c
@@ -119,6 +119,10 @@ static ssize_t iwl_dbgfs_sta_drain_write(struct file *file,
        if (sscanf(buf, "%d %d", &sta_id, &drain) != 2)
                return -EINVAL;
+        if (sta_id < 0 || sta_id >= IWL_MVM_STATION_COUNT)
+                return -EINVAL;
+        if (drain < 0 || drain > 1)
+                return -EINVAL;
        mutex_lock(&mvm->mutex);
diff --git a/drivers/net/wireless/iwlwifi/mvm/time-event.c b/drivers/net/wireless/iwlwifi/mvm/time-event.c
index 33cf56fdfc41..95ce4b601fef 100644
--- a/drivers/net/wireless/iwlwifi/mvm/time-event.c
+++ b/drivers/net/wireless/iwlwifi/mvm/time-event.c
@@ -176,8 +176,11 @@ static void iwl_mvm_te_handle_notif(struct iwl_mvm *mvm,
         * P2P Device discoveribility, while there are other higher priority
         * events in the system).
         */
-        if (WARN_ONCE(!le32_to_cpu(notif->status),
+        if (!le32_to_cpu(notif->status)) {
-                      "Failed to schedule time event\n")) {
+                bool start = le32_to_cpu(notif->action) &
+                                TE_V2_NOTIF_HOST_EVENT_START;
+                IWL_WARN(mvm, "Time Event %s notification failure\n",
+                         start ? "start" : "end");
                if (iwl_mvm_te_check_disconnect(mvm, te_data->vif, NULL)) {
                        iwl_mvm_te_clear_data(mvm, te_data);
                        return;
diff --git a/drivers/net/wireless/iwlwifi/pcie/drv.c b/drivers/net/wireless/iwlwifi/pcie/drv.c
index 941c0c88f982..e6272546395a 100644
--- a/drivers/net/wireless/iwlwifi/pcie/drv.c
+++ b/drivers/net/wireless/iwlwifi/pcie/drv.c
@@ -353,6 +353,33 @@ static DEFINE_PCI_DEVICE_TABLE(iwl_hw_card_ids) = {
 /* 7265 Series */
        {IWL_PCI_DEVICE(0x095A, 0x5010, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x5110, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095B, 0x5310, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095B, 0x5302, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095B, 0x5210, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x5012, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x500A, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x5410, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x5400, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x1010, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x5000, iwl7265_2n_cfg)},
+        {IWL_PCI_DEVICE(0x095B, 0x5200, iwl7265_2n_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x5002, iwl7265_n_cfg)},
+        {IWL_PCI_DEVICE(0x095B, 0x5202, iwl7265_n_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x9010, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x9110, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x9210, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x9510, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x9310, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x9410, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x5020, iwl7265_2n_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x502A, iwl7265_2n_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x5420, iwl7265_2n_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x5090, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x5190, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x5590, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095B, 0x5290, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x5490, iwl7265_2ac_cfg)},
 #endif /* CONFIG_IWLMVM */
        {0}
diff --git a/drivers/net/wireless/iwlwifi/pcie/internal.h b/drivers/net/wireless/iwlwifi/pcie/internal.h
index fa22639b63c9..051268c037b1 100644
--- a/drivers/net/wireless/iwlwifi/pcie/internal.h
+++ b/drivers/net/wireless/iwlwifi/pcie/internal.h
@@ -477,4 +477,12 @@ static inline bool iwl_is_rfkill_set(struct iwl_trans *trans)
                CSR_GP_CNTRL_REG_FLAG_HW_RF_KILL_SW);
 }
+static inline void iwl_nic_error(struct iwl_trans *trans)
+{
+        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
+        set_bit(STATUS_FW_ERROR, &trans_pcie->status);
+        iwl_op_mode_nic_error(trans->op_mode);
+}
 #endif /* __iwl_trans_int_pcie_h__ */
diff --git a/drivers/net/wireless/iwlwifi/pcie/rx.c b/drivers/net/wireless/iwlwifi/pcie/rx.c
index 3f237b42eb36..be3995afa9d0 100644
--- a/drivers/net/wireless/iwlwifi/pcie/rx.c
+++ b/drivers/net/wireless/iwlwifi/pcie/rx.c
@@ -489,6 +489,10 @@ static void iwl_pcie_rx_hw_init(struct iwl_trans *trans, struct iwl_rxq *rxq)
        /* Set interrupt coalescing timer to default (2048 usecs) */
        iwl_write8(trans, CSR_INT_COALESCING, IWL_HOST_INT_TIMEOUT_DEF);
+        /* W/A for interrupt coalescing bug in 7260 and 3160 */
+        if (trans->cfg->host_interrupt_operation_mode)
+                iwl_set_bit(trans, CSR_INT_COALESCING, IWL_HOST_INT_OPER_MODE);
 }
 static void iwl_pcie_rx_init_rxb_lists(struct iwl_rxq *rxq)
@@ -796,12 +800,13 @@ static void iwl_pcie_irq_handle_error(struct iwl_trans *trans)
        iwl_pcie_dump_csr(trans);
        iwl_dump_fh(trans, NULL);
+        /* set the ERROR bit before we wake up the caller */
        set_bit(STATUS_FW_ERROR, &trans_pcie->status);
        clear_bit(STATUS_HCMD_ACTIVE, &trans_pcie->status);
        wake_up(&trans_pcie->wait_command_queue);
        local_bh_disable();
-        iwl_op_mode_nic_error(trans->op_mode);
+        iwl_nic_error(trans);
        local_bh_enable();
 }
diff --git a/drivers/net/wireless/iwlwifi/pcie/trans.c b/drivers/net/wireless/iwlwifi/pcie/trans.c
index 5d9337bec67a..cde9c16f6e4f 100644
--- a/drivers/net/wireless/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/iwlwifi/pcie/trans.c
@@ -279,9 +279,6 @@ static int iwl_pcie_nic_init(struct iwl_trans *trans)
        spin_lock_irqsave(&trans_pcie->irq_lock, flags);
        iwl_pcie_apm_init(trans);
-        /* Set interrupt coalescing calibration timer to default (512 usecs) */
-        iwl_write8(trans, CSR_INT_COALESCING, IWL_HOST_INT_CALIB_TIMEOUT_DEF);
        spin_unlock_irqrestore(&trans_pcie->irq_lock, flags);
        iwl_pcie_set_pwr(trans, false);
diff --git a/drivers/net/wireless/iwlwifi/pcie/tx.c b/drivers/net/wireless/iwlwifi/pcie/tx.c
index 059c5acad3a0..0adde919a258 100644
--- a/drivers/net/wireless/iwlwifi/pcie/tx.c
+++ b/drivers/net/wireless/iwlwifi/pcie/tx.c
@@ -207,7 +207,7 @@ static void iwl_pcie_txq_stuck_timer(unsigned long data)
                IWL_ERR(trans, "scratch %d = 0x%08x\n", i,
                        le32_to_cpu(txq->scratchbufs[i].scratch));
-        iwl_op_mode_nic_error(trans->op_mode);
+        iwl_nic_error(trans);
 }
 /*
@@ -1023,7 +1023,7 @@ static void iwl_pcie_cmdq_reclaim(struct iwl_trans *trans, int txq_id, int idx)
                if (nfreed++ > 0) {
                        IWL_ERR(trans, "HCMD skipped: index (%d) %d %d\n",
                                idx, q->write_ptr, q->read_ptr);
-                        iwl_op_mode_nic_error(trans->op_mode);
+                        iwl_nic_error(trans);
                }
        }
@@ -1562,7 +1562,7 @@ static int iwl_pcie_send_hcmd_sync(struct iwl_trans *trans,
                                       get_cmd_string(trans_pcie, cmd->id));
                        ret = -ETIMEDOUT;
-                        iwl_op_mode_nic_error(trans->op_mode);
+                        iwl_nic_error(trans);
                        goto cancel;
                }
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index 9df7bc91a26f..a1b32ee9594a 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -383,6 +383,14 @@ struct hwsim_radiotap_hdr {
        __le16 rt_chbitmask;
 } __packed;
+struct hwsim_radiotap_ack_hdr {
+        struct ieee80211_radiotap_header hdr;
+        u8 rt_flags;
+        u8 pad;
+        __le16 rt_channel;
+        __le16 rt_chbitmask;
+} __packed;
 /* MAC80211_HWSIM netlinf family */
 static struct genl_family hwsim_genl_family = {
        .id = GENL_ID_GENERATE,
@@ -500,7 +508,7 @@ static void mac80211_hwsim_monitor_ack(struct ieee80211_channel *chan,
                                       const u8 *addr)
 {
        struct sk_buff *skb;
-        struct hwsim_radiotap_hdr *hdr;
+        struct hwsim_radiotap_ack_hdr *hdr;
        u16 flags;
        struct ieee80211_hdr *hdr11;
@@ -511,14 +519,14 @@ static void mac80211_hwsim_monitor_ack(struct ieee80211_channel *chan,
        if (skb == NULL)
                return;
-        hdr = (struct hwsim_radiotap_hdr *) skb_put(skb, sizeof(*hdr));
+        hdr = (struct hwsim_radiotap_ack_hdr *) skb_put(skb, sizeof(*hdr));
        hdr->hdr.it_version = PKTHDR_RADIOTAP_VERSION;
        hdr->hdr.it_pad = 0;
        hdr->hdr.it_len = cpu_to_le16(sizeof(*hdr));
        hdr->hdr.it_present = cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
                                          (1 << IEEE80211_RADIOTAP_CHANNEL));
        hdr->rt_flags = 0;
-        hdr->rt_rate = 0;
+        hdr->pad = 0;
        hdr->rt_channel = cpu_to_le16(chan->center_freq);
        flags = IEEE80211_CHAN_2GHZ;
        hdr->rt_chbitmask = cpu_to_le16(flags);
@@ -1230,7 +1238,7 @@ static void mac80211_hwsim_bss_info_changed(struct ieee80211_hw *hw,
                                              HRTIMER_MODE_REL);
                } else if (!info->enable_beacon) {
                        unsigned int count = 0;
-                        ieee80211_iterate_active_interfaces(
+                        ieee80211_iterate_active_interfaces_atomic(
                                data->hw, IEEE80211_IFACE_ITER_NORMAL,
                                mac80211_hwsim_bcn_en_iter, &count);
                        wiphy_debug(hw->wiphy, "  beaconing vifs remaining: %u",
@@ -2003,7 +2011,7 @@ static int hwsim_tx_info_frame_received_nl(struct sk_buff *skb_2,
           (hwsim_flags & HWSIM_TX_STAT_ACK)) {
                if (skb->len >= 16) {
                        hdr = (struct ieee80211_hdr *) skb->data;
-                        mac80211_hwsim_monitor_ack(txi->rate_driver_data[0],
+                        mac80211_hwsim_monitor_ack(data2->channel,
                                                   hdr->addr2);
                }
                txi->flags |= IEEE80211_TX_STAT_ACK;
diff --git a/drivers/net/wireless/mwifiex/main.c b/drivers/net/wireless/mwifiex/main.c
index 78e8a6666cc6..8bb8988c435c 100644
--- a/drivers/net/wireless/mwifiex/main.c
+++ b/drivers/net/wireless/mwifiex/main.c
@@ -746,7 +746,8 @@ static struct net_device_stats *mwifiex_get_stats(struct net_device *dev)
 }
 static u16
-mwifiex_netdev_select_wmm_queue(struct net_device *dev, struct sk_buff *skb)
+mwifiex_netdev_select_wmm_queue(struct net_device *dev, struct sk_buff *skb,
+                                void *accel_priv)
 {
        skb->priority = cfg80211_classify8021d(skb);
        return mwifiex_1d_to_wmm_queue[skb->priority];
diff --git a/drivers/net/wireless/mwifiex/sta_ioctl.c b/drivers/net/wireless/mwifiex/sta_ioctl.c
index c8e029df770e..a09398fe9e2a 100644
--- a/drivers/net/wireless/mwifiex/sta_ioctl.c
+++ b/drivers/net/wireless/mwifiex/sta_ioctl.c
@@ -319,8 +319,8 @@ int mwifiex_bss_start(struct mwifiex_private *priv, struct cfg80211_bss *bss,
                if (bss_desc && bss_desc->ssid.ssid_len &&
                    (!mwifiex_ssid_cmp(&priv->curr_bss_params.bss_descriptor.
                                       ssid, &bss_desc->ssid))) {
-                        kfree(bss_desc);
+                        ret = 0;
-                        return 0;
+                        goto done;
                }
                /* Exit Adhoc mode first */
diff --git a/drivers/net/wireless/rtlwifi/pci.c b/drivers/net/wireless/rtlwifi/pci.c
index 0f494444bcd1..5a53195d016b 100644
--- a/drivers/net/wireless/rtlwifi/pci.c
+++ b/drivers/net/wireless/rtlwifi/pci.c
@@ -740,6 +740,8 @@ static void _rtl_pci_rx_interrupt(struct ieee80211_hw *hw)
        };
        int index = rtlpci->rx_ring[rx_queue_idx].idx;
+        if (rtlpci->driver_is_goingto_unload)
+                return;
        /*RX NORMAL PKT */
        while (count--) {
                /*rx descriptor */
@@ -1636,6 +1638,7 @@ static void rtl_pci_stop(struct ieee80211_hw *hw)
         */
        set_hal_stop(rtlhal);
+        rtlpci->driver_is_goingto_unload = true;
        rtlpriv->cfg->ops->disable_interrupt(hw);
        cancel_work_sync(&rtlpriv->works.lps_change_work);
@@ -1653,7 +1656,6 @@ static void rtl_pci_stop(struct ieee80211_hw *hw)
        ppsc->rfchange_inprogress = true;
        spin_unlock_irqrestore(&rtlpriv->locks.rf_ps_lock, flags);
-        rtlpci->driver_is_goingto_unload = true;
        rtlpriv->cfg->ops->hw_disable(hw);
        /* some things are not needed if firmware not available */
        if (!rtlpriv->max_fw_size)
diff --git a/drivers/net/xen-netback/common.h b/drivers/net/xen-netback/common.h
index 08ae01b41c83..c47794b9d42f 100644
--- a/drivers/net/xen-netback/common.h
+++ b/drivers/net/xen-netback/common.h
@@ -101,6 +101,13 @@ struct xenvif_rx_meta {
 #define MAX_PENDING_REQS 256
+/* It's possible for an skb to have a maximal number of frags
+ * but still be less than MAX_BUFFER_OFFSET in size. Thus the
+ * worst-case number of copy operations is MAX_SKB_FRAGS per
+ * ring slot.
+ */
+#define MAX_GRANT_COPY_OPS (MAX_SKB_FRAGS * XEN_NETIF_RX_RING_SIZE)
 struct xenvif {
        /* Unique identifier for this interface. */
        domid_t          domid;
@@ -143,13 +150,13 @@ struct xenvif {
         */
        RING_IDX rx_req_cons_peek;
-        /* Given MAX_BUFFER_OFFSET of 4096 the worst case is that each
+        /* This array is allocated seperately as it is large */
-         * head/fragment page uses 2 copy operations because it
+        struct gnttab_copy *grant_copy_op;
-         * straddles two buffers in the frontend.
-         */
-        struct gnttab_copy grant_copy_op[2*XEN_NETIF_RX_RING_SIZE];
-        struct xenvif_rx_meta meta[2*XEN_NETIF_RX_RING_SIZE];
+        /* We create one meta structure per ring request we consume, so
+         * the maximum number is the same as the ring size.
+         */
+        struct xenvif_rx_meta meta[XEN_NETIF_RX_RING_SIZE];
        u8               fe_dev_addr[6];
diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
index 2329cccf1fa6..fff8cddfed81 100644
--- a/drivers/net/xen-netback/interface.c
+++ b/drivers/net/xen-netback/interface.c
@@ -34,6 +34,7 @@
 #include <linux/ethtool.h>
 #include <linux/rtnetlink.h>
 #include <linux/if_vlan.h>
+#include <linux/vmalloc.h>
 #include <xen/events.h>
 #include <asm/xen/hypercall.h>
@@ -307,6 +308,15 @@ struct xenvif *xenvif_alloc(struct device *parent, domid_t domid,
        SET_NETDEV_DEV(dev, parent);
        vif = netdev_priv(dev);
+        vif->grant_copy_op = vmalloc(sizeof(struct gnttab_copy) *
+                                     MAX_GRANT_COPY_OPS);
+        if (vif->grant_copy_op == NULL) {
+                pr_warn("Could not allocate grant copy space for %s\n", name);
+                free_netdev(dev);
+                return ERR_PTR(-ENOMEM);
+        }
        vif->domid  = domid;
        vif->handle = handle;
        vif->can_sg = 1;
@@ -368,11 +378,11 @@ int xenvif_connect(struct xenvif *vif, unsigned long tx_ring_ref,
                   unsigned long rx_ring_ref, unsigned int tx_evtchn,
                   unsigned int rx_evtchn)
 {
+        struct task_struct *task;
        int err = -ENOMEM;
-        /* Already connected through? */
+        BUG_ON(vif->tx_irq);
-        if (vif->tx_irq)
+        BUG_ON(vif->task);
-                return 0;
        err = xenvif_map_frontend_rings(vif, tx_ring_ref, rx_ring_ref);
        if (err < 0)
@@ -411,14 +421,16 @@ int xenvif_connect(struct xenvif *vif, unsigned long tx_ring_ref,
        }
        init_waitqueue_head(&vif->wq);
-        vif->task = kthread_create(xenvif_kthread,
+        task = kthread_create(xenvif_kthread,
-                                   (void *)vif, "%s", vif->dev->name);
+                              (void *)vif, "%s", vif->dev->name);
-        if (IS_ERR(vif->task)) {
+        if (IS_ERR(task)) {
                pr_warn("Could not allocate kthread for %s\n", vif->dev->name);
-                err = PTR_ERR(vif->task);
+                err = PTR_ERR(task);
                goto err_rx_unbind;
        }
+        vif->task = task;
        rtnl_lock();
        if (!vif->can_sg && vif->dev->mtu > ETH_DATA_LEN)
                dev_set_mtu(vif->dev, ETH_DATA_LEN);
@@ -461,8 +473,10 @@ void xenvif_disconnect(struct xenvif *vif)
        if (netif_carrier_ok(vif->dev))
                xenvif_carrier_off(vif);
-        if (vif->task)
+        if (vif->task) {
                kthread_stop(vif->task);
+                vif->task = NULL;
+        }
        if (vif->tx_irq) {
                if (vif->tx_irq == vif->rx_irq)
@@ -483,6 +497,7 @@ void xenvif_free(struct xenvif *vif)
        unregister_netdev(vif->dev);
+        vfree(vif->grant_copy_op);
        free_netdev(vif->dev);
        module_put(THIS_MODULE);
diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
index 919b6509455c..78425554a537 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -39,6 +39,7 @@
 #include <linux/udp.h>
 #include <net/tcp.h>
+#include <net/ip6_checksum.h>
 #include <xen/xen.h>
 #include <xen/events.h>
@@ -451,7 +452,7 @@ static int xenvif_gop_skb(struct sk_buff *skb,
        }
        /* Set up a GSO prefix descriptor, if necessary */
-        if ((1 << skb_shinfo(skb)->gso_type) & vif->gso_prefix_mask) {
+        if ((1 << gso_type) & vif->gso_prefix_mask) {
                req = RING_GET_REQUEST(&vif->rx, vif->rx.req_cons++);
                meta = npo->meta + npo->meta_prod++;
                meta->gso_type = gso_type;
@@ -607,7 +608,7 @@ void xenvif_rx_action(struct xenvif *vif)
        if (!npo.copy_prod)
                return;
-        BUG_ON(npo.copy_prod > ARRAY_SIZE(vif->grant_copy_op));
+        BUG_ON(npo.copy_prod > MAX_GRANT_COPY_OPS);
        gnttab_batch_copy(vif->grant_copy_op, npo.copy_prod);
        while ((skb = __skb_dequeue(&rxq)) != NULL) {
@@ -1148,75 +1149,99 @@ static int xenvif_set_skb_gso(struct xenvif *vif,
        return 0;
 }
-static inline void maybe_pull_tail(struct sk_buff *skb, unsigned int len)
+static inline int maybe_pull_tail(struct sk_buff *skb, unsigned int len,
+                                  unsigned int max)
 {
-        if (skb_is_nonlinear(skb) && skb_headlen(skb) < len) {
+        if (skb_headlen(skb) >= len)
-                /* If we need to pullup then pullup to the max, so we
+                return 0;
-                 * won't need to do it again.
-                 */
+        /* If we need to pullup then pullup to the max, so we
-                int target = min_t(int, skb->len, MAX_TCP_HEADER);
+         * won't need to do it again.
-                __pskb_pull_tail(skb, target - skb_headlen(skb));
+         */
-        }
+        if (max > skb->len)
+                max = skb->len;
+        if (__pskb_pull_tail(skb, max - skb_headlen(skb)) == NULL)
+                return -ENOMEM;
+        if (skb_headlen(skb) < len)
+                return -EPROTO;
+        return 0;
 }
+/* This value should be large enough to cover a tagged ethernet header plus
+ * maximally sized IP and TCP or UDP headers.
+ */
+#define MAX_IP_HDR_LEN 128
 static int checksum_setup_ip(struct xenvif *vif, struct sk_buff *skb,
                             int recalculate_partial_csum)
 {
-        struct iphdr *iph = (void *)skb->data;
-        unsigned int header_size;
        unsigned int off;
-        int err = -EPROTO;
+        bool fragment;
+        int err;
-        off = sizeof(struct iphdr);
+        fragment = false;
-        header_size = skb->network_header + off + MAX_IPOPTLEN;
+        err = maybe_pull_tail(skb,
-        maybe_pull_tail(skb, header_size);
+                              sizeof(struct iphdr),
+                              MAX_IP_HDR_LEN);
+        if (err < 0)
+                goto out;
-        off = iph->ihl * 4;
+        if (ip_hdr(skb)->frag_off & htons(IP_OFFSET | IP_MF))
+                fragment = true;
-        switch (iph->protocol) {
+        off = ip_hdrlen(skb);
-        case IPPROTO_TCP:
-                if (!skb_partial_csum_set(skb, off,
-                                          offsetof(struct tcphdr, check)))
-                        goto out;
-                if (recalculate_partial_csum) {
+        err = -EPROTO;
-                        struct tcphdr *tcph = tcp_hdr(skb);
+        if (fragment)
+                goto out;
-                        header_size = skb->network_header +
+        switch (ip_hdr(skb)->protocol) {
-                                off +
+        case IPPROTO_TCP:
-                                sizeof(struct tcphdr);
+                err = maybe_pull_tail(skb,
-                        maybe_pull_tail(skb, header_size);
+                                      off + sizeof(struct tcphdr),
+                                      MAX_IP_HDR_LEN);
+                if (err < 0)
+                        goto out;
-                        tcph->check = ~csum_tcpudp_magic(iph->saddr, iph->daddr,
+                if (!skb_partial_csum_set(skb, off,
-                                                         skb->len - off,
+                                          offsetof(struct tcphdr, check))) {
-                                                         IPPROTO_TCP, 0);
+                        err = -EPROTO;
+                        goto out;
                }
+                if (recalculate_partial_csum)
+                        tcp_hdr(skb)->check =
+                                ~csum_tcpudp_magic(ip_hdr(skb)->saddr,
+                                                   ip_hdr(skb)->daddr,
+                                                   skb->len - off,
+                                                   IPPROTO_TCP, 0);
                break;
        case IPPROTO_UDP:
-                if (!skb_partial_csum_set(skb, off,
+                err = maybe_pull_tail(skb,
-                                          offsetof(struct udphdr, check)))
+                                      off + sizeof(struct udphdr),
+                                      MAX_IP_HDR_LEN);
+                if (err < 0)
                        goto out;
-                if (recalculate_partial_csum) {
+                if (!skb_partial_csum_set(skb, off,
-                        struct udphdr *udph = udp_hdr(skb);
+                                          offsetof(struct udphdr, check))) {
+                        err = -EPROTO;
-                        header_size = skb->network_header +
+                        goto out;
-                                off +
-                                sizeof(struct udphdr);
-                        maybe_pull_tail(skb, header_size);
-                        udph->check = ~csum_tcpudp_magic(iph->saddr, iph->daddr,
-                                                         skb->len - off,
-                                                         IPPROTO_UDP, 0);
                }
+                if (recalculate_partial_csum)
+                        udp_hdr(skb)->check =
+                                ~csum_tcpudp_magic(ip_hdr(skb)->saddr,
+                                                   ip_hdr(skb)->daddr,
+                                                   skb->len - off,
+                                                   IPPROTO_UDP, 0);
                break;
        default:
-                if (net_ratelimit())
-                        netdev_err(vif->dev,
-                                   "Attempting to checksum a non-TCP/UDP packet, "
-                                   "dropping a protocol %d packet\n",
-                                   iph->protocol);
                goto out;
        }
@@ -1226,121 +1251,142 @@ out:
        return err;
 }
+/* This value should be large enough to cover a tagged ethernet header plus
+ * an IPv6 header, all options, and a maximal TCP or UDP header.
+ */
+#define MAX_IPV6_HDR_LEN 256
+#define OPT_HDR(type, skb, off) \
+        (type *)(skb_network_header(skb) + (off))
 static int checksum_setup_ipv6(struct xenvif *vif, struct sk_buff *skb,
                               int recalculate_partial_csum)
 {
-        int err = -EPROTO;
+        int err;
-        struct ipv6hdr *ipv6h = (void *)skb->data;
        u8 nexthdr;
-        unsigned int header_size;
        unsigned int off;
+        unsigned int len;
        bool fragment;
        bool done;
+        fragment = false;
        done = false;
        off = sizeof(struct ipv6hdr);
-        header_size = skb->network_header + off;
+        err = maybe_pull_tail(skb, off, MAX_IPV6_HDR_LEN);
-        maybe_pull_tail(skb, header_size);
+        if (err < 0)
+                goto out;
-        nexthdr = ipv6h->nexthdr;
+        nexthdr = ipv6_hdr(skb)->nexthdr;
-        while ((off <= sizeof(struct ipv6hdr) + ntohs(ipv6h->payload_len)) &&
+        len = sizeof(struct ipv6hdr) + ntohs(ipv6_hdr(skb)->payload_len);
-               !done) {
+        while (off <= len && !done) {
                switch (nexthdr) {
                case IPPROTO_DSTOPTS:
                case IPPROTO_HOPOPTS:
                case IPPROTO_ROUTING: {
-                        struct ipv6_opt_hdr *hp = (void *)(skb->data + off);
+                        struct ipv6_opt_hdr *hp;
-                        header_size = skb->network_header +
+                        err = maybe_pull_tail(skb,
-                                off +
+                                              off +
-                                sizeof(struct ipv6_opt_hdr);
+                                              sizeof(struct ipv6_opt_hdr),
-                        maybe_pull_tail(skb, header_size);
+                                              MAX_IPV6_HDR_LEN);
+                        if (err < 0)
+                                goto out;
+                        hp = OPT_HDR(struct ipv6_opt_hdr, skb, off);
                        nexthdr = hp->nexthdr;
                        off += ipv6_optlen(hp);
                        break;
                }
                case IPPROTO_AH: {
-                        struct ip_auth_hdr *hp = (void *)(skb->data + off);
+                        struct ip_auth_hdr *hp;
-                        header_size = skb->network_header +
+                        err = maybe_pull_tail(skb,
-                                off +
+                                              off +
-                                sizeof(struct ip_auth_hdr);
+                                              sizeof(struct ip_auth_hdr),
-                        maybe_pull_tail(skb, header_size);
+                                              MAX_IPV6_HDR_LEN);
+                        if (err < 0)
+                                goto out;
+                        hp = OPT_HDR(struct ip_auth_hdr, skb, off);
                        nexthdr = hp->nexthdr;
-                        off += (hp->hdrlen+2)<<2;
+                        off += ipv6_authlen(hp);
+                        break;
+                }
+                case IPPROTO_FRAGMENT: {
+                        struct frag_hdr *hp;
+                        err = maybe_pull_tail(skb,
+                                              off +
+                                              sizeof(struct frag_hdr),
+                                              MAX_IPV6_HDR_LEN);
+                        if (err < 0)
+                                goto out;
+                        hp = OPT_HDR(struct frag_hdr, skb, off);
+                        if (hp->frag_off & htons(IP6_OFFSET | IP6_MF))
+                                fragment = true;
+                        nexthdr = hp->nexthdr;
+                        off += sizeof(struct frag_hdr);
                        break;
                }
-                case IPPROTO_FRAGMENT:
-                        fragment = true;
-                        /* fall through */
                default:
                        done = true;
                        break;
                }
        }
-        if (!done) {
+        err = -EPROTO;
-                if (net_ratelimit())
-                        netdev_err(vif->dev, "Failed to parse packet header\n");
-                goto out;
-        }
-        if (fragment) {
+        if (!done || fragment)
-                if (net_ratelimit())
-                        netdev_err(vif->dev, "Packet is a fragment!\n");
                goto out;
-        }
        switch (nexthdr) {
        case IPPROTO_TCP:
-                if (!skb_partial_csum_set(skb, off,
+                err = maybe_pull_tail(skb,
-                                          offsetof(struct tcphdr, check)))
+                                      off + sizeof(struct tcphdr),
+                                      MAX_IPV6_HDR_LEN);
+                if (err < 0)
                        goto out;
-                if (recalculate_partial_csum) {
+                if (!skb_partial_csum_set(skb, off,
-                        struct tcphdr *tcph = tcp_hdr(skb);
+                                          offsetof(struct tcphdr, check))) {
+                        err = -EPROTO;
-                        header_size = skb->network_header +
+                        goto out;
-                                off +
-                                sizeof(struct tcphdr);
-                        maybe_pull_tail(skb, header_size);
-                        tcph->check = ~csum_ipv6_magic(&ipv6h->saddr,
-                                                       &ipv6h->daddr,
-                                                       skb->len - off,
-                                                       IPPROTO_TCP, 0);
                }
+                if (recalculate_partial_csum)
+                        tcp_hdr(skb)->check =
+                                ~csum_ipv6_magic(&ipv6_hdr(skb)->saddr,
+                                                 &ipv6_hdr(skb)->daddr,
+                                                 skb->len - off,
+                                                 IPPROTO_TCP, 0);
                break;
        case IPPROTO_UDP:
-                if (!skb_partial_csum_set(skb, off,
+                err = maybe_pull_tail(skb,
-                                          offsetof(struct udphdr, check)))
+                                      off + sizeof(struct udphdr),
+                                      MAX_IPV6_HDR_LEN);
+                if (err < 0)
                        goto out;
-                if (recalculate_partial_csum) {
+                if (!skb_partial_csum_set(skb, off,
-                        struct udphdr *udph = udp_hdr(skb);
+                                          offsetof(struct udphdr, check))) {
+                        err = -EPROTO;
-                        header_size = skb->network_header +
+                        goto out;
-                                off +
-                                sizeof(struct udphdr);
-                        maybe_pull_tail(skb, header_size);
-                        udph->check = ~csum_ipv6_magic(&ipv6h->saddr,
-                                                       &ipv6h->daddr,
-                                                       skb->len - off,
-                                                       IPPROTO_UDP, 0);
                }
+                if (recalculate_partial_csum)
+                        udp_hdr(skb)->check =
+                                ~csum_ipv6_magic(&ipv6_hdr(skb)->saddr,
+                                                 &ipv6_hdr(skb)->daddr,
+                                                 skb->len - off,
+                                                 IPPROTO_UDP, 0);
                break;
        default:
-                if (net_ratelimit())
-                        netdev_err(vif->dev,
-                                   "Attempting to checksum a non-TCP/UDP packet, "
-                                   "dropping a protocol %d packet\n",
-                                   nexthdr);
                goto out;
        }
@@ -1410,14 +1456,15 @@ static bool tx_credit_exceeded(struct xenvif *vif, unsigned size)
        return false;
 }
-static unsigned xenvif_tx_build_gops(struct xenvif *vif)
+static unsigned xenvif_tx_build_gops(struct xenvif *vif, int budget)
 {
        struct gnttab_copy *gop = vif->tx_copy_ops, *request_gop;
        struct sk_buff *skb;
        int ret;
        while ((nr_pending_reqs(vif) + XEN_NETBK_LEGACY_SLOTS_MAX
-                < MAX_PENDING_REQS)) {
+                < MAX_PENDING_REQS) &&
+               (skb_queue_len(&vif->tx_queue) < budget)) {
                struct xen_netif_tx_request txreq;
                struct xen_netif_tx_request txfrags[XEN_NETBK_LEGACY_SLOTS_MAX];
                struct page *page;
@@ -1439,7 +1486,7 @@ static unsigned xenvif_tx_build_gops(struct xenvif *vif)
                        continue;
                }
-                RING_FINAL_CHECK_FOR_REQUESTS(&vif->tx, work_to_do);
+                work_to_do = RING_HAS_UNCONSUMED_REQUESTS(&vif->tx);
                if (!work_to_do)
                        break;
@@ -1579,14 +1626,13 @@ static unsigned xenvif_tx_build_gops(struct xenvif *vif)
 }
-static int xenvif_tx_submit(struct xenvif *vif, int budget)
+static int xenvif_tx_submit(struct xenvif *vif)
 {
        struct gnttab_copy *gop = vif->tx_copy_ops;
        struct sk_buff *skb;
        int work_done = 0;
-        while (work_done < budget &&
+        while ((skb = __skb_dequeue(&vif->tx_queue)) != NULL) {
-               (skb = __skb_dequeue(&vif->tx_queue)) != NULL) {
                struct xen_netif_tx_request *txp;
                u16 pending_idx;
                unsigned data_len;
@@ -1661,14 +1707,14 @@ int xenvif_tx_action(struct xenvif *vif, int budget)
        if (unlikely(!tx_work_todo(vif)))
                return 0;
-        nr_gops = xenvif_tx_build_gops(vif);
+        nr_gops = xenvif_tx_build_gops(vif, budget);
        if (nr_gops == 0)
                return 0;
        gnttab_batch_copy(vif->tx_copy_ops, nr_gops);
-        work_done = xenvif_tx_submit(vif, nr_gops);
+        work_done = xenvif_tx_submit(vif);
        return work_done;
 }