92 files changed, 954 insertions, 571 deletions

diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 04f35f960cb8..701f86cd5993 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1025,10 +1025,14 @@ static netdev_features_t bond_fix_features(struct net_device *dev,
                                  NETIF_F_FRAGLIST | NETIF_F_ALL_TSO | \
                                  NETIF_F_HIGHDMA | NETIF_F_LRO)
 
+#define BOND_ENC_FEATURES       (NETIF_F_ALL_CSUM | NETIF_F_SG | NETIF_F_RXCSUM |\
+                                 NETIF_F_TSO | NETIF_F_GSO_UDP_TUNNEL)
+
 static void bond_compute_features(struct bonding *bond)
 {
         unsigned int flags, dst_release_flag = IFF_XMIT_DST_RELEASE;
         netdev_features_t vlan_features = BOND_VLAN_FEATURES;
+        netdev_features_t enc_features  = BOND_ENC_FEATURES;
         struct net_device *bond_dev = bond->dev;
         struct list_head *iter;
         struct slave *slave;
@@ -1044,6 +1048,9 @@ static void bond_compute_features(struct bonding *bond)
                 vlan_features = netdev_increment_features(vlan_features,
                         slave->dev->vlan_features, BOND_VLAN_FEATURES);
 
+                enc_features = netdev_increment_features(enc_features,
+                                                         slave->dev->hw_enc_features,
+                                                         BOND_ENC_FEATURES);
                 dst_release_flag &= slave->dev->priv_flags;
                 if (slave->dev->hard_header_len > max_hard_header_len)
                         max_hard_header_len = slave->dev->hard_header_len;
@@ -1054,6 +1061,7 @@ static void bond_compute_features(struct bonding *bond)
 
 done:
         bond_dev->vlan_features = vlan_features;
+        bond_dev->hw_enc_features = enc_features;
         bond_dev->hard_header_len = max_hard_header_len;
         bond_dev->gso_max_segs = gso_max_segs;
         netif_set_gso_max_size(bond_dev, gso_max_size);
@@ -3975,6 +3983,7 @@ void bond_setup(struct net_device *bond_dev)
                                 NETIF_F_HW_VLAN_CTAG_FILTER;
 
         bond_dev->hw_features &= ~(NETIF_F_ALL_CSUM & ~NETIF_F_HW_CSUM);
+        bond_dev->hw_features |= NETIF_F_GSO_UDP_TUNNEL;
         bond_dev->features |= bond_dev->hw_features;
 }
 
@@ -4059,7 +4068,7 @@ static int bond_check_params(struct bond_params *params)
         }
 
         if (ad_select) {
-                bond_opt_initstr(&newval, lacp_rate);
+                bond_opt_initstr(&newval, ad_select);
                 valptr = bond_opt_parse(bond_opt_get(BOND_OPT_AD_SELECT),
                                         &newval);
                 if (!valptr) {
diff --git a/drivers/net/can/slcan.c b/drivers/net/can/slcan.c
index dcf9196f6316..ea4d4f1a6411 100644
--- a/drivers/net/can/slcan.c
+++ b/drivers/net/can/slcan.c
@@ -52,6 +52,7 @@
 #include <linux/delay.h>
 #include <linux/init.h>
 #include <linux/kernel.h>
+#include <linux/workqueue.h>
 #include <linux/can.h>
 #include <linux/can/skb.h>
 
@@ -85,6 +86,7 @@ struct slcan {
         struct tty_struct       *tty;           /* ptr to TTY structure      */
         struct net_device       *dev;           /* easy for intr handling    */
         spinlock_t              lock;
+        struct work_struct      tx_work;        /* Flushes transmit buffer   */
 
         /* These are pointers to the malloc()ed frame buffers. */
         unsigned char           rbuff[SLC_MTU]; /* receiver buffer           */
@@ -309,36 +311,46 @@ static void slc_encaps(struct slcan *sl, struct can_frame *cf)
         sl->dev->stats.tx_bytes += cf->can_dlc;
 }
 
-/*
- * Called by the driver when there's room for more data.  If we have
- * more packets to send, we send them here.
- */
-static void slcan_write_wakeup(struct tty_struct *tty)
+/* Write out any remaining transmit buffer. Scheduled when tty is writable */
+static void slcan_transmit(struct work_struct *work)
 {
+        struct slcan *sl = container_of(work, struct slcan, tx_work);
         int actual;
-        struct slcan *sl = (struct slcan *) tty->disc_data;
 
+        spin_lock_bh(&sl->lock);
         /* First make sure we're connected. */
-        if (!sl || sl->magic != SLCAN_MAGIC || !netif_running(sl->dev))
+        if (!sl->tty || sl->magic != SLCAN_MAGIC || !netif_running(sl->dev)) {
+                spin_unlock_bh(&sl->lock);
                 return;
+        }
 
-        spin_lock_bh(&sl->lock);
         if (sl->xleft <= 0)  {
                 /* Now serial buffer is almost free & we can start
                  * transmission of another packet */
                 sl->dev->stats.tx_packets++;
-                clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
+                clear_bit(TTY_DO_WRITE_WAKEUP, &sl->tty->flags);
                 spin_unlock_bh(&sl->lock);
                 netif_wake_queue(sl->dev);
                 return;
         }
 
-        actual = tty->ops->write(tty, sl->xhead, sl->xleft);
+        actual = sl->tty->ops->write(sl->tty, sl->xhead, sl->xleft);
         sl->xleft -= actual;
         sl->xhead += actual;
         spin_unlock_bh(&sl->lock);
 }
 
+/*
+ * Called by the driver when there's room for more data.
+ * Schedule the transmit.
+ */
+static void slcan_write_wakeup(struct tty_struct *tty)
+{
+        struct slcan *sl = tty->disc_data;
+
+        schedule_work(&sl->tx_work);
+}
+
 /* Send a can_frame to a TTY queue. */
 static netdev_tx_t slc_xmit(struct sk_buff *skb, struct net_device *dev)
 {
@@ -528,6 +540,7 @@ static struct slcan *slc_alloc(dev_t line)
         sl->magic = SLCAN_MAGIC;
         sl->dev = dev;
         spin_lock_init(&sl->lock);
+        INIT_WORK(&sl->tx_work, slcan_transmit);
         slcan_devs[i] = dev;
 
         return sl;
@@ -626,8 +639,12 @@ static void slcan_close(struct tty_struct *tty)
         if (!sl || sl->magic != SLCAN_MAGIC || sl->tty != tty)
                 return;
 
+        spin_lock_bh(&sl->lock);
         tty->disc_data = NULL;
         sl->tty = NULL;
+        spin_unlock_bh(&sl->lock);
+
+        flush_work(&sl->tx_work);
 
         /* Flush network side */
         unregister_netdev(sl->dev);
diff --git a/drivers/net/ethernet/allwinner/sun4i-emac.c b/drivers/net/ethernet/allwinner/sun4i-emac.c
index 28460676b8ca..d81e7167a8b5 100644
--- a/drivers/net/ethernet/allwinner/sun4i-emac.c
+++ b/drivers/net/ethernet/allwinner/sun4i-emac.c
@@ -736,6 +736,7 @@ static int emac_open(struct net_device *dev)
 
         ret = emac_mdio_probe(dev);
         if (ret < 0) {
+                free_irq(dev->irq, dev);
                 netdev_err(dev, "cannot probe MDIO bus\n");
                 return ret;
         }
diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
index 141160ef249a..5776e503e4c5 100644
--- a/drivers/net/ethernet/broadcom/bcmsysport.c
+++ b/drivers/net/ethernet/broadcom/bcmsysport.c
@@ -654,13 +654,13 @@ static int bcm_sysport_tx_poll(struct napi_struct *napi, int budget)
 
         work_done = bcm_sysport_tx_reclaim(ring->priv, ring);
 
-        if (work_done < budget) {
+        if (work_done == 0) {
                 napi_complete(napi);
                 /* re-enable TX interrupt */
                 intrl2_1_mask_clear(ring->priv, BIT(ring->index));
         }
 
-        return work_done;
+        return 0;
 }
 
 static void bcm_sysport_tx_reclaim_all(struct bcm_sysport_priv *priv)
@@ -1254,28 +1254,17 @@ static inline void umac_enable_set(struct bcm_sysport_priv *priv,
                 usleep_range(1000, 2000);
 }
 
-static inline int umac_reset(struct bcm_sysport_priv *priv)
+static inline void umac_reset(struct bcm_sysport_priv *priv)
 {
-        unsigned int timeout = 0;
         u32 reg;
-        int ret = 0;
-
-        umac_writel(priv, 0, UMAC_CMD);
-        while (timeout++ < 1000) {
-                reg = umac_readl(priv, UMAC_CMD);
-                if (!(reg & CMD_SW_RESET))
-                        break;
-
-                udelay(1);
-        }
-
-        if (timeout == 1000) {
-                dev_err(&priv->pdev->dev,
-                        "timeout waiting for MAC to come out of reset\n");
-                ret = -ETIMEDOUT;
-        }
 
-        return ret;
+        reg = umac_readl(priv, UMAC_CMD);
+        reg |= CMD_SW_RESET;
+        umac_writel(priv, reg, UMAC_CMD);
+        udelay(10);
+        reg = umac_readl(priv, UMAC_CMD);
+        reg &= ~CMD_SW_RESET;
+        umac_writel(priv, reg, UMAC_CMD);
 }
 
 static void umac_set_hw_addr(struct bcm_sysport_priv *priv,
@@ -1303,11 +1292,7 @@ static int bcm_sysport_open(struct net_device *dev)
         int ret;
 
         /* Reset UniMAC */
-        ret = umac_reset(priv);
-        if (ret) {
-                netdev_err(dev, "UniMAC reset failed\n");
-                return ret;
-        }
+        umac_reset(priv);
 
         /* Flush TX and RX FIFOs at TOPCTRL level */
         topctrl_flush(priv);
@@ -1589,12 +1574,6 @@ static int bcm_sysport_probe(struct platform_device *pdev)
         BUILD_BUG_ON(sizeof(struct bcm_tsb) != 8);
         dev->needed_headroom += sizeof(struct bcm_tsb);
 
-        /* We are interfaced to a switch which handles the multicast
-         * filtering for us, so we do not support programming any
-         * multicast hash table in this Ethernet MAC.
-         */
-        dev->flags &= ~IFF_MULTICAST;
-
         /* libphy will adjust the link state accordingly */
         netif_carrier_off(dev);
 
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
index 47c5814114e1..4b875da1c7ed 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
@@ -797,7 +797,8 @@ static void bnx2x_tpa_stop(struct bnx2x *bp, struct bnx2x_fastpath *fp,
 
                 return;
         }
-        bnx2x_frag_free(fp, new_data);
+        if (new_data)
+                bnx2x_frag_free(fp, new_data);
 drop:
         /* drop the packet and keep the buffer in the bin */
         DP(NETIF_MSG_RX_STATUS,
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index 2887034523e0..6a8b1453a1b9 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -12937,7 +12937,7 @@ static int bnx2x_get_num_non_def_sbs(struct pci_dev *pdev, int cnic_cnt)
          * without the default SB.
          * For VFs there is no default SB, then we return (index+1).
          */
-        pci_read_config_word(pdev, pdev->msix_cap + PCI_MSI_FLAGS, &control);
+        pci_read_config_word(pdev, pdev->msix_cap + PCI_MSIX_FLAGS, &control);
 
         index = control & PCI_MSIX_FLAGS_QSIZE;
 
diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
index 5ba1cfbd60da..16281ad2da12 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
@@ -1408,13 +1408,6 @@ static int bcmgenet_alloc_rx_buffers(struct bcmgenet_priv *priv)
                 if (cb->skb)
                         continue;
 
-                /* set the DMA descriptor length once and for all
-                 * it will only change if we support dynamically sizing
-                 * priv->rx_buf_len, but we do not
-                 */
-                dmadesc_set_length_status(priv, priv->rx_bd_assign_ptr,
-                                priv->rx_buf_len << DMA_BUFLENGTH_SHIFT);
-
                 ret = bcmgenet_rx_refill(priv, cb);
                 if (ret)
                         break;
@@ -2535,14 +2528,17 @@ static int bcmgenet_probe(struct platform_device *pdev)
         netif_set_real_num_tx_queues(priv->dev, priv->hw_params->tx_queues + 1);
         netif_set_real_num_rx_queues(priv->dev, priv->hw_params->rx_queues + 1);
 
-        err = register_netdev(dev);
-        if (err)
-                goto err_clk_disable;
+        /* libphy will determine the link state */
+        netif_carrier_off(dev);
 
         /* Turn off the main clock, WOL clock is handled separately */
         if (!IS_ERR(priv->clk))
                 clk_disable_unprepare(priv->clk);
 
+        err = register_netdev(dev);
+        if (err)
+                goto err;
+
         return err;
 
 err_clk_disable:
diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.h b/drivers/net/ethernet/broadcom/genet/bcmgenet.h
index 0f117105fed1..e23c993b1362 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.h
+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.h
@@ -331,9 +331,9 @@ struct bcmgenet_mib_counters {
 #define  EXT_ENERGY_DET_MASK            (1 << 12)
 
 #define EXT_RGMII_OOB_CTRL              0x0C
-#define  RGMII_MODE_EN                  (1 << 0)
 #define  RGMII_LINK                     (1 << 4)
 #define  OOB_DISABLE                    (1 << 5)
+#define  RGMII_MODE_EN                  (1 << 6)
 #define  ID_MODE_DIS                    (1 << 16)
 
 #define EXT_GPHY_CTRL                   0x1C
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index df2792d8383d..8afa579e7c40 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -3224,7 +3224,7 @@ static int tg3_nvram_read_using_eeprom(struct tg3 *tp,
         return 0;
 }
 
-#define NVRAM_CMD_TIMEOUT 100
+#define NVRAM_CMD_TIMEOUT 5000
 
 static int tg3_nvram_exec_cmd(struct tg3 *tp, u32 nvram_cmd)
 {
@@ -3232,7 +3232,7 @@ static int tg3_nvram_exec_cmd(struct tg3 *tp, u32 nvram_cmd)
 
         tw32(NVRAM_CMD, nvram_cmd);
         for (i = 0; i < NVRAM_CMD_TIMEOUT; i++) {
-                udelay(10);
+                usleep_range(10, 40);
                 if (tr32(NVRAM_CMD) & NVRAM_CMD_DONE) {
                         udelay(10);
                         break;
@@ -7854,8 +7854,8 @@ static int tg3_tso_bug(struct tg3 *tp, struct sk_buff *skb)
                 netif_wake_queue(tp->dev);
         }
 
-        segs = skb_gso_segment(skb, tp->dev->features & ~NETIF_F_TSO);
-        if (IS_ERR(segs))
+        segs = skb_gso_segment(skb, tp->dev->features & ~(NETIF_F_TSO | NETIF_F_TSO6));
+        if (IS_ERR(segs) || !segs)
                 goto tg3_tso_bug_end;
 
         do {
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
index 2f8d6b910383..a83271cf17c3 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
@@ -4057,22 +4057,19 @@ int cxgb4_unregister_uld(enum cxgb4_uld type)
 EXPORT_SYMBOL(cxgb4_unregister_uld);
 
 /* Check if netdev on which event is occured belongs to us or not. Return
- * suceess (1) if it belongs otherwise failure (0).
+ * success (true) if it belongs otherwise failure (false).
+ * Called with rcu_read_lock() held.
  */
-static int cxgb4_netdev(struct net_device *netdev)
+static bool cxgb4_netdev(const struct net_device *netdev)
 {
         struct adapter *adap;
         int i;
 
-        spin_lock(&adap_rcu_lock);
         list_for_each_entry_rcu(adap, &adap_rcu_list, rcu_node)
                 for (i = 0; i < MAX_NPORTS; i++)
-                        if (adap->port[i] == netdev) {
-                                spin_unlock(&adap_rcu_lock);
-                                return 1;
-                        }
-        spin_unlock(&adap_rcu_lock);
-        return 0;
+                        if (adap->port[i] == netdev)
+                                return true;
+        return false;
 }
 
 static int clip_add(struct net_device *event_dev, struct inet6_ifaddr *ifa,
@@ -6396,6 +6393,7 @@ static void remove_one(struct pci_dev *pdev)
                         adapter->flags &= ~DEV_ENABLED;
                 }
                 pci_release_regions(pdev);
+                synchronize_rcu();
                 kfree(adapter);
         } else
                 pci_release_regions(pdev);
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
index bba67681aeaa..931478e7bd28 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
@@ -3962,6 +3962,7 @@ int t4_port_init(struct adapter *adap, int mbox, int pf, int vf)
                 p->lport = j;
                 p->rss_size = rss_size;
                 memcpy(adap->port[i]->dev_addr, addr, ETH_ALEN);
+                adap->port[i]->dev_port = j;
 
                 ret = ntohl(c.u.info.lstatus_to_modtype);
                 p->mdio_addr = (ret & FW_PORT_CMD_MDIOCAP) ?
diff --git a/drivers/net/ethernet/dec/tulip/timer.c b/drivers/net/ethernet/dec/tulip/timer.c
index 768379b8aee9..523d9dde50a2 100644
--- a/drivers/net/ethernet/dec/tulip/timer.c
+++ b/drivers/net/ethernet/dec/tulip/timer.c
@@ -158,7 +158,7 @@ void comet_timer(unsigned long data)
 {
         struct net_device *dev = (struct net_device *)data;
         struct tulip_private *tp = netdev_priv(dev);
-        int next_tick = 60*HZ;
+        int next_tick = 2*HZ;
 
         if (tulip_debug > 1)
                 netdev_dbg(dev, "Comet link status %04x partner capability %04x\n",
diff --git a/drivers/net/ethernet/emulex/benet/be.h b/drivers/net/ethernet/emulex/benet/be.h
index 2e7c5553955e..c2f5d2d3b932 100644
--- a/drivers/net/ethernet/emulex/benet/be.h
+++ b/drivers/net/ethernet/emulex/benet/be.h
@@ -557,9 +557,7 @@ static inline u16 be_max_qs(struct be_adapter *adapter)
 #define be_pvid_tagging_enabled(adapter)        (adapter->pvid)
 
 /* Is BE in QNQ multi-channel mode */
-#define be_is_qnq_mode(adapter)         (adapter->mc_type == FLEX10 ||  \
-                                         adapter->mc_type == vNIC1 ||   \
-                                         adapter->mc_type == UFP)
+#define be_is_qnq_mode(adapter)         (adapter->function_mode & QNQ_MODE)
 
 #define lancer_chip(adapter)    (adapter->pdev->device == OC_DEVICE_ID3 || \
                                  adapter->pdev->device == OC_DEVICE_ID4)
diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.h b/drivers/net/ethernet/emulex/benet/be_cmds.h
index 3e0a6b243806..59b3c056f329 100644
--- a/drivers/net/ethernet/emulex/benet/be_cmds.h
+++ b/drivers/net/ethernet/emulex/benet/be_cmds.h
@@ -1091,7 +1091,7 @@ struct be_cmd_resp_modify_eq_delay {
  * based on the skew/IPL.
  */
 #define RDMA_ENABLED                            0x4
-#define FLEX10_MODE                             0x400
+#define QNQ_MODE                                0x400
 #define VNIC_MODE                               0x20000
 #define UMC_ENABLED                             0x1000000
 struct be_cmd_req_query_fw_cfg {
diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
index 6822b3d76d85..1e187fb760f8 100644
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -2902,7 +2902,7 @@ static int be_open(struct net_device *netdev)
         for_all_evt_queues(adapter, eqo, i) {
                 napi_enable(&eqo->napi);
                 be_enable_busy_poll(eqo);
-                be_eq_notify(adapter, eqo->q.id, true, false, 0);
+                be_eq_notify(adapter, eqo->q.id, true, true, 0);
         }
         adapter->flags |= BE_FLAGS_NAPI_ENABLED;
 
@@ -3254,9 +3254,9 @@ err:
 
 static u8 be_convert_mc_type(u32 function_mode)
 {
-        if (function_mode & VNIC_MODE && function_mode & FLEX10_MODE)
+        if (function_mode & VNIC_MODE && function_mode & QNQ_MODE)
                 return vNIC1;
-        else if (function_mode & FLEX10_MODE)
+        else if (function_mode & QNQ_MODE)
                 return FLEX10;
         else if (function_mode & VNIC_MODE)
                 return vNIC2;
diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index 38d9d276ab8b..77037fd377b8 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -320,6 +320,11 @@ static void *swap_buffer(void *bufaddr, int len)
         return bufaddr;
 }
 
+static inline bool is_ipv4_pkt(struct sk_buff *skb)
+{
+        return skb->protocol == htons(ETH_P_IP) && ip_hdr(skb)->version == 4;
+}
+
 static int
 fec_enet_clear_csum(struct sk_buff *skb, struct net_device *ndev)
 {
@@ -330,7 +335,8 @@ fec_enet_clear_csum(struct sk_buff *skb, struct net_device *ndev)
         if (unlikely(skb_cow_head(skb, 0)))
                 return -1;
 
-        ip_hdr(skb)->check = 0;
+        if (is_ipv4_pkt(skb))
+                ip_hdr(skb)->check = 0;
         *(__sum16 *)(skb->head + skb->csum_start + skb->csum_offset) = 0;
 
         return 0;
diff --git a/drivers/net/ethernet/freescale/ucc_geth.c b/drivers/net/ethernet/freescale/ucc_geth.c
index fab39e295441..36fc429298e3 100644
--- a/drivers/net/ethernet/freescale/ucc_geth.c
+++ b/drivers/net/ethernet/freescale/ucc_geth.c
@@ -2990,11 +2990,11 @@ static int ucc_geth_startup(struct ucc_geth_private *ugeth)
         if (ug_info->rxExtendedFiltering) {
                 size += THREAD_RX_PRAM_ADDITIONAL_FOR_EXTENDED_FILTERING;
                 if (ug_info->largestexternallookupkeysize ==
-                    QE_FLTR_TABLE_LOOKUP_KEY_SIZE_8_BYTES)
+                    QE_FLTR_LARGEST_EXTERNAL_TABLE_LOOKUP_KEY_SIZE_8_BYTES)
                         size +=
                             THREAD_RX_PRAM_ADDITIONAL_FOR_EXTENDED_FILTERING_8;
                 if (ug_info->largestexternallookupkeysize ==
-                    QE_FLTR_TABLE_LOOKUP_KEY_SIZE_16_BYTES)
+                    QE_FLTR_LARGEST_EXTERNAL_TABLE_LOOKUP_KEY_SIZE_16_BYTES)
                         size +=
                             THREAD_RX_PRAM_ADDITIONAL_FOR_EXTENDED_FILTERING_16;
         }
diff --git a/drivers/net/ethernet/intel/igb/e1000_82575.c b/drivers/net/ethernet/intel/igb/e1000_82575.c
index a2db388cc31e..ee74f9536b31 100644
--- a/drivers/net/ethernet/intel/igb/e1000_82575.c
+++ b/drivers/net/ethernet/intel/igb/e1000_82575.c
@@ -1481,6 +1481,13 @@ static s32 igb_init_hw_82575(struct e1000_hw *hw)
         s32 ret_val;
         u16 i, rar_count = mac->rar_entry_count;
 
+        if ((hw->mac.type >= e1000_i210) &&
+            !(igb_get_flash_presence_i210(hw))) {
+                ret_val = igb_pll_workaround_i210(hw);
+                if (ret_val)
+                        return ret_val;
+        }
+
         /* Initialize identification LED */
         ret_val = igb_id_led_init(hw);
         if (ret_val) {
diff --git a/drivers/net/ethernet/intel/igb/e1000_defines.h b/drivers/net/ethernet/intel/igb/e1000_defines.h
index 2a8bb35c2df2..217f8138851b 100644
--- a/drivers/net/ethernet/intel/igb/e1000_defines.h
+++ b/drivers/net/ethernet/intel/igb/e1000_defines.h
@@ -46,14 +46,15 @@
 #define E1000_CTRL_EXT_SDP3_DIR  0x00000800 /* SDP3 Data direction */
 
 /* Physical Func Reset Done Indication */
-#define E1000_CTRL_EXT_PFRSTD    0x00004000
-#define E1000_CTRL_EXT_LINK_MODE_MASK 0x00C00000
-#define E1000_CTRL_EXT_LINK_MODE_PCIE_SERDES  0x00C00000
-#define E1000_CTRL_EXT_LINK_MODE_1000BASE_KX  0x00400000
-#define E1000_CTRL_EXT_LINK_MODE_SGMII   0x00800000
-#define E1000_CTRL_EXT_LINK_MODE_GMII   0x00000000
-#define E1000_CTRL_EXT_EIAME          0x01000000
-#define E1000_CTRL_EXT_IRCA           0x00000001
+#define E1000_CTRL_EXT_PFRSTD   0x00004000
+#define E1000_CTRL_EXT_SDLPE    0X00040000  /* SerDes Low Power Enable */
+#define E1000_CTRL_EXT_LINK_MODE_MASK   0x00C00000
+#define E1000_CTRL_EXT_LINK_MODE_PCIE_SERDES    0x00C00000
+#define E1000_CTRL_EXT_LINK_MODE_1000BASE_KX    0x00400000
+#define E1000_CTRL_EXT_LINK_MODE_SGMII  0x00800000
+#define E1000_CTRL_EXT_LINK_MODE_GMII   0x00000000
+#define E1000_CTRL_EXT_EIAME    0x01000000
+#define E1000_CTRL_EXT_IRCA             0x00000001
 /* Interrupt delay cancellation */
 /* Driver loaded bit for FW */
 #define E1000_CTRL_EXT_DRV_LOAD       0x10000000
@@ -62,6 +63,7 @@
 /* packet buffer parity error detection enabled */
 /* descriptor FIFO parity error detection enable */
 #define E1000_CTRL_EXT_PBA_CLR          0x80000000 /* PBA Clear */
+#define E1000_CTRL_EXT_PHYPDEN          0x00100000
 #define E1000_I2CCMD_REG_ADDR_SHIFT     16
 #define E1000_I2CCMD_PHY_ADDR_SHIFT     24
 #define E1000_I2CCMD_OPCODE_READ        0x08000000
diff --git a/drivers/net/ethernet/intel/igb/e1000_hw.h b/drivers/net/ethernet/intel/igb/e1000_hw.h
index 89925e405849..ce55ea5d750c 100644
--- a/drivers/net/ethernet/intel/igb/e1000_hw.h
+++ b/drivers/net/ethernet/intel/igb/e1000_hw.h
@@ -567,4 +567,7 @@ struct net_device *igb_get_hw_dev(struct e1000_hw *hw);
 /* These functions must be implemented by drivers */
 s32 igb_read_pcie_cap_reg(struct e1000_hw *hw, u32 reg, u16 *value);
 s32 igb_write_pcie_cap_reg(struct e1000_hw *hw, u32 reg, u16 *value);
+
+void igb_read_pci_cfg(struct e1000_hw *hw, u32 reg, u16 *value);
+void igb_write_pci_cfg(struct e1000_hw *hw, u32 reg, u16 *value);
 #endif /* _E1000_HW_H_ */
diff --git a/drivers/net/ethernet/intel/igb/e1000_i210.c b/drivers/net/ethernet/intel/igb/e1000_i210.c
index 337161f440dd..65d931669f81 100644
--- a/drivers/net/ethernet/intel/igb/e1000_i210.c
+++ b/drivers/net/ethernet/intel/igb/e1000_i210.c
@@ -834,3 +834,69 @@ s32 igb_init_nvm_params_i210(struct e1000_hw *hw)
         }
         return ret_val;
 }
+
+/**
+ * igb_pll_workaround_i210
+ * @hw: pointer to the HW structure
+ *
+ * Works around an errata in the PLL circuit where it occasionally
+ * provides the wrong clock frequency after power up.
+ **/
+s32 igb_pll_workaround_i210(struct e1000_hw *hw)
+{
+        s32 ret_val;
+        u32 wuc, mdicnfg, ctrl, ctrl_ext, reg_val;
+        u16 nvm_word, phy_word, pci_word, tmp_nvm;
+        int i;
+
+        /* Get and set needed register values */
+        wuc = rd32(E1000_WUC);
+        mdicnfg = rd32(E1000_MDICNFG);
+        reg_val = mdicnfg & ~E1000_MDICNFG_EXT_MDIO;
+        wr32(E1000_MDICNFG, reg_val);
+
+        /* Get data from NVM, or set default */
+        ret_val = igb_read_invm_word_i210(hw, E1000_INVM_AUTOLOAD,
+                                          &nvm_word);
+        if (ret_val)
+                nvm_word = E1000_INVM_DEFAULT_AL;
+        tmp_nvm = nvm_word | E1000_INVM_PLL_WO_VAL;
+        for (i = 0; i < E1000_MAX_PLL_TRIES; i++) {
+                /* check current state directly from internal PHY */
+                igb_read_phy_reg_gs40g(hw, (E1000_PHY_PLL_FREQ_PAGE |
+                                         E1000_PHY_PLL_FREQ_REG), &phy_word);
+                if ((phy_word & E1000_PHY_PLL_UNCONF)
+                    != E1000_PHY_PLL_UNCONF) {
+                        ret_val = 0;
+                        break;
+                } else {
+                        ret_val = -E1000_ERR_PHY;
+                }
+                /* directly reset the internal PHY */
+                ctrl = rd32(E1000_CTRL);
+                wr32(E1000_CTRL, ctrl|E1000_CTRL_PHY_RST);
+
+                ctrl_ext = rd32(E1000_CTRL_EXT);
+                ctrl_ext |= (E1000_CTRL_EXT_PHYPDEN | E1000_CTRL_EXT_SDLPE);
+                wr32(E1000_CTRL_EXT, ctrl_ext);
+
+                wr32(E1000_WUC, 0);
+                reg_val = (E1000_INVM_AUTOLOAD << 4) | (tmp_nvm << 16);
+                wr32(E1000_EEARBC_I210, reg_val);
+
+                igb_read_pci_cfg(hw, E1000_PCI_PMCSR, &pci_word);
+                pci_word |= E1000_PCI_PMCSR_D3;
+                igb_write_pci_cfg(hw, E1000_PCI_PMCSR, &pci_word);
+                usleep_range(1000, 2000);
+                pci_word &= ~E1000_PCI_PMCSR_D3;
+                igb_write_pci_cfg(hw, E1000_PCI_PMCSR, &pci_word);
+                reg_val = (E1000_INVM_AUTOLOAD << 4) | (nvm_word << 16);
+                wr32(E1000_EEARBC_I210, reg_val);
+
+                /* restore WUC register */
+                wr32(E1000_WUC, wuc);
+        }
+        /* restore MDICNFG setting */
+        wr32(E1000_MDICNFG, mdicnfg);
+        return ret_val;
+}
diff --git a/drivers/net/ethernet/intel/igb/e1000_i210.h b/drivers/net/ethernet/intel/igb/e1000_i210.h
index 9f34976687ba..3442b6357d01 100644
--- a/drivers/net/ethernet/intel/igb/e1000_i210.h
+++ b/drivers/net/ethernet/intel/igb/e1000_i210.h
@@ -33,6 +33,7 @@ s32 igb_read_xmdio_reg(struct e1000_hw *hw, u16 addr, u8 dev_addr, u16 *data);
 s32 igb_write_xmdio_reg(struct e1000_hw *hw, u16 addr, u8 dev_addr, u16 data);
 s32 igb_init_nvm_params_i210(struct e1000_hw *hw);
 bool igb_get_flash_presence_i210(struct e1000_hw *hw);
+s32 igb_pll_workaround_i210(struct e1000_hw *hw);
 
 #define E1000_STM_OPCODE                0xDB00
 #define E1000_EEPROM_FLASH_SIZE_WORD    0x11
@@ -78,4 +79,15 @@ enum E1000_INVM_STRUCTURE_TYPE {
 #define NVM_LED_1_CFG_DEFAULT_I211      0x0184
 #define NVM_LED_0_2_CFG_DEFAULT_I211    0x200C
 
+/* PLL Defines */
+#define E1000_PCI_PMCSR                 0x44
+#define E1000_PCI_PMCSR_D3              0x03
+#define E1000_MAX_PLL_TRIES             5
+#define E1000_PHY_PLL_UNCONF            0xFF
+#define E1000_PHY_PLL_FREQ_PAGE         0xFC0000
+#define E1000_PHY_PLL_FREQ_REG          0x000E
+#define E1000_INVM_DEFAULT_AL           0x202F
+#define E1000_INVM_AUTOLOAD             0x0A
+#define E1000_INVM_PLL_WO_VAL           0x0010
+
 #endif
diff --git a/drivers/net/ethernet/intel/igb/e1000_regs.h b/drivers/net/ethernet/intel/igb/e1000_regs.h
index 1cc4b1a7e597..f5ba4e4eafb9 100644
--- a/drivers/net/ethernet/intel/igb/e1000_regs.h
+++ b/drivers/net/ethernet/intel/igb/e1000_regs.h
@@ -66,6 +66,7 @@
 #define E1000_PBA      0x01000  /* Packet Buffer Allocation - RW */
 #define E1000_PBS      0x01008  /* Packet Buffer Size */
 #define E1000_EEMNGCTL 0x01010  /* MNG EEprom Control */
+#define E1000_EEARBC_I210 0x12024  /* EEPROM Auto Read Bus Control */
 #define E1000_EEWR     0x0102C  /* EEPROM Write Register - RW */
 #define E1000_I2CCMD   0x01028  /* SFPI2C Command Register - RW */
 #define E1000_FRTIMER  0x01048  /* Free Running Timer - RW */
diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
index f145adbb55ac..a9537ba7a5a0 100644
--- a/drivers/net/ethernet/intel/igb/igb_main.c
+++ b/drivers/net/ethernet/intel/igb/igb_main.c
@@ -7215,6 +7215,20 @@ static int igb_ioctl(struct net_device *netdev, struct ifreq *ifr, int cmd)
         }
 }
 
+void igb_read_pci_cfg(struct e1000_hw *hw, u32 reg, u16 *value)
+{
+        struct igb_adapter *adapter = hw->back;
+
+        pci_read_config_word(adapter->pdev, reg, value);
+}
+
+void igb_write_pci_cfg(struct e1000_hw *hw, u32 reg, u16 *value)
+{
+        struct igb_adapter *adapter = hw->back;
+
+        pci_write_config_word(adapter->pdev, reg, *value);
+}
+
 s32 igb_read_pcie_cap_reg(struct e1000_hw *hw, u32 reg, u16 *value)
 {
         struct igb_adapter *adapter = hw->back;
@@ -7578,6 +7592,8 @@ static int igb_sriov_reinit(struct pci_dev *dev)
 
         if (netif_running(netdev))
                 igb_close(netdev);
+        else
+                igb_reset(adapter);
 
         igb_clear_interrupt_scheme(adapter);
 
diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
index 45beca17fa50..dadd9a5f6323 100644
--- a/drivers/net/ethernet/marvell/mvneta.c
+++ b/drivers/net/ethernet/marvell/mvneta.c
@@ -1207,7 +1207,7 @@ static u32 mvneta_txq_desc_csum(int l3_offs, int l3_proto,
         command =  l3_offs    << MVNETA_TX_L3_OFF_SHIFT;
         command |= ip_hdr_len << MVNETA_TX_IP_HLEN_SHIFT;
 
-        if (l3_proto == swab16(ETH_P_IP))
+        if (l3_proto == htons(ETH_P_IP))
                 command |= MVNETA_TXD_IP_CSUM;
         else
                 command |= MVNETA_TX_L3_IP6;
@@ -2529,7 +2529,7 @@ static void mvneta_adjust_link(struct net_device *ndev)
 
                         if (phydev->speed == SPEED_1000)
                                 val |= MVNETA_GMAC_CONFIG_GMII_SPEED;
-                        else
+                        else if (phydev->speed == SPEED_100)
                                 val |= MVNETA_GMAC_CONFIG_MII_SPEED;
 
                         mvreg_write(pp, MVNETA_GMAC_AUTONEG_CONFIG, val);
diff --git a/drivers/net/ethernet/marvell/skge.c b/drivers/net/ethernet/marvell/skge.c
index 7f81ae66cc89..e912b6887d40 100644
--- a/drivers/net/ethernet/marvell/skge.c
+++ b/drivers/net/ethernet/marvell/skge.c
@@ -4199,6 +4199,13 @@ static struct dmi_system_id skge_32bit_dma_boards[] = {
                         DMI_MATCH(DMI_BOARD_NAME, "P5NSLI")
                 },
         },
+        {
+                .ident = "FUJITSU SIEMENS A8NE-FM",
+                .matches = {
+                        DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTek Computer INC."),
+                        DMI_MATCH(DMI_BOARD_NAME, "A8NE-FM")
+                },
+        },
         {}
 };
 
diff --git a/drivers/net/ethernet/mellanox/mlx4/cq.c b/drivers/net/ethernet/mellanox/mlx4/cq.c
index 80f725228f5b..56022d647837 100644
--- a/drivers/net/ethernet/mellanox/mlx4/cq.c
+++ b/drivers/net/ethernet/mellanox/mlx4/cq.c
@@ -294,8 +294,6 @@ int mlx4_cq_alloc(struct mlx4_dev *dev, int nent,
         init_completion(&cq->free);
 
         cq->irq = priv->eq_table.eq[cq->vector].irq;
-        cq->irq_affinity_change = false;
-
         return 0;
 
 err_radix:
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_cq.c b/drivers/net/ethernet/mellanox/mlx4/en_cq.c
index 4b2130760eed..14c00048bbec 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_cq.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_cq.c
@@ -128,6 +128,10 @@ int mlx4_en_activate_cq(struct mlx4_en_priv *priv, struct mlx4_en_cq *cq,
                                         mlx4_warn(mdev, "Failed assigning an EQ to %s, falling back to legacy EQ's\n",
                                                   name);
                                 }
+
+                                cq->irq_desc =
+                                        irq_to_desc(mlx4_eq_get_irq(mdev->dev,
+                                                                    cq->vector));
                         }
                 } else {
                         cq->vector = (cq->ring + 1 + priv->port) %
@@ -187,8 +191,6 @@ void mlx4_en_destroy_cq(struct mlx4_en_priv *priv, struct mlx4_en_cq **pcq)
         mlx4_en_unmap_buffer(&cq->wqres.buf);
         mlx4_free_hwq_res(mdev->dev, &cq->wqres, cq->buf_size);
         if (priv->mdev->dev->caps.comp_pool && cq->vector) {
-                if (!cq->is_tx)
-                        irq_set_affinity_hint(cq->mcq.irq, NULL);
                 mlx4_release_eq(priv->mdev->dev, cq->vector);
         }
         cq->vector = 0;
@@ -204,6 +206,7 @@ void mlx4_en_deactivate_cq(struct mlx4_en_priv *priv, struct mlx4_en_cq *cq)
         if (!cq->is_tx) {
                 napi_hash_del(&cq->napi);
                 synchronize_rcu();
+                irq_set_affinity_hint(cq->mcq.irq, NULL);
         }
         netif_napi_del(&cq->napi);
 
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
index fa1a069e14e6..68d763d2d030 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
@@ -417,6 +417,8 @@ static int mlx4_en_get_coalesce(struct net_device *dev,
 
         coal->tx_coalesce_usecs = priv->tx_usecs;
         coal->tx_max_coalesced_frames = priv->tx_frames;
+        coal->tx_max_coalesced_frames_irq = priv->tx_work_limit;
+
         coal->rx_coalesce_usecs = priv->rx_usecs;
         coal->rx_max_coalesced_frames = priv->rx_frames;
 
@@ -426,6 +428,7 @@ static int mlx4_en_get_coalesce(struct net_device *dev,
         coal->rx_coalesce_usecs_high = priv->rx_usecs_high;
         coal->rate_sample_interval = priv->sample_interval;
         coal->use_adaptive_rx_coalesce = priv->adaptive_rx_coal;
+
         return 0;
 }
 
@@ -434,6 +437,9 @@ static int mlx4_en_set_coalesce(struct net_device *dev,
 {
         struct mlx4_en_priv *priv = netdev_priv(dev);
 
+        if (!coal->tx_max_coalesced_frames_irq)
+                return -EINVAL;
+
         priv->rx_frames = (coal->rx_max_coalesced_frames ==
                            MLX4_EN_AUTO_CONF) ?
                                 MLX4_EN_RX_COAL_TARGET :
@@ -457,6 +463,7 @@ static int mlx4_en_set_coalesce(struct net_device *dev,
         priv->rx_usecs_high = coal->rx_coalesce_usecs_high;
         priv->sample_interval = coal->rate_sample_interval;
         priv->adaptive_rx_coal = coal->use_adaptive_rx_coalesce;
+        priv->tx_work_limit = coal->tx_max_coalesced_frames_irq;
 
         return mlx4_en_moderation_update(priv);
 }
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
index 7d4fb7bf2593..7345c43b019e 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
@@ -2336,7 +2336,7 @@ static void mlx4_en_add_vxlan_port(struct  net_device *dev,
         struct mlx4_en_priv *priv = netdev_priv(dev);
         __be16 current_port;
 
-        if (!(priv->mdev->dev->caps.flags2 & MLX4_DEV_CAP_FLAG2_VXLAN_OFFLOADS))
+        if (priv->mdev->dev->caps.tunnel_offload_mode != MLX4_TUNNEL_OFFLOAD_MODE_VXLAN)
                 return;
 
         if (sa_family == AF_INET6)
@@ -2473,6 +2473,7 @@ int mlx4_en_init_netdev(struct mlx4_en_dev *mdev, int port,
                         MLX4_WQE_CTRL_SOLICITED);
         priv->num_tx_rings_p_up = mdev->profile.num_tx_rings_p_up;
         priv->tx_ring_num = prof->tx_ring_num;
+        priv->tx_work_limit = MLX4_EN_DEFAULT_TX_WORK;
 
         priv->tx_ring = kzalloc(sizeof(struct mlx4_en_tx_ring *) * MAX_TX_RINGS,
                                 GFP_KERNEL);
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_rx.c b/drivers/net/ethernet/mellanox/mlx4/en_rx.c
index d2d415732d99..5535862f27cc 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_rx.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_rx.c
@@ -40,6 +40,7 @@
 #include <linux/if_ether.h>
 #include <linux/if_vlan.h>
 #include <linux/vmalloc.h>
+#include <linux/irq.h>
 
 #include "mlx4_en.h"
 
@@ -782,6 +783,7 @@ int mlx4_en_process_rx_cq(struct net_device *dev, struct mlx4_en_cq *cq, int bud
                                                              PKT_HASH_TYPE_L3);
 
                                         skb_record_rx_queue(gro_skb, cq->ring);
+                                        skb_mark_napi_id(gro_skb, &cq->napi);
 
                                         if (ring->hwtstamp_rx_filter == HWTSTAMP_FILTER_ALL) {
                                                 timestamp = mlx4_en_get_cqe_ts(cqe);
@@ -896,16 +898,25 @@ int mlx4_en_poll_rx_cq(struct napi_struct *napi, int budget)
 
         /* If we used up all the quota - we're probably not done yet... */
         if (done == budget) {
+                int cpu_curr;
+                const struct cpumask *aff;
+
                 INC_PERF_COUNTER(priv->pstats.napi_quota);
-                if (unlikely(cq->mcq.irq_affinity_change)) {
-                        cq->mcq.irq_affinity_change = false;
+
+                cpu_curr = smp_processor_id();
+                aff = irq_desc_get_irq_data(cq->irq_desc)->affinity;
+
+                if (unlikely(!cpumask_test_cpu(cpu_curr, aff))) {
+                        /* Current cpu is not according to smp_irq_affinity -
+                         * probably affinity changed. need to stop this NAPI
+                         * poll, and restart it on the right CPU
+                         */
                         napi_complete(napi);
                         mlx4_en_arm_cq(priv, cq);
                         return 0;
                 }
         } else {
                 /* Done for now */
-                cq->mcq.irq_affinity_change = false;
                 napi_complete(napi);
                 mlx4_en_arm_cq(priv, cq);
         }
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_tx.c b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
index 8be7483f8236..5045bab59633 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_tx.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
@@ -351,9 +351,8 @@ int mlx4_en_free_tx_buf(struct net_device *dev, struct mlx4_en_tx_ring *ring)
         return cnt;
 }
 
-static int mlx4_en_process_tx_cq(struct net_device *dev,
-                                 struct mlx4_en_cq *cq,
-                                 int budget)
+static bool mlx4_en_process_tx_cq(struct net_device *dev,
+                                 struct mlx4_en_cq *cq)
 {
         struct mlx4_en_priv *priv = netdev_priv(dev);
         struct mlx4_cq *mcq = &cq->mcq;
@@ -372,9 +371,10 @@ static int mlx4_en_process_tx_cq(struct net_device *dev,
         int factor = priv->cqe_factor;
         u64 timestamp = 0;
         int done = 0;
+        int budget = priv->tx_work_limit;
 
         if (!priv->port_up)
-                return 0;
+                return true;
 
         index = cons_index & size_mask;
         cqe = &buf[(index << factor) + factor];
@@ -447,7 +447,7 @@ static int mlx4_en_process_tx_cq(struct net_device *dev,
                 netif_tx_wake_queue(ring->tx_queue);
                 ring->wake_queue++;
         }
-        return done;
+        return done < budget;
 }
 
 void mlx4_en_tx_irq(struct mlx4_cq *mcq)
@@ -467,24 +467,16 @@ int mlx4_en_poll_tx_cq(struct napi_struct *napi, int budget)
         struct mlx4_en_cq *cq = container_of(napi, struct mlx4_en_cq, napi);
         struct net_device *dev = cq->dev;
         struct mlx4_en_priv *priv = netdev_priv(dev);
-        int done;
+        int clean_complete;
 
-        done = mlx4_en_process_tx_cq(dev, cq, budget);
+        clean_complete = mlx4_en_process_tx_cq(dev, cq);
+        if (!clean_complete)
+                return budget;
 
-        /* If we used up all the quota - we're probably not done yet... */
-        if (done < budget) {
-                /* Done for now */
-                cq->mcq.irq_affinity_change = false;
-                napi_complete(napi);
-                mlx4_en_arm_cq(priv, cq);
-                return done;
-        } else if (unlikely(cq->mcq.irq_affinity_change)) {
-                cq->mcq.irq_affinity_change = false;
-                napi_complete(napi);
-                mlx4_en_arm_cq(priv, cq);
-                return 0;
-        }
-        return budget;
+        napi_complete(napi);
+        mlx4_en_arm_cq(priv, cq);
+
+        return 0;
 }
 
 static struct mlx4_en_tx_desc *mlx4_en_bounce_to_desc(struct mlx4_en_priv *priv,
diff --git a/drivers/net/ethernet/mellanox/mlx4/eq.c b/drivers/net/ethernet/mellanox/mlx4/eq.c
index d954ec1eac17..2a004b347e1d 100644
--- a/drivers/net/ethernet/mellanox/mlx4/eq.c
+++ b/drivers/net/ethernet/mellanox/mlx4/eq.c
@@ -53,11 +53,6 @@ enum {
         MLX4_EQ_ENTRY_SIZE      = 0x20
 };
 
-struct mlx4_irq_notify {
-        void *arg;
-        struct irq_affinity_notify notify;
-};
-
 #define MLX4_EQ_STATUS_OK          ( 0 << 28)
 #define MLX4_EQ_STATUS_WRITE_FAIL  (10 << 28)
 #define MLX4_EQ_OWNER_SW           ( 0 << 24)
@@ -1088,57 +1083,6 @@ static void mlx4_unmap_clr_int(struct mlx4_dev *dev)
         iounmap(priv->clr_base);
 }
 
-static void mlx4_irq_notifier_notify(struct irq_affinity_notify *notify,
-                                     const cpumask_t *mask)
-{
-        struct mlx4_irq_notify *n = container_of(notify,
-                                                 struct mlx4_irq_notify,
-                                                 notify);
-        struct mlx4_priv *priv = (struct mlx4_priv *)n->arg;
-        struct radix_tree_iter iter;
-        void **slot;
-
-        radix_tree_for_each_slot(slot, &priv->cq_table.tree, &iter, 0) {
-                struct mlx4_cq *cq = (struct mlx4_cq *)(*slot);
-
-                if (cq->irq == notify->irq)
-                        cq->irq_affinity_change = true;
-        }
-}
-
-static void mlx4_release_irq_notifier(struct kref *ref)
-{
-        struct mlx4_irq_notify *n = container_of(ref, struct mlx4_irq_notify,
-                                                 notify.kref);
-        kfree(n);
-}
-
-static void mlx4_assign_irq_notifier(struct mlx4_priv *priv,
-                                     struct mlx4_dev *dev, int irq)
-{
-        struct mlx4_irq_notify *irq_notifier = NULL;
-        int err = 0;
-
-        irq_notifier = kzalloc(sizeof(*irq_notifier), GFP_KERNEL);
-        if (!irq_notifier) {
-                mlx4_warn(dev, "Failed to allocate irq notifier. irq %d\n",
-                          irq);
-                return;
-        }
-
-        irq_notifier->notify.irq = irq;
-        irq_notifier->notify.notify = mlx4_irq_notifier_notify;
-        irq_notifier->notify.release = mlx4_release_irq_notifier;
-        irq_notifier->arg = priv;
-        err = irq_set_affinity_notifier(irq, &irq_notifier->notify);
-        if (err) {
-                kfree(irq_notifier);
-                irq_notifier = NULL;
-                mlx4_warn(dev, "Failed to set irq notifier. irq %d\n", irq);
-        }
-}
-
-
 int mlx4_alloc_eq_table(struct mlx4_dev *dev)
 {
         struct mlx4_priv *priv = mlx4_priv(dev);
@@ -1409,8 +1353,6 @@ int mlx4_assign_eq(struct mlx4_dev *dev, char *name, struct cpu_rmap *rmap,
                                 continue;
                                 /*we dont want to break here*/
                         }
-                        mlx4_assign_irq_notifier(priv, dev,
-                                                 priv->eq_table.eq[vec].irq);
 
                         eq_set_ci(&priv->eq_table.eq[vec], 1);
                 }
@@ -1427,6 +1369,14 @@ int mlx4_assign_eq(struct mlx4_dev *dev, char *name, struct cpu_rmap *rmap,
 }
 EXPORT_SYMBOL(mlx4_assign_eq);
 
+int mlx4_eq_get_irq(struct mlx4_dev *dev, int vec)
+{
+        struct mlx4_priv *priv = mlx4_priv(dev);
+
+        return priv->eq_table.eq[vec].irq;
+}
+EXPORT_SYMBOL(mlx4_eq_get_irq);
+
 void mlx4_release_eq(struct mlx4_dev *dev, int vec)
 {
         struct mlx4_priv *priv = mlx4_priv(dev);
@@ -1438,9 +1388,6 @@ void mlx4_release_eq(struct mlx4_dev *dev, int vec)
                   Belonging to a legacy EQ*/
                 mutex_lock(&priv->msix_ctl.pool_lock);
                 if (priv->msix_ctl.pool_bm & 1ULL << i) {
-                        irq_set_affinity_notifier(
-                                priv->eq_table.eq[vec].irq,
-                                NULL);
                         free_irq(priv->eq_table.eq[vec].irq,
                                  &priv->eq_table.eq[vec]);
                         priv->msix_ctl.pool_bm &= ~(1ULL << i);
diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
index 5f42f6d6e4c6..82ab427290c3 100644
--- a/drivers/net/ethernet/mellanox/mlx4/main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/main.c
@@ -2439,7 +2439,8 @@ slave_start:
                             (num_vfs_argc > 1 || probe_vfs_argc > 1)) {
                                 mlx4_err(dev,
                                          "Invalid syntax of num_vfs/probe_vfs with IB port - single port VFs syntax is only supported when all ports are configured as ethernet\n");
-                                goto err_close;
+                                err = -EINVAL;
+                                goto err_master_mfunc;
                         }
                         for (i = 0; i < sizeof(nvfs)/sizeof(nvfs[0]); i++) {
                                 unsigned j;
diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
index 0e15295bedd6..d72a5a894fc6 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
+++ b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
@@ -126,6 +126,8 @@ enum {
 #define MAX_TX_RINGS                    (MLX4_EN_MAX_TX_RING_P_UP * \
                                          MLX4_EN_NUM_UP)
 
+#define MLX4_EN_DEFAULT_TX_WORK         256
+
 /* Target number of packets to coalesce with interrupt moderation */
 #define MLX4_EN_RX_COAL_TARGET  44
 #define MLX4_EN_RX_COAL_TIME    0x10
@@ -343,6 +345,7 @@ struct mlx4_en_cq {
 #define CQ_USER_PEND (MLX4_EN_CQ_STATE_POLL | MLX4_EN_CQ_STATE_POLL_YIELD)
         spinlock_t poll_lock; /* protects from LLS/napi conflicts */
 #endif  /* CONFIG_NET_RX_BUSY_POLL */
+        struct irq_desc *irq_desc;
 };
 
 struct mlx4_en_port_profile {
@@ -542,6 +545,7 @@ struct mlx4_en_priv {
         __be32 ctrl_flags;
         u32 flags;
         u8 num_tx_rings_p_up;
+        u32 tx_work_limit;
         u32 tx_ring_num;
         u32 rx_ring_num;
         u32 rx_skb_size;
diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
index be425ad5e824..06bdc31a828d 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -538,6 +538,7 @@ enum rtl_register_content {
         MagicPacket     = (1 << 5),     /* Wake up when receives a Magic Packet */
         LinkUp          = (1 << 4),     /* Wake up when the cable connection is re-established */
         Jumbo_En0       = (1 << 2),     /* 8168 only. Reserved in the 8168b */
+        Rdy_to_L23      = (1 << 1),     /* L23 Enable */
         Beacon_en       = (1 << 0),     /* 8168 only. Reserved in the 8168b */
 
         /* Config4 register */
@@ -4897,6 +4898,21 @@ static void rtl_enable_clock_request(struct pci_dev *pdev)
                                  PCI_EXP_LNKCTL_CLKREQ_EN);
 }
 
+static void rtl_pcie_state_l2l3_enable(struct rtl8169_private *tp, bool enable)
+{
+        void __iomem *ioaddr = tp->mmio_addr;
+        u8 data;
+
+        data = RTL_R8(Config3);
+
+        if (enable)
+                data |= Rdy_to_L23;
+        else
+                data &= ~Rdy_to_L23;
+
+        RTL_W8(Config3, data);
+}
+
 #define R8168_CPCMD_QUIRK_MASK (\
         EnableBist | \
         Mac_dbgo_oe | \
@@ -5246,6 +5262,7 @@ static void rtl_hw_start_8411(struct rtl8169_private *tp)
         };
 
         rtl_hw_start_8168f(tp);
+        rtl_pcie_state_l2l3_enable(tp, false);
 
         rtl_ephy_init(tp, e_info_8168f_1, ARRAY_SIZE(e_info_8168f_1));
 
@@ -5284,6 +5301,8 @@ static void rtl_hw_start_8168g_1(struct rtl8169_private *tp)
 
         rtl_w1w0_eri(tp, 0x2fc, ERIAR_MASK_0001, 0x01, 0x06, ERIAR_EXGMAC);
         rtl_w1w0_eri(tp, 0x1b0, ERIAR_MASK_0011, 0x0000, 0x1000, ERIAR_EXGMAC);
+
+        rtl_pcie_state_l2l3_enable(tp, false);
 }
 
 static void rtl_hw_start_8168g_2(struct rtl8169_private *tp)
@@ -5536,6 +5555,8 @@ static void rtl_hw_start_8105e_1(struct rtl8169_private *tp)
         RTL_W8(DLLPR, RTL_R8(DLLPR) | PFM_EN);
 
         rtl_ephy_init(tp, e_info_8105e_1, ARRAY_SIZE(e_info_8105e_1));
+
+        rtl_pcie_state_l2l3_enable(tp, false);
 }
 
 static void rtl_hw_start_8105e_2(struct rtl8169_private *tp)
@@ -5571,6 +5592,8 @@ static void rtl_hw_start_8402(struct rtl8169_private *tp)
         rtl_eri_write(tp, 0xc0, ERIAR_MASK_0011, 0x0000, ERIAR_EXGMAC);
         rtl_eri_write(tp, 0xb8, ERIAR_MASK_0011, 0x0000, ERIAR_EXGMAC);
         rtl_w1w0_eri(tp, 0x0d4, ERIAR_MASK_0011, 0x0e00, 0xff00, ERIAR_EXGMAC);
+
+        rtl_pcie_state_l2l3_enable(tp, false);
 }
 
 static void rtl_hw_start_8106(struct rtl8169_private *tp)
@@ -5583,6 +5606,8 @@ static void rtl_hw_start_8106(struct rtl8169_private *tp)
         RTL_W32(MISC, (RTL_R32(MISC) | DISABLE_LAN_EN) & ~EARLY_TALLY_EN);
         RTL_W8(MCU, RTL_R8(MCU) | EN_NDP | EN_OOB_RESET);
         RTL_W8(DLLPR, RTL_R8(DLLPR) & ~PFM_EN);
+
+        rtl_pcie_state_l2l3_enable(tp, false);
 }
 
 static void rtl_hw_start_8101(struct net_device *dev)
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c b/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c
index b3e148ef5683..9d3748361a1e 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c
@@ -320,11 +320,8 @@ static void dwmac1000_set_eee_timer(void __iomem *ioaddr, int ls, int tw)
 
 static void dwmac1000_ctrl_ane(void __iomem *ioaddr, bool restart)
 {
-        u32 value;
-
-        value = readl(ioaddr + GMAC_AN_CTRL);
         /* auto negotiation enable and External Loopback enable */
-        value = GMAC_AN_CTRL_ANE | GMAC_AN_CTRL_ELE;
+        u32 value = GMAC_AN_CTRL_ANE | GMAC_AN_CTRL_ELE;
 
         if (restart)
                 value |= GMAC_AN_CTRL_RAN;
diff --git a/drivers/net/ethernet/stmicro/stmmac/enh_desc.c b/drivers/net/ethernet/stmicro/stmmac/enh_desc.c
index 7e6628a91514..1e2bcf5f89e1 100644
--- a/drivers/net/ethernet/stmicro/stmmac/enh_desc.c
+++ b/drivers/net/ethernet/stmicro/stmmac/enh_desc.c
@@ -145,7 +145,7 @@ static void enh_desc_get_ext_status(void *data, struct stmmac_extra_stats *x,
                         x->rx_msg_type_delay_req++;
                 else if (p->des4.erx.msg_type == RDES_EXT_DELAY_RESP)
                         x->rx_msg_type_delay_resp++;
-                else if (p->des4.erx.msg_type == RDES_EXT_DELAY_REQ)
+                else if (p->des4.erx.msg_type == RDES_EXT_PDELAY_REQ)
                         x->rx_msg_type_pdelay_req++;
                 else if (p->des4.erx.msg_type == RDES_EXT_PDELAY_RESP)
                         x->rx_msg_type_pdelay_resp++;
diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
index ff380dac6629..b988d16cd34e 100644
--- a/drivers/net/ethernet/ti/cpsw.c
+++ b/drivers/net/ethernet/ti/cpsw.c
@@ -1212,7 +1212,12 @@ static int cpsw_ndo_open(struct net_device *ndev)
         for_each_slave(priv, cpsw_slave_open, priv);
 
         /* Add default VLAN */
-        cpsw_add_default_vlan(priv);
+        if (!priv->data.dual_emac)
+                cpsw_add_default_vlan(priv);
+        else
+                cpsw_ale_add_vlan(priv->ale, priv->data.default_vlan,
+                                  ALE_ALL_PORTS << priv->host_port,
+                                  ALE_ALL_PORTS << priv->host_port, 0, 0);
 
         if (!cpsw_common_res_usage_state(priv)) {
                 /* setup tx dma to fixed prio and zero offset */
diff --git a/drivers/net/ethernet/tile/tilegx.c b/drivers/net/ethernet/tile/tilegx.c
index 14389f841d43..4c70360967c2 100644
--- a/drivers/net/ethernet/tile/tilegx.c
+++ b/drivers/net/ethernet/tile/tilegx.c
@@ -2191,7 +2191,6 @@ static void tile_net_setup(struct net_device *dev)
 static void tile_net_dev_init(const char *name, const uint8_t *mac)
 {
         int ret;
-        int i;
         struct net_device *dev;
         struct tile_net_priv *priv;
 
diff --git a/drivers/net/fddi/defxx.c b/drivers/net/fddi/defxx.c
index eb78203cd58e..2aa57270838f 100644
--- a/drivers/net/fddi/defxx.c
+++ b/drivers/net/fddi/defxx.c
@@ -291,7 +291,11 @@ static int		dfx_hw_dma_uninit(DFX_board_t *bp, PI_UINT32 type);
 
 static int              dfx_rcv_init(DFX_board_t *bp, int get_buffers);
 static void             dfx_rcv_queue_process(DFX_board_t *bp);
+#ifdef DYNAMIC_BUFFERS
 static void             dfx_rcv_flush(DFX_board_t *bp);
+#else
+static inline void      dfx_rcv_flush(DFX_board_t *bp) {}
+#endif
 
 static netdev_tx_t dfx_xmt_queue_pkt(struct sk_buff *skb,
                                      struct net_device *dev);
@@ -2849,7 +2853,7 @@ static int dfx_hw_dma_uninit(DFX_board_t *bp, PI_UINT32 type)
  *      Align an sk_buff to a boundary power of 2
  *
  */
-
+#ifdef DYNAMIC_BUFFERS
 static void my_skb_align(struct sk_buff *skb, int n)
 {
         unsigned long x = (unsigned long)skb->data;
@@ -2859,7 +2863,7 @@ static void my_skb_align(struct sk_buff *skb, int n)
 
         skb_reserve(skb, v - x);
 }
-
+#endif
 
 /*
  * ================
@@ -3074,10 +3078,7 @@ static void dfx_rcv_queue_process(
                                         break;
                                         }
                                 else {
-#ifndef DYNAMIC_BUFFERS
-                                        if (! rx_in_place)
-#endif
-                                        {
+                                        if (!rx_in_place) {
                                                 /* Receive buffer allocated, pass receive packet up */
 
                                                 skb_copy_to_linear_data(skb,
@@ -3453,10 +3454,6 @@ static void dfx_rcv_flush( DFX_board_t *bp )
                 }
 
         }
-#else
-static inline void dfx_rcv_flush( DFX_board_t *bp )
-{
-}
 #endif /* DYNAMIC_BUFFERS */
 
 /*
diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c
index c041f63a6d30..4ed38eaecea8 100644
--- a/drivers/net/hyperv/netvsc.c
+++ b/drivers/net/hyperv/netvsc.c
@@ -189,7 +189,7 @@ static int netvsc_destroy_buf(struct netvsc_device *net_device)
                                    "unable to teardown send buffer's gpadl\n");
                         return ret;
                 }
-                net_device->recv_buf_gpadl_handle = 0;
+                net_device->send_buf_gpadl_handle = 0;
         }
         if (net_device->send_buf) {
                 /* Free up the receive buffer */
diff --git a/drivers/net/ieee802154/at86rf230.c b/drivers/net/ieee802154/at86rf230.c
index 4517b149ed07..50899416f668 100644
--- a/drivers/net/ieee802154/at86rf230.c
+++ b/drivers/net/ieee802154/at86rf230.c
@@ -1137,6 +1137,8 @@ static int at86rf230_probe(struct spi_device *spi)
         dev->flags = IEEE802154_HW_OMIT_CKSUM | IEEE802154_HW_AACK;
 
         irq_type = irq_get_trigger_type(spi->irq);
+        if (!irq_type)
+                irq_type = IRQF_TRIGGER_RISING;
         if (irq_type & (IRQF_TRIGGER_RISING | IRQF_TRIGGER_FALLING)) {
                 irq_worker = at86rf230_irqwork;
                 irq_handler = at86rf230_isr;
@@ -1168,7 +1170,8 @@ static int at86rf230_probe(struct spi_device *spi)
         if (rc)
                 goto err_hw_init;
 
-        rc = devm_request_irq(&spi->dev, spi->irq, irq_handler, IRQF_SHARED,
+        rc = devm_request_irq(&spi->dev, spi->irq, irq_handler,
+                              IRQF_SHARED | irq_type,
                               dev_name(&spi->dev), lp);
         if (rc)
                 goto err_hw_init;
diff --git a/drivers/net/phy/at803x.c b/drivers/net/phy/at803x.c
index 6c622aedbae1..fdc1b418fa6a 100644
--- a/drivers/net/phy/at803x.c
+++ b/drivers/net/phy/at803x.c
@@ -16,9 +16,13 @@
 #include <linux/string.h>
 #include <linux/netdevice.h>
 #include <linux/etherdevice.h>
+#include <linux/of_gpio.h>
+#include <linux/gpio/consumer.h>
 
 #define AT803X_INTR_ENABLE                      0x12
 #define AT803X_INTR_STATUS                      0x13
+#define AT803X_SMART_SPEED                      0x14
+#define AT803X_LED_CONTROL                      0x18
 #define AT803X_WOL_ENABLE                       0x01
 #define AT803X_DEVICE_ADDR                      0x03
 #define AT803X_LOC_MAC_ADDR_0_15_OFFSET         0x804C
@@ -35,10 +39,52 @@
 #define AT803X_DEBUG_SYSTEM_MODE_CTRL           0x05
 #define AT803X_DEBUG_RGMII_TX_CLK_DLY           BIT(8)
 
+#define ATH8030_PHY_ID 0x004dd076
+#define ATH8031_PHY_ID 0x004dd074
+#define ATH8035_PHY_ID 0x004dd072
+
 MODULE_DESCRIPTION("Atheros 803x PHY driver");
 MODULE_AUTHOR("Matus Ujhelyi");
 MODULE_LICENSE("GPL");
 
+struct at803x_priv {
+        bool phy_reset:1;
+        struct gpio_desc *gpiod_reset;
+};
+
+struct at803x_context {
+        u16 bmcr;
+        u16 advertise;
+        u16 control1000;
+        u16 int_enable;
+        u16 smart_speed;
+        u16 led_control;
+};
+
+/* save relevant PHY registers to private copy */
+static void at803x_context_save(struct phy_device *phydev,
+                                struct at803x_context *context)
+{
+        context->bmcr = phy_read(phydev, MII_BMCR);
+        context->advertise = phy_read(phydev, MII_ADVERTISE);
+        context->control1000 = phy_read(phydev, MII_CTRL1000);
+        context->int_enable = phy_read(phydev, AT803X_INTR_ENABLE);
+        context->smart_speed = phy_read(phydev, AT803X_SMART_SPEED);
+        context->led_control = phy_read(phydev, AT803X_LED_CONTROL);
+}
+
+/* restore relevant PHY registers from private copy */
+static void at803x_context_restore(struct phy_device *phydev,
+                                   const struct at803x_context *context)
+{
+        phy_write(phydev, MII_BMCR, context->bmcr);
+        phy_write(phydev, MII_ADVERTISE, context->advertise);
+        phy_write(phydev, MII_CTRL1000, context->control1000);
+        phy_write(phydev, AT803X_INTR_ENABLE, context->int_enable);
+        phy_write(phydev, AT803X_SMART_SPEED, context->smart_speed);
+        phy_write(phydev, AT803X_LED_CONTROL, context->led_control);
+}
+
 static int at803x_set_wol(struct phy_device *phydev,
                           struct ethtool_wolinfo *wol)
 {
@@ -142,6 +188,26 @@ static int at803x_resume(struct phy_device *phydev)
         return 0;
 }
 
+static int at803x_probe(struct phy_device *phydev)
+{
+        struct device *dev = &phydev->dev;
+        struct at803x_priv *priv;
+
+        priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
+        if (!priv)
+                return -ENOMEM;
+
+        priv->gpiod_reset = devm_gpiod_get(dev, "reset");
+        if (IS_ERR(priv->gpiod_reset))
+                priv->gpiod_reset = NULL;
+        else
+                gpiod_direction_output(priv->gpiod_reset, 1);
+
+        phydev->priv = priv;
+
+        return 0;
+}
+
 static int at803x_config_init(struct phy_device *phydev)
 {
         int ret;
@@ -189,58 +255,99 @@ static int at803x_config_intr(struct phy_device *phydev)
         return err;
 }
 
+static void at803x_link_change_notify(struct phy_device *phydev)
+{
+        struct at803x_priv *priv = phydev->priv;
+
+        /*
+         * Conduct a hardware reset for AT8030 every time a link loss is
+         * signalled. This is necessary to circumvent a hardware bug that
+         * occurs when the cable is unplugged while TX packets are pending
+         * in the FIFO. In such cases, the FIFO enters an error mode it
+         * cannot recover from by software.
+         */
+        if (phydev->drv->phy_id == ATH8030_PHY_ID) {
+                if (phydev->state == PHY_NOLINK) {
+                        if (priv->gpiod_reset && !priv->phy_reset) {
+                                struct at803x_context context;
+
+                                at803x_context_save(phydev, &context);
+
+                                gpiod_set_value(priv->gpiod_reset, 0);
+                                msleep(1);
+                                gpiod_set_value(priv->gpiod_reset, 1);
+                                msleep(1);
+
+                                at803x_context_restore(phydev, &context);
+
+                                dev_dbg(&phydev->dev, "%s(): phy was reset\n",
+                                        __func__);
+                                priv->phy_reset = true;
+                        }
+                } else {
+                        priv->phy_reset = false;
+                }
+        }
+}
+
 static struct phy_driver at803x_driver[] = {
 {
         /* ATHEROS 8035 */
-        .phy_id         = 0x004dd072,
-        .name           = "Atheros 8035 ethernet",
-        .phy_id_mask    = 0xffffffef,
-        .config_init    = at803x_config_init,
-        .set_wol        = at803x_set_wol,
-        .get_wol        = at803x_get_wol,
-        .suspend        = at803x_suspend,
-        .resume         = at803x_resume,
-        .features       = PHY_GBIT_FEATURES,
-        .flags          = PHY_HAS_INTERRUPT,
-        .config_aneg    = genphy_config_aneg,
-        .read_status    = genphy_read_status,
-        .driver         = {
+        .phy_id                 = ATH8035_PHY_ID,
+        .name                   = "Atheros 8035 ethernet",
+        .phy_id_mask            = 0xffffffef,
+        .probe                  = at803x_probe,
+        .config_init            = at803x_config_init,
+        .link_change_notify     = at803x_link_change_notify,
+        .set_wol                = at803x_set_wol,
+        .get_wol                = at803x_get_wol,
+        .suspend                = at803x_suspend,
+        .resume                 = at803x_resume,
+        .features               = PHY_GBIT_FEATURES,
+        .flags                  = PHY_HAS_INTERRUPT,
+        .config_aneg            = genphy_config_aneg,
+        .read_status            = genphy_read_status,
+        .driver                 = {
                 .owner = THIS_MODULE,
         },
 }, {
         /* ATHEROS 8030 */
-        .phy_id         = 0x004dd076,
-        .name           = "Atheros 8030 ethernet",
-        .phy_id_mask    = 0xffffffef,
-        .config_init    = at803x_config_init,
-        .set_wol        = at803x_set_wol,
-        .get_wol        = at803x_get_wol,
-        .suspend        = at803x_suspend,
-        .resume         = at803x_resume,
-        .features       = PHY_GBIT_FEATURES,
-        .flags          = PHY_HAS_INTERRUPT,
-        .config_aneg    = genphy_config_aneg,
-        .read_status    = genphy_read_status,
-        .driver         = {
+        .phy_id                 = ATH8030_PHY_ID,
+        .name                   = "Atheros 8030 ethernet",
+        .phy_id_mask            = 0xffffffef,
+        .probe                  = at803x_probe,
+        .config_init            = at803x_config_init,
+        .link_change_notify     = at803x_link_change_notify,
+        .set_wol                = at803x_set_wol,
+        .get_wol                = at803x_get_wol,
+        .suspend                = at803x_suspend,
+        .resume                 = at803x_resume,
+        .features               = PHY_GBIT_FEATURES,
+        .flags                  = PHY_HAS_INTERRUPT,
+        .config_aneg            = genphy_config_aneg,
+        .read_status            = genphy_read_status,
+        .driver                 = {
                 .owner = THIS_MODULE,
         },
 }, {
         /* ATHEROS 8031 */
-        .phy_id         = 0x004dd074,
-        .name           = "Atheros 8031 ethernet",
-        .phy_id_mask    = 0xffffffef,
-        .config_init    = at803x_config_init,
-        .set_wol        = at803x_set_wol,
-        .get_wol        = at803x_get_wol,
-        .suspend        = at803x_suspend,
-        .resume         = at803x_resume,
-        .features       = PHY_GBIT_FEATURES,
-        .flags          = PHY_HAS_INTERRUPT,
-        .config_aneg    = genphy_config_aneg,
-        .read_status    = genphy_read_status,
-        .ack_interrupt  = &at803x_ack_interrupt,
-        .config_intr    = &at803x_config_intr,
-        .driver         = {
+        .phy_id                 = ATH8031_PHY_ID,
+        .name                   = "Atheros 8031 ethernet",
+        .phy_id_mask            = 0xffffffef,
+        .probe                  = at803x_probe,
+        .config_init            = at803x_config_init,
+        .link_change_notify     = at803x_link_change_notify,
+        .set_wol                = at803x_set_wol,
+        .get_wol                = at803x_get_wol,
+        .suspend                = at803x_suspend,
+        .resume                 = at803x_resume,
+        .features               = PHY_GBIT_FEATURES,
+        .flags                  = PHY_HAS_INTERRUPT,
+        .config_aneg            = genphy_config_aneg,
+        .read_status            = genphy_read_status,
+        .ack_interrupt          = &at803x_ack_interrupt,
+        .config_intr            = &at803x_config_intr,
+        .driver                 = {
                 .owner = THIS_MODULE,
         },
 } };
@@ -260,9 +367,9 @@ module_init(atheros_init);
 module_exit(atheros_exit);
 
 static struct mdio_device_id __maybe_unused atheros_tbl[] = {
-        { 0x004dd076, 0xffffffef },
-        { 0x004dd074, 0xffffffef },
-        { 0x004dd072, 0xffffffef },
+        { ATH8030_PHY_ID, 0xffffffef },
+        { ATH8031_PHY_ID, 0xffffffef },
+        { ATH8035_PHY_ID, 0xffffffef },
         { }
 };
 
diff --git a/drivers/net/phy/dp83640.c b/drivers/net/phy/dp83640.c
index 6a999e6814a0..9408157a246c 100644
--- a/drivers/net/phy/dp83640.c
+++ b/drivers/net/phy/dp83640.c
@@ -1323,15 +1323,15 @@ static bool dp83640_rxtstamp(struct phy_device *phydev,
 {
         struct dp83640_private *dp83640 = phydev->priv;
 
-        if (!dp83640->hwts_rx_en)
-                return false;
-
         if (is_status_frame(skb, type)) {
                 decode_status_frame(dp83640, skb);
                 kfree_skb(skb);
                 return true;
         }
 
+        if (!dp83640->hwts_rx_en)
+                return false;
+
         SKB_PTP_TYPE(skb) = type;
         skb_queue_tail(&dp83640->rx_queue, skb);
         schedule_work(&dp83640->ts_work);
diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c
index 2e58aa54484c..4eaadcfcb0fe 100644
--- a/drivers/net/phy/mdio_bus.c
+++ b/drivers/net/phy/mdio_bus.c
@@ -187,6 +187,50 @@ struct mii_bus *of_mdio_find_bus(struct device_node *mdio_bus_np)
         return d ? to_mii_bus(d) : NULL;
 }
 EXPORT_SYMBOL(of_mdio_find_bus);
+
+/* Walk the list of subnodes of a mdio bus and look for a node that matches the
+ * phy's address with its 'reg' property. If found, set the of_node pointer for
+ * the phy. This allows auto-probed pyh devices to be supplied with information
+ * passed in via DT.
+ */
+static void of_mdiobus_link_phydev(struct mii_bus *mdio,
+                                   struct phy_device *phydev)
+{
+        struct device *dev = &phydev->dev;
+        struct device_node *child;
+
+        if (dev->of_node || !mdio->dev.of_node)
+                return;
+
+        for_each_available_child_of_node(mdio->dev.of_node, child) {
+                int addr;
+                int ret;
+
+                ret = of_property_read_u32(child, "reg", &addr);
+                if (ret < 0) {
+                        dev_err(dev, "%s has invalid PHY address\n",
+                                child->full_name);
+                        continue;
+                }
+
+                /* A PHY must have a reg property in the range [0-31] */
+                if (addr >= PHY_MAX_ADDR) {
+                        dev_err(dev, "%s PHY address %i is too large\n",
+                                child->full_name, addr);
+                        continue;
+                }
+
+                if (addr == phydev->addr) {
+                        dev->of_node = child;
+                        return;
+                }
+        }
+}
+#else /* !IS_ENABLED(CONFIG_OF_MDIO) */
+static inline void of_mdiobus_link_phydev(struct mii_bus *mdio,
+                                          struct phy_device *phydev)
+{
+}
 #endif
 
 /**
diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
index 3bc079a67a3d..f7c61812ea4a 100644
--- a/drivers/net/phy/phy.c
+++ b/drivers/net/phy/phy.c
@@ -720,6 +720,9 @@ void phy_state_machine(struct work_struct *work)
 
         mutex_lock(&phydev->lock);
 
+        if (phydev->drv->link_change_notify)
+                phydev->drv->link_change_notify(phydev);
+
         switch (phydev->state) {
         case PHY_DOWN:
         case PHY_STARTING:
diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
index 91d6c1272fcf..e2f20f807de8 100644
--- a/drivers/net/ppp/ppp_generic.c
+++ b/drivers/net/ppp/ppp_generic.c
@@ -539,7 +539,7 @@ static int get_filter(void __user *arg, struct sock_filter **p)
 {
         struct sock_fprog uprog;
         struct sock_filter *code = NULL;
-        int len, err;
+        int len;
 
         if (copy_from_user(&uprog, arg, sizeof(uprog)))
                 return -EFAULT;
@@ -554,12 +554,6 @@ static int get_filter(void __user *arg, struct sock_filter **p)
         if (IS_ERR(code))
                 return PTR_ERR(code);
 
-        err = sk_chk_filter(code, uprog.len);
-        if (err) {
-                kfree(code);
-                return err;
-        }
-
         *p = code;
         return uprog.len;
 }
diff --git a/drivers/net/ppp/pppoe.c b/drivers/net/ppp/pppoe.c
index 2ea7efd11857..6c9c16d76935 100644
--- a/drivers/net/ppp/pppoe.c
+++ b/drivers/net/ppp/pppoe.c
@@ -675,7 +675,7 @@ static int pppoe_connect(struct socket *sock, struct sockaddr *uservaddr,
                 po->chan.hdrlen = (sizeof(struct pppoe_hdr) +
                                    dev->hard_header_len);
 
-                po->chan.mtu = dev->mtu - sizeof(struct pppoe_hdr);
+                po->chan.mtu = dev->mtu - sizeof(struct pppoe_hdr) - 2;
                 po->chan.private = sk;
                 po->chan.ops = &pppoe_chan_ops;
 
diff --git a/drivers/net/slip/slip.c b/drivers/net/slip/slip.c
index ad4a94e9ff57..87526443841f 100644
--- a/drivers/net/slip/slip.c
+++ b/drivers/net/slip/slip.c
@@ -83,6 +83,7 @@
 #include <linux/delay.h>
 #include <linux/init.h>
 #include <linux/slab.h>
+#include <linux/workqueue.h>
 #include "slip.h"
 #ifdef CONFIG_INET
 #include <linux/ip.h>
@@ -416,36 +417,46 @@ static void sl_encaps(struct slip *sl, unsigned char *icp, int len)
 #endif
 }
 
-/*
- * Called by the driver when there's room for more data.  If we have
- * more packets to send, we send them here.
- */
-static void slip_write_wakeup(struct tty_struct *tty)
+/* Write out any remaining transmit buffer. Scheduled when tty is writable */
+static void slip_transmit(struct work_struct *work)
 {
+        struct slip *sl = container_of(work, struct slip, tx_work);
         int actual;
-        struct slip *sl = tty->disc_data;
 
+        spin_lock_bh(&sl->lock);
         /* First make sure we're connected. */
-        if (!sl || sl->magic != SLIP_MAGIC || !netif_running(sl->dev))
+        if (!sl->tty || sl->magic != SLIP_MAGIC || !netif_running(sl->dev)) {
+                spin_unlock_bh(&sl->lock);
                 return;
+        }
 
-        spin_lock_bh(&sl->lock);
         if (sl->xleft <= 0)  {
                 /* Now serial buffer is almost free & we can start
                  * transmission of another packet */
                 sl->dev->stats.tx_packets++;
-                clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
+                clear_bit(TTY_DO_WRITE_WAKEUP, &sl->tty->flags);
                 spin_unlock_bh(&sl->lock);
                 sl_unlock(sl);
                 return;
         }
 
-        actual = tty->ops->write(tty, sl->xhead, sl->xleft);
+        actual = sl->tty->ops->write(sl->tty, sl->xhead, sl->xleft);
         sl->xleft -= actual;
         sl->xhead += actual;
         spin_unlock_bh(&sl->lock);
 }
 
+/*
+ * Called by the driver when there's room for more data.
+ * Schedule the transmit.
+ */
+static void slip_write_wakeup(struct tty_struct *tty)
+{
+        struct slip *sl = tty->disc_data;
+
+        schedule_work(&sl->tx_work);
+}
+
 static void sl_tx_timeout(struct net_device *dev)
 {
         struct slip *sl = netdev_priv(dev);
@@ -749,6 +760,7 @@ static struct slip *sl_alloc(dev_t line)
         sl->magic       = SLIP_MAGIC;
         sl->dev         = dev;
         spin_lock_init(&sl->lock);
+        INIT_WORK(&sl->tx_work, slip_transmit);
         sl->mode        = SL_MODE_DEFAULT;
 #ifdef CONFIG_SLIP_SMART
         /* initialize timer_list struct */
@@ -872,8 +884,12 @@ static void slip_close(struct tty_struct *tty)
         if (!sl || sl->magic != SLIP_MAGIC || sl->tty != tty)
                 return;
 
+        spin_lock_bh(&sl->lock);
         tty->disc_data = NULL;
         sl->tty = NULL;
+        spin_unlock_bh(&sl->lock);
+
+        flush_work(&sl->tx_work);
 
         /* VSV = very important to remove timers */
 #ifdef CONFIG_SLIP_SMART
diff --git a/drivers/net/slip/slip.h b/drivers/net/slip/slip.h
index 67673cf1266b..cf32aadf508f 100644
--- a/drivers/net/slip/slip.h
+++ b/drivers/net/slip/slip.h
@@ -53,6 +53,7 @@ struct slip {
   struct tty_struct     *tty;           /* ptr to TTY structure         */
   struct net_device     *dev;           /* easy for intr handling       */
   spinlock_t            lock;
+  struct work_struct    tx_work;        /* Flushes transmit buffer      */
 
 #ifdef SL_INCLUDE_CSLIP
   struct slcompress     *slcomp;        /* for header compression       */
diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
index a3a05869309d..a4272ed62da8 100644
--- a/drivers/net/usb/hso.c
+++ b/drivers/net/usb/hso.c
@@ -258,10 +258,8 @@ struct hso_serial {
          * so as not to drop characters on the floor.
          */
         int  curr_rx_urb_idx;
-        u16  curr_rx_urb_offset;
         u8   rx_urb_filled[MAX_RX_URBS];
         struct tasklet_struct unthrottle_tasklet;
-        struct work_struct    retry_unthrottle_workqueue;
 };
 
 struct hso_device {
@@ -1252,14 +1250,6 @@ static	void hso_unthrottle(struct tty_struct *tty)
         tasklet_hi_schedule(&serial->unthrottle_tasklet);
 }
 
-static void hso_unthrottle_workfunc(struct work_struct *work)
-{
-        struct hso_serial *serial =
-            container_of(work, struct hso_serial,
-                         retry_unthrottle_workqueue);
-        hso_unthrottle_tasklet(serial);
-}
-
 /* open the requested serial port */
 static int hso_serial_open(struct tty_struct *tty, struct file *filp)
 {
@@ -1295,8 +1285,6 @@ static int hso_serial_open(struct tty_struct *tty, struct file *filp)
                 tasklet_init(&serial->unthrottle_tasklet,
                              (void (*)(unsigned long))hso_unthrottle_tasklet,
                              (unsigned long)serial);
-                INIT_WORK(&serial->retry_unthrottle_workqueue,
-                          hso_unthrottle_workfunc);
                 result = hso_start_serial_device(serial->parent, GFP_KERNEL);
                 if (result) {
                         hso_stop_serial_device(serial->parent);
@@ -1345,7 +1333,6 @@ static void hso_serial_close(struct tty_struct *tty, struct file *filp)
                 if (!usb_gone)
                         hso_stop_serial_device(serial->parent);
                 tasklet_kill(&serial->unthrottle_tasklet);
-                cancel_work_sync(&serial->retry_unthrottle_workqueue);
         }
 
         if (!usb_gone)
@@ -2013,8 +2000,7 @@ static void ctrl_callback(struct urb *urb)
 static int put_rxbuf_data(struct urb *urb, struct hso_serial *serial)
 {
         struct tty_struct *tty;
-        int write_length_remaining = 0;
-        int curr_write_len;
+        int count;
 
         /* Sanity check */
         if (urb == NULL || serial == NULL) {
@@ -2024,29 +2010,28 @@ static int put_rxbuf_data(struct urb *urb, struct hso_serial *serial)
 
         tty = tty_port_tty_get(&serial->port);
 
+        if (tty && test_bit(TTY_THROTTLED, &tty->flags)) {
+                tty_kref_put(tty);
+                return -1;
+        }
+
         /* Push data to tty */
-        write_length_remaining = urb->actual_length -
-                serial->curr_rx_urb_offset;
         D1("data to push to tty");
-        while (write_length_remaining) {
-                if (tty && test_bit(TTY_THROTTLED, &tty->flags)) {
-                        tty_kref_put(tty);
-                        return -1;
-                }
-                curr_write_len = tty_insert_flip_string(&serial->port,
-                        urb->transfer_buffer + serial->curr_rx_urb_offset,
-                        write_length_remaining);
-                serial->curr_rx_urb_offset += curr_write_len;
-                write_length_remaining -= curr_write_len;
+        count = tty_buffer_request_room(&serial->port, urb->actual_length);
+        if (count >= urb->actual_length) {
+                tty_insert_flip_string(&serial->port, urb->transfer_buffer,
+                                       urb->actual_length);
                 tty_flip_buffer_push(&serial->port);
+        } else {
+                dev_warn(&serial->parent->usb->dev,
+                         "dropping data, %d bytes lost\n", urb->actual_length);
         }
+
         tty_kref_put(tty);
 
-        if (write_length_remaining == 0) {
-                serial->curr_rx_urb_offset = 0;
-                serial->rx_urb_filled[hso_urb_to_index(serial, urb)] = 0;
-        }
-        return write_length_remaining;
+        serial->rx_urb_filled[hso_urb_to_index(serial, urb)] = 0;
+
+        return 0;
 }
 
 
@@ -2217,7 +2202,6 @@ static int hso_stop_serial_device(struct hso_device *hso_dev)
                 }
         }
         serial->curr_rx_urb_idx = 0;
-        serial->curr_rx_urb_offset = 0;
 
         if (serial->tx_urb)
                 usb_kill_urb(serial->tx_urb);
diff --git a/drivers/net/usb/huawei_cdc_ncm.c b/drivers/net/usb/huawei_cdc_ncm.c
index f9822bc75425..5d95a13dbe2a 100644
--- a/drivers/net/usb/huawei_cdc_ncm.c
+++ b/drivers/net/usb/huawei_cdc_ncm.c
@@ -84,12 +84,13 @@ static int huawei_cdc_ncm_bind(struct usbnet *usbnet_dev,
         ctx = drvstate->ctx;
 
         if (usbnet_dev->status)
-                /* CDC-WMC r1.1 requires wMaxCommand to be "at least 256
-                 * decimal (0x100)"
+                /* The wMaxCommand buffer must be big enough to hold
+                 * any message from the modem. Experience has shown
+                 * that some replies are more than 256 bytes long
                  */
                 subdriver = usb_cdc_wdm_register(ctx->control,
                                                  &usbnet_dev->status->desc,
-                                                 256, /* wMaxCommand */
+                                                 1024, /* wMaxCommand */
                                                  huawei_cdc_ncm_wdm_manage_power);
         if (IS_ERR(subdriver)) {
                 ret = PTR_ERR(subdriver);
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index cf62d7e8329f..c4638c67f6b9 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -741,6 +741,7 @@ static const struct usb_device_id products[] = {
         {QMI_FIXED_INTF(0x19d2, 0x1424, 2)},
         {QMI_FIXED_INTF(0x19d2, 0x1425, 2)},
         {QMI_FIXED_INTF(0x19d2, 0x1426, 2)},    /* ZTE MF91 */
+        {QMI_FIXED_INTF(0x19d2, 0x1428, 2)},    /* Telewell TW-LTE 4G v2 */
         {QMI_FIXED_INTF(0x19d2, 0x2002, 4)},    /* ZTE (Vodafone) K3765-Z */
         {QMI_FIXED_INTF(0x0f3d, 0x68a2, 8)},    /* Sierra Wireless MC7700 */
         {QMI_FIXED_INTF(0x114f, 0x68a2, 8)},    /* Sierra Wireless MC7750 */
diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
index 25431965a625..7bad2d316637 100644
--- a/drivers/net/usb/r8152.c
+++ b/drivers/net/usb/r8152.c
@@ -1359,7 +1359,7 @@ static void r8152_csum_workaround(struct r8152 *tp, struct sk_buff *skb,
                 struct sk_buff_head seg_list;
                 struct sk_buff *segs, *nskb;
 
-                features &= ~(NETIF_F_IP_CSUM | NETIF_F_SG | NETIF_F_TSO);
+                features &= ~(NETIF_F_SG | NETIF_F_IPV6_CSUM | NETIF_F_TSO6);
                 segs = skb_gso_segment(skb, features);
                 if (IS_ERR(segs) || !segs)
                         goto drop;
@@ -3204,8 +3204,13 @@ static void rtl8152_get_ethtool_stats(struct net_device *dev,
         struct r8152 *tp = netdev_priv(dev);
         struct tally_counter tally;
 
+        if (usb_autopm_get_interface(tp->intf) < 0)
+                return;
+
         generic_ocp_read(tp, PLA_TALLYCNT, sizeof(tally), &tally, MCU_TYPE_PLA);
 
+        usb_autopm_put_interface(tp->intf);
+
         data[0] = le64_to_cpu(tally.tx_packets);
         data[1] = le64_to_cpu(tally.rx_packets);
         data[2] = le64_to_cpu(tally.tx_errors);
diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c
index 424db65e4396..d07bf4cb893f 100644
--- a/drivers/net/usb/smsc95xx.c
+++ b/drivers/net/usb/smsc95xx.c
@@ -1714,6 +1714,18 @@ static int smsc95xx_resume(struct usb_interface *intf)
         return ret;
 }
 
+static int smsc95xx_reset_resume(struct usb_interface *intf)
+{
+        struct usbnet *dev = usb_get_intfdata(intf);
+        int ret;
+
+        ret = smsc95xx_reset(dev);
+        if (ret < 0)
+                return ret;
+
+        return smsc95xx_resume(intf);
+}
+
 static void smsc95xx_rx_csum_offload(struct sk_buff *skb)
 {
         skb->csum = *(u16 *)(skb_tail_pointer(skb) - 2);
@@ -2004,7 +2016,7 @@ static struct usb_driver smsc95xx_driver = {
         .probe          = usbnet_probe,
         .suspend        = smsc95xx_suspend,
         .resume         = smsc95xx_resume,
-        .reset_resume   = smsc95xx_resume,
+        .reset_resume   = smsc95xx_reset_resume,
         .disconnect     = usbnet_disconnect,
         .disable_hub_initiated_lpm = 1,
         .supports_autosuspend = 1,
diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
index 97394345e5dd..b76f7dcde0db 100644
--- a/drivers/net/vmxnet3/vmxnet3_drv.c
+++ b/drivers/net/vmxnet3/vmxnet3_drv.c
@@ -2589,8 +2589,8 @@ vmxnet3_open(struct net_device *netdev)
         for (i = 0; i < adapter->num_tx_queues; i++)
                 spin_lock_init(&adapter->tx_queue[i].tx_lock);
 
-        err = vmxnet3_create_queues(adapter, VMXNET3_DEF_TX_RING_SIZE,
-                                    VMXNET3_DEF_RX_RING_SIZE,
+        err = vmxnet3_create_queues(adapter, adapter->tx_ring_size,
+                                    adapter->rx_ring_size,
                                     VMXNET3_DEF_RX_RING_SIZE);
         if (err)
                 goto queue_err;
@@ -2968,6 +2968,9 @@ vmxnet3_probe_device(struct pci_dev *pdev,
         adapter->netdev = netdev;
         adapter->pdev = pdev;
 
+        adapter->tx_ring_size = VMXNET3_DEF_TX_RING_SIZE;
+        adapter->rx_ring_size = VMXNET3_DEF_RX_RING_SIZE;
+
         spin_lock_init(&adapter->cmd_lock);
         adapter->adapter_pa = dma_map_single(&adapter->pdev->dev, adapter,
                                              sizeof(struct vmxnet3_adapter),
diff --git a/drivers/net/vmxnet3/vmxnet3_ethtool.c b/drivers/net/vmxnet3/vmxnet3_ethtool.c
index 40c1c7b0d9e0..b725fd9e7803 100644
--- a/drivers/net/vmxnet3/vmxnet3_ethtool.c
+++ b/drivers/net/vmxnet3/vmxnet3_ethtool.c
@@ -449,8 +449,8 @@ vmxnet3_get_ringparam(struct net_device *netdev,
         param->rx_mini_max_pending = 0;
         param->rx_jumbo_max_pending = 0;
 
-        param->rx_pending = adapter->rx_queue[0].rx_ring[0].size;
-        param->tx_pending = adapter->tx_queue[0].tx_ring.size;
+        param->rx_pending = adapter->rx_ring_size;
+        param->tx_pending = adapter->tx_ring_size;
         param->rx_mini_pending = 0;
         param->rx_jumbo_pending = 0;
 }
@@ -529,9 +529,11 @@ vmxnet3_set_ringparam(struct net_device *netdev,
                          * size */
                         netdev_err(netdev, "failed to apply new sizes, "
                                    "try the default ones\n");
+                        new_rx_ring_size = VMXNET3_DEF_RX_RING_SIZE;
+                        new_tx_ring_size = VMXNET3_DEF_TX_RING_SIZE;
                         err = vmxnet3_create_queues(adapter,
-                                                    VMXNET3_DEF_TX_RING_SIZE,
-                                                    VMXNET3_DEF_RX_RING_SIZE,
+                                                    new_tx_ring_size,
+                                                    new_rx_ring_size,
                                                     VMXNET3_DEF_RX_RING_SIZE);
                         if (err) {
                                 netdev_err(netdev, "failed to create queues "
@@ -545,6 +547,8 @@ vmxnet3_set_ringparam(struct net_device *netdev,
                         netdev_err(netdev, "failed to re-activate, error %d."
                                    " Closing it\n", err);
         }
+        adapter->tx_ring_size = new_tx_ring_size;
+        adapter->rx_ring_size = new_rx_ring_size;
 
 out:
         clear_bit(VMXNET3_STATE_BIT_RESETTING, &adapter->state);
diff --git a/drivers/net/vmxnet3/vmxnet3_int.h b/drivers/net/vmxnet3/vmxnet3_int.h
index 190569d02450..29ee77f2c97f 100644
--- a/drivers/net/vmxnet3/vmxnet3_int.h
+++ b/drivers/net/vmxnet3/vmxnet3_int.h
@@ -349,6 +349,11 @@ struct vmxnet3_adapter {
         u32     link_speed; /* in mbps */
 
         u64     tx_timeout_count;
+
+        /* Ring sizes */
+        u32 tx_ring_size;
+        u32 rx_ring_size;
+
         struct work_struct work;
 
         unsigned long  state;    /* VMXNET3_STATE_BIT_xxx */
diff --git a/drivers/net/wan/farsync.c b/drivers/net/wan/farsync.c
index 93ace042d0aa..1f041271f7fe 100644
--- a/drivers/net/wan/farsync.c
+++ b/drivers/net/wan/farsync.c
@@ -2363,7 +2363,7 @@ static char *type_strings[] = {
         "FarSync TE1"
 };
 
-static void
+static int
 fst_init_card(struct fst_card_info *card)
 {
         int i;
@@ -2374,24 +2374,21 @@ fst_init_card(struct fst_card_info *card)
          * we'll have to revise it in some way then.
          */
         for (i = 0; i < card->nports; i++) {
-                err = register_hdlc_device(card->ports[i].dev);
-                if (err < 0) {
-                        int j;
+                err = register_hdlc_device(card->ports[i].dev);
+                if (err < 0) {
                         pr_err("Cannot register HDLC device for port %d (errno %d)\n",
-                               i, -err);
-                        for (j = i; j < card->nports; j++) {
-                                free_netdev(card->ports[j].dev);
-                                card->ports[j].dev = NULL;
-                        }
-                        card->nports = i;
-                        break;
-                }
+                                i, -err);
+                        while (i--)
+                                unregister_hdlc_device(card->ports[i].dev);
+                        return err;
+                }
         }
 
         pr_info("%s-%s: %s IRQ%d, %d ports\n",
                 port_to_dev(&card->ports[0])->name,
                 port_to_dev(&card->ports[card->nports - 1])->name,
                 type_strings[card->type], card->irq, card->nports);
+        return 0;
 }
 
 static const struct net_device_ops fst_ops = {
@@ -2447,15 +2444,12 @@ fst_add_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         /* Try to enable the device */
         if ((err = pci_enable_device(pdev)) != 0) {
                 pr_err("Failed to enable card. Err %d\n", -err);
-                kfree(card);
-                return err;
+                goto enable_fail;
         }
 
         if ((err = pci_request_regions(pdev, "FarSync")) !=0) {
                 pr_err("Failed to allocate regions. Err %d\n", -err);
-                pci_disable_device(pdev);
-                kfree(card);
-                return err;
+                goto regions_fail;
         }
 
         /* Get virtual addresses of memory regions */
@@ -2464,30 +2458,21 @@ fst_add_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         card->phys_ctlmem = pci_resource_start(pdev, 3);
         if ((card->mem = ioremap(card->phys_mem, FST_MEMSIZE)) == NULL) {
                 pr_err("Physical memory remap failed\n");
-                pci_release_regions(pdev);
-                pci_disable_device(pdev);
-                kfree(card);
-                return -ENODEV;
+                err = -ENODEV;
+                goto ioremap_physmem_fail;
         }
         if ((card->ctlmem = ioremap(card->phys_ctlmem, 0x10)) == NULL) {
                 pr_err("Control memory remap failed\n");
-                pci_release_regions(pdev);
-                pci_disable_device(pdev);
-                iounmap(card->mem);
-                kfree(card);
-                return -ENODEV;
+                err = -ENODEV;
+                goto ioremap_ctlmem_fail;
         }
         dbg(DBG_PCI, "kernel mem %p, ctlmem %p\n", card->mem, card->ctlmem);
 
         /* Register the interrupt handler */
         if (request_irq(pdev->irq, fst_intr, IRQF_SHARED, FST_DEV_NAME, card)) {
                 pr_err("Unable to register interrupt %d\n", card->irq);
-                pci_release_regions(pdev);
-                pci_disable_device(pdev);
-                iounmap(card->ctlmem);
-                iounmap(card->mem);
-                kfree(card);
-                return -ENODEV;
+                err = -ENODEV;
+                goto irq_fail;
         }
 
         /* Record info we need */
@@ -2513,13 +2498,8 @@ fst_add_one(struct pci_dev *pdev, const struct pci_device_id *ent)
                         while (i--)
                                 free_netdev(card->ports[i].dev);
                         pr_err("FarSync: out of memory\n");
-                        free_irq(card->irq, card);
-                        pci_release_regions(pdev);
-                        pci_disable_device(pdev);
-                        iounmap(card->ctlmem);
-                        iounmap(card->mem);
-                        kfree(card);
-                        return -ENODEV;
+                        err = -ENOMEM;
+                        goto hdlcdev_fail;
                 }
                 card->ports[i].dev    = dev;
                 card->ports[i].card   = card;
@@ -2565,9 +2545,16 @@ fst_add_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         pci_set_drvdata(pdev, card);
 
         /* Remainder of card setup */
+        if (no_of_cards_added >= FST_MAX_CARDS) {
+                pr_err("FarSync: too many cards\n");
+                err = -ENOMEM;
+                goto card_array_fail;
+        }
         fst_card_array[no_of_cards_added] = card;
         card->card_no = no_of_cards_added++;    /* Record instance and bump it */
-        fst_init_card(card);
+        err = fst_init_card(card);
+        if (err)
+                goto init_card_fail;
         if (card->family == FST_FAMILY_TXU) {
                 /*
                  * Allocate a dma buffer for transmit and receives
@@ -2577,29 +2564,46 @@ fst_add_one(struct pci_dev *pdev, const struct pci_device_id *ent)
                                          &card->rx_dma_handle_card);
                 if (card->rx_dma_handle_host == NULL) {
                         pr_err("Could not allocate rx dma buffer\n");
-                        fst_disable_intr(card);
-                        pci_release_regions(pdev);
-                        pci_disable_device(pdev);
-                        iounmap(card->ctlmem);
-                        iounmap(card->mem);
-                        kfree(card);
-                        return -ENOMEM;
+                        err = -ENOMEM;
+                        goto rx_dma_fail;
                 }
                 card->tx_dma_handle_host =
                     pci_alloc_consistent(card->device, FST_MAX_MTU,
                                          &card->tx_dma_handle_card);
                 if (card->tx_dma_handle_host == NULL) {
                         pr_err("Could not allocate tx dma buffer\n");
-                        fst_disable_intr(card);
-                        pci_release_regions(pdev);
-                        pci_disable_device(pdev);
-                        iounmap(card->ctlmem);
-                        iounmap(card->mem);
-                        kfree(card);
-                        return -ENOMEM;
+                        err = -ENOMEM;
+                        goto tx_dma_fail;
                 }
         }
         return 0;               /* Success */
+
+tx_dma_fail:
+        pci_free_consistent(card->device, FST_MAX_MTU,
+                            card->rx_dma_handle_host,
+                            card->rx_dma_handle_card);
+rx_dma_fail:
+        fst_disable_intr(card);
+        for (i = 0 ; i < card->nports ; i++)
+                unregister_hdlc_device(card->ports[i].dev);
+init_card_fail:
+        fst_card_array[card->card_no] = NULL;
+card_array_fail:
+        for (i = 0 ; i < card->nports ; i++)
+                free_netdev(card->ports[i].dev);
+hdlcdev_fail:
+        free_irq(card->irq, card);
+irq_fail:
+        iounmap(card->ctlmem);
+ioremap_ctlmem_fail:
+        iounmap(card->mem);
+ioremap_physmem_fail:
+        pci_release_regions(pdev);
+regions_fail:
+        pci_disable_device(pdev);
+enable_fail:
+        kfree(card);
+        return err;
 }
 
 /*
diff --git a/drivers/net/wireless/ath/ath10k/core.c b/drivers/net/wireless/ath/ath10k/core.c
index 82017f56e661..e6c56c5bb0f6 100644
--- a/drivers/net/wireless/ath/ath10k/core.c
+++ b/drivers/net/wireless/ath/ath10k/core.c
@@ -795,7 +795,11 @@ int ath10k_core_start(struct ath10k *ar)
         if (status)
                 goto err_htc_stop;
 
-        ar->free_vdev_map = (1 << TARGET_NUM_VDEVS) - 1;
+        if (test_bit(ATH10K_FW_FEATURE_WMI_10X, ar->fw_features))
+                ar->free_vdev_map = (1 << TARGET_10X_NUM_VDEVS) - 1;
+        else
+                ar->free_vdev_map = (1 << TARGET_NUM_VDEVS) - 1;
+
         INIT_LIST_HEAD(&ar->arvifs);
 
         if (!test_bit(ATH10K_FLAG_FIRST_BOOT_DONE, &ar->dev_flags))
diff --git a/drivers/net/wireless/ath/ath10k/htt_rx.c b/drivers/net/wireless/ath/ath10k/htt_rx.c
index 6c102b1312ff..eebc860c3655 100644
--- a/drivers/net/wireless/ath/ath10k/htt_rx.c
+++ b/drivers/net/wireless/ath/ath10k/htt_rx.c
@@ -312,7 +312,6 @@ static int ath10k_htt_rx_amsdu_pop(struct ath10k_htt *htt,
         int msdu_len, msdu_chaining = 0;
         struct sk_buff *msdu;
         struct htt_rx_desc *rx_desc;
-        bool corrupted = false;
 
         lockdep_assert_held(&htt->rx_ring.lock);
 
@@ -439,9 +438,6 @@ static int ath10k_htt_rx_amsdu_pop(struct ath10k_htt *htt,
                 last_msdu = __le32_to_cpu(rx_desc->msdu_end.info0) &
                                 RX_MSDU_END_INFO0_LAST_MSDU;
 
-                if (msdu_chaining && !last_msdu)
-                        corrupted = true;
-
                 if (last_msdu) {
                         msdu->next = NULL;
                         break;
@@ -457,20 +453,6 @@ static int ath10k_htt_rx_amsdu_pop(struct ath10k_htt *htt,
                 msdu_chaining = -1;
 
         /*
-         * Apparently FW sometimes reports weird chained MSDU sequences with
-         * more than one rx descriptor. This seems like a bug but needs more
-         * analyzing. For the time being fix it by dropping such sequences to
-         * avoid blowing up the host system.
-         */
-        if (corrupted) {
-                ath10k_warn("failed to pop chained msdus, dropping\n");
-                ath10k_htt_rx_free_msdu_chain(*head_msdu);
-                *head_msdu = NULL;
-                *tail_msdu = NULL;
-                msdu_chaining = -EINVAL;
-        }
-
-        /*
          * Don't refill the ring yet.
          *
          * First, the elements popped here are still in use - it is not
diff --git a/drivers/net/wireless/b43/Kconfig b/drivers/net/wireless/b43/Kconfig
index e3f67b8d3f80..40fd9b7b1426 100644
--- a/drivers/net/wireless/b43/Kconfig
+++ b/drivers/net/wireless/b43/Kconfig
@@ -36,7 +36,7 @@ config B43_SSB
 choice
         prompt "Supported bus types"
         depends on B43
-        default B43_BCMA_AND_SSB
+        default B43_BUSES_BCMA_AND_SSB
 
 config B43_BUSES_BCMA_AND_SSB
         bool "BCMA and SSB"
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index 32538ac5f7e4..0d6a0bb1f876 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -5221,6 +5221,7 @@ static int b43_wireless_core_attach(struct b43_wldev *dev)
         /* We don't support 5 GHz on some PHYs yet */
         switch (dev->phy.type) {
         case B43_PHYTYPE_A:
+        case B43_PHYTYPE_G:
         case B43_PHYTYPE_N:
         case B43_PHYTYPE_LP:
         case B43_PHYTYPE_HT:
diff --git a/drivers/net/wireless/b43/xmit.c b/drivers/net/wireless/b43/xmit.c
index 4f38f19b8e3d..6e6ef3fc2247 100644
--- a/drivers/net/wireless/b43/xmit.c
+++ b/drivers/net/wireless/b43/xmit.c
@@ -811,9 +811,13 @@ void b43_rx(struct b43_wldev *dev, struct sk_buff *skb, const void *_rxhdr)
                 break;
         case B43_PHYTYPE_G:
                 status.band = IEEE80211_BAND_2GHZ;
-                /* chanid is the radio channel cookie value as used
-                 * to tune the radio. */
-                status.freq = chanid + 2400;
+                /* Somewhere between 478.104 and 508.1084 firmware for G-PHY
+                 * has been modified to be compatible with N-PHY and others.
+                 */
+                if (dev->fw.rev >= 508)
+                        status.freq = ieee80211_channel_to_frequency(chanid, status.band);
+                else
+                        status.freq = chanid + 2400;
                 break;
         case B43_PHYTYPE_N:
         case B43_PHYTYPE_LP:
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/usb.c b/drivers/net/wireless/brcm80211/brcmfmac/usb.c
index 6db51a666f61..d06fcb05adf2 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/usb.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/usb.c
@@ -1184,8 +1184,6 @@ static int brcmf_usb_probe_cb(struct brcmf_usbdev_info *devinfo)
         bus->bus_priv.usb = bus_pub;
         dev_set_drvdata(dev, bus);
         bus->ops = &brcmf_usb_bus_ops;
-        bus->chip = bus_pub->devid;
-        bus->chiprev = bus_pub->chiprev;
         bus->proto_type = BRCMF_PROTO_BCDC;
         bus->always_use_fws_queue = true;
 
@@ -1194,6 +1192,9 @@ static int brcmf_usb_probe_cb(struct brcmf_usbdev_info *devinfo)
                 if (ret)
                         goto fail;
         }
+        bus->chip = bus_pub->devid;
+        bus->chiprev = bus_pub->chiprev;
+
         /* request firmware here */
         brcmf_fw_get_firmwares(dev, 0, brcmf_usb_get_fwname(devinfo), NULL,
                                brcmf_usb_probe_phase2);
diff --git a/drivers/net/wireless/iwlwifi/dvm/rxon.c b/drivers/net/wireless/iwlwifi/dvm/rxon.c
index ed50de6362ed..6dc5dd3ced44 100644
--- a/drivers/net/wireless/iwlwifi/dvm/rxon.c
+++ b/drivers/net/wireless/iwlwifi/dvm/rxon.c
@@ -1068,13 +1068,6 @@ int iwlagn_commit_rxon(struct iwl_priv *priv, struct iwl_rxon_context *ctx)
         /* recalculate basic rates */
         iwl_calc_basic_rates(priv, ctx);
 
-        /*
-         * force CTS-to-self frames protection if RTS-CTS is not preferred
-         * one aggregation protection method
-         */
-        if (!priv->hw_params.use_rts_for_aggregation)
-                ctx->staging.flags |= RXON_FLG_SELF_CTS_EN;
-
         if ((ctx->vif && ctx->vif->bss_conf.use_short_slot) ||
             !(ctx->staging.flags & RXON_FLG_BAND_24G_MSK))
                 ctx->staging.flags |= RXON_FLG_SHORT_SLOT_MSK;
@@ -1480,11 +1473,6 @@ void iwlagn_bss_info_changed(struct ieee80211_hw *hw,
         else
                 ctx->staging.flags &= ~RXON_FLG_TGG_PROTECT_MSK;
 
-        if (bss_conf->use_cts_prot)
-                ctx->staging.flags |= RXON_FLG_SELF_CTS_EN;
-        else
-                ctx->staging.flags &= ~RXON_FLG_SELF_CTS_EN;
-
         memcpy(ctx->staging.bssid_addr, bss_conf->bssid, ETH_ALEN);
 
         if (vif->type == NL80211_IFTYPE_AP ||
diff --git a/drivers/net/wireless/iwlwifi/iwl-fw.h b/drivers/net/wireless/iwlwifi/iwl-fw.h
index 0aa7c0085c9f..b1a33322b9ba 100644
--- a/drivers/net/wireless/iwlwifi/iwl-fw.h
+++ b/drivers/net/wireless/iwlwifi/iwl-fw.h
@@ -88,6 +88,7 @@
  *      P2P client interfaces simultaneously if they are in different bindings.
  * @IWL_UCODE_TLV_FLAGS_P2P_BSS_PS_SCM: support power save on BSS station and
  *      P2P client interfaces simultaneously if they are in same bindings.
+ * @IWL_UCODE_TLV_FLAGS_UAPSD_SUPPORT: General support for uAPSD
  * @IWL_UCODE_TLV_FLAGS_P2P_PS_UAPSD: P2P client supports uAPSD power save
  * @IWL_UCODE_TLV_FLAGS_BCAST_FILTERING: uCode supports broadcast filtering.
  * @IWL_UCODE_TLV_FLAGS_GO_UAPSD: AP/GO interfaces support uAPSD clients
diff --git a/drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c b/drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c
index 8b5302777632..725ba49576bf 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c
+++ b/drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c
@@ -667,10 +667,9 @@ static void iwl_mvm_mac_ctxt_cmd_common(struct iwl_mvm *mvm,
         if (vif->bss_conf.qos)
                 cmd->qos_flags |= cpu_to_le32(MAC_QOS_FLG_UPDATE_EDCA);
 
-        if (vif->bss_conf.use_cts_prot) {
+        if (vif->bss_conf.use_cts_prot)
                 cmd->protection_flags |= cpu_to_le32(MAC_PROT_FLG_TGG_PROTECT);
-                cmd->protection_flags |= cpu_to_le32(MAC_PROT_FLG_SELF_CTS_EN);
-        }
+
         IWL_DEBUG_RATE(mvm, "use_cts_prot %d, ht_operation_mode %d\n",
                        vif->bss_conf.use_cts_prot,
                        vif->bss_conf.ht_operation_mode);
diff --git a/drivers/net/wireless/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
index 7215f5980186..9bfb90680cdc 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
@@ -303,6 +303,13 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
                 hw->uapsd_max_sp_len = IWL_UAPSD_MAX_SP;
         }
 
+        if (mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_UAPSD_SUPPORT &&
+            !iwlwifi_mod_params.uapsd_disable) {
+                hw->flags |= IEEE80211_HW_SUPPORTS_UAPSD;
+                hw->uapsd_queues = IWL_UAPSD_AC_INFO;
+                hw->uapsd_max_sp_len = IWL_UAPSD_MAX_SP;
+        }
+
         hw->sta_data_size = sizeof(struct iwl_mvm_sta);
         hw->vif_data_size = sizeof(struct iwl_mvm_vif);
         hw->chanctx_data_size = sizeof(u16);
@@ -1159,8 +1166,12 @@ static void iwl_mvm_bcast_filter_iterator(void *_data, u8 *mac,
 
         bcast_mac = &cmd->macs[mvmvif->id];
 
-        /* enable filtering only for associated stations */
-        if (vif->type != NL80211_IFTYPE_STATION || !vif->bss_conf.assoc)
+        /*
+         * enable filtering only for associated stations, but not for P2P
+         * Clients
+         */
+        if (vif->type != NL80211_IFTYPE_STATION || vif->p2p ||
+            !vif->bss_conf.assoc)
                 return;
 
         bcast_mac->default_discard = 1;
@@ -1237,10 +1248,6 @@ static int iwl_mvm_configure_bcast_filter(struct iwl_mvm *mvm,
         if (!(mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_BCAST_FILTERING))
                 return 0;
 
-        /* bcast filtering isn't supported for P2P client */
-        if (vif->p2p)
-                return 0;
-
         if (!iwl_mvm_bcast_filter_build_cmd(mvm, &cmd))
                 return 0;
 
diff --git a/drivers/net/wireless/iwlwifi/mvm/scan.c b/drivers/net/wireless/iwlwifi/mvm/scan.c
index 4b6c7d4bd199..eac2b424f6a0 100644
--- a/drivers/net/wireless/iwlwifi/mvm/scan.c
+++ b/drivers/net/wireless/iwlwifi/mvm/scan.c
@@ -588,9 +588,7 @@ static void iwl_build_scan_cmd(struct iwl_mvm *mvm,
                                struct iwl_scan_offload_cmd *scan,
                                struct iwl_mvm_scan_params *params)
 {
-        scan->channel_count =
-                mvm->nvm_data->bands[IEEE80211_BAND_2GHZ].n_channels +
-                mvm->nvm_data->bands[IEEE80211_BAND_5GHZ].n_channels;
+        scan->channel_count = req->n_channels;
         scan->quiet_time = cpu_to_le16(IWL_ACTIVE_QUIET_TIME);
         scan->quiet_plcp_th = cpu_to_le16(IWL_PLCP_QUIET_THRESH);
         scan->good_CRC_th = IWL_GOOD_CRC_TH_DEFAULT;
@@ -669,61 +667,37 @@ static void iwl_build_channel_cfg(struct iwl_mvm *mvm,
                                   struct cfg80211_sched_scan_request *req,
                                   struct iwl_scan_channel_cfg *channels,
                                   enum ieee80211_band band,
-                                  int *head, int *tail,
+                                  int *head,
                                   u32 ssid_bitmap,
                                   struct iwl_mvm_scan_params *params)
 {
-        struct ieee80211_supported_band *s_band;
-        int n_channels = req->n_channels;
-        int i, j, index = 0;
-        bool partial;
+        int i, index = 0;
 
-        /*
-         * We have to configure all supported channels, even if we don't want to
-         * scan on them, but we have to send channels in the order that we want
-         * to scan. So add requested channels to head of the list and others to
-         * the end.
-        */
-        s_band = &mvm->nvm_data->bands[band];
-
-        for (i = 0; i < s_band->n_channels && *head <= *tail; i++) {
-                partial = false;
-                for (j = 0; j < n_channels; j++)
-                        if (s_band->channels[i].center_freq ==
-                                                req->channels[j]->center_freq) {
-                                index = *head;
-                                (*head)++;
-                                /*
-                                 * Channels that came with the request will be
-                                 * in partial scan .
-                                 */
-                                partial = true;
-                                break;
-                        }
-                if (!partial) {
-                        index = *tail;
-                        (*tail)--;
-                }
-                channels->channel_number[index] =
-                        cpu_to_le16(ieee80211_frequency_to_channel(
-                                        s_band->channels[i].center_freq));
+        for (i = 0; i < req->n_channels; i++) {
+                struct ieee80211_channel *chan = req->channels[i];
+
+                if (chan->band != band)
+                        continue;
+
+                index = *head;
+                (*head)++;
+
+                channels->channel_number[index] = cpu_to_le16(chan->hw_value);
                 channels->dwell_time[index][0] = params->dwell[band].active;
                 channels->dwell_time[index][1] = params->dwell[band].passive;
 
                 channels->iter_count[index] = cpu_to_le16(1);
                 channels->iter_interval[index] = 0;
 
-                if (!(s_band->channels[i].flags & IEEE80211_CHAN_NO_IR))
+                if (!(chan->flags & IEEE80211_CHAN_NO_IR))
                         channels->type[index] |=
                                 cpu_to_le32(IWL_SCAN_OFFLOAD_CHANNEL_ACTIVE);
 
                 channels->type[index] |=
-                                cpu_to_le32(IWL_SCAN_OFFLOAD_CHANNEL_FULL);
-                if (partial)
-                        channels->type[index] |=
-                                cpu_to_le32(IWL_SCAN_OFFLOAD_CHANNEL_PARTIAL);
+                                cpu_to_le32(IWL_SCAN_OFFLOAD_CHANNEL_FULL |
+                                            IWL_SCAN_OFFLOAD_CHANNEL_PARTIAL);
 
-                if (s_band->channels[i].flags & IEEE80211_CHAN_NO_HT40)
+                if (chan->flags & IEEE80211_CHAN_NO_HT40)
                         channels->type[index] |=
                                 cpu_to_le32(IWL_SCAN_OFFLOAD_CHANNEL_NARROW);
 
@@ -740,7 +714,6 @@ int iwl_mvm_config_sched_scan(struct iwl_mvm *mvm,
         int band_2ghz = mvm->nvm_data->bands[IEEE80211_BAND_2GHZ].n_channels;
         int band_5ghz = mvm->nvm_data->bands[IEEE80211_BAND_5GHZ].n_channels;
         int head = 0;
-        int tail = band_2ghz + band_5ghz - 1;
         u32 ssid_bitmap;
         int cmd_len;
         int ret;
@@ -772,7 +745,7 @@ int iwl_mvm_config_sched_scan(struct iwl_mvm *mvm,
                                               &scan_cfg->scan_cmd.tx_cmd[0],
                                               scan_cfg->data);
                 iwl_build_channel_cfg(mvm, req, &scan_cfg->channel_cfg,
-                                      IEEE80211_BAND_2GHZ, &head, &tail,
+                                      IEEE80211_BAND_2GHZ, &head,
                                       ssid_bitmap, &params);
         }
         if (band_5ghz) {
@@ -782,7 +755,7 @@ int iwl_mvm_config_sched_scan(struct iwl_mvm *mvm,
                                               scan_cfg->data +
                                                 SCAN_OFFLOAD_PROBE_REQ_SIZE);
                 iwl_build_channel_cfg(mvm, req, &scan_cfg->channel_cfg,
-                                      IEEE80211_BAND_5GHZ, &head, &tail,
+                                      IEEE80211_BAND_5GHZ, &head,
                                       ssid_bitmap, &params);
         }
 
diff --git a/drivers/net/wireless/iwlwifi/pcie/drv.c b/drivers/net/wireless/iwlwifi/pcie/drv.c
index 7091a18d5a72..98950e45c7b0 100644
--- a/drivers/net/wireless/iwlwifi/pcie/drv.c
+++ b/drivers/net/wireless/iwlwifi/pcie/drv.c
@@ -367,6 +367,7 @@ static DEFINE_PCI_DEVICE_TABLE(iwl_hw_card_ids) = {
         {IWL_PCI_DEVICE(0x095A, 0x5012, iwl7265_2ac_cfg)},
         {IWL_PCI_DEVICE(0x095A, 0x5412, iwl7265_2ac_cfg)},
         {IWL_PCI_DEVICE(0x095A, 0x5410, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x5510, iwl7265_2ac_cfg)},
         {IWL_PCI_DEVICE(0x095A, 0x5400, iwl7265_2ac_cfg)},
         {IWL_PCI_DEVICE(0x095A, 0x1010, iwl7265_2ac_cfg)},
         {IWL_PCI_DEVICE(0x095A, 0x5000, iwl7265_2n_cfg)},
@@ -380,7 +381,7 @@ static DEFINE_PCI_DEVICE_TABLE(iwl_hw_card_ids) = {
         {IWL_PCI_DEVICE(0x095A, 0x9110, iwl7265_2ac_cfg)},
         {IWL_PCI_DEVICE(0x095A, 0x9112, iwl7265_2ac_cfg)},
         {IWL_PCI_DEVICE(0x095A, 0x9210, iwl7265_2ac_cfg)},
-        {IWL_PCI_DEVICE(0x095A, 0x9200, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095B, 0x9200, iwl7265_2ac_cfg)},
         {IWL_PCI_DEVICE(0x095A, 0x9510, iwl7265_2ac_cfg)},
         {IWL_PCI_DEVICE(0x095A, 0x9310, iwl7265_2ac_cfg)},
         {IWL_PCI_DEVICE(0x095A, 0x9410, iwl7265_2ac_cfg)},
diff --git a/drivers/net/wireless/mwifiex/11n_aggr.c b/drivers/net/wireless/mwifiex/11n_aggr.c
index 5b32106182f8..fe0f66f73507 100644
--- a/drivers/net/wireless/mwifiex/11n_aggr.c
+++ b/drivers/net/wireless/mwifiex/11n_aggr.c
@@ -185,6 +185,7 @@ mwifiex_11n_aggregate_pkt(struct mwifiex_private *priv,
         skb_reserve(skb_aggr, headroom + sizeof(struct txpd));
         tx_info_aggr =  MWIFIEX_SKB_TXCB(skb_aggr);
 
+        memset(tx_info_aggr, 0, sizeof(*tx_info_aggr));
         tx_info_aggr->bss_type = tx_info_src->bss_type;
         tx_info_aggr->bss_num = tx_info_src->bss_num;
 
diff --git a/drivers/net/wireless/mwifiex/cfg80211.c b/drivers/net/wireless/mwifiex/cfg80211.c
index e95dec91a561..b511613bba2d 100644
--- a/drivers/net/wireless/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/mwifiex/cfg80211.c
@@ -220,6 +220,7 @@ mwifiex_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
         }
 
         tx_info = MWIFIEX_SKB_TXCB(skb);
+        memset(tx_info, 0, sizeof(*tx_info));
         tx_info->bss_num = priv->bss_num;
         tx_info->bss_type = priv->bss_type;
         tx_info->pkt_len = pkt_len;
diff --git a/drivers/net/wireless/mwifiex/cmdevt.c b/drivers/net/wireless/mwifiex/cmdevt.c
index 8dee6c86f4f1..c161141f6c39 100644
--- a/drivers/net/wireless/mwifiex/cmdevt.c
+++ b/drivers/net/wireless/mwifiex/cmdevt.c
@@ -453,6 +453,7 @@ int mwifiex_process_event(struct mwifiex_adapter *adapter)
 
         if (skb) {
                 rx_info = MWIFIEX_SKB_RXCB(skb);
+                memset(rx_info, 0, sizeof(*rx_info));
                 rx_info->bss_num = priv->bss_num;
                 rx_info->bss_type = priv->bss_type;
         }
diff --git a/drivers/net/wireless/mwifiex/main.c b/drivers/net/wireless/mwifiex/main.c
index cbabc12fbda3..e91cd0fa5ca8 100644
--- a/drivers/net/wireless/mwifiex/main.c
+++ b/drivers/net/wireless/mwifiex/main.c
@@ -645,6 +645,7 @@ mwifiex_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
         }
 
         tx_info = MWIFIEX_SKB_TXCB(skb);
+        memset(tx_info, 0, sizeof(*tx_info));
         tx_info->bss_num = priv->bss_num;
         tx_info->bss_type = priv->bss_type;
         tx_info->pkt_len = skb->len;
diff --git a/drivers/net/wireless/mwifiex/pcie.c b/drivers/net/wireless/mwifiex/pcie.c
index 574d4b597468..2cc9b6fca490 100644
--- a/drivers/net/wireless/mwifiex/pcie.c
+++ b/drivers/net/wireless/mwifiex/pcie.c
@@ -50,7 +50,7 @@ mwifiex_map_pci_memory(struct mwifiex_adapter *adapter, struct sk_buff *skb,
                 return -1;
         }
         mapping.len = size;
-        memcpy(skb->cb, &mapping, sizeof(mapping));
+        mwifiex_store_mapping(skb, &mapping);
         return 0;
 }
 
@@ -60,7 +60,7 @@ static void mwifiex_unmap_pci_memory(struct mwifiex_adapter *adapter,
         struct pcie_service_card *card = adapter->card;
         struct mwifiex_dma_mapping mapping;
 
-        MWIFIEX_SKB_PACB(skb, &mapping);
+        mwifiex_get_mapping(skb, &mapping);
         pci_unmap_single(card->dev, mapping.addr, mapping.len, flags);
 }
 
diff --git a/drivers/net/wireless/mwifiex/sta_tx.c b/drivers/net/wireless/mwifiex/sta_tx.c
index 5fce7e78a36e..70eb863c7249 100644
--- a/drivers/net/wireless/mwifiex/sta_tx.c
+++ b/drivers/net/wireless/mwifiex/sta_tx.c
@@ -150,6 +150,7 @@ int mwifiex_send_null_packet(struct mwifiex_private *priv, u8 flags)
                 return -1;
 
         tx_info = MWIFIEX_SKB_TXCB(skb);
+        memset(tx_info, 0, sizeof(*tx_info));
         tx_info->bss_num = priv->bss_num;
         tx_info->bss_type = priv->bss_type;
         tx_info->pkt_len = data_len - (sizeof(struct txpd) + INTF_HEADER_LEN);
diff --git a/drivers/net/wireless/mwifiex/tdls.c b/drivers/net/wireless/mwifiex/tdls.c
index e73034fbbde9..0e88364e0c67 100644
--- a/drivers/net/wireless/mwifiex/tdls.c
+++ b/drivers/net/wireless/mwifiex/tdls.c
@@ -605,6 +605,7 @@ int mwifiex_send_tdls_data_frame(struct mwifiex_private *priv, const u8 *peer,
         }
 
         tx_info = MWIFIEX_SKB_TXCB(skb);
+        memset(tx_info, 0, sizeof(*tx_info));
         tx_info->bss_num = priv->bss_num;
         tx_info->bss_type = priv->bss_type;
 
@@ -760,6 +761,7 @@ int mwifiex_send_tdls_action_frame(struct mwifiex_private *priv, const u8 *peer,
         skb->priority = MWIFIEX_PRIO_VI;
 
         tx_info = MWIFIEX_SKB_TXCB(skb);
+        memset(tx_info, 0, sizeof(*tx_info));
         tx_info->bss_num = priv->bss_num;
         tx_info->bss_type = priv->bss_type;
         tx_info->flags |= MWIFIEX_BUF_FLAG_TDLS_PKT;
diff --git a/drivers/net/wireless/mwifiex/txrx.c b/drivers/net/wireless/mwifiex/txrx.c
index 37f26afd4314..fd7e5b9b4581 100644
--- a/drivers/net/wireless/mwifiex/txrx.c
+++ b/drivers/net/wireless/mwifiex/txrx.c
@@ -55,6 +55,7 @@ int mwifiex_handle_rx_packet(struct mwifiex_adapter *adapter,
                 return -1;
         }
 
+        memset(rx_info, 0, sizeof(*rx_info));
         rx_info->bss_num = priv->bss_num;
         rx_info->bss_type = priv->bss_type;
 
diff --git a/drivers/net/wireless/mwifiex/uap_txrx.c b/drivers/net/wireless/mwifiex/uap_txrx.c
index 9a56bc61cb1d..b0601b91cc4f 100644
--- a/drivers/net/wireless/mwifiex/uap_txrx.c
+++ b/drivers/net/wireless/mwifiex/uap_txrx.c
@@ -175,6 +175,7 @@ static void mwifiex_uap_queue_bridged_pkt(struct mwifiex_private *priv,
         }
 
         tx_info = MWIFIEX_SKB_TXCB(skb);
+        memset(tx_info, 0, sizeof(*tx_info));
         tx_info->bss_num = priv->bss_num;
         tx_info->bss_type = priv->bss_type;
         tx_info->flags |= MWIFIEX_BUF_FLAG_BRIDGED_PKT;
diff --git a/drivers/net/wireless/mwifiex/util.h b/drivers/net/wireless/mwifiex/util.h
index ddae57021397..caadb3737b9e 100644
--- a/drivers/net/wireless/mwifiex/util.h
+++ b/drivers/net/wireless/mwifiex/util.h
@@ -20,32 +20,55 @@
 #ifndef _MWIFIEX_UTIL_H_
 #define _MWIFIEX_UTIL_H_
 
+struct mwifiex_dma_mapping {
+        dma_addr_t addr;
+        size_t len;
+};
+
+struct mwifiex_cb {
+        struct mwifiex_dma_mapping dma_mapping;
+        union {
+                struct mwifiex_rxinfo rx_info;
+                struct mwifiex_txinfo tx_info;
+        };
+};
+
 static inline struct mwifiex_rxinfo *MWIFIEX_SKB_RXCB(struct sk_buff *skb)
 {
-        return (struct mwifiex_rxinfo *)(skb->cb + sizeof(dma_addr_t));
+        struct mwifiex_cb *cb = (struct mwifiex_cb *)skb->cb;
+
+        BUILD_BUG_ON(sizeof(struct mwifiex_cb) > sizeof(skb->cb));
+        return &cb->rx_info;
 }
 
 static inline struct mwifiex_txinfo *MWIFIEX_SKB_TXCB(struct sk_buff *skb)
 {
-        return (struct mwifiex_txinfo *)(skb->cb + sizeof(dma_addr_t));
+        struct mwifiex_cb *cb = (struct mwifiex_cb *)skb->cb;
+
+        return &cb->tx_info;
 }
 
-struct mwifiex_dma_mapping {
-        dma_addr_t addr;
-        size_t len;
-};
+static inline void mwifiex_store_mapping(struct sk_buff *skb,
+                                         struct mwifiex_dma_mapping *mapping)
+{
+        struct mwifiex_cb *cb = (struct mwifiex_cb *)skb->cb;
+
+        memcpy(&cb->dma_mapping, mapping, sizeof(*mapping));
+}
 
-static inline void MWIFIEX_SKB_PACB(struct sk_buff *skb,
-                                        struct mwifiex_dma_mapping *mapping)
+static inline void mwifiex_get_mapping(struct sk_buff *skb,
+                                       struct mwifiex_dma_mapping *mapping)
 {
-        memcpy(mapping, skb->cb, sizeof(*mapping));
+        struct mwifiex_cb *cb = (struct mwifiex_cb *)skb->cb;
+
+        memcpy(mapping, &cb->dma_mapping, sizeof(*mapping));
 }
 
 static inline dma_addr_t MWIFIEX_SKB_DMA_ADDR(struct sk_buff *skb)
 {
         struct mwifiex_dma_mapping mapping;
 
-        MWIFIEX_SKB_PACB(skb, &mapping);
+        mwifiex_get_mapping(skb, &mapping);
 
         return mapping.addr;
 }
diff --git a/drivers/net/wireless/rt2x00/rt2500pci.c b/drivers/net/wireless/rt2x00/rt2500pci.c
index 2f1cd929c6f6..a511cccc9f01 100644
--- a/drivers/net/wireless/rt2x00/rt2500pci.c
+++ b/drivers/net/wireless/rt2x00/rt2500pci.c
@@ -1681,8 +1681,13 @@ static int rt2500pci_init_eeprom(struct rt2x00_dev *rt2x00dev)
         /*
          * Detect if this device has an hardware controlled radio.
          */
-        if (rt2x00_get_field16(eeprom, EEPROM_ANTENNA_HARDWARE_RADIO))
+        if (rt2x00_get_field16(eeprom, EEPROM_ANTENNA_HARDWARE_RADIO)) {
                 __set_bit(CAPABILITY_HW_BUTTON, &rt2x00dev->cap_flags);
+                /*
+                 * On this device RFKILL initialized during probe does not work.
+                 */
+                __set_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags);
+        }
 
         /*
          * Check if the BBP tuning should be enabled.
diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c
index a49c3d73ea2c..832006b5aab1 100644
--- a/drivers/net/wireless/rt2x00/rt2800usb.c
+++ b/drivers/net/wireless/rt2x00/rt2800usb.c
@@ -229,6 +229,31 @@ static enum hrtimer_restart rt2800usb_tx_sta_fifo_timeout(struct hrtimer *timer)
 /*
  * Firmware functions
  */
+static int rt2800usb_autorun_detect(struct rt2x00_dev *rt2x00dev)
+{
+        __le32 *reg;
+        u32 fw_mode;
+
+        reg = kmalloc(sizeof(*reg), GFP_KERNEL);
+        if (reg == NULL)
+                return -ENOMEM;
+        /* cannot use rt2x00usb_register_read here as it uses different
+         * mode (MULTI_READ vs. DEVICE_MODE) and does not pass the
+         * magic value USB_MODE_AUTORUN (0x11) to the device, thus the
+         * returned value would be invalid.
+         */
+        rt2x00usb_vendor_request(rt2x00dev, USB_DEVICE_MODE,
+                                 USB_VENDOR_REQUEST_IN, 0, USB_MODE_AUTORUN,
+                                 reg, sizeof(*reg), REGISTER_TIMEOUT_FIRMWARE);
+        fw_mode = le32_to_cpu(*reg);
+        kfree(reg);
+
+        if ((fw_mode & 0x00000003) == 2)
+                return 1;
+
+        return 0;
+}
+
 static char *rt2800usb_get_firmware_name(struct rt2x00_dev *rt2x00dev)
 {
         return FIRMWARE_RT2870;
@@ -240,6 +265,7 @@ static int rt2800usb_write_firmware(struct rt2x00_dev *rt2x00dev,
         int status;
         u32 offset;
         u32 length;
+        int retval;
 
         /*
          * Check which section of the firmware we need.
@@ -257,8 +283,16 @@ static int rt2800usb_write_firmware(struct rt2x00_dev *rt2x00dev,
         /*
          * Write firmware to device.
          */
-        rt2x00usb_register_multiwrite(rt2x00dev, FIRMWARE_IMAGE_BASE,
-                                      data + offset, length);
+        retval = rt2800usb_autorun_detect(rt2x00dev);
+        if (retval < 0)
+                return retval;
+        if (retval) {
+                rt2x00_info(rt2x00dev,
+                            "Firmware loading not required - NIC in AutoRun mode\n");
+        } else {
+                rt2x00usb_register_multiwrite(rt2x00dev, FIRMWARE_IMAGE_BASE,
+                                              data + offset, length);
+        }
 
         rt2x00usb_register_write(rt2x00dev, H2M_MAILBOX_CID, ~0);
         rt2x00usb_register_write(rt2x00dev, H2M_MAILBOX_STATUS, ~0);
@@ -735,11 +769,26 @@ static void rt2800usb_fill_rxdone(struct queue_entry *entry,
 /*
  * Device probe functions.
  */
+static int rt2800usb_efuse_detect(struct rt2x00_dev *rt2x00dev)
+{
+        int retval;
+
+        retval = rt2800usb_autorun_detect(rt2x00dev);
+        if (retval < 0)
+                return retval;
+        if (retval)
+                return 1;
+        return rt2800_efuse_detect(rt2x00dev);
+}
+
 static int rt2800usb_read_eeprom(struct rt2x00_dev *rt2x00dev)
 {
         int retval;
 
-        if (rt2800_efuse_detect(rt2x00dev))
+        retval = rt2800usb_efuse_detect(rt2x00dev);
+        if (retval < 0)
+                return retval;
+        if (retval)
                 retval = rt2800_read_eeprom_efuse(rt2x00dev);
         else
                 retval = rt2x00usb_eeprom_read(rt2x00dev, rt2x00dev->eeprom,
diff --git a/drivers/net/wireless/rt2x00/rt2x00.h b/drivers/net/wireless/rt2x00/rt2x00.h
index 010b76505243..d13f25cd70d5 100644
--- a/drivers/net/wireless/rt2x00/rt2x00.h
+++ b/drivers/net/wireless/rt2x00/rt2x00.h
@@ -693,6 +693,7 @@ enum rt2x00_capability_flags {
         REQUIRE_SW_SEQNO,
         REQUIRE_HT_TX_DESC,
         REQUIRE_PS_AUTOWAKE,
+        REQUIRE_DELAYED_RFKILL,
 
         /*
          * Capabilities
diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
index 2bde6729f5e6..4fa43a2eeb73 100644
--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
@@ -1126,9 +1126,10 @@ static void rt2x00lib_uninitialize(struct rt2x00_dev *rt2x00dev)
                 return;
 
         /*
-         * Unregister extra components.
+         * Stop rfkill polling.
          */
-        rt2x00rfkill_unregister(rt2x00dev);
+        if (test_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags))
+                rt2x00rfkill_unregister(rt2x00dev);
 
         /*
          * Allow the HW to uninitialize.
@@ -1166,6 +1167,12 @@ static int rt2x00lib_initialize(struct rt2x00_dev *rt2x00dev)
 
         set_bit(DEVICE_STATE_INITIALIZED, &rt2x00dev->flags);
 
+        /*
+         * Start rfkill polling.
+         */
+        if (test_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags))
+                rt2x00rfkill_register(rt2x00dev);
+
         return 0;
 }
 
@@ -1375,7 +1382,12 @@ int rt2x00lib_probe_dev(struct rt2x00_dev *rt2x00dev)
         rt2x00link_register(rt2x00dev);
         rt2x00leds_register(rt2x00dev);
         rt2x00debug_register(rt2x00dev);
-        rt2x00rfkill_register(rt2x00dev);
+
+        /*
+         * Start rfkill polling.
+         */
+        if (!test_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags))
+                rt2x00rfkill_register(rt2x00dev);
 
         return 0;
 
@@ -1391,6 +1403,12 @@ void rt2x00lib_remove_dev(struct rt2x00_dev *rt2x00dev)
         clear_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags);
 
         /*
+         * Stop rfkill polling.
+         */
+        if (!test_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags))
+                rt2x00rfkill_unregister(rt2x00dev);
+
+        /*
          * Disable radio.
          */
         rt2x00lib_disable_radio(rt2x00dev);
diff --git a/drivers/net/wireless/rt2x00/rt2x00mac.c b/drivers/net/wireless/rt2x00/rt2x00mac.c
index 212ac4842c16..004dff9b962d 100644
--- a/drivers/net/wireless/rt2x00/rt2x00mac.c
+++ b/drivers/net/wireless/rt2x00/rt2x00mac.c
@@ -487,6 +487,8 @@ int rt2x00mac_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
         crypto.cipher = rt2x00crypto_key_to_cipher(key);
         if (crypto.cipher == CIPHER_NONE)
                 return -EOPNOTSUPP;
+        if (crypto.cipher == CIPHER_TKIP && rt2x00_is_usb(rt2x00dev))
+                return -EOPNOTSUPP;
 
         crypto.cmd = cmd;
 
diff --git a/drivers/net/wireless/rt2x00/rt2x00usb.h b/drivers/net/wireless/rt2x00/rt2x00usb.h
index e7bcf62347d5..831b65f93feb 100644
--- a/drivers/net/wireless/rt2x00/rt2x00usb.h
+++ b/drivers/net/wireless/rt2x00/rt2x00usb.h
@@ -93,6 +93,7 @@ enum rt2x00usb_mode_offset {
         USB_MODE_SLEEP = 7,     /* RT73USB */
         USB_MODE_FIRMWARE = 8,  /* RT73USB */
         USB_MODE_WAKEUP = 9,    /* RT73USB */
+        USB_MODE_AUTORUN = 17, /* RT2800USB */
 };
 
 /**
diff --git a/drivers/net/xen-netback/common.h b/drivers/net/xen-netback/common.h
index 4dd7c4a1923b..2532ce85d718 100644
--- a/drivers/net/xen-netback/common.h
+++ b/drivers/net/xen-netback/common.h
@@ -222,6 +222,7 @@ struct xenvif {
 
         /* Queues */
         struct xenvif_queue *queues;
+        unsigned int num_queues; /* active queues, resource allocated */
 
         /* Miscellaneous private stuff. */
         struct net_device *dev;
diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
index 852da34b8961..9e97c7ca0ddd 100644
--- a/drivers/net/xen-netback/interface.c
+++ b/drivers/net/xen-netback/interface.c
@@ -137,32 +137,11 @@ static void xenvif_wake_queue_callback(unsigned long data)
         }
 }
 
-static u16 xenvif_select_queue(struct net_device *dev, struct sk_buff *skb,
-                               void *accel_priv, select_queue_fallback_t fallback)
-{
-        unsigned int num_queues = dev->real_num_tx_queues;
-        u32 hash;
-        u16 queue_index;
-
-        /* First, check if there is only one queue to optimise the
-         * single-queue or old frontend scenario.
-         */
-        if (num_queues == 1) {
-                queue_index = 0;
-        } else {
-                /* Use skb_get_hash to obtain an L4 hash if available */
-                hash = skb_get_hash(skb);
-                queue_index = hash % num_queues;
-        }
-
-        return queue_index;
-}
-
 static int xenvif_start_xmit(struct sk_buff *skb, struct net_device *dev)
 {
         struct xenvif *vif = netdev_priv(dev);
         struct xenvif_queue *queue = NULL;
-        unsigned int num_queues = dev->real_num_tx_queues;
+        unsigned int num_queues = vif->num_queues;
         u16 index;
         int min_slots_needed;
 
@@ -225,7 +204,7 @@ static struct net_device_stats *xenvif_get_stats(struct net_device *dev)
 {
         struct xenvif *vif = netdev_priv(dev);
         struct xenvif_queue *queue = NULL;
-        unsigned int num_queues = dev->real_num_tx_queues;
+        unsigned int num_queues = vif->num_queues;
         unsigned long rx_bytes = 0;
         unsigned long rx_packets = 0;
         unsigned long tx_bytes = 0;
@@ -256,7 +235,7 @@ out:
 static void xenvif_up(struct xenvif *vif)
 {
         struct xenvif_queue *queue = NULL;
-        unsigned int num_queues = vif->dev->real_num_tx_queues;
+        unsigned int num_queues = vif->num_queues;
         unsigned int queue_index;
 
         for (queue_index = 0; queue_index < num_queues; ++queue_index) {
@@ -272,7 +251,7 @@ static void xenvif_up(struct xenvif *vif)
 static void xenvif_down(struct xenvif *vif)
 {
         struct xenvif_queue *queue = NULL;
-        unsigned int num_queues = vif->dev->real_num_tx_queues;
+        unsigned int num_queues = vif->num_queues;
         unsigned int queue_index;
 
         for (queue_index = 0; queue_index < num_queues; ++queue_index) {
@@ -379,7 +358,7 @@ static void xenvif_get_ethtool_stats(struct net_device *dev,
                                      struct ethtool_stats *stats, u64 * data)
 {
         struct xenvif *vif = netdev_priv(dev);
-        unsigned int num_queues = dev->real_num_tx_queues;
+        unsigned int num_queues = vif->num_queues;
         int i;
         unsigned int queue_index;
         struct xenvif_stats *vif_stats;
@@ -424,7 +403,6 @@ static const struct net_device_ops xenvif_netdev_ops = {
         .ndo_fix_features = xenvif_fix_features,
         .ndo_set_mac_address = eth_mac_addr,
         .ndo_validate_addr   = eth_validate_addr,
-        .ndo_select_queue = xenvif_select_queue,
 };
 
 struct xenvif *xenvif_alloc(struct device *parent, domid_t domid,
@@ -438,7 +416,7 @@ struct xenvif *xenvif_alloc(struct device *parent, domid_t domid,
         snprintf(name, IFNAMSIZ - 1, "vif%u.%u", domid, handle);
         /* Allocate a netdev with the max. supported number of queues.
          * When the guest selects the desired number, it will be updated
-         * via netif_set_real_num_tx_queues().
+         * via netif_set_real_num_*_queues().
          */
         dev = alloc_netdev_mq(sizeof(struct xenvif), name, ether_setup,
                               xenvif_max_queues);
@@ -458,11 +436,9 @@ struct xenvif *xenvif_alloc(struct device *parent, domid_t domid,
         vif->dev = dev;
         vif->disabled = false;
 
-        /* Start out with no queues. The call below does not require
-         * rtnl_lock() as it happens before register_netdev().
-         */
+        /* Start out with no queues. */
         vif->queues = NULL;
-        netif_set_real_num_tx_queues(dev, 0);
+        vif->num_queues = 0;
 
         dev->netdev_ops = &xenvif_netdev_ops;
         dev->hw_features = NETIF_F_SG |
@@ -677,7 +653,7 @@ static void xenvif_wait_unmap_timeout(struct xenvif_queue *queue,
 void xenvif_disconnect(struct xenvif *vif)
 {
         struct xenvif_queue *queue = NULL;
-        unsigned int num_queues = vif->dev->real_num_tx_queues;
+        unsigned int num_queues = vif->num_queues;
         unsigned int queue_index;
 
         if (netif_carrier_ok(vif->dev))
@@ -724,7 +700,7 @@ void xenvif_deinit_queue(struct xenvif_queue *queue)
 void xenvif_free(struct xenvif *vif)
 {
         struct xenvif_queue *queue = NULL;
-        unsigned int num_queues = vif->dev->real_num_tx_queues;
+        unsigned int num_queues = vif->num_queues;
         unsigned int queue_index;
         /* Here we want to avoid timeout messages if an skb can be legitimately
          * stuck somewhere else. Realistically this could be an another vif's
@@ -748,12 +724,9 @@ void xenvif_free(struct xenvif *vif)
                 xenvif_deinit_queue(queue);
         }
 
-        /* Free the array of queues. The call below does not require
-         * rtnl_lock() because it happens after unregister_netdev().
-         */
-        netif_set_real_num_tx_queues(vif->dev, 0);
         vfree(vif->queues);
         vif->queues = NULL;
+        vif->num_queues = 0;
 
         free_netdev(vif->dev);
 
diff --git a/drivers/net/xen-netback/xenbus.c b/drivers/net/xen-netback/xenbus.c
index 96c63dc2509e..3d85acd84bad 100644
--- a/drivers/net/xen-netback/xenbus.c
+++ b/drivers/net/xen-netback/xenbus.c
@@ -527,9 +527,7 @@ static void connect(struct backend_info *be)
         /* Use the number of queues requested by the frontend */
         be->vif->queues = vzalloc(requested_num_queues *
                                   sizeof(struct xenvif_queue));
-        rtnl_lock();
-        netif_set_real_num_tx_queues(be->vif->dev, requested_num_queues);
-        rtnl_unlock();
+        be->vif->num_queues = requested_num_queues;
 
         for (queue_index = 0; queue_index < requested_num_queues; ++queue_index) {
                 queue = &be->vif->queues[queue_index];
@@ -546,9 +544,7 @@ static void connect(struct backend_info *be)
                          * earlier queues can be destroyed using the regular
                          * disconnect logic.
                          */
-                        rtnl_lock();
-                        netif_set_real_num_tx_queues(be->vif->dev, queue_index);
-                        rtnl_unlock();
+                        be->vif->num_queues = queue_index;
                         goto err;
                 }
 
@@ -561,13 +557,19 @@ static void connect(struct backend_info *be)
                          * and also clean up any previously initialised queues.
                          */
                         xenvif_deinit_queue(queue);
-                        rtnl_lock();
-                        netif_set_real_num_tx_queues(be->vif->dev, queue_index);
-                        rtnl_unlock();
+                        be->vif->num_queues = queue_index;
                         goto err;
                 }
         }
 
+        /* Initialisation completed, tell core driver the number of
+         * active queues.
+         */
+        rtnl_lock();
+        netif_set_real_num_tx_queues(be->vif->dev, requested_num_queues);
+        netif_set_real_num_rx_queues(be->vif->dev, requested_num_queues);
+        rtnl_unlock();
+
         xenvif_carrier_on(be->vif);
 
         unregister_hotplug_status_watch(be);
@@ -582,13 +584,11 @@ static void connect(struct backend_info *be)
         return;
 
 err:
-        if (be->vif->dev->real_num_tx_queues > 0)
+        if (be->vif->num_queues > 0)
                 xenvif_disconnect(be->vif); /* Clean up existing queues */
         vfree(be->vif->queues);
         be->vif->queues = NULL;
-        rtnl_lock();
-        netif_set_real_num_tx_queues(be->vif->dev, 0);
-        rtnl_unlock();
+        be->vif->num_queues = 0;
         return;
 }
 
@@ -596,7 +596,7 @@ err:
 static int connect_rings(struct backend_info *be, struct xenvif_queue *queue)
 {
         struct xenbus_device *dev = be->dev;
-        unsigned int num_queues = queue->vif->dev->real_num_tx_queues;
+        unsigned int num_queues = queue->vif->num_queues;
         unsigned long tx_ring_ref, rx_ring_ref;
         unsigned int tx_evtchn, rx_evtchn;
         int err;
diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
index 5a7872ac3566..055222bae6e4 100644
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -1287,7 +1287,7 @@ static irqreturn_t xennet_rx_interrupt(int irq, void *dev_id)
 
         if (likely(netif_carrier_ok(dev) &&
                    RING_HAS_UNCONSUMED_RESPONSES(&queue->rx)))
-                        napi_schedule(&queue->napi);
+                napi_schedule(&queue->napi);
 
         return IRQ_HANDLED;
 }
@@ -1437,16 +1437,12 @@ static void xennet_end_access(int ref, void *page)
 static void xennet_disconnect_backend(struct netfront_info *info)
 {
         unsigned int i = 0;
-        struct netfront_queue *queue = NULL;
         unsigned int num_queues = info->netdev->real_num_tx_queues;
 
+        netif_carrier_off(info->netdev);
+
         for (i = 0; i < num_queues; ++i) {
-                /* Stop old i/f to prevent errors whilst we rebuild the state. */
-                spin_lock_bh(&queue->rx_lock);
-                spin_lock_irq(&queue->tx_lock);
-                netif_carrier_off(queue->info->netdev);
-                spin_unlock_irq(&queue->tx_lock);
-                spin_unlock_bh(&queue->rx_lock);
+                struct netfront_queue *queue = &info->queues[i];
 
                 if (queue->tx_irq && (queue->tx_irq == queue->rx_irq))
                         unbind_from_irqhandler(queue->tx_irq, queue);
@@ -1457,6 +1453,8 @@ static void xennet_disconnect_backend(struct netfront_info *info)
                 queue->tx_evtchn = queue->rx_evtchn = 0;
                 queue->tx_irq = queue->rx_irq = 0;
 
+                napi_synchronize(&queue->napi);
+
                 /* End access and free the pages */
                 xennet_end_access(queue->tx_ring_ref, queue->tx.sring);
                 xennet_end_access(queue->rx_ring_ref, queue->rx.sring);
@@ -1698,8 +1696,6 @@ static int xennet_init_queue(struct netfront_queue *queue)
                 goto exit_free_tx;
         }
 
-        netif_napi_add(queue->info->netdev, &queue->napi, xennet_poll, 64);
-
         return 0;
 
  exit_free_tx:
@@ -1790,6 +1786,70 @@ error:
         return err;
 }
 
+static void xennet_destroy_queues(struct netfront_info *info)
+{
+        unsigned int i;
+
+        rtnl_lock();
+
+        for (i = 0; i < info->netdev->real_num_tx_queues; i++) {
+                struct netfront_queue *queue = &info->queues[i];
+
+                if (netif_running(info->netdev))
+                        napi_disable(&queue->napi);
+                netif_napi_del(&queue->napi);
+        }
+
+        rtnl_unlock();
+
+        kfree(info->queues);
+        info->queues = NULL;
+}
+
+static int xennet_create_queues(struct netfront_info *info,
+                                unsigned int num_queues)
+{
+        unsigned int i;
+        int ret;
+
+        info->queues = kcalloc(num_queues, sizeof(struct netfront_queue),
+                               GFP_KERNEL);
+        if (!info->queues)
+                return -ENOMEM;
+
+        rtnl_lock();
+
+        for (i = 0; i < num_queues; i++) {
+                struct netfront_queue *queue = &info->queues[i];
+
+                queue->id = i;
+                queue->info = info;
+
+                ret = xennet_init_queue(queue);
+                if (ret < 0) {
+                        dev_warn(&info->netdev->dev, "only created %d queues\n",
+                                 num_queues);
+                        num_queues = i;
+                        break;
+                }
+
+                netif_napi_add(queue->info->netdev, &queue->napi,
+                               xennet_poll, 64);
+                if (netif_running(info->netdev))
+                        napi_enable(&queue->napi);
+        }
+
+        netif_set_real_num_tx_queues(info->netdev, num_queues);
+
+        rtnl_unlock();
+
+        if (num_queues == 0) {
+                dev_err(&info->netdev->dev, "no queues\n");
+                return -EINVAL;
+        }
+        return 0;
+}
+
 /* Common code used when first setting up, and when resuming. */
 static int talk_to_netback(struct xenbus_device *dev,
                            struct netfront_info *info)
@@ -1826,42 +1886,20 @@ static int talk_to_netback(struct xenbus_device *dev,
                 goto out;
         }
 
-        /* Allocate array of queues */
-        info->queues = kcalloc(num_queues, sizeof(struct netfront_queue), GFP_KERNEL);
-        if (!info->queues) {
-                err = -ENOMEM;
-                goto out;
-        }
-        rtnl_lock();
-        netif_set_real_num_tx_queues(info->netdev, num_queues);
-        rtnl_unlock();
+        if (info->queues)
+                xennet_destroy_queues(info);
+
+        err = xennet_create_queues(info, num_queues);
+        if (err < 0)
+                goto destroy_ring;
 
         /* Create shared ring, alloc event channel -- for each queue */
         for (i = 0; i < num_queues; ++i) {
                 queue = &info->queues[i];
-                queue->id = i;
-                queue->info = info;
-                err = xennet_init_queue(queue);
-                if (err) {
-                        /* xennet_init_queue() cleans up after itself on failure,
-                         * but we still have to clean up any previously initialised
-                         * queues. If i > 0, set num_queues to i, then goto
-                         * destroy_ring, which calls xennet_disconnect_backend()
-                         * to tidy up.
-                         */
-                        if (i > 0) {
-                                rtnl_lock();
-                                netif_set_real_num_tx_queues(info->netdev, i);
-                                rtnl_unlock();
-                                goto destroy_ring;
-                        } else {
-                                goto out;
-                        }
-                }
                 err = setup_netfront(dev, queue, feature_split_evtchn);
                 if (err) {
-                        /* As for xennet_init_queue(), setup_netfront() will tidy
-                         * up the current queue on error, but we need to clean up
+                        /* setup_netfront() will tidy up the current
+                         * queue on error, but we need to clean up
                          * those already allocated.
                          */
                         if (i > 0) {
@@ -2005,13 +2043,15 @@ static int xennet_connect(struct net_device *dev)
         /* By now, the queue structures have been set up */
         for (j = 0; j < num_queues; ++j) {
                 queue = &np->queues[j];
-                spin_lock_bh(&queue->rx_lock);
-                spin_lock_irq(&queue->tx_lock);
 
                 /* Step 1: Discard all pending TX packet fragments. */
+                spin_lock_irq(&queue->tx_lock);
                 xennet_release_tx_bufs(queue);
+                spin_unlock_irq(&queue->tx_lock);
 
                 /* Step 2: Rebuild the RX buffer freelist and the RX ring itself. */
+                spin_lock_bh(&queue->rx_lock);
+
                 for (requeue_idx = 0, i = 0; i < NET_RX_RING_SIZE; i++) {
                         skb_frag_t *frag;
                         const struct page *page;
@@ -2035,6 +2075,8 @@ static int xennet_connect(struct net_device *dev)
                 }
 
                 queue->rx.req_prod_pvt = requeue_idx;
+
+                spin_unlock_bh(&queue->rx_lock);
         }
 
         /*
@@ -2046,13 +2088,17 @@ static int xennet_connect(struct net_device *dev)
         netif_carrier_on(np->netdev);
         for (j = 0; j < num_queues; ++j) {
                 queue = &np->queues[j];
+
                 notify_remote_via_irq(queue->tx_irq);
                 if (queue->tx_irq != queue->rx_irq)
                         notify_remote_via_irq(queue->rx_irq);
-                xennet_tx_buf_gc(queue);
-                xennet_alloc_rx_buffers(queue);
 
+                spin_lock_irq(&queue->tx_lock);
+                xennet_tx_buf_gc(queue);
                 spin_unlock_irq(&queue->tx_lock);
+
+                spin_lock_bh(&queue->rx_lock);
+                xennet_alloc_rx_buffers(queue);
                 spin_unlock_bh(&queue->rx_lock);
         }