19 files changed, 289 insertions, 106 deletions

diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 38a83acd502e..43f2ea541088 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -3419,9 +3419,27 @@ static int bond_xmit_hash_policy_l2(struct sk_buff *skb, int count)
 static int bond_open(struct net_device *bond_dev)
 {
         struct bonding *bond = netdev_priv(bond_dev);
+        struct slave *slave;
+        int i;
 
         bond->kill_timers = 0;
 
+        /* reset slave->backup and slave->inactive */
+        read_lock(&bond->lock);
+        if (bond->slave_cnt > 0) {
+                read_lock(&bond->curr_slave_lock);
+                bond_for_each_slave(bond, slave, i) {
+                        if ((bond->params.mode == BOND_MODE_ACTIVEBACKUP)
+                                && (slave != bond->curr_active_slave)) {
+                                bond_set_slave_inactive_flags(slave);
+                        } else {
+                                bond_set_slave_active_flags(slave);
+                        }
+                }
+                read_unlock(&bond->curr_slave_lock);
+        }
+        read_unlock(&bond->lock);
+
         INIT_DELAYED_WORK(&bond->mcast_work, bond_resend_igmp_join_requests_delayed);
 
         if (bond_is_lb(bond)) {
diff --git a/drivers/net/can/sja1000/plx_pci.c b/drivers/net/can/sja1000/plx_pci.c
index 231385b8e08f..c7f3d4ea1167 100644
--- a/drivers/net/can/sja1000/plx_pci.c
+++ b/drivers/net/can/sja1000/plx_pci.c
@@ -408,7 +408,7 @@ static void plx_pci_del_card(struct pci_dev *pdev)
         struct sja1000_priv *priv;
         int i = 0;
 
-        for (i = 0; i < card->channels; i++) {
+        for (i = 0; i < PLX_PCI_MAX_CHAN; i++) {
                 dev = card->net_dev[i];
                 if (!dev)
                         continue;
@@ -536,7 +536,6 @@ static int __devinit plx_pci_add_card(struct pci_dev *pdev,
                         if (err) {
                                 dev_err(&pdev->dev, "Registering device failed "
                                         "(err=%d)\n", err);
-                                free_sja1000dev(dev);
                                 goto failure_cleanup;
                         }
 
@@ -549,6 +548,7 @@ static int __devinit plx_pci_add_card(struct pci_dev *pdev,
                         dev_err(&pdev->dev, "Channel #%d not detected\n",
                                 i + 1);
                         free_sja1000dev(dev);
+                        card->net_dev[i] = NULL;
                 }
         }
 
diff --git a/drivers/net/e1000e/e1000.h b/drivers/net/e1000e/e1000.h
index 35916f485028..8533ad7f3559 100644
--- a/drivers/net/e1000e/e1000.h
+++ b/drivers/net/e1000e/e1000.h
@@ -155,6 +155,9 @@ struct e1000_info;
 #define HV_M_STATUS_SPEED_1000            0x0200
 #define HV_M_STATUS_LINK_UP               0x0040
 
+#define E1000_ICH_FWSM_PCIM2PCI         0x01000000 /* ME PCIm-to-PCI active */
+#define E1000_ICH_FWSM_PCIM2PCI_COUNT   2000
+
 /* Time to wait before putting the device into D3 if there's no link (in ms). */
 #define LINK_TIMEOUT            100
 
@@ -454,6 +457,7 @@ struct e1000_info {
 #define FLAG2_DISABLE_AIM                 (1 << 8)
 #define FLAG2_CHECK_PHY_HANG              (1 << 9)
 #define FLAG2_NO_DISABLE_RX               (1 << 10)
+#define FLAG2_PCIM2PCI_ARBITER_WA         (1 << 11)
 
 #define E1000_RX_DESC_PS(R, i)      \
         (&(((union e1000_rx_desc_packet_split *)((R).desc))[i]))
diff --git a/drivers/net/e1000e/ich8lan.c b/drivers/net/e1000e/ich8lan.c
index 4e36978b8fd8..54add27c8f76 100644
--- a/drivers/net/e1000e/ich8lan.c
+++ b/drivers/net/e1000e/ich8lan.c
@@ -137,8 +137,9 @@
 #define HV_PM_CTRL              PHY_REG(770, 17)
 
 /* PHY Low Power Idle Control */
-#define I82579_LPI_CTRL                 PHY_REG(772, 20)
-#define I82579_LPI_CTRL_ENABLE_MASK     0x6000
+#define I82579_LPI_CTRL                         PHY_REG(772, 20)
+#define I82579_LPI_CTRL_ENABLE_MASK             0x6000
+#define I82579_LPI_CTRL_FORCE_PLL_LOCK_COUNT    0x80
 
 /* EMI Registers */
 #define I82579_EMI_ADDR         0x10
@@ -163,6 +164,11 @@
 #define HV_KMRN_MODE_CTRL      PHY_REG(769, 16)
 #define HV_KMRN_MDIO_SLOW      0x0400
 
+/* KMRN FIFO Control and Status */
+#define HV_KMRN_FIFO_CTRLSTA                  PHY_REG(770, 16)
+#define HV_KMRN_FIFO_CTRLSTA_PREAMBLE_MASK    0x7000
+#define HV_KMRN_FIFO_CTRLSTA_PREAMBLE_SHIFT   12
+
 /* ICH GbE Flash Hardware Sequencing Flash Status Register bit breakdown */
 /* Offset 04h HSFSTS */
 union ich8_hws_flash_status {
@@ -657,6 +663,7 @@ static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw)
         struct e1000_mac_info *mac = &hw->mac;
         s32 ret_val;
         bool link;
+        u16 phy_reg;
 
         /*
          * We only want to go out to the PHY registers to see if Auto-Neg
@@ -689,16 +696,35 @@ static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw)
 
         mac->get_link_status = false;
 
-        if (hw->phy.type == e1000_phy_82578) {
-                ret_val = e1000_link_stall_workaround_hv(hw);
-                if (ret_val)
-                        goto out;
-        }
-
-        if (hw->mac.type == e1000_pch2lan) {
+        switch (hw->mac.type) {
+        case e1000_pch2lan:
                 ret_val = e1000_k1_workaround_lv(hw);
                 if (ret_val)
                         goto out;
+                /* fall-thru */
+        case e1000_pchlan:
+                if (hw->phy.type == e1000_phy_82578) {
+                        ret_val = e1000_link_stall_workaround_hv(hw);
+                        if (ret_val)
+                                goto out;
+                }
+
+                /*
+                 * Workaround for PCHx parts in half-duplex:
+                 * Set the number of preambles removed from the packet
+                 * when it is passed from the PHY to the MAC to prevent
+                 * the MAC from misinterpreting the packet type.
+                 */
+                e1e_rphy(hw, HV_KMRN_FIFO_CTRLSTA, &phy_reg);
+                phy_reg &= ~HV_KMRN_FIFO_CTRLSTA_PREAMBLE_MASK;
+
+                if ((er32(STATUS) & E1000_STATUS_FD) != E1000_STATUS_FD)
+                        phy_reg |= (1 << HV_KMRN_FIFO_CTRLSTA_PREAMBLE_SHIFT);
+
+                e1e_wphy(hw, HV_KMRN_FIFO_CTRLSTA, phy_reg);
+                break;
+        default:
+                break;
         }
 
         /*
@@ -788,6 +814,11 @@ static s32 e1000_get_variants_ich8lan(struct e1000_adapter *adapter)
             (adapter->hw.phy.type == e1000_phy_igp_3))
                 adapter->flags |= FLAG_LSC_GIG_SPEED_DROP;
 
+        /* Enable workaround for 82579 w/ ME enabled */
+        if ((adapter->hw.mac.type == e1000_pch2lan) &&
+            (er32(FWSM) & E1000_ICH_FWSM_FW_VALID))
+                adapter->flags2 |= FLAG2_PCIM2PCI_ARBITER_WA;
+
         /* Disable EEE by default until IEEE802.3az spec is finalized */
         if (adapter->flags2 & FLAG2_HAS_EEE)
                 adapter->hw.dev_spec.ich8lan.eee_disable = true;
@@ -1355,7 +1386,7 @@ static s32 e1000_hv_phy_workarounds_ich8lan(struct e1000_hw *hw)
                         return ret_val;
 
                 /* Preamble tuning for SSC */
-                ret_val = e1e_wphy(hw, PHY_REG(770, 16), 0xA204);
+                ret_val = e1e_wphy(hw, HV_KMRN_FIFO_CTRLSTA, 0xA204);
                 if (ret_val)
                         return ret_val;
         }
@@ -1645,6 +1676,7 @@ static s32 e1000_k1_workaround_lv(struct e1000_hw *hw)
         s32 ret_val = 0;
         u16 status_reg = 0;
         u32 mac_reg;
+        u16 phy_reg;
 
         if (hw->mac.type != e1000_pch2lan)
                 goto out;
@@ -1659,12 +1691,19 @@ static s32 e1000_k1_workaround_lv(struct e1000_hw *hw)
                 mac_reg = er32(FEXTNVM4);
                 mac_reg &= ~E1000_FEXTNVM4_BEACON_DURATION_MASK;
 
-                if (status_reg & HV_M_STATUS_SPEED_1000)
+                ret_val = e1e_rphy(hw, I82579_LPI_CTRL, &phy_reg);
+                if (ret_val)
+                        goto out;
+
+                if (status_reg & HV_M_STATUS_SPEED_1000) {
                         mac_reg |= E1000_FEXTNVM4_BEACON_DURATION_8USEC;
-                else
+                        phy_reg &= ~I82579_LPI_CTRL_FORCE_PLL_LOCK_COUNT;
+                } else {
                         mac_reg |= E1000_FEXTNVM4_BEACON_DURATION_16USEC;
-
+                        phy_reg |= I82579_LPI_CTRL_FORCE_PLL_LOCK_COUNT;
+                }
                 ew32(FEXTNVM4, mac_reg);
+                ret_val = e1e_wphy(hw, I82579_LPI_CTRL, phy_reg);
         }
 
 out:
diff --git a/drivers/net/e1000e/netdev.c b/drivers/net/e1000e/netdev.c
index 362f70382cdd..2198e615f241 100644
--- a/drivers/net/e1000e/netdev.c
+++ b/drivers/net/e1000e/netdev.c
@@ -519,6 +519,63 @@ static void e1000_rx_checksum(struct e1000_adapter *adapter, u32 status_err,
 }
 
 /**
+ * e1000e_update_tail_wa - helper function for e1000e_update_[rt]dt_wa()
+ * @hw: pointer to the HW structure
+ * @tail: address of tail descriptor register
+ * @i: value to write to tail descriptor register
+ *
+ * When updating the tail register, the ME could be accessing Host CSR
+ * registers at the same time.  Normally, this is handled in h/w by an
+ * arbiter but on some parts there is a bug that acknowledges Host accesses
+ * later than it should which could result in the descriptor register to
+ * have an incorrect value.  Workaround this by checking the FWSM register
+ * which has bit 24 set while ME is accessing Host CSR registers, wait
+ * if it is set and try again a number of times.
+ **/
+static inline s32 e1000e_update_tail_wa(struct e1000_hw *hw, u8 __iomem * tail,
+                                        unsigned int i)
+{
+        unsigned int j = 0;
+
+        while ((j++ < E1000_ICH_FWSM_PCIM2PCI_COUNT) &&
+               (er32(FWSM) & E1000_ICH_FWSM_PCIM2PCI))
+                udelay(50);
+
+        writel(i, tail);
+
+        if ((j == E1000_ICH_FWSM_PCIM2PCI_COUNT) && (i != readl(tail)))
+                return E1000_ERR_SWFW_SYNC;
+
+        return 0;
+}
+
+static void e1000e_update_rdt_wa(struct e1000_adapter *adapter, unsigned int i)
+{
+        u8 __iomem *tail = (adapter->hw.hw_addr + adapter->rx_ring->tail);
+        struct e1000_hw *hw = &adapter->hw;
+
+        if (e1000e_update_tail_wa(hw, tail, i)) {
+                u32 rctl = er32(RCTL);
+                ew32(RCTL, rctl & ~E1000_RCTL_EN);
+                e_err("ME firmware caused invalid RDT - resetting\n");
+                schedule_work(&adapter->reset_task);
+        }
+}
+
+static void e1000e_update_tdt_wa(struct e1000_adapter *adapter, unsigned int i)
+{
+        u8 __iomem *tail = (adapter->hw.hw_addr + adapter->tx_ring->tail);
+        struct e1000_hw *hw = &adapter->hw;
+
+        if (e1000e_update_tail_wa(hw, tail, i)) {
+                u32 tctl = er32(TCTL);
+                ew32(TCTL, tctl & ~E1000_TCTL_EN);
+                e_err("ME firmware caused invalid TDT - resetting\n");
+                schedule_work(&adapter->reset_task);
+        }
+}
+
+/**
  * e1000_alloc_rx_buffers - Replace used receive buffers; legacy & extended
  * @adapter: address of board private structure
  **/
@@ -573,7 +630,10 @@ map_skb:
                          * such as IA-64).
                          */
                         wmb();
-                        writel(i, adapter->hw.hw_addr + rx_ring->tail);
+                        if (adapter->flags2 & FLAG2_PCIM2PCI_ARBITER_WA)
+                                e1000e_update_rdt_wa(adapter, i);
+                        else
+                                writel(i, adapter->hw.hw_addr + rx_ring->tail);
                 }
                 i++;
                 if (i == rx_ring->count)
@@ -673,7 +733,11 @@ static void e1000_alloc_rx_buffers_ps(struct e1000_adapter *adapter,
                          * such as IA-64).
                          */
                         wmb();
-                        writel(i << 1, adapter->hw.hw_addr + rx_ring->tail);
+                        if (adapter->flags2 & FLAG2_PCIM2PCI_ARBITER_WA)
+                                e1000e_update_rdt_wa(adapter, i << 1);
+                        else
+                                writel(i << 1,
+                                       adapter->hw.hw_addr + rx_ring->tail);
                 }
 
                 i++;
@@ -756,7 +820,10 @@ check_page:
                  * applicable for weak-ordered memory model archs,
                  * such as IA-64). */
                 wmb();
-                writel(i, adapter->hw.hw_addr + rx_ring->tail);
+                if (adapter->flags2 & FLAG2_PCIM2PCI_ARBITER_WA)
+                        e1000e_update_rdt_wa(adapter, i);
+                else
+                        writel(i, adapter->hw.hw_addr + rx_ring->tail);
         }
 }
 
@@ -4689,7 +4756,12 @@ static void e1000_tx_queue(struct e1000_adapter *adapter,
         wmb();
 
         tx_ring->next_to_use = i;
-        writel(i, adapter->hw.hw_addr + tx_ring->tail);
+
+        if (adapter->flags2 & FLAG2_PCIM2PCI_ARBITER_WA)
+                e1000e_update_tdt_wa(adapter, i);
+        else
+                writel(i, adapter->hw.hw_addr + tx_ring->tail);
+
         /*
          * we need this if more than one processor can write to our tail
          * at a time, it synchronizes IO on IA64/Altix systems
diff --git a/drivers/net/forcedeth.c b/drivers/net/forcedeth.c
index e55df308a3af..6d5fbd4d4256 100644
--- a/drivers/net/forcedeth.c
+++ b/drivers/net/forcedeth.c
@@ -5615,7 +5615,8 @@ static int __devinit nv_probe(struct pci_dev *pci_dev, const struct pci_device_i
                 goto out_error;
         }
 
-        nv_vlan_mode(dev, dev->features);
+        if (id->driver_data & DEV_HAS_VLAN)
+                nv_vlan_mode(dev, dev->features);
 
         netif_carrier_off(dev);
 
diff --git a/drivers/net/gianfar.c b/drivers/net/gianfar.c
index 2659daad783d..31d5c574e5a9 100644
--- a/drivers/net/gianfar.c
+++ b/drivers/net/gianfar.c
@@ -2710,8 +2710,13 @@ static int gfar_process_frame(struct net_device *dev, struct sk_buff *skb,
         /* Tell the skb what kind of packet this is */
         skb->protocol = eth_type_trans(skb, dev);
 
-        /* Set vlan tag */
-        if (fcb->flags & RXFCB_VLN)
+        /*
+         * There's need to check for NETIF_F_HW_VLAN_RX here.
+         * Even if vlan rx accel is disabled, on some chips
+         * RXFCB_VLN is pseudo randomly set.
+         */
+        if (dev->features & NETIF_F_HW_VLAN_RX &&
+            fcb->flags & RXFCB_VLN)
                 __vlan_hwaccel_put_tag(skb, fcb->vlctl);
 
         /* Send the packet up the stack */
diff --git a/drivers/net/gianfar_ethtool.c b/drivers/net/gianfar_ethtool.c
index 6e350692d118..25a8c2adb001 100644
--- a/drivers/net/gianfar_ethtool.c
+++ b/drivers/net/gianfar_ethtool.c
@@ -686,10 +686,21 @@ static int gfar_ethflow_to_filer_table(struct gfar_private *priv, u64 ethflow, u
 {
         unsigned int last_rule_idx = priv->cur_filer_idx;
         unsigned int cmp_rqfpr;
-        unsigned int local_rqfpr[MAX_FILER_IDX + 1];
-        unsigned int local_rqfcr[MAX_FILER_IDX + 1];
+        unsigned int *local_rqfpr;
+        unsigned int *local_rqfcr;
         int i = 0x0, k = 0x0;
         int j = MAX_FILER_IDX, l = 0x0;
+        int ret = 1;
+
+        local_rqfpr = kmalloc(sizeof(unsigned int) * (MAX_FILER_IDX + 1),
+                GFP_KERNEL);
+        local_rqfcr = kmalloc(sizeof(unsigned int) * (MAX_FILER_IDX + 1),
+                GFP_KERNEL);
+        if (!local_rqfpr || !local_rqfcr) {
+                pr_err("Out of memory\n");
+                ret = 0;
+                goto err;
+        }
 
         switch (class) {
         case TCP_V4_FLOW:
@@ -706,7 +717,8 @@ static int gfar_ethflow_to_filer_table(struct gfar_private *priv, u64 ethflow, u
                 break;
         default:
                 pr_err("Right now this class is not supported\n");
-                return 0;
+                ret = 0;
+                goto err;
         }
 
         for (i = 0; i < MAX_FILER_IDX + 1; i++) {
@@ -721,7 +733,8 @@ static int gfar_ethflow_to_filer_table(struct gfar_private *priv, u64 ethflow, u
 
         if (i == MAX_FILER_IDX + 1) {
                 pr_err("No parse rule found, can't create hash rules\n");
-                return 0;
+                ret = 0;
+                goto err;
         }
 
         /* If a match was found, then it begins the starting of a cluster rule
@@ -765,7 +778,10 @@ static int gfar_ethflow_to_filer_table(struct gfar_private *priv, u64 ethflow, u
                 priv->cur_filer_idx = priv->cur_filer_idx - 1;
         }
 
-        return 1;
+err:
+        kfree(local_rqfcr);
+        kfree(local_rqfpr);
+        return ret;
 }
 
 static int gfar_set_hash_opts(struct gfar_private *priv, struct ethtool_rxnfc *cmd)
diff --git a/drivers/net/ixgbe/ixgbe_main.c b/drivers/net/ixgbe/ixgbe_main.c
index e86297b32733..22790394318a 100644
--- a/drivers/net/ixgbe/ixgbe_main.c
+++ b/drivers/net/ixgbe/ixgbe_main.c
@@ -1459,8 +1459,10 @@ static void ixgbe_clean_rx_irq(struct ixgbe_q_vector *q_vector,
                 if (ixgbe_rx_is_fcoe(adapter, rx_desc)) {
                         ddp_bytes = ixgbe_fcoe_ddp(adapter, rx_desc, skb,
                                                    staterr);
-                        if (!ddp_bytes)
+                        if (!ddp_bytes) {
+                                dev_kfree_skb_any(skb);
                                 goto next_desc;
+                        }
                 }
 #endif /* IXGBE_FCOE */
                 ixgbe_receive_skb(q_vector, skb, staterr, rx_ring, rx_desc);
diff --git a/drivers/net/rionet.c b/drivers/net/rionet.c
index 86ac38c96bcf..3bb131137033 100644
--- a/drivers/net/rionet.c
+++ b/drivers/net/rionet.c
@@ -80,13 +80,13 @@ static int rionet_capable = 1;
  */
 static struct rio_dev **rionet_active;
 
-#define is_rionet_capable(pef, src_ops, dst_ops)                \
-                        ((pef & RIO_PEF_INB_MBOX) &&            \
-                         (pef & RIO_PEF_INB_DOORBELL) &&        \
+#define is_rionet_capable(src_ops, dst_ops)                     \
+                        ((src_ops & RIO_SRC_OPS_DATA_MSG) &&    \
+                         (dst_ops & RIO_DST_OPS_DATA_MSG) &&    \
                          (src_ops & RIO_SRC_OPS_DOORBELL) &&    \
                          (dst_ops & RIO_DST_OPS_DOORBELL))
 #define dev_rionet_capable(dev) \
-        is_rionet_capable(dev->pef, dev->src_ops, dev->dst_ops)
+        is_rionet_capable(dev->src_ops, dev->dst_ops)
 
 #define RIONET_MAC_MATCH(x)     (*(u32 *)x == 0x00010001)
 #define RIONET_GET_DESTID(x)    (*(u16 *)(x + 4))
@@ -282,7 +282,6 @@ static int rionet_open(struct net_device *ndev)
 {
         int i, rc = 0;
         struct rionet_peer *peer, *tmp;
-        u32 pwdcsr;
         struct rionet_private *rnet = netdev_priv(ndev);
 
         if (netif_msg_ifup(rnet))
@@ -332,13 +331,8 @@ static int rionet_open(struct net_device *ndev)
                         continue;
                 }
 
-                /*
-                 * If device has initialized inbound doorbells,
-                 * send a join message
-                 */
-                rio_read_config_32(peer->rdev, RIO_WRITE_PORT_CSR, &pwdcsr);
-                if (pwdcsr & RIO_DOORBELL_AVAIL)
-                        rio_send_doorbell(peer->rdev, RIONET_DOORBELL_JOIN);
+                /* Send a join message */
+                rio_send_doorbell(peer->rdev, RIONET_DOORBELL_JOIN);
         }
 
       out:
@@ -492,7 +486,7 @@ static int rionet_setup_netdev(struct rio_mport *mport, struct net_device *ndev)
 static int rionet_probe(struct rio_dev *rdev, const struct rio_device_id *id)
 {
         int rc = -ENODEV;
-        u32 lpef, lsrc_ops, ldst_ops;
+        u32 lsrc_ops, ldst_ops;
         struct rionet_peer *peer;
         struct net_device *ndev = NULL;
 
@@ -515,12 +509,11 @@ static int rionet_probe(struct rio_dev *rdev, const struct rio_device_id *id)
          * on later probes
          */
         if (!rionet_check) {
-                rio_local_read_config_32(rdev->net->hport, RIO_PEF_CAR, &lpef);
                 rio_local_read_config_32(rdev->net->hport, RIO_SRC_OPS_CAR,
                                          &lsrc_ops);
                 rio_local_read_config_32(rdev->net->hport, RIO_DST_OPS_CAR,
                                          &ldst_ops);
-                if (!is_rionet_capable(lpef, lsrc_ops, ldst_ops)) {
+                if (!is_rionet_capable(lsrc_ops, ldst_ops)) {
                         printk(KERN_ERR
                                "%s: local device is not network capable\n",
                                DRV_NAME);
diff --git a/drivers/net/sh_eth.c b/drivers/net/sh_eth.c
index ad35c210b839..190f619e4215 100644
--- a/drivers/net/sh_eth.c
+++ b/drivers/net/sh_eth.c
@@ -21,6 +21,7 @@
  */
 
 #include <linux/init.h>
+#include <linux/interrupt.h>
 #include <linux/dma-mapping.h>
 #include <linux/etherdevice.h>
 #include <linux/delay.h>
diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
index a03336e086d5..f06fb78383a1 100644
--- a/drivers/net/usb/cdc_ncm.c
+++ b/drivers/net/usb/cdc_ncm.c
@@ -228,23 +228,40 @@ static u8 cdc_ncm_setup(struct cdc_ncm_ctx *ctx)
         if (ctx->rx_max != le32_to_cpu(ctx->ncm_parm.dwNtbInMaxSize)) {
 
                 if (flags & USB_CDC_NCM_NCAP_NTB_INPUT_SIZE) {
-                        struct usb_cdc_ncm_ndp_input_size ndp_in_sz;
+                        struct usb_cdc_ncm_ndp_input_size *ndp_in_sz;
+
+                        ndp_in_sz = kzalloc(sizeof(*ndp_in_sz), GFP_KERNEL);
+                        if (!ndp_in_sz) {
+                                err = -ENOMEM;
+                                goto size_err;
+                        }
+
                         err = usb_control_msg(ctx->udev,
                                         usb_sndctrlpipe(ctx->udev, 0),
                                         USB_CDC_SET_NTB_INPUT_SIZE,
                                         USB_TYPE_CLASS | USB_DIR_OUT
                                          | USB_RECIP_INTERFACE,
-                                        0, iface_no, &ndp_in_sz, 8, 1000);
+                                        0, iface_no, ndp_in_sz, 8, 1000);
+                        kfree(ndp_in_sz);
                 } else {
-                        __le32 dwNtbInMaxSize = cpu_to_le32(ctx->rx_max);
+                        __le32 *dwNtbInMaxSize;
+                        dwNtbInMaxSize = kzalloc(sizeof(*dwNtbInMaxSize),
+                                        GFP_KERNEL);
+                        if (!dwNtbInMaxSize) {
+                                err = -ENOMEM;
+                                goto size_err;
+                        }
+                        *dwNtbInMaxSize = cpu_to_le32(ctx->rx_max);
+
                         err = usb_control_msg(ctx->udev,
                                         usb_sndctrlpipe(ctx->udev, 0),
                                         USB_CDC_SET_NTB_INPUT_SIZE,
                                         USB_TYPE_CLASS | USB_DIR_OUT
                                          | USB_RECIP_INTERFACE,
-                                        0, iface_no, &dwNtbInMaxSize, 4, 1000);
+                                        0, iface_no, dwNtbInMaxSize, 4, 1000);
+                        kfree(dwNtbInMaxSize);
                 }
-
+size_err:
                 if (err < 0)
                         pr_debug("Setting NTB Input Size failed\n");
         }
@@ -325,19 +342,29 @@ static u8 cdc_ncm_setup(struct cdc_ncm_ctx *ctx)
 
         /* set Max Datagram Size (MTU) */
         if (flags & USB_CDC_NCM_NCAP_MAX_DATAGRAM_SIZE) {
-                __le16 max_datagram_size;
+                __le16 *max_datagram_size;
                 u16 eth_max_sz = le16_to_cpu(ctx->ether_desc->wMaxSegmentSize);
+
+                max_datagram_size = kzalloc(sizeof(*max_datagram_size),
+                                GFP_KERNEL);
+                if (!max_datagram_size) {
+                        err = -ENOMEM;
+                        goto max_dgram_err;
+                }
+
                 err = usb_control_msg(ctx->udev, usb_rcvctrlpipe(ctx->udev, 0),
                                 USB_CDC_GET_MAX_DATAGRAM_SIZE,
                                 USB_TYPE_CLASS | USB_DIR_IN
                                  | USB_RECIP_INTERFACE,
-                                0, iface_no, &max_datagram_size,
+                                0, iface_no, max_datagram_size,
                                 2, 1000);
                 if (err < 0) {
                         pr_debug("GET_MAX_DATAGRAM_SIZE failed, use size=%u\n",
                                                 CDC_NCM_MIN_DATAGRAM_SIZE);
+                        kfree(max_datagram_size);
                 } else {
-                        ctx->max_datagram_size = le16_to_cpu(max_datagram_size);
+                        ctx->max_datagram_size =
+                                le16_to_cpu(*max_datagram_size);
                         /* Check Eth descriptor value */
                         if (eth_max_sz < CDC_NCM_MAX_DATAGRAM_SIZE) {
                                 if (ctx->max_datagram_size > eth_max_sz)
@@ -360,8 +387,10 @@ static u8 cdc_ncm_setup(struct cdc_ncm_ctx *ctx)
                                                 USB_TYPE_CLASS | USB_DIR_OUT
                                                  | USB_RECIP_INTERFACE,
                                                 0,
-                                                iface_no, &max_datagram_size,
+                                                iface_no, max_datagram_size,
                                                 2, 1000);
+                        kfree(max_datagram_size);
+max_dgram_err:
                         if (err < 0)
                                 pr_debug("SET_MAX_DATAGRAM_SIZE failed\n");
                 }
diff --git a/drivers/net/via-velocity.c b/drivers/net/via-velocity.c
index deb1eca13c9f..7c5336c5c37f 100644
--- a/drivers/net/via-velocity.c
+++ b/drivers/net/via-velocity.c
@@ -515,10 +515,6 @@ static void velocity_init_cam_filter(struct velocity_info *vptr)
         mac_set_cam_mask(regs, vptr->mCAMmask);
 
         /* Enable VCAMs */
-
-        if (test_bit(0, vptr->active_vlans))
-                WORD_REG_BITS_ON(MCFG_RTGOPT, &regs->MCFG);
-
         for_each_set_bit(vid, vptr->active_vlans, VLAN_N_VID) {
                 mac_set_vlan_cam(regs, i, (u8 *) &vid);
                 vptr->vCAMmask[i / 8] |= 0x1 << (i % 8);
diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
index 1cbacb389652..0959583feb27 100644
--- a/drivers/net/vmxnet3/vmxnet3_drv.c
+++ b/drivers/net/vmxnet3/vmxnet3_drv.c
@@ -1929,14 +1929,17 @@ static void
 vmxnet3_vlan_rx_add_vid(struct net_device *netdev, u16 vid)
 {
         struct vmxnet3_adapter *adapter = netdev_priv(netdev);
-        u32 *vfTable = adapter->shared->devRead.rxFilterConf.vfTable;
-        unsigned long flags;
 
-        VMXNET3_SET_VFTABLE_ENTRY(vfTable, vid);
-        spin_lock_irqsave(&adapter->cmd_lock, flags);
-        VMXNET3_WRITE_BAR1_REG(adapter, VMXNET3_REG_CMD,
-                               VMXNET3_CMD_UPDATE_VLAN_FILTERS);
-        spin_unlock_irqrestore(&adapter->cmd_lock, flags);
+        if (!(netdev->flags & IFF_PROMISC)) {
+                u32 *vfTable = adapter->shared->devRead.rxFilterConf.vfTable;
+                unsigned long flags;
+
+                VMXNET3_SET_VFTABLE_ENTRY(vfTable, vid);
+                spin_lock_irqsave(&adapter->cmd_lock, flags);
+                VMXNET3_WRITE_BAR1_REG(adapter, VMXNET3_REG_CMD,
+                                       VMXNET3_CMD_UPDATE_VLAN_FILTERS);
+                spin_unlock_irqrestore(&adapter->cmd_lock, flags);
+        }
 
         set_bit(vid, adapter->active_vlans);
 }
@@ -1946,14 +1949,17 @@ static void
 vmxnet3_vlan_rx_kill_vid(struct net_device *netdev, u16 vid)
 {
         struct vmxnet3_adapter *adapter = netdev_priv(netdev);
-        u32 *vfTable = adapter->shared->devRead.rxFilterConf.vfTable;
-        unsigned long flags;
 
-        VMXNET3_CLEAR_VFTABLE_ENTRY(vfTable, vid);
-        spin_lock_irqsave(&adapter->cmd_lock, flags);
-        VMXNET3_WRITE_BAR1_REG(adapter, VMXNET3_REG_CMD,
-                               VMXNET3_CMD_UPDATE_VLAN_FILTERS);
-        spin_unlock_irqrestore(&adapter->cmd_lock, flags);
+        if (!(netdev->flags & IFF_PROMISC)) {
+                u32 *vfTable = adapter->shared->devRead.rxFilterConf.vfTable;
+                unsigned long flags;
+
+                VMXNET3_CLEAR_VFTABLE_ENTRY(vfTable, vid);
+                spin_lock_irqsave(&adapter->cmd_lock, flags);
+                VMXNET3_WRITE_BAR1_REG(adapter, VMXNET3_REG_CMD,
+                                       VMXNET3_CMD_UPDATE_VLAN_FILTERS);
+                spin_unlock_irqrestore(&adapter->cmd_lock, flags);
+        }
 
         clear_bit(vid, adapter->active_vlans);
 }
diff --git a/drivers/net/wireless/iwlwifi/iwl-pci.c b/drivers/net/wireless/iwlwifi/iwl-pci.c
index 69d4ec467dca..2fdbffa079c1 100644
--- a/drivers/net/wireless/iwlwifi/iwl-pci.c
+++ b/drivers/net/wireless/iwlwifi/iwl-pci.c
@@ -478,27 +478,22 @@ out_no_pci:
         return err;
 }
 
-static void iwl_pci_down(struct iwl_bus *bus)
-{
-        struct iwl_pci_bus *pci_bus = (struct iwl_pci_bus *) bus->bus_specific;
-
-        pci_disable_msi(pci_bus->pci_dev);
-        pci_iounmap(pci_bus->pci_dev, pci_bus->hw_base);
-        pci_release_regions(pci_bus->pci_dev);
-        pci_disable_device(pci_bus->pci_dev);
-        pci_set_drvdata(pci_bus->pci_dev, NULL);
-
-        kfree(bus);
-}
-
 static void __devexit iwl_pci_remove(struct pci_dev *pdev)
 {
         struct iwl_priv *priv = pci_get_drvdata(pdev);
-        void *bus_specific = priv->bus->bus_specific;
+        struct iwl_bus *bus = priv->bus;
+        struct iwl_pci_bus *pci_bus = IWL_BUS_GET_PCI_BUS(bus);
+        struct pci_dev *pci_dev = IWL_BUS_GET_PCI_DEV(bus);
 
         iwl_remove(priv);
 
-        iwl_pci_down(bus_specific);
+        pci_disable_msi(pci_dev);
+        pci_iounmap(pci_dev, pci_bus->hw_base);
+        pci_release_regions(pci_dev);
+        pci_disable_device(pci_dev);
+        pci_set_drvdata(pci_dev, NULL);
+
+        kfree(bus);
 }
 
 #ifdef CONFIG_PM
diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c
index 939563162fb3..dbf501ca317f 100644
--- a/drivers/net/wireless/rt2x00/rt2800usb.c
+++ b/drivers/net/wireless/rt2x00/rt2800usb.c
@@ -464,6 +464,15 @@ static bool rt2800usb_txdone_entry_check(struct queue_entry *entry, u32 reg)
         int wcid, ack, pid;
         int tx_wcid, tx_ack, tx_pid;
 
+        if (test_bit(ENTRY_OWNER_DEVICE_DATA, &entry->flags) ||
+            !test_bit(ENTRY_DATA_STATUS_PENDING, &entry->flags)) {
+                WARNING(entry->queue->rt2x00dev,
+                        "Data pending for entry %u in queue %u\n",
+                        entry->entry_idx, entry->queue->qid);
+                cond_resched();
+                return false;
+        }
+
         wcid    = rt2x00_get_field32(reg, TX_STA_FIFO_WCID);
         ack     = rt2x00_get_field32(reg, TX_STA_FIFO_TX_ACK_REQUIRED);
         pid     = rt2x00_get_field32(reg, TX_STA_FIFO_PID_TYPE);
@@ -529,12 +538,11 @@ static void rt2800usb_txdone(struct rt2x00_dev *rt2x00dev)
                         entry = rt2x00queue_get_entry(queue, Q_INDEX_DONE);
                         if (rt2800usb_txdone_entry_check(entry, reg))
                                 break;
+                        entry = NULL;
                 }
 
-                if (!entry || rt2x00queue_empty(queue))
-                        break;
-
-                rt2800_txdone_entry(entry, reg);
+                if (entry)
+                        rt2800_txdone_entry(entry, reg);
         }
 }
 
@@ -558,8 +566,10 @@ static void rt2800usb_work_txdone(struct work_struct *work)
                 while (!rt2x00queue_empty(queue)) {
                         entry = rt2x00queue_get_entry(queue, Q_INDEX_DONE);
 
-                        if (test_bit(ENTRY_OWNER_DEVICE_DATA, &entry->flags))
+                        if (test_bit(ENTRY_OWNER_DEVICE_DATA, &entry->flags) ||
+                            !test_bit(ENTRY_DATA_STATUS_PENDING, &entry->flags))
                                 break;
+
                         if (test_bit(ENTRY_DATA_IO_FAILED, &entry->flags))
                                 rt2x00lib_txdone_noinfo(entry, TXDONE_FAILURE);
                         else if (rt2x00queue_status_timeout(entry))
diff --git a/drivers/net/wireless/rt2x00/rt2x00usb.c b/drivers/net/wireless/rt2x00/rt2x00usb.c
index b6b4542c2460..7fbb55c9da82 100644
--- a/drivers/net/wireless/rt2x00/rt2x00usb.c
+++ b/drivers/net/wireless/rt2x00/rt2x00usb.c
@@ -262,23 +262,20 @@ static void rt2x00usb_interrupt_txdone(struct urb *urb)
         struct queue_entry *entry = (struct queue_entry *)urb->context;
         struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
 
-        if (!test_and_clear_bit(ENTRY_OWNER_DEVICE_DATA, &entry->flags))
+        if (!test_bit(ENTRY_OWNER_DEVICE_DATA, &entry->flags))
                 return;
-
-        if (rt2x00dev->ops->lib->tx_dma_done)
-                rt2x00dev->ops->lib->tx_dma_done(entry);
-
-        /*
-         * Report the frame as DMA done
-         */
-        rt2x00lib_dmadone(entry);
-
         /*
          * Check if the frame was correctly uploaded
          */
         if (urb->status)
                 set_bit(ENTRY_DATA_IO_FAILED, &entry->flags);
+        /*
+         * Report the frame as DMA done
+         */
+        rt2x00lib_dmadone(entry);
 
+        if (rt2x00dev->ops->lib->tx_dma_done)
+                rt2x00dev->ops->lib->tx_dma_done(entry);
         /*
          * Schedule the delayed work for reading the TX status
          * from the device.
diff --git a/drivers/net/wireless/wl12xx/acx.c b/drivers/net/wireless/wl12xx/acx.c
index 7e33f1f4f3d4..34f6ab53e519 100644
--- a/drivers/net/wireless/wl12xx/acx.c
+++ b/drivers/net/wireless/wl12xx/acx.c
@@ -77,8 +77,6 @@ int wl1271_acx_sleep_auth(struct wl1271 *wl, u8 sleep_auth)
         auth->sleep_auth = sleep_auth;
 
         ret = wl1271_cmd_configure(wl, ACX_SLEEP_AUTH, auth, sizeof(*auth));
-        if (ret < 0)
-                return ret;
 
 out:
         kfree(auth);
@@ -624,10 +622,8 @@ int wl1271_acx_cca_threshold(struct wl1271 *wl)
 
         ret = wl1271_cmd_configure(wl, ACX_CCA_THRESHOLD,
                                    detection, sizeof(*detection));
-        if (ret < 0) {
+        if (ret < 0)
                 wl1271_warning("failed to set cca threshold: %d", ret);
-                return ret;
-        }
 
 out:
         kfree(detection);
diff --git a/drivers/net/wireless/wl12xx/testmode.c b/drivers/net/wireless/wl12xx/testmode.c
index 5d5e1ef87206..88add68bd9ac 100644
--- a/drivers/net/wireless/wl12xx/testmode.c
+++ b/drivers/net/wireless/wl12xx/testmode.c
@@ -139,12 +139,15 @@ static int wl1271_tm_cmd_interrogate(struct wl1271 *wl, struct nlattr *tb[])
 
         if (ret < 0) {
                 wl1271_warning("testmode cmd interrogate failed: %d", ret);
+                kfree(cmd);
                 return ret;
         }
 
         skb = cfg80211_testmode_alloc_reply_skb(wl->hw->wiphy, sizeof(*cmd));
-        if (!skb)
+        if (!skb) {
+                kfree(cmd);
                 return -ENOMEM;
+        }
 
         NLA_PUT(skb, WL1271_TM_ATTR_DATA, sizeof(*cmd), cmd);