65 files changed, 538 insertions, 379 deletions
diff --git a/drivers/acpi/event.c b/drivers/acpi/event.c
index fdef416c0ff6..cae3b387b867 100644
--- a/drivers/acpi/event.c
+++ b/drivers/acpi/event.c
@@ -78,15 +78,17 @@ enum {
 #define ACPI_GENL_VERSION               0x01
 #define ACPI_GENL_MCAST_GROUP_NAME      "acpi_mc_group"
+static const struct genl_multicast_group acpi_event_mcgrps[] = {
+        { .name = ACPI_GENL_MCAST_GROUP_NAME, },
+};
 static struct genl_family acpi_event_genl_family = {
        .id = GENL_ID_GENERATE,
        .name = ACPI_GENL_FAMILY_NAME,
        .version = ACPI_GENL_VERSION,
        .maxattr = ACPI_GENL_ATTR_MAX,
-};
+        .mcgrps = acpi_event_mcgrps,
+        .n_mcgrps = ARRAY_SIZE(acpi_event_mcgrps),
-static struct genl_multicast_group acpi_event_mcgrp = {
-        .name = ACPI_GENL_MCAST_GROUP_NAME,
 };
 int acpi_bus_generate_netlink_event(const char *device_class,
@@ -141,7 +143,7 @@ int acpi_bus_generate_netlink_event(const char *device_class,
                return result;
        }
-        genlmsg_multicast(skb, 0, acpi_event_mcgrp.id, GFP_ATOMIC);
+        genlmsg_multicast(&acpi_event_genl_family, skb, 0, 0, GFP_ATOMIC);
        return 0;
 }
@@ -149,18 +151,7 @@ EXPORT_SYMBOL(acpi_bus_generate_netlink_event);
 static int acpi_event_genetlink_init(void)
 {
-        int result;
+        return genl_register_family(&acpi_event_genl_family);
-        result = genl_register_family(&acpi_event_genl_family);
-        if (result)
-                return result;
-        result = genl_register_mc_group(&acpi_event_genl_family,
-                                        &acpi_event_mcgrp);
-        if (result)
-                genl_unregister_family(&acpi_event_genl_family);
-        return result;
 }
 #else
diff --git a/drivers/atm/idt77252.c b/drivers/atm/idt77252.c
index 272f00927761..1bdf104e90bb 100644
--- a/drivers/atm/idt77252.c
+++ b/drivers/atm/idt77252.c
@@ -3511,7 +3511,7 @@ static int init_card(struct atm_dev *dev)
        tmp = dev_get_by_name(&init_net, tname);        /* jhs: was "tmp = dev_get(tname);" */
        if (tmp) {
                memcpy(card->atmdev->esi, tmp->dev_addr, 6);
+                dev_put(tmp);
                printk("%s: ESI %pM\n", card->name, card->atmdev->esi);
        }
        /*
diff --git a/drivers/connector/cn_proc.c b/drivers/connector/cn_proc.c
index c73fc2b74de2..18c5b9b16645 100644
--- a/drivers/connector/cn_proc.c
+++ b/drivers/connector/cn_proc.c
@@ -32,11 +32,23 @@
 #include <linux/atomic.h>
 #include <linux/pid_namespace.h>
-#include <asm/unaligned.h>
 #include <linux/cn_proc.h>
-#define CN_PROC_MSG_SIZE (sizeof(struct cn_msg) + sizeof(struct proc_event))
+/*
+ * Size of a cn_msg followed by a proc_event structure.  Since the
+ * sizeof struct cn_msg is a multiple of 4 bytes, but not 8 bytes, we
+ * add one 4-byte word to the size here, and then start the actual
+ * cn_msg structure 4 bytes into the stack buffer.  The result is that
+ * the immediately following proc_event structure is aligned to 8 bytes.
+ */
+#define CN_PROC_MSG_SIZE (sizeof(struct cn_msg) + sizeof(struct proc_event) + 4)
+/* See comment above; we test our assumption about sizeof struct cn_msg here. */
+static inline struct cn_msg *buffer_to_cn_msg(__u8 *buffer)
+{
+        BUILD_BUG_ON(sizeof(struct cn_msg) != 20);
+        return (struct cn_msg *)(buffer + 4);
+}
 static atomic_t proc_event_num_listeners = ATOMIC_INIT(0);
 static struct cb_id cn_proc_event_id = { CN_IDX_PROC, CN_VAL_PROC };
@@ -56,19 +68,19 @@ void proc_fork_connector(struct task_struct *task)
 {
        struct cn_msg *msg;
        struct proc_event *ev;
-        __u8 buffer[CN_PROC_MSG_SIZE];
+        __u8 buffer[CN_PROC_MSG_SIZE] __aligned(8);
        struct timespec ts;
        struct task_struct *parent;
        if (atomic_read(&proc_event_num_listeners) < 1)
                return;
-        msg = (struct cn_msg *)buffer;
+        msg = buffer_to_cn_msg(buffer);
        ev = (struct proc_event *)msg->data;
        memset(&ev->event_data, 0, sizeof(ev->event_data));
        get_seq(&msg->seq, &ev->cpu);
        ktime_get_ts(&ts); /* get high res monotonic timestamp */
-        put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
+        ev->timestamp_ns = timespec_to_ns(&ts);
        ev->what = PROC_EVENT_FORK;
        rcu_read_lock();
        parent = rcu_dereference(task->real_parent);
@@ -91,17 +103,17 @@ void proc_exec_connector(struct task_struct *task)
        struct cn_msg *msg;
        struct proc_event *ev;
        struct timespec ts;
-        __u8 buffer[CN_PROC_MSG_SIZE];
+        __u8 buffer[CN_PROC_MSG_SIZE] __aligned(8);
        if (atomic_read(&proc_event_num_listeners) < 1)
                return;
-        msg = (struct cn_msg *)buffer;
+        msg = buffer_to_cn_msg(buffer);
        ev = (struct proc_event *)msg->data;
        memset(&ev->event_data, 0, sizeof(ev->event_data));
        get_seq(&msg->seq, &ev->cpu);
        ktime_get_ts(&ts); /* get high res monotonic timestamp */
-        put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
+        ev->timestamp_ns = timespec_to_ns(&ts);
        ev->what = PROC_EVENT_EXEC;
        ev->event_data.exec.process_pid = task->pid;
        ev->event_data.exec.process_tgid = task->tgid;
@@ -117,14 +129,14 @@ void proc_id_connector(struct task_struct *task, int which_id)
 {
        struct cn_msg *msg;
        struct proc_event *ev;
-        __u8 buffer[CN_PROC_MSG_SIZE];
+        __u8 buffer[CN_PROC_MSG_SIZE] __aligned(8);
        struct timespec ts;
        const struct cred *cred;
        if (atomic_read(&proc_event_num_listeners) < 1)
                return;
-        msg = (struct cn_msg *)buffer;
+        msg = buffer_to_cn_msg(buffer);
        ev = (struct proc_event *)msg->data;
        memset(&ev->event_data, 0, sizeof(ev->event_data));
        ev->what = which_id;
@@ -145,7 +157,7 @@ void proc_id_connector(struct task_struct *task, int which_id)
        rcu_read_unlock();
        get_seq(&msg->seq, &ev->cpu);
        ktime_get_ts(&ts); /* get high res monotonic timestamp */
-        put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
+        ev->timestamp_ns = timespec_to_ns(&ts);
        memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
        msg->ack = 0; /* not used */
@@ -159,17 +171,17 @@ void proc_sid_connector(struct task_struct *task)
        struct cn_msg *msg;
        struct proc_event *ev;
        struct timespec ts;
-        __u8 buffer[CN_PROC_MSG_SIZE];
+        __u8 buffer[CN_PROC_MSG_SIZE] __aligned(8);
        if (atomic_read(&proc_event_num_listeners) < 1)
                return;
-        msg = (struct cn_msg *)buffer;
+        msg = buffer_to_cn_msg(buffer);
        ev = (struct proc_event *)msg->data;
        memset(&ev->event_data, 0, sizeof(ev->event_data));
        get_seq(&msg->seq, &ev->cpu);
        ktime_get_ts(&ts); /* get high res monotonic timestamp */
-        put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
+        ev->timestamp_ns = timespec_to_ns(&ts);
        ev->what = PROC_EVENT_SID;
        ev->event_data.sid.process_pid = task->pid;
        ev->event_data.sid.process_tgid = task->tgid;
@@ -186,17 +198,17 @@ void proc_ptrace_connector(struct task_struct *task, int ptrace_id)
        struct cn_msg *msg;
        struct proc_event *ev;
        struct timespec ts;
-        __u8 buffer[CN_PROC_MSG_SIZE];
+        __u8 buffer[CN_PROC_MSG_SIZE] __aligned(8);
        if (atomic_read(&proc_event_num_listeners) < 1)
                return;
-        msg = (struct cn_msg *)buffer;
+        msg = buffer_to_cn_msg(buffer);
        ev = (struct proc_event *)msg->data;
        memset(&ev->event_data, 0, sizeof(ev->event_data));
        get_seq(&msg->seq, &ev->cpu);
        ktime_get_ts(&ts); /* get high res monotonic timestamp */
-        put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
+        ev->timestamp_ns = timespec_to_ns(&ts);
        ev->what = PROC_EVENT_PTRACE;
        ev->event_data.ptrace.process_pid  = task->pid;
        ev->event_data.ptrace.process_tgid = task->tgid;
@@ -221,17 +233,17 @@ void proc_comm_connector(struct task_struct *task)
        struct cn_msg *msg;
        struct proc_event *ev;
        struct timespec ts;
-        __u8 buffer[CN_PROC_MSG_SIZE];
+        __u8 buffer[CN_PROC_MSG_SIZE] __aligned(8);
        if (atomic_read(&proc_event_num_listeners) < 1)
                return;
-        msg = (struct cn_msg *)buffer;
+        msg = buffer_to_cn_msg(buffer);
        ev = (struct proc_event *)msg->data;
        memset(&ev->event_data, 0, sizeof(ev->event_data));
        get_seq(&msg->seq, &ev->cpu);
        ktime_get_ts(&ts); /* get high res monotonic timestamp */
-        put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
+        ev->timestamp_ns = timespec_to_ns(&ts);
        ev->what = PROC_EVENT_COMM;
        ev->event_data.comm.process_pid  = task->pid;
        ev->event_data.comm.process_tgid = task->tgid;
@@ -248,18 +260,18 @@ void proc_coredump_connector(struct task_struct *task)
 {
        struct cn_msg *msg;
        struct proc_event *ev;
-        __u8 buffer[CN_PROC_MSG_SIZE];
+        __u8 buffer[CN_PROC_MSG_SIZE] __aligned(8);
        struct timespec ts;
        if (atomic_read(&proc_event_num_listeners) < 1)
                return;
-        msg = (struct cn_msg *)buffer;
+        msg = buffer_to_cn_msg(buffer);
        ev = (struct proc_event *)msg->data;
        memset(&ev->event_data, 0, sizeof(ev->event_data));
        get_seq(&msg->seq, &ev->cpu);
        ktime_get_ts(&ts); /* get high res monotonic timestamp */
-        put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
+        ev->timestamp_ns = timespec_to_ns(&ts);
        ev->what = PROC_EVENT_COREDUMP;
        ev->event_data.coredump.process_pid = task->pid;
        ev->event_data.coredump.process_tgid = task->tgid;
@@ -275,18 +287,18 @@ void proc_exit_connector(struct task_struct *task)
 {
        struct cn_msg *msg;
        struct proc_event *ev;
-        __u8 buffer[CN_PROC_MSG_SIZE];
+        __u8 buffer[CN_PROC_MSG_SIZE] __aligned(8);
        struct timespec ts;
        if (atomic_read(&proc_event_num_listeners) < 1)
                return;
-        msg = (struct cn_msg *)buffer;
+        msg = buffer_to_cn_msg(buffer);
        ev = (struct proc_event *)msg->data;
        memset(&ev->event_data, 0, sizeof(ev->event_data));
        get_seq(&msg->seq, &ev->cpu);
        ktime_get_ts(&ts); /* get high res monotonic timestamp */
-        put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
+        ev->timestamp_ns = timespec_to_ns(&ts);
        ev->what = PROC_EVENT_EXIT;
        ev->event_data.exit.process_pid = task->pid;
        ev->event_data.exit.process_tgid = task->tgid;
@@ -312,18 +324,18 @@ static void cn_proc_ack(int err, int rcvd_seq, int rcvd_ack)
 {
        struct cn_msg *msg;
        struct proc_event *ev;
-        __u8 buffer[CN_PROC_MSG_SIZE];
+        __u8 buffer[CN_PROC_MSG_SIZE] __aligned(8);
        struct timespec ts;
        if (atomic_read(&proc_event_num_listeners) < 1)
                return;
-        msg = (struct cn_msg *)buffer;
+        msg = buffer_to_cn_msg(buffer);
        ev = (struct proc_event *)msg->data;
        memset(&ev->event_data, 0, sizeof(ev->event_data));
        msg->seq = rcvd_seq;
        ktime_get_ts(&ts); /* get high res monotonic timestamp */
-        put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
+        ev->timestamp_ns = timespec_to_ns(&ts);
        ev->cpu = -1;
        ev->what = PROC_EVENT_NONE;
        ev->event_data.ack.err = err;
diff --git a/drivers/isdn/isdnloop/isdnloop.c b/drivers/isdn/isdnloop/isdnloop.c
index baf2686aa8eb..02125e6a9109 100644
--- a/drivers/isdn/isdnloop/isdnloop.c
+++ b/drivers/isdn/isdnloop/isdnloop.c
@@ -1083,8 +1083,10 @@ isdnloop_start(isdnloop_card *card, isdnloop_sdef *sdefp)
                        spin_unlock_irqrestore(&card->isdnloop_lock, flags);
                        return -ENOMEM;
                }
-                for (i = 0; i < 3; i++)
+                for (i = 0; i < 3; i++) {
-                        strcpy(card->s0num[i], sdef.num[i]);
+                        strlcpy(card->s0num[i], sdef.num[i],
+                                sizeof(card->s0num[0]));
+                }
                break;
        case ISDN_PTYPE_1TR6:
                if (isdnloop_fake(card, "DRV1.04TC-1TR6-CAPI-CNS-BASIS-29.11.95",
@@ -1097,7 +1099,7 @@ isdnloop_start(isdnloop_card *card, isdnloop_sdef *sdefp)
                        spin_unlock_irqrestore(&card->isdnloop_lock, flags);
                        return -ENOMEM;
                }
-                strcpy(card->s0num[0], sdef.num[0]);
+                strlcpy(card->s0num[0], sdef.num[0], sizeof(card->s0num[0]));
                card->s0num[1][0] = '\0';
                card->s0num[2][0] = '\0';
                break;
diff --git a/drivers/net/bonding/bond_sysfs.c b/drivers/net/bonding/bond_sysfs.c
index bc8fd362a5aa..0ec2a7e8c8a9 100644
--- a/drivers/net/bonding/bond_sysfs.c
+++ b/drivers/net/bonding/bond_sysfs.c
@@ -524,8 +524,9 @@ static ssize_t bonding_store_arp_interval(struct device *d,
                goto out;
        }
        if (bond->params.mode == BOND_MODE_ALB ||
-            bond->params.mode == BOND_MODE_TLB) {
+            bond->params.mode == BOND_MODE_TLB ||
-                pr_info("%s: ARP monitoring cannot be used with ALB/TLB. Only MII monitoring is supported on %s.\n",
+            bond->params.mode == BOND_MODE_8023AD) {
+                pr_info("%s: ARP monitoring cannot be used with ALB/TLB/802.3ad. Only MII monitoring is supported on %s.\n",
                        bond->dev->name, bond->dev->name);
                ret = -EINVAL;
                goto out;
@@ -603,15 +604,14 @@ static ssize_t bonding_store_arp_targets(struct device *d,
                return restart_syscall();
        targets = bond->params.arp_targets;
-        newtarget = in_aton(buf + 1);
+        if (!in4_pton(buf + 1, -1, (u8 *)&newtarget, -1, NULL) ||
+            IS_IP_TARGET_UNUSABLE_ADDRESS(newtarget)) {
+                pr_err("%s: invalid ARP target %pI4 specified for addition\n",
+                       bond->dev->name, &newtarget);
+                goto out;
+        }
        /* look for adds */
        if (buf[0] == '+') {
-                if ((newtarget == 0) || (newtarget == htonl(INADDR_BROADCAST))) {
-                        pr_err("%s: invalid ARP target %pI4 specified for addition\n",
-                               bond->dev->name, &newtarget);
-                        goto out;
-                }
                if (bond_get_targets_ip(targets, newtarget) != -1) { /* dup */
                        pr_err("%s: ARP target %pI4 is already present\n",
                               bond->dev->name, &newtarget);
@@ -634,12 +634,6 @@ static ssize_t bonding_store_arp_targets(struct device *d,
                targets[ind] = newtarget;
                write_unlock_bh(&bond->lock);
        } else if (buf[0] == '-')       {
-                if ((newtarget == 0) || (newtarget == htonl(INADDR_BROADCAST))) {
-                        pr_err("%s: invalid ARP target %pI4 specified for removal\n",
-                               bond->dev->name, &newtarget);
-                        goto out;
-                }
                ind = bond_get_targets_ip(targets, newtarget);
                if (ind == -1) {
                        pr_err("%s: unable to remove nonexistent ARP target %pI4.\n",
@@ -701,6 +695,8 @@ static ssize_t bonding_store_downdelay(struct device *d,
        int new_value, ret = count;
        struct bonding *bond = to_bond(d);
+        if (!rtnl_trylock())
+                return restart_syscall();
        if (!(bond->params.miimon)) {
                pr_err("%s: Unable to set down delay as MII monitoring is disabled\n",
                       bond->dev->name);
@@ -734,6 +730,7 @@ static ssize_t bonding_store_downdelay(struct device *d,
        }
 out:
+        rtnl_unlock();
        return ret;
 }
 static DEVICE_ATTR(downdelay, S_IRUGO | S_IWUSR,
@@ -756,6 +753,8 @@ static ssize_t bonding_store_updelay(struct device *d,
        int new_value, ret = count;
        struct bonding *bond = to_bond(d);
+        if (!rtnl_trylock())
+                return restart_syscall();
        if (!(bond->params.miimon)) {
                pr_err("%s: Unable to set up delay as MII monitoring is disabled\n",
                       bond->dev->name);
@@ -789,6 +788,7 @@ static ssize_t bonding_store_updelay(struct device *d,
        }
 out:
+        rtnl_unlock();
        return ret;
 }
 static DEVICE_ATTR(updelay, S_IRUGO | S_IWUSR,
diff --git a/drivers/net/bonding/bonding.h b/drivers/net/bonding/bonding.h
index 77a07a12e77f..ca31286aa028 100644
--- a/drivers/net/bonding/bonding.h
+++ b/drivers/net/bonding/bonding.h
@@ -63,6 +63,9 @@
                (((mode) == BOND_MODE_TLB) ||   \
                 ((mode) == BOND_MODE_ALB))
+#define IS_IP_TARGET_UNUSABLE_ADDRESS(a)        \
+        ((htonl(INADDR_BROADCAST) == a) ||      \
+         ipv4_is_zeronet(a))
 /*
 * Less bad way to call ioctl from within the kernel; this needs to be
 * done some other way to get the call out of interrupt context.
diff --git a/drivers/net/ethernet/atheros/alx/main.c b/drivers/net/ethernet/atheros/alx/main.c
index 5aa5e8146496..c3c4c266b846 100644
--- a/drivers/net/ethernet/atheros/alx/main.c
+++ b/drivers/net/ethernet/atheros/alx/main.c
@@ -1388,6 +1388,9 @@ static int alx_resume(struct device *dev)
 {
        struct pci_dev *pdev = to_pci_dev(dev);
        struct alx_priv *alx = pci_get_drvdata(pdev);
+        struct alx_hw *hw = &alx->hw;
+        alx_reset_phy(hw);
        if (!netif_running(alx->dev))
                return 0;
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
index 4e01c57d8c8d..a1f66e2c9a86 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
@@ -1376,7 +1376,6 @@ enum {
        BNX2X_SP_RTNL_RX_MODE,
        BNX2X_SP_RTNL_HYPERVISOR_VLAN,
        BNX2X_SP_RTNL_TX_STOP,
-        BNX2X_SP_RTNL_TX_RESUME,
 };
 struct bnx2x_prev_path_list {
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
index dcafbda3e5be..ec96130533cc 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
@@ -2959,6 +2959,10 @@ int bnx2x_nic_unload(struct bnx2x *bp, int unload_mode, bool keep_link)
        bp->port.pmf = 0;
+        /* clear pending work in rtnl task */
+        bp->sp_rtnl_state = 0;
+        smp_mb();
        /* Free SKBs, SGEs, TPA pool and driver internals */
        bnx2x_free_skbs(bp);
        if (CNIC_LOADED(bp))
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_dcb.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_dcb.c
index fcf2761d8828..fdace204b054 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_dcb.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_dcb.c
@@ -778,11 +778,6 @@ void bnx2x_dcbx_set_params(struct bnx2x *bp, u32 state)
                /* ets may affect cmng configuration: reinit it in hw */
                bnx2x_set_local_cmng(bp);
-                set_bit(BNX2X_SP_RTNL_TX_RESUME, &bp->sp_rtnl_state);
-                schedule_delayed_work(&bp->sp_rtnl_task, 0);
                return;
        case BNX2X_DCBX_STATE_TX_RELEASED:
                DP(BNX2X_MSG_DCB, "BNX2X_DCBX_STATE_TX_RELEASED\n");
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index e622cc1f96ff..814d0eca9b33 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -577,7 +577,9 @@ void bnx2x_write_dmae(struct bnx2x *bp, dma_addr_t dma_addr, u32 dst_addr,
        rc = bnx2x_issue_dmae_with_comp(bp, &dmae, bnx2x_sp(bp, wb_comp));
        if (rc) {
                BNX2X_ERR("DMAE returned failure %d\n", rc);
+#ifdef BNX2X_STOP_ON_ERROR
                bnx2x_panic();
+#endif
        }
 }
@@ -614,7 +616,9 @@ void bnx2x_read_dmae(struct bnx2x *bp, u32 src_addr, u32 len32)
        rc = bnx2x_issue_dmae_with_comp(bp, &dmae, bnx2x_sp(bp, wb_comp));
        if (rc) {
                BNX2X_ERR("DMAE returned failure %d\n", rc);
+#ifdef BNX2X_STOP_ON_ERROR
                bnx2x_panic();
+#endif
        }
 }
@@ -5231,18 +5235,18 @@ static void bnx2x_eq_int(struct bnx2x *bp)
                case EVENT_RING_OPCODE_STOP_TRAFFIC:
                        DP(BNX2X_MSG_SP | BNX2X_MSG_DCB, "got STOP TRAFFIC\n");
+                        bnx2x_dcbx_set_params(bp, BNX2X_DCBX_STATE_TX_PAUSED);
                        if (f_obj->complete_cmd(bp, f_obj,
                                                BNX2X_F_CMD_TX_STOP))
                                break;
-                        bnx2x_dcbx_set_params(bp, BNX2X_DCBX_STATE_TX_PAUSED);
                        goto next_spqe;
                case EVENT_RING_OPCODE_START_TRAFFIC:
                        DP(BNX2X_MSG_SP | BNX2X_MSG_DCB, "got START TRAFFIC\n");
+                        bnx2x_dcbx_set_params(bp, BNX2X_DCBX_STATE_TX_RELEASED);
                        if (f_obj->complete_cmd(bp, f_obj,
                                                BNX2X_F_CMD_TX_START))
                                break;
-                        bnx2x_dcbx_set_params(bp, BNX2X_DCBX_STATE_TX_RELEASED);
                        goto next_spqe;
                case EVENT_RING_OPCODE_FUNCTION_UPDATE:
@@ -9352,6 +9356,10 @@ static int bnx2x_process_kill(struct bnx2x *bp, bool global)
        bnx2x_process_kill_chip_reset(bp, global);
        barrier();
+        /* clear errors in PGB */
+        if (!CHIP_IS_E1x(bp))
+                REG_WR(bp, PGLUE_B_REG_LATCHED_ERRORS_CLR, 0x7f);
        /* Recover after reset: */
        /* MCP */
        if (global && bnx2x_reset_mcp_comp(bp, val))
@@ -9706,11 +9714,10 @@ sp_rtnl_not_reset:
                               &bp->sp_rtnl_state))
                bnx2x_pf_set_vfs_vlan(bp);
-        if (test_and_clear_bit(BNX2X_SP_RTNL_TX_STOP, &bp->sp_rtnl_state))
+        if (test_and_clear_bit(BNX2X_SP_RTNL_TX_STOP, &bp->sp_rtnl_state)) {
                bnx2x_dcbx_stop_hw_tx(bp);
-        if (test_and_clear_bit(BNX2X_SP_RTNL_TX_RESUME, &bp->sp_rtnl_state))
                bnx2x_dcbx_resume_hw_tx(bp);
+        }
        /* work which needs rtnl lock not-taken (as it takes the lock itself and
         * can be called from other contexts as well)
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_reg.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_reg.h
index 5ecf267dc4cc..3efbb35267c8 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_reg.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_reg.h
@@ -2864,6 +2864,17 @@
 #define PGLUE_B_REG_INTERNAL_PFID_ENABLE_TARGET_READ             0x9430
 #define PGLUE_B_REG_INTERNAL_PFID_ENABLE_TARGET_WRITE            0x9434
 #define PGLUE_B_REG_INTERNAL_VFID_ENABLE                         0x9438
+/* [W 7] Writing 1 to each bit in this register clears a corresponding error
+ * details register and enables logging new error details. Bit 0 - clears
+ * INCORRECT_RCV_DETAILS; Bit 1 - clears RX_ERR_DETAILS; Bit 2 - clears
+ * TX_ERR_WR_ADD_31_0 TX_ERR_WR_ADD_63_32 TX_ERR_WR_DETAILS
+ * TX_ERR_WR_DETAILS2 TX_ERR_RD_ADD_31_0 TX_ERR_RD_ADD_63_32
+ * TX_ERR_RD_DETAILS TX_ERR_RD_DETAILS2 TX_ERR_WR_DETAILS_ICPL; Bit 3 -
+ * clears VF_LENGTH_VIOLATION_DETAILS. Bit 4 - clears
+ * VF_GRC_SPACE_VIOLATION_DETAILS. Bit 5 - clears RX_TCPL_ERR_DETAILS. Bit 6
+ * - clears TCPL_IN_TWO_RCBS_DETAILS. */
+#define PGLUE_B_REG_LATCHED_ERRORS_CLR                           0x943c
 /* [R 9] Interrupt register #0 read */
 #define PGLUE_B_REG_PGLUE_B_INT_STS                              0x9298
 /* [RC 9] Interrupt register #0 read clear */
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c
index 9199adf32d33..efa8a151d789 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c
@@ -152,7 +152,7 @@ static int bnx2x_send_msg2pf(struct bnx2x *bp, u8 *done, dma_addr_t msg_mapping)
        if (bp->old_bulletin.valid_bitmap & 1 << CHANNEL_DOWN) {
                DP(BNX2X_MSG_IOV, "detecting channel down. Aborting message\n");
                *done = PFVF_STATUS_SUCCESS;
-                return 0;
+                return -EINVAL;
        }
        /* Write message address */
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index 00c5be8c55b8..a9e068423ba0 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -13618,16 +13618,9 @@ static int tg3_hwtstamp_ioctl(struct net_device *dev,
        if (stmpconf.flags)
                return -EINVAL;
-        switch (stmpconf.tx_type) {
+        if (stmpconf.tx_type != HWTSTAMP_TX_ON &&
-        case HWTSTAMP_TX_ON:
+            stmpconf.tx_type != HWTSTAMP_TX_OFF)
-                tg3_flag_set(tp, TX_TSTAMP_EN);
-                break;
-        case HWTSTAMP_TX_OFF:
-                tg3_flag_clear(tp, TX_TSTAMP_EN);
-                break;
-        default:
                return -ERANGE;
-        }
        switch (stmpconf.rx_filter) {
        case HWTSTAMP_FILTER_NONE:
@@ -13689,6 +13682,11 @@ static int tg3_hwtstamp_ioctl(struct net_device *dev,
                tw32(TG3_RX_PTP_CTL,
                     tp->rxptpctl | TG3_RX_PTP_CTL_HWTS_INTERLOCK);
+        if (stmpconf.tx_type == HWTSTAMP_TX_ON)
+                tg3_flag_set(tp, TX_TSTAMP_EN);
+        else
+                tg3_flag_clear(tp, TX_TSTAMP_EN);
        return copy_to_user(ifr->ifr_data, &stmpconf, sizeof(stmpconf)) ?
                -EFAULT : 0;
 }
diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.c b/drivers/net/ethernet/emulex/benet/be_cmds.c
index 7fb0edfe3d24..dbcd5262c016 100644
--- a/drivers/net/ethernet/emulex/benet/be_cmds.c
+++ b/drivers/net/ethernet/emulex/benet/be_cmds.c
@@ -1758,7 +1758,7 @@ err:
 /* Uses sycnhronous mcc */
 int be_cmd_vlan_config(struct be_adapter *adapter, u32 if_id, u16 *vtag_array,
-                        u32 num, bool untagged, bool promiscuous)
+                       u32 num, bool promiscuous)
 {
        struct be_mcc_wrb *wrb;
        struct be_cmd_req_vlan_config *req;
@@ -1778,7 +1778,7 @@ int be_cmd_vlan_config(struct be_adapter *adapter, u32 if_id, u16 *vtag_array,
        req->interface_id = if_id;
        req->promiscuous = promiscuous;
-        req->untagged = untagged;
+        req->untagged = BE_IF_FLAGS_UNTAGGED & be_if_cap_flags(adapter) ? 1 : 0;
        req->num_vlan = num;
        if (!promiscuous) {
                memcpy(req->normal_vlan, vtag_array,
@@ -1847,7 +1847,19 @@ int be_cmd_rx_filter(struct be_adapter *adapter, u32 flags, u32 value)
                        memcpy(req->mcast_mac[i++].byte, ha->addr, ETH_ALEN);
        }
+        if ((req->if_flags_mask & cpu_to_le32(be_if_cap_flags(adapter))) !=
+             req->if_flags_mask) {
+                dev_warn(&adapter->pdev->dev,
+                         "Cannot set rx filter flags 0x%x\n",
+                         req->if_flags_mask);
+                dev_warn(&adapter->pdev->dev,
+                         "Interface is capable of 0x%x flags only\n",
+                         be_if_cap_flags(adapter));
+        }
+        req->if_flags_mask &= cpu_to_le32(be_if_cap_flags(adapter));
        status = be_mcc_notify_wait(adapter);
 err:
        spin_unlock_bh(&adapter->mcc_lock);
        return status;
diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.h b/drivers/net/ethernet/emulex/benet/be_cmds.h
index edf3e8a0ff83..0075686276aa 100644
--- a/drivers/net/ethernet/emulex/benet/be_cmds.h
+++ b/drivers/net/ethernet/emulex/benet/be_cmds.h
@@ -1984,7 +1984,7 @@ int be_cmd_get_fw_ver(struct be_adapter *adapter, char *fw_ver,
                      char *fw_on_flash);
 int be_cmd_modify_eqd(struct be_adapter *adapter, struct be_set_eqd *, int num);
 int be_cmd_vlan_config(struct be_adapter *adapter, u32 if_id, u16 *vtag_array,
-                       u32 num, bool untagged, bool promiscuous);
+                       u32 num, bool promiscuous);
 int be_cmd_rx_filter(struct be_adapter *adapter, u32 flags, u32 status);
 int be_cmd_set_flow_control(struct be_adapter *adapter, u32 tx_fc, u32 rx_fc);
 int be_cmd_get_flow_control(struct be_adapter *adapter, u32 *tx_fc, u32 *rx_fc);
diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
index eaecaadfa8c5..abde97471636 100644
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -1079,7 +1079,7 @@ static int be_vid_config(struct be_adapter *adapter)
                        vids[num++] = cpu_to_le16(i);
        status = be_cmd_vlan_config(adapter, adapter->if_handle,
-                                    vids, num, 1, 0);
+                                    vids, num, 0);
        if (status) {
                /* Set to VLAN promisc mode as setting VLAN filter failed */
@@ -2676,6 +2676,11 @@ static int be_close(struct net_device *netdev)
        be_rx_qs_destroy(adapter);
+        for (i = 1; i < (adapter->uc_macs + 1); i++)
+                be_cmd_pmac_del(adapter, adapter->if_handle,
+                                adapter->pmac_id[i], 0);
+        adapter->uc_macs = 0;
        for_all_evt_queues(adapter, eqo, i) {
                if (msix_enabled(adapter))
                        synchronize_irq(be_msix_vec_get(adapter, eqo));
diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index b2793b91cc55..4cbebf3d80eb 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -386,7 +386,14 @@ fec_enet_start_xmit(struct sk_buff *skb, struct net_device *ndev)
         */
        bdp->cbd_bufaddr = dma_map_single(&fep->pdev->dev, bufaddr,
                        FEC_ENET_TX_FRSIZE, DMA_TO_DEVICE);
+        if (dma_mapping_error(&fep->pdev->dev, bdp->cbd_bufaddr)) {
+                bdp->cbd_bufaddr = 0;
+                fep->tx_skbuff[index] = NULL;
+                dev_kfree_skb_any(skb);
+                if (net_ratelimit())
+                        netdev_err(ndev, "Tx DMA memory map failed\n");
+                return NETDEV_TX_OK;
+        }
        /* Send it on its way.  Tell FEC it's ready, interrupt when done,
         * it's the last BD of the frame, and to put the CRC on the end.
         */
@@ -861,6 +868,7 @@ fec_enet_rx(struct net_device *ndev, int budget)
        struct  bufdesc_ex *ebdp = NULL;
        bool    vlan_packet_rcvd = false;
        u16     vlan_tag;
+        int     index = 0;
 #ifdef CONFIG_M532x
        flush_cache_all();
@@ -916,10 +924,15 @@ fec_enet_rx(struct net_device *ndev, int budget)
                ndev->stats.rx_packets++;
                pkt_len = bdp->cbd_datlen;
                ndev->stats.rx_bytes += pkt_len;
-                data = (__u8*)__va(bdp->cbd_bufaddr);
-                dma_unmap_single(&fep->pdev->dev, bdp->cbd_bufaddr,
+                if (fep->bufdesc_ex)
-                                FEC_ENET_TX_FRSIZE, DMA_FROM_DEVICE);
+                        index = (struct bufdesc_ex *)bdp -
+                                (struct bufdesc_ex *)fep->rx_bd_base;
+                else
+                        index = bdp - fep->rx_bd_base;
+                data = fep->rx_skbuff[index]->data;
+                dma_sync_single_for_cpu(&fep->pdev->dev, bdp->cbd_bufaddr,
+                                        FEC_ENET_RX_FRSIZE, DMA_FROM_DEVICE);
                if (id_entry->driver_data & FEC_QUIRK_SWAP_FRAME)
                        swap_buffer(data, pkt_len);
@@ -999,8 +1012,8 @@ fec_enet_rx(struct net_device *ndev, int budget)
                        napi_gro_receive(&fep->napi, skb);
                }
-                bdp->cbd_bufaddr = dma_map_single(&fep->pdev->dev, data,
+                dma_sync_single_for_device(&fep->pdev->dev, bdp->cbd_bufaddr,
-                                FEC_ENET_TX_FRSIZE, DMA_FROM_DEVICE);
+                                        FEC_ENET_RX_FRSIZE, DMA_FROM_DEVICE);
 rx_processing_done:
                /* Clear the status flags for this buffer */
                status &= ~BD_ENET_RX_STATS;
@@ -1719,6 +1732,12 @@ static int fec_enet_alloc_buffers(struct net_device *ndev)
                bdp->cbd_bufaddr = dma_map_single(&fep->pdev->dev, skb->data,
                                FEC_ENET_RX_FRSIZE, DMA_FROM_DEVICE);
+                if (dma_mapping_error(&fep->pdev->dev, bdp->cbd_bufaddr)) {
+                        fec_enet_free_buffers(ndev);
+                        if (net_ratelimit())
+                                netdev_err(ndev, "Rx DMA memory map failed\n");
+                        return -ENOMEM;
+                }
                bdp->cbd_sc = BD_ENET_RX_EMPTY;
                if (fep->bufdesc_ex) {
diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c
index aedd5736a87d..8d3945ab7334 100644
--- a/drivers/net/ethernet/intel/e1000e/netdev.c
+++ b/drivers/net/ethernet/intel/e1000e/netdev.c
@@ -3482,10 +3482,10 @@ s32 e1000e_get_base_timinca(struct e1000_adapter *adapter, u32 *timinca)
 * specified. Matching the kind of event packet is not supported, with the
 * exception of "all V2 events regardless of level 2 or 4".
 **/
-static int e1000e_config_hwtstamp(struct e1000_adapter *adapter)
+static int e1000e_config_hwtstamp(struct e1000_adapter *adapter,
+                                  struct hwtstamp_config *config)
 {
        struct e1000_hw *hw = &adapter->hw;
-        struct hwtstamp_config *config = &adapter->hwtstamp_config;
        u32 tsync_tx_ctl = E1000_TSYNCTXCTL_ENABLED;
        u32 tsync_rx_ctl = E1000_TSYNCRXCTL_ENABLED;
        u32 rxmtrl = 0;
@@ -3586,6 +3586,8 @@ static int e1000e_config_hwtstamp(struct e1000_adapter *adapter)
                return -ERANGE;
        }
+        adapter->hwtstamp_config = *config;
        /* enable/disable Tx h/w time stamping */
        regval = er32(TSYNCTXCTL);
        regval &= ~E1000_TSYNCTXCTL_ENABLED;
@@ -3874,7 +3876,7 @@ void e1000e_reset(struct e1000_adapter *adapter)
        e1000e_reset_adaptive(hw);
        /* initialize systim and reset the ns time counter */
-        e1000e_config_hwtstamp(adapter);
+        e1000e_config_hwtstamp(adapter, &adapter->hwtstamp_config);
        /* Set EEE advertisement as appropriate */
        if (adapter->flags2 & FLAG2_HAS_EEE) {
@@ -5797,14 +5799,10 @@ static int e1000e_hwtstamp_ioctl(struct net_device *netdev, struct ifreq *ifr)
        if (copy_from_user(&config, ifr->ifr_data, sizeof(config)))
                return -EFAULT;
-        adapter->hwtstamp_config = config;
+        ret_val = e1000e_config_hwtstamp(adapter, &config);
-        ret_val = e1000e_config_hwtstamp(adapter);
        if (ret_val)
                return ret_val;
-        config = adapter->hwtstamp_config;
        switch (config.rx_filter) {
        case HWTSTAMP_FILTER_PTP_V2_L4_SYNC:
        case HWTSTAMP_FILTER_PTP_V2_L2_SYNC:
diff --git a/drivers/net/ethernet/marvell/mv643xx_eth.c b/drivers/net/ethernet/marvell/mv643xx_eth.c
index 00cd36e08601..61088a6a9424 100644
--- a/drivers/net/ethernet/marvell/mv643xx_eth.c
+++ b/drivers/net/ethernet/marvell/mv643xx_eth.c
@@ -2890,7 +2890,8 @@ static int mv643xx_eth_probe(struct platform_device *pdev)
                                         PHY_INTERFACE_MODE_GMII);
                if (!mp->phy)
                        err = -ENODEV;
-                phy_addr_set(mp, mp->phy->addr);
+                else
+                        phy_addr_set(mp, mp->phy->addr);
        } else if (pd->phy_addr != MV643XX_ETH_PHY_NONE) {
                mp->phy = phy_scan(mp, pd->phy_addr);
diff --git a/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c b/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c
index 5a0f04c2c813..27ffe0ebf0a6 100644
--- a/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c
+++ b/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c
@@ -245,16 +245,8 @@ static int hwtstamp_ioctl(struct net_device *netdev, struct ifreq *ifr, int cmd)
        /* Get ieee1588's dev information */
        pdev = adapter->ptp_pdev;
-        switch (cfg.tx_type) {
+        if (cfg.tx_type != HWTSTAMP_TX_OFF && cfg.tx_type != HWTSTAMP_TX_ON)
-        case HWTSTAMP_TX_OFF:
-                adapter->hwts_tx_en = 0;
-                break;
-        case HWTSTAMP_TX_ON:
-                adapter->hwts_tx_en = 1;
-                break;
-        default:
                return -ERANGE;
-        }
        switch (cfg.rx_filter) {
        case HWTSTAMP_FILTER_NONE:
@@ -284,6 +276,8 @@ static int hwtstamp_ioctl(struct net_device *netdev, struct ifreq *ifr, int cmd)
                return -ERANGE;
        }
+        adapter->hwts_tx_en = cfg.tx_type == HWTSTAMP_TX_ON;
        /* Clear out any old time stamps. */
        pch_ch_event_write(pdev, TX_SNAPSHOT_LOCKED | RX_SNAPSHOT_LOCKED);
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 8d4ccd35a016..8a7a23a84ac5 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -435,16 +435,9 @@ static int stmmac_hwtstamp_ioctl(struct net_device *dev, struct ifreq *ifr)
        if (config.flags)
                return -EINVAL;
-        switch (config.tx_type) {
+        if (config.tx_type != HWTSTAMP_TX_OFF &&
-        case HWTSTAMP_TX_OFF:
+            config.tx_type != HWTSTAMP_TX_ON)
-                priv->hwts_tx_en = 0;
-                break;
-        case HWTSTAMP_TX_ON:
-                priv->hwts_tx_en = 1;
-                break;
-        default:
                return -ERANGE;
-        }
        if (priv->adv_ts) {
                switch (config.rx_filter) {
@@ -576,6 +569,7 @@ static int stmmac_hwtstamp_ioctl(struct net_device *dev, struct ifreq *ifr)
                }
        }
        priv->hwts_rx_en = ((config.rx_filter == HWTSTAMP_FILTER_NONE) ? 0 : 1);
+        priv->hwts_tx_en = config.tx_type == HWTSTAMP_TX_ON;
        if (!priv->hwts_tx_en && !priv->hwts_rx_en)
                priv->hw->ptp->config_hw_tstamping(priv->ioaddr, 0);
diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
index 90d41d26ec6d..7536a4c01293 100644
--- a/drivers/net/ethernet/ti/cpsw.c
+++ b/drivers/net/ethernet/ti/cpsw.c
@@ -967,14 +967,19 @@ static inline void cpsw_add_dual_emac_def_ale_entries(
                priv->host_port, ALE_VLAN, slave->port_vlan);
 }
-static void cpsw_slave_open(struct cpsw_slave *slave, struct cpsw_priv *priv)
+static void soft_reset_slave(struct cpsw_slave *slave)
 {
        char name[32];
-        u32 slave_port;
-        sprintf(name, "slave-%d", slave->slave_num);
+        snprintf(name, sizeof(name), "slave-%d", slave->slave_num);
        soft_reset(name, &slave->sliver->soft_reset);
+}
+static void cpsw_slave_open(struct cpsw_slave *slave, struct cpsw_priv *priv)
+{
+        u32 slave_port;
+        soft_reset_slave(slave);
        /* setup priority mapping */
        __raw_writel(RX_PRIORITY_MAPPING, &slave->sliver->rx_pri_map);
@@ -1323,6 +1328,10 @@ static int cpsw_hwtstamp_ioctl(struct net_device *dev, struct ifreq *ifr)
        struct cpts *cpts = priv->cpts;
        struct hwtstamp_config cfg;
+        if (priv->version != CPSW_VERSION_1 &&
+            priv->version != CPSW_VERSION_2)
+                return -EOPNOTSUPP;
        if (copy_from_user(&cfg, ifr->ifr_data, sizeof(cfg)))
                return -EFAULT;
@@ -1330,16 +1339,8 @@ static int cpsw_hwtstamp_ioctl(struct net_device *dev, struct ifreq *ifr)
        if (cfg.flags)
                return -EINVAL;
-        switch (cfg.tx_type) {
+        if (cfg.tx_type != HWTSTAMP_TX_OFF && cfg.tx_type != HWTSTAMP_TX_ON)
-        case HWTSTAMP_TX_OFF:
-                cpts->tx_enable = 0;
-                break;
-        case HWTSTAMP_TX_ON:
-                cpts->tx_enable = 1;
-                break;
-        default:
                return -ERANGE;
-        }
        switch (cfg.rx_filter) {
        case HWTSTAMP_FILTER_NONE:
@@ -1366,6 +1367,8 @@ static int cpsw_hwtstamp_ioctl(struct net_device *dev, struct ifreq *ifr)
                return -ERANGE;
        }
+        cpts->tx_enable = cfg.tx_type == HWTSTAMP_TX_ON;
        switch (priv->version) {
        case CPSW_VERSION_1:
                cpsw_hwtstamp_v1(priv);
@@ -1374,7 +1377,7 @@ static int cpsw_hwtstamp_ioctl(struct net_device *dev, struct ifreq *ifr)
                cpsw_hwtstamp_v2(priv);
                break;
        default:
-                return -ENOTSUPP;
+                WARN_ON(1);
        }
        return copy_to_user(ifr->ifr_data, &cfg, sizeof(cfg)) ? -EFAULT : 0;
@@ -2173,8 +2176,9 @@ static int cpsw_suspend(struct device *dev)
        if (netif_running(ndev))
                cpsw_ndo_stop(ndev);
-        soft_reset("sliver 0", &priv->slaves[0].sliver->soft_reset);
-        soft_reset("sliver 1", &priv->slaves[1].sliver->soft_reset);
+        for_each_slave(priv, soft_reset_slave);
        pm_runtime_put_sync(&pdev->dev);
        /* Select sleep pin state */
diff --git a/drivers/net/ethernet/xscale/ixp4xx_eth.c b/drivers/net/ethernet/xscale/ixp4xx_eth.c
index e78802e75ea6..bcc224a83734 100644
--- a/drivers/net/ethernet/xscale/ixp4xx_eth.c
+++ b/drivers/net/ethernet/xscale/ixp4xx_eth.c
@@ -389,16 +389,8 @@ static int hwtstamp_ioctl(struct net_device *netdev, struct ifreq *ifr, int cmd)
        ch = PORT2CHANNEL(port);
        regs = (struct ixp46x_ts_regs __iomem *) IXP4XX_TIMESYNC_BASE_VIRT;
-        switch (cfg.tx_type) {
+        if (cfg.tx_type != HWTSTAMP_TX_OFF && cfg.tx_type != HWTSTAMP_TX_ON)
-        case HWTSTAMP_TX_OFF:
-                port->hwts_tx_en = 0;
-                break;
-        case HWTSTAMP_TX_ON:
-                port->hwts_tx_en = 1;
-                break;
-        default:
                return -ERANGE;
-        }
        switch (cfg.rx_filter) {
        case HWTSTAMP_FILTER_NONE:
@@ -416,6 +408,8 @@ static int hwtstamp_ioctl(struct net_device *netdev, struct ifreq *ifr, int cmd)
                return -ERANGE;
        }
+        port->hwts_tx_en = cfg.tx_type == HWTSTAMP_TX_ON;
        /* Clear out any old time stamps. */
        __raw_writel(TX_SNAPSHOT_LOCKED | RX_SNAPSHOT_LOCKED,
                     &regs->channel[ch].ch_event);
diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c
index 9dccb1edfd2a..dc76670c2f2a 100644
--- a/drivers/net/macvtap.c
+++ b/drivers/net/macvtap.c
@@ -628,6 +628,7 @@ static ssize_t macvtap_get_user(struct macvtap_queue *q, struct msghdr *m,
                                const struct iovec *iv, unsigned long total_len,
                                size_t count, int noblock)
 {
+        int good_linear = SKB_MAX_HEAD(NET_IP_ALIGN);
        struct sk_buff *skb;
        struct macvlan_dev *vlan;
        unsigned long len = total_len;
@@ -670,6 +671,8 @@ static ssize_t macvtap_get_user(struct macvtap_queue *q, struct msghdr *m,
        if (m && m->msg_control && sock_flag(&q->sk, SOCK_ZEROCOPY)) {
                copylen = vnet_hdr.hdr_len ? vnet_hdr.hdr_len : GOODCOPY_LEN;
+                if (copylen > good_linear)
+                        copylen = good_linear;
                linear = copylen;
                if (iov_pages(iv, vnet_hdr_len + copylen, count)
                    <= MAX_SKB_FRAGS)
@@ -678,7 +681,10 @@ static ssize_t macvtap_get_user(struct macvtap_queue *q, struct msghdr *m,
        if (!zerocopy) {
                copylen = len;
-                linear = vnet_hdr.hdr_len;
+                if (vnet_hdr.hdr_len > good_linear)
+                        linear = good_linear;
+                else
+                        linear = vnet_hdr.hdr_len;
        }
        skb = macvtap_alloc_skb(&q->sk, NET_IP_ALIGN, copylen,
diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
index 6574eb8766f9..34b0de09d881 100644
--- a/drivers/net/team/team.c
+++ b/drivers/net/team/team.c
@@ -2650,7 +2650,7 @@ static int team_nl_cmd_port_list_get(struct sk_buff *skb,
        return err;
 }
-static struct genl_ops team_nl_ops[] = {
+static const struct genl_ops team_nl_ops[] = {
        {
                .cmd = TEAM_CMD_NOOP,
                .doit = team_nl_cmd_noop,
@@ -2676,15 +2676,15 @@ static struct genl_ops team_nl_ops[] = {
        },
 };
-static struct genl_multicast_group team_change_event_mcgrp = {
+static const struct genl_multicast_group team_nl_mcgrps[] = {
-        .name = TEAM_GENL_CHANGE_EVENT_MC_GRP_NAME,
+        { .name = TEAM_GENL_CHANGE_EVENT_MC_GRP_NAME, },
 };
 static int team_nl_send_multicast(struct sk_buff *skb,
                                  struct team *team, u32 portid)
 {
-        return genlmsg_multicast_netns(dev_net(team->dev), skb, 0,
+        return genlmsg_multicast_netns(&team_nl_family, dev_net(team->dev),
-                                       team_change_event_mcgrp.id, GFP_KERNEL);
+                                       skb, 0, 0, GFP_KERNEL);
 }
 static int team_nl_send_event_options_get(struct team *team,
@@ -2703,23 +2703,8 @@ static int team_nl_send_event_port_get(struct team *team,
 static int team_nl_init(void)
 {
-        int err;
+        return genl_register_family_with_ops_groups(&team_nl_family, team_nl_ops,
+                                                    team_nl_mcgrps);
-        err = genl_register_family_with_ops(&team_nl_family, team_nl_ops,
-                                            ARRAY_SIZE(team_nl_ops));
-        if (err)
-                return err;
-        err = genl_register_mc_group(&team_nl_family, &team_change_event_mcgrp);
-        if (err)
-                goto err_change_event_grp_reg;
-        return 0;
-err_change_event_grp_reg:
-        genl_unregister_family(&team_nl_family);
-        return err;
 }
 static void team_nl_fini(void)
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 7cb105c103fe..782e38bfc1ee 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -981,6 +981,7 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,
        struct sk_buff *skb;
        size_t len = total_len, align = NET_SKB_PAD, linear;
        struct virtio_net_hdr gso = { 0 };
+        int good_linear;
        int offset = 0;
        int copylen;
        bool zerocopy = false;
@@ -1021,12 +1022,16 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,
                        return -EINVAL;
        }
+        good_linear = SKB_MAX_HEAD(align);
        if (msg_control) {
                /* There are 256 bytes to be copied in skb, so there is
                 * enough room for skb expand head in case it is used.
                 * The rest of the buffer is mapped from userspace.
                 */
                copylen = gso.hdr_len ? gso.hdr_len : GOODCOPY_LEN;
+                if (copylen > good_linear)
+                        copylen = good_linear;
                linear = copylen;
                if (iov_pages(iv, offset + copylen, count) <= MAX_SKB_FRAGS)
                        zerocopy = true;
@@ -1034,7 +1039,10 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,
        if (!zerocopy) {
                copylen = len;
-                linear = gso.hdr_len;
+                if (gso.hdr_len > good_linear)
+                        linear = good_linear;
+                else
+                        linear = gso.hdr_len;
        }
        skb = tun_alloc_skb(tfile, align, copylen, linear, noblock);
diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
index f74786aa37be..e15ec2b12035 100644
--- a/drivers/net/usb/cdc_ncm.c
+++ b/drivers/net/usb/cdc_ncm.c
@@ -66,7 +66,7 @@ static void cdc_ncm_tx_timeout_start(struct cdc_ncm_ctx *ctx);
 static enum hrtimer_restart cdc_ncm_tx_timer_cb(struct hrtimer *hr_timer);
 static struct usb_driver cdc_ncm_driver;
-static u8 cdc_ncm_setup(struct usbnet *dev)
+static int cdc_ncm_setup(struct usbnet *dev)
 {
        struct cdc_ncm_ctx *ctx = (struct cdc_ncm_ctx *)dev->data[0];
        struct usb_cdc_ncm_ntb_parameters ncm_parm;
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index 90a429b7ebad..8494bb53ebdc 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -204,9 +204,6 @@ static void intr_complete (struct urb *urb)
                break;
        }
-        if (!netif_running (dev->net))
-                return;
        status = usb_submit_urb (urb, GFP_ATOMIC);
        if (status != 0)
                netif_err(dev, timer, dev->net,
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index cdc7c90a6a9e..7bab4de658a9 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -36,7 +36,10 @@ module_param(csum, bool, 0444);
 module_param(gso, bool, 0444);
 /* FIXME: MTU in config. */
-#define MAX_PACKET_LEN (ETH_HLEN + VLAN_HLEN + ETH_DATA_LEN)
+#define GOOD_PACKET_LEN (ETH_HLEN + VLAN_HLEN + ETH_DATA_LEN)
+#define MERGE_BUFFER_LEN (ALIGN(GOOD_PACKET_LEN + \
+                                sizeof(struct virtio_net_hdr_mrg_rxbuf), \
+                                L1_CACHE_BYTES))
 #define GOOD_COPY_LEN   128
 #define VIRTNET_DRIVER_VERSION "1.0.0"
@@ -314,10 +317,10 @@ static int receive_mergeable(struct receive_queue *rq, struct sk_buff *head_skb)
                        head_skb->dev->stats.rx_length_errors++;
                        return -EINVAL;
                }
-                if (unlikely(len > MAX_PACKET_LEN)) {
+                if (unlikely(len > MERGE_BUFFER_LEN)) {
                        pr_debug("%s: rx error: merge buffer too long\n",
                                 head_skb->dev->name);
-                        len = MAX_PACKET_LEN;
+                        len = MERGE_BUFFER_LEN;
                }
                if (unlikely(num_skb_frags == MAX_SKB_FRAGS)) {
                        struct sk_buff *nskb = alloc_skb(0, GFP_ATOMIC);
@@ -336,18 +339,17 @@ static int receive_mergeable(struct receive_queue *rq, struct sk_buff *head_skb)
                if (curr_skb != head_skb) {
                        head_skb->data_len += len;
                        head_skb->len += len;
-                        head_skb->truesize += MAX_PACKET_LEN;
+                        head_skb->truesize += MERGE_BUFFER_LEN;
                }
                page = virt_to_head_page(buf);
                offset = buf - (char *)page_address(page);
                if (skb_can_coalesce(curr_skb, num_skb_frags, page, offset)) {
                        put_page(page);
                        skb_coalesce_rx_frag(curr_skb, num_skb_frags - 1,
-                                             len, MAX_PACKET_LEN);
+                                             len, MERGE_BUFFER_LEN);
                } else {
                        skb_add_rx_frag(curr_skb, num_skb_frags, page,
-                                        offset, len,
+                                        offset, len, MERGE_BUFFER_LEN);
-                                        MAX_PACKET_LEN);
                }
                --rq->num;
        }
@@ -383,7 +385,7 @@ static void receive_buf(struct receive_queue *rq, void *buf, unsigned int len)
                struct page *page = virt_to_head_page(buf);
                skb = page_to_skb(rq, page,
                                  (char *)buf - (char *)page_address(page),
-                                  len, MAX_PACKET_LEN);
+                                  len, MERGE_BUFFER_LEN);
                if (unlikely(!skb)) {
                        dev->stats.rx_dropped++;
                        put_page(page);
@@ -471,11 +473,11 @@ static int add_recvbuf_small(struct receive_queue *rq, gfp_t gfp)
        struct skb_vnet_hdr *hdr;
        int err;
-        skb = __netdev_alloc_skb_ip_align(vi->dev, MAX_PACKET_LEN, gfp);
+        skb = __netdev_alloc_skb_ip_align(vi->dev, GOOD_PACKET_LEN, gfp);
        if (unlikely(!skb))
                return -ENOMEM;
-        skb_put(skb, MAX_PACKET_LEN);
+        skb_put(skb, GOOD_PACKET_LEN);
        hdr = skb_vnet_hdr(skb);
        sg_set_buf(rq->sg, &hdr->hdr, sizeof hdr->hdr);
@@ -542,20 +544,20 @@ static int add_recvbuf_mergeable(struct receive_queue *rq, gfp_t gfp)
        int err;
        if (gfp & __GFP_WAIT) {
-                if (skb_page_frag_refill(MAX_PACKET_LEN, &vi->alloc_frag,
+                if (skb_page_frag_refill(MERGE_BUFFER_LEN, &vi->alloc_frag,
                                         gfp)) {
                        buf = (char *)page_address(vi->alloc_frag.page) +
                              vi->alloc_frag.offset;
                        get_page(vi->alloc_frag.page);
-                        vi->alloc_frag.offset += MAX_PACKET_LEN;
+                        vi->alloc_frag.offset += MERGE_BUFFER_LEN;
                }
        } else {
-                buf = netdev_alloc_frag(MAX_PACKET_LEN);
+                buf = netdev_alloc_frag(MERGE_BUFFER_LEN);
        }
        if (!buf)
                return -ENOMEM;
-        sg_init_one(rq->sg, buf, MAX_PACKET_LEN);
+        sg_init_one(rq->sg, buf, MERGE_BUFFER_LEN);
        err = virtqueue_add_inbuf(rq->vq, rq->sg, 1, buf, gfp);
        if (err < 0)
                put_page(virt_to_head_page(buf));
@@ -1619,8 +1621,8 @@ static int virtnet_probe(struct virtio_device *vdev)
        if (err)
                goto free_stats;
-        netif_set_real_num_tx_queues(dev, 1);
+        netif_set_real_num_tx_queues(dev, vi->curr_queue_pairs);
-        netif_set_real_num_rx_queues(dev, 1);
+        netif_set_real_num_rx_queues(dev, vi->curr_queue_pairs);
        err = register_netdev(dev);
        if (err) {
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_hw.c b/drivers/net/wireless/ath/ath9k/ar9003_hw.c
index b07f164d65cf..20e49095db2a 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_hw.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_hw.c
@@ -187,17 +187,17 @@ static void ar9003_hw_init_mode_regs(struct ath_hw *ah)
                INIT_INI_ARRAY(&ah->iniCckfirJapan2484,
                               ar9485_1_1_baseband_core_txfir_coeff_japan_2484);
-                /* Load PCIE SERDES settings from INI */
+                if (ah->config.no_pll_pwrsave) {
+                        INIT_INI_ARRAY(&ah->iniPcieSerdes,
-                /* Awake Setting */
+                                       ar9485_1_1_pcie_phy_clkreq_disable_L1);
+                        INIT_INI_ARRAY(&ah->iniPcieSerdesLowPower,
-                INIT_INI_ARRAY(&ah->iniPcieSerdes,
+                                       ar9485_1_1_pcie_phy_clkreq_disable_L1);
-                                ar9485_1_1_pcie_phy_clkreq_disable_L1);
+                } else {
+                        INIT_INI_ARRAY(&ah->iniPcieSerdes,
-                /* Sleep Setting */
+                                       ar9485_1_1_pll_on_cdr_on_clkreq_disable_L1);
+                        INIT_INI_ARRAY(&ah->iniPcieSerdesLowPower,
-                INIT_INI_ARRAY(&ah->iniPcieSerdesLowPower,
+                                       ar9485_1_1_pll_on_cdr_on_clkreq_disable_L1);
-                                ar9485_1_1_pcie_phy_clkreq_disable_L1);
+                }
        } else if (AR_SREV_9462_21(ah)) {
                INIT_INI_ARRAY(&ah->iniMac[ATH_INI_CORE],
                               ar9462_2p1_mac_core);
diff --git a/drivers/net/wireless/ath/ath9k/ar9485_initvals.h b/drivers/net/wireless/ath/ath9k/ar9485_initvals.h
index 6f899c692647..7c1845221e1c 100644
--- a/drivers/net/wireless/ath/ath9k/ar9485_initvals.h
+++ b/drivers/net/wireless/ath/ath9k/ar9485_initvals.h
@@ -32,13 +32,6 @@ static const u32 ar9485_1_1_mac_postamble[][5] = {
        {0x00008318, 0x00003e80, 0x00007d00, 0x00006880, 0x00003440},
 };
-static const u32 ar9485_1_1_pcie_phy_pll_on_clkreq_disable_L1[][2] = {
-        /* Addr      allmodes  */
-        {0x00018c00, 0x18012e5e},
-        {0x00018c04, 0x000801d8},
-        {0x00018c08, 0x0000080c},
-};
 static const u32 ar9485Common_wo_xlna_rx_gain_1_1[][2] = {
        /* Addr      allmodes  */
        {0x00009e00, 0x037216a0},
@@ -1101,20 +1094,6 @@ static const u32 ar9485_common_rx_gain_1_1[][2] = {
        {0x0000a1fc, 0x00000296},
 };
-static const u32 ar9485_1_1_pcie_phy_pll_on_clkreq_enable_L1[][2] = {
-        /* Addr      allmodes  */
-        {0x00018c00, 0x18052e5e},
-        {0x00018c04, 0x000801d8},
-        {0x00018c08, 0x0000080c},
-};
-static const u32 ar9485_1_1_pcie_phy_clkreq_enable_L1[][2] = {
-        /* Addr      allmodes  */
-        {0x00018c00, 0x18053e5e},
-        {0x00018c04, 0x000801d8},
-        {0x00018c08, 0x0000080c},
-};
 static const u32 ar9485_1_1_soc_preamble[][2] = {
        /* Addr      allmodes  */
        {0x00004014, 0xba280400},
@@ -1173,13 +1152,6 @@ static const u32 ar9485_1_1_baseband_postamble[][5] = {
        {0x0000be18, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
 };
-static const u32 ar9485_1_1_pcie_phy_clkreq_disable_L1[][2] = {
-        /* Addr      allmodes  */
-        {0x00018c00, 0x18013e5e},
-        {0x00018c04, 0x000801d8},
-        {0x00018c08, 0x0000080c},
-};
 static const u32 ar9485_1_1_radio_postamble[][2] = {
        /* Addr      allmodes  */
        {0x0001609c, 0x0b283f31},
@@ -1358,4 +1330,18 @@ static const u32 ar9485_1_1_baseband_core_txfir_coeff_japan_2484[][2] = {
        {0x0000a3a0, 0xca9228ee},
 };
+static const u32 ar9485_1_1_pcie_phy_clkreq_disable_L1[][2] = {
+        /* Addr      allmodes  */
+        {0x00018c00, 0x18013e5e},
+        {0x00018c04, 0x000801d8},
+        {0x00018c08, 0x0000080c},
+};
+static const u32 ar9485_1_1_pll_on_cdr_on_clkreq_disable_L1[][2] = {
+        /* Addr      allmodes  */
+        {0x00018c00, 0x1801265e},
+        {0x00018c04, 0x000801d8},
+        {0x00018c08, 0x0000080c},
+};
 #endif /* INITVALS_9485_H */
diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
index e7a38d844a6a..60a5da53668f 100644
--- a/drivers/net/wireless/ath/ath9k/ath9k.h
+++ b/drivers/net/wireless/ath/ath9k/ath9k.h
@@ -632,15 +632,16 @@ void ath_ant_comb_scan(struct ath_softc *sc, struct ath_rx_status *rs);
 /* Main driver core */
 /********************/
-#define ATH9K_PCI_CUS198      0x0001
+#define ATH9K_PCI_CUS198          0x0001
-#define ATH9K_PCI_CUS230      0x0002
+#define ATH9K_PCI_CUS230          0x0002
-#define ATH9K_PCI_CUS217      0x0004
+#define ATH9K_PCI_CUS217          0x0004
-#define ATH9K_PCI_CUS252      0x0008
+#define ATH9K_PCI_CUS252          0x0008
-#define ATH9K_PCI_WOW         0x0010
+#define ATH9K_PCI_WOW             0x0010
-#define ATH9K_PCI_BT_ANT_DIV  0x0020
+#define ATH9K_PCI_BT_ANT_DIV      0x0020
-#define ATH9K_PCI_D3_L1_WAR   0x0040
+#define ATH9K_PCI_D3_L1_WAR       0x0040
-#define ATH9K_PCI_AR9565_1ANT 0x0080
+#define ATH9K_PCI_AR9565_1ANT     0x0080
-#define ATH9K_PCI_AR9565_2ANT 0x0100
+#define ATH9K_PCI_AR9565_2ANT     0x0100
+#define ATH9K_PCI_NO_PLL_PWRSAVE  0x0200
 /*
 * Default cache line size, in bytes.
diff --git a/drivers/net/wireless/ath/ath9k/dfs_debug.c b/drivers/net/wireless/ath/ath9k/dfs_debug.c
index 90b8342d1ed4..8824610c21fb 100644
--- a/drivers/net/wireless/ath/ath9k/dfs_debug.c
+++ b/drivers/net/wireless/ath/ath9k/dfs_debug.c
@@ -44,14 +44,20 @@ static ssize_t read_file_dfs(struct file *file, char __user *user_buf,
        if (buf == NULL)
                return -ENOMEM;
-        if (sc->dfs_detector)
-                dfs_pool_stats = sc->dfs_detector->get_stats(sc->dfs_detector);
        len += scnprintf(buf + len, size - len, "DFS support for "
                         "macVersion = 0x%x, macRev = 0x%x: %s\n",
                         hw_ver->macVersion, hw_ver->macRev,
                         (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_DFS) ?
                                        "enabled" : "disabled");
+        if (!sc->dfs_detector) {
+                len += scnprintf(buf + len, size - len,
+                                 "DFS detector not enabled\n");
+                goto exit;
+        }
+        dfs_pool_stats = sc->dfs_detector->get_stats(sc->dfs_detector);
        len += scnprintf(buf + len, size - len, "Pulse detector statistics:\n");
        ATH9K_DFS_STAT("pulse events reported   ", pulses_total);
        ATH9K_DFS_STAT("invalid pulse events    ", pulses_no_dfs);
@@ -76,6 +82,7 @@ static ssize_t read_file_dfs(struct file *file, char __user *user_buf,
        ATH9K_DFS_POOL_STAT("Seqs. alloc error       ", pseq_alloc_error);
        ATH9K_DFS_POOL_STAT("Seqs. in use            ", pseq_used);
+exit:
        if (len > size)
                len = size;
diff --git a/drivers/net/wireless/ath/ath9k/hw.h b/drivers/net/wireless/ath/ath9k/hw.h
index 9ea24f1cba73..a2c9a5dbac6b 100644
--- a/drivers/net/wireless/ath/ath9k/hw.h
+++ b/drivers/net/wireless/ath/ath9k/hw.h
@@ -316,6 +316,7 @@ struct ath9k_ops_config {
        u32 ant_ctrl_comm2g_switch_enable;
        bool xatten_margin_cfg;
        bool alt_mingainidx;
+        bool no_pll_pwrsave;
 };
 enum ath9k_int {
diff --git a/drivers/net/wireless/ath/ath9k/init.c b/drivers/net/wireless/ath/ath9k/init.c
index d8643ebabd30..710192ed27ed 100644
--- a/drivers/net/wireless/ath/ath9k/init.c
+++ b/drivers/net/wireless/ath/ath9k/init.c
@@ -609,6 +609,11 @@ static void ath9k_init_platform(struct ath_softc *sc)
                ah->config.pcie_waen = 0x0040473b;
                ath_info(common, "Enable WAR for ASPM D3/L1\n");
        }
+        if (sc->driver_data & ATH9K_PCI_NO_PLL_PWRSAVE) {
+                ah->config.no_pll_pwrsave = true;
+                ath_info(common, "Disable PLL PowerSave\n");
+        }
 }
 static void ath9k_eeprom_request_cb(const struct firmware *eeprom_blob,
@@ -863,8 +868,8 @@ static const struct ieee80211_iface_combination if_comb[] = {
                .max_interfaces = 1,
                .num_different_channels = 1,
                .beacon_int_infra_match = true,
-                .radar_detect_widths =  BIT(NL80211_CHAN_NO_HT) |
+                .radar_detect_widths =  BIT(NL80211_CHAN_WIDTH_20_NOHT) |
-                                        BIT(NL80211_CHAN_HT20),
+                                        BIT(NL80211_CHAN_WIDTH_20),
        }
 };
diff --git a/drivers/net/wireless/ath/ath9k/pci.c b/drivers/net/wireless/ath/ath9k/pci.c
index 7e4c2524b630..b5656fce4ff5 100644
--- a/drivers/net/wireless/ath/ath9k/pci.c
+++ b/drivers/net/wireless/ath/ath9k/pci.c
@@ -195,6 +195,93 @@ static DEFINE_PCI_DEVICE_TABLE(ath_pci_id_table) = {
                         0x3219),
          .driver_data = ATH9K_PCI_BT_ANT_DIV },
+        /* AR9485 cards with PLL power-save disabled by default. */
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0032,
+                         PCI_VENDOR_ID_AZWAVE,
+                         0x2C97),
+          .driver_data = ATH9K_PCI_NO_PLL_PWRSAVE },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0032,
+                         PCI_VENDOR_ID_AZWAVE,
+                         0x2100),
+          .driver_data = ATH9K_PCI_NO_PLL_PWRSAVE },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0032,
+                         0x1C56, /* ASKEY */
+                         0x4001),
+          .driver_data = ATH9K_PCI_NO_PLL_PWRSAVE },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0032,
+                         0x11AD, /* LITEON */
+                         0x6627),
+          .driver_data = ATH9K_PCI_NO_PLL_PWRSAVE },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0032,
+                         0x11AD, /* LITEON */
+                         0x6628),
+          .driver_data = ATH9K_PCI_NO_PLL_PWRSAVE },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0032,
+                         PCI_VENDOR_ID_FOXCONN,
+                         0xE04E),
+          .driver_data = ATH9K_PCI_NO_PLL_PWRSAVE },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0032,
+                         PCI_VENDOR_ID_FOXCONN,
+                         0xE04F),
+          .driver_data = ATH9K_PCI_NO_PLL_PWRSAVE },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0032,
+                         0x144F, /* ASKEY */
+                         0x7197),
+          .driver_data = ATH9K_PCI_NO_PLL_PWRSAVE },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0032,
+                         0x1B9A, /* XAVI */
+                         0x2000),
+          .driver_data = ATH9K_PCI_NO_PLL_PWRSAVE },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0032,
+                         0x1B9A, /* XAVI */
+                         0x2001),
+          .driver_data = ATH9K_PCI_NO_PLL_PWRSAVE },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0032,
+                         PCI_VENDOR_ID_AZWAVE,
+                         0x1186),
+          .driver_data = ATH9K_PCI_NO_PLL_PWRSAVE },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0032,
+                         PCI_VENDOR_ID_AZWAVE,
+                         0x1F86),
+          .driver_data = ATH9K_PCI_NO_PLL_PWRSAVE },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0032,
+                         PCI_VENDOR_ID_AZWAVE,
+                         0x1195),
+          .driver_data = ATH9K_PCI_NO_PLL_PWRSAVE },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0032,
+                         PCI_VENDOR_ID_AZWAVE,
+                         0x1F95),
+          .driver_data = ATH9K_PCI_NO_PLL_PWRSAVE },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0032,
+                         0x1B9A, /* XAVI */
+                         0x1C00),
+          .driver_data = ATH9K_PCI_NO_PLL_PWRSAVE },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0032,
+                         0x1B9A, /* XAVI */
+                         0x1C01),
+          .driver_data = ATH9K_PCI_NO_PLL_PWRSAVE },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0032,
+                         PCI_VENDOR_ID_ASUSTEK,
+                         0x850D),
+          .driver_data = ATH9K_PCI_NO_PLL_PWRSAVE },
        { PCI_VDEVICE(ATHEROS, 0x0032) }, /* PCI-E  AR9485 */
        { PCI_VDEVICE(ATHEROS, 0x0033) }, /* PCI-E  AR9580 */
diff --git a/drivers/net/wireless/ath/wcn36xx/debug.c b/drivers/net/wireless/ath/wcn36xx/debug.c
index 5b84f7ae0b1e..ef44a2da644d 100644
--- a/drivers/net/wireless/ath/wcn36xx/debug.c
+++ b/drivers/net/wireless/ath/wcn36xx/debug.c
@@ -126,7 +126,7 @@ static ssize_t write_file_dump(struct file *file,
                if (begin == NULL)
                        break;
-                if (kstrtoul(begin, 0, (unsigned long *)(arg + i)) != 0)
+                if (kstrtou32(begin, 0, &arg[i]) != 0)
                        break;
        }
diff --git a/drivers/net/wireless/ath/wcn36xx/smd.c b/drivers/net/wireless/ath/wcn36xx/smd.c
index f8c3a10510c2..de9eb2cfbf4b 100644
--- a/drivers/net/wireless/ath/wcn36xx/smd.c
+++ b/drivers/net/wireless/ath/wcn36xx/smd.c
@@ -1286,7 +1286,8 @@ int wcn36xx_smd_send_beacon(struct wcn36xx *wcn, struct ieee80211_vif *vif,
        } else {
                wcn36xx_err("Beacon is to big: beacon size=%d\n",
                              msg_body.beacon_length);
-                return -ENOMEM;
+                ret = -ENOMEM;
+                goto out;
        }
        memcpy(msg_body.bssid, vif->addr, ETH_ALEN);
@@ -1327,7 +1328,8 @@ int wcn36xx_smd_update_proberesp_tmpl(struct wcn36xx *wcn,
        if (skb->len > BEACON_TEMPLATE_SIZE) {
                wcn36xx_warn("probe response template is too big: %d\n",
                             skb->len);
-                return -E2BIG;
+                ret = -E2BIG;
+                goto out;
        }
        msg.probe_resp_template_len = skb->len;
@@ -1606,7 +1608,8 @@ int wcn36xx_smd_keep_alive_req(struct wcn36xx *wcn,
                /* TODO: it also support ARP response type */
        } else {
                wcn36xx_warn("unknow keep alive packet type %d\n", packet_type);
-                return -EINVAL;
+                ret = -EINVAL;
+                goto out;
        }
        PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
diff --git a/drivers/net/wireless/libertas/debugfs.c b/drivers/net/wireless/libertas/debugfs.c
index 668dd27616a0..cc6a0a586f0b 100644
--- a/drivers/net/wireless/libertas/debugfs.c
+++ b/drivers/net/wireless/libertas/debugfs.c
@@ -913,7 +913,10 @@ static ssize_t lbs_debugfs_write(struct file *f, const char __user *buf,
        char *p2;
        struct debug_data *d = f->private_data;
-        pdata = kmalloc(cnt, GFP_KERNEL);
+        if (cnt == 0)
+                return 0;
+        pdata = kmalloc(cnt + 1, GFP_KERNEL);
        if (pdata == NULL)
                return 0;
@@ -922,6 +925,7 @@ static ssize_t lbs_debugfs_write(struct file *f, const char __user *buf,
                kfree(pdata);
                return 0;
        }
+        pdata[cnt] = '\0';
        p0 = pdata;
        for (i = 0; i < num_of_items; i++) {
diff --git a/drivers/net/wireless/libertas/if_cs.c b/drivers/net/wireless/libertas/if_cs.c
index ef8c98e21098..f499efc6abcf 100644
--- a/drivers/net/wireless/libertas/if_cs.c
+++ b/drivers/net/wireless/libertas/if_cs.c
@@ -902,6 +902,7 @@ static int if_cs_probe(struct pcmcia_device *p_dev)
        if (card->model == MODEL_UNKNOWN) {
                pr_err("unsupported manf_id 0x%04x / card_id 0x%04x\n",
                       p_dev->manf_id, p_dev->card_id);
+                ret = -ENODEV;
                goto out2;
        }
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index de0df86704e7..9df7bc91a26f 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -2097,7 +2097,7 @@ out:
 }
 /* Generic Netlink operations array */
-static struct genl_ops hwsim_ops[] = {
+static const struct genl_ops hwsim_ops[] = {
        {
                .cmd = HWSIM_CMD_REGISTER,
                .policy = hwsim_genl_policy,
@@ -2148,8 +2148,7 @@ static int hwsim_init_netlink(void)
        printk(KERN_INFO "mac80211_hwsim: initializing netlink\n");
-        rc = genl_register_family_with_ops(&hwsim_genl_family,
+        rc = genl_register_family_with_ops(&hwsim_genl_family, hwsim_ops);
-                hwsim_ops, ARRAY_SIZE(hwsim_ops));
        if (rc)
                goto failure;
diff --git a/drivers/net/wireless/mwifiex/fw.h b/drivers/net/wireless/mwifiex/fw.h
index f80f30b6160e..c8385ec77a86 100644
--- a/drivers/net/wireless/mwifiex/fw.h
+++ b/drivers/net/wireless/mwifiex/fw.h
@@ -1020,8 +1020,8 @@ struct mwifiex_power_group {
 } __packed;
 struct mwifiex_types_power_group {
-        u16 type;
+        __le16 type;
-        u16 length;
+        __le16 length;
 } __packed;
 struct host_cmd_ds_txpwr_cfg {
diff --git a/drivers/net/wireless/mwifiex/ie.c b/drivers/net/wireless/mwifiex/ie.c
index 220af4fe0fc6..81ac001ee741 100644
--- a/drivers/net/wireless/mwifiex/ie.c
+++ b/drivers/net/wireless/mwifiex/ie.c
@@ -82,7 +82,7 @@ mwifiex_update_autoindex_ies(struct mwifiex_private *priv,
                             struct mwifiex_ie_list *ie_list)
 {
        u16 travel_len, index, mask;
-        s16 input_len;
+        s16 input_len, tlv_len;
        struct mwifiex_ie *ie;
        u8 *tmp;
@@ -91,11 +91,13 @@ mwifiex_update_autoindex_ies(struct mwifiex_private *priv,
        ie_list->len = 0;
-        while (input_len > 0) {
+        while (input_len >= sizeof(struct mwifiex_ie_types_header)) {
                ie = (struct mwifiex_ie *)(((u8 *)ie_list) + travel_len);
-                input_len -= le16_to_cpu(ie->ie_length) + MWIFIEX_IE_HDR_SIZE;
+                tlv_len = le16_to_cpu(ie->ie_length);
-                travel_len += le16_to_cpu(ie->ie_length) + MWIFIEX_IE_HDR_SIZE;
+                travel_len += tlv_len + MWIFIEX_IE_HDR_SIZE;
+                if (input_len < tlv_len + MWIFIEX_IE_HDR_SIZE)
+                        return -1;
                index = le16_to_cpu(ie->ie_index);
                mask = le16_to_cpu(ie->mgmt_subtype_mask);
@@ -132,6 +134,7 @@ mwifiex_update_autoindex_ies(struct mwifiex_private *priv,
                le16_add_cpu(&ie_list->len,
                             le16_to_cpu(priv->mgmt_ie[index].ie_length) +
                             MWIFIEX_IE_HDR_SIZE);
+                input_len -= tlv_len + MWIFIEX_IE_HDR_SIZE;
        }
        if (GET_BSS_ROLE(priv) == MWIFIEX_BSS_ROLE_UAP)
diff --git a/drivers/net/wireless/mwifiex/sdio.c b/drivers/net/wireless/mwifiex/sdio.c
index 1576104e3d95..9bf8898743ab 100644
--- a/drivers/net/wireless/mwifiex/sdio.c
+++ b/drivers/net/wireless/mwifiex/sdio.c
@@ -1029,7 +1029,10 @@ static int mwifiex_decode_rx_packet(struct mwifiex_adapter *adapter,
                                    struct sk_buff *skb, u32 upld_typ)
 {
        u8 *cmd_buf;
+        __le16 *curr_ptr = (__le16 *)skb->data;
+        u16 pkt_len = le16_to_cpu(*curr_ptr);
+        skb_trim(skb, pkt_len);
        skb_pull(skb, INTF_HEADER_LEN);
        switch (upld_typ) {
diff --git a/drivers/net/wireless/mwifiex/sta_cmd.c b/drivers/net/wireless/mwifiex/sta_cmd.c
index 7d66018a2e33..2181ee283d82 100644
--- a/drivers/net/wireless/mwifiex/sta_cmd.c
+++ b/drivers/net/wireless/mwifiex/sta_cmd.c
@@ -239,14 +239,14 @@ static int mwifiex_cmd_tx_power_cfg(struct host_cmd_ds_command *cmd,
                        memmove(cmd_txp_cfg, txp,
                                sizeof(struct host_cmd_ds_txpwr_cfg) +
                                sizeof(struct mwifiex_types_power_group) +
-                                pg_tlv->length);
+                                le16_to_cpu(pg_tlv->length));
                        pg_tlv = (struct mwifiex_types_power_group *) ((u8 *)
                                  cmd_txp_cfg +
                                  sizeof(struct host_cmd_ds_txpwr_cfg));
                        cmd->size = cpu_to_le16(le16_to_cpu(cmd->size) +
                                  sizeof(struct mwifiex_types_power_group) +
-                                  pg_tlv->length);
+                                  le16_to_cpu(pg_tlv->length));
                } else {
                        memmove(cmd_txp_cfg, txp, sizeof(*txp));
                }
diff --git a/drivers/net/wireless/mwifiex/sta_cmdresp.c b/drivers/net/wireless/mwifiex/sta_cmdresp.c
index 58a6013712d2..2675ca7f8d14 100644
--- a/drivers/net/wireless/mwifiex/sta_cmdresp.c
+++ b/drivers/net/wireless/mwifiex/sta_cmdresp.c
@@ -274,17 +274,20 @@ static int mwifiex_ret_tx_rate_cfg(struct mwifiex_private *priv,
        struct host_cmd_ds_tx_rate_cfg *rate_cfg = &resp->params.tx_rate_cfg;
        struct mwifiex_rate_scope *rate_scope;
        struct mwifiex_ie_types_header *head;
-        u16 tlv, tlv_buf_len;
+        u16 tlv, tlv_buf_len, tlv_buf_left;
        u8 *tlv_buf;
        u32 i;
-        tlv_buf = ((u8 *)rate_cfg) +
+        tlv_buf = ((u8 *)rate_cfg) + sizeof(struct host_cmd_ds_tx_rate_cfg);
-                        sizeof(struct host_cmd_ds_tx_rate_cfg);
+        tlv_buf_left = le16_to_cpu(resp->size) - S_DS_GEN - sizeof(*rate_cfg);
-        tlv_buf_len = le16_to_cpu(*(__le16 *) (tlv_buf + sizeof(u16)));
-        while (tlv_buf && tlv_buf_len > 0) {
+        while (tlv_buf_left >= sizeof(*head)) {
-                tlv = (*tlv_buf);
+                head = (struct mwifiex_ie_types_header *)tlv_buf;
-                tlv = tlv | (*(tlv_buf + 1) << 8);
+                tlv = le16_to_cpu(head->type);
+                tlv_buf_len = le16_to_cpu(head->len);
+                if (tlv_buf_left < (sizeof(*head) + tlv_buf_len))
+                        break;
                switch (tlv) {
                case TLV_TYPE_RATE_SCOPE:
@@ -304,9 +307,8 @@ static int mwifiex_ret_tx_rate_cfg(struct mwifiex_private *priv,
                        /* Add RATE_DROP tlv here */
                }
-                head = (struct mwifiex_ie_types_header *) tlv_buf;
+                tlv_buf += (sizeof(*head) + tlv_buf_len);
-                tlv_buf += le16_to_cpu(head->len) + sizeof(*head);
+                tlv_buf_left -= (sizeof(*head) + tlv_buf_len);
-                tlv_buf_len -= le16_to_cpu(head->len);
        }
        priv->is_data_rate_auto = mwifiex_is_rate_auto(priv);
@@ -340,13 +342,17 @@ static int mwifiex_get_power_level(struct mwifiex_private *priv, void *data_buf)
                ((u8 *) data_buf + sizeof(struct host_cmd_ds_txpwr_cfg));
        pg = (struct mwifiex_power_group *)
                ((u8 *) pg_tlv_hdr + sizeof(struct mwifiex_types_power_group));
-        length = pg_tlv_hdr->length;
+        length = le16_to_cpu(pg_tlv_hdr->length);
-        if (length > 0) {
-                max_power = pg->power_max;
+        /* At least one structure required to update power */
-                min_power = pg->power_min;
+        if (length < sizeof(struct mwifiex_power_group))
-                length -= sizeof(struct mwifiex_power_group);
+                return 0;
-        }
-        while (length) {
+        max_power = pg->power_max;
+        min_power = pg->power_min;
+        length -= sizeof(struct mwifiex_power_group);
+        while (length >= sizeof(struct mwifiex_power_group)) {
                pg++;
                if (max_power < pg->power_max)
                        max_power = pg->power_max;
@@ -356,10 +362,8 @@ static int mwifiex_get_power_level(struct mwifiex_private *priv, void *data_buf)
                length -= sizeof(struct mwifiex_power_group);
        }
-        if (pg_tlv_hdr->length > 0) {
+        priv->min_tx_power_level = (u8) min_power;
-                priv->min_tx_power_level = (u8) min_power;
+        priv->max_tx_power_level = (u8) max_power;
-                priv->max_tx_power_level = (u8) max_power;
-        }
        return 0;
 }
diff --git a/drivers/net/wireless/mwifiex/sta_ioctl.c b/drivers/net/wireless/mwifiex/sta_ioctl.c
index f084412eee0b..c8e029df770e 100644
--- a/drivers/net/wireless/mwifiex/sta_ioctl.c
+++ b/drivers/net/wireless/mwifiex/sta_ioctl.c
@@ -638,8 +638,9 @@ int mwifiex_set_tx_power(struct mwifiex_private *priv,
                txp_cfg->mode = cpu_to_le32(1);
                pg_tlv = (struct mwifiex_types_power_group *)
                         (buf + sizeof(struct host_cmd_ds_txpwr_cfg));
-                pg_tlv->type = TLV_TYPE_POWER_GROUP;
+                pg_tlv->type = cpu_to_le16(TLV_TYPE_POWER_GROUP);
-                pg_tlv->length = 4 * sizeof(struct mwifiex_power_group);
+                pg_tlv->length =
+                        cpu_to_le16(4 * sizeof(struct mwifiex_power_group));
                pg = (struct mwifiex_power_group *)
                     (buf + sizeof(struct host_cmd_ds_txpwr_cfg)
                      + sizeof(struct mwifiex_types_power_group));
diff --git a/drivers/net/wireless/mwifiex/uap_txrx.c b/drivers/net/wireless/mwifiex/uap_txrx.c
index 1cfe5a738c47..92f76d655e6c 100644
--- a/drivers/net/wireless/mwifiex/uap_txrx.c
+++ b/drivers/net/wireless/mwifiex/uap_txrx.c
@@ -97,6 +97,7 @@ static void mwifiex_uap_queue_bridged_pkt(struct mwifiex_private *priv,
        struct mwifiex_txinfo *tx_info;
        int hdr_chop;
        struct timeval tv;
+        struct ethhdr *p_ethhdr;
        u8 rfc1042_eth_hdr[ETH_ALEN] = { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00 };
        uap_rx_pd = (struct uap_rxpd *)(skb->data);
@@ -112,14 +113,36 @@ static void mwifiex_uap_queue_bridged_pkt(struct mwifiex_private *priv,
        }
        if (!memcmp(&rx_pkt_hdr->rfc1042_hdr,
-                    rfc1042_eth_hdr, sizeof(rfc1042_eth_hdr)))
+                    rfc1042_eth_hdr, sizeof(rfc1042_eth_hdr))) {
+                /* Replace the 803 header and rfc1042 header (llc/snap) with
+                 * an Ethernet II header, keep the src/dst and snap_type
+                 * (ethertype).
+                 *
+                 * The firmware only passes up SNAP frames converting all RX
+                 * data from 802.11 to 802.2/LLC/SNAP frames.
+                 *
+                 * To create the Ethernet II, just move the src, dst address
+                 * right before the snap_type.
+                 */
+                p_ethhdr = (struct ethhdr *)
+                        ((u8 *)(&rx_pkt_hdr->eth803_hdr)
+                         + sizeof(rx_pkt_hdr->eth803_hdr)
+                         + sizeof(rx_pkt_hdr->rfc1042_hdr)
+                         - sizeof(rx_pkt_hdr->eth803_hdr.h_dest)
+                         - sizeof(rx_pkt_hdr->eth803_hdr.h_source)
+                         - sizeof(rx_pkt_hdr->rfc1042_hdr.snap_type));
+                memcpy(p_ethhdr->h_source, rx_pkt_hdr->eth803_hdr.h_source,
+                       sizeof(p_ethhdr->h_source));
+                memcpy(p_ethhdr->h_dest, rx_pkt_hdr->eth803_hdr.h_dest,
+                       sizeof(p_ethhdr->h_dest));
                /* Chop off the rxpd + the excess memory from
                 * 802.2/llc/snap header that was removed.
                 */
-                hdr_chop = (u8 *)eth_hdr - (u8 *)uap_rx_pd;
+                hdr_chop = (u8 *)p_ethhdr - (u8 *)uap_rx_pd;
-        else
+        } else {
                /* Chop off the rxpd */
                hdr_chop = (u8 *)&rx_pkt_hdr->eth803_hdr - (u8 *)uap_rx_pd;
+        }
        /* Chop off the leading header bytes so the it points
         * to the start of either the reconstructed EthII frame
diff --git a/drivers/net/wireless/mwifiex/wmm.c b/drivers/net/wireless/mwifiex/wmm.c
index 5dd0ccc70b86..13eaeed03898 100644
--- a/drivers/net/wireless/mwifiex/wmm.c
+++ b/drivers/net/wireless/mwifiex/wmm.c
@@ -722,6 +722,9 @@ int mwifiex_ret_wmm_get_status(struct mwifiex_private *priv,
                tlv_hdr = (struct mwifiex_ie_types_data *) curr;
                tlv_len = le16_to_cpu(tlv_hdr->header.len);
+                if (resp_len < tlv_len + sizeof(tlv_hdr->header))
+                        break;
                switch (le16_to_cpu(tlv_hdr->header.type)) {
                case TLV_TYPE_WMMQSTATUS:
                        tlv_wmm_qstatus =
diff --git a/drivers/net/wireless/prism54/islpci_dev.c b/drivers/net/wireless/prism54/islpci_dev.c
index 41a16d30c79c..e05d9b4c8317 100644
--- a/drivers/net/wireless/prism54/islpci_dev.c
+++ b/drivers/net/wireless/prism54/islpci_dev.c
@@ -811,6 +811,10 @@ static const struct net_device_ops islpci_netdev_ops = {
        .ndo_validate_addr      = eth_validate_addr,
 };
+static struct device_type wlan_type = {
+        .name   = "wlan",
+};
 struct net_device *
 islpci_setup(struct pci_dev *pdev)
 {
@@ -821,9 +825,8 @@ islpci_setup(struct pci_dev *pdev)
                return ndev;
        pci_set_drvdata(pdev, ndev);
-#if defined(SET_NETDEV_DEV)
        SET_NETDEV_DEV(ndev, &pdev->dev);
-#endif
+        SET_NETDEV_DEVTYPE(ndev, &wlan_type);
        /* setup the structure members */
        ndev->base_addr = pci_resource_start(pdev, 0);
diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c b/drivers/net/wireless/rt2x00/rt2800lib.c
index c5738f14c4ba..776aff3678ff 100644
--- a/drivers/net/wireless/rt2x00/rt2800lib.c
+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
@@ -2640,7 +2640,7 @@ static void rt2800_config_channel_rf53xx(struct rt2x00_dev *rt2x00dev,
        if (rt2x00_rt(rt2x00dev, RT5392)) {
                rt2800_rfcsr_read(rt2x00dev, 50, &rfcsr);
-                if (info->default_power1 > POWER_BOUND)
+                if (info->default_power2 > POWER_BOUND)
                        rt2x00_set_field8(&rfcsr, RFCSR50_TX, POWER_BOUND);
                else
                        rt2x00_set_field8(&rfcsr, RFCSR50_TX,
diff --git a/drivers/net/wireless/rt2x00/rt2x00lib.h b/drivers/net/wireless/rt2x00/rt2x00lib.h
index a0935987fa3a..7f40ab8e1bd8 100644
--- a/drivers/net/wireless/rt2x00/rt2x00lib.h
+++ b/drivers/net/wireless/rt2x00/rt2x00lib.h
@@ -146,7 +146,7 @@ void rt2x00queue_remove_l2pad(struct sk_buff *skb, unsigned int header_length);
 * @local: frame is not from mac80211
 */
 int rt2x00queue_write_tx_frame(struct data_queue *queue, struct sk_buff *skb,
-                               bool local);
+                               struct ieee80211_sta *sta, bool local);
 /**
 * rt2x00queue_update_beacon - Send new beacon from mac80211
diff --git a/drivers/net/wireless/rt2x00/rt2x00mac.c b/drivers/net/wireless/rt2x00/rt2x00mac.c
index 7c157857f5ce..2183e7978399 100644
--- a/drivers/net/wireless/rt2x00/rt2x00mac.c
+++ b/drivers/net/wireless/rt2x00/rt2x00mac.c
@@ -90,7 +90,7 @@ static int rt2x00mac_tx_rts_cts(struct rt2x00_dev *rt2x00dev,
                                  frag_skb->data, data_length, tx_info,
                                  (struct ieee80211_rts *)(skb->data));
-        retval = rt2x00queue_write_tx_frame(queue, skb, true);
+        retval = rt2x00queue_write_tx_frame(queue, skb, NULL, true);
        if (retval) {
                dev_kfree_skb_any(skb);
                rt2x00_warn(rt2x00dev, "Failed to send RTS/CTS frame\n");
@@ -151,7 +151,7 @@ void rt2x00mac_tx(struct ieee80211_hw *hw,
                        goto exit_fail;
        }
-        if (unlikely(rt2x00queue_write_tx_frame(queue, skb, false)))
+        if (unlikely(rt2x00queue_write_tx_frame(queue, skb, control->sta, false)))
                goto exit_fail;
        /*
diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.c b/drivers/net/wireless/rt2x00/rt2x00queue.c
index 50590b1420a5..a5d38e8ad9e4 100644
--- a/drivers/net/wireless/rt2x00/rt2x00queue.c
+++ b/drivers/net/wireless/rt2x00/rt2x00queue.c
@@ -635,7 +635,7 @@ static void rt2x00queue_bar_check(struct queue_entry *entry)
 }
 int rt2x00queue_write_tx_frame(struct data_queue *queue, struct sk_buff *skb,
-                               bool local)
+                               struct ieee80211_sta *sta, bool local)
 {
        struct ieee80211_tx_info *tx_info;
        struct queue_entry *entry;
@@ -649,7 +649,7 @@ int rt2x00queue_write_tx_frame(struct data_queue *queue, struct sk_buff *skb,
         * after that we are free to use the skb->cb array
         * for our information.
         */
-        rt2x00queue_create_tx_descriptor(queue->rt2x00dev, skb, &txdesc, NULL);
+        rt2x00queue_create_tx_descriptor(queue->rt2x00dev, skb, &txdesc, sta);
        /*
         * All information is retrieved from the skb->cb array,
diff --git a/drivers/net/wireless/rtlwifi/base.c b/drivers/net/wireless/rtlwifi/base.c
index 9a78e3daf742..ff784072fb42 100644
--- a/drivers/net/wireless/rtlwifi/base.c
+++ b/drivers/net/wireless/rtlwifi/base.c
@@ -37,6 +37,7 @@
 #include <linux/ip.h>
 #include <linux/module.h>
+#include <linux/udp.h>
 /*
 *NOTICE!!!: This file will be very big, we should
@@ -1074,64 +1075,52 @@ u8 rtl_is_special_data(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx)
        if (!ieee80211_is_data(fc))
                return false;
+        ip = (const struct iphdr *)(skb->data + mac_hdr_len +
+                                    SNAP_SIZE + PROTOC_TYPE_SIZE);
+        ether_type = be16_to_cpup((__be16 *)
+                                  (skb->data + mac_hdr_len + SNAP_SIZE));
-        ip = (struct iphdr *)((u8 *) skb->data + mac_hdr_len +
+        switch (ether_type) {
-                              SNAP_SIZE + PROTOC_TYPE_SIZE);
+        case ETH_P_IP: {
-        ether_type = *(u16 *) ((u8 *) skb->data + mac_hdr_len + SNAP_SIZE);
+                struct udphdr *udp;
-        /*      ether_type = ntohs(ether_type); */
+                u16 src;
+                u16 dst;
-        if (ETH_P_IP == ether_type) {
-                if (IPPROTO_UDP == ip->protocol) {
-                        struct udphdr *udp = (struct udphdr *)((u8 *) ip +
-                                                               (ip->ihl << 2));
-                        if (((((u8 *) udp)[1] == 68) &&
-                             (((u8 *) udp)[3] == 67)) ||
-                            ((((u8 *) udp)[1] == 67) &&
-                             (((u8 *) udp)[3] == 68))) {
-                                /*
-                                 * 68 : UDP BOOTP client
-                                 * 67 : UDP BOOTP server
-                                 */
-                                RT_TRACE(rtlpriv, (COMP_SEND | COMP_RECV),
-                                         DBG_DMESG, "dhcp %s !!\n",
-                                         is_tx ? "Tx" : "Rx");
-                                if (is_tx) {
-                                        rtlpriv->enter_ps = false;
-                                        schedule_work(&rtlpriv->
-                                                      works.lps_change_work);
-                                        ppsc->last_delaylps_stamp_jiffies =
-                                            jiffies;
-                                }
-                                return true;
+                if (ip->protocol != IPPROTO_UDP)
-                        }
+                        return false;
-                }
+                udp = (struct udphdr *)((u8 *)ip + (ip->ihl << 2));
-        } else if (ETH_P_ARP == ether_type) {
+                src = be16_to_cpu(udp->source);
-                if (is_tx) {
+                dst = be16_to_cpu(udp->dest);
-                        rtlpriv->enter_ps = false;
-                        schedule_work(&rtlpriv->works.lps_change_work);
-                        ppsc->last_delaylps_stamp_jiffies = jiffies;
-                }
-                return true;
+                /* If this case involves port 68 (UDP BOOTP client) connecting
-        } else if (ETH_P_PAE == ether_type) {
+                 * with port 67 (UDP BOOTP server), then return true so that
+                 * the lowest speed is used.
+                 */
+                if (!((src == 68 && dst == 67) || (src == 67 && dst == 68)))
+                        return false;
+                RT_TRACE(rtlpriv, (COMP_SEND | COMP_RECV), DBG_DMESG,
+                         "dhcp %s !!\n", is_tx ? "Tx" : "Rx");
+                break;
+        }
+        case ETH_P_ARP:
+                break;
+        case ETH_P_PAE:
                RT_TRACE(rtlpriv, (COMP_SEND | COMP_RECV), DBG_DMESG,
                         "802.1X %s EAPOL pkt!!\n", is_tx ? "Tx" : "Rx");
+                break;
-                if (is_tx) {
+        case ETH_P_IPV6:
-                        rtlpriv->enter_ps = false;
+                /* TODO: Is this right? */
-                        schedule_work(&rtlpriv->works.lps_change_work);
+                return false;
-                        ppsc->last_delaylps_stamp_jiffies = jiffies;
+        default:
-                }
+                return false;
-                return true;
-        } else if (ETH_P_IPV6 == ether_type) {
-                /* IPv6 */
-                return true;
        }
+        if (is_tx) {
-        return false;
+                rtlpriv->enter_ps = false;
+                schedule_work(&rtlpriv->works.lps_change_work);
+                ppsc->last_delaylps_stamp_jiffies = jiffies;
+        }
+        return true;
 }
 EXPORT_SYMBOL_GPL(rtl_is_special_data);
diff --git a/drivers/net/wireless/rtlwifi/efuse.c b/drivers/net/wireless/rtlwifi/efuse.c
index ae13fb94b2e8..2ffc7298f686 100644
--- a/drivers/net/wireless/rtlwifi/efuse.c
+++ b/drivers/net/wireless/rtlwifi/efuse.c
@@ -262,9 +262,9 @@ void read_efuse(struct ieee80211_hw *hw, u16 _offset, u16 _size_byte, u8 *pbuf)
                            sizeof(u8), GFP_ATOMIC);
        if (!efuse_tbl)
                return;
-        efuse_word = kmalloc(EFUSE_MAX_WORD_UNIT * sizeof(u16 *), GFP_ATOMIC);
+        efuse_word = kzalloc(EFUSE_MAX_WORD_UNIT * sizeof(u16 *), GFP_ATOMIC);
        if (!efuse_word)
-                goto done;
+                goto out;
        for (i = 0; i < EFUSE_MAX_WORD_UNIT; i++) {
                efuse_word[i] = kmalloc(efuse_max_section * sizeof(u16),
                                        GFP_ATOMIC);
@@ -378,6 +378,7 @@ done:
        for (i = 0; i < EFUSE_MAX_WORD_UNIT; i++)
                kfree(efuse_word[i]);
        kfree(efuse_word);
+out:
        kfree(efuse_tbl);
 }
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c b/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c
index 25e50ffc44ec..b0c346a9e4b8 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c
@@ -349,7 +349,7 @@ bool rtl92cu_rx_query_desc(struct ieee80211_hw *hw,
                                                 p_drvinfo);
        }
        /*rx_status->qual = stats->signal; */
-        rx_status->signal = stats->rssi + 10;
+        rx_status->signal = stats->recvsignalpower + 10;
        return true;
 }
diff --git a/drivers/net/wireless/rtlwifi/rtl8192de/trx.c b/drivers/net/wireless/rtlwifi/rtl8192de/trx.c
index 945ddecf90c9..0eb0f4ae5920 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192de/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192de/trx.c
@@ -525,7 +525,7 @@ bool rtl92de_rx_query_desc(struct ieee80211_hw *hw,	struct rtl_stats *stats,
                                                   p_drvinfo);
        }
        /*rx_status->qual = stats->signal; */
-        rx_status->signal = stats->rssi + 10;
+        rx_status->signal = stats->recvsignalpower + 10;
        return true;
 }
diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/rf.c b/drivers/net/wireless/rtlwifi/rtl8192se/rf.c
index 5061f1db3f02..92d38ab3c60e 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192se/rf.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192se/rf.c
@@ -265,7 +265,7 @@ static void _rtl92s_get_txpower_writeval_byregulatory(struct ieee80211_hw *hw,
                                    rtlefuse->pwrgroup_ht40
                                    [RF90_PATH_A][chnl - 1]) {
                                        pwrdiff_limit[i] =
-                                          rtlefuse->pwrgroup_ht20
+                                          rtlefuse->pwrgroup_ht40
                                          [RF90_PATH_A][chnl - 1];
                                }
                        } else {
diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/trx.c b/drivers/net/wireless/rtlwifi/rtl8192se/trx.c
index 222d2e792ca6..27efbcdac6a9 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192se/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192se/trx.c
@@ -329,7 +329,7 @@ bool rtl92se_rx_query_desc(struct ieee80211_hw *hw, struct rtl_stats *stats,
        }
        /*rx_status->qual = stats->signal; */
-        rx_status->signal = stats->rssi + 10;
+        rx_status->signal = stats->recvsignalpower + 10;
        return true;
 }
diff --git a/drivers/net/wireless/rtlwifi/wifi.h b/drivers/net/wireless/rtlwifi/wifi.h
index d224dc3bb092..0c65386fa30d 100644
--- a/drivers/net/wireless/rtlwifi/wifi.h
+++ b/drivers/net/wireless/rtlwifi/wifi.h
@@ -77,11 +77,7 @@
 #define RTL_SLOT_TIME_9                         9
 #define RTL_SLOT_TIME_20                        20
-/*related with tcp/ip. */
+/*related to tcp/ip. */
-/*if_ehther.h*/
-#define ETH_P_PAE               0x888E  /*Port Access Entity (IEEE 802.1X) */
-#define ETH_P_IP                0x0800  /*Internet Protocol packet */
-#define ETH_P_ARP               0x0806  /*Address Resolution packet */
 #define SNAP_SIZE               6
 #define PROTOC_TYPE_SIZE        2
diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
index d85e66979711..e59acb1daa23 100644
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -277,12 +277,13 @@ static void xennet_alloc_rx_buffers(struct net_device *dev)
                if (!page) {
                        kfree_skb(skb);
 no_skb:
-                        /* Any skbuffs queued for refill? Force them out. */
-                        if (i != 0)
-                                goto refill;
                        /* Could not allocate any skbuffs. Try again later. */
                        mod_timer(&np->rx_refill_timer,
                                  jiffies + (HZ/10));
+                        /* Any skbuffs queued for refill? Force them out. */
+                        if (i != 0)
+                                goto refill;
                        break;
                }
diff --git a/drivers/scsi/pmcraid.c b/drivers/scsi/pmcraid.c
index e43db7742047..bd6f743d87a7 100644
--- a/drivers/scsi/pmcraid.c
+++ b/drivers/scsi/pmcraid.c
@@ -1512,7 +1512,8 @@ static int pmcraid_notify_aen(
        }
        result =
-                genlmsg_multicast(skb, 0, pmcraid_event_family.id, GFP_ATOMIC);
+                genlmsg_multicast(&pmcraid_event_family, skb, 0,
+                                  pmcraid_event_family.id, GFP_ATOMIC);
        /* If there are no listeners, genlmsg_multicast may return non-zero
         * value.
diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c
index 03a567199bbe..f1d511a9475b 100644
--- a/drivers/thermal/thermal_core.c
+++ b/drivers/thermal/thermal_core.c
@@ -1608,15 +1608,17 @@ exit:
 EXPORT_SYMBOL_GPL(thermal_zone_get_zone_by_name);
 #ifdef CONFIG_NET
+static const struct genl_multicast_group thermal_event_mcgrps[] = {
+        { .name = THERMAL_GENL_MCAST_GROUP_NAME, },
+};
 static struct genl_family thermal_event_genl_family = {
        .id = GENL_ID_GENERATE,
        .name = THERMAL_GENL_FAMILY_NAME,
        .version = THERMAL_GENL_VERSION,
        .maxattr = THERMAL_GENL_ATTR_MAX,
-};
+        .mcgrps = thermal_event_mcgrps,
+        .n_mcgrps = ARRAY_SIZE(thermal_event_mcgrps),
-static struct genl_multicast_group thermal_event_mcgrp = {
-        .name = THERMAL_GENL_MCAST_GROUP_NAME,
 };
 int thermal_generate_netlink_event(struct thermal_zone_device *tz,
@@ -1677,7 +1679,8 @@ int thermal_generate_netlink_event(struct thermal_zone_device *tz,
                return result;
        }
-        result = genlmsg_multicast(skb, 0, thermal_event_mcgrp.id, GFP_ATOMIC);
+        result = genlmsg_multicast(&thermal_event_genl_family, skb, 0,
+                                   0, GFP_ATOMIC);
        if (result)
                dev_err(&tz->device, "Failed to send netlink event:%d", result);
@@ -1687,17 +1690,7 @@ EXPORT_SYMBOL_GPL(thermal_generate_netlink_event);
 static int genetlink_init(void)
 {
-        int result;
+        return genl_register_family(&thermal_event_genl_family);
-        result = genl_register_family(&thermal_event_genl_family);
-        if (result)
-                return result;
-        result = genl_register_mc_group(&thermal_event_genl_family,
-                                        &thermal_event_mcgrp);
-        if (result)
-                genl_unregister_family(&thermal_event_genl_family);
-        return result;
 }
 static void genetlink_exit(void)