19 files changed, 293 insertions, 136 deletions

diff --git a/drivers/isdn/mISDN/socket.c b/drivers/isdn/mISDN/socket.c
index e47dcb9d1e91..5cefb479c707 100644
--- a/drivers/isdn/mISDN/socket.c
+++ b/drivers/isdn/mISDN/socket.c
@@ -117,7 +117,6 @@ mISDN_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
 {
         struct sk_buff          *skb;
         struct sock             *sk = sock->sk;
-        struct sockaddr_mISDN   *maddr;
 
         int             copied, err;
 
@@ -135,9 +134,9 @@ mISDN_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
         if (!skb)
                 return err;
 
-        if (msg->msg_namelen >= sizeof(struct sockaddr_mISDN)) {
-                msg->msg_namelen = sizeof(struct sockaddr_mISDN);
-                maddr = (struct sockaddr_mISDN *)msg->msg_name;
+        if (msg->msg_name) {
+                struct sockaddr_mISDN *maddr = msg->msg_name;
+
                 maddr->family = AF_ISDN;
                 maddr->dev = _pms(sk)->dev->id;
                 if ((sk->sk_protocol == ISDN_P_LAPD_TE) ||
@@ -150,11 +149,7 @@ mISDN_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
                         maddr->sapi = _pms(sk)->ch.addr & 0xFF;
                         maddr->tei =  (_pms(sk)->ch.addr >> 8) & 0xFF;
                 }
-        } else {
-                if (msg->msg_namelen)
-                        printk(KERN_WARNING "%s: too small namelen %d\n",
-                               __func__, msg->msg_namelen);
-                msg->msg_namelen = 0;
+                msg->msg_namelen = sizeof(*maddr);
         }
 
         copied = skb->len + MISDN_HEADER_LEN;
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index 74630e94fa3b..d6447b3f7409 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -697,7 +697,7 @@ static int genphy_config_advert(struct phy_device *phydev)
  *   to the values in phydev. Assumes that the values are valid.
  *   Please see phy_sanitize_settings().
  */
-static int genphy_setup_forced(struct phy_device *phydev)
+int genphy_setup_forced(struct phy_device *phydev)
 {
         int err;
         int ctl = 0;
@@ -716,7 +716,7 @@ static int genphy_setup_forced(struct phy_device *phydev)
 
         return err;
 }
-
+EXPORT_SYMBOL(genphy_setup_forced);
 
 /**
  * genphy_restart_aneg - Enable and Restart Autonegotiation
diff --git a/drivers/net/phy/vitesse.c b/drivers/net/phy/vitesse.c
index 69b482bce7d2..508e4359338b 100644
--- a/drivers/net/phy/vitesse.c
+++ b/drivers/net/phy/vitesse.c
@@ -3,7 +3,7 @@
  *
  * Author: Kriston Carson
  *
- * Copyright (c) 2005, 2009 Freescale Semiconductor, Inc.
+ * Copyright (c) 2005, 2009, 2011 Freescale Semiconductor, Inc.
  *
  * This program is free software; you can redistribute  it and/or modify it
  * under  the terms of  the GNU General  Public License as published by the
@@ -18,6 +18,11 @@
 #include <linux/ethtool.h>
 #include <linux/phy.h>
 
+/* Vitesse Extended Page Magic Register(s) */
+#define MII_VSC82X4_EXT_PAGE_16E        0x10
+#define MII_VSC82X4_EXT_PAGE_17E        0x11
+#define MII_VSC82X4_EXT_PAGE_18E        0x12
+
 /* Vitesse Extended Control Register 1 */
 #define MII_VSC8244_EXT_CON1           0x17
 #define MII_VSC8244_EXTCON1_INIT       0x0000
@@ -54,7 +59,13 @@
 #define MII_VSC8221_AUXCONSTAT_INIT     0x0004 /* need to set this bit? */
 #define MII_VSC8221_AUXCONSTAT_RESERVED 0x0004
 
+/* Vitesse Extended Page Access Register */
+#define MII_VSC82X4_EXT_PAGE_ACCESS     0x1f
+
+#define PHY_ID_VSC8234                  0x000fc620
 #define PHY_ID_VSC8244                  0x000fc6c0
+#define PHY_ID_VSC8574                  0x000704a0
+#define PHY_ID_VSC8662                  0x00070660
 #define PHY_ID_VSC8221                  0x000fc550
 #define PHY_ID_VSC8211                  0x000fc4b0
 
@@ -118,7 +129,9 @@ static int vsc82xx_config_intr(struct phy_device *phydev)
 
         if (phydev->interrupts == PHY_INTERRUPT_ENABLED)
                 err = phy_write(phydev, MII_VSC8244_IMASK,
-                        phydev->drv->phy_id == PHY_ID_VSC8244 ?
+                        (phydev->drv->phy_id == PHY_ID_VSC8234 ||
+                         phydev->drv->phy_id == PHY_ID_VSC8244 ||
+                         phydev->drv->phy_id == PHY_ID_VSC8574) ?
                                 MII_VSC8244_IMASK_MASK :
                                 MII_VSC8221_IMASK_MASK);
         else {
@@ -149,21 +162,114 @@ static int vsc8221_config_init(struct phy_device *phydev)
          */
 }
 
-/* Vitesse 824x */
+/* vsc82x4_config_autocross_enable - Enable auto MDI/MDI-X for forced links
+ * @phydev: target phy_device struct
+ *
+ * Enable auto MDI/MDI-X when in 10/100 forced link speeds by writing
+ * special values in the VSC8234/VSC8244 extended reserved registers
+ */
+static int vsc82x4_config_autocross_enable(struct phy_device *phydev)
+{
+        int ret;
+
+        if (phydev->autoneg == AUTONEG_ENABLE || phydev->speed > SPEED_100)
+                return 0;
+
+        /* map extended registers set 0x10 - 0x1e */
+        ret = phy_write(phydev, MII_VSC82X4_EXT_PAGE_ACCESS, 0x52b5);
+        if (ret >= 0)
+                ret = phy_write(phydev, MII_VSC82X4_EXT_PAGE_18E, 0x0012);
+        if (ret >= 0)
+                ret = phy_write(phydev, MII_VSC82X4_EXT_PAGE_17E, 0x2803);
+        if (ret >= 0)
+                ret = phy_write(phydev, MII_VSC82X4_EXT_PAGE_16E, 0x87fa);
+        /* map standard registers set 0x10 - 0x1e */
+        if (ret >= 0)
+                ret = phy_write(phydev, MII_VSC82X4_EXT_PAGE_ACCESS, 0x0000);
+        else
+                phy_write(phydev, MII_VSC82X4_EXT_PAGE_ACCESS, 0x0000);
+
+        return ret;
+}
+
+/* vsc82x4_config_aneg - restart auto-negotiation or write BMCR
+ * @phydev: target phy_device struct
+ *
+ * Description: If auto-negotiation is enabled, we configure the
+ *   advertising, and then restart auto-negotiation.  If it is not
+ *   enabled, then we write the BMCR and also start the auto
+ *   MDI/MDI-X feature
+ */
+static int vsc82x4_config_aneg(struct phy_device *phydev)
+{
+        int ret;
+
+        /* Enable auto MDI/MDI-X when in 10/100 forced link speeds by
+         * writing special values in the VSC8234 extended reserved registers
+         */
+        if (phydev->autoneg != AUTONEG_ENABLE && phydev->speed <= SPEED_100) {
+                ret = genphy_setup_forced(phydev);
+
+                if (ret < 0) /* error */
+                        return ret;
+
+                return vsc82x4_config_autocross_enable(phydev);
+        }
+
+        return genphy_config_aneg(phydev);
+}
+
+/* Vitesse 82xx */
 static struct phy_driver vsc82xx_driver[] = {
 {
+        .phy_id         = PHY_ID_VSC8234,
+        .name           = "Vitesse VSC8234",
+        .phy_id_mask    = 0x000ffff0,
+        .features       = PHY_GBIT_FEATURES,
+        .flags          = PHY_HAS_INTERRUPT,
+        .config_init    = &vsc824x_config_init,
+        .config_aneg    = &vsc82x4_config_aneg,
+        .read_status    = &genphy_read_status,
+        .ack_interrupt  = &vsc824x_ack_interrupt,
+        .config_intr    = &vsc82xx_config_intr,
+        .driver         = { .owner = THIS_MODULE,},
+}, {
         .phy_id         = PHY_ID_VSC8244,
         .name           = "Vitesse VSC8244",
         .phy_id_mask    = 0x000fffc0,
         .features       = PHY_GBIT_FEATURES,
         .flags          = PHY_HAS_INTERRUPT,
         .config_init    = &vsc824x_config_init,
-        .config_aneg    = &genphy_config_aneg,
+        .config_aneg    = &vsc82x4_config_aneg,
         .read_status    = &genphy_read_status,
         .ack_interrupt  = &vsc824x_ack_interrupt,
         .config_intr    = &vsc82xx_config_intr,
         .driver         = { .owner = THIS_MODULE,},
 }, {
+        .phy_id         = PHY_ID_VSC8574,
+        .name           = "Vitesse VSC8574",
+        .phy_id_mask    = 0x000ffff0,
+        .features       = PHY_GBIT_FEATURES,
+        .flags          = PHY_HAS_INTERRUPT,
+        .config_init    = &vsc824x_config_init,
+        .config_aneg    = &vsc82x4_config_aneg,
+        .read_status    = &genphy_read_status,
+        .ack_interrupt  = &vsc824x_ack_interrupt,
+        .config_intr    = &vsc82xx_config_intr,
+        .driver         = { .owner = THIS_MODULE,},
+}, {
+        .phy_id         = PHY_ID_VSC8662,
+        .name           = "Vitesse VSC8662",
+        .phy_id_mask    = 0x000ffff0,
+        .features       = PHY_GBIT_FEATURES,
+        .flags          = PHY_HAS_INTERRUPT,
+        .config_init    = &vsc824x_config_init,
+        .config_aneg    = &vsc82x4_config_aneg,
+        .read_status    = &genphy_read_status,
+        .ack_interrupt  = &vsc824x_ack_interrupt,
+        .config_intr    = &vsc82xx_config_intr,
+        .driver         = { .owner = THIS_MODULE,},
+}, {
         /* Vitesse 8221 */
         .phy_id         = PHY_ID_VSC8221,
         .phy_id_mask    = 0x000ffff0,
@@ -207,7 +313,10 @@ module_init(vsc82xx_init);
 module_exit(vsc82xx_exit);
 
 static struct mdio_device_id __maybe_unused vitesse_tbl[] = {
+        { PHY_ID_VSC8234, 0x000ffff0 },
         { PHY_ID_VSC8244, 0x000fffc0 },
+        { PHY_ID_VSC8574, 0x000ffff0 },
+        { PHY_ID_VSC8662, 0x000ffff0 },
         { PHY_ID_VSC8221, 0x000ffff0 },
         { PHY_ID_VSC8211, 0x000ffff0 },
         { }
diff --git a/drivers/net/ppp/pppoe.c b/drivers/net/ppp/pppoe.c
index 5f66e30d9823..82ee6ed954cb 100644
--- a/drivers/net/ppp/pppoe.c
+++ b/drivers/net/ppp/pppoe.c
@@ -979,8 +979,6 @@ static int pppoe_recvmsg(struct kiocb *iocb, struct socket *sock,
         if (error < 0)
                 goto end;
 
-        m->msg_namelen = 0;
-
         if (skb) {
                 total_len = min_t(size_t, total_len, skb->len);
                 error = skb_copy_datagram_iovec(skb, 0, m->msg_iov, total_len);
diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
index f3fce412c0c1..51073721e224 100644
--- a/drivers/net/usb/r8152.c
+++ b/drivers/net/usb/r8152.c
@@ -24,7 +24,7 @@
 #include <linux/ipv6.h>
 
 /* Version Information */
-#define DRIVER_VERSION "v1.01.0 (2013/08/12)"
+#define DRIVER_VERSION "v1.02.0 (2013/10/28)"
 #define DRIVER_AUTHOR "Realtek linux nic maintainers <nic_swsd@realtek.com>"
 #define DRIVER_DESC "Realtek RTL8152 Based USB 2.0 Ethernet Adapters"
 #define MODULENAME "r8152"
@@ -307,22 +307,22 @@ enum rtl8152_flags {
 #define MCU_TYPE_USB                    0x0000
 
 struct rx_desc {
-        u32 opts1;
+        __le32 opts1;
 #define RX_LEN_MASK                     0x7fff
-        u32 opts2;
-        u32 opts3;
-        u32 opts4;
-        u32 opts5;
-        u32 opts6;
+        __le32 opts2;
+        __le32 opts3;
+        __le32 opts4;
+        __le32 opts5;
+        __le32 opts6;
 };
 
 struct tx_desc {
-        u32 opts1;
+        __le32 opts1;
 #define TX_FS                   (1 << 31) /* First segment of a packet */
 #define TX_LS                   (1 << 30) /* Final segment of a packet */
 #define TX_LEN_MASK             0x3ffff
 
-        u32 opts2;
+        __le32 opts2;
 #define UDP_CS                  (1 << 31) /* Calculate UDP/IP checksum */
 #define TCP_CS                  (1 << 30) /* Calculate TCP/IP checksum */
 #define IPV4_CS                 (1 << 29) /* Calculate IPv4 checksum */
@@ -365,6 +365,7 @@ struct r8152 {
         struct mii_if_info mii;
         int intr_interval;
         u32 msg_enable;
+        u32 tx_qlen;
         u16 ocp_base;
         u8 *intr_buff;
         u8 version;
@@ -876,7 +877,7 @@ static void write_bulk_callback(struct urb *urb)
 static void intr_callback(struct urb *urb)
 {
         struct r8152 *tp;
-        __u16 *d;
+        __le16 *d;
         int status = urb->status;
         int res;
 
@@ -1136,14 +1137,14 @@ r8152_tx_csum(struct r8152 *tp, struct tx_desc *desc, struct sk_buff *skb)
 
 static int r8152_tx_agg_fill(struct r8152 *tp, struct tx_agg *agg)
 {
-        u32 remain;
+        int remain;
         u8 *tx_data;
 
         tx_data = agg->head;
         agg->skb_num = agg->skb_len = 0;
-        remain = rx_buf_sz - sizeof(struct tx_desc);
+        remain = rx_buf_sz;
 
-        while (remain >= ETH_ZLEN) {
+        while (remain >= ETH_ZLEN + sizeof(struct tx_desc)) {
                 struct tx_desc *tx_desc;
                 struct sk_buff *skb;
                 unsigned int len;
@@ -1152,12 +1153,14 @@ static int r8152_tx_agg_fill(struct r8152 *tp, struct tx_agg *agg)
                 if (!skb)
                         break;
 
+                remain -= sizeof(*tx_desc);
                 len = skb->len;
                 if (remain < len) {
                         skb_queue_head(&tp->tx_queue, skb);
                         break;
                 }
 
+                tx_data = tx_agg_align(tx_data);
                 tx_desc = (struct tx_desc *)tx_data;
                 tx_data += sizeof(*tx_desc);
 
@@ -1167,11 +1170,18 @@ static int r8152_tx_agg_fill(struct r8152 *tp, struct tx_agg *agg)
                 agg->skb_len += len;
                 dev_kfree_skb_any(skb);
 
-                tx_data = tx_agg_align(tx_data + len);
-                remain = rx_buf_sz - sizeof(*tx_desc) -
-                         (u32)((void *)tx_data - agg->head);
+                tx_data += len;
+                remain = rx_buf_sz - (int)(tx_agg_align(tx_data) - agg->head);
         }
 
+        netif_tx_lock(tp->netdev);
+
+        if (netif_queue_stopped(tp->netdev) &&
+            skb_queue_len(&tp->tx_queue) < tp->tx_qlen)
+                netif_wake_queue(tp->netdev);
+
+        netif_tx_unlock(tp->netdev);
+
         usb_fill_bulk_urb(agg->urb, tp->udev, usb_sndbulkpipe(tp->udev, 2),
                           agg->head, (int)(tx_data - (u8 *)agg->head),
                           (usb_complete_t)write_bulk_callback, agg);
@@ -1188,7 +1198,6 @@ static void rx_bottom(struct r8152 *tp)
         list_for_each_safe(cursor, next, &tp->rx_done) {
                 struct rx_desc *rx_desc;
                 struct rx_agg *agg;
-                unsigned pkt_len;
                 int len_used = 0;
                 struct urb *urb;
                 u8 *rx_data;
@@ -1204,17 +1213,22 @@ static void rx_bottom(struct r8152 *tp)
 
                 rx_desc = agg->head;
                 rx_data = agg->head;
-                pkt_len = le32_to_cpu(rx_desc->opts1) & RX_LEN_MASK;
-                len_used += sizeof(struct rx_desc) + pkt_len;
+                len_used += sizeof(struct rx_desc);
 
-                while (urb->actual_length >= len_used) {
+                while (urb->actual_length > len_used) {
                         struct net_device *netdev = tp->netdev;
                         struct net_device_stats *stats;
+                        unsigned int pkt_len;
                         struct sk_buff *skb;
 
+                        pkt_len = le32_to_cpu(rx_desc->opts1) & RX_LEN_MASK;
                         if (pkt_len < ETH_ZLEN)
                                 break;
 
+                        len_used += pkt_len;
+                        if (urb->actual_length < len_used)
+                                break;
+
                         stats = rtl8152_get_stats(netdev);
 
                         pkt_len -= 4; /* CRC */
@@ -1234,9 +1248,8 @@ static void rx_bottom(struct r8152 *tp)
 
                         rx_data = rx_agg_align(rx_data + pkt_len + 4);
                         rx_desc = (struct rx_desc *)rx_data;
-                        pkt_len = le32_to_cpu(rx_desc->opts1) & RX_LEN_MASK;
                         len_used = (int)(rx_data - (u8 *)agg->head);
-                        len_used += sizeof(struct rx_desc) + pkt_len;
+                        len_used += sizeof(struct rx_desc);
                 }
 
 submit:
@@ -1384,53 +1397,17 @@ static netdev_tx_t rtl8152_start_xmit(struct sk_buff *skb,
                                             struct net_device *netdev)
 {
         struct r8152 *tp = netdev_priv(netdev);
-        struct net_device_stats *stats = rtl8152_get_stats(netdev);
-        unsigned long flags;
-        struct tx_agg *agg = NULL;
-        struct tx_desc *tx_desc;
-        unsigned int len;
-        u8 *tx_data;
-        int res;
 
         skb_tx_timestamp(skb);
 
-        /* If tx_queue is not empty, it means at least one previous packt */
-        /* is waiting for sending. Don't send current one before it.      */
-        if (skb_queue_empty(&tp->tx_queue))
-                agg = r8152_get_tx_agg(tp);
-
-        if (!agg) {
-                skb_queue_tail(&tp->tx_queue, skb);
-                return NETDEV_TX_OK;
-        }
+        skb_queue_tail(&tp->tx_queue, skb);
 
-        tx_desc = (struct tx_desc *)agg->head;
-        tx_data = agg->head + sizeof(*tx_desc);
-        agg->skb_num = agg->skb_len = 0;
+        if (list_empty(&tp->tx_free) &&
+            skb_queue_len(&tp->tx_queue) > tp->tx_qlen)
+                netif_stop_queue(netdev);
 
-        len = skb->len;
-        r8152_tx_csum(tp, tx_desc, skb);
-        memcpy(tx_data, skb->data, len);
-        dev_kfree_skb_any(skb);
-        agg->skb_num++;
-        agg->skb_len += len;
-        usb_fill_bulk_urb(agg->urb, tp->udev, usb_sndbulkpipe(tp->udev, 2),
-                          agg->head, len + sizeof(*tx_desc),
-                          (usb_complete_t)write_bulk_callback, agg);
-        res = usb_submit_urb(agg->urb, GFP_ATOMIC);
-        if (res) {
-                /* Can we get/handle EPIPE here? */
-                if (res == -ENODEV) {
-                        netif_device_detach(tp->netdev);
-                } else {
-                        netif_warn(tp, tx_err, netdev,
-                                   "failed tx_urb %d\n", res);
-                        stats->tx_dropped++;
-                        spin_lock_irqsave(&tp->tx_lock, flags);
-                        list_add_tail(&agg->list, &tp->tx_free);
-                        spin_unlock_irqrestore(&tp->tx_lock, flags);
-                }
-        }
+        if (!list_empty(&tp->tx_free))
+                tasklet_schedule(&tp->tl);
 
         return NETDEV_TX_OK;
 }
@@ -1459,6 +1436,14 @@ static void rtl8152_nic_reset(struct r8152 *tp)
         }
 }
 
+static void set_tx_qlen(struct r8152 *tp)
+{
+        struct net_device *netdev = tp->netdev;
+
+        tp->tx_qlen = rx_buf_sz / (netdev->mtu + VLAN_ETH_HLEN + VLAN_HLEN +
+                                   sizeof(struct tx_desc));
+}
+
 static inline u8 rtl8152_get_speed(struct r8152 *tp)
 {
         return ocp_read_byte(tp, MCU_TYPE_PLA, PLA_PHYSTATUS);
@@ -1470,6 +1455,7 @@ static int rtl8152_enable(struct r8152 *tp)
         int i, ret;
         u8 speed;
 
+        set_tx_qlen(tp);
         speed = rtl8152_get_speed(tp);
         if (speed & _10bps) {
                 ocp_data = ocp_read_word(tp, MCU_TYPE_PLA, PLA_EEEP_CR);
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.c b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
index 11f53589a3f3..d39b79f5e841 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
@@ -701,6 +701,54 @@ static int ar9550_hw_get_modes_txgain_index(struct ath_hw *ah,
         return ret;
 }
 
+static void ar9003_doubler_fix(struct ath_hw *ah)
+{
+        if (AR_SREV_9300(ah) || AR_SREV_9580(ah) || AR_SREV_9550(ah)) {
+                REG_RMW(ah, AR_PHY_65NM_CH0_RXTX2,
+                        1 << AR_PHY_65NM_CH0_RXTX2_SYNTHON_MASK_S |
+                        1 << AR_PHY_65NM_CH0_RXTX2_SYNTHOVR_MASK_S, 0);
+                REG_RMW(ah, AR_PHY_65NM_CH1_RXTX2,
+                        1 << AR_PHY_65NM_CH0_RXTX2_SYNTHON_MASK_S |
+                        1 << AR_PHY_65NM_CH0_RXTX2_SYNTHOVR_MASK_S, 0);
+                REG_RMW(ah, AR_PHY_65NM_CH2_RXTX2,
+                        1 << AR_PHY_65NM_CH0_RXTX2_SYNTHON_MASK_S |
+                        1 << AR_PHY_65NM_CH0_RXTX2_SYNTHOVR_MASK_S, 0);
+
+                udelay(200);
+
+                REG_CLR_BIT(ah, AR_PHY_65NM_CH0_RXTX2,
+                            AR_PHY_65NM_CH0_RXTX2_SYNTHON_MASK);
+                REG_CLR_BIT(ah, AR_PHY_65NM_CH1_RXTX2,
+                            AR_PHY_65NM_CH0_RXTX2_SYNTHON_MASK);
+                REG_CLR_BIT(ah, AR_PHY_65NM_CH2_RXTX2,
+                            AR_PHY_65NM_CH0_RXTX2_SYNTHON_MASK);
+
+                udelay(1);
+
+                REG_RMW_FIELD(ah, AR_PHY_65NM_CH0_RXTX2,
+                              AR_PHY_65NM_CH0_RXTX2_SYNTHON_MASK, 1);
+                REG_RMW_FIELD(ah, AR_PHY_65NM_CH1_RXTX2,
+                              AR_PHY_65NM_CH0_RXTX2_SYNTHON_MASK, 1);
+                REG_RMW_FIELD(ah, AR_PHY_65NM_CH2_RXTX2,
+                              AR_PHY_65NM_CH0_RXTX2_SYNTHON_MASK, 1);
+
+                udelay(200);
+
+                REG_RMW_FIELD(ah, AR_PHY_65NM_CH0_SYNTH12,
+                              AR_PHY_65NM_CH0_SYNTH12_VREFMUL3, 0xf);
+
+                REG_RMW(ah, AR_PHY_65NM_CH0_RXTX2, 0,
+                        1 << AR_PHY_65NM_CH0_RXTX2_SYNTHON_MASK_S |
+                        1 << AR_PHY_65NM_CH0_RXTX2_SYNTHOVR_MASK_S);
+                REG_RMW(ah, AR_PHY_65NM_CH1_RXTX2, 0,
+                        1 << AR_PHY_65NM_CH0_RXTX2_SYNTHON_MASK_S |
+                        1 << AR_PHY_65NM_CH0_RXTX2_SYNTHOVR_MASK_S);
+                REG_RMW(ah, AR_PHY_65NM_CH2_RXTX2, 0,
+                        1 << AR_PHY_65NM_CH0_RXTX2_SYNTHON_MASK_S |
+                        1 << AR_PHY_65NM_CH0_RXTX2_SYNTHOVR_MASK_S);
+        }
+}
+
 static int ar9003_hw_process_ini(struct ath_hw *ah,
                                  struct ath9k_channel *chan)
 {
@@ -726,6 +774,8 @@ static int ar9003_hw_process_ini(struct ath_hw *ah,
                                            modesIndex);
         }
 
+        ar9003_doubler_fix(ah);
+
         /*
          * RXGAIN initvals.
          */
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.h b/drivers/net/wireless/ath/ath9k/ar9003_phy.h
index fca624322dc8..2af667beb273 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.h
+++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.h
@@ -656,13 +656,24 @@
 #define AR_PHY_SYNTH4_LONG_SHIFT_SELECT   ((AR_SREV_9462(ah) || AR_SREV_9565(ah)) ? 0x00000001 : 0x00000002)
 #define AR_PHY_SYNTH4_LONG_SHIFT_SELECT_S ((AR_SREV_9462(ah) || AR_SREV_9565(ah)) ? 0 : 1)
 #define AR_PHY_65NM_CH0_SYNTH7      0x16098
+#define AR_PHY_65NM_CH0_SYNTH12     0x160ac
 #define AR_PHY_65NM_CH0_BIAS1       0x160c0
 #define AR_PHY_65NM_CH0_BIAS2       0x160c4
 #define AR_PHY_65NM_CH0_BIAS4       0x160cc
+#define AR_PHY_65NM_CH0_RXTX2       0x16104
+#define AR_PHY_65NM_CH1_RXTX2       0x16504
+#define AR_PHY_65NM_CH2_RXTX2       0x16904
 #define AR_PHY_65NM_CH0_RXTX4       0x1610c
 #define AR_PHY_65NM_CH1_RXTX4       0x1650c
 #define AR_PHY_65NM_CH2_RXTX4       0x1690c
 
+#define AR_PHY_65NM_CH0_SYNTH12_VREFMUL3           0x00780000
+#define AR_PHY_65NM_CH0_SYNTH12_VREFMUL3_S         19
+#define AR_PHY_65NM_CH0_RXTX2_SYNTHON_MASK         0x00000004
+#define AR_PHY_65NM_CH0_RXTX2_SYNTHON_MASK_S       2
+#define AR_PHY_65NM_CH0_RXTX2_SYNTHOVR_MASK        0x00000008
+#define AR_PHY_65NM_CH0_RXTX2_SYNTHOVR_MASK_S      3
+
 #define AR_CH0_TOP      (AR_SREV_9300(ah) ? 0x16288 : \
                          (((AR_SREV_9462(ah) || AR_SREV_9565(ah)) ? 0x1628c : 0x16280)))
 #define AR_CH0_TOP_XPABIASLVL (AR_SREV_9550(ah) ? 0x3c0 : 0x300)
diff --git a/drivers/net/wireless/ath/ath9k/ar9462_2p1_initvals.h b/drivers/net/wireless/ath/ath9k/ar9462_2p1_initvals.h
index 4dbc294df7e3..57fc5f459d0a 100644
--- a/drivers/net/wireless/ath/ath9k/ar9462_2p1_initvals.h
+++ b/drivers/net/wireless/ath/ath9k/ar9462_2p1_initvals.h
@@ -361,7 +361,7 @@ static const u32 ar9462_2p1_baseband_postamble[][5] = {
         {0x00009e14, 0x37b95d5e, 0x37b9605e, 0x3236605e, 0x32365a5e},
         {0x00009e18, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
         {0x00009e1c, 0x0001cf9c, 0x0001cf9c, 0x00021f9c, 0x00021f9c},
-        {0x00009e20, 0x000003b5, 0x000003b5, 0x000003ce, 0x000003ce},
+        {0x00009e20, 0x000003a5, 0x000003a5, 0x000003a5, 0x000003a5},
         {0x00009e2c, 0x0000001c, 0x0000001c, 0x00000021, 0x00000021},
         {0x00009e3c, 0xcf946220, 0xcf946220, 0xcfd5c782, 0xcfd5c282},
         {0x00009e44, 0x62321e27, 0x62321e27, 0xfe291e27, 0xfe291e27},
@@ -400,7 +400,7 @@ static const u32 ar9462_2p1_baseband_postamble[][5] = {
         {0x0000ae04, 0x001c0000, 0x001c0000, 0x001c0000, 0x00100000},
         {0x0000ae18, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
         {0x0000ae1c, 0x0000019c, 0x0000019c, 0x0000019c, 0x0000019c},
-        {0x0000ae20, 0x000001b5, 0x000001b5, 0x000001ce, 0x000001ce},
+        {0x0000ae20, 0x000001a6, 0x000001a6, 0x000001aa, 0x000001aa},
         {0x0000b284, 0x00000000, 0x00000000, 0x00000550, 0x00000550},
 };
 
@@ -472,7 +472,7 @@ static const u32 ar9462_2p1_radio_postamble[][5] = {
 
 static const u32 ar9462_2p1_soc_preamble[][2] = {
         /* Addr      allmodes  */
-        {0x000040a4, 0x00a0c1c9},
+        {0x000040a4, 0x00a0c9c9},
         {0x00007020, 0x00000000},
         {0x00007034, 0x00000002},
         {0x00007038, 0x000004c2},
diff --git a/drivers/net/wireless/ath/regd.c b/drivers/net/wireless/ath/regd.c
index c00687e05688..1217c52ab28e 100644
--- a/drivers/net/wireless/ath/regd.c
+++ b/drivers/net/wireless/ath/regd.c
@@ -362,7 +362,8 @@ static int __ath_reg_dyn_country(struct wiphy *wiphy,
 {
         u16 country_code;
 
-        if (!ath_is_world_regd(reg))
+        if (request->initiator == NL80211_REGDOM_SET_BY_COUNTRY_IE &&
+            !ath_is_world_regd(reg))
                 return -EINVAL;
 
         country_code = ath_regd_find_country_by_name(request->alpha2);
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/p2p.c b/drivers/net/wireless/brcm80211/brcmfmac/p2p.c
index 5b5b952d47b1..4a2293041821 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/p2p.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/p2p.c
@@ -823,6 +823,7 @@ static s32 brcmf_p2p_run_escan(struct brcmf_cfg80211_info *cfg,
                 }
                 err = brcmf_p2p_escan(p2p, num_nodfs, chanspecs, search_state,
                                       action, P2PAPI_BSSCFG_DEVICE);
+                kfree(chanspecs);
         }
 exit:
         if (err)
diff --git a/drivers/net/wireless/mwifiex/cfg80211.c b/drivers/net/wireless/mwifiex/cfg80211.c
index fbad00a5abc8..aeaea0e3b4c4 100644
--- a/drivers/net/wireless/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/mwifiex/cfg80211.c
@@ -2210,8 +2210,10 @@ struct wireless_dev *mwifiex_add_virtual_intf(struct wiphy *wiphy,
                 priv->bss_started = 0;
                 priv->bss_num = 0;
 
-                if (mwifiex_cfg80211_init_p2p_client(priv))
-                        return ERR_PTR(-EFAULT);
+                if (mwifiex_cfg80211_init_p2p_client(priv)) {
+                        wdev = ERR_PTR(-EFAULT);
+                        goto done;
+                }
 
                 break;
         default:
@@ -2224,7 +2226,8 @@ struct wireless_dev *mwifiex_add_virtual_intf(struct wiphy *wiphy,
         if (!dev) {
                 wiphy_err(wiphy, "no memory available for netdevice\n");
                 priv->bss_mode = NL80211_IFTYPE_UNSPECIFIED;
-                return ERR_PTR(-ENOMEM);
+                wdev = ERR_PTR(-ENOMEM);
+                goto done;
         }
 
         mwifiex_init_priv_params(priv, dev);
@@ -2264,7 +2267,9 @@ struct wireless_dev *mwifiex_add_virtual_intf(struct wiphy *wiphy,
                 wiphy_err(wiphy, "cannot register virtual network device\n");
                 free_netdev(dev);
                 priv->bss_mode = NL80211_IFTYPE_UNSPECIFIED;
-                return ERR_PTR(-EFAULT);
+                priv->netdev = NULL;
+                wdev = ERR_PTR(-EFAULT);
+                goto done;
         }
 
         sema_init(&priv->async_sem, 1);
@@ -2274,6 +2279,13 @@ struct wireless_dev *mwifiex_add_virtual_intf(struct wiphy *wiphy,
 #ifdef CONFIG_DEBUG_FS
         mwifiex_dev_debugfs_init(priv);
 #endif
+
+done:
+        if (IS_ERR(wdev)) {
+                kfree(priv->wdev);
+                priv->wdev = NULL;
+        }
+
         return wdev;
 }
 EXPORT_SYMBOL_GPL(mwifiex_add_virtual_intf);
@@ -2298,7 +2310,10 @@ int mwifiex_del_virtual_intf(struct wiphy *wiphy, struct wireless_dev *wdev)
                 unregister_netdevice(wdev->netdev);
 
         /* Clear the priv in adapter */
+        priv->netdev->ieee80211_ptr = NULL;
         priv->netdev = NULL;
+        kfree(wdev);
+        priv->wdev = NULL;
 
         priv->media_connected = false;
 
diff --git a/drivers/net/wireless/mwifiex/main.c b/drivers/net/wireless/mwifiex/main.c
index 9d7c9d354d34..78e8a6666cc6 100644
--- a/drivers/net/wireless/mwifiex/main.c
+++ b/drivers/net/wireless/mwifiex/main.c
@@ -411,13 +411,14 @@ static void mwifiex_terminate_workqueue(struct mwifiex_adapter *adapter)
  */
 static void mwifiex_fw_dpc(const struct firmware *firmware, void *context)
 {
-        int ret, i;
+        int ret;
         char fmt[64];
         struct mwifiex_private *priv;
         struct mwifiex_adapter *adapter = context;
         struct mwifiex_fw_image fw;
         struct semaphore *sem = adapter->card_sem;
         bool init_failed = false;
+        struct wireless_dev *wdev;
 
         if (!firmware) {
                 dev_err(adapter->dev,
@@ -469,14 +470,16 @@ static void mwifiex_fw_dpc(const struct firmware *firmware, void *context)
         priv = adapter->priv[MWIFIEX_BSS_ROLE_STA];
         if (mwifiex_register_cfg80211(adapter)) {
                 dev_err(adapter->dev, "cannot register with cfg80211\n");
-                goto err_register_cfg80211;
+                goto err_init_fw;
         }
 
         rtnl_lock();
         /* Create station interface by default */
-        if (!mwifiex_add_virtual_intf(adapter->wiphy, "mlan%d",
-                                      NL80211_IFTYPE_STATION, NULL, NULL)) {
+        wdev = mwifiex_add_virtual_intf(adapter->wiphy, "mlan%d",
+                                        NL80211_IFTYPE_STATION, NULL, NULL);
+        if (IS_ERR(wdev)) {
                 dev_err(adapter->dev, "cannot create default STA interface\n");
+                rtnl_unlock();
                 goto err_add_intf;
         }
         rtnl_unlock();
@@ -486,17 +489,6 @@ static void mwifiex_fw_dpc(const struct firmware *firmware, void *context)
         goto done;
 
 err_add_intf:
-        for (i = 0; i < adapter->priv_num; i++) {
-                priv = adapter->priv[i];
-
-                if (!priv)
-                        continue;
-
-                if (priv->wdev && priv->netdev)
-                        mwifiex_del_virtual_intf(adapter->wiphy, priv->wdev);
-        }
-        rtnl_unlock();
-err_register_cfg80211:
         wiphy_unregister(adapter->wiphy);
         wiphy_free(adapter->wiphy);
 err_init_fw:
@@ -1006,12 +998,6 @@ int mwifiex_remove_card(struct mwifiex_adapter *adapter, struct semaphore *sem)
         wiphy_unregister(priv->wdev->wiphy);
         wiphy_free(priv->wdev->wiphy);
 
-        for (i = 0; i < adapter->priv_num; i++) {
-                priv = adapter->priv[i];
-                if (priv)
-                        kfree(priv->wdev);
-        }
-
         mwifiex_terminate_workqueue(adapter);
 
         /* Unregister device */
diff --git a/drivers/net/wireless/mwifiex/pcie.c b/drivers/net/wireless/mwifiex/pcie.c
index 33fa9432b241..03688aa14e8a 100644
--- a/drivers/net/wireless/mwifiex/pcie.c
+++ b/drivers/net/wireless/mwifiex/pcie.c
@@ -232,7 +232,6 @@ static void mwifiex_pcie_remove(struct pci_dev *pdev)
         }
 
         mwifiex_remove_card(card->adapter, &add_remove_card_sem);
-        kfree(card);
 }
 
 static void mwifiex_pcie_shutdown(struct pci_dev *pdev)
@@ -2313,6 +2312,7 @@ static void mwifiex_pcie_cleanup(struct mwifiex_adapter *adapter)
                 pci_release_region(pdev, 0);
                 pci_set_drvdata(pdev, NULL);
         }
+        kfree(card);
 }
 
 /*
diff --git a/drivers/net/wireless/mwifiex/sdio.c b/drivers/net/wireless/mwifiex/sdio.c
index 9bf8898743ab..b44a31523461 100644
--- a/drivers/net/wireless/mwifiex/sdio.c
+++ b/drivers/net/wireless/mwifiex/sdio.c
@@ -196,7 +196,6 @@ mwifiex_sdio_remove(struct sdio_func *func)
         }
 
         mwifiex_remove_card(card->adapter, &add_remove_card_sem);
-        kfree(card);
 }
 
 /*
@@ -1745,7 +1744,6 @@ mwifiex_unregister_dev(struct mwifiex_adapter *adapter)
                 sdio_claim_host(card->func);
                 sdio_disable_func(card->func);
                 sdio_release_host(card->func);
-                sdio_set_drvdata(card->func, NULL);
         }
 }
 
@@ -1773,7 +1771,6 @@ static int mwifiex_register_dev(struct mwifiex_adapter *adapter)
                 return ret;
         }
 
-        sdio_set_drvdata(func, card);
 
         adapter->dev = &func->dev;
 
@@ -1801,6 +1798,8 @@ static int mwifiex_init_sdio(struct mwifiex_adapter *adapter)
         int ret;
         u8 sdio_ireg;
 
+        sdio_set_drvdata(card->func, card);
+
         /*
          * Read the HOST_INT_STATUS_REG for ACK the first interrupt got
          * from the bootloader. If we don't do this we get a interrupt
@@ -1883,6 +1882,8 @@ static void mwifiex_cleanup_sdio(struct mwifiex_adapter *adapter)
         kfree(card->mpa_rx.len_arr);
         kfree(card->mpa_tx.buf);
         kfree(card->mpa_rx.buf);
+        sdio_set_drvdata(card->func, NULL);
+        kfree(card);
 }
 
 /*
diff --git a/drivers/net/wireless/mwifiex/usb.c b/drivers/net/wireless/mwifiex/usb.c
index 1c70b8d09227..edf5b7a24900 100644
--- a/drivers/net/wireless/mwifiex/usb.c
+++ b/drivers/net/wireless/mwifiex/usb.c
@@ -350,7 +350,6 @@ static int mwifiex_usb_probe(struct usb_interface *intf,
 
         card->udev = udev;
         card->intf = intf;
-        usb_card = card;
 
         pr_debug("info: bcdUSB=%#x Device Class=%#x SubClass=%#x Protocol=%#x\n",
                  udev->descriptor.bcdUSB, udev->descriptor.bDeviceClass,
@@ -525,25 +524,28 @@ static int mwifiex_usb_resume(struct usb_interface *intf)
 static void mwifiex_usb_disconnect(struct usb_interface *intf)
 {
         struct usb_card_rec *card = usb_get_intfdata(intf);
-        struct mwifiex_adapter *adapter;
 
-        if (!card || !card->adapter) {
-                pr_err("%s: card or card->adapter is NULL\n", __func__);
+        if (!card) {
+                pr_err("%s: card is NULL\n", __func__);
                 return;
         }
 
-        adapter = card->adapter;
-        if (!adapter->priv_num)
-                return;
-
         mwifiex_usb_free(card);
 
-        dev_dbg(adapter->dev, "%s: removing card\n", __func__);
-        mwifiex_remove_card(adapter, &add_remove_card_sem);
+        if (card->adapter) {
+                struct mwifiex_adapter *adapter = card->adapter;
+
+                if (!adapter->priv_num)
+                        return;
+
+                dev_dbg(adapter->dev, "%s: removing card\n", __func__);
+                mwifiex_remove_card(adapter, &add_remove_card_sem);
+        }
 
         usb_set_intfdata(intf, NULL);
         usb_put_dev(interface_to_usbdev(intf));
         kfree(card);
+        usb_card = NULL;
 
         return;
 }
@@ -754,6 +756,7 @@ static int mwifiex_register_dev(struct mwifiex_adapter *adapter)
         card->adapter = adapter;
         adapter->dev = &card->udev->dev;
         strcpy(adapter->fw_name, USB8797_DEFAULT_FW_NAME);
+        usb_card = card;
 
         return 0;
 }
@@ -762,7 +765,7 @@ static void mwifiex_unregister_dev(struct mwifiex_adapter *adapter)
 {
         struct usb_card_rec *card = (struct usb_card_rec *)adapter->card;
 
-        usb_set_intfdata(card->intf, NULL);
+        card->adapter = NULL;
 }
 
 static int mwifiex_prog_fw_w_helper(struct mwifiex_adapter *adapter,
@@ -1004,7 +1007,7 @@ static void mwifiex_usb_cleanup_module(void)
         if (!down_interruptible(&add_remove_card_sem))
                 up(&add_remove_card_sem);
 
-        if (usb_card) {
+        if (usb_card && usb_card->adapter) {
                 struct mwifiex_adapter *adapter = usb_card->adapter;
                 int i;
 
diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
index 080b1fcae5fa..9dd92a700442 100644
--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
@@ -181,6 +181,7 @@ static void rt2x00lib_autowakeup(struct work_struct *work)
 static void rt2x00lib_bc_buffer_iter(void *data, u8 *mac,
                                      struct ieee80211_vif *vif)
 {
+        struct ieee80211_tx_control control = {};
         struct rt2x00_dev *rt2x00dev = data;
         struct sk_buff *skb;
 
@@ -195,7 +196,7 @@ static void rt2x00lib_bc_buffer_iter(void *data, u8 *mac,
          */
         skb = ieee80211_get_buffered_bc(rt2x00dev->hw, vif);
         while (skb) {
-                rt2x00mac_tx(rt2x00dev->hw, NULL, skb);
+                rt2x00mac_tx(rt2x00dev->hw, &control, skb);
                 skb = ieee80211_get_buffered_bc(rt2x00dev->hw, vif);
         }
 }
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/mac.c b/drivers/net/wireless/rtlwifi/rtl8192cu/mac.c
index 393685390f3e..e26312fb4356 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/mac.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/mac.c
@@ -769,7 +769,7 @@ static long _rtl92c_signal_scale_mapping(struct ieee80211_hw *hw,
 
 static void _rtl92c_query_rxphystatus(struct ieee80211_hw *hw,
                                       struct rtl_stats *pstats,
-                                      struct rx_desc_92c *pdesc,
+                                      struct rx_desc_92c *p_desc,
                                       struct rx_fwinfo_92c *p_drvinfo,
                                       bool packet_match_bssid,
                                       bool packet_toself,
@@ -784,11 +784,11 @@ static void _rtl92c_query_rxphystatus(struct ieee80211_hw *hw,
         u32 rssi, total_rssi = 0;
         bool in_powersavemode = false;
         bool is_cck_rate;
+        u8 *pdesc = (u8 *)p_desc;
 
-        is_cck_rate = RX_HAL_IS_CCK_RATE(pdesc);
+        is_cck_rate = RX_HAL_IS_CCK_RATE(p_desc);
         pstats->packet_matchbssid = packet_match_bssid;
         pstats->packet_toself = packet_toself;
-        pstats->is_cck = is_cck_rate;
         pstats->packet_beacon = packet_beacon;
         pstats->is_cck = is_cck_rate;
         pstats->RX_SIGQ[0] = -1;
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c b/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c
index b0c346a9e4b8..1bc21ccfa71b 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c
@@ -303,10 +303,10 @@ out:
 bool rtl92cu_rx_query_desc(struct ieee80211_hw *hw,
                            struct rtl_stats *stats,
                            struct ieee80211_rx_status *rx_status,
-                           u8 *p_desc, struct sk_buff *skb)
+                           u8 *pdesc, struct sk_buff *skb)
 {
         struct rx_fwinfo_92c *p_drvinfo;
-        struct rx_desc_92c *pdesc = (struct rx_desc_92c *)p_desc;
+        struct rx_desc_92c *p_desc = (struct rx_desc_92c *)pdesc;
         u32 phystatus = GET_RX_DESC_PHY_STATUS(pdesc);
 
         stats->length = (u16) GET_RX_DESC_PKT_LEN(pdesc);
@@ -345,7 +345,7 @@ bool rtl92cu_rx_query_desc(struct ieee80211_hw *hw,
         if (phystatus) {
                 p_drvinfo = (struct rx_fwinfo_92c *)(skb->data +
                                                      stats->rx_bufshift);
-                rtl92c_translate_rx_signal_stuff(hw, skb, stats, pdesc,
+                rtl92c_translate_rx_signal_stuff(hw, skb, stats, p_desc,
                                                  p_drvinfo);
         }
         /*rx_status->qual = stats->signal; */
diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
index b78ee10a956a..2329cccf1fa6 100644
--- a/drivers/net/xen-netback/interface.c
+++ b/drivers/net/xen-netback/interface.c
@@ -461,6 +461,9 @@ void xenvif_disconnect(struct xenvif *vif)
         if (netif_carrier_ok(vif->dev))
                 xenvif_carrier_off(vif);
 
+        if (vif->task)
+                kthread_stop(vif->task);
+
         if (vif->tx_irq) {
                 if (vif->tx_irq == vif->rx_irq)
                         unbind_from_irqhandler(vif->tx_irq, vif);
@@ -471,9 +474,6 @@ void xenvif_disconnect(struct xenvif *vif)
                 vif->tx_irq = 0;
         }
 
-        if (vif->task)
-                kthread_stop(vif->task);
-
         xenvif_unmap_frontend_rings(vif);
 }