Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6

Conflicts:
	drivers/net/wireless/iwlwifi/iwl-agn-rxon.c
	drivers/net/wireless/rtlwifi/pci.c
	net/netfilter/ipvs/ip_vs_core.c

35 files changed, 690 insertions, 251 deletions

diff --git a/drivers/net/3c503.c b/drivers/net/3c503.c
index 554a26c55188..84e68f1b9adf 100644
--- a/drivers/net/3c503.c
+++ b/drivers/net/3c503.c
@@ -413,7 +413,7 @@ el2_open(struct net_device *dev)
                 outb_p(0x04 << ((*irqp == 9) ? 2 : *irqp), E33G_IDCFR);
                 outb_p(0x00, E33G_IDCFR);
                 msleep(1);
-                free_irq(*irqp, el2_probe_interrupt);
+                free_irq(*irqp, &seen);
                 if (!seen)
                         continue;
 
@@ -423,6 +423,7 @@ el2_open(struct net_device *dev)
                         continue;
                 if (retval < 0)
                         goto err_disable;
+                break;
         } while (*++irqp);
 
         if (*irqp == 0) {
diff --git a/drivers/net/arm/am79c961a.c b/drivers/net/arm/am79c961a.c
index 0c9217f48b72..7b3e23f38913 100644
--- a/drivers/net/arm/am79c961a.c
+++ b/drivers/net/arm/am79c961a.c
@@ -50,7 +50,7 @@ static const char version[] =
 #ifdef __arm__
 static void write_rreg(u_long base, u_int reg, u_int val)
 {
-        __asm__(
+        asm volatile(
         "str%?h %1, [%2]        @ NET_RAP\n\t"
         "str%?h %0, [%2, #-4]   @ NET_RDP"
         :
@@ -60,7 +60,7 @@ static void write_rreg(u_long base, u_int reg, u_int val)
 static inline unsigned short read_rreg(u_long base_addr, u_int reg)
 {
         unsigned short v;
-        __asm__(
+        asm volatile(
         "str%?h %1, [%2]        @ NET_RAP\n\t"
         "ldr%?h %0, [%2, #-4]   @ NET_RDP"
         : "=r" (v)
@@ -70,7 +70,7 @@ static inline unsigned short read_rreg(u_long base_addr, u_int reg)
 
 static inline void write_ireg(u_long base, u_int reg, u_int val)
 {
-        __asm__(
+        asm volatile(
         "str%?h %1, [%2]        @ NET_RAP\n\t"
         "str%?h %0, [%2, #8]    @ NET_IDP"
         :
@@ -80,7 +80,7 @@ static inline void write_ireg(u_long base, u_int reg, u_int val)
 static inline unsigned short read_ireg(u_long base_addr, u_int reg)
 {
         u_short v;
-        __asm__(
+        asm volatile(
         "str%?h %1, [%2]        @ NAT_RAP\n\t"
         "ldr%?h %0, [%2, #8]    @ NET_IDP\n\t"
         : "=r" (v)
@@ -91,47 +91,48 @@ static inline unsigned short read_ireg(u_long base_addr, u_int reg)
 #define am_writeword(dev,off,val) __raw_writew(val, ISAMEM_BASE + ((off) << 1))
 #define am_readword(dev,off)      __raw_readw(ISAMEM_BASE + ((off) << 1))
 
-static inline void
+static void
 am_writebuffer(struct net_device *dev, u_int offset, unsigned char *buf, unsigned int length)
 {
         offset = ISAMEM_BASE + (offset << 1);
         length = (length + 1) & ~1;
         if ((int)buf & 2) {
-                __asm__ __volatile__("str%?h    %2, [%0], #4"
+                asm volatile("str%?h    %2, [%0], #4"
                  : "=&r" (offset) : "0" (offset), "r" (buf[0] | (buf[1] << 8)));
                 buf += 2;
                 length -= 2;
         }
         while (length > 8) {
-                unsigned int tmp, tmp2;
-                __asm__ __volatile__(
-                        "ldm%?ia        %1!, {%2, %3}\n\t"
+                register unsigned int tmp asm("r2"), tmp2 asm("r3");
+                asm volatile(
+                        "ldm%?ia        %0!, {%1, %2}"
+                        : "+r" (buf), "=&r" (tmp), "=&r" (tmp2));
+                length -= 8;
+                asm volatile(
+                        "str%?h %1, [%0], #4\n\t"
+                        "mov%?  %1, %1, lsr #16\n\t"
+                        "str%?h %1, [%0], #4\n\t"
                         "str%?h %2, [%0], #4\n\t"
                         "mov%?  %2, %2, lsr #16\n\t"
-                        "str%?h %2, [%0], #4\n\t"
-                        "str%?h %3, [%0], #4\n\t"
-                        "mov%?  %3, %3, lsr #16\n\t"
-                        "str%?h %3, [%0], #4"
-                : "=&r" (offset), "=&r" (buf), "=r" (tmp), "=r" (tmp2)
-                : "0" (offset), "1" (buf));
-                length -= 8;
+                        "str%?h %2, [%0], #4"
+                : "+r" (offset), "=&r" (tmp), "=&r" (tmp2));
         }
         while (length > 0) {
-                __asm__ __volatile__("str%?h    %2, [%0], #4"
+                asm volatile("str%?h    %2, [%0], #4"
                  : "=&r" (offset) : "0" (offset), "r" (buf[0] | (buf[1] << 8)));
                 buf += 2;
                 length -= 2;
         }
 }
 
-static inline void
+static void
 am_readbuffer(struct net_device *dev, u_int offset, unsigned char *buf, unsigned int length)
 {
         offset = ISAMEM_BASE + (offset << 1);
         length = (length + 1) & ~1;
         if ((int)buf & 2) {
                 unsigned int tmp;
-                __asm__ __volatile__(
+                asm volatile(
                         "ldr%?h %2, [%0], #4\n\t"
                         "str%?b %2, [%1], #1\n\t"
                         "mov%?  %2, %2, lsr #8\n\t"
@@ -140,12 +141,12 @@ am_readbuffer(struct net_device *dev, u_int offset, unsigned char *buf, unsigned
                 length -= 2;
         }
         while (length > 8) {
-                unsigned int tmp, tmp2, tmp3;
-                __asm__ __volatile__(
+                register unsigned int tmp asm("r2"), tmp2 asm("r3"), tmp3;
+                asm volatile(
                         "ldr%?h %2, [%0], #4\n\t"
+                        "ldr%?h %4, [%0], #4\n\t"
                         "ldr%?h %3, [%0], #4\n\t"
-                        "orr%?  %2, %2, %3, lsl #16\n\t"
-                        "ldr%?h %3, [%0], #4\n\t"
+                        "orr%?  %2, %2, %4, lsl #16\n\t"
                         "ldr%?h %4, [%0], #4\n\t"
                         "orr%?  %3, %3, %4, lsl #16\n\t"
                         "stm%?ia        %1!, {%2, %3}"
@@ -155,7 +156,7 @@ am_readbuffer(struct net_device *dev, u_int offset, unsigned char *buf, unsigned
         }
         while (length > 0) {
                 unsigned int tmp;
-                __asm__ __volatile__(
+                asm volatile(
                         "ldr%?h %2, [%0], #4\n\t"
                         "str%?b %2, [%1], #1\n\t"
                         "mov%?  %2, %2, lsr #8\n\t"
@@ -196,6 +197,42 @@ am79c961_ramtest(struct net_device *dev, unsigned int val)
         return errorcount;
 }
 
+static void am79c961_mc_hash(char *addr, u16 *hash)
+{
+        if (addr[0] & 0x01) {
+                int idx, bit;
+                u32 crc;
+
+                crc = ether_crc_le(ETH_ALEN, addr);
+
+                idx = crc >> 30;
+                bit = (crc >> 26) & 15;
+
+                hash[idx] |= 1 << bit;
+        }
+}
+
+static unsigned int am79c961_get_rx_mode(struct net_device *dev, u16 *hash)
+{
+        unsigned int mode = MODE_PORT_10BT;
+
+        if (dev->flags & IFF_PROMISC) {
+                mode |= MODE_PROMISC;
+                memset(hash, 0xff, 4 * sizeof(*hash));
+        } else if (dev->flags & IFF_ALLMULTI) {
+                memset(hash, 0xff, 4 * sizeof(*hash));
+        } else {
+                struct netdev_hw_addr *ha;
+
+                memset(hash, 0, 4 * sizeof(*hash));
+
+                netdev_for_each_mc_addr(ha, dev)
+                        am79c961_mc_hash(ha->addr, hash);
+        }
+
+        return mode;
+}
+
 static void
 am79c961_init_for_open(struct net_device *dev)
 {
@@ -203,6 +240,7 @@ am79c961_init_for_open(struct net_device *dev)
         unsigned long flags;
         unsigned char *p;
         u_int hdr_addr, first_free_addr;
+        u16 multi_hash[4], mode = am79c961_get_rx_mode(dev, multi_hash);
         int i;
 
         /*
@@ -218,16 +256,12 @@ am79c961_init_for_open(struct net_device *dev)
         write_ireg (dev->base_addr, 2, 0x0000); /* MODE register selects media */
 
         for (i = LADRL; i <= LADRH; i++)
-                write_rreg (dev->base_addr, i, 0);
+                write_rreg (dev->base_addr, i, multi_hash[i - LADRL]);
 
         for (i = PADRL, p = dev->dev_addr; i <= PADRH; i++, p += 2)
                 write_rreg (dev->base_addr, i, p[0] | (p[1] << 8));
 
-        i = MODE_PORT_10BT;
-        if (dev->flags & IFF_PROMISC)
-                i |= MODE_PROMISC;
-
-        write_rreg (dev->base_addr, MODE, i);
+        write_rreg (dev->base_addr, MODE, mode);
         write_rreg (dev->base_addr, POLLINT, 0);
         write_rreg (dev->base_addr, SIZERXR, -RX_BUFFERS);
         write_rreg (dev->base_addr, SIZETXR, -TX_BUFFERS);
@@ -340,21 +374,6 @@ am79c961_close(struct net_device *dev)
         return 0;
 }
 
-static void am79c961_mc_hash(char *addr, unsigned short *hash)
-{
-        if (addr[0] & 0x01) {
-                int idx, bit;
-                u32 crc;
-
-                crc = ether_crc_le(ETH_ALEN, addr);
-
-                idx = crc >> 30;
-                bit = (crc >> 26) & 15;
-
-                hash[idx] |= 1 << bit;
-        }
-}
-
 /*
  * Set or clear promiscuous/multicast mode filter for this adapter.
  */
@@ -362,24 +381,9 @@ static void am79c961_setmulticastlist (struct net_device *dev)
 {
         struct dev_priv *priv = netdev_priv(dev);
         unsigned long flags;
-        unsigned short multi_hash[4], mode;
+        u16 multi_hash[4], mode = am79c961_get_rx_mode(dev, multi_hash);
         int i, stopped;
 
-        mode = MODE_PORT_10BT;
-
-        if (dev->flags & IFF_PROMISC) {
-                mode |= MODE_PROMISC;
-        } else if (dev->flags & IFF_ALLMULTI) {
-                memset(multi_hash, 0xff, sizeof(multi_hash));
-        } else {
-                struct netdev_hw_addr *ha;
-
-                memset(multi_hash, 0x00, sizeof(multi_hash));
-
-                netdev_for_each_mc_addr(ha, dev)
-                        am79c961_mc_hash(ha->addr, multi_hash);
-        }
-
         spin_lock_irqsave(&priv->chip_lock, flags);
 
         stopped = read_rreg(dev->base_addr, CSR0) & CSR0_STOP;
diff --git a/drivers/net/arm/ep93xx_eth.c b/drivers/net/arm/ep93xx_eth.c
index a167addd5382..4317af8d2f0a 100644
--- a/drivers/net/arm/ep93xx_eth.c
+++ b/drivers/net/arm/ep93xx_eth.c
@@ -284,10 +284,14 @@ static int ep93xx_rx(struct net_device *dev, int processed, int budget)
 
                 skb = dev_alloc_skb(length + 2);
                 if (likely(skb != NULL)) {
+                        struct ep93xx_rdesc *rxd = &ep->descs->rdesc[entry];
                         skb_reserve(skb, 2);
-                        dma_sync_single_for_cpu(NULL, ep->descs->rdesc[entry].buf_addr,
+                        dma_sync_single_for_cpu(dev->dev.parent, rxd->buf_addr,
                                                 length, DMA_FROM_DEVICE);
                         skb_copy_to_linear_data(skb, ep->rx_buf[entry], length);
+                        dma_sync_single_for_device(dev->dev.parent,
+                                                   rxd->buf_addr, length,
+                                                   DMA_FROM_DEVICE);
                         skb_put(skb, length);
                         skb->protocol = eth_type_trans(skb, dev);
 
@@ -349,6 +353,7 @@ poll_some_more:
 static int ep93xx_xmit(struct sk_buff *skb, struct net_device *dev)
 {
         struct ep93xx_priv *ep = netdev_priv(dev);
+        struct ep93xx_tdesc *txd;
         int entry;
 
         if (unlikely(skb->len > MAX_PKT_SIZE)) {
@@ -360,11 +365,14 @@ static int ep93xx_xmit(struct sk_buff *skb, struct net_device *dev)
         entry = ep->tx_pointer;
         ep->tx_pointer = (ep->tx_pointer + 1) & (TX_QUEUE_ENTRIES - 1);
 
-        ep->descs->tdesc[entry].tdesc1 =
-                TDESC1_EOF | (entry << 16) | (skb->len & 0xfff);
+        txd = &ep->descs->tdesc[entry];
+
+        txd->tdesc1 = TDESC1_EOF | (entry << 16) | (skb->len & 0xfff);
+        dma_sync_single_for_cpu(dev->dev.parent, txd->buf_addr, skb->len,
+                                DMA_TO_DEVICE);
         skb_copy_and_csum_dev(skb, ep->tx_buf[entry]);
-        dma_sync_single_for_cpu(NULL, ep->descs->tdesc[entry].buf_addr,
-                                skb->len, DMA_TO_DEVICE);
+        dma_sync_single_for_device(dev->dev.parent, txd->buf_addr, skb->len,
+                                   DMA_TO_DEVICE);
         dev_kfree_skb(skb);
 
         spin_lock_irq(&ep->tx_pending_lock);
@@ -458,89 +466,80 @@ static irqreturn_t ep93xx_irq(int irq, void *dev_id)
 
 static void ep93xx_free_buffers(struct ep93xx_priv *ep)
 {
+        struct device *dev = ep->dev->dev.parent;
         int i;
 
-        for (i = 0; i < RX_QUEUE_ENTRIES; i += 2) {
+        for (i = 0; i < RX_QUEUE_ENTRIES; i++) {
                 dma_addr_t d;
 
                 d = ep->descs->rdesc[i].buf_addr;
                 if (d)
-                        dma_unmap_single(NULL, d, PAGE_SIZE, DMA_FROM_DEVICE);
+                        dma_unmap_single(dev, d, PKT_BUF_SIZE, DMA_FROM_DEVICE);
 
                 if (ep->rx_buf[i] != NULL)
-                        free_page((unsigned long)ep->rx_buf[i]);
+                        kfree(ep->rx_buf[i]);
         }
 
-        for (i = 0; i < TX_QUEUE_ENTRIES; i += 2) {
+        for (i = 0; i < TX_QUEUE_ENTRIES; i++) {
                 dma_addr_t d;
 
                 d = ep->descs->tdesc[i].buf_addr;
                 if (d)
-                        dma_unmap_single(NULL, d, PAGE_SIZE, DMA_TO_DEVICE);
+                        dma_unmap_single(dev, d, PKT_BUF_SIZE, DMA_TO_DEVICE);
 
                 if (ep->tx_buf[i] != NULL)
-                        free_page((unsigned long)ep->tx_buf[i]);
+                        kfree(ep->tx_buf[i]);
         }
 
-        dma_free_coherent(NULL, sizeof(struct ep93xx_descs), ep->descs,
+        dma_free_coherent(dev, sizeof(struct ep93xx_descs), ep->descs,
                                                         ep->descs_dma_addr);
 }
 
-/*
- * The hardware enforces a sub-2K maximum packet size, so we put
- * two buffers on every hardware page.
- */
 static int ep93xx_alloc_buffers(struct ep93xx_priv *ep)
 {
+        struct device *dev = ep->dev->dev.parent;
         int i;
 
-        ep->descs = dma_alloc_coherent(NULL, sizeof(struct ep93xx_descs),
-                                &ep->descs_dma_addr, GFP_KERNEL | GFP_DMA);
+        ep->descs = dma_alloc_coherent(dev, sizeof(struct ep93xx_descs),
+                                &ep->descs_dma_addr, GFP_KERNEL);
         if (ep->descs == NULL)
                 return 1;
 
-        for (i = 0; i < RX_QUEUE_ENTRIES; i += 2) {
-                void *page;
+        for (i = 0; i < RX_QUEUE_ENTRIES; i++) {
+                void *buf;
                 dma_addr_t d;
 
-                page = (void *)__get_free_page(GFP_KERNEL | GFP_DMA);
-                if (page == NULL)
+                buf = kmalloc(PKT_BUF_SIZE, GFP_KERNEL);
+                if (buf == NULL)
                         goto err;
 
-                d = dma_map_single(NULL, page, PAGE_SIZE, DMA_FROM_DEVICE);
-                if (dma_mapping_error(NULL, d)) {
-                        free_page((unsigned long)page);
+                d = dma_map_single(dev, buf, PKT_BUF_SIZE, DMA_FROM_DEVICE);
+                if (dma_mapping_error(dev, d)) {
+                        kfree(buf);
                         goto err;
                 }
 
-                ep->rx_buf[i] = page;
+                ep->rx_buf[i] = buf;
                 ep->descs->rdesc[i].buf_addr = d;
                 ep->descs->rdesc[i].rdesc1 = (i << 16) | PKT_BUF_SIZE;
-
-                ep->rx_buf[i + 1] = page + PKT_BUF_SIZE;
-                ep->descs->rdesc[i + 1].buf_addr = d + PKT_BUF_SIZE;
-                ep->descs->rdesc[i + 1].rdesc1 = ((i + 1) << 16) | PKT_BUF_SIZE;
         }
 
-        for (i = 0; i < TX_QUEUE_ENTRIES; i += 2) {
-                void *page;
+        for (i = 0; i < TX_QUEUE_ENTRIES; i++) {
+                void *buf;
                 dma_addr_t d;
 
-                page = (void *)__get_free_page(GFP_KERNEL | GFP_DMA);
-                if (page == NULL)
+                buf = kmalloc(PKT_BUF_SIZE, GFP_KERNEL);
+                if (buf == NULL)
                         goto err;
 
-                d = dma_map_single(NULL, page, PAGE_SIZE, DMA_TO_DEVICE);
-                if (dma_mapping_error(NULL, d)) {
-                        free_page((unsigned long)page);
+                d = dma_map_single(dev, buf, PKT_BUF_SIZE, DMA_TO_DEVICE);
+                if (dma_mapping_error(dev, d)) {
+                        kfree(buf);
                         goto err;
                 }
 
-                ep->tx_buf[i] = page;
+                ep->tx_buf[i] = buf;
                 ep->descs->tdesc[i].buf_addr = d;
-
-                ep->tx_buf[i + 1] = page + PKT_BUF_SIZE;
-                ep->descs->tdesc[i + 1].buf_addr = d + PKT_BUF_SIZE;
         }
 
         return 0;
@@ -830,6 +829,7 @@ static int ep93xx_eth_probe(struct platform_device *pdev)
         }
         ep = netdev_priv(dev);
         ep->dev = dev;
+        SET_NETDEV_DEV(dev, &pdev->dev);
         netif_napi_add(dev, &ep->napi, ep93xx_poll, 64);
 
         platform_set_drvdata(pdev, dev);
diff --git a/drivers/net/bfin_mac.c b/drivers/net/bfin_mac.c
index 68d45ba2d9b9..6c019e148546 100644
--- a/drivers/net/bfin_mac.c
+++ b/drivers/net/bfin_mac.c
@@ -52,13 +52,13 @@ MODULE_DESCRIPTION(DRV_DESC);
 MODULE_ALIAS("platform:bfin_mac");
 
 #if defined(CONFIG_BFIN_MAC_USE_L1)
-# define bfin_mac_alloc(dma_handle, size)  l1_data_sram_zalloc(size)
-# define bfin_mac_free(dma_handle, ptr)    l1_data_sram_free(ptr)
+# define bfin_mac_alloc(dma_handle, size, num)  l1_data_sram_zalloc(size*num)
+# define bfin_mac_free(dma_handle, ptr, num)    l1_data_sram_free(ptr)
 #else
-# define bfin_mac_alloc(dma_handle, size) \
-        dma_alloc_coherent(NULL, size, dma_handle, GFP_KERNEL)
-# define bfin_mac_free(dma_handle, ptr) \
-        dma_free_coherent(NULL, sizeof(*ptr), ptr, dma_handle)
+# define bfin_mac_alloc(dma_handle, size, num) \
+        dma_alloc_coherent(NULL, size*num, dma_handle, GFP_KERNEL)
+# define bfin_mac_free(dma_handle, ptr, num) \
+        dma_free_coherent(NULL, sizeof(*ptr)*num, ptr, dma_handle)
 #endif
 
 #define PKT_BUF_SZ 1580
@@ -95,7 +95,7 @@ static void desc_list_free(void)
                                 t = t->next;
                         }
                 }
-                bfin_mac_free(dma_handle, tx_desc);
+                bfin_mac_free(dma_handle, tx_desc, CONFIG_BFIN_TX_DESC_NUM);
         }
 
         if (rx_desc) {
@@ -109,7 +109,7 @@ static void desc_list_free(void)
                                 r = r->next;
                         }
                 }
-                bfin_mac_free(dma_handle, rx_desc);
+                bfin_mac_free(dma_handle, rx_desc, CONFIG_BFIN_RX_DESC_NUM);
         }
 }
 
@@ -126,13 +126,13 @@ static int desc_list_init(void)
 #endif
 
         tx_desc = bfin_mac_alloc(&dma_handle,
-                                sizeof(struct net_dma_desc_tx) *
+                                sizeof(struct net_dma_desc_tx),
                                 CONFIG_BFIN_TX_DESC_NUM);
         if (tx_desc == NULL)
                 goto init_error;
 
         rx_desc = bfin_mac_alloc(&dma_handle,
-                                sizeof(struct net_dma_desc_rx) *
+                                sizeof(struct net_dma_desc_rx),
                                 CONFIG_BFIN_RX_DESC_NUM);
         if (rx_desc == NULL)
                 goto init_error;
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 07e866d5a87c..d117280b9cd8 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -378,6 +378,8 @@ struct vlan_entry *bond_next_vlan(struct bonding *bond, struct vlan_entry *curr)
         return next;
 }
 
+#define bond_queue_mapping(skb) (*(u16 *)((skb)->cb))
+
 /**
  * bond_dev_queue_xmit - Prepare skb for xmit.
  *
@@ -390,6 +392,9 @@ int bond_dev_queue_xmit(struct bonding *bond, struct sk_buff *skb,
 {
         skb->dev = slave_dev;
         skb->priority = 1;
+
+        skb->queue_mapping = bond_queue_mapping(skb);
+
         if (unlikely(netpoll_tx_running(slave_dev)))
                 bond_netpoll_send_skb(bond_get_slave_by_dev(bond, slave_dev), skb);
         else
@@ -1275,6 +1280,7 @@ static inline int slave_enable_netpoll(struct slave *slave)
                 goto out;
 
         np->dev = slave->dev;
+        strlcpy(np->dev_name, slave->dev->name, IFNAMSIZ);
         err = __netpoll_setup(np);
         if (err) {
                 kfree(np);
@@ -4188,6 +4194,7 @@ static inline int bond_slave_override(struct bonding *bond,
         return res;
 }
 
+
 static u16 bond_select_queue(struct net_device *dev, struct sk_buff *skb)
 {
         /*
@@ -4198,6 +4205,11 @@ static u16 bond_select_queue(struct net_device *dev, struct sk_buff *skb)
          */
         u16 txq = skb_rx_queue_recorded(skb) ? skb_get_rx_queue(skb) : 0;
 
+        /*
+         * Save the original txq to restore before passing to the driver
+         */
+        bond_queue_mapping(skb) = skb->queue_mapping;
+
         if (unlikely(txq >= dev->real_num_tx_queues)) {
                 do {
                         txq -= dev->real_num_tx_queues;
diff --git a/drivers/net/dl2k.c b/drivers/net/dl2k.c
index c445457b66d5..23179dbcedd2 100644
--- a/drivers/net/dl2k.c
+++ b/drivers/net/dl2k.c
@@ -346,7 +346,7 @@ parse_eeprom (struct net_device *dev)
         if (np->pdev->vendor == PCI_VENDOR_ID_DLINK) {  /* D-Link Only */
                 /* Check CRC */
                 crc = ~ether_crc_le (256 - 4, sromdata);
-                if (psrom->crc != crc) {
+                if (psrom->crc != cpu_to_le32(crc)) {
                         printk (KERN_ERR "%s: EEPROM data CRC error.\n",
                                         dev->name);
                         return -1;
diff --git a/drivers/net/fs_enet/mac-fcc.c b/drivers/net/fs_enet/mac-fcc.c
index 7a84e45487e8..7583a9572bcc 100644
--- a/drivers/net/fs_enet/mac-fcc.c
+++ b/drivers/net/fs_enet/mac-fcc.c
@@ -105,7 +105,7 @@ static int do_pd_setup(struct fs_enet_private *fep)
                 goto out_ep;
 
         fep->fcc.mem = (void __iomem *)cpm2_immr;
-        fpi->dpram_offset = cpm_dpalloc(128, 8);
+        fpi->dpram_offset = cpm_dpalloc(128, 32);
         if (IS_ERR_VALUE(fpi->dpram_offset)) {
                 ret = fpi->dpram_offset;
                 goto out_fcccp;
diff --git a/drivers/net/gianfar.c b/drivers/net/gianfar.c
index def7f7efc803..dc0a7aa42b2e 100644
--- a/drivers/net/gianfar.c
+++ b/drivers/net/gianfar.c
@@ -10,7 +10,7 @@
  * Maintainer: Kumar Gala
  * Modifier: Sandeep Gopalpet <sandeep.kumar@freescale.com>
  *
- * Copyright 2002-2009 Freescale Semiconductor, Inc.
+ * Copyright 2002-2009, 2011 Freescale Semiconductor, Inc.
  * Copyright 2007 MontaVista Software, Inc.
  *
  * This program is free software; you can redistribute  it and/or modify it
@@ -475,9 +475,6 @@ static const struct net_device_ops gfar_netdev_ops = {
 #endif
 };
 
-unsigned int ftp_rqfpr[MAX_FILER_IDX + 1];
-unsigned int ftp_rqfcr[MAX_FILER_IDX + 1];
-
 void lock_rx_qs(struct gfar_private *priv)
 {
         int i = 0x0;
@@ -872,28 +869,28 @@ static u32 cluster_entry_per_class(struct gfar_private *priv, u32 rqfar,
 
         rqfar--;
         rqfcr = RQFCR_CLE | RQFCR_PID_MASK | RQFCR_CMP_EXACT;
-        ftp_rqfpr[rqfar] = rqfpr;
-        ftp_rqfcr[rqfar] = rqfcr;
+        priv->ftp_rqfpr[rqfar] = rqfpr;
+        priv->ftp_rqfcr[rqfar] = rqfcr;
         gfar_write_filer(priv, rqfar, rqfcr, rqfpr);
 
         rqfar--;
         rqfcr = RQFCR_CMP_NOMATCH;
-        ftp_rqfpr[rqfar] = rqfpr;
-        ftp_rqfcr[rqfar] = rqfcr;
+        priv->ftp_rqfpr[rqfar] = rqfpr;
+        priv->ftp_rqfcr[rqfar] = rqfcr;
         gfar_write_filer(priv, rqfar, rqfcr, rqfpr);
 
         rqfar--;
         rqfcr = RQFCR_CMP_EXACT | RQFCR_PID_PARSE | RQFCR_CLE | RQFCR_AND;
         rqfpr = class;
-        ftp_rqfcr[rqfar] = rqfcr;
-        ftp_rqfpr[rqfar] = rqfpr;
+        priv->ftp_rqfcr[rqfar] = rqfcr;
+        priv->ftp_rqfpr[rqfar] = rqfpr;
         gfar_write_filer(priv, rqfar, rqfcr, rqfpr);
 
         rqfar--;
         rqfcr = RQFCR_CMP_EXACT | RQFCR_PID_MASK | RQFCR_AND;
         rqfpr = class;
-        ftp_rqfcr[rqfar] = rqfcr;
-        ftp_rqfpr[rqfar] = rqfpr;
+        priv->ftp_rqfcr[rqfar] = rqfcr;
+        priv->ftp_rqfpr[rqfar] = rqfpr;
         gfar_write_filer(priv, rqfar, rqfcr, rqfpr);
 
         return rqfar;
@@ -908,8 +905,8 @@ static void gfar_init_filer_table(struct gfar_private *priv)
 
         /* Default rule */
         rqfcr = RQFCR_CMP_MATCH;
-        ftp_rqfcr[rqfar] = rqfcr;
-        ftp_rqfpr[rqfar] = rqfpr;
+        priv->ftp_rqfcr[rqfar] = rqfcr;
+        priv->ftp_rqfpr[rqfar] = rqfpr;
         gfar_write_filer(priv, rqfar, rqfcr, rqfpr);
 
         rqfar = cluster_entry_per_class(priv, rqfar, RQFPR_IPV6);
@@ -925,8 +922,8 @@ static void gfar_init_filer_table(struct gfar_private *priv)
         /* Rest are masked rules */
         rqfcr = RQFCR_CMP_NOMATCH;
         for (i = 0; i < rqfar; i++) {
-                ftp_rqfcr[i] = rqfcr;
-                ftp_rqfpr[i] = rqfpr;
+                priv->ftp_rqfcr[i] = rqfcr;
+                priv->ftp_rqfpr[i] = rqfpr;
                 gfar_write_filer(priv, i, rqfcr, rqfpr);
         }
 }
diff --git a/drivers/net/gianfar.h b/drivers/net/gianfar.h
index a4e690a9aeb9..76f14d044470 100644
--- a/drivers/net/gianfar.h
+++ b/drivers/net/gianfar.h
@@ -9,7 +9,7 @@
  * Maintainer: Kumar Gala
  * Modifier: Sandeep Gopalpet <sandeep.kumar@freescale.com>
  *
- * Copyright 2002-2009 Freescale Semiconductor, Inc.
+ * Copyright 2002-2009, 2011 Freescale Semiconductor, Inc.
  *
  * This program is free software; you can redistribute  it and/or modify it
  * under  the terms of  the GNU General  Public License as published by the
@@ -1122,10 +1122,12 @@ struct gfar_private {
         /* HW time stamping enabled flag */
         int hwts_rx_en;
         int hwts_tx_en;
+
+        /*Filer table*/
+        unsigned int ftp_rqfpr[MAX_FILER_IDX + 1];
+        unsigned int ftp_rqfcr[MAX_FILER_IDX + 1];
 };
 
-extern unsigned int ftp_rqfpr[MAX_FILER_IDX + 1];
-extern unsigned int ftp_rqfcr[MAX_FILER_IDX + 1];
 
 static inline int gfar_has_errata(struct gfar_private *priv,
                                   enum gfar_errata err)
diff --git a/drivers/net/gianfar_ethtool.c b/drivers/net/gianfar_ethtool.c
index 05103362bebe..2ecdc9a785fa 100644
--- a/drivers/net/gianfar_ethtool.c
+++ b/drivers/net/gianfar_ethtool.c
@@ -9,7 +9,7 @@
  *  Maintainer: Kumar Gala
  *  Modifier: Sandeep Gopalpet <sandeep.kumar@freescale.com>
  *
- *  Copyright 2003-2006, 2008-2009 Freescale Semiconductor, Inc.
+ *  Copyright 2003-2006, 2008-2009, 2011 Freescale Semiconductor, Inc.
  *
  *  This software may be used and distributed according to
  *  the terms of the GNU Public License, Version 2, incorporated herein
@@ -610,15 +610,15 @@ static void ethflow_to_filer_rules (struct gfar_private *priv, u64 ethflow)
         if (ethflow & RXH_L2DA) {
                 fcr = RQFCR_PID_DAH |RQFCR_CMP_NOMATCH |
                         RQFCR_HASH | RQFCR_AND | RQFCR_HASHTBL_0;
-                ftp_rqfpr[priv->cur_filer_idx] = fpr;
-                ftp_rqfcr[priv->cur_filer_idx] = fcr;
+                priv->ftp_rqfpr[priv->cur_filer_idx] = fpr;
+                priv->ftp_rqfcr[priv->cur_filer_idx] = fcr;
                 gfar_write_filer(priv, priv->cur_filer_idx, fcr, fpr);
                 priv->cur_filer_idx = priv->cur_filer_idx - 1;
 
                 fcr = RQFCR_PID_DAL | RQFCR_AND | RQFCR_CMP_NOMATCH |
                                 RQFCR_HASH | RQFCR_AND | RQFCR_HASHTBL_0;
-                ftp_rqfpr[priv->cur_filer_idx] = fpr;
-                ftp_rqfcr[priv->cur_filer_idx] = fcr;
+                priv->ftp_rqfpr[priv->cur_filer_idx] = fpr;
+                priv->ftp_rqfcr[priv->cur_filer_idx] = fcr;
                 gfar_write_filer(priv, priv->cur_filer_idx, fcr, fpr);
                 priv->cur_filer_idx = priv->cur_filer_idx - 1;
         }
@@ -627,16 +627,16 @@ static void ethflow_to_filer_rules (struct gfar_private *priv, u64 ethflow)
                 fcr = RQFCR_PID_VID | RQFCR_CMP_NOMATCH | RQFCR_HASH |
                                 RQFCR_AND | RQFCR_HASHTBL_0;
                 gfar_write_filer(priv, priv->cur_filer_idx, fcr, fpr);
-                ftp_rqfpr[priv->cur_filer_idx] = fpr;
-                ftp_rqfcr[priv->cur_filer_idx] = fcr;
+                priv->ftp_rqfpr[priv->cur_filer_idx] = fpr;
+                priv->ftp_rqfcr[priv->cur_filer_idx] = fcr;
                 priv->cur_filer_idx = priv->cur_filer_idx - 1;
         }
 
         if (ethflow & RXH_IP_SRC) {
                 fcr = RQFCR_PID_SIA | RQFCR_CMP_NOMATCH | RQFCR_HASH |
                         RQFCR_AND | RQFCR_HASHTBL_0;
-                ftp_rqfpr[priv->cur_filer_idx] = fpr;
-                ftp_rqfcr[priv->cur_filer_idx] = fcr;
+                priv->ftp_rqfpr[priv->cur_filer_idx] = fpr;
+                priv->ftp_rqfcr[priv->cur_filer_idx] = fcr;
                 gfar_write_filer(priv, priv->cur_filer_idx, fcr, fpr);
                 priv->cur_filer_idx = priv->cur_filer_idx - 1;
         }
@@ -644,8 +644,8 @@ static void ethflow_to_filer_rules (struct gfar_private *priv, u64 ethflow)
         if (ethflow & (RXH_IP_DST)) {
                 fcr = RQFCR_PID_DIA | RQFCR_CMP_NOMATCH | RQFCR_HASH |
                         RQFCR_AND | RQFCR_HASHTBL_0;
-                ftp_rqfpr[priv->cur_filer_idx] = fpr;
-                ftp_rqfcr[priv->cur_filer_idx] = fcr;
+                priv->ftp_rqfpr[priv->cur_filer_idx] = fpr;
+                priv->ftp_rqfcr[priv->cur_filer_idx] = fcr;
                 gfar_write_filer(priv, priv->cur_filer_idx, fcr, fpr);
                 priv->cur_filer_idx = priv->cur_filer_idx - 1;
         }
@@ -653,8 +653,8 @@ static void ethflow_to_filer_rules (struct gfar_private *priv, u64 ethflow)
         if (ethflow & RXH_L3_PROTO) {
                 fcr = RQFCR_PID_L4P | RQFCR_CMP_NOMATCH | RQFCR_HASH |
                         RQFCR_AND | RQFCR_HASHTBL_0;
-                ftp_rqfpr[priv->cur_filer_idx] = fpr;
-                ftp_rqfcr[priv->cur_filer_idx] = fcr;
+                priv->ftp_rqfpr[priv->cur_filer_idx] = fpr;
+                priv->ftp_rqfcr[priv->cur_filer_idx] = fcr;
                 gfar_write_filer(priv, priv->cur_filer_idx, fcr, fpr);
                 priv->cur_filer_idx = priv->cur_filer_idx - 1;
         }
@@ -662,8 +662,8 @@ static void ethflow_to_filer_rules (struct gfar_private *priv, u64 ethflow)
         if (ethflow & RXH_L4_B_0_1) {
                 fcr = RQFCR_PID_SPT | RQFCR_CMP_NOMATCH | RQFCR_HASH |
                         RQFCR_AND | RQFCR_HASHTBL_0;
-                ftp_rqfpr[priv->cur_filer_idx] = fpr;
-                ftp_rqfcr[priv->cur_filer_idx] = fcr;
+                priv->ftp_rqfpr[priv->cur_filer_idx] = fpr;
+                priv->ftp_rqfcr[priv->cur_filer_idx] = fcr;
                 gfar_write_filer(priv, priv->cur_filer_idx, fcr, fpr);
                 priv->cur_filer_idx = priv->cur_filer_idx - 1;
         }
@@ -671,8 +671,8 @@ static void ethflow_to_filer_rules (struct gfar_private *priv, u64 ethflow)
         if (ethflow & RXH_L4_B_2_3) {
                 fcr = RQFCR_PID_DPT | RQFCR_CMP_NOMATCH | RQFCR_HASH |
                         RQFCR_AND | RQFCR_HASHTBL_0;
-                ftp_rqfpr[priv->cur_filer_idx] = fpr;
-                ftp_rqfcr[priv->cur_filer_idx] = fcr;
+                priv->ftp_rqfpr[priv->cur_filer_idx] = fpr;
+                priv->ftp_rqfcr[priv->cur_filer_idx] = fcr;
                 gfar_write_filer(priv, priv->cur_filer_idx, fcr, fpr);
                 priv->cur_filer_idx = priv->cur_filer_idx - 1;
         }
@@ -706,12 +706,12 @@ static int gfar_ethflow_to_filer_table(struct gfar_private *priv, u64 ethflow, u
         }
 
         for (i = 0; i < MAX_FILER_IDX + 1; i++) {
-                local_rqfpr[j] = ftp_rqfpr[i];
-                local_rqfcr[j] = ftp_rqfcr[i];
+                local_rqfpr[j] = priv->ftp_rqfpr[i];
+                local_rqfcr[j] = priv->ftp_rqfcr[i];
                 j--;
-                if ((ftp_rqfcr[i] == (RQFCR_PID_PARSE |
+                if ((priv->ftp_rqfcr[i] == (RQFCR_PID_PARSE |
                         RQFCR_CLE |RQFCR_AND)) &&
-                        (ftp_rqfpr[i] == cmp_rqfpr))
+                        (priv->ftp_rqfpr[i] == cmp_rqfpr))
                         break;
         }
 
@@ -724,20 +724,22 @@ static int gfar_ethflow_to_filer_table(struct gfar_private *priv, u64 ethflow, u
          * if it was already programmed, we need to overwrite these rules
          */
         for (l = i+1; l < MAX_FILER_IDX; l++) {
-                if ((ftp_rqfcr[l] & RQFCR_CLE) &&
-                        !(ftp_rqfcr[l] & RQFCR_AND)) {
-                        ftp_rqfcr[l] = RQFCR_CLE | RQFCR_CMP_EXACT |
+                if ((priv->ftp_rqfcr[l] & RQFCR_CLE) &&
+                        !(priv->ftp_rqfcr[l] & RQFCR_AND)) {
+                        priv->ftp_rqfcr[l] = RQFCR_CLE | RQFCR_CMP_EXACT |
                                 RQFCR_HASHTBL_0 | RQFCR_PID_MASK;
-                        ftp_rqfpr[l] = FPR_FILER_MASK;
-                        gfar_write_filer(priv, l, ftp_rqfcr[l], ftp_rqfpr[l]);
+                        priv->ftp_rqfpr[l] = FPR_FILER_MASK;
+                        gfar_write_filer(priv, l, priv->ftp_rqfcr[l],
+                                priv->ftp_rqfpr[l]);
                         break;
                 }
 
-                if (!(ftp_rqfcr[l] & RQFCR_CLE) && (ftp_rqfcr[l] & RQFCR_AND))
+                if (!(priv->ftp_rqfcr[l] & RQFCR_CLE) &&
+                        (priv->ftp_rqfcr[l] & RQFCR_AND))
                         continue;
                 else {
-                        local_rqfpr[j] = ftp_rqfpr[l];
-                        local_rqfcr[j] = ftp_rqfcr[l];
+                        local_rqfpr[j] = priv->ftp_rqfpr[l];
+                        local_rqfcr[j] = priv->ftp_rqfcr[l];
                         j--;
                 }
         }
@@ -750,8 +752,8 @@ static int gfar_ethflow_to_filer_table(struct gfar_private *priv, u64 ethflow, u
 
         /* Write back the popped out rules again */
         for (k = j+1; k < MAX_FILER_IDX; k++) {
-                ftp_rqfpr[priv->cur_filer_idx] = local_rqfpr[k];
-                ftp_rqfcr[priv->cur_filer_idx] = local_rqfcr[k];
+                priv->ftp_rqfpr[priv->cur_filer_idx] = local_rqfpr[k];
+                priv->ftp_rqfcr[priv->cur_filer_idx] = local_rqfcr[k];
                 gfar_write_filer(priv, priv->cur_filer_idx,
                                 local_rqfcr[k], local_rqfpr[k]);
                 if (!priv->cur_filer_idx)
diff --git a/drivers/net/hp100.c b/drivers/net/hp100.c
index 8e10d2f6a5ad..c3ecb118c1df 100644
--- a/drivers/net/hp100.c
+++ b/drivers/net/hp100.c
@@ -1580,12 +1580,12 @@ static netdev_tx_t hp100_start_xmit_bm(struct sk_buff *skb,
         hp100_outl(ringptr->pdl_paddr, TX_PDA_L);       /* Low Prio. Queue */
 
         lp->txrcommit++;
-        spin_unlock_irqrestore(&lp->lock, flags);
 
-        /* Update statistics */
         dev->stats.tx_packets++;
         dev->stats.tx_bytes += skb->len;
 
+        spin_unlock_irqrestore(&lp->lock, flags);
+
         return NETDEV_TX_OK;
 
 drop:
diff --git a/drivers/net/hplance.c b/drivers/net/hplance.c
index b6060f7538df..a900d5bf2948 100644
--- a/drivers/net/hplance.c
+++ b/drivers/net/hplance.c
@@ -135,7 +135,7 @@ static void __devexit hplance_remove_one(struct dio_dev *d)
 }
 
 /* Initialise a single lance board at the given DIO device */
-static void __init hplance_init(struct net_device *dev, struct dio_dev *d)
+static void __devinit hplance_init(struct net_device *dev, struct dio_dev *d)
 {
         unsigned long va = (d->resource.start + DIO_VIRADDRBASE);
         struct hplance_private *lp;
diff --git a/drivers/net/igb/igb_main.c b/drivers/net/igb/igb_main.c
index c2e9670d154d..fd64c56a433d 100644
--- a/drivers/net/igb/igb_main.c
+++ b/drivers/net/igb/igb_main.c
@@ -2372,6 +2372,9 @@ static int __devinit igb_sw_init(struct igb_adapter *adapter)
         }
 #endif /* CONFIG_PCI_IOV */
         adapter->rss_queues = min_t(u32, IGB_MAX_RX_QUEUES, num_online_cpus());
+        /* i350 cannot do RSS and SR-IOV at the same time */
+        if (hw->mac.type == e1000_i350 && adapter->vfs_allocated_count)
+                adapter->rss_queues = 1;
 
         /*
          * if rss_queues > 4 or vfs are going to be allocated with rss_queues
diff --git a/drivers/net/netxen/netxen_nic_main.c b/drivers/net/netxen/netxen_nic_main.c
index 684cacec10f8..30f41e62049a 100644
--- a/drivers/net/netxen/netxen_nic_main.c
+++ b/drivers/net/netxen/netxen_nic_main.c
@@ -1966,11 +1966,11 @@ netxen_nic_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
 
         netxen_tso_check(netdev, tx_ring, first_desc, skb);
 
-        netxen_nic_update_cmd_producer(adapter, tx_ring);
-
         adapter->stats.txbytes += skb->len;
         adapter->stats.xmitcalled++;
 
+        netxen_nic_update_cmd_producer(adapter, tx_ring);
+
         return NETDEV_TX_OK;
 
 drop_packet:
diff --git a/drivers/net/phy/Kconfig b/drivers/net/phy/Kconfig
index 392a6c4b72e5..a70244306c94 100644
--- a/drivers/net/phy/Kconfig
+++ b/drivers/net/phy/Kconfig
@@ -58,6 +58,7 @@ config BROADCOM_PHY
 
 config BCM63XX_PHY
         tristate "Drivers for Broadcom 63xx SOCs internal PHY"
+        depends on BCM63XX
         ---help---
           Currently supports the 6348 and 6358 PHYs.
 
diff --git a/drivers/net/phy/dp83640.c b/drivers/net/phy/dp83640.c
index b0c9522bb535..2cd8dc5847b4 100644
--- a/drivers/net/phy/dp83640.c
+++ b/drivers/net/phy/dp83640.c
@@ -543,11 +543,20 @@ static void recalibrate(struct dp83640_clock *clock)
 
 /* time stamping methods */
 
-static void decode_evnt(struct dp83640_private *dp83640,
-                        struct phy_txts *phy_txts, u16 ests)
+static int decode_evnt(struct dp83640_private *dp83640,
+                       void *data, u16 ests)
 {
+        struct phy_txts *phy_txts;
         struct ptp_clock_event event;
         int words = (ests >> EVNT_TS_LEN_SHIFT) & EVNT_TS_LEN_MASK;
+        u16 ext_status = 0;
+
+        if (ests & MULT_EVNT) {
+                ext_status = *(u16 *) data;
+                data += sizeof(ext_status);
+        }
+
+        phy_txts = data;
 
         switch (words) { /* fall through in every case */
         case 3:
@@ -565,6 +574,9 @@ static void decode_evnt(struct dp83640_private *dp83640,
         event.timestamp = phy2txts(&dp83640->edata);
 
         ptp_clock_event(dp83640->clock->ptp_clock, &event);
+
+        words = ext_status ? words + 2 : words + 1;
+        return words * sizeof(u16);
 }
 
 static void decode_rxts(struct dp83640_private *dp83640,
@@ -643,9 +655,7 @@ static void decode_status_frame(struct dp83640_private *dp83640,
 
                 } else if (PSF_EVNT == type && len >= sizeof(*phy_txts)) {
 
-                        phy_txts = (struct phy_txts *) ptr;
-                        decode_evnt(dp83640, phy_txts, ests);
-                        size = sizeof(*phy_txts);
+                        size = decode_evnt(dp83640, ptr, ests);
 
                 } else {
                         size = 0;
@@ -1034,8 +1044,8 @@ static bool dp83640_rxtstamp(struct phy_device *phydev,
 
         if (is_status_frame(skb, type)) {
                 decode_status_frame(dp83640, skb);
-                /* Let the stack drop this frame. */
-                return false;
+                kfree_skb(skb);
+                return true;
         }
 
         SKB_PTP_TYPE(skb) = type;
diff --git a/drivers/net/ppp_async.c b/drivers/net/ppp_async.c
index 6436ba916fe4..c6ba64380829 100644
--- a/drivers/net/ppp_async.c
+++ b/drivers/net/ppp_async.c
@@ -524,7 +524,7 @@ static void ppp_async_process(unsigned long arg)
 #define PUT_BYTE(ap, buf, c, islcp)     do {            \
         if ((islcp && c < 0x20) || (ap->xaccm[c >> 5] & (1 << (c & 0x1f)))) {\
                 *buf++ = PPP_ESCAPE;                    \
-                *buf++ = c ^ 0x20;                      \
+                *buf++ = c ^ PPP_TRANS;                 \
         } else                                          \
                 *buf++ = c;                             \
 } while (0)
@@ -897,7 +897,7 @@ ppp_async_input(struct asyncppp *ap, const unsigned char *buf,
                                 sp = skb_put(skb, n);
                                 memcpy(sp, buf, n);
                                 if (ap->state & SC_ESCAPE) {
-                                        sp[0] ^= 0x20;
+                                        sp[0] ^= PPP_TRANS;
                                         ap->state &= ~SC_ESCAPE;
                                 }
                         }
diff --git a/drivers/net/pxa168_eth.c b/drivers/net/pxa168_eth.c
index e224740c6e2a..1f97db1fc4b1 100644
--- a/drivers/net/pxa168_eth.c
+++ b/drivers/net/pxa168_eth.c
@@ -1276,7 +1276,7 @@ static int pxa168_eth_start_xmit(struct sk_buff *skb, struct net_device *dev)
         wmb();
         wrl(pep, SDMA_CMD, SDMA_CMD_TXDH | SDMA_CMD_ERD);
 
-        stats->tx_bytes += skb->len;
+        stats->tx_bytes += length;
         stats->tx_packets++;
         dev->trans_start = jiffies;
         if (pep->tx_ring_size - pep->tx_desc_count <= 1) {
diff --git a/drivers/net/qlcnic/qlcnic_hw.c b/drivers/net/qlcnic/qlcnic_hw.c
index e9656616f2a2..a5d9fbf9d816 100644
--- a/drivers/net/qlcnic/qlcnic_hw.c
+++ b/drivers/net/qlcnic/qlcnic_hw.c
@@ -1406,6 +1406,7 @@ qlcnic_dump_que(struct qlcnic_adapter *adapter, struct qlcnic_dump_entry *entry,
 
         for (loop = 0; loop < que->no_ops; loop++) {
                 QLCNIC_WR_DUMP_REG(que->sel_addr, base, que_id);
+                addr = que->read_addr;
                 for (i = 0; i < cnt; i++) {
                         QLCNIC_RD_DUMP_REG(addr, base, &data);
                         *buffer++ = cpu_to_le32(data);
diff --git a/drivers/net/qlcnic/qlcnic_main.c b/drivers/net/qlcnic/qlcnic_main.c
index 3ab7d2c7baf2..0f6af5c61a7c 100644
--- a/drivers/net/qlcnic/qlcnic_main.c
+++ b/drivers/net/qlcnic/qlcnic_main.c
@@ -2159,6 +2159,7 @@ qlcnic_unmap_buffers(struct pci_dev *pdev, struct sk_buff *skb,
 
         nf = &pbuf->frag_array[0];
         pci_unmap_single(pdev, nf->dma, skb_headlen(skb), PCI_DMA_TODEVICE);
+        pbuf->skb = NULL;
 }
 
 static inline void
diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
index bc5bb378d008..f8c4435afe51 100644
--- a/drivers/net/r8169.c
+++ b/drivers/net/r8169.c
@@ -1635,7 +1635,7 @@ static void rtl8169_get_mac_version(struct rtl8169_private *tp,
          *
          * (RTL_R32(TxConfig) & 0x700000) == 0x200000 ? 8101Eb : 8101Ec
          */
-        static const struct {
+        static const struct rtl_mac_info {
                 u32 mask;
                 u32 val;
                 int mac_version;
@@ -1703,7 +1703,8 @@ static void rtl8169_get_mac_version(struct rtl8169_private *tp,
 
                 /* Catch-all */
                 { 0x00000000, 0x00000000,       RTL_GIGA_MAC_NONE   }
-        }, *p = mac_info;
+        };
+        const struct rtl_mac_info *p = mac_info;
         u32 reg;
 
         reg = RTL_R32(TxConfig);
@@ -3799,7 +3800,7 @@ static void rtl_set_rx_max_size(void __iomem *ioaddr, unsigned int rx_buf_sz)
 
 static void rtl8169_set_magic_reg(void __iomem *ioaddr, unsigned mac_version)
 {
-        static const struct {
+        static const struct rtl_cfg2_info {
                 u32 mac_version;
                 u32 clk;
                 u32 val;
@@ -3808,7 +3809,8 @@ static void rtl8169_set_magic_reg(void __iomem *ioaddr, unsigned mac_version)
                 { RTL_GIGA_MAC_VER_05, PCI_Clock_66MHz, 0x000fffff },
                 { RTL_GIGA_MAC_VER_06, PCI_Clock_33MHz, 0x00ffff00 }, // 8110SCe
                 { RTL_GIGA_MAC_VER_06, PCI_Clock_66MHz, 0x00ffffff }
-        }, *p = cfg2_info;
+        };
+        const struct rtl_cfg2_info *p = cfg2_info;
         unsigned int i;
         u32 clk;
 
diff --git a/drivers/net/smc91x.c b/drivers/net/smc91x.c
index dc4805f473e3..f6285748bd3c 100644
--- a/drivers/net/smc91x.c
+++ b/drivers/net/smc91x.c
@@ -2400,8 +2400,10 @@ static const struct of_device_id smc91x_match[] = {
         { .compatible = "smsc,lan91c94", },
         { .compatible = "smsc,lan91c111", },
         {},
-}
+};
 MODULE_DEVICE_TABLE(of, smc91x_match);
+#else
+#define smc91x_match NULL
 #endif
 
 static struct dev_pm_ops smc_drv_pm_ops = {
@@ -2416,9 +2418,7 @@ static struct platform_driver smc_driver = {
                 .name   = CARDNAME,
                 .owner  = THIS_MODULE,
                 .pm     = &smc_drv_pm_ops,
-#ifdef CONFIG_OF
                 .of_match_table = smc91x_match,
-#endif
         },
 };
 
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 4dab85eecb60..9a6b3824da14 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -460,7 +460,23 @@ static u32 tun_net_fix_features(struct net_device *dev, u32 features)
 
         return (features & tun->set_features) | (features & ~TUN_USER_FEATURES);
 }
-
+#ifdef CONFIG_NET_POLL_CONTROLLER
+static void tun_poll_controller(struct net_device *dev)
+{
+        /*
+         * Tun only receives frames when:
+         * 1) the char device endpoint gets data from user space
+         * 2) the tun socket gets a sendmsg call from user space
+         * Since both of those are syncronous operations, we are guaranteed
+         * never to have pending data when we poll for it
+         * so theres nothing to do here but return.
+         * We need this though so netpoll recognizes us as an interface that
+         * supports polling, which enables bridge devices in virt setups to
+         * still use netconsole
+         */
+        return;
+}
+#endif
 static const struct net_device_ops tun_netdev_ops = {
         .ndo_uninit             = tun_net_uninit,
         .ndo_open               = tun_net_open,
@@ -468,6 +484,9 @@ static const struct net_device_ops tun_netdev_ops = {
         .ndo_start_xmit         = tun_net_xmit,
         .ndo_change_mtu         = tun_net_change_mtu,
         .ndo_fix_features       = tun_net_fix_features,
+#ifdef CONFIG_NET_POLL_CONTROLLER
+        .ndo_poll_controller    = tun_poll_controller,
+#endif
 };
 
 static const struct net_device_ops tap_netdev_ops = {
@@ -480,6 +499,9 @@ static const struct net_device_ops tap_netdev_ops = {
         .ndo_set_multicast_list = tun_net_mclist,
         .ndo_set_mac_address    = eth_mac_addr,
         .ndo_validate_addr      = eth_validate_addr,
+#ifdef CONFIG_NET_POLL_CONTROLLER
+        .ndo_poll_controller    = tun_poll_controller,
+#endif
 };
 
 /* Initialize net device. */
diff --git a/drivers/net/usb/Kconfig b/drivers/net/usb/Kconfig
index 9d4f9117260f..84d4608153c9 100644
--- a/drivers/net/usb/Kconfig
+++ b/drivers/net/usb/Kconfig
@@ -385,6 +385,16 @@ config USB_NET_CX82310_ETH
           router with USB ethernet port. This driver is for routers only,
           it will not work with ADSL modems (use cxacru driver instead).
 
+config USB_NET_KALMIA
+        tristate "Samsung Kalmia based LTE USB modem"
+        depends on USB_USBNET
+        help
+          Choose this option if you have a Samsung Kalmia based USB modem
+          as Samsung GT-B3730.
+
+          To compile this driver as a module, choose M here: the
+          module will be called kalmia.
+
 config USB_HSO
         tristate "Option USB High Speed Mobile Devices"
         depends on USB && RFKILL
diff --git a/drivers/net/usb/Makefile b/drivers/net/usb/Makefile
index c7ec8a5f0a90..c203fa21f6b1 100644
--- a/drivers/net/usb/Makefile
+++ b/drivers/net/usb/Makefile
@@ -23,6 +23,7 @@ obj-$(CONFIG_USB_NET_MCS7830)	+= mcs7830.o
 obj-$(CONFIG_USB_USBNET)        += usbnet.o
 obj-$(CONFIG_USB_NET_INT51X1)   += int51x1.o
 obj-$(CONFIG_USB_CDC_PHONET)    += cdc-phonet.o
+obj-$(CONFIG_USB_NET_KALMIA)    += kalmia.o
 obj-$(CONFIG_USB_IPHETH)        += ipheth.o
 obj-$(CONFIG_USB_SIERRA_NET)    += sierra_net.o
 obj-$(CONFIG_USB_NET_CX82310_ETH)       += cx82310_eth.o
diff --git a/drivers/net/usb/kalmia.c b/drivers/net/usb/kalmia.c
new file mode 100644
index 000000000000..d965fb1e013e
--- /dev/null
+++ b/drivers/net/usb/kalmia.c
@@ -0,0 +1,384 @@
+/*
+ * USB network interface driver for Samsung Kalmia based LTE USB modem like the
+ * Samsung GT-B3730 and GT-B3710.
+ *
+ * Copyright (C) 2011 Marius Bjoernstad Kotsbak <marius@kotsbak.com>
+ *
+ * Sponsored by Quicklink Video Distribution Services Ltd.
+ *
+ * Based on the cdc_eem module.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/ctype.h>
+#include <linux/ethtool.h>
+#include <linux/workqueue.h>
+#include <linux/mii.h>
+#include <linux/usb.h>
+#include <linux/crc32.h>
+#include <linux/usb/cdc.h>
+#include <linux/usb/usbnet.h>
+#include <linux/gfp.h>
+
+/*
+ * The Samsung Kalmia based LTE USB modems have a CDC ACM port for modem control
+ * handled by the "option" module and an ethernet data port handled by this
+ * module.
+ *
+ * The stick must first be switched into modem mode by usb_modeswitch
+ * or similar tool. Then the modem gets sent two initialization packets by
+ * this module, which gives the MAC address of the device. User space can then
+ * connect the modem using AT commands through the ACM port and then use
+ * DHCP on the network interface exposed by this module. Network packets are
+ * sent to and from the modem in a proprietary format discovered after watching
+ * the behavior of the windows driver for the modem.
+ *
+ * More information about the use of the modem is available in usb_modeswitch
+ * forum and the project page:
+ *
+ * http://www.draisberghof.de/usb_modeswitch/bb/viewtopic.php?t=465
+ * https://github.com/mkotsbak/Samsung-GT-B3730-linux-driver
+ */
+
+/* #define      DEBUG */
+/* #define      VERBOSE */
+
+#define KALMIA_HEADER_LENGTH 6
+#define KALMIA_ALIGN_SIZE 4
+#define KALMIA_USB_TIMEOUT 10000
+
+/*-------------------------------------------------------------------------*/
+
+static int
+kalmia_send_init_packet(struct usbnet *dev, u8 *init_msg, u8 init_msg_len,
+        u8 *buffer, u8 expected_len)
+{
+        int act_len;
+        int status;
+
+        netdev_dbg(dev->net, "Sending init packet");
+
+        status = usb_bulk_msg(dev->udev, usb_sndbulkpipe(dev->udev, 0x02),
+                init_msg, init_msg_len, &act_len, KALMIA_USB_TIMEOUT);
+        if (status != 0) {
+                netdev_err(dev->net,
+                        "Error sending init packet. Status %i, length %i\n",
+                        status, act_len);
+                return status;
+        }
+        else if (act_len != init_msg_len) {
+                netdev_err(dev->net,
+                        "Did not send all of init packet. Bytes sent: %i",
+                        act_len);
+        }
+        else {
+                netdev_dbg(dev->net, "Successfully sent init packet.");
+        }
+
+        status = usb_bulk_msg(dev->udev, usb_rcvbulkpipe(dev->udev, 0x81),
+                buffer, expected_len, &act_len, KALMIA_USB_TIMEOUT);
+
+        if (status != 0)
+                netdev_err(dev->net,
+                        "Error receiving init result. Status %i, length %i\n",
+                        status, act_len);
+        else if (act_len != expected_len)
+                netdev_err(dev->net, "Unexpected init result length: %i\n",
+                        act_len);
+
+        return status;
+}
+
+static int
+kalmia_init_and_get_ethernet_addr(struct usbnet *dev, u8 *ethernet_addr)
+{
+        char init_msg_1[] =
+                { 0x57, 0x50, 0x04, 0x00, 0x00, 0x00, 0x00, 0x20, 0x00, 0x00,
+                0x00, 0x00 };
+        char init_msg_2[] =
+                { 0x57, 0x50, 0x04, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0xf4,
+                0x00, 0x00 };
+        char receive_buf[28];
+        int status;
+
+        status = kalmia_send_init_packet(dev, init_msg_1, sizeof(init_msg_1)
+                / sizeof(init_msg_1[0]), receive_buf, 24);
+        if (status != 0)
+                return status;
+
+        status = kalmia_send_init_packet(dev, init_msg_2, sizeof(init_msg_2)
+                / sizeof(init_msg_2[0]), receive_buf, 28);
+        if (status != 0)
+                return status;
+
+        memcpy(ethernet_addr, receive_buf + 10, ETH_ALEN);
+
+        return status;
+}
+
+static int
+kalmia_bind(struct usbnet *dev, struct usb_interface *intf)
+{
+        u8 status;
+        u8 ethernet_addr[ETH_ALEN];
+
+        /* Don't bind to AT command interface */
+        if (intf->cur_altsetting->desc.bInterfaceClass != USB_CLASS_VENDOR_SPEC)
+                return -EINVAL;
+
+        dev->in = usb_rcvbulkpipe(dev->udev, 0x81 & USB_ENDPOINT_NUMBER_MASK);
+        dev->out = usb_sndbulkpipe(dev->udev, 0x02 & USB_ENDPOINT_NUMBER_MASK);
+        dev->status = NULL;
+
+        dev->net->hard_header_len += KALMIA_HEADER_LENGTH;
+        dev->hard_mtu = 1400;
+        dev->rx_urb_size = dev->hard_mtu * 10; // Found as optimal after testing
+
+        status = kalmia_init_and_get_ethernet_addr(dev, ethernet_addr);
+
+        if (status < 0) {
+                usb_set_intfdata(intf, NULL);
+                usb_driver_release_interface(driver_of(intf), intf);
+                return status;
+        }
+
+        memcpy(dev->net->dev_addr, ethernet_addr, ETH_ALEN);
+        memcpy(dev->net->perm_addr, ethernet_addr, ETH_ALEN);
+
+        return status;
+}
+
+static struct sk_buff *
+kalmia_tx_fixup(struct usbnet *dev, struct sk_buff *skb, gfp_t flags)
+{
+        struct sk_buff *skb2 = NULL;
+        u16 content_len;
+        unsigned char *header_start;
+        unsigned char ether_type_1, ether_type_2;
+        u8 remainder, padlen = 0;
+
+        if (!skb_cloned(skb)) {
+                int headroom = skb_headroom(skb);
+                int tailroom = skb_tailroom(skb);
+
+                if ((tailroom >= KALMIA_ALIGN_SIZE) && (headroom
+                        >= KALMIA_HEADER_LENGTH))
+                        goto done;
+
+                if ((headroom + tailroom) > (KALMIA_HEADER_LENGTH
+                        + KALMIA_ALIGN_SIZE)) {
+                        skb->data = memmove(skb->head + KALMIA_HEADER_LENGTH,
+                                skb->data, skb->len);
+                        skb_set_tail_pointer(skb, skb->len);
+                        goto done;
+                }
+        }
+
+        skb2 = skb_copy_expand(skb, KALMIA_HEADER_LENGTH,
+                KALMIA_ALIGN_SIZE, flags);
+        if (!skb2)
+                return NULL;
+
+        dev_kfree_skb_any(skb);
+        skb = skb2;
+
+        done: header_start = skb_push(skb, KALMIA_HEADER_LENGTH);
+        ether_type_1 = header_start[KALMIA_HEADER_LENGTH + 12];
+        ether_type_2 = header_start[KALMIA_HEADER_LENGTH + 13];
+
+        netdev_dbg(dev->net, "Sending etherType: %02x%02x", ether_type_1,
+                ether_type_2);
+
+        /* According to empiric data for data packages */
+        header_start[0] = 0x57;
+        header_start[1] = 0x44;
+        content_len = skb->len - KALMIA_HEADER_LENGTH;
+        header_start[2] = (content_len & 0xff); /* low byte */
+        header_start[3] = (content_len >> 8); /* high byte */
+
+        header_start[4] = ether_type_1;
+        header_start[5] = ether_type_2;
+
+        /* Align to 4 bytes by padding with zeros */
+        remainder = skb->len % KALMIA_ALIGN_SIZE;
+        if (remainder > 0) {
+                padlen = KALMIA_ALIGN_SIZE - remainder;
+                memset(skb_put(skb, padlen), 0, padlen);
+        }
+
+        netdev_dbg(
+                dev->net,
+                "Sending package with length %i and padding %i. Header: %02x:%02x:%02x:%02x:%02x:%02x.",
+                content_len, padlen, header_start[0], header_start[1],
+                header_start[2], header_start[3], header_start[4],
+                header_start[5]);
+
+        return skb;
+}
+
+static int
+kalmia_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
+{
+        /*
+         * Our task here is to strip off framing, leaving skb with one
+         * data frame for the usbnet framework code to process.
+         */
+        const u8 HEADER_END_OF_USB_PACKET[] =
+                { 0x57, 0x5a, 0x00, 0x00, 0x08, 0x00 };
+        const u8 EXPECTED_UNKNOWN_HEADER_1[] =
+                { 0x57, 0x43, 0x1e, 0x00, 0x15, 0x02 };
+        const u8 EXPECTED_UNKNOWN_HEADER_2[] =
+                { 0x57, 0x50, 0x0e, 0x00, 0x00, 0x00 };
+        u8 i = 0;
+
+        /* incomplete header? */
+        if (skb->len < KALMIA_HEADER_LENGTH)
+                return 0;
+
+        do {
+                struct sk_buff *skb2 = NULL;
+                u8 *header_start;
+                u16 usb_packet_length, ether_packet_length;
+                int is_last;
+
+                header_start = skb->data;
+
+                if (unlikely(header_start[0] != 0x57 || header_start[1] != 0x44)) {
+                        if (!memcmp(header_start, EXPECTED_UNKNOWN_HEADER_1,
+                                sizeof(EXPECTED_UNKNOWN_HEADER_1)) || !memcmp(
+                                header_start, EXPECTED_UNKNOWN_HEADER_2,
+                                sizeof(EXPECTED_UNKNOWN_HEADER_2))) {
+                                netdev_dbg(
+                                        dev->net,
+                                        "Received expected unknown frame header: %02x:%02x:%02x:%02x:%02x:%02x. Package length: %i\n",
+                                        header_start[0], header_start[1],
+                                        header_start[2], header_start[3],
+                                        header_start[4], header_start[5],
+                                        skb->len - KALMIA_HEADER_LENGTH);
+                        }
+                        else {
+                                netdev_err(
+                                        dev->net,
+                                        "Received unknown frame header: %02x:%02x:%02x:%02x:%02x:%02x. Package length: %i\n",
+                                        header_start[0], header_start[1],
+                                        header_start[2], header_start[3],
+                                        header_start[4], header_start[5],
+                                        skb->len - KALMIA_HEADER_LENGTH);
+                                return 0;
+                        }
+                }
+                else
+                        netdev_dbg(
+                                dev->net,
+                                "Received header: %02x:%02x:%02x:%02x:%02x:%02x. Package length: %i\n",
+                                header_start[0], header_start[1], header_start[2],
+                                header_start[3], header_start[4], header_start[5],
+                                skb->len - KALMIA_HEADER_LENGTH);
+
+                /* subtract start header and end header */
+                usb_packet_length = skb->len - (2 * KALMIA_HEADER_LENGTH);
+                ether_packet_length = header_start[2] + (header_start[3] << 8);
+                skb_pull(skb, KALMIA_HEADER_LENGTH);
+
+                /* Some small packets misses end marker */
+                if (usb_packet_length < ether_packet_length) {
+                        ether_packet_length = usb_packet_length
+                                + KALMIA_HEADER_LENGTH;
+                        is_last = true;
+                }
+                else {
+                        netdev_dbg(dev->net, "Correct package length #%i", i
+                                + 1);
+
+                        is_last = (memcmp(skb->data + ether_packet_length,
+                                HEADER_END_OF_USB_PACKET,
+                                sizeof(HEADER_END_OF_USB_PACKET)) == 0);
+                        if (!is_last) {
+                                header_start = skb->data + ether_packet_length;
+                                netdev_dbg(
+                                        dev->net,
+                                        "End header: %02x:%02x:%02x:%02x:%02x:%02x. Package length: %i\n",
+                                        header_start[0], header_start[1],
+                                        header_start[2], header_start[3],
+                                        header_start[4], header_start[5],
+                                        skb->len - KALMIA_HEADER_LENGTH);
+                        }
+                }
+
+                if (is_last) {
+                        skb2 = skb;
+                }
+                else {
+                        skb2 = skb_clone(skb, GFP_ATOMIC);
+                        if (unlikely(!skb2))
+                                return 0;
+                }
+
+                skb_trim(skb2, ether_packet_length);
+
+                if (is_last) {
+                        return 1;
+                }
+                else {
+                        usbnet_skb_return(dev, skb2);
+                        skb_pull(skb, ether_packet_length);
+                }
+
+                i++;
+        }
+        while (skb->len);
+
+        return 1;
+}
+
+static const struct driver_info kalmia_info = {
+        .description = "Samsung Kalmia LTE USB dongle",
+        .flags = FLAG_WWAN,
+        .bind = kalmia_bind,
+        .rx_fixup = kalmia_rx_fixup,
+        .tx_fixup = kalmia_tx_fixup
+};
+
+/*-------------------------------------------------------------------------*/
+
+static const struct usb_device_id products[] = {
+        /* The unswitched USB ID, to get the module auto loaded: */
+        { USB_DEVICE(0x04e8, 0x689a) },
+        /* The stick swithed into modem (by e.g. usb_modeswitch): */
+        { USB_DEVICE(0x04e8, 0x6889),
+                .driver_info = (unsigned long) &kalmia_info, },
+        { /* EMPTY == end of list */} };
+MODULE_DEVICE_TABLE( usb, products);
+
+static struct usb_driver kalmia_driver = {
+        .name = "kalmia",
+        .id_table = products,
+        .probe = usbnet_probe,
+        .disconnect = usbnet_disconnect,
+        .suspend = usbnet_suspend,
+        .resume = usbnet_resume
+};
+
+static int __init kalmia_init(void)
+{
+        return usb_register(&kalmia_driver);
+}
+module_init( kalmia_init);
+
+static void __exit kalmia_exit(void)
+{
+        usb_deregister(&kalmia_driver);
+}
+module_exit( kalmia_exit);
+
+MODULE_AUTHOR("Marius Bjoernstad Kotsbak <marius@kotsbak.com>");
+MODULE_DESCRIPTION("Samsung Kalmia USB network driver");
+MODULE_LICENSE("GPL");
diff --git a/drivers/net/wan/farsync.c b/drivers/net/wan/farsync.c
index 1eba06f6fa4c..0f27f4c5bb73 100644
--- a/drivers/net/wan/farsync.c
+++ b/drivers/net/wan/farsync.c
@@ -2204,8 +2204,10 @@ fst_open(struct net_device *dev)
 
         if (port->mode != FST_RAW) {
                 err = hdlc_open(dev);
-                if (err)
+                if (err) {
+                        module_put(THIS_MODULE);
                         return err;
+                }
         }
 
         fst_openport(port);
diff --git a/drivers/net/wireless/iwlegacy/iwl-4965.c b/drivers/net/wireless/iwlegacy/iwl-4965.c
index 3a022bcf615c..9cf96cb51712 100644
--- a/drivers/net/wireless/iwlegacy/iwl-4965.c
+++ b/drivers/net/wireless/iwlegacy/iwl-4965.c
@@ -1216,10 +1216,10 @@ static int iwl4965_commit_rxon(struct iwl_priv *priv, struct iwl_rxon_context *c
          * receive commit_rxon request
          * abort any previous channel switch if still in process
          */
-        if (priv->switch_rxon.switch_in_progress &&
-            (priv->switch_rxon.channel != ctx->staging.channel)) {
+        if (test_bit(STATUS_CHANNEL_SWITCH_PENDING, &priv->status) &&
+            (priv->switch_channel != ctx->staging.channel)) {
                 IWL_DEBUG_11H(priv, "abort channel switch on %d\n",
-                      le16_to_cpu(priv->switch_rxon.channel));
+                      le16_to_cpu(priv->switch_channel));
                 iwl_legacy_chswitch_done(priv, false);
         }
 
@@ -1402,9 +1402,6 @@ static int iwl4965_hw_channel_switch(struct iwl_priv *priv,
                 return rc;
         }
 
-        priv->switch_rxon.channel = cmd.channel;
-        priv->switch_rxon.switch_in_progress = true;
-
         return iwl_legacy_send_cmd_pdu(priv,
                          REPLY_CHANNEL_SWITCH, sizeof(cmd), &cmd);
 }
diff --git a/drivers/net/wireless/iwlegacy/iwl-core.c b/drivers/net/wireless/iwlegacy/iwl-core.c
index 42df8321dae8..3be76bd5499a 100644
--- a/drivers/net/wireless/iwlegacy/iwl-core.c
+++ b/drivers/net/wireless/iwlegacy/iwl-core.c
@@ -859,12 +859,8 @@ void iwl_legacy_chswitch_done(struct iwl_priv *priv, bool is_success)
         if (test_bit(STATUS_EXIT_PENDING, &priv->status))
                 return;
 
-        if (priv->switch_rxon.switch_in_progress) {
+        if (test_and_clear_bit(STATUS_CHANNEL_SWITCH_PENDING, &priv->status))
                 ieee80211_chswitch_done(ctx->vif, is_success);
-                mutex_lock(&priv->mutex);
-                priv->switch_rxon.switch_in_progress = false;
-                mutex_unlock(&priv->mutex);
-        }
 }
 EXPORT_SYMBOL(iwl_legacy_chswitch_done);
 
@@ -876,19 +872,19 @@ void iwl_legacy_rx_csa(struct iwl_priv *priv, struct iwl_rx_mem_buffer *rxb)
         struct iwl_rxon_context *ctx = &priv->contexts[IWL_RXON_CTX_BSS];
         struct iwl_legacy_rxon_cmd *rxon = (void *)&ctx->active;
 
-        if (priv->switch_rxon.switch_in_progress) {
-                if (!le32_to_cpu(csa->status) &&
-                    (csa->channel == priv->switch_rxon.channel)) {
-                        rxon->channel = csa->channel;
-                        ctx->staging.channel = csa->channel;
-                        IWL_DEBUG_11H(priv, "CSA notif: channel %d\n",
-                              le16_to_cpu(csa->channel));
-                        iwl_legacy_chswitch_done(priv, true);
-                } else {
-                        IWL_ERR(priv, "CSA notif (fail) : channel %d\n",
+        if (!test_bit(STATUS_CHANNEL_SWITCH_PENDING, &priv->status))
+                return;
+
+        if (!le32_to_cpu(csa->status) && csa->channel == priv->switch_channel) {
+                rxon->channel = csa->channel;
+                ctx->staging.channel = csa->channel;
+                IWL_DEBUG_11H(priv, "CSA notif: channel %d\n",
                               le16_to_cpu(csa->channel));
-                        iwl_legacy_chswitch_done(priv, false);
-                }
+                iwl_legacy_chswitch_done(priv, true);
+        } else {
+                IWL_ERR(priv, "CSA notif (fail) : channel %d\n",
+                        le16_to_cpu(csa->channel));
+                iwl_legacy_chswitch_done(priv, false);
         }
 }
 EXPORT_SYMBOL(iwl_legacy_rx_csa);
diff --git a/drivers/net/wireless/iwlegacy/iwl-core.h b/drivers/net/wireless/iwlegacy/iwl-core.h
index bc66c604106c..c5fbda0760de 100644
--- a/drivers/net/wireless/iwlegacy/iwl-core.h
+++ b/drivers/net/wireless/iwlegacy/iwl-core.h
@@ -560,7 +560,7 @@ void iwl_legacy_free_geos(struct iwl_priv *priv);
 #define STATUS_SCAN_HW          15
 #define STATUS_POWER_PMI        16
 #define STATUS_FW_ERROR         17
-
+#define STATUS_CHANNEL_SWITCH_PENDING 18
 
 static inline int iwl_legacy_is_ready(struct iwl_priv *priv)
 {
diff --git a/drivers/net/wireless/iwlegacy/iwl-dev.h b/drivers/net/wireless/iwlegacy/iwl-dev.h
index 416448acd971..0a8d07fdc0e7 100644
--- a/drivers/net/wireless/iwlegacy/iwl-dev.h
+++ b/drivers/net/wireless/iwlegacy/iwl-dev.h
@@ -856,17 +856,6 @@ struct traffic_stats {
 };
 
 /*
- * iwl_switch_rxon: "channel switch" structure
- *
- * @ switch_in_progress: channel switch in progress
- * @ channel: new channel
- */
-struct iwl_switch_rxon {
-        bool switch_in_progress;
-        __le16 channel;
-};
-
-/*
  * schedule the timer to wake up every UCODE_TRACE_PERIOD milliseconds
  * to perform continuous uCode event logging operation if enabled
  */
@@ -1116,7 +1105,7 @@ struct iwl_priv {
 
         struct iwl_rxon_context contexts[NUM_IWL_RXON_CTX];
 
-        struct iwl_switch_rxon switch_rxon;
+        __le16 switch_channel;
 
         /* 1st responses from initialize and runtime uCode images.
          * _4965's initialize alive response contains some calibration data. */
diff --git a/drivers/net/wireless/iwlegacy/iwl4965-base.c b/drivers/net/wireless/iwlegacy/iwl4965-base.c
index af2ae22fcfd3..7157ba529680 100644
--- a/drivers/net/wireless/iwlegacy/iwl4965-base.c
+++ b/drivers/net/wireless/iwlegacy/iwl4965-base.c
@@ -2861,16 +2861,13 @@ void iwl4965_mac_channel_switch(struct ieee80211_hw *hw,
                 goto out;
 
         if (test_bit(STATUS_EXIT_PENDING, &priv->status) ||
-            test_bit(STATUS_SCANNING, &priv->status))
+            test_bit(STATUS_SCANNING, &priv->status) ||
+            test_bit(STATUS_CHANNEL_SWITCH_PENDING, &priv->status))
                 goto out;
 
         if (!iwl_legacy_is_associated_ctx(ctx))
                 goto out;
 
-        /* channel switch in progress */
-        if (priv->switch_rxon.switch_in_progress == true)
-                goto out;
-
         if (priv->cfg->ops->lib->set_channel_switch) {
 
                 ch = channel->hw_value;
@@ -2919,15 +2916,18 @@ void iwl4965_mac_channel_switch(struct ieee80211_hw *hw,
                          * at this point, staging_rxon has the
                          * configuration for channel switch
                          */
-                        if (priv->cfg->ops->lib->set_channel_switch(priv,
-                                                                    ch_switch))
-                                priv->switch_rxon.switch_in_progress = false;
+                        set_bit(STATUS_CHANNEL_SWITCH_PENDING, &priv->status);
+                        priv->switch_channel = cpu_to_le16(ch);
+                        if (priv->cfg->ops->lib->set_channel_switch(priv, ch_switch)) {
+                                clear_bit(STATUS_CHANNEL_SWITCH_PENDING,
+                                          &priv->status);
+                                priv->switch_channel = 0;
+                                ieee80211_chswitch_done(ctx->vif, false);
+                        }
                 }
         }
 out:
         mutex_unlock(&priv->mutex);
-        if (!priv->switch_rxon.switch_in_progress)
-                ieee80211_chswitch_done(ctx->vif, false);
         IWL_DEBUG_MAC80211(priv, "leave\n");
 }
 
diff --git a/drivers/net/wireless/mwifiex/cfg80211.c b/drivers/net/wireless/mwifiex/cfg80211.c
index 660831ce293c..687c1f223497 100644
--- a/drivers/net/wireless/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/mwifiex/cfg80211.c
@@ -1288,6 +1288,8 @@ int mwifiex_register_cfg80211(struct net_device *dev, u8 *mac,
 
         *(unsigned long *) wdev_priv = (unsigned long) priv;
 
+        set_wiphy_dev(wdev->wiphy, (struct device *) priv->adapter->dev);
+
         ret = wiphy_register(wdev->wiphy);
         if (ret < 0) {
                 dev_err(priv->adapter->dev, "%s: registering cfg80211 device\n",
diff --git a/drivers/net/wireless/mwl8k.c b/drivers/net/wireless/mwl8k.c
index 8ff43c281411..d633edbd9796 100644
--- a/drivers/net/wireless/mwl8k.c
+++ b/drivers/net/wireless/mwl8k.c
@@ -2475,6 +2475,7 @@ struct mwl8k_cmd_set_hw_spec {
  * faster client.
  */
 #define MWL8K_SET_HW_SPEC_FLAG_ENABLE_LIFE_TIME_EXPIRY  0x00000400
+#define MWL8K_SET_HW_SPEC_FLAG_GENERATE_CCMP_HDR        0x00000200
 #define MWL8K_SET_HW_SPEC_FLAG_HOST_DECR_MGMT           0x00000080
 #define MWL8K_SET_HW_SPEC_FLAG_HOSTFORM_PROBERESP       0x00000020
 #define MWL8K_SET_HW_SPEC_FLAG_HOSTFORM_BEACON          0x00000010
@@ -2511,7 +2512,8 @@ static int mwl8k_cmd_set_hw_spec(struct ieee80211_hw *hw)
         cmd->flags = cpu_to_le32(MWL8K_SET_HW_SPEC_FLAG_HOST_DECR_MGMT |
                                  MWL8K_SET_HW_SPEC_FLAG_HOSTFORM_PROBERESP |
                                  MWL8K_SET_HW_SPEC_FLAG_HOSTFORM_BEACON |
-                                 MWL8K_SET_HW_SPEC_FLAG_ENABLE_LIFE_TIME_EXPIRY);
+                                 MWL8K_SET_HW_SPEC_FLAG_ENABLE_LIFE_TIME_EXPIRY |
+                                 MWL8K_SET_HW_SPEC_FLAG_GENERATE_CCMP_HDR);
         cmd->num_tx_desc_per_queue = cpu_to_le32(MWL8K_TX_DESCS);
         cmd->total_rxd = cpu_to_le32(MWL8K_RX_DESCS);
 
diff --git a/drivers/net/wireless/rtlwifi/pci.c b/drivers/net/wireless/rtlwifi/pci.c
index fc44005b0d53..e502db0532e5 100644
--- a/drivers/net/wireless/rtlwifi/pci.c
+++ b/drivers/net/wireless/rtlwifi/pci.c
@@ -670,6 +670,19 @@ static void _rtl_pci_rx_interrupt(struct ieee80211_hw *hw)
                                                          &rx_status,
                                                          (u8 *) pdesc, skb);
 
+                        new_skb = dev_alloc_skb(rtlpci->rxbuffersize);
+                        if (unlikely(!new_skb)) {
+                                RT_TRACE(rtlpriv, (COMP_INTR | COMP_RECV),
+                                         DBG_DMESG,
+                                         ("can't alloc skb for rx\n"));
+                                goto done;
+                        }
+
+                        pci_unmap_single(rtlpci->pdev,
+                                         *((dma_addr_t *) skb->cb),
+                                         rtlpci->rxbuffersize,
+                                         PCI_DMA_FROMDEVICE);
+
                         skb_put(skb, rtlpriv->cfg->ops->get_desc((u8 *) pdesc,
                                                          false,
                                                          HW_DESC_RXPKT_LEN));
@@ -686,21 +699,6 @@ static void _rtl_pci_rx_interrupt(struct ieee80211_hw *hw)
                         hdr = rtl_get_hdr(skb);
                         fc = rtl_get_fc(skb);
 
-                        /* try for new buffer - if allocation fails, drop
-                         * frame and reuse old buffer
-                         */
-                        new_skb = dev_alloc_skb(rtlpci->rxbuffersize);
-                        if (unlikely(!new_skb)) {
-                                RT_TRACE(rtlpriv, (COMP_INTR | COMP_RECV),
-                                         DBG_DMESG,
-                                         ("can't alloc skb for rx\n"));
-                                goto done;
-                        }
-                        pci_unmap_single(rtlpci->pdev,
-                                         *((dma_addr_t *) skb->cb),
-                                         rtlpci->rxbuffersize,
-                                         PCI_DMA_FROMDEVICE);
-
                         if (!stats.crc && !stats.hwerror) {
                                 memcpy(IEEE80211_SKB_RXCB(skb), &rx_status,
                                        sizeof(rx_status));