Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (40 commits)
  ethoc: limit the number of buffers to 128
  ethoc: use system memory as buffer
  ethoc: align received packet to make IP header at word boundary
  ethoc: fix buffer address mapping
  ethoc: fix typo to compute number of tx descriptors
  au1000_eth: Duplicate test of RX_OVERLEN bit in update_rx_stats()
  netxen: Fix Unlikely(x) > y
  pasemi_mac: ethtool get settings fix
  add maintainer for network drop monitor kernel service
  tg3: Fix phylib locking strategy
  rndis_host: support ETHTOOL_GPERMADDR
  ipv4: arp_notify address list bug
  gigaset: add kerneldoc comments
  gigaset: correct debugging output selection
  gigaset: improve error recovery
  gigaset: fix device ERROR response handling
  gigaset: announce if built with debugging
  gigaset: handle isoc frame errors more gracefully
  gigaset: linearize skb
  gigaset: fix reject/hangup handling
  ...

45 files changed, 545 insertions, 253 deletions

diff --git a/Documentation/isdn/INTERFACE.CAPI b/Documentation/isdn/INTERFACE.CAPI
index 686e107923ec..5fe8de5cc727 100644
--- a/Documentation/isdn/INTERFACE.CAPI
+++ b/Documentation/isdn/INTERFACE.CAPI
@@ -60,10 +60,9 @@ open() operation on regular files or character devices.
 
 After a successful return from register_appl(), CAPI messages from the
 application may be passed to the driver for the device via calls to the
-send_message() callback function. The CAPI message to send is stored in the
-data portion of an skb. Conversely, the driver may call Kernel CAPI's
-capi_ctr_handle_message() function to pass a received CAPI message to Kernel
-CAPI for forwarding to an application, specifying its ApplID.
+send_message() callback function. Conversely, the driver may call Kernel
+CAPI's capi_ctr_handle_message() function to pass a received CAPI message to
+Kernel CAPI for forwarding to an application, specifying its ApplID.
 
 Deregistration requests (CAPI operation CAPI_RELEASE) from applications are
 forwarded as calls to the release_appl() callback function, passing the same
@@ -142,6 +141,7 @@ u16  (*send_message)(struct capi_ctr *ctrlr, struct sk_buff *skb)
         to accepting or queueing the message. Errors occurring during the
         actual processing of the message should be signaled with an
         appropriate reply message.
+        May be called in process or interrupt context.
         Calls to this function are not serialized by Kernel CAPI, ie. it must
         be prepared to be re-entered.
 
@@ -154,7 +154,8 @@ read_proc_t *ctr_read_proc
         system entry, /proc/capi/controllers/<n>; will be called with a
         pointer to the device's capi_ctr structure as the last (data) argument
 
-Note: Callback functions are never called in interrupt context.
+Note: Callback functions except send_message() are never called in interrupt
+context.
 
 - to be filled in before calling capi_ctr_ready():
 
@@ -171,14 +172,40 @@ u8 serial[CAPI_SERIAL_LEN]
         value to return for CAPI_GET_SERIAL
 
 
-4.3 The _cmsg Structure
+4.3 SKBs
+
+CAPI messages are passed between Kernel CAPI and the driver via send_message()
+and capi_ctr_handle_message(), stored in the data portion of a socket buffer
+(skb).  Each skb contains a single CAPI message coded according to the CAPI 2.0
+standard.
+
+For the data transfer messages, DATA_B3_REQ and DATA_B3_IND, the actual
+payload data immediately follows the CAPI message itself within the same skb.
+The Data and Data64 parameters are not used for processing. The Data64
+parameter may be omitted by setting the length field of the CAPI message to 22
+instead of 30.
+
+
+4.4 The _cmsg Structure
 
 (declared in <linux/isdn/capiutil.h>)
 
 The _cmsg structure stores the contents of a CAPI 2.0 message in an easily
-accessible form. It contains members for all possible CAPI 2.0 parameters, of
-which only those appearing in the message type currently being processed are
-actually used. Unused members should be set to zero.
+accessible form. It contains members for all possible CAPI 2.0 parameters,
+including subparameters of the Additional Info and B Protocol structured
+parameters, with the following exceptions:
+
+* second Calling party number (CONNECT_IND)
+
+* Data64 (DATA_B3_REQ and DATA_B3_IND)
+
+* Sending complete (subparameter of Additional Info, CONNECT_REQ and INFO_REQ)
+
+* Global Configuration (subparameter of B Protocol, CONNECT_REQ, CONNECT_RESP
+  and SELECT_B_PROTOCOL_REQ)
+
+Only those parameters appearing in the message type currently being processed
+are actually used. Unused members should be set to zero.
 
 Members are named after the CAPI 2.0 standard names of the parameters they
 represent. See <linux/isdn/capiutil.h> for the exact spelling. Member data
@@ -190,18 +217,19 @@ u16         for CAPI parameters of type 'word'
 
 u32         for CAPI parameters of type 'dword'
 
-_cstruct    for CAPI parameters of type 'struct' not containing any
-            variably-sized (struct) subparameters (eg. 'Called Party Number')
+_cstruct    for CAPI parameters of type 'struct'
             The member is a pointer to a buffer containing the parameter in
             CAPI encoding (length + content). It may also be NULL, which will
             be taken to represent an empty (zero length) parameter.
+            Subparameters are stored in encoded form within the content part.
 
-_cmstruct   for CAPI parameters of type 'struct' containing 'struct'
-            subparameters ('Additional Info' and 'B Protocol')
+_cmstruct   alternative representation for CAPI parameters of type 'struct'
+            (used only for the 'Additional Info' and 'B Protocol' parameters)
             The representation is a single byte containing one of the values:
-            CAPI_DEFAULT: the parameter is empty
-            CAPI_COMPOSE: the values of the subparameters are stored
-            individually in the corresponding _cmsg structure members
+            CAPI_DEFAULT: The parameter is empty/absent.
+            CAPI_COMPOSE: The parameter is present.
+            Subparameter values are stored individually in the corresponding
+            _cmsg structure members.
 
 Functions capi_cmsg2message() and capi_message2cmsg() are provided to convert
 messages between their transport encoding described in the CAPI 2.0 standard
@@ -297,3 +325,26 @@ char *capi_cmd2str(u8 Command, u8 Subcommand)
         be NULL if the command/subcommand is not one of those defined in the
         CAPI 2.0 standard.
 
+
+7. Debugging
+
+The module kernelcapi has a module parameter showcapimsgs controlling some
+debugging output produced by the module. It can only be set when the module is
+loaded, via a parameter "showcapimsgs=<n>" to the modprobe command, either on
+the command line or in the configuration file.
+
+If the lowest bit of showcapimsgs is set, kernelcapi logs controller and
+application up and down events.
+
+In addition, every registered CAPI controller has an associated traceflag
+parameter controlling how CAPI messages sent from and to tha controller are
+logged. The traceflag parameter is initialized with the value of the
+showcapimsgs parameter when the controller is registered, but can later be
+changed via the MANUFACTURER_REQ command KCAPI_CMD_TRACE.
+
+If the value of traceflag is non-zero, CAPI messages are logged.
+DATA_B3 messages are only logged if the value of traceflag is > 2.
+
+If the lowest bit of traceflag is set, only the command/subcommand and message
+length are logged. Otherwise, kernelcapi logs a readable representation of
+the entire message.
diff --git a/Documentation/networking/pktgen.txt b/Documentation/networking/pktgen.txt
index c6cf4a3c16e0..61bb645d50e0 100644
--- a/Documentation/networking/pktgen.txt
+++ b/Documentation/networking/pktgen.txt
@@ -90,6 +90,11 @@ Examples:
  pgset "dstmac 00:00:00:00:00:00"    sets MAC destination address
  pgset "srcmac 00:00:00:00:00:00"    sets MAC source address
 
+ pgset "queue_map_min 0" Sets the min value of tx queue interval
+ pgset "queue_map_max 7" Sets the max value of tx queue interval, for multiqueue devices
+                         To select queue 1 of a given device,
+                         use queue_map_min=1 and queue_map_max=1
+
  pgset "src_mac_count 1" Sets the number of MACs we'll range through.  
                          The 'minimum' MAC is what you set with srcmac.
 
@@ -101,6 +106,9 @@ Examples:
                               IPDST_RND, UDPSRC_RND,
                               UDPDST_RND, MACSRC_RND, MACDST_RND 
                               MPLS_RND, VID_RND, SVID_RND
+                              QUEUE_MAP_RND # queue map random
+                              QUEUE_MAP_CPU # queue map mirrors smp_processor_id()
+
 
  pgset "udp_src_min 9"   set UDP source port min, If < udp_src_max, then
                          cycle through the port range.
diff --git a/MAINTAINERS b/MAINTAINERS
index 571900efeb26..e1da925b38c8 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3643,6 +3643,13 @@ F:	Documentation/blockdev/nbd.txt
 F:      drivers/block/nbd.c
 F:      include/linux/nbd.h
 
+NETWORK DROP MONITOR
+M:      Neil Horman <nhorman@tuxdriver.com>
+L:      netdev@vger.kernel.org
+S:      Maintained
+W:      https://fedorahosted.org/dropwatch/
+F:      net/core/drop_monitor.c
+
 NETWORKING [GENERAL]
 M:      "David S. Miller" <davem@davemloft.net>
 L:      netdev@vger.kernel.org
diff --git a/drivers/connector/cn_proc.c b/drivers/connector/cn_proc.c
index abf4a2529f80..60697909ebdb 100644
--- a/drivers/connector/cn_proc.c
+++ b/drivers/connector/cn_proc.c
@@ -227,7 +227,8 @@ static void cn_proc_ack(int err, int rcvd_seq, int rcvd_ack)
  * cn_proc_mcast_ctl
  * @data: message sent from userspace via the connector
  */
-static void cn_proc_mcast_ctl(struct cn_msg *msg)
+static void cn_proc_mcast_ctl(struct cn_msg *msg,
+                              struct netlink_skb_parms *nsp)
 {
         enum proc_cn_mcast_op *mc_op = NULL;
         int err = 0;
diff --git a/drivers/isdn/capi/capi.c b/drivers/isdn/capi/capi.c
index 2d8352419c0d..65bf91e16a42 100644
--- a/drivers/isdn/capi/capi.c
+++ b/drivers/isdn/capi/capi.c
@@ -603,7 +603,7 @@ static void capi_recv_message(struct capi20_appl *ap, struct sk_buff *skb)
 
         if (CAPIMSG_CMD(skb->data) == CAPI_CONNECT_B3_CONF) {
                 u16 info = CAPIMSG_U16(skb->data, 12); // Info field
-                if (info == 0) {
+                if ((info & 0xff00) == 0) {
                         mutex_lock(&cdev->ncci_list_mtx);
                         capincci_alloc(cdev, CAPIMSG_NCCI(skb->data));
                         mutex_unlock(&cdev->ncci_list_mtx);
diff --git a/drivers/isdn/capi/capidrv.c b/drivers/isdn/capi/capidrv.c
index 650120261abf..3e6d17f42a98 100644
--- a/drivers/isdn/capi/capidrv.c
+++ b/drivers/isdn/capi/capidrv.c
@@ -40,7 +40,7 @@ static int debugmode = 0;
 MODULE_DESCRIPTION("CAPI4Linux: Interface to ISDN4Linux");
 MODULE_AUTHOR("Carsten Paeth");
 MODULE_LICENSE("GPL");
-module_param(debugmode, uint, 0);
+module_param(debugmode, uint, S_IRUGO|S_IWUSR);
 
 /* -------- type definitions ----------------------------------------- */
 
@@ -671,8 +671,8 @@ static void n0(capidrv_contr * card, capidrv_ncci * ncci)
                                  NULL,  /* Useruserdata */   /* $$$$ */
                                  NULL   /* Facilitydataarray */
         );
-        send_message(card, &cmsg);
         plci_change_state(card, ncci->plcip, EV_PLCI_DISCONNECT_REQ);
+        send_message(card, &cmsg);
 
         cmd.command = ISDN_STAT_BHUP;
         cmd.driver = card->myid;
@@ -924,8 +924,8 @@ static void handle_incoming_call(capidrv_contr * card, _cmsg * cmsg)
                  */
                 capi_cmsg_answer(cmsg);
                 cmsg->Reject = 1;       /* ignore */
-                send_message(card, cmsg);
                 plci_change_state(card, plcip, EV_PLCI_CONNECT_REJECT);
+                send_message(card, cmsg);
                 printk(KERN_INFO "capidrv-%d: incoming call %s,%d,%d,%s ignored\n",
                         card->contrnr,
                         cmd.parm.setup.phone,
@@ -974,8 +974,8 @@ static void handle_incoming_call(capidrv_contr * card, _cmsg * cmsg)
         case 2:         /* Call will be rejected. */
                 capi_cmsg_answer(cmsg);
                 cmsg->Reject = 2;       /* reject call, normal call clearing */
-                send_message(card, cmsg);
                 plci_change_state(card, plcip, EV_PLCI_CONNECT_REJECT);
+                send_message(card, cmsg);
                 break;
 
         default:
@@ -983,8 +983,8 @@ static void handle_incoming_call(capidrv_contr * card, _cmsg * cmsg)
                 capi_cmsg_answer(cmsg);
                 cmsg->Reject = 8;       /* reject call,
                                            destination out of order */
-                send_message(card, cmsg);
                 plci_change_state(card, plcip, EV_PLCI_CONNECT_REJECT);
+                send_message(card, cmsg);
                 break;
         }
         return;
@@ -1020,8 +1020,8 @@ static void handle_plci(_cmsg * cmsg)
                 card->bchans[plcip->chan].disconnecting = 1;
                 plci_change_state(card, plcip, EV_PLCI_DISCONNECT_IND);
                 capi_cmsg_answer(cmsg);
-                send_message(card, cmsg);
                 plci_change_state(card, plcip, EV_PLCI_DISCONNECT_RESP);
+                send_message(card, cmsg);
                 break;
 
         case CAPI_DISCONNECT_CONF:      /* plci */
@@ -1078,8 +1078,8 @@ static void handle_plci(_cmsg * cmsg)
 
                 if (card->bchans[plcip->chan].incoming) {
                         capi_cmsg_answer(cmsg);
-                        send_message(card, cmsg);
                         plci_change_state(card, plcip, EV_PLCI_CONNECT_ACTIVE_IND);
+                        send_message(card, cmsg);
                 } else {
                         capidrv_ncci *nccip;
                         capi_cmsg_answer(cmsg);
@@ -1098,13 +1098,14 @@ static void handle_plci(_cmsg * cmsg)
                                                  NULL   /* NCPI */
                         );
                         nccip->msgid = cmsg->Messagenumber;
+                        plci_change_state(card, plcip,
+                                          EV_PLCI_CONNECT_ACTIVE_IND);
+                        ncci_change_state(card, nccip, EV_NCCI_CONNECT_B3_REQ);
                         send_message(card, cmsg);
                         cmd.command = ISDN_STAT_DCONN;
                         cmd.driver = card->myid;
                         cmd.arg = plcip->chan;
                         card->interface.statcallb(&cmd);
-                        plci_change_state(card, plcip, EV_PLCI_CONNECT_ACTIVE_IND);
-                        ncci_change_state(card, nccip, EV_NCCI_CONNECT_B3_REQ);
                 }
                 break;
 
@@ -1193,8 +1194,8 @@ static void handle_ncci(_cmsg * cmsg)
                         goto notfound;
 
                 capi_cmsg_answer(cmsg);
-                send_message(card, cmsg);
                 ncci_change_state(card, nccip, EV_NCCI_CONNECT_B3_ACTIVE_IND);
+                send_message(card, cmsg);
 
                 cmd.command = ISDN_STAT_BCONN;
                 cmd.driver = card->myid;
@@ -1222,8 +1223,8 @@ static void handle_ncci(_cmsg * cmsg)
                                                           0,    /* Reject */
                                                           NULL  /* NCPI */
                                 );
-                                send_message(card, cmsg);
                                 ncci_change_state(card, nccip, EV_NCCI_CONNECT_B3_RESP);
+                                send_message(card, cmsg);
                                 break;
                         }
                         printk(KERN_ERR "capidrv-%d: no mem for ncci, sorry\n",                                                 card->contrnr);
@@ -1299,8 +1300,8 @@ static void handle_ncci(_cmsg * cmsg)
                 card->bchans[nccip->chan].disconnecting = 1;
                 ncci_change_state(card, nccip, EV_NCCI_DISCONNECT_B3_IND);
                 capi_cmsg_answer(cmsg);
-                send_message(card, cmsg);
                 ncci_change_state(card, nccip, EV_NCCI_DISCONNECT_B3_RESP);
+                send_message(card, cmsg);
                 break;
 
         case CAPI_DISCONNECT_B3_CONF:   /* ncci */
@@ -2014,8 +2015,8 @@ static void send_listen(capidrv_contr *card)
                              card->cipmask,
                              card->cipmask2,
                              NULL, NULL);
-        send_message(card, &cmdcmsg);
         listen_change_state(card, EV_LISTEN_REQ);
+        send_message(card, &cmdcmsg);
 }
 
 static void listentimerfunc(unsigned long x)
diff --git a/drivers/isdn/gigaset/asyncdata.c b/drivers/isdn/gigaset/asyncdata.c
index 234cc5d53312..44a58e6f8f65 100644
--- a/drivers/isdn/gigaset/asyncdata.c
+++ b/drivers/isdn/gigaset/asyncdata.c
@@ -334,7 +334,14 @@ static inline int iraw_loop(unsigned char c, unsigned char *src, int numbytes,
         return startbytes - numbytes;
 }
 
-/* process a block of data received from the device
+/**
+ * gigaset_m10x_input() - process a block of data received from the device
+ * @inbuf:      received data and device descriptor structure.
+ *
+ * Called by hardware module {ser,usb}_gigaset with a block of received
+ * bytes. Separates the bytes received over the serial data channel into
+ * user data and command replies (locked/unlocked) according to the
+ * current state of the interface.
  */
 void gigaset_m10x_input(struct inbuf_t *inbuf)
 {
@@ -543,16 +550,17 @@ static struct sk_buff *iraw_encode(struct sk_buff *skb, int head, int tail)
         return iraw_skb;
 }
 
-/* gigaset_send_skb
- * called by common.c to queue an skb for sending
- * and start transmission if necessary
- * parameters:
- *      B Channel control structure
- *      skb
+/**
+ * gigaset_m10x_send_skb() - queue an skb for sending
+ * @bcs:        B channel descriptor structure.
+ * @skb:        data to send.
+ *
+ * Called by i4l.c to encode and queue an skb for sending, and start
+ * transmission if necessary.
+ *
  * Return value:
- *      number of bytes accepted for sending
- *      (skb->len if ok, 0 if out of buffer space)
- *      or error code (< 0, eg. -EINVAL)
+ *      number of bytes accepted for sending (skb->len) if ok,
+ *      error code < 0 (eg. -ENOMEM) on error
  */
 int gigaset_m10x_send_skb(struct bc_state *bcs, struct sk_buff *skb)
 {
diff --git a/drivers/isdn/gigaset/bas-gigaset.c b/drivers/isdn/gigaset/bas-gigaset.c
index 781c4041f7b0..5ed1d99eb9f3 100644
--- a/drivers/isdn/gigaset/bas-gigaset.c
+++ b/drivers/isdn/gigaset/bas-gigaset.c
@@ -134,6 +134,7 @@ struct bas_cardstate {
 #define BS_ATRDPEND     0x040   /* urb_cmd_in in use */
 #define BS_ATWRPEND     0x080   /* urb_cmd_out in use */
 #define BS_SUSPEND      0x100   /* USB port suspended */
+#define BS_RESETTING    0x200   /* waiting for HD_RESET_INTERRUPT_PIPE_ACK */
 
 
 static struct gigaset_driver *driver = NULL;
@@ -319,6 +320,21 @@ static int gigaset_set_line_ctrl(struct cardstate *cs, unsigned cflag)
         return -EINVAL;
 }
 
+/* set/clear bits in base connection state, return previous state
+ */
+static inline int update_basstate(struct bas_cardstate *ucs,
+                                  int set, int clear)
+{
+        unsigned long flags;
+        int state;
+
+        spin_lock_irqsave(&ucs->lock, flags);
+        state = ucs->basstate;
+        ucs->basstate = (state & ~clear) | set;
+        spin_unlock_irqrestore(&ucs->lock, flags);
+        return state;
+}
+
 /* error_hangup
  * hang up any existing connection because of an unrecoverable error
  * This function may be called from any context and takes care of scheduling
@@ -350,12 +366,9 @@ static inline void error_hangup(struct bc_state *bcs)
  */
 static inline void error_reset(struct cardstate *cs)
 {
-        /* close AT command channel to recover (ignore errors) */
-        req_submit(cs->bcs, HD_CLOSE_ATCHANNEL, 0, BAS_TIMEOUT);
-
-        //FIXME try to recover without bothering the user
-        dev_err(cs->dev,
-            "unrecoverable error - please disconnect Gigaset base to reset\n");
+        /* reset interrupt pipe to recover (ignore errors) */
+        update_basstate(cs->hw.bas, BS_RESETTING, 0);
+        req_submit(cs->bcs, HD_RESET_INTERRUPT_PIPE, 0, BAS_TIMEOUT);
 }
 
 /* check_pending
@@ -398,8 +411,13 @@ static void check_pending(struct bas_cardstate *ucs)
         case HD_DEVICE_INIT_ACK:                /* no reply expected */
                 ucs->pending = 0;
                 break;
-        /* HD_READ_ATMESSAGE, HD_WRITE_ATMESSAGE, HD_RESET_INTERRUPTPIPE
-         * are handled separately and should never end up here
+        case HD_RESET_INTERRUPT_PIPE:
+                if (!(ucs->basstate & BS_RESETTING))
+                        ucs->pending = 0;
+                break;
+        /*
+         * HD_READ_ATMESSAGE and HD_WRITE_ATMESSAGE are handled separately
+         * and should never end up here
          */
         default:
                 dev_warn(&ucs->interface->dev,
@@ -449,21 +467,6 @@ static void cmd_in_timeout(unsigned long data)
         error_reset(cs);
 }
 
-/* set/clear bits in base connection state, return previous state
- */
-inline static int update_basstate(struct bas_cardstate *ucs,
-                                  int set, int clear)
-{
-        unsigned long flags;
-        int state;
-
-        spin_lock_irqsave(&ucs->lock, flags);
-        state = ucs->basstate;
-        ucs->basstate = (state & ~clear) | set;
-        spin_unlock_irqrestore(&ucs->lock, flags);
-        return state;
-}
-
 /* read_ctrl_callback
  * USB completion handler for control pipe input
  * called by the USB subsystem in interrupt context
@@ -762,7 +765,8 @@ static void read_int_callback(struct urb *urb)
                 break;
 
         case HD_RESET_INTERRUPT_PIPE_ACK:
-                gig_dbg(DEBUG_USBREQ, "HD_RESET_INTERRUPT_PIPE_ACK");
+                update_basstate(ucs, 0, BS_RESETTING);
+                dev_notice(cs->dev, "interrupt pipe reset\n");
                 break;
 
         case HD_SUSPEND_END:
@@ -1331,28 +1335,24 @@ static void read_iso_tasklet(unsigned long data)
                 rcvbuf = urb->transfer_buffer;
                 totleft = urb->actual_length;
                 for (frame = 0; totleft > 0 && frame < BAS_NUMFRAMES; frame++) {
-                        if (unlikely(urb->iso_frame_desc[frame].status)) {
+                        numbytes = urb->iso_frame_desc[frame].actual_length;
+                        if (unlikely(urb->iso_frame_desc[frame].status))
                                 dev_warn(cs->dev,
-                                         "isochronous read: frame %d: %s\n",
-                                         frame,
+                                         "isochronous read: frame %d[%d]: %s\n",
+                                         frame, numbytes,
                                          get_usb_statmsg(
                                             urb->iso_frame_desc[frame].status));
-                                break;
-                        }
-                        numbytes = urb->iso_frame_desc[frame].actual_length;
-                        if (unlikely(numbytes > BAS_MAXFRAME)) {
+                        if (unlikely(numbytes > BAS_MAXFRAME))
                                 dev_warn(cs->dev,
                                          "isochronous read: frame %d: "
                                          "numbytes (%d) > BAS_MAXFRAME\n",
                                          frame, numbytes);
-                                break;
-                        }
                         if (unlikely(numbytes > totleft)) {
                                 dev_warn(cs->dev,
                                          "isochronous read: frame %d: "
                                          "numbytes (%d) > totleft (%d)\n",
                                          frame, numbytes, totleft);
-                                break;
+                                numbytes = totleft;
                         }
                         offset = urb->iso_frame_desc[frame].offset;
                         if (unlikely(offset + numbytes > BAS_INBUFSIZE)) {
@@ -1361,7 +1361,7 @@ static void read_iso_tasklet(unsigned long data)
                                          "offset (%d) + numbytes (%d) "
                                          "> BAS_INBUFSIZE\n",
                                          frame, offset, numbytes);
-                                break;
+                                numbytes = BAS_INBUFSIZE - offset;
                         }
                         gigaset_isoc_receive(rcvbuf + offset, numbytes, bcs);
                         totleft -= numbytes;
@@ -1433,6 +1433,7 @@ static void req_timeout(unsigned long data)
 
         case HD_CLOSE_ATCHANNEL:
                 dev_err(bcs->cs->dev, "timeout closing AT channel\n");
+                error_reset(bcs->cs);
                 break;
 
         case HD_CLOSE_B2CHANNEL:
@@ -1442,6 +1443,13 @@ static void req_timeout(unsigned long data)
                 error_reset(bcs->cs);
                 break;
 
+        case HD_RESET_INTERRUPT_PIPE:
+                /* error recovery escalation */
+                dev_err(bcs->cs->dev,
+                        "reset interrupt pipe timeout, attempting USB reset\n");
+                usb_queue_reset_device(bcs->cs->hw.bas->interface);
+                break;
+
         default:
                 dev_warn(bcs->cs->dev, "request 0x%02x timed out, clearing\n",
                          pending);
@@ -1934,6 +1942,15 @@ static int gigaset_write_cmd(struct cardstate *cs,
                 goto notqueued;
         }
 
+        /* translate "+++" escape sequence sent as a single separate command
+         * into "close AT channel" command for error recovery
+         * The next command will reopen the AT channel automatically.
+         */
+        if (len == 3 && !memcmp(buf, "+++", 3)) {
+                rc = req_submit(cs->bcs, HD_CLOSE_ATCHANNEL, 0, BAS_TIMEOUT);
+                goto notqueued;
+        }
+
         if (len > IF_WRITEBUF)
                 len = IF_WRITEBUF;
         if (!(cb = kmalloc(sizeof(struct cmdbuf_t) + len, GFP_ATOMIC))) {
diff --git a/drivers/isdn/gigaset/common.c b/drivers/isdn/gigaset/common.c
index e4141bf8b2f3..33dcd8d72b7c 100644
--- a/drivers/isdn/gigaset/common.c
+++ b/drivers/isdn/gigaset/common.c
@@ -22,6 +22,12 @@
 #define DRIVER_AUTHOR "Hansjoerg Lipp <hjlipp@web.de>, Tilman Schmidt <tilman@imap.cc>, Stefan Eilers"
 #define DRIVER_DESC "Driver for Gigaset 307x"
 
+#ifdef CONFIG_GIGASET_DEBUG
+#define DRIVER_DESC_DEBUG " (debug build)"
+#else
+#define DRIVER_DESC_DEBUG ""
+#endif
+
 /* Module parameters */
 int gigaset_debuglevel = DEBUG_DEFAULT;
 EXPORT_SYMBOL_GPL(gigaset_debuglevel);
@@ -32,6 +38,17 @@ MODULE_PARM_DESC(debug, "debug level");
 #define VALID_MINOR     0x01
 #define VALID_ID        0x02
 
+/**
+ * gigaset_dbg_buffer() - dump data in ASCII and hex for debugging
+ * @level:      debugging level.
+ * @msg:        message prefix.
+ * @len:        number of bytes to dump.
+ * @buf:        data to dump.
+ *
+ * If the current debugging level includes one of the bits set in @level,
+ * @len bytes starting at @buf are logged to dmesg at KERN_DEBUG prio,
+ * prefixed by the text @msg.
+ */
 void gigaset_dbg_buffer(enum debuglevel level, const unsigned char *msg,
                         size_t len, const unsigned char *buf)
 {
@@ -274,6 +291,20 @@ static void clear_events(struct cardstate *cs)
         spin_unlock_irqrestore(&cs->ev_lock, flags);
 }
 
+/**
+ * gigaset_add_event() - add event to device event queue
+ * @cs:         device descriptor structure.
+ * @at_state:   connection state structure.
+ * @type:       event type.
+ * @ptr:        pointer parameter for event.
+ * @parameter:  integer parameter for event.
+ * @arg:        pointer parameter for event.
+ *
+ * Allocate an event queue entry from the device's event queue, and set it up
+ * with the parameters given.
+ *
+ * Return value: added event
+ */
 struct event_t *gigaset_add_event(struct cardstate *cs,
                                   struct at_state_t *at_state, int type,
                                   void *ptr, int parameter, void *arg)
@@ -398,6 +429,15 @@ static void make_invalid(struct cardstate *cs, unsigned mask)
         spin_unlock_irqrestore(&drv->lock, flags);
 }
 
+/**
+ * gigaset_freecs() - free all associated ressources of a device
+ * @cs:         device descriptor structure.
+ *
+ * Stops all tasklets and timers, unregisters the device from all
+ * subsystems it was registered to, deallocates the device structure
+ * @cs and all structures referenced from it.
+ * Operations on the device should be stopped before calling this.
+ */
 void gigaset_freecs(struct cardstate *cs)
 {
         int i;
@@ -506,7 +546,12 @@ static void gigaset_inbuf_init(struct inbuf_t *inbuf, struct bc_state *bcs,
         inbuf->inputstate = inputstate;
 }
 
-/* append received bytes to inbuf */
+/**
+ * gigaset_fill_inbuf() - append received data to input buffer
+ * @inbuf:      buffer structure.
+ * @src:        received data.
+ * @numbytes:   number of bytes received.
+ */
 int gigaset_fill_inbuf(struct inbuf_t *inbuf, const unsigned char *src,
                        unsigned numbytes)
 {
@@ -606,20 +651,22 @@ static struct bc_state *gigaset_initbcs(struct bc_state *bcs,
         return NULL;
 }
 
-/* gigaset_initcs
+/**
+ * gigaset_initcs() - initialize device structure
+ * @drv:        hardware driver the device belongs to
+ * @channels:   number of B channels supported by device
+ * @onechannel: !=0 if B channel data and AT commands share one
+ *                  communication channel (M10x),
+ *              ==0 if B channels have separate communication channels (base)
+ * @ignoreframes:       number of frames to ignore after setting up B channel
+ * @cidmode:    !=0: start in CallID mode
+ * @modulename: name of driver module for LL registration
+ *
  * Allocate and initialize cardstate structure for Gigaset driver
  * Calls hardware dependent gigaset_initcshw() function
  * Calls B channel initialization function gigaset_initbcs() for each B channel
- * parameters:
- *      drv             hardware driver the device belongs to
- *      channels        number of B channels supported by device
- *      onechannel      !=0: B channel data and AT commands share one
- *                           communication channel
- *                      ==0: B channels have separate communication channels
- *      ignoreframes    number of frames to ignore after setting up B channel
- *      cidmode         !=0: start in CallID mode
- *      modulename      name of driver module (used for I4L registration)
- * return value:
+ *
+ * Return value:
  *      pointer to cardstate structure
  */
 struct cardstate *gigaset_initcs(struct gigaset_driver *drv, int channels,
@@ -837,6 +884,17 @@ static void cleanup_cs(struct cardstate *cs)
 }
 
 
+/**
+ * gigaset_start() - start device operations
+ * @cs:         device descriptor structure.
+ *
+ * Prepares the device for use by setting up communication parameters,
+ * scheduling an EV_START event to initiate device initialization, and
+ * waiting for completion of the initialization.
+ *
+ * Return value:
+ *      1 - success, 0 - error
+ */
 int gigaset_start(struct cardstate *cs)
 {
         unsigned long flags;
@@ -879,9 +937,15 @@ error:
 }
 EXPORT_SYMBOL_GPL(gigaset_start);
 
-/* gigaset_shutdown
- * check if a device is associated to the cardstate structure and stop it
- * return value: 0 if ok, -1 if no device was associated
+/**
+ * gigaset_shutdown() - shut down device operations
+ * @cs:         device descriptor structure.
+ *
+ * Deactivates the device by scheduling an EV_SHUTDOWN event and
+ * waiting for completion of the shutdown.
+ *
+ * Return value:
+ *      0 - success, -1 - error (no device associated)
  */
 int gigaset_shutdown(struct cardstate *cs)
 {
@@ -912,6 +976,13 @@ exit:
 }
 EXPORT_SYMBOL_GPL(gigaset_shutdown);
 
+/**
+ * gigaset_stop() - stop device operations
+ * @cs:         device descriptor structure.
+ *
+ * Stops operations on the device by scheduling an EV_STOP event and
+ * waiting for completion of the shutdown.
+ */
 void gigaset_stop(struct cardstate *cs)
 {
         mutex_lock(&cs->mutex);
@@ -1020,6 +1091,14 @@ struct cardstate *gigaset_get_cs_by_tty(struct tty_struct *tty)
         return gigaset_get_cs_by_minor(tty->index + tty->driver->minor_start);
 }
 
+/**
+ * gigaset_freedriver() - free all associated ressources of a driver
+ * @drv:        driver descriptor structure.
+ *
+ * Unregisters the driver from the system and deallocates the driver
+ * structure @drv and all structures referenced from it.
+ * All devices should be shut down before calling this.
+ */
 void gigaset_freedriver(struct gigaset_driver *drv)
 {
         unsigned long flags;
@@ -1035,14 +1114,16 @@ void gigaset_freedriver(struct gigaset_driver *drv)
 }
 EXPORT_SYMBOL_GPL(gigaset_freedriver);
 
-/* gigaset_initdriver
+/**
+ * gigaset_initdriver() - initialize driver structure
+ * @minor:      First minor number
+ * @minors:     Number of minors this driver can handle
+ * @procname:   Name of the driver
+ * @devname:    Name of the device files (prefix without minor number)
+ *
  * Allocate and initialize gigaset_driver structure. Initialize interface.
- * parameters:
- *      minor           First minor number
- *      minors          Number of minors this driver can handle
- *      procname        Name of the driver
- *      devname         Name of the device files (prefix without minor number)
- * return value:
+ *
+ * Return value:
  *      Pointer to the gigaset_driver structure on success, NULL on failure.
  */
 struct gigaset_driver *gigaset_initdriver(unsigned minor, unsigned minors,
@@ -1095,6 +1176,13 @@ error:
 }
 EXPORT_SYMBOL_GPL(gigaset_initdriver);
 
+/**
+ * gigaset_blockdriver() - block driver
+ * @drv:        driver descriptor structure.
+ *
+ * Prevents the driver from attaching new devices, in preparation for
+ * deregistration.
+ */
 void gigaset_blockdriver(struct gigaset_driver *drv)
 {
         drv->blocked = 1;
@@ -1110,7 +1198,7 @@ static int __init gigaset_init_module(void)
         if (gigaset_debuglevel == 1)
                 gigaset_debuglevel = DEBUG_DEFAULT;
 
-        pr_info(DRIVER_DESC "\n");
+        pr_info(DRIVER_DESC DRIVER_DESC_DEBUG "\n");
         return 0;
 }
 
diff --git a/drivers/isdn/gigaset/ev-layer.c b/drivers/isdn/gigaset/ev-layer.c
index 2d91049571a4..cc768caa38f5 100644
--- a/drivers/isdn/gigaset/ev-layer.c
+++ b/drivers/isdn/gigaset/ev-layer.c
@@ -207,7 +207,6 @@ struct reply_t gigaset_tab_nocid[] =
         /* leave dle mode */
         {RSP_INIT,      0,  0,SEQ_DLE0,           201, 5, {0},             "^SDLE=0\r"},
         {RSP_OK,      201,201, -1,                202,-1},
-        //{RSP_ZDLE,    202,202,  0,                202, 0, {ACT_ERROR}},//DELETE
         {RSP_ZDLE,    202,202,  0,                  0, 0, {ACT_DLE0}},
         {RSP_NODEV,   200,249, -1,                  0, 0, {ACT_FAKEDLE0}},
         {RSP_ERROR,   200,249, -1,                  0, 0, {ACT_FAILDLE0}},
@@ -265,6 +264,7 @@ struct reply_t gigaset_tab_nocid[] =
         {EV_SHUTDOWN,  -1, -1, -1,                 -1,-1, {ACT_SHUTDOWN}}, //FIXME
 
         /* misc. */
+        {RSP_ERROR,    -1, -1, -1,                 -1, -1, {ACT_ERROR} },
         {RSP_EMPTY,    -1, -1, -1,                 -1,-1, {ACT_DEBUG}}, //FIXME
         {RSP_ZCFGT,    -1, -1, -1,                 -1,-1, {ACT_DEBUG}}, //FIXME
         {RSP_ZCFG,     -1, -1, -1,                 -1,-1, {ACT_DEBUG}}, //FIXME
@@ -328,10 +328,9 @@ struct reply_t gigaset_tab_cid[] =
         {RSP_INIT,     -1, -1,SEQ_HUP,            401, 5, {0},             "+VLS=0\r"}, /* hang up */ //-1,-1?
         {RSP_OK,      401,401, -1,                402, 5},
         {RSP_ZVLS,    402,402,  0,                403, 5},
-        {RSP_ZSAU,    403,403,ZSAU_DISCONNECT_REQ, -1,-1, {ACT_DEBUG}}, /* if not remote hup */
-        //{RSP_ZSAU,    403,403,ZSAU_NULL,          401, 0, {ACT_ERROR}}, //DELETE//FIXME -> DLE0 // should we do this _before_ hanging up for base driver?
-        {RSP_ZSAU,    403,403,ZSAU_NULL,            0, 0, {ACT_DISCONNECT}}, //FIXME -> DLE0 // should we do this _before_ hanging up for base driver?
-        {RSP_NODEV,   401,403, -1,                  0, 0, {ACT_FAKEHUP}}, //FIXME -> DLE0 // should we do this _before_ hanging up for base driver?
+        {RSP_ZSAU,    403, 403, ZSAU_DISCONNECT_REQ, -1, -1, {ACT_DEBUG} },
+        {RSP_ZSAU,    403, 403, ZSAU_NULL,            0,  0, {ACT_DISCONNECT} },
+        {RSP_NODEV,   401, 403, -1,                   0,  0, {ACT_FAKEHUP} },
         {RSP_ERROR,   401,401, -1,                  0, 0, {ACT_ABORTHUP}},
         {EV_TIMEOUT,  401,403, -1,                  0, 0, {ACT_ABORTHUP}},
 
@@ -474,8 +473,13 @@ static int cid_of_response(char *s)
         //FIXME is ;<digit>+ at end of non-CID response really impossible?
 }
 
-/* This function will be called via task queue from the callback handler.
- * We received a modem response and have to handle it..
+/**
+ * gigaset_handle_modem_response() - process received modem response
+ * @cs:         device descriptor structure.
+ *
+ * Called by asyncdata/isocdata if a block of data received from the
+ * device must be processed as a modem command response. The data is
+ * already in the cs structure.
  */
 void gigaset_handle_modem_response(struct cardstate *cs)
 {
@@ -707,6 +711,11 @@ static void disconnect(struct at_state_t **at_state_p)
         if (bcs) {
                 /* B channel assigned: invoke hardware specific handler */
                 cs->ops->close_bchannel(bcs);
+                /* notify LL */
+                if (bcs->chstate & (CHS_D_UP | CHS_NOTIFY_LL)) {
+                        bcs->chstate &= ~(CHS_D_UP | CHS_NOTIFY_LL);
+                        gigaset_i4l_channel_cmd(bcs, ISDN_STAT_DHUP);
+                }
         } else {
                 /* no B channel assigned: just deallocate */
                 spin_lock_irqsave(&cs->lock, flags);
@@ -1429,11 +1438,12 @@ static void do_action(int action, struct cardstate *cs,
                 cs->gotfwver = -1;
                 dev_err(cs->dev, "could not read firmware version.\n");
                 break;
-#ifdef CONFIG_GIGASET_DEBUG
         case ACT_ERROR:
-                *p_genresp = 1;
-                *p_resp_code = RSP_ERROR;
+                gig_dbg(DEBUG_ANY, "%s: ERROR response in ConState %d",
+                        __func__, at_state->ConState);
+                cs->cur_at_seq = SEQ_NONE;
                 break;
+#ifdef CONFIG_GIGASET_DEBUG
         case ACT_TEST:
                 {
                         static int count = 3; //2; //1;
diff --git a/drivers/isdn/gigaset/i4l.c b/drivers/isdn/gigaset/i4l.c
index 9b22f9cf2f33..654489d836cd 100644
--- a/drivers/isdn/gigaset/i4l.c
+++ b/drivers/isdn/gigaset/i4l.c
@@ -51,6 +51,12 @@ static int writebuf_from_LL(int driverID, int channel, int ack,
                 return -ENODEV;
         }
         bcs = &cs->bcs[channel];
+
+        /* can only handle linear sk_buffs */
+        if (skb_linearize(skb) < 0) {
+                dev_err(cs->dev, "%s: skb_linearize failed\n", __func__);
+                return -ENOMEM;
+        }
         len = skb->len;
 
         gig_dbg(DEBUG_LLDATA,
@@ -79,6 +85,14 @@ static int writebuf_from_LL(int driverID, int channel, int ack,
         return cs->ops->send_skb(bcs, skb);
 }
 
+/**
+ * gigaset_skb_sent() - acknowledge sending an skb
+ * @bcs:        B channel descriptor structure.
+ * @skb:        sent data.
+ *
+ * Called by hardware module {bas,ser,usb}_gigaset when the data in a
+ * skb has been successfully sent, for signalling completion to the LL.
+ */
 void gigaset_skb_sent(struct bc_state *bcs, struct sk_buff *skb)
 {
         unsigned len;
@@ -455,6 +469,15 @@ int gigaset_isdn_setup_accept(struct at_state_t *at_state)
         return 0;
 }
 
+/**
+ * gigaset_isdn_icall() - signal incoming call
+ * @at_state:   connection state structure.
+ *
+ * Called by main module to notify the LL that an incoming call has been
+ * received. @at_state contains the parameters of the call.
+ *
+ * Return value: call disposition (ICALL_*)
+ */
 int gigaset_isdn_icall(struct at_state_t *at_state)
 {
         struct cardstate *cs = at_state->cs;
diff --git a/drivers/isdn/gigaset/interface.c b/drivers/isdn/gigaset/interface.c
index f33ac27de643..6a8e1384e7bd 100644
--- a/drivers/isdn/gigaset/interface.c
+++ b/drivers/isdn/gigaset/interface.c
@@ -616,6 +616,15 @@ void gigaset_if_free(struct cardstate *cs)
         tty_unregister_device(drv->tty, cs->minor_index);
 }
 
+/**
+ * gigaset_if_receive() - pass a received block of data to the tty device
+ * @cs:         device descriptor structure.
+ * @buffer:     received data.
+ * @len:        number of bytes received.
+ *
+ * Called by asyncdata/isocdata if a block of data received from the
+ * device must be sent to userspace through the ttyG* device.
+ */
 void gigaset_if_receive(struct cardstate *cs,
                         unsigned char *buffer, size_t len)
 {
diff --git a/drivers/isdn/gigaset/isocdata.c b/drivers/isdn/gigaset/isocdata.c
index bed38fcc432b..9f3ef7b4248c 100644
--- a/drivers/isdn/gigaset/isocdata.c
+++ b/drivers/isdn/gigaset/isocdata.c
@@ -429,7 +429,7 @@ static inline int hdlc_buildframe(struct isowbuf_t *iwb,
                 return -EAGAIN;
         }
 
-        dump_bytes(DEBUG_STREAM, "snd data", in, count);
+        dump_bytes(DEBUG_STREAM_DUMP, "snd data", in, count);
 
         /* bitstuff and checksum input data */
         fcs = PPP_INITFCS;
@@ -448,7 +448,6 @@ static inline int hdlc_buildframe(struct isowbuf_t *iwb,
         /* put closing flag and repeat byte for flag idle */
         isowbuf_putflag(iwb);
         end = isowbuf_donewrite(iwb);
-        dump_bytes(DEBUG_STREAM_DUMP, "isowbuf", iwb->data, end + 1);
         return end;
 }
 
@@ -482,6 +481,8 @@ static inline int trans_buildframe(struct isowbuf_t *iwb,
         }
 
         gig_dbg(DEBUG_STREAM, "put %d bytes", count);
+        dump_bytes(DEBUG_STREAM_DUMP, "snd data", in, count);
+
         write = iwb->write;
         do {
                 c = bitrev8(*in++);
@@ -583,7 +584,7 @@ static inline void hdlc_done(struct bc_state *bcs)
                 procskb->tail -= 2;
                 gig_dbg(DEBUG_ISO, "%s: good frame (%d octets)",
                         __func__, procskb->len);
-                dump_bytes(DEBUG_STREAM,
+                dump_bytes(DEBUG_STREAM_DUMP,
                            "rcv data", procskb->data, procskb->len);
                 bcs->hw.bas->goodbytes += procskb->len;
                 gigaset_rcv_skb(procskb, bcs->cs, bcs);
@@ -878,6 +879,8 @@ static inline void trans_receive(unsigned char *src, unsigned count,
                         dobytes--;
                 }
                 if (dobytes == 0) {
+                        dump_bytes(DEBUG_STREAM_DUMP,
+                                   "rcv data", skb->data, skb->len);
                         gigaset_rcv_skb(skb, bcs->cs, bcs);
                         bcs->skb = skb = dev_alloc_skb(SBUFSIZE + HW_HDR_LEN);
                         if (!skb) {
@@ -973,16 +976,17 @@ void gigaset_isoc_input(struct inbuf_t *inbuf)
 
 /* == data output ========================================================== */
 
-/* gigaset_send_skb
- * called by common.c to queue an skb for sending
- * and start transmission if necessary
- * parameters:
- *      B Channel control structure
- *      skb
- * return value:
- *      number of bytes accepted for sending
- *      (skb->len if ok, 0 if out of buffer space)
- *      or error code (< 0, eg. -EINVAL)
+/**
+ * gigaset_isoc_send_skb() - queue an skb for sending
+ * @bcs:        B channel descriptor structure.
+ * @skb:        data to send.
+ *
+ * Called by i4l.c to queue an skb for sending, and start transmission if
+ * necessary.
+ *
+ * Return value:
+ *      number of bytes accepted for sending (skb->len) if ok,
+ *      error code < 0 (eg. -ENODEV) on error
  */
 int gigaset_isoc_send_skb(struct bc_state *bcs, struct sk_buff *skb)
 {
diff --git a/drivers/net/au1000_eth.c b/drivers/net/au1000_eth.c
index fdf5937233fc..04f63c77071d 100644
--- a/drivers/net/au1000_eth.c
+++ b/drivers/net/au1000_eth.c
@@ -721,7 +721,7 @@ static inline void update_rx_stats(struct net_device *dev, u32 status)
                 ps->rx_errors++;
                 if (status & RX_MISSED_FRAME)
                         ps->rx_missed_errors++;
-                if (status & (RX_OVERLEN | RX_OVERLEN | RX_LEN_ERROR))
+                if (status & (RX_OVERLEN | RX_RUNT | RX_LEN_ERROR))
                         ps->rx_length_errors++;
                 if (status & RX_CRC_ERROR)
                         ps->rx_crc_errors++;
@@ -794,8 +794,6 @@ static int au1000_rx(struct net_device *dev)
                                         printk("rx len error\n");
                                 if (status & RX_U_CNTRL_FRAME)
                                         printk("rx u control frame\n");
-                                if (status & RX_MISSED_FRAME)
-                                        printk("rx miss\n");
                         }
                 }
                 prxd->buff_stat = (u32)(pDB->dma_addr | RX_DMA_ENABLE);
diff --git a/drivers/net/benet/be_cmds.c b/drivers/net/benet/be_cmds.c
index 79d35d122c08..89876ade5e33 100644
--- a/drivers/net/benet/be_cmds.c
+++ b/drivers/net/benet/be_cmds.c
@@ -1129,7 +1129,6 @@ int be_cmd_write_flashrom(struct be_adapter *adapter, struct be_dma_mem *cmd,
         spin_lock_bh(&adapter->mcc_lock);
 
         wrb = wrb_from_mccq(adapter);
-        req = embedded_payload(wrb);
         sge = nonembedded_sgl(wrb);
 
         be_wrb_hdr_prepare(wrb, cmd->size, false, 1);
diff --git a/drivers/net/benet/be_cmds.h b/drivers/net/benet/be_cmds.h
index 8b4c2cb9ad62..a86f917f85f4 100644
--- a/drivers/net/benet/be_cmds.h
+++ b/drivers/net/benet/be_cmds.h
@@ -62,7 +62,7 @@ enum {
         MCC_STATUS_QUEUE_FLUSHING = 0x4,
 /* The command is completing with a DMA error */
         MCC_STATUS_DMA_FAILED = 0x5,
-        MCC_STATUS_NOT_SUPPORTED = 0x66
+        MCC_STATUS_NOT_SUPPORTED = 66
 };
 
 #define CQE_STATUS_COMPL_MASK           0xFFFF
diff --git a/drivers/net/benet/be_ethtool.c b/drivers/net/benet/be_ethtool.c
index 11445df3dbc0..cda5bf2fc50a 100644
--- a/drivers/net/benet/be_ethtool.c
+++ b/drivers/net/benet/be_ethtool.c
@@ -358,7 +358,7 @@ const struct ethtool_ops be_ethtool_ops = {
         .get_rx_csum = be_get_rx_csum,
         .set_rx_csum = be_set_rx_csum,
         .get_tx_csum = ethtool_op_get_tx_csum,
-        .set_tx_csum = ethtool_op_set_tx_csum,
+        .set_tx_csum = ethtool_op_set_tx_hw_csum,
         .get_sg = ethtool_op_get_sg,
         .set_sg = ethtool_op_set_sg,
         .get_tso = ethtool_op_get_tso,
diff --git a/drivers/net/benet/be_main.c b/drivers/net/benet/be_main.c
index 2f9b50156e0c..6d5e81f7046f 100644
--- a/drivers/net/benet/be_main.c
+++ b/drivers/net/benet/be_main.c
@@ -197,7 +197,7 @@ void netdev_stats_update(struct be_adapter *adapter)
         /* no space available in linux */
         dev_stats->tx_dropped = 0;
 
-        dev_stats->multicast = port_stats->tx_multicastframes;
+        dev_stats->multicast = port_stats->rx_multicast_frames;
         dev_stats->collisions = 0;
 
         /* detailed tx_errors */
@@ -1899,8 +1899,8 @@ static void be_netdev_init(struct net_device *netdev)
         struct be_adapter *adapter = netdev_priv(netdev);
 
         netdev->features |= NETIF_F_SG | NETIF_F_HW_VLAN_RX | NETIF_F_TSO |
-                NETIF_F_HW_VLAN_TX | NETIF_F_HW_VLAN_FILTER | NETIF_F_IP_CSUM |
-                NETIF_F_IPV6_CSUM | NETIF_F_GRO;
+                NETIF_F_HW_VLAN_TX | NETIF_F_HW_VLAN_FILTER | NETIF_F_HW_CSUM |
+                NETIF_F_GRO;
 
         netdev->flags |= IFF_MULTICAST;
 
diff --git a/drivers/net/e1000e/82571.c b/drivers/net/e1000e/82571.c
index b53b40ba88a8..d1e0563a67df 100644
--- a/drivers/net/e1000e/82571.c
+++ b/drivers/net/e1000e/82571.c
@@ -1803,7 +1803,7 @@ struct e1000_info e1000_82574_info = {
                                   | FLAG_HAS_AMT
                                   | FLAG_HAS_CTRLEXT_ON_LOAD,
         .pba                    = 20,
-        .max_hw_frame_size      = ETH_FRAME_LEN + ETH_FCS_LEN,
+        .max_hw_frame_size      = DEFAULT_JUMBO,
         .get_variants           = e1000_get_variants_82571,
         .mac_ops                = &e82571_mac_ops,
         .phy_ops                = &e82_phy_ops_bm,
@@ -1820,7 +1820,7 @@ struct e1000_info e1000_82583_info = {
                                   | FLAG_HAS_AMT
                                   | FLAG_HAS_CTRLEXT_ON_LOAD,
         .pba                    = 20,
-        .max_hw_frame_size      = DEFAULT_JUMBO,
+        .max_hw_frame_size      = ETH_FRAME_LEN + ETH_FCS_LEN,
         .get_variants           = e1000_get_variants_82571,
         .mac_ops                = &e82571_mac_ops,
         .phy_ops                = &e82_phy_ops_bm,
diff --git a/drivers/net/ethoc.c b/drivers/net/ethoc.c
index b7311bc00258..34d0c69e67f7 100644
--- a/drivers/net/ethoc.c
+++ b/drivers/net/ethoc.c
@@ -19,6 +19,10 @@
 #include <linux/platform_device.h>
 #include <net/ethoc.h>
 
+static int buffer_size = 0x8000; /* 32 KBytes */
+module_param(buffer_size, int, 0);
+MODULE_PARM_DESC(buffer_size, "DMA buffer allocation size");
+
 /* register offsets */
 #define MODER           0x00
 #define INT_SOURCE      0x04
@@ -167,6 +171,7 @@
  * struct ethoc - driver-private device structure
  * @iobase:     pointer to I/O memory region
  * @membase:    pointer to buffer memory region
+ * @dma_alloc:  dma allocated buffer size
  * @num_tx:     number of send buffers
  * @cur_tx:     last send buffer written
  * @dty_tx:     last buffer actually sent
@@ -185,6 +190,7 @@
 struct ethoc {
         void __iomem *iobase;
         void __iomem *membase;
+        int dma_alloc;
 
         unsigned int num_tx;
         unsigned int cur_tx;
@@ -284,7 +290,7 @@ static int ethoc_init_ring(struct ethoc *dev)
         dev->cur_rx = 0;
 
         /* setup transmission buffers */
-        bd.addr = 0;
+        bd.addr = virt_to_phys(dev->membase);
         bd.stat = TX_BD_IRQ | TX_BD_CRC;
 
         for (i = 0; i < dev->num_tx; i++) {
@@ -295,7 +301,6 @@ static int ethoc_init_ring(struct ethoc *dev)
                 bd.addr += ETHOC_BUFSIZ;
         }
 
-        bd.addr = dev->num_tx * ETHOC_BUFSIZ;
         bd.stat = RX_BD_EMPTY | RX_BD_IRQ;
 
         for (i = 0; i < dev->num_rx; i++) {
@@ -400,8 +405,12 @@ static int ethoc_rx(struct net_device *dev, int limit)
                 if (ethoc_update_rx_stats(priv, &bd) == 0) {
                         int size = bd.stat >> 16;
                         struct sk_buff *skb = netdev_alloc_skb(dev, size);
+
+                        size -= 4; /* strip the CRC */
+                        skb_reserve(skb, 2); /* align TCP/IP header */
+
                         if (likely(skb)) {
-                                void *src = priv->membase + bd.addr;
+                                void *src = phys_to_virt(bd.addr);
                                 memcpy_fromio(skb_put(skb, size), src, size);
                                 skb->protocol = eth_type_trans(skb, dev);
                                 priv->stats.rx_packets++;
@@ -653,9 +662,9 @@ static int ethoc_open(struct net_device *dev)
         if (ret)
                 return ret;
 
-        /* calculate the number of TX/RX buffers */
-        num_bd = (dev->mem_end - dev->mem_start + 1) / ETHOC_BUFSIZ;
-        priv->num_tx = min(min_tx, num_bd / 4);
+        /* calculate the number of TX/RX buffers, maximum 128 supported */
+        num_bd = min(128, (dev->mem_end - dev->mem_start + 1) / ETHOC_BUFSIZ);
+        priv->num_tx = max(min_tx, num_bd / 4);
         priv->num_rx = num_bd - priv->num_tx;
         ethoc_write(priv, TX_BD_NUM, priv->num_tx);
 
@@ -823,7 +832,7 @@ static netdev_tx_t ethoc_start_xmit(struct sk_buff *skb, struct net_device *dev)
         else
                 bd.stat &= ~TX_BD_PAD;
 
-        dest = priv->membase + bd.addr;
+        dest = phys_to_virt(bd.addr);
         memcpy_toio(dest, skb->data, skb->len);
 
         bd.stat &= ~(TX_BD_STATS | TX_BD_LEN_MASK);
@@ -903,22 +912,19 @@ static int ethoc_probe(struct platform_device *pdev)
 
         /* obtain buffer memory space */
         res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
-        if (!res) {
-                dev_err(&pdev->dev, "cannot obtain memory space\n");
-                ret = -ENXIO;
-                goto free;
-        }
-
-        mem = devm_request_mem_region(&pdev->dev, res->start,
+        if (res) {
+                mem = devm_request_mem_region(&pdev->dev, res->start,
                         res->end - res->start + 1, res->name);
-        if (!mem) {
-                dev_err(&pdev->dev, "cannot request memory space\n");
-                ret = -ENXIO;
-                goto free;
+                if (!mem) {
+                        dev_err(&pdev->dev, "cannot request memory space\n");
+                        ret = -ENXIO;
+                        goto free;
+                }
+
+                netdev->mem_start = mem->start;
+                netdev->mem_end   = mem->end;
         }
 
-        netdev->mem_start = mem->start;
-        netdev->mem_end   = mem->end;
 
         /* obtain device IRQ number */
         res = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
@@ -933,6 +939,7 @@ static int ethoc_probe(struct platform_device *pdev)
         /* setup driver-private data */
         priv = netdev_priv(netdev);
         priv->netdev = netdev;
+        priv->dma_alloc = 0;
 
         priv->iobase = devm_ioremap_nocache(&pdev->dev, netdev->base_addr,
                         mmio->end - mmio->start + 1);
@@ -942,12 +949,27 @@ static int ethoc_probe(struct platform_device *pdev)
                 goto error;
         }
 
-        priv->membase = devm_ioremap_nocache(&pdev->dev, netdev->mem_start,
-                        mem->end - mem->start + 1);
-        if (!priv->membase) {
-                dev_err(&pdev->dev, "cannot remap memory space\n");
-                ret = -ENXIO;
-                goto error;
+        if (netdev->mem_end) {
+                priv->membase = devm_ioremap_nocache(&pdev->dev,
+                        netdev->mem_start, mem->end - mem->start + 1);
+                if (!priv->membase) {
+                        dev_err(&pdev->dev, "cannot remap memory space\n");
+                        ret = -ENXIO;
+                        goto error;
+                }
+        } else {
+                /* Allocate buffer memory */
+                priv->membase = dma_alloc_coherent(NULL,
+                        buffer_size, (void *)&netdev->mem_start,
+                        GFP_KERNEL);
+                if (!priv->membase) {
+                        dev_err(&pdev->dev, "cannot allocate %dB buffer\n",
+                                buffer_size);
+                        ret = -ENOMEM;
+                        goto error;
+                }
+                netdev->mem_end = netdev->mem_start + buffer_size;
+                priv->dma_alloc = buffer_size;
         }
 
         /* Allow the platform setup code to pass in a MAC address. */
@@ -1034,6 +1056,9 @@ free_mdio:
         kfree(priv->mdio->irq);
         mdiobus_free(priv->mdio);
 free:
+        if (priv->dma_alloc)
+                dma_free_coherent(NULL, priv->dma_alloc, priv->membase,
+                        netdev->mem_start);
         free_netdev(netdev);
 out:
         return ret;
@@ -1059,7 +1084,9 @@ static int ethoc_remove(struct platform_device *pdev)
                         kfree(priv->mdio->irq);
                         mdiobus_free(priv->mdio);
                 }
-
+                if (priv->dma_alloc)
+                        dma_free_coherent(NULL, priv->dma_alloc, priv->membase,
+                                netdev->mem_start);
                 unregister_netdev(netdev);
                 free_netdev(netdev);
         }
diff --git a/drivers/net/ixgbe/ixgbe_82599.c b/drivers/net/ixgbe/ixgbe_82599.c
index 2ec58dcdb82b..34b04924c8a1 100644
--- a/drivers/net/ixgbe/ixgbe_82599.c
+++ b/drivers/net/ixgbe/ixgbe_82599.c
@@ -330,6 +330,8 @@ static enum ixgbe_media_type ixgbe_get_media_type_82599(struct ixgbe_hw *hw)
 
         switch (hw->device_id) {
         case IXGBE_DEV_ID_82599_KX4:
+        case IXGBE_DEV_ID_82599_KX4_MEZZ:
+        case IXGBE_DEV_ID_82599_COMBO_BACKPLANE:
         case IXGBE_DEV_ID_82599_XAUI_LOM:
                 /* Default device ID is mezzanine card KX/KX4 */
                 media_type = ixgbe_media_type_backplane;
diff --git a/drivers/net/ixgbe/ixgbe_main.c b/drivers/net/ixgbe/ixgbe_main.c
index 28fbb9d281f9..cbb143ca1eb8 100644
--- a/drivers/net/ixgbe/ixgbe_main.c
+++ b/drivers/net/ixgbe/ixgbe_main.c
@@ -97,8 +97,12 @@ static struct pci_device_id ixgbe_pci_tbl[] = {
          board_82599 },
         {PCI_VDEVICE(INTEL, IXGBE_DEV_ID_82599_SFP),
          board_82599 },
+        {PCI_VDEVICE(INTEL, IXGBE_DEV_ID_82599_KX4_MEZZ),
+         board_82599 },
         {PCI_VDEVICE(INTEL, IXGBE_DEV_ID_82599_CX4),
          board_82599 },
+        {PCI_VDEVICE(INTEL, IXGBE_DEV_ID_82599_COMBO_BACKPLANE),
+         board_82599 },
 
         /* required last entry */
         {0, }
diff --git a/drivers/net/ixgbe/ixgbe_type.h b/drivers/net/ixgbe/ixgbe_type.h
index 7c93e923bf2e..ef4bdd58e016 100644
--- a/drivers/net/ixgbe/ixgbe_type.h
+++ b/drivers/net/ixgbe/ixgbe_type.h
@@ -49,9 +49,11 @@
 #define IXGBE_DEV_ID_82598_SR_DUAL_PORT_EM      0x10E1
 #define IXGBE_DEV_ID_82598EB_XF_LR       0x10F4
 #define IXGBE_DEV_ID_82599_KX4           0x10F7
+#define IXGBE_DEV_ID_82599_KX4_MEZZ      0x1514
 #define IXGBE_DEV_ID_82599_CX4           0x10F9
 #define IXGBE_DEV_ID_82599_SFP           0x10FB
 #define IXGBE_DEV_ID_82599_XAUI_LOM      0x10FC
+#define IXGBE_DEV_ID_82599_COMBO_BACKPLANE 0x10F8
 
 /* General Registers */
 #define IXGBE_CTRL      0x00000
diff --git a/drivers/net/netxen/netxen_nic_main.c b/drivers/net/netxen/netxen_nic_main.c
index b5aa974827e5..9b9eab107704 100644
--- a/drivers/net/netxen/netxen_nic_main.c
+++ b/drivers/net/netxen/netxen_nic_main.c
@@ -1714,7 +1714,7 @@ netxen_nic_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
         /* 4 fragments per cmd des */
         no_of_desc = (frag_count + 3) >> 2;
 
-        if (unlikely(no_of_desc + 2) > netxen_tx_avail(tx_ring)) {
+        if (unlikely(no_of_desc + 2 > netxen_tx_avail(tx_ring))) {
                 netif_stop_queue(netdev);
                 return NETDEV_TX_BUSY;
         }
diff --git a/drivers/net/pasemi_mac_ethtool.c b/drivers/net/pasemi_mac_ethtool.c
index 064a4fe1dd90..28a86224879d 100644
--- a/drivers/net/pasemi_mac_ethtool.c
+++ b/drivers/net/pasemi_mac_ethtool.c
@@ -71,6 +71,9 @@ pasemi_mac_ethtool_get_settings(struct net_device *netdev,
         struct pasemi_mac *mac = netdev_priv(netdev);
         struct phy_device *phydev = mac->phydev;
 
+        if (!phydev)
+                return -EOPNOTSUPP;
+
         return phy_ethtool_gset(phydev, cmd);
 }
 
diff --git a/drivers/net/pcmcia/pcnet_cs.c b/drivers/net/pcmcia/pcnet_cs.c
index 474876c879cb..bd3447f04902 100644
--- a/drivers/net/pcmcia/pcnet_cs.c
+++ b/drivers/net/pcmcia/pcnet_cs.c
@@ -1754,14 +1754,14 @@ static struct pcmcia_device_id pcnet_ids[] = {
         PCMCIA_PFC_DEVICE_CIS_PROD_ID12(0, "Psion Dacom", "Gold Card V34 Ethernet", 0xf5f025c2, 0x338e8155, "cis/PCMLM28.cis"),
         PCMCIA_PFC_DEVICE_CIS_PROD_ID12(0, "Psion Dacom", "Gold Card V34 Ethernet GSM", 0xf5f025c2, 0x4ae85d35, "cis/PCMLM28.cis"),
         PCMCIA_PFC_DEVICE_CIS_PROD_ID12(0, "LINKSYS", "PCMLM28", 0xf7cb0b07, 0x66881874, "cis/PCMLM28.cis"),
-        PCMCIA_MFC_DEVICE_CIS_PROD_ID12(0, "DAYNA COMMUNICATIONS", "LAN AND MODEM MULTIFUNCTION", 0x8fdf8f89, 0xdd5ed9e8, "DP83903.cis"),
-        PCMCIA_MFC_DEVICE_CIS_PROD_ID4(0, "NSC MF LAN/Modem", 0x58fc6056, "DP83903.cis"),
-        PCMCIA_MFC_DEVICE_CIS_MANF_CARD(0, 0x0175, 0x0000, "DP83903.cis"),
+        PCMCIA_MFC_DEVICE_CIS_PROD_ID12(0, "DAYNA COMMUNICATIONS", "LAN AND MODEM MULTIFUNCTION", 0x8fdf8f89, 0xdd5ed9e8, "cis/DP83903.cis"),
+        PCMCIA_MFC_DEVICE_CIS_PROD_ID4(0, "NSC MF LAN/Modem", 0x58fc6056, "cis/DP83903.cis"),
+        PCMCIA_MFC_DEVICE_CIS_MANF_CARD(0, 0x0175, 0x0000, "cis/DP83903.cis"),
         PCMCIA_DEVICE_CIS_MANF_CARD(0xc00f, 0x0002, "cis/LA-PCM.cis"),
         PCMCIA_DEVICE_CIS_PROD_ID12("KTI", "PE520 PLUS", 0xad180345, 0x9d58d392, "PE520.cis"),
-        PCMCIA_DEVICE_CIS_PROD_ID12("NDC", "Ethernet", 0x01c43ae1, 0x00b2e941, "NE2K.cis"),
+        PCMCIA_DEVICE_CIS_PROD_ID12("NDC", "Ethernet", 0x01c43ae1, 0x00b2e941, "cis/NE2K.cis"),
         PCMCIA_DEVICE_CIS_PROD_ID12("PMX   ", "PE-200", 0x34f3f1c8, 0x10b59f8c, "PE-200.cis"),
-        PCMCIA_DEVICE_CIS_PROD_ID12("TAMARACK", "Ethernet", 0xcf434fba, 0x00b2e941, "tamarack.cis"),
+        PCMCIA_DEVICE_CIS_PROD_ID12("TAMARACK", "Ethernet", 0xcf434fba, 0x00b2e941, "cis/tamarack.cis"),
         PCMCIA_DEVICE_PROD_ID12("Ethernet", "CF Size PC Card", 0x00b2e941, 0x43ac239b),
         PCMCIA_DEVICE_PROD_ID123("Fast Ethernet", "CF Size PC Card", "1.0",
                 0xb4be14e3, 0x43ac239b, 0x0877b627),
diff --git a/drivers/net/qlge/qlge.h b/drivers/net/qlge/qlge.h
index 30d5585beeee..3ec6e85587a2 100644
--- a/drivers/net/qlge/qlge.h
+++ b/drivers/net/qlge/qlge.h
@@ -9,6 +9,7 @@
 
 #include <linux/pci.h>
 #include <linux/netdevice.h>
+#include <linux/rtnetlink.h>
 
 /*
  * General definitions...
@@ -135,9 +136,9 @@ enum {
         RST_FO_TFO = (1 << 0),
         RST_FO_RR_MASK = 0x00060000,
         RST_FO_RR_CQ_CAM = 0x00000000,
-        RST_FO_RR_DROP = 0x00000001,
-        RST_FO_RR_DQ = 0x00000002,
-        RST_FO_RR_RCV_FUNC_CQ = 0x00000003,
+        RST_FO_RR_DROP = 0x00000002,
+        RST_FO_RR_DQ = 0x00000004,
+        RST_FO_RR_RCV_FUNC_CQ = 0x00000006,
         RST_FO_FRB = (1 << 12),
         RST_FO_MOP = (1 << 13),
         RST_FO_REG = (1 << 14),
@@ -1477,7 +1478,6 @@ struct ql_adapter {
         u32 mailbox_in;
         u32 mailbox_out;
         struct mbox_params idc_mbc;
-        struct mutex    mpi_mutex;
 
         int tx_ring_size;
         int rx_ring_size;
diff --git a/drivers/net/qlge/qlge_ethtool.c b/drivers/net/qlge/qlge_ethtool.c
index 68f9bd280f86..52073946bce3 100644
--- a/drivers/net/qlge/qlge_ethtool.c
+++ b/drivers/net/qlge/qlge_ethtool.c
@@ -45,7 +45,6 @@ static int ql_update_ring_coalescing(struct ql_adapter *qdev)
         if (!netif_running(qdev->ndev))
                 return status;
 
-        spin_lock(&qdev->hw_lock);
         /* Skip the default queue, and update the outbound handler
          * queues if they changed.
          */
@@ -92,7 +91,6 @@ static int ql_update_ring_coalescing(struct ql_adapter *qdev)
                 }
         }
 exit:
-        spin_unlock(&qdev->hw_lock);
         return status;
 }
 
diff --git a/drivers/net/qlge/qlge_main.c b/drivers/net/qlge/qlge_main.c
index 3d0efea32111..61680715cde0 100644
--- a/drivers/net/qlge/qlge_main.c
+++ b/drivers/net/qlge/qlge_main.c
@@ -34,7 +34,6 @@
 #include <linux/etherdevice.h>
 #include <linux/ethtool.h>
 #include <linux/skbuff.h>
-#include <linux/rtnetlink.h>
 #include <linux/if_vlan.h>
 #include <linux/delay.h>
 #include <linux/mm.h>
@@ -1926,12 +1925,10 @@ static void ql_vlan_rx_add_vid(struct net_device *ndev, u16 vid)
         status = ql_sem_spinlock(qdev, SEM_MAC_ADDR_MASK);
         if (status)
                 return;
-        spin_lock(&qdev->hw_lock);
         if (ql_set_mac_addr_reg
             (qdev, (u8 *) &enable_bit, MAC_ADDR_TYPE_VLAN, vid)) {
                 QPRINTK(qdev, IFUP, ERR, "Failed to init vlan address.\n");
         }
-        spin_unlock(&qdev->hw_lock);
         ql_sem_unlock(qdev, SEM_MAC_ADDR_MASK);
 }
 
@@ -1945,12 +1942,10 @@ static void ql_vlan_rx_kill_vid(struct net_device *ndev, u16 vid)
         if (status)
                 return;
 
-        spin_lock(&qdev->hw_lock);
         if (ql_set_mac_addr_reg
             (qdev, (u8 *) &enable_bit, MAC_ADDR_TYPE_VLAN, vid)) {
                 QPRINTK(qdev, IFUP, ERR, "Failed to clear vlan address.\n");
         }
-        spin_unlock(&qdev->hw_lock);
         ql_sem_unlock(qdev, SEM_MAC_ADDR_MASK);
 
 }
@@ -2001,15 +1996,17 @@ static irqreturn_t qlge_isr(int irq, void *dev_id)
         /*
          * Check MPI processor activity.
          */
-        if (var & STS_PI) {
+        if ((var & STS_PI) &&
+                (ql_read32(qdev, INTR_MASK) & INTR_MASK_PI)) {
                 /*
                  * We've got an async event or mailbox completion.
                  * Handle it and clear the source of the interrupt.
                  */
                 QPRINTK(qdev, INTR, ERR, "Got MPI processor interrupt.\n");
                 ql_disable_completion_interrupt(qdev, intr_context->intr);
-                queue_delayed_work_on(smp_processor_id(), qdev->workqueue,
-                                      &qdev->mpi_work, 0);
+                ql_write32(qdev, INTR_MASK, (INTR_MASK_PI << 16));
+                queue_delayed_work_on(smp_processor_id(),
+                                qdev->workqueue, &qdev->mpi_work, 0);
                 work_done++;
         }
 
@@ -3585,7 +3582,6 @@ static void qlge_set_multicast_list(struct net_device *ndev)
         status = ql_sem_spinlock(qdev, SEM_RT_IDX_MASK);
         if (status)
                 return;
-        spin_lock(&qdev->hw_lock);
         /*
          * Set or clear promiscuous mode if a
          * transition is taking place.
@@ -3662,7 +3658,6 @@ static void qlge_set_multicast_list(struct net_device *ndev)
                 }
         }
 exit:
-        spin_unlock(&qdev->hw_lock);
         ql_sem_unlock(qdev, SEM_RT_IDX_MASK);
 }
 
@@ -3682,10 +3677,8 @@ static int qlge_set_mac_address(struct net_device *ndev, void *p)
         status = ql_sem_spinlock(qdev, SEM_MAC_ADDR_MASK);
         if (status)
                 return status;
-        spin_lock(&qdev->hw_lock);
         status = ql_set_mac_addr_reg(qdev, (u8 *) ndev->dev_addr,
                         MAC_ADDR_TYPE_CAM_MAC, qdev->func * MAX_CQ);
-        spin_unlock(&qdev->hw_lock);
         if (status)
                 QPRINTK(qdev, HW, ERR, "Failed to load MAC address.\n");
         ql_sem_unlock(qdev, SEM_MAC_ADDR_MASK);
@@ -3928,7 +3921,6 @@ static int __devinit ql_init_device(struct pci_dev *pdev,
         INIT_DELAYED_WORK(&qdev->mpi_work, ql_mpi_work);
         INIT_DELAYED_WORK(&qdev->mpi_port_cfg_work, ql_mpi_port_cfg_work);
         INIT_DELAYED_WORK(&qdev->mpi_idc_work, ql_mpi_idc_work);
-        mutex_init(&qdev->mpi_mutex);
         init_completion(&qdev->ide_completion);
 
         if (!cards_found) {
diff --git a/drivers/net/qlge/qlge_mpi.c b/drivers/net/qlge/qlge_mpi.c
index 6685bd97da91..c2e43073047e 100644
--- a/drivers/net/qlge/qlge_mpi.c
+++ b/drivers/net/qlge/qlge_mpi.c
@@ -472,7 +472,6 @@ static int ql_mailbox_command(struct ql_adapter *qdev, struct mbox_params *mbcp)
 {
         int status, count;
 
-        mutex_lock(&qdev->mpi_mutex);
 
         /* Begin polled mode for MPI */
         ql_write32(qdev, INTR_MASK, (INTR_MASK_PI << 16));
@@ -541,7 +540,6 @@ static int ql_mailbox_command(struct ql_adapter *qdev, struct mbox_params *mbcp)
                 status = -EIO;
         }
 end:
-        mutex_unlock(&qdev->mpi_mutex);
         /* End polled mode for MPI */
         ql_write32(qdev, INTR_MASK, (INTR_MASK_PI << 16) | INTR_MASK_PI);
         return status;
@@ -776,7 +774,9 @@ static int ql_idc_wait(struct ql_adapter *qdev)
 static int ql_set_port_cfg(struct ql_adapter *qdev)
 {
         int status;
+        rtnl_lock();
         status = ql_mb_set_port_cfg(qdev);
+        rtnl_unlock();
         if (status)
                 return status;
         status = ql_idc_wait(qdev);
@@ -797,7 +797,9 @@ void ql_mpi_port_cfg_work(struct work_struct *work)
             container_of(work, struct ql_adapter, mpi_port_cfg_work.work);
         int status;
 
+        rtnl_lock();
         status = ql_mb_get_port_cfg(qdev);
+        rtnl_unlock();
         if (status) {
                 QPRINTK(qdev, DRV, ERR,
                         "Bug: Failed to get port config data.\n");
@@ -855,7 +857,9 @@ void ql_mpi_idc_work(struct work_struct *work)
                  * needs to be set.
                  * */
                 set_bit(QL_CAM_RT_SET, &qdev->flags);
+                rtnl_lock();
                 status = ql_mb_idc_ack(qdev);
+                rtnl_unlock();
                 if (status) {
                         QPRINTK(qdev, DRV, ERR,
                         "Bug: No pending IDC!\n");
@@ -871,7 +875,7 @@ void ql_mpi_work(struct work_struct *work)
         struct mbox_params *mbcp = &mbc;
         int err = 0;
 
-        mutex_lock(&qdev->mpi_mutex);
+        rtnl_lock();
 
         while (ql_read32(qdev, STS) & STS_PI) {
                 memset(mbcp, 0, sizeof(struct mbox_params));
@@ -884,7 +888,7 @@ void ql_mpi_work(struct work_struct *work)
                         break;
         }
 
-        mutex_unlock(&qdev->mpi_mutex);
+        rtnl_unlock();
         ql_enable_completion_interrupt(qdev, 0);
 }
 
diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
index f09bc5dfe8b2..ba5d3fe753b6 100644
--- a/drivers/net/tg3.c
+++ b/drivers/net/tg3.c
@@ -902,11 +902,12 @@ static int tg3_mdio_read(struct mii_bus *bp, int mii_id, int reg)
         struct tg3 *tp = bp->priv;
         u32 val;
 
-        if (tp->tg3_flags3 & TG3_FLG3_MDIOBUS_PAUSED)
-                return -EAGAIN;
+        spin_lock_bh(&tp->lock);
 
         if (tg3_readphy(tp, reg, &val))
-                return -EIO;
+                val = -EIO;
+
+        spin_unlock_bh(&tp->lock);
 
         return val;
 }
@@ -914,14 +915,16 @@ static int tg3_mdio_read(struct mii_bus *bp, int mii_id, int reg)
 static int tg3_mdio_write(struct mii_bus *bp, int mii_id, int reg, u16 val)
 {
         struct tg3 *tp = bp->priv;
+        u32 ret = 0;
 
-        if (tp->tg3_flags3 & TG3_FLG3_MDIOBUS_PAUSED)
-                return -EAGAIN;
+        spin_lock_bh(&tp->lock);
 
         if (tg3_writephy(tp, reg, val))
-                return -EIO;
+                ret = -EIO;
 
-        return 0;
+        spin_unlock_bh(&tp->lock);
+
+        return ret;
 }
 
 static int tg3_mdio_reset(struct mii_bus *bp)
@@ -1011,12 +1014,6 @@ static void tg3_mdio_config_5785(struct tg3 *tp)
 
 static void tg3_mdio_start(struct tg3 *tp)
 {
-        if (tp->tg3_flags3 & TG3_FLG3_MDIOBUS_INITED) {
-                mutex_lock(&tp->mdio_bus->mdio_lock);
-                tp->tg3_flags3 &= ~TG3_FLG3_MDIOBUS_PAUSED;
-                mutex_unlock(&tp->mdio_bus->mdio_lock);
-        }
-
         tp->mi_mode &= ~MAC_MI_MODE_AUTO_POLL;
         tw32_f(MAC_MI_MODE, tp->mi_mode);
         udelay(80);
@@ -1041,15 +1038,6 @@ static void tg3_mdio_start(struct tg3 *tp)
                 tg3_mdio_config_5785(tp);
 }
 
-static void tg3_mdio_stop(struct tg3 *tp)
-{
-        if (tp->tg3_flags3 & TG3_FLG3_MDIOBUS_INITED) {
-                mutex_lock(&tp->mdio_bus->mdio_lock);
-                tp->tg3_flags3 |= TG3_FLG3_MDIOBUS_PAUSED;
-                mutex_unlock(&tp->mdio_bus->mdio_lock);
-        }
-}
-
 static int tg3_mdio_init(struct tg3 *tp)
 {
         int i;
@@ -1141,7 +1129,6 @@ static void tg3_mdio_fini(struct tg3 *tp)
                 tp->tg3_flags3 &= ~TG3_FLG3_MDIOBUS_INITED;
                 mdiobus_unregister(tp->mdio_bus);
                 mdiobus_free(tp->mdio_bus);
-                tp->tg3_flags3 &= ~TG3_FLG3_MDIOBUS_PAUSED;
         }
 }
 
@@ -1363,7 +1350,7 @@ static void tg3_adjust_link(struct net_device *dev)
         struct tg3 *tp = netdev_priv(dev);
         struct phy_device *phydev = tp->mdio_bus->phy_map[PHY_ADDR];
 
-        spin_lock(&tp->lock);
+        spin_lock_bh(&tp->lock);
 
         mac_mode = tp->mac_mode & ~(MAC_MODE_PORT_MODE_MASK |
                                     MAC_MODE_HALF_DUPLEX);
@@ -1431,7 +1418,7 @@ static void tg3_adjust_link(struct net_device *dev)
         tp->link_config.active_speed = phydev->speed;
         tp->link_config.active_duplex = phydev->duplex;
 
-        spin_unlock(&tp->lock);
+        spin_unlock_bh(&tp->lock);
 
         if (linkmesg)
                 tg3_link_report(tp);
@@ -6392,8 +6379,6 @@ static int tg3_chip_reset(struct tg3 *tp)
 
         tg3_nvram_lock(tp);
 
-        tg3_mdio_stop(tp);
-
         tg3_ape_lock(tp, TG3_APE_LOCK_GRC);
 
         /* No matching tg3_nvram_unlock() after this because
@@ -8698,6 +8683,8 @@ static int tg3_close(struct net_device *dev)
 
         del_timer_sync(&tp->timer);
 
+        tg3_phy_stop(tp);
+
         tg3_full_lock(tp, 1);
 #if 0
         tg3_dump_state(tp);
diff --git a/drivers/net/tg3.h b/drivers/net/tg3.h
index 524691cd9896..bab7940158e6 100644
--- a/drivers/net/tg3.h
+++ b/drivers/net/tg3.h
@@ -2748,7 +2748,6 @@ struct tg3 {
 #define TG3_FLG3_5701_DMA_BUG           0x00000008
 #define TG3_FLG3_USE_PHYLIB             0x00000010
 #define TG3_FLG3_MDIOBUS_INITED         0x00000020
-#define TG3_FLG3_MDIOBUS_PAUSED         0x00000040
 #define TG3_FLG3_PHY_CONNECTED          0x00000080
 #define TG3_FLG3_RGMII_STD_IBND_DISABLE 0x00000100
 #define TG3_FLG3_RGMII_EXT_IBND_RX_EN   0x00000200
diff --git a/drivers/net/usb/rndis_host.c b/drivers/net/usb/rndis_host.c
index d032bba9bc4c..0caa8008c51c 100644
--- a/drivers/net/usb/rndis_host.c
+++ b/drivers/net/usb/rndis_host.c
@@ -418,6 +418,7 @@ generic_rndis_bind(struct usbnet *dev, struct usb_interface *intf, int flags)
                 goto halt_fail_and_release;
         }
         memcpy(net->dev_addr, bp, ETH_ALEN);
+        memcpy(net->perm_addr, bp, ETH_ALEN);
 
         /* set a nonzero filter to enable data transfers */
         memset(u.set, 0, sizeof *u.set);
diff --git a/drivers/serial/serial_cs.c b/drivers/serial/serial_cs.c
index a3bb49031a7f..ff4617e21426 100644
--- a/drivers/serial/serial_cs.c
+++ b/drivers/serial/serial_cs.c
@@ -873,10 +873,10 @@ static struct pcmcia_device_id serial_ids[] = {
         PCMCIA_PFC_DEVICE_CIS_PROD_ID12(1, "Psion Dacom", "Gold Card V34 Ethernet", 0xf5f025c2, 0x338e8155, "cis/PCMLM28.cis"),
         PCMCIA_PFC_DEVICE_CIS_PROD_ID12(1, "Psion Dacom", "Gold Card V34 Ethernet GSM", 0xf5f025c2, 0x4ae85d35, "cis/PCMLM28.cis"),
         PCMCIA_PFC_DEVICE_CIS_PROD_ID12(1, "LINKSYS", "PCMLM28", 0xf7cb0b07, 0x66881874, "cis/PCMLM28.cis"),
-        PCMCIA_MFC_DEVICE_CIS_PROD_ID12(1, "DAYNA COMMUNICATIONS", "LAN AND MODEM MULTIFUNCTION", 0x8fdf8f89, 0xdd5ed9e8, "DP83903.cis"),
-        PCMCIA_MFC_DEVICE_CIS_PROD_ID4(1, "NSC MF LAN/Modem", 0x58fc6056, "DP83903.cis"),
+        PCMCIA_MFC_DEVICE_CIS_PROD_ID12(1, "DAYNA COMMUNICATIONS", "LAN AND MODEM MULTIFUNCTION", 0x8fdf8f89, 0xdd5ed9e8, "cis/DP83903.cis"),
+        PCMCIA_MFC_DEVICE_CIS_PROD_ID4(1, "NSC MF LAN/Modem", 0x58fc6056, "cis/DP83903.cis"),
         PCMCIA_MFC_DEVICE_CIS_MANF_CARD(1, 0x0101, 0x0556, "cis/3CCFEM556.cis"),
-        PCMCIA_MFC_DEVICE_CIS_MANF_CARD(1, 0x0175, 0x0000, "DP83903.cis"),
+        PCMCIA_MFC_DEVICE_CIS_MANF_CARD(1, 0x0175, 0x0000, "cis/DP83903.cis"),
         PCMCIA_MFC_DEVICE_CIS_MANF_CARD(1, 0x0101, 0x0035, "cis/3CXEM556.cis"),
         PCMCIA_MFC_DEVICE_CIS_MANF_CARD(1, 0x0101, 0x003d, "cis/3CXEM556.cis"),
         PCMCIA_DEVICE_CIS_PROD_ID12("Sierra Wireless", "AC850", 0xd85f6206, 0x42a2c018, "SW_8xx_SER.cis"),  /* Sierra Wireless AC850 3G Network Adapter R1 */
@@ -884,9 +884,9 @@ static struct pcmcia_device_id serial_ids[] = {
         PCMCIA_DEVICE_CIS_MANF_CARD(0x0192, 0xa555, "SW_555_SER.cis"),  /* Sierra Aircard 555 CDMA 1xrtt Modem -- pre update */
         PCMCIA_DEVICE_CIS_MANF_CARD(0x013f, 0xa555, "SW_555_SER.cis"),  /* Sierra Aircard 555 CDMA 1xrtt Modem -- post update */
         PCMCIA_DEVICE_CIS_PROD_ID12("MultiTech", "PCMCIA 56K DataFax", 0x842047ee, 0xc2efcf03, "cis/MT5634ZLX.cis"),
-        PCMCIA_DEVICE_CIS_PROD_ID12("ADVANTECH", "COMpad-32/85B-2", 0x96913a85, 0x27ab5437, "COMpad2.cis"),
-        PCMCIA_DEVICE_CIS_PROD_ID12("ADVANTECH", "COMpad-32/85B-4", 0x96913a85, 0xcec8f102, "COMpad4.cis"),
-        PCMCIA_DEVICE_CIS_PROD_ID123("ADVANTECH", "COMpad-32/85", "1.0", 0x96913a85, 0x8fbe92ae, 0x0877b627, "COMpad2.cis"),
+        PCMCIA_DEVICE_CIS_PROD_ID12("ADVANTECH", "COMpad-32/85B-2", 0x96913a85, 0x27ab5437, "cis/COMpad2.cis"),
+        PCMCIA_DEVICE_CIS_PROD_ID12("ADVANTECH", "COMpad-32/85B-4", 0x96913a85, 0xcec8f102, "cis/COMpad4.cis"),
+        PCMCIA_DEVICE_CIS_PROD_ID123("ADVANTECH", "COMpad-32/85", "1.0", 0x96913a85, 0x8fbe92ae, 0x0877b627, "cis/COMpad2.cis"),
         PCMCIA_DEVICE_CIS_PROD_ID2("RS-COM 2P", 0xad20b156, "cis/RS-COM-2P.cis"),
         PCMCIA_DEVICE_CIS_MANF_CARD(0x0013, 0x0000, "GLOBETROTTER.cis"),
         PCMCIA_DEVICE_PROD_ID12("ELAN DIGITAL SYSTEMS LTD, c1997.","SERIAL CARD: SL100  1.00.",0x19ca78af,0xf964f42b),
diff --git a/firmware/Makefile b/firmware/Makefile
index 5ea80b19785b..a6c7c3e47e42 100644
--- a/firmware/Makefile
+++ b/firmware/Makefile
@@ -67,10 +67,13 @@ fw-shipped-$(CONFIG_DVB_TTUSB_BUDGET) += ttusb-budget/dspbootcode.bin
 fw-shipped-$(CONFIG_E100) += e100/d101m_ucode.bin e100/d101s_ucode.bin \
                              e100/d102e_ucode.bin
 fw-shipped-$(CONFIG_MYRI_SBUS) += myricom/lanai.bin
-fw-shipped-$(CONFIG_PCMCIA_PCNET) += cis/LA-PCM.cis cis/PCMLM28.cis
+fw-shipped-$(CONFIG_PCMCIA_PCNET) += cis/LA-PCM.cis cis/PCMLM28.cis \
+                                     cis/DP83903.cis cis/NE2K.cis \
+                                     cis/tamarack.cis
 fw-shipped-$(CONFIG_PCMCIA_3C589) += cis/3CXEM556.cis
 fw-shipped-$(CONFIG_PCMCIA_3C574) += cis/3CCFEM556.cis
-fw-shipped-$(CONFIG_SERIAL_8250_CS) += cis/MT5634ZLX.cis cis/RS-COM-2P.cis
+fw-shipped-$(CONFIG_SERIAL_8250_CS) += cis/MT5634ZLX.cis cis/RS-COM-2P.cis \
+                                       cis/COMpad2.cis cis/COMpad4.cis
 fw-shipped-$(CONFIG_PCMCIA_SMC91C92) += ositech/Xilinx7OD.bin
 fw-shipped-$(CONFIG_SCSI_ADVANSYS) += advansys/mcode.bin advansys/38C1600.bin \
                                       advansys/3550.bin advansys/38C0800.bin
diff --git a/firmware/WHENCE b/firmware/WHENCE
index 3f8c4f6bc43f..c437e14f0b11 100644
--- a/firmware/WHENCE
+++ b/firmware/WHENCE
@@ -597,6 +597,9 @@ Driver: PCMCIA_PCNET - NE2000 compatible PCMCIA adapter
 
 File: cis/LA-PCM.cis
       cis/PCMLM28.cis
+      cis/DP83903.cis
+      cis/NE2K.cis
+      cis/tamarack.cis
 
 Licence: GPL
 
@@ -628,6 +631,8 @@ Driver: SERIAL_8250_CS - Serial PCMCIA adapter
 
 File: cis/MT5634ZLX.cis
       cis/RS-COM-2P.cis
+      cis/COMpad2.cis
+      cis/COMpad4.cis
 
 Licence: GPL
 
diff --git a/firmware/cis/COMpad2.cis.ihex b/firmware/cis/COMpad2.cis.ihex
new file mode 100644
index 000000000000..1671c5e48caa
--- /dev/null
+++ b/firmware/cis/COMpad2.cis.ihex
@@ -0,0 +1,11 @@
+:1000000001030000FF151F0401414456414E5445B1
+:10001000434800434F4D7061642D33322F38350013
+:10002000312E300000FF210202011A0501050001F6
+:10003000031B0EC18118AA61E80207E8030730B864
+:100040009E1B08820108AA6030030F1B0883010869
+:10005000AA6040030F1B08840108AA6050030F1B0D
+:0D00600008850108AA6060030F1400FF006E
+:00000001FF
+#
+# Replacement CIS for Advantech COMpad-32/85
+#
diff --git a/firmware/cis/COMpad4.cis.ihex b/firmware/cis/COMpad4.cis.ihex
new file mode 100644
index 000000000000..27bbec1921b3
--- /dev/null
+++ b/firmware/cis/COMpad4.cis.ihex
@@ -0,0 +1,9 @@
+:1000000001030000FF151F0401414456414E5445B1
+:10001000434800434F4D7061642D33322F383542D1
+:100020002D34000000FF210202011A050102000127
+:10003000011B0BC18118AA6040021F30B89E1B082B
+:0C004000820108AA6040031F1400FF00AA
+:00000001FF
+#
+# Replacement CIS for Advantech COMpad-32/85B-4
+#
diff --git a/firmware/cis/DP83903.cis.ihex b/firmware/cis/DP83903.cis.ihex
new file mode 100644
index 000000000000..6d73ea3cf1b8
--- /dev/null
+++ b/firmware/cis/DP83903.cis.ihex
@@ -0,0 +1,14 @@
+:1000000001030000FF152904014D756C74696675C4
+:100010006E6374696F6E20436172640000004E531A
+:1000200043204D46204C414E2F4D6F64656D00FFBF
+:1000300020047501000021020000060B02004900A7
+:100040000000006A000000FF00130343495321022F
+:1000500006001A060517201077021B0C970179017C
+:10006000556530FFFF284000FF001303434953212B
+:100070000202001A060507401077021B09870119C2
+:0800800001552330FFFFFF00D2
+:00000001FF
+#
+# This CIS is for cards based on the National Semiconductor
+# DP83903 Multiple Function Interface Chip
+#
diff --git a/firmware/cis/NE2K.cis.ihex b/firmware/cis/NE2K.cis.ihex
new file mode 100644
index 000000000000..1bb40fc4759f
--- /dev/null
+++ b/firmware/cis/NE2K.cis.ihex
@@ -0,0 +1,8 @@
+:1000000001030000FF1515040150434D4349410011
+:1000100045746865726E6574000000FF2102060079
+:100020001A050120F803031B09E001190155653089
+:06003000FFFF1400FF00B9
+:00000001FF
+#
+# Replacement CIS for various busted NE2000-compatible cards
+#
diff --git a/firmware/cis/tamarack.cis.ihex b/firmware/cis/tamarack.cis.ihex
new file mode 100644
index 000000000000..1e86547fb361
--- /dev/null
+++ b/firmware/cis/tamarack.cis.ihex
@@ -0,0 +1,10 @@
+:100000000103D400FF17034100FF152404015441EC
+:100010004D415241434B0045746865726E657400F2
+:10002000410030303437343331313830303100FF33
+:10003000210206001A050120F803031B14E08119B0
+:100040003F554D5D06864626E551000F100F30FFE7
+:05005000FF1400FF0099
+:00000001FF
+#
+# Replacement CIS for Surecom, Tamarack NE2000 cards
+#
diff --git a/include/linux/socket.h b/include/linux/socket.h
index 3b461dffe244..3273a0c5043b 100644
--- a/include/linux/socket.h
+++ b/include/linux/socket.h
@@ -16,7 +16,7 @@ struct __kernel_sockaddr_storage {
                                 /* _SS_MAXSIZE value minus size of ss_family */
 } __attribute__ ((aligned(_K_SS_ALIGNSIZE)));   /* force desired alignment */
 
-#if defined(__KERNEL__) || !defined(__GLIBC__) || (__GLIBC__ < 2)
+#ifdef __KERNEL__
 
 #include <asm/socket.h>                 /* arch-dependent defines       */
 #include <linux/sockios.h>              /* the SIOCxxx I/O controls     */
@@ -101,21 +101,6 @@ struct cmsghdr {
                               ((char *)(cmsg) - (char *)(mhdr)->msg_control)))
 
 /*
- *      This mess will go away with glibc
- */
- 
-#ifdef __KERNEL__
-#define __KINLINE static inline
-#elif  defined(__GNUC__) 
-#define __KINLINE static __inline__
-#elif defined(__cplusplus)
-#define __KINLINE static inline
-#else
-#define __KINLINE static
-#endif
-
-
-/*
  *      Get the next cmsg header
  *
  *      PLEASE, do not touch this function. If you think, that it is
@@ -128,7 +113,7 @@ struct cmsghdr {
  *      ancillary object DATA.                          --ANK (980731)
  */
  
-__KINLINE struct cmsghdr * __cmsg_nxthdr(void *__ctl, __kernel_size_t __size,
+static inline struct cmsghdr * __cmsg_nxthdr(void *__ctl, __kernel_size_t __size,
                                                struct cmsghdr *__cmsg)
 {
         struct cmsghdr * __ptr;
@@ -140,7 +125,7 @@ __KINLINE struct cmsghdr * __cmsg_nxthdr(void *__ctl, __kernel_size_t __size,
         return __ptr;
 }
 
-__KINLINE struct cmsghdr * cmsg_nxthdr (struct msghdr *__msg, struct cmsghdr *__cmsg)
+static inline struct cmsghdr * cmsg_nxthdr (struct msghdr *__msg, struct cmsghdr *__cmsg)
 {
         return __cmsg_nxthdr(__msg->msg_control, __msg->msg_controllen, __cmsg);
 }
diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
index 821d30918cfc..427ded841224 100644
--- a/net/core/net-sysfs.c
+++ b/net/core/net-sysfs.c
@@ -366,13 +366,13 @@ static ssize_t wireless_show(struct device *d, char *buf,
         const struct iw_statistics *iw;
         ssize_t ret = -EINVAL;
 
-        read_lock(&dev_base_lock);
+        rtnl_lock();
         if (dev_isalive(dev)) {
                 iw = get_wireless_stats(dev);
                 if (iw)
                         ret = (*format)(iw, buf);
         }
-        read_unlock(&dev_base_lock);
+        rtnl_unlock();
 
         return ret;
 }
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index b69455217ed6..86acdba0a97d 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -964,7 +964,7 @@ static ssize_t pktgen_if_write(struct file *file,
                 if (value == 0x7FFFFFFF)
                         pkt_dev->delay = ULLONG_MAX;
                 else
-                        pkt_dev->delay = (u64)value * NSEC_PER_USEC;
+                        pkt_dev->delay = (u64)value;
 
                 sprintf(pg_result, "OK: delay=%llu",
                         (unsigned long long) pkt_dev->delay);
@@ -2212,7 +2212,7 @@ static void set_cur_queue_map(struct pktgen_dev *pkt_dev)
         if (pkt_dev->flags & F_QUEUE_MAP_CPU)
                 pkt_dev->cur_queue_map = smp_processor_id();
 
-        else if (pkt_dev->queue_map_min < pkt_dev->queue_map_max) {
+        else if (pkt_dev->queue_map_min <= pkt_dev->queue_map_max) {
                 __u16 t;
                 if (pkt_dev->flags & F_QUEUE_MAP_RND) {
                         t = random32() %
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index e92f1fd28aa5..5df2f6a0b0f0 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -1077,12 +1077,16 @@ static int inetdev_event(struct notifier_block *this, unsigned long event,
                 ip_mc_up(in_dev);
                 /* fall through */
         case NETDEV_CHANGEADDR:
-                if (IN_DEV_ARP_NOTIFY(in_dev))
-                        arp_send(ARPOP_REQUEST, ETH_P_ARP,
-                                 in_dev->ifa_list->ifa_address,
-                                 dev,
-                                 in_dev->ifa_list->ifa_address,
-                                 NULL, dev->dev_addr, NULL);
+                /* Send gratuitous ARP to notify of link change */
+                if (IN_DEV_ARP_NOTIFY(in_dev)) {
+                        struct in_ifaddr *ifa = in_dev->ifa_list;
+
+                        if (ifa)
+                                arp_send(ARPOP_REQUEST, ETH_P_ARP,
+                                         ifa->ifa_address, dev,
+                                         ifa->ifa_address, NULL,
+                                         dev->dev_addr, NULL);
+                }
                 break;
         case NETDEV_DOWN:
                 ip_mc_down(in_dev);