Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6

30 files changed, 1270 insertions, 147 deletions

diff --git a/drivers/net/bnx2.c b/drivers/net/bnx2.c
index 53326fed6c81..ab26bbc2a1d3 100644
--- a/drivers/net/bnx2.c
+++ b/drivers/net/bnx2.c
@@ -58,8 +58,8 @@
 #include "bnx2_fw.h"
 
 #define DRV_MODULE_NAME         "bnx2"
-#define DRV_MODULE_VERSION      "2.0.8"
-#define DRV_MODULE_RELDATE      "Feb 15, 2010"
+#define DRV_MODULE_VERSION      "2.0.9"
+#define DRV_MODULE_RELDATE      "April 27, 2010"
 #define FW_MIPS_FILE_06         "bnx2/bnx2-mips-06-5.0.0.j6.fw"
 #define FW_RV2P_FILE_06         "bnx2/bnx2-rv2p-06-5.0.0.j3.fw"
 #define FW_MIPS_FILE_09         "bnx2/bnx2-mips-09-5.0.0.j9.fw"
@@ -651,9 +651,10 @@ bnx2_napi_enable(struct bnx2 *bp)
 }
 
 static void
-bnx2_netif_stop(struct bnx2 *bp)
+bnx2_netif_stop(struct bnx2 *bp, bool stop_cnic)
 {
-        bnx2_cnic_stop(bp);
+        if (stop_cnic)
+                bnx2_cnic_stop(bp);
         if (netif_running(bp->dev)) {
                 int i;
 
@@ -671,14 +672,15 @@ bnx2_netif_stop(struct bnx2 *bp)
 }
 
 static void
-bnx2_netif_start(struct bnx2 *bp)
+bnx2_netif_start(struct bnx2 *bp, bool start_cnic)
 {
         if (atomic_dec_and_test(&bp->intr_sem)) {
                 if (netif_running(bp->dev)) {
                         netif_tx_wake_all_queues(bp->dev);
                         bnx2_napi_enable(bp);
                         bnx2_enable_int(bp);
-                        bnx2_cnic_start(bp);
+                        if (start_cnic)
+                                bnx2_cnic_start(bp);
                 }
         }
 }
@@ -4758,8 +4760,12 @@ bnx2_reset_chip(struct bnx2 *bp, u32 reset_code)
                 rc = bnx2_alloc_bad_rbuf(bp);
         }
 
-        if (bp->flags & BNX2_FLAG_USING_MSIX)
+        if (bp->flags & BNX2_FLAG_USING_MSIX) {
                 bnx2_setup_msix_tbl(bp);
+                /* Prevent MSIX table reads and write from timing out */
+                REG_WR(bp, BNX2_MISC_ECO_HW_CTL,
+                        BNX2_MISC_ECO_HW_CTL_LARGE_GRC_TMOUT_EN);
+        }
 
         return rc;
 }
@@ -6272,12 +6278,12 @@ bnx2_reset_task(struct work_struct *work)
                 return;
         }
 
-        bnx2_netif_stop(bp);
+        bnx2_netif_stop(bp, true);
 
         bnx2_init_nic(bp, 1);
 
         atomic_set(&bp->intr_sem, 1);
-        bnx2_netif_start(bp);
+        bnx2_netif_start(bp, true);
         rtnl_unlock();
 }
 
@@ -6319,7 +6325,7 @@ bnx2_vlan_rx_register(struct net_device *dev, struct vlan_group *vlgrp)
         struct bnx2 *bp = netdev_priv(dev);
 
         if (netif_running(dev))
-                bnx2_netif_stop(bp);
+                bnx2_netif_stop(bp, false);
 
         bp->vlgrp = vlgrp;
 
@@ -6330,7 +6336,7 @@ bnx2_vlan_rx_register(struct net_device *dev, struct vlan_group *vlgrp)
         if (bp->flags & BNX2_FLAG_CAN_KEEP_VLAN)
                 bnx2_fw_sync(bp, BNX2_DRV_MSG_CODE_KEEP_VLAN_UPDATE, 0, 1);
 
-        bnx2_netif_start(bp);
+        bnx2_netif_start(bp, false);
 }
 #endif
 
@@ -7050,9 +7056,9 @@ bnx2_set_coalesce(struct net_device *dev, struct ethtool_coalesce *coal)
         bp->stats_ticks &= BNX2_HC_STATS_TICKS_HC_STAT_TICKS;
 
         if (netif_running(bp->dev)) {
-                bnx2_netif_stop(bp);
+                bnx2_netif_stop(bp, true);
                 bnx2_init_nic(bp, 0);
-                bnx2_netif_start(bp);
+                bnx2_netif_start(bp, true);
         }
 
         return 0;
@@ -7082,7 +7088,7 @@ bnx2_change_ring_size(struct bnx2 *bp, u32 rx, u32 tx)
                 /* Reset will erase chipset stats; save them */
                 bnx2_save_stats(bp);
 
-                bnx2_netif_stop(bp);
+                bnx2_netif_stop(bp, true);
                 bnx2_reset_chip(bp, BNX2_DRV_MSG_CODE_RESET);
                 bnx2_free_skbs(bp);
                 bnx2_free_mem(bp);
@@ -7110,7 +7116,7 @@ bnx2_change_ring_size(struct bnx2 *bp, u32 rx, u32 tx)
                         bnx2_setup_cnic_irq_info(bp);
                 mutex_unlock(&bp->cnic_lock);
 #endif
-                bnx2_netif_start(bp);
+                bnx2_netif_start(bp, true);
         }
         return 0;
 }
@@ -7363,7 +7369,7 @@ bnx2_self_test(struct net_device *dev, struct ethtool_test *etest, u64 *buf)
         if (etest->flags & ETH_TEST_FL_OFFLINE) {
                 int i;
 
-                bnx2_netif_stop(bp);
+                bnx2_netif_stop(bp, true);
                 bnx2_reset_chip(bp, BNX2_DRV_MSG_CODE_DIAG);
                 bnx2_free_skbs(bp);
 
@@ -7382,7 +7388,7 @@ bnx2_self_test(struct net_device *dev, struct ethtool_test *etest, u64 *buf)
                         bnx2_shutdown_chip(bp);
                 else {
                         bnx2_init_nic(bp, 1);
-                        bnx2_netif_start(bp);
+                        bnx2_netif_start(bp, true);
                 }
 
                 /* wait for link up */
@@ -8376,7 +8382,7 @@ bnx2_suspend(struct pci_dev *pdev, pm_message_t state)
                 return 0;
 
         flush_scheduled_work();
-        bnx2_netif_stop(bp);
+        bnx2_netif_stop(bp, true);
         netif_device_detach(dev);
         del_timer_sync(&bp->timer);
         bnx2_shutdown_chip(bp);
@@ -8398,7 +8404,7 @@ bnx2_resume(struct pci_dev *pdev)
         bnx2_set_power_state(bp, PCI_D0);
         netif_device_attach(dev);
         bnx2_init_nic(bp, 1);
-        bnx2_netif_start(bp);
+        bnx2_netif_start(bp, true);
         return 0;
 }
 
@@ -8425,7 +8431,7 @@ static pci_ers_result_t bnx2_io_error_detected(struct pci_dev *pdev,
         }
 
         if (netif_running(dev)) {
-                bnx2_netif_stop(bp);
+                bnx2_netif_stop(bp, true);
                 del_timer_sync(&bp->timer);
                 bnx2_reset_nic(bp, BNX2_DRV_MSG_CODE_RESET);
         }
@@ -8482,7 +8488,7 @@ static void bnx2_io_resume(struct pci_dev *pdev)
 
         rtnl_lock();
         if (netif_running(dev))
-                bnx2_netif_start(bp);
+                bnx2_netif_start(bp, true);
 
         netif_device_attach(dev);
         rtnl_unlock();
diff --git a/drivers/net/e1000e/netdev.c b/drivers/net/e1000e/netdev.c
index 904bd6bf3199..d13760dc27f8 100644
--- a/drivers/net/e1000e/netdev.c
+++ b/drivers/net/e1000e/netdev.c
@@ -5020,6 +5020,9 @@ static void __e1000e_disable_aspm(struct pci_dev *pdev, u16 state)
         reg16 &= ~state;
         pci_write_config_word(pdev, pos + PCI_EXP_LNKCTL, reg16);
 
+        if (!pdev->bus->self)
+                return;
+
         pos = pci_pcie_cap(pdev->bus->self);
         pci_read_config_word(pdev->bus->self, pos + PCI_EXP_LNKCTL, &reg16);
         reg16 &= ~state;
diff --git a/drivers/net/gianfar.c b/drivers/net/gianfar.c
index 0cef967499d3..5267c27e3174 100644
--- a/drivers/net/gianfar.c
+++ b/drivers/net/gianfar.c
@@ -1567,9 +1567,9 @@ static void gfar_halt_nodisable(struct net_device *dev)
                 tempval |= (DMACTRL_GRS | DMACTRL_GTS);
                 gfar_write(&regs->dmactrl, tempval);
 
-                while (!(gfar_read(&regs->ievent) &
-                         (IEVENT_GRSC | IEVENT_GTSC)))
-                        cpu_relax();
+                spin_event_timeout(((gfar_read(&regs->ievent) &
+                         (IEVENT_GRSC | IEVENT_GTSC)) ==
+                         (IEVENT_GRSC | IEVENT_GTSC)), -1, 0);
         }
 }
 
diff --git a/drivers/net/pcmcia/smc91c92_cs.c b/drivers/net/pcmcia/smc91c92_cs.c
index 408f3d7b1545..949ac1a12537 100644
--- a/drivers/net/pcmcia/smc91c92_cs.c
+++ b/drivers/net/pcmcia/smc91c92_cs.c
@@ -1804,23 +1804,30 @@ static void media_check(u_long arg)
     SMC_SELECT_BANK(1);
     media |= (inw(ioaddr + CONFIG) & CFG_AUI_SELECT) ? 2 : 1;
 
+    SMC_SELECT_BANK(saved_bank);
+    spin_unlock_irqrestore(&smc->lock, flags);
+
     /* Check for pending interrupt with watchdog flag set: with
        this, we can limp along even if the interrupt is blocked */
     if (smc->watchdog++ && ((i>>8) & i)) {
         if (!smc->fast_poll)
             printk(KERN_INFO "%s: interrupt(s) dropped!\n", dev->name);
+        local_irq_save(flags);
         smc_interrupt(dev->irq, dev);
+        local_irq_restore(flags);
         smc->fast_poll = HZ;
     }
     if (smc->fast_poll) {
         smc->fast_poll--;
         smc->media.expires = jiffies + HZ/100;
         add_timer(&smc->media);
-        SMC_SELECT_BANK(saved_bank);
-        spin_unlock_irqrestore(&smc->lock, flags);
         return;
     }
 
+    spin_lock_irqsave(&smc->lock, flags);
+
+    saved_bank = inw(ioaddr + BANK_SELECT);
+
     if (smc->cfg & CFG_MII_SELECT) {
         if (smc->mii_if.phy_id < 0)
             goto reschedule;
@@ -1978,15 +1985,16 @@ static int smc_get_settings(struct net_device *dev, struct ethtool_cmd *ecmd)
         unsigned int ioaddr = dev->base_addr;
         u16 saved_bank = inw(ioaddr + BANK_SELECT);
         int ret;
+        unsigned long flags;
 
-        spin_lock_irq(&smc->lock);
+        spin_lock_irqsave(&smc->lock, flags);
         SMC_SELECT_BANK(3);
         if (smc->cfg & CFG_MII_SELECT)
                 ret = mii_ethtool_gset(&smc->mii_if, ecmd);
         else
                 ret = smc_netdev_get_ecmd(dev, ecmd);
         SMC_SELECT_BANK(saved_bank);
-        spin_unlock_irq(&smc->lock);
+        spin_unlock_irqrestore(&smc->lock, flags);
         return ret;
 }
 
@@ -1996,15 +2004,16 @@ static int smc_set_settings(struct net_device *dev, struct ethtool_cmd *ecmd)
         unsigned int ioaddr = dev->base_addr;
         u16 saved_bank = inw(ioaddr + BANK_SELECT);
         int ret;
+        unsigned long flags;
 
-        spin_lock_irq(&smc->lock);
+        spin_lock_irqsave(&smc->lock, flags);
         SMC_SELECT_BANK(3);
         if (smc->cfg & CFG_MII_SELECT)
                 ret = mii_ethtool_sset(&smc->mii_if, ecmd);
         else
                 ret = smc_netdev_set_ecmd(dev, ecmd);
         SMC_SELECT_BANK(saved_bank);
-        spin_unlock_irq(&smc->lock);
+        spin_unlock_irqrestore(&smc->lock, flags);
         return ret;
 }
 
@@ -2014,12 +2023,13 @@ static u32 smc_get_link(struct net_device *dev)
         unsigned int ioaddr = dev->base_addr;
         u16 saved_bank = inw(ioaddr + BANK_SELECT);
         u32 ret;
+        unsigned long flags;
 
-        spin_lock_irq(&smc->lock);
+        spin_lock_irqsave(&smc->lock, flags);
         SMC_SELECT_BANK(3);
         ret = smc_link_ok(dev);
         SMC_SELECT_BANK(saved_bank);
-        spin_unlock_irq(&smc->lock);
+        spin_unlock_irqrestore(&smc->lock, flags);
         return ret;
 }
 
@@ -2056,16 +2066,17 @@ static int smc_ioctl (struct net_device *dev, struct ifreq *rq, int cmd)
         int rc = 0;
         u16 saved_bank;
         unsigned int ioaddr = dev->base_addr;
+        unsigned long flags;
 
         if (!netif_running(dev))
                 return -EINVAL;
 
-        spin_lock_irq(&smc->lock);
+        spin_lock_irqsave(&smc->lock, flags);
         saved_bank = inw(ioaddr + BANK_SELECT);
         SMC_SELECT_BANK(3);
         rc = generic_mii_ioctl(&smc->mii_if, mii, cmd, NULL);
         SMC_SELECT_BANK(saved_bank);
-        spin_unlock_irq(&smc->lock);
+        spin_unlock_irqrestore(&smc->lock, flags);
         return rc;
 }
 
diff --git a/drivers/net/sb1250-mac.c b/drivers/net/sb1250-mac.c
index ba4770a6c2e4..fec3c29b2ea8 100644
--- a/drivers/net/sb1250-mac.c
+++ b/drivers/net/sb1250-mac.c
@@ -2256,17 +2256,36 @@ static int sbmac_init(struct platform_device *pldev, long long base)
 
         sc->mii_bus = mdiobus_alloc();
         if (sc->mii_bus == NULL) {
-                sbmac_uninitctx(sc);
-                return -ENOMEM;
+                err = -ENOMEM;
+                goto uninit_ctx;
         }
 
+        sc->mii_bus->name = sbmac_mdio_string;
+        snprintf(sc->mii_bus->id, MII_BUS_ID_SIZE, "%x", idx);
+        sc->mii_bus->priv = sc;
+        sc->mii_bus->read = sbmac_mii_read;
+        sc->mii_bus->write = sbmac_mii_write;
+        sc->mii_bus->irq = sc->phy_irq;
+        for (i = 0; i < PHY_MAX_ADDR; ++i)
+                sc->mii_bus->irq[i] = SBMAC_PHY_INT;
+
+        sc->mii_bus->parent = &pldev->dev;
+        /*
+         * Probe PHY address
+         */
+        err = mdiobus_register(sc->mii_bus);
+        if (err) {
+                printk(KERN_ERR "%s: unable to register MDIO bus\n",
+                       dev->name);
+                goto free_mdio;
+        }
+        dev_set_drvdata(&pldev->dev, sc->mii_bus);
+
         err = register_netdev(dev);
         if (err) {
                 printk(KERN_ERR "%s.%d: unable to register netdev\n",
                        sbmac_string, idx);
-                mdiobus_free(sc->mii_bus);
-                sbmac_uninitctx(sc);
-                return err;
+                goto unreg_mdio;
         }
 
         pr_info("%s.%d: registered as %s\n", sbmac_string, idx, dev->name);
@@ -2282,19 +2301,15 @@ static int sbmac_init(struct platform_device *pldev, long long base)
         pr_info("%s: SiByte Ethernet at 0x%08Lx, address: %pM\n",
                dev->name, base, eaddr);
 
-        sc->mii_bus->name = sbmac_mdio_string;
-        snprintf(sc->mii_bus->id, MII_BUS_ID_SIZE, "%x", idx);
-        sc->mii_bus->priv = sc;
-        sc->mii_bus->read = sbmac_mii_read;
-        sc->mii_bus->write = sbmac_mii_write;
-        sc->mii_bus->irq = sc->phy_irq;
-        for (i = 0; i < PHY_MAX_ADDR; ++i)
-                sc->mii_bus->irq[i] = SBMAC_PHY_INT;
-
-        sc->mii_bus->parent = &pldev->dev;
-        dev_set_drvdata(&pldev->dev, sc->mii_bus);
-
         return 0;
+unreg_mdio:
+        mdiobus_unregister(sc->mii_bus);
+        dev_set_drvdata(&pldev->dev, NULL);
+free_mdio:
+        mdiobus_free(sc->mii_bus);
+uninit_ctx:
+        sbmac_uninitctx(sc);
+        return err;
 }
 
 
@@ -2320,16 +2335,6 @@ static int sbmac_open(struct net_device *dev)
                 goto out_err;
         }
 
-        /*
-         * Probe PHY address
-         */
-        err = mdiobus_register(sc->mii_bus);
-        if (err) {
-                printk(KERN_ERR "%s: unable to register MDIO bus\n",
-                       dev->name);
-                goto out_unirq;
-        }
-
         sc->sbm_speed = sbmac_speed_none;
         sc->sbm_duplex = sbmac_duplex_none;
         sc->sbm_fc = sbmac_fc_none;
@@ -2360,11 +2365,7 @@ static int sbmac_open(struct net_device *dev)
         return 0;
 
 out_unregister:
-        mdiobus_unregister(sc->mii_bus);
-
-out_unirq:
         free_irq(dev->irq, dev);
-
 out_err:
         return err;
 }
@@ -2553,9 +2554,6 @@ static int sbmac_close(struct net_device *dev)
 
         phy_disconnect(sc->phy_dev);
         sc->phy_dev = NULL;
-
-        mdiobus_unregister(sc->mii_bus);
-
         free_irq(dev->irq, dev);
 
         sbdma_emptyring(&(sc->sbm_txdma));
@@ -2662,6 +2660,7 @@ static int __exit sbmac_remove(struct platform_device *pldev)
 
         unregister_netdev(dev);
         sbmac_uninitctx(sc);
+        mdiobus_unregister(sc->mii_bus);
         mdiobus_free(sc->mii_bus);
         iounmap(sc->sbm_base);
         free_netdev(dev);
diff --git a/drivers/net/sfc/efx.c b/drivers/net/sfc/efx.c
index bc75ef683c9f..156460527231 100644
--- a/drivers/net/sfc/efx.c
+++ b/drivers/net/sfc/efx.c
@@ -1870,6 +1870,7 @@ out:
         }
 
         if (disabled) {
+                dev_close(efx->net_dev);
                 EFX_ERR(efx, "has been disabled\n");
                 efx->state = STATE_DISABLED;
         } else {
@@ -1893,8 +1894,7 @@ static void efx_reset_work(struct work_struct *data)
         }
 
         rtnl_lock();
-        if (efx_reset(efx, efx->reset_pending))
-                dev_close(efx->net_dev);
+        (void)efx_reset(efx, efx->reset_pending);
         rtnl_unlock();
 }
 
diff --git a/drivers/net/sfc/falcon.c b/drivers/net/sfc/falcon.c
index f7df24dce38a..655b697b45b2 100644
--- a/drivers/net/sfc/falcon.c
+++ b/drivers/net/sfc/falcon.c
@@ -1326,7 +1326,9 @@ static int falcon_probe_nvconfig(struct efx_nic *efx)
 
         EFX_LOG(efx, "PHY is %d phy_id %d\n", efx->phy_type, efx->mdio.prtad);
 
-        falcon_probe_board(efx, board_rev);
+        rc = falcon_probe_board(efx, board_rev);
+        if (rc)
+                goto fail2;
 
         kfree(nvconfig);
         return 0;
diff --git a/drivers/net/sfc/falcon_boards.c b/drivers/net/sfc/falcon_boards.c
index 5712fddd72f2..c7a933a3292e 100644
--- a/drivers/net/sfc/falcon_boards.c
+++ b/drivers/net/sfc/falcon_boards.c
@@ -728,15 +728,7 @@ static const struct falcon_board_type board_types[] = {
         },
 };
 
-static const struct falcon_board_type falcon_dummy_board = {
-        .init           = efx_port_dummy_op_int,
-        .init_phy       = efx_port_dummy_op_void,
-        .fini           = efx_port_dummy_op_void,
-        .set_id_led     = efx_port_dummy_op_set_id_led,
-        .monitor        = efx_port_dummy_op_int,
-};
-
-void falcon_probe_board(struct efx_nic *efx, u16 revision_info)
+int falcon_probe_board(struct efx_nic *efx, u16 revision_info)
 {
         struct falcon_board *board = falcon_board(efx);
         u8 type_id = FALCON_BOARD_TYPE(revision_info);
@@ -754,8 +746,9 @@ void falcon_probe_board(struct efx_nic *efx, u16 revision_info)
                          (efx->pci_dev->subsystem_vendor == EFX_VENDID_SFC)
                          ? board->type->ref_model : board->type->gen_type,
                          'A' + board->major, board->minor);
+                return 0;
         } else {
                 EFX_ERR(efx, "unknown board type %d\n", type_id);
-                board->type = &falcon_dummy_board;
+                return -ENODEV;
         }
 }
diff --git a/drivers/net/sfc/nic.h b/drivers/net/sfc/nic.h
index 5825f37b51bd..bbc2c0c2f843 100644
--- a/drivers/net/sfc/nic.h
+++ b/drivers/net/sfc/nic.h
@@ -158,7 +158,7 @@ extern struct efx_nic_type siena_a0_nic_type;
  **************************************************************************
  */
 
-extern void falcon_probe_board(struct efx_nic *efx, u16 revision_info);
+extern int falcon_probe_board(struct efx_nic *efx, u16 revision_info);
 
 /* TX data path */
 extern int efx_nic_probe_tx(struct efx_tx_queue *tx_queue);
diff --git a/drivers/net/sfc/siena.c b/drivers/net/sfc/siena.c
index 7bf93faff3ab..727b4228e081 100644
--- a/drivers/net/sfc/siena.c
+++ b/drivers/net/sfc/siena.c
@@ -475,8 +475,17 @@ static int siena_try_update_nic_stats(struct efx_nic *efx)
 
 static void siena_update_nic_stats(struct efx_nic *efx)
 {
-        while (siena_try_update_nic_stats(efx) == -EAGAIN)
-                cpu_relax();
+        int retry;
+
+        /* If we're unlucky enough to read statistics wduring the DMA, wait
+         * up to 10ms for it to finish (typically takes <500us) */
+        for (retry = 0; retry < 100; ++retry) {
+                if (siena_try_update_nic_stats(efx) == 0)
+                        return;
+                udelay(100);
+        }
+
+        /* Use the old values instead */
 }
 
 static void siena_start_nic_stats(struct efx_nic *efx)
diff --git a/drivers/net/usb/Kconfig b/drivers/net/usb/Kconfig
index 63be4caec70e..d7b7018a1de1 100644
--- a/drivers/net/usb/Kconfig
+++ b/drivers/net/usb/Kconfig
@@ -397,4 +397,13 @@ config USB_IPHETH
 
           For more information: http://giagio.com/wiki/moin.cgi/iPhoneEthernetDriver
 
+config USB_SIERRA_NET
+        tristate "USB-to-WWAN Driver for Sierra Wireless modems"
+        depends on USB_USBNET
+        help
+          Choose this option if you have a Sierra Wireless USB-to-WWAN device.
+
+          To compile this driver as a module, choose M here: the
+          module will be called sierra_net.
+
 endmenu
diff --git a/drivers/net/usb/Makefile b/drivers/net/usb/Makefile
index edb09c0ddf8e..b13a279663ba 100644
--- a/drivers/net/usb/Makefile
+++ b/drivers/net/usb/Makefile
@@ -24,4 +24,5 @@ obj-$(CONFIG_USB_USBNET)	+= usbnet.o
 obj-$(CONFIG_USB_NET_INT51X1)   += int51x1.o
 obj-$(CONFIG_USB_CDC_PHONET)    += cdc-phonet.o
 obj-$(CONFIG_USB_IPHETH)        += ipheth.o
+obj-$(CONFIG_USB_SIERRA_NET)    += sierra_net.o
 
diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
index 811b2dc423d1..b3fe0de40469 100644
--- a/drivers/net/usb/cdc_ether.c
+++ b/drivers/net/usb/cdc_ether.c
@@ -466,6 +466,7 @@ static const struct driver_info mbm_info = {
         .bind =         cdc_bind,
         .unbind =       usbnet_cdc_unbind,
         .status =       cdc_status,
+        .manage_power = cdc_manage_power,
 };
 
 /*-------------------------------------------------------------------------*/
diff --git a/drivers/net/usb/ipheth.c b/drivers/net/usb/ipheth.c
index fd1033130a81..418825d26f90 100644
--- a/drivers/net/usb/ipheth.c
+++ b/drivers/net/usb/ipheth.c
@@ -122,25 +122,25 @@ static int ipheth_alloc_urbs(struct ipheth_device *iphone)
 
         tx_urb = usb_alloc_urb(0, GFP_KERNEL);
         if (tx_urb == NULL)
-                goto error;
+                goto error_nomem;
 
         rx_urb = usb_alloc_urb(0, GFP_KERNEL);
         if (rx_urb == NULL)
-                goto error;
+                goto free_tx_urb;
 
         tx_buf = usb_buffer_alloc(iphone->udev,
                                   IPHETH_BUF_SIZE,
                                   GFP_KERNEL,
                                   &tx_urb->transfer_dma);
         if (tx_buf == NULL)
-                goto error;
+                goto free_rx_urb;
 
         rx_buf = usb_buffer_alloc(iphone->udev,
                                   IPHETH_BUF_SIZE,
                                   GFP_KERNEL,
                                   &rx_urb->transfer_dma);
         if (rx_buf == NULL)
-                goto error;
+                goto free_tx_buf;
 
 
         iphone->tx_urb = tx_urb;
@@ -149,13 +149,14 @@ static int ipheth_alloc_urbs(struct ipheth_device *iphone)
         iphone->rx_buf = rx_buf;
         return 0;
 
-error:
-        usb_buffer_free(iphone->udev, IPHETH_BUF_SIZE, rx_buf,
-                        rx_urb->transfer_dma);
+free_tx_buf:
         usb_buffer_free(iphone->udev, IPHETH_BUF_SIZE, tx_buf,
                         tx_urb->transfer_dma);
+free_rx_urb:
         usb_free_urb(rx_urb);
+free_tx_urb:
         usb_free_urb(tx_urb);
+error_nomem:
         return -ENOMEM;
 }
 
diff --git a/drivers/net/usb/kaweth.c b/drivers/net/usb/kaweth.c
index 52671ea043a7..c4c334d9770f 100644
--- a/drivers/net/usb/kaweth.c
+++ b/drivers/net/usb/kaweth.c
@@ -145,6 +145,7 @@ static struct usb_device_id usb_klsi_table[] = {
         { USB_DEVICE(0x0707, 0x0100) }, /* SMC 2202USB */
         { USB_DEVICE(0x07aa, 0x0001) }, /* Correga K.K. */
         { USB_DEVICE(0x07b8, 0x4000) }, /* D-Link DU-E10 */
+        { USB_DEVICE(0x07c9, 0xb010) }, /* Allied Telesyn AT-USB10 USB Ethernet Adapter */
         { USB_DEVICE(0x0846, 0x1001) }, /* NetGear EA-101 */
         { USB_DEVICE(0x0846, 0x1002) }, /* NetGear EA-101 */
         { USB_DEVICE(0x085a, 0x0008) }, /* PortGear Ethernet Adapter */
diff --git a/drivers/net/usb/sierra_net.c b/drivers/net/usb/sierra_net.c
new file mode 100644
index 000000000000..f1942d69a0d5
--- /dev/null
+++ b/drivers/net/usb/sierra_net.c
@@ -0,0 +1,1004 @@
+/*
+ * USB-to-WWAN Driver for Sierra Wireless modems
+ *
+ * Copyright (C) 2008, 2009, 2010 Paxton Smith, Matthew Safar, Rory Filer
+ *                          <linux@sierrawireless.com>
+ *
+ * Portions of this based on the cdc_ether driver by David Brownell (2003-2005)
+ * and Ole Andre Vadla Ravnas (ActiveSync) (2006).
+ *
+ * IMPORTANT DISCLAIMER: This driver is not commercially supported by
+ * Sierra Wireless. Use at your own risk.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ */
+
+#define DRIVER_VERSION "v.2.0"
+#define DRIVER_AUTHOR "Paxton Smith, Matthew Safar, Rory Filer"
+#define DRIVER_DESC "USB-to-WWAN Driver for Sierra Wireless modems"
+static const char driver_name[] = "sierra_net";
+
+/* if defined debug messages enabled */
+/*#define       DEBUG*/
+
+#include <linux/module.h>
+#include <linux/etherdevice.h>
+#include <linux/ethtool.h>
+#include <linux/mii.h>
+#include <linux/sched.h>
+#include <linux/timer.h>
+#include <linux/usb.h>
+#include <linux/usb/cdc.h>
+#include <net/ip.h>
+#include <net/udp.h>
+#include <asm/unaligned.h>
+#include <linux/usb/usbnet.h>
+
+#define SWI_USB_REQUEST_GET_FW_ATTR     0x06
+#define SWI_GET_FW_ATTR_MASK            0x08
+
+/* atomic counter partially included in MAC address to make sure 2 devices
+ * do not end up with the same MAC - concept breaks in case of > 255 ifaces
+ */
+static  atomic_t iface_counter = ATOMIC_INIT(0);
+
+/*
+ * SYNC Timer Delay definition used to set the expiry time
+ */
+#define SIERRA_NET_SYNCDELAY (2*HZ)
+
+/* Max. MTU supported. The modem buffers are limited to 1500 */
+#define SIERRA_NET_MAX_SUPPORTED_MTU    1500
+
+/* The SIERRA_NET_USBCTL_BUF_LEN defines a buffer size allocated for control
+ * message reception ... and thus the max. received packet.
+ * (May be the cause for parse_hip returning -EINVAL)
+ */
+#define SIERRA_NET_USBCTL_BUF_LEN       1024
+
+/* list of interface numbers - used for constructing interface lists */
+struct sierra_net_iface_info {
+        const u32 infolen;      /* number of interface numbers on list */
+        const u8  *ifaceinfo;   /* pointer to the array holding the numbers */
+};
+
+struct sierra_net_info_data {
+        u16 rx_urb_size;
+        struct sierra_net_iface_info whitelist;
+};
+
+/* Private data structure */
+struct sierra_net_data {
+
+        u8 ethr_hdr_tmpl[ETH_HLEN]; /* ethernet header template for rx'd pkts */
+
+        u16 link_up;            /* air link up or down */
+        u8 tx_hdr_template[4];  /* part of HIP hdr for tx'd packets */
+
+        u8 sync_msg[4];         /* SYNC message */
+        u8 shdwn_msg[4];        /* Shutdown message */
+
+        /* Backpointer to the container */
+        struct usbnet *usbnet;
+
+        u8 ifnum;       /* interface number */
+
+/* Bit masks, must be a power of 2 */
+#define SIERRA_NET_EVENT_RESP_AVAIL    0x01
+#define SIERRA_NET_TIMER_EXPIRY        0x02
+        unsigned long kevent_flags;
+        struct work_struct sierra_net_kevent;
+        struct timer_list sync_timer; /* For retrying SYNC sequence */
+};
+
+struct param {
+        int is_present;
+        union {
+                void  *ptr;
+                u32    dword;
+                u16    word;
+                u8     byte;
+        };
+};
+
+/* HIP message type */
+#define SIERRA_NET_HIP_EXTENDEDID       0x7F
+#define SIERRA_NET_HIP_HSYNC_ID         0x60    /* Modem -> host */
+#define SIERRA_NET_HIP_RESTART_ID       0x62    /* Modem -> host */
+#define SIERRA_NET_HIP_MSYNC_ID         0x20    /* Host -> modem */
+#define SIERRA_NET_HIP_SHUTD_ID         0x26    /* Host -> modem */
+
+#define SIERRA_NET_HIP_EXT_IP_IN_ID   0x0202
+#define SIERRA_NET_HIP_EXT_IP_OUT_ID  0x0002
+
+/* 3G UMTS Link Sense Indication definitions */
+#define SIERRA_NET_HIP_LSI_UMTSID       0x78
+
+/* Reverse Channel Grant Indication HIP message */
+#define SIERRA_NET_HIP_RCGI             0x64
+
+/* LSI Protocol types */
+#define SIERRA_NET_PROTOCOL_UMTS      0x01
+/* LSI Coverage */
+#define SIERRA_NET_COVERAGE_NONE      0x00
+#define SIERRA_NET_COVERAGE_NOPACKET  0x01
+
+/* LSI Session */
+#define SIERRA_NET_SESSION_IDLE       0x00
+/* LSI Link types */
+#define SIERRA_NET_AS_LINK_TYPE_IPv4  0x00
+
+struct lsi_umts {
+        u8 protocol;
+        u8 unused1;
+        __be16 length;
+        /* eventually use a union for the rest - assume umts for now */
+        u8 coverage;
+        u8 unused2[41];
+        u8 session_state;
+        u8 unused3[33];
+        u8 link_type;
+        u8 pdp_addr_len; /* NW-supplied PDP address len */
+        u8 pdp_addr[16]; /* NW-supplied PDP address (bigendian)) */
+        u8 unused4[23];
+        u8 dns1_addr_len; /* NW-supplied 1st DNS address len (bigendian) */
+        u8 dns1_addr[16]; /* NW-supplied 1st DNS address */
+        u8 dns2_addr_len; /* NW-supplied 2nd DNS address len */
+        u8 dns2_addr[16]; /* NW-supplied 2nd DNS address (bigendian)*/
+        u8 wins1_addr_len; /* NW-supplied 1st Wins address len */
+        u8 wins1_addr[16]; /* NW-supplied 1st Wins address (bigendian)*/
+        u8 wins2_addr_len; /* NW-supplied 2nd Wins address len */
+        u8 wins2_addr[16]; /* NW-supplied 2nd Wins address (bigendian) */
+        u8 unused5[4];
+        u8 gw_addr_len; /* NW-supplied GW address len */
+        u8 gw_addr[16]; /* NW-supplied GW address (bigendian) */
+        u8 reserved[8];
+} __attribute__ ((packed));
+
+#define SIERRA_NET_LSI_COMMON_LEN      4
+#define SIERRA_NET_LSI_UMTS_LEN        (sizeof(struct lsi_umts))
+#define SIERRA_NET_LSI_UMTS_STATUS_LEN \
+        (SIERRA_NET_LSI_UMTS_LEN - SIERRA_NET_LSI_COMMON_LEN)
+
+/* Forward definitions */
+static void sierra_sync_timer(unsigned long syncdata);
+static int sierra_net_change_mtu(struct net_device *net, int new_mtu);
+
+/* Our own net device operations structure */
+static const struct net_device_ops sierra_net_device_ops = {
+        .ndo_open               = usbnet_open,
+        .ndo_stop               = usbnet_stop,
+        .ndo_start_xmit         = usbnet_start_xmit,
+        .ndo_tx_timeout         = usbnet_tx_timeout,
+        .ndo_change_mtu         = sierra_net_change_mtu,
+        .ndo_set_mac_address    = eth_mac_addr,
+        .ndo_validate_addr      = eth_validate_addr,
+};
+
+/* get private data associated with passed in usbnet device */
+static inline struct sierra_net_data *sierra_net_get_private(struct usbnet *dev)
+{
+        return (struct sierra_net_data *)dev->data[0];
+}
+
+/* set private data associated with passed in usbnet device */
+static inline void sierra_net_set_private(struct usbnet *dev,
+                        struct sierra_net_data *priv)
+{
+        dev->data[0] = (unsigned long)priv;
+}
+
+/* is packet IPv4 */
+static inline int is_ip(struct sk_buff *skb)
+{
+        return (skb->protocol == cpu_to_be16(ETH_P_IP));
+}
+
+/*
+ * check passed in packet and make sure that:
+ *  - it is linear (no scatter/gather)
+ *  - it is ethernet (mac_header properly set)
+ */
+static int check_ethip_packet(struct sk_buff *skb, struct usbnet *dev)
+{
+        skb_reset_mac_header(skb); /* ethernet header */
+
+        if (skb_is_nonlinear(skb)) {
+                netdev_err(dev->net, "Non linear buffer-dropping\n");
+                return 0;
+        }
+
+        if (!pskb_may_pull(skb, ETH_HLEN))
+                return 0;
+        skb->protocol = eth_hdr(skb)->h_proto;
+
+        return 1;
+}
+
+static const u8 *save16bit(struct param *p, const u8 *datap)
+{
+        p->is_present = 1;
+        p->word = get_unaligned_be16(datap);
+        return datap + sizeof(p->word);
+}
+
+static const u8 *save8bit(struct param *p, const u8 *datap)
+{
+        p->is_present = 1;
+        p->byte = *datap;
+        return datap + sizeof(p->byte);
+}
+
+/*----------------------------------------------------------------------------*
+ *                              BEGIN HIP                                     *
+ *----------------------------------------------------------------------------*/
+/* HIP header */
+#define SIERRA_NET_HIP_HDR_LEN 4
+/* Extended HIP header */
+#define SIERRA_NET_HIP_EXT_HDR_LEN 6
+
+struct hip_hdr {
+        int    hdrlen;
+        struct param payload_len;
+        struct param msgid;
+        struct param msgspecific;
+        struct param extmsgid;
+};
+
+static int parse_hip(const u8 *buf, const u32 buflen, struct hip_hdr *hh)
+{
+        const u8 *curp = buf;
+        int    padded;
+
+        if (buflen < SIERRA_NET_HIP_HDR_LEN)
+                return -EPROTO;
+
+        curp = save16bit(&hh->payload_len, curp);
+        curp = save8bit(&hh->msgid, curp);
+        curp = save8bit(&hh->msgspecific, curp);
+
+        padded = hh->msgid.byte & 0x80;
+        hh->msgid.byte &= 0x7F;                 /* 7 bits */
+
+        hh->extmsgid.is_present = (hh->msgid.byte == SIERRA_NET_HIP_EXTENDEDID);
+        if (hh->extmsgid.is_present) {
+                if (buflen < SIERRA_NET_HIP_EXT_HDR_LEN)
+                        return -EPROTO;
+
+                hh->payload_len.word &= 0x3FFF; /* 14 bits */
+
+                curp = save16bit(&hh->extmsgid, curp);
+                hh->extmsgid.word &= 0x03FF;    /* 10 bits */
+
+                hh->hdrlen = SIERRA_NET_HIP_EXT_HDR_LEN;
+        } else {
+                hh->payload_len.word &= 0x07FF; /* 11 bits */
+                hh->hdrlen = SIERRA_NET_HIP_HDR_LEN;
+        }
+
+        if (padded) {
+                hh->hdrlen++;
+                hh->payload_len.word--;
+        }
+
+        /* if real packet shorter than the claimed length */
+        if (buflen < (hh->hdrlen + hh->payload_len.word))
+                return -EINVAL;
+
+        return 0;
+}
+
+static void build_hip(u8 *buf, const u16 payloadlen,
+                struct sierra_net_data *priv)
+{
+        /* the following doesn't have the full functionality. We
+         * currently build only one kind of header, so it is faster this way
+         */
+        put_unaligned_be16(payloadlen, buf);
+        memcpy(buf+2, priv->tx_hdr_template, sizeof(priv->tx_hdr_template));
+}
+/*----------------------------------------------------------------------------*
+ *                              END HIP                                       *
+ *----------------------------------------------------------------------------*/
+
+static int sierra_net_send_cmd(struct usbnet *dev,
+                u8 *cmd, int cmdlen, const char * cmd_name)
+{
+        struct sierra_net_data *priv = sierra_net_get_private(dev);
+        int  status;
+
+        status = usb_control_msg(dev->udev, usb_sndctrlpipe(dev->udev, 0),
+                        USB_CDC_SEND_ENCAPSULATED_COMMAND,
+                        USB_DIR_OUT|USB_TYPE_CLASS|USB_RECIP_INTERFACE, 0,
+                        priv->ifnum, cmd, cmdlen, USB_CTRL_SET_TIMEOUT);
+
+        if (status != cmdlen && status != -ENODEV)
+                netdev_err(dev->net, "Submit %s failed %d\n", cmd_name, status);
+
+        return status;
+}
+
+static int sierra_net_send_sync(struct usbnet *dev)
+{
+        int  status;
+        struct sierra_net_data *priv = sierra_net_get_private(dev);
+
+        dev_dbg(&dev->udev->dev, "%s", __func__);
+
+        status = sierra_net_send_cmd(dev, priv->sync_msg,
+                        sizeof(priv->sync_msg), "SYNC");
+
+        return status;
+}
+
+static void sierra_net_set_ctx_index(struct sierra_net_data *priv, u8 ctx_ix)
+{
+        dev_dbg(&(priv->usbnet->udev->dev), "%s %d", __func__, ctx_ix);
+        priv->tx_hdr_template[0] = 0x3F;
+        priv->tx_hdr_template[1] = ctx_ix;
+        *((u16 *)&priv->tx_hdr_template[2]) =
+                cpu_to_be16(SIERRA_NET_HIP_EXT_IP_OUT_ID);
+}
+
+static inline int sierra_net_is_valid_addrlen(u8 len)
+{
+        return (len == sizeof(struct in_addr));
+}
+
+static int sierra_net_parse_lsi(struct usbnet *dev, char *data, int datalen)
+{
+        struct lsi_umts *lsi = (struct lsi_umts *)data;
+
+        if (datalen < sizeof(struct lsi_umts)) {
+                netdev_err(dev->net, "%s: Data length %d, exp %Zu\n",
+                                __func__, datalen,
+                                sizeof(struct lsi_umts));
+                return -1;
+        }
+
+        if (lsi->length != cpu_to_be16(SIERRA_NET_LSI_UMTS_STATUS_LEN)) {
+                netdev_err(dev->net, "%s: LSI_UMTS_STATUS_LEN %d, exp %u\n",
+                                __func__, be16_to_cpu(lsi->length),
+                                (u32)SIERRA_NET_LSI_UMTS_STATUS_LEN);
+                return -1;
+        }
+
+        /* Validate the protocol  - only support UMTS for now */
+        if (lsi->protocol != SIERRA_NET_PROTOCOL_UMTS) {
+                netdev_err(dev->net, "Protocol unsupported, 0x%02x\n",
+                        lsi->protocol);
+                return -1;
+        }
+
+        /* Validate the link type */
+        if (lsi->link_type != SIERRA_NET_AS_LINK_TYPE_IPv4) {
+                netdev_err(dev->net, "Link type unsupported: 0x%02x\n",
+                        lsi->link_type);
+                return -1;
+        }
+
+        /* Validate the coverage */
+        if (lsi->coverage == SIERRA_NET_COVERAGE_NONE
+           || lsi->coverage == SIERRA_NET_COVERAGE_NOPACKET) {
+                netdev_err(dev->net, "No coverage, 0x%02x\n", lsi->coverage);
+                return 0;
+        }
+
+        /* Validate the session state */
+        if (lsi->session_state == SIERRA_NET_SESSION_IDLE) {
+                netdev_err(dev->net, "Session idle, 0x%02x\n",
+                        lsi->session_state);
+                return 0;
+        }
+
+        /* Set link_sense true */
+        return 1;
+}
+
+static void sierra_net_handle_lsi(struct usbnet *dev, char *data,
+                struct hip_hdr  *hh)
+{
+        struct sierra_net_data *priv = sierra_net_get_private(dev);
+        int link_up;
+
+        link_up = sierra_net_parse_lsi(dev, data + hh->hdrlen,
+                                        hh->payload_len.word);
+        if (link_up < 0) {
+                netdev_err(dev->net, "Invalid LSI\n");
+                return;
+        }
+        if (link_up) {
+                sierra_net_set_ctx_index(priv, hh->msgspecific.byte);
+                priv->link_up = 1;
+                netif_carrier_on(dev->net);
+        } else {
+                priv->link_up = 0;
+                netif_carrier_off(dev->net);
+        }
+}
+
+static void sierra_net_dosync(struct usbnet *dev)
+{
+        int status;
+        struct sierra_net_data *priv = sierra_net_get_private(dev);
+
+        dev_dbg(&dev->udev->dev, "%s", __func__);
+
+        /* tell modem we are ready */
+        status = sierra_net_send_sync(dev);
+        if (status < 0)
+                netdev_err(dev->net,
+                        "Send SYNC failed, status %d\n", status);
+        status = sierra_net_send_sync(dev);
+        if (status < 0)
+                netdev_err(dev->net,
+                        "Send SYNC failed, status %d\n", status);
+
+        /* Now, start a timer and make sure we get the Restart Indication */
+        priv->sync_timer.function = sierra_sync_timer;
+        priv->sync_timer.data = (unsigned long) dev;
+        priv->sync_timer.expires = jiffies + SIERRA_NET_SYNCDELAY;
+        add_timer(&priv->sync_timer);
+}
+
+static void sierra_net_kevent(struct work_struct *work)
+{
+        struct sierra_net_data *priv =
+                container_of(work, struct sierra_net_data, sierra_net_kevent);
+        struct usbnet *dev = priv->usbnet;
+        int  len;
+        int  err;
+        u8  *buf;
+        u8   ifnum;
+
+        if (test_bit(SIERRA_NET_EVENT_RESP_AVAIL, &priv->kevent_flags)) {
+                clear_bit(SIERRA_NET_EVENT_RESP_AVAIL, &priv->kevent_flags);
+
+                /* Query the modem for the LSI message */
+                buf = kzalloc(SIERRA_NET_USBCTL_BUF_LEN, GFP_KERNEL);
+                if (!buf) {
+                        netdev_err(dev->net,
+                                "failed to allocate buf for LS msg\n");
+                        return;
+                }
+                ifnum = priv->ifnum;
+                len = usb_control_msg(dev->udev, usb_rcvctrlpipe(dev->udev, 0),
+                                USB_CDC_GET_ENCAPSULATED_RESPONSE,
+                                USB_DIR_IN|USB_TYPE_CLASS|USB_RECIP_INTERFACE,
+                                0, ifnum, buf, SIERRA_NET_USBCTL_BUF_LEN,
+                                USB_CTRL_SET_TIMEOUT);
+
+                if (len < 0) {
+                        netdev_err(dev->net,
+                                "usb_control_msg failed, status %d\n", len);
+                } else {
+                        struct hip_hdr  hh;
+
+                        dev_dbg(&dev->udev->dev, "%s: Received status message,"
+                                " %04x bytes", __func__, len);
+
+                        err = parse_hip(buf, len, &hh);
+                        if (err) {
+                                netdev_err(dev->net, "%s: Bad packet,"
+                                        " parse result %d\n", __func__, err);
+                                kfree(buf);
+                                return;
+                        }
+
+                        /* Validate packet length */
+                        if (len != hh.hdrlen + hh.payload_len.word) {
+                                netdev_err(dev->net, "%s: Bad packet, received"
+                                        " %d, expected %d\n",   __func__, len,
+                                        hh.hdrlen + hh.payload_len.word);
+                                kfree(buf);
+                                return;
+                        }
+
+                        /* Switch on received message types */
+                        switch (hh.msgid.byte) {
+                        case SIERRA_NET_HIP_LSI_UMTSID:
+                                dev_dbg(&dev->udev->dev, "LSI for ctx:%d",
+                                        hh.msgspecific.byte);
+                                sierra_net_handle_lsi(dev, buf, &hh);
+                                break;
+                        case SIERRA_NET_HIP_RESTART_ID:
+                                dev_dbg(&dev->udev->dev, "Restart reported: %d,"
+                                                " stopping sync timer",
+                                                hh.msgspecific.byte);
+                                /* Got sync resp - stop timer & clear mask */
+                                del_timer_sync(&priv->sync_timer);
+                                clear_bit(SIERRA_NET_TIMER_EXPIRY,
+                                          &priv->kevent_flags);
+                                break;
+                        case SIERRA_NET_HIP_HSYNC_ID:
+                                dev_dbg(&dev->udev->dev, "SYNC received");
+                                err = sierra_net_send_sync(dev);
+                                if (err < 0)
+                                        netdev_err(dev->net,
+                                                "Send SYNC failed %d\n", err);
+                                break;
+                        case SIERRA_NET_HIP_EXTENDEDID:
+                                netdev_err(dev->net, "Unrecognized HIP msg, "
+                                        "extmsgid 0x%04x\n", hh.extmsgid.word);
+                                break;
+                        case SIERRA_NET_HIP_RCGI:
+                                /* Ignored */
+                                break;
+                        default:
+                                netdev_err(dev->net, "Unrecognized HIP msg, "
+                                        "msgid 0x%02x\n", hh.msgid.byte);
+                                break;
+                        }
+                }
+                kfree(buf);
+        }
+        /* The sync timer bit might be set */
+        if (test_bit(SIERRA_NET_TIMER_EXPIRY, &priv->kevent_flags)) {
+                clear_bit(SIERRA_NET_TIMER_EXPIRY, &priv->kevent_flags);
+                dev_dbg(&dev->udev->dev, "Deferred sync timer expiry");
+                sierra_net_dosync(priv->usbnet);
+        }
+
+        if (priv->kevent_flags)
+                dev_dbg(&dev->udev->dev, "sierra_net_kevent done, "
+                        "kevent_flags = 0x%lx", priv->kevent_flags);
+}
+
+static void sierra_net_defer_kevent(struct usbnet *dev, int work)
+{
+        struct sierra_net_data *priv = sierra_net_get_private(dev);
+
+        set_bit(work, &priv->kevent_flags);
+        schedule_work(&priv->sierra_net_kevent);
+}
+
+/*
+ * Sync Retransmit Timer Handler. On expiry, kick the work queue
+ */
+void sierra_sync_timer(unsigned long syncdata)
+{
+        struct usbnet *dev = (struct usbnet *)syncdata;
+
+        dev_dbg(&dev->udev->dev, "%s", __func__);
+        /* Kick the tasklet */
+        sierra_net_defer_kevent(dev, SIERRA_NET_TIMER_EXPIRY);
+}
+
+static void sierra_net_status(struct usbnet *dev, struct urb *urb)
+{
+        struct usb_cdc_notification *event;
+
+        dev_dbg(&dev->udev->dev, "%s", __func__);
+
+        if (urb->actual_length < sizeof *event)
+                return;
+
+        /* Add cases to handle other standard notifications. */
+        event = urb->transfer_buffer;
+        switch (event->bNotificationType) {
+        case USB_CDC_NOTIFY_NETWORK_CONNECTION:
+        case USB_CDC_NOTIFY_SPEED_CHANGE:
+                /* USB 305 sends those */
+                break;
+        case USB_CDC_NOTIFY_RESPONSE_AVAILABLE:
+                sierra_net_defer_kevent(dev, SIERRA_NET_EVENT_RESP_AVAIL);
+                break;
+        default:
+                netdev_err(dev->net, ": unexpected notification %02x!\n",
+                                event->bNotificationType);
+                break;
+        }
+}
+
+static void sierra_net_get_drvinfo(struct net_device *net,
+                struct ethtool_drvinfo *info)
+{
+        /* Inherit standard device info */
+        usbnet_get_drvinfo(net, info);
+        strncpy(info->driver, driver_name, sizeof info->driver);
+        strncpy(info->version, DRIVER_VERSION, sizeof info->version);
+}
+
+static u32 sierra_net_get_link(struct net_device *net)
+{
+        struct usbnet *dev = netdev_priv(net);
+        /* Report link is down whenever the interface is down */
+        return sierra_net_get_private(dev)->link_up && netif_running(net);
+}
+
+static struct ethtool_ops sierra_net_ethtool_ops = {
+        .get_drvinfo = sierra_net_get_drvinfo,
+        .get_link = sierra_net_get_link,
+        .get_msglevel = usbnet_get_msglevel,
+        .set_msglevel = usbnet_set_msglevel,
+        .get_settings = usbnet_get_settings,
+        .set_settings = usbnet_set_settings,
+        .nway_reset = usbnet_nway_reset,
+};
+
+/* MTU can not be more than 1500 bytes, enforce it. */
+static int sierra_net_change_mtu(struct net_device *net, int new_mtu)
+{
+        if (new_mtu > SIERRA_NET_MAX_SUPPORTED_MTU)
+                return -EINVAL;
+
+        return usbnet_change_mtu(net, new_mtu);
+}
+
+static int is_whitelisted(const u8 ifnum,
+                        const struct sierra_net_iface_info *whitelist)
+{
+        if (whitelist) {
+                const u8 *list = whitelist->ifaceinfo;
+                int i;
+
+                for (i = 0; i < whitelist->infolen; i++) {
+                        if (list[i] == ifnum)
+                                return 1;
+                }
+        }
+        return 0;
+}
+
+static int sierra_net_get_fw_attr(struct usbnet *dev, u16 *datap)
+{
+        int result = 0;
+        u16 *attrdata;
+
+        attrdata = kmalloc(sizeof(*attrdata), GFP_KERNEL);
+        if (!attrdata)
+                return -ENOMEM;
+
+        result = usb_control_msg(
+                        dev->udev,
+                        usb_rcvctrlpipe(dev->udev, 0),
+                        /* _u8 vendor specific request */
+                        SWI_USB_REQUEST_GET_FW_ATTR,
+                        USB_DIR_IN | USB_TYPE_VENDOR,   /* __u8 request type */
+                        0x0000,         /* __u16 value not used */
+                        0x0000,         /* __u16 index  not used */
+                        attrdata,       /* char *data */
+                        sizeof(*attrdata),              /* __u16 size */
+                        USB_CTRL_SET_TIMEOUT);  /* int timeout */
+
+        if (result < 0) {
+                kfree(attrdata);
+                return -EIO;
+        }
+
+        *datap = *attrdata;
+
+        kfree(attrdata);
+        return result;
+}
+
+/*
+ * collects the bulk endpoints, the status endpoint.
+ */
+static int sierra_net_bind(struct usbnet *dev, struct usb_interface *intf)
+{
+        u8      ifacenum;
+        u8      numendpoints;
+        u16     fwattr = 0;
+        int     status;
+        struct ethhdr *eth;
+        struct sierra_net_data *priv;
+        static const u8 sync_tmplate[sizeof(priv->sync_msg)] = {
+                0x00, 0x00, SIERRA_NET_HIP_MSYNC_ID, 0x00};
+        static const u8 shdwn_tmplate[sizeof(priv->shdwn_msg)] = {
+                0x00, 0x00, SIERRA_NET_HIP_SHUTD_ID, 0x00};
+
+        struct sierra_net_info_data *data =
+                        (struct sierra_net_info_data *)dev->driver_info->data;
+
+        dev_dbg(&dev->udev->dev, "%s", __func__);
+
+        ifacenum = intf->cur_altsetting->desc.bInterfaceNumber;
+        /* We only accept certain interfaces */
+        if (!is_whitelisted(ifacenum, &data->whitelist)) {
+                dev_dbg(&dev->udev->dev, "Ignoring interface: %d", ifacenum);
+                return -ENODEV;
+        }
+        numendpoints = intf->cur_altsetting->desc.bNumEndpoints;
+        /* We have three endpoints, bulk in and out, and a status */
+        if (numendpoints != 3) {
+                dev_err(&dev->udev->dev, "Expected 3 endpoints, found: %d",
+                        numendpoints);
+                return -ENODEV;
+        }
+        /* Status endpoint set in usbnet_get_endpoints() */
+        dev->status = NULL;
+        status = usbnet_get_endpoints(dev, intf);
+        if (status < 0) {
+                dev_err(&dev->udev->dev, "Error in usbnet_get_endpoints (%d)",
+                        status);
+                return -ENODEV;
+        }
+        /* Initialize sierra private data */
+        priv = kzalloc(sizeof *priv, GFP_KERNEL);
+        if (!priv) {
+                dev_err(&dev->udev->dev, "No memory");
+                return -ENOMEM;
+        }
+
+        priv->usbnet = dev;
+        priv->ifnum = ifacenum;
+        dev->net->netdev_ops = &sierra_net_device_ops;
+
+        /* change MAC addr to include, ifacenum, and to be unique */
+        dev->net->dev_addr[ETH_ALEN-2] = atomic_inc_return(&iface_counter);
+        dev->net->dev_addr[ETH_ALEN-1] = ifacenum;
+
+        /* we will have to manufacture ethernet headers, prepare template */
+        eth = (struct ethhdr *)priv->ethr_hdr_tmpl;
+        memcpy(&eth->h_dest, dev->net->dev_addr, ETH_ALEN);
+        eth->h_proto = cpu_to_be16(ETH_P_IP);
+
+        /* prepare shutdown message template */
+        memcpy(priv->shdwn_msg, shdwn_tmplate, sizeof(priv->shdwn_msg));
+        /* set context index initially to 0 - prepares tx hdr template */
+        sierra_net_set_ctx_index(priv, 0);
+
+        /* decrease the rx_urb_size and max_tx_size to 4k on USB 1.1 */
+        dev->rx_urb_size  = data->rx_urb_size;
+        if (dev->udev->speed != USB_SPEED_HIGH)
+                dev->rx_urb_size  = min_t(size_t, 4096, data->rx_urb_size);
+
+        dev->net->hard_header_len += SIERRA_NET_HIP_EXT_HDR_LEN;
+        dev->hard_mtu = dev->net->mtu + dev->net->hard_header_len;
+
+        /* Set up the netdev */
+        dev->net->flags |= IFF_NOARP;
+        dev->net->ethtool_ops = &sierra_net_ethtool_ops;
+        netif_carrier_off(dev->net);
+
+        sierra_net_set_private(dev, priv);
+
+        priv->kevent_flags = 0;
+
+        /* Use the shared workqueue */
+        INIT_WORK(&priv->sierra_net_kevent, sierra_net_kevent);
+
+        /* Only need to do this once */
+        init_timer(&priv->sync_timer);
+
+        /* verify fw attributes */
+        status = sierra_net_get_fw_attr(dev, &fwattr);
+        dev_dbg(&dev->udev->dev, "Fw attr: %x\n", fwattr);
+
+        /* test whether firmware supports DHCP */
+        if (!(status == sizeof(fwattr) && (fwattr & SWI_GET_FW_ATTR_MASK))) {
+                /* found incompatible firmware version */
+                dev_err(&dev->udev->dev, "Incompatible driver and firmware"
+                        " versions\n");
+                kfree(priv);
+                return -ENODEV;
+        }
+        /* prepare sync message from template */
+        memcpy(priv->sync_msg, sync_tmplate, sizeof(priv->sync_msg));
+
+        /* initiate the sync sequence */
+        sierra_net_dosync(dev);
+
+        return 0;
+}
+
+static void sierra_net_unbind(struct usbnet *dev, struct usb_interface *intf)
+{
+        int status;
+        struct sierra_net_data *priv = sierra_net_get_private(dev);
+
+        dev_dbg(&dev->udev->dev, "%s", __func__);
+
+        /* Kill the timer then flush the work queue */
+        del_timer_sync(&priv->sync_timer);
+
+        flush_scheduled_work();
+
+        /* tell modem we are going away */
+        status = sierra_net_send_cmd(dev, priv->shdwn_msg,
+                        sizeof(priv->shdwn_msg), "Shutdown");
+        if (status < 0)
+                netdev_err(dev->net,
+                        "usb_control_msg failed, status %d\n", status);
+
+        sierra_net_set_private(dev, NULL);
+
+        kfree(priv);
+}
+
+static struct sk_buff *sierra_net_skb_clone(struct usbnet *dev,
+                struct sk_buff *skb, int len)
+{
+        struct sk_buff *new_skb;
+
+        /* clone skb */
+        new_skb = skb_clone(skb, GFP_ATOMIC);
+
+        /* remove len bytes from original */
+        skb_pull(skb, len);
+
+        /* trim next packet to it's length */
+        if (new_skb) {
+                skb_trim(new_skb, len);
+        } else {
+                if (netif_msg_rx_err(dev))
+                        netdev_err(dev->net, "failed to get skb\n");
+                dev->net->stats.rx_dropped++;
+        }
+
+        return new_skb;
+}
+
+/* ---------------------------- Receive data path ----------------------*/
+static int sierra_net_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
+{
+        int err;
+        struct hip_hdr  hh;
+        struct sk_buff *new_skb;
+
+        dev_dbg(&dev->udev->dev, "%s", __func__);
+
+        /* could contain multiple packets */
+        while (likely(skb->len)) {
+                err = parse_hip(skb->data, skb->len, &hh);
+                if (err) {
+                        if (netif_msg_rx_err(dev))
+                                netdev_err(dev->net, "Invalid HIP header %d\n",
+                                        err);
+                        /* dev->net->stats.rx_errors incremented by caller */
+                        dev->net->stats.rx_length_errors++;
+                        return 0;
+                }
+
+                /* Validate Extended HIP header */
+                if (!hh.extmsgid.is_present
+                    || hh.extmsgid.word != SIERRA_NET_HIP_EXT_IP_IN_ID) {
+                        if (netif_msg_rx_err(dev))
+                                netdev_err(dev->net, "HIP/ETH: Invalid pkt\n");
+
+                        dev->net->stats.rx_frame_errors++;
+                        /* dev->net->stats.rx_errors incremented by caller */;
+                        return 0;
+                }
+
+                skb_pull(skb, hh.hdrlen);
+
+                /* We are going to accept this packet, prepare it */
+                memcpy(skb->data, sierra_net_get_private(dev)->ethr_hdr_tmpl,
+                        ETH_HLEN);
+
+                /* Last packet in batch handled by usbnet */
+                if (hh.payload_len.word == skb->len)
+                        return 1;
+
+                new_skb = sierra_net_skb_clone(dev, skb, hh.payload_len.word);
+                if (new_skb)
+                        usbnet_skb_return(dev, new_skb);
+
+        } /* while */
+
+        return 0;
+}
+
+/* ---------------------------- Transmit data path ----------------------*/
+struct sk_buff *sierra_net_tx_fixup(struct usbnet *dev, struct sk_buff *skb,
+                gfp_t flags)
+{
+        struct sierra_net_data *priv = sierra_net_get_private(dev);
+        u16 len;
+        bool need_tail;
+
+        dev_dbg(&dev->udev->dev, "%s", __func__);
+        if (priv->link_up && check_ethip_packet(skb, dev) && is_ip(skb)) {
+                /* enough head room as is? */
+                if (SIERRA_NET_HIP_EXT_HDR_LEN <= skb_headroom(skb)) {
+                        /* Save the Eth/IP length and set up HIP hdr */
+                        len = skb->len;
+                        skb_push(skb, SIERRA_NET_HIP_EXT_HDR_LEN);
+                        /* Handle ZLP issue */
+                        need_tail = ((len + SIERRA_NET_HIP_EXT_HDR_LEN)
+                                % dev->maxpacket == 0);
+                        if (need_tail) {
+                                if (unlikely(skb_tailroom(skb) == 0)) {
+                                        netdev_err(dev->net, "tx_fixup:"
+                                                "no room for packet\n");
+                                        dev_kfree_skb_any(skb);
+                                        return NULL;
+                                } else {
+                                        skb->data[skb->len] = 0;
+                                        __skb_put(skb, 1);
+                                        len = len + 1;
+                                }
+                        }
+                        build_hip(skb->data, len, priv);
+                        return skb;
+                } else {
+                        /*
+                         * compensate in the future if necessary
+                         */
+                        netdev_err(dev->net, "tx_fixup: no room for HIP\n");
+                } /* headroom */
+        }
+
+        if (!priv->link_up)
+                dev->net->stats.tx_carrier_errors++;
+
+        /* tx_dropped incremented by usbnet */
+
+        /* filter the packet out, release it  */
+        dev_kfree_skb_any(skb);
+        return NULL;
+}
+
+static const u8 sierra_net_ifnum_list[] = { 7, 10, 11 };
+static const struct sierra_net_info_data sierra_net_info_data_68A3 = {
+        .rx_urb_size = 8 * 1024,
+        .whitelist = {
+                .infolen = ARRAY_SIZE(sierra_net_ifnum_list),
+                .ifaceinfo = sierra_net_ifnum_list
+        }
+};
+
+static const struct driver_info sierra_net_info_68A3 = {
+        .description = "Sierra Wireless USB-to-WWAN Modem",
+        .flags = FLAG_WWAN | FLAG_SEND_ZLP,
+        .bind = sierra_net_bind,
+        .unbind = sierra_net_unbind,
+        .status = sierra_net_status,
+        .rx_fixup = sierra_net_rx_fixup,
+        .tx_fixup = sierra_net_tx_fixup,
+        .data = (unsigned long)&sierra_net_info_data_68A3,
+};
+
+static const struct usb_device_id products[] = {
+        {USB_DEVICE(0x1199, 0x68A3), /* Sierra Wireless USB-to-WWAN modem */
+        .driver_info = (unsigned long) &sierra_net_info_68A3},
+
+        {}, /* last item */
+};
+MODULE_DEVICE_TABLE(usb, products);
+
+/* We are based on usbnet, so let it handle the USB driver specifics */
+static struct usb_driver sierra_net_driver = {
+        .name = "sierra_net",
+        .id_table = products,
+        .probe = usbnet_probe,
+        .disconnect = usbnet_disconnect,
+        .suspend = usbnet_suspend,
+        .resume = usbnet_resume,
+        .no_dynamic_id = 1,
+};
+
+static int __init sierra_net_init(void)
+{
+        BUILD_BUG_ON(FIELD_SIZEOF(struct usbnet, data)
+                                < sizeof(struct cdc_state));
+
+        return usb_register(&sierra_net_driver);
+}
+
+static void __exit sierra_net_exit(void)
+{
+        usb_deregister(&sierra_net_driver);
+}
+
+module_exit(sierra_net_exit);
+module_init(sierra_net_init);
+
+MODULE_AUTHOR(DRIVER_AUTHOR);
+MODULE_DESCRIPTION(DRIVER_DESC);
+MODULE_VERSION(DRIVER_VERSION);
+MODULE_LICENSE("GPL");
diff --git a/drivers/net/wireless/p54/p54pci.c b/drivers/net/wireless/p54/p54pci.c
index 679da7e7522e..ca42ccb23d76 100644
--- a/drivers/net/wireless/p54/p54pci.c
+++ b/drivers/net/wireless/p54/p54pci.c
@@ -246,7 +246,7 @@ static void p54p_check_tx_ring(struct ieee80211_hw *dev, u32 *index,
         u32 idx, i;
 
         i = (*index) % ring_limit;
-        (*index) = idx = le32_to_cpu(ring_control->device_idx[1]);
+        (*index) = idx = le32_to_cpu(ring_control->device_idx[ring_index]);
         idx %= ring_limit;
 
         while (i != idx) {
diff --git a/include/net/sctp/command.h b/include/net/sctp/command.h
index 8be5135ff7aa..2c55a7ea20af 100644
--- a/include/net/sctp/command.h
+++ b/include/net/sctp/command.h
@@ -107,6 +107,7 @@ typedef enum {
         SCTP_CMD_T1_RETRAN,      /* Mark for retransmission after T1 timeout  */
         SCTP_CMD_UPDATE_INITTAG, /* Update peer inittag */
         SCTP_CMD_SEND_MSG,       /* Send the whole use message */
+        SCTP_CMD_SEND_NEXT_ASCONF, /* Send the next ASCONF after ACK */
         SCTP_CMD_LAST
 } sctp_verb_t;
 
diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h
index 59151557406c..e9a408718636 100644
--- a/include/net/sctp/sctp.h
+++ b/include/net/sctp/sctp.h
@@ -128,6 +128,7 @@ extern int sctp_register_pf(struct sctp_pf *, sa_family_t);
 int sctp_backlog_rcv(struct sock *sk, struct sk_buff *skb);
 int sctp_inet_listen(struct socket *sock, int backlog);
 void sctp_write_space(struct sock *sk);
+void sctp_data_ready(struct sock *sk, int len);
 unsigned int sctp_poll(struct file *file, struct socket *sock,
                 poll_table *wait);
 void sctp_sock_rfree(struct sk_buff *skb);
diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
index ff3017744711..597f8e27aaf6 100644
--- a/include/net/sctp/structs.h
+++ b/include/net/sctp/structs.h
@@ -778,6 +778,7 @@ int sctp_user_addto_chunk(struct sctp_chunk *chunk, int off, int len,
                           struct iovec *data);
 void sctp_chunk_free(struct sctp_chunk *);
 void  *sctp_addto_chunk(struct sctp_chunk *, int len, const void *data);
+void  *sctp_addto_chunk_fixed(struct sctp_chunk *, int len, const void *data);
 struct sctp_chunk *sctp_chunkify(struct sk_buff *,
                                  const struct sctp_association *,
                                  struct sock *);
diff --git a/include/net/sock.h b/include/net/sock.h
index cc7f91ec972c..328e03f47dd1 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -74,7 +74,7 @@
                                         printk(KERN_DEBUG msg); } while (0)
 #else
 /* Validate arguments and do nothing */
-static void inline int __attribute__ ((format (printf, 2, 3)))
+static inline void __attribute__ ((format (printf, 2, 3)))
 SOCK_DEBUG(struct sock *sk, const char *msg, ...)
 {
 }
diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
index c1e60eed5a97..864c76f4a678 100644
--- a/net/bluetooth/l2cap.c
+++ b/net/bluetooth/l2cap.c
@@ -1626,7 +1626,10 @@ static int l2cap_sock_sendmsg(struct kiocb *iocb, struct socket *sock, struct ms
         /* Connectionless channel */
         if (sk->sk_type == SOCK_DGRAM) {
                 skb = l2cap_create_connless_pdu(sk, msg, len);
-                err = l2cap_do_send(sk, skb);
+                if (IS_ERR(skb))
+                        err = PTR_ERR(skb);
+                else
+                        err = l2cap_do_send(sk, skb);
                 goto done;
         }
 
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index 78cbc39f56c4..e0a3e3537b14 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -70,17 +70,13 @@ int inet_csk_bind_conflict(const struct sock *sk,
                     (!sk->sk_bound_dev_if ||
                      !sk2->sk_bound_dev_if ||
                      sk->sk_bound_dev_if == sk2->sk_bound_dev_if)) {
-                        const __be32 sk2_rcv_saddr = inet_rcv_saddr(sk2);
-
                         if (!reuse || !sk2->sk_reuse ||
                             sk2->sk_state == TCP_LISTEN) {
+                                const __be32 sk2_rcv_saddr = inet_rcv_saddr(sk2);
                                 if (!sk2_rcv_saddr || !sk_rcv_saddr ||
                                     sk2_rcv_saddr == sk_rcv_saddr)
                                         break;
-                        } else if (reuse && sk2->sk_reuse &&
-                                   sk2_rcv_saddr &&
-                                   sk2_rcv_saddr == sk_rcv_saddr)
-                                break;
+                        }
                 }
         }
         return node != NULL;
@@ -124,11 +120,9 @@ again:
                                                 smallest_size = tb->num_owners;
                                                 smallest_rover = rover;
                                                 if (atomic_read(&hashinfo->bsockets) > (high - low) + 1) {
-                                                        if (!inet_csk(sk)->icsk_af_ops->bind_conflict(sk, tb)) {
-                                                                spin_unlock(&head->lock);
-                                                                snum = smallest_rover;
-                                                                goto have_snum;
-                                                        }
+                                                        spin_unlock(&head->lock);
+                                                        snum = smallest_rover;
+                                                        goto have_snum;
                                                 }
                                         }
                                         goto next;
diff --git a/net/ipv6/inet6_connection_sock.c b/net/ipv6/inet6_connection_sock.c
index 9ca1efc923a1..0c5e3c3b7fd5 100644
--- a/net/ipv6/inet6_connection_sock.c
+++ b/net/ipv6/inet6_connection_sock.c
@@ -42,16 +42,11 @@ int inet6_csk_bind_conflict(const struct sock *sk,
                 if (sk != sk2 &&
                     (!sk->sk_bound_dev_if ||
                      !sk2->sk_bound_dev_if ||
-                     sk->sk_bound_dev_if == sk2->sk_bound_dev_if)) {
-                        if ((!sk->sk_reuse || !sk2->sk_reuse ||
-                             sk2->sk_state == TCP_LISTEN) &&
-                             ipv6_rcv_saddr_equal(sk, sk2))
-                                break;
-                        else if (sk->sk_reuse && sk2->sk_reuse &&
-                                !ipv6_addr_any(inet6_rcv_saddr(sk)) &&
-                                ipv6_rcv_saddr_equal(sk, sk2))
-                                break;
-                }
+                     sk->sk_bound_dev_if == sk2->sk_bound_dev_if) &&
+                    (!sk->sk_reuse || !sk2->sk_reuse ||
+                     sk2->sk_state == TCP_LISTEN) &&
+                     ipv6_rcv_saddr_equal(sk, sk2))
+                        break;
         }
 
         return node != NULL;
diff --git a/net/sctp/associola.c b/net/sctp/associola.c
index df5abbff63e2..99c93ee98ad9 100644
--- a/net/sctp/associola.c
+++ b/net/sctp/associola.c
@@ -1194,8 +1194,10 @@ void sctp_assoc_update(struct sctp_association *asoc,
         /* Remove any peer addresses not present in the new association. */
         list_for_each_safe(pos, temp, &asoc->peer.transport_addr_list) {
                 trans = list_entry(pos, struct sctp_transport, transports);
-                if (!sctp_assoc_lookup_paddr(new, &trans->ipaddr))
-                        sctp_assoc_del_peer(asoc, &trans->ipaddr);
+                if (!sctp_assoc_lookup_paddr(new, &trans->ipaddr)) {
+                        sctp_assoc_rm_peer(asoc, trans);
+                        continue;
+                }
 
                 if (asoc->state >= SCTP_STATE_ESTABLISHED)
                         sctp_transport_reset(trans);
diff --git a/net/sctp/endpointola.c b/net/sctp/endpointola.c
index 905fda582b92..7ec09ba03a1c 100644
--- a/net/sctp/endpointola.c
+++ b/net/sctp/endpointola.c
@@ -144,6 +144,7 @@ static struct sctp_endpoint *sctp_endpoint_init(struct sctp_endpoint *ep,
         /* Use SCTP specific send buffer space queues.  */
         ep->sndbuf_policy = sctp_sndbuf_policy;
 
+        sk->sk_data_ready = sctp_data_ready;
         sk->sk_write_space = sctp_write_space;
         sock_set_flag(sk, SOCK_USE_WRITE_QUEUE);
 
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index 17cb400ecd6a..30c1767186b8 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -108,7 +108,7 @@ static const struct sctp_paramhdr prsctp_param = {
         cpu_to_be16(sizeof(struct sctp_paramhdr)),
 };
 
-/* A helper to initialize to initialize an op error inside a
+/* A helper to initialize an op error inside a
  * provided chunk, as most cause codes will be embedded inside an
  * abort chunk.
  */
@@ -125,6 +125,29 @@ void  sctp_init_cause(struct sctp_chunk *chunk, __be16 cause_code,
         chunk->subh.err_hdr = sctp_addto_chunk(chunk, sizeof(sctp_errhdr_t), &err);
 }
 
+/* A helper to initialize an op error inside a
+ * provided chunk, as most cause codes will be embedded inside an
+ * abort chunk.  Differs from sctp_init_cause in that it won't oops
+ * if there isn't enough space in the op error chunk
+ */
+int sctp_init_cause_fixed(struct sctp_chunk *chunk, __be16 cause_code,
+                      size_t paylen)
+{
+        sctp_errhdr_t err;
+        __u16 len;
+
+        /* Cause code constants are now defined in network order.  */
+        err.cause = cause_code;
+        len = sizeof(sctp_errhdr_t) + paylen;
+        err.length  = htons(len);
+
+        if (skb_tailroom(chunk->skb) >  len)
+                return -ENOSPC;
+        chunk->subh.err_hdr = sctp_addto_chunk_fixed(chunk,
+                                                     sizeof(sctp_errhdr_t),
+                                                     &err);
+        return 0;
+}
 /* 3.3.2 Initiation (INIT) (1)
  *
  * This chunk is used to initiate a SCTP association between two
@@ -208,7 +231,8 @@ struct sctp_chunk *sctp_make_init(const struct sctp_association *asoc,
         sp = sctp_sk(asoc->base.sk);
         num_types = sp->pf->supported_addrs(sp, types);
 
-        chunksize = sizeof(init) + addrs_len + SCTP_SAT_LEN(num_types);
+        chunksize = sizeof(init) + addrs_len;
+        chunksize += WORD_ROUND(SCTP_SAT_LEN(num_types));
         chunksize += sizeof(ecap_param);
 
         if (sctp_prsctp_enable)
@@ -238,14 +262,14 @@ struct sctp_chunk *sctp_make_init(const struct sctp_association *asoc,
                 /* Add HMACS parameter length if any were defined */
                 auth_hmacs = (sctp_paramhdr_t *)asoc->c.auth_hmacs;
                 if (auth_hmacs->length)
-                        chunksize += ntohs(auth_hmacs->length);
+                        chunksize += WORD_ROUND(ntohs(auth_hmacs->length));
                 else
                         auth_hmacs = NULL;
 
                 /* Add CHUNKS parameter length */
                 auth_chunks = (sctp_paramhdr_t *)asoc->c.auth_chunks;
                 if (auth_chunks->length)
-                        chunksize += ntohs(auth_chunks->length);
+                        chunksize += WORD_ROUND(ntohs(auth_chunks->length));
                 else
                         auth_chunks = NULL;
 
@@ -255,7 +279,8 @@ struct sctp_chunk *sctp_make_init(const struct sctp_association *asoc,
 
         /* If we have any extensions to report, account for that */
         if (num_ext)
-                chunksize += sizeof(sctp_supported_ext_param_t) + num_ext;
+                chunksize += WORD_ROUND(sizeof(sctp_supported_ext_param_t) +
+                                        num_ext);
 
         /* RFC 2960 3.3.2 Initiation (INIT) (1)
          *
@@ -397,13 +422,13 @@ struct sctp_chunk *sctp_make_init_ack(const struct sctp_association *asoc,
 
                 auth_hmacs = (sctp_paramhdr_t *)asoc->c.auth_hmacs;
                 if (auth_hmacs->length)
-                        chunksize += ntohs(auth_hmacs->length);
+                        chunksize += WORD_ROUND(ntohs(auth_hmacs->length));
                 else
                         auth_hmacs = NULL;
 
                 auth_chunks = (sctp_paramhdr_t *)asoc->c.auth_chunks;
                 if (auth_chunks->length)
-                        chunksize += ntohs(auth_chunks->length);
+                        chunksize += WORD_ROUND(ntohs(auth_chunks->length));
                 else
                         auth_chunks = NULL;
 
@@ -412,7 +437,8 @@ struct sctp_chunk *sctp_make_init_ack(const struct sctp_association *asoc,
         }
 
         if (num_ext)
-                chunksize += sizeof(sctp_supported_ext_param_t) + num_ext;
+                chunksize += WORD_ROUND(sizeof(sctp_supported_ext_param_t) +
+                                        num_ext);
 
         /* Now allocate and fill out the chunk.  */
         retval = sctp_make_chunk(asoc, SCTP_CID_INIT_ACK, 0, chunksize);
@@ -1129,6 +1155,24 @@ nodata:
         return retval;
 }
 
+/* Create an Operation Error chunk of a fixed size,
+ * specifically, max(asoc->pathmtu, SCTP_DEFAULT_MAXSEGMENT)
+ * This is a helper function to allocate an error chunk for
+ * for those invalid parameter codes in which we may not want
+ * to report all the errors, if the incomming chunk is large
+ */
+static inline struct sctp_chunk *sctp_make_op_error_fixed(
+        const struct sctp_association *asoc,
+        const struct sctp_chunk *chunk)
+{
+        size_t size = asoc ? asoc->pathmtu : 0;
+
+        if (!size)
+                size = SCTP_DEFAULT_MAXSEGMENT;
+
+        return sctp_make_op_error_space(asoc, chunk, size);
+}
+
 /* Create an Operation Error chunk.  */
 struct sctp_chunk *sctp_make_op_error(const struct sctp_association *asoc,
                                  const struct sctp_chunk *chunk,
@@ -1371,6 +1415,18 @@ void *sctp_addto_chunk(struct sctp_chunk *chunk, int len, const void *data)
         return target;
 }
 
+/* Append bytes to the end of a chunk. Returns NULL if there isn't sufficient
+ * space in the chunk
+ */
+void *sctp_addto_chunk_fixed(struct sctp_chunk *chunk,
+                             int len, const void *data)
+{
+        if (skb_tailroom(chunk->skb) > len)
+                return sctp_addto_chunk(chunk, len, data);
+        else
+                return NULL;
+}
+
 /* Append bytes from user space to the end of a chunk.  Will panic if
  * chunk is not big enough.
  * Returns a kernel err value.
@@ -1974,13 +2030,12 @@ static sctp_ierror_t sctp_process_unk_param(const struct sctp_association *asoc,
                  * returning multiple unknown parameters.
                  */
                 if (NULL == *errp)
-                        *errp = sctp_make_op_error_space(asoc, chunk,
-                                        ntohs(chunk->chunk_hdr->length));
+                        *errp = sctp_make_op_error_fixed(asoc, chunk);
 
                 if (*errp) {
-                        sctp_init_cause(*errp, SCTP_ERROR_UNKNOWN_PARAM,
+                        sctp_init_cause_fixed(*errp, SCTP_ERROR_UNKNOWN_PARAM,
                                         WORD_ROUND(ntohs(param.p->length)));
-                        sctp_addto_chunk(*errp,
+                        sctp_addto_chunk_fixed(*errp,
                                         WORD_ROUND(ntohs(param.p->length)),
                                         param.v);
                 } else {
@@ -3315,21 +3370,6 @@ int sctp_process_asconf_ack(struct sctp_association *asoc,
         sctp_chunk_free(asconf);
         asoc->addip_last_asconf = NULL;
 
-        /* Send the next asconf chunk from the addip chunk queue. */
-        if (!list_empty(&asoc->addip_chunk_list)) {
-                struct list_head *entry = asoc->addip_chunk_list.next;
-                asconf = list_entry(entry, struct sctp_chunk, list);
-
-                list_del_init(entry);
-
-                /* Hold the chunk until an ASCONF_ACK is received. */
-                sctp_chunk_hold(asconf);
-                if (sctp_primitive_ASCONF(asoc, asconf))
-                        sctp_chunk_free(asconf);
-                else
-                        asoc->addip_last_asconf = asconf;
-        }
-
         return retval;
 }
 
diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c
index 4c5bed9af4e3..d5ae450b6f02 100644
--- a/net/sctp/sm_sideeffect.c
+++ b/net/sctp/sm_sideeffect.c
@@ -962,6 +962,29 @@ static int sctp_cmd_send_msg(struct sctp_association *asoc,
 }
 
 
+/* Sent the next ASCONF packet currently stored in the association.
+ * This happens after the ASCONF_ACK was succeffully processed.
+ */
+static void sctp_cmd_send_asconf(struct sctp_association *asoc)
+{
+        /* Send the next asconf chunk from the addip chunk
+         * queue.
+         */
+        if (!list_empty(&asoc->addip_chunk_list)) {
+                struct list_head *entry = asoc->addip_chunk_list.next;
+                struct sctp_chunk *asconf = list_entry(entry,
+                                                struct sctp_chunk, list);
+                list_del_init(entry);
+
+                /* Hold the chunk until an ASCONF_ACK is received. */
+                sctp_chunk_hold(asconf);
+                if (sctp_primitive_ASCONF(asoc, asconf))
+                        sctp_chunk_free(asconf);
+                else
+                        asoc->addip_last_asconf = asconf;
+        }
+}
+
 
 /* These three macros allow us to pull the debugging code out of the
  * main flow of sctp_do_sm() to keep attention focused on the real
@@ -1617,6 +1640,9 @@ static int sctp_cmd_interpreter(sctp_event_t event_type,
                         }
                         error = sctp_cmd_send_msg(asoc, cmd->obj.msg);
                         break;
+                case SCTP_CMD_SEND_NEXT_ASCONF:
+                        sctp_cmd_send_asconf(asoc);
+                        break;
                 default:
                         printk(KERN_WARNING "Impossible command: %u, %p\n",
                                cmd->verb, cmd->obj.ptr);
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index abf601a1b847..24b2cd555637 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -3676,8 +3676,14 @@ sctp_disposition_t sctp_sf_do_asconf_ack(const struct sctp_endpoint *ep,
                                 SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO));
 
                 if (!sctp_process_asconf_ack((struct sctp_association *)asoc,
-                                             asconf_ack))
+                                             asconf_ack)) {
+                        /* Successfully processed ASCONF_ACK.  We can
+                         * release the next asconf if we have one.
+                         */
+                        sctp_add_cmd_sf(commands, SCTP_CMD_SEND_NEXT_ASCONF,
+                                        SCTP_NULL());
                         return SCTP_DISPOSITION_CONSUME;
+                }
 
                 abort = sctp_make_abort(asoc, asconf_ack,
                                         sizeof(sctp_errhdr_t));
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index d54700af927a..bae764005d2d 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -3719,9 +3719,9 @@ SCTP_STATIC int sctp_init_sock(struct sock *sk)
         sp->hmac = NULL;
 
         SCTP_DBG_OBJCNT_INC(sock);
-        percpu_counter_inc(&sctp_sockets_allocated);
 
         local_bh_disable();
+        percpu_counter_inc(&sctp_sockets_allocated);
         sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1);
         local_bh_enable();
 
@@ -3738,8 +3738,8 @@ SCTP_STATIC void sctp_destroy_sock(struct sock *sk)
         /* Release our hold on the endpoint. */
         ep = sctp_sk(sk)->ep;
         sctp_endpoint_free(ep);
-        percpu_counter_dec(&sctp_sockets_allocated);
         local_bh_disable();
+        percpu_counter_dec(&sctp_sockets_allocated);
         sock_prot_inuse_add(sock_net(sk), sk->sk_prot, -1);
         local_bh_enable();
 }
@@ -6185,6 +6185,19 @@ do_nonblock:
         goto out;
 }
 
+void sctp_data_ready(struct sock *sk, int len)
+{
+        struct socket_wq *wq;
+
+        rcu_read_lock();
+        wq = rcu_dereference(sk->sk_wq);
+        if (wq_has_sleeper(wq))
+                wake_up_interruptible_sync_poll(&wq->wait, POLLIN |
+                                                POLLRDNORM | POLLRDBAND);
+        sk_wake_async(sk, SOCK_WAKE_WAITD, POLL_IN);
+        rcu_read_unlock();
+}
+
 /* If socket sndbuf has changed, wake up all per association waiters.  */
 void sctp_write_space(struct sock *sk)
 {