Merge tag 'v2.6.33' for its firewire changes since last branch point

Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>

180 files changed, 1868 insertions, 1466 deletions

diff --git a/drivers/net/3c507.c b/drivers/net/3c507.c
index fbc231153e55..77cf0901a441 100644
--- a/drivers/net/3c507.c
+++ b/drivers/net/3c507.c
@@ -56,6 +56,7 @@ static const char version[] =
 #include <linux/errno.h>
 #include <linux/netdevice.h>
 #include <linux/etherdevice.h>
+#include <linux/if_ether.h>
 #include <linux/skbuff.h>
 #include <linux/slab.h>
 #include <linux/init.h>
@@ -734,8 +735,7 @@ static void init_82586_mem(struct net_device *dev)
         memcpy_toio(lp->base, init_words + 5, sizeof(init_words) - 10);
 
         /* Fill in the station address. */
-        memcpy_toio(lp->base+SA_OFFSET, dev->dev_addr,
-                   sizeof(dev->dev_addr));
+        memcpy_toio(lp->base+SA_OFFSET, dev->dev_addr, ETH_ALEN);
 
         /* The Tx-block list is written as needed.  We just set up the values. */
         lp->tx_cmd_link = IDLELOOP + 4;
diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
index e58a65391ad2..dd9a09c72dff 100644
--- a/drivers/net/Kconfig
+++ b/drivers/net/Kconfig
@@ -2346,6 +2346,7 @@ config GELIC_NET
 
 config GELIC_WIRELESS
         bool "PS3 Wireless support"
+        depends on WLAN
         depends on GELIC_NET
         select WIRELESS_EXT
         help
@@ -2358,6 +2359,7 @@ config GELIC_WIRELESS
 config GELIC_WIRELESS_OLD_PSK_INTERFACE
        bool "PS3 Wireless private PSK interface (OBSOLETE)"
        depends on GELIC_WIRELESS
+       select WEXT_PRIV
        help
           This option retains the obsolete private interface to pass
           the PSK from user space programs to the driver.  The PSK
diff --git a/drivers/net/arm/Kconfig b/drivers/net/arm/Kconfig
index c37ee9e6b67b..39e1c0d39476 100644
--- a/drivers/net/arm/Kconfig
+++ b/drivers/net/arm/Kconfig
@@ -68,6 +68,7 @@ config W90P910_ETH
         tristate "Nuvoton w90p910 Ethernet support"
         depends on ARM && ARCH_W90X900
         select PHYLIB
+        select MII
         help
           Say Y here if you want to use built-in Ethernet ports
           on w90p910 processor.
diff --git a/drivers/net/atarilance.c b/drivers/net/atarilance.c
index c5721cb38265..cc9ed8643910 100644
--- a/drivers/net/atarilance.c
+++ b/drivers/net/atarilance.c
@@ -663,7 +663,7 @@ static int lance_open( struct net_device *dev )
         while (--i > 0)
                 if (DREG & CSR0_IDON)
                         break;
-        if (i < 0 || (DREG & CSR0_ERR)) {
+        if (i <= 0 || (DREG & CSR0_ERR)) {
                 DPRINTK( 2, ( "lance_open(): opening %s failed, i=%d, csr0=%04x\n",
                                           dev->name, i, DREG ));
                 DREG = CSR0_STOP;
diff --git a/drivers/net/atlx/atl2.c b/drivers/net/atlx/atl2.c
index c0451d75cdcf..ec52529394ad 100644
--- a/drivers/net/atlx/atl2.c
+++ b/drivers/net/atlx/atl2.c
@@ -1959,12 +1959,15 @@ static int atl2_get_eeprom(struct net_device *netdev,
                 return -ENOMEM;
 
         for (i = first_dword; i < last_dword; i++) {
-                if (!atl2_read_eeprom(hw, i*4, &(eeprom_buff[i-first_dword])))
-                        return -EIO;
+                if (!atl2_read_eeprom(hw, i*4, &(eeprom_buff[i-first_dword]))) {
+                        ret_val = -EIO;
+                        goto free;
+                }
         }
 
         memcpy(bytes, (u8 *)eeprom_buff + (eeprom->offset & 3),
                 eeprom->len);
+free:
         kfree(eeprom_buff);
 
         return ret_val;
diff --git a/drivers/net/ax88796.c b/drivers/net/ax88796.c
index 62d9c9cc5671..1dd4403247ca 100644
--- a/drivers/net/ax88796.c
+++ b/drivers/net/ax88796.c
@@ -921,7 +921,7 @@ static int ax_probe(struct platform_device *pdev)
                 size = (res->end - res->start) + 1;
 
                 ax->mem2 = request_mem_region(res->start, size, pdev->name);
-                if (ax->mem == NULL) {
+                if (ax->mem2 == NULL) {
                         dev_err(&pdev->dev, "cannot reserve registers\n");
                         ret = -ENXIO;
                         goto exit_mem1;
diff --git a/drivers/net/benet/be.h b/drivers/net/benet/be.h
index 9e56014d27ed..5bc74590c73e 100644
--- a/drivers/net/benet/be.h
+++ b/drivers/net/benet/be.h
@@ -275,8 +275,14 @@ struct be_adapter {
         u32 tx_fc;              /* Tx flow control */
         int link_speed;
         u8 port_type;
+        u8 transceiver;
+        u8 generation;          /* BladeEngine ASIC generation */
 };
 
+/* BladeEngine Generation numbers */
+#define BE_GEN2 2
+#define BE_GEN3 3
+
 extern const struct ethtool_ops be_ethtool_ops;
 
 #define drvr_stats(adapter)             (&adapter->stats.drvr_stats)
diff --git a/drivers/net/benet/be_cmds.c b/drivers/net/benet/be_cmds.c
index 1b68bd98dc0c..006cb2efcd22 100644
--- a/drivers/net/benet/be_cmds.c
+++ b/drivers/net/benet/be_cmds.c
@@ -286,7 +286,7 @@ static void be_wrb_hdr_prepare(struct be_mcc_wrb *wrb, int payload_len,
                                 MCC_WRB_SGE_CNT_SHIFT;
         wrb->payload_length = payload_len;
         wrb->tag0 = opcode;
-        be_dws_cpu_to_le(wrb, 20);
+        be_dws_cpu_to_le(wrb, 8);
 }
 
 /* Don't touch the hdr after it's prepared */
@@ -296,6 +296,7 @@ static void be_cmd_hdr_prepare(struct be_cmd_req_hdr *req_hdr,
         req_hdr->opcode = opcode;
         req_hdr->subsystem = subsystem;
         req_hdr->request_length = cpu_to_le32(cmd_len - sizeof(*req_hdr));
+        req_hdr->version = 0;
 }
 
 static void be_cmd_page_addrs_prepare(struct phys_addr *pages, u32 max_pages,
@@ -1479,6 +1480,41 @@ err:
         return status;
 }
 
+int be_cmd_set_loopback(struct be_adapter *adapter, u8 port_num,
+                        u8 loopback_type, u8 enable)
+{
+        struct be_mcc_wrb *wrb;
+        struct be_cmd_req_set_lmode *req;
+        int status;
+
+        spin_lock_bh(&adapter->mcc_lock);
+
+        wrb = wrb_from_mccq(adapter);
+        if (!wrb) {
+                status = -EBUSY;
+                goto err;
+        }
+
+        req = embedded_payload(wrb);
+
+        be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
+                                OPCODE_LOWLEVEL_SET_LOOPBACK_MODE);
+
+        be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_LOWLEVEL,
+                        OPCODE_LOWLEVEL_SET_LOOPBACK_MODE,
+                        sizeof(*req));
+
+        req->src_port = port_num;
+        req->dest_port = port_num;
+        req->loopback_type = loopback_type;
+        req->loopback_state = enable;
+
+        status = be_mcc_notify_wait(adapter);
+err:
+        spin_unlock_bh(&adapter->mcc_lock);
+        return status;
+}
+
 int be_cmd_loopback_test(struct be_adapter *adapter, u32 port_num,
                 u32 loopback_type, u32 pkt_size, u32 num_pkts, u64 pattern)
 {
@@ -1501,6 +1537,7 @@ int be_cmd_loopback_test(struct be_adapter *adapter, u32 port_num,
 
         be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_LOWLEVEL,
                         OPCODE_LOWLEVEL_LOOPBACK_TEST, sizeof(*req));
+        req->hdr.timeout = 4;
 
         req->pattern = cpu_to_le64(pattern);
         req->src_port = cpu_to_le32(port_num);
diff --git a/drivers/net/benet/be_cmds.h b/drivers/net/benet/be_cmds.h
index 92b87ef156ed..13b33c841083 100644
--- a/drivers/net/benet/be_cmds.h
+++ b/drivers/net/benet/be_cmds.h
@@ -155,6 +155,7 @@ struct be_mcc_mailbox {
 
 #define OPCODE_LOWLEVEL_HOST_DDR_DMA                    17
 #define OPCODE_LOWLEVEL_LOOPBACK_TEST                   18
+#define OPCODE_LOWLEVEL_SET_LOOPBACK_MODE               19
 
 struct be_cmd_req_hdr {
         u8 opcode;              /* dword 0 */
@@ -163,7 +164,8 @@ struct be_cmd_req_hdr {
         u8 domain;              /* dword 0 */
         u32 timeout;            /* dword 1 */
         u32 request_length;     /* dword 2 */
-        u32 rsvd;               /* dword 3 */
+        u8 version;             /* dword 3 */
+        u8 rsvd[3];             /* dword 3 */
 };
 
 #define RESP_HDR_INFO_OPCODE_SHIFT      0       /* bits 0 - 7 */
@@ -821,6 +823,19 @@ struct be_cmd_resp_loopback_test {
         u32    ticks_compl;
 };
 
+struct be_cmd_req_set_lmode {
+        struct be_cmd_req_hdr hdr;
+        u8 src_port;
+        u8 dest_port;
+        u8 loopback_type;
+        u8 loopback_state;
+};
+
+struct be_cmd_resp_set_lmode {
+        struct be_cmd_resp_hdr resp_hdr;
+        u8 rsvd0[4];
+};
+
 /********************** DDR DMA test *********************/
 struct be_cmd_req_ddrdma_test {
         struct be_cmd_req_hdr hdr;
@@ -912,3 +927,5 @@ extern int be_cmd_loopback_test(struct be_adapter *adapter, u32 port_num,
                                 u32 num_pkts, u64 pattern);
 extern int be_cmd_ddr_dma_test(struct be_adapter *adapter, u64 pattern,
                         u32 byte_cnt, struct be_dma_mem *cmd);
+extern int be_cmd_set_loopback(struct be_adapter *adapter, u8 port_num,
+                                u8 loopback_type, u8 enable);
diff --git a/drivers/net/benet/be_ethtool.c b/drivers/net/benet/be_ethtool.c
index 298b92cbd689..5d001c4deac1 100644
--- a/drivers/net/benet/be_ethtool.c
+++ b/drivers/net/benet/be_ethtool.c
@@ -118,6 +118,7 @@ static const char et_self_tests[][ETH_GSTRING_LEN] = {
 #define BE_MAC_LOOPBACK 0x0
 #define BE_PHY_LOOPBACK 0x1
 #define BE_ONE_PORT_EXT_LOOPBACK 0x2
+#define BE_NO_LOOPBACK 0xff
 
 static void
 be_get_drvinfo(struct net_device *netdev, struct ethtool_drvinfo *drvinfo)
@@ -339,28 +340,50 @@ static int be_get_settings(struct net_device *netdev, struct ethtool_cmd *ecmd)
 
                 status = be_cmd_read_port_type(adapter, adapter->port_num,
                                                 &connector);
-                switch (connector) {
-                case 7:
-                        ecmd->port = PORT_FIBRE;
-                        break;
-                default:
-                        ecmd->port = PORT_TP;
-                        break;
+                if (!status) {
+                        switch (connector) {
+                        case 7:
+                                ecmd->port = PORT_FIBRE;
+                                ecmd->transceiver = XCVR_EXTERNAL;
+                                break;
+                        case 0:
+                                ecmd->port = PORT_TP;
+                                ecmd->transceiver = XCVR_EXTERNAL;
+                                break;
+                        default:
+                                ecmd->port = PORT_TP;
+                                ecmd->transceiver = XCVR_INTERNAL;
+                                break;
+                        }
+                } else {
+                        ecmd->port = PORT_AUI;
+                        ecmd->transceiver = XCVR_INTERNAL;
                 }
 
                 /* Save for future use */
                 adapter->link_speed = ecmd->speed;
                 adapter->port_type = ecmd->port;
+                adapter->transceiver = ecmd->transceiver;
         } else {
                 ecmd->speed = adapter->link_speed;
                 ecmd->port = adapter->port_type;
+                ecmd->transceiver = adapter->transceiver;
         }
 
         ecmd->duplex = DUPLEX_FULL;
         ecmd->autoneg = AUTONEG_DISABLE;
-        ecmd->supported = (SUPPORTED_10000baseT_Full | SUPPORTED_TP);
         ecmd->phy_address = adapter->port_num;
-        ecmd->transceiver = XCVR_INTERNAL;
+        switch (ecmd->port) {
+        case PORT_FIBRE:
+                ecmd->supported = (SUPPORTED_10000baseT_Full | SUPPORTED_FIBRE);
+                break;
+        case PORT_TP:
+                ecmd->supported = (SUPPORTED_10000baseT_Full | SUPPORTED_TP);
+                break;
+        case PORT_AUI:
+                ecmd->supported = (SUPPORTED_10000baseT_Full | SUPPORTED_AUI);
+                break;
+        }
 
         return 0;
 }
@@ -489,6 +512,19 @@ err:
         return ret;
 }
 
+static u64 be_loopback_test(struct be_adapter *adapter, u8 loopback_type,
+                                u64 *status)
+{
+        be_cmd_set_loopback(adapter, adapter->port_num,
+                                loopback_type, 1);
+        *status = be_cmd_loopback_test(adapter, adapter->port_num,
+                                loopback_type, 1500,
+                                2, 0xabc);
+        be_cmd_set_loopback(adapter, adapter->port_num,
+                                BE_NO_LOOPBACK, 1);
+        return *status;
+}
+
 static void
 be_self_test(struct net_device *netdev, struct ethtool_test *test, u64 *data)
 {
@@ -497,23 +533,18 @@ be_self_test(struct net_device *netdev, struct ethtool_test *test, u64 *data)
         memset(data, 0, sizeof(u64) * ETHTOOL_TESTS_NUM);
 
         if (test->flags & ETH_TEST_FL_OFFLINE) {
-                data[0] = be_cmd_loopback_test(adapter, adapter->port_num,
-                                                BE_MAC_LOOPBACK, 1500,
-                                                2, 0xabc);
-                if (data[0] != 0)
+                if (be_loopback_test(adapter, BE_MAC_LOOPBACK,
+                                                &data[0]) != 0) {
                         test->flags |= ETH_TEST_FL_FAILED;
-
-                data[1] = be_cmd_loopback_test(adapter, adapter->port_num,
-                                                BE_PHY_LOOPBACK, 1500,
-                                                2, 0xabc);
-                if (data[1] != 0)
+                }
+                if (be_loopback_test(adapter, BE_PHY_LOOPBACK,
+                                                &data[1]) != 0) {
                         test->flags |= ETH_TEST_FL_FAILED;
-
-                data[2] = be_cmd_loopback_test(adapter, adapter->port_num,
-                                                BE_ONE_PORT_EXT_LOOPBACK,
-                                                1500, 2, 0xabc);
-                if (data[2] != 0)
+                }
+                if (be_loopback_test(adapter, BE_ONE_PORT_EXT_LOOPBACK,
+                                                &data[2]) != 0) {
                         test->flags |= ETH_TEST_FL_FAILED;
+                }
 
                 data[3] = be_test_ddr_dma(adapter);
                 if (data[3] != 0)
diff --git a/drivers/net/benet/be_main.c b/drivers/net/benet/be_main.c
index 3a1f7902c16d..626b76c0ebc7 100644
--- a/drivers/net/benet/be_main.c
+++ b/drivers/net/benet/be_main.c
@@ -910,7 +910,7 @@ static inline struct page *be_alloc_pages(u32 size)
 static void be_post_rx_frags(struct be_adapter *adapter)
 {
         struct be_rx_page_info *page_info_tbl = adapter->rx_obj.page_info_tbl;
-        struct be_rx_page_info *page_info = NULL;
+        struct be_rx_page_info *page_info = NULL, *prev_page_info = NULL;
         struct be_queue_info *rxq = &adapter->rx_obj.q;
         struct page *pagep = NULL;
         struct be_eth_rx_d *rxd;
@@ -941,7 +941,6 @@ static void be_post_rx_frags(struct be_adapter *adapter)
                 rxd = queue_head_node(rxq);
                 rxd->fragpa_lo = cpu_to_le32(frag_dmaaddr & 0xFFFFFFFF);
                 rxd->fragpa_hi = cpu_to_le32(upper_32_bits(frag_dmaaddr));
-                queue_head_inc(rxq);
 
                 /* Any space left in the current big page for another frag? */
                 if ((page_offset + rx_frag_size + rx_frag_size) >
@@ -949,10 +948,13 @@ static void be_post_rx_frags(struct be_adapter *adapter)
                         pagep = NULL;
                         page_info->last_page_user = true;
                 }
+
+                prev_page_info = page_info;
+                queue_head_inc(rxq);
                 page_info = &page_info_tbl[rxq->head];
         }
         if (pagep)
-                page_info->last_page_user = true;
+                prev_page_info->last_page_user = true;
 
         if (posted) {
                 atomic_add(posted, &rxq->used);
@@ -1348,7 +1350,7 @@ static irqreturn_t be_intx(int irq, void *dev)
         int isr;
 
         isr = ioread32(adapter->csr + CEV_ISR0_OFFSET +
-                        be_pci_func(adapter) * CEV_ISR_SIZE);
+                (adapter->tx_eq.q.id/ 8) * CEV_ISR_SIZE);
         if (!isr)
                 return IRQ_NONE;
 
@@ -2049,6 +2051,7 @@ static void be_unmap_pci_bars(struct be_adapter *adapter)
 static int be_map_pci_bars(struct be_adapter *adapter)
 {
         u8 __iomem *addr;
+        int pcicfg_reg;
 
         addr = ioremap_nocache(pci_resource_start(adapter->pdev, 2),
                         pci_resource_len(adapter->pdev, 2));
@@ -2062,8 +2065,13 @@ static int be_map_pci_bars(struct be_adapter *adapter)
                 goto pci_map_err;
         adapter->db = addr;
 
-        addr = ioremap_nocache(pci_resource_start(adapter->pdev, 1),
-                        pci_resource_len(adapter->pdev, 1));
+        if (adapter->generation == BE_GEN2)
+                pcicfg_reg = 1;
+        else
+                pcicfg_reg = 0;
+
+        addr = ioremap_nocache(pci_resource_start(adapter->pdev, pcicfg_reg),
+                        pci_resource_len(adapter->pdev, pcicfg_reg));
         if (addr == NULL)
                 goto pci_map_err;
         adapter->pcicfg = addr;
@@ -2160,6 +2168,7 @@ static int be_stats_init(struct be_adapter *adapter)
         cmd->va = pci_alloc_consistent(adapter->pdev, cmd->size, &cmd->dma);
         if (cmd->va == NULL)
                 return -1;
+        memset(cmd->va, 0, cmd->size);
         return 0;
 }
 
@@ -2238,6 +2247,20 @@ static int __devinit be_probe(struct pci_dev *pdev,
                 goto rel_reg;
         }
         adapter = netdev_priv(netdev);
+
+        switch (pdev->device) {
+        case BE_DEVICE_ID1:
+        case OC_DEVICE_ID1:
+                adapter->generation = BE_GEN2;
+                break;
+        case BE_DEVICE_ID2:
+        case OC_DEVICE_ID2:
+                adapter->generation = BE_GEN3;
+                break;
+        default:
+                adapter->generation = 0;
+        }
+
         adapter->pdev = pdev;
         pci_set_drvdata(pdev, adapter);
         adapter->netdev = netdev;
diff --git a/drivers/net/bfin_mac.c b/drivers/net/bfin_mac.c
index 8ffea3990d07..0b23bc4f56c6 100644
--- a/drivers/net/bfin_mac.c
+++ b/drivers/net/bfin_mac.c
@@ -33,6 +33,7 @@
 #include <asm/dma.h>
 #include <linux/dma-mapping.h>
 
+#include <asm/dpmc.h>
 #include <asm/blackfin.h>
 #include <asm/cacheflush.h>
 #include <asm/portmux.h>
@@ -386,8 +387,8 @@ static int mii_probe(struct net_device *dev)
         u32 sclk, mdc_div;
 
         /* Enable PHY output early */
-        if (!(bfin_read_VR_CTL() & PHYCLKOE))
-                bfin_write_VR_CTL(bfin_read_VR_CTL() | PHYCLKOE);
+        if (!(bfin_read_VR_CTL() & CLKBUFOE))
+                bfin_write_VR_CTL(bfin_read_VR_CTL() | CLKBUFOE);
 
         sclk = get_sclk();
         mdc_div = ((sclk / MDC_CLK) / 2) - 1;
diff --git a/drivers/net/bnx2x_main.c b/drivers/net/bnx2x_main.c
index 77ba13520d87..306c2b8165e2 100644
--- a/drivers/net/bnx2x_main.c
+++ b/drivers/net/bnx2x_main.c
@@ -7593,6 +7593,8 @@ static int bnx2x_nic_load(struct bnx2x *bp, int load_mode)
                 if (bp->cnic_eth_dev.drv_state & CNIC_DRV_STATE_REGD) {
                         bnx2x_set_iscsi_eth_mac_addr(bp, 1);
                         bp->cnic_flags |= BNX2X_CNIC_FLAG_MAC_SET;
+                        bnx2x_init_sb(bp, bp->cnic_sb, bp->cnic_sb_mapping,
+                                      CNIC_SB_ID(bp));
                 }
                 mutex_unlock(&bp->cnic_mutex);
 #endif
diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c
index 0fb7a4964e75..822f586d72af 100644
--- a/drivers/net/bonding/bond_3ad.c
+++ b/drivers/net/bonding/bond_3ad.c
@@ -1580,7 +1580,7 @@ static void ad_agg_selection_logic(struct aggregator *agg)
                 // check if any partner replys
                 if (best->is_individual) {
                         pr_warning("%s: Warning: No 802.3ad response from the link partner for any adapters in the bond\n",
-                                   best->slave->dev->master->name);
+                                   best->slave ? best->slave->dev->master->name : "NULL");
                 }
 
                 best->is_active = 1;
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 3f0071cfe56b..efa0e41bf3ec 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -3639,7 +3639,7 @@ static int bond_open(struct net_device *bond_dev)
                  */
                 if (bond_alb_initialize(bond, (bond->params.mode == BOND_MODE_ALB))) {
                         /* something went wrong - fail the open operation */
-                        return -1;
+                        return -ENOMEM;
                 }
 
                 INIT_DELAYED_WORK(&bond->alb_work, bond_alb_monitor);
diff --git a/drivers/net/can/mcp251x.c b/drivers/net/can/mcp251x.c
index 9c5a1537939c..1a72ca066a17 100644
--- a/drivers/net/can/mcp251x.c
+++ b/drivers/net/can/mcp251x.c
@@ -990,7 +990,7 @@ static int __devinit mcp251x_can_probe(struct spi_device *spi)
                         goto error_tx_buf;
                 }
                 priv->spi_rx_buf = kmalloc(SPI_TRANSFER_BUF_LEN, GFP_KERNEL);
-                if (!priv->spi_tx_buf) {
+                if (!priv->spi_rx_buf) {
                         ret = -ENOMEM;
                         goto error_rx_buf;
                 }
diff --git a/drivers/net/cs89x0.c b/drivers/net/cs89x0.c
index af9321617ce4..0e79cef95c0a 100644
--- a/drivers/net/cs89x0.c
+++ b/drivers/net/cs89x0.c
@@ -1325,8 +1325,7 @@ net_open(struct net_device *dev)
                 write_irq(dev, lp->chip_type, dev->irq);
                 ret = request_irq(dev->irq, net_interrupt, 0, dev->name, dev);
                 if (ret) {
-                        if (net_debug)
-                                printk(KERN_DEBUG "cs89x0: request_irq(%d) failed\n", dev->irq);
+                        printk(KERN_ERR "cs89x0: request_irq(%d) failed\n", dev->irq);
                         goto bad_out;
                 }
         }
diff --git a/drivers/net/cxgb3/sge.c b/drivers/net/cxgb3/sge.c
index bdbd14727e4b..318a018ca7c5 100644
--- a/drivers/net/cxgb3/sge.c
+++ b/drivers/net/cxgb3/sge.c
@@ -2079,6 +2079,7 @@ static void lro_add_page(struct adapter *adap, struct sge_qset *qs,
                          struct sge_fl *fl, int len, int complete)
 {
         struct rx_sw_desc *sd = &fl->sdesc[fl->cidx];
+        struct port_info *pi = netdev_priv(qs->netdev);
         struct sk_buff *skb = NULL;
         struct cpl_rx_pkt *cpl;
         struct skb_frag_struct *rx_frag;
@@ -2116,11 +2117,18 @@ static void lro_add_page(struct adapter *adap, struct sge_qset *qs,
 
         if (!nr_frags) {
                 offset = 2 + sizeof(struct cpl_rx_pkt);
-                qs->lro_va = sd->pg_chunk.va + 2;
-        }
-        len -= offset;
+                cpl = qs->lro_va = sd->pg_chunk.va + 2;
 
-        prefetch(qs->lro_va);
+                if ((pi->rx_offload & T3_RX_CSUM) &&
+                     cpl->csum_valid && cpl->csum == htons(0xffff)) {
+                        skb->ip_summed = CHECKSUM_UNNECESSARY;
+                        qs->port_stats[SGE_PSTAT_RX_CSUM_GOOD]++;
+                } else
+                        skb->ip_summed = CHECKSUM_NONE;
+        } else
+                cpl = qs->lro_va;
+
+        len -= offset;
 
         rx_frag += nr_frags;
         rx_frag->page = sd->pg_chunk.page;
@@ -2136,12 +2144,8 @@ static void lro_add_page(struct adapter *adap, struct sge_qset *qs,
                 return;
 
         skb_record_rx_queue(skb, qs - &adap->sge.qs[0]);
-        skb->ip_summed = CHECKSUM_UNNECESSARY;
-        cpl = qs->lro_va;
 
         if (unlikely(cpl->vlan_valid)) {
-                struct net_device *dev = qs->netdev;
-                struct port_info *pi = netdev_priv(dev);
                 struct vlan_group *grp = pi->vlan_grp;
 
                 if (likely(grp != NULL)) {
diff --git a/drivers/net/davinci_emac.c b/drivers/net/davinci_emac.c
index 34e03104c3c1..33c4fe26178c 100644
--- a/drivers/net/davinci_emac.c
+++ b/drivers/net/davinci_emac.c
@@ -2711,6 +2711,8 @@ static int __devinit davinci_emac_probe(struct platform_device *pdev)
         SET_ETHTOOL_OPS(ndev, &ethtool_ops);
         netif_napi_add(ndev, &priv->napi, emac_poll, EMAC_POLL_WEIGHT);
 
+        clk_enable(emac_clk);
+
         /* register the network device */
         SET_NETDEV_DEV(ndev, &pdev->dev);
         rc = register_netdev(ndev);
@@ -2720,7 +2722,6 @@ static int __devinit davinci_emac_probe(struct platform_device *pdev)
                 goto netdev_reg_err;
         }
 
-        clk_enable(emac_clk);
 
         /* MII/Phy intialisation, mdio bus registration */
         emac_mii = mdiobus_alloc();
@@ -2760,6 +2761,7 @@ mdiobus_quit:
 
 netdev_reg_err:
 mdio_alloc_err:
+        clk_disable(emac_clk);
 no_irq_res:
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         release_mem_region(res->start, res->end - res->start + 1);
diff --git a/drivers/net/e1000/e1000.h b/drivers/net/e1000/e1000.h
index 2a567df3ea71..e8932db7ee77 100644
--- a/drivers/net/e1000/e1000.h
+++ b/drivers/net/e1000/e1000.h
@@ -326,6 +326,8 @@ struct e1000_adapter {
         /* for ioport free */
         int bars;
         int need_ioport;
+
+        bool discarding;
 };
 
 enum e1000_state_t {
diff --git a/drivers/net/e1000/e1000_main.c b/drivers/net/e1000/e1000_main.c
index 7e855f9bbd97..765543663a4f 100644
--- a/drivers/net/e1000/e1000_main.c
+++ b/drivers/net/e1000/e1000_main.c
@@ -1698,18 +1698,6 @@ static void e1000_setup_rctl(struct e1000_adapter *adapter)
         rctl &= ~E1000_RCTL_SZ_4096;
         rctl |= E1000_RCTL_BSEX;
         switch (adapter->rx_buffer_len) {
-                case E1000_RXBUFFER_256:
-                        rctl |= E1000_RCTL_SZ_256;
-                        rctl &= ~E1000_RCTL_BSEX;
-                        break;
-                case E1000_RXBUFFER_512:
-                        rctl |= E1000_RCTL_SZ_512;
-                        rctl &= ~E1000_RCTL_BSEX;
-                        break;
-                case E1000_RXBUFFER_1024:
-                        rctl |= E1000_RCTL_SZ_1024;
-                        rctl &= ~E1000_RCTL_BSEX;
-                        break;
                 case E1000_RXBUFFER_2048:
                 default:
                         rctl |= E1000_RCTL_SZ_2048;
@@ -2802,13 +2790,13 @@ static int e1000_tx_map(struct e1000_adapter *adapter,
 dma_error:
         dev_err(&pdev->dev, "TX DMA map failed\n");
         buffer_info->dma = 0;
-        count--;
-
-        while (count >= 0) {
+        if (count)
                 count--;
-                i--;
-                if (i < 0)
+
+        while (count--) {
+                if (i==0)
                         i += tx_ring->count;
+                i--;
                 buffer_info = &tx_ring->buffer_info[i];
                 e1000_unmap_and_free_tx_resource(adapter, buffer_info);
         }
@@ -3176,13 +3164,7 @@ static int e1000_change_mtu(struct net_device *netdev, int new_mtu)
          *  however with the new *_jumbo_rx* routines, jumbo receives will use
          *  fragmented skbs */
 
-        if (max_frame <= E1000_RXBUFFER_256)
-                adapter->rx_buffer_len = E1000_RXBUFFER_256;
-        else if (max_frame <= E1000_RXBUFFER_512)
-                adapter->rx_buffer_len = E1000_RXBUFFER_512;
-        else if (max_frame <= E1000_RXBUFFER_1024)
-                adapter->rx_buffer_len = E1000_RXBUFFER_1024;
-        else if (max_frame <= E1000_RXBUFFER_2048)
+        if (max_frame <= E1000_RXBUFFER_2048)
                 adapter->rx_buffer_len = E1000_RXBUFFER_2048;
         else
 #if (PAGE_SIZE >= E1000_RXBUFFER_16384)
@@ -3850,13 +3832,22 @@ static bool e1000_clean_rx_irq(struct e1000_adapter *adapter,
 
                 length = le16_to_cpu(rx_desc->length);
                 /* !EOP means multiple descriptors were used to store a single
-                 * packet, also make sure the frame isn't just CRC only */
-                if (unlikely(!(status & E1000_RXD_STAT_EOP) || (length <= 4))) {
+                 * packet, if thats the case we need to toss it.  In fact, we
+                 * to toss every packet with the EOP bit clear and the next
+                 * frame that _does_ have the EOP bit set, as it is by
+                 * definition only a frame fragment
+                 */
+                if (unlikely(!(status & E1000_RXD_STAT_EOP)))
+                        adapter->discarding = true;
+
+                if (adapter->discarding) {
                         /* All receives must fit into a single buffer */
                         E1000_DBG("%s: Receive packet consumed multiple"
                                   " buffers\n", netdev->name);
                         /* recycle */
                         buffer_info->skb = skb;
+                        if (status & E1000_RXD_STAT_EOP)
+                                adapter->discarding = false;
                         goto next_desc;
                 }
 
@@ -4015,11 +4006,21 @@ check_page:
                         }
                 }
 
-                if (!buffer_info->dma)
+                if (!buffer_info->dma) {
                         buffer_info->dma = pci_map_page(pdev,
                                                         buffer_info->page, 0,
                                                         buffer_info->length,
                                                         PCI_DMA_FROMDEVICE);
+                        if (pci_dma_mapping_error(pdev, buffer_info->dma)) {
+                                put_page(buffer_info->page);
+                                dev_kfree_skb(skb);
+                                buffer_info->page = NULL;
+                                buffer_info->skb = NULL;
+                                buffer_info->dma = 0;
+                                adapter->alloc_rx_buff_failed++;
+                                break; /* while !buffer_info->skb */
+                        }
+                }
 
                 rx_desc = E1000_RX_DESC(*rx_ring, i);
                 rx_desc->buffer_addr = cpu_to_le64(buffer_info->dma);
@@ -4110,6 +4111,13 @@ map_skb:
                                                   skb->data,
                                                   buffer_info->length,
                                                   PCI_DMA_FROMDEVICE);
+                if (pci_dma_mapping_error(pdev, buffer_info->dma)) {
+                        dev_kfree_skb(skb);
+                        buffer_info->skb = NULL;
+                        buffer_info->dma = 0;
+                        adapter->alloc_rx_buff_failed++;
+                        break; /* while !buffer_info->skb */
+                }
 
                 /*
                  * XXX if it was allocated cleanly it will never map to a
diff --git a/drivers/net/e1000e/82571.c b/drivers/net/e1000e/82571.c
index b979464091bb..02d67d047d96 100644
--- a/drivers/net/e1000e/82571.c
+++ b/drivers/net/e1000e/82571.c
@@ -237,6 +237,8 @@ static s32 e1000_init_mac_params_82571(struct e1000_adapter *adapter)
         /* Set if manageability features are enabled. */
         mac->arc_subsystem_valid = (er32(FWSM) & E1000_FWSM_MODE_MASK)
                         ? true : false;
+        /* Adaptive IFS supported */
+        mac->adaptive_ifs = true;
 
         /* check for link */
         switch (hw->phy.media_type) {
diff --git a/drivers/net/e1000e/e1000.h b/drivers/net/e1000e/e1000.h
index cebbd9079d53..d236efaf7478 100644
--- a/drivers/net/e1000e/e1000.h
+++ b/drivers/net/e1000e/e1000.h
@@ -421,6 +421,7 @@ struct e1000_info {
 /* CRC Stripping defines */
 #define FLAG2_CRC_STRIPPING               (1 << 0)
 #define FLAG2_HAS_PHY_WAKEUP              (1 << 1)
+#define FLAG2_IS_DISCARDING               (1 << 2)
 
 #define E1000_RX_DESC_PS(R, i)      \
         (&(((union e1000_rx_desc_packet_split *)((R).desc))[i]))
@@ -582,7 +583,6 @@ extern s32 e1000_read_phy_reg_hv_locked(struct e1000_hw *hw, u32 offset,
 extern s32 e1000_write_phy_reg_hv(struct e1000_hw *hw, u32 offset, u16 data);
 extern s32 e1000_write_phy_reg_hv_locked(struct e1000_hw *hw, u32 offset,
                                          u16 data);
-extern s32 e1000_set_mdio_slow_mode_hv(struct e1000_hw *hw, bool slow);
 extern s32 e1000_link_stall_workaround_hv(struct e1000_hw *hw);
 extern s32 e1000_copper_link_setup_82577(struct e1000_hw *hw);
 extern s32 e1000_check_polarity_82577(struct e1000_hw *hw);
diff --git a/drivers/net/e1000e/es2lan.c b/drivers/net/e1000e/es2lan.c
index 3028f23da891..e2aa3b788564 100644
--- a/drivers/net/e1000e/es2lan.c
+++ b/drivers/net/e1000e/es2lan.c
@@ -224,6 +224,8 @@ static s32 e1000_init_mac_params_80003es2lan(struct e1000_adapter *adapter)
         /* Set if manageability features are enabled. */
         mac->arc_subsystem_valid = (er32(FWSM) & E1000_FWSM_MODE_MASK)
                         ? true : false;
+        /* Adaptive IFS not supported */
+        mac->adaptive_ifs = false;
 
         /* check for link */
         switch (hw->phy.media_type) {
diff --git a/drivers/net/e1000e/hw.h b/drivers/net/e1000e/hw.h
index 2784cf44a6f3..eccf29b75c41 100644
--- a/drivers/net/e1000e/hw.h
+++ b/drivers/net/e1000e/hw.h
@@ -818,6 +818,7 @@ struct e1000_mac_info {
 
         u8  forced_speed_duplex;
 
+        bool adaptive_ifs;
         bool arc_subsystem_valid;
         bool autoneg;
         bool autoneg_failed;
diff --git a/drivers/net/e1000e/ich8lan.c b/drivers/net/e1000e/ich8lan.c
index 9b09246af064..8b6ecd127889 100644
--- a/drivers/net/e1000e/ich8lan.c
+++ b/drivers/net/e1000e/ich8lan.c
@@ -138,6 +138,10 @@
 #define E1000_NVM_K1_CONFIG 0x1B /* NVM K1 Config Word */
 #define E1000_NVM_K1_ENABLE 0x1  /* NVM Enable K1 bit */
 
+/* KMRN Mode Control */
+#define HV_KMRN_MODE_CTRL      PHY_REG(769, 16)
+#define HV_KMRN_MDIO_SLOW      0x0400
+
 /* ICH GbE Flash Hardware Sequencing Flash Status Register bit breakdown */
 /* Offset 04h HSFSTS */
 union ich8_hws_flash_status {
@@ -219,6 +223,7 @@ static s32 e1000_set_lplu_state_pchlan(struct e1000_hw *hw, bool active);
 static void e1000_power_down_phy_copper_ich8lan(struct e1000_hw *hw);
 static void e1000_lan_init_done_ich8lan(struct e1000_hw *hw);
 static s32  e1000_k1_gig_workaround_hv(struct e1000_hw *hw, bool link);
+static s32 e1000_set_mdio_slow_mode_hv(struct e1000_hw *hw);
 
 static inline u16 __er16flash(struct e1000_hw *hw, unsigned long reg)
 {
@@ -270,7 +275,21 @@ static s32 e1000_init_phy_params_pchlan(struct e1000_hw *hw)
         phy->autoneg_mask             = AUTONEG_ADVERTISE_SPEED_DEFAULT;
 
         phy->id = e1000_phy_unknown;
-        e1000e_get_phy_id(hw);
+        ret_val = e1000e_get_phy_id(hw);
+        if (ret_val)
+                goto out;
+        if ((phy->id == 0) || (phy->id == PHY_REVISION_MASK)) {
+                /*
+                 * In case the PHY needs to be in mdio slow mode (eg. 82577),
+                 * set slow mode and try to get the PHY id again.
+                 */
+                ret_val = e1000_set_mdio_slow_mode_hv(hw);
+                if (ret_val)
+                        goto out;
+                ret_val = e1000e_get_phy_id(hw);
+                if (ret_val)
+                        goto out;
+        }
         phy->type = e1000e_get_phy_type_from_id(phy->id);
 
         switch (phy->type) {
@@ -292,6 +311,7 @@ static s32 e1000_init_phy_params_pchlan(struct e1000_hw *hw)
                 break;
         }
 
+out:
         return ret_val;
 }
 
@@ -454,6 +474,8 @@ static s32 e1000_init_mac_params_ich8lan(struct e1000_adapter *adapter)
                 mac->rar_entry_count--;
         /* Set if manageability features are enabled. */
         mac->arc_subsystem_valid = true;
+        /* Adaptive IFS supported */
+        mac->adaptive_ifs = true;
 
         /* LED operations */
         switch (mac->type) {
@@ -1074,16 +1096,44 @@ out:
 
 
 /**
+ *  e1000_set_mdio_slow_mode_hv - Set slow MDIO access mode
+ *  @hw:   pointer to the HW structure
+ **/
+static s32 e1000_set_mdio_slow_mode_hv(struct e1000_hw *hw)
+{
+        s32 ret_val;
+        u16 data;
+
+        ret_val = e1e_rphy(hw, HV_KMRN_MODE_CTRL, &data);
+        if (ret_val)
+                return ret_val;
+
+        data |= HV_KMRN_MDIO_SLOW;
+
+        ret_val = e1e_wphy(hw, HV_KMRN_MODE_CTRL, data);
+
+        return ret_val;
+}
+
+/**
  *  e1000_hv_phy_workarounds_ich8lan - A series of Phy workarounds to be
  *  done after every PHY reset.
  **/
 static s32 e1000_hv_phy_workarounds_ich8lan(struct e1000_hw *hw)
 {
         s32 ret_val = 0;
+        u16 phy_data;
 
         if (hw->mac.type != e1000_pchlan)
                 return ret_val;
 
+        /* Set MDIO slow mode before any other MDIO access */
+        if (hw->phy.type == e1000_phy_82577) {
+                ret_val = e1000_set_mdio_slow_mode_hv(hw);
+                if (ret_val)
+                        goto out;
+        }
+
         if (((hw->phy.type == e1000_phy_82577) &&
              ((hw->phy.revision == 1) || (hw->phy.revision == 2))) ||
             ((hw->phy.type == e1000_phy_82578) && (hw->phy.revision == 1))) {
@@ -1116,16 +1166,32 @@ static s32 e1000_hv_phy_workarounds_ich8lan(struct e1000_hw *hw)
 
         hw->phy.addr = 1;
         ret_val = e1000e_write_phy_reg_mdic(hw, IGP01E1000_PHY_PAGE_SELECT, 0);
+        hw->phy.ops.release(hw);
         if (ret_val)
                 goto out;
-        hw->phy.ops.release(hw);
 
         /*
          * Configure the K1 Si workaround during phy reset assuming there is
          * link so that it disables K1 if link is in 1Gbps.
          */
         ret_val = e1000_k1_gig_workaround_hv(hw, true);
+        if (ret_val)
+                goto out;
 
+        /* Workaround for link disconnects on a busy hub in half duplex */
+        ret_val = hw->phy.ops.acquire(hw);
+        if (ret_val)
+                goto out;
+        ret_val = hw->phy.ops.read_reg_locked(hw,
+                                              PHY_REG(BM_PORT_CTRL_PAGE, 17),
+                                              &phy_data);
+        if (ret_val)
+                goto release;
+        ret_val = hw->phy.ops.write_reg_locked(hw,
+                                               PHY_REG(BM_PORT_CTRL_PAGE, 17),
+                                               phy_data & 0x00FF);
+release:
+        hw->phy.ops.release(hw);
 out:
         return ret_val;
 }
@@ -1182,6 +1248,7 @@ static s32 e1000_phy_hw_reset_ich8lan(struct e1000_hw *hw)
         /* Allow time for h/w to get to a quiescent state after reset */
         mdelay(10);
 
+        /* Perform any necessary post-reset workarounds */
         if (hw->mac.type == e1000_pchlan) {
                 ret_val = e1000_hv_phy_workarounds_ich8lan(hw);
                 if (ret_val)
@@ -2482,6 +2549,10 @@ static s32 e1000_reset_hw_ich8lan(struct e1000_hw *hw)
         if (!ret_val)
                 e1000_release_swflag_ich8lan(hw);
 
+        /* Perform any necessary post-reset workarounds */
+        if (hw->mac.type == e1000_pchlan)
+                ret_val = e1000_hv_phy_workarounds_ich8lan(hw);
+
         if (ctrl & E1000_CTRL_PHY_RST)
                 ret_val = hw->phy.ops.get_cfg_done(hw);
 
@@ -2526,9 +2597,6 @@ static s32 e1000_reset_hw_ich8lan(struct e1000_hw *hw)
         kab |= E1000_KABGTXD_BGSQLBIAS;
         ew32(KABGTXD, kab);
 
-        if (hw->mac.type == e1000_pchlan)
-                ret_val = e1000_hv_phy_workarounds_ich8lan(hw);
-
 out:
         return ret_val;
 }
diff --git a/drivers/net/e1000e/lib.c b/drivers/net/e1000e/lib.c
index a86c17548c1e..2fa9b36a2c5a 100644
--- a/drivers/net/e1000e/lib.c
+++ b/drivers/net/e1000e/lib.c
@@ -125,6 +125,7 @@ void e1000_write_vfta_generic(struct e1000_hw *hw, u32 offset, u32 value)
 void e1000e_init_rx_addrs(struct e1000_hw *hw, u16 rar_count)
 {
         u32 i;
+        u8 mac_addr[ETH_ALEN] = {0};
 
         /* Setup the receive address */
         e_dbg("Programming MAC Address into RAR[0]\n");
@@ -133,12 +134,8 @@ void e1000e_init_rx_addrs(struct e1000_hw *hw, u16 rar_count)
 
         /* Zero out the other (rar_entry_count - 1) receive addresses */
         e_dbg("Clearing RAR[1-%u]\n", rar_count-1);
-        for (i = 1; i < rar_count; i++) {
-                E1000_WRITE_REG_ARRAY(hw, E1000_RA, (i << 1), 0);
-                e1e_flush();
-                E1000_WRITE_REG_ARRAY(hw, E1000_RA, ((i << 1) + 1), 0);
-                e1e_flush();
-        }
+        for (i = 1; i < rar_count; i++)
+                e1000e_rar_set(hw, mac_addr, i);
 }
 
 /**
@@ -164,10 +161,19 @@ void e1000e_rar_set(struct e1000_hw *hw, u8 *addr, u32 index)
 
         rar_high = ((u32) addr[4] | ((u32) addr[5] << 8));
 
-        rar_high |= E1000_RAH_AV;
+        /* If MAC address zero, no need to set the AV bit */
+        if (rar_low || rar_high)
+                rar_high |= E1000_RAH_AV;
 
-        E1000_WRITE_REG_ARRAY(hw, E1000_RA, (index << 1), rar_low);
-        E1000_WRITE_REG_ARRAY(hw, E1000_RA, ((index << 1) + 1), rar_high);
+        /*
+         * Some bridges will combine consecutive 32-bit writes into
+         * a single burst write, which will malfunction on some parts.
+         * The flushes avoid this.
+         */
+        ew32(RAL(index), rar_low);
+        e1e_flush();
+        ew32(RAH(index), rar_high);
+        e1e_flush();
 }
 
 /**
@@ -1609,6 +1615,11 @@ void e1000e_reset_adaptive(struct e1000_hw *hw)
 {
         struct e1000_mac_info *mac = &hw->mac;
 
+        if (!mac->adaptive_ifs) {
+                e_dbg("Not in Adaptive IFS mode!\n");
+                goto out;
+        }
+
         mac->current_ifs_val = 0;
         mac->ifs_min_val = IFS_MIN;
         mac->ifs_max_val = IFS_MAX;
@@ -1617,6 +1628,8 @@ void e1000e_reset_adaptive(struct e1000_hw *hw)
 
         mac->in_ifs_mode = false;
         ew32(AIT, 0);
+out:
+        return;
 }
 
 /**
@@ -1630,6 +1643,11 @@ void e1000e_update_adaptive(struct e1000_hw *hw)
 {
         struct e1000_mac_info *mac = &hw->mac;
 
+        if (!mac->adaptive_ifs) {
+                e_dbg("Not in Adaptive IFS mode!\n");
+                goto out;
+        }
+
         if ((mac->collision_delta * mac->ifs_ratio) > mac->tx_packet_delta) {
                 if (mac->tx_packet_delta > MIN_NUM_XMITS) {
                         mac->in_ifs_mode = true;
@@ -1650,6 +1668,8 @@ void e1000e_update_adaptive(struct e1000_hw *hw)
                         ew32(AIT, 0);
                 }
         }
+out:
+        return;
 }
 
 /**
@@ -2287,10 +2307,12 @@ bool e1000e_enable_tx_pkt_filtering(struct e1000_hw *hw)
         s32 ret_val, hdr_csum, csum;
         u8 i, len;
 
+        hw->mac.tx_pkt_filtering = true;
+
         /* No manageability, no filtering */
         if (!e1000e_check_mng_mode(hw)) {
                 hw->mac.tx_pkt_filtering = false;
-                return 0;
+                goto out;
         }
 
         /*
@@ -2298,9 +2320,9 @@ bool e1000e_enable_tx_pkt_filtering(struct e1000_hw *hw)
          * reason, disable filtering.
          */
         ret_val = e1000_mng_enable_host_if(hw);
-        if (ret_val != 0) {
+        if (ret_val) {
                 hw->mac.tx_pkt_filtering = false;
-                return ret_val;
+                goto out;
         }
 
         /* Read in the header.  Length and offset are in dwords. */
@@ -2319,17 +2341,17 @@ bool e1000e_enable_tx_pkt_filtering(struct e1000_hw *hw)
          */
         if ((hdr_csum != csum) || (hdr->signature != E1000_IAMT_SIGNATURE)) {
                 hw->mac.tx_pkt_filtering = true;
-                return 1;
+                goto out;
         }
 
         /* Cookie area is valid, make the final check for filtering. */
         if (!(hdr->status & E1000_MNG_DHCP_COOKIE_STATUS_PARSING)) {
                 hw->mac.tx_pkt_filtering = false;
-                return 0;
+                goto out;
         }
 
-        hw->mac.tx_pkt_filtering = true;
-        return 1;
+out:
+        return hw->mac.tx_pkt_filtering;
 }
 
 /**
diff --git a/drivers/net/e1000e/netdev.c b/drivers/net/e1000e/netdev.c
index 762b697ce731..57f149b75fbe 100644
--- a/drivers/net/e1000e/netdev.c
+++ b/drivers/net/e1000e/netdev.c
@@ -450,13 +450,23 @@ static bool e1000_clean_rx_irq(struct e1000_adapter *adapter,
 
                 length = le16_to_cpu(rx_desc->length);
 
-                /* !EOP means multiple descriptors were used to store a single
-                 * packet, also make sure the frame isn't just CRC only */
-                if (!(status & E1000_RXD_STAT_EOP) || (length <= 4)) {
+                /*
+                 * !EOP means multiple descriptors were used to store a single
+                 * packet, if that's the case we need to toss it.  In fact, we
+                 * need to toss every packet with the EOP bit clear and the
+                 * next frame that _does_ have the EOP bit set, as it is by
+                 * definition only a frame fragment
+                 */
+                if (unlikely(!(status & E1000_RXD_STAT_EOP)))
+                        adapter->flags2 |= FLAG2_IS_DISCARDING;
+
+                if (adapter->flags2 & FLAG2_IS_DISCARDING) {
                         /* All receives must fit into a single buffer */
                         e_dbg("Receive packet consumed multiple buffers\n");
                         /* recycle */
                         buffer_info->skb = skb;
+                        if (status & E1000_RXD_STAT_EOP)
+                                adapter->flags2 &= ~FLAG2_IS_DISCARDING;
                         goto next_desc;
                 }
 
@@ -745,10 +755,16 @@ static bool e1000_clean_rx_irq_ps(struct e1000_adapter *adapter,
                                  PCI_DMA_FROMDEVICE);
                 buffer_info->dma = 0;
 
-                if (!(staterr & E1000_RXD_STAT_EOP)) {
+                /* see !EOP comment in other rx routine */
+                if (!(staterr & E1000_RXD_STAT_EOP))
+                        adapter->flags2 |= FLAG2_IS_DISCARDING;
+
+                if (adapter->flags2 & FLAG2_IS_DISCARDING) {
                         e_dbg("Packet Split buffers didn't pick up the full "
                               "packet\n");
                         dev_kfree_skb_irq(skb);
+                        if (staterr & E1000_RXD_STAT_EOP)
+                                adapter->flags2 &= ~FLAG2_IS_DISCARDING;
                         goto next_desc;
                 }
 
@@ -1118,6 +1134,7 @@ static void e1000_clean_rx_ring(struct e1000_adapter *adapter)
 
         rx_ring->next_to_clean = 0;
         rx_ring->next_to_use = 0;
+        adapter->flags2 &= ~FLAG2_IS_DISCARDING;
 
         writel(0, adapter->hw.hw_addr + rx_ring->head);
         writel(0, adapter->hw.hw_addr + rx_ring->tail);
@@ -2333,18 +2350,6 @@ static void e1000_setup_rctl(struct e1000_adapter *adapter)
         rctl &= ~E1000_RCTL_SZ_4096;
         rctl |= E1000_RCTL_BSEX;
         switch (adapter->rx_buffer_len) {
-        case 256:
-                rctl |= E1000_RCTL_SZ_256;
-                rctl &= ~E1000_RCTL_BSEX;
-                break;
-        case 512:
-                rctl |= E1000_RCTL_SZ_512;
-                rctl &= ~E1000_RCTL_BSEX;
-                break;
-        case 1024:
-                rctl |= E1000_RCTL_SZ_1024;
-                rctl &= ~E1000_RCTL_BSEX;
-                break;
         case 2048:
         default:
                 rctl |= E1000_RCTL_SZ_2048;
@@ -3315,24 +3320,24 @@ void e1000e_update_stats(struct e1000_adapter *adapter)
         if ((hw->phy.type == e1000_phy_82578) ||
             (hw->phy.type == e1000_phy_82577)) {
                 e1e_rphy(hw, HV_SCC_UPPER, &phy_data);
-                e1e_rphy(hw, HV_SCC_LOWER, &phy_data);
-                adapter->stats.scc += phy_data;
+                if (!e1e_rphy(hw, HV_SCC_LOWER, &phy_data))
+                        adapter->stats.scc += phy_data;
 
                 e1e_rphy(hw, HV_ECOL_UPPER, &phy_data);
-                e1e_rphy(hw, HV_ECOL_LOWER, &phy_data);
-                adapter->stats.ecol += phy_data;
+                if (!e1e_rphy(hw, HV_ECOL_LOWER, &phy_data))
+                        adapter->stats.ecol += phy_data;
 
                 e1e_rphy(hw, HV_MCC_UPPER, &phy_data);
-                e1e_rphy(hw, HV_MCC_LOWER, &phy_data);
-                adapter->stats.mcc += phy_data;
+                if (!e1e_rphy(hw, HV_MCC_LOWER, &phy_data))
+                        adapter->stats.mcc += phy_data;
 
                 e1e_rphy(hw, HV_LATECOL_UPPER, &phy_data);
-                e1e_rphy(hw, HV_LATECOL_LOWER, &phy_data);
-                adapter->stats.latecol += phy_data;
+                if (!e1e_rphy(hw, HV_LATECOL_LOWER, &phy_data))
+                        adapter->stats.latecol += phy_data;
 
                 e1e_rphy(hw, HV_DC_UPPER, &phy_data);
-                e1e_rphy(hw, HV_DC_LOWER, &phy_data);
-                adapter->stats.dc += phy_data;
+                if (!e1e_rphy(hw, HV_DC_LOWER, &phy_data))
+                        adapter->stats.dc += phy_data;
         } else {
                 adapter->stats.scc += er32(SCC);
                 adapter->stats.ecol += er32(ECOL);
@@ -3360,8 +3365,8 @@ void e1000e_update_stats(struct e1000_adapter *adapter)
         if ((hw->phy.type == e1000_phy_82578) ||
             (hw->phy.type == e1000_phy_82577)) {
                 e1e_rphy(hw, HV_COLC_UPPER, &phy_data);
-                e1e_rphy(hw, HV_COLC_LOWER, &phy_data);
-                hw->mac.collision_delta = phy_data;
+                if (!e1e_rphy(hw, HV_COLC_LOWER, &phy_data))
+                        hw->mac.collision_delta = phy_data;
         } else {
                 hw->mac.collision_delta = er32(COLC);
         }
@@ -3372,8 +3377,8 @@ void e1000e_update_stats(struct e1000_adapter *adapter)
         if ((hw->phy.type == e1000_phy_82578) ||
             (hw->phy.type == e1000_phy_82577)) {
                 e1e_rphy(hw, HV_TNCRS_UPPER, &phy_data);
-                e1e_rphy(hw, HV_TNCRS_LOWER, &phy_data);
-                adapter->stats.tncrs += phy_data;
+                if (!e1e_rphy(hw, HV_TNCRS_LOWER, &phy_data))
+                        adapter->stats.tncrs += phy_data;
         } else {
                 if ((hw->mac.type != e1000_82574) &&
                     (hw->mac.type != e1000_82583))
@@ -3781,7 +3786,7 @@ static int e1000_tso(struct e1000_adapter *adapter,
                                                          0, IPPROTO_TCP, 0);
                 cmd_length = E1000_TXD_CMD_IP;
                 ipcse = skb_transport_offset(skb) - 1;
-        } else if (skb_shinfo(skb)->gso_type == SKB_GSO_TCPV6) {
+        } else if (skb_is_gso_v6(skb)) {
                 ipv6_hdr(skb)->payload_len = 0;
                 tcp_hdr(skb)->check = ~csum_ipv6_magic(&ipv6_hdr(skb)->saddr,
                                                        &ipv6_hdr(skb)->daddr,
@@ -3962,13 +3967,13 @@ static int e1000_tx_map(struct e1000_adapter *adapter,
 dma_error:
         dev_err(&pdev->dev, "TX DMA map failed\n");
         buffer_info->dma = 0;
-        count--;
-
-        while (count >= 0) {
+        if (count)
                 count--;
-                i--;
-                if (i < 0)
+
+        while (count--) {
+                if (i==0)
                         i += tx_ring->count;
+                i--;
                 buffer_info = &tx_ring->buffer_info[i];
                 e1000_put_txbuf(adapter, buffer_info);;
         }
@@ -4317,13 +4322,7 @@ static int e1000_change_mtu(struct net_device *netdev, int new_mtu)
          * fragmented skbs
          */
 
-        if (max_frame <= 256)
-                adapter->rx_buffer_len = 256;
-        else if (max_frame <= 512)
-                adapter->rx_buffer_len = 512;
-        else if (max_frame <= 1024)
-                adapter->rx_buffer_len = 1024;
-        else if (max_frame <= 2048)
+        if (max_frame <= 2048)
                 adapter->rx_buffer_len = 2048;
         else
                 adapter->rx_buffer_len = 4096;
@@ -4674,6 +4673,7 @@ static int e1000_resume(struct pci_dev *pdev)
 
         pci_set_power_state(pdev, PCI_D0);
         pci_restore_state(pdev);
+        pci_save_state(pdev);
         e1000e_disable_l1aspm(pdev);
 
         err = pci_enable_device_mem(pdev);
@@ -4825,6 +4825,7 @@ static pci_ers_result_t e1000_io_slot_reset(struct pci_dev *pdev)
         } else {
                 pci_set_master(pdev);
                 pci_restore_state(pdev);
+                pci_save_state(pdev);
 
                 pci_enable_wake(pdev, PCI_D3hot, 0);
                 pci_enable_wake(pdev, PCI_D3cold, 0);
diff --git a/drivers/net/e1000e/phy.c b/drivers/net/e1000e/phy.c
index 55a2c0acfee7..7f3ceb9dad6a 100644
--- a/drivers/net/e1000e/phy.c
+++ b/drivers/net/e1000e/phy.c
@@ -152,32 +152,9 @@ s32 e1000e_get_phy_id(struct e1000_hw *hw)
                 if (phy->id != 0 && phy->id != PHY_REVISION_MASK)
                         goto out;
 
-                /*
-                 * If the PHY ID is still unknown, we may have an 82577
-                 * without link.  We will try again after setting Slow MDIC
-                 * mode. No harm in trying again in this case since the PHY
-                 * ID is unknown at this point anyway.
-                 */
-                ret_val = phy->ops.acquire(hw);
-                if (ret_val)
-                        goto out;
-                ret_val = e1000_set_mdio_slow_mode_hv(hw, true);
-                if (ret_val)
-                        goto out;
-                phy->ops.release(hw);
-
                 retry_count++;
         }
 out:
-        /* Revert to MDIO fast mode, if applicable */
-        if (retry_count) {
-                ret_val = phy->ops.acquire(hw);
-                if (ret_val)
-                        return ret_val;
-                ret_val = e1000_set_mdio_slow_mode_hv(hw, false);
-                phy->ops.release(hw);
-        }
-
         return ret_val;
 }
 
@@ -2791,38 +2768,6 @@ static s32 e1000_set_d0_lplu_state(struct e1000_hw *hw, bool active)
 }
 
 /**
- *  e1000_set_mdio_slow_mode_hv - Set slow MDIO access mode
- *  @hw:   pointer to the HW structure
- *  @slow: true for slow mode, false for normal mode
- *
- *  Assumes semaphore already acquired.
- **/
-s32 e1000_set_mdio_slow_mode_hv(struct e1000_hw *hw, bool slow)
-{
-        s32 ret_val = 0;
-        u16 data = 0;
-
-        /* Set MDIO mode - page 769, register 16: 0x2580==slow, 0x2180==fast */
-        hw->phy.addr = 1;
-        ret_val = e1000e_write_phy_reg_mdic(hw, IGP01E1000_PHY_PAGE_SELECT,
-                                         (BM_PORT_CTRL_PAGE << IGP_PAGE_SHIFT));
-        if (ret_val)
-                goto out;
-
-        ret_val = e1000e_write_phy_reg_mdic(hw, BM_CS_CTRL1,
-                                           (0x2180 | (slow << 10)));
-        if (ret_val)
-                goto out;
-
-        /* dummy read when reverting to fast mode - throw away result */
-        if (!slow)
-                ret_val = e1000e_read_phy_reg_mdic(hw, BM_CS_CTRL1, &data);
-
-out:
-        return ret_val;
-}
-
-/**
  *  __e1000_read_phy_reg_hv -  Read HV PHY register
  *  @hw: pointer to the HW structure
  *  @offset: register offset to be read
@@ -2839,7 +2784,6 @@ static s32 __e1000_read_phy_reg_hv(struct e1000_hw *hw, u32 offset, u16 *data,
         s32 ret_val;
         u16 page = BM_PHY_REG_PAGE(offset);
         u16 reg = BM_PHY_REG_NUM(offset);
-        bool in_slow_mode = false;
 
         if (!locked) {
                 ret_val = hw->phy.ops.acquire(hw);
@@ -2847,16 +2791,6 @@ static s32 __e1000_read_phy_reg_hv(struct e1000_hw *hw, u32 offset, u16 *data,
                         return ret_val;
         }
 
-        /* Workaround failure in MDIO access while cable is disconnected */
-        if ((hw->phy.type == e1000_phy_82577) &&
-            !(er32(STATUS) & E1000_STATUS_LU)) {
-                ret_val = e1000_set_mdio_slow_mode_hv(hw, true);
-                if (ret_val)
-                        goto out;
-
-                in_slow_mode = true;
-        }
-
         /* Page 800 works differently than the rest so it has its own func */
         if (page == BM_WUC_PAGE) {
                 ret_val = e1000_access_phy_wakeup_reg_bm(hw, offset,
@@ -2893,10 +2827,6 @@ static s32 __e1000_read_phy_reg_hv(struct e1000_hw *hw, u32 offset, u16 *data,
         ret_val = e1000e_read_phy_reg_mdic(hw, MAX_PHY_REG_ADDRESS & reg,
                                           data);
 out:
-        /* Revert to MDIO fast mode, if applicable */
-        if ((hw->phy.type == e1000_phy_82577) && in_slow_mode)
-                ret_val |= e1000_set_mdio_slow_mode_hv(hw, false);
-
         if (!locked)
                 hw->phy.ops.release(hw);
 
@@ -2948,7 +2878,6 @@ static s32 __e1000_write_phy_reg_hv(struct e1000_hw *hw, u32 offset, u16 data,
         s32 ret_val;
         u16 page = BM_PHY_REG_PAGE(offset);
         u16 reg = BM_PHY_REG_NUM(offset);
-        bool in_slow_mode = false;
 
         if (!locked) {
                 ret_val = hw->phy.ops.acquire(hw);
@@ -2956,16 +2885,6 @@ static s32 __e1000_write_phy_reg_hv(struct e1000_hw *hw, u32 offset, u16 data,
                         return ret_val;
         }
 
-        /* Workaround failure in MDIO access while cable is disconnected */
-        if ((hw->phy.type == e1000_phy_82577) &&
-            !(er32(STATUS) & E1000_STATUS_LU)) {
-                ret_val = e1000_set_mdio_slow_mode_hv(hw, true);
-                if (ret_val)
-                        goto out;
-
-                in_slow_mode = true;
-        }
-
         /* Page 800 works differently than the rest so it has its own func */
         if (page == BM_WUC_PAGE) {
                 ret_val = e1000_access_phy_wakeup_reg_bm(hw, offset,
@@ -3019,10 +2938,6 @@ static s32 __e1000_write_phy_reg_hv(struct e1000_hw *hw, u32 offset, u16 data,
                                           data);
 
 out:
-        /* Revert to MDIO fast mode, if applicable */
-        if ((hw->phy.type == e1000_phy_82577) && in_slow_mode)
-                ret_val |= e1000_set_mdio_slow_mode_hv(hw, false);
-
         if (!locked)
                 hw->phy.ops.release(hw);
 
diff --git a/drivers/net/fsl_pq_mdio.c b/drivers/net/fsl_pq_mdio.c
index 25fabb3eedc5..d5160edf2fcf 100644
--- a/drivers/net/fsl_pq_mdio.c
+++ b/drivers/net/fsl_pq_mdio.c
@@ -46,6 +46,11 @@
 #include "gianfar.h"
 #include "fsl_pq_mdio.h"
 
+struct fsl_pq_mdio_priv {
+        void __iomem *map;
+        struct fsl_pq_mdio __iomem *regs;
+};
+
 /*
  * Write value to the PHY at mii_id at register regnum,
  * on the bus attached to the local interface, which may be different from the
@@ -105,7 +110,9 @@ int fsl_pq_local_mdio_read(struct fsl_pq_mdio __iomem *regs,
 
 static struct fsl_pq_mdio __iomem *fsl_pq_mdio_get_regs(struct mii_bus *bus)
 {
-        return (void __iomem __force *)bus->priv;
+        struct fsl_pq_mdio_priv *priv = bus->priv;
+
+        return priv->regs;
 }
 
 /*
@@ -266,6 +273,7 @@ static int fsl_pq_mdio_probe(struct of_device *ofdev,
 {
         struct device_node *np = ofdev->node;
         struct device_node *tbi;
+        struct fsl_pq_mdio_priv *priv;
         struct fsl_pq_mdio __iomem *regs = NULL;
         void __iomem *map;
         u32 __iomem *tbipa;
@@ -274,14 +282,19 @@ static int fsl_pq_mdio_probe(struct of_device *ofdev,
         u64 addr = 0, size = 0;
         int err = 0;
 
+        priv = kzalloc(sizeof(*priv), GFP_KERNEL);
+        if (!priv)
+                return -ENOMEM;
+
         new_bus = mdiobus_alloc();
         if (NULL == new_bus)
-                return -ENOMEM;
+                goto err_free_priv;
 
         new_bus->name = "Freescale PowerQUICC MII Bus",
         new_bus->read = &fsl_pq_mdio_read,
         new_bus->write = &fsl_pq_mdio_write,
         new_bus->reset = &fsl_pq_mdio_reset,
+        new_bus->priv = priv;
         fsl_pq_mdio_bus_name(new_bus->id, np);
 
         /* Set the PHY base address */
@@ -291,6 +304,7 @@ static int fsl_pq_mdio_probe(struct of_device *ofdev,
                 err = -ENOMEM;
                 goto err_free_bus;
         }
+        priv->map = map;
 
         if (of_device_is_compatible(np, "fsl,gianfar-mdio") ||
                         of_device_is_compatible(np, "fsl,gianfar-tbi") ||
@@ -298,8 +312,7 @@ static int fsl_pq_mdio_probe(struct of_device *ofdev,
                         of_device_is_compatible(np, "ucc_geth_phy"))
                 map -= offsetof(struct fsl_pq_mdio, miimcfg);
         regs = map;
-
-        new_bus->priv = (void __force *)regs;
+        priv->regs = regs;
 
         new_bus->irq = kcalloc(PHY_MAX_ADDR, sizeof(int), GFP_KERNEL);
 
@@ -392,10 +405,11 @@ static int fsl_pq_mdio_probe(struct of_device *ofdev,
 err_free_irqs:
         kfree(new_bus->irq);
 err_unmap_regs:
-        iounmap(regs);
+        iounmap(priv->map);
 err_free_bus:
         kfree(new_bus);
-
+err_free_priv:
+        kfree(priv);
         return err;
 }
 
@@ -404,14 +418,16 @@ static int fsl_pq_mdio_remove(struct of_device *ofdev)
 {
         struct device *device = &ofdev->dev;
         struct mii_bus *bus = dev_get_drvdata(device);
+        struct fsl_pq_mdio_priv *priv = bus->priv;
 
         mdiobus_unregister(bus);
 
         dev_set_drvdata(device, NULL);
 
-        iounmap(fsl_pq_mdio_get_regs(bus));
+        iounmap(priv->map);
         bus->priv = NULL;
         mdiobus_free(bus);
+        kfree(priv);
 
         return 0;
 }
diff --git a/drivers/net/gianfar.c b/drivers/net/gianfar.c
index e0620d084644..8bd3c9f17532 100644
--- a/drivers/net/gianfar.c
+++ b/drivers/net/gianfar.c
@@ -143,7 +143,6 @@ void gfar_start(struct net_device *dev);
 static void gfar_clear_exact_match(struct net_device *dev);
 static void gfar_set_mac_for_addr(struct net_device *dev, int num, u8 *addr);
 static int gfar_ioctl(struct net_device *dev, struct ifreq *rq, int cmd);
-u16 gfar_select_queue(struct net_device *dev, struct sk_buff *skb);
 
 MODULE_AUTHOR("Freescale Semiconductor, Inc");
 MODULE_DESCRIPTION("Gianfar Ethernet Driver");
@@ -455,7 +454,6 @@ static const struct net_device_ops gfar_netdev_ops = {
         .ndo_set_multicast_list = gfar_set_multi,
         .ndo_tx_timeout = gfar_timeout,
         .ndo_do_ioctl = gfar_ioctl,
-        .ndo_select_queue = gfar_select_queue,
         .ndo_get_stats = gfar_get_stats,
         .ndo_vlan_rx_register = gfar_vlan_rx_register,
         .ndo_set_mac_address = eth_mac_addr,
@@ -506,10 +504,6 @@ static inline int gfar_uses_fcb(struct gfar_private *priv)
         return priv->vlgrp || priv->rx_csum_enable;
 }
 
-u16 gfar_select_queue(struct net_device *dev, struct sk_buff *skb)
-{
-        return skb_get_queue_mapping(skb);
-}
 static void free_tx_pointers(struct gfar_private *priv)
 {
         int i = 0;
@@ -2470,10 +2464,11 @@ static int gfar_process_frame(struct net_device *dev, struct sk_buff *skb,
         fcb = (struct rxfcb *)skb->data;
 
         /* Remove the FCB from the skb */
-        skb_set_queue_mapping(skb, fcb->rq);
         /* Remove the padded bytes, if there are any */
-        if (amount_pull)
+        if (amount_pull) {
+                skb_record_rx_queue(skb, fcb->rq);
                 skb_pull(skb, amount_pull);
+        }
 
         if (priv->rx_csum_enable)
                 gfar_rx_checksum(skb, fcb);
@@ -2554,7 +2549,7 @@ int gfar_clean_rx_ring(struct gfar_priv_rx_q *rx_queue, int rx_work_limit)
                                 /* Remove the FCS from the packet length */
                                 skb_put(skb, pkt_len);
                                 rx_queue->stats.rx_bytes += pkt_len;
-
+                                skb_record_rx_queue(skb, rx_queue->qindex);
                                 gfar_process_frame(dev, skb, amount_pull);
 
                         } else {
diff --git a/drivers/net/hamradio/bpqether.c b/drivers/net/hamradio/bpqether.c
index ae5f11c8fc13..bdadf3e23c94 100644
--- a/drivers/net/hamradio/bpqether.c
+++ b/drivers/net/hamradio/bpqether.c
@@ -248,6 +248,7 @@ static netdev_tx_t bpq_xmit(struct sk_buff *skb, struct net_device *dev)
 {
         unsigned char *ptr;
         struct bpqdev *bpq;
+        struct net_device *orig_dev;
         int size;
 
         /*
@@ -282,8 +283,9 @@ static netdev_tx_t bpq_xmit(struct sk_buff *skb, struct net_device *dev)
 
         bpq = netdev_priv(dev);
 
+        orig_dev = dev;
         if ((dev = bpq_get_ether_dev(dev)) == NULL) {
-                dev->stats.tx_dropped++;
+                orig_dev->stats.tx_dropped++;
                 kfree_skb(skb);
                 return NETDEV_TX_OK;
         }
diff --git a/drivers/net/ibmlana.c b/drivers/net/ibmlana.c
index 090a6d3af112..052c74091d91 100644
--- a/drivers/net/ibmlana.c
+++ b/drivers/net/ibmlana.c
@@ -87,6 +87,7 @@ History:
 #include <linux/module.h>
 #include <linux/netdevice.h>
 #include <linux/etherdevice.h>
+#include <linux/if_ether.h>
 #include <linux/skbuff.h>
 #include <linux/bitops.h>
 
@@ -988,7 +989,7 @@ static int __devinit ibmlana_init_one(struct device *kdev)
 
         /* copy out MAC address */
 
-        for (z = 0; z < sizeof(dev->dev_addr); z++)
+        for (z = 0; z < ETH_ALEN; z++)
                 dev->dev_addr[z] = inb(dev->base_addr + MACADDRPROM + z);
 
         /* print config */
diff --git a/drivers/net/igb/e1000_82575.c b/drivers/net/igb/e1000_82575.c
index e8e9e9194a88..c505b50d1fa3 100644
--- a/drivers/net/igb/e1000_82575.c
+++ b/drivers/net/igb/e1000_82575.c
@@ -1096,9 +1096,7 @@ static s32 igb_setup_serdes_link_82575(struct e1000_hw *hw)
                 hw_dbg("Configuring Autoneg:PCS_LCTL=0x%08X\n", reg);
         } else {
                 /* Set PCS register for forced link */
-                reg |= E1000_PCS_LCTL_FSD |        /* Force Speed */
-                       E1000_PCS_LCTL_FORCE_LINK | /* Force Link */
-                       E1000_PCS_LCTL_FLV_LINK_UP; /* Force link value up */
+                reg |= E1000_PCS_LCTL_FSD;        /* Force Speed */
 
                 hw_dbg("Configuring Forced Link:PCS_LCTL=0x%08X\n", reg);
         }
diff --git a/drivers/net/igb/e1000_phy.c b/drivers/net/igb/e1000_phy.c
index 5c9d73e9bb8d..3670a66401b8 100644
--- a/drivers/net/igb/e1000_phy.c
+++ b/drivers/net/igb/e1000_phy.c
@@ -457,15 +457,6 @@ s32 igb_copper_link_setup_82580(struct e1000_hw *hw)
         phy_data |= I82580_CFG_ENABLE_DOWNSHIFT;
 
         ret_val = phy->ops.write_reg(hw, I82580_CFG_REG, phy_data);
-        if (ret_val)
-                goto out;
-
-        /* Set number of link attempts before downshift */
-        ret_val = phy->ops.read_reg(hw, I82580_CTRL_REG, &phy_data);
-        if (ret_val)
-                goto out;
-        phy_data &= ~I82580_CTRL_DOWNSHIFT_MASK;
-        ret_val = phy->ops.write_reg(hw, I82580_CTRL_REG, phy_data);
 
 out:
         return ret_val;
diff --git a/drivers/net/igb/igb_ethtool.c b/drivers/net/igb/igb_ethtool.c
index ac9d5272650d..f771a6c08777 100644
--- a/drivers/net/igb/igb_ethtool.c
+++ b/drivers/net/igb/igb_ethtool.c
@@ -1795,7 +1795,7 @@ static int igb_wol_exclusion(struct igb_adapter *adapter,
                 /* dual port cards only support WoL on port A from now on
                  * unless it was enabled in the eeprom for port B
                  * so exclude FUNC_1 ports from having WoL enabled */
-                if (rd32(E1000_STATUS) & E1000_STATUS_FUNC_1 &&
+                if ((rd32(E1000_STATUS) & E1000_STATUS_FUNC_MASK) &&
                     !adapter->eeprom_wol) {
                         wol->supported = 0;
                         break;
diff --git a/drivers/net/igb/igb_main.c b/drivers/net/igb/igb_main.c
index 78963a0e128d..c881347cb26d 100644
--- a/drivers/net/igb/igb_main.c
+++ b/drivers/net/igb/igb_main.c
@@ -421,6 +421,8 @@ static void igb_assign_vector(struct igb_q_vector *q_vector, int msix_vector)
                         msixbm = E1000_EICR_RX_QUEUE0 << rx_queue;
                 if (tx_queue > IGB_N0_QUEUE)
                         msixbm |= E1000_EICR_TX_QUEUE0 << tx_queue;
+                if (!adapter->msix_entries && msix_vector == 0)
+                        msixbm |= E1000_EIMS_OTHER;
                 array_wr32(E1000_MSIXBM(0), msix_vector, msixbm);
                 q_vector->eims_value = msixbm;
                 break;
@@ -877,7 +879,6 @@ static int igb_request_irq(struct igb_adapter *adapter)
 {
         struct net_device *netdev = adapter->netdev;
         struct pci_dev *pdev = adapter->pdev;
-        struct e1000_hw *hw = &adapter->hw;
         int err = 0;
 
         if (adapter->msix_entries) {
@@ -909,20 +910,7 @@ static int igb_request_irq(struct igb_adapter *adapter)
                 igb_setup_all_tx_resources(adapter);
                 igb_setup_all_rx_resources(adapter);
         } else {
-                switch (hw->mac.type) {
-                case e1000_82575:
-                        wr32(E1000_MSIXBM(0),
-                             (E1000_EICR_RX_QUEUE0 |
-                              E1000_EICR_TX_QUEUE0 |
-                              E1000_EIMS_OTHER));
-                        break;
-                case e1000_82580:
-                case e1000_82576:
-                        wr32(E1000_IVAR0, E1000_IVAR_VALID);
-                        break;
-                default:
-                        break;
-                }
+                igb_assign_vector(adapter->q_vector[0], 0);
         }
 
         if (adapter->flags & IGB_FLAG_HAS_MSI) {
@@ -1140,6 +1128,8 @@ int igb_up(struct igb_adapter *adapter)
         }
         if (adapter->msix_entries)
                 igb_configure_msix(adapter);
+        else
+                igb_assign_vector(adapter->q_vector[0], 0);
 
         /* Clear any pending interrupts. */
         rd32(E1000_ICR);
@@ -1306,13 +1296,8 @@ void igb_reset(struct igb_adapter *adapter)
         hwm = min(((pba << 10) * 9 / 10),
                         ((pba << 10) - 2 * adapter->max_frame_size));
 
-        if (mac->type < e1000_82576) {
-                fc->high_water = hwm & 0xFFF8;  /* 8-byte granularity */
-                fc->low_water = fc->high_water - 8;
-        } else {
-                fc->high_water = hwm & 0xFFF0;  /* 16-byte granularity */
-                fc->low_water = fc->high_water - 16;
-        }
+        fc->high_water = hwm & 0xFFF0;  /* 16-byte granularity */
+        fc->low_water = fc->high_water - 16;
         fc->pause_time = 0xFFFF;
         fc->send_xon = 1;
         fc->current_mode = fc->requested_mode;
@@ -3427,7 +3412,7 @@ static inline int igb_tso_adv(struct igb_ring *tx_ring,
                                                          iph->daddr, 0,
                                                          IPPROTO_TCP,
                                                          0);
-        } else if (skb_shinfo(skb)->gso_type == SKB_GSO_TCPV6) {
+        } else if (skb_is_gso_v6(skb)) {
                 ipv6_hdr(skb)->payload_len = 0;
                 tcp_hdr(skb)->check = ~csum_ipv6_magic(&ipv6_hdr(skb)->saddr,
                                                        &ipv6_hdr(skb)->daddr,
@@ -3589,6 +3574,7 @@ static inline int igb_tx_map_adv(struct igb_ring *tx_ring, struct sk_buff *skb,
         for (f = 0; f < skb_shinfo(skb)->nr_frags; f++) {
                 struct skb_frag_struct *frag;
 
+                count++;
                 i++;
                 if (i == tx_ring->count)
                         i = 0;
@@ -3610,7 +3596,6 @@ static inline int igb_tx_map_adv(struct igb_ring *tx_ring, struct sk_buff *skb,
                 if (pci_dma_mapping_error(pdev, buffer_info->dma))
                         goto dma_error;
 
-                count++;
         }
 
         tx_ring->buffer_info[i].skb = skb;
diff --git a/drivers/net/igbvf/netdev.c b/drivers/net/igbvf/netdev.c
index e9dd95f136aa..2aa71a766c35 100644
--- a/drivers/net/igbvf/netdev.c
+++ b/drivers/net/igbvf/netdev.c
@@ -1963,7 +1963,7 @@ static int igbvf_tso(struct igbvf_adapter *adapter,
                                                          iph->daddr, 0,
                                                          IPPROTO_TCP,
                                                          0);
-        } else if (skb_shinfo(skb)->gso_type == SKB_GSO_TCPV6) {
+        } else if (skb_is_gso_v6(skb)) {
                 ipv6_hdr(skb)->payload_len = 0;
                 tcp_hdr(skb)->check = ~csum_ipv6_magic(&ipv6_hdr(skb)->saddr,
                                                        &ipv6_hdr(skb)->daddr,
@@ -2117,6 +2117,7 @@ static inline int igbvf_tx_map_adv(struct igbvf_adapter *adapter,
         /* set time_stamp *before* dma to help avoid a possible race */
         buffer_info->time_stamp = jiffies;
         buffer_info->next_to_watch = i;
+        buffer_info->mapped_as_page = false;
         buffer_info->dma = pci_map_single(pdev, skb->data, len,
                                           PCI_DMA_TODEVICE);
         if (pci_dma_mapping_error(pdev, buffer_info->dma))
@@ -2126,6 +2127,7 @@ static inline int igbvf_tx_map_adv(struct igbvf_adapter *adapter,
         for (f = 0; f < skb_shinfo(skb)->nr_frags; f++) {
                 struct skb_frag_struct *frag;
 
+                count++;
                 i++;
                 if (i == tx_ring->count)
                         i = 0;
@@ -2146,7 +2148,6 @@ static inline int igbvf_tx_map_adv(struct igbvf_adapter *adapter,
                                                 PCI_DMA_TODEVICE);
                 if (pci_dma_mapping_error(pdev, buffer_info->dma))
                         goto dma_error;
-                count++;
         }
 
         tx_ring->buffer_info[i].skb = skb;
@@ -2163,14 +2164,14 @@ dma_error:
         buffer_info->length = 0;
         buffer_info->next_to_watch = 0;
         buffer_info->mapped_as_page = false;
-        count--;
+        if (count)
+                count--;
 
         /* clear timestamp and dma mappings for remaining portion of packet */
-        while (count >= 0) {
-                count--;
-                i--;
-                if (i < 0)
+        while (count--) {
+                if (i==0)
                         i += tx_ring->count;
+                i--;
                 buffer_info = &tx_ring->buffer_info[i];
                 igbvf_put_txbuf(adapter, buffer_info);
         }
@@ -2763,7 +2764,8 @@ static int __devinit igbvf_probe(struct pci_dev *pdev,
         err = hw->mac.ops.reset_hw(hw);
         if (err) {
                 dev_info(&pdev->dev,
-                         "PF still in reset state, assigning new address\n");
+                         "PF still in reset state, assigning new address."
+                         " Is the PF interface up?\n");
                 random_ether_addr(hw->mac.addr);
         } else {
                 err = hw->mac.ops.read_mac_addr(hw);
diff --git a/drivers/net/ixgb/ixgb_main.c b/drivers/net/ixgb/ixgb_main.c
index bcd0f01d5feb..593d1a4f217c 100644
--- a/drivers/net/ixgb/ixgb_main.c
+++ b/drivers/net/ixgb/ixgb_main.c
@@ -1363,13 +1363,13 @@ ixgb_tx_map(struct ixgb_adapter *adapter, struct sk_buff *skb,
 dma_error:
         dev_err(&pdev->dev, "TX DMA map failed\n");
         buffer_info->dma = 0;
-        count--;
-
-        while (count >= 0) {
+        if (count)
                 count--;
-                i--;
-                if (i < 0)
+
+        while (count--) {
+                if (i==0)
                         i += tx_ring->count;
+                i--;
                 buffer_info = &tx_ring->buffer_info[i];
                 ixgb_unmap_and_free_tx_resource(adapter, buffer_info);
         }
diff --git a/drivers/net/ixgbe/Makefile b/drivers/net/ixgbe/Makefile
index 21b41f42b61c..bfef0ebcba9a 100644
--- a/drivers/net/ixgbe/Makefile
+++ b/drivers/net/ixgbe/Makefile
@@ -1,7 +1,7 @@
 ################################################################################
 #
 # Intel 10 Gigabit PCI Express Linux driver
-# Copyright(c) 1999 - 2009 Intel Corporation.
+# Copyright(c) 1999 - 2010 Intel Corporation.
 #
 # This program is free software; you can redistribute it and/or modify it
 # under the terms and conditions of the GNU General Public License,
diff --git a/drivers/net/ixgbe/ixgbe.h b/drivers/net/ixgbe/ixgbe.h
index 8da8eb535084..303e7bd39b67 100644
--- a/drivers/net/ixgbe/ixgbe.h
+++ b/drivers/net/ixgbe/ixgbe.h
@@ -1,7 +1,7 @@
 /*******************************************************************************
 
   Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2009 Intel Corporation.
+  Copyright(c) 1999 - 2010 Intel Corporation.
 
   This program is free software; you can redistribute it and/or modify it
   under the terms and conditions of the GNU General Public License,
diff --git a/drivers/net/ixgbe/ixgbe_82598.c b/drivers/net/ixgbe/ixgbe_82598.c
index 204177d78cec..35a06b47587b 100644
--- a/drivers/net/ixgbe/ixgbe_82598.c
+++ b/drivers/net/ixgbe/ixgbe_82598.c
@@ -1,7 +1,7 @@
 /*******************************************************************************
 
   Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2009 Intel Corporation.
+  Copyright(c) 1999 - 2010 Intel Corporation.
 
   This program is free software; you can redistribute it and/or modify it
   under the terms and conditions of the GNU General Public License,
@@ -357,12 +357,34 @@ static s32 ixgbe_fc_enable_82598(struct ixgbe_hw *hw, s32 packetbuf_num)
         u32 fctrl_reg;
         u32 rmcs_reg;
         u32 reg;
+        u32 link_speed = 0;
+        bool link_up;
 
 #ifdef CONFIG_DCB
         if (hw->fc.requested_mode == ixgbe_fc_pfc)
                 goto out;
 
 #endif /* CONFIG_DCB */
+        /*
+         * On 82598 having Rx FC on causes resets while doing 1G
+         * so if it's on turn it off once we know link_speed. For
+         * more details see 82598 Specification update.
+         */
+        hw->mac.ops.check_link(hw, &link_speed, &link_up, false);
+        if (link_up && link_speed == IXGBE_LINK_SPEED_1GB_FULL) {
+                switch (hw->fc.requested_mode) {
+                case ixgbe_fc_full:
+                        hw->fc.requested_mode = ixgbe_fc_tx_pause;
+                        break;
+                case ixgbe_fc_rx_pause:
+                        hw->fc.requested_mode = ixgbe_fc_none;
+                        break;
+                default:
+                        /* no change */
+                        break;
+                }
+        }
+
         /* Negotiate the fc mode to use */
         ret_val = ixgbe_fc_autoneg(hw);
         if (ret_val)
diff --git a/drivers/net/ixgbe/ixgbe_82599.c b/drivers/net/ixgbe/ixgbe_82599.c
index 538340527aa6..b49bd6b9feb7 100644
--- a/drivers/net/ixgbe/ixgbe_82599.c
+++ b/drivers/net/ixgbe/ixgbe_82599.c
@@ -1,7 +1,7 @@
 /*******************************************************************************
 
   Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2009 Intel Corporation.
+  Copyright(c) 1999 - 2010 Intel Corporation.
 
   This program is free software; you can redistribute it and/or modify it
   under the terms and conditions of the GNU General Public License,
diff --git a/drivers/net/ixgbe/ixgbe_common.c b/drivers/net/ixgbe/ixgbe_common.c
index 688b8ca5da32..21f158f79dd0 100644
--- a/drivers/net/ixgbe/ixgbe_common.c
+++ b/drivers/net/ixgbe/ixgbe_common.c
@@ -1,7 +1,7 @@
 /*******************************************************************************
 
   Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2009 Intel Corporation.
+  Copyright(c) 1999 - 2010 Intel Corporation.
 
   This program is free software; you can redistribute it and/or modify it
   under the terms and conditions of the GNU General Public License,
diff --git a/drivers/net/ixgbe/ixgbe_common.h b/drivers/net/ixgbe/ixgbe_common.h
index 27f3214bed2e..dfff0ffaa502 100644
--- a/drivers/net/ixgbe/ixgbe_common.h
+++ b/drivers/net/ixgbe/ixgbe_common.h
@@ -1,7 +1,7 @@
 /*******************************************************************************
 
   Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2009 Intel Corporation.
+  Copyright(c) 1999 - 2010 Intel Corporation.
 
   This program is free software; you can redistribute it and/or modify it
   under the terms and conditions of the GNU General Public License,
diff --git a/drivers/net/ixgbe/ixgbe_dcb.c b/drivers/net/ixgbe/ixgbe_dcb.c
index a1562287342f..9aea4f04bbd2 100644
--- a/drivers/net/ixgbe/ixgbe_dcb.c
+++ b/drivers/net/ixgbe/ixgbe_dcb.c
@@ -1,7 +1,7 @@
 /*******************************************************************************
 
   Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2009 Intel Corporation.
+  Copyright(c) 1999 - 2010 Intel Corporation.
 
   This program is free software; you can redistribute it and/or modify it
   under the terms and conditions of the GNU General Public License,
diff --git a/drivers/net/ixgbe/ixgbe_dcb.h b/drivers/net/ixgbe/ixgbe_dcb.h
index 64a9fa15c059..5caafd4afbc3 100644
--- a/drivers/net/ixgbe/ixgbe_dcb.h
+++ b/drivers/net/ixgbe/ixgbe_dcb.h
@@ -1,7 +1,7 @@
 /*******************************************************************************
 
   Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2009 Intel Corporation.
+  Copyright(c) 1999 - 2010 Intel Corporation.
 
   This program is free software; you can redistribute it and/or modify it
   under the terms and conditions of the GNU General Public License,
diff --git a/drivers/net/ixgbe/ixgbe_dcb_82598.c b/drivers/net/ixgbe/ixgbe_dcb_82598.c
index f30263898ebc..f0e9279d4669 100644
--- a/drivers/net/ixgbe/ixgbe_dcb_82598.c
+++ b/drivers/net/ixgbe/ixgbe_dcb_82598.c
@@ -1,7 +1,7 @@
 /*******************************************************************************
 
   Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2009 Intel Corporation.
+  Copyright(c) 1999 - 2010 Intel Corporation.
 
   This program is free software; you can redistribute it and/or modify it
   under the terms and conditions of the GNU General Public License,
diff --git a/drivers/net/ixgbe/ixgbe_dcb_82598.h b/drivers/net/ixgbe/ixgbe_dcb_82598.h
index ebbe53c352a7..cc728fa092e2 100644
--- a/drivers/net/ixgbe/ixgbe_dcb_82598.h
+++ b/drivers/net/ixgbe/ixgbe_dcb_82598.h
@@ -1,7 +1,7 @@
 /*******************************************************************************
 
   Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2009 Intel Corporation.
+  Copyright(c) 1999 - 2010 Intel Corporation.
 
   This program is free software; you can redistribute it and/or modify it
   under the terms and conditions of the GNU General Public License,
diff --git a/drivers/net/ixgbe/ixgbe_dcb_82599.c b/drivers/net/ixgbe/ixgbe_dcb_82599.c
index ec8a252636d3..4f7a26ab411e 100644
--- a/drivers/net/ixgbe/ixgbe_dcb_82599.c
+++ b/drivers/net/ixgbe/ixgbe_dcb_82599.c
@@ -1,7 +1,7 @@
 /*******************************************************************************
 
   Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2009 Intel Corporation.
+  Copyright(c) 1999 - 2010 Intel Corporation.
 
   This program is free software; you can redistribute it and/or modify it
   under the terms and conditions of the GNU General Public License,
diff --git a/drivers/net/ixgbe/ixgbe_dcb_82599.h b/drivers/net/ixgbe/ixgbe_dcb_82599.h
index 9e5e2827e4af..0f3f791e1e1d 100644
--- a/drivers/net/ixgbe/ixgbe_dcb_82599.h
+++ b/drivers/net/ixgbe/ixgbe_dcb_82599.h
@@ -1,7 +1,7 @@
 /*******************************************************************************
 
   Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2009 Intel Corporation.
+  Copyright(c) 1999 - 2010 Intel Corporation.
 
   This program is free software; you can redistribute it and/or modify it
   under the terms and conditions of the GNU General Public License,
diff --git a/drivers/net/ixgbe/ixgbe_dcb_nl.c b/drivers/net/ixgbe/ixgbe_dcb_nl.c
index 3c7a79a7d7c6..dd4883f642be 100644
--- a/drivers/net/ixgbe/ixgbe_dcb_nl.c
+++ b/drivers/net/ixgbe/ixgbe_dcb_nl.c
@@ -1,7 +1,7 @@
 /*******************************************************************************
 
   Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2009 Intel Corporation.
+  Copyright(c) 1999 - 2010 Intel Corporation.
 
   This program is free software; you can redistribute it and/or modify it
   under the terms and conditions of the GNU General Public License,
@@ -223,7 +223,7 @@ static void ixgbe_dcbnl_set_pg_bwg_cfg_tx(struct net_device *netdev, int bwg_id,
 
         if (adapter->temp_dcb_cfg.bw_percentage[0][bwg_id] !=
             adapter->dcb_cfg.bw_percentage[0][bwg_id]) {
-                adapter->dcb_set_bitmap |= BIT_PG_RX;
+                adapter->dcb_set_bitmap |= BIT_PG_TX;
                 adapter->dcb_set_bitmap |= BIT_RESETLINK;
         }
 }
@@ -341,6 +341,12 @@ static u8 ixgbe_dcbnl_set_all(struct net_device *netdev)
         if (!adapter->dcb_set_bitmap)
                 return DCB_NO_HW_CHG;
 
+        ret = ixgbe_copy_dcb_cfg(&adapter->temp_dcb_cfg, &adapter->dcb_cfg,
+                                 adapter->ring_feature[RING_F_DCB].indices);
+
+        if (ret)
+                return DCB_NO_HW_CHG;
+
         /*
          * Only take down the adapter if the configuration change
          * requires a reset.
@@ -359,14 +365,6 @@ static u8 ixgbe_dcbnl_set_all(struct net_device *netdev)
                 }
         }
 
-        ret = ixgbe_copy_dcb_cfg(&adapter->temp_dcb_cfg, &adapter->dcb_cfg,
-                                 adapter->ring_feature[RING_F_DCB].indices);
-        if (ret) {
-                if (adapter->dcb_set_bitmap & BIT_RESETLINK)
-                        clear_bit(__IXGBE_RESETTING, &adapter->state);
-                return DCB_NO_HW_CHG;
-        }
-
         if (adapter->dcb_cfg.pfc_mode_enable) {
                 if ((adapter->hw.mac.type != ixgbe_mac_82598EB) &&
                         (adapter->hw.fc.current_mode != ixgbe_fc_pfc))
diff --git a/drivers/net/ixgbe/ixgbe_ethtool.c b/drivers/net/ixgbe/ixgbe_ethtool.c
index 0bd49d3b9f65..d77961fc75f9 100644
--- a/drivers/net/ixgbe/ixgbe_ethtool.c
+++ b/drivers/net/ixgbe/ixgbe_ethtool.c
@@ -1,7 +1,7 @@
 /*******************************************************************************
 
   Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2009 Intel Corporation.
+  Copyright(c) 1999 - 2010 Intel Corporation.
 
   This program is free software; you can redistribute it and/or modify it
   under the terms and conditions of the GNU General Public License,
diff --git a/drivers/net/ixgbe/ixgbe_fcoe.c b/drivers/net/ixgbe/ixgbe_fcoe.c
index da32a108a7b4..e9a20c88c155 100644
--- a/drivers/net/ixgbe/ixgbe_fcoe.c
+++ b/drivers/net/ixgbe/ixgbe_fcoe.c
@@ -1,7 +1,7 @@
 /*******************************************************************************
 
   Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2009 Intel Corporation.
+  Copyright(c) 1999 - 2010 Intel Corporation.
 
   This program is free software; you can redistribute it and/or modify it
   under the terms and conditions of the GNU General Public License,
diff --git a/drivers/net/ixgbe/ixgbe_fcoe.h b/drivers/net/ixgbe/ixgbe_fcoe.h
index de8ff53187da..abf4b2b3f252 100644
--- a/drivers/net/ixgbe/ixgbe_fcoe.h
+++ b/drivers/net/ixgbe/ixgbe_fcoe.h
@@ -1,7 +1,7 @@
 /*******************************************************************************
 
   Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2009 Intel Corporation.
+  Copyright(c) 1999 - 2010 Intel Corporation.
 
   This program is free software; you can redistribute it and/or modify it
   under the terms and conditions of the GNU General Public License,
diff --git a/drivers/net/ixgbe/ixgbe_main.c b/drivers/net/ixgbe/ixgbe_main.c
index bd64387563f0..951b73cf5ca2 100644
--- a/drivers/net/ixgbe/ixgbe_main.c
+++ b/drivers/net/ixgbe/ixgbe_main.c
@@ -1,7 +1,7 @@
 /*******************************************************************************
 
   Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2009 Intel Corporation.
+  Copyright(c) 1999 - 2010 Intel Corporation.
 
   This program is free software; you can redistribute it and/or modify it
   under the terms and conditions of the GNU General Public License,
@@ -52,7 +52,7 @@ static const char ixgbe_driver_string[] =
 
 #define DRV_VERSION "2.0.44-k2"
 const char ixgbe_driver_version[] = DRV_VERSION;
-static char ixgbe_copyright[] = "Copyright (c) 1999-2009 Intel Corporation.";
+static char ixgbe_copyright[] = "Copyright (c) 1999-2010 Intel Corporation.";
 
 static const struct ixgbe_info *ixgbe_info_tbl[] = {
         [board_82598] = &ixgbe_82598_info,
@@ -262,10 +262,12 @@ static inline bool ixgbe_tx_is_paused(struct ixgbe_adapter *adapter,
                 int reg_idx = tx_ring->reg_idx;
                 int dcb_i = adapter->ring_feature[RING_F_DCB].indices;
 
-                if (adapter->hw.mac.type == ixgbe_mac_82598EB) {
+                switch (adapter->hw.mac.type) {
+                case ixgbe_mac_82598EB:
                         tc = reg_idx >> 2;
                         txoff = IXGBE_TFCS_TXOFF0;
-                } else if (adapter->hw.mac.type == ixgbe_mac_82599EB) {
+                        break;
+                case ixgbe_mac_82599EB:
                         tc = 0;
                         txoff = IXGBE_TFCS_TXOFF;
                         if (dcb_i == 8) {
@@ -284,6 +286,9 @@ static inline bool ixgbe_tx_is_paused(struct ixgbe_adapter *adapter,
                                                 tc += (reg_idx - 96) >> 4;
                                 }
                         }
+                        break;
+                default:
+                        tc = 0;
                 }
                 txoff <<= tc;
         }
@@ -4373,6 +4378,11 @@ static int ixgbe_resume(struct pci_dev *pdev)
 
         pci_set_power_state(pdev, PCI_D0);
         pci_restore_state(pdev);
+        /*
+         * pci_restore_state clears dev->state_saved so call
+         * pci_save_state to restore it.
+         */
+        pci_save_state(pdev);
 
         err = pci_enable_device_mem(pdev);
         if (err) {
@@ -4918,7 +4928,7 @@ static int ixgbe_tso(struct ixgbe_adapter *adapter,
                                                                  iph->daddr, 0,
                                                                  IPPROTO_TCP,
                                                                  0);
-                } else if (skb_shinfo(skb)->gso_type == SKB_GSO_TCPV6) {
+                } else if (skb_is_gso_v6(skb)) {
                         ipv6_hdr(skb)->payload_len = 0;
                         tcp_hdr(skb)->check =
                             ~csum_ipv6_magic(&ipv6_hdr(skb)->saddr,
@@ -5157,19 +5167,19 @@ dma_error:
         tx_buffer_info->dma = 0;
         tx_buffer_info->time_stamp = 0;
         tx_buffer_info->next_to_watch = 0;
-        count--;
+        if (count)
+                count--;
 
         /* clear timestamp and dma mappings for remaining portion of packet */
-        while (count >= 0) {
-                count--;
-                i--;
-                if (i < 0)
+        while (count--) {
+                if (i==0)
                         i += tx_ring->count;
+                i--;
                 tx_buffer_info = &tx_ring->tx_buffer_info[i];
                 ixgbe_unmap_and_free_tx_resource(adapter, tx_buffer_info);
         }
 
-        return count;
+        return 0;
 }
 
 static void ixgbe_tx_queue(struct ixgbe_adapter *adapter,
@@ -5319,8 +5329,11 @@ static u16 ixgbe_select_queue(struct net_device *dev, struct sk_buff *skb)
         struct ixgbe_adapter *adapter = netdev_priv(dev);
         int txq = smp_processor_id();
 
-        if (adapter->flags & IXGBE_FLAG_FDIR_HASH_CAPABLE)
+        if (adapter->flags & IXGBE_FLAG_FDIR_HASH_CAPABLE) {
+                while (unlikely(txq >= dev->real_num_tx_queues))
+                        txq -= dev->real_num_tx_queues;
                 return txq;
+        }
 
 #ifdef IXGBE_FCOE
         if ((adapter->flags & IXGBE_FLAG_FCOE_ENABLED) &&
@@ -5566,6 +5579,10 @@ static void ixgbe_netpoll(struct net_device *netdev)
         struct ixgbe_adapter *adapter = netdev_priv(netdev);
         int i;
 
+        /* if interface is down do nothing */
+        if (test_bit(__IXGBE_DOWN, &adapter->state))
+                return;
+
         adapter->flags |= IXGBE_FLAG_IN_NETPOLL;
         if (adapter->flags & IXGBE_FLAG_MSIX_ENABLED) {
                 int num_q_vectors = adapter->num_msix_vectors - NON_Q_VECTORS;
@@ -5746,6 +5763,10 @@ static int __devinit ixgbe_probe(struct pci_dev *pdev,
         if (err)
                 goto err_sw_init;
 
+        /* Make it possible the adapter to be woken up via WOL */
+        if (adapter->hw.mac.type == ixgbe_mac_82599EB)
+                IXGBE_WRITE_REG(&adapter->hw, IXGBE_WUS, ~0);
+
         /*
          * If there is a fan on this device and it has failed log the
          * failure.
diff --git a/drivers/net/ixgbe/ixgbe_phy.c b/drivers/net/ixgbe/ixgbe_phy.c
index 9ecad17522c3..1c1efd386956 100644
--- a/drivers/net/ixgbe/ixgbe_phy.c
+++ b/drivers/net/ixgbe/ixgbe_phy.c
@@ -1,7 +1,7 @@
 /*******************************************************************************
 
   Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2009 Intel Corporation.
+  Copyright(c) 1999 - 2010 Intel Corporation.
 
   This program is free software; you can redistribute it and/or modify it
   under the terms and conditions of the GNU General Public License,
diff --git a/drivers/net/ixgbe/ixgbe_phy.h b/drivers/net/ixgbe/ixgbe_phy.h
index 9b700f5bf1ed..9cf5f3b4cc5d 100644
--- a/drivers/net/ixgbe/ixgbe_phy.h
+++ b/drivers/net/ixgbe/ixgbe_phy.h
@@ -1,7 +1,7 @@
 /*******************************************************************************
 
   Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2009 Intel Corporation.
+  Copyright(c) 1999 - 2010 Intel Corporation.
 
   This program is free software; you can redistribute it and/or modify it
   under the terms and conditions of the GNU General Public License,
diff --git a/drivers/net/ixgbe/ixgbe_type.h b/drivers/net/ixgbe/ixgbe_type.h
index 84650c6ebe03..9eafddfa1b97 100644
--- a/drivers/net/ixgbe/ixgbe_type.h
+++ b/drivers/net/ixgbe/ixgbe_type.h
@@ -1,7 +1,7 @@
 /*******************************************************************************
 
   Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2009 Intel Corporation.
+  Copyright(c) 1999 - 2010 Intel Corporation.
 
   This program is free software; you can redistribute it and/or modify it
   under the terms and conditions of the GNU General Public License,
diff --git a/drivers/net/ks8851_mll.c b/drivers/net/ks8851_mll.c
index c146304d8d6c..c0ceebccaa49 100644
--- a/drivers/net/ks8851_mll.c
+++ b/drivers/net/ks8851_mll.c
@@ -854,8 +854,8 @@ static void ks_update_link_status(struct net_device *netdev, struct ks_net *ks)
 
 static irqreturn_t ks_irq(int irq, void *pw)
 {
-        struct ks_net *ks = pw;
-        struct net_device *netdev = ks->netdev;
+        struct net_device *netdev = pw;
+        struct ks_net *ks = netdev_priv(netdev);
         u16 status;
 
         /*this should be the first in IRQ handler */
diff --git a/drivers/net/ll_temac_main.c b/drivers/net/ll_temac_main.c
index 336e7c7a9275..a8522bd73ae7 100644
--- a/drivers/net/ll_temac_main.c
+++ b/drivers/net/ll_temac_main.c
@@ -134,7 +134,7 @@ static int temac_dma_bd_init(struct net_device *ndev)
         struct sk_buff *skb;
         int i;
 
-        lp->rx_skb = kzalloc(sizeof(struct sk_buff)*RX_BD_NUM, GFP_KERNEL);
+        lp->rx_skb = kzalloc(sizeof(*lp->rx_skb) * RX_BD_NUM, GFP_KERNEL);
         /* allocate the tx and rx ring buffer descriptors. */
         /* returns a virtual addres and a physical address. */
         lp->tx_bd_v = dma_alloc_coherent(ndev->dev.parent,
diff --git a/drivers/net/mlx4/main.c b/drivers/net/mlx4/main.c
index 291a505fd4fc..3cf56d90d859 100644
--- a/drivers/net/mlx4/main.c
+++ b/drivers/net/mlx4/main.c
@@ -1174,7 +1174,7 @@ static int __mlx4_init_one(struct pci_dev *pdev, const struct pci_device_id *id)
         return 0;
 
 err_port:
-        for (port = 1; port <= dev->caps.num_ports; port++)
+        for (--port; port >= 1; --port)
                 mlx4_cleanup_port_info(&priv->port[port]);
 
         mlx4_cleanup_mcg_table(dev);
diff --git a/drivers/net/mv643xx_eth.c b/drivers/net/mv643xx_eth.c
index 1405a170bb43..af67af55efe7 100644
--- a/drivers/net/mv643xx_eth.c
+++ b/drivers/net/mv643xx_eth.c
@@ -656,6 +656,7 @@ static int rxq_refill(struct rx_queue *rxq, int budget)
                 struct sk_buff *skb;
                 int rx;
                 struct rx_desc *rx_desc;
+                int size;
 
                 skb = __skb_dequeue(&mp->rx_recycle);
                 if (skb == NULL)
@@ -678,10 +679,11 @@ static int rxq_refill(struct rx_queue *rxq, int budget)
 
                 rx_desc = rxq->rx_desc_area + rx;
 
+                size = skb->end - skb->data;
                 rx_desc->buf_ptr = dma_map_single(mp->dev->dev.parent,
-                                                  skb->data, mp->skb_size,
+                                                  skb->data, size,
                                                   DMA_FROM_DEVICE);
-                rx_desc->buf_size = mp->skb_size;
+                rx_desc->buf_size = size;
                 rxq->rx_skb[rx] = skb;
                 wmb();
                 rx_desc->cmd_sts = BUFFER_OWNED_BY_DMA | RX_ENABLE_INTERRUPT;
diff --git a/drivers/net/netxen/netxen_nic.h b/drivers/net/netxen/netxen_nic.h
index 76cd1f3e9fc8..9bc5bd1d538a 100644
--- a/drivers/net/netxen/netxen_nic.h
+++ b/drivers/net/netxen/netxen_nic.h
@@ -53,8 +53,8 @@
 
 #define _NETXEN_NIC_LINUX_MAJOR 4
 #define _NETXEN_NIC_LINUX_MINOR 0
-#define _NETXEN_NIC_LINUX_SUBVERSION 65
-#define NETXEN_NIC_LINUX_VERSIONID  "4.0.65"
+#define _NETXEN_NIC_LINUX_SUBVERSION 72
+#define NETXEN_NIC_LINUX_VERSIONID  "4.0.72"
 
 #define NETXEN_VERSION_CODE(a, b, c)    (((a) << 24) + ((b) << 16) + (c))
 #define _major(v)       (((v) >> 24) & 0xff)
diff --git a/drivers/net/netxen/netxen_nic_ethtool.c b/drivers/net/netxen/netxen_nic_ethtool.c
index ddd704ae0188..542f408333ff 100644
--- a/drivers/net/netxen/netxen_nic_ethtool.c
+++ b/drivers/net/netxen/netxen_nic_ethtool.c
@@ -66,7 +66,7 @@ static const char netxen_nic_gstrings_test[][ETH_GSTRING_LEN] = {
 
 #define NETXEN_NIC_TEST_LEN     ARRAY_SIZE(netxen_nic_gstrings_test)
 
-#define NETXEN_NIC_REGS_COUNT 42
+#define NETXEN_NIC_REGS_COUNT 30
 #define NETXEN_NIC_REGS_LEN (NETXEN_NIC_REGS_COUNT * sizeof(__le32))
 #define NETXEN_MAX_EEPROM_LEN   1024
 
@@ -312,150 +312,91 @@ static int netxen_nic_get_regs_len(struct net_device *dev)
         return NETXEN_NIC_REGS_LEN;
 }
 
-struct netxen_niu_regs {
-        __u32 reg[NETXEN_NIC_REGS_COUNT];
-};
-
-static struct netxen_niu_regs niu_registers[] = {
-        {
-         /* GB Mode */
-         {
-          NETXEN_NIU_GB_SERDES_RESET,
-          NETXEN_NIU_GB0_MII_MODE,
-          NETXEN_NIU_GB1_MII_MODE,
-          NETXEN_NIU_GB2_MII_MODE,
-          NETXEN_NIU_GB3_MII_MODE,
-          NETXEN_NIU_GB0_GMII_MODE,
-          NETXEN_NIU_GB1_GMII_MODE,
-          NETXEN_NIU_GB2_GMII_MODE,
-          NETXEN_NIU_GB3_GMII_MODE,
-          NETXEN_NIU_REMOTE_LOOPBACK,
-          NETXEN_NIU_GB0_HALF_DUPLEX,
-          NETXEN_NIU_GB1_HALF_DUPLEX,
-          NETXEN_NIU_RESET_SYS_FIFOS,
-          NETXEN_NIU_GB_CRC_DROP,
-          NETXEN_NIU_GB_DROP_WRONGADDR,
-          NETXEN_NIU_TEST_MUX_CTL,
-
-          NETXEN_NIU_GB_MAC_CONFIG_0(0),
-          NETXEN_NIU_GB_MAC_CONFIG_1(0),
-          NETXEN_NIU_GB_HALF_DUPLEX_CTRL(0),
-          NETXEN_NIU_GB_MAX_FRAME_SIZE(0),
-          NETXEN_NIU_GB_TEST_REG(0),
-          NETXEN_NIU_GB_MII_MGMT_CONFIG(0),
-          NETXEN_NIU_GB_MII_MGMT_COMMAND(0),
-          NETXEN_NIU_GB_MII_MGMT_ADDR(0),
-          NETXEN_NIU_GB_MII_MGMT_CTRL(0),
-          NETXEN_NIU_GB_MII_MGMT_STATUS(0),
-          NETXEN_NIU_GB_MII_MGMT_INDICATE(0),
-          NETXEN_NIU_GB_INTERFACE_CTRL(0),
-          NETXEN_NIU_GB_INTERFACE_STATUS(0),
-          NETXEN_NIU_GB_STATION_ADDR_0(0),
-          NETXEN_NIU_GB_STATION_ADDR_1(0),
-          -1,
-          }
-         },
-        {
-         /* XG Mode */
-         {
-          NETXEN_NIU_XG_SINGLE_TERM,
-          NETXEN_NIU_XG_DRIVE_HI,
-          NETXEN_NIU_XG_DRIVE_LO,
-          NETXEN_NIU_XG_DTX,
-          NETXEN_NIU_XG_DEQ,
-          NETXEN_NIU_XG_WORD_ALIGN,
-          NETXEN_NIU_XG_RESET,
-          NETXEN_NIU_XG_POWER_DOWN,
-          NETXEN_NIU_XG_RESET_PLL,
-          NETXEN_NIU_XG_SERDES_LOOPBACK,
-          NETXEN_NIU_XG_DO_BYTE_ALIGN,
-          NETXEN_NIU_XG_TX_ENABLE,
-          NETXEN_NIU_XG_RX_ENABLE,
-          NETXEN_NIU_XG_STATUS,
-          NETXEN_NIU_XG_PAUSE_THRESHOLD,
-          NETXEN_NIU_XGE_CONFIG_0,
-          NETXEN_NIU_XGE_CONFIG_1,
-          NETXEN_NIU_XGE_IPG,
-          NETXEN_NIU_XGE_STATION_ADDR_0_HI,
-          NETXEN_NIU_XGE_STATION_ADDR_0_1,
-          NETXEN_NIU_XGE_STATION_ADDR_1_LO,
-          NETXEN_NIU_XGE_STATUS,
-          NETXEN_NIU_XGE_MAX_FRAME_SIZE,
-          NETXEN_NIU_XGE_PAUSE_FRAME_VALUE,
-          NETXEN_NIU_XGE_TX_BYTE_CNT,
-          NETXEN_NIU_XGE_TX_FRAME_CNT,
-          NETXEN_NIU_XGE_RX_BYTE_CNT,
-          NETXEN_NIU_XGE_RX_FRAME_CNT,
-          NETXEN_NIU_XGE_AGGR_ERROR_CNT,
-          NETXEN_NIU_XGE_MULTICAST_FRAME_CNT,
-          NETXEN_NIU_XGE_UNICAST_FRAME_CNT,
-          NETXEN_NIU_XGE_CRC_ERROR_CNT,
-          NETXEN_NIU_XGE_OVERSIZE_FRAME_ERR,
-          NETXEN_NIU_XGE_UNDERSIZE_FRAME_ERR,
-          NETXEN_NIU_XGE_LOCAL_ERROR_CNT,
-          NETXEN_NIU_XGE_REMOTE_ERROR_CNT,
-          NETXEN_NIU_XGE_CONTROL_CHAR_CNT,
-          NETXEN_NIU_XGE_PAUSE_FRAME_CNT,
-          -1,
-          }
-         }
-};
-
 static void
 netxen_nic_get_regs(struct net_device *dev, struct ethtool_regs *regs, void *p)
 {
         struct netxen_adapter *adapter = netdev_priv(dev);
-        __u32 mode, *regs_buff = p;
-        int i, window;
+        struct netxen_recv_context *recv_ctx = &adapter->recv_ctx;
+        struct nx_host_sds_ring *sds_ring;
+        u32 *regs_buff = p;
+        int ring, i = 0;
+        int port = adapter->physical_port;
 
         memset(p, 0, NETXEN_NIC_REGS_LEN);
+
         regs->version = (1 << 24) | (adapter->ahw.revision_id << 16) |
             (adapter->pdev)->device;
-        /* which mode */
-        regs_buff[0] = NXRD32(adapter, NETXEN_NIU_MODE);
-        mode = regs_buff[0];
-
-        /* Common registers to all the modes */
-        regs_buff[2] = NXRD32(adapter, NETXEN_NIU_STRAP_VALUE_SAVE_HIGHER);
-        /* GB/XGB Mode */
-        mode = (mode / 2) - 1;
-        window = 0;
-        if (mode <= 1) {
-                for (i = 3; niu_registers[mode].reg[i - 3] != -1; i++) {
-                        /* GB: port specific registers */
-                        if (mode == 0 && i >= 19)
-                                window = adapter->physical_port *
-                                        NETXEN_NIC_PORT_WINDOW;
-
-                        regs_buff[i] = NXRD32(adapter,
-                                niu_registers[mode].reg[i - 3] + window);
-                }
 
+        if (adapter->is_up != NETXEN_ADAPTER_UP_MAGIC)
+                return;
+
+        regs_buff[i++] = NXRD32(adapter, CRB_CMDPEG_STATE);
+        regs_buff[i++] = NXRD32(adapter, CRB_RCVPEG_STATE);
+        regs_buff[i++] = NXRD32(adapter, CRB_FW_CAPABILITIES_1);
+        regs_buff[i++] = NXRDIO(adapter, adapter->crb_int_state_reg);
+        regs_buff[i++] = NXRD32(adapter, NX_CRB_DEV_REF_COUNT);
+        regs_buff[i++] = NXRD32(adapter, NX_CRB_DEV_STATE);
+        regs_buff[i++] = NXRD32(adapter, NETXEN_PEG_ALIVE_COUNTER);
+        regs_buff[i++] = NXRD32(adapter, NETXEN_PEG_HALT_STATUS1);
+        regs_buff[i++] = NXRD32(adapter, NETXEN_PEG_HALT_STATUS2);
+
+        regs_buff[i++] = NXRD32(adapter, NETXEN_CRB_PEG_NET_0+0x3c);
+        regs_buff[i++] = NXRD32(adapter, NETXEN_CRB_PEG_NET_1+0x3c);
+        regs_buff[i++] = NXRD32(adapter, NETXEN_CRB_PEG_NET_2+0x3c);
+        regs_buff[i++] = NXRD32(adapter, NETXEN_CRB_PEG_NET_3+0x3c);
+
+        if (NX_IS_REVISION_P3(adapter->ahw.revision_id)) {
+
+                regs_buff[i++] = NXRD32(adapter, NETXEN_CRB_PEG_NET_4+0x3c);
+                i += 2;
+
+                regs_buff[i++] = NXRD32(adapter, CRB_XG_STATE_P3);
+                regs_buff[i++] = le32_to_cpu(*(adapter->tx_ring->hw_consumer));
+
+        } else {
+                i++;
+
+                regs_buff[i++] = NXRD32(adapter,
+                                        NETXEN_NIU_XGE_CONFIG_0+(0x10000*port));
+                regs_buff[i++] = NXRD32(adapter,
+                                        NETXEN_NIU_XGE_CONFIG_1+(0x10000*port));
+
+                regs_buff[i++] = NXRD32(adapter, CRB_XG_STATE);
+                regs_buff[i++] = NXRDIO(adapter,
+                                 adapter->tx_ring->crb_cmd_consumer);
+        }
+
+        regs_buff[i++] = NXRDIO(adapter, adapter->tx_ring->crb_cmd_producer);
+
+        regs_buff[i++] = NXRDIO(adapter,
+                         recv_ctx->rds_rings[0].crb_rcv_producer);
+        regs_buff[i++] = NXRDIO(adapter,
+                         recv_ctx->rds_rings[1].crb_rcv_producer);
+
+        regs_buff[i++] = adapter->max_sds_rings;
+
+        for (ring = 0; ring < adapter->max_sds_rings; ring++) {
+                sds_ring = &(recv_ctx->sds_rings[ring]);
+                regs_buff[i++] = NXRDIO(adapter,
+                                        sds_ring->crb_sts_consumer);
         }
 }
 
 static u32 netxen_nic_test_link(struct net_device *dev)
 {
         struct netxen_adapter *adapter = netdev_priv(dev);
-        __u32 status;
-        int val;
+        u32 val, port;
 
-        /* read which mode */
-        if (adapter->ahw.port_type == NETXEN_NIC_GBE) {
-                if (adapter->phy_read &&
-                    adapter->phy_read(adapter,
-                                      NETXEN_NIU_GB_MII_MGMT_ADDR_PHY_STATUS,
-                                      &status) != 0)
-                        return -EIO;
-                else {
-                        val = netxen_get_phy_link(status);
-                        return !val;
-                }
-        } else if (adapter->ahw.port_type == NETXEN_NIC_XGBE) {
+        port = adapter->physical_port;
+        if (NX_IS_REVISION_P3(adapter->ahw.revision_id)) {
+                val = NXRD32(adapter, CRB_XG_STATE_P3);
+                val = XG_LINK_STATE_P3(adapter->ahw.pci_func, val);
+                return (val == XG_LINK_UP_P3) ? 0 : 1;
+        } else {
                 val = NXRD32(adapter, CRB_XG_STATE);
+                val = (val >> port*8) & 0xff;
                 return (val == XG_LINK_UP) ? 0 : 1;
         }
-        return -EIO;
 }
 
 static int
diff --git a/drivers/net/netxen/netxen_nic_hw.c b/drivers/net/netxen/netxen_nic_hw.c
index 2e364fee3cbb..85e28e60ecf1 100644
--- a/drivers/net/netxen/netxen_nic_hw.c
+++ b/drivers/net/netxen/netxen_nic_hw.c
@@ -345,8 +345,7 @@ netxen_pcie_sem_lock(struct netxen_adapter *adapter, int sem, u32 id_reg)
 void
 netxen_pcie_sem_unlock(struct netxen_adapter *adapter, int sem)
 {
-        int val;
-        val = NXRD32(adapter, NETXEN_PCIE_REG(PCIE_SEM_UNLOCK(sem)));
+        NXRD32(adapter, NETXEN_PCIE_REG(PCIE_SEM_UNLOCK(sem)));
 }
 
 int netxen_niu_xg_init_port(struct netxen_adapter *adapter, int port)
@@ -691,6 +690,9 @@ void netxen_p3_nic_set_multi(struct net_device *netdev)
         struct list_head *head;
         nx_mac_list_t *cur;
 
+        if (adapter->is_up != NETXEN_ADAPTER_UP_MAGIC)
+                return;
+
         list_splice_tail_init(&adapter->mac_list, &del_list);
 
         nx_p3_nic_add_mac(adapter, adapter->mac_addr, &del_list);
diff --git a/drivers/net/netxen/netxen_nic_init.c b/drivers/net/netxen/netxen_nic_init.c
index 02f8d4b4db63..64cff68d372c 100644
--- a/drivers/net/netxen/netxen_nic_init.c
+++ b/drivers/net/netxen/netxen_nic_init.c
@@ -184,6 +184,8 @@ skip_rds:
 
         tx_ring = adapter->tx_ring;
         vfree(tx_ring->cmd_buf_arr);
+        kfree(tx_ring);
+        adapter->tx_ring = NULL;
 }
 
 int netxen_alloc_sw_resources(struct netxen_adapter *adapter)
@@ -782,7 +784,7 @@ netxen_need_fw_reset(struct netxen_adapter *adapter)
         if (NXRD32(adapter, CRB_CMDPEG_STATE) == PHAN_INITIALIZE_FAILED)
                 return 1;
 
-        old_count = count = NXRD32(adapter, NETXEN_PEG_ALIVE_COUNTER);
+        old_count = NXRD32(adapter, NETXEN_PEG_ALIVE_COUNTER);
 
         for (i = 0; i < 10; i++) {
 
diff --git a/drivers/net/netxen/netxen_nic_main.c b/drivers/net/netxen/netxen_nic_main.c
index 6cae26a5bd67..24279e6e55f5 100644
--- a/drivers/net/netxen/netxen_nic_main.c
+++ b/drivers/net/netxen/netxen_nic_main.c
@@ -340,7 +340,7 @@ netxen_check_hw_init(struct netxen_adapter *adapter, int first_boot)
                 if (!(first_boot & 0x4)) {
                         first_boot |= 0x4;
                         NXWR32(adapter, NETXEN_PCIE_REG(0x4), first_boot);
-                        first_boot = NXRD32(adapter, NETXEN_PCIE_REG(0x4));
+                        NXRD32(adapter, NETXEN_PCIE_REG(0x4));
                 }
 
                 /* This is the first boot after power up */
@@ -1898,12 +1898,8 @@ static void netxen_nic_handle_phy_intr(struct netxen_adapter *adapter)
                 linkup = (val == XG_LINK_UP_P3);
         } else {
                 val = NXRD32(adapter, CRB_XG_STATE);
-                if (adapter->ahw.port_type == NETXEN_NIC_GBE)
-                        linkup = (val >> port) & 1;
-                else {
-                        val = (val >> port*8) & 0xff;
-                        linkup = (val == XG_LINK_UP);
-                }
+                val = (val >> port*8) & 0xff;
+                linkup = (val == XG_LINK_UP);
         }
 
         netxen_advert_link_change(adapter, linkup);
@@ -1945,7 +1941,7 @@ static void netxen_tx_timeout_task(struct work_struct *work)
                 netif_wake_queue(adapter->netdev);
 
                 clear_bit(__NX_RESETTING, &adapter->state);
-
+                return;
         } else {
                 clear_bit(__NX_RESETTING, &adapter->state);
                 if (!netxen_nic_reset_context(adapter)) {
@@ -2244,7 +2240,9 @@ netxen_detach_work(struct work_struct *work)
 
         netxen_nic_down(adapter, netdev);
 
+        rtnl_lock();
         netxen_nic_detach(adapter);
+        rtnl_unlock();
 
         status = NXRD32(adapter, NETXEN_PEG_HALT_STATUS1);
 
diff --git a/drivers/net/niu.c b/drivers/net/niu.c
index 8ce58c4c7dd3..2aed2b382c40 100644
--- a/drivers/net/niu.c
+++ b/drivers/net/niu.c
@@ -2844,7 +2844,7 @@ static int tcam_wait_bit(struct niu *np, u64 bit)
                         break;
                 udelay(1);
         }
-        if (limit < 0)
+        if (limit <= 0)
                 return -ENODEV;
 
         return 0;
diff --git a/drivers/net/pcmcia/fmvj18x_cs.c b/drivers/net/pcmcia/fmvj18x_cs.c
index 813aca3fc433..7b17404d0858 100644
--- a/drivers/net/pcmcia/fmvj18x_cs.c
+++ b/drivers/net/pcmcia/fmvj18x_cs.c
@@ -717,6 +717,7 @@ static struct pcmcia_device_id fmvj18x_ids[] = {
         PCMCIA_PFC_DEVICE_PROD_ID12(0, "NEC", "PK-UG-J001" ,0x18df0ba0 ,0x831b1064),
         PCMCIA_PFC_DEVICE_MANF_CARD(0, 0x0105, 0x0d0a),
         PCMCIA_PFC_DEVICE_MANF_CARD(0, 0x0105, 0x0e0a),
+        PCMCIA_PFC_DEVICE_MANF_CARD(0, 0x0032, 0x0e01),
         PCMCIA_PFC_DEVICE_MANF_CARD(0, 0x0032, 0x0a05),
         PCMCIA_PFC_DEVICE_MANF_CARD(0, 0x0032, 0x1101),
         PCMCIA_DEVICE_NULL,
diff --git a/drivers/net/pcmcia/nmclan_cs.c b/drivers/net/pcmcia/nmclan_cs.c
index 8a5ae3b182ed..12e3233868e9 100644
--- a/drivers/net/pcmcia/nmclan_cs.c
+++ b/drivers/net/pcmcia/nmclan_cs.c
@@ -1402,7 +1402,6 @@ static void BuildLAF(int *ladrf, int *adr)
   for (i = 0; i < 8; i++)
     printk(KERN_CONT " %02X", ladrf[i]);
   printk(KERN_CONT "\n");
-  }
 #endif
 } /* BuildLAF */
 
diff --git a/drivers/net/pcmcia/pcnet_cs.c b/drivers/net/pcmcia/pcnet_cs.c
index 92ed3fbf89a5..776cad2f5715 100644
--- a/drivers/net/pcmcia/pcnet_cs.c
+++ b/drivers/net/pcmcia/pcnet_cs.c
@@ -1741,7 +1741,7 @@ static struct pcmcia_device_id pcnet_ids[] = {
         PCMCIA_MFC_DEVICE_CIS_PROD_ID4(0, "NSC MF LAN/Modem", 0x58fc6056, "cis/DP83903.cis"),
         PCMCIA_MFC_DEVICE_CIS_MANF_CARD(0, 0x0175, 0x0000, "cis/DP83903.cis"),
         PCMCIA_DEVICE_CIS_MANF_CARD(0xc00f, 0x0002, "cis/LA-PCM.cis"),
-        PCMCIA_DEVICE_CIS_PROD_ID12("KTI", "PE520 PLUS", 0xad180345, 0x9d58d392, "PE520.cis"),
+        PCMCIA_DEVICE_CIS_PROD_ID12("KTI", "PE520 PLUS", 0xad180345, 0x9d58d392, "cis/PE520.cis"),
         PCMCIA_DEVICE_CIS_PROD_ID12("NDC", "Ethernet", 0x01c43ae1, 0x00b2e941, "cis/NE2K.cis"),
         PCMCIA_DEVICE_CIS_PROD_ID12("PMX   ", "PE-200", 0x34f3f1c8, 0x10b59f8c, "cis/PE-200.cis"),
         PCMCIA_DEVICE_CIS_PROD_ID12("TAMARACK", "Ethernet", 0xcf434fba, 0x00b2e941, "cis/tamarack.cis"),
@@ -1754,7 +1754,7 @@ MODULE_DEVICE_TABLE(pcmcia, pcnet_ids);
 MODULE_FIRMWARE("cis/PCMLM28.cis");
 MODULE_FIRMWARE("cis/DP83903.cis");
 MODULE_FIRMWARE("cis/LA-PCM.cis");
-MODULE_FIRMWARE("PE520.cis");
+MODULE_FIRMWARE("cis/PE520.cis");
 MODULE_FIRMWARE("cis/NE2K.cis");
 MODULE_FIRMWARE("cis/PE-200.cis");
 MODULE_FIRMWARE("cis/tamarack.cis");
diff --git a/drivers/net/pcnet32.c b/drivers/net/pcnet32.c
index dcc67a35e8f2..e154677ff706 100644
--- a/drivers/net/pcnet32.c
+++ b/drivers/net/pcnet32.c
@@ -45,6 +45,7 @@ static const char *const version =
 #include <linux/crc32.h>
 #include <linux/netdevice.h>
 #include <linux/etherdevice.h>
+#include <linux/if_ether.h>
 #include <linux/skbuff.h>
 #include <linux/spinlock.h>
 #include <linux/moduleparam.h>
@@ -1765,7 +1766,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
 
         /* if the ethernet address is not valid, force to 00:00:00:00:00:00 */
         if (!is_valid_ether_addr(dev->perm_addr))
-                memset(dev->dev_addr, 0, sizeof(dev->dev_addr));
+                memset(dev->dev_addr, 0, ETH_ALEN);
 
         if (pcnet32_debug & NETIF_MSG_PROBE) {
                 printk(" %pM", dev->dev_addr);
diff --git a/drivers/net/phy/broadcom.c b/drivers/net/phy/broadcom.c
index c13cf64095b6..33c4b12a63ba 100644
--- a/drivers/net/phy/broadcom.c
+++ b/drivers/net/phy/broadcom.c
@@ -331,8 +331,8 @@ static void bcm54xx_adjust_rxrefclk(struct phy_device *phydev)
         bool clk125en = true;
 
         /* Abort if we are using an untested phy. */
-        if (BRCM_PHY_MODEL(phydev) != PHY_ID_BCM57780 ||
-            BRCM_PHY_MODEL(phydev) != PHY_ID_BCM50610 ||
+        if (BRCM_PHY_MODEL(phydev) != PHY_ID_BCM57780 &&
+            BRCM_PHY_MODEL(phydev) != PHY_ID_BCM50610 &&
             BRCM_PHY_MODEL(phydev) != PHY_ID_BCM50610M)
                 return;
 
diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c
index bd4e8d72dc08..e17b70291bbc 100644
--- a/drivers/net/phy/mdio_bus.c
+++ b/drivers/net/phy/mdio_bus.c
@@ -264,6 +264,8 @@ static int mdio_bus_match(struct device *dev, struct device_driver *drv)
                 (phydev->phy_id & phydrv->phy_id_mask));
 }
 
+#ifdef CONFIG_PM
+
 static bool mdio_bus_phy_may_suspend(struct phy_device *phydev)
 {
         struct device_driver *drv = phydev->dev.driver;
@@ -295,34 +297,88 @@ static bool mdio_bus_phy_may_suspend(struct phy_device *phydev)
         return true;
 }
 
-/* Suspend and resume.  Copied from platform_suspend and
- * platform_resume
- */
-static int mdio_bus_suspend(struct device * dev, pm_message_t state)
+static int mdio_bus_suspend(struct device *dev)
 {
         struct phy_driver *phydrv = to_phy_driver(dev->driver);
         struct phy_device *phydev = to_phy_device(dev);
 
+        /*
+         * We must stop the state machine manually, otherwise it stops out of
+         * control, possibly with the phydev->lock held. Upon resume, netdev
+         * may call phy routines that try to grab the same lock, and that may
+         * lead to a deadlock.
+         */
+        if (phydev->attached_dev)
+                phy_stop_machine(phydev);
+
         if (!mdio_bus_phy_may_suspend(phydev))
                 return 0;
+
         return phydrv->suspend(phydev);
 }
 
-static int mdio_bus_resume(struct device * dev)
+static int mdio_bus_resume(struct device *dev)
 {
         struct phy_driver *phydrv = to_phy_driver(dev->driver);
         struct phy_device *phydev = to_phy_device(dev);
+        int ret;
 
         if (!mdio_bus_phy_may_suspend(phydev))
+                goto no_resume;
+
+        ret = phydrv->resume(phydev);
+        if (ret < 0)
+                return ret;
+
+no_resume:
+        if (phydev->attached_dev)
+                phy_start_machine(phydev, NULL);
+
+        return 0;
+}
+
+static int mdio_bus_restore(struct device *dev)
+{
+        struct phy_device *phydev = to_phy_device(dev);
+        struct net_device *netdev = phydev->attached_dev;
+        int ret;
+
+        if (!netdev)
                 return 0;
-        return phydrv->resume(phydev);
+
+        ret = phy_init_hw(phydev);
+        if (ret < 0)
+                return ret;
+
+        /* The PHY needs to renegotiate. */
+        phydev->link = 0;
+        phydev->state = PHY_UP;
+
+        phy_start_machine(phydev, NULL);
+
+        return 0;
 }
 
+static struct dev_pm_ops mdio_bus_pm_ops = {
+        .suspend = mdio_bus_suspend,
+        .resume = mdio_bus_resume,
+        .freeze = mdio_bus_suspend,
+        .thaw = mdio_bus_resume,
+        .restore = mdio_bus_restore,
+};
+
+#define MDIO_BUS_PM_OPS (&mdio_bus_pm_ops)
+
+#else
+
+#define MDIO_BUS_PM_OPS NULL
+
+#endif /* CONFIG_PM */
+
 struct bus_type mdio_bus_type = {
         .name           = "mdio_bus",
         .match          = mdio_bus_match,
-        .suspend        = mdio_bus_suspend,
-        .resume         = mdio_bus_resume,
+        .pm             = MDIO_BUS_PM_OPS,
 };
 EXPORT_SYMBOL(mdio_bus_type);
 
diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
index b0e9f9c51721..0295097d6c44 100644
--- a/drivers/net/phy/phy.c
+++ b/drivers/net/phy/phy.c
@@ -410,7 +410,6 @@ EXPORT_SYMBOL(phy_start_aneg);
 
 
 static void phy_change(struct work_struct *work);
-static void phy_state_machine(struct work_struct *work);
 
 /**
  * phy_start_machine - start PHY state machine tracking
@@ -430,7 +429,6 @@ void phy_start_machine(struct phy_device *phydev,
 {
         phydev->adjust_state = handler;
 
-        INIT_DELAYED_WORK(&phydev->state_queue, phy_state_machine);
         schedule_delayed_work(&phydev->state_queue, HZ);
 }
 
@@ -761,7 +759,7 @@ EXPORT_SYMBOL(phy_start);
  * phy_state_machine - Handle the state machine
  * @work: work_struct that describes the work to be done
  */
-static void phy_state_machine(struct work_struct *work)
+void phy_state_machine(struct work_struct *work)
 {
         struct delayed_work *dwork = to_delayed_work(work);
         struct phy_device *phydev =
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index b10fedd82143..adbc0fded130 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -177,6 +177,7 @@ struct phy_device* phy_device_create(struct mii_bus *bus, int addr, int phy_id)
         dev->state = PHY_DOWN;
 
         mutex_init(&dev->lock);
+        INIT_DELAYED_WORK(&dev->state_queue, phy_state_machine);
 
         return dev;
 }
@@ -378,6 +379,20 @@ void phy_disconnect(struct phy_device *phydev)
 }
 EXPORT_SYMBOL(phy_disconnect);
 
+int phy_init_hw(struct phy_device *phydev)
+{
+        int ret;
+
+        if (!phydev->drv || !phydev->drv->config_init)
+                return 0;
+
+        ret = phy_scan_fixups(phydev);
+        if (ret < 0)
+                return ret;
+
+        return phydev->drv->config_init(phydev);
+}
+
 /**
  * phy_attach_direct - attach a network device to a given PHY device pointer
  * @dev: network device to attach
@@ -425,21 +440,7 @@ int phy_attach_direct(struct net_device *dev, struct phy_device *phydev,
         /* Do initial configuration here, now that
          * we have certain key parameters
          * (dev_flags and interface) */
-        if (phydev->drv->config_init) {
-                int err;
-
-                err = phy_scan_fixups(phydev);
-
-                if (err < 0)
-                        return err;
-
-                err = phydev->drv->config_init(phydev);
-
-                if (err < 0)
-                        return err;
-        }
-
-        return 0;
+        return phy_init_hw(phydev);
 }
 EXPORT_SYMBOL(phy_attach_direct);
 
diff --git a/drivers/net/qlge/qlge_main.c b/drivers/net/qlge/qlge_main.c
index 707b391afa02..894a7c84faef 100644
--- a/drivers/net/qlge/qlge_main.c
+++ b/drivers/net/qlge/qlge_main.c
@@ -4119,7 +4119,7 @@ static int __devinit ql_init_device(struct pci_dev *pdev,
         err = pcie_set_readrq(pdev, 4096);
         if (err) {
                 dev_err(&pdev->dev, "Set readrq failed.\n");
-                goto err_out;
+                goto err_out1;
         }
 
         err = pci_request_regions(pdev, DRV_NAME);
@@ -4140,7 +4140,7 @@ static int __devinit ql_init_device(struct pci_dev *pdev,
 
         if (err) {
                 dev_err(&pdev->dev, "No usable DMA configuration.\n");
-                goto err_out;
+                goto err_out2;
         }
 
         /* Set PCIe reset type for EEH to fundamental. */
@@ -4152,7 +4152,7 @@ static int __devinit ql_init_device(struct pci_dev *pdev,
         if (!qdev->reg_base) {
                 dev_err(&pdev->dev, "Register mapping failed.\n");
                 err = -ENOMEM;
-                goto err_out;
+                goto err_out2;
         }
 
         qdev->doorbell_area_size = pci_resource_len(pdev, 3);
@@ -4162,14 +4162,14 @@ static int __devinit ql_init_device(struct pci_dev *pdev,
         if (!qdev->doorbell_area) {
                 dev_err(&pdev->dev, "Doorbell register mapping failed.\n");
                 err = -ENOMEM;
-                goto err_out;
+                goto err_out2;
         }
 
         err = ql_get_board_info(qdev);
         if (err) {
                 dev_err(&pdev->dev, "Register access failed.\n");
                 err = -EIO;
-                goto err_out;
+                goto err_out2;
         }
         qdev->msg_enable = netif_msg_init(debug, default_msg);
         spin_lock_init(&qdev->hw_lock);
@@ -4179,7 +4179,7 @@ static int __devinit ql_init_device(struct pci_dev *pdev,
         err = qdev->nic_ops->get_flash(qdev);
         if (err) {
                 dev_err(&pdev->dev, "Invalid FLASH.\n");
-                goto err_out;
+                goto err_out2;
         }
 
         memcpy(ndev->perm_addr, ndev->dev_addr, ndev->addr_len);
@@ -4212,8 +4212,9 @@ static int __devinit ql_init_device(struct pci_dev *pdev,
                          DRV_NAME, DRV_VERSION);
         }
         return 0;
-err_out:
+err_out2:
         ql_release_all(pdev);
+err_out1:
         pci_disable_device(pdev);
         return err;
 }
diff --git a/drivers/net/rrunner.c b/drivers/net/rrunner.c
index 20a71749154a..1c257098d0a6 100644
--- a/drivers/net/rrunner.c
+++ b/drivers/net/rrunner.c
@@ -1293,7 +1293,7 @@ static void rr_dump(struct net_device *dev)
 
         printk("Error code 0x%x\n", readl(&regs->Fail1));
 
-        index = (((readl(&regs->EvtPrd) >> 8) & 0xff ) - 1) % EVT_RING_ENTRIES;
+        index = (((readl(&regs->EvtPrd) >> 8) & 0xff) - 1) % TX_RING_ENTRIES;
         cons = rrpriv->dirty_tx;
         printk("TX ring index %i, TX consumer %i\n",
                index, cons);
diff --git a/drivers/net/s2io.c b/drivers/net/s2io.c
index cc4218667cba..3c4836d0898f 100644
--- a/drivers/net/s2io.c
+++ b/drivers/net/s2io.c
@@ -3421,7 +3421,7 @@ static int wait_for_cmd_complete(void __iomem *addr, u64 busy_bit,
                                 break;
                         }
                 } else {
-                        if (!(val64 & busy_bit)) {
+                        if (val64 & busy_bit) {
                                 ret = SUCCESS;
                                 break;
                         }
diff --git a/drivers/net/sfc/efx.c b/drivers/net/sfc/efx.c
index f983e3b507cc..46997e177ee3 100644
--- a/drivers/net/sfc/efx.c
+++ b/drivers/net/sfc/efx.c
@@ -741,14 +741,14 @@ static int efx_probe_port(struct efx_nic *efx)
 
         EFX_LOG(efx, "create port\n");
 
+        if (phy_flash_cfg)
+                efx->phy_mode = PHY_MODE_SPECIAL;
+
         /* Connect up MAC/PHY operations table */
         rc = efx->type->probe_port(efx);
         if (rc)
                 goto err;
 
-        if (phy_flash_cfg)
-                efx->phy_mode = PHY_MODE_SPECIAL;
-
         /* Sanity check MAC address */
         if (is_valid_ether_addr(efx->mac_address)) {
                 memcpy(efx->net_dev->dev_addr, efx->mac_address, ETH_ALEN);
@@ -2284,6 +2284,7 @@ static int __devinit efx_pci_probe(struct pci_dev *pci_dev,
  fail2:
         efx_fini_struct(efx);
  fail1:
+        WARN_ON(rc > 0);
         EFX_LOG(efx, "initialisation failed. rc=%d\n", rc);
         free_netdev(net_dev);
         return rc;
diff --git a/drivers/net/sfc/falcon.c b/drivers/net/sfc/falcon.c
index 17afcd26e870..9d009c46e962 100644
--- a/drivers/net/sfc/falcon.c
+++ b/drivers/net/sfc/falcon.c
@@ -925,6 +925,7 @@ static int falcon_probe_port(struct efx_nic *efx)
 
 static void falcon_remove_port(struct efx_nic *efx)
 {
+        efx->phy_op->remove(efx);
         efx_nic_free_buffer(efx, &efx->stats_buffer);
 }
 
diff --git a/drivers/net/sfc/falcon_boards.c b/drivers/net/sfc/falcon_boards.c
index bf0b96af5334..5712fddd72f2 100644
--- a/drivers/net/sfc/falcon_boards.c
+++ b/drivers/net/sfc/falcon_boards.c
@@ -29,6 +29,15 @@
 #define FALCON_BOARD_SFN4111T 0x51
 #define FALCON_BOARD_SFN4112F 0x52
 
+/* Board temperature is about 15°C above ambient when air flow is
+ * limited. */
+#define FALCON_BOARD_TEMP_BIAS  15
+
+/* SFC4000 datasheet says: 'The maximum permitted junction temperature
+ * is 125°C; the thermal design of the environment for the SFC4000
+ * should aim to keep this well below 100°C.' */
+#define FALCON_JUNC_TEMP_MAX    90
+
 /*****************************************************************************
  * Support for LM87 sensor chip used on several boards
  */
@@ -548,16 +557,16 @@ fail_hwmon:
 static u8 sfe4002_lm87_channel = 0x03; /* use AIN not FAN inputs */
 
 static const u8 sfe4002_lm87_regs[] = {
-        LM87_IN_LIMITS(0, 0x83, 0x91),          /* 2.5V:  1.8V +/- 5% */
-        LM87_IN_LIMITS(1, 0x51, 0x5a),          /* Vccp1: 1.2V +/- 5% */
-        LM87_IN_LIMITS(2, 0xb6, 0xca),          /* 3.3V:  3.3V +/- 5% */
-        LM87_IN_LIMITS(3, 0xb0, 0xc9),          /* 5V:    4.6-5.2V */
-        LM87_IN_LIMITS(4, 0xb0, 0xe0),          /* 12V:   11-14V */
-        LM87_IN_LIMITS(5, 0x44, 0x4b),          /* Vccp2: 1.0V +/- 5% */
-        LM87_AIN_LIMITS(0, 0xa0, 0xb2),         /* AIN1:  1.66V +/- 5% */
-        LM87_AIN_LIMITS(1, 0x91, 0xa1),         /* AIN2:  1.5V +/- 5% */
-        LM87_TEMP_INT_LIMITS(10, 60),           /* board */
-        LM87_TEMP_EXT1_LIMITS(10, 70),          /* Falcon */
+        LM87_IN_LIMITS(0, 0x7c, 0x99),          /* 2.5V:  1.8V +/- 10% */
+        LM87_IN_LIMITS(1, 0x4c, 0x5e),          /* Vccp1: 1.2V +/- 10% */
+        LM87_IN_LIMITS(2, 0xac, 0xd4),          /* 3.3V:  3.3V +/- 10% */
+        LM87_IN_LIMITS(3, 0xac, 0xd4),          /* 5V:    5.0V +/- 10% */
+        LM87_IN_LIMITS(4, 0xac, 0xe0),          /* 12V:   10.8-14V */
+        LM87_IN_LIMITS(5, 0x3f, 0x4f),          /* Vccp2: 1.0V +/- 10% */
+        LM87_AIN_LIMITS(0, 0x98, 0xbb),         /* AIN1:  1.66V +/- 10% */
+        LM87_AIN_LIMITS(1, 0x8a, 0xa9),         /* AIN2:  1.5V +/- 10% */
+        LM87_TEMP_INT_LIMITS(0, 80 + FALCON_BOARD_TEMP_BIAS),
+        LM87_TEMP_EXT1_LIMITS(0, FALCON_JUNC_TEMP_MAX),
         0
 };
 
@@ -619,14 +628,14 @@ static int sfe4002_init(struct efx_nic *efx)
 static u8 sfn4112f_lm87_channel = 0x03; /* use AIN not FAN inputs */
 
 static const u8 sfn4112f_lm87_regs[] = {
-        LM87_IN_LIMITS(0, 0x83, 0x91),          /* 2.5V:  1.8V +/- 5% */
-        LM87_IN_LIMITS(1, 0x51, 0x5a),          /* Vccp1: 1.2V +/- 5% */
-        LM87_IN_LIMITS(2, 0xb6, 0xca),          /* 3.3V:  3.3V +/- 5% */
-        LM87_IN_LIMITS(4, 0xb0, 0xe0),          /* 12V:   11-14V */
-        LM87_IN_LIMITS(5, 0x44, 0x4b),          /* Vccp2: 1.0V +/- 5% */
-        LM87_AIN_LIMITS(1, 0x91, 0xa1),         /* AIN2:  1.5V +/- 5% */
-        LM87_TEMP_INT_LIMITS(10, 60),           /* board */
-        LM87_TEMP_EXT1_LIMITS(10, 70),          /* Falcon */
+        LM87_IN_LIMITS(0, 0x7c, 0x99),          /* 2.5V:  1.8V +/- 10% */
+        LM87_IN_LIMITS(1, 0x4c, 0x5e),          /* Vccp1: 1.2V +/- 10% */
+        LM87_IN_LIMITS(2, 0xac, 0xd4),          /* 3.3V:  3.3V +/- 10% */
+        LM87_IN_LIMITS(4, 0xac, 0xe0),          /* 12V:   10.8-14V */
+        LM87_IN_LIMITS(5, 0x3f, 0x4f),          /* Vccp2: 1.0V +/- 10% */
+        LM87_AIN_LIMITS(1, 0x8a, 0xa9),         /* AIN2:  1.5V +/- 10% */
+        LM87_TEMP_INT_LIMITS(0, 60 + FALCON_BOARD_TEMP_BIAS),
+        LM87_TEMP_EXT1_LIMITS(0, FALCON_JUNC_TEMP_MAX),
         0
 };
 
diff --git a/drivers/net/sfc/falcon_xmac.c b/drivers/net/sfc/falcon_xmac.c
index 3da933f8f079..8ccab2c67a20 100644
--- a/drivers/net/sfc/falcon_xmac.c
+++ b/drivers/net/sfc/falcon_xmac.c
@@ -111,16 +111,12 @@ static void falcon_mask_status_intr(struct efx_nic *efx, bool enable)
         efx_writeo(efx, &reg, FR_AB_XM_MGT_INT_MASK);
 }
 
-/* Get status of XAUI link */
-static bool falcon_xaui_link_ok(struct efx_nic *efx)
+static bool falcon_xgxs_link_ok(struct efx_nic *efx)
 {
         efx_oword_t reg;
         bool align_done, link_ok = false;
         int sync_status;
 
-        if (LOOPBACK_INTERNAL(efx))
-                return true;
-
         /* Read link status */
         efx_reado(efx, &reg, FR_AB_XX_CORE_STAT);
 
@@ -135,14 +131,24 @@ static bool falcon_xaui_link_ok(struct efx_nic *efx)
         EFX_SET_OWORD_FIELD(reg, FRF_AB_XX_DISPERR, FFE_AB_XX_STAT_ALL_LANES);
         efx_writeo(efx, &reg, FR_AB_XX_CORE_STAT);
 
-        /* If the link is up, then check the phy side of the xaui link */
-        if (efx->link_state.up && link_ok)
-                if (efx->mdio.mmds & (1 << MDIO_MMD_PHYXS))
-                        link_ok = efx_mdio_phyxgxs_lane_sync(efx);
-
         return link_ok;
 }
 
+static bool falcon_xmac_link_ok(struct efx_nic *efx)
+{
+        /*
+         * Check MAC's XGXS link status except when using XGMII loopback
+         * which bypasses the XGXS block.
+         * If possible, check PHY's XGXS link status except when using
+         * MAC loopback.
+         */
+        return (efx->loopback_mode == LOOPBACK_XGMII ||
+                falcon_xgxs_link_ok(efx)) &&
+                (!(efx->mdio.mmds & (1 << MDIO_MMD_PHYXS)) ||
+                 LOOPBACK_INTERNAL(efx) || 
+                 efx_mdio_phyxgxs_lane_sync(efx));
+}
+
 void falcon_reconfigure_xmac_core(struct efx_nic *efx)
 {
         unsigned int max_frame_len;
@@ -245,9 +251,9 @@ static void falcon_reconfigure_xgxs_core(struct efx_nic *efx)
 
 
 /* Try to bring up the Falcon side of the Falcon-Phy XAUI link */
-static bool falcon_check_xaui_link_up(struct efx_nic *efx, int tries)
+static bool falcon_xmac_link_ok_retry(struct efx_nic *efx, int tries)
 {
-        bool mac_up = falcon_xaui_link_ok(efx);
+        bool mac_up = falcon_xmac_link_ok(efx);
 
         if (LOOPBACK_MASK(efx) & LOOPBACKS_EXTERNAL(efx) & LOOPBACKS_WS ||
             efx_phy_mode_disabled(efx->phy_mode))
@@ -261,7 +267,7 @@ static bool falcon_check_xaui_link_up(struct efx_nic *efx, int tries)
                 falcon_reset_xaui(efx);
                 udelay(200);
 
-                mac_up = falcon_xaui_link_ok(efx);
+                mac_up = falcon_xmac_link_ok(efx);
                 --tries;
         }
 
@@ -272,7 +278,7 @@ static bool falcon_check_xaui_link_up(struct efx_nic *efx, int tries)
 
 static bool falcon_xmac_check_fault(struct efx_nic *efx)
 {
-        return !falcon_check_xaui_link_up(efx, 5);
+        return !falcon_xmac_link_ok_retry(efx, 5);
 }
 
 static int falcon_reconfigure_xmac(struct efx_nic *efx)
@@ -284,7 +290,7 @@ static int falcon_reconfigure_xmac(struct efx_nic *efx)
 
         falcon_reconfigure_mac_wrapper(efx);
 
-        efx->xmac_poll_required = !falcon_check_xaui_link_up(efx, 5);
+        efx->xmac_poll_required = !falcon_xmac_link_ok_retry(efx, 5);
         falcon_mask_status_intr(efx, true);
 
         return 0;
@@ -357,7 +363,7 @@ void falcon_poll_xmac(struct efx_nic *efx)
                 return;
 
         falcon_mask_status_intr(efx, false);
-        efx->xmac_poll_required = !falcon_check_xaui_link_up(efx, 1);
+        efx->xmac_poll_required = !falcon_xmac_link_ok_retry(efx, 1);
         falcon_mask_status_intr(efx, true);
 }
 
diff --git a/drivers/net/sfc/mcdi.c b/drivers/net/sfc/mcdi.c
index 683353b904c7..f66b3da6ddff 100644
--- a/drivers/net/sfc/mcdi.c
+++ b/drivers/net/sfc/mcdi.c
@@ -127,7 +127,7 @@ static int efx_mcdi_poll(struct efx_nic *efx)
         efx_dword_t reg;
 
         /* Check for a reboot atomically with respect to efx_mcdi_copyout() */
-        rc = efx_mcdi_poll_reboot(efx);
+        rc = -efx_mcdi_poll_reboot(efx);
         if (rc)
                 goto out;
 
@@ -142,8 +142,9 @@ static int efx_mcdi_poll(struct efx_nic *efx)
                 if (spins != 0) {
                         --spins;
                         udelay(1);
-                } else
-                        schedule();
+                } else {
+                        schedule_timeout_uninterruptible(1);
+                }
 
                 time = get_seconds();
 
@@ -803,7 +804,7 @@ int efx_mcdi_nvram_read(struct efx_nic *efx, unsigned int type,
                         loff_t offset, u8 *buffer, size_t length)
 {
         u8 inbuf[MC_CMD_NVRAM_READ_IN_LEN];
-        u8 outbuf[MC_CMD_NVRAM_READ_OUT_LEN(length)];
+        u8 outbuf[MC_CMD_NVRAM_READ_OUT_LEN(EFX_MCDI_NVRAM_LEN_MAX)];
         size_t outlen;
         int rc;
 
@@ -827,7 +828,7 @@ fail:
 int efx_mcdi_nvram_write(struct efx_nic *efx, unsigned int type,
                            loff_t offset, const u8 *buffer, size_t length)
 {
-        u8 inbuf[MC_CMD_NVRAM_WRITE_IN_LEN(length)];
+        u8 inbuf[MC_CMD_NVRAM_WRITE_IN_LEN(EFX_MCDI_NVRAM_LEN_MAX)];
         int rc;
 
         MCDI_SET_DWORD(inbuf, NVRAM_WRITE_IN_TYPE, type);
@@ -837,7 +838,8 @@ int efx_mcdi_nvram_write(struct efx_nic *efx, unsigned int type,
 
         BUILD_BUG_ON(MC_CMD_NVRAM_WRITE_OUT_LEN != 0);
 
-        rc = efx_mcdi_rpc(efx, MC_CMD_NVRAM_WRITE, inbuf, sizeof(inbuf),
+        rc = efx_mcdi_rpc(efx, MC_CMD_NVRAM_WRITE, inbuf,
+                          ALIGN(MC_CMD_NVRAM_WRITE_IN_LEN(length), 4),
                           NULL, 0, NULL);
         if (rc)
                 goto fail;
diff --git a/drivers/net/sfc/mcdi.h b/drivers/net/sfc/mcdi.h
index de916728c2e3..10ce98f4c0fb 100644
--- a/drivers/net/sfc/mcdi.h
+++ b/drivers/net/sfc/mcdi.h
@@ -111,6 +111,7 @@ extern int efx_mcdi_nvram_read(struct efx_nic *efx, unsigned int type,
 extern int efx_mcdi_nvram_write(struct efx_nic *efx, unsigned int type,
                                 loff_t offset, const u8 *buffer,
                                 size_t length);
+#define EFX_MCDI_NVRAM_LEN_MAX 128
 extern int efx_mcdi_nvram_erase(struct efx_nic *efx, unsigned int type,
                                 loff_t offset, size_t length);
 extern int efx_mcdi_nvram_update_finish(struct efx_nic *efx,
diff --git a/drivers/net/sfc/mcdi_pcol.h b/drivers/net/sfc/mcdi_pcol.h
index 2a85360a46f0..73e71f420624 100644
--- a/drivers/net/sfc/mcdi_pcol.h
+++ b/drivers/net/sfc/mcdi_pcol.h
@@ -1090,8 +1090,10 @@
 #define MC_CMD_MAC_RX_LANES01_DISP_ERR 57
 #define MC_CMD_MAC_RX_LANES23_DISP_ERR 58
 #define MC_CMD_MAC_RX_MATCH_FAULT 59
+#define MC_CMD_GMAC_DMABUF_START 64
+#define MC_CMD_GMAC_DMABUF_END   95
 /* Insert new members here. */
-#define MC_CMD_MAC_GENERATION_END 60
+#define MC_CMD_MAC_GENERATION_END 96
 #define MC_CMD_MAC_NSTATS (MC_CMD_MAC_GENERATION_END+1)
 
 /* MC_CMD_MAC_STATS:
diff --git a/drivers/net/sfc/mcdi_phy.c b/drivers/net/sfc/mcdi_phy.c
index 0e1bcc5a0d52..eb694af7a473 100644
--- a/drivers/net/sfc/mcdi_phy.c
+++ b/drivers/net/sfc/mcdi_phy.c
@@ -304,31 +304,47 @@ static u32 mcdi_to_ethtool_media(u32 media)
 
 static int efx_mcdi_phy_probe(struct efx_nic *efx)
 {
-        struct efx_mcdi_phy_cfg *phy_cfg;
+        struct efx_mcdi_phy_cfg *phy_data;
+        u8 outbuf[MC_CMD_GET_LINK_OUT_LEN];
+        u32 caps;
         int rc;
 
-        /* TODO: Move phy_data initialisation to
-         * phy_op->probe/remove, rather than init/fini */
-        phy_cfg = kzalloc(sizeof(*phy_cfg), GFP_KERNEL);
-        if (phy_cfg == NULL) {
-                rc = -ENOMEM;
-                goto fail_alloc;
-        }
-        rc = efx_mcdi_get_phy_cfg(efx, phy_cfg);
+        /* Initialise and populate phy_data */
+        phy_data = kzalloc(sizeof(*phy_data), GFP_KERNEL);
+        if (phy_data == NULL)
+                return -ENOMEM;
+
+        rc = efx_mcdi_get_phy_cfg(efx, phy_data);
         if (rc != 0)
                 goto fail;
 
-        efx->phy_type = phy_cfg->type;
+        /* Read initial link advertisement */
+        BUILD_BUG_ON(MC_CMD_GET_LINK_IN_LEN != 0);
+        rc = efx_mcdi_rpc(efx, MC_CMD_GET_LINK, NULL, 0,
+                          outbuf, sizeof(outbuf), NULL);
+        if (rc)
+                goto fail;
+
+        /* Fill out nic state */
+        efx->phy_data = phy_data;
+        efx->phy_type = phy_data->type;
 
-        efx->mdio_bus = phy_cfg->channel;
-        efx->mdio.prtad = phy_cfg->port;
-        efx->mdio.mmds = phy_cfg->mmd_mask & ~(1 << MC_CMD_MMD_CLAUSE22);
+        efx->mdio_bus = phy_data->channel;
+        efx->mdio.prtad = phy_data->port;
+        efx->mdio.mmds = phy_data->mmd_mask & ~(1 << MC_CMD_MMD_CLAUSE22);
         efx->mdio.mode_support = 0;
-        if (phy_cfg->mmd_mask & (1 << MC_CMD_MMD_CLAUSE22))
+        if (phy_data->mmd_mask & (1 << MC_CMD_MMD_CLAUSE22))
                 efx->mdio.mode_support |= MDIO_SUPPORTS_C22;
-        if (phy_cfg->mmd_mask & ~(1 << MC_CMD_MMD_CLAUSE22))
+        if (phy_data->mmd_mask & ~(1 << MC_CMD_MMD_CLAUSE22))
                 efx->mdio.mode_support |= MDIO_SUPPORTS_C45 | MDIO_EMULATE_C22;
 
+        caps = MCDI_DWORD(outbuf, GET_LINK_OUT_CAP);
+        if (caps & (1 << MC_CMD_PHY_CAP_AN_LBN))
+                efx->link_advertising =
+                        mcdi_to_ethtool_cap(phy_data->media, caps);
+        else
+                phy_data->forced_cap = caps;
+
         /* Assert that we can map efx -> mcdi loopback modes */
         BUILD_BUG_ON(LOOPBACK_NONE != MC_CMD_LOOPBACK_NONE);
         BUILD_BUG_ON(LOOPBACK_DATA != MC_CMD_LOOPBACK_DATA);
@@ -365,46 +381,6 @@ static int efx_mcdi_phy_probe(struct efx_nic *efx)
          * but by convention we don't */
         efx->loopback_modes &= ~(1 << LOOPBACK_NONE);
 
-        kfree(phy_cfg);
-
-        return 0;
-
-fail:
-        kfree(phy_cfg);
-fail_alloc:
-        return rc;
-}
-
-static int efx_mcdi_phy_init(struct efx_nic *efx)
-{
-        struct efx_mcdi_phy_cfg *phy_data;
-        u8 outbuf[MC_CMD_GET_LINK_OUT_LEN];
-        u32 caps;
-        int rc;
-
-        phy_data = kzalloc(sizeof(*phy_data), GFP_KERNEL);
-        if (phy_data == NULL)
-                return -ENOMEM;
-
-        rc = efx_mcdi_get_phy_cfg(efx, phy_data);
-        if (rc != 0)
-                goto fail;
-
-        efx->phy_data = phy_data;
-
-        BUILD_BUG_ON(MC_CMD_GET_LINK_IN_LEN != 0);
-        rc = efx_mcdi_rpc(efx, MC_CMD_GET_LINK, NULL, 0,
-                          outbuf, sizeof(outbuf), NULL);
-        if (rc)
-                goto fail;
-
-        caps = MCDI_DWORD(outbuf, GET_LINK_OUT_CAP);
-        if (caps & (1 << MC_CMD_PHY_CAP_AN_LBN))
-                efx->link_advertising =
-                        mcdi_to_ethtool_cap(phy_data->media, caps);
-        else
-                phy_data->forced_cap = caps;
-
         return 0;
 
 fail:
@@ -504,7 +480,7 @@ static bool efx_mcdi_phy_poll(struct efx_nic *efx)
         return !efx_link_state_equal(&efx->link_state, &old_state);
 }
 
-static void efx_mcdi_phy_fini(struct efx_nic *efx)
+static void efx_mcdi_phy_remove(struct efx_nic *efx)
 {
         struct efx_mcdi_phy_data *phy_data = efx->phy_data;
 
@@ -586,10 +562,11 @@ static int efx_mcdi_phy_set_settings(struct efx_nic *efx, struct ethtool_cmd *ec
 
 struct efx_phy_operations efx_mcdi_phy_ops = {
         .probe          = efx_mcdi_phy_probe,
-        .init           = efx_mcdi_phy_init,
+        .init           = efx_port_dummy_op_int,
         .reconfigure    = efx_mcdi_phy_reconfigure,
         .poll           = efx_mcdi_phy_poll,
-        .fini           = efx_mcdi_phy_fini,
+        .fini           = efx_port_dummy_op_void,
+        .remove         = efx_mcdi_phy_remove,
         .get_settings   = efx_mcdi_phy_get_settings,
         .set_settings   = efx_mcdi_phy_set_settings,
         .run_tests      = NULL,
diff --git a/drivers/net/sfc/mtd.c b/drivers/net/sfc/mtd.c
index 3a464529a46b..407bbaddfea6 100644
--- a/drivers/net/sfc/mtd.c
+++ b/drivers/net/sfc/mtd.c
@@ -23,7 +23,6 @@
 #include "mcdi_pcol.h"
 
 #define EFX_SPI_VERIFY_BUF_LEN 16
-#define EFX_MCDI_CHUNK_LEN 128
 
 struct efx_mtd_partition {
         struct mtd_info mtd;
@@ -428,7 +427,7 @@ static int siena_mtd_read(struct mtd_info *mtd, loff_t start,
         int rc = 0;
 
         while (offset < end) {
-                chunk = min_t(size_t, end - offset, EFX_MCDI_CHUNK_LEN);
+                chunk = min_t(size_t, end - offset, EFX_MCDI_NVRAM_LEN_MAX);
                 rc = efx_mcdi_nvram_read(efx, part->mcdi.nvram_type, offset,
                                          buffer, chunk);
                 if (rc)
@@ -491,7 +490,7 @@ static int siena_mtd_write(struct mtd_info *mtd, loff_t start,
         }
 
         while (offset < end) {
-                chunk = min_t(size_t, end - offset, EFX_MCDI_CHUNK_LEN);
+                chunk = min_t(size_t, end - offset, EFX_MCDI_NVRAM_LEN_MAX);
                 rc = efx_mcdi_nvram_write(efx, part->mcdi.nvram_type, offset,
                                           buffer, chunk);
                 if (rc)
diff --git a/drivers/net/sfc/net_driver.h b/drivers/net/sfc/net_driver.h
index 34c381f009b7..d5aab5b3fa06 100644
--- a/drivers/net/sfc/net_driver.h
+++ b/drivers/net/sfc/net_driver.h
@@ -524,6 +524,7 @@ struct efx_phy_operations {
         int (*probe) (struct efx_nic *efx);
         int (*init) (struct efx_nic *efx);
         void (*fini) (struct efx_nic *efx);
+        void (*remove) (struct efx_nic *efx);
         int (*reconfigure) (struct efx_nic *efx);
         bool (*poll) (struct efx_nic *efx);
         void (*get_settings) (struct efx_nic *efx,
diff --git a/drivers/net/sfc/nic.c b/drivers/net/sfc/nic.c
index a577be227862..db44224ed2ca 100644
--- a/drivers/net/sfc/nic.c
+++ b/drivers/net/sfc/nic.c
@@ -1576,6 +1576,8 @@ void efx_nic_init_common(struct efx_nic *efx)
         EFX_SET_OWORD_FIELD(temp, FRF_AZ_TX_SOFT_EVT_EN, 1);
         /* Prefetch threshold 2 => fetch when descriptor cache half empty */
         EFX_SET_OWORD_FIELD(temp, FRF_AZ_TX_PREF_THRESHOLD, 2);
+        /* Disable hardware watchdog which can misfire */
+        EFX_SET_OWORD_FIELD(temp, FRF_AZ_TX_PREF_WD_TMR, 0x3fffff);
         /* Squash TX of packets of 16 bytes or less */
         if (efx_nic_rev(efx) >= EFX_REV_FALCON_B0)
                 EFX_SET_OWORD_FIELD(temp, FRF_BZ_TX_FLUSH_MIN_LEN_EN, 1);
diff --git a/drivers/net/sfc/qt202x_phy.c b/drivers/net/sfc/qt202x_phy.c
index 3800fc791b2f..67eec7a6e487 100644
--- a/drivers/net/sfc/qt202x_phy.c
+++ b/drivers/net/sfc/qt202x_phy.c
@@ -33,6 +33,9 @@
 #define PCS_FW_HEARTBEAT_REG    0xd7ee
 #define PCS_FW_HEARTB_LBN       0
 #define PCS_FW_HEARTB_WIDTH     8
+#define PCS_FW_PRODUCT_CODE_1   0xd7f0
+#define PCS_FW_VERSION_1        0xd7f3
+#define PCS_FW_BUILD_1          0xd7f6
 #define PCS_UC8051_STATUS_REG   0xd7fd
 #define PCS_UC_STATUS_LBN       0
 #define PCS_UC_STATUS_WIDTH     8
@@ -52,14 +55,24 @@ void falcon_qt202x_set_led(struct efx_nic *p, int led, int mode)
 
 struct qt202x_phy_data {
         enum efx_phy_mode phy_mode;
+        bool bug17190_in_bad_state;
+        unsigned long bug17190_timer;
+        u32 firmware_ver;
 };
 
 #define QT2022C2_MAX_RESET_TIME 500
 #define QT2022C2_RESET_WAIT 10
 
-static int qt2025c_wait_reset(struct efx_nic *efx)
+#define QT2025C_MAX_HEARTB_TIME (5 * HZ)
+#define QT2025C_HEARTB_WAIT 100
+#define QT2025C_MAX_FWSTART_TIME (25 * HZ / 10)
+#define QT2025C_FWSTART_WAIT 100
+
+#define BUG17190_INTERVAL (2 * HZ)
+
+static int qt2025c_wait_heartbeat(struct efx_nic *efx)
 {
-        unsigned long timeout = jiffies + 10 * HZ;
+        unsigned long timeout = jiffies + QT2025C_MAX_HEARTB_TIME;
         int reg, old_counter = 0;
 
         /* Wait for firmware heartbeat to start */
@@ -74,11 +87,25 @@ static int qt2025c_wait_reset(struct efx_nic *efx)
                         old_counter = counter;
                 else if (counter != old_counter)
                         break;
-                if (time_after(jiffies, timeout))
+                if (time_after(jiffies, timeout)) {
+                        /* Some cables have EEPROMs that conflict with the
+                         * PHY's on-board EEPROM so it cannot load firmware */
+                        EFX_ERR(efx, "If an SFP+ direct attach cable is"
+                                " connected, please check that it complies"
+                                " with the SFP+ specification\n");
                         return -ETIMEDOUT;
-                msleep(10);
+                }
+                msleep(QT2025C_HEARTB_WAIT);
         }
 
+        return 0;
+}
+
+static int qt2025c_wait_fw_status_good(struct efx_nic *efx)
+{
+        unsigned long timeout = jiffies + QT2025C_MAX_FWSTART_TIME;
+        int reg;
+
         /* Wait for firmware status to look good */
         for (;;) {
                 reg = efx_mdio_read(efx, MDIO_MMD_PCS, PCS_UC8051_STATUS_REG);
@@ -90,7 +117,178 @@ static int qt2025c_wait_reset(struct efx_nic *efx)
                         break;
                 if (time_after(jiffies, timeout))
                         return -ETIMEDOUT;
+                msleep(QT2025C_FWSTART_WAIT);
+        }
+
+        return 0;
+}
+
+static void qt2025c_restart_firmware(struct efx_nic *efx)
+{
+        /* Restart microcontroller execution of firmware from RAM */
+        efx_mdio_write(efx, 3, 0xe854, 0x00c0);
+        efx_mdio_write(efx, 3, 0xe854, 0x0040);
+        msleep(50);
+}
+
+static int qt2025c_wait_reset(struct efx_nic *efx)
+{
+        int rc;
+
+        rc = qt2025c_wait_heartbeat(efx);
+        if (rc != 0)
+                return rc;
+
+        rc = qt2025c_wait_fw_status_good(efx);
+        if (rc == -ETIMEDOUT) {
+                /* Bug 17689: occasionally heartbeat starts but firmware status
+                 * code never progresses beyond 0x00.  Try again, once, after
+                 * restarting execution of the firmware image. */
+                EFX_LOG(efx, "bashing QT2025C microcontroller\n");
+                qt2025c_restart_firmware(efx);
+                rc = qt2025c_wait_heartbeat(efx);
+                if (rc != 0)
+                        return rc;
+                rc = qt2025c_wait_fw_status_good(efx);
+        }
+
+        return rc;
+}
+
+static void qt2025c_firmware_id(struct efx_nic *efx)
+{
+        struct qt202x_phy_data *phy_data = efx->phy_data;
+        u8 firmware_id[9];
+        size_t i;
+
+        for (i = 0; i < sizeof(firmware_id); i++)
+                firmware_id[i] = efx_mdio_read(efx, MDIO_MMD_PCS,
+                                               PCS_FW_PRODUCT_CODE_1 + i);
+        EFX_INFO(efx, "QT2025C firmware %xr%d v%d.%d.%d.%d [20%02d-%02d-%02d]\n",
+                 (firmware_id[0] << 8) | firmware_id[1], firmware_id[2],
+                 firmware_id[3] >> 4, firmware_id[3] & 0xf,
+                 firmware_id[4], firmware_id[5],
+                 firmware_id[6], firmware_id[7], firmware_id[8]);
+        phy_data->firmware_ver = ((firmware_id[3] & 0xf0) << 20) |
+                                 ((firmware_id[3] & 0x0f) << 16) |
+                                 (firmware_id[4] << 8) | firmware_id[5];
+}
+
+static void qt2025c_bug17190_workaround(struct efx_nic *efx)
+{
+        struct qt202x_phy_data *phy_data = efx->phy_data;
+
+        /* The PHY can get stuck in a state where it reports PHY_XS and PMA/PMD
+         * layers up, but PCS down (no block_lock).  If we notice this state
+         * persisting for a couple of seconds, we switch PMA/PMD loopback
+         * briefly on and then off again, which is normally sufficient to
+         * recover it.
+         */
+        if (efx->link_state.up ||
+            !efx_mdio_links_ok(efx, MDIO_DEVS_PMAPMD | MDIO_DEVS_PHYXS)) {
+                phy_data->bug17190_in_bad_state = false;
+                return;
+        }
+
+        if (!phy_data->bug17190_in_bad_state) {
+                phy_data->bug17190_in_bad_state = true;
+                phy_data->bug17190_timer = jiffies + BUG17190_INTERVAL;
+                return;
+        }
+
+        if (time_after_eq(jiffies, phy_data->bug17190_timer)) {
+                EFX_LOG(efx, "bashing QT2025C PMA/PMD\n");
+                efx_mdio_set_flag(efx, MDIO_MMD_PMAPMD, MDIO_CTRL1,
+                                  MDIO_PMA_CTRL1_LOOPBACK, true);
                 msleep(100);
+                efx_mdio_set_flag(efx, MDIO_MMD_PMAPMD, MDIO_CTRL1,
+                                  MDIO_PMA_CTRL1_LOOPBACK, false);
+                phy_data->bug17190_timer = jiffies + BUG17190_INTERVAL;
+        }
+}
+
+static int qt2025c_select_phy_mode(struct efx_nic *efx)
+{
+        struct qt202x_phy_data *phy_data = efx->phy_data;
+        struct falcon_board *board = falcon_board(efx);
+        int reg, rc, i;
+        uint16_t phy_op_mode;
+
+        /* Only 2.0.1.0+ PHY firmware supports the more optimal SFP+
+         * Self-Configure mode.  Don't attempt any switching if we encounter
+         * older firmware. */
+        if (phy_data->firmware_ver < 0x02000100)
+                return 0;
+
+        /* In general we will get optimal behaviour in "SFP+ Self-Configure"
+         * mode; however, that powers down most of the PHY when no module is
+         * present, so we must use a different mode (any fixed mode will do)
+         * to be sure that loopbacks will work. */
+        phy_op_mode = (efx->loopback_mode == LOOPBACK_NONE) ? 0x0038 : 0x0020;
+
+        /* Only change mode if really necessary */
+        reg = efx_mdio_read(efx, 1, 0xc319);
+        if ((reg & 0x0038) == phy_op_mode)
+                return 0;
+        EFX_LOG(efx, "Switching PHY to mode 0x%04x\n", phy_op_mode);
+
+        /* This sequence replicates the register writes configured in the boot
+         * EEPROM (including the differences between board revisions), except
+         * that the operating mode is changed, and the PHY is prevented from
+         * unnecessarily reloading the main firmware image again. */
+        efx_mdio_write(efx, 1, 0xc300, 0x0000);
+        /* (Note: this portion of the boot EEPROM sequence, which bit-bashes 9
+         * STOPs onto the firmware/module I2C bus to reset it, varies across
+         * board revisions, as the bus is connected to different GPIO/LED
+         * outputs on the PHY.) */
+        if (board->major == 0 && board->minor < 2) {
+                efx_mdio_write(efx, 1, 0xc303, 0x4498);
+                for (i = 0; i < 9; i++) {
+                        efx_mdio_write(efx, 1, 0xc303, 0x4488);
+                        efx_mdio_write(efx, 1, 0xc303, 0x4480);
+                        efx_mdio_write(efx, 1, 0xc303, 0x4490);
+                        efx_mdio_write(efx, 1, 0xc303, 0x4498);
+                }
+        } else {
+                efx_mdio_write(efx, 1, 0xc303, 0x0920);
+                efx_mdio_write(efx, 1, 0xd008, 0x0004);
+                for (i = 0; i < 9; i++) {
+                        efx_mdio_write(efx, 1, 0xc303, 0x0900);
+                        efx_mdio_write(efx, 1, 0xd008, 0x0005);
+                        efx_mdio_write(efx, 1, 0xc303, 0x0920);
+                        efx_mdio_write(efx, 1, 0xd008, 0x0004);
+                }
+                efx_mdio_write(efx, 1, 0xc303, 0x4900);
+        }
+        efx_mdio_write(efx, 1, 0xc303, 0x4900);
+        efx_mdio_write(efx, 1, 0xc302, 0x0004);
+        efx_mdio_write(efx, 1, 0xc316, 0x0013);
+        efx_mdio_write(efx, 1, 0xc318, 0x0054);
+        efx_mdio_write(efx, 1, 0xc319, phy_op_mode);
+        efx_mdio_write(efx, 1, 0xc31a, 0x0098);
+        efx_mdio_write(efx, 3, 0x0026, 0x0e00);
+        efx_mdio_write(efx, 3, 0x0027, 0x0013);
+        efx_mdio_write(efx, 3, 0x0028, 0xa528);
+        efx_mdio_write(efx, 1, 0xd006, 0x000a);
+        efx_mdio_write(efx, 1, 0xd007, 0x0009);
+        efx_mdio_write(efx, 1, 0xd008, 0x0004);
+        /* This additional write is not present in the boot EEPROM.  It
+         * prevents the PHY's internal boot ROM doing another pointless (and
+         * slow) reload of the firmware image (the microcontroller's code
+         * memory is not affected by the microcontroller reset). */
+        efx_mdio_write(efx, 1, 0xc317, 0x00ff);
+        efx_mdio_write(efx, 1, 0xc300, 0x0002);
+        msleep(20);
+
+        /* Restart microcontroller execution of firmware from RAM */
+        qt2025c_restart_firmware(efx);
+
+        /* Wait for the microcontroller to be ready again */
+        rc = qt2025c_wait_reset(efx);
+        if (rc < 0) {
+                EFX_ERR(efx, "PHY microcontroller reset during mode switch "
+                                "timed out\n");
+                return rc;
         }
 
         return 0;
@@ -120,15 +318,9 @@ static int qt202x_reset_phy(struct efx_nic *efx)
         /* Wait 250ms for the PHY to complete bootup */
         msleep(250);
 
-        /* Check that all the MMDs we expect are present and responding. We
-         * expect faults on some if the link is down, but not on the PHY XS */
-        rc = efx_mdio_check_mmds(efx, QT202X_REQUIRED_DEVS, MDIO_DEVS_PHYXS);
-        if (rc < 0)
-                goto fail;
-
         falcon_board(efx)->type->init_phy(efx);
 
-        return rc;
+        return 0;
 
  fail:
         EFX_ERR(efx, "PHY reset timed out\n");
@@ -137,6 +329,16 @@ static int qt202x_reset_phy(struct efx_nic *efx)
 
 static int qt202x_phy_probe(struct efx_nic *efx)
 {
+        struct qt202x_phy_data *phy_data;
+
+        phy_data = kzalloc(sizeof(struct qt202x_phy_data), GFP_KERNEL);
+        if (!phy_data)
+                return -ENOMEM;
+        efx->phy_data = phy_data;
+        phy_data->phy_mode = efx->phy_mode;
+        phy_data->bug17190_in_bad_state = false;
+        phy_data->bug17190_timer = 0;
+
         efx->mdio.mmds = QT202X_REQUIRED_DEVS;
         efx->mdio.mode_support = MDIO_SUPPORTS_C45 | MDIO_EMULATE_C22;
         efx->loopback_modes = QT202X_LOOPBACKS | FALCON_XMAC_LOOPBACKS;
@@ -145,7 +347,6 @@ static int qt202x_phy_probe(struct efx_nic *efx)
 
 static int qt202x_phy_init(struct efx_nic *efx)
 {
-        struct qt202x_phy_data *phy_data;
         u32 devid;
         int rc;
 
@@ -155,17 +356,14 @@ static int qt202x_phy_init(struct efx_nic *efx)
                 return rc;
         }
 
-        phy_data = kzalloc(sizeof(struct qt202x_phy_data), GFP_KERNEL);
-        if (!phy_data)
-                return -ENOMEM;
-        efx->phy_data = phy_data;
-
         devid = efx_mdio_read_id(efx, MDIO_MMD_PHYXS);
         EFX_INFO(efx, "PHY ID reg %x (OUI %06x model %02x revision %x)\n",
                  devid, efx_mdio_id_oui(devid), efx_mdio_id_model(devid),
                  efx_mdio_id_rev(devid));
 
-        phy_data->phy_mode = efx->phy_mode;
+        if (efx->phy_type == PHY_TYPE_QT2025C)
+                qt2025c_firmware_id(efx);
+
         return 0;
 }
 
@@ -183,6 +381,9 @@ static bool qt202x_phy_poll(struct efx_nic *efx)
         efx->link_state.fd = true;
         efx->link_state.fc = efx->wanted_fc;
 
+        if (efx->phy_type == PHY_TYPE_QT2025C)
+                qt2025c_bug17190_workaround(efx);
+
         return efx->link_state.up != was_up;
 }
 
@@ -191,6 +392,10 @@ static int qt202x_phy_reconfigure(struct efx_nic *efx)
         struct qt202x_phy_data *phy_data = efx->phy_data;
 
         if (efx->phy_type == PHY_TYPE_QT2025C) {
+                int rc = qt2025c_select_phy_mode(efx);
+                if (rc)
+                        return rc;
+
                 /* There are several different register bits which can
                  * disable TX (and save power) on direct-attach cables
                  * or optical transceivers, varying somewhat between
@@ -224,7 +429,7 @@ static void qt202x_phy_get_settings(struct efx_nic *efx, struct ethtool_cmd *ecm
         mdio45_ethtool_gset(&efx->mdio, ecmd);
 }
 
-static void qt202x_phy_fini(struct efx_nic *efx)
+static void qt202x_phy_remove(struct efx_nic *efx)
 {
         /* Free the context block */
         kfree(efx->phy_data);
@@ -236,7 +441,8 @@ struct efx_phy_operations falcon_qt202x_phy_ops = {
         .init            = qt202x_phy_init,
         .reconfigure     = qt202x_phy_reconfigure,
         .poll            = qt202x_phy_poll,
-        .fini            = qt202x_phy_fini,
+        .fini            = efx_port_dummy_op_void,
+        .remove          = qt202x_phy_remove,
         .get_settings    = qt202x_phy_get_settings,
         .set_settings    = efx_mdio_set_settings,
 };
diff --git a/drivers/net/sfc/selftest.c b/drivers/net/sfc/selftest.c
index af3933579790..250c8827b842 100644
--- a/drivers/net/sfc/selftest.c
+++ b/drivers/net/sfc/selftest.c
@@ -79,10 +79,14 @@ struct efx_loopback_state {
 static int efx_test_mdio(struct efx_nic *efx, struct efx_self_tests *tests)
 {
         int rc = 0;
-        int devad = __ffs(efx->mdio.mmds);
+        int devad;
         u16 physid1, physid2;
 
-        if (efx->phy_type == PHY_TYPE_NONE)
+        if (efx->mdio.mode_support & MDIO_SUPPORTS_C45)
+                devad = __ffs(efx->mdio.mmds);
+        else if (efx->mdio.mode_support & MDIO_SUPPORTS_C22)
+                devad = MDIO_DEVAD_NONE;
+        else
                 return 0;
 
         mutex_lock(&efx->mac_lock);
diff --git a/drivers/net/sfc/siena.c b/drivers/net/sfc/siena.c
index de07a4f031b2..f8c6771e66d8 100644
--- a/drivers/net/sfc/siena.c
+++ b/drivers/net/sfc/siena.c
@@ -133,6 +133,7 @@ static int siena_probe_port(struct efx_nic *efx)
 
 void siena_remove_port(struct efx_nic *efx)
 {
+        efx->phy_op->remove(efx);
         efx_nic_free_buffer(efx, &efx->stats_buffer);
 }
 
diff --git a/drivers/net/sfc/tenxpress.c b/drivers/net/sfc/tenxpress.c
index ca11572a49a9..3009c297c135 100644
--- a/drivers/net/sfc/tenxpress.c
+++ b/drivers/net/sfc/tenxpress.c
@@ -202,10 +202,14 @@ static ssize_t set_phy_short_reach(struct device *dev,
         int rc;
 
         rtnl_lock();
-        efx_mdio_set_flag(efx, MDIO_MMD_PMAPMD, MDIO_PMA_10GBT_TXPWR,
-                          MDIO_PMA_10GBT_TXPWR_SHORT,
-                          count != 0 && *buf != '0');
-        rc = efx_reconfigure_port(efx);
+        if (efx->state != STATE_RUNNING) {
+                rc = -EBUSY;
+        } else {
+                efx_mdio_set_flag(efx, MDIO_MMD_PMAPMD, MDIO_PMA_10GBT_TXPWR,
+                                  MDIO_PMA_10GBT_TXPWR_SHORT,
+                                  count != 0 && *buf != '0');
+                rc = efx_reconfigure_port(efx);
+        }
         rtnl_unlock();
 
         return rc < 0 ? rc : (ssize_t)count;
@@ -298,36 +302,62 @@ static int tenxpress_init(struct efx_nic *efx)
         return 0;
 }
 
-static int sfx7101_phy_probe(struct efx_nic *efx)
+static int tenxpress_phy_probe(struct efx_nic *efx)
 {
-        efx->mdio.mmds = TENXPRESS_REQUIRED_DEVS;
-        efx->mdio.mode_support = MDIO_SUPPORTS_C45 | MDIO_EMULATE_C22;
-        efx->loopback_modes = SFX7101_LOOPBACKS | FALCON_XMAC_LOOPBACKS;
-        return 0;
-}
+        struct tenxpress_phy_data *phy_data;
+        int rc;
+
+        /* Allocate phy private storage */
+        phy_data = kzalloc(sizeof(*phy_data), GFP_KERNEL);
+        if (!phy_data)
+                return -ENOMEM;
+        efx->phy_data = phy_data;
+        phy_data->phy_mode = efx->phy_mode;
+
+        /* Create any special files */
+        if (efx->phy_type == PHY_TYPE_SFT9001B) {
+                rc = device_create_file(&efx->pci_dev->dev,
+                                        &dev_attr_phy_short_reach);
+                if (rc)
+                        goto fail;
+        }
+
+        if (efx->phy_type == PHY_TYPE_SFX7101) {
+                efx->mdio.mmds = TENXPRESS_REQUIRED_DEVS;
+                efx->mdio.mode_support = MDIO_SUPPORTS_C45;
+
+                efx->loopback_modes = SFX7101_LOOPBACKS | FALCON_XMAC_LOOPBACKS;
+
+                efx->link_advertising = (ADVERTISED_TP | ADVERTISED_Autoneg |
+                                         ADVERTISED_10000baseT_Full);
+        } else {
+                efx->mdio.mmds = TENXPRESS_REQUIRED_DEVS;
+                efx->mdio.mode_support = MDIO_SUPPORTS_C45 | MDIO_EMULATE_C22;
+
+                efx->loopback_modes = (SFT9001_LOOPBACKS |
+                                       FALCON_XMAC_LOOPBACKS | 
+                                       FALCON_GMAC_LOOPBACKS);
+
+                efx->link_advertising = (ADVERTISED_TP | ADVERTISED_Autoneg |
+                                         ADVERTISED_10000baseT_Full |
+                                         ADVERTISED_1000baseT_Full |
+                                         ADVERTISED_100baseT_Full);
+        }
 
-static int sft9001_phy_probe(struct efx_nic *efx)
-{
-        efx->mdio.mmds = TENXPRESS_REQUIRED_DEVS;
-        efx->mdio.mode_support = MDIO_SUPPORTS_C45 | MDIO_EMULATE_C22;
-        efx->loopback_modes = (SFT9001_LOOPBACKS | FALCON_XMAC_LOOPBACKS |
-                               FALCON_GMAC_LOOPBACKS);
         return 0;
+
+fail:
+        kfree(efx->phy_data);
+        efx->phy_data = NULL;
+        return rc;
 }
 
 static int tenxpress_phy_init(struct efx_nic *efx)
 {
-        struct tenxpress_phy_data *phy_data;
-        int rc = 0;
+        int rc;
 
         falcon_board(efx)->type->init_phy(efx);
 
-        phy_data = kzalloc(sizeof(*phy_data), GFP_KERNEL);
-        if (!phy_data)
-                return -ENOMEM;
-        efx->phy_data = phy_data;
-        phy_data->phy_mode = efx->phy_mode;
-
         if (!(efx->phy_mode & PHY_MODE_SPECIAL)) {
                 if (efx->phy_type == PHY_TYPE_SFT9001A) {
                         int reg;
@@ -341,44 +371,27 @@ static int tenxpress_phy_init(struct efx_nic *efx)
 
                 rc = efx_mdio_wait_reset_mmds(efx, TENXPRESS_REQUIRED_DEVS);
                 if (rc < 0)
-                        goto fail;
+                        return rc;
 
                 rc = efx_mdio_check_mmds(efx, TENXPRESS_REQUIRED_DEVS, 0);
                 if (rc < 0)
-                        goto fail;
+                        return rc;
         }
 
         rc = tenxpress_init(efx);
         if (rc < 0)
-                goto fail;
+                return rc;
 
-        /* Initialise advertising flags */
-        efx->link_advertising = (ADVERTISED_TP | ADVERTISED_Autoneg |
-                                  ADVERTISED_10000baseT_Full);
-        if (efx->phy_type != PHY_TYPE_SFX7101)
-                efx->link_advertising |= (ADVERTISED_1000baseT_Full |
-                                           ADVERTISED_100baseT_Full);
+        /* Reinitialise flow control settings */
         efx_link_set_wanted_fc(efx, efx->wanted_fc);
         efx_mdio_an_reconfigure(efx);
 
-        if (efx->phy_type == PHY_TYPE_SFT9001B) {
-                rc = device_create_file(&efx->pci_dev->dev,
-                                        &dev_attr_phy_short_reach);
-                if (rc)
-                        goto fail;
-        }
-
         schedule_timeout_uninterruptible(HZ / 5); /* 200ms */
 
         /* Let XGXS and SerDes out of reset */
         falcon_reset_xaui(efx);
 
         return 0;
-
- fail:
-        kfree(efx->phy_data);
-        efx->phy_data = NULL;
-        return rc;
 }
 
 /* Perform a "special software reset" on the PHY. The caller is
@@ -589,25 +602,26 @@ static bool tenxpress_phy_poll(struct efx_nic *efx)
         return !efx_link_state_equal(&efx->link_state, &old_state);
 }
 
-static void tenxpress_phy_fini(struct efx_nic *efx)
+static void sfx7101_phy_fini(struct efx_nic *efx)
 {
         int reg;
 
+        /* Power down the LNPGA */
+        reg = (1 << PMA_PMD_LNPGA_POWERDOWN_LBN);
+        efx_mdio_write(efx, MDIO_MMD_PMAPMD, PMA_PMD_XCONTROL_REG, reg);
+
+        /* Waiting here ensures that the board fini, which can turn
+         * off the power to the PHY, won't get run until the LNPGA
+         * powerdown has been given long enough to complete. */
+        schedule_timeout_uninterruptible(LNPGA_PDOWN_WAIT); /* 200 ms */
+}
+
+static void tenxpress_phy_remove(struct efx_nic *efx)
+{
         if (efx->phy_type == PHY_TYPE_SFT9001B)
                 device_remove_file(&efx->pci_dev->dev,
                                    &dev_attr_phy_short_reach);
 
-        if (efx->phy_type == PHY_TYPE_SFX7101) {
-                /* Power down the LNPGA */
-                reg = (1 << PMA_PMD_LNPGA_POWERDOWN_LBN);
-                efx_mdio_write(efx, MDIO_MMD_PMAPMD, PMA_PMD_XCONTROL_REG, reg);
-
-                /* Waiting here ensures that the board fini, which can turn
-                 * off the power to the PHY, won't get run until the LNPGA
-                 * powerdown has been given long enough to complete. */
-                schedule_timeout_uninterruptible(LNPGA_PDOWN_WAIT); /* 200 ms */
-        }
-
         kfree(efx->phy_data);
         efx->phy_data = NULL;
 }
@@ -819,11 +833,12 @@ static void sft9001_set_npage_adv(struct efx_nic *efx, u32 advertising)
 }
 
 struct efx_phy_operations falcon_sfx7101_phy_ops = {
-        .probe            = sfx7101_phy_probe,
+        .probe            = tenxpress_phy_probe,
         .init             = tenxpress_phy_init,
         .reconfigure      = tenxpress_phy_reconfigure,
         .poll             = tenxpress_phy_poll,
-        .fini             = tenxpress_phy_fini,
+        .fini             = sfx7101_phy_fini,
+        .remove           = tenxpress_phy_remove,
         .get_settings     = tenxpress_get_settings,
         .set_settings     = tenxpress_set_settings,
         .set_npage_adv    = sfx7101_set_npage_adv,
@@ -832,11 +847,12 @@ struct efx_phy_operations falcon_sfx7101_phy_ops = {
 };
 
 struct efx_phy_operations falcon_sft9001_phy_ops = {
-        .probe            = sft9001_phy_probe,
+        .probe            = tenxpress_phy_probe,
         .init             = tenxpress_phy_init,
         .reconfigure      = tenxpress_phy_reconfigure,
         .poll             = tenxpress_phy_poll,
-        .fini             = tenxpress_phy_fini,
+        .fini             = efx_port_dummy_op_void,
+        .remove           = tenxpress_phy_remove,
         .get_settings     = tenxpress_get_settings,
         .set_settings     = tenxpress_set_settings,
         .set_npage_adv    = sft9001_set_npage_adv,
diff --git a/drivers/net/sfc/tx.c b/drivers/net/sfc/tx.c
index e669f94e821b..a8b70ef6d817 100644
--- a/drivers/net/sfc/tx.c
+++ b/drivers/net/sfc/tx.c
@@ -821,8 +821,6 @@ static void efx_enqueue_unwind(struct efx_tx_queue *tx_queue)
                                            EFX_TXQ_MASK];
                 efx_tsoh_free(tx_queue, buffer);
                 EFX_BUG_ON_PARANOID(buffer->skb);
-                buffer->len = 0;
-                buffer->continuation = true;
                 if (buffer->unmap_len) {
                         unmap_addr = (buffer->dma_addr + buffer->len -
                                       buffer->unmap_len);
@@ -836,6 +834,8 @@ static void efx_enqueue_unwind(struct efx_tx_queue *tx_queue)
                                                PCI_DMA_TODEVICE);
                         buffer->unmap_len = 0;
                 }
+                buffer->len = 0;
+                buffer->continuation = true;
         }
 }
 
diff --git a/drivers/net/sh_eth.c b/drivers/net/sh_eth.c
index ca6285016dfd..7402b858cab7 100644
--- a/drivers/net/sh_eth.c
+++ b/drivers/net/sh_eth.c
@@ -110,7 +110,7 @@ static void sh_eth_reset(struct net_device *ndev)
                 mdelay(1);
                 cnt--;
         }
-        if (cnt < 0)
+        if (cnt == 0)
                 printk(KERN_ERR "Device reset fail\n");
 
         /* Table Init */
diff --git a/drivers/net/sky2.c b/drivers/net/sky2.c
index 1c01b96c9611..67249c3c9f50 100644
--- a/drivers/net/sky2.c
+++ b/drivers/net/sky2.c
@@ -644,6 +644,7 @@ static void sky2_phy_power_up(struct sky2_hw *hw, unsigned port)
 {
         u32 reg1;
 
+        sky2_write8(hw, B2_TST_CTRL1, TST_CFG_WRITE_ON);
         reg1 = sky2_pci_read32(hw, PCI_DEV_REG1);
         reg1 &= ~phy_power[port];
 
@@ -651,6 +652,7 @@ static void sky2_phy_power_up(struct sky2_hw *hw, unsigned port)
                 reg1 |= coma_mode[port];
 
         sky2_pci_write32(hw, PCI_DEV_REG1, reg1);
+        sky2_write8(hw, B2_TST_CTRL1, TST_CFG_WRITE_OFF);
         sky2_pci_read32(hw, PCI_DEV_REG1);
 
         if (hw->chip_id == CHIP_ID_YUKON_FE)
@@ -707,9 +709,11 @@ static void sky2_phy_power_down(struct sky2_hw *hw, unsigned port)
                 gm_phy_write(hw, port, PHY_MARV_CTRL, PHY_CT_PDOWN);
         }
 
+        sky2_write8(hw, B2_TST_CTRL1, TST_CFG_WRITE_ON);
         reg1 = sky2_pci_read32(hw, PCI_DEV_REG1);
         reg1 |= phy_power[port];                /* set PHY to PowerDown/COMA Mode */
         sky2_pci_write32(hw, PCI_DEV_REG1, reg1);
+        sky2_write8(hw, B2_TST_CTRL1, TST_CFG_WRITE_OFF);
 }
 
 /* Force a renegotiation */
@@ -1021,11 +1025,8 @@ static void sky2_prefetch_init(struct sky2_hw *hw, u32 qaddr,
 static inline struct sky2_tx_le *get_tx_le(struct sky2_port *sky2, u16 *slot)
 {
         struct sky2_tx_le *le = sky2->tx_le + *slot;
-        struct tx_ring_info *re = sky2->tx_ring + *slot;
 
         *slot = RING_NEXT(*slot, sky2->tx_ring_size);
-        re->flags = 0;
-        re->skb = NULL;
         le->ctrl = 0;
         return le;
 }
@@ -1618,8 +1619,7 @@ static unsigned tx_le_req(const struct sk_buff *skb)
         return count;
 }
 
-static void sky2_tx_unmap(struct pci_dev *pdev,
-                          const struct tx_ring_info *re)
+static void sky2_tx_unmap(struct pci_dev *pdev, struct tx_ring_info *re)
 {
         if (re->flags & TX_MAP_SINGLE)
                 pci_unmap_single(pdev, pci_unmap_addr(re, mapaddr),
@@ -1629,6 +1629,7 @@ static void sky2_tx_unmap(struct pci_dev *pdev,
                 pci_unmap_page(pdev, pci_unmap_addr(re, mapaddr),
                                pci_unmap_len(re, maplen),
                                PCI_DMA_TODEVICE);
+        re->flags = 0;
 }
 
 /*
@@ -1835,6 +1836,7 @@ static void sky2_tx_complete(struct sky2_port *sky2, u16 done)
                         dev->stats.tx_packets++;
                         dev->stats.tx_bytes += skb->len;
 
+                        re->skb = NULL;
                         dev_kfree_skb_any(skb);
 
                         sky2->tx_next = RING_NEXT(idx, sky2->tx_ring_size);
@@ -1844,7 +1846,8 @@ static void sky2_tx_complete(struct sky2_port *sky2, u16 done)
         sky2->tx_cons = idx;
         smp_mb();
 
-        if (tx_avail(sky2) > MAX_SKB_TX_LE + 4)
+        /* Wake unless it's detached, and called e.g. from sky2_down() */
+        if (tx_avail(sky2) > MAX_SKB_TX_LE + 4 && netif_device_present(dev))
                 netif_wake_queue(dev);
 }
 
@@ -2148,7 +2151,9 @@ static void sky2_qlink_intr(struct sky2_hw *hw)
 
         /* reset PHY Link Detect */
         phy = sky2_pci_read16(hw, PSM_CONFIG_REG4);
+        sky2_write8(hw, B2_TST_CTRL1, TST_CFG_WRITE_ON);
         sky2_pci_write16(hw, PSM_CONFIG_REG4, phy | 1);
+        sky2_write8(hw, B2_TST_CTRL1, TST_CFG_WRITE_OFF);
 
         sky2_link_up(sky2);
 }
@@ -2639,6 +2644,7 @@ static void sky2_hw_intr(struct sky2_hw *hw)
         if (status & (Y2_IS_MST_ERR | Y2_IS_IRQ_STAT)) {
                 u16 pci_err;
 
+                sky2_write8(hw, B2_TST_CTRL1, TST_CFG_WRITE_ON);
                 pci_err = sky2_pci_read16(hw, PCI_STATUS);
                 if (net_ratelimit())
                         dev_err(&pdev->dev, "PCI hardware error (0x%x)\n",
@@ -2646,12 +2652,14 @@ static void sky2_hw_intr(struct sky2_hw *hw)
 
                 sky2_pci_write16(hw, PCI_STATUS,
                                       pci_err | PCI_STATUS_ERROR_BITS);
+                sky2_write8(hw, B2_TST_CTRL1, TST_CFG_WRITE_OFF);
         }
 
         if (status & Y2_IS_PCI_EXP) {
                 /* PCI-Express uncorrectable Error occurred */
                 u32 err;
 
+                sky2_write8(hw, B2_TST_CTRL1, TST_CFG_WRITE_ON);
                 err = sky2_read32(hw, Y2_CFG_AER + PCI_ERR_UNCOR_STATUS);
                 sky2_write32(hw, Y2_CFG_AER + PCI_ERR_UNCOR_STATUS,
                              0xfffffffful);
@@ -2659,6 +2667,7 @@ static void sky2_hw_intr(struct sky2_hw *hw)
                         dev_err(&pdev->dev, "PCI Express error (0x%x)\n", err);
 
                 sky2_read32(hw, Y2_CFG_AER + PCI_ERR_UNCOR_STATUS);
+                sky2_write8(hw, B2_TST_CTRL1, TST_CFG_WRITE_OFF);
         }
 
         if (status & Y2_HWE_L1_MASK)
@@ -3037,6 +3046,7 @@ static void sky2_reset(struct sky2_hw *hw)
         }
 
         sky2_power_on(hw);
+        sky2_write8(hw, B2_TST_CTRL1, TST_CFG_WRITE_OFF);
 
         for (i = 0; i < hw->ports; i++) {
                 sky2_write8(hw, SK_REG(i, GMAC_LINK_CTRL), GMLC_RST_SET);
@@ -3073,6 +3083,7 @@ static void sky2_reset(struct sky2_hw *hw)
                 reg <<= PSM_CONFIG_REG4_TIMER_PHY_LINK_DETECT_BASE;
 
                 /* reset PHY Link Detect */
+                sky2_write8(hw, B2_TST_CTRL1, TST_CFG_WRITE_ON);
                 sky2_pci_write16(hw, PSM_CONFIG_REG4,
                                  reg | PSM_CONFIG_REG4_RST_PHY_LINK_DETECT);
                 sky2_pci_write16(hw, PSM_CONFIG_REG4, reg);
@@ -3090,6 +3101,7 @@ static void sky2_reset(struct sky2_hw *hw)
                         /* restore the PCIe Link Control register */
                         sky2_pci_write16(hw, cap + PCI_EXP_LNKCTL, reg);
                 }
+                sky2_write8(hw, B2_TST_CTRL1, TST_CFG_WRITE_OFF);
 
                 /* re-enable PEX PM in PEX PHY debug reg. 8 (clear bit 12) */
                 sky2_write32(hw, Y2_PEX_PHY_DATA, PEX_DB_ACCESS | (0x08UL << 16));
@@ -3227,6 +3239,27 @@ static inline u8 sky2_wol_supported(const struct sky2_hw *hw)
         return sky2_is_copper(hw) ? (WAKE_PHY | WAKE_MAGIC) : 0;
 }
 
+static void sky2_hw_set_wol(struct sky2_hw *hw)
+{
+        int wol = 0;
+        int i;
+
+        for (i = 0; i < hw->ports; i++) {
+                struct net_device *dev = hw->dev[i];
+                struct sky2_port *sky2 = netdev_priv(dev);
+
+                if (sky2->wol)
+                        wol = 1;
+        }
+
+        if (hw->chip_id == CHIP_ID_YUKON_EC_U ||
+            hw->chip_id == CHIP_ID_YUKON_EX ||
+            hw->chip_id == CHIP_ID_YUKON_FE_P)
+                sky2_write32(hw, B0_CTST, wol ? Y2_HW_WOL_ON : Y2_HW_WOL_OFF);
+
+        device_set_wakeup_enable(&hw->pdev->dev, wol);
+}
+
 static void sky2_get_wol(struct net_device *dev, struct ethtool_wolinfo *wol)
 {
         const struct sky2_port *sky2 = netdev_priv(dev);
@@ -3246,13 +3279,7 @@ static int sky2_set_wol(struct net_device *dev, struct ethtool_wolinfo *wol)
 
         sky2->wol = wol->wolopts;
 
-        if (hw->chip_id == CHIP_ID_YUKON_EC_U ||
-            hw->chip_id == CHIP_ID_YUKON_EX ||
-            hw->chip_id == CHIP_ID_YUKON_FE_P)
-                sky2_write32(hw, B0_CTST, sky2->wol
-                             ? Y2_HW_WOL_ON : Y2_HW_WOL_OFF);
-
-        device_set_wakeup_enable(&hw->pdev->dev, sky2->wol);
+        sky2_hw_set_wol(hw);
 
         if (!netif_running(dev))
                 sky2_wol_init(sky2);
@@ -4684,6 +4711,7 @@ static int __devinit sky2_probe(struct pci_dev *pdev,
         INIT_WORK(&hw->restart_work, sky2_restart);
 
         pci_set_drvdata(pdev, hw);
+        pdev->d3_delay = 150;
 
         return 0;
 
diff --git a/drivers/net/starfire.c b/drivers/net/starfire.c
index 95db60adde41..f9521136a869 100644
--- a/drivers/net/starfire.c
+++ b/drivers/net/starfire.c
@@ -1063,7 +1063,7 @@ static int netdev_open(struct net_device *dev)
         if (retval) {
                 printk(KERN_ERR "starfire: Failed to load firmware \"%s\"\n",
                        FIRMWARE_RX);
-                return retval;
+                goto out_init;
         }
         if (fw_rx->size % 4) {
                 printk(KERN_ERR "starfire: bogus length %zu in \"%s\"\n",
@@ -1108,6 +1108,9 @@ out_tx:
         release_firmware(fw_tx);
 out_rx:
         release_firmware(fw_rx);
+out_init:
+        if (retval)
+                netdev_close(dev);
         return retval;
 }
 
diff --git a/drivers/net/tc35815.c b/drivers/net/tc35815.c
index 75a669d48e5e..d71c1976072e 100644
--- a/drivers/net/tc35815.c
+++ b/drivers/net/tc35815.c
@@ -1437,7 +1437,6 @@ static int tc35815_do_interrupt(struct net_device *dev, u32 status, int limit)
                 /* Transmit complete. */
                 lp->lstats.tx_ints++;
                 tc35815_txdone(dev);
-                netif_wake_queue(dev);
                 if (ret < 0)
                         ret = 0;
         }
diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
index 3a74d2168598..7f82b0238e08 100644
--- a/drivers/net/tg3.c
+++ b/drivers/net/tg3.c
@@ -4,7 +4,7 @@
  * Copyright (C) 2001, 2002, 2003, 2004 David S. Miller (davem@redhat.com)
  * Copyright (C) 2001, 2002, 2003 Jeff Garzik (jgarzik@pobox.com)
  * Copyright (C) 2004 Sun Microsystems Inc.
- * Copyright (C) 2005-2009 Broadcom Corporation.
+ * Copyright (C) 2005-2010 Broadcom Corporation.
  *
  * Firmware is:
  *      Derived from proprietary unpublished source code,
@@ -68,8 +68,8 @@
 
 #define DRV_MODULE_NAME         "tg3"
 #define PFX DRV_MODULE_NAME     ": "
-#define DRV_MODULE_VERSION      "3.105"
-#define DRV_MODULE_RELDATE      "December 2, 2009"
+#define DRV_MODULE_VERSION      "3.106"
+#define DRV_MODULE_RELDATE      "January 12, 2010"
 
 #define TG3_DEF_MAC_MODE        0
 #define TG3_DEF_RX_MODE         0
@@ -1037,7 +1037,11 @@ static void tg3_mdio_start(struct tg3 *tp)
                 else
                         tp->phy_addr = 1;
 
-                is_serdes = tr32(SG_DIG_STATUS) & SG_DIG_IS_SERDES;
+                if (tp->pci_chip_rev_id != CHIPREV_ID_5717_A0)
+                        is_serdes = tr32(SG_DIG_STATUS) & SG_DIG_IS_SERDES;
+                else
+                        is_serdes = tr32(TG3_CPMU_PHY_STRAP) &
+                                    TG3_CPMU_PHY_STRAP_IS_SERDES;
                 if (is_serdes)
                         tp->phy_addr += 7;
         } else
@@ -4693,8 +4697,9 @@ next_pkt:
                 (*post_ptr)++;
 
                 if (unlikely(rx_std_posted >= tp->rx_std_max_post)) {
-                        u32 idx = *post_ptr % TG3_RX_RING_SIZE;
-                        tw32_rx_mbox(TG3_RX_STD_PROD_IDX_REG, idx);
+                        tpr->rx_std_prod_idx = std_prod_idx % TG3_RX_RING_SIZE;
+                        tw32_rx_mbox(TG3_RX_STD_PROD_IDX_REG,
+                                     tpr->rx_std_prod_idx);
                         work_mask &= ~RXD_OPAQUE_RING_STD;
                         rx_std_posted = 0;
                 }
@@ -7742,7 +7747,7 @@ static int tg3_reset_hw(struct tg3 *tp, int reset_phy)
              ((u64) tpr->rx_std_mapping >> 32));
         tw32(RCVDBDI_STD_BD + TG3_BDINFO_HOST_ADDR + TG3_64BIT_REG_LOW,
              ((u64) tpr->rx_std_mapping & 0xffffffff));
-        if (!(tp->tg3_flags3 & TG3_FLG3_5755_PLUS))
+        if (GET_ASIC_REV(tp->pci_chip_rev_id) != ASIC_REV_5717)
                 tw32(RCVDBDI_STD_BD + TG3_BDINFO_NIC_ADDR,
                      NIC_SRAM_RX_BUFFER_DESC);
 
@@ -12122,7 +12127,8 @@ static void __devinit tg3_get_eeprom_hw_cfg(struct tg3 *tp)
 
                 tp->phy_id = eeprom_phy_id;
                 if (eeprom_phy_serdes) {
-                        if (tp->tg3_flags2 & TG3_FLG2_5780_CLASS)
+                        if ((tp->tg3_flags2 & TG3_FLG2_5780_CLASS) ||
+                            GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5717)
                                 tp->tg3_flags2 |= TG3_FLG2_MII_SERDES;
                         else
                                 tp->tg3_flags2 |= TG3_FLG2_PHY_SERDES;
@@ -13384,6 +13390,11 @@ static int __devinit tg3_get_invariants(struct tg3 *tp)
         if (err)
                 return err;
 
+        if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5717 &&
+            (tp->pci_chip_rev_id != CHIPREV_ID_5717_A0 ||
+                 (tp->tg3_flags2 & TG3_FLG2_MII_SERDES)))
+                return -ENOTSUPP;
+
         /* Initialize data/descriptor byte/word swapping. */
         val = tr32(GRC_MODE);
         val &= GRC_MODE_HOST_STACKUP;
diff --git a/drivers/net/tg3.h b/drivers/net/tg3.h
index cd30889650f8..8a167912902b 100644
--- a/drivers/net/tg3.h
+++ b/drivers/net/tg3.h
@@ -4,6 +4,7 @@
  * Copyright (C) 2001, 2002, 2003, 2004 David S. Miller (davem@redhat.com)
  * Copyright (C) 2001 Jeff Garzik (jgarzik@pobox.com)
  * Copyright (C) 2004 Sun Microsystems Inc.
+ * Copyright (C) 2007-2010 Broadcom Corporation.
  */
 
 #ifndef _T3_H
@@ -1054,6 +1055,8 @@
 #define  CPMU_MUTEX_REQ_DRIVER           0x00001000
 #define TG3_CPMU_MUTEX_GNT              0x00003660
 #define  CPMU_MUTEX_GNT_DRIVER           0x00001000
+#define TG3_CPMU_PHY_STRAP              0x00003664
+#define TG3_CPMU_PHY_STRAP_IS_SERDES     0x00000020
 /* 0x3664 --> 0x3800 unused */
 
 /* Mbuf cluster free registers */
diff --git a/drivers/net/tulip/Kconfig b/drivers/net/tulip/Kconfig
index 1cc8cf4425d1..516713fa0a05 100644
--- a/drivers/net/tulip/Kconfig
+++ b/drivers/net/tulip/Kconfig
@@ -101,6 +101,10 @@ config TULIP_NAPI_HW_MITIGATION
 
           If in doubt, say Y.
 
+config TULIP_DM910X
+        def_bool y
+        depends on TULIP && SPARC
+
 config DE4X5
         tristate "Generic DECchip & DIGITAL EtherWORKS PCI/EISA"
         depends on PCI || EISA
diff --git a/drivers/net/tulip/dmfe.c b/drivers/net/tulip/dmfe.c
index ad63621913c3..6f44ebf58910 100644
--- a/drivers/net/tulip/dmfe.c
+++ b/drivers/net/tulip/dmfe.c
@@ -92,6 +92,10 @@
 #include <asm/uaccess.h>
 #include <asm/irq.h>
 
+#ifdef CONFIG_TULIP_DM910X
+#include <linux/of.h>
+#endif
+
 
 /* Board/System/Debug information/definition ---------------- */
 #define PCI_DM9132_ID   0x91321282      /* Davicom DM9132 ID */
@@ -377,6 +381,23 @@ static int __devinit dmfe_init_one (struct pci_dev *pdev,
         if (!printed_version++)
                 printk(version);
 
+        /*
+         *      SPARC on-board DM910x chips should be handled by the main
+         *      tulip driver, except for early DM9100s.
+         */
+#ifdef CONFIG_TULIP_DM910X
+        if ((ent->driver_data == PCI_DM9100_ID && pdev->revision >= 0x30) ||
+            ent->driver_data == PCI_DM9102_ID) {
+                struct device_node *dp = pci_device_to_OF_node(pdev);
+
+                if (dp && of_get_property(dp, "local-mac-address", NULL)) {
+                        printk(KERN_INFO DRV_NAME
+                               ": skipping on-board DM910x (use tulip)\n");
+                        return -ENODEV;
+                }
+        }
+#endif
+
         /* Init network device */
         dev = alloc_etherdev(sizeof(*db));
         if (dev == NULL)
diff --git a/drivers/net/tulip/tulip_core.c b/drivers/net/tulip/tulip_core.c
index 0fa3140d65bf..20696b5d60a5 100644
--- a/drivers/net/tulip/tulip_core.c
+++ b/drivers/net/tulip/tulip_core.c
@@ -196,9 +196,13 @@ struct tulip_chip_table tulip_tbl[] = {
         | HAS_NWAY | HAS_PCI_MWI, tulip_timer, tulip_media_task },
 
   /* DM910X */
+#ifdef CONFIG_TULIP_DM910X
   { "Davicom DM9102/DM9102A", 128, 0x0001ebef,
         HAS_MII | HAS_MEDIA_TABLE | CSR12_IN_SROM | HAS_ACPI,
         tulip_timer, tulip_media_task },
+#else
+  { NULL },
+#endif
 
   /* RS7112 */
   { "Conexant LANfinity", 256, 0x0001ebef,
@@ -228,8 +232,10 @@ static struct pci_device_id tulip_pci_tbl[] = {
         { 0x1259, 0xa120, PCI_ANY_ID, PCI_ANY_ID, 0, 0, COMET },
         { 0x11F6, 0x9881, PCI_ANY_ID, PCI_ANY_ID, 0, 0, COMPEX9881 },
         { 0x8086, 0x0039, PCI_ANY_ID, PCI_ANY_ID, 0, 0, I21145 },
+#ifdef CONFIG_TULIP_DM910X
         { 0x1282, 0x9100, PCI_ANY_ID, PCI_ANY_ID, 0, 0, DM910X },
         { 0x1282, 0x9102, PCI_ANY_ID, PCI_ANY_ID, 0, 0, DM910X },
+#endif
         { 0x1113, 0x1216, PCI_ANY_ID, PCI_ANY_ID, 0, 0, COMET },
         { 0x1113, 0x1217, PCI_ANY_ID, PCI_ANY_ID, 0, 0, MX98715 },
         { 0x1113, 0x9511, PCI_ANY_ID, PCI_ANY_ID, 0, 0, COMET },
@@ -243,6 +249,7 @@ static struct pci_device_id tulip_pci_tbl[] = {
         { 0x17B3, 0xAB08, PCI_ANY_ID, PCI_ANY_ID, 0, 0, COMET },
         { 0x10b7, 0x9300, PCI_ANY_ID, PCI_ANY_ID, 0, 0, COMET }, /* 3Com 3CSOHO100B-TX */
         { 0x14ea, 0xab08, PCI_ANY_ID, PCI_ANY_ID, 0, 0, COMET }, /* Planex FNW-3602-TX */
+        { 0x1414, 0x0001, PCI_ANY_ID, PCI_ANY_ID, 0, 0, COMET }, /* Microsoft MN-120 */
         { 0x1414, 0x0002, PCI_ANY_ID, PCI_ANY_ID, 0, 0, COMET },
         { } /* terminate list */
 };
@@ -1299,18 +1306,30 @@ static int __devinit tulip_init_one (struct pci_dev *pdev,
         }
 
         /*
-         *      Early DM9100's need software CRC and the DMFE driver
+         *      DM910x chips should be handled by the dmfe driver, except
+         *      on-board chips on SPARC systems.  Also, early DM9100s need
+         *      software CRC which only the dmfe driver supports.
          */
 
-        if (pdev->vendor == 0x1282 && pdev->device == 0x9100)
-        {
-                /* Read Chip revision */
-                if (pdev->revision < 0x30)
-                {
-                        printk(KERN_ERR PFX "skipping early DM9100 with Crc bug (use dmfe)\n");
+#ifdef CONFIG_TULIP_DM910X
+        if (chip_idx == DM910X) {
+                struct device_node *dp;
+
+                if (pdev->vendor == 0x1282 && pdev->device == 0x9100 &&
+                    pdev->revision < 0x30) {
+                        printk(KERN_INFO PFX
+                               "skipping early DM9100 with Crc bug (use dmfe)\n");
+                        return -ENODEV;
+                }
+
+                dp = pci_device_to_OF_node(pdev);
+                if (!(dp && of_get_property(dp, "local-mac-address", NULL))) {
+                        printk(KERN_INFO PFX
+                               "skipping DM910x expansion card (use dmfe)\n");
                         return -ENODEV;
                 }
         }
+#endif
 
         /*
          *      Looks for early PCI chipsets where people report hangs
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 01e99f22210e..2834a01bae24 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -849,13 +849,13 @@ static void tun_sock_write_space(struct sock *sk)
         if (sk->sk_sleep && waitqueue_active(sk->sk_sleep))
                 wake_up_interruptible_sync(sk->sk_sleep);
 
-        tun = container_of(sk, struct tun_sock, sk)->tun;
+        tun = tun_sk(sk)->tun;
         kill_fasync(&tun->fasync, SIGIO, POLL_OUT);
 }
 
 static void tun_sock_destruct(struct sock *sk)
 {
-        free_netdev(container_of(sk, struct tun_sock, sk)->tun->dev);
+        free_netdev(tun_sk(sk)->tun->dev);
 }
 
 static struct proto tun_proto = {
@@ -990,7 +990,7 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
                 sk->sk_write_space = tun_sock_write_space;
                 sk->sk_sndbuf = INT_MAX;
 
-                container_of(sk, struct tun_sock, sk)->tun = tun;
+                tun_sk(sk)->tun = tun;
 
                 security_tun_dev_post_create(sk);
 
diff --git a/drivers/net/ucc_geth.c b/drivers/net/ucc_geth.c
index afaf088b72ea..eb8fe7e16c6c 100644
--- a/drivers/net/ucc_geth.c
+++ b/drivers/net/ucc_geth.c
@@ -1563,7 +1563,10 @@ static int ugeth_disable(struct ucc_geth_private *ugeth, enum comm_dir mode)
 
 static void ugeth_quiesce(struct ucc_geth_private *ugeth)
 {
-        /* Wait for and prevent any further xmits. */
+        /* Prevent any further xmits, plus detach the device. */
+        netif_device_detach(ugeth->ndev);
+
+        /* Wait for any current xmits to finish. */
         netif_tx_disable(ugeth->ndev);
 
         /* Disable the interrupt to avoid NAPI rescheduling. */
@@ -1577,7 +1580,7 @@ static void ugeth_activate(struct ucc_geth_private *ugeth)
 {
         napi_enable(&ugeth->napi);
         enable_irq(ugeth->ug_info->uf_info.irq);
-        netif_tx_wake_all_queues(ugeth->ndev);
+        netif_device_attach(ugeth->ndev);
 }
 
 /* Called every time the controller might need to be made
@@ -1648,25 +1651,28 @@ static void adjust_link(struct net_device *dev)
                         ugeth->oldspeed = phydev->speed;
                 }
 
-                /*
-                 * To change the MAC configuration we need to disable the
-                 * controller. To do so, we have to either grab ugeth->lock,
-                 * which is a bad idea since 'graceful stop' commands might
-                 * take quite a while, or we can quiesce driver's activity.
-                 */
-                ugeth_quiesce(ugeth);
-                ugeth_disable(ugeth, COMM_DIR_RX_AND_TX);
-
-                out_be32(&ug_regs->maccfg2, tempval);
-                out_be32(&uf_regs->upsmr, upsmr);
-
-                ugeth_enable(ugeth, COMM_DIR_RX_AND_TX);
-                ugeth_activate(ugeth);
-
                 if (!ugeth->oldlink) {
                         new_state = 1;
                         ugeth->oldlink = 1;
                 }
+
+                if (new_state) {
+                        /*
+                         * To change the MAC configuration we need to disable
+                         * the controller. To do so, we have to either grab
+                         * ugeth->lock, which is a bad idea since 'graceful
+                         * stop' commands might take quite a while, or we can
+                         * quiesce driver's activity.
+                         */
+                        ugeth_quiesce(ugeth);
+                        ugeth_disable(ugeth, COMM_DIR_RX_AND_TX);
+
+                        out_be32(&ug_regs->maccfg2, tempval);
+                        out_be32(&uf_regs->upsmr, upsmr);
+
+                        ugeth_enable(ugeth, COMM_DIR_RX_AND_TX);
+                        ugeth_activate(ugeth);
+                }
         } else if (ugeth->oldlink) {
                         new_state = 1;
                         ugeth->oldlink = 0;
@@ -3273,13 +3279,12 @@ static int ucc_geth_tx(struct net_device *dev, u8 txQ)
                 /* Handle the transmitted buffer and release */
                 /* the BD to be used with the current frame  */
 
-                if ((bd == ugeth->txBd[txQ]) && (netif_queue_stopped(dev) == 0))
+                skb = ugeth->tx_skbuff[txQ][ugeth->skb_dirtytx[txQ]];
+                if (!skb)
                         break;
 
                 dev->stats.tx_packets++;
 
-                skb = ugeth->tx_skbuff[txQ][ugeth->skb_dirtytx[txQ]];
-
                 if (skb_queue_len(&ugeth->rx_recycle) < RX_BD_RING_LEN &&
                              skb_recycle_check(skb,
                                     ugeth->ug_info->uf_info.max_rx_buf_length +
@@ -3601,6 +3606,7 @@ static int ucc_geth_suspend(struct of_device *ofdev, pm_message_t state)
         if (!netif_running(ndev))
                 return 0;
 
+        netif_device_detach(ndev);
         napi_disable(&ugeth->napi);
 
         /*
@@ -3659,7 +3665,7 @@ static int ucc_geth_resume(struct of_device *ofdev)
         phy_start(ugeth->phydev);
 
         napi_enable(&ugeth->napi);
-        netif_start_queue(ndev);
+        netif_device_attach(ndev);
 
         return 0;
 }
diff --git a/drivers/net/ucc_geth.h b/drivers/net/ucc_geth.h
index a007e2acf651..ef1fbeb11c6e 100644
--- a/drivers/net/ucc_geth.h
+++ b/drivers/net/ucc_geth.h
@@ -838,13 +838,13 @@ struct ucc_geth_hardware_statistics {
                                                            using the maximum is
                                                            easier */
 #define UCC_GETH_SEND_QUEUE_QUEUE_DESCRIPTOR_ALIGNMENT  32
-#define UCC_GETH_SCHEDULER_ALIGNMENT            4       /* This is a guess */
+#define UCC_GETH_SCHEDULER_ALIGNMENT            8       /* This is a guess */
 #define UCC_GETH_TX_STATISTICS_ALIGNMENT        4       /* This is a guess */
 #define UCC_GETH_RX_STATISTICS_ALIGNMENT        4       /* This is a guess */
 #define UCC_GETH_RX_INTERRUPT_COALESCING_ALIGNMENT      64
 #define UCC_GETH_RX_BD_QUEUES_ALIGNMENT         8       /* This is a guess */
 #define UCC_GETH_RX_PREFETCHED_BDS_ALIGNMENT    128     /* This is a guess */
-#define UCC_GETH_RX_EXTENDED_FILTERING_GLOBAL_PARAMETERS_ALIGNMENT 4    /* This
+#define UCC_GETH_RX_EXTENDED_FILTERING_GLOBAL_PARAMETERS_ALIGNMENT 8    /* This
                                                                            is a
                                                                            guess
                                                                          */
@@ -899,16 +899,17 @@ struct ucc_geth_hardware_statistics {
 #define UCC_GETH_UTFS_INIT                      512     /* Tx virtual FIFO size
                                                          */
 #define UCC_GETH_UTFET_INIT                     256     /* 1/2 utfs */
-#define UCC_GETH_UTFTT_INIT                     128
+#define UCC_GETH_UTFTT_INIT                     512
 /* Gigabit Ethernet (1000 Mbps) */
 #define UCC_GETH_URFS_GIGA_INIT                 4096/*2048*/    /* Rx virtual
                                                                    FIFO size */
 #define UCC_GETH_URFET_GIGA_INIT                2048/*1024*/    /* 1/2 urfs */
 #define UCC_GETH_URFSET_GIGA_INIT               3072/*1536*/    /* 3/4 urfs */
-#define UCC_GETH_UTFS_GIGA_INIT                 8192/*2048*/    /* Tx virtual
+#define UCC_GETH_UTFS_GIGA_INIT                 4096/*2048*/    /* Tx virtual
+                                                                   FIFO size */
+#define UCC_GETH_UTFET_GIGA_INIT                2048/*1024*/    /* 1/2 utfs */
+#define UCC_GETH_UTFTT_GIGA_INIT                4096/*0x40*/    /* Tx virtual
                                                                    FIFO size */
-#define UCC_GETH_UTFET_GIGA_INIT                4096/*1024*/    /* 1/2 utfs */
-#define UCC_GETH_UTFTT_GIGA_INIT                0x400/*0x40*/   /* */
 
 #define UCC_GETH_REMODER_INIT                   0       /* bits that must be
                                                            set */
diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
index 21e183a83b99..5f3b9eaeb04f 100644
--- a/drivers/net/usb/cdc_ether.c
+++ b/drivers/net/usb/cdc_ether.c
@@ -419,7 +419,7 @@ static int cdc_manage_power(struct usbnet *dev, int on)
 
 static const struct driver_info cdc_info = {
         .description =  "CDC Ethernet Device",
-        .flags =        FLAG_ETHER | FLAG_LINK_INTR,
+        .flags =        FLAG_ETHER,
         // .check_connect = cdc_check_connect,
         .bind =         cdc_bind,
         .unbind =       usbnet_cdc_unbind,
@@ -584,6 +584,11 @@ static const struct usb_device_id	products [] = {
                         USB_CDC_SUBCLASS_MDLM, USB_CDC_PROTO_NONE),
         .driver_info = (unsigned long) &mbm_info,
 }, {
+        /* Ericsson C3607w ver 2 */
+        USB_DEVICE_AND_INTERFACE_INFO(0x0bdb, 0x190b, USB_CLASS_COMM,
+                        USB_CDC_SUBCLASS_MDLM, USB_CDC_PROTO_NONE),
+        .driver_info = (unsigned long) &mbm_info,
+}, {
         /* Toshiba F3507g */
         USB_DEVICE_AND_INTERFACE_INFO(0x0930, 0x130b, USB_CLASS_COMM,
                         USB_CDC_SUBCLASS_MDLM, USB_CDC_PROTO_NONE),
diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
index f78f0903b073..6895f1531238 100644
--- a/drivers/net/usb/hso.c
+++ b/drivers/net/usb/hso.c
@@ -286,6 +286,7 @@ struct hso_device {
         u8 usb_gone;
         struct work_struct async_get_intf;
         struct work_struct async_put_intf;
+        struct work_struct reset_device;
 
         struct usb_device *usb;
         struct usb_interface *interface;
@@ -332,7 +333,8 @@ static void hso_kick_transmit(struct hso_serial *serial);
 /* Helper functions */
 static int hso_mux_submit_intr_urb(struct hso_shared_int *mux_int,
                                    struct usb_device *usb, gfp_t gfp);
-static void log_usb_status(int status, const char *function);
+static void handle_usb_error(int status, const char *function,
+                             struct hso_device *hso_dev);
 static struct usb_endpoint_descriptor *hso_get_ep(struct usb_interface *intf,
                                                   int type, int dir);
 static int hso_get_mux_ports(struct usb_interface *intf, unsigned char *ports);
@@ -350,6 +352,7 @@ static void async_put_intf(struct work_struct *data);
 static int hso_put_activity(struct hso_device *hso_dev);
 static int hso_get_activity(struct hso_device *hso_dev);
 static void tiocmget_intr_callback(struct urb *urb);
+static void reset_device(struct work_struct *data);
 /*****************************************************************************/
 /* Helping functions                                                         */
 /*****************************************************************************/
@@ -461,10 +464,17 @@ static const struct usb_device_id hso_ids[] = {
         {USB_DEVICE(0x0af0, 0x7501)},           /* GTM 382 */
         {USB_DEVICE(0x0af0, 0x7601)},           /* GE40x */
         {USB_DEVICE(0x0af0, 0x7701)},
+        {USB_DEVICE(0x0af0, 0x7706)},
         {USB_DEVICE(0x0af0, 0x7801)},
         {USB_DEVICE(0x0af0, 0x7901)},
+        {USB_DEVICE(0x0af0, 0x7A01)},
+        {USB_DEVICE(0x0af0, 0x7A05)},
         {USB_DEVICE(0x0af0, 0x8200)},
         {USB_DEVICE(0x0af0, 0x8201)},
+        {USB_DEVICE(0x0af0, 0x8300)},
+        {USB_DEVICE(0x0af0, 0x8302)},
+        {USB_DEVICE(0x0af0, 0x8304)},
+        {USB_DEVICE(0x0af0, 0x8400)},
         {USB_DEVICE(0x0af0, 0xd035)},
         {USB_DEVICE(0x0af0, 0xd055)},
         {USB_DEVICE(0x0af0, 0xd155)},
@@ -473,6 +483,8 @@ static const struct usb_device_id hso_ids[] = {
         {USB_DEVICE(0x0af0, 0xd157)},
         {USB_DEVICE(0x0af0, 0xd257)},
         {USB_DEVICE(0x0af0, 0xd357)},
+        {USB_DEVICE(0x0af0, 0xd058)},
+        {USB_DEVICE(0x0af0, 0xc100)},
         {}
 };
 MODULE_DEVICE_TABLE(usb, hso_ids);
@@ -655,8 +667,8 @@ static void set_serial_by_index(unsigned index, struct hso_serial *serial)
         spin_unlock_irqrestore(&serial_table_lock, flags);
 }
 
-/* log a meaningful explanation of an USB status */
-static void log_usb_status(int status, const char *function)
+static void handle_usb_error(int status, const char *function,
+                             struct hso_device *hso_dev)
 {
         char *explanation;
 
@@ -685,10 +697,20 @@ static void log_usb_status(int status, const char *function)
         case -EMSGSIZE:
                 explanation = "internal error";
                 break;
+        case -EILSEQ:
+        case -EPROTO:
+        case -ETIME:
+        case -ETIMEDOUT:
+                explanation = "protocol error";
+                if (hso_dev)
+                        schedule_work(&hso_dev->reset_device);
+                break;
         default:
                 explanation = "unknown status";
                 break;
         }
+
+        /* log a meaningful explanation of an USB status */
         D1("%s: received USB status - %s (%d)", function, explanation, status);
 }
 
@@ -762,7 +784,7 @@ static void write_bulk_callback(struct urb *urb)
         /* log status, but don't act on it, we don't need to resubmit anything
          * anyhow */
         if (status)
-                log_usb_status(status, __func__);
+                handle_usb_error(status, __func__, odev->parent);
 
         hso_put_activity(odev->parent);
 
@@ -806,7 +828,7 @@ static netdev_tx_t hso_net_start_xmit(struct sk_buff *skb,
         result = usb_submit_urb(odev->mux_bulk_tx_urb, GFP_ATOMIC);
         if (result) {
                 dev_warn(&odev->parent->interface->dev,
-                        "failed mux_bulk_tx_urb %d", result);
+                        "failed mux_bulk_tx_urb %d\n", result);
                 net->stats.tx_errors++;
                 netif_start_queue(net);
         } else {
@@ -998,7 +1020,7 @@ static void read_bulk_callback(struct urb *urb)
 
         /* is al ok?  (Filip: Who's Al ?) */
         if (status) {
-                log_usb_status(status, __func__);
+                handle_usb_error(status, __func__, odev->parent);
                 return;
         }
 
@@ -1019,7 +1041,8 @@ static void read_bulk_callback(struct urb *urb)
         if (odev->parent->port_spec & HSO_INFO_CRC_BUG) {
                 u32 rest;
                 u8 crc_check[4] = { 0xDE, 0xAD, 0xBE, 0xEF };
-                rest = urb->actual_length % odev->in_endp->wMaxPacketSize;
+                rest = urb->actual_length %
+                        le16_to_cpu(odev->in_endp->wMaxPacketSize);
                 if (((rest == 5) || (rest == 6)) &&
                     !memcmp(((u8 *) urb->transfer_buffer) +
                             urb->actual_length - 4, crc_check, 4)) {
@@ -1053,7 +1076,7 @@ static void read_bulk_callback(struct urb *urb)
         result = usb_submit_urb(urb, GFP_ATOMIC);
         if (result)
                 dev_warn(&odev->parent->interface->dev,
-                         "%s failed submit mux_bulk_rx_urb %d", __func__,
+                         "%s failed submit mux_bulk_rx_urb %d\n", __func__,
                          result);
 }
 
@@ -1207,7 +1230,7 @@ static void hso_std_serial_read_bulk_callback(struct urb *urb)
                 D1("serial == NULL");
                 return;
         } else if (status) {
-                log_usb_status(status, __func__);
+                handle_usb_error(status, __func__, serial->parent);
                 return;
         }
 
@@ -1225,7 +1248,7 @@ static void hso_std_serial_read_bulk_callback(struct urb *urb)
                         u8 crc_check[4] = { 0xDE, 0xAD, 0xBE, 0xEF };
                         rest =
                             urb->actual_length %
-                            serial->in_endp->wMaxPacketSize;
+                            le16_to_cpu(serial->in_endp->wMaxPacketSize);
                         if (((rest == 5) || (rest == 6)) &&
                             !memcmp(((u8 *) urb->transfer_buffer) +
                                     urb->actual_length - 4, crc_check, 4)) {
@@ -1513,7 +1536,7 @@ static void tiocmget_intr_callback(struct urb *urb)
         if (!serial)
                 return;
         if (status) {
-                log_usb_status(status, __func__);
+                handle_usb_error(status, __func__, serial->parent);
                 return;
         }
         tiocmget = serial->tiocmget;
@@ -1700,6 +1723,10 @@ static int hso_serial_tiocmset(struct tty_struct *tty, struct file *file,
                 D1("no tty structures");
                 return -EINVAL;
         }
+
+        if ((serial->parent->port_spec & HSO_PORT_MASK) != HSO_PORT_MODEM)
+                return -EINVAL;
+
         if_num = serial->parent->interface->altsetting->desc.bInterfaceNumber;
 
         spin_lock_irqsave(&serial->serial_lock, flags);
@@ -1838,7 +1865,7 @@ static int mux_device_request(struct hso_serial *serial, u8 type, u16 port,
         result = usb_submit_urb(ctrl_urb, GFP_ATOMIC);
         if (result) {
                 dev_err(&ctrl_urb->dev->dev,
-                        "%s failed submit ctrl_urb %d type %d", __func__,
+                        "%s failed submit ctrl_urb %d type %d\n", __func__,
                         result, type);
                 return result;
         }
@@ -1888,7 +1915,7 @@ static void intr_callback(struct urb *urb)
 
         /* status check */
         if (status) {
-                log_usb_status(status, __func__);
+                handle_usb_error(status, __func__, NULL);
                 return;
         }
         D4("\n--- Got intr callback 0x%02X ---", status);
@@ -1905,18 +1932,18 @@ static void intr_callback(struct urb *urb)
                         if (serial != NULL) {
                                 D1("Pending read interrupt on port %d\n", i);
                                 spin_lock(&serial->serial_lock);
-                                if (serial->rx_state == RX_IDLE) {
+                                if (serial->rx_state == RX_IDLE &&
+                                        serial->open_count > 0) {
                                         /* Setup and send a ctrl req read on
                                          * port i */
-                                if (!serial->rx_urb_filled[0]) {
+                                        if (!serial->rx_urb_filled[0]) {
                                                 serial->rx_state = RX_SENT;
                                                 hso_mux_serial_read(serial);
                                         } else
                                                 serial->rx_state = RX_PENDING;
-
                                 } else {
-                                        D1("Already pending a read on "
-                                           "port %d\n", i);
+                                        D1("Already a read pending on "
+                                           "port %d or port not open\n", i);
                                 }
                                 spin_unlock(&serial->serial_lock);
                         }
@@ -1958,7 +1985,7 @@ static void hso_std_serial_write_bulk_callback(struct urb *urb)
         tty = tty_kref_get(serial->tty);
         spin_unlock(&serial->serial_lock);
         if (status) {
-                log_usb_status(status, __func__);
+                handle_usb_error(status, __func__, serial->parent);
                 tty_kref_put(tty);
                 return;
         }
@@ -2014,7 +2041,7 @@ static void ctrl_callback(struct urb *urb)
         tty = tty_kref_get(serial->tty);
         spin_unlock(&serial->serial_lock);
         if (status) {
-                log_usb_status(status, __func__);
+                handle_usb_error(status, __func__, serial->parent);
                 tty_kref_put(tty);
                 return;
         }
@@ -2358,12 +2385,12 @@ static int hso_serial_common_create(struct hso_serial *serial, int num_urbs,
         serial->tx_data_length = tx_size;
         serial->tx_data = kzalloc(serial->tx_data_length, GFP_KERNEL);
         if (!serial->tx_data) {
-                dev_err(dev, "%s - Out of memory", __func__);
+                dev_err(dev, "%s - Out of memory\n", __func__);
                 goto exit;
         }
         serial->tx_buffer = kzalloc(serial->tx_data_length, GFP_KERNEL);
         if (!serial->tx_buffer) {
-                dev_err(dev, "%s - Out of memory", __func__);
+                dev_err(dev, "%s - Out of memory\n", __func__);
                 goto exit;
         }
 
@@ -2391,6 +2418,7 @@ static struct hso_device *hso_create_device(struct usb_interface *intf,
 
         INIT_WORK(&hso_dev->async_get_intf, async_get_intf);
         INIT_WORK(&hso_dev->async_put_intf, async_put_intf);
+        INIT_WORK(&hso_dev->reset_device, reset_device);
 
         return hso_dev;
 }
@@ -2831,13 +2859,14 @@ struct hso_shared_int *hso_create_shared_int(struct usb_interface *interface)
 
         mux->shared_intr_urb = usb_alloc_urb(0, GFP_KERNEL);
         if (!mux->shared_intr_urb) {
-                dev_err(&interface->dev, "Could not allocate intr urb?");
+                dev_err(&interface->dev, "Could not allocate intr urb?\n");
                 goto exit;
         }
-        mux->shared_intr_buf = kzalloc(mux->intr_endp->wMaxPacketSize,
-                                       GFP_KERNEL);
+        mux->shared_intr_buf =
+                kzalloc(le16_to_cpu(mux->intr_endp->wMaxPacketSize),
+                        GFP_KERNEL);
         if (!mux->shared_intr_buf) {
-                dev_err(&interface->dev, "Could not allocate intr buf?");
+                dev_err(&interface->dev, "Could not allocate intr buf?\n");
                 goto exit;
         }
 
@@ -3132,6 +3161,26 @@ out:
         return result;
 }
 
+static void reset_device(struct work_struct *data)
+{
+        struct hso_device *hso_dev =
+            container_of(data, struct hso_device, reset_device);
+        struct usb_device *usb = hso_dev->usb;
+        int result;
+
+        if (hso_dev->usb_gone) {
+                D1("No reset during disconnect\n");
+        } else {
+                result = usb_lock_device_for_reset(usb, hso_dev->interface);
+                if (result < 0)
+                        D1("unable to lock device for reset: %d\n", result);
+                else {
+                        usb_reset_device(usb);
+                        usb_unlock_device(usb);
+                }
+        }
+}
+
 static void hso_serial_ref_free(struct kref *ref)
 {
         struct hso_device *hso_dev = container_of(ref, struct hso_device, ref);
@@ -3232,13 +3281,13 @@ static int hso_mux_submit_intr_urb(struct hso_shared_int *shared_int,
                          usb_rcvintpipe(usb,
                                 shared_int->intr_endp->bEndpointAddress & 0x7F),
                          shared_int->shared_intr_buf,
-                         shared_int->intr_endp->wMaxPacketSize,
+                         1,
                          intr_callback, shared_int,
                          shared_int->intr_endp->bInterval);
 
         result = usb_submit_urb(shared_int->shared_intr_urb, gfp);
         if (result)
-                dev_warn(&usb->dev, "%s failed mux_intr_urb %d", __func__,
+                dev_warn(&usb->dev, "%s failed mux_intr_urb %d\n", __func__,
                         result);
 
         return result;
diff --git a/drivers/net/usb/rtl8150.c b/drivers/net/usb/rtl8150.c
index f14d225404da..fd19db0d2504 100644
--- a/drivers/net/usb/rtl8150.c
+++ b/drivers/net/usb/rtl8150.c
@@ -270,7 +270,7 @@ static int read_mii_word(rtl8150_t * dev, u8 phy, __u8 indx, u16 * reg)
                 get_registers(dev, PHYCNT, 1, data);
         } while ((data[0] & PHY_GO) && (i++ < MII_TIMEOUT));
 
-        if (i < MII_TIMEOUT) {
+        if (i <= MII_TIMEOUT) {
                 get_registers(dev, PHYDAT, 2, data);
                 *reg = data[0] | (data[1] << 8);
                 return 0;
@@ -295,7 +295,7 @@ static int write_mii_word(rtl8150_t * dev, u8 phy, __u8 indx, u16 reg)
                 get_registers(dev, PHYCNT, 1, data);
         } while ((data[0] & PHY_GO) && (i++ < MII_TIMEOUT));
 
-        if (i < MII_TIMEOUT)
+        if (i <= MII_TIMEOUT)
                 return 0;
         else
                 return 1;
diff --git a/drivers/net/via-rhine.c b/drivers/net/via-rhine.c
index 593e01f64e9b..611b80435955 100644
--- a/drivers/net/via-rhine.c
+++ b/drivers/net/via-rhine.c
@@ -102,6 +102,7 @@ static const int multicast_filter_limit = 32;
 #include <linux/ethtool.h>
 #include <linux/crc32.h>
 #include <linux/bitops.h>
+#include <linux/workqueue.h>
 #include <asm/processor.h>      /* Processor type for cache alignment. */
 #include <asm/io.h>
 #include <asm/irq.h>
@@ -389,6 +390,7 @@ struct rhine_private {
         struct net_device *dev;
         struct napi_struct napi;
         spinlock_t lock;
+        struct work_struct reset_task;
 
         /* Frequently used values: keep some adjacent for cache effect. */
         u32 quirks;
@@ -407,6 +409,7 @@ struct rhine_private {
 static int  mdio_read(struct net_device *dev, int phy_id, int location);
 static void mdio_write(struct net_device *dev, int phy_id, int location, int value);
 static int  rhine_open(struct net_device *dev);
+static void rhine_reset_task(struct work_struct *work);
 static void rhine_tx_timeout(struct net_device *dev);
 static netdev_tx_t rhine_start_tx(struct sk_buff *skb,
                                   struct net_device *dev);
@@ -775,6 +778,8 @@ static int __devinit rhine_init_one(struct pci_dev *pdev,
         dev->irq = pdev->irq;
 
         spin_lock_init(&rp->lock);
+        INIT_WORK(&rp->reset_task, rhine_reset_task);
+
         rp->mii_if.dev = dev;
         rp->mii_if.mdio_read = mdio_read;
         rp->mii_if.mdio_write = mdio_write;
@@ -1179,22 +1184,18 @@ static int rhine_open(struct net_device *dev)
         return 0;
 }
 
-static void rhine_tx_timeout(struct net_device *dev)
+static void rhine_reset_task(struct work_struct *work)
 {
-        struct rhine_private *rp = netdev_priv(dev);
-        void __iomem *ioaddr = rp->base;
-
-        printk(KERN_WARNING "%s: Transmit timed out, status %4.4x, PHY status "
-               "%4.4x, resetting...\n",
-               dev->name, ioread16(ioaddr + IntrStatus),
-               mdio_read(dev, rp->mii_if.phy_id, MII_BMSR));
+        struct rhine_private *rp = container_of(work, struct rhine_private,
+                                                reset_task);
+        struct net_device *dev = rp->dev;
 
         /* protect against concurrent rx interrupts */
         disable_irq(rp->pdev->irq);
 
         napi_disable(&rp->napi);
 
-        spin_lock(&rp->lock);
+        spin_lock_bh(&rp->lock);
 
         /* clear all descriptors */
         free_tbufs(dev);
@@ -1206,7 +1207,7 @@ static void rhine_tx_timeout(struct net_device *dev)
         rhine_chip_reset(dev);
         init_registers(dev);
 
-        spin_unlock(&rp->lock);
+        spin_unlock_bh(&rp->lock);
         enable_irq(rp->pdev->irq);
 
         dev->trans_start = jiffies;
@@ -1214,6 +1215,19 @@ static void rhine_tx_timeout(struct net_device *dev)
         netif_wake_queue(dev);
 }
 
+static void rhine_tx_timeout(struct net_device *dev)
+{
+        struct rhine_private *rp = netdev_priv(dev);
+        void __iomem *ioaddr = rp->base;
+
+        printk(KERN_WARNING "%s: Transmit timed out, status %4.4x, PHY status "
+               "%4.4x, resetting...\n",
+               dev->name, ioread16(ioaddr + IntrStatus),
+               mdio_read(dev, rp->mii_if.phy_id, MII_BMSR));
+
+        schedule_work(&rp->reset_task);
+}
+
 static netdev_tx_t rhine_start_tx(struct sk_buff *skb,
                                   struct net_device *dev)
 {
@@ -1830,10 +1844,11 @@ static int rhine_close(struct net_device *dev)
         struct rhine_private *rp = netdev_priv(dev);
         void __iomem *ioaddr = rp->base;
 
-        spin_lock_irq(&rp->lock);
-
-        netif_stop_queue(dev);
         napi_disable(&rp->napi);
+        cancel_work_sync(&rp->reset_task);
+        netif_stop_queue(dev);
+
+        spin_lock_irq(&rp->lock);
 
         if (debug > 1)
                 printk(KERN_DEBUG "%s: Shutting down ethercard, "
diff --git a/drivers/net/via-velocity.c b/drivers/net/via-velocity.c
index 4ceb441f2687..317aa34b21cf 100644
--- a/drivers/net/via-velocity.c
+++ b/drivers/net/via-velocity.c
@@ -1877,13 +1877,12 @@ static void velocity_error(struct velocity_info *vptr, int status)
 /**
  *      tx_srv          -       transmit interrupt service
  *      @vptr; Velocity
- *      @status:
  *
  *      Scan the queues looking for transmitted packets that
  *      we can complete and clean up. Update any statistics as
  *      necessary/
  */
-static int velocity_tx_srv(struct velocity_info *vptr, u32 status)
+static int velocity_tx_srv(struct velocity_info *vptr)
 {
         struct tx_desc *td;
         int qnum;
@@ -2090,14 +2089,12 @@ static int velocity_receive_frame(struct velocity_info *vptr, int idx)
 /**
  *      velocity_rx_srv         -       service RX interrupt
  *      @vptr: velocity
- *      @status: adapter status (unused)
  *
  *      Walk the receive ring of the velocity adapter and remove
  *      any received packets from the receive queue. Hand the ring
  *      slots back to the adapter for reuse.
  */
-static int velocity_rx_srv(struct velocity_info *vptr, int status,
-                int budget_left)
+static int velocity_rx_srv(struct velocity_info *vptr, int budget_left)
 {
         struct net_device_stats *stats = &vptr->dev->stats;
         int rd_curr = vptr->rx.curr;
@@ -2151,32 +2148,24 @@ static int velocity_poll(struct napi_struct *napi, int budget)
         struct velocity_info *vptr = container_of(napi,
                         struct velocity_info, napi);
         unsigned int rx_done;
-        u32 isr_status;
-
-        spin_lock(&vptr->lock);
-        isr_status = mac_read_isr(vptr->mac_regs);
-
-        /* Ack the interrupt */
-        mac_write_isr(vptr->mac_regs, isr_status);
-        if (isr_status & (~(ISR_PRXI | ISR_PPRXI | ISR_PTXI | ISR_PPTXI)))
-                velocity_error(vptr, isr_status);
+        unsigned long flags;
 
+        spin_lock_irqsave(&vptr->lock, flags);
         /*
          * Do rx and tx twice for performance (taken from the VIA
          * out-of-tree driver).
          */
-        rx_done = velocity_rx_srv(vptr, isr_status, budget / 2);
-        velocity_tx_srv(vptr, isr_status);
-        rx_done += velocity_rx_srv(vptr, isr_status, budget - rx_done);
-        velocity_tx_srv(vptr, isr_status);
-
-        spin_unlock(&vptr->lock);
+        rx_done = velocity_rx_srv(vptr, budget / 2);
+        velocity_tx_srv(vptr);
+        rx_done += velocity_rx_srv(vptr, budget - rx_done);
+        velocity_tx_srv(vptr);
 
         /* If budget not fully consumed, exit the polling mode */
         if (rx_done < budget) {
                 napi_complete(napi);
                 mac_enable_int(vptr->mac_regs);
         }
+        spin_unlock_irqrestore(&vptr->lock, flags);
 
         return rx_done;
 }
@@ -2206,10 +2195,17 @@ static irqreturn_t velocity_intr(int irq, void *dev_instance)
                 return IRQ_NONE;
         }
 
+        /* Ack the interrupt */
+        mac_write_isr(vptr->mac_regs, isr_status);
+
         if (likely(napi_schedule_prep(&vptr->napi))) {
                 mac_disable_int(vptr->mac_regs);
                 __napi_schedule(&vptr->napi);
         }
+
+        if (isr_status & (~(ISR_PRXI | ISR_PPRXI | ISR_PTXI | ISR_PPTXI)))
+                velocity_error(vptr, isr_status);
+
         spin_unlock(&vptr->lock);
 
         return IRQ_HANDLED;
@@ -2237,8 +2233,6 @@ static int velocity_open(struct net_device *dev)
         /* Ensure chip is running */
         pci_set_power_state(vptr->pdev, PCI_D0);
 
-        velocity_give_many_rx_descs(vptr);
-
         velocity_init_registers(vptr, VELOCITY_INIT_COLD);
 
         ret = request_irq(vptr->pdev->irq, velocity_intr, IRQF_SHARED,
@@ -2250,6 +2244,8 @@ static int velocity_open(struct net_device *dev)
                 goto out;
         }
 
+        velocity_give_many_rx_descs(vptr);
+
         mac_enable_int(vptr->mac_regs);
         netif_start_queue(dev);
         napi_enable(&vptr->napi);
@@ -2339,10 +2335,10 @@ static int velocity_change_mtu(struct net_device *dev, int new_mtu)
 
                 dev->mtu = new_mtu;
 
-                velocity_give_many_rx_descs(vptr);
-
                 velocity_init_registers(vptr, VELOCITY_INIT_COLD);
 
+                velocity_give_many_rx_descs(vptr);
+
                 mac_enable_int(vptr->mac_regs);
                 netif_start_queue(dev);
 
@@ -3100,7 +3096,7 @@ static int velocity_resume(struct pci_dev *pdev)
         velocity_init_registers(vptr, VELOCITY_INIT_WOL);
         mac_disable_int(vptr->mac_regs);
 
-        velocity_tx_srv(vptr, 0);
+        velocity_tx_srv(vptr);
 
         for (i = 0; i < vptr->tx.numq; i++) {
                 if (vptr->tx.used[i])
@@ -3344,6 +3340,7 @@ static int velocity_set_coalesce(struct net_device *dev,
 {
         struct velocity_info *vptr = netdev_priv(dev);
         int max_us = 0x3f * 64;
+        unsigned long flags;
 
         /* 6 bits of  */
         if (ecmd->tx_coalesce_usecs > max_us)
@@ -3365,6 +3362,7 @@ static int velocity_set_coalesce(struct net_device *dev,
                         ecmd->tx_coalesce_usecs);
 
         /* Setup the interrupt suppression and queue timers */
+        spin_lock_irqsave(&vptr->lock, flags);
         mac_disable_int(vptr->mac_regs);
         setup_adaptive_interrupts(vptr);
         setup_queue_timers(vptr);
@@ -3372,6 +3370,7 @@ static int velocity_set_coalesce(struct net_device *dev,
         mac_write_int_mask(vptr->int_mask, vptr->mac_regs);
         mac_clear_isr(vptr->mac_regs);
         mac_enable_int(vptr->mac_regs);
+        spin_unlock_irqrestore(&vptr->lock, flags);
 
         return 0;
 }
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index c708ecc3cb2e..9ead30bd00c4 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -395,8 +395,7 @@ static void refill_work(struct work_struct *work)
 
         vi = container_of(work, struct virtnet_info, refill.work);
         napi_disable(&vi->napi);
-        try_fill_recv(vi, GFP_KERNEL);
-        still_empty = (vi->num == 0);
+        still_empty = !try_fill_recv(vi, GFP_KERNEL);
         napi_enable(&vi->napi);
 
         /* In theory, this can happen: if we don't get any buffers in
diff --git a/drivers/net/vxge/vxge-main.c b/drivers/net/vxge/vxge-main.c
index f1c4b2a1e867..b9685e82f7b6 100644
--- a/drivers/net/vxge/vxge-main.c
+++ b/drivers/net/vxge/vxge-main.c
@@ -310,7 +310,7 @@ static int vxge_rx_map(void *dtrh, struct vxge_ring *ring)
         dma_addr = pci_map_single(ring->pdev, rx_priv->skb_data,
                                 rx_priv->data_size, PCI_DMA_FROMDEVICE);
 
-        if (dma_addr == 0) {
+        if (unlikely(pci_dma_mapping_error(ring->pdev, dma_addr))) {
                 ring->stats.pci_map_fail++;
                 return -EIO;
         }
@@ -4087,21 +4087,21 @@ vxge_probe(struct pci_dev *pdev, const struct pci_device_id *pre)
                 goto _exit0;
         }
 
-        if (!pci_set_dma_mask(pdev, 0xffffffffffffffffULL)) {
+        if (!pci_set_dma_mask(pdev, DMA_BIT_MASK(64))) {
                 vxge_debug_ll_config(VXGE_TRACE,
                         "%s : using 64bit DMA", __func__);
 
                 high_dma = 1;
 
                 if (pci_set_consistent_dma_mask(pdev,
-                                                0xffffffffffffffffULL)) {
+                                                DMA_BIT_MASK(64))) {
                         vxge_debug_init(VXGE_ERR,
                                 "%s : unable to obtain 64bit DMA for "
                                 "consistent allocations", __func__);
                         ret = -ENOMEM;
                         goto _exit1;
                 }
-        } else if (!pci_set_dma_mask(pdev, 0xffffffffUL)) {
+        } else if (!pci_set_dma_mask(pdev, DMA_BIT_MASK(32))) {
                 vxge_debug_ll_config(VXGE_TRACE,
                         "%s : using 32bit DMA", __func__);
         } else {
diff --git a/drivers/net/wimax/i2400m/i2400m-usb.h b/drivers/net/wimax/i2400m/i2400m-usb.h
index 5cc0f279417e..2d7c96d7e865 100644
--- a/drivers/net/wimax/i2400m/i2400m-usb.h
+++ b/drivers/net/wimax/i2400m/i2400m-usb.h
@@ -151,6 +151,7 @@ enum {
 
         /* Device IDs */
         USB_DEVICE_ID_I6050 = 0x0186,
+        USB_DEVICE_ID_I6050_2 = 0x0188,
 };
 
 
@@ -234,6 +235,7 @@ struct i2400mu {
         u8 rx_size_auto_shrink;
 
         struct dentry *debugfs_dentry;
+        unsigned i6050:1;       /* 1 if this is a 6050 based SKU */
 };
 
 
diff --git a/drivers/net/wimax/i2400m/usb.c b/drivers/net/wimax/i2400m/usb.c
index 3b48681f8a0d..98f4f8c5fb68 100644
--- a/drivers/net/wimax/i2400m/usb.c
+++ b/drivers/net/wimax/i2400m/usb.c
@@ -478,7 +478,16 @@ int i2400mu_probe(struct usb_interface *iface,
         i2400m->bus_bm_wait_for_ack = i2400mu_bus_bm_wait_for_ack;
         i2400m->bus_bm_mac_addr_impaired = 0;
 
-        if (id->idProduct == USB_DEVICE_ID_I6050) {
+        switch (id->idProduct) {
+        case USB_DEVICE_ID_I6050:
+        case USB_DEVICE_ID_I6050_2:
+                i2400mu->i6050 = 1;
+                break;
+        default:
+                break;
+        }
+
+        if (i2400mu->i6050) {
                 i2400m->bus_fw_names = i2400mu_bus_fw_names_6050;
                 i2400mu->endpoint_cfg.bulk_out = 0;
                 i2400mu->endpoint_cfg.notification = 3;
@@ -719,6 +728,7 @@ int i2400mu_post_reset(struct usb_interface *iface)
 static
 struct usb_device_id i2400mu_id_table[] = {
         { USB_DEVICE(0x8086, USB_DEVICE_ID_I6050) },
+        { USB_DEVICE(0x8086, USB_DEVICE_ID_I6050_2) },
         { USB_DEVICE(0x8086, 0x0181) },
         { USB_DEVICE(0x8086, 0x1403) },
         { USB_DEVICE(0x8086, 0x1405) },
diff --git a/drivers/net/wireless/ath/ath5k/base.c b/drivers/net/wireless/ath/ath5k/base.c
index a4c086f069b1..e63b7c40d0ee 100644
--- a/drivers/net/wireless/ath/ath5k/base.c
+++ b/drivers/net/wireless/ath/ath5k/base.c
@@ -1903,17 +1903,6 @@ accept:
                 rxs->noise = sc->ah->ah_noise_floor;
                 rxs->signal = rxs->noise + rs.rs_rssi;
 
-                /* An rssi of 35 indicates you should be able use
-                 * 54 Mbps reliably. A more elaborate scheme can be used
-                 * here but it requires a map of SNR/throughput for each
-                 * possible mode used */
-                rxs->qual = rs.rs_rssi * 100 / 35;
-
-                /* rssi can be more than 35 though, anything above that
-                 * should be considered at 100% */
-                if (rxs->qual > 100)
-                        rxs->qual = 100;
-
                 rxs->antenna = rs.rs_antenna;
                 rxs->rate_idx = ath5k_hw_to_driver_rix(sc, rs.rs_rate);
                 rxs->flag |= ath5k_rx_decrypted(sc, ds, skb, &rs);
@@ -2381,6 +2370,9 @@ ath5k_init(struct ath5k_softc *sc)
          */
         ath5k_stop_locked(sc);
 
+        /* Set PHY calibration interval */
+        ah->ah_cal_intval = ath5k_calinterval;
+
         /*
          * The basic interface to setting the hardware in a good
          * state is ``reset''.  On return the hardware is known to
@@ -2408,10 +2400,6 @@ ath5k_init(struct ath5k_softc *sc)
 
         /* Set ack to be sent at low bit-rates */
         ath5k_hw_set_ack_bitrate_high(ah, false);
-
-        /* Set PHY calibration inteval */
-        ah->ah_cal_intval = ath5k_calinterval;
-
         ret = 0;
 done:
         mmiowb();
diff --git a/drivers/net/wireless/ath/ath5k/eeprom.c b/drivers/net/wireless/ath/ath5k/eeprom.c
index 5d1c8677f180..6a3f4da7fb48 100644
--- a/drivers/net/wireless/ath/ath5k/eeprom.c
+++ b/drivers/net/wireless/ath/ath5k/eeprom.c
@@ -97,7 +97,7 @@ ath5k_eeprom_init_header(struct ath5k_hw *ah)
         struct ath5k_eeprom_info *ee = &ah->ah_capabilities.cap_eeprom;
         int ret;
         u16 val;
-        u32 cksum, offset;
+        u32 cksum, offset, eep_max = AR5K_EEPROM_INFO_MAX;
 
         /*
          * Read values from EEPROM and store them in the capability structure
@@ -116,12 +116,38 @@ ath5k_eeprom_init_header(struct ath5k_hw *ah)
          * Validate the checksum of the EEPROM date. There are some
          * devices with invalid EEPROMs.
          */
-        for (cksum = 0, offset = 0; offset < AR5K_EEPROM_INFO_MAX; offset++) {
+        AR5K_EEPROM_READ(AR5K_EEPROM_SIZE_UPPER, val);
+        if (val) {
+                eep_max = (val & AR5K_EEPROM_SIZE_UPPER_MASK) <<
+                           AR5K_EEPROM_SIZE_ENDLOC_SHIFT;
+                AR5K_EEPROM_READ(AR5K_EEPROM_SIZE_LOWER, val);
+                eep_max = (eep_max | val) - AR5K_EEPROM_INFO_BASE;
+
+                /*
+                 * Fail safe check to prevent stupid loops due
+                 * to busted EEPROMs. XXX: This value is likely too
+                 * big still, waiting on a better value.
+                 */
+                if (eep_max > (3 * AR5K_EEPROM_INFO_MAX)) {
+                        ATH5K_ERR(ah->ah_sc, "Invalid max custom EEPROM size: "
+                                  "%d (0x%04x) max expected: %d (0x%04x)\n",
+                                  eep_max, eep_max,
+                                  3 * AR5K_EEPROM_INFO_MAX,
+                                  3 * AR5K_EEPROM_INFO_MAX);
+                        return -EIO;
+                }
+        }
+
+        for (cksum = 0, offset = 0; offset < eep_max; offset++) {
                 AR5K_EEPROM_READ(AR5K_EEPROM_INFO(offset), val);
                 cksum ^= val;
         }
         if (cksum != AR5K_EEPROM_INFO_CKSUM) {
-                ATH5K_ERR(ah->ah_sc, "Invalid EEPROM checksum 0x%04x\n", cksum);
+                ATH5K_ERR(ah->ah_sc, "Invalid EEPROM "
+                          "checksum: 0x%04x eep_max: 0x%04x (%s)\n",
+                          cksum, eep_max,
+                          eep_max == AR5K_EEPROM_INFO_MAX ?
+                                "default size" : "custom size");
                 return -EIO;
         }
 
diff --git a/drivers/net/wireless/ath/ath5k/eeprom.h b/drivers/net/wireless/ath/ath5k/eeprom.h
index 0123f3521a0b..473a483bb9c3 100644
--- a/drivers/net/wireless/ath/ath5k/eeprom.h
+++ b/drivers/net/wireless/ath/ath5k/eeprom.h
@@ -37,6 +37,14 @@
 #define AR5K_EEPROM_RFKILL_POLARITY_S   1
 
 #define AR5K_EEPROM_REG_DOMAIN          0x00bf  /* EEPROM regdom */
+
+/* FLASH(EEPROM) Defines for AR531X chips */
+#define AR5K_EEPROM_SIZE_LOWER          0x1b /* size info -- lower */
+#define AR5K_EEPROM_SIZE_UPPER          0x1c /* size info -- upper */
+#define AR5K_EEPROM_SIZE_UPPER_MASK     0xfff0
+#define AR5K_EEPROM_SIZE_UPPER_SHIFT    4
+#define AR5K_EEPROM_SIZE_ENDLOC_SHIFT   12
+
 #define AR5K_EEPROM_CHECKSUM            0x00c0  /* EEPROM checksum */
 #define AR5K_EEPROM_INFO_BASE           0x00c0  /* EEPROM header */
 #define AR5K_EEPROM_INFO_MAX            (0x400 - AR5K_EEPROM_INFO_BASE)
diff --git a/drivers/net/wireless/ath/ath9k/Kconfig b/drivers/net/wireless/ath/ath9k/Kconfig
index 03a1106ad725..5774cea23a3b 100644
--- a/drivers/net/wireless/ath/ath9k/Kconfig
+++ b/drivers/net/wireless/ath/ath9k/Kconfig
@@ -25,7 +25,7 @@ config ATH9K
 
 config ATH9K_DEBUGFS
         bool "Atheros ath9k debugging"
-        depends on ATH9K
+        depends on ATH9K && DEBUG_FS
         ---help---
           Say Y, if you need access to ath9k's statistics for
           interrupts, rate control, etc.
diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
index e2cef2ff5d8f..1597a42731ed 100644
--- a/drivers/net/wireless/ath/ath9k/ath9k.h
+++ b/drivers/net/wireless/ath/ath9k/ath9k.h
@@ -33,11 +33,11 @@ struct ath_node;
 
 /* Macro to expand scalars to 64-bit objects */
 
-#define ito64(x) (sizeof(x) == 8) ?                     \
+#define ito64(x) (sizeof(x) == 1) ?                     \
         (((unsigned long long int)(x)) & (0xff)) :      \
-        (sizeof(x) == 16) ?                             \
+        (sizeof(x) == 2) ?                              \
         (((unsigned long long int)(x)) & 0xffff) :      \
-        ((sizeof(x) == 32) ?                            \
+        ((sizeof(x) == 4) ?                             \
          (((unsigned long long int)(x)) & 0xffffffff) : \
          (unsigned long long int)(x))
 
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index 2ec61f08cfdb..ae371448b5a0 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -855,12 +855,11 @@ static void ath9k_hw_init_mode_gain_regs(struct ath_hw *ah)
         }
 }
 
-static void ath9k_hw_init_11a_eeprom_fix(struct ath_hw *ah)
+static void ath9k_hw_init_eeprom_fix(struct ath_hw *ah)
 {
         u32 i, j;
 
-        if ((ah->hw_version.devid == AR9280_DEVID_PCI) &&
-            test_bit(ATH9K_MODE_11A, ah->caps.wireless_modes)) {
+        if (ah->hw_version.devid == AR9280_DEVID_PCI) {
 
                 /* EEPROM Fixup */
                 for (i = 0; i < ah->iniModes.ia_rows; i++) {
@@ -980,7 +979,7 @@ int ath9k_hw_init(struct ath_hw *ah)
         if (r)
                 return r;
 
-        ath9k_hw_init_11a_eeprom_fix(ah);
+        ath9k_hw_init_eeprom_fix(ah);
 
         r = ath9k_hw_init_macaddr(ah);
         if (r) {
diff --git a/drivers/net/wireless/ath/ath9k/mac.c b/drivers/net/wireless/ath/ath9k/mac.c
index 71b84d91dcff..efc420cd42bf 100644
--- a/drivers/net/wireless/ath/ath9k/mac.c
+++ b/drivers/net/wireless/ath/ath9k/mac.c
@@ -186,7 +186,7 @@ bool ath9k_hw_stoptxdma(struct ath_hw *ah, u32 q)
                 wait = wait_time;
                 while (ath9k_hw_numtxpending(ah, q)) {
                         if ((--wait) == 0) {
-                                ath_print(common, ATH_DBG_QUEUE,
+                                ath_print(common, ATH_DBG_FATAL,
                                           "Failed to stop TX DMA in 100 "
                                           "msec after killing last frame\n");
                                 break;
diff --git a/drivers/net/wireless/ath/ath9k/mac.h b/drivers/net/wireless/ath/ath9k/mac.h
index 0c87771383f0..e185479e295e 100644
--- a/drivers/net/wireless/ath/ath9k/mac.h
+++ b/drivers/net/wireless/ath/ath9k/mac.h
@@ -77,6 +77,9 @@
 #define ATH9K_TXERR_XTXOP          0x08
 #define ATH9K_TXERR_TIMER_EXPIRED  0x10
 #define ATH9K_TX_ACKED             0x20
+#define ATH9K_TXERR_MASK                                                \
+        (ATH9K_TXERR_XRETRY | ATH9K_TXERR_FILT | ATH9K_TXERR_FIFO |     \
+         ATH9K_TXERR_XTXOP | ATH9K_TXERR_TIMER_EXPIRED)
 
 #define ATH9K_TX_BA                0x01
 #define ATH9K_TX_PWRMGMT           0x02
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index c48743452515..643bea35686f 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -1973,6 +1973,9 @@ int ath_reset(struct ath_softc *sc, bool retry_tx)
         struct ieee80211_hw *hw = sc->hw;
         int r;
 
+        /* Stop ANI */
+        del_timer_sync(&common->ani.timer);
+
         ath9k_hw_set_interrupts(ah, 0);
         ath_drain_all_txq(sc, retry_tx);
         ath_stoprecv(sc);
@@ -2014,6 +2017,9 @@ int ath_reset(struct ath_softc *sc, bool retry_tx)
                 }
         }
 
+        /* Start ANI */
+        ath_start_ani(common);
+
         return r;
 }
 
@@ -2508,6 +2514,9 @@ static void ath9k_stop(struct ieee80211_hw *hw)
                 return; /* another wiphy still in use */
         }
 
+        /* Ensure HW is awake when we try to shut it down. */
+        ath9k_ps_wakeup(sc);
+
         if (ah->btcoex_hw.enabled) {
                 ath9k_hw_btcoex_disable(ah);
                 if (ah->btcoex_hw.scheme == ATH_BTCOEX_CFG_3WIRE)
@@ -2528,6 +2537,9 @@ static void ath9k_stop(struct ieee80211_hw *hw)
         /* disable HAL and put h/w to sleep */
         ath9k_hw_disable(ah);
         ath9k_hw_configpcipowersave(ah, 1, 1);
+        ath9k_ps_restore(sc);
+
+        /* Finally, put the chip in FULL SLEEP mode */
         ath9k_setpower(sc, ATH9K_PM_FULL_SLEEP);
 
         sc->sc_flags |= SC_OP_INVALID;
@@ -2641,10 +2653,12 @@ static void ath9k_remove_interface(struct ieee80211_hw *hw,
         if ((sc->sc_ah->opmode == NL80211_IFTYPE_AP) ||
             (sc->sc_ah->opmode == NL80211_IFTYPE_ADHOC) ||
             (sc->sc_ah->opmode == NL80211_IFTYPE_MESH_POINT)) {
+                ath9k_ps_wakeup(sc);
                 ath9k_hw_stoptxdma(sc->sc_ah, sc->beacon.beaconq);
-                ath_beacon_return(sc, avp);
+                ath9k_ps_restore(sc);
         }
 
+        ath_beacon_return(sc, avp);
         sc->sc_flags &= ~SC_OP_BEACONS;
 
         for (i = 0; i < ARRAY_SIZE(sc->beacon.bslot); i++) {
@@ -3091,15 +3105,21 @@ static int ath9k_ampdu_action(struct ieee80211_hw *hw,
         case IEEE80211_AMPDU_RX_STOP:
                 break;
         case IEEE80211_AMPDU_TX_START:
+                ath9k_ps_wakeup(sc);
                 ath_tx_aggr_start(sc, sta, tid, ssn);
                 ieee80211_start_tx_ba_cb_irqsafe(vif, sta->addr, tid);
+                ath9k_ps_restore(sc);
                 break;
         case IEEE80211_AMPDU_TX_STOP:
+                ath9k_ps_wakeup(sc);
                 ath_tx_aggr_stop(sc, sta, tid);
                 ieee80211_stop_tx_ba_cb_irqsafe(vif, sta->addr, tid);
+                ath9k_ps_restore(sc);
                 break;
         case IEEE80211_AMPDU_TX_OPERATIONAL:
+                ath9k_ps_wakeup(sc);
                 ath_tx_aggr_resume(sc, sta, tid);
+                ath9k_ps_restore(sc);
                 break;
         default:
                 ath_print(ath9k_hw_common(sc->sc_ah), ATH_DBG_FATAL,
diff --git a/drivers/net/wireless/ath/ath9k/pci.c b/drivers/net/wireless/ath/ath9k/pci.c
index 5321f735e5a0..f7af5ea54753 100644
--- a/drivers/net/wireless/ath/ath9k/pci.c
+++ b/drivers/net/wireless/ath/ath9k/pci.c
@@ -96,7 +96,7 @@ static void ath_pci_bt_coex_prep(struct ath_common *common)
         pci_write_config_byte(pdev, ATH_PCIE_CAP_LINK_CTRL, aspm);
 }
 
-const static struct ath_bus_ops ath_pci_bus_ops = {
+static const struct ath_bus_ops ath_pci_bus_ops = {
         .read_cachesize = ath_pci_read_cachesize,
         .cleanup = ath_pci_cleanup,
         .eeprom_read = ath_pci_eeprom_read,
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index 2a11cc57ceea..29bf33692f71 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -1108,11 +1108,11 @@ void ath_drain_all_txq(struct ath_softc *sc, bool retry_tx)
         if (npend) {
                 int r;
 
-                ath_print(common, ATH_DBG_XMIT,
+                ath_print(common, ATH_DBG_FATAL,
                           "Unable to stop TxDMA. Reset HAL!\n");
 
                 spin_lock_bh(&sc->sc_resetlock);
-                r = ath9k_hw_reset(ah, sc->sc_ah->curchan, true);
+                r = ath9k_hw_reset(ah, sc->sc_ah->curchan, false);
                 if (r)
                         ath_print(common, ATH_DBG_FATAL,
                                   "Unable to reset hardware; reset status %d\n",
@@ -1414,17 +1414,9 @@ static void assign_aggr_tid_seqno(struct sk_buff *skb,
          * For HT capable stations, we save tidno for later use.
          * We also override seqno set by upper layer with the one
          * in tx aggregation state.
-         *
-         * If fragmentation is on, the sequence number is
-         * not overridden, since it has been
-         * incremented by the fragmentation routine.
-         *
-         * FIXME: check if the fragmentation threshold exceeds
-         * IEEE80211 max.
          */
         tid = ATH_AN_2_TID(an, bf->bf_tidno);
-        hdr->seq_ctrl = cpu_to_le16(tid->seq_next <<
-                        IEEE80211_SEQ_SEQ_SHIFT);
+        hdr->seq_ctrl = cpu_to_le16(tid->seq_next << IEEE80211_SEQ_SEQ_SHIFT);
         bf->bf_seqno = tid->seq_next;
         INCR(tid->seq_next, IEEE80211_SEQ_MAX);
 }
@@ -1623,7 +1615,7 @@ static int ath_tx_setup_buffer(struct ieee80211_hw *hw, struct ath_buf *bf,
                 bf->bf_frmlen -= padsize;
         }
 
-        if (conf_is_ht(&hw->conf) && !is_pae(skb))
+        if (conf_is_ht(&hw->conf))
                 bf->bf_state.bf_type |= BUF_HT;
 
         bf->bf_flags = setup_tx_flags(sc, skb, txctl->txq);
@@ -1636,7 +1628,8 @@ static int ath_tx_setup_buffer(struct ieee80211_hw *hw, struct ath_buf *bf,
                 bf->bf_keyix = ATH9K_TXKEYIX_INVALID;
         }
 
-        if (ieee80211_is_data_qos(fc) && (sc->sc_flags & SC_OP_TXAGGR))
+        if (ieee80211_is_data_qos(fc) && bf_isht(bf) &&
+            (sc->sc_flags & SC_OP_TXAGGR))
                 assign_aggr_tid_seqno(skb, bf);
 
         bf->bf_mpdu = skb;
@@ -1708,7 +1701,7 @@ static void ath_tx_start_dma(struct ath_softc *sc, struct ath_buf *bf,
                         goto tx_done;
                 }
 
-                if (tx_info->flags & IEEE80211_TX_CTL_AMPDU) {
+                if ((tx_info->flags & IEEE80211_TX_CTL_AMPDU) && !is_pae(skb)) {
                         /*
                          * Try aggregation if it's a unicast data frame
                          * and the destination is HT capable.
@@ -1780,7 +1773,8 @@ void ath_tx_cabq(struct ieee80211_hw *hw, struct sk_buff *skb)
         struct ath_wiphy *aphy = hw->priv;
         struct ath_softc *sc = aphy->sc;
         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
-        int hdrlen, padsize;
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
+        int padpos, padsize;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         struct ath_tx_control txctl;
 
@@ -1792,7 +1786,6 @@ void ath_tx_cabq(struct ieee80211_hw *hw, struct sk_buff *skb)
          * BSSes.
          */
         if (info->flags & IEEE80211_TX_CTL_ASSIGN_SEQ) {
-                struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
                 if (info->flags & IEEE80211_TX_CTL_FIRST_FRAGMENT)
                         sc->tx.seq_no += 0x10;
                 hdr->seq_ctrl &= cpu_to_le16(IEEE80211_SCTL_FRAG);
@@ -1800,9 +1793,9 @@ void ath_tx_cabq(struct ieee80211_hw *hw, struct sk_buff *skb)
         }
 
         /* Add the padding after the header if this is not already done */
-        hdrlen = ieee80211_get_hdrlen_from_skb(skb);
-        if (hdrlen & 3) {
-                padsize = hdrlen % 4;
+        padpos = ath9k_cmn_padpos(hdr->frame_control);
+        padsize = padpos & 3;
+        if (padsize && skb->len>padpos) {
                 if (skb_headroom(skb) < padsize) {
                         ath_print(common, ATH_DBG_XMIT,
                                   "TX CABQ padding failed\n");
@@ -1810,7 +1803,7 @@ void ath_tx_cabq(struct ieee80211_hw *hw, struct sk_buff *skb)
                         return;
                 }
                 skb_push(skb, padsize);
-                memmove(skb->data, skb->data + padsize, hdrlen);
+                memmove(skb->data, skb->data + padsize, padpos);
         }
 
         txctl.txq = sc->beacon.cabq;
@@ -1838,7 +1831,8 @@ static void ath_tx_complete(struct ath_softc *sc, struct sk_buff *skb,
         struct ieee80211_hw *hw = sc->hw;
         struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
-        int hdrlen, padsize;
+        struct ieee80211_hdr * hdr = (struct ieee80211_hdr *)skb->data;
+        int padpos, padsize;
 
         ath_print(common, ATH_DBG_XMIT, "TX complete: skb: %p\n", skb);
 
@@ -1853,14 +1847,14 @@ static void ath_tx_complete(struct ath_softc *sc, struct sk_buff *skb,
                 tx_info->flags |= IEEE80211_TX_STAT_ACK;
         }
 
-        hdrlen = ieee80211_get_hdrlen_from_skb(skb);
-        padsize = hdrlen & 3;
-        if (padsize && hdrlen >= 24) {
+        padpos = ath9k_cmn_padpos(hdr->frame_control);
+        padsize = padpos & 3;
+        if (padsize && skb->len>padpos+padsize) {
                 /*
                  * Remove MAC header padding before giving the frame back to
                  * mac80211.
                  */
-                memmove(skb->data + padsize, skb->data, hdrlen);
+                memmove(skb->data + padsize, skb->data, padpos);
                 skb_pull(skb, padsize);
         }
 
@@ -2078,7 +2072,7 @@ static void ath_tx_processq(struct ath_softc *sc, struct ath_txq *txq)
                                 &txq->axq_q, lastbf->list.prev);
 
                 txq->axq_depth--;
-                txok = !(ds->ds_txstat.ts_status & ATH9K_TXERR_FILT);
+                txok = !(ds->ds_txstat.ts_status & ATH9K_TXERR_MASK);
                 txq->axq_tx_inprogress = false;
                 spin_unlock_bh(&txq->axq_lock);
 
diff --git a/drivers/net/wireless/b43/b43.h b/drivers/net/wireless/b43/b43.h
index fe3bf9491997..c484cc253892 100644
--- a/drivers/net/wireless/b43/b43.h
+++ b/drivers/net/wireless/b43/b43.h
@@ -115,6 +115,7 @@
 #define B43_MMIO_TSF_2                  0x636   /* core rev < 3 only */
 #define B43_MMIO_TSF_3                  0x638   /* core rev < 3 only */
 #define B43_MMIO_RNG                    0x65A
+#define B43_MMIO_IFSSLOT                0x684   /* Interframe slot time */
 #define B43_MMIO_IFSCTL                 0x688 /* Interframe space control */
 #define  B43_MMIO_IFSCTL_USE_EDCF       0x0004
 #define B43_MMIO_POWERUP_DELAY          0x6A8
diff --git a/drivers/net/wireless/b43/dma.c b/drivers/net/wireless/b43/dma.c
index 027be275e035..88d1fd02d40a 100644
--- a/drivers/net/wireless/b43/dma.c
+++ b/drivers/net/wireless/b43/dma.c
@@ -383,160 +383,44 @@ static inline
         }
 }
 
-/* Check if a DMA region fits the device constraints.
- * Returns true, if the region is OK for usage with this device. */
-static inline bool b43_dma_address_ok(struct b43_dmaring *ring,
-                                      dma_addr_t addr, size_t size)
-{
-        switch (ring->type) {
-        case B43_DMA_30BIT:
-                if ((u64)addr + size > (1ULL << 30))
-                        return 0;
-                break;
-        case B43_DMA_32BIT:
-                if ((u64)addr + size > (1ULL << 32))
-                        return 0;
-                break;
-        case B43_DMA_64BIT:
-                /* Currently we can't have addresses beyond
-                 * 64bit in the kernel. */
-                break;
-        }
-        return 1;
-}
-
-#define is_4k_aligned(addr)     (((u64)(addr) & 0x0FFFull) == 0)
-#define is_8k_aligned(addr)     (((u64)(addr) & 0x1FFFull) == 0)
-
-static void b43_unmap_and_free_ringmem(struct b43_dmaring *ring, void *base,
-                                       dma_addr_t dmaaddr, size_t size)
-{
-        ssb_dma_unmap_single(ring->dev->dev, dmaaddr, size, DMA_TO_DEVICE);
-        free_pages((unsigned long)base, get_order(size));
-}
-
-static void * __b43_get_and_map_ringmem(struct b43_dmaring *ring,
-                                        dma_addr_t *dmaaddr, size_t size,
-                                        gfp_t gfp_flags)
-{
-        void *base;
-
-        base = (void *)__get_free_pages(gfp_flags, get_order(size));
-        if (!base)
-                return NULL;
-        memset(base, 0, size);
-        *dmaaddr = ssb_dma_map_single(ring->dev->dev, base, size,
-                                      DMA_TO_DEVICE);
-        if (ssb_dma_mapping_error(ring->dev->dev, *dmaaddr)) {
-                free_pages((unsigned long)base, get_order(size));
-                return NULL;
-        }
-
-        return base;
-}
-
-static void * b43_get_and_map_ringmem(struct b43_dmaring *ring,
-                                      dma_addr_t *dmaaddr, size_t size)
-{
-        void *base;
-
-        base = __b43_get_and_map_ringmem(ring, dmaaddr, size,
-                                         GFP_KERNEL);
-        if (!base) {
-                b43err(ring->dev->wl, "Failed to allocate or map pages "
-                       "for DMA ringmemory\n");
-                return NULL;
-        }
-        if (!b43_dma_address_ok(ring, *dmaaddr, size)) {
-                /* The memory does not fit our device constraints.
-                 * Retry with GFP_DMA set to get lower memory. */
-                b43_unmap_and_free_ringmem(ring, base, *dmaaddr, size);
-                base = __b43_get_and_map_ringmem(ring, dmaaddr, size,
-                                                 GFP_KERNEL | GFP_DMA);
-                if (!base) {
-                        b43err(ring->dev->wl, "Failed to allocate or map pages "
-                               "in the GFP_DMA region for DMA ringmemory\n");
-                        return NULL;
-                }
-                if (!b43_dma_address_ok(ring, *dmaaddr, size)) {
-                        b43_unmap_and_free_ringmem(ring, base, *dmaaddr, size);
-                        b43err(ring->dev->wl, "Failed to allocate DMA "
-                               "ringmemory that fits device constraints\n");
-                        return NULL;
-                }
-        }
-        /* We expect the memory to be 4k aligned, at least. */
-        if (B43_WARN_ON(!is_4k_aligned(*dmaaddr))) {
-                b43_unmap_and_free_ringmem(ring, base, *dmaaddr, size);
-                return NULL;
-        }
-
-        return base;
-}
-
 static int alloc_ringmemory(struct b43_dmaring *ring)
 {
-        unsigned int required;
-        void *base;
-        dma_addr_t dmaaddr;
-
-        /* There are several requirements to the descriptor ring memory:
-         * - The memory region needs to fit the address constraints for the
-         *   device (same as for frame buffers).
-         * - For 30/32bit DMA devices, the descriptor ring must be 4k aligned.
-         * - For 64bit DMA devices, the descriptor ring must be 8k aligned.
+        gfp_t flags = GFP_KERNEL;
+
+        /* The specs call for 4K buffers for 30- and 32-bit DMA with 4K
+         * alignment and 8K buffers for 64-bit DMA with 8K alignment. Testing
+         * has shown that 4K is sufficient for the latter as long as the buffer
+         * does not cross an 8K boundary.
+         *
+         * For unknown reasons - possibly a hardware error - the BCM4311 rev
+         * 02, which uses 64-bit DMA, needs the ring buffer in very low memory,
+         * which accounts for the GFP_DMA flag below.
+         *
+         * The flags here must match the flags in free_ringmemory below!
          */
-
         if (ring->type == B43_DMA_64BIT)
-                required = ring->nr_slots * sizeof(struct b43_dmadesc64);
-        else
-                required = ring->nr_slots * sizeof(struct b43_dmadesc32);
-        if (B43_WARN_ON(required > 0x1000))
+                flags |= GFP_DMA;
+        ring->descbase = ssb_dma_alloc_consistent(ring->dev->dev,
+                                                  B43_DMA_RINGMEMSIZE,
+                                                  &(ring->dmabase), flags);
+        if (!ring->descbase) {
+                b43err(ring->dev->wl, "DMA ringmemory allocation failed\n");
                 return -ENOMEM;
-
-        ring->alloc_descsize = 0x1000;
-        base = b43_get_and_map_ringmem(ring, &dmaaddr, ring->alloc_descsize);
-        if (!base)
-                return -ENOMEM;
-        ring->alloc_descbase = base;
-        ring->alloc_dmabase = dmaaddr;
-
-        if ((ring->type != B43_DMA_64BIT) || is_8k_aligned(dmaaddr)) {
-                /* We're on <=32bit DMA, or we already got 8k aligned memory.
-                 * That's all we need, so we're fine. */
-                ring->descbase = base;
-                ring->dmabase = dmaaddr;
-                return 0;
-        }
-        b43_unmap_and_free_ringmem(ring, base, dmaaddr, ring->alloc_descsize);
-
-        /* Ok, we failed at the 8k alignment requirement.
-         * Try to force-align the memory region now. */
-        ring->alloc_descsize = 0x2000;
-        base = b43_get_and_map_ringmem(ring, &dmaaddr, ring->alloc_descsize);
-        if (!base)
-                return -ENOMEM;
-        ring->alloc_descbase = base;
-        ring->alloc_dmabase = dmaaddr;
-
-        if (is_8k_aligned(dmaaddr)) {
-                /* We're already 8k aligned. That Ok, too. */
-                ring->descbase = base;
-                ring->dmabase = dmaaddr;
-                return 0;
         }
-        /* Force-align it to 8k */
-        ring->descbase = (void *)((u8 *)base + 0x1000);
-        ring->dmabase = dmaaddr + 0x1000;
-        B43_WARN_ON(!is_8k_aligned(ring->dmabase));
+        memset(ring->descbase, 0, B43_DMA_RINGMEMSIZE);
 
         return 0;
 }
 
 static void free_ringmemory(struct b43_dmaring *ring)
 {
-        b43_unmap_and_free_ringmem(ring, ring->alloc_descbase,
-                                   ring->alloc_dmabase, ring->alloc_descsize);
+        gfp_t flags = GFP_KERNEL;
+
+        if (ring->type == B43_DMA_64BIT)
+                flags |= GFP_DMA;
+
+        ssb_dma_free_consistent(ring->dev->dev, B43_DMA_RINGMEMSIZE,
+                                ring->descbase, ring->dmabase, flags);
 }
 
 /* Reset the RX DMA channel */
@@ -646,14 +530,29 @@ static bool b43_dma_mapping_error(struct b43_dmaring *ring,
         if (unlikely(ssb_dma_mapping_error(ring->dev->dev, addr)))
                 return 1;
 
-        if (!b43_dma_address_ok(ring, addr, buffersize)) {
-                /* We can't support this address. Unmap it again. */
-                unmap_descbuffer(ring, addr, buffersize, dma_to_device);
-                return 1;
+        switch (ring->type) {
+        case B43_DMA_30BIT:
+                if ((u64)addr + buffersize > (1ULL << 30))
+                        goto address_error;
+                break;
+        case B43_DMA_32BIT:
+                if ((u64)addr + buffersize > (1ULL << 32))
+                        goto address_error;
+                break;
+        case B43_DMA_64BIT:
+                /* Currently we can't have addresses beyond
+                 * 64bit in the kernel. */
+                break;
         }
 
         /* The address is OK. */
         return 0;
+
+address_error:
+        /* We can't support this address. Unmap it again. */
+        unmap_descbuffer(ring, addr, buffersize, dma_to_device);
+
+        return 1;
 }
 
 static bool b43_rx_buffer_is_poisoned(struct b43_dmaring *ring, struct sk_buff *skb)
@@ -715,9 +614,6 @@ static int setup_rx_descbuffer(struct b43_dmaring *ring,
         meta->dmaaddr = dmaaddr;
         ring->ops->fill_descriptor(ring, desc, dmaaddr,
                                    ring->rx_buffersize, 0, 0, 0);
-        ssb_dma_sync_single_for_device(ring->dev->dev,
-                                       ring->alloc_dmabase,
-                                       ring->alloc_descsize, DMA_TO_DEVICE);
 
         return 0;
 }
@@ -1354,9 +1250,6 @@ static int dma_tx_fragment(struct b43_dmaring *ring,
         }
         /* Now transfer the whole frame. */
         wmb();
-        ssb_dma_sync_single_for_device(ring->dev->dev,
-                                       ring->alloc_dmabase,
-                                       ring->alloc_descsize, DMA_TO_DEVICE);
         ops->poke_tx(ring, next_slot(ring, slot));
         return 0;
 
diff --git a/drivers/net/wireless/b43/dma.h b/drivers/net/wireless/b43/dma.h
index e607b392314c..f7ab37c4cdbc 100644
--- a/drivers/net/wireless/b43/dma.h
+++ b/drivers/net/wireless/b43/dma.h
@@ -157,6 +157,7 @@ struct b43_dmadesc_generic {
 } __attribute__ ((__packed__));
 
 /* Misc DMA constants */
+#define B43_DMA_RINGMEMSIZE             PAGE_SIZE
 #define B43_DMA0_RX_FRAMEOFFSET         30
 
 /* DMA engine tuning knobs */
@@ -246,12 +247,6 @@ struct b43_dmaring {
         /* The QOS priority assigned to this ring. Only used for TX rings.
          * This is the mac80211 "queue" value. */
         u8 queue_prio;
-        /* Pointers and size of the originally allocated and mapped memory
-         * region for the descriptor ring. */
-        void *alloc_descbase;
-        dma_addr_t alloc_dmabase;
-        unsigned int alloc_descsize;
-        /* Pointer to our wireless device. */
         struct b43_wldev *dev;
 #ifdef CONFIG_B43_DEBUG
         /* Maximum number of used slots. */
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index 4c41cfe44f26..490fb45d1d05 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -628,10 +628,17 @@ static void b43_upload_card_macaddress(struct b43_wldev *dev)
 static void b43_set_slot_time(struct b43_wldev *dev, u16 slot_time)
 {
         /* slot_time is in usec. */
-        if (dev->phy.type != B43_PHYTYPE_G)
+        /* This test used to exit for all but a G PHY. */
+        if (b43_current_band(dev->wl) == IEEE80211_BAND_5GHZ)
                 return;
-        b43_write16(dev, 0x684, 510 + slot_time);
-        b43_shm_write16(dev, B43_SHM_SHARED, 0x0010, slot_time);
+        b43_write16(dev, B43_MMIO_IFSSLOT, 510 + slot_time);
+        /* Shared memory location 0x0010 is the slot time and should be
+         * set to slot_time; however, this register is initially 0 and changing
+         * the value adversely affects the transmit rate for BCM4311
+         * devices. Until this behavior is unterstood, delete this step
+         *
+         * b43_shm_write16(dev, B43_SHM_SHARED, 0x0010, slot_time);
+         */
 }
 
 static void b43_short_slot_timing_enable(struct b43_wldev *dev)
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945.c b/drivers/net/wireless/iwlwifi/iwl-3945.c
index 7da1dab933d9..234891d8cc10 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945.c
+++ b/drivers/net/wireless/iwlwifi/iwl-3945.c
@@ -681,19 +681,13 @@ static void iwl3945_rx_reply_rx(struct iwl_priv *priv,
                 snr = rx_stats_sig_avg / rx_stats_noise_diff;
                 rx_status.noise = rx_status.signal -
                                         iwl3945_calc_db_from_ratio(snr);
-                rx_status.qual = iwl3945_calc_sig_qual(rx_status.signal,
-                                                         rx_status.noise);
-
-        /* If noise info not available, calculate signal quality indicator (%)
-         *   using just the dBm signal level. */
         } else {
                 rx_status.noise = priv->last_rx_noise;
-                rx_status.qual = iwl3945_calc_sig_qual(rx_status.signal, 0);
         }
 
 
-        IWL_DEBUG_STATS(priv, "Rssi %d noise %d qual %d sig_avg %d noise_diff %d\n",
-                        rx_status.signal, rx_status.noise, rx_status.qual,
+        IWL_DEBUG_STATS(priv, "Rssi %d noise %d sig_avg %d noise_diff %d\n",
+                        rx_status.signal, rx_status.noise,
                         rx_stats_sig_avg, rx_stats_noise_diff);
 
         header = (struct ieee80211_hdr *)IWL_RX_DATA(pkt);
@@ -1835,8 +1829,7 @@ static int iwl3945_send_rxon_assoc(struct iwl_priv *priv)
                 rc = -EIO;
         }
 
-        priv->alloc_rxb_page--;
-        free_pages(cmd.reply_page, priv->hw_params.rx_page_order);
+        iwl_free_pages(priv, cmd.reply_page);
 
         return rc;
 }
@@ -2836,6 +2829,7 @@ static struct iwl_cfg iwl3945_bg_cfg = {
         .use_isr_legacy = true,
         .ht_greenfield_support = false,
         .led_compensation = 64,
+        .broken_powersave = true,
 };
 
 static struct iwl_cfg iwl3945_abg_cfg = {
@@ -2852,6 +2846,7 @@ static struct iwl_cfg iwl3945_abg_cfg = {
         .use_isr_legacy = true,
         .ht_greenfield_support = false,
         .led_compensation = 64,
+        .broken_powersave = true,
 };
 
 struct pci_device_id iwl3945_hw_card_ids[] = {
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945.h b/drivers/net/wireless/iwlwifi/iwl-3945.h
index ecc23ec1f6a4..531fa125f5a6 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945.h
+++ b/drivers/net/wireless/iwlwifi/iwl-3945.h
@@ -222,7 +222,6 @@ struct iwl3945_ibss_seq {
  *
  *****************************************************************************/
 extern int iwl3945_calc_db_from_ratio(int sig_ratio);
-extern int iwl3945_calc_sig_qual(int rssi_dbm, int noise_dbm);
 extern void iwl3945_rx_replenish(void *data);
 extern void iwl3945_rx_queue_reset(struct iwl_priv *priv, struct iwl_rx_queue *rxq);
 extern unsigned int iwl3945_fill_beacon_frame(struct iwl_priv *priv,
diff --git a/drivers/net/wireless/iwlwifi/iwl-4965.c b/drivers/net/wireless/iwlwifi/iwl-4965.c
index 386513b601f5..31462813bac0 100644
--- a/drivers/net/wireless/iwlwifi/iwl-4965.c
+++ b/drivers/net/wireless/iwlwifi/iwl-4965.c
@@ -1204,7 +1204,7 @@ static int iwl4965_fill_txpower_tbl(struct iwl_priv *priv, u8 band, u16 channel,
         iwl4965_interpolate_chan(priv, channel, &ch_eeprom_info);
 
         /* calculate tx gain adjustment based on power supply voltage */
-        voltage = priv->calib_info->voltage;
+        voltage = le16_to_cpu(priv->calib_info->voltage);
         init_voltage = (s32)le32_to_cpu(priv->card_alive_init.voltage);
         voltage_compensation =
             iwl4965_get_voltage_compensation(voltage, init_voltage);
@@ -1961,7 +1961,7 @@ static void iwl4965_rx_reply_tx(struct iwl_priv *priv,
         struct ieee80211_tx_info *info;
         struct iwl4965_tx_resp *tx_resp = (void *)&pkt->u.raw[0];
         u32  status = le32_to_cpu(tx_resp->u.status);
-        int tid = MAX_TID_COUNT;
+        int uninitialized_var(tid);
         int sta_id;
         int freed;
         u8 *qc = NULL;
@@ -2008,7 +2008,7 @@ static void iwl4965_rx_reply_tx(struct iwl_priv *priv,
                         IWL_DEBUG_TX_REPLY(priv, "Retry scheduler reclaim scd_ssn "
                                            "%d index %d\n", scd_ssn , index);
                         freed = iwl_tx_queue_reclaim(priv, txq_id, index);
-                        priv->stations[sta_id].tid[tid].tfds_in_queue -= freed;
+                        iwl_free_tfds_in_queue(priv, sta_id, tid, freed);
 
                         if (priv->mac80211_registered &&
                             (iwl_queue_space(&txq->q) > txq->q.low_mark) &&
diff --git a/drivers/net/wireless/iwlwifi/iwl-5000-hw.h b/drivers/net/wireless/iwlwifi/iwl-5000-hw.h
index 4ef6804a455a..bc056e9ab85f 100644
--- a/drivers/net/wireless/iwlwifi/iwl-5000-hw.h
+++ b/drivers/net/wireless/iwlwifi/iwl-5000-hw.h
@@ -92,11 +92,15 @@
 
 static inline s32 iwl_temp_calib_to_offset(struct iwl_priv *priv)
 {
-        u16 *temp_calib = (u16 *)iwl_eeprom_query_addr(priv,
-                                                       EEPROM_5000_TEMPERATURE);
-        /* offset =  temperature -  voltage / coef */
-        s32 offset = (s32)(temp_calib[0] - temp_calib[1] / IWL_5150_VOLTAGE_TO_TEMPERATURE_COEFF);
-        return offset;
+        u16 temperature, voltage;
+        __le16 *temp_calib =
+                (__le16 *)iwl_eeprom_query_addr(priv, EEPROM_5000_TEMPERATURE);
+
+        temperature = le16_to_cpu(temp_calib[0]);
+        voltage = le16_to_cpu(temp_calib[1]);
+
+        /* offset = temp - volt / coeff */
+        return (s32)(temperature - voltage / IWL_5150_VOLTAGE_TO_TEMPERATURE_COEFF);
 }
 
 /* Fixed (non-configurable) rx data from phy */
diff --git a/drivers/net/wireless/iwlwifi/iwl-5000.c b/drivers/net/wireless/iwlwifi/iwl-5000.c
index e2f8615c8c9b..cffaae772d51 100644
--- a/drivers/net/wireless/iwlwifi/iwl-5000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-5000.c
@@ -333,14 +333,15 @@ static void iwl5000_set_ct_threshold(struct iwl_priv *priv)
 static int iwl5000_set_Xtal_calib(struct iwl_priv *priv)
 {
         struct iwl_calib_xtal_freq_cmd cmd;
-        u16 *xtal_calib = (u16 *)iwl_eeprom_query_addr(priv, EEPROM_5000_XTAL);
+        __le16 *xtal_calib =
+                (__le16 *)iwl_eeprom_query_addr(priv, EEPROM_5000_XTAL);
 
         cmd.hdr.op_code = IWL_PHY_CALIBRATE_CRYSTAL_FRQ_CMD;
         cmd.hdr.first_group = 0;
         cmd.hdr.groups_num = 1;
         cmd.hdr.data_valid = 1;
-        cmd.cap_pin1 = (u8)xtal_calib[0];
-        cmd.cap_pin2 = (u8)xtal_calib[1];
+        cmd.cap_pin1 = le16_to_cpu(xtal_calib[0]);
+        cmd.cap_pin2 = le16_to_cpu(xtal_calib[1]);
         return iwl_calib_set(&priv->calib_results[IWL_CALIB_XTAL],
                              (u8 *)&cmd, sizeof(cmd));
 }
@@ -1124,7 +1125,7 @@ static void iwl5000_rx_reply_tx(struct iwl_priv *priv,
                                         scd_ssn , index, txq_id, txq->swq_id);
 
                         freed = iwl_tx_queue_reclaim(priv, txq_id, index);
-                        priv->stations[sta_id].tid[tid].tfds_in_queue -= freed;
+                        iwl_free_tfds_in_queue(priv, sta_id, tid, freed);
 
                         if (priv->mac80211_registered &&
                             (iwl_queue_space(&txq->q) > txq->q.low_mark) &&
@@ -1152,16 +1153,14 @@ static void iwl5000_rx_reply_tx(struct iwl_priv *priv,
                                    tx_resp->failure_frame);
 
                 freed = iwl_tx_queue_reclaim(priv, txq_id, index);
-                if (ieee80211_is_data_qos(tx_resp->frame_ctrl))
-                        priv->stations[sta_id].tid[tid].tfds_in_queue -= freed;
+                iwl_free_tfds_in_queue(priv, sta_id, tid, freed);
 
                 if (priv->mac80211_registered &&
                     (iwl_queue_space(&txq->q) > txq->q.low_mark))
                         iwl_wake_queue(priv, txq_id);
         }
 
-        if (ieee80211_is_data_qos(tx_resp->frame_ctrl))
-                iwl_txq_check_empty(priv, sta_id, tid, txq_id);
+        iwl_txq_check_empty(priv, sta_id, tid, txq_id);
 
         if (iwl_check_bits(status, TX_ABORT_REQUIRED_MSK))
                 IWL_ERR(priv, "TODO:  Implement Tx ABORT REQUIRED!!!\n");
@@ -1597,6 +1596,7 @@ struct iwl_cfg iwl5300_agn_cfg = {
         .use_bsm = false,
         .ht_greenfield_support = true,
         .led_compensation = 51,
+        .use_rts_for_ht = true, /* use rts/cts protection */
         .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
         .sm_ps_mode = WLAN_HT_CAP_SM_PS_DISABLED,
 };
@@ -1621,6 +1621,7 @@ struct iwl_cfg iwl5100_bgn_cfg = {
         .use_bsm = false,
         .ht_greenfield_support = true,
         .led_compensation = 51,
+        .use_rts_for_ht = true, /* use rts/cts protection */
         .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
 };
 
@@ -1666,6 +1667,7 @@ struct iwl_cfg iwl5100_agn_cfg = {
         .use_bsm = false,
         .ht_greenfield_support = true,
         .led_compensation = 51,
+        .use_rts_for_ht = true, /* use rts/cts protection */
         .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
         .sm_ps_mode = WLAN_HT_CAP_SM_PS_DISABLED,
 };
@@ -1690,6 +1692,7 @@ struct iwl_cfg iwl5350_agn_cfg = {
         .use_bsm = false,
         .ht_greenfield_support = true,
         .led_compensation = 51,
+        .use_rts_for_ht = true, /* use rts/cts protection */
         .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
         .sm_ps_mode = WLAN_HT_CAP_SM_PS_DISABLED,
 };
@@ -1714,6 +1717,7 @@ struct iwl_cfg iwl5150_agn_cfg = {
         .use_bsm = false,
         .ht_greenfield_support = true,
         .led_compensation = 51,
+        .use_rts_for_ht = true, /* use rts/cts protection */
         .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
         .sm_ps_mode = WLAN_HT_CAP_SM_PS_DISABLED,
 };
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
index fe511cbf012e..b93e49158196 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
@@ -150,7 +150,7 @@ static s32 expected_tpt_mimo3_40MHz[4][IWL_RATE_COUNT] = {
 };
 
 /* mbps, mcs */
-const static struct iwl_rate_mcs_info iwl_rate_mcs[IWL_RATE_COUNT] = {
+static const struct iwl_rate_mcs_info iwl_rate_mcs[IWL_RATE_COUNT] = {
         {  "1", "BPSK DSSS"},
         {  "2", "QPSK DSSS"},
         {"5.5", "BPSK CCK"},
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index b8377efb3ba7..1c9866daf815 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -1842,7 +1842,7 @@ void iwl_dump_nic_event_log(struct iwl_priv *priv, bool full_log)
         }
 
 #ifdef CONFIG_IWLWIFI_DEBUG
-        if (!(iwl_get_debug_level(priv) & IWL_DL_FW_ERRORS))
+        if (!(iwl_get_debug_level(priv) & IWL_DL_FW_ERRORS) && !full_log)
                 size = (size > DEFAULT_DUMP_EVENT_LOG_ENTRIES)
                         ? DEFAULT_DUMP_EVENT_LOG_ENTRIES : size;
 #else
@@ -3173,7 +3173,6 @@ static int iwl_init_drv(struct iwl_priv *priv)
 
         priv->ibss_beacon = NULL;
 
-        spin_lock_init(&priv->lock);
         spin_lock_init(&priv->sta_lock);
         spin_lock_init(&priv->hcmd_lock);
 
@@ -3361,10 +3360,11 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
                 (unsigned long long) pci_resource_len(pdev, 0));
         IWL_DEBUG_INFO(priv, "pci_resource_base = %p\n", priv->hw_base);
 
-        /* this spin lock will be used in apm_ops.init and EEPROM access
+        /* these spin locks will be used in apm_ops.init and EEPROM access
          * we should init now
          */
         spin_lock_init(&priv->reg_lock);
+        spin_lock_init(&priv->lock);
         iwl_hw_detect(priv);
         IWL_INFO(priv, "Detected Intel Wireless WiFi Link %s REV=0x%X\n",
                 priv->cfg->name, priv->hw_rev);
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.c b/drivers/net/wireless/iwlwifi/iwl-core.c
index 574d36658702..f36f804804fc 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.c
+++ b/drivers/net/wireless/iwlwifi/iwl-core.c
@@ -2344,6 +2344,21 @@ static void iwl_ht_conf(struct iwl_priv *priv,
         IWL_DEBUG_MAC80211(priv, "leave\n");
 }
 
+static inline void iwl_set_no_assoc(struct iwl_priv *priv)
+{
+        priv->assoc_id = 0;
+        iwl_led_disassociate(priv);
+        /*
+         * inform the ucode that there is no longer an
+         * association and that no more packets should be
+         * sent
+         */
+        priv->staging_rxon.filter_flags &=
+                ~RXON_FILTER_ASSOC_MSK;
+        priv->staging_rxon.assoc_id = 0;
+        iwlcore_commit_rxon(priv);
+}
+
 #define IWL_DELAY_NEXT_SCAN_AFTER_ASSOC (HZ*6)
 void iwl_bss_info_changed(struct ieee80211_hw *hw,
                           struct ieee80211_vif *vif,
@@ -2475,20 +2490,8 @@ void iwl_bss_info_changed(struct ieee80211_hw *hw,
                                         IWL_DELAY_NEXT_SCAN_AFTER_ASSOC;
                         if (!iwl_is_rfkill(priv))
                                 priv->cfg->ops->lib->post_associate(priv);
-                } else {
-                        priv->assoc_id = 0;
-                        iwl_led_disassociate(priv);
-
-                        /*
-                         * inform the ucode that there is no longer an
-                         * association and that no more packets should be
-                         * send
-                         */
-                        priv->staging_rxon.filter_flags &=
-                                ~RXON_FILTER_ASSOC_MSK;
-                        priv->staging_rxon.assoc_id = 0;
-                        iwlcore_commit_rxon(priv);
-                }
+                } else
+                        iwl_set_no_assoc(priv);
         }
 
         if (changes && iwl_is_associated(priv) && priv->assoc_id) {
@@ -2503,12 +2506,14 @@ void iwl_bss_info_changed(struct ieee80211_hw *hw,
                 }
         }
 
-        if ((changes & BSS_CHANGED_BEACON_ENABLED) &&
-            vif->bss_conf.enable_beacon) {
-                memcpy(priv->staging_rxon.bssid_addr,
-                       bss_conf->bssid, ETH_ALEN);
-                memcpy(priv->bssid, bss_conf->bssid, ETH_ALEN);
-                iwlcore_config_ap(priv);
+        if (changes & BSS_CHANGED_BEACON_ENABLED) {
+                if (vif->bss_conf.enable_beacon) {
+                        memcpy(priv->staging_rxon.bssid_addr,
+                               bss_conf->bssid, ETH_ALEN);
+                        memcpy(priv->bssid, bss_conf->bssid, ETH_ALEN);
+                        iwlcore_config_ap(priv);
+                } else
+                        iwl_set_no_assoc(priv);
         }
 
         mutex_unlock(&priv->mutex);
@@ -2740,6 +2745,7 @@ int iwl_mac_config(struct ieee80211_hw *hw, u32 changed)
                         priv->staging_rxon.flags = 0;
 
                 iwl_set_rxon_channel(priv, conf->channel);
+                iwl_set_rxon_ht(priv, ht_conf);
 
                 iwl_set_flags_for_band(priv, conf->channel->band);
                 spin_unlock_irqrestore(&priv->lock, flags);
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.h b/drivers/net/wireless/iwlwifi/iwl-core.h
index 27ca859e7453..b69e972671b2 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.h
+++ b/drivers/net/wireless/iwlwifi/iwl-core.h
@@ -446,6 +446,8 @@ void iwl_hw_txq_ctx_free(struct iwl_priv *priv);
 int iwl_hw_tx_queue_init(struct iwl_priv *priv,
                          struct iwl_tx_queue *txq);
 int iwl_txq_update_write_ptr(struct iwl_priv *priv, struct iwl_tx_queue *txq);
+void iwl_free_tfds_in_queue(struct iwl_priv *priv,
+                            int sta_id, int tid, int freed);
 int iwl_tx_queue_init(struct iwl_priv *priv, struct iwl_tx_queue *txq,
                       int slots_num, u32 txq_id);
 void iwl_tx_queue_free(struct iwl_priv *priv, int txq_id);
diff --git a/drivers/net/wireless/iwlwifi/iwl-csr.h b/drivers/net/wireless/iwlwifi/iwl-csr.h
index a7bfae01f19b..1ec8cb4d5eae 100644
--- a/drivers/net/wireless/iwlwifi/iwl-csr.h
+++ b/drivers/net/wireless/iwlwifi/iwl-csr.h
@@ -77,8 +77,7 @@
  * The MAC (uCode processor, etc.) does not need to be powered up for accessing
  * the CSR registers.
  *
- * NOTE:  Newer devices using one-time-programmable (OTP) memory
- *        require device to be awake in order to read this memory
+ * NOTE:  Device does need to be awake in order to read this memory
  *        via CSR_EEPROM and CSR_OTP registers
  */
 #define CSR_BASE    (0x000)
@@ -111,9 +110,8 @@
 /*
  * EEPROM and OTP (one-time-programmable) memory reads
  *
- * NOTE:  For (newer) devices using OTP, device must be awake, initialized via
- *        apm_ops.init() in order to read.  Older devices (3945/4965/5000)
- *        use EEPROM and do not require this.
+ * NOTE:  Device must be awake, initialized via apm_ops.init(),
+ *        in order to read.
  */
 #define CSR_EEPROM_REG          (CSR_BASE+0x02c)
 #define CSR_EEPROM_GP           (CSR_BASE+0x030)
diff --git a/drivers/net/wireless/iwlwifi/iwl-dev.h b/drivers/net/wireless/iwlwifi/iwl-dev.h
index 2673e9a4db92..3822cf53e368 100644
--- a/drivers/net/wireless/iwlwifi/iwl-dev.h
+++ b/drivers/net/wireless/iwlwifi/iwl-dev.h
@@ -711,7 +711,7 @@ extern void iwl_txq_ctx_stop(struct iwl_priv *priv);
 extern int iwl_queue_space(const struct iwl_queue *q);
 static inline int iwl_queue_used(const struct iwl_queue *q, int i)
 {
-        return q->write_ptr > q->read_ptr ?
+        return q->write_ptr >= q->read_ptr ?
                 (i >= q->read_ptr && i < q->write_ptr) :
                 !(i < q->read_ptr && i >= q->write_ptr);
 }
@@ -1168,7 +1168,7 @@ struct iwl_priv {
         u32 last_beacon_time;
         u64 last_tsf;
 
-        /* eeprom */
+        /* eeprom -- this is in the card's little endian byte order */
         u8 *eeprom;
         int    nvm_device_type;
         struct iwl_eeprom_calib_info *calib_info;
@@ -1353,4 +1353,15 @@ static inline int is_channel_ibss(const struct iwl_channel_info *ch)
         return ((ch->flags & EEPROM_CHANNEL_IBSS)) ? 1 : 0;
 }
 
+static inline void __iwl_free_pages(struct iwl_priv *priv, struct page *page)
+{
+        __free_pages(page, priv->hw_params.rx_page_order);
+        priv->alloc_rxb_page--;
+}
+
+static inline void iwl_free_pages(struct iwl_priv *priv, unsigned long page)
+{
+        free_pages(page, priv->hw_params.rx_page_order);
+        priv->alloc_rxb_page--;
+}
 #endif                          /* __iwl_dev_h__ */
diff --git a/drivers/net/wireless/iwlwifi/iwl-devtrace.c b/drivers/net/wireless/iwlwifi/iwl-devtrace.c
index e7d88d1da15d..83cc4e500a96 100644
--- a/drivers/net/wireless/iwlwifi/iwl-devtrace.c
+++ b/drivers/net/wireless/iwlwifi/iwl-devtrace.c
@@ -1,3 +1,29 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2009 - 2010 Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ * The full GNU General Public License is included in this distribution in the
+ * file called LICENSE.
+ *
+ * Contact Information:
+ *  Intel Linux Wireless <ilw@linux.intel.com>
+ * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
+ *
+ *****************************************************************************/
+
 #include <linux/module.h>
 
 /* sparse doesn't like tracepoint macros */
diff --git a/drivers/net/wireless/iwlwifi/iwl-devtrace.h b/drivers/net/wireless/iwlwifi/iwl-devtrace.h
index 21361968ab7e..d9c7363b1bbb 100644
--- a/drivers/net/wireless/iwlwifi/iwl-devtrace.h
+++ b/drivers/net/wireless/iwlwifi/iwl-devtrace.h
@@ -1,3 +1,29 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2009 - 2010 Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ * The full GNU General Public License is included in this distribution in the
+ * file called LICENSE.
+ *
+ * Contact Information:
+ *  Intel Linux Wireless <ilw@linux.intel.com>
+ * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
+ *
+ *****************************************************************************/
+
 #if !defined(__IWLWIFI_DEVICE_TRACE) || defined(TRACE_HEADER_MULTI_READ)
 #define __IWLWIFI_DEVICE_TRACE
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-eeprom.c b/drivers/net/wireless/iwlwifi/iwl-eeprom.c
index 3946e5c03f81..4a30969689ff 100644
--- a/drivers/net/wireless/iwlwifi/iwl-eeprom.c
+++ b/drivers/net/wireless/iwlwifi/iwl-eeprom.c
@@ -370,7 +370,7 @@ static int iwl_init_otp_access(struct iwl_priv *priv)
         return ret;
 }
 
-static int iwl_read_otp_word(struct iwl_priv *priv, u16 addr, u16 *eeprom_data)
+static int iwl_read_otp_word(struct iwl_priv *priv, u16 addr, __le16 *eeprom_data)
 {
         int ret = 0;
         u32 r;
@@ -404,7 +404,7 @@ static int iwl_read_otp_word(struct iwl_priv *priv, u16 addr, u16 *eeprom_data)
                                 CSR_OTP_GP_REG_ECC_CORR_STATUS_MSK);
                 IWL_ERR(priv, "Correctable OTP ECC error, continue read\n");
         }
-        *eeprom_data = le16_to_cpu((__force __le16)(r >> 16));
+        *eeprom_data = cpu_to_le16(r >> 16);
         return 0;
 }
 
@@ -413,7 +413,8 @@ static int iwl_read_otp_word(struct iwl_priv *priv, u16 addr, u16 *eeprom_data)
  */
 static bool iwl_is_otp_empty(struct iwl_priv *priv)
 {
-        u16 next_link_addr = 0, link_value;
+        u16 next_link_addr = 0;
+        __le16 link_value;
         bool is_empty = false;
 
         /* locate the beginning of OTP link list */
@@ -443,7 +444,8 @@ static bool iwl_is_otp_empty(struct iwl_priv *priv)
 static int iwl_find_otp_image(struct iwl_priv *priv,
                                         u16 *validblockaddr)
 {
-        u16 next_link_addr = 0, link_value = 0, valid_addr;
+        u16 next_link_addr = 0, valid_addr;
+        __le16 link_value = 0;
         int usedblocks = 0;
 
         /* set addressing mode to absolute to traverse the link list */
@@ -463,7 +465,7 @@ static int iwl_find_otp_image(struct iwl_priv *priv,
                  * check for more block on the link list
                  */
                 valid_addr = next_link_addr;
-                next_link_addr = link_value * sizeof(u16);
+                next_link_addr = le16_to_cpu(link_value) * sizeof(u16);
                 IWL_DEBUG_INFO(priv, "OTP blocks %d addr 0x%x\n",
                                usedblocks, next_link_addr);
                 if (iwl_read_otp_word(priv, next_link_addr, &link_value))
@@ -497,7 +499,7 @@ static int iwl_find_otp_image(struct iwl_priv *priv,
  */
 int iwl_eeprom_init(struct iwl_priv *priv)
 {
-        u16 *e;
+        __le16 *e;
         u32 gp = iwl_read32(priv, CSR_EEPROM_GP);
         int sz;
         int ret;
@@ -516,12 +518,9 @@ int iwl_eeprom_init(struct iwl_priv *priv)
                 ret = -ENOMEM;
                 goto alloc_err;
         }
-        e = (u16 *)priv->eeprom;
+        e = (__le16 *)priv->eeprom;
 
-        if (priv->nvm_device_type == NVM_DEVICE_TYPE_OTP) {
-                /* OTP reads require powered-up chip */
-                priv->cfg->ops->lib->apm_ops.init(priv);
-        }
+        priv->cfg->ops->lib->apm_ops.init(priv);
 
         ret = priv->cfg->ops->lib->eeprom_ops.verify_signature(priv);
         if (ret < 0) {
@@ -562,7 +561,7 @@ int iwl_eeprom_init(struct iwl_priv *priv)
                 }
                 for (addr = validblockaddr; addr < validblockaddr + sz;
                      addr += sizeof(u16)) {
-                        u16 eeprom_data;
+                        __le16 eeprom_data;
 
                         ret = iwl_read_otp_word(priv, addr, &eeprom_data);
                         if (ret)
@@ -570,13 +569,6 @@ int iwl_eeprom_init(struct iwl_priv *priv)
                         e[cache_addr / 2] = eeprom_data;
                         cache_addr += sizeof(u16);
                 }
-
-                /*
-                 * Now that OTP reads are complete, reset chip to save
-                 *   power until we load uCode during "up".
-                 */
-                priv->cfg->ops->lib->apm_ops.stop(priv);
-
         } else {
                 /* eeprom is an array of 16bit values */
                 for (addr = 0; addr < sz; addr += sizeof(u16)) {
@@ -594,7 +586,7 @@ int iwl_eeprom_init(struct iwl_priv *priv)
                                 goto done;
                         }
                         r = _iwl_read_direct32(priv, CSR_EEPROM_REG);
-                        e[addr / 2] = le16_to_cpu((__force __le16)(r >> 16));
+                        e[addr / 2] = cpu_to_le16(r >> 16);
                 }
         }
         ret = 0;
@@ -603,6 +595,8 @@ done:
 err:
         if (ret)
                 iwl_eeprom_free(priv);
+        /* Reset chip to save power until we load uCode during "up". */
+        priv->cfg->ops->lib->apm_ops.stop(priv);
 alloc_err:
         return ret;
 }
@@ -755,7 +749,8 @@ static int iwl_mod_ht40_chan_info(struct iwl_priv *priv,
         ch_info->ht40_eeprom = *eeprom_ch;
         ch_info->ht40_max_power_avg = eeprom_ch->max_power_avg;
         ch_info->ht40_flags = eeprom_ch->flags;
-        ch_info->ht40_extension_channel &= ~clear_ht40_extension_channel;
+        if (eeprom_ch->flags & EEPROM_CHANNEL_VALID)
+                ch_info->ht40_extension_channel &= ~clear_ht40_extension_channel;
 
         return 0;
 }
diff --git a/drivers/net/wireless/iwlwifi/iwl-eeprom.h b/drivers/net/wireless/iwlwifi/iwl-eeprom.h
index 5cd2b66bbe45..0cd9c02ee044 100644
--- a/drivers/net/wireless/iwlwifi/iwl-eeprom.h
+++ b/drivers/net/wireless/iwlwifi/iwl-eeprom.h
@@ -137,7 +137,7 @@ struct iwl_eeprom_channel {
  *
  */
 struct iwl_eeprom_enhanced_txpwr {
-        u16 common;
+        __le16 common;
         s8 chain_a_max;
         s8 chain_b_max;
         s8 chain_c_max;
@@ -360,7 +360,7 @@ struct iwl_eeprom_calib_subband_info {
 struct iwl_eeprom_calib_info {
         u8 saturation_power24;  /* half-dBm (e.g. "34" = 17 dBm) */
         u8 saturation_power52;  /* half-dBm */
-        s16 voltage;            /* signed */
+        __le16 voltage;         /* signed */
         struct iwl_eeprom_calib_subband_info
                 band_info[EEPROM_TX_POWER_BANDS];
 } __attribute__ ((packed));
diff --git a/drivers/net/wireless/iwlwifi/iwl-hcmd.c b/drivers/net/wireless/iwlwifi/iwl-hcmd.c
index a23165948202..30e9ea6d54ec 100644
--- a/drivers/net/wireless/iwlwifi/iwl-hcmd.c
+++ b/drivers/net/wireless/iwlwifi/iwl-hcmd.c
@@ -234,7 +234,7 @@ cancel:
         }
 fail:
         if (cmd->reply_page) {
-                free_pages(cmd->reply_page, priv->hw_params.rx_page_order);
+                iwl_free_pages(priv, cmd->reply_page);
                 cmd->reply_page = 0;
         }
 out:
diff --git a/drivers/net/wireless/iwlwifi/iwl-rx.c b/drivers/net/wireless/iwlwifi/iwl-rx.c
index 6090bc15a6d5..2dbce85404aa 100644
--- a/drivers/net/wireless/iwlwifi/iwl-rx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-rx.c
@@ -345,10 +345,8 @@ void iwl_rx_queue_free(struct iwl_priv *priv, struct iwl_rx_queue *rxq)
                         pci_unmap_page(priv->pci_dev, rxq->pool[i].page_dma,
                                 PAGE_SIZE << priv->hw_params.rx_page_order,
                                 PCI_DMA_FROMDEVICE);
-                        __free_pages(rxq->pool[i].page,
-                                     priv->hw_params.rx_page_order);
+                        __iwl_free_pages(priv, rxq->pool[i].page);
                         rxq->pool[i].page = NULL;
-                        priv->alloc_rxb_page--;
                 }
         }
 
@@ -416,9 +414,7 @@ void iwl_rx_queue_reset(struct iwl_priv *priv, struct iwl_rx_queue *rxq)
                         pci_unmap_page(priv->pci_dev, rxq->pool[i].page_dma,
                                 PAGE_SIZE << priv->hw_params.rx_page_order,
                                 PCI_DMA_FROMDEVICE);
-                        priv->alloc_rxb_page--;
-                        __free_pages(rxq->pool[i].page,
-                                     priv->hw_params.rx_page_order);
+                        __iwl_free_pages(priv, rxq->pool[i].page);
                         rxq->pool[i].page = NULL;
                 }
                 list_add_tail(&rxq->pool[i].list, &rxq->rx_used);
@@ -654,47 +650,6 @@ void iwl_reply_statistics(struct iwl_priv *priv,
 }
 EXPORT_SYMBOL(iwl_reply_statistics);
 
-#define PERFECT_RSSI (-20) /* dBm */
-#define WORST_RSSI (-95)   /* dBm */
-#define RSSI_RANGE (PERFECT_RSSI - WORST_RSSI)
-
-/* Calculate an indication of rx signal quality (a percentage, not dBm!).
- * See http://www.ces.clemson.edu/linux/signal_quality.shtml for info
- *   about formulas used below. */
-static int iwl_calc_sig_qual(int rssi_dbm, int noise_dbm)
-{
-        int sig_qual;
-        int degradation = PERFECT_RSSI - rssi_dbm;
-
-        /* If we get a noise measurement, use signal-to-noise ratio (SNR)
-         * as indicator; formula is (signal dbm - noise dbm).
-         * SNR at or above 40 is a great signal (100%).
-         * Below that, scale to fit SNR of 0 - 40 dB within 0 - 100% indicator.
-         * Weakest usable signal is usually 10 - 15 dB SNR. */
-        if (noise_dbm) {
-                if (rssi_dbm - noise_dbm >= 40)
-                        return 100;
-                else if (rssi_dbm < noise_dbm)
-                        return 0;
-                sig_qual = ((rssi_dbm - noise_dbm) * 5) / 2;
-
-        /* Else use just the signal level.
-         * This formula is a least squares fit of data points collected and
-         *   compared with a reference system that had a percentage (%) display
-         *   for signal quality. */
-        } else
-                sig_qual = (100 * (RSSI_RANGE * RSSI_RANGE) - degradation *
-                            (15 * RSSI_RANGE + 62 * degradation)) /
-                           (RSSI_RANGE * RSSI_RANGE);
-
-        if (sig_qual > 100)
-                sig_qual = 100;
-        else if (sig_qual < 1)
-                sig_qual = 0;
-
-        return sig_qual;
-}
-
 /* Calc max signal level (dBm) among 3 possible receivers */
 static inline int iwl_calc_rssi(struct iwl_priv *priv,
                                 struct iwl_rx_phy_res *rx_resp)
@@ -973,7 +928,10 @@ static void iwl_pass_packet_to_mac80211(struct iwl_priv *priv,
         if (ieee80211_is_mgmt(fc) ||
             ieee80211_has_protected(fc) ||
             ieee80211_has_morefrags(fc) ||
-            le16_to_cpu(hdr->seq_ctrl) & IEEE80211_SCTL_FRAG)
+            le16_to_cpu(hdr->seq_ctrl) & IEEE80211_SCTL_FRAG ||
+            (ieee80211_is_data_qos(fc) &&
+             *ieee80211_get_qos_ctl(hdr) &
+             IEEE80211_QOS_CONTROL_A_MSDU_PRESENT))
                 ret = skb_linearize(skb);
         else
                 ret = __pskb_pull_tail(skb, min_t(u16, IWL_LINK_HDR_MAX, len)) ?
@@ -1105,11 +1063,8 @@ void iwl_rx_reply_rx(struct iwl_priv *priv,
         if (iwl_is_associated(priv) &&
             !test_bit(STATUS_SCANNING, &priv->status)) {
                 rx_status.noise = priv->last_rx_noise;
-                rx_status.qual = iwl_calc_sig_qual(rx_status.signal,
-                                                         rx_status.noise);
         } else {
                 rx_status.noise = IWL_NOISE_MEAS_NOT_AVAILABLE;
-                rx_status.qual = iwl_calc_sig_qual(rx_status.signal, 0);
         }
 
         /* Reset beacon noise level if not associated. */
@@ -1122,8 +1077,8 @@ void iwl_rx_reply_rx(struct iwl_priv *priv,
                 iwl_dbg_report_frame(priv, phy_res, len, header, 1);
 #endif
         iwl_dbg_log_rx_data_frame(priv, len, header);
-        IWL_DEBUG_STATS_LIMIT(priv, "Rssi %d, noise %d, qual %d, TSF %llu\n",
-                rx_status.signal, rx_status.noise, rx_status.qual,
+        IWL_DEBUG_STATS_LIMIT(priv, "Rssi %d, noise %d, TSF %llu\n",
+                rx_status.signal, rx_status.noise,
                 (unsigned long long)rx_status.mactime);
 
         /*
diff --git a/drivers/net/wireless/iwlwifi/iwl-scan.c b/drivers/net/wireless/iwlwifi/iwl-scan.c
index a2b2b8315ff9..fa1c89ba6459 100644
--- a/drivers/net/wireless/iwlwifi/iwl-scan.c
+++ b/drivers/net/wireless/iwlwifi/iwl-scan.c
@@ -144,8 +144,7 @@ static int iwl_send_scan_abort(struct iwl_priv *priv)
                 clear_bit(STATUS_SCAN_HW, &priv->status);
         }
 
-        priv->alloc_rxb_page--;
-        free_pages(cmd.reply_page, priv->hw_params.rx_page_order);
+        iwl_free_pages(priv, cmd.reply_page);
 
         return ret;
 }
diff --git a/drivers/net/wireless/iwlwifi/iwl-sta.c b/drivers/net/wireless/iwlwifi/iwl-sta.c
index cd6a6901216e..90fbdb25399e 100644
--- a/drivers/net/wireless/iwlwifi/iwl-sta.c
+++ b/drivers/net/wireless/iwlwifi/iwl-sta.c
@@ -164,9 +164,7 @@ int iwl_send_add_sta(struct iwl_priv *priv,
                         break;
                 }
         }
-
-        priv->alloc_rxb_page--;
-        free_pages(cmd.reply_page, priv->hw_params.rx_page_order);
+        iwl_free_pages(priv, cmd.reply_page);
 
         return ret;
 }
@@ -299,7 +297,7 @@ u8 iwl_add_station(struct iwl_priv *priv, const u8 *addr, bool is_ap, u8 flags,
 }
 EXPORT_SYMBOL(iwl_add_station);
 
-static void iwl_sta_ucode_deactivate(struct iwl_priv *priv, const char *addr)
+static void iwl_sta_ucode_deactivate(struct iwl_priv *priv, const u8 *addr)
 {
         unsigned long flags;
         u8 sta_id = iwl_find_station(priv, addr);
@@ -326,7 +324,7 @@ static void iwl_remove_sta_callback(struct iwl_priv *priv,
 {
         struct iwl_rem_sta_cmd *rm_sta =
                         (struct iwl_rem_sta_cmd *)cmd->cmd.payload;
-        const char *addr = rm_sta->addr;
+        const u8 *addr = rm_sta->addr;
 
         if (pkt->hdr.flags & IWL_CMD_FAILED_MSK) {
                 IWL_ERR(priv, "Bad return from REPLY_REMOVE_STA (0x%08X)\n",
@@ -391,9 +389,7 @@ static int iwl_send_remove_station(struct iwl_priv *priv, const u8 *addr,
                         break;
                 }
         }
-
-        priv->alloc_rxb_page--;
-        free_pages(cmd.reply_page, priv->hw_params.rx_page_order);
+        iwl_free_pages(priv, cmd.reply_page);
 
         return ret;
 }
diff --git a/drivers/net/wireless/iwlwifi/iwl-tx.c b/drivers/net/wireless/iwlwifi/iwl-tx.c
index 00da5e152d46..8f4071562857 100644
--- a/drivers/net/wireless/iwlwifi/iwl-tx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-tx.c
@@ -120,6 +120,20 @@ int iwl_txq_update_write_ptr(struct iwl_priv *priv, struct iwl_tx_queue *txq)
 EXPORT_SYMBOL(iwl_txq_update_write_ptr);
 
 
+void iwl_free_tfds_in_queue(struct iwl_priv *priv,
+                            int sta_id, int tid, int freed)
+{
+        if (priv->stations[sta_id].tid[tid].tfds_in_queue >= freed)
+                priv->stations[sta_id].tid[tid].tfds_in_queue -= freed;
+        else {
+                IWL_ERR(priv, "free more than tfds_in_queue (%u:%d)\n",
+                        priv->stations[sta_id].tid[tid].tfds_in_queue,
+                        freed);
+                priv->stations[sta_id].tid[tid].tfds_in_queue = 0;
+        }
+}
+EXPORT_SYMBOL(iwl_free_tfds_in_queue);
+
 /**
  * iwl_tx_queue_free - Deallocate DMA queue.
  * @txq: Transmit queue to deallocate.
@@ -407,13 +421,14 @@ void iwl_hw_txq_ctx_free(struct iwl_priv *priv)
         int txq_id;
 
         /* Tx queues */
-        if (priv->txq)
+        if (priv->txq) {
                 for (txq_id = 0; txq_id < priv->hw_params.max_txq_num;
                      txq_id++)
                         if (txq_id == IWL_CMD_QUEUE_NUM)
                                 iwl_cmd_queue_free(priv);
                         else
                                 iwl_tx_queue_free(priv, txq_id);
+        }
         iwl_free_dma_ptr(priv, &priv->kw);
 
         iwl_free_dma_ptr(priv, &priv->scd_bc_tbls);
@@ -1130,6 +1145,7 @@ int iwl_tx_queue_reclaim(struct iwl_priv *priv, int txq_id, int index)
         struct iwl_queue *q = &txq->q;
         struct iwl_tx_info *tx_info;
         int nfreed = 0;
+        struct ieee80211_hdr *hdr;
 
         if ((index >= q->n_bd) || (iwl_queue_used(q, index) == 0)) {
                 IWL_ERR(priv, "Read index for DMA queue txq id (%d), index %d, "
@@ -1144,13 +1160,16 @@ int iwl_tx_queue_reclaim(struct iwl_priv *priv, int txq_id, int index)
 
                 tx_info = &txq->txb[txq->q.read_ptr];
                 iwl_tx_status(priv, tx_info->skb[0]);
+
+                hdr = (struct ieee80211_hdr *)tx_info->skb[0]->data;
+                if (hdr && ieee80211_is_data_qos(hdr->frame_control))
+                        nfreed++;
                 tx_info->skb[0] = NULL;
 
                 if (priv->cfg->ops->lib->txq_inval_byte_cnt_tbl)
                         priv->cfg->ops->lib->txq_inval_byte_cnt_tbl(priv, txq);
 
                 priv->cfg->ops->lib->txq_free_tfd(priv, txq);
-                nfreed++;
         }
         return nfreed;
 }
@@ -1558,7 +1577,7 @@ void iwl_rx_reply_compressed_ba(struct iwl_priv *priv,
         if (txq->q.read_ptr != (ba_resp_scd_ssn & 0xff)) {
                 /* calculate mac80211 ampdu sw queue to wake */
                 int freed = iwl_tx_queue_reclaim(priv, scd_flow, index);
-                priv->stations[sta_id].tid[tid].tfds_in_queue -= freed;
+                iwl_free_tfds_in_queue(priv, sta_id, tid, freed);
 
                 if ((iwl_queue_space(&txq->q) > txq->q.low_mark) &&
                     priv->mac80211_registered &&
diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
index 2a28a1f8b1fe..f8e4e4b18d02 100644
--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -548,6 +548,9 @@ static int iwl3945_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
         txq = &priv->txq[txq_id];
         q = &txq->q;
 
+        if ((iwl_queue_space(q) < q->high_mark))
+                goto drop;
+
         spin_lock_irqsave(&priv->lock, flags);
 
         idx = get_cmd_index(q, q->write_ptr, 0);
@@ -812,7 +815,7 @@ static int iwl3945_get_measurement(struct iwl_priv *priv,
                 break;
         }
 
-        free_pages(cmd.reply_page, priv->hw_params.rx_page_order);
+        iwl_free_pages(priv, cmd.reply_page);
 
         return rc;
 }
@@ -1198,9 +1201,7 @@ void iwl3945_rx_queue_reset(struct iwl_priv *priv, struct iwl_rx_queue *rxq)
                         pci_unmap_page(priv->pci_dev, rxq->pool[i].page_dma,
                                 PAGE_SIZE << priv->hw_params.rx_page_order,
                                 PCI_DMA_FROMDEVICE);
-                        priv->alloc_rxb_page--;
-                        __free_pages(rxq->pool[i].page,
-                                     priv->hw_params.rx_page_order);
+                        __iwl_free_pages(priv, rxq->pool[i].page);
                         rxq->pool[i].page = NULL;
                 }
                 list_add_tail(&rxq->pool[i].list, &rxq->rx_used);
@@ -1247,10 +1248,8 @@ static void iwl3945_rx_queue_free(struct iwl_priv *priv, struct iwl_rx_queue *rx
                         pci_unmap_page(priv->pci_dev, rxq->pool[i].page_dma,
                                 PAGE_SIZE << priv->hw_params.rx_page_order,
                                 PCI_DMA_FROMDEVICE);
-                        __free_pages(rxq->pool[i].page,
-                                     priv->hw_params.rx_page_order);
+                        __iwl_free_pages(priv, rxq->pool[i].page);
                         rxq->pool[i].page = NULL;
-                        priv->alloc_rxb_page--;
                 }
         }
 
@@ -1300,47 +1299,6 @@ int iwl3945_calc_db_from_ratio(int sig_ratio)
         return (int)ratio2dB[sig_ratio];
 }
 
-#define PERFECT_RSSI (-20) /* dBm */
-#define WORST_RSSI (-95)   /* dBm */
-#define RSSI_RANGE (PERFECT_RSSI - WORST_RSSI)
-
-/* Calculate an indication of rx signal quality (a percentage, not dBm!).
- * See http://www.ces.clemson.edu/linux/signal_quality.shtml for info
- *   about formulas used below. */
-int iwl3945_calc_sig_qual(int rssi_dbm, int noise_dbm)
-{
-        int sig_qual;
-        int degradation = PERFECT_RSSI - rssi_dbm;
-
-        /* If we get a noise measurement, use signal-to-noise ratio (SNR)
-         * as indicator; formula is (signal dbm - noise dbm).
-         * SNR at or above 40 is a great signal (100%).
-         * Below that, scale to fit SNR of 0 - 40 dB within 0 - 100% indicator.
-         * Weakest usable signal is usually 10 - 15 dB SNR. */
-        if (noise_dbm) {
-                if (rssi_dbm - noise_dbm >= 40)
-                        return 100;
-                else if (rssi_dbm < noise_dbm)
-                        return 0;
-                sig_qual = ((rssi_dbm - noise_dbm) * 5) / 2;
-
-        /* Else use just the signal level.
-         * This formula is a least squares fit of data points collected and
-         *   compared with a reference system that had a percentage (%) display
-         *   for signal quality. */
-        } else
-                sig_qual = (100 * (RSSI_RANGE * RSSI_RANGE) - degradation *
-                            (15 * RSSI_RANGE + 62 * degradation)) /
-                           (RSSI_RANGE * RSSI_RANGE);
-
-        if (sig_qual > 100)
-                sig_qual = 100;
-        else if (sig_qual < 1)
-                sig_qual = 0;
-
-        return sig_qual;
-}
-
 /**
  * iwl3945_rx_handle - Main entry function for receiving responses from uCode
  *
@@ -1688,7 +1646,7 @@ void iwl3945_dump_nic_event_log(struct iwl_priv *priv, bool full_log)
         }
 
 #ifdef CONFIG_IWLWIFI_DEBUG
-        if (!(iwl_get_debug_level(priv) & IWL_DL_FW_ERRORS))
+        if (!(iwl_get_debug_level(priv) & IWL_DL_FW_ERRORS) && !full_log)
                 size = (size > DEFAULT_IWL3945_DUMP_EVENT_LOG_ENTRIES)
                         ? DEFAULT_IWL3945_DUMP_EVENT_LOG_ENTRIES : size;
 #else
@@ -3867,7 +3825,6 @@ static int iwl3945_init_drv(struct iwl_priv *priv)
         priv->retry_rate = 1;
         priv->ibss_beacon = NULL;
 
-        spin_lock_init(&priv->lock);
         spin_lock_init(&priv->sta_lock);
         spin_lock_init(&priv->hcmd_lock);
 
@@ -3936,9 +3893,11 @@ static int iwl3945_setup_mac(struct iwl_priv *priv)
         /* Tell mac80211 our characteristics */
         hw->flags = IEEE80211_HW_SIGNAL_DBM |
                     IEEE80211_HW_NOISE_DBM |
-                    IEEE80211_HW_SPECTRUM_MGMT |
-                    IEEE80211_HW_SUPPORTS_PS |
-                    IEEE80211_HW_SUPPORTS_DYNAMIC_PS;
+                    IEEE80211_HW_SPECTRUM_MGMT;
+
+        if (!priv->cfg->broken_powersave)
+                hw->flags |= IEEE80211_HW_SUPPORTS_PS |
+                             IEEE80211_HW_SUPPORTS_DYNAMIC_PS;
 
         hw->wiphy->interface_modes =
                 BIT(NL80211_IFTYPE_STATION) |
@@ -4057,10 +4016,11 @@ static int iwl3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *e
          * PCI Tx retries from interfering with C3 CPU state */
         pci_write_config_byte(pdev, 0x41, 0x00);
 
-        /* this spin lock will be used in apm_ops.init and EEPROM access
+        /* these spin locks will be used in apm_ops.init and EEPROM access
          * we should init now
          */
         spin_lock_init(&priv->reg_lock);
+        spin_lock_init(&priv->lock);
 
         /***********************
          * 4. Read EEPROM
diff --git a/drivers/net/wireless/iwmc3200wifi/commands.c b/drivers/net/wireless/iwmc3200wifi/commands.c
index 777584d76a88..1e41ad0fcad5 100644
--- a/drivers/net/wireless/iwmc3200wifi/commands.c
+++ b/drivers/net/wireless/iwmc3200wifi/commands.c
@@ -973,6 +973,10 @@ int iwm_send_pmkid_update(struct iwm_priv *iwm,
 
         memset(&update, 0, sizeof(struct iwm_umac_pmkid_update));
 
+        update.hdr.oid = UMAC_WIFI_IF_CMD_PMKID_UPDATE;
+        update.hdr.buf_size = cpu_to_le16(sizeof(struct iwm_umac_pmkid_update) -
+                                          sizeof(struct iwm_umac_wifi_if));
+
         update.command = cpu_to_le32(command);
         if (pmksa->bssid)
                 memcpy(&update.bssid, pmksa->bssid, ETH_ALEN);
diff --git a/drivers/net/wireless/iwmc3200wifi/commands.h b/drivers/net/wireless/iwmc3200wifi/commands.h
index 06af0552cd75..3dfd9f0e9003 100644
--- a/drivers/net/wireless/iwmc3200wifi/commands.h
+++ b/drivers/net/wireless/iwmc3200wifi/commands.h
@@ -463,6 +463,7 @@ struct iwm_umac_cmd_stop_resume_tx {
 #define IWM_CMD_PMKID_FLUSH 3
 
 struct iwm_umac_pmkid_update {
+        struct iwm_umac_wifi_if hdr;
         __le32 command;
         u8 bssid[ETH_ALEN];
         __le16 reserved;
diff --git a/drivers/net/wireless/iwmc3200wifi/iwm.h b/drivers/net/wireless/iwmc3200wifi/iwm.h
index 5a26bb05a33a..842811142bef 100644
--- a/drivers/net/wireless/iwmc3200wifi/iwm.h
+++ b/drivers/net/wireless/iwmc3200wifi/iwm.h
@@ -268,7 +268,7 @@ struct iwm_priv {
 
         struct sk_buff_head rx_list;
         struct list_head rx_tickets;
-        struct list_head rx_packets[IWM_RX_ID_HASH];
+        struct list_head rx_packets[IWM_RX_ID_HASH + 1];
         struct workqueue_struct *rx_wq;
         struct work_struct rx_worker;
 
@@ -349,7 +349,7 @@ int iwm_up(struct iwm_priv *iwm);
 int iwm_down(struct iwm_priv *iwm);
 
 /* TX API */
-u16 iwm_tid_to_queue(u16 tid);
+int iwm_tid_to_queue(u16 tid);
 void iwm_tx_credit_inc(struct iwm_priv *iwm, int id, int total_freed_pages);
 void iwm_tx_worker(struct work_struct *work);
 int iwm_xmit_frame(struct sk_buff *skb, struct net_device *netdev);
diff --git a/drivers/net/wireless/iwmc3200wifi/netdev.c b/drivers/net/wireless/iwmc3200wifi/netdev.c
index e4f0f8705f65..c4c0d23c63ec 100644
--- a/drivers/net/wireless/iwmc3200wifi/netdev.c
+++ b/drivers/net/wireless/iwmc3200wifi/netdev.c
@@ -76,7 +76,7 @@ static int iwm_stop(struct net_device *ndev)
  */
 static const u16 iwm_1d_to_queue[8] = { 1, 0, 0, 1, 2, 2, 3, 3 };
 
-u16 iwm_tid_to_queue(u16 tid)
+int iwm_tid_to_queue(u16 tid)
 {
         if (tid > IWM_UMAC_TID_NR - 2)
                 return -EINVAL;
diff --git a/drivers/net/wireless/iwmc3200wifi/rx.c b/drivers/net/wireless/iwmc3200wifi/rx.c
index 1c57c1f72cba..f727b4a83196 100644
--- a/drivers/net/wireless/iwmc3200wifi/rx.c
+++ b/drivers/net/wireless/iwmc3200wifi/rx.c
@@ -794,7 +794,7 @@ static int iwm_mlme_update_bss_table(struct iwm_priv *iwm, u8 *buf,
         }
 
         bss->bss = kzalloc(bss_len, GFP_KERNEL);
-        if (!bss) {
+        if (!bss->bss) {
                 kfree(bss);
                 IWM_ERR(iwm, "Couldn't allocate bss\n");
                 return -ENOMEM;
@@ -1126,7 +1126,7 @@ static int iwm_ntf_stop_resume_tx(struct iwm_priv *iwm, u8 *buf,
 
                 if (!stop) {
                         struct iwm_tx_queue *txq;
-                        u16 queue = iwm_tid_to_queue(bit);
+                        int queue = iwm_tid_to_queue(bit);
 
                         if (queue < 0)
                                 continue;
diff --git a/drivers/net/wireless/libertas/mesh.c b/drivers/net/wireless/libertas/mesh.c
index 2f91c9b808af..92b7a357a5e4 100644
--- a/drivers/net/wireless/libertas/mesh.c
+++ b/drivers/net/wireless/libertas/mesh.c
@@ -2,6 +2,7 @@
 #include <linux/delay.h>
 #include <linux/etherdevice.h>
 #include <linux/netdevice.h>
+#include <linux/if_ether.h>
 #include <linux/if_arp.h>
 #include <linux/kthread.h>
 #include <linux/kfifo.h>
@@ -351,8 +352,7 @@ int lbs_add_mesh(struct lbs_private *priv)
 
         mesh_dev->netdev_ops = &mesh_netdev_ops;
         mesh_dev->ethtool_ops = &lbs_ethtool_ops;
-        memcpy(mesh_dev->dev_addr, priv->dev->dev_addr,
-                        sizeof(priv->dev->dev_addr));
+        memcpy(mesh_dev->dev_addr, priv->dev->dev_addr, ETH_ALEN);
 
         SET_NETDEV_DEV(priv->mesh_dev, priv->dev->dev.parent);
 
diff --git a/drivers/net/wireless/libertas/scan.c b/drivers/net/wireless/libertas/scan.c
index c6a6c042b82f..b0b1c7841500 100644
--- a/drivers/net/wireless/libertas/scan.c
+++ b/drivers/net/wireless/libertas/scan.c
@@ -567,11 +567,8 @@ int lbs_scan_networks(struct lbs_private *priv, int full_scan)
         chan_count = lbs_scan_create_channel_list(priv, chan_list);
 
         netif_stop_queue(priv->dev);
-        netif_carrier_off(priv->dev);
-        if (priv->mesh_dev) {
+        if (priv->mesh_dev)
                 netif_stop_queue(priv->mesh_dev);
-                netif_carrier_off(priv->mesh_dev);
-        }
 
         /* Prepare to continue an interrupted scan */
         lbs_deb_scan("chan_count %d, scan_channel %d\n",
@@ -635,16 +632,13 @@ out2:
         priv->scan_channel = 0;
 
 out:
-        if (priv->connect_status == LBS_CONNECTED) {
-                netif_carrier_on(priv->dev);
-                if (!priv->tx_pending_len)
-                        netif_wake_queue(priv->dev);
-        }
-        if (priv->mesh_dev && (priv->mesh_connect_status == LBS_CONNECTED)) {
-                netif_carrier_on(priv->mesh_dev);
-                if (!priv->tx_pending_len)
-                        netif_wake_queue(priv->mesh_dev);
-        }
+        if (priv->connect_status == LBS_CONNECTED && !priv->tx_pending_len)
+                netif_wake_queue(priv->dev);
+
+        if (priv->mesh_dev && (priv->mesh_connect_status == LBS_CONNECTED) &&
+            !priv->tx_pending_len)
+                netif_wake_queue(priv->mesh_dev);
+
         kfree(chan_list);
 
         lbs_deb_leave_args(LBS_DEB_SCAN, "ret %d", ret);
diff --git a/drivers/net/wireless/libertas/wext.c b/drivers/net/wireless/libertas/wext.c
index a8eb9e1fcf36..4b1aab593a84 100644
--- a/drivers/net/wireless/libertas/wext.c
+++ b/drivers/net/wireless/libertas/wext.c
@@ -2025,10 +2025,8 @@ static int lbs_get_essid(struct net_device *dev, struct iw_request_info *info,
         if (priv->connect_status == LBS_CONNECTED) {
                 memcpy(extra, priv->curbssparams.ssid,
                        priv->curbssparams.ssid_len);
-                extra[priv->curbssparams.ssid_len] = '\0';
         } else {
                 memset(extra, 0, 32);
-                extra[priv->curbssparams.ssid_len] = '\0';
         }
         /*
          * If none, we may want to get the one that was set
diff --git a/drivers/net/wireless/libertas_tf/main.c b/drivers/net/wireless/libertas_tf/main.c
index 019431d2f8a9..26a1abd5bb03 100644
--- a/drivers/net/wireless/libertas_tf/main.c
+++ b/drivers/net/wireless/libertas_tf/main.c
@@ -495,7 +495,6 @@ int lbtf_rx(struct lbtf_private *priv, struct sk_buff *skb)
         stats.band = IEEE80211_BAND_2GHZ;
         stats.signal = prxpd->snr;
         stats.noise = prxpd->nf;
-        stats.qual = prxpd->snr - prxpd->nf;
         /* Marvell rate index has a hole at value 4 */
         if (prxpd->rx_rate > 4)
                 --prxpd->rx_rate;
diff --git a/drivers/net/wireless/mwl8k.c b/drivers/net/wireless/mwl8k.c
index 59d49159cf2a..59f92105b0c2 100644
--- a/drivers/net/wireless/mwl8k.c
+++ b/drivers/net/wireless/mwl8k.c
@@ -3157,8 +3157,10 @@ static void mwl8k_configure_filter(struct ieee80211_hw *hw,
         /* Clear unsupported feature flags */
         *total_flags &= FIF_ALLMULTI | FIF_BCN_PRBRESP_PROMISC;
 
-        if (mwl8k_fw_lock(hw))
+        if (mwl8k_fw_lock(hw)) {
+                kfree(cmd);
                 return;
+        }
 
         if (priv->sniffer_enabled) {
                 mwl8k_enable_sniffer(hw, 0);
diff --git a/drivers/net/wireless/orinoco/wext.c b/drivers/net/wireless/orinoco/wext.c
index 7698fdd6a3a2..31ca241f7753 100644
--- a/drivers/net/wireless/orinoco/wext.c
+++ b/drivers/net/wireless/orinoco/wext.c
@@ -23,7 +23,7 @@
 #define MAX_RID_LEN 1024
 
 /* Helper routine to record keys
- * Do not call from interrupt context */
+ * It is called under orinoco_lock so it may not sleep */
 static int orinoco_set_key(struct orinoco_private *priv, int index,
                            enum orinoco_alg alg, const u8 *key, int key_len,
                            const u8 *seq, int seq_len)
@@ -32,14 +32,14 @@ static int orinoco_set_key(struct orinoco_private *priv, int index,
         kzfree(priv->keys[index].seq);
 
         if (key_len) {
-                priv->keys[index].key = kzalloc(key_len, GFP_KERNEL);
+                priv->keys[index].key = kzalloc(key_len, GFP_ATOMIC);
                 if (!priv->keys[index].key)
                         goto nomem;
         } else
                 priv->keys[index].key = NULL;
 
         if (seq_len) {
-                priv->keys[index].seq = kzalloc(seq_len, GFP_KERNEL);
+                priv->keys[index].seq = kzalloc(seq_len, GFP_ATOMIC);
                 if (!priv->keys[index].seq)
                         goto free_key;
         } else
diff --git a/drivers/net/wireless/p54/p54pci.c b/drivers/net/wireless/p54/p54pci.c
index a15962a19b2a..a72f7c2577de 100644
--- a/drivers/net/wireless/p54/p54pci.c
+++ b/drivers/net/wireless/p54/p54pci.c
@@ -197,6 +197,14 @@ static void p54p_check_rx_ring(struct ieee80211_hw *dev, u32 *index,
                         i %= ring_limit;
                         continue;
                 }
+
+                if (unlikely(len > priv->common.rx_mtu)) {
+                        if (net_ratelimit())
+                                dev_err(&priv->pdev->dev, "rx'd frame size "
+                                        "exceeds length threshold.\n");
+
+                        len = priv->common.rx_mtu;
+                }
                 skb_put(skb, len);
 
                 if (p54_rx(dev, skb)) {
diff --git a/drivers/net/wireless/rt2x00/rt2800.h b/drivers/net/wireless/rt2x00/rt2800.h
index c5fe867665e6..1a7eae357fef 100644
--- a/drivers/net/wireless/rt2x00/rt2800.h
+++ b/drivers/net/wireless/rt2x00/rt2800.h
@@ -1323,7 +1323,7 @@
 #define PAIRWISE_KEY_ENTRY(__idx) \
         ( PAIRWISE_KEY_TABLE_BASE + ((__idx) * sizeof(struct hw_key_entry)) )
 #define MAC_IVEIV_ENTRY(__idx) \
-        ( MAC_IVEIV_TABLE_BASE + ((__idx) & sizeof(struct mac_iveiv_entry)) )
+        ( MAC_IVEIV_TABLE_BASE + ((__idx) * sizeof(struct mac_iveiv_entry)) )
 #define MAC_WCID_ATTR_ENTRY(__idx) \
         ( MAC_WCID_ATTRIBUTE_BASE + ((__idx) * sizeof(u32)) )
 #define SHARED_KEY_ENTRY(__idx) \
diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c b/drivers/net/wireless/rt2x00/rt2800lib.c
index eb1e1d00bec3..9deae41cb784 100644
--- a/drivers/net/wireless/rt2x00/rt2800lib.c
+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
@@ -37,7 +37,7 @@
 #include <linux/module.h>
 
 #include "rt2x00.h"
-#ifdef CONFIG_RT2800USB
+#if defined(CONFIG_RT2800USB) || defined(CONFIG_RT2800USB_MODULE)
 #include "rt2x00usb.h"
 #endif
 #include "rt2800lib.h"
@@ -340,7 +340,7 @@ static int rt2800_blink_set(struct led_classdev *led_cdev,
         rt2x00_set_field32(&reg, LED_CFG_OFF_PERIOD, *delay_off);
         rt2x00_set_field32(&reg, LED_CFG_SLOW_BLINK_PERIOD, 3);
         rt2x00_set_field32(&reg, LED_CFG_R_LED_MODE, 3);
-        rt2x00_set_field32(&reg, LED_CFG_G_LED_MODE, 12);
+        rt2x00_set_field32(&reg, LED_CFG_G_LED_MODE, 3);
         rt2x00_set_field32(&reg, LED_CFG_Y_LED_MODE, 3);
         rt2x00_set_field32(&reg, LED_CFG_LED_POLAR, 1);
         rt2800_register_write(led->rt2x00dev, LED_CFG, reg);
@@ -1121,7 +1121,7 @@ int rt2800_init_registers(struct rt2x00_dev *rt2x00dev)
 
         if (rt2x00_intf_is_usb(rt2x00dev)) {
                 rt2800_register_write(rt2x00dev, USB_DMA_CFG, 0x00000000);
-#ifdef CONFIG_RT2800USB
+#if defined(CONFIG_RT2800USB) || defined(CONFIG_RT2800USB_MODULE)
                 rt2x00usb_vendor_request_sw(rt2x00dev, USB_DEVICE_MODE, 0,
                                             USB_MODE_RESET, REGISTER_TIMEOUT);
 #endif
@@ -2022,6 +2022,12 @@ int rt2800_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
         u16 eeprom;
 
         /*
+         * Disable powersaving as default on PCI devices.
+         */
+        if (rt2x00_intf_is_pci(rt2x00dev))
+                rt2x00dev->hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
+
+        /*
          * Initialize all hw fields.
          */
         rt2x00dev->hw->flags =
@@ -2074,8 +2080,7 @@ int rt2800_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
             IEEE80211_HT_CAP_SGI_20 |
             IEEE80211_HT_CAP_SGI_40 |
             IEEE80211_HT_CAP_TX_STBC |
-            IEEE80211_HT_CAP_RX_STBC |
-            IEEE80211_HT_CAP_PSMP_SUPPORT;
+            IEEE80211_HT_CAP_RX_STBC;
         spec->ht.ampdu_factor = 3;
         spec->ht.ampdu_density = 4;
         spec->ht.mcs.tx_params =
@@ -2140,8 +2145,8 @@ static void rt2800_get_tkip_seq(struct ieee80211_hw *hw, u8 hw_key_idx,
         rt2800_register_multiread(rt2x00dev, offset,
                                       &iveiv_entry, sizeof(iveiv_entry));
 
-        memcpy(&iveiv_entry.iv[0], iv16, sizeof(iv16));
-        memcpy(&iveiv_entry.iv[4], iv32, sizeof(iv32));
+        memcpy(iv16, &iveiv_entry.iv[0], sizeof(*iv16));
+        memcpy(iv32, &iveiv_entry.iv[4], sizeof(*iv32));
 }
 
 static int rt2800_set_rts_threshold(struct ieee80211_hw *hw, u32 value)
diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c
index af85d18cdbe7..ab95346cf6a3 100644
--- a/drivers/net/wireless/rt2x00/rt2800usb.c
+++ b/drivers/net/wireless/rt2x00/rt2800usb.c
@@ -922,6 +922,7 @@ static struct usb_device_id rt2800usb_device_table[] = {
         { USB_DEVICE(0x1737, 0x0070), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x1737, 0x0071), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x1737, 0x0077), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x1737, 0x0079), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Logitec */
         { USB_DEVICE(0x0789, 0x0162), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x0789, 0x0163), USB_DEVICE_DATA(&rt2800usb_ops) },
diff --git a/drivers/net/wireless/rt2x00/rt2x00.h b/drivers/net/wireless/rt2x00/rt2x00.h
index 4d841c07c970..dcfc8c25d1a7 100644
--- a/drivers/net/wireless/rt2x00/rt2x00.h
+++ b/drivers/net/wireless/rt2x00/rt2x00.h
@@ -113,6 +113,12 @@
         (  ((unsigned long)((__skb)->data + (__header))) & 3 )
 
 /*
+ * Constants for extra TX headroom for alignment purposes.
+ */
+#define RT2X00_ALIGN_SIZE       4 /* Only whole frame needs alignment */
+#define RT2X00_L2PAD_SIZE       8 /* Both header & payload need alignment */
+
+/*
  * Standard timing and size defines.
  * These values should follow the ieee80211 specifications.
  */
diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
index 06c43ca39bf8..265e66dba552 100644
--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
@@ -686,7 +686,17 @@ static int rt2x00lib_probe_hw(struct rt2x00_dev *rt2x00dev)
         /*
          * Initialize extra TX headroom required.
          */
-        rt2x00dev->hw->extra_tx_headroom = rt2x00dev->ops->extra_tx_headroom;
+        rt2x00dev->hw->extra_tx_headroom =
+                max_t(unsigned int, IEEE80211_TX_STATUS_HEADROOM,
+                      rt2x00dev->ops->extra_tx_headroom);
+
+        /*
+         * Take TX headroom required for alignment into account.
+         */
+        if (test_bit(DRIVER_REQUIRE_L2PAD, &rt2x00dev->flags))
+                rt2x00dev->hw->extra_tx_headroom += RT2X00_L2PAD_SIZE;
+        else if (test_bit(DRIVER_REQUIRE_DMA, &rt2x00dev->flags))
+                rt2x00dev->hw->extra_tx_headroom += RT2X00_ALIGN_SIZE;
 
         /*
          * Register HW.
diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.c b/drivers/net/wireless/rt2x00/rt2x00queue.c
index 239afc7a9c0b..9915a09141ef 100644
--- a/drivers/net/wireless/rt2x00/rt2x00queue.c
+++ b/drivers/net/wireless/rt2x00/rt2x00queue.c
@@ -104,7 +104,7 @@ void rt2x00queue_map_txskb(struct rt2x00_dev *rt2x00dev, struct sk_buff *skb)
          * is also mapped to the DMA so it can be used for transfering
          * additional descriptor information to the hardware.
          */
-        skb_push(skb, rt2x00dev->hw->extra_tx_headroom);
+        skb_push(skb, rt2x00dev->ops->extra_tx_headroom);
 
         skbdesc->skb_dma =
             dma_map_single(rt2x00dev->dev, skb->data, skb->len, DMA_TO_DEVICE);
@@ -112,7 +112,7 @@ void rt2x00queue_map_txskb(struct rt2x00_dev *rt2x00dev, struct sk_buff *skb)
         /*
          * Restore data pointer to original location again.
          */
-        skb_pull(skb, rt2x00dev->hw->extra_tx_headroom);
+        skb_pull(skb, rt2x00dev->ops->extra_tx_headroom);
 
         skbdesc->flags |= SKBDESC_DMA_MAPPED_TX;
 }
@@ -134,7 +134,7 @@ void rt2x00queue_unmap_skb(struct rt2x00_dev *rt2x00dev, struct sk_buff *skb)
                  * by the driver, but it was actually mapped to DMA.
                  */
                 dma_unmap_single(rt2x00dev->dev, skbdesc->skb_dma,
-                                 skb->len + rt2x00dev->hw->extra_tx_headroom,
+                                 skb->len + rt2x00dev->ops->extra_tx_headroom,
                                  DMA_TO_DEVICE);
                 skbdesc->flags &= ~SKBDESC_DMA_MAPPED_TX;
         }
diff --git a/drivers/net/wireless/rt2x00/rt61pci.c b/drivers/net/wireless/rt2x00/rt61pci.c
index 687e17dc2e9f..0ca589306d71 100644
--- a/drivers/net/wireless/rt2x00/rt61pci.c
+++ b/drivers/net/wireless/rt2x00/rt61pci.c
@@ -2539,6 +2539,11 @@ static int rt61pci_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
         unsigned int i;
 
         /*
+         * Disable powersaving as default.
+         */
+        rt2x00dev->hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
+
+        /*
          * Initialize all hw fields.
          */
         rt2x00dev->hw->flags =
diff --git a/drivers/net/wireless/rtl818x/rtl8180_dev.c b/drivers/net/wireless/rtl818x/rtl8180_dev.c
index a1a3dd15c664..8a40a1439984 100644
--- a/drivers/net/wireless/rtl818x/rtl8180_dev.c
+++ b/drivers/net/wireless/rtl818x/rtl8180_dev.c
@@ -132,7 +132,6 @@ static void rtl8180_handle_rx(struct ieee80211_hw *dev)
 
                         rx_status.antenna = (flags2 >> 15) & 1;
                         /* TODO: improve signal/rssi reporting */
-                        rx_status.qual = flags2 & 0xFF;
                         rx_status.signal = (flags2 >> 8) & 0x7F;
                         /* XXX: is this correct? */
                         rx_status.rate_idx = (flags >> 20) & 0xF;
diff --git a/drivers/net/wireless/rtl818x/rtl8187_dev.c b/drivers/net/wireless/rtl818x/rtl8187_dev.c
index bc5726dd5fe4..7ba3052b0708 100644
--- a/drivers/net/wireless/rtl818x/rtl8187_dev.c
+++ b/drivers/net/wireless/rtl818x/rtl8187_dev.c
@@ -65,6 +65,7 @@ static struct usb_device_id rtl8187_table[] __devinitdata = {
         /* Sitecom */
         {USB_DEVICE(0x0df6, 0x000d), .driver_info = DEVICE_RTL8187},
         {USB_DEVICE(0x0df6, 0x0028), .driver_info = DEVICE_RTL8187B},
+        {USB_DEVICE(0x0df6, 0x0029), .driver_info = DEVICE_RTL8187B},
         /* Sphairon Access Systems GmbH */
         {USB_DEVICE(0x114B, 0x0150), .driver_info = DEVICE_RTL8187},
         /* Dick Smith Electronics */
diff --git a/drivers/net/wireless/wl12xx/wl1251_boot.c b/drivers/net/wireless/wl12xx/wl1251_boot.c
index 2e733e7bdfd4..28a808674080 100644
--- a/drivers/net/wireless/wl12xx/wl1251_boot.c
+++ b/drivers/net/wireless/wl12xx/wl1251_boot.c
@@ -256,7 +256,7 @@ int wl1251_boot_run_firmware(struct wl1251 *wl)
                 }
         }
 
-        if (loop >= INIT_LOOP) {
+        if (loop > INIT_LOOP) {
                 wl1251_error("timeout waiting for the hardware to "
                              "complete initialization");
                 return -EIO;
diff --git a/drivers/net/wireless/wl12xx/wl1271_cmd.c b/drivers/net/wireless/wl12xx/wl1271_cmd.c
index 886a9bc39cc1..c3385b3d246c 100644
--- a/drivers/net/wireless/wl12xx/wl1271_cmd.c
+++ b/drivers/net/wireless/wl12xx/wl1271_cmd.c
@@ -777,7 +777,7 @@ out:
         return ret;
 }
 
-static int wl1271_build_basic_rates(char *rates, u8 band)
+static int wl1271_build_basic_rates(u8 *rates, u8 band)
 {
         u8 index = 0;
 
@@ -804,7 +804,7 @@ static int wl1271_build_basic_rates(char *rates, u8 band)
         return index;
 }
 
-static int wl1271_build_extended_rates(char *rates, u8 band)
+static int wl1271_build_extended_rates(u8 *rates, u8 band)
 {
         u8 index = 0;
 
diff --git a/drivers/net/wireless/zd1211rw/zd_chip.c b/drivers/net/wireless/zd1211rw/zd_chip.c
index dfa1b9bc22c8..7ca95c414fa8 100644
--- a/drivers/net/wireless/zd1211rw/zd_chip.c
+++ b/drivers/net/wireless/zd1211rw/zd_chip.c
@@ -1325,151 +1325,11 @@ int zd_chip_set_basic_rates(struct zd_chip *chip, u16 cr_rates)
         return r;
 }
 
-static int ofdm_qual_db(u8 status_quality, u8 zd_rate, unsigned int size)
-{
-        static const u16 constants[] = {
-                715, 655, 585, 540, 470, 410, 360, 315,
-                270, 235, 205, 175, 150, 125, 105,  85,
-                 65,  50,  40,  25,  15
-        };
-
-        int i;
-        u32 x;
-
-        /* It seems that their quality parameter is somehow per signal
-         * and is now transferred per bit.
-         */
-        switch (zd_rate) {
-        case ZD_OFDM_RATE_6M:
-        case ZD_OFDM_RATE_12M:
-        case ZD_OFDM_RATE_24M:
-                size *= 2;
-                break;
-        case ZD_OFDM_RATE_9M:
-        case ZD_OFDM_RATE_18M:
-        case ZD_OFDM_RATE_36M:
-        case ZD_OFDM_RATE_54M:
-                size *= 4;
-                size /= 3;
-                break;
-        case ZD_OFDM_RATE_48M:
-                size *= 3;
-                size /= 2;
-                break;
-        default:
-                return -EINVAL;
-        }
-
-        x = (10000 * status_quality)/size;
-        for (i = 0; i < ARRAY_SIZE(constants); i++) {
-                if (x > constants[i])
-                        break;
-        }
-
-        switch (zd_rate) {
-        case ZD_OFDM_RATE_6M:
-        case ZD_OFDM_RATE_9M:
-                i += 3;
-                break;
-        case ZD_OFDM_RATE_12M:
-        case ZD_OFDM_RATE_18M:
-                i += 5;
-                break;
-        case ZD_OFDM_RATE_24M:
-        case ZD_OFDM_RATE_36M:
-                i += 9;
-                break;
-        case ZD_OFDM_RATE_48M:
-        case ZD_OFDM_RATE_54M:
-                i += 15;
-                break;
-        default:
-                return -EINVAL;
-        }
-
-        return i;
-}
-
-static int ofdm_qual_percent(u8 status_quality, u8 zd_rate, unsigned int size)
-{
-        int r;
-
-        r = ofdm_qual_db(status_quality, zd_rate, size);
-        ZD_ASSERT(r >= 0);
-        if (r < 0)
-                r = 0;
-
-        r = (r * 100)/29;
-        return r <= 100 ? r : 100;
-}
-
-static unsigned int log10times100(unsigned int x)
-{
-        static const u8 log10[] = {
-                  0,
-                  0,   30,   47,   60,   69,   77,   84,   90,   95,  100,
-                104,  107,  111,  114,  117,  120,  123,  125,  127,  130,
-                132,  134,  136,  138,  139,  141,  143,  144,  146,  147,
-                149,  150,  151,  153,  154,  155,  156,  157,  159,  160,
-                161,  162,  163,  164,  165,  166,  167,  168,  169,  169,
-                170,  171,  172,  173,  174,  174,  175,  176,  177,  177,
-                178,  179,  179,  180,  181,  181,  182,  183,  183,  184,
-                185,  185,  186,  186,  187,  188,  188,  189,  189,  190,
-                190,  191,  191,  192,  192,  193,  193,  194,  194,  195,
-                195,  196,  196,  197,  197,  198,  198,  199,  199,  200,
-                200,  200,  201,  201,  202,  202,  202,  203,  203,  204,
-                204,  204,  205,  205,  206,  206,  206,  207,  207,  207,
-                208,  208,  208,  209,  209,  210,  210,  210,  211,  211,
-                211,  212,  212,  212,  213,  213,  213,  213,  214,  214,
-                214,  215,  215,  215,  216,  216,  216,  217,  217,  217,
-                217,  218,  218,  218,  219,  219,  219,  219,  220,  220,
-                220,  220,  221,  221,  221,  222,  222,  222,  222,  223,
-                223,  223,  223,  224,  224,  224,  224,
-        };
-
-        return x < ARRAY_SIZE(log10) ? log10[x] : 225;
-}
-
-enum {
-        MAX_CCK_EVM_DB = 45,
-};
-
-static int cck_evm_db(u8 status_quality)
-{
-        return (20 * log10times100(status_quality)) / 100;
-}
-
-static int cck_snr_db(u8 status_quality)
-{
-        int r = MAX_CCK_EVM_DB - cck_evm_db(status_quality);
-        ZD_ASSERT(r >= 0);
-        return r;
-}
-
-static int cck_qual_percent(u8 status_quality)
-{
-        int r;
-
-        r = cck_snr_db(status_quality);
-        r = (100*r)/17;
-        return r <= 100 ? r : 100;
-}
-
 static inline u8 zd_rate_from_ofdm_plcp_header(const void *rx_frame)
 {
         return ZD_OFDM | zd_ofdm_plcp_header_rate(rx_frame);
 }
 
-u8 zd_rx_qual_percent(const void *rx_frame, unsigned int size,
-                      const struct rx_status *status)
-{
-        return (status->frame_status&ZD_RX_OFDM) ?
-                ofdm_qual_percent(status->signal_quality_ofdm,
-                                  zd_rate_from_ofdm_plcp_header(rx_frame),
-                                  size) :
-                cck_qual_percent(status->signal_quality_cck);
-}
-
 /**
  * zd_rx_rate - report zd-rate
  * @rx_frame - received frame
diff --git a/drivers/net/wireless/zd1211rw/zd_chip.h b/drivers/net/wireless/zd1211rw/zd_chip.h
index 9fd8f3508d66..f8bbf7d302ae 100644
--- a/drivers/net/wireless/zd1211rw/zd_chip.h
+++ b/drivers/net/wireless/zd1211rw/zd_chip.h
@@ -929,9 +929,6 @@ static inline int zd_get_beacon_interval(struct zd_chip *chip, u32 *interval)
 
 struct rx_status;
 
-u8 zd_rx_qual_percent(const void *rx_frame, unsigned int size,
-                       const struct rx_status *status);
-
 u8 zd_rx_rate(const void *rx_frame, const struct rx_status *status);
 
 struct zd_mc_hash {
diff --git a/drivers/net/wireless/zd1211rw/zd_mac.c b/drivers/net/wireless/zd1211rw/zd_mac.c
index cf51e8f8174b..f14deb0c8514 100644
--- a/drivers/net/wireless/zd1211rw/zd_mac.c
+++ b/drivers/net/wireless/zd1211rw/zd_mac.c
@@ -828,9 +828,6 @@ int zd_mac_rx(struct ieee80211_hw *hw, const u8 *buffer, unsigned int length)
         stats.freq = zd_channels[_zd_chip_get_channel(&mac->chip) - 1].center_freq;
         stats.band = IEEE80211_BAND_2GHZ;
         stats.signal = status->signal_strength;
-        stats.qual = zd_rx_qual_percent(buffer,
-                                          length - sizeof(struct rx_status),
-                                          status);
 
         rate = zd_rx_rate(buffer, status);
 
@@ -990,12 +987,13 @@ static void zd_op_configure_filter(struct ieee80211_hw *hw,
         changed_flags &= SUPPORTED_FIF_FLAGS;
         *new_flags &= SUPPORTED_FIF_FLAGS;
 
-        /* changed_flags is always populated but this driver
-         * doesn't support all FIF flags so its possible we don't
-         * need to do anything */
-        if (!changed_flags)
-                return;
-
+        /*
+         * If multicast parameter (as returned by zd_op_prepare_multicast)
+         * has changed, no bit in changed_flags is set. To handle this
+         * situation, we do not return if changed_flags is 0. If we do so,
+         * we will have some issue with IPv6 which uses multicast for link
+         * layer address resolution.
+         */
         if (*new_flags & (FIF_PROMISC_IN_BSS | FIF_ALLMULTI))
                 zd_mc_add_all(&hash);
 
diff --git a/drivers/net/wireless/zd1211rw/zd_usb.c b/drivers/net/wireless/zd1211rw/zd_usb.c
index ac19ecd19cfe..72d3e437e190 100644
--- a/drivers/net/wireless/zd1211rw/zd_usb.c
+++ b/drivers/net/wireless/zd1211rw/zd_usb.c
@@ -62,6 +62,7 @@ static struct usb_device_id usb_ids[] = {
         { USB_DEVICE(0x6891, 0xa727), .driver_info = DEVICE_ZD1211 },
         /* ZD1211B */
         { USB_DEVICE(0x0053, 0x5301), .driver_info = DEVICE_ZD1211B },
+        { USB_DEVICE(0x0409, 0x0248), .driver_info = DEVICE_ZD1211B },
         { USB_DEVICE(0x0411, 0x00da), .driver_info = DEVICE_ZD1211B },
         { USB_DEVICE(0x0471, 0x1236), .driver_info = DEVICE_ZD1211B },
         { USB_DEVICE(0x0471, 0x1237), .driver_info = DEVICE_ZD1211B },