Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux-2.6

35 files changed, 184 insertions, 135 deletions

diff --git a/drivers/net/3c59x.c b/drivers/net/3c59x.c
index 001c66dd3a94..a8c0f436cdd2 100644
--- a/drivers/net/3c59x.c
+++ b/drivers/net/3c59x.c
@@ -1555,6 +1555,7 @@ vortex_up(struct net_device *dev)
                 mii_reg1 = mdio_read(dev, vp->phys[0], MII_BMSR);
                 mii_reg5 = mdio_read(dev, vp->phys[0], MII_LPA);
                 vp->partner_flow_ctrl = ((mii_reg5 & 0x0400) != 0);
+                vp->mii.full_duplex = vp->full_duplex;
 
                 vortex_check_media(dev, 1);
         }
diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
index 81ef81c9a584..5b9e17bf1749 100644
--- a/drivers/net/Kconfig
+++ b/drivers/net/Kconfig
@@ -1968,6 +1968,16 @@ menuconfig NETDEV_1000
         bool "Ethernet (1000 Mbit)"
         depends on !UML
         default y
+        ---help---
+          Ethernet (also called IEEE 802.3 or ISO 8802-2) is the most common
+          type of Local Area Network (LAN) in universities and companies.
+
+          Say Y here to get to see options for Gigabit Ethernet drivers.
+          This option alone does not add any kernel code.
+          Note that drivers supporting both 100 and 1000 MBit may be listed
+          under "Ethernet (10 or 100MBit)" instead.
+
+          If you say N, all options in this submenu will be skipped and disabled.
 
 if NETDEV_1000
 
@@ -2339,6 +2349,11 @@ menuconfig NETDEV_10000
         bool "Ethernet (10000 Mbit)"
         depends on !UML
         default y
+        ---help---
+          Say Y here to get to see options for 10 Gigabit Ethernet drivers.
+          This option alone does not add any kernel code.
+
+          If you say N, all options in this submenu will be skipped and disabled.
 
 if NETDEV_10000
 
diff --git a/drivers/net/atl1/atl1_main.c b/drivers/net/atl1/atl1_main.c
index 56f6389a300e..3c1984ecf36c 100644
--- a/drivers/net/atl1/atl1_main.c
+++ b/drivers/net/atl1/atl1_main.c
@@ -1704,10 +1704,8 @@ static int atl1_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
                 }
         }
 
-        local_irq_save(flags);
-        if (!spin_trylock(&adapter->lock)) {
+        if (!spin_trylock_irqsave(&adapter->lock, flags)) {
                 /* Can't get lock - tell upper layer to requeue */
-                local_irq_restore(flags);
                 dev_printk(KERN_DEBUG, &adapter->pdev->dev, "tx locked\n");
                 return NETDEV_TX_LOCKED;
         }
diff --git a/drivers/net/ax88796.c b/drivers/net/ax88796.c
index 83da1770bafb..90e0734e6037 100644
--- a/drivers/net/ax88796.c
+++ b/drivers/net/ax88796.c
@@ -821,8 +821,9 @@ static int ax_probe(struct platform_device *pdev)
         dev->base_addr = (unsigned long)ei_status.mem;
 
         if (ei_status.mem == NULL) {
-                dev_err(&pdev->dev, "Cannot ioremap area (%08zx,%08zx)\n",
-                        res->start, res->end);
+                dev_err(&pdev->dev, "Cannot ioremap area (%08llx,%08llx)\n",
+                        (unsigned long long)res->start,
+                        (unsigned long long)res->end);
 
                 ret = -ENXIO;
                 goto exit_req;
diff --git a/drivers/net/bnx2.c b/drivers/net/bnx2.c
index d53dfc5bbae0..24e7f9ab3f5a 100644
--- a/drivers/net/bnx2.c
+++ b/drivers/net/bnx2.c
@@ -54,8 +54,8 @@
 
 #define DRV_MODULE_NAME         "bnx2"
 #define PFX DRV_MODULE_NAME     ": "
-#define DRV_MODULE_VERSION      "1.6.3"
-#define DRV_MODULE_RELDATE      "July 16, 2007"
+#define DRV_MODULE_VERSION      "1.6.4"
+#define DRV_MODULE_RELDATE      "August 3, 2007"
 
 #define RUN_AT(x) (jiffies + (x))
 
@@ -6937,6 +6937,11 @@ bnx2_suspend(struct pci_dev *pdev, pm_message_t state)
         struct bnx2 *bp = netdev_priv(dev);
         u32 reset_code;
 
+        /* PCI register 4 needs to be saved whether netif_running() or not.
+         * MSI address and data need to be saved if using MSI and
+         * netif_running().
+         */
+        pci_save_state(pdev);
         if (!netif_running(dev))
                 return 0;
 
@@ -6952,7 +6957,6 @@ bnx2_suspend(struct pci_dev *pdev, pm_message_t state)
                 reset_code = BNX2_DRV_MSG_CODE_SUSPEND_NO_WOL;
         bnx2_reset_chip(bp, reset_code);
         bnx2_free_skbs(bp);
-        pci_save_state(pdev);
         bnx2_set_power_state(bp, pci_choose_state(pdev, state));
         return 0;
 }
@@ -6963,10 +6967,10 @@ bnx2_resume(struct pci_dev *pdev)
         struct net_device *dev = pci_get_drvdata(pdev);
         struct bnx2 *bp = netdev_priv(dev);
 
+        pci_restore_state(pdev);
         if (!netif_running(dev))
                 return 0;
 
-        pci_restore_state(pdev);
         bnx2_set_power_state(bp, PCI_D0);
         netif_device_attach(dev);
         bnx2_init_nic(bp);
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 070b78d959cc..1afda3230def 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1202,43 +1202,35 @@ static int bond_sethwaddr(struct net_device *bond_dev,
         return 0;
 }
 
-#define BOND_INTERSECT_FEATURES \
-        (NETIF_F_SG | NETIF_F_ALL_CSUM | NETIF_F_TSO | NETIF_F_UFO)
+#define BOND_VLAN_FEATURES \
+        (NETIF_F_VLAN_CHALLENGED | NETIF_F_HW_VLAN_RX | NETIF_F_HW_VLAN_TX | \
+         NETIF_F_HW_VLAN_FILTER)
 
 /* 
  * Compute the common dev->feature set available to all slaves.  Some
- * feature bits are managed elsewhere, so preserve feature bits set on
- * master device that are not part of the examined set.
+ * feature bits are managed elsewhere, so preserve those feature bits
+ * on the master device.
  */
 static int bond_compute_features(struct bonding *bond)
 {
-        unsigned long features = BOND_INTERSECT_FEATURES;
         struct slave *slave;
         struct net_device *bond_dev = bond->dev;
+        unsigned long features = bond_dev->features;
         unsigned short max_hard_header_len = ETH_HLEN;
         int i;
 
+        features &= ~(NETIF_F_ALL_CSUM | BOND_VLAN_FEATURES);
+        features |= NETIF_F_SG | NETIF_F_FRAGLIST | NETIF_F_HIGHDMA |
+                    NETIF_F_GSO_MASK | NETIF_F_NO_CSUM;
+
         bond_for_each_slave(bond, slave, i) {
-                features &= (slave->dev->features & BOND_INTERSECT_FEATURES);
+                features = netdev_compute_features(features,
+                                                   slave->dev->features);
                 if (slave->dev->hard_header_len > max_hard_header_len)
                         max_hard_header_len = slave->dev->hard_header_len;
         }
 
-        if ((features & NETIF_F_SG) && 
-            !(features & NETIF_F_ALL_CSUM))
-                features &= ~NETIF_F_SG;
-
-        /* 
-         * features will include NETIF_F_TSO (NETIF_F_UFO) iff all 
-         * slave devices support NETIF_F_TSO (NETIF_F_UFO), which 
-         * implies that all slaves also support scatter-gather 
-         * (NETIF_F_SG), which implies that features also includes 
-         * NETIF_F_SG. So no need to check whether we have an  
-         * illegal combination of NETIF_F_{TSO,UFO} and 
-         * !NETIF_F_SG 
-         */
-
-        features |= (bond_dev->features & ~BOND_INTERSECT_FEATURES);
+        features |= (bond_dev->features & BOND_VLAN_FEATURES);
         bond_dev->features = features;
         bond_dev->hard_header_len = max_hard_header_len;
 
diff --git a/drivers/net/e1000/e1000_ethtool.c b/drivers/net/e1000/e1000_ethtool.c
index c90c92e72d2a..4c3785c9d4b8 100644
--- a/drivers/net/e1000/e1000_ethtool.c
+++ b/drivers/net/e1000/e1000_ethtool.c
@@ -1706,6 +1706,7 @@ static int e1000_wol_exclusion(struct e1000_adapter *adapter, struct ethtool_wol
         case E1000_DEV_ID_82545EM_COPPER:
         case E1000_DEV_ID_82546GB_QUAD_COPPER:
         case E1000_DEV_ID_82546GB_PCIE:
+        case E1000_DEV_ID_82571EB_SERDES_QUAD:
                 /* these don't support WoL at all */
                 wol->supported = 0;
                 break;
@@ -1723,6 +1724,7 @@ static int e1000_wol_exclusion(struct e1000_adapter *adapter, struct ethtool_wol
                 retval = 0;
                 break;
         case E1000_DEV_ID_82571EB_QUAD_COPPER:
+        case E1000_DEV_ID_82571EB_QUAD_FIBER:
         case E1000_DEV_ID_82571EB_QUAD_COPPER_LOWPROFILE:
         case E1000_DEV_ID_82546GB_QUAD_COPPER_KSP3:
                 /* quad port adapters only support WoL on port A */
diff --git a/drivers/net/e1000/e1000_hw.c b/drivers/net/e1000/e1000_hw.c
index 9be44699300b..ba120f7fb0be 100644
--- a/drivers/net/e1000/e1000_hw.c
+++ b/drivers/net/e1000/e1000_hw.c
@@ -384,7 +384,10 @@ e1000_set_mac_type(struct e1000_hw *hw)
         case E1000_DEV_ID_82571EB_COPPER:
         case E1000_DEV_ID_82571EB_FIBER:
         case E1000_DEV_ID_82571EB_SERDES:
+        case E1000_DEV_ID_82571EB_SERDES_DUAL:
+        case E1000_DEV_ID_82571EB_SERDES_QUAD:
         case E1000_DEV_ID_82571EB_QUAD_COPPER:
+        case E1000_DEV_ID_82571EB_QUAD_FIBER:
         case E1000_DEV_ID_82571EB_QUAD_COPPER_LOWPROFILE:
                 hw->mac_type = e1000_82571;
                 break;
@@ -485,6 +488,8 @@ e1000_set_media_type(struct e1000_hw *hw)
     case E1000_DEV_ID_82545GM_SERDES:
     case E1000_DEV_ID_82546GB_SERDES:
     case E1000_DEV_ID_82571EB_SERDES:
+    case E1000_DEV_ID_82571EB_SERDES_DUAL:
+    case E1000_DEV_ID_82571EB_SERDES_QUAD:
     case E1000_DEV_ID_82572EI_SERDES:
     case E1000_DEV_ID_80003ES2LAN_SERDES_DPT:
         hw->media_type = e1000_media_type_internal_serdes;
diff --git a/drivers/net/e1000/e1000_hw.h b/drivers/net/e1000/e1000_hw.h
index bd000b802ee7..fe8714655c90 100644
--- a/drivers/net/e1000/e1000_hw.h
+++ b/drivers/net/e1000/e1000_hw.h
@@ -475,7 +475,10 @@ int32_t e1000_check_phy_reset_block(struct e1000_hw *hw);
 #define E1000_DEV_ID_82571EB_FIBER       0x105F
 #define E1000_DEV_ID_82571EB_SERDES      0x1060
 #define E1000_DEV_ID_82571EB_QUAD_COPPER 0x10A4
+#define E1000_DEV_ID_82571EB_QUAD_FIBER  0x10A5
 #define E1000_DEV_ID_82571EB_QUAD_COPPER_LOWPROFILE  0x10BC
+#define E1000_DEV_ID_82571EB_SERDES_DUAL 0x10D9
+#define E1000_DEV_ID_82571EB_SERDES_QUAD 0x10DA
 #define E1000_DEV_ID_82572EI_COPPER      0x107D
 #define E1000_DEV_ID_82572EI_FIBER       0x107E
 #define E1000_DEV_ID_82572EI_SERDES      0x107F
diff --git a/drivers/net/e1000/e1000_main.c b/drivers/net/e1000/e1000_main.c
index f48b659e0c2b..4a225950fb43 100644
--- a/drivers/net/e1000/e1000_main.c
+++ b/drivers/net/e1000/e1000_main.c
@@ -100,6 +100,7 @@ static struct pci_device_id e1000_pci_tbl[] = {
         INTEL_E1000_ETHERNET_DEVICE(0x1099),
         INTEL_E1000_ETHERNET_DEVICE(0x109A),
         INTEL_E1000_ETHERNET_DEVICE(0x10A4),
+        INTEL_E1000_ETHERNET_DEVICE(0x10A5),
         INTEL_E1000_ETHERNET_DEVICE(0x10B5),
         INTEL_E1000_ETHERNET_DEVICE(0x10B9),
         INTEL_E1000_ETHERNET_DEVICE(0x10BA),
@@ -107,6 +108,8 @@ static struct pci_device_id e1000_pci_tbl[] = {
         INTEL_E1000_ETHERNET_DEVICE(0x10BC),
         INTEL_E1000_ETHERNET_DEVICE(0x10C4),
         INTEL_E1000_ETHERNET_DEVICE(0x10C5),
+        INTEL_E1000_ETHERNET_DEVICE(0x10D9),
+        INTEL_E1000_ETHERNET_DEVICE(0x10DA),
         /* required last entry */
         {0,}
 };
@@ -1096,6 +1099,7 @@ e1000_probe(struct pci_dev *pdev,
                 break;
         case E1000_DEV_ID_82546GB_QUAD_COPPER_KSP3:
         case E1000_DEV_ID_82571EB_QUAD_COPPER:
+        case E1000_DEV_ID_82571EB_QUAD_FIBER:
         case E1000_DEV_ID_82571EB_QUAD_COPPER_LOWPROFILE:
                 /* if quad port adapter, disable WoL on all but port A */
                 if (global_quad_port_a != 0)
diff --git a/drivers/net/ehea/ehea.h b/drivers/net/ehea/ehea.h
index 8ee2c2c86b42..d67f97bfa3a4 100644
--- a/drivers/net/ehea/ehea.h
+++ b/drivers/net/ehea/ehea.h
@@ -39,7 +39,7 @@
 #include <asm/io.h>
 
 #define DRV_NAME        "ehea"
-#define DRV_VERSION     "EHEA_0072"
+#define DRV_VERSION     "EHEA_0073"
 
 /* eHEA capability flags */
 #define DLPAR_PORT_ADD_REM 1
diff --git a/drivers/net/ehea/ehea_main.c b/drivers/net/ehea/ehea_main.c
index 58702f54c3fb..9756211e83ce 100644
--- a/drivers/net/ehea/ehea_main.c
+++ b/drivers/net/ehea/ehea_main.c
@@ -1326,7 +1326,6 @@ static void write_swqe2_TSO(struct sk_buff *skb,
         u8 *imm_data = &swqe->u.immdata_desc.immediate_data[0];
         int skb_data_size = skb->len - skb->data_len;
         int headersize;
-        u64 tmp_addr;
 
         /* Packet is TCP with TSO enabled */
         swqe->tx_control |= EHEA_SWQE_TSO;
@@ -1347,9 +1346,8 @@ static void write_swqe2_TSO(struct sk_buff *skb,
                         /* set sg1entry data */
                         sg1entry->l_key = lkey;
                         sg1entry->len = skb_data_size - headersize;
-
-                        tmp_addr = (u64)(skb->data + headersize);
-                        sg1entry->vaddr = ehea_map_vaddr(tmp_addr);
+                        sg1entry->vaddr =
+                                ehea_map_vaddr(skb->data + headersize);
                         swqe->descriptors++;
                 }
         } else
@@ -1362,7 +1360,6 @@ static void write_swqe2_nonTSO(struct sk_buff *skb,
         int skb_data_size = skb->len - skb->data_len;
         u8 *imm_data = &swqe->u.immdata_desc.immediate_data[0];
         struct ehea_vsgentry *sg1entry = &swqe->u.immdata_desc.sg_entry;
-        u64 tmp_addr;
 
         /* Packet is any nonTSO type
          *
@@ -1379,8 +1376,8 @@ static void write_swqe2_nonTSO(struct sk_buff *skb,
                         /* copy sg1entry data */
                         sg1entry->l_key = lkey;
                         sg1entry->len = skb_data_size - SWQE2_MAX_IMM;
-                        tmp_addr = (u64)(skb->data + SWQE2_MAX_IMM);
-                        sg1entry->vaddr = ehea_map_vaddr(tmp_addr);
+                        sg1entry->vaddr =
+                                ehea_map_vaddr(skb->data + SWQE2_MAX_IMM);
                         swqe->descriptors++;
                 }
         } else {
@@ -1395,7 +1392,6 @@ static inline void write_swqe2_data(struct sk_buff *skb, struct net_device *dev,
         struct ehea_vsgentry *sg_list, *sg1entry, *sgentry;
         skb_frag_t *frag;
         int nfrags, sg1entry_contains_frag_data, i;
-        u64 tmp_addr;
 
         nfrags = skb_shinfo(skb)->nr_frags;
         sg1entry = &swqe->u.immdata_desc.sg_entry;
@@ -1417,9 +1413,9 @@ static inline void write_swqe2_data(struct sk_buff *skb, struct net_device *dev,
                         /* copy sg1entry data */
                         sg1entry->l_key = lkey;
                         sg1entry->len = frag->size;
-                        tmp_addr =  (u64)(page_address(frag->page)
-                                          + frag->page_offset);
-                        sg1entry->vaddr = ehea_map_vaddr(tmp_addr);
+                        sg1entry->vaddr =
+                                ehea_map_vaddr(page_address(frag->page)
+                                               + frag->page_offset);
                         swqe->descriptors++;
                         sg1entry_contains_frag_data = 1;
                 }
@@ -1431,10 +1427,9 @@ static inline void write_swqe2_data(struct sk_buff *skb, struct net_device *dev,
 
                         sgentry->l_key = lkey;
                         sgentry->len = frag->size;
-
-                        tmp_addr = (u64)(page_address(frag->page)
-                                         + frag->page_offset);
-                        sgentry->vaddr = ehea_map_vaddr(tmp_addr);
+                        sgentry->vaddr =
+                                ehea_map_vaddr(page_address(frag->page)
+                                               + frag->page_offset);
                         swqe->descriptors++;
                 }
         }
@@ -2165,24 +2160,18 @@ static int ehea_clean_all_portres(struct ehea_port *port)
         return ret;
 }
 
-static void ehea_remove_adapter_mr (struct ehea_adapter *adapter)
+static void ehea_remove_adapter_mr(struct ehea_adapter *adapter)
 {
-        int i;
-
-        for (i=0; i < EHEA_MAX_PORTS; i++)
-                if (adapter->port[i])
-                        return;
+        if (adapter->active_ports)
+                return;
 
         ehea_rem_mr(&adapter->mr);
 }
 
-static int ehea_add_adapter_mr (struct ehea_adapter *adapter)
+static int ehea_add_adapter_mr(struct ehea_adapter *adapter)
 {
-        int i;
-
-        for (i=0; i < EHEA_MAX_PORTS; i++)
-                if (adapter->port[i])
-                        return 0;
+        if (adapter->active_ports)
+                return 0;
 
         return ehea_reg_kernel_mr(adapter, &adapter->mr);
 }
@@ -3099,6 +3088,7 @@ out:
 
 static void __exit ehea_module_exit(void)
 {
+        destroy_workqueue(ehea_driver_wq);
         driver_remove_file(&ehea_driver.driver, &driver_attr_capabilities);
         ibmebus_unregister_driver(&ehea_driver);
         ehea_destroy_busmap();
diff --git a/drivers/net/forcedeth.c b/drivers/net/forcedeth.c
index 69f5f365239a..10f4e3b55168 100644
--- a/drivers/net/forcedeth.c
+++ b/drivers/net/forcedeth.c
@@ -3068,8 +3068,8 @@ static irqreturn_t nv_nic_irq(int foo, void *data)
                                 np->nic_poll_irq = np->irqmask;
                                 mod_timer(&np->nic_poll, jiffies + POLL_WAIT);
                         }
-                        printk(KERN_DEBUG "%s: too many iterations (%d) in nv_nic_irq.\n", dev->name, i);
                         spin_unlock(&np->lock);
+                        printk(KERN_DEBUG "%s: too many iterations (%d) in nv_nic_irq.\n", dev->name, i);
                         break;
                 }
 
@@ -3186,8 +3186,8 @@ static irqreturn_t nv_nic_irq_optimized(int foo, void *data)
                                 np->nic_poll_irq = np->irqmask;
                                 mod_timer(&np->nic_poll, jiffies + POLL_WAIT);
                         }
-                        printk(KERN_DEBUG "%s: too many iterations (%d) in nv_nic_irq.\n", dev->name, i);
                         spin_unlock(&np->lock);
+                        printk(KERN_DEBUG "%s: too many iterations (%d) in nv_nic_irq.\n", dev->name, i);
                         break;
                 }
 
@@ -3233,8 +3233,8 @@ static irqreturn_t nv_nic_irq_tx(int foo, void *data)
                                 np->nic_poll_irq |= NVREG_IRQ_TX_ALL;
                                 mod_timer(&np->nic_poll, jiffies + POLL_WAIT);
                         }
-                        printk(KERN_DEBUG "%s: too many iterations (%d) in nv_nic_irq_tx.\n", dev->name, i);
                         spin_unlock_irqrestore(&np->lock, flags);
+                        printk(KERN_DEBUG "%s: too many iterations (%d) in nv_nic_irq_tx.\n", dev->name, i);
                         break;
                 }
 
@@ -3348,8 +3348,8 @@ static irqreturn_t nv_nic_irq_rx(int foo, void *data)
                                 np->nic_poll_irq |= NVREG_IRQ_RX_ALL;
                                 mod_timer(&np->nic_poll, jiffies + POLL_WAIT);
                         }
-                        printk(KERN_DEBUG "%s: too many iterations (%d) in nv_nic_irq_rx.\n", dev->name, i);
                         spin_unlock_irqrestore(&np->lock, flags);
+                        printk(KERN_DEBUG "%s: too many iterations (%d) in nv_nic_irq_rx.\n", dev->name, i);
                         break;
                 }
         }
@@ -3421,8 +3421,8 @@ static irqreturn_t nv_nic_irq_other(int foo, void *data)
                                 np->nic_poll_irq |= NVREG_IRQ_OTHER;
                                 mod_timer(&np->nic_poll, jiffies + POLL_WAIT);
                         }
-                        printk(KERN_DEBUG "%s: too many iterations (%d) in nv_nic_irq_other.\n", dev->name, i);
                         spin_unlock_irqrestore(&np->lock, flags);
+                        printk(KERN_DEBUG "%s: too many iterations (%d) in nv_nic_irq_other.\n", dev->name, i);
                         break;
                 }
 
diff --git a/drivers/net/ibmveth.c b/drivers/net/ibmveth.c
index d96eb7229548..acba90f1638e 100644
--- a/drivers/net/ibmveth.c
+++ b/drivers/net/ibmveth.c
@@ -963,7 +963,7 @@ static int __devinit ibmveth_probe(struct vio_dev *dev, const struct vio_device_
 {
         int rc, i;
         struct net_device *netdev;
-        struct ibmveth_adapter *adapter = NULL;
+        struct ibmveth_adapter *adapter;
 
         unsigned char *mac_addr_p;
         unsigned int *mcastFilterSize_p;
@@ -997,7 +997,6 @@ static int __devinit ibmveth_probe(struct vio_dev *dev, const struct vio_device_
         SET_MODULE_OWNER(netdev);
 
         adapter = netdev->priv;
-        memset(adapter, 0, sizeof(adapter));
         dev->dev.driver_data = netdev;
 
         adapter->vdev = dev;
@@ -1280,24 +1279,28 @@ const char * buf, size_t count)
                         int i;
                         /* Make sure there is a buffer pool with buffers that
                            can hold a packet of the size of the MTU */
-                        for(i = 0; i<IbmVethNumBufferPools; i++) {
+                        for (i = 0; i < IbmVethNumBufferPools; i++) {
                                 if (pool == &adapter->rx_buff_pool[i])
                                         continue;
                                 if (!adapter->rx_buff_pool[i].active)
                                         continue;
-                                if (mtu < adapter->rx_buff_pool[i].buff_size) {
-                                        pool->active = 0;
-                                        h_free_logical_lan_buffer(adapter->
-                                                                  vdev->
-                                                                  unit_address,
-                                                                  pool->
-                                                                  buff_size);
-                                }
+                                if (mtu <= adapter->rx_buff_pool[i].buff_size)
+                                        break;
                         }
-                        if (pool->active) {
+
+                        if (i == IbmVethNumBufferPools) {
                                 ibmveth_error_printk("no active pool >= MTU\n");
                                 return -EPERM;
                         }
+
+                        pool->active = 0;
+                        if (netif_running(netdev)) {
+                                adapter->pool_config = 1;
+                                ibmveth_close(netdev);
+                                adapter->pool_config = 0;
+                                if ((rc = ibmveth_open(netdev)))
+                                        return rc;
+                        }
                 }
         } else if (attr == &veth_num_attr) {
                 if (value <= 0 || value > IBMVETH_MAX_POOL_COUNT)
diff --git a/drivers/net/ibmveth.h b/drivers/net/ibmveth.h
index bb69ccae8ace..72cc15a6cab7 100644
--- a/drivers/net/ibmveth.h
+++ b/drivers/net/ibmveth.h
@@ -73,9 +73,6 @@ static inline long h_send_logical_lan(unsigned long unit_address,
 #define h_change_logical_lan_mac(ua, mac) \
   plpar_hcall_norets(H_CHANGE_LOGICAL_LAN_MAC, ua, mac)
 
-#define h_free_logical_lan_buffer(ua, bufsize) \
-  plpar_hcall_norets(H_FREE_LOGICAL_LAN_BUFFER, ua, bufsize)
-
 #define IbmVethNumBufferPools 5
 #define IBMVETH_BUFF_OH 22 /* Overhead: 14 ethernet header + 8 opaque handle */
 #define IBMVETH_MAX_MTU 68
diff --git a/drivers/net/irda/irda-usb.c b/drivers/net/irda/irda-usb.c
index 0ac240ca905b..3b0fd83fa266 100644
--- a/drivers/net/irda/irda-usb.c
+++ b/drivers/net/irda/irda-usb.c
@@ -1561,10 +1561,9 @@ static inline struct irda_class_desc *irda_usb_find_class_desc(struct usb_interf
         struct irda_class_desc *desc;
         int ret;
 
-        desc = kmalloc(sizeof (*desc), GFP_KERNEL);
-        if (desc == NULL) 
+        desc = kzalloc(sizeof(*desc), GFP_KERNEL);
+        if (!desc)
                 return NULL;
-        memset(desc, 0, sizeof(*desc));
 
         /* USB-IrDA class spec 1.0:
          *      6.1.3: Standard "Get Descriptor" Device Request is not
@@ -1617,7 +1616,7 @@ static int irda_usb_probe(struct usb_interface *intf,
 {
         struct net_device *net;
         struct usb_device *dev = interface_to_usbdev(intf);
-        struct irda_usb_cb *self = NULL;
+        struct irda_usb_cb *self;
         struct usb_host_interface *interface;
         struct irda_class_desc *irda_desc;
         int ret = -ENOMEM;
@@ -1655,7 +1654,7 @@ static int irda_usb_probe(struct usb_interface *intf,
                 self->header_length = USB_IRDA_HEADER;
         }
 
-        self->rx_urb = kzalloc(self->max_rx_urb * sizeof(struct urb *),
+        self->rx_urb = kcalloc(self->max_rx_urb, sizeof(struct urb *),
                                 GFP_KERNEL);
 
         for (i = 0; i < self->max_rx_urb; i++) {
@@ -1715,7 +1714,7 @@ static int irda_usb_probe(struct usb_interface *intf,
         /* Find IrDA class descriptor */
         irda_desc = irda_usb_find_class_desc(intf);
         ret = -ENODEV;
-        if (irda_desc == NULL)
+        if (!irda_desc)
                 goto err_out_3;
 
         if (self->needspatch) {
@@ -1738,15 +1737,13 @@ static int irda_usb_probe(struct usb_interface *intf,
         /* Don't change this buffer size and allocation without doing
          * some heavy and complete testing. Don't ask why :-(
          * Jean II */
-        self->speed_buff = kmalloc(IRDA_USB_SPEED_MTU, GFP_KERNEL);
-        if (self->speed_buff == NULL) 
+        self->speed_buff = kzalloc(IRDA_USB_SPEED_MTU, GFP_KERNEL);
+        if (!self->speed_buff)
                 goto err_out_3;
 
-        memset(self->speed_buff, 0, IRDA_USB_SPEED_MTU);
-
         self->tx_buff = kzalloc(IRDA_SKB_MAX_MTU + self->header_length,
                                 GFP_KERNEL);
-        if (self->tx_buff == NULL)
+        if (!self->tx_buff)
                 goto err_out_4;
 
         ret = irda_usb_open(self);
@@ -1767,12 +1764,11 @@ static int irda_usb_probe(struct usb_interface *intf,
 
                 /* replace IrDA class descriptor with what patched device is now reporting */
                 irda_desc = irda_usb_find_class_desc (self->usbintf);
-                if (irda_desc == NULL) {
+                if (!irda_desc) {
                         ret = -ENODEV;
                         goto err_out_6;
                 }
-                if (self->irda_desc)
-                        kfree (self->irda_desc);
+                kfree(self->irda_desc);
                 self->irda_desc = irda_desc;
                 irda_usb_init_qos(self);
         }
diff --git a/drivers/net/mlx4/reset.c b/drivers/net/mlx4/reset.c
index e4dfd4b11a4a..e199715fabd0 100644
--- a/drivers/net/mlx4/reset.c
+++ b/drivers/net/mlx4/reset.c
@@ -119,6 +119,9 @@ int mlx4_reset(struct mlx4_dev *dev)
         writel(MLX4_RESET_VALUE, reset + MLX4_RESET_OFFSET);
         iounmap(reset);
 
+        /* Docs say to wait one second before accessing device */
+        msleep(1000);
+
         end = jiffies + MLX4_RESET_TIMEOUT_JIFFIES;
         do {
                 if (!pci_read_config_word(dev->pdev, PCI_VENDOR_ID, &vendor) &&
diff --git a/drivers/net/myri10ge/myri10ge.c b/drivers/net/myri10ge/myri10ge.c
index deca65330b0f..ae9bb7b7fd67 100644
--- a/drivers/net/myri10ge/myri10ge.c
+++ b/drivers/net/myri10ge/myri10ge.c
@@ -191,6 +191,7 @@ struct myri10ge_priv {
         struct timer_list watchdog_timer;
         int watchdog_tx_done;
         int watchdog_tx_req;
+        int watchdog_pause;
         int watchdog_resets;
         int tx_linearized;
         int pause;
@@ -2800,6 +2801,7 @@ static void myri10ge_watchdog(struct work_struct *work)
 static void myri10ge_watchdog_timer(unsigned long arg)
 {
         struct myri10ge_priv *mgp;
+        u32 rx_pause_cnt;
 
         mgp = (struct myri10ge_priv *)arg;
 
@@ -2816,19 +2818,28 @@ static void myri10ge_watchdog_timer(unsigned long arg)
                     myri10ge_fill_thresh)
                         mgp->rx_big.watchdog_needed = 0;
         }
+        rx_pause_cnt = ntohl(mgp->fw_stats->dropped_pause);
 
         if (mgp->tx.req != mgp->tx.done &&
             mgp->tx.done == mgp->watchdog_tx_done &&
-            mgp->watchdog_tx_req != mgp->watchdog_tx_done)
+            mgp->watchdog_tx_req != mgp->watchdog_tx_done) {
                 /* nic seems like it might be stuck.. */
-                schedule_work(&mgp->watchdog_work);
-        else
-                /* rearm timer */
-                mod_timer(&mgp->watchdog_timer,
-                          jiffies + myri10ge_watchdog_timeout * HZ);
-
+                if (rx_pause_cnt != mgp->watchdog_pause) {
+                        if (net_ratelimit())
+                                printk(KERN_WARNING "myri10ge %s:"
+                                       "TX paused, check link partner\n",
+                                       mgp->dev->name);
+                } else {
+                        schedule_work(&mgp->watchdog_work);
+                        return;
+                }
+        }
+        /* rearm timer */
+        mod_timer(&mgp->watchdog_timer,
+                  jiffies + myri10ge_watchdog_timeout * HZ);
         mgp->watchdog_tx_done = mgp->tx.done;
         mgp->watchdog_tx_req = mgp->tx.req;
+        mgp->watchdog_pause = rx_pause_cnt;
 }
 
 static int myri10ge_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
diff --git a/drivers/net/natsemi.c b/drivers/net/natsemi.c
index 6bb48ba80964..b47a12d684f9 100644
--- a/drivers/net/natsemi.c
+++ b/drivers/net/natsemi.c
@@ -2438,13 +2438,16 @@ static void netdev_error(struct net_device *dev, int intr_status)
                                 dev->name);
                 }
                 np->stats.rx_fifo_errors++;
+                np->stats.rx_errors++;
         }
         /* Hmmmmm, it's not clear how to recover from PCI faults. */
         if (intr_status & IntrPCIErr) {
                 printk(KERN_NOTICE "%s: PCI error %#08x\n", dev->name,
                         intr_status & IntrPCIErr);
                 np->stats.tx_fifo_errors++;
+                np->stats.tx_errors++;
                 np->stats.rx_fifo_errors++;
+                np->stats.rx_errors++;
         }
         spin_unlock(&np->lock);
 }
diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
index f71dab347667..e323efd4ed18 100644
--- a/drivers/net/phy/phy.c
+++ b/drivers/net/phy/phy.c
@@ -261,7 +261,7 @@ void phy_sanitize_settings(struct phy_device *phydev)
 
         /* Sanitize settings based on PHY capabilities */
         if ((features & SUPPORTED_Autoneg) == 0)
-                phydev->autoneg = 0;
+                phydev->autoneg = AUTONEG_DISABLE;
 
         idx = phy_find_valid(phy_find_setting(phydev->speed, phydev->duplex),
                         features);
@@ -374,7 +374,7 @@ int phy_mii_ioctl(struct phy_device *phydev,
                 if (mii_data->phy_id == phydev->addr) {
                         switch(mii_data->reg_num) {
                         case MII_BMCR:
-                                if (val & (BMCR_RESET|BMCR_ANENABLE))
+                                if ((val & (BMCR_RESET|BMCR_ANENABLE)) == 0)
                                         phydev->autoneg = AUTONEG_DISABLE;
                                 else
                                         phydev->autoneg = AUTONEG_ENABLE;
diff --git a/drivers/net/ppp_generic.c b/drivers/net/ppp_generic.c
index ef3325b69233..9293c82ef2af 100644
--- a/drivers/net/ppp_generic.c
+++ b/drivers/net/ppp_generic.c
@@ -1726,7 +1726,7 @@ ppp_decompress_frame(struct ppp *ppp, struct sk_buff *skb)
                 }
                 /* the decompressor still expects the A/C bytes in the hdr */
                 len = ppp->rcomp->decompress(ppp->rc_state, skb->data - 2,
-                                skb->len + 2, ns->data, ppp->mru + PPP_HDRLEN);
+                                skb->len + 2, ns->data, obuff_size);
                 if (len < 0) {
                         /* Pass the compressed frame to pppd as an
                            error indication. */
diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
index c9333b9dd51a..b85ab4a8f2a3 100644
--- a/drivers/net/r8169.c
+++ b/drivers/net/r8169.c
@@ -725,6 +725,12 @@ static int rtl8169_set_speed_xmii(struct net_device *dev,
 
         auto_nego |= ADVERTISE_PAUSE_CAP | ADVERTISE_PAUSE_ASYM;
 
+        if (tp->mac_version == RTL_GIGA_MAC_VER_12) {
+                /* Vendor specific (0x1f) and reserved (0x0e) MII registers. */
+                mdio_write(ioaddr, 0x1f, 0x0000);
+                mdio_write(ioaddr, 0x0e, 0x0000);
+        }
+
         tp->phy_auto_nego_reg = auto_nego;
         tp->phy_1000_ctrl_reg = giga_ctrl;
 
@@ -2760,14 +2766,16 @@ static irqreturn_t rtl8169_interrupt(int irq, void *dev_instance)
                         rtl8169_check_link_status(dev, tp, ioaddr);
 
 #ifdef CONFIG_R8169_NAPI
-                RTL_W16(IntrMask, tp->intr_event & ~tp->napi_event);
-                tp->intr_mask = ~tp->napi_event;
-
-                if (likely(netif_rx_schedule_prep(dev)))
-                        __netif_rx_schedule(dev);
-                else if (netif_msg_intr(tp)) {
-                        printk(KERN_INFO "%s: interrupt %04x taken in poll\n",
-                               dev->name, status);
+                if (status & tp->napi_event) {
+                        RTL_W16(IntrMask, tp->intr_event & ~tp->napi_event);
+                        tp->intr_mask = ~tp->napi_event;
+
+                        if (likely(netif_rx_schedule_prep(dev)))
+                                __netif_rx_schedule(dev);
+                        else if (netif_msg_intr(tp)) {
+                                printk(KERN_INFO "%s: interrupt %04x in poll\n",
+                                       dev->name, status);
+                        }
                 }
                 break;
 #else
diff --git a/drivers/net/s2io.c b/drivers/net/s2io.c
index 2be0a0f1b48f..24feb00600ee 100644
--- a/drivers/net/s2io.c
+++ b/drivers/net/s2io.c
@@ -2430,7 +2430,7 @@ static int fill_rx_buffers(struct s2io_nic *nic, int ring_no)
                                         (rxdp3->Buffer1_ptr == DMA_ERROR_CODE)) {
                                         pci_unmap_single
                                                 (nic->pdev,
-                                                (dma_addr_t)skb->data,
+                                                (dma_addr_t)rxdp3->Buffer2_ptr,
                                                 dev->mtu + 4,
                                                 PCI_DMA_FROMDEVICE);
                                         goto pci_map_failed;
@@ -6211,7 +6211,7 @@ static int set_rxd_buffer_pointer(struct s2io_nic *sp, struct RxD_t *rxdp,
                         if( (rxdp3->Buffer0_ptr == 0) ||
                                 (rxdp3->Buffer0_ptr == DMA_ERROR_CODE)) {
                                 pci_unmap_single (sp->pdev,
-                                        (dma_addr_t)(*skb)->data,
+                                        (dma_addr_t)rxdp3->Buffer2_ptr,
                                         dev->mtu + 4, PCI_DMA_FROMDEVICE);
                                 goto memalloc_failed;
                         }
@@ -6224,7 +6224,10 @@ static int set_rxd_buffer_pointer(struct s2io_nic *sp, struct RxD_t *rxdp,
                         if( (rxdp3->Buffer1_ptr == 0) ||
                                 (rxdp3->Buffer1_ptr == DMA_ERROR_CODE)) {
                                 pci_unmap_single (sp->pdev,
-                                        (dma_addr_t)(*skb)->data,
+                                        (dma_addr_t)rxdp3->Buffer0_ptr,
+                                        BUF0_LEN, PCI_DMA_FROMDEVICE);
+                                pci_unmap_single (sp->pdev,
+                                        (dma_addr_t)rxdp3->Buffer2_ptr,
                                         dev->mtu + 4, PCI_DMA_FROMDEVICE);
                                 goto memalloc_failed;
                         }
diff --git a/drivers/net/sis190.c b/drivers/net/sis190.c
index ec2ad9f0efa2..d470b19c0810 100644
--- a/drivers/net/sis190.c
+++ b/drivers/net/sis190.c
@@ -1593,6 +1593,9 @@ static int __devinit sis190_get_mac_addr_from_apc(struct pci_dev *pdev,
                   pci_name(pdev));
 
         isa_bridge = pci_get_device(PCI_VENDOR_ID_SI, 0x0965, NULL);
+        if (!isa_bridge)
+                isa_bridge = pci_get_device(PCI_VENDOR_ID_SI, 0x0966, NULL);
+
         if (!isa_bridge) {
                 net_probe(tp, KERN_INFO "%s: Can not find ISA bridge.\n",
                           pci_name(pdev));
diff --git a/drivers/net/sky2.c b/drivers/net/sky2.c
index e7a2eadcc3b0..757592436390 100644
--- a/drivers/net/sky2.c
+++ b/drivers/net/sky2.c
@@ -696,8 +696,8 @@ static void sky2_mac_init(struct sky2_hw *hw, unsigned port)
         int i;
         const u8 *addr = hw->dev[port]->dev_addr;
 
-        sky2_write32(hw, SK_REG(port, GPHY_CTRL), GPC_RST_SET);
-        sky2_write32(hw, SK_REG(port, GPHY_CTRL), GPC_RST_CLR);
+        sky2_write8(hw, SK_REG(port, GPHY_CTRL), GPC_RST_SET);
+        sky2_write8(hw, SK_REG(port, GPHY_CTRL), GPC_RST_CLR);
 
         sky2_write8(hw, SK_REG(port, GMAC_CTRL), GMC_RST_CLR);
 
diff --git a/drivers/net/smc91x.h b/drivers/net/smc91x.h
index f8429449dc1e..6ff3a1627af8 100644
--- a/drivers/net/smc91x.h
+++ b/drivers/net/smc91x.h
@@ -299,7 +299,7 @@ SMC_outw(u16 val, void __iomem *ioaddr, int reg)
 
 #define SMC_CAN_USE_8BIT       1
 #define SMC_CAN_USE_16BIT      1
-#define SMC_CAN_USE_32BIT      1
+#define SMC_CAN_USE_32BIT      0
 
 #define SMC_inb(a, r)          inb((a) + (r))
 #define SMC_inw(a, r)          inw((a) + (r))
@@ -310,8 +310,6 @@ SMC_outw(u16 val, void __iomem *ioaddr, int reg)
 
 #endif  /* BOARDS */
 
-#define set_irq_type(irq, type) do {} while (0)
-
 #elif   defined(CONFIG_M32R)
 
 #define SMC_CAN_USE_8BIT        0
diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
index dc41c055ebb5..58740428dd07 100644
--- a/drivers/net/tg3.c
+++ b/drivers/net/tg3.c
@@ -64,8 +64,8 @@
 
 #define DRV_MODULE_NAME         "tg3"
 #define PFX DRV_MODULE_NAME     ": "
-#define DRV_MODULE_VERSION      "3.79"
-#define DRV_MODULE_RELDATE      "July 18, 2007"
+#define DRV_MODULE_VERSION      "3.80"
+#define DRV_MODULE_RELDATE      "August 2, 2007"
 
 #define TG3_DEF_MAC_MODE        0
 #define TG3_DEF_RX_MODE         0
@@ -12111,6 +12111,12 @@ static int tg3_suspend(struct pci_dev *pdev, pm_message_t state)
         struct tg3 *tp = netdev_priv(dev);
         int err;
 
+        /* PCI register 4 needs to be saved whether netif_running() or not.
+         * MSI address and data need to be saved if using MSI and
+         * netif_running().
+         */
+        pci_save_state(pdev);
+
         if (!netif_running(dev))
                 return 0;
 
@@ -12130,9 +12136,6 @@ static int tg3_suspend(struct pci_dev *pdev, pm_message_t state)
         tp->tg3_flags &= ~TG3_FLAG_INIT_COMPLETE;
         tg3_full_unlock(tp);
 
-        /* Save MSI address and data for resume.  */
-        pci_save_state(pdev);
-
         err = tg3_set_power_state(tp, pci_choose_state(pdev, state));
         if (err) {
                 tg3_full_lock(tp, 0);
@@ -12160,11 +12163,11 @@ static int tg3_resume(struct pci_dev *pdev)
         struct tg3 *tp = netdev_priv(dev);
         int err;
 
+        pci_restore_state(tp->pdev);
+
         if (!netif_running(dev))
                 return 0;
 
-        pci_restore_state(tp->pdev);
-
         err = tg3_set_power_state(tp, PCI_D0);
         if (err)
                 return err;
diff --git a/drivers/net/ucc_geth_ethtool.c b/drivers/net/ucc_geth_ethtool.c
index a8994c7b8583..64bef7c12365 100644
--- a/drivers/net/ucc_geth_ethtool.c
+++ b/drivers/net/ucc_geth_ethtool.c
@@ -379,7 +379,6 @@ static const struct ethtool_ops uec_ethtool_ops = {
         .get_stats_count        = uec_get_stats_count,
         .get_strings            = uec_get_strings,
         .get_ethtool_stats      = uec_get_ethtool_stats,
-        .get_perm_addr          = ethtool_op_get_perm_addr,
 };
 
 void uec_set_ethtool_ops(struct net_device *netdev)
diff --git a/drivers/net/ucc_geth_mii.c b/drivers/net/ucc_geth_mii.c
index 5f8c2d30a328..6c257b88ce51 100644
--- a/drivers/net/ucc_geth_mii.c
+++ b/drivers/net/ucc_geth_mii.c
@@ -272,7 +272,8 @@ int __init uec_mdio_init(void)
         return of_register_platform_driver(&uec_mdio_driver);
 }
 
-void __exit uec_mdio_exit(void)
+/* called from __init ucc_geth_init, therefore can not be __exit */
+void uec_mdio_exit(void)
 {
         of_unregister_platform_driver(&uec_mdio_driver);
 }
diff --git a/drivers/net/via-rhine.c b/drivers/net/via-rhine.c
index c3fe230695a0..b56dff26772d 100644
--- a/drivers/net/via-rhine.c
+++ b/drivers/net/via-rhine.c
@@ -42,7 +42,13 @@ static int max_interrupt_work = 20;
 
 /* Set the copy breakpoint for the copy-only-tiny-frames scheme.
    Setting to > 1518 effectively disables this feature. */
+#if defined(__alpha__) || defined(__arm__) || defined(__hppa__) \
+       || defined(CONFIG_SPARC) || defined(__ia64__) \
+       || defined(__sh__) || defined(__mips__)
+static int rx_copybreak = 1518;
+#else
 static int rx_copybreak;
+#endif
 
 /* Work-around for broken BIOSes: they are unable to get the chip back out of
    power state D3 so PXE booting fails. bootparam(7): via-rhine.avoid_D3=1 */
diff --git a/drivers/net/wan/hdlc_fr.c b/drivers/net/wan/hdlc_fr.c
index 15b6e07a4382..071a64cacd5c 100644
--- a/drivers/net/wan/hdlc_fr.c
+++ b/drivers/net/wan/hdlc_fr.c
@@ -212,14 +212,13 @@ static pvc_device* add_pvc(struct net_device *dev, u16 dlci)
                 pvc_p = &(*pvc_p)->next;
         }
 
-        pvc = kmalloc(sizeof(pvc_device), GFP_ATOMIC);
+        pvc = kzalloc(sizeof(pvc_device), GFP_ATOMIC);
 #ifdef DEBUG_PVC
         printk(KERN_DEBUG "add_pvc: allocated pvc %p, frad %p\n", pvc, dev);
 #endif
         if (!pvc)
                 return NULL;
 
-        memset(pvc, 0, sizeof(pvc_device));
         pvc->dlci = dlci;
         pvc->frad = dev;
         pvc->next = *pvc_p;     /* Put it in the chain */
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_phy.c b/drivers/net/wireless/bcm43xx/bcm43xx_phy.c
index d779199c30d0..b37f1e348700 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_phy.c
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_phy.c
@@ -1638,7 +1638,7 @@ void bcm43xx_phy_set_baseband_attenuation(struct bcm43xx_private *bcm,
                 return;
         }
 
-        if (phy->analog == 1) {
+        if (phy->analog > 1) {
                 value = bcm43xx_phy_read(bcm, 0x0060) & ~0x003C;
                 value |= (baseband_attenuation << 2) & 0x003C;
         } else {
diff --git a/drivers/net/wireless/rtl8187_dev.c b/drivers/net/wireless/rtl8187_dev.c
index cea85894b7f2..e61c6d5ba1a9 100644
--- a/drivers/net/wireless/rtl8187_dev.c
+++ b/drivers/net/wireless/rtl8187_dev.c
@@ -466,7 +466,7 @@ static int rtl8187_add_interface(struct ieee80211_hw *dev,
                 return -EOPNOTSUPP;
         }
 
-        priv->hwaddr = conf->mac_addr;
+        priv->hwaddr = conf->mac_addr ? conf->mac_addr : dev->wiphy->perm_addr;
 
         return 0;
 }
diff --git a/drivers/net/wireless/zd1211rw/zd_mac.c b/drivers/net/wireless/zd1211rw/zd_mac.c
index f6c487aa8246..26869d107e52 100644
--- a/drivers/net/wireless/zd1211rw/zd_mac.c
+++ b/drivers/net/wireless/zd1211rw/zd_mac.c
@@ -822,7 +822,7 @@ static void cs_set_control(struct zd_mac *mac, struct zd_ctrlset *cs,
                 cs->control |= ZD_CS_MULTICAST;
 
         /* PS-POLL */
-        if (stype == IEEE80211_STYPE_PSPOLL)
+        if (ftype == IEEE80211_FTYPE_CTL && stype == IEEE80211_STYPE_PSPOLL)
                 cs->control |= ZD_CS_PS_POLL_FRAME;
 
         /* Unicast data frames over the threshold should have RTS */
diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
index 489f69c5d6ca..4445810335a8 100644
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -566,6 +566,10 @@ static int xennet_start_xmit(struct sk_buff *skb, struct net_device *dev)
         if (notify)
                 notify_remote_via_irq(np->netdev->irq);
 
+        np->stats.tx_bytes += skb->len;
+        np->stats.tx_packets++;
+
+        /* Note: It is not safe to access skb after xennet_tx_buf_gc()! */
         xennet_tx_buf_gc(dev);
 
         if (!netfront_tx_slot_available(np))
@@ -573,9 +577,6 @@ static int xennet_start_xmit(struct sk_buff *skb, struct net_device *dev)
 
         spin_unlock_irq(&np->tx_lock);
 
-        np->stats.tx_bytes += skb->len;
-        np->stats.tx_packets++;
-
         return 0;
 
  drop: