Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6

21 files changed, 271 insertions, 184 deletions

diff --git a/drivers/net/arm/am79c961a.c b/drivers/net/arm/am79c961a.c
index 0c628a9e5339..c2d012fcc29b 100644
--- a/drivers/net/arm/am79c961a.c
+++ b/drivers/net/arm/am79c961a.c
@@ -208,9 +208,9 @@ am79c961_init_for_open(struct net_device *dev)
         /*
          * Stop the chip.
          */
-        spin_lock_irqsave(priv->chip_lock, flags);
+        spin_lock_irqsave(&priv->chip_lock, flags);
         write_rreg (dev->base_addr, CSR0, CSR0_BABL|CSR0_CERR|CSR0_MISS|CSR0_MERR|CSR0_TINT|CSR0_RINT|CSR0_STOP);
-        spin_unlock_irqrestore(priv->chip_lock, flags);
+        spin_unlock_irqrestore(&priv->chip_lock, flags);
 
         write_ireg (dev->base_addr, 5, 0x00a0); /* Receive address LED */
         write_ireg (dev->base_addr, 6, 0x0081); /* Collision LED */
@@ -332,10 +332,10 @@ am79c961_close(struct net_device *dev)
         netif_stop_queue(dev);
         netif_carrier_off(dev);
 
-        spin_lock_irqsave(priv->chip_lock, flags);
+        spin_lock_irqsave(&priv->chip_lock, flags);
         write_rreg (dev->base_addr, CSR0, CSR0_STOP);
         write_rreg (dev->base_addr, CSR3, CSR3_MASKALL);
-        spin_unlock_irqrestore(priv->chip_lock, flags);
+        spin_unlock_irqrestore(&priv->chip_lock, flags);
 
         free_irq (dev->irq, dev);
 
@@ -391,7 +391,7 @@ static void am79c961_setmulticastlist (struct net_device *dev)
                         am79c961_mc_hash(dmi, multi_hash);
         }
 
-        spin_lock_irqsave(priv->chip_lock, flags);
+        spin_lock_irqsave(&priv->chip_lock, flags);
 
         stopped = read_rreg(dev->base_addr, CSR0) & CSR0_STOP;
 
@@ -405,9 +405,9 @@ static void am79c961_setmulticastlist (struct net_device *dev)
                  * Spin waiting for chip to report suspend mode
                  */
                 while ((read_rreg(dev->base_addr, CTRL1) & CTRL1_SPND) == 0) {
-                        spin_unlock_irqrestore(priv->chip_lock, flags);
+                        spin_unlock_irqrestore(&priv->chip_lock, flags);
                         nop();
-                        spin_lock_irqsave(priv->chip_lock, flags);
+                        spin_lock_irqsave(&priv->chip_lock, flags);
                 }
         }
 
@@ -429,7 +429,7 @@ static void am79c961_setmulticastlist (struct net_device *dev)
                 write_rreg(dev->base_addr, CTRL1, 0);
         }
 
-        spin_unlock_irqrestore(priv->chip_lock, flags);
+        spin_unlock_irqrestore(&priv->chip_lock, flags);
 }
 
 static void am79c961_timeout(struct net_device *dev)
@@ -467,10 +467,10 @@ am79c961_sendpacket(struct sk_buff *skb, struct net_device *dev)
         am_writeword (dev, hdraddr + 2, TMD_OWN|TMD_STP|TMD_ENP);
         priv->txhead = head;
 
-        spin_lock_irqsave(priv->chip_lock, flags);
+        spin_lock_irqsave(&priv->chip_lock, flags);
         write_rreg (dev->base_addr, CSR0, CSR0_TDMD|CSR0_IENA);
         dev->trans_start = jiffies;
-        spin_unlock_irqrestore(priv->chip_lock, flags);
+        spin_unlock_irqrestore(&priv->chip_lock, flags);
 
         /*
          * If the next packet is owned by the ethernet device,
diff --git a/drivers/net/bnx2x_main.c b/drivers/net/bnx2x_main.c
index 21764bfc048e..71f81c79d638 100644
--- a/drivers/net/bnx2x_main.c
+++ b/drivers/net/bnx2x_main.c
@@ -57,8 +57,8 @@
 #include "bnx2x.h"
 #include "bnx2x_init.h"
 
-#define DRV_MODULE_VERSION      "1.45.24"
-#define DRV_MODULE_RELDATE      "2009/01/14"
+#define DRV_MODULE_VERSION      "1.45.26"
+#define DRV_MODULE_RELDATE      "2009/01/26"
 #define BNX2X_BC_VER            0x040200
 
 /* Time in jiffies before concluding the transmitter is hung */
@@ -740,8 +740,15 @@ static inline int bnx2x_has_tx_work(struct bnx2x_fastpath *fp)
         /* Tell compiler that status block fields can change */
         barrier();
         tx_cons_sb = le16_to_cpu(*fp->tx_cons_sb);
-        return ((fp->tx_pkt_prod != tx_cons_sb) ||
-                (fp->tx_pkt_prod != fp->tx_pkt_cons));
+        return (fp->tx_pkt_cons != tx_cons_sb);
+}
+
+static inline int bnx2x_has_tx_work_unload(struct bnx2x_fastpath *fp)
+{
+        /* Tell compiler that consumer and producer can change */
+        barrier();
+        return (fp->tx_pkt_prod != fp->tx_pkt_cons);
+
 }
 
 /* free skb in the packet ring at pos idx
@@ -5148,12 +5155,21 @@ static void enable_blocks_attention(struct bnx2x *bp)
 }
 
 
+static void bnx2x_reset_common(struct bnx2x *bp)
+{
+        /* reset_common */
+        REG_WR(bp, GRCBASE_MISC + MISC_REGISTERS_RESET_REG_1_CLEAR,
+               0xd3ffff7f);
+        REG_WR(bp, GRCBASE_MISC + MISC_REGISTERS_RESET_REG_2_CLEAR, 0x1403);
+}
+
 static int bnx2x_init_common(struct bnx2x *bp)
 {
         u32 val, i;
 
         DP(BNX2X_MSG_MCP, "starting common init  func %d\n", BP_FUNC(bp));
 
+        bnx2x_reset_common(bp);
         REG_WR(bp, GRCBASE_MISC + MISC_REGISTERS_RESET_REG_1_SET, 0xffffffff);
         REG_WR(bp, GRCBASE_MISC + MISC_REGISTERS_RESET_REG_2_SET, 0xfffc);
 
@@ -6134,8 +6150,8 @@ static void bnx2x_netif_start(struct bnx2x *bp)
 static void bnx2x_netif_stop(struct bnx2x *bp, int disable_hw)
 {
         bnx2x_int_disable_sync(bp, disable_hw);
+        bnx2x_napi_disable(bp);
         if (netif_running(bp->dev)) {
-                bnx2x_napi_disable(bp);
                 netif_tx_disable(bp->dev);
                 bp->dev->trans_start = jiffies; /* prevent tx timeout */
         }
@@ -6319,7 +6335,7 @@ static void bnx2x_set_rx_mode(struct net_device *dev);
 static int bnx2x_nic_load(struct bnx2x *bp, int load_mode)
 {
         u32 load_code;
-        int i, rc;
+        int i, rc = 0;
 #ifdef BNX2X_STOP_ON_ERROR
         if (unlikely(bp->panic))
                 return -EPERM;
@@ -6327,48 +6343,6 @@ static int bnx2x_nic_load(struct bnx2x *bp, int load_mode)
 
         bp->state = BNX2X_STATE_OPENING_WAIT4_LOAD;
 
-        /* Send LOAD_REQUEST command to MCP
-           Returns the type of LOAD command:
-           if it is the first port to be initialized
-           common blocks should be initialized, otherwise - not
-        */
-        if (!BP_NOMCP(bp)) {
-                load_code = bnx2x_fw_command(bp, DRV_MSG_CODE_LOAD_REQ);
-                if (!load_code) {
-                        BNX2X_ERR("MCP response failure, aborting\n");
-                        return -EBUSY;
-                }
-                if (load_code == FW_MSG_CODE_DRV_LOAD_REFUSED)
-                        return -EBUSY; /* other port in diagnostic mode */
-
-        } else {
-                int port = BP_PORT(bp);
-
-                DP(NETIF_MSG_IFUP, "NO MCP load counts before us %d, %d, %d\n",
-                   load_count[0], load_count[1], load_count[2]);
-                load_count[0]++;
-                load_count[1 + port]++;
-                DP(NETIF_MSG_IFUP, "NO MCP new load counts       %d, %d, %d\n",
-                   load_count[0], load_count[1], load_count[2]);
-                if (load_count[0] == 1)
-                        load_code = FW_MSG_CODE_DRV_LOAD_COMMON;
-                else if (load_count[1 + port] == 1)
-                        load_code = FW_MSG_CODE_DRV_LOAD_PORT;
-                else
-                        load_code = FW_MSG_CODE_DRV_LOAD_FUNCTION;
-        }
-
-        if ((load_code == FW_MSG_CODE_DRV_LOAD_COMMON) ||
-            (load_code == FW_MSG_CODE_DRV_LOAD_PORT))
-                bp->port.pmf = 1;
-        else
-                bp->port.pmf = 0;
-        DP(NETIF_MSG_LINK, "pmf %d\n", bp->port.pmf);
-
-        /* if we can't use MSI-X we only need one fp,
-         * so try to enable MSI-X with the requested number of fp's
-         * and fallback to inta with one fp
-         */
         if (use_inta) {
                 bp->num_queues = 1;
 
@@ -6383,7 +6357,15 @@ static int bnx2x_nic_load(struct bnx2x *bp, int load_mode)
                 else
                         bp->num_queues = 1;
 
-                if (bnx2x_enable_msix(bp)) {
+                DP(NETIF_MSG_IFUP,
+                   "set number of queues to %d\n", bp->num_queues);
+
+                /* if we can't use MSI-X we only need one fp,
+                 * so try to enable MSI-X with the requested number of fp's
+                 * and fallback to MSI or legacy INTx with one fp
+                 */
+                rc = bnx2x_enable_msix(bp);
+                if (rc) {
                         /* failed to enable MSI-X */
                         bp->num_queues = 1;
                         if (use_multi)
@@ -6391,8 +6373,6 @@ static int bnx2x_nic_load(struct bnx2x *bp, int load_mode)
                                           " to enable MSI-X\n");
                 }
         }
-        DP(NETIF_MSG_IFUP,
-           "set number of queues to %d\n", bp->num_queues);
 
         if (bnx2x_alloc_mem(bp))
                 return -ENOMEM;
@@ -6401,30 +6381,85 @@ static int bnx2x_nic_load(struct bnx2x *bp, int load_mode)
                 bnx2x_fp(bp, i, disable_tpa) =
                                         ((bp->flags & TPA_ENABLE_FLAG) == 0);
 
+        for_each_queue(bp, i)
+                netif_napi_add(bp->dev, &bnx2x_fp(bp, i, napi),
+                               bnx2x_poll, 128);
+
+#ifdef BNX2X_STOP_ON_ERROR
+        for_each_queue(bp, i) {
+                struct bnx2x_fastpath *fp = &bp->fp[i];
+
+                fp->poll_no_work = 0;
+                fp->poll_calls = 0;
+                fp->poll_max_calls = 0;
+                fp->poll_complete = 0;
+                fp->poll_exit = 0;
+        }
+#endif
+        bnx2x_napi_enable(bp);
+
         if (bp->flags & USING_MSIX_FLAG) {
                 rc = bnx2x_req_msix_irqs(bp);
                 if (rc) {
                         pci_disable_msix(bp->pdev);
-                        goto load_error;
+                        goto load_error1;
                 }
+                printk(KERN_INFO PFX "%s: using MSI-X\n", bp->dev->name);
         } else {
                 bnx2x_ack_int(bp);
                 rc = bnx2x_req_irq(bp);
                 if (rc) {
-                        BNX2X_ERR("IRQ request failed, aborting\n");
-                        goto load_error;
+                        BNX2X_ERR("IRQ request failed  rc %d, aborting\n", rc);
+                        goto load_error1;
                 }
         }
 
-        for_each_queue(bp, i)
-                netif_napi_add(bp->dev, &bnx2x_fp(bp, i, napi),
-                               bnx2x_poll, 128);
+        /* Send LOAD_REQUEST command to MCP
+           Returns the type of LOAD command:
+           if it is the first port to be initialized
+           common blocks should be initialized, otherwise - not
+        */
+        if (!BP_NOMCP(bp)) {
+                load_code = bnx2x_fw_command(bp, DRV_MSG_CODE_LOAD_REQ);
+                if (!load_code) {
+                        BNX2X_ERR("MCP response failure, aborting\n");
+                        rc = -EBUSY;
+                        goto load_error2;
+                }
+                if (load_code == FW_MSG_CODE_DRV_LOAD_REFUSED) {
+                        rc = -EBUSY; /* other port in diagnostic mode */
+                        goto load_error2;
+                }
+
+        } else {
+                int port = BP_PORT(bp);
+
+                DP(NETIF_MSG_IFUP, "NO MCP load counts before us %d, %d, %d\n",
+                   load_count[0], load_count[1], load_count[2]);
+                load_count[0]++;
+                load_count[1 + port]++;
+                DP(NETIF_MSG_IFUP, "NO MCP new load counts       %d, %d, %d\n",
+                   load_count[0], load_count[1], load_count[2]);
+                if (load_count[0] == 1)
+                        load_code = FW_MSG_CODE_DRV_LOAD_COMMON;
+                else if (load_count[1 + port] == 1)
+                        load_code = FW_MSG_CODE_DRV_LOAD_PORT;
+                else
+                        load_code = FW_MSG_CODE_DRV_LOAD_FUNCTION;
+        }
+
+        if ((load_code == FW_MSG_CODE_DRV_LOAD_COMMON) ||
+            (load_code == FW_MSG_CODE_DRV_LOAD_PORT))
+                bp->port.pmf = 1;
+        else
+                bp->port.pmf = 0;
+        DP(NETIF_MSG_LINK, "pmf %d\n", bp->port.pmf);
 
         /* Initialize HW */
         rc = bnx2x_init_hw(bp, load_code);
         if (rc) {
                 BNX2X_ERR("HW init failed, aborting\n");
-                goto load_int_disable;
+                goto load_error2;
         }
 
         /* Setup NIC internals and enable interrupts */
@@ -6436,7 +6471,7 @@ static int bnx2x_nic_load(struct bnx2x *bp, int load_mode)
                 if (!load_code) {
                         BNX2X_ERR("MCP response failure, aborting\n");
                         rc = -EBUSY;
-                        goto load_rings_free;
+                        goto load_error3;
                 }
         }
 
@@ -6445,7 +6480,7 @@ static int bnx2x_nic_load(struct bnx2x *bp, int load_mode)
         rc = bnx2x_setup_leading(bp);
         if (rc) {
                 BNX2X_ERR("Setup leading failed!\n");
-                goto load_netif_stop;
+                goto load_error3;
         }
 
         if (CHIP_IS_E1H(bp))
@@ -6458,7 +6493,7 @@ static int bnx2x_nic_load(struct bnx2x *bp, int load_mode)
                 for_each_nondefault_queue(bp, i) {
                         rc = bnx2x_setup_multi(bp, i);
                         if (rc)
-                                goto load_netif_stop;
+                                goto load_error3;
                 }
 
         if (CHIP_IS_E1(bp))
@@ -6474,18 +6509,18 @@ static int bnx2x_nic_load(struct bnx2x *bp, int load_mode)
         case LOAD_NORMAL:
                 /* Tx queue should be only reenabled */
                 netif_wake_queue(bp->dev);
+                /* Initialize the receive filter. */
                 bnx2x_set_rx_mode(bp->dev);
                 break;
 
         case LOAD_OPEN:
                 netif_start_queue(bp->dev);
+                /* Initialize the receive filter. */
                 bnx2x_set_rx_mode(bp->dev);
-                if (bp->flags & USING_MSIX_FLAG)
-                        printk(KERN_INFO PFX "%s: using MSI-X\n",
-                               bp->dev->name);
                 break;
 
         case LOAD_DIAG:
+                /* Initialize the receive filter. */
                 bnx2x_set_rx_mode(bp->dev);
                 bp->state = BNX2X_STATE_DIAG;
                 break;
@@ -6503,20 +6538,25 @@ static int bnx2x_nic_load(struct bnx2x *bp, int load_mode)
 
         return 0;
 
-load_netif_stop:
-        bnx2x_napi_disable(bp);
-load_rings_free:
+load_error3:
+        bnx2x_int_disable_sync(bp, 1);
+        if (!BP_NOMCP(bp)) {
+                bnx2x_fw_command(bp, DRV_MSG_CODE_UNLOAD_REQ_WOL_MCP);
+                bnx2x_fw_command(bp, DRV_MSG_CODE_UNLOAD_DONE);
+        }
+        bp->port.pmf = 0;
         /* Free SKBs, SGEs, TPA pool and driver internals */
         bnx2x_free_skbs(bp);
         for_each_queue(bp, i)
                 bnx2x_free_rx_sge_range(bp, bp->fp + i, NUM_RX_SGE);
-load_int_disable:
-        bnx2x_int_disable_sync(bp, 1);
+load_error2:
         /* Release IRQs */
         bnx2x_free_irq(bp);
-load_error:
+load_error1:
+        bnx2x_napi_disable(bp);
+        for_each_queue(bp, i)
+                netif_napi_del(&bnx2x_fp(bp, i, napi));
         bnx2x_free_mem(bp);
-        bp->port.pmf = 0;
 
         /* TBD we really need to reset the chip
            if we want to recover from this */
@@ -6589,6 +6629,7 @@ static int bnx2x_stop_leading(struct bnx2x *bp)
                 }
                 cnt--;
                 msleep(1);
+                rmb(); /* Refresh the dsb_sp_prod */
         }
         bp->state = BNX2X_STATE_CLOSING_WAIT4_UNLOAD;
         bp->fp[0].state = BNX2X_FP_STATE_CLOSED;
@@ -6640,14 +6681,6 @@ static void bnx2x_reset_port(struct bnx2x *bp)
         /* TODO: Close Doorbell port? */
 }
 
-static void bnx2x_reset_common(struct bnx2x *bp)
-{
-        /* reset_common */
-        REG_WR(bp, GRCBASE_MISC + MISC_REGISTERS_RESET_REG_1_CLEAR,
-               0xd3ffff7f);
-        REG_WR(bp, GRCBASE_MISC + MISC_REGISTERS_RESET_REG_2_CLEAR, 0x1403);
-}
-
 static void bnx2x_reset_chip(struct bnx2x *bp, u32 reset_code)
 {
         DP(BNX2X_MSG_MCP, "function %d  reset_code %x\n",
@@ -6688,8 +6721,7 @@ static int bnx2x_nic_unload(struct bnx2x *bp, int unload_mode)
         bnx2x_set_storm_rx_mode(bp);
 
         bnx2x_netif_stop(bp, 1);
-        if (!netif_running(bp->dev))
-                bnx2x_napi_disable(bp);
+
         del_timer_sync(&bp->timer);
         SHMEM_WR(bp, func_mb[BP_FUNC(bp)].drv_pulse_mb,
                  (DRV_PULSE_ALWAYS_ALIVE | bp->fw_drv_pulse_wr_seq));
@@ -6704,7 +6736,7 @@ static int bnx2x_nic_unload(struct bnx2x *bp, int unload_mode)
 
                 cnt = 1000;
                 smp_rmb();
-                while (bnx2x_has_tx_work(fp)) {
+                while (bnx2x_has_tx_work_unload(fp)) {
 
                         bnx2x_tx_int(fp, 1000);
                         if (!cnt) {
@@ -6833,6 +6865,8 @@ unload_error:
         bnx2x_free_skbs(bp);
         for_each_queue(bp, i)
                 bnx2x_free_rx_sge_range(bp, bp->fp + i, NUM_RX_SGE);
+        for_each_queue(bp, i)
+                netif_napi_del(&bnx2x_fp(bp, i, napi));
         bnx2x_free_mem(bp);
 
         bp->state = BNX2X_STATE_CLOSED;
@@ -8723,18 +8757,17 @@ static int bnx2x_run_loopback(struct bnx2x *bp, int loopback_mode, u8 link_up)
 
         if (loopback_mode == BNX2X_MAC_LOOPBACK) {
                 bp->link_params.loopback_mode = LOOPBACK_BMAC;
-                bnx2x_acquire_phy_lock(bp);
                 bnx2x_phy_init(&bp->link_params, &bp->link_vars);
-                bnx2x_release_phy_lock(bp);
 
         } else if (loopback_mode == BNX2X_PHY_LOOPBACK) {
+                u16 cnt = 1000;
                 bp->link_params.loopback_mode = LOOPBACK_XGXS_10;
-                bnx2x_acquire_phy_lock(bp);
                 bnx2x_phy_init(&bp->link_params, &bp->link_vars);
-                bnx2x_release_phy_lock(bp);
                 /* wait until link state is restored */
-                bnx2x_wait_for_link(bp, link_up);
-
+                if (link_up)
+                        while (cnt-- && bnx2x_test_link(&bp->link_params,
+                                                        &bp->link_vars))
+                                msleep(10);
         } else
                 return -EINVAL;
 
@@ -8840,6 +8873,7 @@ static int bnx2x_test_loopback(struct bnx2x *bp, u8 link_up)
                 return BNX2X_LOOPBACK_FAILED;
 
         bnx2x_netif_stop(bp, 1);
+        bnx2x_acquire_phy_lock(bp);
 
         if (bnx2x_run_loopback(bp, BNX2X_MAC_LOOPBACK, link_up)) {
                 DP(NETIF_MSG_PROBE, "MAC loopback failed\n");
@@ -8851,6 +8885,7 @@ static int bnx2x_test_loopback(struct bnx2x *bp, u8 link_up)
                 rc |= BNX2X_PHY_LOOPBACK_FAILED;
         }
 
+        bnx2x_release_phy_lock(bp);
         bnx2x_netif_start(bp);
 
         return rc;
@@ -9805,6 +9840,8 @@ static int bnx2x_open(struct net_device *dev)
 {
         struct bnx2x *bp = netdev_priv(dev);
 
+        netif_carrier_off(dev);
+
         bnx2x_set_power_state(bp, PCI_D0);
 
         return bnx2x_nic_load(bp, LOAD_OPEN);
@@ -10310,8 +10347,6 @@ static int __devinit bnx2x_init_one(struct pci_dev *pdev,
                 goto init_one_exit;
         }
 
-        netif_carrier_off(dev);
-
         bp->common.name = board_info[ent->driver_data].name;
         printk(KERN_INFO "%s: %s (%c%d) PCI-E x%d %s found at mem %lx,"
                " IRQ %d, ", dev->name, bp->common.name,
@@ -10459,6 +10494,8 @@ static int bnx2x_eeh_nic_unload(struct bnx2x *bp)
         bnx2x_free_skbs(bp);
         for_each_queue(bp, i)
                 bnx2x_free_rx_sge_range(bp, bp->fp + i, NUM_RX_SGE);
+        for_each_queue(bp, i)
+                netif_napi_del(&bnx2x_fp(bp, i, napi));
         bnx2x_free_mem(bp);
 
         bp->state = BNX2X_STATE_CLOSED;
diff --git a/drivers/net/e1000e/82571.c b/drivers/net/e1000e/82571.c
index cf43ee743b3c..0890162953e9 100644
--- a/drivers/net/e1000e/82571.c
+++ b/drivers/net/e1000e/82571.c
@@ -981,11 +981,15 @@ static void e1000_initialize_hw_bits_82571(struct e1000_hw *hw)
                 ew32(PBA_ECC, reg);
         }
 
-        /* PCI-Ex Control Register */
+        /* PCI-Ex Control Registers */
         if (hw->mac.type == e1000_82574) {
                 reg = er32(GCR);
                 reg |= (1 << 22);
                 ew32(GCR, reg);
+
+                reg = er32(GCR2);
+                reg |= 1;
+                ew32(GCR2, reg);
         }
 
         return;
diff --git a/drivers/net/e1000e/hw.h b/drivers/net/e1000e/hw.h
index f25e961c6b3b..2d4ce0492df0 100644
--- a/drivers/net/e1000e/hw.h
+++ b/drivers/net/e1000e/hw.h
@@ -206,6 +206,7 @@ enum e1e_registers {
         E1000_MANC2H    = 0x05860, /* Management Control To Host - RW */
         E1000_SW_FW_SYNC = 0x05B5C, /* Software-Firmware Synchronization - RW */
         E1000_GCR       = 0x05B00, /* PCI-Ex Control */
+        E1000_GCR2      = 0x05B64, /* PCI-Ex Control #2 */
         E1000_FACTPS    = 0x05B30, /* Function Active and Power State to MNG */
         E1000_SWSM      = 0x05B50, /* SW Semaphore */
         E1000_FWSM      = 0x05B54, /* FW Semaphore */
diff --git a/drivers/net/gianfar.c b/drivers/net/gianfar.c
index 2e76699f8104..f5e6068f9b07 100644
--- a/drivers/net/gianfar.c
+++ b/drivers/net/gianfar.c
@@ -1423,15 +1423,11 @@ static void gfar_vlan_rx_register(struct net_device *dev,
 {
         struct gfar_private *priv = netdev_priv(dev);
         unsigned long flags;
-        struct vlan_group *old_grp;
         u32 tempval;
 
         spin_lock_irqsave(&priv->rxlock, flags);
 
-        old_grp = priv->vlgrp;
-
-        if (old_grp == grp)
-                return;
+        priv->vlgrp = grp;
 
         if (grp) {
                 /* Enable VLAN tag insertion */
diff --git a/drivers/net/netxen/netxen_nic.h b/drivers/net/netxen/netxen_nic.h
index c11c568fd7db..a75a31005fd3 100644
--- a/drivers/net/netxen/netxen_nic.h
+++ b/drivers/net/netxen/netxen_nic.h
@@ -146,7 +146,7 @@
 
 #define MAX_RX_BUFFER_LENGTH            1760
 #define MAX_RX_JUMBO_BUFFER_LENGTH      8062
-#define MAX_RX_LRO_BUFFER_LENGTH        ((48*1024)-512)
+#define MAX_RX_LRO_BUFFER_LENGTH        (8062)
 #define RX_DMA_MAP_LEN                  (MAX_RX_BUFFER_LENGTH - 2)
 #define RX_JUMBO_DMA_MAP_LEN    \
         (MAX_RX_JUMBO_BUFFER_LENGTH - 2)
@@ -207,11 +207,11 @@
 
 #define MAX_CMD_DESCRIPTORS             4096
 #define MAX_RCV_DESCRIPTORS             16384
-#define MAX_CMD_DESCRIPTORS_HOST        (MAX_CMD_DESCRIPTORS / 4)
-#define MAX_RCV_DESCRIPTORS_1G          (MAX_RCV_DESCRIPTORS / 4)
-#define MAX_RCV_DESCRIPTORS_10G         8192
-#define MAX_JUMBO_RCV_DESCRIPTORS       1024
-#define MAX_LRO_RCV_DESCRIPTORS         64
+#define MAX_CMD_DESCRIPTORS_HOST        1024
+#define MAX_RCV_DESCRIPTORS_1G          2048
+#define MAX_RCV_DESCRIPTORS_10G         4096
+#define MAX_JUMBO_RCV_DESCRIPTORS       512
+#define MAX_LRO_RCV_DESCRIPTORS         8
 #define MAX_RCVSTATUS_DESCRIPTORS       MAX_RCV_DESCRIPTORS
 #define MAX_JUMBO_RCV_DESC      MAX_JUMBO_RCV_DESCRIPTORS
 #define MAX_RCV_DESC            MAX_RCV_DESCRIPTORS
diff --git a/drivers/net/netxen/netxen_nic_ethtool.c b/drivers/net/netxen/netxen_nic_ethtool.c
index c0bd40fcf708..0894a7be0225 100644
--- a/drivers/net/netxen/netxen_nic_ethtool.c
+++ b/drivers/net/netxen/netxen_nic_ethtool.c
@@ -561,7 +561,10 @@ netxen_nic_get_ringparam(struct net_device *dev, struct ethtool_ringparam *ring)
         }
         ring->tx_pending = adapter->max_tx_desc_count;
 
-        ring->rx_max_pending = MAX_RCV_DESCRIPTORS;
+        if (adapter->ahw.board_type == NETXEN_NIC_GBE)
+                ring->rx_max_pending = MAX_RCV_DESCRIPTORS_1G;
+        else
+                ring->rx_max_pending = MAX_RCV_DESCRIPTORS_10G;
         ring->tx_max_pending = MAX_CMD_DESCRIPTORS_HOST;
         ring->rx_jumbo_max_pending = MAX_JUMBO_RCV_DESCRIPTORS;
         ring->rx_mini_max_pending = 0;
diff --git a/drivers/net/netxen/netxen_nic_main.c b/drivers/net/netxen/netxen_nic_main.c
index 1139e637f5da..cc06cc5429fe 100644
--- a/drivers/net/netxen/netxen_nic_main.c
+++ b/drivers/net/netxen/netxen_nic_main.c
@@ -735,17 +735,18 @@ netxen_nic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 
         SET_ETHTOOL_OPS(netdev, &netxen_nic_ethtool_ops);
 
-        /* ScatterGather support */
-        netdev->features = NETIF_F_SG;
-        netdev->features |= NETIF_F_IP_CSUM;
-        netdev->features |= NETIF_F_TSO;
+        netdev->features |= (NETIF_F_SG | NETIF_F_IP_CSUM | NETIF_F_TSO);
+        netdev->vlan_features |= (NETIF_F_SG | NETIF_F_IP_CSUM | NETIF_F_TSO);
+
         if (NX_IS_REVISION_P3(revision_id)) {
-                netdev->features |= NETIF_F_IPV6_CSUM;
-                netdev->features |= NETIF_F_TSO6;
+                netdev->features |= (NETIF_F_IPV6_CSUM | NETIF_F_TSO6);
+                netdev->vlan_features |= (NETIF_F_IPV6_CSUM | NETIF_F_TSO6);
         }
 
-        if (adapter->pci_using_dac)
+        if (adapter->pci_using_dac) {
                 netdev->features |= NETIF_F_HIGHDMA;
+                netdev->vlan_features |= NETIF_F_HIGHDMA;
+        }
 
         /*
          * Set the CRB window to invalid. If any register in window 0 is
@@ -1166,6 +1167,14 @@ static bool netxen_tso_check(struct net_device *netdev,
 {
         bool tso = false;
         u8 opcode = TX_ETHER_PKT;
+        __be16 protocol = skb->protocol;
+        u16 flags = 0;
+
+        if (protocol == __constant_htons(ETH_P_8021Q)) {
+                struct vlan_ethhdr *vh = (struct vlan_ethhdr *)skb->data;
+                protocol = vh->h_vlan_encapsulated_proto;
+                flags = FLAGS_VLAN_TAGGED;
+        }
 
         if ((netdev->features & (NETIF_F_TSO | NETIF_F_TSO6)) &&
                         skb_shinfo(skb)->gso_size > 0) {
@@ -1174,21 +1183,21 @@ static bool netxen_tso_check(struct net_device *netdev,
                 desc->total_hdr_length =
                         skb_transport_offset(skb) + tcp_hdrlen(skb);
 
-                opcode = (skb->protocol == htons(ETH_P_IPV6)) ?
+                opcode = (protocol == __constant_htons(ETH_P_IPV6)) ?
                                 TX_TCP_LSO6 : TX_TCP_LSO;
                 tso = true;
 
         } else if (skb->ip_summed == CHECKSUM_PARTIAL) {
                 u8 l4proto;
 
-                if (skb->protocol == htons(ETH_P_IP)) {
+                if (protocol == __constant_htons(ETH_P_IP)) {
                         l4proto = ip_hdr(skb)->protocol;
 
                         if (l4proto == IPPROTO_TCP)
                                 opcode = TX_TCP_PKT;
                         else if(l4proto == IPPROTO_UDP)
                                 opcode = TX_UDP_PKT;
-                } else if (skb->protocol == htons(ETH_P_IPV6)) {
+                } else if (protocol == __constant_htons(ETH_P_IPV6)) {
                         l4proto = ipv6_hdr(skb)->nexthdr;
 
                         if (l4proto == IPPROTO_TCP)
@@ -1199,7 +1208,7 @@ static bool netxen_tso_check(struct net_device *netdev,
         }
         desc->tcp_hdr_offset = skb_transport_offset(skb);
         desc->ip_hdr_offset = skb_network_offset(skb);
-        netxen_set_tx_flags_opcode(desc, 0, opcode);
+        netxen_set_tx_flags_opcode(desc, flags, opcode);
         return tso;
 }
 
diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c
index 11adf6ed4628..811a637695ca 100644
--- a/drivers/net/phy/mdio_bus.c
+++ b/drivers/net/phy/mdio_bus.c
@@ -296,9 +296,8 @@ static int mdio_bus_suspend(struct device * dev, pm_message_t state)
         struct phy_driver *phydrv = to_phy_driver(drv);
         struct phy_device *phydev = to_phy_device(dev);
 
-        if ((!device_may_wakeup(phydev->dev.parent)) &&
-                (phydrv && phydrv->suspend))
-                        ret = phydrv->suspend(phydev);
+        if (drv && phydrv->suspend && !device_may_wakeup(phydev->dev.parent))
+                ret = phydrv->suspend(phydev);
 
         return ret;
 }
@@ -310,8 +309,7 @@ static int mdio_bus_resume(struct device * dev)
         struct phy_driver *phydrv = to_phy_driver(drv);
         struct phy_device *phydev = to_phy_device(dev);
 
-        if ((!device_may_wakeup(phydev->dev.parent)) &&
-                (phydrv && phydrv->resume))
+        if (drv && phydrv->resume && !device_may_wakeup(phydev->dev.parent))
                 ret = phydrv->resume(phydev);
 
         return ret;
diff --git a/drivers/net/phy/smsc.c b/drivers/net/phy/smsc.c
index c05d38d46350..1387187543e4 100644
--- a/drivers/net/phy/smsc.c
+++ b/drivers/net/phy/smsc.c
@@ -81,6 +81,9 @@ static struct phy_driver lan83c185_driver = {
         .ack_interrupt  = smsc_phy_ack_interrupt,
         .config_intr    = smsc_phy_config_intr,
 
+        .suspend        = genphy_suspend,
+        .resume         = genphy_resume,
+
         .driver         = { .owner = THIS_MODULE, }
 };
 
@@ -102,6 +105,9 @@ static struct phy_driver lan8187_driver = {
         .ack_interrupt  = smsc_phy_ack_interrupt,
         .config_intr    = smsc_phy_config_intr,
 
+        .suspend        = genphy_suspend,
+        .resume         = genphy_resume,
+
         .driver         = { .owner = THIS_MODULE, }
 };
 
@@ -123,6 +129,9 @@ static struct phy_driver lan8700_driver = {
         .ack_interrupt  = smsc_phy_ack_interrupt,
         .config_intr    = smsc_phy_config_intr,
 
+        .suspend        = genphy_suspend,
+        .resume         = genphy_resume,
+
         .driver         = { .owner = THIS_MODULE, }
 };
 
@@ -144,6 +153,9 @@ static struct phy_driver lan911x_int_driver = {
         .ack_interrupt  = smsc_phy_ack_interrupt,
         .config_intr    = smsc_phy_config_intr,
 
+        .suspend        = genphy_suspend,
+        .resume         = genphy_resume,
+
         .driver         = { .owner = THIS_MODULE, }
 };
 
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 9b33d6ebf542..3b6225a2c7d2 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -24,6 +24,7 @@
 #include <linux/virtio.h>
 #include <linux/virtio_net.h>
 #include <linux/scatterlist.h>
+#include <linux/if_vlan.h>
 
 static int napi_weight = 128;
 module_param(napi_weight, int, 0444);
@@ -33,7 +34,7 @@ module_param(csum, bool, 0444);
 module_param(gso, bool, 0444);
 
 /* FIXME: MTU in config. */
-#define MAX_PACKET_LEN (ETH_HLEN+ETH_DATA_LEN)
+#define MAX_PACKET_LEN (ETH_HLEN + VLAN_HLEN + ETH_DATA_LEN)
 #define GOOD_COPY_LEN   128
 
 struct virtnet_info
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945-rs.c b/drivers/net/wireless/iwlwifi/iwl-3945-rs.c
index 9b60a0c5de5f..21c841847d88 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945-rs.c
+++ b/drivers/net/wireless/iwlwifi/iwl-3945-rs.c
@@ -638,12 +638,16 @@ static void rs_get_rate(void *priv_r, struct ieee80211_sta *sta,
         s8 scale_action = 0;
         unsigned long flags;
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
-        u16 fc, rate_mask;
+        u16 fc;
+        u16 rate_mask = 0;
         struct iwl3945_priv *priv = (struct iwl3945_priv *)priv_r;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 
         IWL_DEBUG_RATE("enter\n");
 
+        if (sta)
+                rate_mask = sta->supp_rates[sband->band];
+
         /* Send management frames and broadcast/multicast data using lowest
          * rate. */
         fc = le16_to_cpu(hdr->frame_control);
@@ -651,11 +655,15 @@ static void rs_get_rate(void *priv_r, struct ieee80211_sta *sta,
             is_multicast_ether_addr(hdr->addr1) ||
             !sta || !priv_sta) {
                 IWL_DEBUG_RATE("leave: No STA priv data to update!\n");
-                info->control.rates[0].idx = rate_lowest_index(sband, sta);
+                if (!rate_mask)
+                        info->control.rates[0].idx =
+                                        rate_lowest_index(sband, NULL);
+                else
+                        info->control.rates[0].idx =
+                                        rate_lowest_index(sband, sta);
                 return;
         }
 
-        rate_mask = sta->supp_rates[sband->band];
         index = min(rs_sta->last_txrate_idx & 0xffff, IWL_RATE_COUNT - 1);
 
         if (sband->band == IEEE80211_BAND_5GHZ)
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
index f3f17929ca0b..27f50471aed8 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
@@ -944,7 +944,8 @@ static void rs_tx_status(void *priv_r, struct ieee80211_supported_band *sband,
         }
 
         /* See if there's a better rate or modulation mode to try. */
-        rs_rate_scale_perform(priv, hdr, sta, lq_sta);
+        if (sta && sta->supp_rates[sband->band])
+                rs_rate_scale_perform(priv, hdr, sta, lq_sta);
 out:
         return;
 }
@@ -2101,14 +2102,23 @@ static void rs_get_rate(void *priv_r, struct ieee80211_sta *sta, void *priv_sta,
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         struct iwl_lq_sta *lq_sta = priv_sta;
         int rate_idx;
+        u64 mask_bit = 0;
 
         IWL_DEBUG_RATE_LIMIT("rate scale calculate new rate for skb\n");
 
+        if (sta)
+                mask_bit = sta->supp_rates[sband->band];
+
         /* Send management frames and broadcast/multicast data using lowest
          * rate. */
         if (!ieee80211_is_data(hdr->frame_control) ||
             is_multicast_ether_addr(hdr->addr1) || !sta || !lq_sta) {
-                info->control.rates[0].idx = rate_lowest_index(sband, sta);
+                if (!mask_bit)
+                        info->control.rates[0].idx =
+                                        rate_lowest_index(sband, NULL);
+                else
+                        info->control.rates[0].idx =
+                                        rate_lowest_index(sband, sta);
                 return;
         }
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index 5da6b35cd26d..0dc8eed16404 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -2482,7 +2482,7 @@ static int iwl_mac_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
                 dev_kfree_skb_any(skb);
 
         IWL_DEBUG_MACDUMP("leave\n");
-        return 0;
+        return NETDEV_TX_OK;
 }
 
 static int iwl_mac_add_interface(struct ieee80211_hw *hw,
diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
index 15f5655c636e..95d01984c80e 100644
--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -6538,7 +6538,7 @@ static int iwl3945_mac_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
                 dev_kfree_skb_any(skb);
 
         IWL_DEBUG_MAC80211("leave\n");
-        return 0;
+        return NETDEV_TX_OK;
 }
 
 static int iwl3945_mac_add_interface(struct ieee80211_hw *hw,
diff --git a/drivers/net/wireless/orinoco/orinoco.c b/drivers/net/wireless/orinoco/orinoco.c
index c3bb85e0251e..45a04faa7818 100644
--- a/drivers/net/wireless/orinoco/orinoco.c
+++ b/drivers/net/wireless/orinoco/orinoco.c
@@ -1673,7 +1673,7 @@ static void print_linkstatus(struct net_device *dev, u16 status)
                 s = "UNKNOWN";
         }
         
-        printk(KERN_INFO "%s: New link status: %s (%04x)\n",
+        printk(KERN_DEBUG "%s: New link status: %s (%04x)\n",
                dev->name, s, status);
 }
 
@@ -5068,33 +5068,30 @@ static int orinoco_ioctl_set_genie(struct net_device *dev,
         struct orinoco_private *priv = netdev_priv(dev);
         u8 *buf;
         unsigned long flags;
-        int err = 0;
 
         /* cut off at IEEE80211_MAX_DATA_LEN */
         if ((wrqu->data.length > IEEE80211_MAX_DATA_LEN) ||
             (wrqu->data.length && (extra == NULL)))
                 return -EINVAL;
 
-        if (orinoco_lock(priv, &flags) != 0)
-                return -EBUSY;
-
         if (wrqu->data.length) {
                 buf = kmalloc(wrqu->data.length, GFP_KERNEL);
-                if (buf == NULL) {
-                        err = -ENOMEM;
-                        goto out;
-                }
+                if (buf == NULL)
+                        return -ENOMEM;
 
                 memcpy(buf, extra, wrqu->data.length);
-                kfree(priv->wpa_ie);
-                priv->wpa_ie = buf;
-                priv->wpa_ie_len = wrqu->data.length;
-        } else {
-                kfree(priv->wpa_ie);
-                priv->wpa_ie = NULL;
-                priv->wpa_ie_len = 0;
+        } else
+                buf = NULL;
+
+        if (orinoco_lock(priv, &flags) != 0) {
+                kfree(buf);
+                return -EBUSY;
         }
 
+        kfree(priv->wpa_ie);
+        priv->wpa_ie = buf;
+        priv->wpa_ie_len = wrqu->data.length;
+
         if (priv->wpa_ie) {
                 /* Looks like wl_lkm wants to check the auth alg, and
                  * somehow pass it to the firmware.
@@ -5103,9 +5100,8 @@ static int orinoco_ioctl_set_genie(struct net_device *dev,
                  */
         }
 
-out:
         orinoco_unlock(priv, &flags);
-        return err;
+        return 0;
 }
 
 static int orinoco_ioctl_get_genie(struct net_device *dev,
diff --git a/drivers/net/wireless/p54/p54common.c b/drivers/net/wireless/p54/p54common.c
index 12d0717c3992..34561e6e816b 100644
--- a/drivers/net/wireless/p54/p54common.c
+++ b/drivers/net/wireless/p54/p54common.c
@@ -451,8 +451,8 @@ static int p54_parse_eeprom(struct ieee80211_hw *dev, void *eeprom, int len)
                         }
                         if (err)
                                 goto err;
-
-                }
+                        }
+                        break;
                 case PDR_PRISM_ZIF_TX_IQ_CALIBRATION:
                         priv->iq_autocal = kmalloc(data_len, GFP_KERNEL);
                         if (!priv->iq_autocal) {
@@ -745,7 +745,7 @@ static void p54_rx_frame_sent(struct ieee80211_hw *dev, struct sk_buff *skb)
                 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(entry);
                 struct p54_hdr *entry_hdr;
                 struct p54_tx_data *entry_data;
-                int pad = 0;
+                unsigned int pad = 0, frame_len;
 
                 range = (void *)info->rate_driver_data;
                 if (range->start_addr != addr) {
@@ -768,6 +768,7 @@ static void p54_rx_frame_sent(struct ieee80211_hw *dev, struct sk_buff *skb)
                 __skb_unlink(entry, &priv->tx_queue);
                 spin_unlock_irqrestore(&priv->tx_queue.lock, flags);
 
+                frame_len = entry->len;
                 entry_hdr = (struct p54_hdr *) entry->data;
                 entry_data = (struct p54_tx_data *) entry_hdr->data;
                 priv->tx_stats[entry_data->hw_queue].len--;
@@ -814,15 +815,28 @@ static void p54_rx_frame_sent(struct ieee80211_hw *dev, struct sk_buff *skb)
                 info->status.ack_signal = p54_rssi_to_dbm(dev,
                                 (int)payload->ack_rssi);
 
-                if (entry_data->key_type == P54_CRYPTO_TKIPMICHAEL) {
+                /* Undo all changes to the frame. */
+                switch (entry_data->key_type) {
+                case P54_CRYPTO_TKIPMICHAEL: {
                         u8 *iv = (u8 *)(entry_data->align + pad +
-                                        entry_data->crypt_offset);
+                                        entry_data->crypt_offset);
 
                         /* Restore the original TKIP IV. */
                         iv[2] = iv[0];
                         iv[0] = iv[1];
                         iv[1] = (iv[0] | 0x20) & 0x7f;  /* WEPSeed - 8.3.2.2 */
+
+                        frame_len -= 12; /* remove TKIP_MMIC + TKIP_ICV */
+                        break;
+                        }
+                case P54_CRYPTO_AESCCMP:
+                        frame_len -= 8; /* remove CCMP_MIC */
+                        break;
+                case P54_CRYPTO_WEP:
+                        frame_len -= 4; /* remove WEP_ICV */
+                        break;
                 }
+                skb_trim(entry, frame_len);
                 skb_pull(entry, sizeof(*hdr) + pad + sizeof(*entry_data));
                 ieee80211_tx_status_irqsafe(dev, entry);
                 goto out;
diff --git a/drivers/net/wireless/p54/p54usb.c b/drivers/net/wireless/p54/p54usb.c
index 6a6a72f6f82c..5de2ebfb28c7 100644
--- a/drivers/net/wireless/p54/p54usb.c
+++ b/drivers/net/wireless/p54/p54usb.c
@@ -144,11 +144,8 @@ static void p54u_tx_cb(struct urb *urb)
         struct sk_buff *skb = urb->context;
         struct ieee80211_hw *dev = (struct ieee80211_hw *)
                 usb_get_intfdata(usb_ifnum_to_if(urb->dev, 0));
-        struct p54u_priv *priv = dev->priv;
 
-        skb_pull(skb, priv->common.tx_hdr_len);
-        if (FREE_AFTER_TX(skb))
-                p54_free_skb(dev, skb);
+        p54_free_skb(dev, skb);
 }
 
 static void p54u_tx_dummy_cb(struct urb *urb) { }
@@ -230,7 +227,10 @@ static void p54u_tx_3887(struct ieee80211_hw *dev, struct sk_buff *skb)
                           p54u_tx_dummy_cb, dev);
         usb_fill_bulk_urb(data_urb, priv->udev,
                           usb_sndbulkpipe(priv->udev, P54U_PIPE_DATA),
-                          skb->data, skb->len, p54u_tx_cb, skb);
+                          skb->data, skb->len, FREE_AFTER_TX(skb) ?
+                          p54u_tx_cb : p54u_tx_dummy_cb, skb);
+        addr_urb->transfer_flags |= URB_ZERO_PACKET;
+        data_urb->transfer_flags |= URB_ZERO_PACKET;
 
         usb_anchor_urb(addr_urb, &priv->submitted);
         err = usb_submit_urb(addr_urb, GFP_ATOMIC);
@@ -239,7 +239,7 @@ static void p54u_tx_3887(struct ieee80211_hw *dev, struct sk_buff *skb)
                 goto out;
         }
 
-        usb_anchor_urb(addr_urb, &priv->submitted);
+        usb_anchor_urb(data_urb, &priv->submitted);
         err = usb_submit_urb(data_urb, GFP_ATOMIC);
         if (err)
                 usb_unanchor_urb(data_urb);
@@ -269,28 +269,24 @@ static void p54u_tx_lm87(struct ieee80211_hw *dev, struct sk_buff *skb)
 {
         struct p54u_priv *priv = dev->priv;
         struct urb *data_urb;
-        struct lm87_tx_hdr *hdr;
-        __le32 checksum;
-        __le32 addr = ((struct p54_hdr *)skb->data)->req_id;
+        struct lm87_tx_hdr *hdr = (void *)skb->data - sizeof(*hdr);
 
         data_urb = usb_alloc_urb(0, GFP_ATOMIC);
         if (!data_urb)
                 return;
 
-        checksum = p54u_lm87_chksum((__le32 *)skb->data, skb->len);
-        hdr = (struct lm87_tx_hdr *)skb_push(skb, sizeof(*hdr));
-        hdr->chksum = checksum;
-        hdr->device_addr = addr;
+        hdr->chksum = p54u_lm87_chksum((__le32 *)skb->data, skb->len);
+        hdr->device_addr = ((struct p54_hdr *)skb->data)->req_id;
 
         usb_fill_bulk_urb(data_urb, priv->udev,
                           usb_sndbulkpipe(priv->udev, P54U_PIPE_DATA),
-                          skb->data, skb->len, p54u_tx_cb, skb);
+                          hdr, skb->len + sizeof(*hdr),  FREE_AFTER_TX(skb) ?
+                          p54u_tx_cb : p54u_tx_dummy_cb, skb);
         data_urb->transfer_flags |= URB_ZERO_PACKET;
 
         usb_anchor_urb(data_urb, &priv->submitted);
         if (usb_submit_urb(data_urb, GFP_ATOMIC)) {
                 usb_unanchor_urb(data_urb);
-                skb_pull(skb, sizeof(*hdr));
                 p54_free_skb(dev, skb);
         }
         usb_free_urb(data_urb);
@@ -300,11 +296,9 @@ static void p54u_tx_net2280(struct ieee80211_hw *dev, struct sk_buff *skb)
 {
         struct p54u_priv *priv = dev->priv;
         struct urb *int_urb, *data_urb;
-        struct net2280_tx_hdr *hdr;
+        struct net2280_tx_hdr *hdr = (void *)skb->data - sizeof(*hdr);
         struct net2280_reg_write *reg;
         int err = 0;
-        __le32 addr = ((struct p54_hdr *) skb->data)->req_id;
-        __le16 len = cpu_to_le16(skb->len);
 
         reg = kmalloc(sizeof(*reg), GFP_ATOMIC);
         if (!reg)
@@ -327,10 +321,9 @@ static void p54u_tx_net2280(struct ieee80211_hw *dev, struct sk_buff *skb)
         reg->addr = cpu_to_le32(P54U_DEV_BASE);
         reg->val = cpu_to_le32(ISL38XX_DEV_INT_DATA);
 
-        hdr = (void *)skb_push(skb, sizeof(*hdr));
         memset(hdr, 0, sizeof(*hdr));
-        hdr->len = len;
-        hdr->device_addr = addr;
+        hdr->len = cpu_to_le16(skb->len);
+        hdr->device_addr = ((struct p54_hdr *) skb->data)->req_id;
 
         usb_fill_bulk_urb(int_urb, priv->udev,
                 usb_sndbulkpipe(priv->udev, P54U_PIPE_DEV), reg, sizeof(*reg),
@@ -341,11 +334,13 @@ static void p54u_tx_net2280(struct ieee80211_hw *dev, struct sk_buff *skb)
          * free what's inside the transfer_buffer after the callback routine
          * has completed.
          */
-        int_urb->transfer_flags |= URB_FREE_BUFFER;
+        int_urb->transfer_flags |= URB_FREE_BUFFER | URB_ZERO_PACKET;
 
         usb_fill_bulk_urb(data_urb, priv->udev,
                           usb_sndbulkpipe(priv->udev, P54U_PIPE_DATA),
-                          skb->data, skb->len, p54u_tx_cb, skb);
+                          hdr, skb->len + sizeof(*hdr), FREE_AFTER_TX(skb) ?
+                          p54u_tx_cb : p54u_tx_dummy_cb, skb);
+        data_urb->transfer_flags |= URB_ZERO_PACKET;
 
         usb_anchor_urb(int_urb, &priv->submitted);
         err = usb_submit_urb(int_urb, GFP_ATOMIC);
diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.c b/drivers/net/wireless/rt2x00/rt2x00queue.c
index 746a8f36b931..0709decec9c2 100644
--- a/drivers/net/wireless/rt2x00/rt2x00queue.c
+++ b/drivers/net/wireless/rt2x00/rt2x00queue.c
@@ -154,6 +154,7 @@ static void rt2x00queue_create_tx_descriptor(struct queue_entry *entry,
         struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
         struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(entry->skb);
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)entry->skb->data;
+        struct ieee80211_tx_rate *txrate = &tx_info->control.rates[0];
         struct ieee80211_rate *rate =
             ieee80211_get_tx_rate(rt2x00dev->hw, tx_info);
         const struct rt2x00_rate *hwrate;
@@ -313,7 +314,7 @@ static void rt2x00queue_create_tx_descriptor(struct queue_entry *entry,
                  * When preamble is enabled we should set the
                  * preamble bit for the signal.
                  */
-                if (rate->flags & IEEE80211_TX_RC_USE_SHORT_PREAMBLE)
+                if (txrate->flags & IEEE80211_TX_RC_USE_SHORT_PREAMBLE)
                         txdesc->signal |= 0x08;
         }
 }
diff --git a/drivers/net/wireless/rtl818x/rtl8187_dev.c b/drivers/net/wireless/rtl818x/rtl8187_dev.c
index 6ad6bac37706..22bc07ef2f37 100644
--- a/drivers/net/wireless/rtl818x/rtl8187_dev.c
+++ b/drivers/net/wireless/rtl818x/rtl8187_dev.c
@@ -273,6 +273,7 @@ static int rtl8187_tx(struct ieee80211_hw *dev, struct sk_buff *skb)
 
         usb_fill_bulk_urb(urb, priv->udev, usb_sndbulkpipe(priv->udev, ep),
                           buf, skb->len, rtl8187_tx_cb, skb);
+        urb->transfer_flags |= URB_ZERO_PACKET;
         usb_anchor_urb(urb, &priv->anchored);
         rc = usb_submit_urb(urb, GFP_ATOMIC);
         if (rc < 0) {
diff --git a/drivers/net/wireless/zd1211rw/zd_usb.c b/drivers/net/wireless/zd1211rw/zd_usb.c
index b5db57d2fcf5..17527f765b39 100644
--- a/drivers/net/wireless/zd1211rw/zd_usb.c
+++ b/drivers/net/wireless/zd1211rw/zd_usb.c
@@ -84,6 +84,7 @@ static struct usb_device_id usb_ids[] = {
         { USB_DEVICE(0x0586, 0x340a), .driver_info = DEVICE_ZD1211B },
         { USB_DEVICE(0x0471, 0x1237), .driver_info = DEVICE_ZD1211B },
         { USB_DEVICE(0x07fa, 0x1196), .driver_info = DEVICE_ZD1211B },
+        { USB_DEVICE(0x0df6, 0x0036), .driver_info = DEVICE_ZD1211B },
         /* "Driverless" devices that need ejecting */
         { USB_DEVICE(0x0ace, 0x2011), .driver_info = DEVICE_INSTALLER },
         { USB_DEVICE(0x0ace, 0x20ff), .driver_info = DEVICE_INSTALLER },