Merge commit 'v2.6.27' into timers/hpet

20 files changed, 308 insertions, 100 deletions

diff --git a/drivers/net/bnx2.h b/drivers/net/bnx2.h
index c3c579f98ed0..dfacd31f7ed0 100644
--- a/drivers/net/bnx2.h
+++ b/drivers/net/bnx2.h
@@ -6597,7 +6597,7 @@ struct flash_spec {
 
 struct bnx2_irq {
         irq_handler_t   handler;
-        u16             vector;
+        unsigned int    vector;
         u8              requested;
         char            name[16];
 };
diff --git a/drivers/net/e100.c b/drivers/net/e100.c
index 453115acaad2..5cf78d612c45 100644
--- a/drivers/net/e100.c
+++ b/drivers/net/e100.c
@@ -2738,9 +2738,7 @@ static int __devinit e100_probe(struct pci_dev *pdev,
                 nic->flags |= wol_magic;
 
         /* ack any pending wake events, disable PME */
-        err = pci_enable_wake(pdev, 0, 0);
-        if (err)
-                DPRINTK(PROBE, ERR, "Error clearing wake event\n");
+        pci_pme_active(pdev, false);
 
         strcpy(netdev->name, "eth%d");
         if((err = register_netdev(netdev))) {
diff --git a/drivers/net/e1000/e1000_hw.c b/drivers/net/e1000/e1000_hw.c
index 9d6edf3e73f9..d04eef53571e 100644
--- a/drivers/net/e1000/e1000_hw.c
+++ b/drivers/net/e1000/e1000_hw.c
@@ -144,6 +144,8 @@ static s32 e1000_host_if_read_cookie(struct e1000_hw *hw, u8 *buffer);
 static u8 e1000_calculate_mng_checksum(char *buffer, u32 length);
 static s32 e1000_configure_kmrn_for_10_100(struct e1000_hw *hw, u16 duplex);
 static s32 e1000_configure_kmrn_for_1000(struct e1000_hw *hw);
+static s32 e1000_do_read_eeprom(struct e1000_hw *hw, u16 offset, u16 words, u16 *data);
+static s32 e1000_do_write_eeprom(struct e1000_hw *hw, u16 offset, u16 words, u16 *data);
 
 /* IGP cable length table */
 static const
@@ -168,6 +170,8 @@ u16 e1000_igp_2_cable_length_table[IGP02E1000_AGC_LENGTH_TABLE_SIZE] =
       83, 89, 95, 100, 105, 109, 113, 116, 119, 122, 124,
       104, 109, 114, 118, 121, 124};
 
+static DEFINE_SPINLOCK(e1000_eeprom_lock);
+
 /******************************************************************************
  * Set the phy type member in the hw struct.
  *
@@ -4904,6 +4908,15 @@ static s32 e1000_spi_eeprom_ready(struct e1000_hw *hw)
  *****************************************************************************/
 s32 e1000_read_eeprom(struct e1000_hw *hw, u16 offset, u16 words, u16 *data)
 {
+    s32 ret;
+    spin_lock(&e1000_eeprom_lock);
+    ret = e1000_do_read_eeprom(hw, offset, words, data);
+    spin_unlock(&e1000_eeprom_lock);
+    return ret;
+}
+
+static s32 e1000_do_read_eeprom(struct e1000_hw *hw, u16 offset, u16 words, u16 *data)
+{
     struct e1000_eeprom_info *eeprom = &hw->eeprom;
     u32 i = 0;
 
@@ -5236,6 +5249,16 @@ s32 e1000_update_eeprom_checksum(struct e1000_hw *hw)
  *****************************************************************************/
 s32 e1000_write_eeprom(struct e1000_hw *hw, u16 offset, u16 words, u16 *data)
 {
+    s32 ret;
+    spin_lock(&e1000_eeprom_lock);
+    ret = e1000_do_write_eeprom(hw, offset, words, data);
+    spin_unlock(&e1000_eeprom_lock);
+    return ret;
+}
+
+
+static s32 e1000_do_write_eeprom(struct e1000_hw *hw, u16 offset, u16 words, u16 *data)
+{
     struct e1000_eeprom_info *eeprom = &hw->eeprom;
     s32 status = 0;
 
diff --git a/drivers/net/e1000e/e1000.h b/drivers/net/e1000e/e1000.h
index ac4e506b4f88..5ea6b60fa377 100644
--- a/drivers/net/e1000e/e1000.h
+++ b/drivers/net/e1000e/e1000.h
@@ -257,7 +257,6 @@ struct e1000_adapter {
         struct net_device *netdev;
         struct pci_dev *pdev;
         struct net_device_stats net_stats;
-        spinlock_t stats_lock;      /* prevent concurrent stats updates */
 
         /* structs defined in e1000_hw.h */
         struct e1000_hw hw;
@@ -284,6 +283,8 @@ struct e1000_adapter {
         unsigned long led_status;
 
         unsigned int flags;
+        struct work_struct downshift_task;
+        struct work_struct update_phy_task;
 };
 
 struct e1000_info {
@@ -305,6 +306,7 @@ struct e1000_info {
 #define FLAG_HAS_CTRLEXT_ON_LOAD          (1 << 5)
 #define FLAG_HAS_SWSM_ON_LOAD             (1 << 6)
 #define FLAG_HAS_JUMBO_FRAMES             (1 << 7)
+#define FLAG_READ_ONLY_NVM                (1 << 8)
 #define FLAG_IS_ICH                       (1 << 9)
 #define FLAG_HAS_SMART_POWER_DOWN         (1 << 11)
 #define FLAG_IS_QUAD_PORT_A               (1 << 12)
@@ -385,6 +387,7 @@ extern bool e1000e_enable_mng_pass_thru(struct e1000_hw *hw);
 extern bool e1000e_get_laa_state_82571(struct e1000_hw *hw);
 extern void e1000e_set_laa_state_82571(struct e1000_hw *hw, bool state);
 
+extern void e1000e_write_protect_nvm_ich8lan(struct e1000_hw *hw);
 extern void e1000e_set_kmrn_lock_loss_workaround_ich8lan(struct e1000_hw *hw,
                                                  bool state);
 extern void e1000e_igp3_phy_powerdown_workaround_ich8lan(struct e1000_hw *hw);
diff --git a/drivers/net/e1000e/ethtool.c b/drivers/net/e1000e/ethtool.c
index e21c9e0f3738..33a3ff17b5d0 100644
--- a/drivers/net/e1000e/ethtool.c
+++ b/drivers/net/e1000e/ethtool.c
@@ -432,6 +432,10 @@ static void e1000_get_regs(struct net_device *netdev,
         regs_buff[11] = er32(TIDV);
 
         regs_buff[12] = adapter->hw.phy.type;  /* PHY type (IGP=1, M88=0) */
+
+        /* ethtool doesn't use anything past this point, so all this
+         * code is likely legacy junk for apps that may or may not
+         * exist */
         if (hw->phy.type == e1000_phy_m88) {
                 e1e_rphy(hw, M88E1000_PHY_SPEC_STATUS, &phy_data);
                 regs_buff[13] = (u32)phy_data; /* cable length */
@@ -447,7 +451,7 @@ static void e1000_get_regs(struct net_device *netdev,
                 regs_buff[22] = adapter->phy_stats.receive_errors;
                 regs_buff[23] = regs_buff[13]; /* mdix mode */
         }
-        regs_buff[21] = adapter->phy_stats.idle_errors;  /* phy idle errors */
+        regs_buff[21] = 0; /* was idle_errors */
         e1e_rphy(hw, PHY_1000T_STATUS, &phy_data);
         regs_buff[24] = (u32)phy_data;  /* phy local receiver status */
         regs_buff[25] = regs_buff[24];  /* phy remote receiver status */
@@ -529,6 +533,9 @@ static int e1000_set_eeprom(struct net_device *netdev,
         if (eeprom->magic != (adapter->pdev->vendor | (adapter->pdev->device << 16)))
                 return -EFAULT;
 
+        if (adapter->flags & FLAG_READ_ONLY_NVM)
+                return -EINVAL;
+
         max_len = hw->nvm.word_size * 2;
 
         first_word = eeprom->offset >> 1;
diff --git a/drivers/net/e1000e/ich8lan.c b/drivers/net/e1000e/ich8lan.c
index 9e38452a738c..bcd2bc477af2 100644
--- a/drivers/net/e1000e/ich8lan.c
+++ b/drivers/net/e1000e/ich8lan.c
@@ -58,6 +58,7 @@
 #define ICH_FLASH_HSFCTL                0x0006
 #define ICH_FLASH_FADDR                 0x0008
 #define ICH_FLASH_FDATA0                0x0010
+#define ICH_FLASH_PR0                   0x0074
 
 #define ICH_FLASH_READ_COMMAND_TIMEOUT  500
 #define ICH_FLASH_WRITE_COMMAND_TIMEOUT 500
@@ -150,6 +151,19 @@ union ich8_hws_flash_regacc {
         u16 regval;
 };
 
+/* ICH Flash Protected Region */
+union ich8_flash_protected_range {
+        struct ich8_pr {
+                u32 base:13;     /* 0:12 Protected Range Base */
+                u32 reserved1:2; /* 13:14 Reserved */
+                u32 rpe:1;       /* 15 Read Protection Enable */
+                u32 limit:13;    /* 16:28 Protected Range Limit */
+                u32 reserved2:2; /* 29:30 Reserved */
+                u32 wpe:1;       /* 31 Write Protection Enable */
+        } range;
+        u32 regval;
+};
+
 static s32 e1000_setup_link_ich8lan(struct e1000_hw *hw);
 static void e1000_clear_hw_cntrs_ich8lan(struct e1000_hw *hw);
 static void e1000_initialize_hw_bits_ich8lan(struct e1000_hw *hw);
@@ -366,6 +380,9 @@ static s32 e1000_get_variants_ich8lan(struct e1000_adapter *adapter)
         return 0;
 }
 
+static DEFINE_MUTEX(nvm_mutex);
+static pid_t nvm_owner = -1;
+
 /**
  *  e1000_acquire_swflag_ich8lan - Acquire software control flag
  *  @hw: pointer to the HW structure
@@ -379,6 +396,15 @@ static s32 e1000_acquire_swflag_ich8lan(struct e1000_hw *hw)
         u32 extcnf_ctrl;
         u32 timeout = PHY_CFG_TIMEOUT;
 
+        might_sleep();
+
+        if (!mutex_trylock(&nvm_mutex)) {
+                WARN(1, KERN_ERR "e1000e mutex contention. Owned by pid %d\n",
+                     nvm_owner);
+                mutex_lock(&nvm_mutex);
+        }
+        nvm_owner = current->pid;
+
         while (timeout) {
                 extcnf_ctrl = er32(EXTCNF_CTRL);
                 extcnf_ctrl |= E1000_EXTCNF_CTRL_SWFLAG;
@@ -393,6 +419,8 @@ static s32 e1000_acquire_swflag_ich8lan(struct e1000_hw *hw)
 
         if (!timeout) {
                 hw_dbg(hw, "FW or HW has locked the resource for too long.\n");
+                nvm_owner = -1;
+                mutex_unlock(&nvm_mutex);
                 return -E1000_ERR_CONFIG;
         }
 
@@ -414,6 +442,9 @@ static void e1000_release_swflag_ich8lan(struct e1000_hw *hw)
         extcnf_ctrl = er32(EXTCNF_CTRL);
         extcnf_ctrl &= ~E1000_EXTCNF_CTRL_SWFLAG;
         ew32(EXTCNF_CTRL, extcnf_ctrl);
+
+        nvm_owner = -1;
+        mutex_unlock(&nvm_mutex);
 }
 
 /**
@@ -1284,6 +1315,7 @@ static s32 e1000_update_nvm_checksum_ich8lan(struct e1000_hw *hw)
          * programming failed.
          */
         if (ret_val) {
+                /* Possibly read-only, see e1000e_write_protect_nvm_ich8lan() */
                 hw_dbg(hw, "Flash commit failed.\n");
                 e1000_release_swflag_ich8lan(hw);
                 return ret_val;
@@ -1374,6 +1406,49 @@ static s32 e1000_validate_nvm_checksum_ich8lan(struct e1000_hw *hw)
 }
 
 /**
+ *  e1000e_write_protect_nvm_ich8lan - Make the NVM read-only
+ *  @hw: pointer to the HW structure
+ *
+ *  To prevent malicious write/erase of the NVM, set it to be read-only
+ *  so that the hardware ignores all write/erase cycles of the NVM via
+ *  the flash control registers.  The shadow-ram copy of the NVM will
+ *  still be updated, however any updates to this copy will not stick
+ *  across driver reloads.
+ **/
+void e1000e_write_protect_nvm_ich8lan(struct e1000_hw *hw)
+{
+        union ich8_flash_protected_range pr0;
+        union ich8_hws_flash_status hsfsts;
+        u32 gfpreg;
+        s32 ret_val;
+
+        ret_val = e1000_acquire_swflag_ich8lan(hw);
+        if (ret_val)
+                return;
+
+        gfpreg = er32flash(ICH_FLASH_GFPREG);
+
+        /* Write-protect GbE Sector of NVM */
+        pr0.regval = er32flash(ICH_FLASH_PR0);
+        pr0.range.base = gfpreg & FLASH_GFPREG_BASE_MASK;
+        pr0.range.limit = ((gfpreg >> 16) & FLASH_GFPREG_BASE_MASK);
+        pr0.range.wpe = true;
+        ew32flash(ICH_FLASH_PR0, pr0.regval);
+
+        /*
+         * Lock down a subset of GbE Flash Control Registers, e.g.
+         * PR0 to prevent the write-protection from being lifted.
+         * Once FLOCKDN is set, the registers protected by it cannot
+         * be written until FLOCKDN is cleared by a hardware reset.
+         */
+        hsfsts.regval = er16flash(ICH_FLASH_HSFSTS);
+        hsfsts.hsf_status.flockdn = true;
+        ew32flash(ICH_FLASH_HSFSTS, hsfsts.regval);
+
+        e1000_release_swflag_ich8lan(hw);
+}
+
+/**
  *  e1000_write_flash_data_ich8lan - Writes bytes to the NVM
  *  @hw: pointer to the HW structure
  *  @offset: The offset (in bytes) of the byte/word to read.
@@ -1720,6 +1795,9 @@ static s32 e1000_reset_hw_ich8lan(struct e1000_hw *hw)
         ew32(CTRL, (ctrl | E1000_CTRL_RST));
         msleep(20);
 
+        /* release the swflag because it is not reset by hardware reset */
+        e1000_release_swflag_ich8lan(hw);
+
         ret_val = e1000e_get_auto_rd_done(hw);
         if (ret_val) {
                 /*
diff --git a/drivers/net/e1000e/netdev.c b/drivers/net/e1000e/netdev.c
index d266510c8a94..b81c4237b5d3 100644
--- a/drivers/net/e1000e/netdev.c
+++ b/drivers/net/e1000e/netdev.c
@@ -47,7 +47,7 @@
 
 #include "e1000.h"
 
-#define DRV_VERSION "0.3.3.3-k2"
+#define DRV_VERSION "0.3.3.3-k6"
 char e1000e_driver_name[] = "e1000e";
 const char e1000e_driver_version[] = DRV_VERSION;
 
@@ -1115,6 +1115,14 @@ static void e1000_clean_rx_ring(struct e1000_adapter *adapter)
         writel(0, adapter->hw.hw_addr + rx_ring->tail);
 }
 
+static void e1000e_downshift_workaround(struct work_struct *work)
+{
+        struct e1000_adapter *adapter = container_of(work,
+                                        struct e1000_adapter, downshift_task);
+
+        e1000e_gig_downshift_workaround_ich8lan(&adapter->hw);
+}
+
 /**
  * e1000_intr_msi - Interrupt Handler
  * @irq: interrupt number
@@ -1139,7 +1147,7 @@ static irqreturn_t e1000_intr_msi(int irq, void *data)
                  */
                 if ((adapter->flags & FLAG_LSC_GIG_SPEED_DROP) &&
                     (!(er32(STATUS) & E1000_STATUS_LU)))
-                        e1000e_gig_downshift_workaround_ich8lan(hw);
+                        schedule_work(&adapter->downshift_task);
 
                 /*
                  * 80003ES2LAN workaround-- For packet buffer work-around on
@@ -1205,7 +1213,7 @@ static irqreturn_t e1000_intr(int irq, void *data)
                  */
                 if ((adapter->flags & FLAG_LSC_GIG_SPEED_DROP) &&
                     (!(er32(STATUS) & E1000_STATUS_LU)))
-                        e1000e_gig_downshift_workaround_ich8lan(hw);
+                        schedule_work(&adapter->downshift_task);
 
                 /*
                  * 80003ES2LAN workaround--
@@ -2592,8 +2600,6 @@ static int __devinit e1000_sw_init(struct e1000_adapter *adapter)
         /* Explicitly disable IRQ since the NIC can be in any state. */
         e1000_irq_disable(adapter);
 
-        spin_lock_init(&adapter->stats_lock);
-
         set_bit(__E1000_DOWN, &adapter->state);
         return 0;
 
@@ -2912,6 +2918,21 @@ static int e1000_set_mac(struct net_device *netdev, void *p)
         return 0;
 }
 
+/**
+ * e1000e_update_phy_task - work thread to update phy
+ * @work: pointer to our work struct
+ *
+ * this worker thread exists because we must acquire a
+ * semaphore to read the phy, which we could msleep while
+ * waiting for it, and we can't msleep in a timer.
+ **/
+static void e1000e_update_phy_task(struct work_struct *work)
+{
+        struct e1000_adapter *adapter = container_of(work,
+                                        struct e1000_adapter, update_phy_task);
+        e1000_get_phy_info(&adapter->hw);
+}
+
 /*
  * Need to wait a few seconds after link up to get diagnostic information from
  * the phy
@@ -2919,7 +2940,7 @@ static int e1000_set_mac(struct net_device *netdev, void *p)
 static void e1000_update_phy_info(unsigned long data)
 {
         struct e1000_adapter *adapter = (struct e1000_adapter *) data;
-        e1000_get_phy_info(&adapter->hw);
+        schedule_work(&adapter->update_phy_task);
 }
 
 /**
@@ -2930,10 +2951,6 @@ void e1000e_update_stats(struct e1000_adapter *adapter)
 {
         struct e1000_hw *hw = &adapter->hw;
         struct pci_dev *pdev = adapter->pdev;
-        unsigned long irq_flags;
-        u16 phy_tmp;
-
-#define PHY_IDLE_ERROR_COUNT_MASK 0x00FF
 
         /*
          * Prevent stats update while adapter is being reset, or if the pci
@@ -2944,14 +2961,6 @@ void e1000e_update_stats(struct e1000_adapter *adapter)
         if (pci_channel_offline(pdev))
                 return;
 
-        spin_lock_irqsave(&adapter->stats_lock, irq_flags);
-
-        /*
-         * these counters are modified from e1000_adjust_tbi_stats,
-         * called from the interrupt context, so they must only
-         * be written while holding adapter->stats_lock
-         */
-
         adapter->stats.crcerrs += er32(CRCERRS);
         adapter->stats.gprc += er32(GPRC);
         adapter->stats.gorc += er32(GORCL);
@@ -3022,21 +3031,10 @@ void e1000e_update_stats(struct e1000_adapter *adapter)
 
         /* Tx Dropped needs to be maintained elsewhere */
 
-        /* Phy Stats */
-        if (hw->phy.media_type == e1000_media_type_copper) {
-                if ((adapter->link_speed == SPEED_1000) &&
-                   (!e1e_rphy(hw, PHY_1000T_STATUS, &phy_tmp))) {
-                        phy_tmp &= PHY_IDLE_ERROR_COUNT_MASK;
-                        adapter->phy_stats.idle_errors += phy_tmp;
-                }
-        }
-
         /* Management Stats */
         adapter->stats.mgptc += er32(MGTPTC);
         adapter->stats.mgprc += er32(MGTPRC);
         adapter->stats.mgpdc += er32(MGTPDC);
-
-        spin_unlock_irqrestore(&adapter->stats_lock, irq_flags);
 }
 
 /**
@@ -3048,10 +3046,6 @@ static void e1000_phy_read_status(struct e1000_adapter *adapter)
         struct e1000_hw *hw = &adapter->hw;
         struct e1000_phy_regs *phy = &adapter->phy_regs;
         int ret_val;
-        unsigned long irq_flags;
-
-
-        spin_lock_irqsave(&adapter->stats_lock, irq_flags);
 
         if ((er32(STATUS) & E1000_STATUS_LU) &&
             (adapter->hw.phy.media_type == e1000_media_type_copper)) {
@@ -3082,8 +3076,6 @@ static void e1000_phy_read_status(struct e1000_adapter *adapter)
                 phy->stat1000 = 0;
                 phy->estatus = (ESTATUS_1000_TFULL | ESTATUS_1000_THALF);
         }
-
-        spin_unlock_irqrestore(&adapter->stats_lock, irq_flags);
 }
 
 static void e1000_print_link_info(struct e1000_adapter *adapter)
@@ -4467,6 +4459,8 @@ static int __devinit e1000_probe(struct pci_dev *pdev,
 
         adapter->bd_number = cards_found++;
 
+        e1000e_check_options(adapter);
+
         /* setup adapter struct */
         err = e1000_sw_init(adapter);
         if (err)
@@ -4482,6 +4476,10 @@ static int __devinit e1000_probe(struct pci_dev *pdev,
         if (err)
                 goto err_hw_init;
 
+        if ((adapter->flags & FLAG_IS_ICH) &&
+            (adapter->flags & FLAG_READ_ONLY_NVM))
+                e1000e_write_protect_nvm_ich8lan(&adapter->hw);
+
         hw->mac.ops.get_bus_info(&adapter->hw);
 
         adapter->hw.phy.autoneg_wait_to_complete = 0;
@@ -4572,8 +4570,8 @@ static int __devinit e1000_probe(struct pci_dev *pdev,
 
         INIT_WORK(&adapter->reset_task, e1000_reset_task);
         INIT_WORK(&adapter->watchdog_task, e1000_watchdog_task);
-
-        e1000e_check_options(adapter);
+        INIT_WORK(&adapter->downshift_task, e1000e_downshift_workaround);
+        INIT_WORK(&adapter->update_phy_task, e1000e_update_phy_task);
 
         /* Initialize link parameters. User can change them with ethtool */
         adapter->hw.mac.autoneg = 1;
diff --git a/drivers/net/e1000e/param.c b/drivers/net/e1000e/param.c
index ed912e023a72..d91dbf7ba434 100644
--- a/drivers/net/e1000e/param.c
+++ b/drivers/net/e1000e/param.c
@@ -133,6 +133,15 @@ E1000_PARAM(SmartPowerDownEnable, "Enable PHY smart power down");
  */
 E1000_PARAM(KumeranLockLoss, "Enable Kumeran lock loss workaround");
 
+/*
+ * Write Protect NVM
+ *
+ * Valid Range: 0, 1
+ *
+ * Default Value: 1 (enabled)
+ */
+E1000_PARAM(WriteProtectNVM, "Write-protect NVM [WARNING: disabling this can lead to corrupted NVM]");
+
 struct e1000_option {
         enum { enable_option, range_option, list_option } type;
         const char *name;
@@ -388,4 +397,25 @@ void __devinit e1000e_check_options(struct e1000_adapter *adapter)
                                                                        opt.def);
                 }
         }
+        { /* Write-protect NVM */
+                const struct e1000_option opt = {
+                        .type = enable_option,
+                        .name = "Write-protect NVM",
+                        .err  = "defaulting to Enabled",
+                        .def  = OPTION_ENABLED
+                };
+
+                if (adapter->flags & FLAG_IS_ICH) {
+                        if (num_WriteProtectNVM > bd) {
+                                unsigned int write_protect_nvm = WriteProtectNVM[bd];
+                                e1000_validate_option(&write_protect_nvm, &opt,
+                                                      adapter);
+                                if (write_protect_nvm)
+                                        adapter->flags |= FLAG_READ_ONLY_NVM;
+                        } else {
+                                if (opt.def)
+                                        adapter->flags |= FLAG_READ_ONLY_NVM;
+                        }
+                }
+        }
 }
diff --git a/drivers/net/forcedeth.c b/drivers/net/forcedeth.c
index 0b6ecef9a849..eeb55ed2152d 100644
--- a/drivers/net/forcedeth.c
+++ b/drivers/net/forcedeth.c
@@ -5643,6 +5643,7 @@ static int __devinit nv_probe(struct pci_dev *pci_dev, const struct pci_device_i
                 dev->dev_addr[4] = (np->orig_mac[0] >>  8) & 0xff;
                 dev->dev_addr[5] = (np->orig_mac[0] >>  0) & 0xff;
                 writel(txreg|NVREG_TRANSMITPOLL_MAC_ADDR_REV, base + NvRegTransmitPoll);
+                printk(KERN_DEBUG "nv_probe: set workaround bit for reversed mac addr\n");
         }
         memcpy(dev->perm_addr, dev->dev_addr, dev->addr_len);
 
@@ -5890,14 +5891,12 @@ static void nv_restore_phy(struct net_device *dev)
         }
 }
 
-static void __devexit nv_remove(struct pci_dev *pci_dev)
+static void nv_restore_mac_addr(struct pci_dev *pci_dev)
 {
         struct net_device *dev = pci_get_drvdata(pci_dev);
         struct fe_priv *np = netdev_priv(dev);
         u8 __iomem *base = get_hwbase(dev);
 
-        unregister_netdev(dev);
-
         /* special op: write back the misordered MAC address - otherwise
          * the next nv_probe would see a wrong address.
          */
@@ -5905,6 +5904,15 @@ static void __devexit nv_remove(struct pci_dev *pci_dev)
         writel(np->orig_mac[1], base + NvRegMacAddrB);
         writel(readl(base + NvRegTransmitPoll) & ~NVREG_TRANSMITPOLL_MAC_ADDR_REV,
                base + NvRegTransmitPoll);
+}
+
+static void __devexit nv_remove(struct pci_dev *pci_dev)
+{
+        struct net_device *dev = pci_get_drvdata(pci_dev);
+
+        unregister_netdev(dev);
+
+        nv_restore_mac_addr(pci_dev);
 
         /* restore any phy related changes */
         nv_restore_phy(dev);
@@ -5975,6 +5983,8 @@ static void nv_shutdown(struct pci_dev *pdev)
         if (netif_running(dev))
                 nv_close(dev);
 
+        nv_restore_mac_addr(pdev);
+
         pci_disable_device(pdev);
         if (system_state == SYSTEM_POWER_OFF) {
                 if (pci_enable_wake(pdev, PCI_D3cold, np->wolenabled))
diff --git a/drivers/net/hp-plus.c b/drivers/net/hp-plus.c
index 8239939554bc..fbbd3e660c27 100644
--- a/drivers/net/hp-plus.c
+++ b/drivers/net/hp-plus.c
@@ -139,7 +139,7 @@ static int __init do_hpp_probe(struct net_device *dev)
 #ifndef MODULE
 struct net_device * __init hp_plus_probe(int unit)
 {
-        struct net_device *dev = alloc_ei_netdev();
+        struct net_device *dev = alloc_eip_netdev();
         int err;
 
         if (!dev)
@@ -284,7 +284,7 @@ hpp_open(struct net_device *dev)
         int option_reg;
         int retval;
 
-        if ((retval = request_irq(dev->irq, ei_interrupt, 0, dev->name, dev))) {
+        if ((retval = request_irq(dev->irq, eip_interrupt, 0, dev->name, dev))) {
             return retval;
         }
 
@@ -302,7 +302,7 @@ hpp_open(struct net_device *dev)
         /* Select the operational page. */
         outw(Perf_Page, ioaddr + HP_PAGING);
 
-        ei_open(dev);
+        eip_open(dev);
         return 0;
 }
 
@@ -313,7 +313,7 @@ hpp_close(struct net_device *dev)
         int option_reg = inw(ioaddr + HPP_OPTION);
 
         free_irq(dev->irq, dev);
-        ei_close(dev);
+        eip_close(dev);
         outw((option_reg & ~EnableIRQ) | MemDisable | NICReset | ChipReset,
                  ioaddr + HPP_OPTION);
 
diff --git a/drivers/net/mlx4/mr.c b/drivers/net/mlx4/mr.c
index 62071d9c4a55..d1dd5b48dbd1 100644
--- a/drivers/net/mlx4/mr.c
+++ b/drivers/net/mlx4/mr.c
@@ -67,11 +67,10 @@ struct mlx4_mpt_entry {
 #define MLX4_MPT_FLAG_PHYSICAL      (1 <<  9)
 #define MLX4_MPT_FLAG_REGION        (1 <<  8)
 
-#define MLX4_MPT_PD_FLAG_FAST_REG   (1 << 26)
+#define MLX4_MPT_PD_FLAG_FAST_REG   (1 << 27)
+#define MLX4_MPT_PD_FLAG_RAE        (1 << 28)
 #define MLX4_MPT_PD_FLAG_EN_INV     (3 << 24)
 
-#define MLX4_MTT_FLAG_PRESENT           1
-
 #define MLX4_MPT_STATUS_SW              0xF0
 #define MLX4_MPT_STATUS_HW              0x00
 
@@ -348,7 +347,10 @@ int mlx4_mr_enable(struct mlx4_dev *dev, struct mlx4_mr *mr)
         if (mr->mtt.order >= 0 && mr->mtt.page_shift == 0) {
                 /* fast register MR in free state */
                 mpt_entry->flags    |= cpu_to_be32(MLX4_MPT_FLAG_FREE);
-                mpt_entry->pd_flags |= cpu_to_be32(MLX4_MPT_PD_FLAG_FAST_REG);
+                mpt_entry->pd_flags |= cpu_to_be32(MLX4_MPT_PD_FLAG_FAST_REG |
+                                                   MLX4_MPT_PD_FLAG_RAE);
+                mpt_entry->mtt_sz    = cpu_to_be32((1 << mr->mtt.order) *
+                                                   MLX4_MTT_ENTRY_PER_SEG);
         } else {
                 mpt_entry->flags    |= cpu_to_be32(MLX4_MPT_FLAG_SW_OWNS);
         }
diff --git a/drivers/net/niu.c b/drivers/net/niu.c
index e4765b713aba..e3be81eba8a4 100644
--- a/drivers/net/niu.c
+++ b/drivers/net/niu.c
@@ -5984,6 +5984,56 @@ static void niu_netif_start(struct niu *np)
         niu_enable_interrupts(np, 1);
 }
 
+static void niu_reset_buffers(struct niu *np)
+{
+        int i, j, k, err;
+
+        if (np->rx_rings) {
+                for (i = 0; i < np->num_rx_rings; i++) {
+                        struct rx_ring_info *rp = &np->rx_rings[i];
+
+                        for (j = 0, k = 0; j < MAX_RBR_RING_SIZE; j++) {
+                                struct page *page;
+
+                                page = rp->rxhash[j];
+                                while (page) {
+                                        struct page *next =
+                                                (struct page *) page->mapping;
+                                        u64 base = page->index;
+                                        base = base >> RBR_DESCR_ADDR_SHIFT;
+                                        rp->rbr[k++] = cpu_to_le32(base);
+                                        page = next;
+                                }
+                        }
+                        for (; k < MAX_RBR_RING_SIZE; k++) {
+                                err = niu_rbr_add_page(np, rp, GFP_ATOMIC, k);
+                                if (unlikely(err))
+                                        break;
+                        }
+
+                        rp->rbr_index = rp->rbr_table_size - 1;
+                        rp->rcr_index = 0;
+                        rp->rbr_pending = 0;
+                        rp->rbr_refill_pending = 0;
+                }
+        }
+        if (np->tx_rings) {
+                for (i = 0; i < np->num_tx_rings; i++) {
+                        struct tx_ring_info *rp = &np->tx_rings[i];
+
+                        for (j = 0; j < MAX_TX_RING_SIZE; j++) {
+                                if (rp->tx_buffs[j].skb)
+                                        (void) release_tx_packet(np, rp, j);
+                        }
+
+                        rp->pending = MAX_TX_RING_SIZE;
+                        rp->prod = 0;
+                        rp->cons = 0;
+                        rp->wrap_bit = 0;
+                }
+        }
+}
+
 static void niu_reset_task(struct work_struct *work)
 {
         struct niu *np = container_of(work, struct niu, reset_task);
@@ -6006,6 +6056,12 @@ static void niu_reset_task(struct work_struct *work)
 
         niu_stop_hw(np);
 
+        spin_unlock_irqrestore(&np->lock, flags);
+
+        niu_reset_buffers(np);
+
+        spin_lock_irqsave(&np->lock, flags);
+
         err = niu_init_hw(np);
         if (!err) {
                 np->timer.expires = jiffies + HZ;
diff --git a/drivers/net/wireless/ath9k/beacon.c b/drivers/net/wireless/ath9k/beacon.c
index caf569401a34..00a0eaa08866 100644
--- a/drivers/net/wireless/ath9k/beacon.c
+++ b/drivers/net/wireless/ath9k/beacon.c
@@ -209,6 +209,7 @@ static struct ath_buf *ath_beacon_generate(struct ath_softc *sc, int if_id)
         unsigned int curlen;
         struct ath_txq *cabq;
         struct ath_txq *mcastq;
+        struct ieee80211_tx_info *info;
         avp = sc->sc_vaps[if_id];
 
         mcastq = &avp->av_mcastq;
@@ -232,6 +233,18 @@ static struct ath_buf *ath_beacon_generate(struct ath_softc *sc, int if_id)
          */
         curlen = skb->len;
 
+        info = IEEE80211_SKB_CB(skb);
+        if (info->flags & IEEE80211_TX_CTL_ASSIGN_SEQ) {
+                /*
+                 * TODO: make sure the seq# gets assigned properly (vs. other
+                 * TX frames)
+                 */
+                struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
+                sc->seq_no += 0x10;
+                hdr->seq_ctrl &= cpu_to_le16(IEEE80211_SCTL_FRAG);
+                hdr->seq_ctrl |= cpu_to_le16(sc->seq_no);
+        }
+
         /* XXX: spin_lock_bh should not be used here, but sparse bitches
          * otherwise. We should fix sparse :) */
         spin_lock_bh(&mcastq->axq_lock);
diff --git a/drivers/net/wireless/ath9k/core.c b/drivers/net/wireless/ath9k/core.c
index f6c45288d0e7..87e37bc39145 100644
--- a/drivers/net/wireless/ath9k/core.c
+++ b/drivers/net/wireless/ath9k/core.c
@@ -294,8 +294,6 @@ static int ath_stop(struct ath_softc *sc)
          * hardware is gone (invalid).
          */
 
-        if (!sc->sc_invalid)
-                ath9k_hw_set_interrupts(ah, 0);
         ath_draintxq(sc, false);
         if (!sc->sc_invalid) {
                 ath_stoprecv(sc);
@@ -797,6 +795,12 @@ int ath_open(struct ath_softc *sc, struct ath9k_channel *initial_chan)
         if (ah->ah_caps.hw_caps & ATH9K_HW_CAP_HT)
                 sc->sc_imask |= ATH9K_INT_CST;
 
+        /* Note: We disable MIB interrupts for now as we don't yet
+         * handle processing ANI, otherwise you will get an interrupt
+         * storm after about 7 hours of usage making the system unusable
+         * with huge latency. Once we do have ANI processing included
+         * we can re-enable this interrupt. */
+#if 0
         /*
          * Enable MIB interrupts when there are hardware phy counters.
          * Note we only do this (at the moment) for station mode.
@@ -804,6 +808,7 @@ int ath_open(struct ath_softc *sc, struct ath9k_channel *initial_chan)
         if (ath9k_hw_phycounters(ah) &&
             ((sc->sc_opmode == ATH9K_M_STA) || (sc->sc_opmode == ATH9K_M_IBSS)))
                 sc->sc_imask |= ATH9K_INT_MIB;
+#endif
         /*
          * Some hardware processes the TIM IE and fires an
          * interrupt when the TIM bit is set.  For hardware
@@ -1336,6 +1341,8 @@ void ath_deinit(struct ath_softc *sc)
 
         DPRINTF(sc, ATH_DBG_CONFIG, "%s\n", __func__);
 
+        tasklet_kill(&sc->intr_tq);
+        tasklet_kill(&sc->bcon_tasklet);
         ath_stop(sc);
         if (!sc->sc_invalid)
                 ath9k_hw_setpower(sc->sc_ah, ATH9K_PM_AWAKE);
diff --git a/drivers/net/wireless/ath9k/core.h b/drivers/net/wireless/ath9k/core.h
index 673b3d81133a..2f84093331ee 100644
--- a/drivers/net/wireless/ath9k/core.h
+++ b/drivers/net/wireless/ath9k/core.h
@@ -974,7 +974,6 @@ struct ath_softc {
         u32 sc_keymax;          /* size of key cache */
         DECLARE_BITMAP(sc_keymap, ATH_KEYMAX);  /* key use bit map */
         u8 sc_splitmic;         /* split TKIP MIC keys */
-        int sc_keytype;
 
         /* RX */
         struct list_head sc_rxbuf;
@@ -992,6 +991,7 @@ struct ath_softc {
         u32 sc_txintrperiod;    /* tx interrupt batching */
         int sc_haltype2q[ATH9K_WME_AC_VO+1]; /* HAL WME AC -> h/w qnum */
         u32 sc_ant_tx[8];       /* recent tx frames/antenna */
+        u16 seq_no; /* TX sequence number */
 
         /* Beacon */
         struct ath9k_tx_queue_info sc_beacon_qi;
diff --git a/drivers/net/wireless/ath9k/main.c b/drivers/net/wireless/ath9k/main.c
index c5107f269f24..acebdf1d20a8 100644
--- a/drivers/net/wireless/ath9k/main.c
+++ b/drivers/net/wireless/ath9k/main.c
@@ -206,8 +206,6 @@ static int ath_key_config(struct ath_softc *sc,
         if (!ret)
                 return -EIO;
 
-        if (mac)
-                sc->sc_keytype = hk.kv_type;
         return 0;
 }
 
@@ -369,6 +367,20 @@ static int ath9k_tx(struct ieee80211_hw *hw,
 {
         struct ath_softc *sc = hw->priv;
         int hdrlen, padsize;
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+
+        /*
+         * As a temporary workaround, assign seq# here; this will likely need
+         * to be cleaned up to work better with Beacon transmission and virtual
+         * BSSes.
+         */
+        if (info->flags & IEEE80211_TX_CTL_ASSIGN_SEQ) {
+                struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
+                if (info->flags & IEEE80211_TX_CTL_FIRST_FRAGMENT)
+                        sc->seq_no += 0x10;
+                hdr->seq_ctrl &= cpu_to_le16(IEEE80211_SCTL_FRAG);
+                hdr->seq_ctrl |= cpu_to_le16(sc->seq_no);
+        }
 
         /* Add the padding after the header if this is not already done */
         hdrlen = ieee80211_get_hdrlen_from_skb(skb);
@@ -764,7 +776,6 @@ static int ath9k_set_key(struct ieee80211_hw *hw,
         case DISABLE_KEY:
                 ath_key_delete(sc, key);
                 clear_bit(key->keyidx, sc->sc_keymap);
-                sc->sc_keytype = ATH9K_CIPHER_CLR;
                 break;
         default:
                 ret = -EINVAL;
@@ -1400,10 +1411,17 @@ static void ath_pci_remove(struct pci_dev *pdev)
 {
         struct ieee80211_hw *hw = pci_get_drvdata(pdev);
         struct ath_softc *sc = hw->priv;
+        enum ath9k_int status;
 
-        if (pdev->irq)
+        if (pdev->irq) {
+                ath9k_hw_set_interrupts(sc->sc_ah, 0);
+                /* clear the ISR */
+                ath9k_hw_getisr(sc->sc_ah, &status);
+                sc->sc_invalid = 1;
                 free_irq(pdev->irq, sc);
+        }
         ath_detach(sc);
+
         pci_iounmap(pdev, sc->mem);
         pci_release_region(pdev, 0);
         pci_disable_device(pdev);
diff --git a/drivers/net/wireless/ath9k/xmit.c b/drivers/net/wireless/ath9k/xmit.c
index 550129f717e2..8b332e11a656 100644
--- a/drivers/net/wireless/ath9k/xmit.c
+++ b/drivers/net/wireless/ath9k/xmit.c
@@ -315,11 +315,11 @@ static int ath_tx_prepare(struct ath_softc *sc,
                 txctl->keyix = tx_info->control.hw_key->hw_key_idx;
                 txctl->frmlen += tx_info->control.icv_len;
 
-                if (sc->sc_keytype == ATH9K_CIPHER_WEP)
+                if (tx_info->control.hw_key->alg == ALG_WEP)
                         txctl->keytype = ATH9K_KEY_TYPE_WEP;
-                else if (sc->sc_keytype == ATH9K_CIPHER_TKIP)
+                else if (tx_info->control.hw_key->alg == ALG_TKIP)
                         txctl->keytype = ATH9K_KEY_TYPE_TKIP;
-                else if (sc->sc_keytype == ATH9K_CIPHER_AES_CCM)
+                else if (tx_info->control.hw_key->alg == ALG_CCMP)
                         txctl->keytype = ATH9K_KEY_TYPE_AES;
         }
 
diff --git a/drivers/net/wireless/b43/rfkill.c b/drivers/net/wireless/b43/rfkill.c
index fec5645944a4..34ae125d5384 100644
--- a/drivers/net/wireless/b43/rfkill.c
+++ b/drivers/net/wireless/b43/rfkill.c
@@ -43,23 +43,6 @@ static bool b43_is_hw_radio_enabled(struct b43_wldev *dev)
         return 0;
 }
 
-/* Update the rfkill state */
-static void b43_rfkill_update_state(struct b43_wldev *dev)
-{
-        struct b43_rfkill *rfk = &(dev->wl->rfkill);
-
-        if (!dev->radio_hw_enable) {
-                rfk->rfkill->state = RFKILL_STATE_HARD_BLOCKED;
-                return;
-        }
-
-        if (!dev->phy.radio_on)
-                rfk->rfkill->state = RFKILL_STATE_SOFT_BLOCKED;
-        else
-                rfk->rfkill->state = RFKILL_STATE_UNBLOCKED;
-
-}
-
 /* The poll callback for the hardware button. */
 static void b43_rfkill_poll(struct input_polled_dev *poll_dev)
 {
@@ -77,7 +60,6 @@ static void b43_rfkill_poll(struct input_polled_dev *poll_dev)
         if (unlikely(enabled != dev->radio_hw_enable)) {
                 dev->radio_hw_enable = enabled;
                 report_change = 1;
-                b43_rfkill_update_state(dev);
                 b43info(wl, "Radio hardware status changed to %s\n",
                         enabled ? "ENABLED" : "DISABLED");
         }
diff --git a/drivers/net/wireless/b43legacy/rfkill.c b/drivers/net/wireless/b43legacy/rfkill.c
index 476add97e974..b32bf6a94f19 100644
--- a/drivers/net/wireless/b43legacy/rfkill.c
+++ b/drivers/net/wireless/b43legacy/rfkill.c
@@ -44,23 +44,6 @@ static bool b43legacy_is_hw_radio_enabled(struct b43legacy_wldev *dev)
         return 0;
 }
 
-/* Update the rfkill state */
-static void b43legacy_rfkill_update_state(struct b43legacy_wldev *dev)
-{
-        struct b43legacy_rfkill *rfk = &(dev->wl->rfkill);
-
-        if (!dev->radio_hw_enable) {
-                rfk->rfkill->state = RFKILL_STATE_HARD_BLOCKED;
-                return;
-        }
-
-        if (!dev->phy.radio_on)
-                rfk->rfkill->state = RFKILL_STATE_SOFT_BLOCKED;
-        else
-                rfk->rfkill->state = RFKILL_STATE_UNBLOCKED;
-
-}
-
 /* The poll callback for the hardware button. */
 static void b43legacy_rfkill_poll(struct input_polled_dev *poll_dev)
 {
@@ -78,7 +61,6 @@ static void b43legacy_rfkill_poll(struct input_polled_dev *poll_dev)
         if (unlikely(enabled != dev->radio_hw_enable)) {
                 dev->radio_hw_enable = enabled;
                 report_change = 1;
-                b43legacy_rfkill_update_state(dev);
                 b43legacyinfo(wl, "Radio hardware status changed to %s\n",
                         enabled ? "ENABLED" : "DISABLED");
         }
diff --git a/drivers/net/wireless/zd1211rw/zd_usb.c b/drivers/net/wireless/zd1211rw/zd_usb.c
index da8b7433e3a6..a60ae86bd5c9 100644
--- a/drivers/net/wireless/zd1211rw/zd_usb.c
+++ b/drivers/net/wireless/zd1211rw/zd_usb.c
@@ -58,6 +58,7 @@ static struct usb_device_id usb_ids[] = {
         { USB_DEVICE(0x0586, 0x3407), .driver_info = DEVICE_ZD1211 },
         { USB_DEVICE(0x129b, 0x1666), .driver_info = DEVICE_ZD1211 },
         { USB_DEVICE(0x157e, 0x300a), .driver_info = DEVICE_ZD1211 },
+        { USB_DEVICE(0x0105, 0x145f), .driver_info = DEVICE_ZD1211 },
         /* ZD1211B */
         { USB_DEVICE(0x0ace, 0x1215), .driver_info = DEVICE_ZD1211B },
         { USB_DEVICE(0x157e, 0x300d), .driver_info = DEVICE_ZD1211B },