32 files changed, 241 insertions, 172 deletions
diff --git a/drivers/net/3c59x.c b/drivers/net/3c59x.c
index c685a55fc2f4..fa42103b2874 100644
--- a/drivers/net/3c59x.c
+++ b/drivers/net/3c59x.c
@@ -635,6 +635,9 @@ struct vortex_private {
                must_free_region:1,                             /* Flag: if zero, Cardbus owns the I/O region */
                large_frames:1,                 /* accept large frames */
                handling_irq:1;                 /* private in_irq indicator */
+        /* {get|set}_wol operations are already serialized by rtnl.
+         * no additional locking is required for the enable_wol and acpi_set_WOL()
+         */
        int drv_flags;
        u16 status_enable;
        u16 intr_enable;
@@ -647,7 +650,7 @@ struct vortex_private {
        u16 io_size;                                            /* Size of PCI region (for release_region) */
        /* Serialises access to hardware other than MII and variables below.
-         * The lock hierarchy is rtnl_lock > lock > mii_lock > window_lock. */
+         * The lock hierarchy is rtnl_lock > {lock, mii_lock} > window_lock. */
        spinlock_t lock;
        spinlock_t mii_lock;            /* Serialises access to MII */
@@ -1994,10 +1997,9 @@ vortex_error(struct net_device *dev, int status)
                }
        }
-        if (status & RxEarly) {                         /* Rx early is unused. */
+        if (status & RxEarly)                           /* Rx early is unused. */
-                vortex_rx(dev);
                iowrite16(AckIntr | RxEarly, ioaddr + EL3_CMD);
-        }
        if (status & StatsFull) {                       /* Empty statistics. */
                static int DoneDidThat;
                if (vortex_debug > 4)
@@ -2298,7 +2300,12 @@ vortex_interrupt(int irq, void *dev_id)
                if (status & (HostError | RxEarly | StatsFull | TxComplete | IntReq)) {
                        if (status == 0xffff)
                                break;
+                        if (status & RxEarly)
+                                vortex_rx(dev);
+                        spin_unlock(&vp->window_lock);
                        vortex_error(dev, status);
+                        spin_lock(&vp->window_lock);
+                        window_set(vp, 7);
                }
                if (--work_done < 0) {
@@ -2935,13 +2942,11 @@ static void vortex_get_wol(struct net_device *dev, struct ethtool_wolinfo *wol)
 {
        struct vortex_private *vp = netdev_priv(dev);
-        spin_lock_irq(&vp->lock);
        wol->supported = WAKE_MAGIC;
        wol->wolopts = 0;
        if (vp->enable_wol)
                wol->wolopts |= WAKE_MAGIC;
-        spin_unlock_irq(&vp->lock);
 }
 static int vortex_set_wol(struct net_device *dev, struct ethtool_wolinfo *wol)
@@ -2950,13 +2955,11 @@ static int vortex_set_wol(struct net_device *dev, struct ethtool_wolinfo *wol)
        if (wol->wolopts & ~WAKE_MAGIC)
                return -EINVAL;
-        spin_lock_irq(&vp->lock);
        if (wol->wolopts & WAKE_MAGIC)
                vp->enable_wol = 1;
        else
                vp->enable_wol = 0;
        acpi_set_WOL(dev);
-        spin_unlock_irq(&vp->lock);
        return 0;
 }
@@ -2984,7 +2987,6 @@ static int vortex_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
 {
        int err;
        struct vortex_private *vp = netdev_priv(dev);
-        unsigned long flags;
        pci_power_t state = 0;
        if(VORTEX_PCI(vp))
@@ -2994,9 +2996,7 @@ static int vortex_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
        if(state != 0)
                pci_set_power_state(VORTEX_PCI(vp), PCI_D0);
-        spin_lock_irqsave(&vp->lock, flags);
        err = generic_mii_ioctl(&vp->mii, if_mii(rq), cmd, NULL);
-        spin_unlock_irqrestore(&vp->lock, flags);
        if(state != 0)
                pci_set_power_state(VORTEX_PCI(vp), state);
diff --git a/drivers/net/b44.c b/drivers/net/b44.c
index 37617abc1647..1e620e287ae0 100644
--- a/drivers/net/b44.c
+++ b/drivers/net/b44.c
@@ -848,6 +848,15 @@ static int b44_poll(struct napi_struct *napi, int budget)
                b44_tx(bp);
                /* spin_unlock(&bp->tx_lock); */
        }
+        if (bp->istat & ISTAT_RFO) {    /* fast recovery, in ~20msec */
+                bp->istat &= ~ISTAT_RFO;
+                b44_disable_ints(bp);
+                ssb_device_enable(bp->sdev, 0); /* resets ISTAT_RFO */
+                b44_init_rings(bp);
+                b44_init_hw(bp, B44_FULL_RESET_SKIP_PHY);
+                netif_wake_queue(bp->dev);
+        }
        spin_unlock_irqrestore(&bp->lock, flags);
        work_done = 0;
diff --git a/drivers/net/benet/be.h b/drivers/net/benet/be.h
index 99197bd54da5..53306bf3f401 100644
--- a/drivers/net/benet/be.h
+++ b/drivers/net/benet/be.h
@@ -181,6 +181,7 @@ struct be_drvr_stats {
        u64 be_rx_bytes_prev;
        u64 be_rx_pkts;
        u32 be_rx_rate;
+        u32 be_rx_mcast_pkt;
        /* number of non ether type II frames dropped where
         * frame len > length field of Mac Hdr */
        u32 be_802_3_dropped_frames;
diff --git a/drivers/net/benet/be_cmds.c b/drivers/net/benet/be_cmds.c
index 3d305494a606..34abcc9403d6 100644
--- a/drivers/net/benet/be_cmds.c
+++ b/drivers/net/benet/be_cmds.c
@@ -140,10 +140,8 @@ int be_process_mcc(struct be_adapter *adapter, int *status)
        while ((compl = be_mcc_compl_get(adapter))) {
                if (compl->flags & CQE_FLAGS_ASYNC_MASK) {
                        /* Interpret flags as an async trailer */
-                        BUG_ON(!is_link_state_evt(compl->flags));
+                        if (is_link_state_evt(compl->flags))
+                                be_async_link_state_process(adapter,
-                        /* Interpret compl as a async link evt */
-                        be_async_link_state_process(adapter,
                                (struct be_async_event_link_state *) compl);
                } else if (compl->flags & CQE_FLAGS_COMPLETED_MASK) {
                                *status = be_mcc_compl_process(adapter, compl);
@@ -207,7 +205,7 @@ static int be_mbox_db_ready_wait(struct be_adapter *adapter, void __iomem *db)
                if (msecs > 4000) {
                        dev_err(&adapter->pdev->dev, "mbox poll timed out\n");
-                        be_dump_ue(adapter);
+                        be_detect_dump_ue(adapter);
                        return -1;
                }
diff --git a/drivers/net/benet/be_cmds.h b/drivers/net/benet/be_cmds.h
index bdc10a28cfda..ad1e6fac60c5 100644
--- a/drivers/net/benet/be_cmds.h
+++ b/drivers/net/benet/be_cmds.h
@@ -992,5 +992,5 @@ extern int be_cmd_set_loopback(struct be_adapter *adapter, u8 port_num,
 extern int be_cmd_get_phy_info(struct be_adapter *adapter,
                struct be_dma_mem *cmd);
 extern int be_cmd_set_qos(struct be_adapter *adapter, u32 bps, u32 domain);
-extern void be_dump_ue(struct be_adapter *adapter);
+extern void be_detect_dump_ue(struct be_adapter *adapter);
diff --git a/drivers/net/benet/be_ethtool.c b/drivers/net/benet/be_ethtool.c
index cd16243c7c36..13f0abbc5205 100644
--- a/drivers/net/benet/be_ethtool.c
+++ b/drivers/net/benet/be_ethtool.c
@@ -60,6 +60,7 @@ static const struct be_ethtool_stat et_stats[] = {
        {DRVSTAT_INFO(be_rx_events)},
        {DRVSTAT_INFO(be_tx_compl)},
        {DRVSTAT_INFO(be_rx_compl)},
+        {DRVSTAT_INFO(be_rx_mcast_pkt)},
        {DRVSTAT_INFO(be_ethrx_post_fail)},
        {DRVSTAT_INFO(be_802_3_dropped_frames)},
        {DRVSTAT_INFO(be_802_3_malformed_frames)},
diff --git a/drivers/net/benet/be_hw.h b/drivers/net/benet/be_hw.h
index 5d38046402b2..a2ec5df0d733 100644
--- a/drivers/net/benet/be_hw.h
+++ b/drivers/net/benet/be_hw.h
@@ -167,8 +167,11 @@
 #define FLASH_FCoE_BIOS_START_g3           (13631488)
 #define FLASH_REDBOOT_START_g3             (262144)
+/************* Rx Packet Type Encoding **************/
+#define BE_UNICAST_PACKET               0
+#define BE_MULTICAST_PACKET             1
+#define BE_BROADCAST_PACKET             2
+#define BE_RSVD_PACKET                  3
 /*
 * BE descriptors: host memory data structures whose formats
diff --git a/drivers/net/benet/be_main.c b/drivers/net/benet/be_main.c
index 74e146f470c6..6eda7a022256 100644
--- a/drivers/net/benet/be_main.c
+++ b/drivers/net/benet/be_main.c
@@ -247,6 +247,7 @@ void netdev_stats_update(struct be_adapter *adapter)
        dev_stats->tx_packets = drvr_stats(adapter)->be_tx_pkts;
        dev_stats->rx_bytes = drvr_stats(adapter)->be_rx_bytes;
        dev_stats->tx_bytes = drvr_stats(adapter)->be_tx_bytes;
+        dev_stats->multicast = drvr_stats(adapter)->be_rx_mcast_pkt;
        /* bad pkts received */
        dev_stats->rx_errors = port_stats->rx_crc_errors +
@@ -294,7 +295,6 @@ void netdev_stats_update(struct be_adapter *adapter)
        /* no space available in linux */
        dev_stats->tx_dropped = 0;
-        dev_stats->multicast = port_stats->rx_multicast_frames;
        dev_stats->collisions = 0;
        /* detailed tx_errors */
@@ -848,7 +848,7 @@ static void be_rx_rate_update(struct be_adapter *adapter)
 }
 static void be_rx_stats_update(struct be_adapter *adapter,
-                u32 pktsize, u16 numfrags)
+                u32 pktsize, u16 numfrags, u8 pkt_type)
 {
        struct be_drvr_stats *stats = drvr_stats(adapter);
@@ -856,6 +856,9 @@ static void be_rx_stats_update(struct be_adapter *adapter,
        stats->be_rx_frags += numfrags;
        stats->be_rx_bytes += pktsize;
        stats->be_rx_pkts++;
+        if (pkt_type == BE_MULTICAST_PACKET)
+                stats->be_rx_mcast_pkt++;
 }
 static inline bool do_pkt_csum(struct be_eth_rx_compl *rxcp, bool cso)
@@ -925,9 +928,11 @@ static void skb_fill_rx_data(struct be_adapter *adapter,
        u16 rxq_idx, i, j;
        u32 pktsize, hdr_len, curr_frag_len, size;
        u8 *start;
+        u8 pkt_type;
        rxq_idx = AMAP_GET_BITS(struct amap_eth_rx_compl, fragndx, rxcp);
        pktsize = AMAP_GET_BITS(struct amap_eth_rx_compl, pktsize, rxcp);
+        pkt_type = AMAP_GET_BITS(struct amap_eth_rx_compl, cast_enc, rxcp);
        page_info = get_rx_page_info(adapter, rxq_idx);
@@ -993,7 +998,7 @@ static void skb_fill_rx_data(struct be_adapter *adapter,
        BUG_ON(j > MAX_SKB_FRAGS);
 done:
-        be_rx_stats_update(adapter, pktsize, num_rcvd);
+        be_rx_stats_update(adapter, pktsize, num_rcvd, pkt_type);
 }
 /* Process the RX completion indicated by rxcp when GRO is disabled */
@@ -1060,6 +1065,7 @@ static void be_rx_compl_process_gro(struct be_adapter *adapter,
        u32 num_rcvd, pkt_size, remaining, vlanf, curr_frag_len;
        u16 i, rxq_idx = 0, vid, j;
        u8 vtm;
+        u8 pkt_type;
        num_rcvd = AMAP_GET_BITS(struct amap_eth_rx_compl, numfrags, rxcp);
        /* Is it a flush compl that has no data */
@@ -1070,6 +1076,7 @@ static void be_rx_compl_process_gro(struct be_adapter *adapter,
        vlanf = AMAP_GET_BITS(struct amap_eth_rx_compl, vtp, rxcp);
        rxq_idx = AMAP_GET_BITS(struct amap_eth_rx_compl, fragndx, rxcp);
        vtm = AMAP_GET_BITS(struct amap_eth_rx_compl, vtm, rxcp);
+        pkt_type = AMAP_GET_BITS(struct amap_eth_rx_compl, cast_enc, rxcp);
        /* vlanf could be wrongly set in some cards.
         * ignore if vtm is not set */
@@ -1125,7 +1132,7 @@ static void be_rx_compl_process_gro(struct be_adapter *adapter,
                vlan_gro_frags(&eq_obj->napi, adapter->vlan_grp, vid);
        }
-        be_rx_stats_update(adapter, pkt_size, num_rcvd);
+        be_rx_stats_update(adapter, pkt_size, num_rcvd, pkt_type);
 }
 static struct be_eth_rx_compl *be_rx_compl_get(struct be_adapter *adapter)
@@ -1743,26 +1750,7 @@ static int be_poll_tx_mcc(struct napi_struct *napi, int budget)
        return 1;
 }
-static inline bool be_detect_ue(struct be_adapter *adapter)
+void be_detect_dump_ue(struct be_adapter *adapter)
-{
-        u32 online0 = 0, online1 = 0;
-        pci_read_config_dword(adapter->pdev, PCICFG_ONLINE0, &online0);
-        pci_read_config_dword(adapter->pdev, PCICFG_ONLINE1, &online1);
-        if (!online0 || !online1) {
-                adapter->ue_detected = true;
-                dev_err(&adapter->pdev->dev,
-                        "UE Detected!! online0=%d online1=%d\n",
-                        online0, online1);
-                return true;
-        }
-        return false;
-}
-void be_dump_ue(struct be_adapter *adapter)
 {
        u32 ue_status_lo, ue_status_hi, ue_status_lo_mask, ue_status_hi_mask;
        u32 i;
@@ -1779,6 +1767,11 @@ void be_dump_ue(struct be_adapter *adapter)
        ue_status_lo = (ue_status_lo & (~ue_status_lo_mask));
        ue_status_hi = (ue_status_hi & (~ue_status_hi_mask));
+        if (ue_status_lo || ue_status_hi) {
+                adapter->ue_detected = true;
+                dev_err(&adapter->pdev->dev, "UE Detected!!\n");
+        }
        if (ue_status_lo) {
                for (i = 0; ue_status_lo; ue_status_lo >>= 1, i++) {
                        if (ue_status_lo & 1)
@@ -1814,10 +1807,8 @@ static void be_worker(struct work_struct *work)
                adapter->rx_post_starved = false;
                be_post_rx_frags(adapter);
        }
-        if (!adapter->ue_detected) {
+        if (!adapter->ue_detected)
-                if (be_detect_ue(adapter))
+                be_detect_dump_ue(adapter);
-                        be_dump_ue(adapter);
-        }
        schedule_delayed_work(&adapter->work, msecs_to_jiffies(1000));
 }
diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c
index 822f586d72af..0ddf4c66afe2 100644
--- a/drivers/net/bonding/bond_3ad.c
+++ b/drivers/net/bonding/bond_3ad.c
@@ -2466,6 +2466,9 @@ int bond_3ad_lacpdu_recv(struct sk_buff *skb, struct net_device *dev, struct pac
        if (!(dev->flags & IFF_MASTER))
                goto out;
+        if (!pskb_may_pull(skb, sizeof(struct lacpdu)))
+                goto out;
        read_lock(&bond->lock);
        slave = bond_get_slave_by_dev((struct bonding *)netdev_priv(dev),
                                        orig_dev);
diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c
index c746b331771d..26bb118c4533 100644
--- a/drivers/net/bonding/bond_alb.c
+++ b/drivers/net/bonding/bond_alb.c
@@ -362,6 +362,9 @@ static int rlb_arp_recv(struct sk_buff *skb, struct net_device *bond_dev, struct
                goto out;
        }
+        if (!pskb_may_pull(skb, arp_hdr_len(bond_dev)))
+                goto out;
        if (skb->len < sizeof(struct arp_pkt)) {
                pr_debug("Packet is too small to be an ARP\n");
                goto out;
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 2cc4cfc31892..3b16f62d5606 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -2797,9 +2797,15 @@ void bond_loadbalance_arp_mon(struct work_struct *work)
         *       so it can wait
         */
        bond_for_each_slave(bond, slave, i) {
+                unsigned long trans_start = dev_trans_start(slave->dev);
                if (slave->link != BOND_LINK_UP) {
-                        if (time_before_eq(jiffies, dev_trans_start(slave->dev) + delta_in_ticks) &&
+                        if (time_in_range(jiffies,
-                            time_before_eq(jiffies, slave->dev->last_rx + delta_in_ticks)) {
+                                trans_start - delta_in_ticks,
+                                trans_start + delta_in_ticks) &&
+                            time_in_range(jiffies,
+                                slave->dev->last_rx - delta_in_ticks,
+                                slave->dev->last_rx + delta_in_ticks)) {
                                slave->link  = BOND_LINK_UP;
                                slave->state = BOND_STATE_ACTIVE;
@@ -2827,8 +2833,12 @@ void bond_loadbalance_arp_mon(struct work_struct *work)
                         * when the source ip is 0, so don't take the link down
                         * if we don't know our ip yet
                         */
-                        if (time_after_eq(jiffies, dev_trans_start(slave->dev) + 2*delta_in_ticks) ||
+                        if (!time_in_range(jiffies,
-                            (time_after_eq(jiffies, slave->dev->last_rx + 2*delta_in_ticks))) {
+                                trans_start - delta_in_ticks,
+                                trans_start + 2 * delta_in_ticks) ||
+                            !time_in_range(jiffies,
+                                slave->dev->last_rx - delta_in_ticks,
+                                slave->dev->last_rx + 2 * delta_in_ticks)) {
                                slave->link  = BOND_LINK_DOWN;
                                slave->state = BOND_STATE_BACKUP;
@@ -2883,13 +2893,16 @@ static int bond_ab_arp_inspect(struct bonding *bond, int delta_in_ticks)
 {
        struct slave *slave;
        int i, commit = 0;
+        unsigned long trans_start;
        bond_for_each_slave(bond, slave, i) {
                slave->new_link = BOND_LINK_NOCHANGE;
                if (slave->link != BOND_LINK_UP) {
-                        if (time_before_eq(jiffies, slave_last_rx(bond, slave) +
+                        if (time_in_range(jiffies,
-                                           delta_in_ticks)) {
+                                slave_last_rx(bond, slave) - delta_in_ticks,
+                                slave_last_rx(bond, slave) + delta_in_ticks)) {
                                slave->new_link = BOND_LINK_UP;
                                commit++;
                        }
@@ -2902,8 +2915,9 @@ static int bond_ab_arp_inspect(struct bonding *bond, int delta_in_ticks)
                 * active.  This avoids bouncing, as the last receive
                 * times need a full ARP monitor cycle to be updated.
                 */
-                if (!time_after_eq(jiffies, slave->jiffies +
+                if (time_in_range(jiffies,
-                                   2 * delta_in_ticks))
+                                  slave->jiffies - delta_in_ticks,
+                                  slave->jiffies + 2 * delta_in_ticks))
                        continue;
                /*
@@ -2921,8 +2935,10 @@ static int bond_ab_arp_inspect(struct bonding *bond, int delta_in_ticks)
                 */
                if (slave->state == BOND_STATE_BACKUP &&
                    !bond->current_arp_slave &&
-                    time_after(jiffies, slave_last_rx(bond, slave) +
+                    !time_in_range(jiffies,
-                               3 * delta_in_ticks)) {
+                        slave_last_rx(bond, slave) - delta_in_ticks,
+                        slave_last_rx(bond, slave) + 3 * delta_in_ticks)) {
                        slave->new_link = BOND_LINK_DOWN;
                        commit++;
                }
@@ -2933,11 +2949,15 @@ static int bond_ab_arp_inspect(struct bonding *bond, int delta_in_ticks)
                 * - (more than 2*delta since receive AND
                 *    the bond has an IP address)
                 */
+                trans_start = dev_trans_start(slave->dev);
                if ((slave->state == BOND_STATE_ACTIVE) &&
-                    (time_after_eq(jiffies, dev_trans_start(slave->dev) +
+                    (!time_in_range(jiffies,
-                                    2 * delta_in_ticks) ||
+                        trans_start - delta_in_ticks,
-                      (time_after_eq(jiffies, slave_last_rx(bond, slave)
+                        trans_start + 2 * delta_in_ticks) ||
-                                     + 2 * delta_in_ticks)))) {
+                     !time_in_range(jiffies,
+                        slave_last_rx(bond, slave) - delta_in_ticks,
+                        slave_last_rx(bond, slave) + 2 * delta_in_ticks))) {
                        slave->new_link = BOND_LINK_DOWN;
                        commit++;
                }
@@ -2956,6 +2976,7 @@ static void bond_ab_arp_commit(struct bonding *bond, int delta_in_ticks)
 {
        struct slave *slave;
        int i;
+        unsigned long trans_start;
        bond_for_each_slave(bond, slave, i) {
                switch (slave->new_link) {
@@ -2963,10 +2984,11 @@ static void bond_ab_arp_commit(struct bonding *bond, int delta_in_ticks)
                        continue;
                case BOND_LINK_UP:
+                        trans_start = dev_trans_start(slave->dev);
                        if ((!bond->curr_active_slave &&
-                             time_before_eq(jiffies,
+                             time_in_range(jiffies,
-                                            dev_trans_start(slave->dev) +
+                                           trans_start - delta_in_ticks,
-                                            delta_in_ticks)) ||
+                                           trans_start + delta_in_ticks)) ||
                            bond->curr_active_slave != slave) {
                                slave->link = BOND_LINK_UP;
                                bond->current_arp_slave = NULL;
diff --git a/drivers/net/cxgb3/cxgb3_main.c b/drivers/net/cxgb3/cxgb3_main.c
index ad19585d960b..f208712c0b90 100644
--- a/drivers/net/cxgb3/cxgb3_main.c
+++ b/drivers/net/cxgb3/cxgb3_main.c
@@ -2296,6 +2296,8 @@ static int cxgb_extension_ioctl(struct net_device *dev, void __user *useraddr)
        case CHELSIO_GET_QSET_NUM:{
                struct ch_reg edata;
+                memset(&edata, 0, sizeof(struct ch_reg));
                edata.cmd = CHELSIO_GET_QSET_NUM;
                edata.val = pi->nqsets;
                if (copy_to_user(useraddr, &edata, sizeof(edata)))
diff --git a/drivers/net/eql.c b/drivers/net/eql.c
index dda2c7944da9..0cb1cf9cf4b0 100644
--- a/drivers/net/eql.c
+++ b/drivers/net/eql.c
@@ -555,6 +555,8 @@ static int eql_g_master_cfg(struct net_device *dev, master_config_t __user *mcp)
        equalizer_t *eql;
        master_config_t mc;
+        memset(&mc, 0, sizeof(master_config_t));
        if (eql_is_master(dev)) {
                eql = netdev_priv(dev);
                mc.max_slaves = eql->max_slaves;
diff --git a/drivers/net/ks8851.c b/drivers/net/ks8851.c
index b4fb07a6f13f..51919fcd50c2 100644
--- a/drivers/net/ks8851.c
+++ b/drivers/net/ks8851.c
@@ -503,30 +503,33 @@ static void ks8851_rx_pkts(struct ks8851_net *ks)
                ks8851_wrreg16(ks, KS_RXQCR,
                               ks->rc_rxqcr | RXQCR_SDA | RXQCR_ADRFE);
-                if (rxlen > 0) {
+                if (rxlen > 4) {
-                        skb = netdev_alloc_skb(ks->netdev, rxlen + 2 + 8);
+                        unsigned int rxalign;
-                        if (!skb) {
-                                /* todo - dump frame and move on */
+                        rxlen -= 4;
-                        }
+                        rxalign = ALIGN(rxlen, 4);
+                        skb = netdev_alloc_skb_ip_align(ks->netdev, rxalign);
+                        if (skb) {
-                        /* two bytes to ensure ip is aligned, and four bytes
+                                /* 4 bytes of status header + 4 bytes of
-                         * for the status header and 4 bytes of garbage */
+                                 * garbage: we put them before ethernet
-                        skb_reserve(skb, 2 + 4 + 4);
+                                 * header, so that they are copied,
+                                 * but ignored.
+                                 */
-                        rxpkt = skb_put(skb, rxlen - 4) - 8;
+                                rxpkt = skb_put(skb, rxlen) - 8;
-                        /* align the packet length to 4 bytes, and add 4 bytes
+                                ks8851_rdfifo(ks, rxpkt, rxalign + 8);
-                         * as we're getting the rx status header as well */
-                        ks8851_rdfifo(ks, rxpkt, ALIGN(rxlen, 4) + 8);
-                        if (netif_msg_pktdata(ks))
+                                if (netif_msg_pktdata(ks))
-                                ks8851_dbg_dumpkkt(ks, rxpkt);
+                                        ks8851_dbg_dumpkkt(ks, rxpkt);
-                        skb->protocol = eth_type_trans(skb, ks->netdev);
+                                skb->protocol = eth_type_trans(skb, ks->netdev);
-                        netif_rx(skb);
+                                netif_rx(skb);
-                        ks->netdev->stats.rx_packets++;
+                                ks->netdev->stats.rx_packets++;
-                        ks->netdev->stats.rx_bytes += rxlen - 4;
+                                ks->netdev->stats.rx_bytes += rxlen;
+                        }
                }
                ks8851_wrreg16(ks, KS_RXQCR, ks->rc_rxqcr);
diff --git a/drivers/net/ll_temac_main.c b/drivers/net/ll_temac_main.c
index bdf2149e5296..87f0a93b165c 100644
--- a/drivers/net/ll_temac_main.c
+++ b/drivers/net/ll_temac_main.c
@@ -38,6 +38,7 @@
 #include <linux/of_device.h>
 #include <linux/of_mdio.h>
 #include <linux/of_platform.h>
+#include <linux/of_address.h>
 #include <linux/skbuff.h>
 #include <linux/spinlock.h>
 #include <linux/tcp.h>      /* needed for sizeof(tcphdr) */
diff --git a/drivers/net/ll_temac_mdio.c b/drivers/net/ll_temac_mdio.c
index 5ae28c975b38..8cf9d4f56bb2 100644
--- a/drivers/net/ll_temac_mdio.c
+++ b/drivers/net/ll_temac_mdio.c
@@ -10,6 +10,7 @@
 #include <linux/phy.h>
 #include <linux/of.h>
 #include <linux/of_device.h>
+#include <linux/of_address.h>
 #include <linux/slab.h>
 #include <linux/of_mdio.h>
diff --git a/drivers/net/niu.c b/drivers/net/niu.c
index bc695d53cdcc..fe6983af6918 100644
--- a/drivers/net/niu.c
+++ b/drivers/net/niu.c
@@ -7269,32 +7269,28 @@ static int niu_get_ethtool_tcam_all(struct niu *np,
        struct niu_parent *parent = np->parent;
        struct niu_tcam_entry *tp;
        int i, idx, cnt;
-        u16 n_entries;
        unsigned long flags;
+        int ret = 0;
        /* put the tcam size here */
        nfc->data = tcam_get_size(np);
        niu_lock_parent(np, flags);
-        n_entries = nfc->rule_cnt;
        for (cnt = 0, i = 0; i < nfc->data; i++) {
                idx = tcam_get_index(np, i);
                tp = &parent->tcam[idx];
                if (!tp->valid)
                        continue;
+                if (cnt == nfc->rule_cnt) {
+                        ret = -EMSGSIZE;
+                        break;
+                }
                rule_locs[cnt] = i;
                cnt++;
        }
        niu_unlock_parent(np, flags);
-        if (n_entries != cnt) {
+        return ret;
-                /* print warning, this should not happen */
-                netdev_info(np->dev, "niu%d: In %s(): n_entries[%d] != cnt[%d]!!!\n",
-                            np->parent->index, __func__, n_entries, cnt);
-        }
-        return 0;
 }
 static int niu_get_nfc(struct net_device *dev, struct ethtool_rxnfc *cmd,
diff --git a/drivers/net/pcmcia/pcnet_cs.c b/drivers/net/pcmcia/pcnet_cs.c
index c3edfe4c2651..f9b509a6b09a 100644
--- a/drivers/net/pcmcia/pcnet_cs.c
+++ b/drivers/net/pcmcia/pcnet_cs.c
@@ -508,7 +508,8 @@ static int pcnet_confcheck(struct pcmcia_device *p_dev,
                           unsigned int vcc,
                           void *priv_data)
 {
-        int *has_shmem = priv_data;
+        int *priv = priv_data;
+        int try = (*priv & 0x1);
        int i;
        cistpl_io_t *io = &cfg->io;
@@ -525,77 +526,103 @@ static int pcnet_confcheck(struct pcmcia_device *p_dev,
                i = p_dev->resource[1]->end = 0;
        }
-        *has_shmem = ((cfg->mem.nwin == 1) &&
+        *priv &= ((cfg->mem.nwin == 1) &&
-                      (cfg->mem.win[0].len >= 0x4000));
+                  (cfg->mem.win[0].len >= 0x4000)) ? 0x10 : ~0x10;
        p_dev->resource[0]->start = io->win[i].base;
        p_dev->resource[0]->end = io->win[i].len;
-        p_dev->io_lines = io->flags & CISTPL_IO_LINES_MASK;
+        if (!try)
+                p_dev->io_lines = io->flags & CISTPL_IO_LINES_MASK;
+        else
+                p_dev->io_lines = 16;
        if (p_dev->resource[0]->end + p_dev->resource[1]->end >= 32)
                return try_io_port(p_dev);
-        return 0;
+        return -EINVAL;
+}
+static hw_info_t *pcnet_try_config(struct pcmcia_device *link,
+                                   int *has_shmem, int try)
+{
+        struct net_device *dev = link->priv;
+        hw_info_t *local_hw_info;
+        pcnet_dev_t *info = PRIV(dev);
+        int priv = try;
+        int ret;
+        ret = pcmcia_loop_config(link, pcnet_confcheck, &priv);
+        if (ret) {
+                dev_warn(&link->dev, "no useable port range found\n");
+                return NULL;
+        }
+        *has_shmem = (priv & 0x10);
+        if (!link->irq)
+                return NULL;
+        if (resource_size(link->resource[1]) == 8) {
+                link->conf.Attributes |= CONF_ENABLE_SPKR;
+                link->conf.Status = CCSR_AUDIO_ENA;
+        }
+        if ((link->manf_id == MANFID_IBM) &&
+            (link->card_id == PRODID_IBM_HOME_AND_AWAY))
+                link->conf.ConfigIndex |= 0x10;
+        ret = pcmcia_request_configuration(link, &link->conf);
+        if (ret)
+                return NULL;
+        dev->irq = link->irq;
+        dev->base_addr = link->resource[0]->start;
+        if (info->flags & HAS_MISC_REG) {
+                if ((if_port == 1) || (if_port == 2))
+                        dev->if_port = if_port;
+                else
+                        dev_notice(&link->dev, "invalid if_port requested\n");
+        } else
+                dev->if_port = 0;
+        if ((link->conf.ConfigBase == 0x03c0) &&
+            (link->manf_id == 0x149) && (link->card_id == 0xc1ab)) {
+                dev_info(&link->dev,
+                        "this is an AX88190 card - use axnet_cs instead.\n");
+                return NULL;
+        }
+        local_hw_info = get_hwinfo(link);
+        if (!local_hw_info)
+                local_hw_info = get_prom(link);
+        if (!local_hw_info)
+                local_hw_info = get_dl10019(link);
+        if (!local_hw_info)
+                local_hw_info = get_ax88190(link);
+        if (!local_hw_info)
+                local_hw_info = get_hwired(link);
+        return local_hw_info;
 }
 static int pcnet_config(struct pcmcia_device *link)
 {
    struct net_device *dev = link->priv;
    pcnet_dev_t *info = PRIV(dev);
-    int ret, start_pg, stop_pg, cm_offset;
+    int start_pg, stop_pg, cm_offset;
    int has_shmem = 0;
    hw_info_t *local_hw_info;
    dev_dbg(&link->dev, "pcnet_config\n");
-    ret = pcmcia_loop_config(link, pcnet_confcheck, &has_shmem);
+    local_hw_info = pcnet_try_config(link, &has_shmem, 0);
-    if (ret)
+    if (!local_hw_info) {
-        goto failed;
+            /* check whether forcing io_lines to 16 helps... */
+            pcmcia_disable_device(link);
-    if (!link->irq)
+            local_hw_info = pcnet_try_config(link, &has_shmem, 1);
-            goto failed;
+            if (local_hw_info == NULL) {
+                    dev_notice(&link->dev, "unable to read hardware net"
-    if (resource_size(link->resource[1]) == 8) {
+                            " address for io base %#3lx\n", dev->base_addr);
-        link->conf.Attributes |= CONF_ENABLE_SPKR;
+                    goto failed;
-        link->conf.Status = CCSR_AUDIO_ENA;
+            }
-    }
-    if ((link->manf_id == MANFID_IBM) &&
-        (link->card_id == PRODID_IBM_HOME_AND_AWAY))
-        link->conf.ConfigIndex |= 0x10;
-    ret = pcmcia_request_configuration(link, &link->conf);
-    if (ret)
-            goto failed;
-    dev->irq = link->irq;
-    dev->base_addr = link->resource[0]->start;
-    if (info->flags & HAS_MISC_REG) {
-        if ((if_port == 1) || (if_port == 2))
-            dev->if_port = if_port;
-        else
-            printk(KERN_NOTICE "pcnet_cs: invalid if_port requested\n");
-    } else {
-        dev->if_port = 0;
-    }
-    if ((link->conf.ConfigBase == 0x03c0) &&
-        (link->manf_id == 0x149) && (link->card_id == 0xc1ab)) {
-        printk(KERN_INFO "pcnet_cs: this is an AX88190 card!\n");
-        printk(KERN_INFO "pcnet_cs: use axnet_cs instead.\n");
-        goto failed;
-    }
-    local_hw_info = get_hwinfo(link);
-    if (local_hw_info == NULL)
-        local_hw_info = get_prom(link);
-    if (local_hw_info == NULL)
-        local_hw_info = get_dl10019(link);
-    if (local_hw_info == NULL)
-        local_hw_info = get_ax88190(link);
-    if (local_hw_info == NULL)
-        local_hw_info = get_hwired(link);
-    if (local_hw_info == NULL) {
-        printk(KERN_NOTICE "pcnet_cs: unable to read hardware net"
-               " address for io base %#3lx\n", dev->base_addr);
-        goto failed;
    }
    info->flags = local_hw_info->flags;
@@ -1637,6 +1664,7 @@ static struct pcmcia_device_id pcnet_ids[] = {
        PCMCIA_DEVICE_PROD_ID12("IO DATA", "PCETTX", 0x547e66dc, 0x6fc5459b),
        PCMCIA_DEVICE_PROD_ID12("iPort", "10/100 Ethernet Card", 0x56c538d2, 0x11b0ffc0),
        PCMCIA_DEVICE_PROD_ID12("KANSAI ELECTRIC CO.,LTD", "KLA-PCM/T", 0xb18dc3b4, 0xcc51a956),
+        PCMCIA_DEVICE_PROD_ID12("KENTRONICS", "KEP-230", 0xaf8144c9, 0x868f6616),
        PCMCIA_DEVICE_PROD_ID12("KCI", "PE520 PCMCIA Ethernet Adapter", 0xa89b87d3, 0x1eb88e64),
        PCMCIA_DEVICE_PROD_ID12("KINGMAX", "EN10T2T", 0x7bcb459a, 0xa5c81fa5),
        PCMCIA_DEVICE_PROD_ID12("Kingston", "KNE-PC2", 0x1128e633, 0xce2a89b3),
diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c
index 6a6b8199a0d6..6c58da2b882c 100644
--- a/drivers/net/phy/mdio_bus.c
+++ b/drivers/net/phy/mdio_bus.c
@@ -308,7 +308,7 @@ static int mdio_bus_suspend(struct device *dev)
         * may call phy routines that try to grab the same lock, and that may
         * lead to a deadlock.
         */
-        if (phydev->attached_dev)
+        if (phydev->attached_dev && phydev->adjust_link)
                phy_stop_machine(phydev);
        if (!mdio_bus_phy_may_suspend(phydev))
@@ -331,7 +331,7 @@ static int mdio_bus_resume(struct device *dev)
                return ret;
 no_resume:
-        if (phydev->attached_dev)
+        if (phydev->attached_dev && phydev->adjust_link)
                phy_start_machine(phydev, NULL);
        return 0;
diff --git a/drivers/net/ppp_generic.c b/drivers/net/ppp_generic.c
index 6695a51e09e9..736b91703b3e 100644
--- a/drivers/net/ppp_generic.c
+++ b/drivers/net/ppp_generic.c
@@ -1314,8 +1314,13 @@ static int ppp_mp_explode(struct ppp *ppp, struct sk_buff *skb)
        hdrlen = (ppp->flags & SC_MP_XSHORTSEQ)? MPHDRLEN_SSN: MPHDRLEN;
        i = 0;
        list_for_each_entry(pch, &ppp->channels, clist) {
-                navail += pch->avail = (pch->chan != NULL);
+                if (pch->chan) {
-                pch->speed = pch->chan->speed;
+                        pch->avail = 1;
+                        navail++;
+                        pch->speed = pch->chan->speed;
+                } else {
+                        pch->avail = 0;
+                }
                if (pch->avail) {
                        if (skb_queue_empty(&pch->file.xq) ||
                                !pch->had_frag) {
diff --git a/drivers/net/pxa168_eth.c b/drivers/net/pxa168_eth.c
index 410ea0a61371..85eddda276bd 100644
--- a/drivers/net/pxa168_eth.c
+++ b/drivers/net/pxa168_eth.c
@@ -1606,6 +1606,8 @@ static int pxa168_eth_remove(struct platform_device *pdev)
        iounmap(pep->base);
        pep->base = NULL;
+        mdiobus_unregister(pep->smi_bus);
+        mdiobus_free(pep->smi_bus);
        unregister_netdev(dev);
        flush_scheduled_work();
        free_netdev(dev);
diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
index 078bbf4e6f19..a0da4a17b025 100644
--- a/drivers/net/r8169.c
+++ b/drivers/net/r8169.c
@@ -2934,7 +2934,7 @@ static const struct rtl_cfg_info {
                .hw_start       = rtl_hw_start_8168,
                .region         = 2,
                .align          = 8,
-                .intr_event     = SYSErr | LinkChg | RxOverflow |
+                .intr_event     = SYSErr | RxFIFOOver | LinkChg | RxOverflow |
                                  TxErr | TxOK | RxOK | RxErr,
                .napi_event     = TxErr | TxOK | RxOK | RxOverflow,
                .features       = RTL_FEATURE_GMII | RTL_FEATURE_MSI,
@@ -4625,8 +4625,7 @@ static irqreturn_t rtl8169_interrupt(int irq, void *dev_instance)
                }
                /* Work around for rx fifo overflow */
-                if (unlikely(status & RxFIFOOver) &&
+                if (unlikely(status & RxFIFOOver)) {
-                (tp->mac_version == RTL_GIGA_MAC_VER_11)) {
                        netif_stop_queue(dev);
                        rtl8169_tx_timeout(dev);
                        break;
diff --git a/drivers/net/stmmac/stmmac_main.c b/drivers/net/stmmac/stmmac_main.c
index bbb7951b9c4c..ea0461eb2dbe 100644
--- a/drivers/net/stmmac/stmmac_main.c
+++ b/drivers/net/stmmac/stmmac_main.c
@@ -1865,15 +1865,15 @@ static int stmmac_resume(struct platform_device *pdev)
        if (!netif_running(dev))
                return 0;
-        spin_lock(&priv->lock);
        if (priv->shutdown) {
                /* Re-open the interface and re-init the MAC/DMA
-                   and the rings. */
+                   and the rings (i.e. on hibernation stage) */
                stmmac_open(dev);
-                goto out_resume;
+                return 0;
        }
+        spin_lock(&priv->lock);
        /* Power Down bit, into the PM register, is cleared
         * automatically as soon as a magic packet or a Wake-up frame
         * is received. Anyway, it's better to manually clear
@@ -1901,7 +1901,6 @@ static int stmmac_resume(struct platform_device *pdev)
        netif_start_queue(dev);
-out_resume:
        spin_unlock(&priv->lock);
        return 0;
 }
diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
index 6efca66b8766..1cd752f9a6e1 100644
--- a/drivers/net/usb/hso.c
+++ b/drivers/net/usb/hso.c
@@ -1652,6 +1652,8 @@ static int hso_get_count(struct hso_serial *serial,
        struct uart_icount cnow;
        struct hso_tiocmget  *tiocmget = serial->tiocmget;
+        memset(&icount, 0, sizeof(struct serial_icounter_struct));
        if (!tiocmget)
                 return -ENOENT;
        spin_lock_irq(&serial->serial_lock);
diff --git a/drivers/net/usb/ipheth.c b/drivers/net/usb/ipheth.c
index 8ed30fa35d0a..b2bcf99e6f08 100644
--- a/drivers/net/usb/ipheth.c
+++ b/drivers/net/usb/ipheth.c
@@ -429,10 +429,6 @@ static const struct net_device_ops ipheth_netdev_ops = {
        .ndo_get_stats = &ipheth_stats,
 };
-static struct device_type ipheth_type = {
-        .name   = "wwan",
-};
 static int ipheth_probe(struct usb_interface *intf,
                        const struct usb_device_id *id)
 {
@@ -450,7 +446,7 @@ static int ipheth_probe(struct usb_interface *intf,
        netdev->netdev_ops = &ipheth_netdev_ops;
        netdev->watchdog_timeo = IPHETH_TX_TIMEOUT;
-        strcpy(netdev->name, "wwan%d");
+        strcpy(netdev->name, "eth%d");
        dev = netdev_priv(netdev);
        dev->udev = udev;
@@ -500,7 +496,6 @@ static int ipheth_probe(struct usb_interface *intf,
        SET_NETDEV_DEV(netdev, &intf->dev);
        SET_ETHTOOL_OPS(netdev, &ops);
-        SET_NETDEV_DEVTYPE(netdev, &ipheth_type);
        retval = register_netdev(netdev);
        if (retval) {
diff --git a/drivers/net/via-velocity.c b/drivers/net/via-velocity.c
index fd69095ef6e3..f53412368ce1 100644
--- a/drivers/net/via-velocity.c
+++ b/drivers/net/via-velocity.c
@@ -2824,7 +2824,7 @@ static int __devinit velocity_found1(struct pci_dev *pdev, const struct pci_devi
        netif_napi_add(dev, &vptr->napi, velocity_poll, VELOCITY_NAPI_WEIGHT);
        dev->features |= NETIF_F_HW_VLAN_TX | NETIF_F_HW_VLAN_FILTER |
-                NETIF_F_HW_VLAN_RX | NETIF_F_IP_CSUM | NETIF_F_SG;
+                NETIF_F_HW_VLAN_RX | NETIF_F_IP_CSUM;
        ret = register_netdev(dev);
        if (ret < 0)
diff --git a/drivers/net/wireless/ath/ath5k/base.c b/drivers/net/wireless/ath/ath5k/base.c
index 373dcfec689c..d77ce9906b6c 100644
--- a/drivers/net/wireless/ath/ath5k/base.c
+++ b/drivers/net/wireless/ath/ath5k/base.c
@@ -1327,6 +1327,10 @@ ath5k_txbuf_setup(struct ath5k_softc *sc, struct ath5k_buf *bf,
                        PCI_DMA_TODEVICE);
        rate = ieee80211_get_tx_rate(sc->hw, info);
+        if (!rate) {
+                ret = -EINVAL;
+                goto err_unmap;
+        }
        if (info->flags & IEEE80211_TX_CTL_NO_ACK)
                flags |= AR5K_TXDESC_NOACK;
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
index b883b174385b..057fb69ddf7f 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
@@ -797,7 +797,7 @@ static bool ar9300_uncompress_block(struct ath_hw *ah,
                length = block[it+1];
                length &= 0xff;
-                if (length > 0 && spot >= 0 && spot+length < mdataSize) {
+                if (length > 0 && spot >= 0 && spot+length <= mdataSize) {
                        ath_print(common, ATH_DBG_EEPROM,
                                  "Restore at %d: spot=%d "
                                  "offset=%d length=%d\n",
diff --git a/drivers/net/wireless/ath/ath9k/eeprom.h b/drivers/net/wireless/ath/ath9k/eeprom.h
index 7f48df1e2903..0b09db0f8e7d 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom.h
+++ b/drivers/net/wireless/ath/ath9k/eeprom.h
@@ -62,7 +62,7 @@
 #define SD_NO_CTL               0xE0
 #define NO_CTL                  0xff
-#define CTL_MODE_M              7
+#define CTL_MODE_M              0xf
 #define CTL_11A                 0
 #define CTL_11B                 1
 #define CTL_11G                 2
diff --git a/drivers/net/wireless/ath/regd.h b/drivers/net/wireless/ath/regd.h
index a1c39526161a..345dd9721b41 100644
--- a/drivers/net/wireless/ath/regd.h
+++ b/drivers/net/wireless/ath/regd.h
@@ -31,7 +31,6 @@ enum ctl_group {
 #define NO_CTL 0xff
 #define SD_NO_CTL               0xE0
 #define NO_CTL                  0xff
-#define CTL_MODE_M              7
 #define CTL_11A                 0
 #define CTL_11B                 1
 #define CTL_11G                 2
diff --git a/drivers/net/wireless/libertas/if_sdio.c b/drivers/net/wireless/libertas/if_sdio.c
index ba854c70ab94..87b634978b35 100644
--- a/drivers/net/wireless/libertas/if_sdio.c
+++ b/drivers/net/wireless/libertas/if_sdio.c
@@ -128,7 +128,7 @@ struct if_sdio_card {
        bool                    helper_allocated;
        bool                    firmware_allocated;
-        u8                      buffer[65536];
+        u8                      buffer[65536] __attribute__((aligned(4)));
        spinlock_t              lock;
        struct if_sdio_packet   *packets;
diff --git a/drivers/net/wireless/p54/txrx.c b/drivers/net/wireless/p54/txrx.c
index 173aec3d6e7e..0e937dc0c9c4 100644
--- a/drivers/net/wireless/p54/txrx.c
+++ b/drivers/net/wireless/p54/txrx.c
@@ -446,7 +446,7 @@ static void p54_rx_frame_sent(struct p54_common *priv, struct sk_buff *skb)
        }
        if (!(info->flags & IEEE80211_TX_CTL_NO_ACK) &&
-             (!payload->status))
+             !(payload->status & P54_TX_FAILED))
                info->flags |= IEEE80211_TX_STAT_ACK;
        if (payload->status & P54_TX_PSM_CANCELLED)
                info->flags |= IEEE80211_TX_STAT_TX_FILTERED;