11 files changed, 431 insertions, 95 deletions

diff --git a/drivers/net/atlx/atl2.c b/drivers/net/atlx/atl2.c
index e637e9f28fd4..937ef1afa5db 100644
--- a/drivers/net/atlx/atl2.c
+++ b/drivers/net/atlx/atl2.c
@@ -1996,13 +1996,15 @@ static int atl2_set_eeprom(struct net_device *netdev,
         if (!eeprom_buff)
                 return -ENOMEM;
 
-        ptr = (u32 *)eeprom_buff;
+        ptr = eeprom_buff;
 
         if (eeprom->offset & 3) {
                 /* need read/modify/write of first changed EEPROM word */
                 /* only the second byte of the word is being modified */
-                if (!atl2_read_eeprom(hw, first_dword*4, &(eeprom_buff[0])))
-                        return -EIO;
+                if (!atl2_read_eeprom(hw, first_dword*4, &(eeprom_buff[0]))) {
+                        ret_val = -EIO;
+                        goto out;
+                }
                 ptr++;
         }
         if (((eeprom->offset + eeprom->len) & 3)) {
@@ -2011,18 +2013,22 @@ static int atl2_set_eeprom(struct net_device *netdev,
                  * only the first byte of the word is being modified
                  */
                 if (!atl2_read_eeprom(hw, last_dword * 4,
-                        &(eeprom_buff[last_dword - first_dword])))
-                        return -EIO;
+                                        &(eeprom_buff[last_dword - first_dword]))) {
+                        ret_val = -EIO;
+                        goto out;
+                }
         }
 
         /* Device's eeprom is always little-endian, word addressable */
         memcpy(ptr, bytes, eeprom->len);
 
         for (i = 0; i < last_dword - first_dword + 1; i++) {
-                if (!atl2_write_eeprom(hw, ((first_dword+i)*4), eeprom_buff[i]))
-                        return -EIO;
+                if (!atl2_write_eeprom(hw, ((first_dword+i)*4), eeprom_buff[i])) {
+                        ret_val = -EIO;
+                        goto out;
+                }
         }
-
+ out:
         kfree(eeprom_buff);
         return ret_val;
 }
diff --git a/drivers/net/bonding/bond_alb.h b/drivers/net/bonding/bond_alb.h
index 118c28aa471e..4b3e35878406 100644
--- a/drivers/net/bonding/bond_alb.h
+++ b/drivers/net/bonding/bond_alb.h
@@ -74,7 +74,7 @@ struct tlb_client_info {
                                  * packets to a Client that the Hash function
                                  * gave this entry index.
                                  */
-        u32 tx_bytes;           /* Each Client acumulates the BytesTx that
+        u32 tx_bytes;           /* Each Client accumulates the BytesTx that
                                  * were tranmitted to it, and after each
                                  * CallBack the LoadHistory is devided
                                  * by the balance interval
diff --git a/drivers/net/irda/via-ircc.c b/drivers/net/irda/via-ircc.c
index 67c0ad42d818..186cd28a61cc 100644
--- a/drivers/net/irda/via-ircc.c
+++ b/drivers/net/irda/via-ircc.c
@@ -75,15 +75,9 @@ static int dongle_id = 0;	/* default: probe */
 /* We can't guess the type of connected dongle, user *must* supply it. */
 module_param(dongle_id, int, 0);
 
-/* FIXME : we should not need this, because instances should be automatically
- * managed by the PCI layer. Especially that we seem to only be using the
- * first entry. Jean II */
-/* Max 4 instances for now */
-static struct via_ircc_cb *dev_self[] = { NULL, NULL, NULL, NULL };
-
 /* Some prototypes */
-static int via_ircc_open(int i, chipio_t * info, unsigned int id);
-static int via_ircc_close(struct via_ircc_cb *self);
+static int via_ircc_open(struct pci_dev *pdev, chipio_t * info,
+                         unsigned int id);
 static int via_ircc_dma_receive(struct via_ircc_cb *self);
 static int via_ircc_dma_receive_complete(struct via_ircc_cb *self,
                                          int iobase);
@@ -215,7 +209,7 @@ static int __devinit via_init_one (struct pci_dev *pcidev, const struct pci_devi
                         pci_write_config_byte(pcidev,0x42,(bTmp | 0xf0));
                         pci_write_config_byte(pcidev,0x5a,0xc0);
                         WriteLPCReg(0x28, 0x70 );
-                        if (via_ircc_open(0, &info,0x3076) == 0)
+                        if (via_ircc_open(pcidev, &info, 0x3076) == 0)
                                 rc=0;
                 } else
                         rc = -ENODEV; //IR not turn on   
@@ -254,7 +248,7 @@ static int __devinit via_init_one (struct pci_dev *pcidev, const struct pci_devi
                         info.irq=FirIRQ;
                         info.dma=FirDRQ1;
                         info.dma2=FirDRQ0;
-                        if (via_ircc_open(0, &info,0x3096) == 0)
+                        if (via_ircc_open(pcidev, &info, 0x3096) == 0)
                                 rc=0;
                 } else
                         rc = -ENODEV; //IR not turn on !!!!!
@@ -264,48 +258,10 @@ static int __devinit via_init_one (struct pci_dev *pcidev, const struct pci_devi
         return rc;
 }
 
-/*
- * Function via_ircc_clean ()
- *
- *    Close all configured chips
- *
- */
-static void via_ircc_clean(void)
-{
-        int i;
-
-        IRDA_DEBUG(3, "%s()\n", __func__);
-
-        for (i=0; i < ARRAY_SIZE(dev_self); i++) {
-                if (dev_self[i])
-                        via_ircc_close(dev_self[i]);
-        }
-}
-
-static void __devexit via_remove_one (struct pci_dev *pdev)
-{
-        IRDA_DEBUG(3, "%s()\n", __func__);
-
-        /* FIXME : This is ugly. We should use pci_get_drvdata(pdev);
-         * to get our driver instance and call directly via_ircc_close().
-         * See vlsi_ir for details...
-         * Jean II */
-        via_ircc_clean();
-
-        /* FIXME : This should be in via_ircc_close(), because here we may
-         * theoritically disable still configured devices :-( - Jean II */
-        pci_disable_device(pdev);
-}
-
 static void __exit via_ircc_cleanup(void)
 {
         IRDA_DEBUG(3, "%s()\n", __func__);
 
-        /* FIXME : This should be redundant, as pci_unregister_driver()
-         * should call via_remove_one() on each device.
-         * Jean II */
-        via_ircc_clean();
-
         /* Cleanup all instances of the driver */
         pci_unregister_driver (&via_driver); 
 }
@@ -324,12 +280,13 @@ static const struct net_device_ops via_ircc_fir_ops = {
 };
 
 /*
- * Function via_ircc_open (iobase, irq)
+ * Function via_ircc_open(pdev, iobase, irq)
  *
  *    Open driver instance
  *
  */
-static __devinit int via_ircc_open(int i, chipio_t * info, unsigned int id)
+static __devinit int via_ircc_open(struct pci_dev *pdev, chipio_t * info,
+                                   unsigned int id)
 {
         struct net_device *dev;
         struct via_ircc_cb *self;
@@ -337,9 +294,6 @@ static __devinit int via_ircc_open(int i, chipio_t * info, unsigned int id)
 
         IRDA_DEBUG(3, "%s()\n", __func__);
 
-        if (i >= ARRAY_SIZE(dev_self))
-                return -ENOMEM;
-
         /* Allocate new instance of the driver */
         dev = alloc_irdadev(sizeof(struct via_ircc_cb));
         if (dev == NULL) 
@@ -349,13 +303,8 @@ static __devinit int via_ircc_open(int i, chipio_t * info, unsigned int id)
         self->netdev = dev;
         spin_lock_init(&self->lock);
 
-        /* FIXME : We should store our driver instance in the PCI layer,
-         * using pci_set_drvdata(), not in this array.
-         * See vlsi_ir for details... - Jean II */
-        /* FIXME : 'i' is always 0 (see via_init_one()) :-( - Jean II */
-        /* Need to store self somewhere */
-        dev_self[i] = self;
-        self->index = i;
+        pci_set_drvdata(pdev, self);
+
         /* Initialize Resource */
         self->io.cfg_base = info->cfg_base;
         self->io.fir_base = info->fir_base;
@@ -414,7 +363,7 @@ static __devinit int via_ircc_open(int i, chipio_t * info, unsigned int id)
 
         /* Allocate memory if needed */
         self->rx_buff.head =
-                dma_alloc_coherent(NULL, self->rx_buff.truesize,
+                dma_alloc_coherent(&pdev->dev, self->rx_buff.truesize,
                                    &self->rx_buff_dma, GFP_KERNEL);
         if (self->rx_buff.head == NULL) {
                 err = -ENOMEM;
@@ -423,7 +372,7 @@ static __devinit int via_ircc_open(int i, chipio_t * info, unsigned int id)
         memset(self->rx_buff.head, 0, self->rx_buff.truesize);
 
         self->tx_buff.head =
-                dma_alloc_coherent(NULL, self->tx_buff.truesize,
+                dma_alloc_coherent(&pdev->dev, self->tx_buff.truesize,
                                    &self->tx_buff_dma, GFP_KERNEL);
         if (self->tx_buff.head == NULL) {
                 err = -ENOMEM;
@@ -455,33 +404,32 @@ static __devinit int via_ircc_open(int i, chipio_t * info, unsigned int id)
         via_hw_init(self);
         return 0;
  err_out4:
-        dma_free_coherent(NULL, self->tx_buff.truesize,
+        dma_free_coherent(&pdev->dev, self->tx_buff.truesize,
                           self->tx_buff.head, self->tx_buff_dma);
  err_out3:
-        dma_free_coherent(NULL, self->rx_buff.truesize,
+        dma_free_coherent(&pdev->dev, self->rx_buff.truesize,
                           self->rx_buff.head, self->rx_buff_dma);
  err_out2:
         release_region(self->io.fir_base, self->io.fir_ext);
  err_out1:
+        pci_set_drvdata(pdev, NULL);
         free_netdev(dev);
-        dev_self[i] = NULL;
         return err;
 }
 
 /*
- * Function via_ircc_close (self)
+ * Function via_remove_one(pdev)
  *
  *    Close driver instance
  *
  */
-static int via_ircc_close(struct via_ircc_cb *self)
+static void __devexit via_remove_one(struct pci_dev *pdev)
 {
+        struct via_ircc_cb *self = pci_get_drvdata(pdev);
         int iobase;
 
         IRDA_DEBUG(3, "%s()\n", __func__);
 
-        IRDA_ASSERT(self != NULL, return -1;);
-
         iobase = self->io.fir_base;
 
         ResetChip(iobase, 5);   //hardware reset.
@@ -493,16 +441,16 @@ static int via_ircc_close(struct via_ircc_cb *self)
                    __func__, self->io.fir_base);
         release_region(self->io.fir_base, self->io.fir_ext);
         if (self->tx_buff.head)
-                dma_free_coherent(NULL, self->tx_buff.truesize,
+                dma_free_coherent(&pdev->dev, self->tx_buff.truesize,
                                   self->tx_buff.head, self->tx_buff_dma);
         if (self->rx_buff.head)
-                dma_free_coherent(NULL, self->rx_buff.truesize,
+                dma_free_coherent(&pdev->dev, self->rx_buff.truesize,
                                   self->rx_buff.head, self->rx_buff_dma);
-        dev_self[self->index] = NULL;
+        pci_set_drvdata(pdev, NULL);
 
         free_netdev(self->netdev);
 
-        return 0;
+        pci_disable_device(pdev);
 }
 
 /*
diff --git a/drivers/net/mlx4/eq.c b/drivers/net/mlx4/eq.c
index 506cfd0372ec..1ad1f6029af8 100644
--- a/drivers/net/mlx4/eq.c
+++ b/drivers/net/mlx4/eq.c
@@ -603,7 +603,9 @@ int mlx4_init_eq_table(struct mlx4_dev *dev)
         }
 
         for (i = 0; i < dev->caps.num_comp_vectors; ++i) {
-                err = mlx4_create_eq(dev, dev->caps.num_cqs + MLX4_NUM_SPARE_EQE,
+                err = mlx4_create_eq(dev, dev->caps.num_cqs -
+                                          dev->caps.reserved_cqs +
+                                          MLX4_NUM_SPARE_EQE,
                                      (dev->flags & MLX4_FLAG_MSI_X) ? i : 0,
                                      &priv->eq_table.eq[i]);
                 if (err) {
diff --git a/drivers/net/mlx4/mcg.c b/drivers/net/mlx4/mcg.c
index e71372aa9cc4..37150b2f6425 100644
--- a/drivers/net/mlx4/mcg.c
+++ b/drivers/net/mlx4/mcg.c
@@ -469,7 +469,6 @@ static int remove_promisc_qp(struct mlx4_dev *dev, u8 vep_num, u8 port,
 
         /*remove from list of promisc qps */
         list_del(&pqp->list);
-        kfree(pqp);
 
         /* set the default entry not to include the removed one */
         mailbox = mlx4_alloc_cmd_mailbox(dev);
@@ -528,6 +527,8 @@ out_mailbox:
 out_list:
         if (back_to_list)
                 list_add_tail(&pqp->list, &s_steer->promisc_qps[steer]);
+        else
+                kfree(pqp);
 out_mutex:
         mutex_unlock(&priv->mcg_table.mutex);
         return err;
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index 993c52c82aeb..e870c0698bbe 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -442,11 +442,11 @@ static int phy_attach_direct(struct net_device *dev, struct phy_device *phydev,
                              u32 flags, phy_interface_t interface)
 {
         struct device *d = &phydev->dev;
+        int err;
 
         /* Assume that if there is no driver, that it doesn't
          * exist, and we should use the genphy driver. */
         if (NULL == d->driver) {
-                int err;
                 d->driver = &genphy_driver.driver;
 
                 err = d->driver->probe(d);
@@ -474,7 +474,11 @@ static int phy_attach_direct(struct net_device *dev, struct phy_device *phydev,
         /* Do initial configuration here, now that
          * we have certain key parameters
          * (dev_flags and interface) */
-        return phy_init_hw(phydev);
+        err = phy_init_hw(phydev);
+        if (err)
+                phy_detach(phydev);
+
+        return err;
 }
 
 /**
diff --git a/drivers/net/usb/Kconfig b/drivers/net/usb/Kconfig
index 6f600cced6e1..3ec22c307797 100644
--- a/drivers/net/usb/Kconfig
+++ b/drivers/net/usb/Kconfig
@@ -433,4 +433,19 @@ config USB_SIERRA_NET
           To compile this driver as a module, choose M here: the
           module will be called sierra_net.
 
+config USB_VL600
+        tristate "LG VL600 modem dongle"
+        depends on USB_NET_CDCETHER
+        select USB_ACM
+        help
+          Select this if you want to use an LG Electronics 4G/LTE usb modem
+          called VL600.  This driver only handles the ethernet
+          interface exposed by the modem firmware.  To establish a connection
+          you will first need a userspace program that sends the right
+          command to the modem through its CDC ACM port, and most
+          likely also a DHCP client.  See this thread about using the
+          4G modem from Verizon:
+
+          http://ubuntuforums.org/showpost.php?p=10589647&postcount=17
+
 endmenu
diff --git a/drivers/net/usb/Makefile b/drivers/net/usb/Makefile
index cac170301187..c7ec8a5f0a90 100644
--- a/drivers/net/usb/Makefile
+++ b/drivers/net/usb/Makefile
@@ -27,4 +27,5 @@ obj-$(CONFIG_USB_IPHETH)	+= ipheth.o
 obj-$(CONFIG_USB_SIERRA_NET)    += sierra_net.o
 obj-$(CONFIG_USB_NET_CX82310_ETH)       += cx82310_eth.o
 obj-$(CONFIG_USB_NET_CDC_NCM)   += cdc_ncm.o
+obj-$(CONFIG_USB_VL600)         += lg-vl600.o
 
diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
index 9a60e415d76b..51c259b69278 100644
--- a/drivers/net/usb/cdc_ether.c
+++ b/drivers/net/usb/cdc_ether.c
@@ -378,7 +378,7 @@ static void dumpspeed(struct usbnet *dev, __le32 *speeds)
                    __le32_to_cpu(speeds[1]) / 1000);
 }
 
-static void cdc_status(struct usbnet *dev, struct urb *urb)
+void usbnet_cdc_status(struct usbnet *dev, struct urb *urb)
 {
         struct usb_cdc_notification     *event;
 
@@ -418,8 +418,9 @@ static void cdc_status(struct usbnet *dev, struct urb *urb)
                 break;
         }
 }
+EXPORT_SYMBOL_GPL(usbnet_cdc_status);
 
-static int cdc_bind(struct usbnet *dev, struct usb_interface *intf)
+int usbnet_cdc_bind(struct usbnet *dev, struct usb_interface *intf)
 {
         int                             status;
         struct cdc_state                *info = (void *) &dev->data;
@@ -441,6 +442,7 @@ static int cdc_bind(struct usbnet *dev, struct usb_interface *intf)
          */
         return 0;
 }
+EXPORT_SYMBOL_GPL(usbnet_cdc_bind);
 
 static int cdc_manage_power(struct usbnet *dev, int on)
 {
@@ -452,18 +454,18 @@ static const struct driver_info	cdc_info = {
         .description =  "CDC Ethernet Device",
         .flags =        FLAG_ETHER,
         // .check_connect = cdc_check_connect,
-        .bind =         cdc_bind,
+        .bind =         usbnet_cdc_bind,
         .unbind =       usbnet_cdc_unbind,
-        .status =       cdc_status,
+        .status =       usbnet_cdc_status,
         .manage_power = cdc_manage_power,
 };
 
 static const struct driver_info mbm_info = {
         .description =  "Mobile Broadband Network Device",
         .flags =        FLAG_WWAN,
-        .bind =         cdc_bind,
+        .bind =         usbnet_cdc_bind,
         .unbind =       usbnet_cdc_unbind,
-        .status =       cdc_status,
+        .status =       usbnet_cdc_status,
         .manage_power = cdc_manage_power,
 };
 
@@ -560,6 +562,13 @@ static const struct usb_device_id	products [] = {
         .driver_info            = 0,
 },
 
+/* LG Electronics VL600 wants additional headers on every frame */
+{
+        USB_DEVICE_AND_INTERFACE_INFO(0x1004, 0x61aa, USB_CLASS_COMM,
+                        USB_CDC_SUBCLASS_ETHERNET, USB_CDC_PROTO_NONE),
+        .driver_info            = 0,
+},
+
 /*
  * WHITELIST!!!
  *
diff --git a/drivers/net/usb/lg-vl600.c b/drivers/net/usb/lg-vl600.c
new file mode 100644
index 000000000000..1d83ccfd7277
--- /dev/null
+++ b/drivers/net/usb/lg-vl600.c
@@ -0,0 +1,346 @@
+/*
+ * Ethernet interface part of the LG VL600 LTE modem (4G dongle)
+ *
+ * Copyright (C) 2011 Intel Corporation
+ * Author: Andrzej Zaborowski <balrogg@gmail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ */
+#include <linux/etherdevice.h>
+#include <linux/ethtool.h>
+#include <linux/mii.h>
+#include <linux/usb.h>
+#include <linux/usb/cdc.h>
+#include <linux/usb/usbnet.h>
+#include <linux/if_ether.h>
+#include <linux/if_arp.h>
+#include <linux/inetdevice.h>
+
+/*
+ * The device has a CDC ACM port for modem control (it claims to be
+ * CDC ACM anyway) and a CDC Ethernet port for actual network data.
+ * It will however ignore data on both ports that is not encapsulated
+ * in a specific way, any data returned is also encapsulated the same
+ * way.  The headers don't seem to follow any popular standard.
+ *
+ * This driver adds and strips these headers from the ethernet frames
+ * sent/received from the CDC Ethernet port.  The proprietary header
+ * replaces the standard ethernet header in a packet so only actual
+ * ethernet frames are allowed.  The headers allow some form of
+ * multiplexing by using non standard values of the .h_proto field.
+ * Windows/Mac drivers do send a couple of such frames to the device
+ * during initialisation, with protocol set to 0x0906 or 0x0b06 and (what
+ * seems to be) a flag in the .dummy_flags.  This doesn't seem necessary
+ * for modem operation but can possibly be used for GPS or other funcitons.
+ */
+
+struct vl600_frame_hdr {
+        __le32 len;
+        __le32 serial;
+        __le32 pkt_cnt;
+        __le32 dummy_flags;
+        __le32 dummy;
+        __le32 magic;
+} __attribute__((packed));
+
+struct vl600_pkt_hdr {
+        __le32 dummy[2];
+        __le32 len;
+        __be16 h_proto;
+} __attribute__((packed));
+
+struct vl600_state {
+        struct sk_buff *current_rx_buf;
+};
+
+static int vl600_bind(struct usbnet *dev, struct usb_interface *intf)
+{
+        int ret;
+        struct vl600_state *s = kzalloc(sizeof(struct vl600_state), GFP_KERNEL);
+
+        if (!s)
+                return -ENOMEM;
+
+        ret = usbnet_cdc_bind(dev, intf);
+        if (ret) {
+                kfree(s);
+                return ret;
+        }
+
+        dev->driver_priv = s;
+
+        /* ARP packets don't go through, but they're also of no use.  The
+         * subnet has only two hosts anyway: us and the gateway / DHCP
+         * server (probably simulated by modem firmware or network operator)
+         * whose address changes everytime we connect to the intarwebz and
+         * who doesn't bother answering ARP requests either.  So hardware
+         * addresses have no meaning, the destination and the source of every
+         * packet depend only on whether it is on the IN or OUT endpoint.  */
+        dev->net->flags |= IFF_NOARP;
+
+        return ret;
+}
+
+static void vl600_unbind(struct usbnet *dev, struct usb_interface *intf)
+{
+        struct vl600_state *s = dev->driver_priv;
+
+        if (s->current_rx_buf)
+                dev_kfree_skb(s->current_rx_buf);
+
+        kfree(s);
+
+        return usbnet_cdc_unbind(dev, intf);
+}
+
+static int vl600_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
+{
+        struct vl600_frame_hdr *frame;
+        struct vl600_pkt_hdr *packet;
+        struct ethhdr *ethhdr;
+        int packet_len, count;
+        struct sk_buff *buf = skb;
+        struct sk_buff *clone;
+        struct vl600_state *s = dev->driver_priv;
+
+        /* Frame lengths are generally 4B multiplies but every couple of
+         * hours there's an odd number of bytes sized yet correct frame,
+         * so don't require this.  */
+
+        /* Allow a packet (or multiple packets batched together) to be
+         * split across many frames.  We don't allow a new batch to
+         * begin in the same frame another one is ending however, and no
+         * leading or trailing pad bytes.  */
+        if (s->current_rx_buf) {
+                frame = (struct vl600_frame_hdr *) s->current_rx_buf->data;
+                if (skb->len + s->current_rx_buf->len >
+                                le32_to_cpup(&frame->len)) {
+                        netif_err(dev, ifup, dev->net, "Fragment too long\n");
+                        dev->net->stats.rx_length_errors++;
+                        goto error;
+                }
+
+                buf = s->current_rx_buf;
+                memcpy(skb_put(buf, skb->len), skb->data, skb->len);
+        } else if (skb->len < 4) {
+                netif_err(dev, ifup, dev->net, "Frame too short\n");
+                dev->net->stats.rx_length_errors++;
+                goto error;
+        }
+
+        frame = (struct vl600_frame_hdr *) buf->data;
+        /* NOTE: Should check that frame->magic == 0x53544448?
+         * Otherwise if we receive garbage at the beginning of the frame
+         * we may end up allocating a huge buffer and saving all the
+         * future incoming data into it.  */
+
+        if (buf->len < sizeof(*frame) ||
+                        buf->len != le32_to_cpup(&frame->len)) {
+                /* Save this fragment for later assembly */
+                if (s->current_rx_buf)
+                        return 0;
+
+                s->current_rx_buf = skb_copy_expand(skb, 0,
+                                le32_to_cpup(&frame->len), GFP_ATOMIC);
+                if (!s->current_rx_buf) {
+                        netif_err(dev, ifup, dev->net, "Reserving %i bytes "
+                                        "for packet assembly failed.\n",
+                                        le32_to_cpup(&frame->len));
+                        dev->net->stats.rx_errors++;
+                }
+
+                return 0;
+        }
+
+        count = le32_to_cpup(&frame->pkt_cnt);
+
+        skb_pull(buf, sizeof(*frame));
+
+        while (count--) {
+                if (buf->len < sizeof(*packet)) {
+                        netif_err(dev, ifup, dev->net, "Packet too short\n");
+                        goto error;
+                }
+
+                packet = (struct vl600_pkt_hdr *) buf->data;
+                packet_len = sizeof(*packet) + le32_to_cpup(&packet->len);
+                if (packet_len > buf->len) {
+                        netif_err(dev, ifup, dev->net,
+                                        "Bad packet length stored in header\n");
+                        goto error;
+                }
+
+                /* Packet header is same size as the ethernet header
+                 * (sizeof(*packet) == sizeof(*ethhdr)), additionally
+                 * the h_proto field is in the same place so we just leave it
+                 * alone and fill in the remaining fields.
+                 */
+                ethhdr = (struct ethhdr *) skb->data;
+                if (be16_to_cpup(&ethhdr->h_proto) == ETH_P_ARP &&
+                                buf->len > 0x26) {
+                        /* Copy the addresses from packet contents */
+                        memcpy(ethhdr->h_source,
+                                        &buf->data[sizeof(*ethhdr) + 0x8],
+                                        ETH_ALEN);
+                        memcpy(ethhdr->h_dest,
+                                        &buf->data[sizeof(*ethhdr) + 0x12],
+                                        ETH_ALEN);
+                } else {
+                        memset(ethhdr->h_source, 0, ETH_ALEN);
+                        memcpy(ethhdr->h_dest, dev->net->dev_addr, ETH_ALEN);
+                }
+
+                if (count) {
+                        /* Not the last packet in this batch */
+                        clone = skb_clone(buf, GFP_ATOMIC);
+                        if (!clone)
+                                goto error;
+
+                        skb_trim(clone, packet_len);
+                        usbnet_skb_return(dev, clone);
+
+                        skb_pull(buf, (packet_len + 3) & ~3);
+                } else {
+                        skb_trim(buf, packet_len);
+
+                        if (s->current_rx_buf) {
+                                usbnet_skb_return(dev, buf);
+                                s->current_rx_buf = NULL;
+                                return 0;
+                        }
+
+                        return 1;
+                }
+        }
+
+error:
+        if (s->current_rx_buf) {
+                dev_kfree_skb_any(s->current_rx_buf);
+                s->current_rx_buf = NULL;
+        }
+        dev->net->stats.rx_errors++;
+        return 0;
+}
+
+static struct sk_buff *vl600_tx_fixup(struct usbnet *dev,
+                struct sk_buff *skb, gfp_t flags)
+{
+        struct sk_buff *ret;
+        struct vl600_frame_hdr *frame;
+        struct vl600_pkt_hdr *packet;
+        static uint32_t serial = 1;
+        int orig_len = skb->len - sizeof(struct ethhdr);
+        int full_len = (skb->len + sizeof(struct vl600_frame_hdr) + 3) & ~3;
+
+        frame = (struct vl600_frame_hdr *) skb->data;
+        if (skb->len > sizeof(*frame) && skb->len == le32_to_cpup(&frame->len))
+                return skb; /* Already encapsulated? */
+
+        if (skb->len < sizeof(struct ethhdr))
+                /* Drop, device can only deal with ethernet packets */
+                return NULL;
+
+        if (!skb_cloned(skb)) {
+                int headroom = skb_headroom(skb);
+                int tailroom = skb_tailroom(skb);
+
+                if (tailroom >= full_len - skb->len - sizeof(*frame) &&
+                                headroom >= sizeof(*frame))
+                        /* There's enough head and tail room */
+                        goto encapsulate;
+
+                if (headroom + tailroom + skb->len >= full_len) {
+                        /* There's enough total room, just readjust */
+                        skb->data = memmove(skb->head + sizeof(*frame),
+                                        skb->data, skb->len);
+                        skb_set_tail_pointer(skb, skb->len);
+                        goto encapsulate;
+                }
+        }
+
+        /* Alloc a new skb with the required size */
+        ret = skb_copy_expand(skb, sizeof(struct vl600_frame_hdr), full_len -
+                        skb->len - sizeof(struct vl600_frame_hdr), flags);
+        dev_kfree_skb_any(skb);
+        if (!ret)
+                return ret;
+        skb = ret;
+
+encapsulate:
+        /* Packet header is same size as ethernet packet header
+         * (sizeof(*packet) == sizeof(struct ethhdr)), additionally the
+         * h_proto field is in the same place so we just leave it alone and
+         * overwrite the remaining fields.
+         */
+        packet = (struct vl600_pkt_hdr *) skb->data;
+        memset(&packet->dummy, 0, sizeof(packet->dummy));
+        packet->len = cpu_to_le32(orig_len);
+
+        frame = (struct vl600_frame_hdr *) skb_push(skb, sizeof(*frame));
+        memset(frame, 0, sizeof(*frame));
+        frame->len = cpu_to_le32(full_len);
+        frame->serial = cpu_to_le32(serial++);
+        frame->pkt_cnt = cpu_to_le32(1);
+
+        if (skb->len < full_len) /* Pad */
+                skb_put(skb, full_len - skb->len);
+
+        return skb;
+}
+
+static const struct driver_info vl600_info = {
+        .description    = "LG VL600 modem",
+        .flags          = FLAG_ETHER | FLAG_RX_ASSEMBLE,
+        .bind           = vl600_bind,
+        .unbind         = vl600_unbind,
+        .status         = usbnet_cdc_status,
+        .rx_fixup       = vl600_rx_fixup,
+        .tx_fixup       = vl600_tx_fixup,
+};
+
+static const struct usb_device_id products[] = {
+        {
+                USB_DEVICE_AND_INTERFACE_INFO(0x1004, 0x61aa, USB_CLASS_COMM,
+                                USB_CDC_SUBCLASS_ETHERNET, USB_CDC_PROTO_NONE),
+                .driver_info    = (unsigned long) &vl600_info,
+        },
+        {},     /* End */
+};
+MODULE_DEVICE_TABLE(usb, products);
+
+static struct usb_driver lg_vl600_driver = {
+        .name           = "lg-vl600",
+        .id_table       = products,
+        .probe          = usbnet_probe,
+        .disconnect     = usbnet_disconnect,
+        .suspend        = usbnet_suspend,
+        .resume         = usbnet_resume,
+};
+
+static int __init vl600_init(void)
+{
+        return usb_register(&lg_vl600_driver);
+}
+module_init(vl600_init);
+
+static void __exit vl600_exit(void)
+{
+        usb_deregister(&lg_vl600_driver);
+}
+module_exit(vl600_exit);
+
+MODULE_AUTHOR("Anrzej Zaborowski");
+MODULE_DESCRIPTION("LG-VL600 modem's ethernet link");
+MODULE_LICENSE("GPL");
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index 95c41d56631c..cf58b7682565 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -387,8 +387,12 @@ static int rx_submit (struct usbnet *dev, struct urb *urb, gfp_t flags)
 static inline void rx_process (struct usbnet *dev, struct sk_buff *skb)
 {
         if (dev->driver_info->rx_fixup &&
-            !dev->driver_info->rx_fixup (dev, skb))
-                goto error;
+            !dev->driver_info->rx_fixup (dev, skb)) {
+                /* With RX_ASSEMBLE, rx_fixup() must update counters */
+                if (!(dev->driver_info->flags & FLAG_RX_ASSEMBLE))
+                        dev->net->stats.rx_errors++;
+                goto done;
+        }
         // else network stack removes extra byte if we forced a short packet
 
         if (skb->len) {
@@ -401,8 +405,8 @@ static inline void rx_process (struct usbnet *dev, struct sk_buff *skb)
         }
 
         netif_dbg(dev, rx_err, dev->net, "drop\n");
-error:
         dev->net->stats.rx_errors++;
+done:
         skb_queue_tail(&dev->done, skb);
 }