33 files changed, 347 insertions, 226 deletions

diff --git a/drivers/net/Makefile b/drivers/net/Makefile
index 1fc4602a6ff2..a1c25cb4669f 100644
--- a/drivers/net/Makefile
+++ b/drivers/net/Makefile
@@ -102,7 +102,7 @@ obj-$(CONFIG_HAMACHI) += hamachi.o
 obj-$(CONFIG_NET) += Space.o loopback.o
 obj-$(CONFIG_SEEQ8005) += seeq8005.o
 obj-$(CONFIG_NET_SB1000) += sb1000.o
-obj-$(CONFIG_MAC8390) += mac8390.o 8390.o
+obj-$(CONFIG_MAC8390) += mac8390.o
 obj-$(CONFIG_APNE) += apne.o 8390.o
 obj-$(CONFIG_PCMCIA_PCNET) += 8390.o
 obj-$(CONFIG_HP100) += hp100.o
diff --git a/drivers/net/arm/ixp4xx_eth.c b/drivers/net/arm/ixp4xx_eth.c
index 448487e22fa3..a740053d3af3 100644
--- a/drivers/net/arm/ixp4xx_eth.c
+++ b/drivers/net/arm/ixp4xx_eth.c
@@ -338,12 +338,12 @@ static int ixp4xx_mdio_register(void)
         if (cpu_is_ixp43x()) {
                 /* IXP43x lacks NPE-B and uses NPE-C for MII PHY access */
                 if (!(ixp4xx_read_feature_bits() & IXP4XX_FEATURE_NPEC_ETH))
-                        return -ENOSYS;
+                        return -ENODEV;
                 mdio_regs = (struct eth_regs __iomem *)IXP4XX_EthC_BASE_VIRT;
         } else {
                 /* All MII PHY accesses use NPE-B Ethernet registers */
                 if (!(ixp4xx_read_feature_bits() & IXP4XX_FEATURE_NPEB_ETH0))
-                        return -ENOSYS;
+                        return -ENODEV;
                 mdio_regs = (struct eth_regs __iomem *)IXP4XX_EthB_BASE_VIRT;
         }
 
@@ -1174,7 +1174,7 @@ static int __devinit eth_init_one(struct platform_device *pdev)
                 regs_phys  = IXP4XX_EthC_BASE_PHYS;
                 break;
         default:
-                err = -ENOSYS;
+                err = -ENODEV;
                 goto err_free;
         }
 
@@ -1189,15 +1189,10 @@ static int __devinit eth_init_one(struct platform_device *pdev)
                 goto err_free;
         }
 
-        if (register_netdev(dev)) {
-                err = -EIO;
-                goto err_npe_rel;
-        }
-
         port->mem_res = request_mem_region(regs_phys, REGS_SIZE, dev->name);
         if (!port->mem_res) {
                 err = -EBUSY;
-                goto err_unreg;
+                goto err_npe_rel;
         }
 
         port->plat = plat;
@@ -1215,20 +1210,25 @@ static int __devinit eth_init_one(struct platform_device *pdev)
         snprintf(phy_id, BUS_ID_SIZE, PHY_ID_FMT, "0", plat->phy);
         port->phydev = phy_connect(dev, phy_id, &ixp4xx_adjust_link, 0,
                                    PHY_INTERFACE_MODE_MII);
-        if (IS_ERR(port->phydev)) {
-                printk(KERN_ERR "%s: Could not attach to PHY\n", dev->name);
-                return PTR_ERR(port->phydev);
-        }
+        if ((err = IS_ERR(port->phydev)))
+                goto err_free_mem;
 
         port->phydev->irq = PHY_POLL;
 
+        if ((err = register_netdev(dev)))
+                goto err_phy_dis;
+
         printk(KERN_INFO "%s: MII PHY %i on %s\n", dev->name, plat->phy,
                npe_name(port->npe));
 
         return 0;
 
-err_unreg:
-        unregister_netdev(dev);
+err_phy_dis:
+        phy_disconnect(port->phydev);
+err_free_mem:
+        npe_port_tab[NPE_ID(port->id)] = NULL;
+        platform_set_drvdata(pdev, NULL);
+        release_resource(port->mem_res);
 err_npe_rel:
         npe_release(port->npe);
 err_free:
@@ -1242,6 +1242,7 @@ static int __devexit eth_remove_one(struct platform_device *pdev)
         struct port *port = netdev_priv(dev);
 
         unregister_netdev(dev);
+        phy_disconnect(port->phydev);
         npe_port_tab[NPE_ID(port->id)] = NULL;
         platform_set_drvdata(pdev, NULL);
         npe_release(port->npe);
diff --git a/drivers/net/benet/be.h b/drivers/net/benet/be.h
index c49ddd08b2aa..b4bb06fdf307 100644
--- a/drivers/net/benet/be.h
+++ b/drivers/net/benet/be.h
@@ -35,8 +35,22 @@
 #define DRV_VER                 "2.0.348"
 #define DRV_NAME                "be2net"
 #define BE_NAME                 "ServerEngines BladeEngine2 10Gbps NIC"
+#define OC_NAME                 "Emulex OneConnect 10Gbps NIC"
 #define DRV_DESC                BE_NAME "Driver"
 
+#define BE_VENDOR_ID            0x19a2
+#define BE_DEVICE_ID1           0x211
+#define OC_DEVICE_ID1           0x700
+#define OC_DEVICE_ID2           0x701
+
+static inline char *nic_name(struct pci_dev *pdev)
+{
+        if (pdev->device == OC_DEVICE_ID1 || pdev->device == OC_DEVICE_ID2)
+                return OC_NAME;
+        else
+                return BE_NAME;
+}
+
 /* Number of bytes of an RX frame that are copied to skb->data */
 #define BE_HDR_LEN              64
 #define BE_MAX_JUMBO_FRAME_SIZE 9018
diff --git a/drivers/net/benet/be_main.c b/drivers/net/benet/be_main.c
index 30d0c81c989e..5c378b5e8e41 100644
--- a/drivers/net/benet/be_main.c
+++ b/drivers/net/benet/be_main.c
@@ -28,10 +28,10 @@ static unsigned int rx_frag_size = 2048;
 module_param(rx_frag_size, uint, S_IRUGO);
 MODULE_PARM_DESC(rx_frag_size, "Size of a fragment that holds rcvd data.");
 
-#define BE_VENDOR_ID            0x19a2
-#define BE2_DEVICE_ID_1         0x0211
 static DEFINE_PCI_DEVICE_TABLE(be_dev_ids) = {
-        { PCI_DEVICE(BE_VENDOR_ID, BE2_DEVICE_ID_1) },
+        { PCI_DEVICE(BE_VENDOR_ID, BE_DEVICE_ID1) },
+        { PCI_DEVICE(BE_VENDOR_ID, OC_DEVICE_ID1) },
+        { PCI_DEVICE(BE_VENDOR_ID, OC_DEVICE_ID2) },
         { 0 }
 };
 MODULE_DEVICE_TABLE(pci, be_dev_ids);
@@ -1859,7 +1859,7 @@ static int __devinit be_probe(struct pci_dev *pdev,
         if (status != 0)
                 goto stats_clean;
 
-        dev_info(&pdev->dev, BE_NAME " port %d\n", adapter->port_num);
+        dev_info(&pdev->dev, "%s port %d\n", nic_name(pdev), adapter->port_num);
         return 0;
 
 stats_clean:
@@ -1873,7 +1873,7 @@ rel_reg:
 disable_dev:
         pci_disable_device(pdev);
 do_none:
-        dev_warn(&pdev->dev, BE_NAME " initialization failed\n");
+        dev_err(&pdev->dev, "%s initialization failed\n", nic_name(pdev));
         return status;
 }
 
diff --git a/drivers/net/bnx2.c b/drivers/net/bnx2.c
index d47839184a06..b0cb29d4cc01 100644
--- a/drivers/net/bnx2.c
+++ b/drivers/net/bnx2.c
@@ -54,8 +54,8 @@
 
 #define DRV_MODULE_NAME         "bnx2"
 #define PFX DRV_MODULE_NAME     ": "
-#define DRV_MODULE_VERSION      "2.0.0"
-#define DRV_MODULE_RELDATE      "April 2, 2009"
+#define DRV_MODULE_VERSION      "2.0.1"
+#define DRV_MODULE_RELDATE      "May 6, 2009"
 #define FW_MIPS_FILE_06         "bnx2/bnx2-mips-06-4.6.16.fw"
 #define FW_RV2P_FILE_06         "bnx2/bnx2-rv2p-06-4.6.16.fw"
 #define FW_MIPS_FILE_09         "bnx2/bnx2-mips-09-4.6.17.fw"
@@ -2600,6 +2600,7 @@ bnx2_get_hw_tx_cons(struct bnx2_napi *bnapi)
         /* Tell compiler that status block fields can change. */
         barrier();
         cons = *bnapi->hw_tx_cons_ptr;
+        barrier();
         if (unlikely((cons & MAX_TX_DESC_CNT) == MAX_TX_DESC_CNT))
                 cons++;
         return cons;
@@ -2879,6 +2880,7 @@ bnx2_get_hw_rx_cons(struct bnx2_napi *bnapi)
         /* Tell compiler that status block fields can change. */
         barrier();
         cons = *bnapi->hw_rx_cons_ptr;
+        barrier();
         if (unlikely((cons & MAX_RX_DESC_CNT) == MAX_RX_DESC_CNT))
                 cons++;
         return cons;
diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c
index 8c2e5ab51f08..faf094abef7f 100644
--- a/drivers/net/bonding/bond_3ad.c
+++ b/drivers/net/bonding/bond_3ad.c
@@ -1465,6 +1465,12 @@ static struct aggregator *ad_agg_selection_test(struct aggregator *best,
         return best;
 }
 
+static int agg_device_up(const struct aggregator *agg)
+{
+        return (netif_running(agg->slave->dev) &&
+                netif_carrier_ok(agg->slave->dev));
+}
+
 /**
  * ad_agg_selection_logic - select an aggregation group for a team
  * @aggregator: the aggregator we're looking at
@@ -1496,14 +1502,13 @@ static void ad_agg_selection_logic(struct aggregator *agg)
         struct port *port;
 
         origin = agg;
-
         active = __get_active_agg(agg);
-        best = active;
+        best = (active && agg_device_up(active)) ? active : NULL;
 
         do {
                 agg->is_active = 0;
 
-                if (agg->num_of_ports)
+                if (agg->num_of_ports && agg_device_up(agg))
                         best = ad_agg_selection_test(best, agg);
 
         } while ((agg = __get_next_agg(agg)));
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 2188a96fc090..74824028f85c 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -5181,7 +5181,6 @@ static int __init bonding_init(void)
 {
         int i;
         int res;
-        struct bonding *bond;
 
         printk(KERN_INFO "%s", version);
 
@@ -5212,13 +5211,6 @@ static int __init bonding_init(void)
 
         goto out;
 err:
-        list_for_each_entry(bond, &bond_dev_list, bond_list) {
-                bond_work_cancel_all(bond);
-                destroy_workqueue(bond->wq);
-        }
-
-        bond_destroy_sysfs();
-
         rtnl_lock();
         bond_free_all();
         rtnl_unlock();
diff --git a/drivers/net/gianfar.c b/drivers/net/gianfar.c
index b2c49679bba7..a0519184e54e 100644
--- a/drivers/net/gianfar.c
+++ b/drivers/net/gianfar.c
@@ -1885,8 +1885,17 @@ int gfar_clean_rx_ring(struct net_device *dev, int rx_work_limit)
 
                         if (unlikely(!newskb))
                                 newskb = skb;
-                        else if (skb)
+                        else if (skb) {
+                                /*
+                                 * We need to reset ->data to what it
+                                 * was before gfar_new_skb() re-aligned
+                                 * it to an RXBUF_ALIGNMENT boundary
+                                 * before we put the skb back on the
+                                 * recycle list.
+                                 */
+                                skb->data = skb->head + NET_SKB_PAD;
                                 __skb_queue_head(&priv->rx_recycle, skb);
+                        }
                 } else {
                         /* Increment the number of packets */
                         dev->stats.rx_packets++;
diff --git a/drivers/net/igb/igb_main.c b/drivers/net/igb/igb_main.c
index 08c801490c72..e25343588fc7 100644
--- a/drivers/net/igb/igb_main.c
+++ b/drivers/net/igb/igb_main.c
@@ -2006,7 +2006,7 @@ static void igb_setup_rctl(struct igb_adapter *adapter)
         struct e1000_hw *hw = &adapter->hw;
         u32 rctl;
         u32 srrctl = 0;
-        int i, j;
+        int i;
 
         rctl = rd32(E1000_RCTL);
 
@@ -2071,8 +2071,6 @@ static void igb_setup_rctl(struct igb_adapter *adapter)
         if (adapter->vfs_allocated_count) {
                 u32 vmolr;
 
-                j = adapter->rx_ring[0].reg_idx;
-
                 /* set all queue drop enable bits */
                 wr32(E1000_QDE, ALL_QUEUES);
                 srrctl |= E1000_SRRCTL_DROP_EN;
@@ -2080,16 +2078,16 @@ static void igb_setup_rctl(struct igb_adapter *adapter)
                 /* disable queue 0 to prevent tail write w/o re-config */
                 wr32(E1000_RXDCTL(0), 0);
 
-                vmolr = rd32(E1000_VMOLR(j));
+                vmolr = rd32(E1000_VMOLR(adapter->vfs_allocated_count));
                 if (rctl & E1000_RCTL_LPE)
                         vmolr |= E1000_VMOLR_LPE;
-                if (adapter->num_rx_queues > 0)
+                if (adapter->num_rx_queues > 1)
                         vmolr |= E1000_VMOLR_RSSE;
-                wr32(E1000_VMOLR(j), vmolr);
+                wr32(E1000_VMOLR(adapter->vfs_allocated_count), vmolr);
         }
 
         for (i = 0; i < adapter->num_rx_queues; i++) {
-                j = adapter->rx_ring[i].reg_idx;
+                int j = adapter->rx_ring[i].reg_idx;
                 wr32(E1000_SRRCTL(j), srrctl);
         }
 
diff --git a/drivers/net/mac8390.c b/drivers/net/mac8390.c
index 8e884869a05b..f26667d5eaae 100644
--- a/drivers/net/mac8390.c
+++ b/drivers/net/mac8390.c
@@ -304,7 +304,7 @@ struct net_device * __init mac8390_probe(int unit)
         if (!MACH_IS_MAC)
                 return ERR_PTR(-ENODEV);
 
-        dev = alloc_ei_netdev();
+        dev = ____alloc_ei_netdev(0);
         if (!dev)
                 return ERR_PTR(-ENOMEM);
 
@@ -481,10 +481,10 @@ void cleanup_module(void)
 static const struct net_device_ops mac8390_netdev_ops = {
         .ndo_open               = mac8390_open,
         .ndo_stop               = mac8390_close,
-        .ndo_start_xmit         = ei_start_xmit,
-        .ndo_tx_timeout         = ei_tx_timeout,
-        .ndo_get_stats          = ei_get_stats,
-        .ndo_set_multicast_list = ei_set_multicast_list,
+        .ndo_start_xmit         = __ei_start_xmit,
+        .ndo_tx_timeout         = __ei_tx_timeout,
+        .ndo_get_stats          = __ei_get_stats,
+        .ndo_set_multicast_list = __ei_set_multicast_list,
         .ndo_validate_addr      = eth_validate_addr,
         .ndo_set_mac_address    = eth_mac_addr,
         .ndo_change_mtu         = eth_change_mtu,
diff --git a/drivers/net/meth.c b/drivers/net/meth.c
index aa08987f6e81..dbd3436912b8 100644
--- a/drivers/net/meth.c
+++ b/drivers/net/meth.c
@@ -127,11 +127,11 @@ static unsigned long mdio_read(struct meth_private *priv, unsigned long phyreg)
 static int mdio_probe(struct meth_private *priv)
 {
         int i;
-        unsigned long p2, p3;
+        unsigned long p2, p3, flags;
         /* check if phy is detected already */
         if(priv->phy_addr>=0&&priv->phy_addr<32)
                 return 0;
-        spin_lock(&priv->meth_lock);
+        spin_lock_irqsave(&priv->meth_lock, flags);
         for (i=0;i<32;++i){
                 priv->phy_addr=i;
                 p2=mdio_read(priv,2);
@@ -157,7 +157,7 @@ static int mdio_probe(struct meth_private *priv)
                         break;
                 }
         }
-        spin_unlock(&priv->meth_lock);
+        spin_unlock_irqrestore(&priv->meth_lock, flags);
         if(priv->phy_addr<32) {
                 return 0;
         }
@@ -373,14 +373,14 @@ static int meth_release(struct net_device *dev)
 static void meth_rx(struct net_device* dev, unsigned long int_status)
 {
         struct sk_buff *skb;
-        unsigned long status;
+        unsigned long status, flags;
         struct meth_private *priv = netdev_priv(dev);
         unsigned long fifo_rptr = (int_status & METH_INT_RX_RPTR_MASK) >> 8;
 
-        spin_lock(&priv->meth_lock);
+        spin_lock_irqsave(&priv->meth_lock, flags);
         priv->dma_ctrl &= ~METH_DMA_RX_INT_EN;
         mace->eth.dma_ctrl = priv->dma_ctrl;
-        spin_unlock(&priv->meth_lock);
+        spin_unlock_irqrestore(&priv->meth_lock, flags);
 
         if (int_status & METH_INT_RX_UNDERFLOW) {
                 fifo_rptr = (fifo_rptr - 1) & 0x0f;
@@ -452,12 +452,12 @@ static void meth_rx(struct net_device* dev, unsigned long int_status)
                 mace->eth.rx_fifo = priv->rx_ring_dmas[priv->rx_write];
                 ADVANCE_RX_PTR(priv->rx_write);
         }
-        spin_lock(&priv->meth_lock);
+        spin_lock_irqsave(&priv->meth_lock, flags);
         /* In case there was underflow, and Rx DMA was disabled */
         priv->dma_ctrl |= METH_DMA_RX_INT_EN | METH_DMA_RX_EN;
         mace->eth.dma_ctrl = priv->dma_ctrl;
         mace->eth.int_stat = METH_INT_RX_THRESHOLD;
-        spin_unlock(&priv->meth_lock);
+        spin_unlock_irqrestore(&priv->meth_lock, flags);
 }
 
 static int meth_tx_full(struct net_device *dev)
@@ -470,11 +470,11 @@ static int meth_tx_full(struct net_device *dev)
 static void meth_tx_cleanup(struct net_device* dev, unsigned long int_status)
 {
         struct meth_private *priv = netdev_priv(dev);
-        unsigned long status;
+        unsigned long status, flags;
         struct sk_buff *skb;
         unsigned long rptr = (int_status&TX_INFO_RPTR) >> 16;
 
-        spin_lock(&priv->meth_lock);
+        spin_lock_irqsave(&priv->meth_lock, flags);
 
         /* Stop DMA notification */
         priv->dma_ctrl &= ~(METH_DMA_TX_INT_EN);
@@ -527,12 +527,13 @@ static void meth_tx_cleanup(struct net_device* dev, unsigned long int_status)
         }
 
         mace->eth.int_stat = METH_INT_TX_EMPTY | METH_INT_TX_PKT;
-        spin_unlock(&priv->meth_lock);
+        spin_unlock_irqrestore(&priv->meth_lock, flags);
 }
 
 static void meth_error(struct net_device* dev, unsigned status)
 {
         struct meth_private *priv = netdev_priv(dev);
+        unsigned long flags;
 
         printk(KERN_WARNING "meth: error status: 0x%08x\n",status);
         /* check for errors too... */
@@ -547,7 +548,7 @@ static void meth_error(struct net_device* dev, unsigned status)
                 printk(KERN_WARNING "meth: Rx overflow\n");
         if (status & (METH_INT_RX_UNDERFLOW)) {
                 printk(KERN_WARNING "meth: Rx underflow\n");
-                spin_lock(&priv->meth_lock);
+                spin_lock_irqsave(&priv->meth_lock, flags);
                 mace->eth.int_stat = METH_INT_RX_UNDERFLOW;
                 /* more underflow interrupts will be delivered,
                  * effectively throwing us into an infinite loop.
@@ -555,7 +556,7 @@ static void meth_error(struct net_device* dev, unsigned status)
                 priv->dma_ctrl &= ~METH_DMA_RX_EN;
                 mace->eth.dma_ctrl = priv->dma_ctrl;
                 DPRINTK("Disabled meth Rx DMA temporarily\n");
-                spin_unlock(&priv->meth_lock);
+                spin_unlock_irqrestore(&priv->meth_lock, flags);
         }
         mace->eth.int_stat = METH_INT_ERROR;
 }
diff --git a/drivers/net/mlx4/en_cq.c b/drivers/net/mlx4/en_cq.c
index 91f50de84be9..a276125b709b 100644
--- a/drivers/net/mlx4/en_cq.c
+++ b/drivers/net/mlx4/en_cq.c
@@ -125,8 +125,10 @@ void mlx4_en_deactivate_cq(struct mlx4_en_priv *priv, struct mlx4_en_cq *cq)
 
         if (cq->is_tx)
                 del_timer(&cq->timer);
-        else
+        else {
                 napi_disable(&cq->napi);
+                netif_napi_del(&cq->napi);
+        }
 
         mlx4_cq_free(mdev->dev, &cq->mcq);
 }
diff --git a/drivers/net/mlx4/en_rx.c b/drivers/net/mlx4/en_rx.c
index 7942c4d3cd88..9ee873e872b3 100644
--- a/drivers/net/mlx4/en_rx.c
+++ b/drivers/net/mlx4/en_rx.c
@@ -951,7 +951,6 @@ static int mlx4_en_config_rss_qp(struct mlx4_en_priv *priv,
         if (err) {
                 mlx4_err(mdev, "Failed to allocate qp #%d\n", qpn);
                 goto out;
-                return err;
         }
         qp->event = mlx4_en_sqp_event;
 
diff --git a/drivers/net/mv643xx_eth.c b/drivers/net/mv643xx_eth.c
index a400d7115f78..6bb5af35eda6 100644
--- a/drivers/net/mv643xx_eth.c
+++ b/drivers/net/mv643xx_eth.c
@@ -569,7 +569,7 @@ static int rxq_process(struct rx_queue *rxq, int budget)
                 if (rxq->rx_curr_desc == rxq->rx_ring_size)
                         rxq->rx_curr_desc = 0;
 
-                dma_unmap_single(NULL, rx_desc->buf_ptr,
+                dma_unmap_single(mp->dev->dev.parent, rx_desc->buf_ptr,
                                  rx_desc->buf_size, DMA_FROM_DEVICE);
                 rxq->rx_desc_count--;
                 rx++;
@@ -678,8 +678,9 @@ static int rxq_refill(struct rx_queue *rxq, int budget)
 
                 rx_desc = rxq->rx_desc_area + rx;
 
-                rx_desc->buf_ptr = dma_map_single(NULL, skb->data,
-                                        mp->skb_size, DMA_FROM_DEVICE);
+                rx_desc->buf_ptr = dma_map_single(mp->dev->dev.parent,
+                                                  skb->data, mp->skb_size,
+                                                  DMA_FROM_DEVICE);
                 rx_desc->buf_size = mp->skb_size;
                 rxq->rx_skb[rx] = skb;
                 wmb();
@@ -718,6 +719,7 @@ static inline unsigned int has_tiny_unaligned_frags(struct sk_buff *skb)
 
 static void txq_submit_frag_skb(struct tx_queue *txq, struct sk_buff *skb)
 {
+        struct mv643xx_eth_private *mp = txq_to_mp(txq);
         int nr_frags = skb_shinfo(skb)->nr_frags;
         int frag;
 
@@ -746,10 +748,10 @@ static void txq_submit_frag_skb(struct tx_queue *txq, struct sk_buff *skb)
 
                 desc->l4i_chk = 0;
                 desc->byte_cnt = this_frag->size;
-                desc->buf_ptr = dma_map_page(NULL, this_frag->page,
-                                                this_frag->page_offset,
-                                                this_frag->size,
-                                                DMA_TO_DEVICE);
+                desc->buf_ptr = dma_map_page(mp->dev->dev.parent,
+                                             this_frag->page,
+                                             this_frag->page_offset,
+                                             this_frag->size, DMA_TO_DEVICE);
         }
 }
 
@@ -826,7 +828,8 @@ no_csum:
 
         desc->l4i_chk = l4i_chk;
         desc->byte_cnt = length;
-        desc->buf_ptr = dma_map_single(NULL, skb->data, length, DMA_TO_DEVICE);
+        desc->buf_ptr = dma_map_single(mp->dev->dev.parent, skb->data,
+                                       length, DMA_TO_DEVICE);
 
         __skb_queue_tail(&txq->tx_skb, skb);
 
@@ -956,10 +959,10 @@ static int txq_reclaim(struct tx_queue *txq, int budget, int force)
                 }
 
                 if (cmd_sts & TX_FIRST_DESC) {
-                        dma_unmap_single(NULL, desc->buf_ptr,
+                        dma_unmap_single(mp->dev->dev.parent, desc->buf_ptr,
                                          desc->byte_cnt, DMA_TO_DEVICE);
                 } else {
-                        dma_unmap_page(NULL, desc->buf_ptr,
+                        dma_unmap_page(mp->dev->dev.parent, desc->buf_ptr,
                                        desc->byte_cnt, DMA_TO_DEVICE);
                 }
 
@@ -1894,9 +1897,9 @@ static int rxq_init(struct mv643xx_eth_private *mp, int index)
                                                 mp->rx_desc_sram_size);
                 rxq->rx_desc_dma = mp->rx_desc_sram_addr;
         } else {
-                rxq->rx_desc_area = dma_alloc_coherent(NULL, size,
-                                                        &rxq->rx_desc_dma,
-                                                        GFP_KERNEL);
+                rxq->rx_desc_area = dma_alloc_coherent(mp->dev->dev.parent,
+                                                       size, &rxq->rx_desc_dma,
+                                                       GFP_KERNEL);
         }
 
         if (rxq->rx_desc_area == NULL) {
@@ -1947,7 +1950,7 @@ out_free:
         if (index == 0 && size <= mp->rx_desc_sram_size)
                 iounmap(rxq->rx_desc_area);
         else
-                dma_free_coherent(NULL, size,
+                dma_free_coherent(mp->dev->dev.parent, size,
                                   rxq->rx_desc_area,
                                   rxq->rx_desc_dma);
 
@@ -1979,7 +1982,7 @@ static void rxq_deinit(struct rx_queue *rxq)
             rxq->rx_desc_area_size <= mp->rx_desc_sram_size)
                 iounmap(rxq->rx_desc_area);
         else
-                dma_free_coherent(NULL, rxq->rx_desc_area_size,
+                dma_free_coherent(mp->dev->dev.parent, rxq->rx_desc_area_size,
                                   rxq->rx_desc_area, rxq->rx_desc_dma);
 
         kfree(rxq->rx_skb);
@@ -2007,9 +2010,9 @@ static int txq_init(struct mv643xx_eth_private *mp, int index)
                                                 mp->tx_desc_sram_size);
                 txq->tx_desc_dma = mp->tx_desc_sram_addr;
         } else {
-                txq->tx_desc_area = dma_alloc_coherent(NULL, size,
-                                                        &txq->tx_desc_dma,
-                                                        GFP_KERNEL);
+                txq->tx_desc_area = dma_alloc_coherent(mp->dev->dev.parent,
+                                                       size, &txq->tx_desc_dma,
+                                                       GFP_KERNEL);
         }
 
         if (txq->tx_desc_area == NULL) {
@@ -2053,7 +2056,7 @@ static void txq_deinit(struct tx_queue *txq)
             txq->tx_desc_area_size <= mp->tx_desc_sram_size)
                 iounmap(txq->tx_desc_area);
         else
-                dma_free_coherent(NULL, txq->tx_desc_area_size,
+                dma_free_coherent(mp->dev->dev.parent, txq->tx_desc_area_size,
                                   txq->tx_desc_area, txq->tx_desc_dma);
 }
 
diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
index 0b6e8c896835..8247a945a1d9 100644
--- a/drivers/net/r8169.c
+++ b/drivers/net/r8169.c
@@ -3554,54 +3554,64 @@ static irqreturn_t rtl8169_interrupt(int irq, void *dev_instance)
         int handled = 0;
         int status;
 
+        /* loop handling interrupts until we have no new ones or
+         * we hit a invalid/hotplug case.
+         */
         status = RTL_R16(IntrStatus);
+        while (status && status != 0xffff) {
+                handled = 1;
 
-        /* hotplug/major error/no more work/shared irq */
-        if ((status == 0xffff) || !status)
-                goto out;
-
-        handled = 1;
+                /* Handle all of the error cases first. These will reset
+                 * the chip, so just exit the loop.
+                 */
+                if (unlikely(!netif_running(dev))) {
+                        rtl8169_asic_down(ioaddr);
+                        break;
+                }
 
-        if (unlikely(!netif_running(dev))) {
-                rtl8169_asic_down(ioaddr);
-                goto out;
-        }
+                /* Work around for rx fifo overflow */
+                if (unlikely(status & RxFIFOOver) &&
+                (tp->mac_version == RTL_GIGA_MAC_VER_11)) {
+                        netif_stop_queue(dev);
+                        rtl8169_tx_timeout(dev);
+                        break;
+                }
 
-        status &= tp->intr_mask;
-        RTL_W16(IntrStatus,
-                (status & RxFIFOOver) ? (status | RxOverflow) : status);
+                if (unlikely(status & SYSErr)) {
+                        rtl8169_pcierr_interrupt(dev);
+                        break;
+                }
 
-        if (!(status & tp->intr_event))
-                goto out;
+                if (status & LinkChg)
+                        rtl8169_check_link_status(dev, tp, ioaddr);
 
-        /* Work around for rx fifo overflow */
-        if (unlikely(status & RxFIFOOver) &&
-            (tp->mac_version == RTL_GIGA_MAC_VER_11)) {
-                netif_stop_queue(dev);
-                rtl8169_tx_timeout(dev);
-                goto out;
-        }
+                /* We need to see the lastest version of tp->intr_mask to
+                 * avoid ignoring an MSI interrupt and having to wait for
+                 * another event which may never come.
+                 */
+                smp_rmb();
+                if (status & tp->intr_mask & tp->napi_event) {
+                        RTL_W16(IntrMask, tp->intr_event & ~tp->napi_event);
+                        tp->intr_mask = ~tp->napi_event;
+
+                        if (likely(napi_schedule_prep(&tp->napi)))
+                                __napi_schedule(&tp->napi);
+                        else if (netif_msg_intr(tp)) {
+                                printk(KERN_INFO "%s: interrupt %04x in poll\n",
+                                dev->name, status);
+                        }
+                }
 
-        if (unlikely(status & SYSErr)) {
-                rtl8169_pcierr_interrupt(dev);
-                goto out;
+                /* We only get a new MSI interrupt when all active irq
+                 * sources on the chip have been acknowledged. So, ack
+                 * everything we've seen and check if new sources have become
+                 * active to avoid blocking all interrupts from the chip.
+                 */
+                RTL_W16(IntrStatus,
+                        (status & RxFIFOOver) ? (status | RxOverflow) : status);
+                status = RTL_R16(IntrStatus);
         }
 
-        if (status & LinkChg)
-                rtl8169_check_link_status(dev, tp, ioaddr);
-
-        if (status & tp->napi_event) {
-                RTL_W16(IntrMask, tp->intr_event & ~tp->napi_event);
-                tp->intr_mask = ~tp->napi_event;
-
-                if (likely(napi_schedule_prep(&tp->napi)))
-                        __napi_schedule(&tp->napi);
-                else if (netif_msg_intr(tp)) {
-                        printk(KERN_INFO "%s: interrupt %04x in poll\n",
-                               dev->name, status);
-                }
-        }
-out:
         return IRQ_RETVAL(handled);
 }
 
@@ -3617,13 +3627,15 @@ static int rtl8169_poll(struct napi_struct *napi, int budget)
 
         if (work_done < budget) {
                 napi_complete(napi);
-                tp->intr_mask = 0xffff;
-                /*
-                 * 20040426: the barrier is not strictly required but the
-                 * behavior of the irq handler could be less predictable
-                 * without it. Btw, the lack of flush for the posted pci
-                 * write is safe - FR
+
+                /* We need for force the visibility of tp->intr_mask
+                 * for other CPUs, as we can loose an MSI interrupt
+                 * and potentially wait for a retransmit timeout if we don't.
+                 * The posted write to IntrMask is safe, as it will
+                 * eventually make it to the chip and we won't loose anything
+                 * until it does.
                  */
+                tp->intr_mask = 0xffff;
                 smp_wmb();
                 RTL_W16(IntrMask, tp->intr_event);
         }
diff --git a/drivers/net/vxge/vxge-traffic.c b/drivers/net/vxge/vxge-traffic.c
index 7be0ae10d69b..c2eeac4125f3 100644
--- a/drivers/net/vxge/vxge-traffic.c
+++ b/drivers/net/vxge/vxge-traffic.c
@@ -115,7 +115,7 @@ enum vxge_hw_status vxge_hw_vpath_intr_enable(struct __vxge_hw_vpath_handle *vp)
                 VXGE_HW_KDFCCTL_ERRORS_REG_KDFCCTL_FIFO1_POISON|
                 VXGE_HW_KDFCCTL_ERRORS_REG_KDFCCTL_FIFO2_POISON|
                 VXGE_HW_KDFCCTL_ERRORS_REG_KDFCCTL_FIFO1_DMA_ERR|
-                VXGE_HW_KDFCCTL_ERRORS_REG_KDFCCTL_FIFO1_DMA_ERR), 0, 32),
+                VXGE_HW_KDFCCTL_ERRORS_REG_KDFCCTL_FIFO2_DMA_ERR), 0, 32),
                 &vp_reg->kdfcctl_errors_mask);
 
         __vxge_hw_pio_mem_write32_upper(0, &vp_reg->vpath_ppif_int_mask);
diff --git a/drivers/net/wan/ixp4xx_hss.c b/drivers/net/wan/ixp4xx_hss.c
index 3bf7d3f447db..765a7f5d6aa4 100644
--- a/drivers/net/wan/ixp4xx_hss.c
+++ b/drivers/net/wan/ixp4xx_hss.c
@@ -1249,7 +1249,7 @@ static int __devinit hss_init_one(struct platform_device *pdev)
                 return -ENOMEM;
 
         if ((port->npe = npe_request(0)) == NULL) {
-                err = -ENOSYS;
+                err = -ENODEV;
                 goto err_free;
         }
 
@@ -1311,7 +1311,7 @@ static int __init hss_init_module(void)
         if ((ixp4xx_read_feature_bits() &
              (IXP4XX_FEATURE_HDLC | IXP4XX_FEATURE_HSS)) !=
             (IXP4XX_FEATURE_HDLC | IXP4XX_FEATURE_HSS))
-                return -ENOSYS;
+                return -ENODEV;
 
         spin_lock_init(&npe_lock);
 
diff --git a/drivers/net/wimax/i2400m/rx.c b/drivers/net/wimax/i2400m/rx.c
index 02419bfd64b5..f9fc38902322 100644
--- a/drivers/net/wimax/i2400m/rx.c
+++ b/drivers/net/wimax/i2400m/rx.c
@@ -819,10 +819,9 @@ void i2400m_roq_queue_update_ws(struct i2400m *i2400m, struct i2400m_roq *roq,
                         roq_data = (struct i2400m_roq_data *) &skb->cb;
                         i2400m_net_erx(i2400m, skb, roq_data->cs);
                 }
-                else {
+                else
                         __i2400m_roq_queue(i2400m, roq, skb, sn, nsn);
-                        __i2400m_roq_update_ws(i2400m, roq, sn + 1);
-                }
+                __i2400m_roq_update_ws(i2400m, roq, sn + 1);
                 i2400m_roq_log_add(i2400m, roq, I2400M_RO_TYPE_PACKET_WS,
                                    old_ws, len, sn, nsn, roq->ws);
         }
diff --git a/drivers/net/wimax/i2400m/usb.c b/drivers/net/wimax/i2400m/usb.c
index ca4151a9e222..17851321b7fd 100644
--- a/drivers/net/wimax/i2400m/usb.c
+++ b/drivers/net/wimax/i2400m/usb.c
@@ -505,27 +505,52 @@ int i2400mu_suspend(struct usb_interface *iface, pm_message_t pm_msg)
 #ifdef CONFIG_PM
         struct usb_device *usb_dev = i2400mu->usb_dev;
 #endif
+        unsigned is_autosuspend = 0;
         struct i2400m *i2400m = &i2400mu->i2400m;
 
+#ifdef CONFIG_PM
+        if (usb_dev->auto_pm > 0)
+                is_autosuspend = 1;
+#endif
+
         d_fnstart(3, dev, "(iface %p pm_msg %u)\n", iface, pm_msg.event);
         if (i2400m->updown == 0)
                 goto no_firmware;
-        d_printf(1, dev, "fw up, requesting standby\n");
+        if (i2400m->state == I2400M_SS_DATA_PATH_CONNECTED && is_autosuspend) {
+                /* ugh -- the device is connected and this suspend
+                 * request is an autosuspend one (not a system standby
+                 * / hibernate).
+                 *
+                 * The only way the device can go to standby is if the
+                 * link with the base station is in IDLE mode; that
+                 * were the case, we'd be in status
+                 * I2400M_SS_CONNECTED_IDLE. But we are not.
+                 *
+                 * If we *tell* him to go power save now, it'll reset
+                 * as a precautionary measure, so if this is an
+                 * autosuspend thing, say no and it'll come back
+                 * later, when the link is IDLE
+                 */
+                result = -EBADF;
+                d_printf(1, dev, "fw up, link up, not-idle, autosuspend: "
+                         "not entering powersave\n");
+                goto error_not_now;
+        }
+        d_printf(1, dev, "fw up: entering powersave\n");
         atomic_dec(&i2400mu->do_autopm);
         result = i2400m_cmd_enter_powersave(i2400m);
         atomic_inc(&i2400mu->do_autopm);
-#ifdef CONFIG_PM
-        if (result < 0 && usb_dev->auto_pm == 0) {
+        if (result < 0 && !is_autosuspend) {
                 /* System suspend, can't fail */
                 dev_err(dev, "failed to suspend, will reset on resume\n");
                 result = 0;
         }
-#endif
         if (result < 0)
                 goto error_enter_powersave;
         i2400mu_notification_release(i2400mu);
-        d_printf(1, dev, "fw up, got standby\n");
+        d_printf(1, dev, "powersave requested\n");
 error_enter_powersave:
+error_not_now:
 no_firmware:
         d_fnend(3, dev, "(iface %p pm_msg %u) = %d\n",
                 iface, pm_msg.event, result);
diff --git a/drivers/net/wireless/airo.c b/drivers/net/wireless/airo.c
index c36d3a3d655f..9eabf4d1f2e7 100644
--- a/drivers/net/wireless/airo.c
+++ b/drivers/net/wireless/airo.c
@@ -6467,6 +6467,7 @@ static int airo_get_encode(struct net_device *dev,
 {
         struct airo_info *local = dev->ml_priv;
         int index = (dwrq->flags & IW_ENCODE_INDEX) - 1;
+        int wep_key_len;
         u8 buf[16];
 
         if (!local->wep_capable)
@@ -6500,8 +6501,13 @@ static int airo_get_encode(struct net_device *dev,
         dwrq->flags |= index + 1;
 
         /* Copy the key to the user buffer */
-        dwrq->length = get_wep_key(local, index, &buf[0], sizeof(buf));
-        memcpy(extra, buf, dwrq->length);
+        wep_key_len = get_wep_key(local, index, &buf[0], sizeof(buf));
+        if (wep_key_len < 0) {
+                dwrq->length = 0;
+        } else {
+                dwrq->length = wep_key_len;
+                memcpy(extra, buf, dwrq->length);
+        }
 
         return 0;
 }
@@ -6614,7 +6620,7 @@ static int airo_get_encodeext(struct net_device *dev,
         struct airo_info *local = dev->ml_priv;
         struct iw_point *encoding = &wrqu->encoding;
         struct iw_encode_ext *ext = (struct iw_encode_ext *)extra;
-        int idx, max_key_len;
+        int idx, max_key_len, wep_key_len;
         u8 buf[16];
 
         if (!local->wep_capable)
@@ -6658,8 +6664,13 @@ static int airo_get_encodeext(struct net_device *dev,
         memset(extra, 0, 16);
         
         /* Copy the key to the user buffer */
-        ext->key_len = get_wep_key(local, idx, &buf[0], sizeof(buf));
-        memcpy(extra, buf, ext->key_len);
+        wep_key_len = get_wep_key(local, idx, &buf[0], sizeof(buf));
+        if (wep_key_len < 0) {
+                ext->key_len = 0;
+        } else {
+                ext->key_len = wep_key_len;
+                memcpy(extra, buf, ext->key_len);
+        }
 
         return 0;
 }
diff --git a/drivers/net/wireless/ath5k/base.c b/drivers/net/wireless/ath5k/base.c
index a08bc8a4fb69..32df27a9c7a2 100644
--- a/drivers/net/wireless/ath5k/base.c
+++ b/drivers/net/wireless/ath5k/base.c
@@ -214,7 +214,7 @@ static struct pci_driver ath5k_pci_driver = {
  * Prototypes - MAC 802.11 stack related functions
  */
 static int ath5k_tx(struct ieee80211_hw *hw, struct sk_buff *skb);
-static int ath5k_reset(struct ath5k_softc *sc, bool stop, bool change_channel);
+static int ath5k_reset(struct ath5k_softc *sc, struct ieee80211_channel *chan);
 static int ath5k_reset_wake(struct ath5k_softc *sc);
 static int ath5k_start(struct ieee80211_hw *hw);
 static void ath5k_stop(struct ieee80211_hw *hw);
@@ -1038,16 +1038,13 @@ ath5k_chan_set(struct ath5k_softc *sc, struct ieee80211_channel *chan)
         if (chan->center_freq != sc->curchan->center_freq ||
                 chan->hw_value != sc->curchan->hw_value) {
 
-                sc->curchan = chan;
-                sc->curband = &sc->sbands[chan->band];
-
                 /*
                  * To switch channels clear any pending DMA operations;
                  * wait long enough for the RX fifo to drain, reset the
                  * hardware at the new frequency, and then re-enable
                  * the relevant bits of the h/w.
                  */
-                return ath5k_reset(sc, true, true);
+                return ath5k_reset(sc, chan);
         }
 
         return 0;
@@ -2314,7 +2311,7 @@ ath5k_init(struct ath5k_softc *sc)
         sc->imask = AR5K_INT_RXOK | AR5K_INT_RXERR | AR5K_INT_RXEOL |
                 AR5K_INT_RXORN | AR5K_INT_TXDESC | AR5K_INT_TXEOL |
                 AR5K_INT_FATAL | AR5K_INT_GLOBAL;
-        ret = ath5k_reset(sc, false, false);
+        ret = ath5k_reset(sc, NULL);
         if (ret)
                 goto done;
 
@@ -2599,18 +2596,25 @@ drop_packet:
         return NETDEV_TX_OK;
 }
 
+/*
+ * Reset the hardware.  If chan is not NULL, then also pause rx/tx
+ * and change to the given channel.
+ */
 static int
-ath5k_reset(struct ath5k_softc *sc, bool stop, bool change_channel)
+ath5k_reset(struct ath5k_softc *sc, struct ieee80211_channel *chan)
 {
         struct ath5k_hw *ah = sc->ah;
         int ret;
 
         ATH5K_DBG(sc, ATH5K_DEBUG_RESET, "resetting\n");
 
-        if (stop) {
+        if (chan) {
                 ath5k_hw_set_imr(ah, 0);
                 ath5k_txq_cleanup(sc);
                 ath5k_rx_stop(sc);
+
+                sc->curchan = chan;
+                sc->curband = &sc->sbands[chan->band];
         }
         ret = ath5k_hw_reset(ah, sc->opmode, sc->curchan, true);
         if (ret) {
@@ -2648,7 +2652,7 @@ ath5k_reset_wake(struct ath5k_softc *sc)
 {
         int ret;
 
-        ret = ath5k_reset(sc, true, true);
+        ret = ath5k_reset(sc, sc->curchan);
         if (!ret)
                 ieee80211_wake_queues(sc->hw);
 
diff --git a/drivers/net/wireless/ath5k/phy.c b/drivers/net/wireless/ath5k/phy.c
index 9e2faae5ae94..b48b29dca3d2 100644
--- a/drivers/net/wireless/ath5k/phy.c
+++ b/drivers/net/wireless/ath5k/phy.c
@@ -1487,28 +1487,35 @@ ath5k_get_linear_pcdac_min(const u8 *stepL, const u8 *stepR,
 {
         s8 tmp;
         s16 min_pwrL, min_pwrR;
-        s16 pwr_i = pwrL[0];
-
-        do {
-                pwr_i--;
-                tmp = (s8) ath5k_get_interpolated_value(pwr_i,
-                                                pwrL[0], pwrL[1],
-                                                stepL[0], stepL[1]);
-
-        } while (tmp > 1);
-
-        min_pwrL = pwr_i;
-
-        pwr_i = pwrR[0];
-        do {
-                pwr_i--;
-                tmp = (s8) ath5k_get_interpolated_value(pwr_i,
-                                                pwrR[0], pwrR[1],
-                                                stepR[0], stepR[1]);
-
-        } while (tmp > 1);
+        s16 pwr_i;
+
+        if (pwrL[0] == pwrL[1])
+                min_pwrL = pwrL[0];
+        else {
+                pwr_i = pwrL[0];
+                do {
+                        pwr_i--;
+                        tmp = (s8) ath5k_get_interpolated_value(pwr_i,
+                                                        pwrL[0], pwrL[1],
+                                                        stepL[0], stepL[1]);
+                } while (tmp > 1);
+
+                min_pwrL = pwr_i;
+        }
 
-        min_pwrR = pwr_i;
+        if (pwrR[0] == pwrR[1])
+                min_pwrR = pwrR[0];
+        else {
+                pwr_i = pwrR[0];
+                do {
+                        pwr_i--;
+                        tmp = (s8) ath5k_get_interpolated_value(pwr_i,
+                                                        pwrR[0], pwrR[1],
+                                                        stepR[0], stepR[1]);
+                } while (tmp > 1);
+
+                min_pwrR = pwr_i;
+        }
 
         /* Keep the right boundary so that it works for both curves */
         return max(min_pwrL, min_pwrR);
diff --git a/drivers/net/wireless/ath5k/reset.c b/drivers/net/wireless/ath5k/reset.c
index 7a17d31b2fd9..5f72c111c2e8 100644
--- a/drivers/net/wireless/ath5k/reset.c
+++ b/drivers/net/wireless/ath5k/reset.c
@@ -26,7 +26,7 @@
 \*****************************/
 
 #include <linux/pci.h>          /* To determine if a card is pci-e */
-#include <linux/bitops.h>       /* For get_bitmask_order */
+#include <linux/log2.h>
 #include "ath5k.h"
 #include "reg.h"
 #include "base.h"
@@ -69,10 +69,10 @@ static inline int ath5k_hw_write_ofdm_timings(struct ath5k_hw *ah,
 
         /* Get exponent
          * ALGO: coef_exp = 14 - highest set bit position */
-        coef_exp = get_bitmask_order(coef_scaled);
+        coef_exp = ilog2(coef_scaled);
 
         /* Doesn't make sense if it's zero*/
-        if (!coef_exp)
+        if (!coef_scaled || !coef_exp)
                 return -EINVAL;
 
         /* Note: we've shifted coef_scaled by 24 */
@@ -359,7 +359,7 @@ int ath5k_hw_nic_wakeup(struct ath5k_hw *ah, int flags, bool initial)
                         mode |= AR5K_PHY_MODE_FREQ_5GHZ;
 
                         if (ah->ah_radio == AR5K_RF5413)
-                                clock |= AR5K_PHY_PLL_40MHZ_5413;
+                                clock = AR5K_PHY_PLL_40MHZ_5413;
                         else
                                 clock |= AR5K_PHY_PLL_40MHZ;
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-5000.c b/drivers/net/wireless/iwlwifi/iwl-5000.c
index e5ca2511a81a..9452461ce864 100644
--- a/drivers/net/wireless/iwlwifi/iwl-5000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-5000.c
@@ -46,7 +46,7 @@
 #include "iwl-6000-hw.h"
 
 /* Highest firmware API version supported */
-#define IWL5000_UCODE_API_MAX 1
+#define IWL5000_UCODE_API_MAX 2
 #define IWL5150_UCODE_API_MAX 2
 
 /* Lowest firmware API version supported */
diff --git a/drivers/net/wireless/iwlwifi/iwl-6000.c b/drivers/net/wireless/iwlwifi/iwl-6000.c
index edfa5e149f71..bd438d8acf55 100644
--- a/drivers/net/wireless/iwlwifi/iwl-6000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-6000.c
@@ -101,8 +101,8 @@ struct iwl_cfg iwl6000_2agn_cfg = {
         .eeprom_ver = EEPROM_5000_EEPROM_VERSION,
         .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
         .mod_params = &iwl50_mod_params,
-        .valid_tx_ant = ANT_BC,
-        .valid_rx_ant = ANT_BC,
+        .valid_tx_ant = ANT_AB,
+        .valid_rx_ant = ANT_AB,
         .need_pll_cfg = false,
 };
 
@@ -117,8 +117,8 @@ struct iwl_cfg iwl6050_2agn_cfg = {
         .eeprom_ver = EEPROM_5000_EEPROM_VERSION,
         .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
         .mod_params = &iwl50_mod_params,
-        .valid_tx_ant = ANT_BC,
-        .valid_rx_ant = ANT_BC,
+        .valid_tx_ant = ANT_AB,
+        .valid_rx_ant = ANT_AB,
         .need_pll_cfg = false,
 };
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index 1ef4192207a5..f46ba2475776 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -669,13 +669,6 @@ static int iwl_set_mode(struct iwl_priv *priv, int mode)
         if (!iwl_is_ready_rf(priv))
                 return -EAGAIN;
 
-        cancel_delayed_work(&priv->scan_check);
-        if (iwl_scan_cancel_timeout(priv, 100)) {
-                IWL_WARN(priv, "Aborted scan still in progress after 100ms\n");
-                IWL_DEBUG_MAC80211(priv, "leaving - scan abort failed.\n");
-                return -EAGAIN;
-        }
-
         iwl_commit_rxon(priv);
 
         return 0;
@@ -3636,7 +3629,9 @@ static struct pci_device_id iwl_hw_card_ids[] = {
         {IWL_PCI_DEVICE(0x0085, 0x1112, iwl6000_2ag_cfg)},
         {IWL_PCI_DEVICE(0x0082, 0x1122, iwl6000_2ag_cfg)},
         {IWL_PCI_DEVICE(0x422B, PCI_ANY_ID, iwl6000_3agn_cfg)},
+        {IWL_PCI_DEVICE(0x422C, PCI_ANY_ID, iwl6000_2agn_cfg)},
         {IWL_PCI_DEVICE(0x4238, PCI_ANY_ID, iwl6000_3agn_cfg)},
+        {IWL_PCI_DEVICE(0x4239, PCI_ANY_ID, iwl6000_2agn_cfg)},
         {IWL_PCI_DEVICE(0x0082, PCI_ANY_ID, iwl6000_2agn_cfg)},
         {IWL_PCI_DEVICE(0x0085, PCI_ANY_ID, iwl6000_3agn_cfg)},
         {IWL_PCI_DEVICE(0x0086, PCI_ANY_ID, iwl6050_3agn_cfg)},
diff --git a/drivers/net/wireless/iwlwifi/iwl-scan.c b/drivers/net/wireless/iwlwifi/iwl-scan.c
index e7c65c4f741b..6330b91e37ce 100644
--- a/drivers/net/wireless/iwlwifi/iwl-scan.c
+++ b/drivers/net/wireless/iwlwifi/iwl-scan.c
@@ -227,9 +227,6 @@ static void iwl_rx_scan_complete_notif(struct iwl_priv *priv,
         /* The HW is no longer scanning */
         clear_bit(STATUS_SCAN_HW, &priv->status);
 
-        /* The scan completion notification came in, so kill that timer... */
-        cancel_delayed_work(&priv->scan_check);
-
         IWL_DEBUG_INFO(priv, "Scan pass on %sGHz took %dms\n",
                        (priv->scan_bands & BIT(IEEE80211_BAND_2GHZ)) ?
                                                 "2.4" : "5.2",
@@ -712,6 +709,8 @@ static void iwl_bg_request_scan(struct work_struct *data)
 
         mutex_lock(&priv->mutex);
 
+        cancel_delayed_work(&priv->scan_check);
+
         if (!iwl_is_ready(priv)) {
                 IWL_WARN(priv, "request scan called when driver not ready.\n");
                 goto done;
@@ -925,6 +924,8 @@ void iwl_bg_scan_completed(struct work_struct *work)
 
         IWL_DEBUG_SCAN(priv, "SCAN complete scan\n");
 
+        cancel_delayed_work(&priv->scan_check);
+
         ieee80211_scan_completed(priv->hw, false);
 
         if (test_bit(STATUS_EXIT_PENDING, &priv->status))
diff --git a/drivers/net/wireless/iwlwifi/iwl-sta.c b/drivers/net/wireless/iwlwifi/iwl-sta.c
index 5798fe49c771..44ab03a12e40 100644
--- a/drivers/net/wireless/iwlwifi/iwl-sta.c
+++ b/drivers/net/wireless/iwlwifi/iwl-sta.c
@@ -719,6 +719,14 @@ static int iwl_set_tkip_dynamic_key_info(struct iwl_priv *priv,
 {
         unsigned long flags;
         int ret = 0;
+        __le16 key_flags = 0;
+
+        key_flags |= (STA_KEY_FLG_TKIP | STA_KEY_FLG_MAP_KEY_MSK);
+        key_flags |= cpu_to_le16(keyconf->keyidx << STA_KEY_FLG_KEYID_POS);
+        key_flags &= ~STA_KEY_FLG_INVALID;
+
+        if (sta_id == priv->hw_params.bcast_sta_id)
+                key_flags |= STA_KEY_MULTICAST_MSK;
 
         keyconf->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
         keyconf->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIC;
@@ -738,6 +746,9 @@ static int iwl_set_tkip_dynamic_key_info(struct iwl_priv *priv,
         WARN(priv->stations[sta_id].sta.key.key_offset == WEP_INVALID_OFFSET,
                 "no space for a new key");
 
+        priv->stations[sta_id].sta.key.key_flags = key_flags;
+
+
         /* This copy is acutally not needed: we get the key with each TX */
         memcpy(priv->stations[sta_id].keyinfo.key, keyconf->key, 16);
 
@@ -754,9 +765,7 @@ void iwl_update_tkip_key(struct iwl_priv *priv,
 {
         u8 sta_id = IWL_INVALID_STATION;
         unsigned long flags;
-        __le16 key_flags = 0;
         int i;
-        DECLARE_MAC_BUF(mac);
 
         sta_id = iwl_find_station(priv, addr);
         if (sta_id == IWL_INVALID_STATION) {
@@ -771,16 +780,8 @@ void iwl_update_tkip_key(struct iwl_priv *priv,
                 return;
         }
 
-        key_flags |= (STA_KEY_FLG_TKIP | STA_KEY_FLG_MAP_KEY_MSK);
-        key_flags |= cpu_to_le16(keyconf->keyidx << STA_KEY_FLG_KEYID_POS);
-        key_flags &= ~STA_KEY_FLG_INVALID;
-
-        if (sta_id == priv->hw_params.bcast_sta_id)
-                key_flags |= STA_KEY_MULTICAST_MSK;
-
         spin_lock_irqsave(&priv->sta_lock, flags);
 
-        priv->stations[sta_id].sta.key.key_flags = key_flags;
         priv->stations[sta_id].sta.key.tkip_rx_tsc_byte2 = (u8) iv32;
 
         for (i = 0; i < 5; i++)
diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
index 70a00c8ee42e..ff4d0e41d7c4 100644
--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -782,13 +782,6 @@ static int iwl3945_set_mode(struct iwl_priv *priv, int mode)
         if (!iwl_is_ready_rf(priv))
                 return -EAGAIN;
 
-        cancel_delayed_work(&priv->scan_check);
-        if (iwl_scan_cancel_timeout(priv, 100)) {
-                IWL_WARN(priv, "Aborted scan still in progress after 100ms\n");
-                IWL_DEBUG_MAC80211(priv, "leaving - scan abort failed.\n");
-                return -EAGAIN;
-        }
-
         iwl3945_commit_rxon(priv);
 
         return 0;
@@ -1744,7 +1737,6 @@ static void iwl3945_rx_queue_free(struct iwl_priv *priv, struct iwl_rx_queue *rx
         rxq->bd = NULL;
         rxq->rb_stts  = NULL;
 }
-EXPORT_SYMBOL(iwl3945_rx_queue_free);
 
 
 /* Convert linear signal-to-noise ratio into dB */
@@ -3299,6 +3291,8 @@ static void iwl3945_bg_request_scan(struct work_struct *data)
 
         mutex_lock(&priv->mutex);
 
+        cancel_delayed_work(&priv->scan_check);
+
         if (!iwl_is_ready(priv)) {
                 IWL_WARN(priv, "request scan called when driver not ready.\n");
                 goto done;
diff --git a/drivers/net/wireless/rt2x00/rt2x00debug.c b/drivers/net/wireless/rt2x00/rt2x00debug.c
index 07d378ef0b46..7b3ee8c2eaef 100644
--- a/drivers/net/wireless/rt2x00/rt2x00debug.c
+++ b/drivers/net/wireless/rt2x00/rt2x00debug.c
@@ -138,7 +138,7 @@ void rt2x00debug_update_crypto(struct rt2x00_dev *rt2x00dev,
 
         if (cipher == CIPHER_TKIP_NO_MIC)
                 cipher = CIPHER_TKIP;
-        if (cipher == CIPHER_NONE || cipher > CIPHER_MAX)
+        if (cipher == CIPHER_NONE || cipher >= CIPHER_MAX)
                 return;
 
         /* Remove CIPHER_NONE index */
diff --git a/drivers/net/wireless/rtl818x/rtl8187.h b/drivers/net/wireless/rtl818x/rtl8187.h
index 9718f61809cf..edeff82a4d06 100644
--- a/drivers/net/wireless/rtl818x/rtl8187.h
+++ b/drivers/net/wireless/rtl818x/rtl8187.h
@@ -120,6 +120,12 @@ struct rtl8187_priv {
                 __le64 buf;
                 struct sk_buff_head queue;
         } b_tx_status; /* This queue is used by both -b and non-b devices */
+        struct mutex io_mutex;
+        union {
+                u8 bits8;
+                __le16 bits16;
+                __le32 bits32;
+        } *io_dmabuf;
 };
 
 void rtl8187_write_phy(struct ieee80211_hw *dev, u8 addr, u32 data);
@@ -129,10 +135,14 @@ static inline u8 rtl818x_ioread8_idx(struct rtl8187_priv *priv,
 {
         u8 val;
 
+        mutex_lock(&priv->io_mutex);
         usb_control_msg(priv->udev, usb_rcvctrlpipe(priv->udev, 0),
                         RTL8187_REQ_GET_REG, RTL8187_REQT_READ,
-                        (unsigned long)addr, idx & 0x03, &val,
-                        sizeof(val), HZ / 2);
+                        (unsigned long)addr, idx & 0x03,
+                        &priv->io_dmabuf->bits8, sizeof(val), HZ / 2);
+
+        val = priv->io_dmabuf->bits8;
+        mutex_unlock(&priv->io_mutex);
 
         return val;
 }
@@ -147,10 +157,14 @@ static inline u16 rtl818x_ioread16_idx(struct rtl8187_priv *priv,
 {
         __le16 val;
 
+        mutex_lock(&priv->io_mutex);
         usb_control_msg(priv->udev, usb_rcvctrlpipe(priv->udev, 0),
                         RTL8187_REQ_GET_REG, RTL8187_REQT_READ,
-                        (unsigned long)addr, idx & 0x03, &val,
-                        sizeof(val), HZ / 2);
+                        (unsigned long)addr, idx & 0x03,
+                        &priv->io_dmabuf->bits16, sizeof(val), HZ / 2);
+
+        val = priv->io_dmabuf->bits16;
+        mutex_unlock(&priv->io_mutex);
 
         return le16_to_cpu(val);
 }
@@ -165,10 +179,14 @@ static inline u32 rtl818x_ioread32_idx(struct rtl8187_priv *priv,
 {
         __le32 val;
 
+        mutex_lock(&priv->io_mutex);
         usb_control_msg(priv->udev, usb_rcvctrlpipe(priv->udev, 0),
                         RTL8187_REQ_GET_REG, RTL8187_REQT_READ,
-                        (unsigned long)addr, idx & 0x03, &val,
-                        sizeof(val), HZ / 2);
+                        (unsigned long)addr, idx & 0x03,
+                        &priv->io_dmabuf->bits32, sizeof(val), HZ / 2);
+
+        val = priv->io_dmabuf->bits32;
+        mutex_unlock(&priv->io_mutex);
 
         return le32_to_cpu(val);
 }
@@ -181,10 +199,15 @@ static inline u32 rtl818x_ioread32(struct rtl8187_priv *priv, __le32 *addr)
 static inline void rtl818x_iowrite8_idx(struct rtl8187_priv *priv,
                                         u8 *addr, u8 val, u8 idx)
 {
+        mutex_lock(&priv->io_mutex);
+
+        priv->io_dmabuf->bits8 = val;
         usb_control_msg(priv->udev, usb_sndctrlpipe(priv->udev, 0),
                         RTL8187_REQ_SET_REG, RTL8187_REQT_WRITE,
-                        (unsigned long)addr, idx & 0x03, &val,
-                        sizeof(val), HZ / 2);
+                        (unsigned long)addr, idx & 0x03,
+                        &priv->io_dmabuf->bits8, sizeof(val), HZ / 2);
+
+        mutex_unlock(&priv->io_mutex);
 }
 
 static inline void rtl818x_iowrite8(struct rtl8187_priv *priv, u8 *addr, u8 val)
@@ -195,12 +218,15 @@ static inline void rtl818x_iowrite8(struct rtl8187_priv *priv, u8 *addr, u8 val)
 static inline void rtl818x_iowrite16_idx(struct rtl8187_priv *priv,
                                          __le16 *addr, u16 val, u8 idx)
 {
-        __le16 buf = cpu_to_le16(val);
+        mutex_lock(&priv->io_mutex);
 
+        priv->io_dmabuf->bits16 = cpu_to_le16(val);
         usb_control_msg(priv->udev, usb_sndctrlpipe(priv->udev, 0),
                         RTL8187_REQ_SET_REG, RTL8187_REQT_WRITE,
-                        (unsigned long)addr, idx & 0x03, &buf, sizeof(buf),
-                        HZ / 2);
+                        (unsigned long)addr, idx & 0x03,
+                        &priv->io_dmabuf->bits16, sizeof(val), HZ / 2);
+
+        mutex_unlock(&priv->io_mutex);
 }
 
 static inline void rtl818x_iowrite16(struct rtl8187_priv *priv, __le16 *addr,
@@ -212,12 +238,15 @@ static inline void rtl818x_iowrite16(struct rtl8187_priv *priv, __le16 *addr,
 static inline void rtl818x_iowrite32_idx(struct rtl8187_priv *priv,
                                          __le32 *addr, u32 val, u8 idx)
 {
-        __le32 buf = cpu_to_le32(val);
+        mutex_lock(&priv->io_mutex);
 
+        priv->io_dmabuf->bits32 = cpu_to_le32(val);
         usb_control_msg(priv->udev, usb_sndctrlpipe(priv->udev, 0),
                         RTL8187_REQ_SET_REG, RTL8187_REQT_WRITE,
-                        (unsigned long)addr, idx & 0x03, &buf, sizeof(buf),
-                        HZ / 2);
+                        (unsigned long)addr, idx & 0x03,
+                        &priv->io_dmabuf->bits32, sizeof(val), HZ / 2);
+
+        mutex_unlock(&priv->io_mutex);
 }
 
 static inline void rtl818x_iowrite32(struct rtl8187_priv *priv, __le32 *addr,
diff --git a/drivers/net/wireless/rtl818x/rtl8187_dev.c b/drivers/net/wireless/rtl818x/rtl8187_dev.c
index fd81884b9c7d..bac6cfba6abd 100644
--- a/drivers/net/wireless/rtl818x/rtl8187_dev.c
+++ b/drivers/net/wireless/rtl818x/rtl8187_dev.c
@@ -1329,6 +1329,14 @@ static int __devinit rtl8187_probe(struct usb_interface *intf,
         priv = dev->priv;
         priv->is_rtl8187b = (id->driver_info == DEVICE_RTL8187B);
 
+        /* allocate "DMA aware" buffer for register accesses */
+        priv->io_dmabuf = kmalloc(sizeof(*priv->io_dmabuf), GFP_KERNEL);
+        if (!priv->io_dmabuf) {
+                err = -ENOMEM;
+                goto err_free_dev;
+        }
+        mutex_init(&priv->io_mutex);
+
         SET_IEEE80211_DEV(dev, &intf->dev);
         usb_set_intfdata(intf, dev);
         priv->udev = udev;
@@ -1495,7 +1503,7 @@ static int __devinit rtl8187_probe(struct usb_interface *intf,
         err = ieee80211_register_hw(dev);
         if (err) {
                 printk(KERN_ERR "rtl8187: Cannot register device\n");
-                goto err_free_dev;
+                goto err_free_dmabuf;
         }
         mutex_init(&priv->conf_mutex);
         skb_queue_head_init(&priv->b_tx_status.queue);
@@ -1506,6 +1514,8 @@ static int __devinit rtl8187_probe(struct usb_interface *intf,
 
         return 0;
 
+ err_free_dmabuf:
+        kfree(priv->io_dmabuf);
  err_free_dev:
         ieee80211_free_hw(dev);
         usb_set_intfdata(intf, NULL);
@@ -1526,6 +1536,7 @@ static void __devexit rtl8187_disconnect(struct usb_interface *intf)
         priv = dev->priv;
         usb_reset_device(priv->udev);
         usb_put_dev(interface_to_usbdev(intf));
+        kfree(priv->io_dmabuf);
         ieee80211_free_hw(dev);
 }
 
diff --git a/drivers/net/wireless/rtl818x/rtl8187_rtl8225.c b/drivers/net/wireless/rtl818x/rtl8187_rtl8225.c
index 78df281b297a..a09819386a1e 100644
--- a/drivers/net/wireless/rtl818x/rtl8187_rtl8225.c
+++ b/drivers/net/wireless/rtl818x/rtl8187_rtl8225.c
@@ -88,9 +88,15 @@ static void rtl8225_write_8051(struct ieee80211_hw *dev, u8 addr, __le16 data)
         rtl818x_iowrite16(priv, &priv->map->RFPinsOutput, reg80);
         udelay(10);
 
+        mutex_lock(&priv->io_mutex);
+
+        priv->io_dmabuf->bits16 = data;
         usb_control_msg(priv->udev, usb_sndctrlpipe(priv->udev, 0),
                         RTL8187_REQ_SET_REG, RTL8187_REQT_WRITE,
-                        addr, 0x8225, &data, sizeof(data), HZ / 2);
+                        addr, 0x8225, &priv->io_dmabuf->bits16, sizeof(data),
+                        HZ / 2);
+
+        mutex_unlock(&priv->io_mutex);
 
         rtl818x_iowrite16(priv, &priv->map->RFPinsOutput, reg80 | (1 << 2));
         udelay(10);