64 files changed, 2272 insertions, 310 deletions
diff --git a/drivers/net/8139too.c b/drivers/net/8139too.c
index a03d291de854..f0d23de32967 100644
--- a/drivers/net/8139too.c
+++ b/drivers/net/8139too.c
@@ -1944,7 +1944,7 @@ static int rtl8139_rx(struct net_device *dev, struct rtl8139_private *tp,
                netif_dbg(tp, rx_status, dev, "%s() status %04x, size %04x, cur %04x\n",
                          __func__, rx_status, rx_size, cur_rx);
 #if RTL8139_DEBUG > 2
-                print_dump_hex(KERN_DEBUG, "Frame contents: ",
+                print_hex_dump(KERN_DEBUG, "Frame contents: ",
                               DUMP_PREFIX_OFFSET, 16, 1,
                               &rx_ring[ring_offset], 70, true);
 #endif
diff --git a/drivers/net/Makefile b/drivers/net/Makefile
index a583b50d9de8..12b280afdd51 100644
--- a/drivers/net/Makefile
+++ b/drivers/net/Makefile
@@ -273,6 +273,7 @@ obj-$(CONFIG_USB_RTL8150)       += usb/
 obj-$(CONFIG_USB_HSO)           += usb/
 obj-$(CONFIG_USB_USBNET)        += usb/
 obj-$(CONFIG_USB_ZD1201)        += usb/
+obj-$(CONFIG_USB_IPHETH)        += usb/
 obj-y += wireless/
 obj-$(CONFIG_NET_TULIP) += tulip/
diff --git a/drivers/net/arm/ep93xx_eth.c b/drivers/net/arm/ep93xx_eth.c
index 6995169d285a..cd17d09f385c 100644
--- a/drivers/net/arm/ep93xx_eth.c
+++ b/drivers/net/arm/ep93xx_eth.c
@@ -311,11 +311,6 @@ err:
                processed++;
        }
-        if (processed) {
-                wrw(ep, REG_RXDENQ, processed);
-                wrw(ep, REG_RXSTSENQ, processed);
-        }
        return processed;
 }
@@ -350,6 +345,11 @@ poll_some_more:
                        goto poll_some_more;
        }
+        if (rx) {
+                wrw(ep, REG_RXDENQ, rx);
+                wrw(ep, REG_RXSTSENQ, rx);
+        }
        return rx;
 }
diff --git a/drivers/net/bnx2.c b/drivers/net/bnx2.c
index a257babd1bb4..ac90a3828f69 100644
--- a/drivers/net/bnx2.c
+++ b/drivers/net/bnx2.c
@@ -58,8 +58,8 @@
 #include "bnx2_fw.h"
 #define DRV_MODULE_NAME         "bnx2"
-#define DRV_MODULE_VERSION      "2.0.8"
+#define DRV_MODULE_VERSION      "2.0.9"
-#define DRV_MODULE_RELDATE      "Feb 15, 2010"
+#define DRV_MODULE_RELDATE      "April 27, 2010"
 #define FW_MIPS_FILE_06         "bnx2/bnx2-mips-06-5.0.0.j6.fw"
 #define FW_RV2P_FILE_06         "bnx2/bnx2-rv2p-06-5.0.0.j3.fw"
 #define FW_MIPS_FILE_09         "bnx2/bnx2-mips-09-5.0.0.j9.fw"
@@ -651,9 +651,10 @@ bnx2_napi_enable(struct bnx2 *bp)
 }
 static void
-bnx2_netif_stop(struct bnx2 *bp)
+bnx2_netif_stop(struct bnx2 *bp, bool stop_cnic)
 {
-        bnx2_cnic_stop(bp);
+        if (stop_cnic)
+                bnx2_cnic_stop(bp);
        if (netif_running(bp->dev)) {
                int i;
@@ -671,14 +672,15 @@ bnx2_netif_stop(struct bnx2 *bp)
 }
 static void
-bnx2_netif_start(struct bnx2 *bp)
+bnx2_netif_start(struct bnx2 *bp, bool start_cnic)
 {
        if (atomic_dec_and_test(&bp->intr_sem)) {
                if (netif_running(bp->dev)) {
                        netif_tx_wake_all_queues(bp->dev);
                        bnx2_napi_enable(bp);
                        bnx2_enable_int(bp);
-                        bnx2_cnic_start(bp);
+                        if (start_cnic)
+                                bnx2_cnic_start(bp);
                }
        }
 }
@@ -4759,8 +4761,12 @@ bnx2_reset_chip(struct bnx2 *bp, u32 reset_code)
                rc = bnx2_alloc_bad_rbuf(bp);
        }
-        if (bp->flags & BNX2_FLAG_USING_MSIX)
+        if (bp->flags & BNX2_FLAG_USING_MSIX) {
                bnx2_setup_msix_tbl(bp);
+                /* Prevent MSIX table reads and write from timing out */
+                REG_WR(bp, BNX2_MISC_ECO_HW_CTL,
+                        BNX2_MISC_ECO_HW_CTL_LARGE_GRC_TMOUT_EN);
+        }
        return rc;
 }
@@ -6273,12 +6279,12 @@ bnx2_reset_task(struct work_struct *work)
                return;
        }
-        bnx2_netif_stop(bp);
+        bnx2_netif_stop(bp, true);
        bnx2_init_nic(bp, 1);
        atomic_set(&bp->intr_sem, 1);
-        bnx2_netif_start(bp);
+        bnx2_netif_start(bp, true);
        rtnl_unlock();
 }
@@ -6320,7 +6326,7 @@ bnx2_vlan_rx_register(struct net_device *dev, struct vlan_group *vlgrp)
        struct bnx2 *bp = netdev_priv(dev);
        if (netif_running(dev))
-                bnx2_netif_stop(bp);
+                bnx2_netif_stop(bp, false);
        bp->vlgrp = vlgrp;
@@ -6331,7 +6337,7 @@ bnx2_vlan_rx_register(struct net_device *dev, struct vlan_group *vlgrp)
        if (bp->flags & BNX2_FLAG_CAN_KEEP_VLAN)
                bnx2_fw_sync(bp, BNX2_DRV_MSG_CODE_KEEP_VLAN_UPDATE, 0, 1);
-        bnx2_netif_start(bp);
+        bnx2_netif_start(bp, false);
 }
 #endif
@@ -7051,9 +7057,9 @@ bnx2_set_coalesce(struct net_device *dev, struct ethtool_coalesce *coal)
        bp->stats_ticks &= BNX2_HC_STATS_TICKS_HC_STAT_TICKS;
        if (netif_running(bp->dev)) {
-                bnx2_netif_stop(bp);
+                bnx2_netif_stop(bp, true);
                bnx2_init_nic(bp, 0);
-                bnx2_netif_start(bp);
+                bnx2_netif_start(bp, true);
        }
        return 0;
@@ -7083,7 +7089,7 @@ bnx2_change_ring_size(struct bnx2 *bp, u32 rx, u32 tx)
                /* Reset will erase chipset stats; save them */
                bnx2_save_stats(bp);
-                bnx2_netif_stop(bp);
+                bnx2_netif_stop(bp, true);
                bnx2_reset_chip(bp, BNX2_DRV_MSG_CODE_RESET);
                bnx2_free_skbs(bp);
                bnx2_free_mem(bp);
@@ -7111,7 +7117,7 @@ bnx2_change_ring_size(struct bnx2 *bp, u32 rx, u32 tx)
                        bnx2_setup_cnic_irq_info(bp);
                mutex_unlock(&bp->cnic_lock);
 #endif
-                bnx2_netif_start(bp);
+                bnx2_netif_start(bp, true);
        }
        return 0;
 }
@@ -7364,7 +7370,7 @@ bnx2_self_test(struct net_device *dev, struct ethtool_test *etest, u64 *buf)
        if (etest->flags & ETH_TEST_FL_OFFLINE) {
                int i;
-                bnx2_netif_stop(bp);
+                bnx2_netif_stop(bp, true);
                bnx2_reset_chip(bp, BNX2_DRV_MSG_CODE_DIAG);
                bnx2_free_skbs(bp);
@@ -7383,7 +7389,7 @@ bnx2_self_test(struct net_device *dev, struct ethtool_test *etest, u64 *buf)
                        bnx2_shutdown_chip(bp);
                else {
                        bnx2_init_nic(bp, 1);
-                        bnx2_netif_start(bp);
+                        bnx2_netif_start(bp, true);
                }
                /* wait for link up */
@@ -8377,7 +8383,7 @@ bnx2_suspend(struct pci_dev *pdev, pm_message_t state)
                return 0;
        flush_scheduled_work();
-        bnx2_netif_stop(bp);
+        bnx2_netif_stop(bp, true);
        netif_device_detach(dev);
        del_timer_sync(&bp->timer);
        bnx2_shutdown_chip(bp);
@@ -8399,7 +8405,7 @@ bnx2_resume(struct pci_dev *pdev)
        bnx2_set_power_state(bp, PCI_D0);
        netif_device_attach(dev);
        bnx2_init_nic(bp, 1);
-        bnx2_netif_start(bp);
+        bnx2_netif_start(bp, true);
        return 0;
 }
@@ -8426,7 +8432,7 @@ static pci_ers_result_t bnx2_io_error_detected(struct pci_dev *pdev,
        }
        if (netif_running(dev)) {
-                bnx2_netif_stop(bp);
+                bnx2_netif_stop(bp, true);
                del_timer_sync(&bp->timer);
                bnx2_reset_nic(bp, BNX2_DRV_MSG_CODE_RESET);
        }
@@ -8483,7 +8489,7 @@ static void bnx2_io_resume(struct pci_dev *pdev)
        rtnl_lock();
        if (netif_running(dev))
-                bnx2_netif_start(bp);
+                bnx2_netif_start(bp, true);
        netif_device_attach(dev);
        rtnl_unlock();
diff --git a/drivers/net/can/usb/ems_usb.c b/drivers/net/can/usb/ems_usb.c
index 33451092b8e8..d800b598ae3d 100644
--- a/drivers/net/can/usb/ems_usb.c
+++ b/drivers/net/can/usb/ems_usb.c
@@ -1006,7 +1006,7 @@ static int ems_usb_probe(struct usb_interface *intf,
        netdev = alloc_candev(sizeof(struct ems_usb), MAX_TX_URBS);
        if (!netdev) {
-                dev_err(netdev->dev.parent, "Couldn't alloc candev\n");
+                dev_err(&intf->dev, "ems_usb: Couldn't alloc candev\n");
                return -ENOMEM;
        }
@@ -1036,20 +1036,20 @@ static int ems_usb_probe(struct usb_interface *intf,
        dev->intr_urb = usb_alloc_urb(0, GFP_KERNEL);
        if (!dev->intr_urb) {
-                dev_err(netdev->dev.parent, "Couldn't alloc intr URB\n");
+                dev_err(&intf->dev, "Couldn't alloc intr URB\n");
                goto cleanup_candev;
        }
        dev->intr_in_buffer = kzalloc(INTR_IN_BUFFER_SIZE, GFP_KERNEL);
        if (!dev->intr_in_buffer) {
-                dev_err(netdev->dev.parent, "Couldn't alloc Intr buffer\n");
+                dev_err(&intf->dev, "Couldn't alloc Intr buffer\n");
                goto cleanup_intr_urb;
        }
        dev->tx_msg_buffer = kzalloc(CPC_HEADER_SIZE +
                                     sizeof(struct ems_cpc_msg), GFP_KERNEL);
        if (!dev->tx_msg_buffer) {
-                dev_err(netdev->dev.parent, "Couldn't alloc Tx buffer\n");
+                dev_err(&intf->dev, "Couldn't alloc Tx buffer\n");
                goto cleanup_intr_in_buffer;
        }
diff --git a/drivers/net/cnic.c b/drivers/net/cnic.c
index 9781942992e9..4b451a7c03e9 100644
--- a/drivers/net/cnic.c
+++ b/drivers/net/cnic.c
@@ -2334,13 +2334,13 @@ static int cnic_service_bnx2x(void *data, void *status_blk)
        struct cnic_local *cp = dev->cnic_priv;
        u16 prod = cp->kcq_prod_idx & MAX_KCQ_IDX;
-        prefetch(cp->status_blk.bnx2x);
+        if (likely(test_bit(CNIC_F_CNIC_UP, &dev->flags))) {
-        prefetch(&cp->kcq[KCQ_PG(prod)][KCQ_IDX(prod)]);
+                prefetch(cp->status_blk.bnx2x);
+                prefetch(&cp->kcq[KCQ_PG(prod)][KCQ_IDX(prod)]);
-        if (likely(test_bit(CNIC_F_CNIC_UP, &dev->flags)))
                tasklet_schedule(&cp->cnic_irq_task);
+                cnic_chk_pkt_rings(cp);
-        cnic_chk_pkt_rings(cp);
+        }
        return 0;
 }
diff --git a/drivers/net/cxgb3/ael1002.c b/drivers/net/cxgb3/ael1002.c
index 5248f9e0b2f4..35cd36729155 100644
--- a/drivers/net/cxgb3/ael1002.c
+++ b/drivers/net/cxgb3/ael1002.c
@@ -934,7 +934,7 @@ static struct cphy_ops xaui_direct_ops = {
 int t3_xaui_direct_phy_prep(struct cphy *phy, struct adapter *adapter,
                            int phy_addr, const struct mdio_ops *mdio_ops)
 {
-        cphy_init(phy, adapter, MDIO_PRTAD_NONE, &xaui_direct_ops, mdio_ops,
+        cphy_init(phy, adapter, phy_addr, &xaui_direct_ops, mdio_ops,
                  SUPPORTED_10000baseT_Full | SUPPORTED_AUI | SUPPORTED_TP,
                  "10GBASE-CX4");
        return 0;
diff --git a/drivers/net/cxgb3/cxgb3_main.c b/drivers/net/cxgb3/cxgb3_main.c
index aced6c5e635c..e3f1b8566495 100644
--- a/drivers/net/cxgb3/cxgb3_main.c
+++ b/drivers/net/cxgb3/cxgb3_main.c
@@ -439,7 +439,7 @@ static void free_irq_resources(struct adapter *adapter)
 static int await_mgmt_replies(struct adapter *adap, unsigned long init_cnt,
                              unsigned long n)
 {
-        int attempts = 5;
+        int attempts = 10;
        while (adap->sge.qs[0].rspq.offload_pkts < init_cnt + n) {
                if (!--attempts)
diff --git a/drivers/net/e100.c b/drivers/net/e100.c
index b997e578e58f..791080303db1 100644
--- a/drivers/net/e100.c
+++ b/drivers/net/e100.c
@@ -166,6 +166,7 @@
 #include <linux/ethtool.h>
 #include <linux/string.h>
 #include <linux/firmware.h>
+#include <linux/rtnetlink.h>
 #include <asm/unaligned.h>
@@ -2265,8 +2266,13 @@ static void e100_tx_timeout_task(struct work_struct *work)
        DPRINTK(TX_ERR, DEBUG, "scb.status=0x%02X\n",
                ioread8(&nic->csr->scb.status));
-        e100_down(netdev_priv(netdev));
-        e100_up(netdev_priv(netdev));
+        rtnl_lock();
+        if (netif_running(netdev)) {
+                e100_down(netdev_priv(netdev));
+                e100_up(netdev_priv(netdev));
+        }
+        rtnl_unlock();
 }
 static int e100_loopback_test(struct nic *nic, enum loopback loopback_mode)
diff --git a/drivers/net/e1000e/82571.c b/drivers/net/e1000e/82571.c
index 712ccc66ba25..90155552ea09 100644
--- a/drivers/net/e1000e/82571.c
+++ b/drivers/net/e1000e/82571.c
@@ -336,7 +336,6 @@ static s32 e1000_get_variants_82571(struct e1000_adapter *adapter)
        struct e1000_hw *hw = &adapter->hw;
        static int global_quad_port_a; /* global port a indication */
        struct pci_dev *pdev = adapter->pdev;
-        u16 eeprom_data = 0;
        int is_port_b = er32(STATUS) & E1000_STATUS_FUNC_1;
        s32 rc;
@@ -387,16 +386,15 @@ static s32 e1000_get_variants_82571(struct e1000_adapter *adapter)
                if (pdev->device == E1000_DEV_ID_82571EB_SERDES_QUAD)
                        adapter->flags &= ~FLAG_HAS_WOL;
                break;
        case e1000_82573:
+        case e1000_82574:
+        case e1000_82583:
+                /* Disable ASPM L0s due to hardware errata */
+                e1000e_disable_aspm(adapter->pdev, PCIE_LINK_STATE_L0S);
                if (pdev->device == E1000_DEV_ID_82573L) {
-                        if (e1000_read_nvm(&adapter->hw, NVM_INIT_3GIO_3, 1,
+                        adapter->flags |= FLAG_HAS_JUMBO_FRAMES;
-                                       &eeprom_data) < 0)
+                        adapter->max_hw_frame_size = DEFAULT_JUMBO;
-                                break;
-                        if (!(eeprom_data & NVM_WORD1A_ASPM_MASK)) {
-                                adapter->flags |= FLAG_HAS_JUMBO_FRAMES;
-                                adapter->max_hw_frame_size = DEFAULT_JUMBO;
-                        }
                }
                break;
        default:
@@ -1792,6 +1790,7 @@ struct e1000_info e1000_82571_info = {
                                  | FLAG_RESET_OVERWRITES_LAA /* errata */
                                  | FLAG_TARC_SPEED_MODE_BIT /* errata */
                                  | FLAG_APME_CHECK_PORT_B,
+        .flags2                 = FLAG2_DISABLE_ASPM_L1, /* errata 13 */
        .pba                    = 38,
        .max_hw_frame_size      = DEFAULT_JUMBO,
        .get_variants           = e1000_get_variants_82571,
@@ -1809,6 +1808,7 @@ struct e1000_info e1000_82572_info = {
                                  | FLAG_RX_CSUM_ENABLED
                                  | FLAG_HAS_CTRLEXT_ON_LOAD
                                  | FLAG_TARC_SPEED_MODE_BIT, /* errata */
+        .flags2                 = FLAG2_DISABLE_ASPM_L1, /* errata 13 */
        .pba                    = 38,
        .max_hw_frame_size      = DEFAULT_JUMBO,
        .get_variants           = e1000_get_variants_82571,
@@ -1820,13 +1820,11 @@ struct e1000_info e1000_82572_info = {
 struct e1000_info e1000_82573_info = {
        .mac                    = e1000_82573,
        .flags                  = FLAG_HAS_HW_VLAN_FILTER
-                                  | FLAG_HAS_JUMBO_FRAMES
                                  | FLAG_HAS_WOL
                                  | FLAG_APME_IN_CTRL3
                                  | FLAG_RX_CSUM_ENABLED
                                  | FLAG_HAS_SMART_POWER_DOWN
                                  | FLAG_HAS_AMT
-                                  | FLAG_HAS_ERT
                                  | FLAG_HAS_SWSM_ON_LOAD,
        .pba                    = 20,
        .max_hw_frame_size      = ETH_FRAME_LEN + ETH_FCS_LEN,
diff --git a/drivers/net/e1000e/e1000.h b/drivers/net/e1000e/e1000.h
index 118bdf483593..ee32b9b27a9f 100644
--- a/drivers/net/e1000e/e1000.h
+++ b/drivers/net/e1000e/e1000.h
@@ -37,6 +37,7 @@
 #include <linux/io.h>
 #include <linux/netdevice.h>
 #include <linux/pci.h>
+#include <linux/pci-aspm.h>
 #include "hw.h"
@@ -374,7 +375,7 @@ struct e1000_adapter {
 struct e1000_info {
        enum e1000_mac_type     mac;
        unsigned int            flags;
-        unsigned int            flags2;
+        unsigned int            flags2;
        u32                     pba;
        u32                     max_hw_frame_size;
        s32                     (*get_variants)(struct e1000_adapter *);
@@ -421,6 +422,7 @@ struct e1000_info {
 #define FLAG2_CRC_STRIPPING               (1 << 0)
 #define FLAG2_HAS_PHY_WAKEUP              (1 << 1)
 #define FLAG2_IS_DISCARDING               (1 << 2)
+#define FLAG2_DISABLE_ASPM_L1             (1 << 3)
 #define E1000_RX_DESC_PS(R, i)      \
        (&(((union e1000_rx_desc_packet_split *)((R).desc))[i]))
@@ -461,6 +463,7 @@ extern void e1000e_update_stats(struct e1000_adapter *adapter);
 extern bool e1000e_has_link(struct e1000_adapter *adapter);
 extern void e1000e_set_interrupt_capability(struct e1000_adapter *adapter);
 extern void e1000e_reset_interrupt_capability(struct e1000_adapter *adapter);
+extern void e1000e_disable_aspm(struct pci_dev *pdev, u16 state);
 extern unsigned int copybreak;
diff --git a/drivers/net/e1000e/netdev.c b/drivers/net/e1000e/netdev.c
index cfd09cea7214..dbf81788bb40 100644
--- a/drivers/net/e1000e/netdev.c
+++ b/drivers/net/e1000e/netdev.c
@@ -661,6 +661,8 @@ static bool e1000_clean_tx_irq(struct e1000_adapter *adapter)
                                i = 0;
                }
+                if (i == tx_ring->next_to_use)
+                        break;
                eop = tx_ring->buffer_info[i].next_to_watch;
                eop_desc = E1000_TX_DESC(*tx_ring, eop);
        }
@@ -4281,6 +4283,14 @@ static int e1000_change_mtu(struct net_device *netdev, int new_mtu)
                return -EINVAL;
        }
+        /* 82573 Errata 17 */
+        if (((adapter->hw.mac.type == e1000_82573) ||
+             (adapter->hw.mac.type == e1000_82574)) &&
+            (max_frame > ETH_FRAME_LEN + ETH_FCS_LEN)) {
+                adapter->flags2 |= FLAG2_DISABLE_ASPM_L1;
+                e1000e_disable_aspm(adapter->pdev, PCIE_LINK_STATE_L1);
+        }
        while (test_and_set_bit(__E1000_RESETTING, &adapter->state))
                msleep(1);
        /* e1000e_down -> e1000e_reset dependent on max_frame_size & mtu */
@@ -4603,29 +4613,42 @@ static void e1000_complete_shutdown(struct pci_dev *pdev, bool sleep,
        }
 }
-static void e1000e_disable_l1aspm(struct pci_dev *pdev)
+#ifdef CONFIG_PCIEASPM
+static void __e1000e_disable_aspm(struct pci_dev *pdev, u16 state)
+{
+        pci_disable_link_state(pdev, state);
+}
+#else
+static void __e1000e_disable_aspm(struct pci_dev *pdev, u16 state)
 {
        int pos;
-        u16 val;
+        u16 reg16;
        /*
-         * 82573 workaround - disable L1 ASPM on mobile chipsets
+         * Both device and parent should have the same ASPM setting.
-         *
+         * Disable ASPM in downstream component first and then upstream.
-         * L1 ASPM on various mobile (ich7) chipsets do not behave properly
-         * resulting in lost data or garbage information on the pci-e link
-         * level. This could result in (false) bad EEPROM checksum errors,
-         * long ping times (up to 2s) or even a system freeze/hang.
-         *
-         * Unfortunately this feature saves about 1W power consumption when
-         * active.
         */
-        pos = pci_find_capability(pdev, PCI_CAP_ID_EXP);
+        pos = pci_pcie_cap(pdev);
-        pci_read_config_word(pdev, pos + PCI_EXP_LNKCTL, &val);
+        pci_read_config_word(pdev, pos + PCI_EXP_LNKCTL, &reg16);
-        if (val & 0x2) {
+        reg16 &= ~state;
-                dev_warn(&pdev->dev, "Disabling L1 ASPM\n");
+        pci_write_config_word(pdev, pos + PCI_EXP_LNKCTL, reg16);
-                val &= ~0x2;
-                pci_write_config_word(pdev, pos + PCI_EXP_LNKCTL, val);
+        if (!pdev->bus->self)
-        }
+                return;
+        pos = pci_pcie_cap(pdev->bus->self);
+        pci_read_config_word(pdev->bus->self, pos + PCI_EXP_LNKCTL, &reg16);
+        reg16 &= ~state;
+        pci_write_config_word(pdev->bus->self, pos + PCI_EXP_LNKCTL, reg16);
+}
+#endif
+void e1000e_disable_aspm(struct pci_dev *pdev, u16 state)
+{
+        dev_info(&pdev->dev, "Disabling ASPM %s %s\n",
+                 (state & PCIE_LINK_STATE_L0S) ? "L0s" : "",
+                 (state & PCIE_LINK_STATE_L1) ? "L1" : "");
+        __e1000e_disable_aspm(pdev, state);
 }
 #ifdef CONFIG_PM
@@ -4651,7 +4674,8 @@ static int e1000_resume(struct pci_dev *pdev)
        pci_set_power_state(pdev, PCI_D0);
        pci_restore_state(pdev);
        pci_save_state(pdev);
-        e1000e_disable_l1aspm(pdev);
+        if (adapter->flags2 & FLAG2_DISABLE_ASPM_L1)
+                e1000e_disable_aspm(pdev, PCIE_LINK_STATE_L1);
        err = pci_enable_device_mem(pdev);
        if (err) {
@@ -4793,7 +4817,8 @@ static pci_ers_result_t e1000_io_slot_reset(struct pci_dev *pdev)
        int err;
        pci_ers_result_t result;
-        e1000e_disable_l1aspm(pdev);
+        if (adapter->flags2 & FLAG2_DISABLE_ASPM_L1)
+                e1000e_disable_aspm(pdev, PCIE_LINK_STATE_L1);
        err = pci_enable_device_mem(pdev);
        if (err) {
                dev_err(&pdev->dev,
@@ -4887,13 +4912,6 @@ static void e1000_eeprom_checks(struct e1000_adapter *adapter)
                dev_warn(&adapter->pdev->dev,
                         "Warning: detected DSPD enabled in EEPROM\n");
        }
-        ret_val = e1000_read_nvm(hw, NVM_INIT_3GIO_3, 1, &buf);
-        if (!ret_val && (le16_to_cpu(buf) & (3 << 2))) {
-                /* ASPM enable */
-                dev_warn(&adapter->pdev->dev,
-                         "Warning: detected ASPM enabled in EEPROM\n");
-        }
 }
 static const struct net_device_ops e1000e_netdev_ops = {
@@ -4942,7 +4960,8 @@ static int __devinit e1000_probe(struct pci_dev *pdev,
        u16 eeprom_data = 0;
        u16 eeprom_apme_mask = E1000_EEPROM_APME;
-        e1000e_disable_l1aspm(pdev);
+        if (ei->flags2 & FLAG2_DISABLE_ASPM_L1)
+                e1000e_disable_aspm(pdev, PCIE_LINK_STATE_L1);
        err = pci_enable_device_mem(pdev);
        if (err)
diff --git a/drivers/net/fec.c b/drivers/net/fec.c
index 9f98c1c4a344..9b4e8f797a7a 100644
--- a/drivers/net/fec.c
+++ b/drivers/net/fec.c
@@ -1653,7 +1653,7 @@ fec_set_mac_address(struct net_device *dev, void *p)
                (dev->dev_addr[1] << 16) | (dev->dev_addr[0] << 24),
                fep->hwp + FEC_ADDR_LOW);
        writel((dev->dev_addr[5] << 16) | (dev->dev_addr[4] << 24),
-                fep + FEC_ADDR_HIGH);
+                fep->hwp + FEC_ADDR_HIGH);
        return 0;
 }
diff --git a/drivers/net/forcedeth.c b/drivers/net/forcedeth.c
index 73b260c3c654..5c98f7c22425 100644
--- a/drivers/net/forcedeth.c
+++ b/drivers/net/forcedeth.c
@@ -5899,7 +5899,7 @@ static int __devinit nv_probe(struct pci_dev *pci_dev, const struct pci_device_i
        /* Limit the number of tx's outstanding for hw bug */
        if (id->driver_data & DEV_NEED_TX_LIMIT) {
                np->tx_limit = 1;
-                if ((id->driver_data & DEV_NEED_TX_LIMIT2) &&
+                if (((id->driver_data & DEV_NEED_TX_LIMIT2) == DEV_NEED_TX_LIMIT2) &&
                    pci_dev->revision >= 0xA2)
                        np->tx_limit = 0;
        }
diff --git a/drivers/net/fsl_pq_mdio.c b/drivers/net/fsl_pq_mdio.c
index d5160edf2fcf..3acac5f930c8 100644
--- a/drivers/net/fsl_pq_mdio.c
+++ b/drivers/net/fsl_pq_mdio.c
@@ -205,8 +205,6 @@ static int fsl_pq_mdio_find_free(struct mii_bus *new_bus)
 static u32 __iomem *get_gfar_tbipa(struct fsl_pq_mdio __iomem *regs, struct device_node *np)
 {
        struct gfar __iomem *enet_regs;
-        u32 __iomem *ioremap_tbipa;
-        u64 addr, size;
        /*
         * This is mildly evil, but so is our hardware for doing this.
@@ -220,9 +218,7 @@ static u32 __iomem *get_gfar_tbipa(struct fsl_pq_mdio __iomem *regs, struct devi
                return &enet_regs->tbipa;
        } else if (of_device_is_compatible(np, "fsl,etsec2-mdio") ||
                        of_device_is_compatible(np, "fsl,etsec2-tbi")) {
-                addr = of_translate_address(np, of_get_address(np, 1, &size, NULL));
+                return of_iomap(np, 1);
-                ioremap_tbipa = ioremap(addr, size);
-                return ioremap_tbipa;
        } else
                return NULL;
 }
@@ -279,6 +275,7 @@ static int fsl_pq_mdio_probe(struct of_device *ofdev,
        u32 __iomem *tbipa;
        struct mii_bus *new_bus;
        int tbiaddr = -1;
+        const u32 *addrp;
        u64 addr = 0, size = 0;
        int err = 0;
@@ -297,8 +294,19 @@ static int fsl_pq_mdio_probe(struct of_device *ofdev,
        new_bus->priv = priv;
        fsl_pq_mdio_bus_name(new_bus->id, np);
+        addrp = of_get_address(np, 0, &size, NULL);
+        if (!addrp) {
+                err = -EINVAL;
+                goto err_free_bus;
+        }
        /* Set the PHY base address */
-        addr = of_translate_address(np, of_get_address(np, 0, &size, NULL));
+        addr = of_translate_address(np, addrp);
+        if (addr == OF_BAD_ADDR) {
+                err = -EINVAL;
+                goto err_free_bus;
+        }
        map = ioremap(addr, size);
        if (!map) {
                err = -ENOMEM;
diff --git a/drivers/net/gianfar.c b/drivers/net/gianfar.c
index 080d1cea5b26..4e97ca182997 100644
--- a/drivers/net/gianfar.c
+++ b/drivers/net/gianfar.c
@@ -549,12 +549,8 @@ static int gfar_parse_group(struct device_node *np,
                struct gfar_private *priv, const char *model)
 {
        u32 *queue_mask;
-        u64 addr, size;
-        addr = of_translate_address(np,
-                        of_get_address(np, 0, &size, NULL));
-        priv->gfargrp[priv->num_grps].regs = ioremap(addr, size);
+        priv->gfargrp[priv->num_grps].regs = of_iomap(np, 0);
        if (!priv->gfargrp[priv->num_grps].regs)
                return -ENOMEM;
@@ -1515,9 +1511,9 @@ static void gfar_halt_nodisable(struct net_device *dev)
                tempval |= (DMACTRL_GRS | DMACTRL_GTS);
                gfar_write(&regs->dmactrl, tempval);
-                while (!(gfar_read(&regs->ievent) &
+                spin_event_timeout(((gfar_read(&regs->ievent) &
-                         (IEVENT_GRSC | IEVENT_GTSC)))
+                         (IEVENT_GRSC | IEVENT_GTSC)) ==
-                        cpu_relax();
+                         (IEVENT_GRSC | IEVENT_GTSC)), -1, 0);
        }
 }
diff --git a/drivers/net/igb/igb_ethtool.c b/drivers/net/igb/igb_ethtool.c
index d313fae992da..743038490104 100644
--- a/drivers/net/igb/igb_ethtool.c
+++ b/drivers/net/igb/igb_ethtool.c
@@ -1814,6 +1814,7 @@ static int igb_wol_exclusion(struct igb_adapter *adapter,
                retval = 0;
                break;
        case E1000_DEV_ID_82576_QUAD_COPPER:
+        case E1000_DEV_ID_82576_QUAD_COPPER_ET2:
                /* quad port adapters only support WoL on port A */
                if (!(adapter->flags & IGB_FLAG_QUAD_PORT_A)) {
                        wol->supported = 0;
diff --git a/drivers/net/igb/igb_main.c b/drivers/net/igb/igb_main.c
index 9b3c51ab1758..c9baa2aa98cd 100644
--- a/drivers/net/igb/igb_main.c
+++ b/drivers/net/igb/igb_main.c
@@ -1612,6 +1612,7 @@ static int __devinit igb_probe(struct pci_dev *pdev,
                        adapter->eeprom_wol = 0;
                break;
        case E1000_DEV_ID_82576_QUAD_COPPER:
+        case E1000_DEV_ID_82576_QUAD_COPPER_ET2:
                /* if quad port adapter, disable WoL on all but port A */
                if (global_quad_port_a != 0)
                        adapter->eeprom_wol = 0;
diff --git a/drivers/net/ixgbe/ixgbe_82599.c b/drivers/net/ixgbe/ixgbe_82599.c
index b405a00817c6..12fc0e7ba2ca 100644
--- a/drivers/net/ixgbe/ixgbe_82599.c
+++ b/drivers/net/ixgbe/ixgbe_82599.c
@@ -39,6 +39,8 @@
 #define IXGBE_82599_MC_TBL_SIZE   128
 #define IXGBE_82599_VFT_TBL_SIZE  128
+void ixgbe_disable_tx_laser_multispeed_fiber(struct ixgbe_hw *hw);
+void ixgbe_enable_tx_laser_multispeed_fiber(struct ixgbe_hw *hw);
 void ixgbe_flap_tx_laser_multispeed_fiber(struct ixgbe_hw *hw);
 s32 ixgbe_setup_mac_link_multispeed_fiber(struct ixgbe_hw *hw,
                                          ixgbe_link_speed speed,
@@ -69,8 +71,14 @@ static void ixgbe_init_mac_link_ops_82599(struct ixgbe_hw *hw)
        if (hw->phy.multispeed_fiber) {
                /* Set up dual speed SFP+ support */
                mac->ops.setup_link = &ixgbe_setup_mac_link_multispeed_fiber;
+                mac->ops.disable_tx_laser =
+                                       &ixgbe_disable_tx_laser_multispeed_fiber;
+                mac->ops.enable_tx_laser =
+                                        &ixgbe_enable_tx_laser_multispeed_fiber;
                mac->ops.flap_tx_laser = &ixgbe_flap_tx_laser_multispeed_fiber;
        } else {
+                mac->ops.disable_tx_laser = NULL;
+                mac->ops.enable_tx_laser = NULL;
                mac->ops.flap_tx_laser = NULL;
                if ((mac->ops.get_media_type(hw) ==
                     ixgbe_media_type_backplane) &&
@@ -415,6 +423,44 @@ s32 ixgbe_start_mac_link_82599(struct ixgbe_hw *hw,
        return status;
 }
+ /**
+  *  ixgbe_disable_tx_laser_multispeed_fiber - Disable Tx laser
+  *  @hw: pointer to hardware structure
+  *
+  *  The base drivers may require better control over SFP+ module
+  *  PHY states.  This includes selectively shutting down the Tx
+  *  laser on the PHY, effectively halting physical link.
+  **/
+void ixgbe_disable_tx_laser_multispeed_fiber(struct ixgbe_hw *hw)
+{
+        u32 esdp_reg = IXGBE_READ_REG(hw, IXGBE_ESDP);
+        /* Disable tx laser; allow 100us to go dark per spec */
+        esdp_reg |= IXGBE_ESDP_SDP3;
+        IXGBE_WRITE_REG(hw, IXGBE_ESDP, esdp_reg);
+        IXGBE_WRITE_FLUSH(hw);
+        udelay(100);
+}
+/**
+ *  ixgbe_enable_tx_laser_multispeed_fiber - Enable Tx laser
+ *  @hw: pointer to hardware structure
+ *
+ *  The base drivers may require better control over SFP+ module
+ *  PHY states.  This includes selectively turning on the Tx
+ *  laser on the PHY, effectively starting physical link.
+ **/
+void ixgbe_enable_tx_laser_multispeed_fiber(struct ixgbe_hw *hw)
+{
+        u32 esdp_reg = IXGBE_READ_REG(hw, IXGBE_ESDP);
+        /* Enable tx laser; allow 100ms to light up */
+        esdp_reg &= ~IXGBE_ESDP_SDP3;
+        IXGBE_WRITE_REG(hw, IXGBE_ESDP, esdp_reg);
+        IXGBE_WRITE_FLUSH(hw);
+        msleep(100);
+}
 /**
 *  ixgbe_flap_tx_laser_multispeed_fiber - Flap Tx laser
 *  @hw: pointer to hardware structure
@@ -429,23 +475,11 @@ s32 ixgbe_start_mac_link_82599(struct ixgbe_hw *hw,
 **/
 void ixgbe_flap_tx_laser_multispeed_fiber(struct ixgbe_hw *hw)
 {
-        u32 esdp_reg = IXGBE_READ_REG(hw, IXGBE_ESDP);
        hw_dbg(hw, "ixgbe_flap_tx_laser_multispeed_fiber\n");
        if (hw->mac.autotry_restart) {
-                /* Disable tx laser; allow 100us to go dark per spec */
+                ixgbe_disable_tx_laser_multispeed_fiber(hw);
-                esdp_reg |= IXGBE_ESDP_SDP3;
+                ixgbe_enable_tx_laser_multispeed_fiber(hw);
-                IXGBE_WRITE_REG(hw, IXGBE_ESDP, esdp_reg);
-                IXGBE_WRITE_FLUSH(hw);
-                udelay(100);
-                /* Enable tx laser; allow 100ms to light up */
-                esdp_reg &= ~IXGBE_ESDP_SDP3;
-                IXGBE_WRITE_REG(hw, IXGBE_ESDP, esdp_reg);
-                IXGBE_WRITE_FLUSH(hw);
-                msleep(100);
                hw->mac.autotry_restart = false;
        }
 }
diff --git a/drivers/net/ixgbe/ixgbe_main.c b/drivers/net/ixgbe/ixgbe_main.c
index 8f677cb86290..6c00ee493a3b 100644
--- a/drivers/net/ixgbe/ixgbe_main.c
+++ b/drivers/net/ixgbe/ixgbe_main.c
@@ -2982,6 +2982,10 @@ static int ixgbe_up_complete(struct ixgbe_adapter *adapter)
        else
                ixgbe_configure_msi_and_legacy(adapter);
+        /* enable the optics */
+        if (hw->phy.multispeed_fiber)
+                hw->mac.ops.enable_tx_laser(hw);
        clear_bit(__IXGBE_DOWN, &adapter->state);
        ixgbe_napi_enable_all(adapter);
@@ -3243,6 +3247,10 @@ void ixgbe_down(struct ixgbe_adapter *adapter)
        /* signal that we are down to the interrupt handler */
        set_bit(__IXGBE_DOWN, &adapter->state);
+        /* power down the optics */
+        if (hw->phy.multispeed_fiber)
+                hw->mac.ops.disable_tx_laser(hw);
        /* disable receive for all VFs and wait one second */
        if (adapter->num_vfs) {
                /* ping all the active vfs to let them know we are going down */
@@ -6253,6 +6261,10 @@ static int __devinit ixgbe_probe(struct pci_dev *pdev,
                goto err_eeprom;
        }
+        /* power down the optics */
+        if (hw->phy.multispeed_fiber)
+                hw->mac.ops.disable_tx_laser(hw);
        init_timer(&adapter->watchdog_timer);
        adapter->watchdog_timer.function = &ixgbe_watchdog;
        adapter->watchdog_timer.data = (unsigned long)adapter;
@@ -6400,16 +6412,6 @@ static void __devexit ixgbe_remove(struct pci_dev *pdev)
        del_timer_sync(&adapter->sfp_timer);
        cancel_work_sync(&adapter->watchdog_task);
        cancel_work_sync(&adapter->sfp_task);
-        if (adapter->hw.phy.multispeed_fiber) {
-                struct ixgbe_hw *hw = &adapter->hw;
-                /*
-                 * Restart clause 37 autoneg, disable and re-enable
-                 * the tx laser, to clear & alert the link partner
-                 * that it needs to restart autotry
-                 */
-                hw->mac.autotry_restart = true;
-                hw->mac.ops.flap_tx_laser(hw);
-        }
        cancel_work_sync(&adapter->multispeed_fiber_task);
        cancel_work_sync(&adapter->sfp_config_module_task);
        if (adapter->flags & IXGBE_FLAG_FDIR_HASH_CAPABLE ||
diff --git a/drivers/net/ixgbe/ixgbe_type.h b/drivers/net/ixgbe/ixgbe_type.h
index 4ec6dc1a5b75..534affcc38ca 100644
--- a/drivers/net/ixgbe/ixgbe_type.h
+++ b/drivers/net/ixgbe/ixgbe_type.h
@@ -2398,6 +2398,8 @@ struct ixgbe_mac_operations {
        s32 (*enable_rx_dma)(struct ixgbe_hw *, u32);
        /* Link */
+        void (*disable_tx_laser)(struct ixgbe_hw *);
+        void (*enable_tx_laser)(struct ixgbe_hw *);
        void (*flap_tx_laser)(struct ixgbe_hw *);
        s32 (*setup_link)(struct ixgbe_hw *, ixgbe_link_speed, bool, bool);
        s32 (*check_link)(struct ixgbe_hw *, ixgbe_link_speed *, bool *, bool);
diff --git a/drivers/net/ks8851.c b/drivers/net/ks8851.c
index 13cc1ca261d9..9e9f9b349766 100644
--- a/drivers/net/ks8851.c
+++ b/drivers/net/ks8851.c
@@ -722,12 +722,14 @@ static void ks8851_tx_work(struct work_struct *work)
                txb = skb_dequeue(&ks->txq);
                last = skb_queue_empty(&ks->txq);
-                ks8851_wrreg16(ks, KS_RXQCR, ks->rc_rxqcr | RXQCR_SDA);
+                if (txb != NULL) {
-                ks8851_wrpkt(ks, txb, last);
+                        ks8851_wrreg16(ks, KS_RXQCR, ks->rc_rxqcr | RXQCR_SDA);
-                ks8851_wrreg16(ks, KS_RXQCR, ks->rc_rxqcr);
+                        ks8851_wrpkt(ks, txb, last);
-                ks8851_wrreg16(ks, KS_TXQCR, TXQCR_METFE);
+                        ks8851_wrreg16(ks, KS_RXQCR, ks->rc_rxqcr);
+                        ks8851_wrreg16(ks, KS_TXQCR, TXQCR_METFE);
-                ks8851_done_tx(ks, txb);
+                        ks8851_done_tx(ks, txb);
+                }
        }
        mutex_unlock(&ks->lock);
diff --git a/drivers/net/myri10ge/myri10ge.c b/drivers/net/myri10ge/myri10ge.c
index 471887742b02..ecde0876a785 100644
--- a/drivers/net/myri10ge/myri10ge.c
+++ b/drivers/net/myri10ge/myri10ge.c
@@ -1690,7 +1690,7 @@ myri10ge_set_pauseparam(struct net_device *netdev,
        if (pause->tx_pause != mgp->pause)
                return myri10ge_change_pause(mgp, pause->tx_pause);
        if (pause->rx_pause != mgp->pause)
-                return myri10ge_change_pause(mgp, pause->tx_pause);
+                return myri10ge_change_pause(mgp, pause->rx_pause);
        if (pause->autoneg != 0)
                return -EINVAL;
        return 0;
diff --git a/drivers/net/pcmcia/3c574_cs.c b/drivers/net/pcmcia/3c574_cs.c
index 3d1d3a7b7ed3..757f87bb1db3 100644
--- a/drivers/net/pcmcia/3c574_cs.c
+++ b/drivers/net/pcmcia/3c574_cs.c
@@ -781,8 +781,13 @@ static netdev_tx_t el3_start_xmit(struct sk_buff *skb,
                  inw(ioaddr + EL3_STATUS));
        spin_lock_irqsave(&lp->window_lock, flags);
+        dev->stats.tx_bytes += skb->len;
+        /* Put out the doubleword header... */
        outw(skb->len, ioaddr + TX_FIFO);
        outw(0, ioaddr + TX_FIFO);
+        /* ... and the packet rounded to a doubleword. */
        outsl(ioaddr + TX_FIFO, skb->data, (skb->len+3)>>2);
        dev->trans_start = jiffies;
@@ -1021,8 +1026,6 @@ static void update_stats(struct net_device *dev)
        /* BadSSD */                               inb(ioaddr + 12);
        up                                       = inb(ioaddr + 13);
-        dev->stats.tx_bytes                     += tx + ((up & 0xf0) << 12);
        EL3WINDOW(1);
 }
diff --git a/drivers/net/pcmcia/smc91c92_cs.c b/drivers/net/pcmcia/smc91c92_cs.c
index ff7eb9116b6a..ccc553782a0d 100644
--- a/drivers/net/pcmcia/smc91c92_cs.c
+++ b/drivers/net/pcmcia/smc91c92_cs.c
@@ -1608,9 +1608,12 @@ static void set_rx_mode(struct net_device *dev)
 {
    unsigned int ioaddr = dev->base_addr;
    struct smc_private *smc = netdev_priv(dev);
-    u_int multicast_table[ 2 ] = { 0, };
+    unsigned char multicast_table[8];
    unsigned long flags;
    u_short rx_cfg_setting;
+    int i;
+    memset(multicast_table, 0, sizeof(multicast_table));
    if (dev->flags & IFF_PROMISC) {
        rx_cfg_setting = RxStripCRC | RxEnable | RxPromisc | RxAllMulti;
@@ -1622,10 +1625,6 @@ static void set_rx_mode(struct net_device *dev)
            netdev_for_each_mc_addr(mc_addr, dev) {
                u_int position = ether_crc(6, mc_addr->dmi_addr);
-#ifndef final_version           /* Verify multicast address. */
-                if ((mc_addr->dmi_addr[0] & 1) == 0)
-                    continue;
-#endif
                multicast_table[position >> 29] |= 1 << ((position >> 26) & 7);
            }
        }
@@ -1635,8 +1634,8 @@ static void set_rx_mode(struct net_device *dev)
    /* Load MC table and Rx setting into the chip without interrupts. */
    spin_lock_irqsave(&smc->lock, flags);
    SMC_SELECT_BANK(3);
-    outl(multicast_table[0], ioaddr + MULTICAST0);
+    for (i = 0; i < 8; i++)
-    outl(multicast_table[1], ioaddr + MULTICAST4);
+        outb(multicast_table[i], ioaddr + MULTICAST0 + i);
    SMC_SELECT_BANK(0);
    outw(rx_cfg_setting, ioaddr + RCR);
    SMC_SELECT_BANK(2);
@@ -1805,23 +1804,30 @@ static void media_check(u_long arg)
    SMC_SELECT_BANK(1);
    media |= (inw(ioaddr + CONFIG) & CFG_AUI_SELECT) ? 2 : 1;
+    SMC_SELECT_BANK(saved_bank);
+    spin_unlock_irqrestore(&smc->lock, flags);
    /* Check for pending interrupt with watchdog flag set: with
       this, we can limp along even if the interrupt is blocked */
    if (smc->watchdog++ && ((i>>8) & i)) {
        if (!smc->fast_poll)
            printk(KERN_INFO "%s: interrupt(s) dropped!\n", dev->name);
+        local_irq_save(flags);
        smc_interrupt(dev->irq, dev);
+        local_irq_restore(flags);
        smc->fast_poll = HZ;
    }
    if (smc->fast_poll) {
        smc->fast_poll--;
        smc->media.expires = jiffies + HZ/100;
        add_timer(&smc->media);
-        SMC_SELECT_BANK(saved_bank);
-        spin_unlock_irqrestore(&smc->lock, flags);
        return;
    }
+    spin_lock_irqsave(&smc->lock, flags);
+    saved_bank = inw(ioaddr + BANK_SELECT);
    if (smc->cfg & CFG_MII_SELECT) {
        if (smc->mii_if.phy_id < 0)
            goto reschedule;
@@ -1979,15 +1985,16 @@ static int smc_get_settings(struct net_device *dev, struct ethtool_cmd *ecmd)
        unsigned int ioaddr = dev->base_addr;
        u16 saved_bank = inw(ioaddr + BANK_SELECT);
        int ret;
+        unsigned long flags;
-        spin_lock_irq(&smc->lock);
+        spin_lock_irqsave(&smc->lock, flags);
        SMC_SELECT_BANK(3);
        if (smc->cfg & CFG_MII_SELECT)
                ret = mii_ethtool_gset(&smc->mii_if, ecmd);
        else
                ret = smc_netdev_get_ecmd(dev, ecmd);
        SMC_SELECT_BANK(saved_bank);
-        spin_unlock_irq(&smc->lock);
+        spin_unlock_irqrestore(&smc->lock, flags);
        return ret;
 }
@@ -1997,15 +2004,16 @@ static int smc_set_settings(struct net_device *dev, struct ethtool_cmd *ecmd)
        unsigned int ioaddr = dev->base_addr;
        u16 saved_bank = inw(ioaddr + BANK_SELECT);
        int ret;
+        unsigned long flags;
-        spin_lock_irq(&smc->lock);
+        spin_lock_irqsave(&smc->lock, flags);
        SMC_SELECT_BANK(3);
        if (smc->cfg & CFG_MII_SELECT)
                ret = mii_ethtool_sset(&smc->mii_if, ecmd);
        else
                ret = smc_netdev_set_ecmd(dev, ecmd);
        SMC_SELECT_BANK(saved_bank);
-        spin_unlock_irq(&smc->lock);
+        spin_unlock_irqrestore(&smc->lock, flags);
        return ret;
 }
@@ -2015,12 +2023,13 @@ static u32 smc_get_link(struct net_device *dev)
        unsigned int ioaddr = dev->base_addr;
        u16 saved_bank = inw(ioaddr + BANK_SELECT);
        u32 ret;
+        unsigned long flags;
-        spin_lock_irq(&smc->lock);
+        spin_lock_irqsave(&smc->lock, flags);
        SMC_SELECT_BANK(3);
        ret = smc_link_ok(dev);
        SMC_SELECT_BANK(saved_bank);
-        spin_unlock_irq(&smc->lock);
+        spin_unlock_irqrestore(&smc->lock, flags);
        return ret;
 }
@@ -2057,16 +2066,17 @@ static int smc_ioctl (struct net_device *dev, struct ifreq *rq, int cmd)
        int rc = 0;
        u16 saved_bank;
        unsigned int ioaddr = dev->base_addr;
+        unsigned long flags;
        if (!netif_running(dev))
                return -EINVAL;
-        spin_lock_irq(&smc->lock);
+        spin_lock_irqsave(&smc->lock, flags);
        saved_bank = inw(ioaddr + BANK_SELECT);
        SMC_SELECT_BANK(3);
        rc = generic_mii_ioctl(&smc->mii_if, mii, cmd, NULL);
        SMC_SELECT_BANK(saved_bank);
-        spin_unlock_irq(&smc->lock);
+        spin_unlock_irqrestore(&smc->lock, flags);
        return rc;
 }
diff --git a/drivers/net/phy/Kconfig b/drivers/net/phy/Kconfig
index fc5938ba3d78..a527e37728cd 100644
--- a/drivers/net/phy/Kconfig
+++ b/drivers/net/phy/Kconfig
@@ -88,6 +88,11 @@ config LSI_ET1011C_PHY
        ---help---
          Supports the LSI ET1011C PHY.
+config MICREL_PHY
+        tristate "Driver for Micrel PHYs"
+        ---help---
+          Supports the KSZ9021, VSC8201, KS8001 PHYs.
 config FIXED_PHY
        bool "Driver for MDIO Bus/PHY emulation with fixed speed/link PHYs"
        depends on PHYLIB=y
diff --git a/drivers/net/phy/Makefile b/drivers/net/phy/Makefile
index 1342585af381..13bebab65d02 100644
--- a/drivers/net/phy/Makefile
+++ b/drivers/net/phy/Makefile
@@ -20,4 +20,5 @@ obj-$(CONFIG_MDIO_BITBANG)	+= mdio-bitbang.o
 obj-$(CONFIG_MDIO_GPIO)         += mdio-gpio.o
 obj-$(CONFIG_NATIONAL_PHY)      += national.o
 obj-$(CONFIG_STE10XP)           += ste10Xp.o
+obj-$(CONFIG_MICREL_PHY)        += micrel.o
 obj-$(CONFIG_MDIO_OCTEON)       += mdio-octeon.o
diff --git a/drivers/net/phy/mdio-octeon.c b/drivers/net/phy/mdio-octeon.c
index a872aea4ed74..f443d43edd80 100644
--- a/drivers/net/phy/mdio-octeon.c
+++ b/drivers/net/phy/mdio-octeon.c
@@ -88,6 +88,7 @@ static int octeon_mdiobus_write(struct mii_bus *bus, int phy_id,
 static int __init octeon_mdiobus_probe(struct platform_device *pdev)
 {
        struct octeon_mdiobus *bus;
+        union cvmx_smix_en smi_en;
        int i;
        int err = -ENOENT;
@@ -103,6 +104,10 @@ static int __init octeon_mdiobus_probe(struct platform_device *pdev)
        if (!bus->mii_bus)
                goto err;
+        smi_en.u64 = 0;
+        smi_en.s.en = 1;
+        cvmx_write_csr(CVMX_SMIX_EN(bus->unit), smi_en.u64);
        /*
         * Standard Octeon evaluation boards don't support phy
         * interrupts, we need to poll.
@@ -133,17 +138,22 @@ err_register:
 err:
        devm_kfree(&pdev->dev, bus);
+        smi_en.u64 = 0;
+        cvmx_write_csr(CVMX_SMIX_EN(bus->unit), smi_en.u64);
        return err;
 }
 static int __exit octeon_mdiobus_remove(struct platform_device *pdev)
 {
        struct octeon_mdiobus *bus;
+        union cvmx_smix_en smi_en;
        bus = dev_get_drvdata(&pdev->dev);
        mdiobus_unregister(bus->mii_bus);
        mdiobus_free(bus->mii_bus);
+        smi_en.u64 = 0;
+        cvmx_write_csr(CVMX_SMIX_EN(bus->unit), smi_en.u64);
        return 0;
 }
diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c
new file mode 100644
index 000000000000..0cd80e4d71d9
--- /dev/null
+++ b/drivers/net/phy/micrel.c
@@ -0,0 +1,104 @@
+/*
+ * drivers/net/phy/micrel.c
+ *
+ * Driver for Micrel PHYs
+ *
+ * Author: David J. Choi
+ *
+ * Copyright (c) 2010 Micrel, Inc.
+ *
+ * This program is free software; you can redistribute  it and/or modify it
+ * under  the terms of  the GNU General  Public License as published by the
+ * Free Software Foundation;  either version 2 of the  License, or (at your
+ * option) any later version.
+ *
+ * Support : ksz9021 , vsc8201, ks8001
+ */
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/phy.h>
+#define PHY_ID_KSZ9021                  0x00221611
+#define PHY_ID_VSC8201                  0x000FC413
+#define PHY_ID_KS8001                   0x0022161A
+static int kszphy_config_init(struct phy_device *phydev)
+{
+        return 0;
+}
+static struct phy_driver ks8001_driver = {
+        .phy_id         = PHY_ID_KS8001,
+        .phy_id_mask    = 0x00fffff0,
+        .features       = PHY_BASIC_FEATURES,
+        .flags          = PHY_POLL,
+        .config_init    = kszphy_config_init,
+        .config_aneg    = genphy_config_aneg,
+        .read_status    = genphy_read_status,
+        .driver         = { .owner = THIS_MODULE,},
+};
+static struct phy_driver vsc8201_driver = {
+        .phy_id         = PHY_ID_VSC8201,
+        .name           = "Micrel VSC8201",
+        .phy_id_mask    = 0x00fffff0,
+        .features       = PHY_BASIC_FEATURES,
+        .flags          = PHY_POLL,
+        .config_init    = kszphy_config_init,
+        .config_aneg    = genphy_config_aneg,
+        .read_status    = genphy_read_status,
+        .driver         = { .owner = THIS_MODULE,},
+};
+static struct phy_driver ksz9021_driver = {
+        .phy_id         = PHY_ID_KSZ9021,
+        .phy_id_mask    = 0x000fff10,
+        .name           = "Micrel KSZ9021 Gigabit PHY",
+        .features       = PHY_GBIT_FEATURES | SUPPORTED_Pause,
+        .flags          = PHY_POLL,
+        .config_init    = kszphy_config_init,
+        .config_aneg    = genphy_config_aneg,
+        .read_status    = genphy_read_status,
+        .driver         = { .owner = THIS_MODULE, },
+};
+static int __init ksphy_init(void)
+{
+        int ret;
+        ret = phy_driver_register(&ks8001_driver);
+        if (ret)
+                goto err1;
+        ret = phy_driver_register(&vsc8201_driver);
+        if (ret)
+                goto err2;
+        ret = phy_driver_register(&ksz9021_driver);
+        if (ret)
+                goto err3;
+        return 0;
+err3:
+        phy_driver_unregister(&vsc8201_driver);
+err2:
+        phy_driver_unregister(&ks8001_driver);
+err1:
+        return ret;
+}
+static void __exit ksphy_exit(void)
+{
+        phy_driver_unregister(&ks8001_driver);
+        phy_driver_unregister(&vsc8201_driver);
+        phy_driver_unregister(&ksz9021_driver);
+}
+module_init(ksphy_init);
+module_exit(ksphy_exit);
+MODULE_DESCRIPTION("Micrel PHY driver");
+MODULE_AUTHOR("David J. Choi");
+MODULE_LICENSE("GPL");
diff --git a/drivers/net/ppp_generic.c b/drivers/net/ppp_generic.c
index 6e281bc825e5..8518a2e58e53 100644
--- a/drivers/net/ppp_generic.c
+++ b/drivers/net/ppp_generic.c
@@ -405,6 +405,7 @@ static ssize_t ppp_read(struct file *file, char __user *buf,
        DECLARE_WAITQUEUE(wait, current);
        ssize_t ret;
        struct sk_buff *skb = NULL;
+        struct iovec iov;
        ret = count;
@@ -448,7 +449,9 @@ static ssize_t ppp_read(struct file *file, char __user *buf,
        if (skb->len > count)
                goto outf;
        ret = -EFAULT;
-        if (copy_to_user(buf, skb->data, skb->len))
+        iov.iov_base = buf;
+        iov.iov_len = count;
+        if (skb_copy_datagram_iovec(skb, 0, &iov, skb->len))
                goto outf;
        ret = skb->len;
@@ -1567,13 +1570,22 @@ ppp_input(struct ppp_channel *chan, struct sk_buff *skb)
        struct channel *pch = chan->ppp;
        int proto;
-        if (!pch || skb->len == 0) {
+        if (!pch) {
                kfree_skb(skb);
                return;
        }
-        proto = PPP_PROTO(skb);
        read_lock_bh(&pch->upl);
+        if (!pskb_may_pull(skb, 2)) {
+                kfree_skb(skb);
+                if (pch->ppp) {
+                        ++pch->ppp->dev->stats.rx_length_errors;
+                        ppp_receive_error(pch->ppp);
+                }
+                goto done;
+        }
+        proto = PPP_PROTO(skb);
        if (!pch->ppp || proto >= 0xc000 || proto == PPP_CCPFRAG) {
                /* put it on the channel queue */
                skb_queue_tail(&pch->file.rq, skb);
@@ -1585,6 +1597,8 @@ ppp_input(struct ppp_channel *chan, struct sk_buff *skb)
        } else {
                ppp_do_recv(pch->ppp, skb, pch);
        }
+done:
        read_unlock_bh(&pch->upl);
 }
@@ -1617,7 +1631,8 @@ ppp_input_error(struct ppp_channel *chan, int code)
 static void
 ppp_receive_frame(struct ppp *ppp, struct sk_buff *skb, struct channel *pch)
 {
-        if (pskb_may_pull(skb, 2)) {
+        /* note: a 0-length skb is used as an error indication */
+        if (skb->len > 0) {
 #ifdef CONFIG_PPP_MULTILINK
                /* XXX do channel-level decompression here */
                if (PPP_PROTO(skb) == PPP_MP)
@@ -1625,15 +1640,10 @@ ppp_receive_frame(struct ppp *ppp, struct sk_buff *skb, struct channel *pch)
                else
 #endif /* CONFIG_PPP_MULTILINK */
                        ppp_receive_nonmp_frame(ppp, skb);
-                return;
+        } else {
+                kfree_skb(skb);
+                ppp_receive_error(ppp);
        }
-        if (skb->len > 0)
-                /* note: a 0-length skb is used as an error indication */
-                ++ppp->dev->stats.rx_length_errors;
-        kfree_skb(skb);
-        ppp_receive_error(ppp);
 }
 static void
diff --git a/drivers/net/qlcnic/qlcnic_hw.c b/drivers/net/qlcnic/qlcnic_hw.c
index a6ef266a2fe2..e73ba455aa20 100644
--- a/drivers/net/qlcnic/qlcnic_hw.c
+++ b/drivers/net/qlcnic/qlcnic_hw.c
@@ -431,6 +431,9 @@ void qlcnic_set_multi(struct net_device *netdev)
        u8 bcast_addr[ETH_ALEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
        u32 mode = VPORT_MISS_MODE_DROP;
+        if (adapter->is_up != QLCNIC_ADAPTER_UP_MAGIC)
+                return;
        qlcnic_nic_add_mac(adapter, adapter->mac_addr);
        qlcnic_nic_add_mac(adapter, bcast_addr);
diff --git a/drivers/net/r6040.c b/drivers/net/r6040.c
index 43afdb6b25e6..0298d8c1dcb6 100644
--- a/drivers/net/r6040.c
+++ b/drivers/net/r6040.c
@@ -134,7 +134,7 @@
 #define RX_DESC_SIZE    (RX_DCNT * sizeof(struct r6040_descriptor))
 #define TX_DESC_SIZE    (TX_DCNT * sizeof(struct r6040_descriptor))
 #define MBCR_DEFAULT    0x012A  /* MAC Bus Control Register */
-#define MCAST_MAX       4       /* Max number multicast addresses to filter */
+#define MCAST_MAX       3       /* Max number multicast addresses to filter */
 /* Descriptor status */
 #define DSC_OWNER_MAC   0x8000  /* MAC is the owner of this descriptor */
@@ -982,9 +982,6 @@ static void r6040_multicast_list(struct net_device *dev)
                        crc >>= 26;
                        hash_table[crc >> 4] |= 1 << (15 - (crc & 0xf));
                }
-                /* Write the index of the hash table */
-                for (i = 0; i < 4; i++)
-                        iowrite16(hash_table[i] << 14, ioaddr + MCR1);
                /* Fill the MAC hash tables with their values */
                iowrite16(hash_table[0], ioaddr + MAR0);
                iowrite16(hash_table[1], ioaddr + MAR1);
@@ -1000,9 +997,9 @@ static void r6040_multicast_list(struct net_device *dev)
                        iowrite16(adrp[1], ioaddr + MID_1M + 8 * i);
                        iowrite16(adrp[2], ioaddr + MID_1H + 8 * i);
                } else {
-                        iowrite16(0xffff, ioaddr + MID_0L + 8 * i);
+                        iowrite16(0xffff, ioaddr + MID_1L + 8 * i);
-                        iowrite16(0xffff, ioaddr + MID_0M + 8 * i);
+                        iowrite16(0xffff, ioaddr + MID_1M + 8 * i);
-                        iowrite16(0xffff, ioaddr + MID_0H + 8 * i);
+                        iowrite16(0xffff, ioaddr + MID_1H + 8 * i);
                }
                i++;
        }
diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
index dbb1f5a1824c..dd8106ff35aa 100644
--- a/drivers/net/r8169.c
+++ b/drivers/net/r8169.c
@@ -1042,14 +1042,14 @@ static void rtl8169_vlan_rx_register(struct net_device *dev,
 }
 static int rtl8169_rx_vlan_skb(struct rtl8169_private *tp, struct RxDesc *desc,
-                               struct sk_buff *skb)
+                               struct sk_buff *skb, int polling)
 {
        u32 opts2 = le32_to_cpu(desc->opts2);
        struct vlan_group *vlgrp = tp->vlgrp;
        int ret;
        if (vlgrp && (opts2 & RxVlanTag)) {
-                vlan_hwaccel_receive_skb(skb, vlgrp, swab16(opts2 & 0xffff));
+                __vlan_hwaccel_rx(skb, vlgrp, swab16(opts2 & 0xffff), polling);
                ret = 0;
        } else
                ret = -1;
@@ -1066,7 +1066,7 @@ static inline u32 rtl8169_tx_vlan_tag(struct rtl8169_private *tp,
 }
 static int rtl8169_rx_vlan_skb(struct rtl8169_private *tp, struct RxDesc *desc,
-                               struct sk_buff *skb)
+                               struct sk_buff *skb, int polling)
 {
        return -1;
 }
@@ -2759,6 +2759,7 @@ static void rtl8169_release_board(struct pci_dev *pdev, struct net_device *dev,
 {
        iounmap(ioaddr);
        pci_release_regions(pdev);
+        pci_clear_mwi(pdev);
        pci_disable_device(pdev);
        free_netdev(dev);
 }
@@ -2825,8 +2826,13 @@ static void rtl_rar_set(struct rtl8169_private *tp, u8 *addr)
        spin_lock_irq(&tp->lock);
        RTL_W8(Cfg9346, Cfg9346_Unlock);
        RTL_W32(MAC4, high);
+        RTL_R32(MAC4);
        RTL_W32(MAC0, low);
+        RTL_R32(MAC0);
        RTL_W8(Cfg9346, Cfg9346_Lock);
        spin_unlock_irq(&tp->lock);
@@ -3014,9 +3020,8 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
                goto err_out_free_dev_1;
        }
-        rc = pci_set_mwi(pdev);
+        if (pci_set_mwi(pdev) < 0)
-        if (rc < 0)
+                netif_info(tp, probe, dev, "Mem-Wr-Inval unavailable\n");
-                goto err_out_disable_2;
        /* make sure PCI base addr 1 is MMIO */
        if (!(pci_resource_flags(pdev, region) & IORESOURCE_MEM)) {
@@ -3024,7 +3029,7 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
                          "region #%d not an MMIO resource, aborting\n",
                          region);
                rc = -ENODEV;
-                goto err_out_mwi_3;
+                goto err_out_mwi_2;
        }
        /* check for weird/broken PCI region reporting */
@@ -3032,13 +3037,13 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
                netif_err(tp, probe, dev,
                          "Invalid PCI region size(s), aborting\n");
                rc = -ENODEV;
-                goto err_out_mwi_3;
+                goto err_out_mwi_2;
        }
        rc = pci_request_regions(pdev, MODULENAME);
        if (rc < 0) {
                netif_err(tp, probe, dev, "could not request regions\n");
-                goto err_out_mwi_3;
+                goto err_out_mwi_2;
        }
        tp->cp_cmd = PCIMulRW | RxChkSum;
@@ -3051,7 +3056,7 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
                rc = pci_set_dma_mask(pdev, DMA_BIT_MASK(32));
                if (rc < 0) {
                        netif_err(tp, probe, dev, "DMA configuration failed\n");
-                        goto err_out_free_res_4;
+                        goto err_out_free_res_3;
                }
        }
@@ -3060,7 +3065,7 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
        if (!ioaddr) {
                netif_err(tp, probe, dev, "cannot remap MMIO, aborting\n");
                rc = -EIO;
-                goto err_out_free_res_4;
+                goto err_out_free_res_3;
        }
        tp->pcie_cap = pci_find_capability(pdev, PCI_CAP_ID_EXP);
@@ -3102,7 +3107,7 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
        if (i == ARRAY_SIZE(rtl_chip_info)) {
                dev_err(&pdev->dev,
                        "driver bug, MAC version not found in rtl_chip_info\n");
-                goto err_out_msi_5;
+                goto err_out_msi_4;
        }
        tp->chipset = i;
@@ -3167,7 +3172,7 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
        rc = register_netdev(dev);
        if (rc < 0)
-                goto err_out_msi_5;
+                goto err_out_msi_4;
        pci_set_drvdata(pdev, dev);
@@ -3190,14 +3195,13 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
 out:
        return rc;
-err_out_msi_5:
+err_out_msi_4:
        rtl_disable_msi(pdev, tp);
        iounmap(ioaddr);
-err_out_free_res_4:
+err_out_free_res_3:
        pci_release_regions(pdev);
-err_out_mwi_3:
+err_out_mwi_2:
        pci_clear_mwi(pdev);
-err_out_disable_2:
        pci_disable_device(pdev);
 err_out_free_dev_1:
        free_netdev(dev);
@@ -4441,12 +4445,20 @@ out:
        return done;
 }
+/*
+ * Warning : rtl8169_rx_interrupt() might be called :
+ * 1) from NAPI (softirq) context
+ *      (polling = 1 : we should call netif_receive_skb())
+ * 2) from process context (rtl8169_reset_task())
+ *      (polling = 0 : we must call netif_rx() instead)
+ */
 static int rtl8169_rx_interrupt(struct net_device *dev,
                                struct rtl8169_private *tp,
                                void __iomem *ioaddr, u32 budget)
 {
        unsigned int cur_rx, rx_left;
        unsigned int delta, count;
+        int polling = (budget != ~(u32)0) ? 1 : 0;
        cur_rx = tp->cur_rx;
        rx_left = NUM_RX_DESC + tp->dirty_rx - cur_rx;
@@ -4508,8 +4520,12 @@ static int rtl8169_rx_interrupt(struct net_device *dev,
                        skb_put(skb, pkt_size);
                        skb->protocol = eth_type_trans(skb, dev);
-                        if (rtl8169_rx_vlan_skb(tp, desc, skb) < 0)
+                        if (rtl8169_rx_vlan_skb(tp, desc, skb, polling) < 0) {
-                                netif_receive_skb(skb);
+                                if (likely(polling))
+                                        netif_receive_skb(skb);
+                                else
+                                        netif_rx(skb);
+                        }
                        dev->stats.rx_bytes += pkt_size;
                        dev->stats.rx_packets++;
diff --git a/drivers/net/sb1250-mac.c b/drivers/net/sb1250-mac.c
index 9944e5d662c0..04efc0c1bda9 100644
--- a/drivers/net/sb1250-mac.c
+++ b/drivers/net/sb1250-mac.c
@@ -2353,17 +2353,36 @@ static int sbmac_init(struct platform_device *pldev, long long base)
        sc->mii_bus = mdiobus_alloc();
        if (sc->mii_bus == NULL) {
-                sbmac_uninitctx(sc);
+                err = -ENOMEM;
-                return -ENOMEM;
+                goto uninit_ctx;
        }
+        sc->mii_bus->name = sbmac_mdio_string;
+        snprintf(sc->mii_bus->id, MII_BUS_ID_SIZE, "%x", idx);
+        sc->mii_bus->priv = sc;
+        sc->mii_bus->read = sbmac_mii_read;
+        sc->mii_bus->write = sbmac_mii_write;
+        sc->mii_bus->irq = sc->phy_irq;
+        for (i = 0; i < PHY_MAX_ADDR; ++i)
+                sc->mii_bus->irq[i] = SBMAC_PHY_INT;
+        sc->mii_bus->parent = &pldev->dev;
+        /*
+         * Probe PHY address
+         */
+        err = mdiobus_register(sc->mii_bus);
+        if (err) {
+                printk(KERN_ERR "%s: unable to register MDIO bus\n",
+                       dev->name);
+                goto free_mdio;
+        }
+        dev_set_drvdata(&pldev->dev, sc->mii_bus);
        err = register_netdev(dev);
        if (err) {
                printk(KERN_ERR "%s.%d: unable to register netdev\n",
                       sbmac_string, idx);
-                mdiobus_free(sc->mii_bus);
+                goto unreg_mdio;
-                sbmac_uninitctx(sc);
-                return err;
        }
        pr_info("%s.%d: registered as %s\n", sbmac_string, idx, dev->name);
@@ -2379,19 +2398,15 @@ static int sbmac_init(struct platform_device *pldev, long long base)
        pr_info("%s: SiByte Ethernet at 0x%08Lx, address: %pM\n",
               dev->name, base, eaddr);
-        sc->mii_bus->name = sbmac_mdio_string;
-        snprintf(sc->mii_bus->id, MII_BUS_ID_SIZE, "%x", idx);
-        sc->mii_bus->priv = sc;
-        sc->mii_bus->read = sbmac_mii_read;
-        sc->mii_bus->write = sbmac_mii_write;
-        sc->mii_bus->irq = sc->phy_irq;
-        for (i = 0; i < PHY_MAX_ADDR; ++i)
-                sc->mii_bus->irq[i] = SBMAC_PHY_INT;
-        sc->mii_bus->parent = &pldev->dev;
-        dev_set_drvdata(&pldev->dev, sc->mii_bus);
        return 0;
+unreg_mdio:
+        mdiobus_unregister(sc->mii_bus);
+        dev_set_drvdata(&pldev->dev, NULL);
+free_mdio:
+        mdiobus_free(sc->mii_bus);
+uninit_ctx:
+        sbmac_uninitctx(sc);
+        return err;
 }
@@ -2417,16 +2432,6 @@ static int sbmac_open(struct net_device *dev)
                goto out_err;
        }
-        /*
-         * Probe PHY address
-         */
-        err = mdiobus_register(sc->mii_bus);
-        if (err) {
-                printk(KERN_ERR "%s: unable to register MDIO bus\n",
-                       dev->name);
-                goto out_unirq;
-        }
        sc->sbm_speed = sbmac_speed_none;
        sc->sbm_duplex = sbmac_duplex_none;
        sc->sbm_fc = sbmac_fc_none;
@@ -2457,11 +2462,7 @@ static int sbmac_open(struct net_device *dev)
        return 0;
 out_unregister:
-        mdiobus_unregister(sc->mii_bus);
-out_unirq:
        free_irq(dev->irq, dev);
 out_err:
        return err;
 }
@@ -2650,9 +2651,6 @@ static int sbmac_close(struct net_device *dev)
        phy_disconnect(sc->phy_dev);
        sc->phy_dev = NULL;
-        mdiobus_unregister(sc->mii_bus);
        free_irq(dev->irq, dev);
        sbdma_emptyring(&(sc->sbm_txdma));
@@ -2760,6 +2758,7 @@ static int __exit sbmac_remove(struct platform_device *pldev)
        unregister_netdev(dev);
        sbmac_uninitctx(sc);
+        mdiobus_unregister(sc->mii_bus);
        mdiobus_free(sc->mii_bus);
        iounmap(sc->sbm_base);
        free_netdev(dev);
diff --git a/drivers/net/sfc/efx.c b/drivers/net/sfc/efx.c
index 6486657c47b8..649a264d6a81 100644
--- a/drivers/net/sfc/efx.c
+++ b/drivers/net/sfc/efx.c
@@ -1861,6 +1861,7 @@ out:
        }
        if (disabled) {
+                dev_close(efx->net_dev);
                EFX_ERR(efx, "has been disabled\n");
                efx->state = STATE_DISABLED;
        } else {
@@ -1884,8 +1885,7 @@ static void efx_reset_work(struct work_struct *data)
        }
        rtnl_lock();
-        if (efx_reset(efx, efx->reset_pending))
+        (void)efx_reset(efx, efx->reset_pending);
-                dev_close(efx->net_dev);
        rtnl_unlock();
 }
diff --git a/drivers/net/sfc/falcon.c b/drivers/net/sfc/falcon.c
index d294d66fd600..08278e7302b3 100644
--- a/drivers/net/sfc/falcon.c
+++ b/drivers/net/sfc/falcon.c
@@ -1320,7 +1320,9 @@ static int falcon_probe_nvconfig(struct efx_nic *efx)
        EFX_LOG(efx, "PHY is %d phy_id %d\n", efx->phy_type, efx->mdio.prtad);
-        falcon_probe_board(efx, board_rev);
+        rc = falcon_probe_board(efx, board_rev);
+        if (rc)
+                goto fail2;
        kfree(nvconfig);
        return 0;
diff --git a/drivers/net/sfc/falcon_boards.c b/drivers/net/sfc/falcon_boards.c
index 5712fddd72f2..c7a933a3292e 100644
--- a/drivers/net/sfc/falcon_boards.c
+++ b/drivers/net/sfc/falcon_boards.c
@@ -728,15 +728,7 @@ static const struct falcon_board_type board_types[] = {
        },
 };
-static const struct falcon_board_type falcon_dummy_board = {
+int falcon_probe_board(struct efx_nic *efx, u16 revision_info)
-        .init           = efx_port_dummy_op_int,
-        .init_phy       = efx_port_dummy_op_void,
-        .fini           = efx_port_dummy_op_void,
-        .set_id_led     = efx_port_dummy_op_set_id_led,
-        .monitor        = efx_port_dummy_op_int,
-};
-void falcon_probe_board(struct efx_nic *efx, u16 revision_info)
 {
        struct falcon_board *board = falcon_board(efx);
        u8 type_id = FALCON_BOARD_TYPE(revision_info);
@@ -754,8 +746,9 @@ void falcon_probe_board(struct efx_nic *efx, u16 revision_info)
                         (efx->pci_dev->subsystem_vendor == EFX_VENDID_SFC)
                         ? board->type->ref_model : board->type->gen_type,
                         'A' + board->major, board->minor);
+                return 0;
        } else {
                EFX_ERR(efx, "unknown board type %d\n", type_id);
-                board->type = &falcon_dummy_board;
+                return -ENODEV;
        }
 }
diff --git a/drivers/net/sfc/nic.h b/drivers/net/sfc/nic.h
index 9351c0331a47..3166bafdfbef 100644
--- a/drivers/net/sfc/nic.h
+++ b/drivers/net/sfc/nic.h
@@ -156,7 +156,7 @@ extern struct efx_nic_type siena_a0_nic_type;
 **************************************************************************
 */
-extern void falcon_probe_board(struct efx_nic *efx, u16 revision_info);
+extern int falcon_probe_board(struct efx_nic *efx, u16 revision_info);
 /* TX data path */
 extern int efx_nic_probe_tx(struct efx_tx_queue *tx_queue);
diff --git a/drivers/net/sfc/siena.c b/drivers/net/sfc/siena.c
index 38dcc42c4f79..e0c46f59d1f8 100644
--- a/drivers/net/sfc/siena.c
+++ b/drivers/net/sfc/siena.c
@@ -456,8 +456,17 @@ static int siena_try_update_nic_stats(struct efx_nic *efx)
 static void siena_update_nic_stats(struct efx_nic *efx)
 {
-        while (siena_try_update_nic_stats(efx) == -EAGAIN)
+        int retry;
-                cpu_relax();
+        /* If we're unlucky enough to read statistics wduring the DMA, wait
+         * up to 10ms for it to finish (typically takes <500us) */
+        for (retry = 0; retry < 100; ++retry) {
+                if (siena_try_update_nic_stats(efx) == 0)
+                        return;
+                udelay(100);
+        }
+        /* Use the old values instead */
 }
 static void siena_start_nic_stats(struct efx_nic *efx)
diff --git a/drivers/net/stmmac/stmmac_main.c b/drivers/net/stmmac/stmmac_main.c
index a214a1627e8b..4111a85ec80e 100644
--- a/drivers/net/stmmac/stmmac_main.c
+++ b/drivers/net/stmmac/stmmac_main.c
@@ -1686,7 +1686,7 @@ static int stmmac_dvr_probe(struct platform_device *pdev)
        }
        pr_info("done!\n");
-        if (!request_mem_region(res->start, (res->end - res->start),
+        if (!request_mem_region(res->start, resource_size(res),
                                pdev->name)) {
                pr_err("%s: ERROR: memory allocation failed"
                       "cannot get the I/O addr 0x%x\n",
@@ -1695,9 +1695,9 @@ static int stmmac_dvr_probe(struct platform_device *pdev)
                goto out;
        }
-        addr = ioremap(res->start, (res->end - res->start));
+        addr = ioremap(res->start, resource_size(res));
        if (!addr) {
-                pr_err("%s: ERROR: memory mapping failed \n", __func__);
+                pr_err("%s: ERROR: memory mapping failed\n", __func__);
                ret = -ENOMEM;
                goto out;
        }
@@ -1775,7 +1775,7 @@ static int stmmac_dvr_probe(struct platform_device *pdev)
 out:
        if (ret < 0) {
                platform_set_drvdata(pdev, NULL);
-                release_mem_region(res->start, (res->end - res->start));
+                release_mem_region(res->start, resource_size(res));
                if (addr != NULL)
                        iounmap(addr);
        }
@@ -1813,7 +1813,7 @@ static int stmmac_dvr_remove(struct platform_device *pdev)
        iounmap((void *)ndev->base_addr);
        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-        release_mem_region(res->start, (res->end - res->start));
+        release_mem_region(res->start, resource_size(res));
        free_netdev(ndev);
diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
index 22cf1c446de3..ecc41cffb470 100644
--- a/drivers/net/tg3.c
+++ b/drivers/net/tg3.c
@@ -8633,6 +8633,7 @@ static int tg3_test_msi(struct tg3 *tp)
        pci_disable_msi(tp->pdev);
        tp->tg3_flags2 &= ~TG3_FLG2_USING_MSI;
+        tp->napi[0].irq_vec = tp->pdev->irq;
        err = tg3_request_irq(tp, 0);
        if (err)
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 96c39bddc78c..43265207d463 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -387,6 +387,10 @@ static netdev_tx_t tun_net_xmit(struct sk_buff *skb, struct net_device *dev)
                }
        }
+        /* Orphan the skb - required as we might hang on to it
+         * for indefinite time. */
+        skb_orphan(skb);
        /* Enqueue packet */
        skb_queue_tail(&tun->socket.sk->sk_receive_queue, skb);
        dev->trans_start = jiffies;
diff --git a/drivers/net/usb/Kconfig b/drivers/net/usb/Kconfig
index ba56ce4382d9..d7b7018a1de1 100644
--- a/drivers/net/usb/Kconfig
+++ b/drivers/net/usb/Kconfig
@@ -385,4 +385,25 @@ config USB_CDC_PHONET
          cellular modem, as found on most Nokia handsets with the
          "PC suite" USB profile.
+config USB_IPHETH
+        tristate "Apple iPhone USB Ethernet driver"
+        default n
+        ---help---
+          Module used to share Internet connection (tethering) from your
+          iPhone (Original, 3G and 3GS) to your system.
+          Note that you need userspace libraries and programs that are needed
+          to pair your device with your system and that understand the iPhone
+          protocol.
+          For more information: http://giagio.com/wiki/moin.cgi/iPhoneEthernetDriver
+config USB_SIERRA_NET
+        tristate "USB-to-WWAN Driver for Sierra Wireless modems"
+        depends on USB_USBNET
+        help
+          Choose this option if you have a Sierra Wireless USB-to-WWAN device.
+          To compile this driver as a module, choose M here: the
+          module will be called sierra_net.
 endmenu
diff --git a/drivers/net/usb/Makefile b/drivers/net/usb/Makefile
index 82ea62955b56..b13a279663ba 100644
--- a/drivers/net/usb/Makefile
+++ b/drivers/net/usb/Makefile
@@ -23,4 +23,6 @@ obj-$(CONFIG_USB_NET_MCS7830)	+= mcs7830.o
 obj-$(CONFIG_USB_USBNET)        += usbnet.o
 obj-$(CONFIG_USB_NET_INT51X1)   += int51x1.o
 obj-$(CONFIG_USB_CDC_PHONET)    += cdc-phonet.o
+obj-$(CONFIG_USB_IPHETH)        += ipheth.o
+obj-$(CONFIG_USB_SIERRA_NET)    += sierra_net.o
diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
index c8cdb7f30adc..3547cf13d219 100644
--- a/drivers/net/usb/cdc_ether.c
+++ b/drivers/net/usb/cdc_ether.c
@@ -431,6 +431,7 @@ static const struct driver_info mbm_info = {
        .bind =         cdc_bind,
        .unbind =       usbnet_cdc_unbind,
        .status =       cdc_status,
+        .manage_power = cdc_manage_power,
 };
 /*-------------------------------------------------------------------------*/
diff --git a/drivers/net/usb/dm9601.c b/drivers/net/usb/dm9601.c
index 04b281002a76..5dfed9297b22 100644
--- a/drivers/net/usb/dm9601.c
+++ b/drivers/net/usb/dm9601.c
@@ -240,7 +240,7 @@ static int dm_write_shared_word(struct usbnet *dev, int phy, u8 reg, __le16 valu
                goto out;
        dm_write_reg(dev, DM_SHARED_ADDR, phy ? (reg | 0x40) : reg);
-        dm_write_reg(dev, DM_SHARED_CTRL, phy ? 0x1c : 0x14);
+        dm_write_reg(dev, DM_SHARED_CTRL, phy ? 0x1a : 0x12);
        for (i = 0; i < DM_TIMEOUT; i++) {
                u8 tmp;
diff --git a/drivers/net/usb/ipheth.c b/drivers/net/usb/ipheth.c
new file mode 100644
index 000000000000..418825d26f90
--- /dev/null
+++ b/drivers/net/usb/ipheth.c
@@ -0,0 +1,569 @@
+/*
+ * ipheth.c - Apple iPhone USB Ethernet driver
+ *
+ * Copyright (c) 2009 Diego Giagio <diego@giagio.com>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the name of GIAGIO.COM nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * Alternatively, provided that this notice is retained in full, this
+ * software may be distributed under the terms of the GNU General
+ * Public License ("GPL") version 2, in which case the provisions of the
+ * GPL apply INSTEAD OF those given above.
+ *
+ * The provided data structures and external interfaces from this code
+ * are not restricted to be used by modules with a GPL compatible license.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ *
+ *
+ * Attention: iPhone device must be paired, otherwise it won't respond to our
+ * driver. For more info: http://giagio.com/wiki/moin.cgi/iPhoneEthernetDriver
+ *
+ */
+#include <linux/kernel.h>
+#include <linux/errno.h>
+#include <linux/init.h>
+#include <linux/slab.h>
+#include <linux/module.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/ethtool.h>
+#include <linux/usb.h>
+#include <linux/workqueue.h>
+#define USB_VENDOR_APPLE        0x05ac
+#define USB_PRODUCT_IPHONE      0x1290
+#define USB_PRODUCT_IPHONE_3G   0x1292
+#define USB_PRODUCT_IPHONE_3GS  0x1294
+#define IPHETH_USBINTF_CLASS    255
+#define IPHETH_USBINTF_SUBCLASS 253
+#define IPHETH_USBINTF_PROTO    1
+#define IPHETH_BUF_SIZE         1516
+#define IPHETH_TX_TIMEOUT       (5 * HZ)
+#define IPHETH_INTFNUM          2
+#define IPHETH_ALT_INTFNUM      1
+#define IPHETH_CTRL_ENDP        0x00
+#define IPHETH_CTRL_BUF_SIZE    0x40
+#define IPHETH_CTRL_TIMEOUT     (5 * HZ)
+#define IPHETH_CMD_GET_MACADDR   0x00
+#define IPHETH_CMD_CARRIER_CHECK 0x45
+#define IPHETH_CARRIER_CHECK_TIMEOUT round_jiffies_relative(1 * HZ)
+#define IPHETH_CARRIER_ON       0x04
+static struct usb_device_id ipheth_table[] = {
+        { USB_DEVICE_AND_INTERFACE_INFO(
+                USB_VENDOR_APPLE, USB_PRODUCT_IPHONE,
+                IPHETH_USBINTF_CLASS, IPHETH_USBINTF_SUBCLASS,
+                IPHETH_USBINTF_PROTO) },
+        { USB_DEVICE_AND_INTERFACE_INFO(
+                USB_VENDOR_APPLE, USB_PRODUCT_IPHONE_3G,
+                IPHETH_USBINTF_CLASS, IPHETH_USBINTF_SUBCLASS,
+                IPHETH_USBINTF_PROTO) },
+        { USB_DEVICE_AND_INTERFACE_INFO(
+                USB_VENDOR_APPLE, USB_PRODUCT_IPHONE_3GS,
+                IPHETH_USBINTF_CLASS, IPHETH_USBINTF_SUBCLASS,
+                IPHETH_USBINTF_PROTO) },
+        { }
+};
+MODULE_DEVICE_TABLE(usb, ipheth_table);
+struct ipheth_device {
+        struct usb_device *udev;
+        struct usb_interface *intf;
+        struct net_device *net;
+        struct sk_buff *tx_skb;
+        struct urb *tx_urb;
+        struct urb *rx_urb;
+        unsigned char *tx_buf;
+        unsigned char *rx_buf;
+        unsigned char *ctrl_buf;
+        u8 bulk_in;
+        u8 bulk_out;
+        struct delayed_work carrier_work;
+};
+static int ipheth_rx_submit(struct ipheth_device *dev, gfp_t mem_flags);
+static int ipheth_alloc_urbs(struct ipheth_device *iphone)
+{
+        struct urb *tx_urb = NULL;
+        struct urb *rx_urb = NULL;
+        u8 *tx_buf = NULL;
+        u8 *rx_buf = NULL;
+        tx_urb = usb_alloc_urb(0, GFP_KERNEL);
+        if (tx_urb == NULL)
+                goto error_nomem;
+        rx_urb = usb_alloc_urb(0, GFP_KERNEL);
+        if (rx_urb == NULL)
+                goto free_tx_urb;
+        tx_buf = usb_buffer_alloc(iphone->udev,
+                                  IPHETH_BUF_SIZE,
+                                  GFP_KERNEL,
+                                  &tx_urb->transfer_dma);
+        if (tx_buf == NULL)
+                goto free_rx_urb;
+        rx_buf = usb_buffer_alloc(iphone->udev,
+                                  IPHETH_BUF_SIZE,
+                                  GFP_KERNEL,
+                                  &rx_urb->transfer_dma);
+        if (rx_buf == NULL)
+                goto free_tx_buf;
+        iphone->tx_urb = tx_urb;
+        iphone->rx_urb = rx_urb;
+        iphone->tx_buf = tx_buf;
+        iphone->rx_buf = rx_buf;
+        return 0;
+free_tx_buf:
+        usb_buffer_free(iphone->udev, IPHETH_BUF_SIZE, tx_buf,
+                        tx_urb->transfer_dma);
+free_rx_urb:
+        usb_free_urb(rx_urb);
+free_tx_urb:
+        usb_free_urb(tx_urb);
+error_nomem:
+        return -ENOMEM;
+}
+static void ipheth_free_urbs(struct ipheth_device *iphone)
+{
+        usb_buffer_free(iphone->udev, IPHETH_BUF_SIZE, iphone->rx_buf,
+                        iphone->rx_urb->transfer_dma);
+        usb_buffer_free(iphone->udev, IPHETH_BUF_SIZE, iphone->tx_buf,
+                        iphone->tx_urb->transfer_dma);
+        usb_free_urb(iphone->rx_urb);
+        usb_free_urb(iphone->tx_urb);
+}
+static void ipheth_kill_urbs(struct ipheth_device *dev)
+{
+        usb_kill_urb(dev->tx_urb);
+        usb_kill_urb(dev->rx_urb);
+}
+static void ipheth_rcvbulk_callback(struct urb *urb)
+{
+        struct ipheth_device *dev;
+        struct sk_buff *skb;
+        int status;
+        char *buf;
+        int len;
+        dev = urb->context;
+        if (dev == NULL)
+                return;
+        status = urb->status;
+        switch (status) {
+        case -ENOENT:
+        case -ECONNRESET:
+        case -ESHUTDOWN:
+                return;
+        case 0:
+                break;
+        default:
+                err("%s: urb status: %d", __func__, urb->status);
+                return;
+        }
+        len = urb->actual_length;
+        buf = urb->transfer_buffer;
+        skb = dev_alloc_skb(NET_IP_ALIGN + len);
+        if (!skb) {
+                err("%s: dev_alloc_skb: -ENOMEM", __func__);
+                dev->net->stats.rx_dropped++;
+                return;
+        }
+        skb_reserve(skb, NET_IP_ALIGN);
+        memcpy(skb_put(skb, len), buf + NET_IP_ALIGN, len - NET_IP_ALIGN);
+        skb->dev = dev->net;
+        skb->protocol = eth_type_trans(skb, dev->net);
+        dev->net->stats.rx_packets++;
+        dev->net->stats.rx_bytes += len;
+        netif_rx(skb);
+        ipheth_rx_submit(dev, GFP_ATOMIC);
+}
+static void ipheth_sndbulk_callback(struct urb *urb)
+{
+        struct ipheth_device *dev;
+        dev = urb->context;
+        if (dev == NULL)
+                return;
+        if (urb->status != 0 &&
+            urb->status != -ENOENT &&
+            urb->status != -ECONNRESET &&
+            urb->status != -ESHUTDOWN)
+                err("%s: urb status: %d", __func__, urb->status);
+        dev_kfree_skb_irq(dev->tx_skb);
+        netif_wake_queue(dev->net);
+}
+static int ipheth_carrier_set(struct ipheth_device *dev)
+{
+        struct usb_device *udev = dev->udev;
+        int retval;
+        retval = usb_control_msg(udev,
+                        usb_rcvctrlpipe(udev, IPHETH_CTRL_ENDP),
+                        IPHETH_CMD_CARRIER_CHECK, /* request */
+                        0xc0, /* request type */
+                        0x00, /* value */
+                        0x02, /* index */
+                        dev->ctrl_buf, IPHETH_CTRL_BUF_SIZE,
+                        IPHETH_CTRL_TIMEOUT);
+        if (retval < 0) {
+                err("%s: usb_control_msg: %d", __func__, retval);
+                return retval;
+        }
+        if (dev->ctrl_buf[0] == IPHETH_CARRIER_ON)
+                netif_carrier_on(dev->net);
+        else
+                netif_carrier_off(dev->net);
+        return 0;
+}
+static void ipheth_carrier_check_work(struct work_struct *work)
+{
+        struct ipheth_device *dev = container_of(work, struct ipheth_device,
+                                                 carrier_work.work);
+        ipheth_carrier_set(dev);
+        schedule_delayed_work(&dev->carrier_work, IPHETH_CARRIER_CHECK_TIMEOUT);
+}
+static int ipheth_get_macaddr(struct ipheth_device *dev)
+{
+        struct usb_device *udev = dev->udev;
+        struct net_device *net = dev->net;
+        int retval;
+        retval = usb_control_msg(udev,
+                                 usb_rcvctrlpipe(udev, IPHETH_CTRL_ENDP),
+                                 IPHETH_CMD_GET_MACADDR, /* request */
+                                 0xc0, /* request type */
+                                 0x00, /* value */
+                                 0x02, /* index */
+                                 dev->ctrl_buf,
+                                 IPHETH_CTRL_BUF_SIZE,
+                                 IPHETH_CTRL_TIMEOUT);
+        if (retval < 0) {
+                err("%s: usb_control_msg: %d", __func__, retval);
+        } else if (retval < ETH_ALEN) {
+                err("%s: usb_control_msg: short packet: %d bytes",
+                        __func__, retval);
+                retval = -EINVAL;
+        } else {
+                memcpy(net->dev_addr, dev->ctrl_buf, ETH_ALEN);
+                retval = 0;
+        }
+        return retval;
+}
+static int ipheth_rx_submit(struct ipheth_device *dev, gfp_t mem_flags)
+{
+        struct usb_device *udev = dev->udev;
+        int retval;
+        usb_fill_bulk_urb(dev->rx_urb, udev,
+                          usb_rcvbulkpipe(udev, dev->bulk_in),
+                          dev->rx_buf, IPHETH_BUF_SIZE,
+                          ipheth_rcvbulk_callback,
+                          dev);
+        dev->rx_urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
+        retval = usb_submit_urb(dev->rx_urb, mem_flags);
+        if (retval)
+                err("%s: usb_submit_urb: %d", __func__, retval);
+        return retval;
+}
+static int ipheth_open(struct net_device *net)
+{
+        struct ipheth_device *dev = netdev_priv(net);
+        struct usb_device *udev = dev->udev;
+        int retval = 0;
+        usb_set_interface(udev, IPHETH_INTFNUM, IPHETH_ALT_INTFNUM);
+        retval = ipheth_carrier_set(dev);
+        if (retval)
+                return retval;
+        retval = ipheth_rx_submit(dev, GFP_KERNEL);
+        if (retval)
+                return retval;
+        schedule_delayed_work(&dev->carrier_work, IPHETH_CARRIER_CHECK_TIMEOUT);
+        netif_start_queue(net);
+        return retval;
+}
+static int ipheth_close(struct net_device *net)
+{
+        struct ipheth_device *dev = netdev_priv(net);
+        cancel_delayed_work_sync(&dev->carrier_work);
+        netif_stop_queue(net);
+        return 0;
+}
+static int ipheth_tx(struct sk_buff *skb, struct net_device *net)
+{
+        struct ipheth_device *dev = netdev_priv(net);
+        struct usb_device *udev = dev->udev;
+        int retval;
+        /* Paranoid */
+        if (skb->len > IPHETH_BUF_SIZE) {
+                WARN(1, "%s: skb too large: %d bytes", __func__, skb->len);
+                dev->net->stats.tx_dropped++;
+                dev_kfree_skb_irq(skb);
+                return NETDEV_TX_OK;
+        }
+        memcpy(dev->tx_buf, skb->data, skb->len);
+        if (skb->len < IPHETH_BUF_SIZE)
+                memset(dev->tx_buf + skb->len, 0, IPHETH_BUF_SIZE - skb->len);
+        usb_fill_bulk_urb(dev->tx_urb, udev,
+                          usb_sndbulkpipe(udev, dev->bulk_out),
+                          dev->tx_buf, IPHETH_BUF_SIZE,
+                          ipheth_sndbulk_callback,
+                          dev);
+        dev->tx_urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
+        retval = usb_submit_urb(dev->tx_urb, GFP_ATOMIC);
+        if (retval) {
+                err("%s: usb_submit_urb: %d", __func__, retval);
+                dev->net->stats.tx_errors++;
+                dev_kfree_skb_irq(skb);
+        } else {
+                dev->tx_skb = skb;
+                dev->net->stats.tx_packets++;
+                dev->net->stats.tx_bytes += skb->len;
+                netif_stop_queue(net);
+        }
+        return NETDEV_TX_OK;
+}
+static void ipheth_tx_timeout(struct net_device *net)
+{
+        struct ipheth_device *dev = netdev_priv(net);
+        err("%s: TX timeout", __func__);
+        dev->net->stats.tx_errors++;
+        usb_unlink_urb(dev->tx_urb);
+}
+static struct net_device_stats *ipheth_stats(struct net_device *net)
+{
+        struct ipheth_device *dev = netdev_priv(net);
+        return &dev->net->stats;
+}
+static u32 ipheth_ethtool_op_get_link(struct net_device *net)
+{
+        struct ipheth_device *dev = netdev_priv(net);
+        return netif_carrier_ok(dev->net);
+}
+static struct ethtool_ops ops = {
+        .get_link = ipheth_ethtool_op_get_link
+};
+static const struct net_device_ops ipheth_netdev_ops = {
+        .ndo_open = &ipheth_open,
+        .ndo_stop = &ipheth_close,
+        .ndo_start_xmit = &ipheth_tx,
+        .ndo_tx_timeout = &ipheth_tx_timeout,
+        .ndo_get_stats = &ipheth_stats,
+};
+static struct device_type ipheth_type = {
+        .name   = "wwan",
+};
+static int ipheth_probe(struct usb_interface *intf,
+                        const struct usb_device_id *id)
+{
+        struct usb_device *udev = interface_to_usbdev(intf);
+        struct usb_host_interface *hintf;
+        struct usb_endpoint_descriptor *endp;
+        struct ipheth_device *dev;
+        struct net_device *netdev;
+        int i;
+        int retval;
+        netdev = alloc_etherdev(sizeof(struct ipheth_device));
+        if (!netdev)
+                return -ENOMEM;
+        netdev->netdev_ops = &ipheth_netdev_ops;
+        netdev->watchdog_timeo = IPHETH_TX_TIMEOUT;
+        strcpy(netdev->name, "wwan%d");
+        dev = netdev_priv(netdev);
+        dev->udev = udev;
+        dev->net = netdev;
+        dev->intf = intf;
+        /* Set up endpoints */
+        hintf = usb_altnum_to_altsetting(intf, IPHETH_ALT_INTFNUM);
+        if (hintf == NULL) {
+                retval = -ENODEV;
+                err("Unable to find alternate settings interface");
+                goto err_endpoints;
+        }
+        for (i = 0; i < hintf->desc.bNumEndpoints; i++) {
+                endp = &hintf->endpoint[i].desc;
+                if (usb_endpoint_is_bulk_in(endp))
+                        dev->bulk_in = endp->bEndpointAddress;
+                else if (usb_endpoint_is_bulk_out(endp))
+                        dev->bulk_out = endp->bEndpointAddress;
+        }
+        if (!(dev->bulk_in && dev->bulk_out)) {
+                retval = -ENODEV;
+                err("Unable to find endpoints");
+                goto err_endpoints;
+        }
+        dev->ctrl_buf = kmalloc(IPHETH_CTRL_BUF_SIZE, GFP_KERNEL);
+        if (dev->ctrl_buf == NULL) {
+                retval = -ENOMEM;
+                goto err_alloc_ctrl_buf;
+        }
+        retval = ipheth_get_macaddr(dev);
+        if (retval)
+                goto err_get_macaddr;
+        INIT_DELAYED_WORK(&dev->carrier_work, ipheth_carrier_check_work);
+        retval = ipheth_alloc_urbs(dev);
+        if (retval) {
+                err("error allocating urbs: %d", retval);
+                goto err_alloc_urbs;
+        }
+        usb_set_intfdata(intf, dev);
+        SET_NETDEV_DEV(netdev, &intf->dev);
+        SET_ETHTOOL_OPS(netdev, &ops);
+        SET_NETDEV_DEVTYPE(netdev, &ipheth_type);
+        retval = register_netdev(netdev);
+        if (retval) {
+                err("error registering netdev: %d", retval);
+                retval = -EIO;
+                goto err_register_netdev;
+        }
+        dev_info(&intf->dev, "Apple iPhone USB Ethernet device attached\n");
+        return 0;
+err_register_netdev:
+        ipheth_free_urbs(dev);
+err_alloc_urbs:
+err_get_macaddr:
+err_alloc_ctrl_buf:
+        kfree(dev->ctrl_buf);
+err_endpoints:
+        free_netdev(netdev);
+        return retval;
+}
+static void ipheth_disconnect(struct usb_interface *intf)
+{
+        struct ipheth_device *dev;
+        dev = usb_get_intfdata(intf);
+        if (dev != NULL) {
+                unregister_netdev(dev->net);
+                ipheth_kill_urbs(dev);
+                ipheth_free_urbs(dev);
+                kfree(dev->ctrl_buf);
+                free_netdev(dev->net);
+        }
+        usb_set_intfdata(intf, NULL);
+        dev_info(&intf->dev, "Apple iPhone USB Ethernet now disconnected\n");
+}
+static struct usb_driver ipheth_driver = {
+        .name =         "ipheth",
+        .probe =        ipheth_probe,
+        .disconnect =   ipheth_disconnect,
+        .id_table =     ipheth_table,
+};
+static int __init ipheth_init(void)
+{
+        int retval;
+        retval = usb_register(&ipheth_driver);
+        if (retval) {
+                err("usb_register failed: %d", retval);
+                return retval;
+        }
+        return 0;
+}
+static void __exit ipheth_exit(void)
+{
+        usb_deregister(&ipheth_driver);
+}
+module_init(ipheth_init);
+module_exit(ipheth_exit);
+MODULE_AUTHOR("Diego Giagio <diego@giagio.com>");
+MODULE_DESCRIPTION("Apple iPhone USB Ethernet driver");
+MODULE_LICENSE("Dual BSD/GPL");
diff --git a/drivers/net/usb/kaweth.c b/drivers/net/usb/kaweth.c
index 52671ea043a7..c4c334d9770f 100644
--- a/drivers/net/usb/kaweth.c
+++ b/drivers/net/usb/kaweth.c
@@ -145,6 +145,7 @@ static struct usb_device_id usb_klsi_table[] = {
        { USB_DEVICE(0x0707, 0x0100) }, /* SMC 2202USB */
        { USB_DEVICE(0x07aa, 0x0001) }, /* Correga K.K. */
        { USB_DEVICE(0x07b8, 0x4000) }, /* D-Link DU-E10 */
+        { USB_DEVICE(0x07c9, 0xb010) }, /* Allied Telesyn AT-USB10 USB Ethernet Adapter */
        { USB_DEVICE(0x0846, 0x1001) }, /* NetGear EA-101 */
        { USB_DEVICE(0x0846, 0x1002) }, /* NetGear EA-101 */
        { USB_DEVICE(0x085a, 0x0008) }, /* PortGear Ethernet Adapter */
diff --git a/drivers/net/usb/sierra_net.c b/drivers/net/usb/sierra_net.c
new file mode 100644
index 000000000000..f1942d69a0d5
--- /dev/null
+++ b/drivers/net/usb/sierra_net.c
@@ -0,0 +1,1004 @@
+/*
+ * USB-to-WWAN Driver for Sierra Wireless modems
+ *
+ * Copyright (C) 2008, 2009, 2010 Paxton Smith, Matthew Safar, Rory Filer
+ *                          <linux@sierrawireless.com>
+ *
+ * Portions of this based on the cdc_ether driver by David Brownell (2003-2005)
+ * and Ole Andre Vadla Ravnas (ActiveSync) (2006).
+ *
+ * IMPORTANT DISCLAIMER: This driver is not commercially supported by
+ * Sierra Wireless. Use at your own risk.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ */
+#define DRIVER_VERSION "v.2.0"
+#define DRIVER_AUTHOR "Paxton Smith, Matthew Safar, Rory Filer"
+#define DRIVER_DESC "USB-to-WWAN Driver for Sierra Wireless modems"
+static const char driver_name[] = "sierra_net";
+/* if defined debug messages enabled */
+/*#define       DEBUG*/
+#include <linux/module.h>
+#include <linux/etherdevice.h>
+#include <linux/ethtool.h>
+#include <linux/mii.h>
+#include <linux/sched.h>
+#include <linux/timer.h>
+#include <linux/usb.h>
+#include <linux/usb/cdc.h>
+#include <net/ip.h>
+#include <net/udp.h>
+#include <asm/unaligned.h>
+#include <linux/usb/usbnet.h>
+#define SWI_USB_REQUEST_GET_FW_ATTR     0x06
+#define SWI_GET_FW_ATTR_MASK            0x08
+/* atomic counter partially included in MAC address to make sure 2 devices
+ * do not end up with the same MAC - concept breaks in case of > 255 ifaces
+ */
+static  atomic_t iface_counter = ATOMIC_INIT(0);
+/*
+ * SYNC Timer Delay definition used to set the expiry time
+ */
+#define SIERRA_NET_SYNCDELAY (2*HZ)
+/* Max. MTU supported. The modem buffers are limited to 1500 */
+#define SIERRA_NET_MAX_SUPPORTED_MTU    1500
+/* The SIERRA_NET_USBCTL_BUF_LEN defines a buffer size allocated for control
+ * message reception ... and thus the max. received packet.
+ * (May be the cause for parse_hip returning -EINVAL)
+ */
+#define SIERRA_NET_USBCTL_BUF_LEN       1024
+/* list of interface numbers - used for constructing interface lists */
+struct sierra_net_iface_info {
+        const u32 infolen;      /* number of interface numbers on list */
+        const u8  *ifaceinfo;   /* pointer to the array holding the numbers */
+};
+struct sierra_net_info_data {
+        u16 rx_urb_size;
+        struct sierra_net_iface_info whitelist;
+};
+/* Private data structure */
+struct sierra_net_data {
+        u8 ethr_hdr_tmpl[ETH_HLEN]; /* ethernet header template for rx'd pkts */
+        u16 link_up;            /* air link up or down */
+        u8 tx_hdr_template[4];  /* part of HIP hdr for tx'd packets */
+        u8 sync_msg[4];         /* SYNC message */
+        u8 shdwn_msg[4];        /* Shutdown message */
+        /* Backpointer to the container */
+        struct usbnet *usbnet;
+        u8 ifnum;       /* interface number */
+/* Bit masks, must be a power of 2 */
+#define SIERRA_NET_EVENT_RESP_AVAIL    0x01
+#define SIERRA_NET_TIMER_EXPIRY        0x02
+        unsigned long kevent_flags;
+        struct work_struct sierra_net_kevent;
+        struct timer_list sync_timer; /* For retrying SYNC sequence */
+};
+struct param {
+        int is_present;
+        union {
+                void  *ptr;
+                u32    dword;
+                u16    word;
+                u8     byte;
+        };
+};
+/* HIP message type */
+#define SIERRA_NET_HIP_EXTENDEDID       0x7F
+#define SIERRA_NET_HIP_HSYNC_ID         0x60    /* Modem -> host */
+#define SIERRA_NET_HIP_RESTART_ID       0x62    /* Modem -> host */
+#define SIERRA_NET_HIP_MSYNC_ID         0x20    /* Host -> modem */
+#define SIERRA_NET_HIP_SHUTD_ID         0x26    /* Host -> modem */
+#define SIERRA_NET_HIP_EXT_IP_IN_ID   0x0202
+#define SIERRA_NET_HIP_EXT_IP_OUT_ID  0x0002
+/* 3G UMTS Link Sense Indication definitions */
+#define SIERRA_NET_HIP_LSI_UMTSID       0x78
+/* Reverse Channel Grant Indication HIP message */
+#define SIERRA_NET_HIP_RCGI             0x64
+/* LSI Protocol types */
+#define SIERRA_NET_PROTOCOL_UMTS      0x01
+/* LSI Coverage */
+#define SIERRA_NET_COVERAGE_NONE      0x00
+#define SIERRA_NET_COVERAGE_NOPACKET  0x01
+/* LSI Session */
+#define SIERRA_NET_SESSION_IDLE       0x00
+/* LSI Link types */
+#define SIERRA_NET_AS_LINK_TYPE_IPv4  0x00
+struct lsi_umts {
+        u8 protocol;
+        u8 unused1;
+        __be16 length;
+        /* eventually use a union for the rest - assume umts for now */
+        u8 coverage;
+        u8 unused2[41];
+        u8 session_state;
+        u8 unused3[33];
+        u8 link_type;
+        u8 pdp_addr_len; /* NW-supplied PDP address len */
+        u8 pdp_addr[16]; /* NW-supplied PDP address (bigendian)) */
+        u8 unused4[23];
+        u8 dns1_addr_len; /* NW-supplied 1st DNS address len (bigendian) */
+        u8 dns1_addr[16]; /* NW-supplied 1st DNS address */
+        u8 dns2_addr_len; /* NW-supplied 2nd DNS address len */
+        u8 dns2_addr[16]; /* NW-supplied 2nd DNS address (bigendian)*/
+        u8 wins1_addr_len; /* NW-supplied 1st Wins address len */
+        u8 wins1_addr[16]; /* NW-supplied 1st Wins address (bigendian)*/
+        u8 wins2_addr_len; /* NW-supplied 2nd Wins address len */
+        u8 wins2_addr[16]; /* NW-supplied 2nd Wins address (bigendian) */
+        u8 unused5[4];
+        u8 gw_addr_len; /* NW-supplied GW address len */
+        u8 gw_addr[16]; /* NW-supplied GW address (bigendian) */
+        u8 reserved[8];
+} __attribute__ ((packed));
+#define SIERRA_NET_LSI_COMMON_LEN      4
+#define SIERRA_NET_LSI_UMTS_LEN        (sizeof(struct lsi_umts))
+#define SIERRA_NET_LSI_UMTS_STATUS_LEN \
+        (SIERRA_NET_LSI_UMTS_LEN - SIERRA_NET_LSI_COMMON_LEN)
+/* Forward definitions */
+static void sierra_sync_timer(unsigned long syncdata);
+static int sierra_net_change_mtu(struct net_device *net, int new_mtu);
+/* Our own net device operations structure */
+static const struct net_device_ops sierra_net_device_ops = {
+        .ndo_open               = usbnet_open,
+        .ndo_stop               = usbnet_stop,
+        .ndo_start_xmit         = usbnet_start_xmit,
+        .ndo_tx_timeout         = usbnet_tx_timeout,
+        .ndo_change_mtu         = sierra_net_change_mtu,
+        .ndo_set_mac_address    = eth_mac_addr,
+        .ndo_validate_addr      = eth_validate_addr,
+};
+/* get private data associated with passed in usbnet device */
+static inline struct sierra_net_data *sierra_net_get_private(struct usbnet *dev)
+{
+        return (struct sierra_net_data *)dev->data[0];
+}
+/* set private data associated with passed in usbnet device */
+static inline void sierra_net_set_private(struct usbnet *dev,
+                        struct sierra_net_data *priv)
+{
+        dev->data[0] = (unsigned long)priv;
+}
+/* is packet IPv4 */
+static inline int is_ip(struct sk_buff *skb)
+{
+        return (skb->protocol == cpu_to_be16(ETH_P_IP));
+}
+/*
+ * check passed in packet and make sure that:
+ *  - it is linear (no scatter/gather)
+ *  - it is ethernet (mac_header properly set)
+ */
+static int check_ethip_packet(struct sk_buff *skb, struct usbnet *dev)
+{
+        skb_reset_mac_header(skb); /* ethernet header */
+        if (skb_is_nonlinear(skb)) {
+                netdev_err(dev->net, "Non linear buffer-dropping\n");
+                return 0;
+        }
+        if (!pskb_may_pull(skb, ETH_HLEN))
+                return 0;
+        skb->protocol = eth_hdr(skb)->h_proto;
+        return 1;
+}
+static const u8 *save16bit(struct param *p, const u8 *datap)
+{
+        p->is_present = 1;
+        p->word = get_unaligned_be16(datap);
+        return datap + sizeof(p->word);
+}
+static const u8 *save8bit(struct param *p, const u8 *datap)
+{
+        p->is_present = 1;
+        p->byte = *datap;
+        return datap + sizeof(p->byte);
+}
+/*----------------------------------------------------------------------------*
+ *                              BEGIN HIP                                     *
+ *----------------------------------------------------------------------------*/
+/* HIP header */
+#define SIERRA_NET_HIP_HDR_LEN 4
+/* Extended HIP header */
+#define SIERRA_NET_HIP_EXT_HDR_LEN 6
+struct hip_hdr {
+        int    hdrlen;
+        struct param payload_len;
+        struct param msgid;
+        struct param msgspecific;
+        struct param extmsgid;
+};
+static int parse_hip(const u8 *buf, const u32 buflen, struct hip_hdr *hh)
+{
+        const u8 *curp = buf;
+        int    padded;
+        if (buflen < SIERRA_NET_HIP_HDR_LEN)
+                return -EPROTO;
+        curp = save16bit(&hh->payload_len, curp);
+        curp = save8bit(&hh->msgid, curp);
+        curp = save8bit(&hh->msgspecific, curp);
+        padded = hh->msgid.byte & 0x80;
+        hh->msgid.byte &= 0x7F;                 /* 7 bits */
+        hh->extmsgid.is_present = (hh->msgid.byte == SIERRA_NET_HIP_EXTENDEDID);
+        if (hh->extmsgid.is_present) {
+                if (buflen < SIERRA_NET_HIP_EXT_HDR_LEN)
+                        return -EPROTO;
+                hh->payload_len.word &= 0x3FFF; /* 14 bits */
+                curp = save16bit(&hh->extmsgid, curp);
+                hh->extmsgid.word &= 0x03FF;    /* 10 bits */
+                hh->hdrlen = SIERRA_NET_HIP_EXT_HDR_LEN;
+        } else {
+                hh->payload_len.word &= 0x07FF; /* 11 bits */
+                hh->hdrlen = SIERRA_NET_HIP_HDR_LEN;
+        }
+        if (padded) {
+                hh->hdrlen++;
+                hh->payload_len.word--;
+        }
+        /* if real packet shorter than the claimed length */
+        if (buflen < (hh->hdrlen + hh->payload_len.word))
+                return -EINVAL;
+        return 0;
+}
+static void build_hip(u8 *buf, const u16 payloadlen,
+                struct sierra_net_data *priv)
+{
+        /* the following doesn't have the full functionality. We
+         * currently build only one kind of header, so it is faster this way
+         */
+        put_unaligned_be16(payloadlen, buf);
+        memcpy(buf+2, priv->tx_hdr_template, sizeof(priv->tx_hdr_template));
+}
+/*----------------------------------------------------------------------------*
+ *                              END HIP                                       *
+ *----------------------------------------------------------------------------*/
+static int sierra_net_send_cmd(struct usbnet *dev,
+                u8 *cmd, int cmdlen, const char * cmd_name)
+{
+        struct sierra_net_data *priv = sierra_net_get_private(dev);
+        int  status;
+        status = usb_control_msg(dev->udev, usb_sndctrlpipe(dev->udev, 0),
+                        USB_CDC_SEND_ENCAPSULATED_COMMAND,
+                        USB_DIR_OUT|USB_TYPE_CLASS|USB_RECIP_INTERFACE, 0,
+                        priv->ifnum, cmd, cmdlen, USB_CTRL_SET_TIMEOUT);
+        if (status != cmdlen && status != -ENODEV)
+                netdev_err(dev->net, "Submit %s failed %d\n", cmd_name, status);
+        return status;
+}
+static int sierra_net_send_sync(struct usbnet *dev)
+{
+        int  status;
+        struct sierra_net_data *priv = sierra_net_get_private(dev);
+        dev_dbg(&dev->udev->dev, "%s", __func__);
+        status = sierra_net_send_cmd(dev, priv->sync_msg,
+                        sizeof(priv->sync_msg), "SYNC");
+        return status;
+}
+static void sierra_net_set_ctx_index(struct sierra_net_data *priv, u8 ctx_ix)
+{
+        dev_dbg(&(priv->usbnet->udev->dev), "%s %d", __func__, ctx_ix);
+        priv->tx_hdr_template[0] = 0x3F;
+        priv->tx_hdr_template[1] = ctx_ix;
+        *((u16 *)&priv->tx_hdr_template[2]) =
+                cpu_to_be16(SIERRA_NET_HIP_EXT_IP_OUT_ID);
+}
+static inline int sierra_net_is_valid_addrlen(u8 len)
+{
+        return (len == sizeof(struct in_addr));
+}
+static int sierra_net_parse_lsi(struct usbnet *dev, char *data, int datalen)
+{
+        struct lsi_umts *lsi = (struct lsi_umts *)data;
+        if (datalen < sizeof(struct lsi_umts)) {
+                netdev_err(dev->net, "%s: Data length %d, exp %Zu\n",
+                                __func__, datalen,
+                                sizeof(struct lsi_umts));
+                return -1;
+        }
+        if (lsi->length != cpu_to_be16(SIERRA_NET_LSI_UMTS_STATUS_LEN)) {
+                netdev_err(dev->net, "%s: LSI_UMTS_STATUS_LEN %d, exp %u\n",
+                                __func__, be16_to_cpu(lsi->length),
+                                (u32)SIERRA_NET_LSI_UMTS_STATUS_LEN);
+                return -1;
+        }
+        /* Validate the protocol  - only support UMTS for now */
+        if (lsi->protocol != SIERRA_NET_PROTOCOL_UMTS) {
+                netdev_err(dev->net, "Protocol unsupported, 0x%02x\n",
+                        lsi->protocol);
+                return -1;
+        }
+        /* Validate the link type */
+        if (lsi->link_type != SIERRA_NET_AS_LINK_TYPE_IPv4) {
+                netdev_err(dev->net, "Link type unsupported: 0x%02x\n",
+                        lsi->link_type);
+                return -1;
+        }
+        /* Validate the coverage */
+        if (lsi->coverage == SIERRA_NET_COVERAGE_NONE
+           || lsi->coverage == SIERRA_NET_COVERAGE_NOPACKET) {
+                netdev_err(dev->net, "No coverage, 0x%02x\n", lsi->coverage);
+                return 0;
+        }
+        /* Validate the session state */
+        if (lsi->session_state == SIERRA_NET_SESSION_IDLE) {
+                netdev_err(dev->net, "Session idle, 0x%02x\n",
+                        lsi->session_state);
+                return 0;
+        }
+        /* Set link_sense true */
+        return 1;
+}
+static void sierra_net_handle_lsi(struct usbnet *dev, char *data,
+                struct hip_hdr  *hh)
+{
+        struct sierra_net_data *priv = sierra_net_get_private(dev);
+        int link_up;
+        link_up = sierra_net_parse_lsi(dev, data + hh->hdrlen,
+                                        hh->payload_len.word);
+        if (link_up < 0) {
+                netdev_err(dev->net, "Invalid LSI\n");
+                return;
+        }
+        if (link_up) {
+                sierra_net_set_ctx_index(priv, hh->msgspecific.byte);
+                priv->link_up = 1;
+                netif_carrier_on(dev->net);
+        } else {
+                priv->link_up = 0;
+                netif_carrier_off(dev->net);
+        }
+}
+static void sierra_net_dosync(struct usbnet *dev)
+{
+        int status;
+        struct sierra_net_data *priv = sierra_net_get_private(dev);
+        dev_dbg(&dev->udev->dev, "%s", __func__);
+        /* tell modem we are ready */
+        status = sierra_net_send_sync(dev);
+        if (status < 0)
+                netdev_err(dev->net,
+                        "Send SYNC failed, status %d\n", status);
+        status = sierra_net_send_sync(dev);
+        if (status < 0)
+                netdev_err(dev->net,
+                        "Send SYNC failed, status %d\n", status);
+        /* Now, start a timer and make sure we get the Restart Indication */
+        priv->sync_timer.function = sierra_sync_timer;
+        priv->sync_timer.data = (unsigned long) dev;
+        priv->sync_timer.expires = jiffies + SIERRA_NET_SYNCDELAY;
+        add_timer(&priv->sync_timer);
+}
+static void sierra_net_kevent(struct work_struct *work)
+{
+        struct sierra_net_data *priv =
+                container_of(work, struct sierra_net_data, sierra_net_kevent);
+        struct usbnet *dev = priv->usbnet;
+        int  len;
+        int  err;
+        u8  *buf;
+        u8   ifnum;
+        if (test_bit(SIERRA_NET_EVENT_RESP_AVAIL, &priv->kevent_flags)) {
+                clear_bit(SIERRA_NET_EVENT_RESP_AVAIL, &priv->kevent_flags);
+                /* Query the modem for the LSI message */
+                buf = kzalloc(SIERRA_NET_USBCTL_BUF_LEN, GFP_KERNEL);
+                if (!buf) {
+                        netdev_err(dev->net,
+                                "failed to allocate buf for LS msg\n");
+                        return;
+                }
+                ifnum = priv->ifnum;
+                len = usb_control_msg(dev->udev, usb_rcvctrlpipe(dev->udev, 0),
+                                USB_CDC_GET_ENCAPSULATED_RESPONSE,
+                                USB_DIR_IN|USB_TYPE_CLASS|USB_RECIP_INTERFACE,
+                                0, ifnum, buf, SIERRA_NET_USBCTL_BUF_LEN,
+                                USB_CTRL_SET_TIMEOUT);
+                if (len < 0) {
+                        netdev_err(dev->net,
+                                "usb_control_msg failed, status %d\n", len);
+                } else {
+                        struct hip_hdr  hh;
+                        dev_dbg(&dev->udev->dev, "%s: Received status message,"
+                                " %04x bytes", __func__, len);
+                        err = parse_hip(buf, len, &hh);
+                        if (err) {
+                                netdev_err(dev->net, "%s: Bad packet,"
+                                        " parse result %d\n", __func__, err);
+                                kfree(buf);
+                                return;
+                        }
+                        /* Validate packet length */
+                        if (len != hh.hdrlen + hh.payload_len.word) {
+                                netdev_err(dev->net, "%s: Bad packet, received"
+                                        " %d, expected %d\n",   __func__, len,
+                                        hh.hdrlen + hh.payload_len.word);
+                                kfree(buf);
+                                return;
+                        }
+                        /* Switch on received message types */
+                        switch (hh.msgid.byte) {
+                        case SIERRA_NET_HIP_LSI_UMTSID:
+                                dev_dbg(&dev->udev->dev, "LSI for ctx:%d",
+                                        hh.msgspecific.byte);
+                                sierra_net_handle_lsi(dev, buf, &hh);
+                                break;
+                        case SIERRA_NET_HIP_RESTART_ID:
+                                dev_dbg(&dev->udev->dev, "Restart reported: %d,"
+                                                " stopping sync timer",
+                                                hh.msgspecific.byte);
+                                /* Got sync resp - stop timer & clear mask */
+                                del_timer_sync(&priv->sync_timer);
+                                clear_bit(SIERRA_NET_TIMER_EXPIRY,
+                                          &priv->kevent_flags);
+                                break;
+                        case SIERRA_NET_HIP_HSYNC_ID:
+                                dev_dbg(&dev->udev->dev, "SYNC received");
+                                err = sierra_net_send_sync(dev);
+                                if (err < 0)
+                                        netdev_err(dev->net,
+                                                "Send SYNC failed %d\n", err);
+                                break;
+                        case SIERRA_NET_HIP_EXTENDEDID:
+                                netdev_err(dev->net, "Unrecognized HIP msg, "
+                                        "extmsgid 0x%04x\n", hh.extmsgid.word);
+                                break;
+                        case SIERRA_NET_HIP_RCGI:
+                                /* Ignored */
+                                break;
+                        default:
+                                netdev_err(dev->net, "Unrecognized HIP msg, "
+                                        "msgid 0x%02x\n", hh.msgid.byte);
+                                break;
+                        }
+                }
+                kfree(buf);
+        }
+        /* The sync timer bit might be set */
+        if (test_bit(SIERRA_NET_TIMER_EXPIRY, &priv->kevent_flags)) {
+                clear_bit(SIERRA_NET_TIMER_EXPIRY, &priv->kevent_flags);
+                dev_dbg(&dev->udev->dev, "Deferred sync timer expiry");
+                sierra_net_dosync(priv->usbnet);
+        }
+        if (priv->kevent_flags)
+                dev_dbg(&dev->udev->dev, "sierra_net_kevent done, "
+                        "kevent_flags = 0x%lx", priv->kevent_flags);
+}
+static void sierra_net_defer_kevent(struct usbnet *dev, int work)
+{
+        struct sierra_net_data *priv = sierra_net_get_private(dev);
+        set_bit(work, &priv->kevent_flags);
+        schedule_work(&priv->sierra_net_kevent);
+}
+/*
+ * Sync Retransmit Timer Handler. On expiry, kick the work queue
+ */
+void sierra_sync_timer(unsigned long syncdata)
+{
+        struct usbnet *dev = (struct usbnet *)syncdata;
+        dev_dbg(&dev->udev->dev, "%s", __func__);
+        /* Kick the tasklet */
+        sierra_net_defer_kevent(dev, SIERRA_NET_TIMER_EXPIRY);
+}
+static void sierra_net_status(struct usbnet *dev, struct urb *urb)
+{
+        struct usb_cdc_notification *event;
+        dev_dbg(&dev->udev->dev, "%s", __func__);
+        if (urb->actual_length < sizeof *event)
+                return;
+        /* Add cases to handle other standard notifications. */
+        event = urb->transfer_buffer;
+        switch (event->bNotificationType) {
+        case USB_CDC_NOTIFY_NETWORK_CONNECTION:
+        case USB_CDC_NOTIFY_SPEED_CHANGE:
+                /* USB 305 sends those */
+                break;
+        case USB_CDC_NOTIFY_RESPONSE_AVAILABLE:
+                sierra_net_defer_kevent(dev, SIERRA_NET_EVENT_RESP_AVAIL);
+                break;
+        default:
+                netdev_err(dev->net, ": unexpected notification %02x!\n",
+                                event->bNotificationType);
+                break;
+        }
+}
+static void sierra_net_get_drvinfo(struct net_device *net,
+                struct ethtool_drvinfo *info)
+{
+        /* Inherit standard device info */
+        usbnet_get_drvinfo(net, info);
+        strncpy(info->driver, driver_name, sizeof info->driver);
+        strncpy(info->version, DRIVER_VERSION, sizeof info->version);
+}
+static u32 sierra_net_get_link(struct net_device *net)
+{
+        struct usbnet *dev = netdev_priv(net);
+        /* Report link is down whenever the interface is down */
+        return sierra_net_get_private(dev)->link_up && netif_running(net);
+}
+static struct ethtool_ops sierra_net_ethtool_ops = {
+        .get_drvinfo = sierra_net_get_drvinfo,
+        .get_link = sierra_net_get_link,
+        .get_msglevel = usbnet_get_msglevel,
+        .set_msglevel = usbnet_set_msglevel,
+        .get_settings = usbnet_get_settings,
+        .set_settings = usbnet_set_settings,
+        .nway_reset = usbnet_nway_reset,
+};
+/* MTU can not be more than 1500 bytes, enforce it. */
+static int sierra_net_change_mtu(struct net_device *net, int new_mtu)
+{
+        if (new_mtu > SIERRA_NET_MAX_SUPPORTED_MTU)
+                return -EINVAL;
+        return usbnet_change_mtu(net, new_mtu);
+}
+static int is_whitelisted(const u8 ifnum,
+                        const struct sierra_net_iface_info *whitelist)
+{
+        if (whitelist) {
+                const u8 *list = whitelist->ifaceinfo;
+                int i;
+                for (i = 0; i < whitelist->infolen; i++) {
+                        if (list[i] == ifnum)
+                                return 1;
+                }
+        }
+        return 0;
+}
+static int sierra_net_get_fw_attr(struct usbnet *dev, u16 *datap)
+{
+        int result = 0;
+        u16 *attrdata;
+        attrdata = kmalloc(sizeof(*attrdata), GFP_KERNEL);
+        if (!attrdata)
+                return -ENOMEM;
+        result = usb_control_msg(
+                        dev->udev,
+                        usb_rcvctrlpipe(dev->udev, 0),
+                        /* _u8 vendor specific request */
+                        SWI_USB_REQUEST_GET_FW_ATTR,
+                        USB_DIR_IN | USB_TYPE_VENDOR,   /* __u8 request type */
+                        0x0000,         /* __u16 value not used */
+                        0x0000,         /* __u16 index  not used */
+                        attrdata,       /* char *data */
+                        sizeof(*attrdata),              /* __u16 size */
+                        USB_CTRL_SET_TIMEOUT);  /* int timeout */
+        if (result < 0) {
+                kfree(attrdata);
+                return -EIO;
+        }
+        *datap = *attrdata;
+        kfree(attrdata);
+        return result;
+}
+/*
+ * collects the bulk endpoints, the status endpoint.
+ */
+static int sierra_net_bind(struct usbnet *dev, struct usb_interface *intf)
+{
+        u8      ifacenum;
+        u8      numendpoints;
+        u16     fwattr = 0;
+        int     status;
+        struct ethhdr *eth;
+        struct sierra_net_data *priv;
+        static const u8 sync_tmplate[sizeof(priv->sync_msg)] = {
+                0x00, 0x00, SIERRA_NET_HIP_MSYNC_ID, 0x00};
+        static const u8 shdwn_tmplate[sizeof(priv->shdwn_msg)] = {
+                0x00, 0x00, SIERRA_NET_HIP_SHUTD_ID, 0x00};
+        struct sierra_net_info_data *data =
+                        (struct sierra_net_info_data *)dev->driver_info->data;
+        dev_dbg(&dev->udev->dev, "%s", __func__);
+        ifacenum = intf->cur_altsetting->desc.bInterfaceNumber;
+        /* We only accept certain interfaces */
+        if (!is_whitelisted(ifacenum, &data->whitelist)) {
+                dev_dbg(&dev->udev->dev, "Ignoring interface: %d", ifacenum);
+                return -ENODEV;
+        }
+        numendpoints = intf->cur_altsetting->desc.bNumEndpoints;
+        /* We have three endpoints, bulk in and out, and a status */
+        if (numendpoints != 3) {
+                dev_err(&dev->udev->dev, "Expected 3 endpoints, found: %d",
+                        numendpoints);
+                return -ENODEV;
+        }
+        /* Status endpoint set in usbnet_get_endpoints() */
+        dev->status = NULL;
+        status = usbnet_get_endpoints(dev, intf);
+        if (status < 0) {
+                dev_err(&dev->udev->dev, "Error in usbnet_get_endpoints (%d)",
+                        status);
+                return -ENODEV;
+        }
+        /* Initialize sierra private data */
+        priv = kzalloc(sizeof *priv, GFP_KERNEL);
+        if (!priv) {
+                dev_err(&dev->udev->dev, "No memory");
+                return -ENOMEM;
+        }
+        priv->usbnet = dev;
+        priv->ifnum = ifacenum;
+        dev->net->netdev_ops = &sierra_net_device_ops;
+        /* change MAC addr to include, ifacenum, and to be unique */
+        dev->net->dev_addr[ETH_ALEN-2] = atomic_inc_return(&iface_counter);
+        dev->net->dev_addr[ETH_ALEN-1] = ifacenum;
+        /* we will have to manufacture ethernet headers, prepare template */
+        eth = (struct ethhdr *)priv->ethr_hdr_tmpl;
+        memcpy(&eth->h_dest, dev->net->dev_addr, ETH_ALEN);
+        eth->h_proto = cpu_to_be16(ETH_P_IP);
+        /* prepare shutdown message template */
+        memcpy(priv->shdwn_msg, shdwn_tmplate, sizeof(priv->shdwn_msg));
+        /* set context index initially to 0 - prepares tx hdr template */
+        sierra_net_set_ctx_index(priv, 0);
+        /* decrease the rx_urb_size and max_tx_size to 4k on USB 1.1 */
+        dev->rx_urb_size  = data->rx_urb_size;
+        if (dev->udev->speed != USB_SPEED_HIGH)
+                dev->rx_urb_size  = min_t(size_t, 4096, data->rx_urb_size);
+        dev->net->hard_header_len += SIERRA_NET_HIP_EXT_HDR_LEN;
+        dev->hard_mtu = dev->net->mtu + dev->net->hard_header_len;
+        /* Set up the netdev */
+        dev->net->flags |= IFF_NOARP;
+        dev->net->ethtool_ops = &sierra_net_ethtool_ops;
+        netif_carrier_off(dev->net);
+        sierra_net_set_private(dev, priv);
+        priv->kevent_flags = 0;
+        /* Use the shared workqueue */
+        INIT_WORK(&priv->sierra_net_kevent, sierra_net_kevent);
+        /* Only need to do this once */
+        init_timer(&priv->sync_timer);
+        /* verify fw attributes */
+        status = sierra_net_get_fw_attr(dev, &fwattr);
+        dev_dbg(&dev->udev->dev, "Fw attr: %x\n", fwattr);
+        /* test whether firmware supports DHCP */
+        if (!(status == sizeof(fwattr) && (fwattr & SWI_GET_FW_ATTR_MASK))) {
+                /* found incompatible firmware version */
+                dev_err(&dev->udev->dev, "Incompatible driver and firmware"
+                        " versions\n");
+                kfree(priv);
+                return -ENODEV;
+        }
+        /* prepare sync message from template */
+        memcpy(priv->sync_msg, sync_tmplate, sizeof(priv->sync_msg));
+        /* initiate the sync sequence */
+        sierra_net_dosync(dev);
+        return 0;
+}
+static void sierra_net_unbind(struct usbnet *dev, struct usb_interface *intf)
+{
+        int status;
+        struct sierra_net_data *priv = sierra_net_get_private(dev);
+        dev_dbg(&dev->udev->dev, "%s", __func__);
+        /* Kill the timer then flush the work queue */
+        del_timer_sync(&priv->sync_timer);
+        flush_scheduled_work();
+        /* tell modem we are going away */
+        status = sierra_net_send_cmd(dev, priv->shdwn_msg,
+                        sizeof(priv->shdwn_msg), "Shutdown");
+        if (status < 0)
+                netdev_err(dev->net,
+                        "usb_control_msg failed, status %d\n", status);
+        sierra_net_set_private(dev, NULL);
+        kfree(priv);
+}
+static struct sk_buff *sierra_net_skb_clone(struct usbnet *dev,
+                struct sk_buff *skb, int len)
+{
+        struct sk_buff *new_skb;
+        /* clone skb */
+        new_skb = skb_clone(skb, GFP_ATOMIC);
+        /* remove len bytes from original */
+        skb_pull(skb, len);
+        /* trim next packet to it's length */
+        if (new_skb) {
+                skb_trim(new_skb, len);
+        } else {
+                if (netif_msg_rx_err(dev))
+                        netdev_err(dev->net, "failed to get skb\n");
+                dev->net->stats.rx_dropped++;
+        }
+        return new_skb;
+}
+/* ---------------------------- Receive data path ----------------------*/
+static int sierra_net_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
+{
+        int err;
+        struct hip_hdr  hh;
+        struct sk_buff *new_skb;
+        dev_dbg(&dev->udev->dev, "%s", __func__);
+        /* could contain multiple packets */
+        while (likely(skb->len)) {
+                err = parse_hip(skb->data, skb->len, &hh);
+                if (err) {
+                        if (netif_msg_rx_err(dev))
+                                netdev_err(dev->net, "Invalid HIP header %d\n",
+                                        err);
+                        /* dev->net->stats.rx_errors incremented by caller */
+                        dev->net->stats.rx_length_errors++;
+                        return 0;
+                }
+                /* Validate Extended HIP header */
+                if (!hh.extmsgid.is_present
+                    || hh.extmsgid.word != SIERRA_NET_HIP_EXT_IP_IN_ID) {
+                        if (netif_msg_rx_err(dev))
+                                netdev_err(dev->net, "HIP/ETH: Invalid pkt\n");
+                        dev->net->stats.rx_frame_errors++;
+                        /* dev->net->stats.rx_errors incremented by caller */;
+                        return 0;
+                }
+                skb_pull(skb, hh.hdrlen);
+                /* We are going to accept this packet, prepare it */
+                memcpy(skb->data, sierra_net_get_private(dev)->ethr_hdr_tmpl,
+                        ETH_HLEN);
+                /* Last packet in batch handled by usbnet */
+                if (hh.payload_len.word == skb->len)
+                        return 1;
+                new_skb = sierra_net_skb_clone(dev, skb, hh.payload_len.word);
+                if (new_skb)
+                        usbnet_skb_return(dev, new_skb);
+        } /* while */
+        return 0;
+}
+/* ---------------------------- Transmit data path ----------------------*/
+struct sk_buff *sierra_net_tx_fixup(struct usbnet *dev, struct sk_buff *skb,
+                gfp_t flags)
+{
+        struct sierra_net_data *priv = sierra_net_get_private(dev);
+        u16 len;
+        bool need_tail;
+        dev_dbg(&dev->udev->dev, "%s", __func__);
+        if (priv->link_up && check_ethip_packet(skb, dev) && is_ip(skb)) {
+                /* enough head room as is? */
+                if (SIERRA_NET_HIP_EXT_HDR_LEN <= skb_headroom(skb)) {
+                        /* Save the Eth/IP length and set up HIP hdr */
+                        len = skb->len;
+                        skb_push(skb, SIERRA_NET_HIP_EXT_HDR_LEN);
+                        /* Handle ZLP issue */
+                        need_tail = ((len + SIERRA_NET_HIP_EXT_HDR_LEN)
+                                % dev->maxpacket == 0);
+                        if (need_tail) {
+                                if (unlikely(skb_tailroom(skb) == 0)) {
+                                        netdev_err(dev->net, "tx_fixup:"
+                                                "no room for packet\n");
+                                        dev_kfree_skb_any(skb);
+                                        return NULL;
+                                } else {
+                                        skb->data[skb->len] = 0;
+                                        __skb_put(skb, 1);
+                                        len = len + 1;
+                                }
+                        }
+                        build_hip(skb->data, len, priv);
+                        return skb;
+                } else {
+                        /*
+                         * compensate in the future if necessary
+                         */
+                        netdev_err(dev->net, "tx_fixup: no room for HIP\n");
+                } /* headroom */
+        }
+        if (!priv->link_up)
+                dev->net->stats.tx_carrier_errors++;
+        /* tx_dropped incremented by usbnet */
+        /* filter the packet out, release it  */
+        dev_kfree_skb_any(skb);
+        return NULL;
+}
+static const u8 sierra_net_ifnum_list[] = { 7, 10, 11 };
+static const struct sierra_net_info_data sierra_net_info_data_68A3 = {
+        .rx_urb_size = 8 * 1024,
+        .whitelist = {
+                .infolen = ARRAY_SIZE(sierra_net_ifnum_list),
+                .ifaceinfo = sierra_net_ifnum_list
+        }
+};
+static const struct driver_info sierra_net_info_68A3 = {
+        .description = "Sierra Wireless USB-to-WWAN Modem",
+        .flags = FLAG_WWAN | FLAG_SEND_ZLP,
+        .bind = sierra_net_bind,
+        .unbind = sierra_net_unbind,
+        .status = sierra_net_status,
+        .rx_fixup = sierra_net_rx_fixup,
+        .tx_fixup = sierra_net_tx_fixup,
+        .data = (unsigned long)&sierra_net_info_data_68A3,
+};
+static const struct usb_device_id products[] = {
+        {USB_DEVICE(0x1199, 0x68A3), /* Sierra Wireless USB-to-WWAN modem */
+        .driver_info = (unsigned long) &sierra_net_info_68A3},
+        {}, /* last item */
+};
+MODULE_DEVICE_TABLE(usb, products);
+/* We are based on usbnet, so let it handle the USB driver specifics */
+static struct usb_driver sierra_net_driver = {
+        .name = "sierra_net",
+        .id_table = products,
+        .probe = usbnet_probe,
+        .disconnect = usbnet_disconnect,
+        .suspend = usbnet_suspend,
+        .resume = usbnet_resume,
+        .no_dynamic_id = 1,
+};
+static int __init sierra_net_init(void)
+{
+        BUILD_BUG_ON(FIELD_SIZEOF(struct usbnet, data)
+                                < sizeof(struct cdc_state));
+        return usb_register(&sierra_net_driver);
+}
+static void __exit sierra_net_exit(void)
+{
+        usb_deregister(&sierra_net_driver);
+}
+module_exit(sierra_net_exit);
+module_init(sierra_net_init);
+MODULE_AUTHOR(DRIVER_AUTHOR);
+MODULE_DESCRIPTION(DRIVER_DESC);
+MODULE_VERSION(DRIVER_VERSION);
+MODULE_LICENSE("GPL");
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 6fb783ce20b9..b0577dd1a42d 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -327,6 +327,7 @@ static int add_recvbuf_small(struct virtnet_info *vi, gfp_t gfp)
        struct scatterlist sg[2];
        int err;
+        sg_init_table(sg, 2);
        skb = netdev_alloc_skb_ip_align(vi->dev, MAX_PACKET_LEN);
        if (unlikely(!skb))
                return -ENOMEM;
@@ -352,6 +353,7 @@ static int add_recvbuf_big(struct virtnet_info *vi, gfp_t gfp)
        char *p;
        int i, err, offset;
+        sg_init_table(sg, MAX_SKB_FRAGS + 2);
        /* page in sg[MAX_SKB_FRAGS + 1] is list tail */
        for (i = MAX_SKB_FRAGS + 1; i > 1; --i) {
                first = get_a_page(vi, gfp);
diff --git a/drivers/net/wan/hdlc_ppp.c b/drivers/net/wan/hdlc_ppp.c
index b9b9d6b01c0b..941f053e650e 100644
--- a/drivers/net/wan/hdlc_ppp.c
+++ b/drivers/net/wan/hdlc_ppp.c
@@ -628,9 +628,15 @@ static void ppp_stop(struct net_device *dev)
        ppp_cp_event(dev, PID_LCP, STOP, 0, 0, 0, NULL);
 }
+static void ppp_close(struct net_device *dev)
+{
+        ppp_tx_flush();
+}
 static struct hdlc_proto proto = {
        .start          = ppp_start,
        .stop           = ppp_stop,
+        .close          = ppp_close,
        .type_trans     = ppp_type_trans,
        .ioctl          = ppp_ioctl,
        .netif_rx       = ppp_rx,
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index 67ca4e5a6017..115e1aeedb59 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -1532,8 +1532,7 @@ static int ath9k_config(struct ieee80211_hw *hw, u32 changed)
                all_wiphys_idle =  ath9k_all_wiphys_idle(sc);
                ath9k_set_wiphy_idle(aphy, idle);
-                if (!idle && all_wiphys_idle)
+                enable_radio = (!idle && all_wiphys_idle);
-                        enable_radio = true;
                /*
                 * After we unlock here its possible another wiphy
diff --git a/drivers/net/wireless/iwlwifi/iwl-4965.c b/drivers/net/wireless/iwlwifi/iwl-4965.c
index 83c52a682622..8972166386cb 100644
--- a/drivers/net/wireless/iwlwifi/iwl-4965.c
+++ b/drivers/net/wireless/iwlwifi/iwl-4965.c
@@ -2015,7 +2015,9 @@ static void iwl4965_rx_reply_tx(struct iwl_priv *priv,
                        IWL_DEBUG_TX_REPLY(priv, "Retry scheduler reclaim scd_ssn "
                                           "%d index %d\n", scd_ssn , index);
                        freed = iwl_tx_queue_reclaim(priv, txq_id, index);
-                        iwl_free_tfds_in_queue(priv, sta_id, tid, freed);
+                        if (qc)
+                                iwl_free_tfds_in_queue(priv, sta_id,
+                                                       tid, freed);
                        if (priv->mac80211_registered &&
                            (iwl_queue_space(&txq->q) > txq->q.low_mark) &&
@@ -2041,14 +2043,17 @@ static void iwl4965_rx_reply_tx(struct iwl_priv *priv,
                                   tx_resp->failure_frame);
                freed = iwl_tx_queue_reclaim(priv, txq_id, index);
-                iwl_free_tfds_in_queue(priv, sta_id, tid, freed);
+                if (qc && likely(sta_id != IWL_INVALID_STATION))
+                        iwl_free_tfds_in_queue(priv, sta_id, tid, freed);
+                else if (sta_id == IWL_INVALID_STATION)
+                        IWL_DEBUG_TX_REPLY(priv, "Station not known\n");
                if (priv->mac80211_registered &&
                    (iwl_queue_space(&txq->q) > txq->q.low_mark))
                        iwl_wake_queue(priv, txq_id);
        }
+        if (qc && likely(sta_id != IWL_INVALID_STATION))
-        iwl_txq_check_empty(priv, sta_id, tid, txq_id);
+                iwl_txq_check_empty(priv, sta_id, tid, txq_id);
        if (iwl_check_bits(status, TX_ABORT_REQUIRED_MSK))
                IWL_ERR(priv, "TODO:  Implement Tx ABORT REQUIRED!!!\n");
diff --git a/drivers/net/wireless/iwlwifi/iwl-6000.c b/drivers/net/wireless/iwlwifi/iwl-6000.c
index c4844adff92a..92b3e64fc14d 100644
--- a/drivers/net/wireless/iwlwifi/iwl-6000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-6000.c
@@ -259,7 +259,7 @@ static struct iwl_lib_ops iwl6000_lib = {
                        EEPROM_5000_REG_BAND_3_CHANNELS,
                        EEPROM_5000_REG_BAND_4_CHANNELS,
                        EEPROM_5000_REG_BAND_5_CHANNELS,
-                        EEPROM_5000_REG_BAND_24_HT40_CHANNELS,
+                        EEPROM_6000_REG_BAND_24_HT40_CHANNELS,
                        EEPROM_5000_REG_BAND_52_HT40_CHANNELS
                },
                .verify_signature  = iwlcore_eeprom_verify_signature,
@@ -323,7 +323,7 @@ static struct iwl_lib_ops iwl6050_lib = {
                        EEPROM_5000_REG_BAND_3_CHANNELS,
                        EEPROM_5000_REG_BAND_4_CHANNELS,
                        EEPROM_5000_REG_BAND_5_CHANNELS,
-                        EEPROM_5000_REG_BAND_24_HT40_CHANNELS,
+                        EEPROM_6000_REG_BAND_24_HT40_CHANNELS,
                        EEPROM_5000_REG_BAND_52_HT40_CHANNELS
                },
                .verify_signature  = iwlcore_eeprom_verify_signature,
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
index 35f819ac87a3..1460116d329f 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
@@ -346,6 +346,17 @@ static inline int get_num_of_ant_from_rate(u32 rate_n_flags)
               !!(rate_n_flags & RATE_MCS_ANT_C_MSK);
 }
+/*
+ * Static function to get the expected throughput from an iwl_scale_tbl_info
+ * that wraps a NULL pointer check
+ */
+static s32 get_expected_tpt(struct iwl_scale_tbl_info *tbl, int rs_index)
+{
+        if (tbl->expected_tpt)
+                return tbl->expected_tpt[rs_index];
+        return 0;
+}
 /**
 * rs_collect_tx_data - Update the success/failure sliding window
 *
@@ -353,19 +364,21 @@ static inline int get_num_of_ant_from_rate(u32 rate_n_flags)
 * at this rate.  window->data contains the bitmask of successful
 * packets.
 */
-static int rs_collect_tx_data(struct iwl_rate_scale_data *windows,
+static int rs_collect_tx_data(struct iwl_scale_tbl_info *tbl,
-                              int scale_index, s32 tpt, int attempts,
+                              int scale_index, int attempts, int successes)
-                              int successes)
 {
        struct iwl_rate_scale_data *window = NULL;
        static const u64 mask = (((u64)1) << (IWL_RATE_MAX_WINDOW - 1));
-        s32 fail_count;
+        s32 fail_count, tpt;
        if (scale_index < 0 || scale_index >= IWL_RATE_COUNT)
                return -EINVAL;
        /* Select window for current tx bit rate */
-        window = &(windows[scale_index]);
+        window = &(tbl->win[scale_index]);
+        /* Get expected throughput */
+        tpt = get_expected_tpt(tbl, scale_index);
        /*
         * Keep track of only the latest 62 tx frame attempts in this rate's
@@ -739,16 +752,6 @@ static bool table_type_matches(struct iwl_scale_tbl_info *a,
        return (a->lq_type == b->lq_type) && (a->ant_type == b->ant_type) &&
                (a->is_SGI == b->is_SGI);
 }
-/*
- * Static function to get the expected throughput from an iwl_scale_tbl_info
- * that wraps a NULL pointer check
- */
-static s32 get_expected_tpt(struct iwl_scale_tbl_info *tbl, int rs_index)
-{
-        if (tbl->expected_tpt)
-                return tbl->expected_tpt[rs_index];
-        return 0;
-}
 /*
 * mac80211 sends us Tx status
@@ -765,12 +768,10 @@ static void rs_tx_status(void *priv_r, struct ieee80211_supported_band *sband,
        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
        struct iwl_priv *priv = (struct iwl_priv *)priv_r;
        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-        struct iwl_rate_scale_data *window = NULL;
        enum mac80211_rate_control_flags mac_flags;
        u32 tx_rate;
        struct iwl_scale_tbl_info tbl_type;
-        struct iwl_scale_tbl_info *curr_tbl, *other_tbl;
+        struct iwl_scale_tbl_info *curr_tbl, *other_tbl, *tmp_tbl;
-        s32 tpt = 0;
        IWL_DEBUG_RATE_LIMIT(priv, "get frame ack response, update rate scale window\n");
@@ -853,7 +854,6 @@ static void rs_tx_status(void *priv_r, struct ieee80211_supported_band *sband,
                IWL_DEBUG_RATE(priv, "Neither active nor search matches tx rate\n");
                return;
        }
-        window = (struct iwl_rate_scale_data *)&(curr_tbl->win[0]);
        /*
         * Updating the frame history depends on whether packets were
@@ -866,8 +866,7 @@ static void rs_tx_status(void *priv_r, struct ieee80211_supported_band *sband,
                tx_rate = le32_to_cpu(table->rs_table[0].rate_n_flags);
                rs_get_tbl_info_from_mcs(tx_rate, priv->band, &tbl_type,
                                &rs_index);
-                tpt = get_expected_tpt(curr_tbl, rs_index);
+                rs_collect_tx_data(curr_tbl, rs_index,
-                rs_collect_tx_data(window, rs_index, tpt,
                                   info->status.ampdu_ack_len,
                                   info->status.ampdu_ack_map);
@@ -897,19 +896,13 @@ static void rs_tx_status(void *priv_r, struct ieee80211_supported_band *sband,
                         * table as active/search.
                         */
                        if (table_type_matches(&tbl_type, curr_tbl))
-                                tpt = get_expected_tpt(curr_tbl, rs_index);
+                                tmp_tbl = curr_tbl;
                        else if (table_type_matches(&tbl_type, other_tbl))
-                                tpt = get_expected_tpt(other_tbl, rs_index);
+                                tmp_tbl = other_tbl;
                        else
                                continue;
+                        rs_collect_tx_data(tmp_tbl, rs_index, 1,
-                        /* Constants mean 1 transmission, 0 successes */
+                                           i < retries ? 0 : legacy_success);
-                        if (i < retries)
-                                rs_collect_tx_data(window, rs_index, tpt, 1,
-                                                0);
-                        else
-                                rs_collect_tx_data(window, rs_index, tpt, 1,
-                                                legacy_success);
                }
                /* Update success/fail counts if not searching for new mode */
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index 8b8e3e1cbb44..bdff56583e11 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -3331,6 +3331,7 @@ static void iwl_cancel_deferred_work(struct iwl_priv *priv)
        cancel_delayed_work_sync(&priv->init_alive_start);
        cancel_delayed_work(&priv->scan_check);
+        cancel_work_sync(&priv->start_internal_scan);
        cancel_delayed_work(&priv->alive_start);
        cancel_work_sync(&priv->beacon_update);
        del_timer_sync(&priv->statistics_periodic);
diff --git a/drivers/net/wireless/iwlwifi/iwl-calib.c b/drivers/net/wireless/iwlwifi/iwl-calib.c
index de3b3f403d1f..8b516c5ff0bb 100644
--- a/drivers/net/wireless/iwlwifi/iwl-calib.c
+++ b/drivers/net/wireless/iwlwifi/iwl-calib.c
@@ -808,6 +808,18 @@ void iwl_chain_noise_calibration(struct iwl_priv *priv,
                }
        }
+        /*
+         * The above algorithm sometimes fails when the ucode
+         * reports 0 for all chains. It's not clear why that
+         * happens to start with, but it is then causing trouble
+         * because this can make us enable more chains than the
+         * hardware really has.
+         *
+         * To be safe, simply mask out any chains that we know
+         * are not on the device.
+         */
+        active_chains &= priv->hw_params.valid_rx_ant;
        num_tx_chains = 0;
        for (i = 0; i < NUM_RX_CHAINS; i++) {
                /* loops on all the bits of
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.c b/drivers/net/wireless/iwlwifi/iwl-core.c
index db050b811232..049b652bcb5e 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.c
+++ b/drivers/net/wireless/iwlwifi/iwl-core.c
@@ -308,10 +308,13 @@ int iwl_hw_nic_init(struct iwl_priv *priv)
        spin_unlock_irqrestore(&priv->lock, flags);
-        /* Allocate and init all Tx and Command queues */
+        /* Allocate or reset and init all Tx and Command queues */
-        ret = iwl_txq_ctx_reset(priv);
+        if (!priv->txq) {
-        if (ret)
+                ret = iwl_txq_ctx_alloc(priv);
-                return ret;
+                if (ret)
+                        return ret;
+        } else
+                iwl_txq_ctx_reset(priv);
        set_bit(STATUS_INIT, &priv->status);
@@ -3355,7 +3358,6 @@ static void iwl_force_rf_reset(struct iwl_priv *priv)
         */
        IWL_DEBUG_INFO(priv, "perform radio reset.\n");
        iwl_internal_short_hw_scan(priv);
-        return;
 }
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.h b/drivers/net/wireless/iwlwifi/iwl-core.h
index 4ef7739f9e8e..36940a9ec6b9 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.h
+++ b/drivers/net/wireless/iwlwifi/iwl-core.h
@@ -442,7 +442,8 @@ void iwl_rx_csa(struct iwl_priv *priv, struct iwl_rx_mem_buffer *rxb);
 /*****************************************************
 * TX
 ******************************************************/
-int iwl_txq_ctx_reset(struct iwl_priv *priv);
+int iwl_txq_ctx_alloc(struct iwl_priv *priv);
+void iwl_txq_ctx_reset(struct iwl_priv *priv);
 void iwl_hw_txq_free_tfd(struct iwl_priv *priv, struct iwl_tx_queue *txq);
 int iwl_hw_txq_attach_buf_to_tfd(struct iwl_priv *priv,
                                 struct iwl_tx_queue *txq,
@@ -456,6 +457,8 @@ void iwl_free_tfds_in_queue(struct iwl_priv *priv,
 void iwl_txq_update_write_ptr(struct iwl_priv *priv, struct iwl_tx_queue *txq);
 int iwl_tx_queue_init(struct iwl_priv *priv, struct iwl_tx_queue *txq,
                      int slots_num, u32 txq_id);
+void iwl_tx_queue_reset(struct iwl_priv *priv, struct iwl_tx_queue *txq,
+                        int slots_num, u32 txq_id);
 void iwl_tx_queue_free(struct iwl_priv *priv, int txq_id);
 int iwl_tx_agg_start(struct iwl_priv *priv, const u8 *ra, u16 tid, u16 *ssn);
 int iwl_tx_agg_stop(struct iwl_priv *priv , const u8 *ra, u16 tid);
@@ -503,7 +506,7 @@ void iwl_init_scan_params(struct iwl_priv *priv);
 int iwl_scan_cancel(struct iwl_priv *priv);
 int iwl_scan_cancel_timeout(struct iwl_priv *priv, unsigned long ms);
 int iwl_mac_hw_scan(struct ieee80211_hw *hw, struct cfg80211_scan_request *req);
-int iwl_internal_short_hw_scan(struct iwl_priv *priv);
+void iwl_internal_short_hw_scan(struct iwl_priv *priv);
 int iwl_force_reset(struct iwl_priv *priv, int mode);
 u16 iwl_fill_probe_req(struct iwl_priv *priv, struct ieee80211_mgmt *frame,
                       const u8 *ie, int ie_len, int left);
diff --git a/drivers/net/wireless/iwlwifi/iwl-dev.h b/drivers/net/wireless/iwlwifi/iwl-dev.h
index 6054c5fba0c1..ef1720a852e9 100644
--- a/drivers/net/wireless/iwlwifi/iwl-dev.h
+++ b/drivers/net/wireless/iwlwifi/iwl-dev.h
@@ -1296,6 +1296,7 @@ struct iwl_priv {
        struct work_struct tt_work;
        struct work_struct ct_enter;
        struct work_struct ct_exit;
+        struct work_struct start_internal_scan;
        struct tasklet_struct irq_tasklet;
diff --git a/drivers/net/wireless/iwlwifi/iwl-eeprom.h b/drivers/net/wireless/iwlwifi/iwl-eeprom.h
index 4e1ba824dc50..8171c701e4e1 100644
--- a/drivers/net/wireless/iwlwifi/iwl-eeprom.h
+++ b/drivers/net/wireless/iwlwifi/iwl-eeprom.h
@@ -203,6 +203,10 @@ struct iwl_eeprom_enhanced_txpwr {
 #define EEPROM_5000_REG_BAND_52_HT40_CHANNELS  ((0x92)\
                | INDIRECT_ADDRESS | INDIRECT_REGULATORY)   /* 22  bytes */
+/* 6000 regulatory - indirect access */
+#define EEPROM_6000_REG_BAND_24_HT40_CHANNELS  ((0x80)\
+                | INDIRECT_ADDRESS | INDIRECT_REGULATORY)   /* 14  bytes */
 /* 6000 and up regulatory tx power - indirect access */
 /* max. elements per section */
 #define EEPROM_MAX_TXPOWER_SECTION_ELEMENTS     (8)
diff --git a/drivers/net/wireless/iwlwifi/iwl-scan.c b/drivers/net/wireless/iwlwifi/iwl-scan.c
index 9ab0e412bf10..12e455a4b90e 100644
--- a/drivers/net/wireless/iwlwifi/iwl-scan.c
+++ b/drivers/net/wireless/iwlwifi/iwl-scan.c
@@ -470,6 +470,8 @@ EXPORT_SYMBOL(iwl_init_scan_params);
 static int iwl_scan_initiate(struct iwl_priv *priv)
 {
+        WARN_ON(!mutex_is_locked(&priv->mutex));
        IWL_DEBUG_INFO(priv, "Starting scan...\n");
        set_bit(STATUS_SCANNING, &priv->status);
        priv->is_internal_short_scan = false;
@@ -547,24 +549,31 @@ EXPORT_SYMBOL(iwl_mac_hw_scan);
 * internal short scan, this function should only been called while associated.
 * It will reset and tune the radio to prevent possible RF related problem
 */
-int iwl_internal_short_hw_scan(struct iwl_priv *priv)
+void iwl_internal_short_hw_scan(struct iwl_priv *priv)
 {
-        int ret = 0;
+        queue_work(priv->workqueue, &priv->start_internal_scan);
+}
+static void iwl_bg_start_internal_scan(struct work_struct *work)
+{
+        struct iwl_priv *priv =
+                container_of(work, struct iwl_priv, start_internal_scan);
+        mutex_lock(&priv->mutex);
        if (!iwl_is_ready_rf(priv)) {
-                ret = -EIO;
                IWL_DEBUG_SCAN(priv, "not ready or exit pending\n");
-                goto out;
+                goto unlock;
        }
        if (test_bit(STATUS_SCANNING, &priv->status)) {
                IWL_DEBUG_SCAN(priv, "Scan already in progress.\n");
-                ret = -EAGAIN;
+                goto unlock;
-                goto out;
        }
        if (test_bit(STATUS_SCAN_ABORTING, &priv->status)) {
                IWL_DEBUG_SCAN(priv, "Scan request while abort pending\n");
-                ret = -EAGAIN;
+                goto unlock;
-                goto out;
        }
        priv->scan_bands = 0;
@@ -577,9 +586,8 @@ int iwl_internal_short_hw_scan(struct iwl_priv *priv)
        set_bit(STATUS_SCANNING, &priv->status);
        priv->is_internal_short_scan = true;
        queue_work(priv->workqueue, &priv->request_scan);
+ unlock:
-out:
+        mutex_unlock(&priv->mutex);
-        return ret;
 }
 EXPORT_SYMBOL(iwl_internal_short_hw_scan);
@@ -965,6 +973,7 @@ void iwl_setup_scan_deferred_work(struct iwl_priv *priv)
        INIT_WORK(&priv->scan_completed, iwl_bg_scan_completed);
        INIT_WORK(&priv->request_scan, iwl_bg_request_scan);
        INIT_WORK(&priv->abort_scan, iwl_bg_abort_scan);
+        INIT_WORK(&priv->start_internal_scan, iwl_bg_start_internal_scan);
        INIT_DELAYED_WORK(&priv->scan_check, iwl_bg_scan_check);
 }
 EXPORT_SYMBOL(iwl_setup_scan_deferred_work);
diff --git a/drivers/net/wireless/iwlwifi/iwl-tx.c b/drivers/net/wireless/iwlwifi/iwl-tx.c
index f0b7e6cfbe4f..8dd0c036d547 100644
--- a/drivers/net/wireless/iwlwifi/iwl-tx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-tx.c
@@ -194,10 +194,34 @@ void iwl_cmd_queue_free(struct iwl_priv *priv)
        struct iwl_queue *q = &txq->q;
        struct device *dev = &priv->pci_dev->dev;
        int i;
+        bool huge = false;
        if (q->n_bd == 0)
                return;
+        for (; q->read_ptr != q->write_ptr;
+             q->read_ptr = iwl_queue_inc_wrap(q->read_ptr, q->n_bd)) {
+                /* we have no way to tell if it is a huge cmd ATM */
+                i = get_cmd_index(q, q->read_ptr, 0);
+                if (txq->meta[i].flags & CMD_SIZE_HUGE) {
+                        huge = true;
+                        continue;
+                }
+                pci_unmap_single(priv->pci_dev,
+                                 pci_unmap_addr(&txq->meta[i], mapping),
+                                 pci_unmap_len(&txq->meta[i], len),
+                                 PCI_DMA_BIDIRECTIONAL);
+        }
+        if (huge) {
+                i = q->n_window;
+                pci_unmap_single(priv->pci_dev,
+                                 pci_unmap_addr(&txq->meta[i], mapping),
+                                 pci_unmap_len(&txq->meta[i], len),
+                                 PCI_DMA_BIDIRECTIONAL);
+        }
        /* De-alloc array of command/tx buffers */
        for (i = 0; i <= TFD_CMD_SLOTS; i++)
                kfree(txq->cmd[i]);
@@ -410,6 +434,26 @@ out_free_arrays:
 }
 EXPORT_SYMBOL(iwl_tx_queue_init);
+void iwl_tx_queue_reset(struct iwl_priv *priv, struct iwl_tx_queue *txq,
+                        int slots_num, u32 txq_id)
+{
+        int actual_slots = slots_num;
+        if (txq_id == IWL_CMD_QUEUE_NUM)
+                actual_slots++;
+        memset(txq->meta, 0, sizeof(struct iwl_cmd_meta) * actual_slots);
+        txq->need_update = 0;
+        /* Initialize queue's high/low-water marks, and head/tail indexes */
+        iwl_queue_init(priv, &txq->q, TFD_QUEUE_SIZE_MAX, slots_num, txq_id);
+        /* Tell device where to find queue */
+        priv->cfg->ops->lib->txq_init(priv, txq);
+}
+EXPORT_SYMBOL(iwl_tx_queue_reset);
 /**
 * iwl_hw_txq_ctx_free - Free TXQ Context
 *
@@ -421,8 +465,7 @@ void iwl_hw_txq_ctx_free(struct iwl_priv *priv)
        /* Tx queues */
        if (priv->txq) {
-                for (txq_id = 0; txq_id < priv->hw_params.max_txq_num;
+                for (txq_id = 0; txq_id < priv->hw_params.max_txq_num; txq_id++)
-                     txq_id++)
                        if (txq_id == IWL_CMD_QUEUE_NUM)
                                iwl_cmd_queue_free(priv);
                        else
@@ -438,15 +481,15 @@ void iwl_hw_txq_ctx_free(struct iwl_priv *priv)
 EXPORT_SYMBOL(iwl_hw_txq_ctx_free);
 /**
- * iwl_txq_ctx_reset - Reset TX queue context
+ * iwl_txq_ctx_alloc - allocate TX queue context
- * Destroys all DMA structures and initialize them again
+ * Allocate all Tx DMA structures and initialize them
 *
 * @param priv
 * @return error code
 */
-int iwl_txq_ctx_reset(struct iwl_priv *priv)
+int iwl_txq_ctx_alloc(struct iwl_priv *priv)
 {
-        int ret = 0;
+        int ret;
        int txq_id, slots_num;
        unsigned long flags;
@@ -504,8 +547,31 @@ int iwl_txq_ctx_reset(struct iwl_priv *priv)
        return ret;
 }
+void iwl_txq_ctx_reset(struct iwl_priv *priv)
+{
+        int txq_id, slots_num;
+        unsigned long flags;
+        spin_lock_irqsave(&priv->lock, flags);
+        /* Turn off all Tx DMA fifos */
+        priv->cfg->ops->lib->txq_set_sched(priv, 0);
+        /* Tell NIC where to find the "keep warm" buffer */
+        iwl_write_direct32(priv, FH_KW_MEM_ADDR_REG, priv->kw.dma >> 4);
+        spin_unlock_irqrestore(&priv->lock, flags);
+        /* Alloc and init all Tx queues, including the command queue (#4) */
+        for (txq_id = 0; txq_id < priv->hw_params.max_txq_num; txq_id++) {
+                slots_num = txq_id == IWL_CMD_QUEUE_NUM ?
+                            TFD_CMD_SLOTS : TFD_TX_CMD_SLOTS;
+                iwl_tx_queue_reset(priv, &priv->txq[txq_id], slots_num, txq_id);
+        }
+}
 /**
- * iwl_txq_ctx_stop - Stop all Tx DMA channels, free Tx queue memory
+ * iwl_txq_ctx_stop - Stop all Tx DMA channels
 */
 void iwl_txq_ctx_stop(struct iwl_priv *priv)
 {
@@ -525,9 +591,6 @@ void iwl_txq_ctx_stop(struct iwl_priv *priv)
                                    1000);
        }
        spin_unlock_irqrestore(&priv->lock, flags);
-        /* Deallocate memory for all Tx queues */
-        iwl_hw_txq_ctx_free(priv);
 }
 EXPORT_SYMBOL(iwl_txq_ctx_stop);
@@ -1050,6 +1113,14 @@ int iwl_enqueue_hcmd(struct iwl_priv *priv, struct iwl_host_cmd *cmd)
        spin_lock_irqsave(&priv->hcmd_lock, flags);
+        /* If this is a huge cmd, mark the huge flag also on the meta.flags
+         * of the _original_ cmd. This is used for DMA mapping clean up.
+         */
+        if (cmd->flags & CMD_SIZE_HUGE) {
+                idx = get_cmd_index(q, q->write_ptr, 0);
+                txq->meta[idx].flags = CMD_SIZE_HUGE;
+        }
        idx = get_cmd_index(q, q->write_ptr, cmd->flags & CMD_SIZE_HUGE);
        out_cmd = txq->cmd[idx];
        out_meta = &txq->meta[idx];
@@ -1227,6 +1298,7 @@ void iwl_tx_cmd_complete(struct iwl_priv *priv, struct iwl_rx_mem_buffer *rxb)
        bool huge = !!(pkt->hdr.sequence & SEQ_HUGE_FRAME);
        struct iwl_device_cmd *cmd;
        struct iwl_cmd_meta *meta;
+        struct iwl_tx_queue *txq = &priv->txq[IWL_CMD_QUEUE_NUM];
        /* If a Tx command is being handled and it isn't in the actual
         * command queue then there a command routing bug has been introduced
@@ -1240,9 +1312,17 @@ void iwl_tx_cmd_complete(struct iwl_priv *priv, struct iwl_rx_mem_buffer *rxb)
                return;
        }
-        cmd_index = get_cmd_index(&priv->txq[IWL_CMD_QUEUE_NUM].q, index, huge);
+        /* If this is a huge cmd, clear the huge flag on the meta.flags
-        cmd = priv->txq[IWL_CMD_QUEUE_NUM].cmd[cmd_index];
+         * of the _original_ cmd. So that iwl_cmd_queue_free won't unmap
-        meta = &priv->txq[IWL_CMD_QUEUE_NUM].meta[cmd_index];
+         * the DMA buffer for the scan (huge) command.
+         */
+        if (huge) {
+                cmd_index = get_cmd_index(&txq->q, index, 0);
+                txq->meta[cmd_index].flags = 0;
+        }
+        cmd_index = get_cmd_index(&txq->q, index, huge);
+        cmd = txq->cmd[cmd_index];
+        meta = &txq->meta[cmd_index];
        pci_unmap_single(priv->pci_dev,
                         pci_unmap_addr(meta, mapping),
@@ -1264,6 +1344,7 @@ void iwl_tx_cmd_complete(struct iwl_priv *priv, struct iwl_rx_mem_buffer *rxb)
                               get_cmd_string(cmd->hdr.cmd));
                wake_up_interruptible(&priv->wait_command_queue);
        }
+        meta->flags = 0;
 }
 EXPORT_SYMBOL(iwl_tx_cmd_complete);
diff --git a/drivers/net/wireless/p54/p54pci.c b/drivers/net/wireless/p54/p54pci.c
index 269fda362836..c24067f1a0cb 100644
--- a/drivers/net/wireless/p54/p54pci.c
+++ b/drivers/net/wireless/p54/p54pci.c
@@ -246,7 +246,7 @@ static void p54p_check_tx_ring(struct ieee80211_hw *dev, u32 *index,
        u32 idx, i;
        i = (*index) % ring_limit;
-        (*index) = idx = le32_to_cpu(ring_control->device_idx[1]);
+        (*index) = idx = le32_to_cpu(ring_control->device_idx[ring_index]);
        idx %= ring_limit;
        while (i != idx) {