87 files changed, 748 insertions, 456 deletions
diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
index 7029cd50c458..0ba5b8e50a7c 100644
--- a/drivers/net/Kconfig
+++ b/drivers/net/Kconfig
@@ -907,7 +907,7 @@ config SMC91X
        select CRC32
        select MII
        depends on ARM || REDWOOD_5 || REDWOOD_6 || M32R || SUPERH || \
-                MIPS || BLACKFIN || MN10300
+                MIPS || BLACKFIN || MN10300 || COLDFIRE
        help
          This is a driver for SMC's 91x series of Ethernet chipsets,
          including the SMC91C94 and the SMC91C111. Say Y if you want it
diff --git a/drivers/net/arm/ks8695net.c b/drivers/net/arm/ks8695net.c
index 8ca639127dbc..a1d4188c430b 100644
--- a/drivers/net/arm/ks8695net.c
+++ b/drivers/net/arm/ks8695net.c
@@ -575,9 +575,9 @@ static int ks8695_poll(struct napi_struct *napi, int budget)
        if (work_done < budget) {
                unsigned long flags;
                spin_lock_irqsave(&ksp->rx_lock, flags);
+                __napi_complete(napi);
                /*enable rx interrupt*/
                writel(isr | mask_bit, KS8695_IRQ_VA + KS8695_INTEN);
-                __napi_complete(napi);
                spin_unlock_irqrestore(&ksp->rx_lock, flags);
        }
        return work_done;
diff --git a/drivers/net/atlx/atl2.h b/drivers/net/atlx/atl2.h
index d918bbe621ea..927e4de6474d 100644
--- a/drivers/net/atlx/atl2.h
+++ b/drivers/net/atlx/atl2.h
@@ -442,7 +442,7 @@ struct atl2_hw {
 struct atl2_ring_header {
    /* pointer to the descriptor ring memory */
    void *desc;
-    /* physical adress of the descriptor ring */
+    /* physical address of the descriptor ring */
    dma_addr_t dma;
    /* length of descriptor ring in bytes */
    unsigned int size;
diff --git a/drivers/net/benet/be.h b/drivers/net/benet/be.h
index be81fb2d10f7..8f0752553681 100644
--- a/drivers/net/benet/be.h
+++ b/drivers/net/benet/be.h
@@ -290,11 +290,6 @@ extern const struct ethtool_ops be_ethtool_ops;
 #define drvr_stats(adapter)             (&adapter->stats.drvr_stats)
-static inline unsigned int be_pci_func(struct be_adapter *adapter)
-{
-        return PCI_FUNC(adapter->pdev->devfn);
-}
 #define BE_SET_NETDEV_OPS(netdev, ops)  (netdev->netdev_ops = ops)
 #define PAGE_SHIFT_4K           12
diff --git a/drivers/net/benet/be_cmds.c b/drivers/net/benet/be_cmds.c
index 4b1f80519ca4..c59215361f4e 100644
--- a/drivers/net/benet/be_cmds.c
+++ b/drivers/net/benet/be_cmds.c
@@ -465,8 +465,6 @@ int be_cmd_eq_create(struct be_adapter *adapter,
        req->num_pages =  cpu_to_le16(PAGES_4K_SPANNED(q_mem->va, q_mem->size));
-        AMAP_SET_BITS(struct amap_eq_context, func, req->context,
-                        be_pci_func(adapter));
        AMAP_SET_BITS(struct amap_eq_context, valid, req->context, 1);
        /* 4byte eqe*/
        AMAP_SET_BITS(struct amap_eq_context, size, req->context, 0);
@@ -629,7 +627,6 @@ int be_cmd_cq_create(struct be_adapter *adapter,
        AMAP_SET_BITS(struct amap_cq_context, eventable, ctxt, 1);
        AMAP_SET_BITS(struct amap_cq_context, eqid, ctxt, eq->id);
        AMAP_SET_BITS(struct amap_cq_context, armed, ctxt, 1);
-        AMAP_SET_BITS(struct amap_cq_context, func, ctxt, be_pci_func(adapter));
        be_dws_cpu_to_le(ctxt, sizeof(req->context));
        be_cmd_page_addrs_prepare(req->pages, ARRAY_SIZE(req->pages), q_mem);
@@ -678,7 +675,6 @@ int be_cmd_mccq_create(struct be_adapter *adapter,
        req->num_pages = PAGES_4K_SPANNED(q_mem->va, q_mem->size);
-        AMAP_SET_BITS(struct amap_mcc_context, fid, ctxt, be_pci_func(adapter));
        AMAP_SET_BITS(struct amap_mcc_context, valid, ctxt, 1);
        AMAP_SET_BITS(struct amap_mcc_context, ring_size, ctxt,
                be_encoded_q_len(mccq->len));
@@ -727,8 +723,6 @@ int be_cmd_txq_create(struct be_adapter *adapter,
        AMAP_SET_BITS(struct amap_tx_context, tx_ring_size, ctxt,
                be_encoded_q_len(txq->len));
-        AMAP_SET_BITS(struct amap_tx_context, pci_func_id, ctxt,
-                        be_pci_func(adapter));
        AMAP_SET_BITS(struct amap_tx_context, ctx_valid, ctxt, 1);
        AMAP_SET_BITS(struct amap_tx_context, cq_id_send, ctxt, cq->id);
diff --git a/drivers/net/benet/be_hw.h b/drivers/net/benet/be_hw.h
index 5ffb149181ad..2d4a4b827637 100644
--- a/drivers/net/benet/be_hw.h
+++ b/drivers/net/benet/be_hw.h
@@ -114,8 +114,7 @@
 #define IMG_TYPE_ISCSI_BACKUP           9
 #define IMG_TYPE_FCOE_FW_ACTIVE         10
 #define IMG_TYPE_FCOE_FW_BACKUP         11
-#define IMG_TYPE_NCSI_BITFILE           13
+#define IMG_TYPE_NCSI_FW                13
-#define IMG_TYPE_NCSI_8051              14
 #define FLASHROM_OPER_FLASH             1
 #define FLASHROM_OPER_SAVE              2
@@ -127,6 +126,7 @@
 #define FLASH_IMAGE_MAX_SIZE_g3            (2097152) /* Max fw image size */
 #define FLASH_BIOS_IMAGE_MAX_SIZE_g3       (524288)  /* Max OPTION ROM img sz */
 #define FLASH_REDBOOT_IMAGE_MAX_SIZE_g3   (1048576)  /* Max Redboot image sz */
+#define FLASH_NCSI_IMAGE_MAX_SIZE_g3       (262144)  /* Max NSCI image sz */
 #define FLASH_NCSI_MAGIC                (0x16032009)
 #define FLASH_NCSI_DISABLED             (0)
@@ -144,6 +144,7 @@
 #define FLASH_FCoE_BIOS_START_g2           (524288)
 #define FLASH_REDBOOT_START_g2            (0)
+#define FLASH_NCSI_START_g3                (15990784)
 #define FLASH_iSCSI_PRIMARY_IMAGE_START_g3 (2097152)
 #define FLASH_iSCSI_BACKUP_IMAGE_START_g3  (4194304)
 #define FLASH_FCoE_PRIMARY_IMAGE_START_g3  (6291456)
diff --git a/drivers/net/benet/be_main.c b/drivers/net/benet/be_main.c
index a703ed8e24fe..43e8032f9236 100644
--- a/drivers/net/benet/be_main.c
+++ b/drivers/net/benet/be_main.c
@@ -1382,7 +1382,7 @@ rx_eq_free:
 /* There are 8 evt ids per func. Retruns the evt id's bit number */
 static inline int be_evt_bit_get(struct be_adapter *adapter, u32 eq_id)
 {
-        return eq_id - 8 * be_pci_func(adapter);
+        return eq_id % 8;
 }
 static irqreturn_t be_intx(int irq, void *dev)
@@ -1880,8 +1880,9 @@ static int be_flash_data(struct be_adapter *adapter,
        const u8 *p = fw->data;
        struct be_cmd_write_flashrom *req = flash_cmd->va;
        struct flash_comp *pflashcomp;
+        int num_comp;
-        struct flash_comp gen3_flash_types[8] = {
+        struct flash_comp gen3_flash_types[9] = {
                { FLASH_iSCSI_PRIMARY_IMAGE_START_g3, IMG_TYPE_ISCSI_ACTIVE,
                        FLASH_IMAGE_MAX_SIZE_g3},
                { FLASH_REDBOOT_START_g3, IMG_TYPE_REDBOOT,
@@ -1897,7 +1898,9 @@ static int be_flash_data(struct be_adapter *adapter,
                { FLASH_FCoE_PRIMARY_IMAGE_START_g3, IMG_TYPE_FCOE_FW_ACTIVE,
                        FLASH_IMAGE_MAX_SIZE_g3},
                { FLASH_FCoE_BACKUP_IMAGE_START_g3, IMG_TYPE_FCOE_FW_BACKUP,
-                        FLASH_IMAGE_MAX_SIZE_g3}
+                        FLASH_IMAGE_MAX_SIZE_g3},
+                { FLASH_NCSI_START_g3, IMG_TYPE_NCSI_FW,
+                        FLASH_NCSI_IMAGE_MAX_SIZE_g3}
        };
        struct flash_comp gen2_flash_types[8] = {
                { FLASH_iSCSI_PRIMARY_IMAGE_START_g2, IMG_TYPE_ISCSI_ACTIVE,
@@ -1921,11 +1924,16 @@ static int be_flash_data(struct be_adapter *adapter,
        if (adapter->generation == BE_GEN3) {
                pflashcomp = gen3_flash_types;
                filehdr_size = sizeof(struct flash_file_hdr_g3);
+                num_comp = 9;
        } else {
                pflashcomp = gen2_flash_types;
                filehdr_size = sizeof(struct flash_file_hdr_g2);
+                num_comp = 8;
        }
-        for (i = 0; i < 8; i++) {
+        for (i = 0; i < num_comp; i++) {
+                if ((pflashcomp[i].optype == IMG_TYPE_NCSI_FW) &&
+                                memcmp(adapter->fw_ver, "3.102.148.0", 11) < 0)
+                        continue;
                if ((pflashcomp[i].optype == IMG_TYPE_REDBOOT) &&
                        (!be_flash_redboot(adapter, fw->data,
                         pflashcomp[i].offset, pflashcomp[i].size,
@@ -1985,16 +1993,7 @@ int be_load_fw(struct be_adapter *adapter, u8 *func)
        struct be_dma_mem flash_cmd;
        int status, i = 0;
        const u8 *p;
-        char fw_ver[FW_VER_LEN];
-        char fw_cfg;
-        status = be_cmd_get_fw_ver(adapter, fw_ver);
-        if (status)
-                return status;
-        fw_cfg = *(fw_ver + 2);
-        if (fw_cfg == '0')
-                fw_cfg = '1';
        strcpy(fw_file, func);
        status = request_firmware(&fw, fw_file, &adapter->pdev->dev);
diff --git a/drivers/net/can/bfin_can.c b/drivers/net/can/bfin_can.c
index bf7f9ba2d903..866905fa4119 100644
--- a/drivers/net/can/bfin_can.c
+++ b/drivers/net/can/bfin_can.c
@@ -26,6 +26,7 @@
 #define DRV_NAME "bfin_can"
 #define BFIN_CAN_TIMEOUT 100
+#define TX_ECHO_SKB_MAX  1
 /*
 * transmit and receive channels
@@ -593,7 +594,7 @@ struct net_device *alloc_bfin_candev(void)
        struct net_device *dev;
        struct bfin_can_priv *priv;
-        dev = alloc_candev(sizeof(*priv));
+        dev = alloc_candev(sizeof(*priv), TX_ECHO_SKB_MAX);
        if (!dev)
                return NULL;
diff --git a/drivers/net/can/usb/ems_usb.c b/drivers/net/can/usb/ems_usb.c
index 11c87840cc00..33451092b8e8 100644
--- a/drivers/net/can/usb/ems_usb.c
+++ b/drivers/net/can/usb/ems_usb.c
@@ -876,9 +876,7 @@ static netdev_tx_t ems_usb_start_xmit(struct sk_buff *skb, struct net_device *ne
        return NETDEV_TX_OK;
 nomem:
-        if (skb)
+        dev_kfree_skb(skb);
-                dev_kfree_skb(skb);
        stats->tx_dropped++;
        return NETDEV_TX_OK;
diff --git a/drivers/net/cassini.c b/drivers/net/cassini.c
index 7cbcfb0ade1c..9bd155e4111c 100644
--- a/drivers/net/cassini.c
+++ b/drivers/net/cassini.c
@@ -5072,7 +5072,7 @@ static int __devinit cas_init_one(struct pci_dev *pdev,
        INIT_WORK(&cp->reset_task, cas_reset_task);
        /* Default link parameters */
-        if (link_mode >= 0 && link_mode <= 6)
+        if (link_mode >= 0 && link_mode < 6)
                cp->link_cntl = link_modes[link_mode];
        else
                cp->link_cntl = BMCR_ANENABLE;
diff --git a/drivers/net/chelsio/sge.c b/drivers/net/chelsio/sge.c
index 71384114a4ed..55d99ca82f8a 100644
--- a/drivers/net/chelsio/sge.c
+++ b/drivers/net/chelsio/sge.c
@@ -248,7 +248,7 @@ static void restart_sched(unsigned long);
 *
 * Interrupts are handled by a single CPU and it is likely that on a MP system
 * the application is migrated to another CPU. In that scenario, we try to
- * seperate the RX(in irq context) and TX state in order to decrease memory
+ * separate the RX(in irq context) and TX state in order to decrease memory
 * contention.
 */
 struct sge {
diff --git a/drivers/net/cpmac.c b/drivers/net/cpmac.c
index b85c81f60d10..60777fd90b33 100644
--- a/drivers/net/cpmac.c
+++ b/drivers/net/cpmac.c
@@ -28,6 +28,7 @@
 #include <linux/delay.h>
 #include <linux/netdevice.h>
+#include <linux/if_vlan.h>
 #include <linux/etherdevice.h>
 #include <linux/ethtool.h>
 #include <linux/skbuff.h>
@@ -55,9 +56,9 @@ module_param(dumb_switch, int, 0444);
 MODULE_PARM_DESC(debug_level, "Number of NETIF_MSG bits to enable");
 MODULE_PARM_DESC(dumb_switch, "Assume switch is not connected to MDIO bus");
-#define CPMAC_VERSION "0.5.1"
+#define CPMAC_VERSION "0.5.2"
-/* frame size + 802.1q tag */
+/* frame size + 802.1q tag + FCS size */
-#define CPMAC_SKB_SIZE          (ETH_FRAME_LEN + 4)
+#define CPMAC_SKB_SIZE          (ETH_FRAME_LEN + ETH_FCS_LEN + VLAN_HLEN)
 #define CPMAC_QUEUES    8
 /* Ethernet registers */
@@ -1136,8 +1137,9 @@ static int __devinit cpmac_probe(struct platform_device *pdev)
        }
        if (phy_id == PHY_MAX_ADDR) {
-                dev_err(&pdev->dev, "no PHY present\n");
+                dev_err(&pdev->dev, "no PHY present, falling back to switch on MDIO bus 0\n");
-                return -ENODEV;
+                strncpy(mdio_bus_id, "0", MII_BUS_ID_SIZE); /* fixed phys bus */
+                phy_id = pdev->id;
        }
        dev = alloc_etherdev_mq(sizeof(*priv), CPMAC_QUEUES);
@@ -1290,8 +1292,8 @@ void __devexit cpmac_exit(void)
 {
        platform_driver_unregister(&cpmac_driver);
        mdiobus_unregister(cpmac_mii);
-        mdiobus_free(cpmac_mii);
        iounmap(cpmac_mii->priv);
+        mdiobus_free(cpmac_mii);
 }
 module_init(cpmac_init);
diff --git a/drivers/net/cs89x0.c b/drivers/net/cs89x0.c
index 14624019ce71..b0208e474f7e 100644
--- a/drivers/net/cs89x0.c
+++ b/drivers/net/cs89x0.c
@@ -580,7 +580,7 @@ cs89x0_probe1(struct net_device *dev, int ioaddr, int modular)
        }
 #ifdef CONFIG_SH_HICOSH4
-        /* truely reset the chip */
+        /* truly reset the chip */
        writeword(ioaddr, ADD_PORT, 0x0114);
        writeword(ioaddr, DATA_PORT, 0x0040);
 #endif
diff --git a/drivers/net/cxgb3/cxgb3_main.c b/drivers/net/cxgb3/cxgb3_main.c
index 3e453e1d97e7..9e3e8750b46a 100644
--- a/drivers/net/cxgb3/cxgb3_main.c
+++ b/drivers/net/cxgb3/cxgb3_main.c
@@ -1294,6 +1294,7 @@ static void cxgb_down(struct adapter *adapter)
        free_irq_resources(adapter);
        quiesce_rx(adapter);
+        t3_sge_stop(adapter);
        flush_workqueue(cxgb3_wq);      /* wait for external IRQ handler */
 }
diff --git a/drivers/net/cxgb3/sge.c b/drivers/net/cxgb3/sge.c
index 78e265b484b6..67e61b2a8c42 100644
--- a/drivers/net/cxgb3/sge.c
+++ b/drivers/net/cxgb3/sge.c
@@ -197,13 +197,13 @@ static inline void refill_rspq(struct adapter *adapter,
 /**
 *      need_skb_unmap - does the platform need unmapping of sk_buffs?
 *
- *      Returns true if the platfrom needs sk_buff unmapping.  The compiler
+ *      Returns true if the platform needs sk_buff unmapping.  The compiler
 *      optimizes away unecessary code if this returns true.
 */
 static inline int need_skb_unmap(void)
 {
        /*
-         * This structure is used to tell if the platfrom needs buffer
+         * This structure is used to tell if the platform needs buffer
         * unmapping by checking if DECLARE_PCI_UNMAP_ADDR defines anything.
         */
        struct dummy {
diff --git a/drivers/net/davinci_emac.c b/drivers/net/davinci_emac.c
index 1ac9440eb3fb..8bd086aee56d 100644
--- a/drivers/net/davinci_emac.c
+++ b/drivers/net/davinci_emac.c
@@ -2385,7 +2385,7 @@ static int emac_dev_open(struct net_device *ndev)
        struct emac_priv *priv = netdev_priv(ndev);
        netif_carrier_off(ndev);
-        for (cnt = 0; cnt <= ETH_ALEN; cnt++)
+        for (cnt = 0; cnt < ETH_ALEN; cnt++)
                ndev->dev_addr[cnt] = priv->mac_addr[cnt];
        /* Configuration items */
@@ -2658,7 +2658,7 @@ static int __devinit davinci_emac_probe(struct platform_device *pdev)
        pdata = pdev->dev.platform_data;
        if (!pdata) {
-                printk(KERN_ERR "DaVinci EMAC: No platfrom data\n");
+                printk(KERN_ERR "DaVinci EMAC: No platform data\n");
                return -ENODEV;
        }
diff --git a/drivers/net/e1000e/82571.c b/drivers/net/e1000e/82571.c
index 3c95acb3a87d..712ccc66ba25 100644
--- a/drivers/net/e1000e/82571.c
+++ b/drivers/net/e1000e/82571.c
@@ -1346,7 +1346,7 @@ static s32 e1000_setup_fiber_serdes_link_82571(struct e1000_hw *hw)
 *
 *  1) down
 *  2) autoneg_progress
- *  3) autoneg_complete (the link sucessfully autonegotiated)
+ *  3) autoneg_complete (the link successfully autonegotiated)
 *  4) forced_up (the link has been forced up, it did not autonegotiate)
 *
 **/
diff --git a/drivers/net/e1000e/defines.h b/drivers/net/e1000e/defines.h
index db05ec355749..e301e26d6897 100644
--- a/drivers/net/e1000e/defines.h
+++ b/drivers/net/e1000e/defines.h
@@ -320,6 +320,8 @@
 #define E1000_RXCSUM_IPPCSE    0x00001000   /* IP payload checksum enable */
 /* Header split receive */
+#define E1000_RFCTL_NFSW_DIS            0x00000040
+#define E1000_RFCTL_NFSR_DIS            0x00000080
 #define E1000_RFCTL_ACK_DIS             0x00001000
 #define E1000_RFCTL_EXTEN               0x00008000
 #define E1000_RFCTL_IPV6_EX_DIS         0x00010000
diff --git a/drivers/net/e1000e/ich8lan.c b/drivers/net/e1000e/ich8lan.c
index 54d03a0ce3ce..8b5e157e9c87 100644
--- a/drivers/net/e1000e/ich8lan.c
+++ b/drivers/net/e1000e/ich8lan.c
@@ -2740,6 +2740,16 @@ static void e1000_initialize_hw_bits_ich8lan(struct e1000_hw *hw)
                reg &= ~(1 << 31);
                ew32(STATUS, reg);
        }
+        /*
+         * work-around descriptor data corruption issue during nfs v2 udp
+         * traffic, just disable the nfs filtering capability
+         */
+        reg = er32(RFCTL);
+        reg |= (E1000_RFCTL_NFSW_DIS | E1000_RFCTL_NFSR_DIS);
+        ew32(RFCTL, reg);
+        return;
 }
 /**
diff --git a/drivers/net/e1000e/lib.c b/drivers/net/e1000e/lib.c
index 2425ed11d5cc..a8b2c0de27c4 100644
--- a/drivers/net/e1000e/lib.c
+++ b/drivers/net/e1000e/lib.c
@@ -647,7 +647,7 @@ s32 e1000e_check_for_serdes_link(struct e1000_hw *hw)
                                if (!(rxcw & E1000_RXCW_IV)) {
                                        mac->serdes_has_link = true;
                                        e_dbg("SERDES: Link up - autoneg "
-                                           "completed sucessfully.\n");
+                                           "completed successfully.\n");
                                } else {
                                        mac->serdes_has_link = false;
                                        e_dbg("SERDES: Link down - invalid"
diff --git a/drivers/net/gianfar.c b/drivers/net/gianfar.c
index 61a7b4351e78..b6715553cf17 100644
--- a/drivers/net/gianfar.c
+++ b/drivers/net/gianfar.c
@@ -2021,7 +2021,6 @@ static int gfar_start_xmit(struct sk_buff *skb, struct net_device *dev)
        }
        /* setup the TxBD length and buffer pointer for the first BD */
-        tx_queue->tx_skbuff[tx_queue->skb_curtx] = skb;
        txbdp_start->bufPtr = dma_map_single(&priv->ofdev->dev, skb->data,
                        skb_headlen(skb), DMA_TO_DEVICE);
@@ -2053,6 +2052,10 @@ static int gfar_start_xmit(struct sk_buff *skb, struct net_device *dev)
        txbdp_start->lstatus = lstatus;
+        eieio(); /* force lstatus write before tx_skbuff */
+        tx_queue->tx_skbuff[tx_queue->skb_curtx] = skb;
        /* Update the current skb pointer to the next entry we will use
         * (wrapping if necessary) */
        tx_queue->skb_curtx = (tx_queue->skb_curtx + 1) &
diff --git a/drivers/net/igb/igb_main.c b/drivers/net/igb/igb_main.c
index 583a21c1def3..0ed25f059a00 100644
--- a/drivers/net/igb/igb_main.c
+++ b/drivers/net/igb/igb_main.c
@@ -688,7 +688,7 @@ static void igb_set_interrupt_capability(struct igb_adapter *adapter)
        /* start with one vector for every rx queue */
        numvecs = adapter->num_rx_queues;
-        /* if tx handler is seperate add 1 for every tx queue */
+        /* if tx handler is separate add 1 for every tx queue */
        if (!(adapter->flags & IGB_FLAG_QUEUE_PAIRS))
                numvecs += adapter->num_tx_queues;
diff --git a/drivers/net/irda/irda-usb.c b/drivers/net/irda/irda-usb.c
index e8e33bb9d876..2c9b3af16612 100644
--- a/drivers/net/irda/irda-usb.c
+++ b/drivers/net/irda/irda-usb.c
@@ -1651,6 +1651,8 @@ static int irda_usb_probe(struct usb_interface *intf,
        self->rx_urb = kcalloc(self->max_rx_urb, sizeof(struct urb *),
                                GFP_KERNEL);
+        if (!self->rx_urb)
+                goto err_free_net;
        for (i = 0; i < self->max_rx_urb; i++) {
                self->rx_urb[i] = usb_alloc_urb(0, GFP_KERNEL);
@@ -1783,6 +1785,8 @@ err_out_2:
 err_out_1:
        for (i = 0; i < self->max_rx_urb; i++)
                usb_free_urb(self->rx_urb[i]);
+        kfree(self->rx_urb);
+err_free_net:
        free_netdev(net);
 err_out:
        return ret;
diff --git a/drivers/net/irda/sa1100_ir.c b/drivers/net/irda/sa1100_ir.c
index c412e8026173..1dcdce0631aa 100644
--- a/drivers/net/irda/sa1100_ir.c
+++ b/drivers/net/irda/sa1100_ir.c
@@ -331,7 +331,7 @@ static int sa1100_irda_resume(struct platform_device *pdev)
                 * If we missed a speed change, initialise at the new speed
                 * directly.  It is debatable whether this is actually
                 * required, but in the interests of continuing from where
-                 * we left off it is desireable.  The converse argument is
+                 * we left off it is desirable.  The converse argument is
                 * that we should re-negotiate at 9600 baud again.
                 */
                if (si->newspeed) {
diff --git a/drivers/net/ks8851.c b/drivers/net/ks8851.c
index b5219cce12ed..0573e0bb4444 100644
--- a/drivers/net/ks8851.c
+++ b/drivers/net/ks8851.c
@@ -407,7 +407,7 @@ static irqreturn_t ks8851_irq(int irq, void *pw)
 * @buff: The buffer address
 * @len: The length of the data to read
 *
- * Issue an RXQ FIFO read command and read the @len ammount of data from
+ * Issue an RXQ FIFO read command and read the @len amount of data from
 * the FIFO into the buffer specified by @buff.
 */
 static void ks8851_rdfifo(struct ks8851_net *ks, u8 *buff, unsigned len)
diff --git a/drivers/net/qlcnic/qlcnic.h b/drivers/net/qlcnic/qlcnic.h
index b40a851ec7d1..0da94b208db1 100644
--- a/drivers/net/qlcnic/qlcnic.h
+++ b/drivers/net/qlcnic/qlcnic.h
@@ -423,6 +423,11 @@ struct qlcnic_adapter_stats {
        u64  lro_pkts;
        u64  rxbytes;
        u64  txbytes;
+        u64  lrobytes;
+        u64  lso_frames;
+        u64  xmit_on;
+        u64  xmit_off;
+        u64  skb_alloc_failure;
 };
 /*
@@ -1095,11 +1100,11 @@ struct qlcnic_brdinfo {
 static const struct qlcnic_brdinfo qlcnic_boards[] = {
        {0x1077, 0x8020, 0x1077, 0x203,
-                "8200 Series Single Port 10GbE Converged Network Adapter \
+                "8200 Series Single Port 10GbE Converged Network Adapter "
-                (TCP/IP Networking)"},
+                "(TCP/IP Networking)"},
        {0x1077, 0x8020, 0x1077, 0x207,
-                "8200 Series Dual Port 10GbE Converged Network Adapter \
+                "8200 Series Dual Port 10GbE Converged Network Adapter "
-                (TCP/IP Networking)"},
+                "(TCP/IP Networking)"},
        {0x1077, 0x8020, 0x1077, 0x20b,
                "3200 Series Dual Port 10Gb Intelligent Ethernet Adapter"},
        {0x1077, 0x8020, 0x1077, 0x20c,
diff --git a/drivers/net/qlcnic/qlcnic_ethtool.c b/drivers/net/qlcnic/qlcnic_ethtool.c
index 8da6ec8c13b9..f83e15fe3e1b 100644
--- a/drivers/net/qlcnic/qlcnic_ethtool.c
+++ b/drivers/net/qlcnic/qlcnic_ethtool.c
@@ -59,6 +59,17 @@ static const struct qlcnic_stats qlcnic_gstrings_stats[] = {
                QLC_SIZEOF(stats.rxbytes), QLC_OFF(stats.rxbytes)},
        {"tx_bytes",
                QLC_SIZEOF(stats.txbytes), QLC_OFF(stats.txbytes)},
+        {"lrobytes",
+                QLC_SIZEOF(stats.lrobytes), QLC_OFF(stats.lrobytes)},
+        {"lso_frames",
+                QLC_SIZEOF(stats.lso_frames), QLC_OFF(stats.lso_frames)},
+        {"xmit_on",
+                QLC_SIZEOF(stats.xmit_on), QLC_OFF(stats.xmit_on)},
+        {"xmit_off",
+                QLC_SIZEOF(stats.xmit_off), QLC_OFF(stats.xmit_off)},
+        {"skb_alloc_failure", QLC_SIZEOF(stats.skb_alloc_failure),
+                QLC_OFF(stats.skb_alloc_failure)},
 };
 #define QLCNIC_STATS_LEN        ARRAY_SIZE(qlcnic_gstrings_stats)
@@ -785,6 +796,11 @@ qlcnic_get_ethtool_stats(struct net_device *dev,
        }
 }
+static u32 qlcnic_get_tx_csum(struct net_device *dev)
+{
+        return dev->features & NETIF_F_IP_CSUM;
+}
 static u32 qlcnic_get_rx_csum(struct net_device *dev)
 {
        struct qlcnic_adapter *adapter = netdev_priv(dev);
@@ -995,6 +1011,7 @@ const struct ethtool_ops qlcnic_ethtool_ops = {
        .set_ringparam = qlcnic_set_ringparam,
        .get_pauseparam = qlcnic_get_pauseparam,
        .set_pauseparam = qlcnic_set_pauseparam,
+        .get_tx_csum = qlcnic_get_tx_csum,
        .set_tx_csum = ethtool_op_set_tx_csum,
        .set_sg = ethtool_op_set_sg,
        .get_tso = qlcnic_get_tso,
diff --git a/drivers/net/qlcnic/qlcnic_hw.c b/drivers/net/qlcnic/qlcnic_hw.c
index 99a4d1379d00..da00e162b6d3 100644
--- a/drivers/net/qlcnic/qlcnic_hw.c
+++ b/drivers/net/qlcnic/qlcnic_hw.c
@@ -349,6 +349,7 @@ qlcnic_send_cmd_descs(struct qlcnic_adapter *adapter,
        if (nr_desc >= qlcnic_tx_avail(tx_ring)) {
                netif_tx_stop_queue(tx_ring->txq);
                __netif_tx_unlock_bh(tx_ring->txq);
+                adapter->stats.xmit_off++;
                return -EBUSY;
        }
@@ -397,20 +398,16 @@ qlcnic_sre_macaddr_change(struct qlcnic_adapter *adapter, u8 *addr,
        return qlcnic_send_cmd_descs(adapter, (struct cmd_desc_type0 *)&req, 1);
 }
-static int qlcnic_nic_add_mac(struct qlcnic_adapter *adapter,
+static int qlcnic_nic_add_mac(struct qlcnic_adapter *adapter, u8 *addr)
-                u8 *addr, struct list_head *del_list)
 {
        struct list_head *head;
        struct qlcnic_mac_list_s *cur;
        /* look up if already exists */
-        list_for_each(head, del_list) {
+        list_for_each(head, &adapter->mac_list) {
                cur = list_entry(head, struct qlcnic_mac_list_s, list);
+                if (memcmp(addr, cur->mac_addr, ETH_ALEN) == 0)
-                if (memcmp(addr, cur->mac_addr, ETH_ALEN) == 0) {
-                        list_move_tail(head, &adapter->mac_list);
                        return 0;
-                }
        }
        cur = kzalloc(sizeof(struct qlcnic_mac_list_s), GFP_ATOMIC);
@@ -432,14 +429,9 @@ void qlcnic_set_multi(struct net_device *netdev)
        struct dev_mc_list *mc_ptr;
        u8 bcast_addr[ETH_ALEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
        u32 mode = VPORT_MISS_MODE_DROP;
-        LIST_HEAD(del_list);
-        struct list_head *head;
-        struct qlcnic_mac_list_s *cur;
-        list_splice_tail_init(&adapter->mac_list, &del_list);
+        qlcnic_nic_add_mac(adapter, adapter->mac_addr);
+        qlcnic_nic_add_mac(adapter, bcast_addr);
-        qlcnic_nic_add_mac(adapter, adapter->mac_addr, &del_list);
-        qlcnic_nic_add_mac(adapter, bcast_addr, &del_list);
        if (netdev->flags & IFF_PROMISC) {
                mode = VPORT_MISS_MODE_ACCEPT_ALL;
@@ -454,22 +446,12 @@ void qlcnic_set_multi(struct net_device *netdev)
        if (!netdev_mc_empty(netdev)) {
                netdev_for_each_mc_addr(mc_ptr, netdev) {
-                        qlcnic_nic_add_mac(adapter, mc_ptr->dmi_addr,
+                        qlcnic_nic_add_mac(adapter, mc_ptr->dmi_addr);
-                                                        &del_list);
                }
        }
 send_fw_cmd:
        qlcnic_nic_set_promisc(adapter, mode);
-        head = &del_list;
-        while (!list_empty(head)) {
-                cur = list_entry(head->next, struct qlcnic_mac_list_s, list);
-                qlcnic_sre_macaddr_change(adapter,
-                                cur->mac_addr, QLCNIC_MAC_DEL);
-                list_del(&cur->list);
-                kfree(cur);
-        }
 }
 int qlcnic_nic_set_promisc(struct qlcnic_adapter *adapter, u32 mode)
diff --git a/drivers/net/qlcnic/qlcnic_init.c b/drivers/net/qlcnic/qlcnic_init.c
index ea00ab4d4feb..7c34e4e29b3f 100644
--- a/drivers/net/qlcnic/qlcnic_init.c
+++ b/drivers/net/qlcnic/qlcnic_init.c
@@ -568,21 +568,123 @@ struct uni_table_desc *qlcnic_get_table_desc(const u8 *unirom, int section)
        return NULL;
 }
+#define FILEHEADER_SIZE (14 * 4)
 static int
-qlcnic_set_product_offs(struct qlcnic_adapter *adapter)
+qlcnic_validate_header(struct qlcnic_adapter *adapter)
 {
-        struct uni_table_desc *ptab_descr;
        const u8 *unirom = adapter->fw->data;
-        u32 i;
+        struct uni_table_desc *directory = (struct uni_table_desc *) &unirom[0];
+        __le32 fw_file_size = adapter->fw->size;
        __le32 entries;
+        __le32 entry_size;
+        __le32 tab_size;
+        if (fw_file_size < FILEHEADER_SIZE)
+                return -EINVAL;
+        entries = cpu_to_le32(directory->num_entries);
+        entry_size = cpu_to_le32(directory->entry_size);
+        tab_size = cpu_to_le32(directory->findex) + (entries * entry_size);
+        if (fw_file_size < tab_size)
+                return -EINVAL;
+        return 0;
+}
+static int
+qlcnic_validate_bootld(struct qlcnic_adapter *adapter)
+{
+        struct uni_table_desc *tab_desc;
+        struct uni_data_desc *descr;
+        const u8 *unirom = adapter->fw->data;
+        int idx = cpu_to_le32(*((int *)&unirom[adapter->file_prd_off] +
+                                QLCNIC_UNI_BOOTLD_IDX_OFF));
+        __le32 offs;
+        __le32 tab_size;
+        __le32 data_size;
+        tab_desc = qlcnic_get_table_desc(unirom, QLCNIC_UNI_DIR_SECT_BOOTLD);
+        if (!tab_desc)
+                return -EINVAL;
+        tab_size = cpu_to_le32(tab_desc->findex) +
+                        (cpu_to_le32(tab_desc->entry_size * (idx + 1)));
+        if (adapter->fw->size < tab_size)
+                return -EINVAL;
+        offs = cpu_to_le32(tab_desc->findex) +
+                (cpu_to_le32(tab_desc->entry_size) * (idx));
+        descr = (struct uni_data_desc *)&unirom[offs];
+        data_size = descr->findex + cpu_to_le32(descr->size);
+        if (adapter->fw->size < data_size)
+                return -EINVAL;
+        return 0;
+}
+static int
+qlcnic_validate_fw(struct qlcnic_adapter *adapter)
+{
+        struct uni_table_desc *tab_desc;
+        struct uni_data_desc *descr;
+        const u8 *unirom = adapter->fw->data;
+        int idx = cpu_to_le32(*((int *)&unirom[adapter->file_prd_off] +
+                                QLCNIC_UNI_FIRMWARE_IDX_OFF));
+        __le32 offs;
+        __le32 tab_size;
+        __le32 data_size;
+        tab_desc = qlcnic_get_table_desc(unirom, QLCNIC_UNI_DIR_SECT_FW);
+        if (!tab_desc)
+                return -EINVAL;
+        tab_size = cpu_to_le32(tab_desc->findex) +
+                        (cpu_to_le32(tab_desc->entry_size * (idx + 1)));
+        if (adapter->fw->size < tab_size)
+                return -EINVAL;
+        offs = cpu_to_le32(tab_desc->findex) +
+                (cpu_to_le32(tab_desc->entry_size) * (idx));
+        descr = (struct uni_data_desc *)&unirom[offs];
+        data_size = descr->findex + cpu_to_le32(descr->size);
+        if (adapter->fw->size < data_size)
+                return -EINVAL;
+        return 0;
+}
+static int
+qlcnic_validate_product_offs(struct qlcnic_adapter *adapter)
+{
+        struct uni_table_desc *ptab_descr;
+        const u8 *unirom = adapter->fw->data;
        int mn_present = qlcnic_has_mn(adapter);
+        __le32 entries;
+        __le32 entry_size;
+        __le32 tab_size;
+        u32 i;
        ptab_descr = qlcnic_get_table_desc(unirom,
                                QLCNIC_UNI_DIR_SECT_PRODUCT_TBL);
-        if (ptab_descr == NULL)
+        if (!ptab_descr)
-                return -1;
+                return -EINVAL;
        entries = cpu_to_le32(ptab_descr->num_entries);
+        entry_size = cpu_to_le32(ptab_descr->entry_size);
+        tab_size = cpu_to_le32(ptab_descr->findex) + (entries * entry_size);
+        if (adapter->fw->size < tab_size)
+                return -EINVAL;
 nomn:
        for (i = 0; i < entries; i++) {
@@ -609,7 +711,37 @@ nomn:
                mn_present = 0;
                goto nomn;
        }
-        return -1;
+        return -EINVAL;
+}
+static int
+qlcnic_validate_unified_romimage(struct qlcnic_adapter *adapter)
+{
+        if (qlcnic_validate_header(adapter)) {
+                dev_err(&adapter->pdev->dev,
+                                "unified image: header validation failed\n");
+                return -EINVAL;
+        }
+        if (qlcnic_validate_product_offs(adapter)) {
+                dev_err(&adapter->pdev->dev,
+                                "unified image: product validation failed\n");
+                return -EINVAL;
+        }
+        if (qlcnic_validate_bootld(adapter)) {
+                dev_err(&adapter->pdev->dev,
+                                "unified image: bootld validation failed\n");
+                return -EINVAL;
+        }
+        if (qlcnic_validate_fw(adapter)) {
+                dev_err(&adapter->pdev->dev,
+                                "unified image: firmware validation failed\n");
+                return -EINVAL;
+        }
+        return 0;
 }
 static
@@ -715,7 +847,7 @@ qlcnic_get_bios_version(struct qlcnic_adapter *adapter)
        bios_ver = cpu_to_le32(*((u32 *) (&fw->data[prd_off])
                                + QLCNIC_UNI_BIOS_VERSION_OFF));
-        return (bios_ver << 24) + ((bios_ver >> 8) & 0xff00) + (bios_ver >> 24);
+        return (bios_ver << 16) + ((bios_ver >> 8) & 0xff00) + (bios_ver >> 24);
 }
 int
@@ -858,7 +990,7 @@ qlcnic_validate_firmware(struct qlcnic_adapter *adapter)
        u8 fw_type = adapter->fw_type;
        if (fw_type == QLCNIC_UNIFIED_ROMIMAGE) {
-                if (qlcnic_set_product_offs(adapter))
+                if (qlcnic_validate_unified_romimage(adapter))
                        return -EINVAL;
                min_size = QLCNIC_UNI_FW_MIN_SIZE;
@@ -1114,8 +1246,10 @@ qlcnic_alloc_rx_skb(struct qlcnic_adapter *adapter,
        struct pci_dev *pdev = adapter->pdev;
        buffer->skb = dev_alloc_skb(rds_ring->skb_size);
-        if (!buffer->skb)
+        if (!buffer->skb) {
+                adapter->stats.skb_alloc_failure++;
                return -ENOMEM;
+        }
        skb = buffer->skb;
@@ -1289,7 +1423,7 @@ qlcnic_process_lro(struct qlcnic_adapter *adapter,
        netif_receive_skb(skb);
        adapter->stats.lro_pkts++;
-        adapter->stats.rxbytes += length;
+        adapter->stats.lrobytes += length;
        return buffer;
 }
@@ -1505,6 +1639,8 @@ qlcnic_process_rcv_diag(struct qlcnic_adapter *adapter,
                adapter->diag_cnt++;
        dev_kfree_skb_any(skb);
+        adapter->stats.rx_pkts++;
+        adapter->stats.rxbytes += length;
        return buffer;
 }
diff --git a/drivers/net/qlcnic/qlcnic_main.c b/drivers/net/qlcnic/qlcnic_main.c
index 665e8e56b6a8..fc721564e69e 100644
--- a/drivers/net/qlcnic/qlcnic_main.c
+++ b/drivers/net/qlcnic/qlcnic_main.c
@@ -118,6 +118,7 @@ qlcnic_update_cmd_producer(struct qlcnic_adapter *adapter,
        if (qlcnic_tx_avail(tx_ring) <= TX_STOP_THRESH) {
                netif_stop_queue(adapter->netdev);
                smp_mb();
+                adapter->stats.xmit_off++;
        }
 }
@@ -1385,6 +1386,7 @@ qlcnic_tso_check(struct net_device *netdev,
        int copied, offset, copy_len, hdr_len = 0, tso = 0, vlan_oob = 0;
        struct cmd_desc_type0 *hwdesc;
        struct vlan_ethhdr *vh;
+        struct qlcnic_adapter *adapter = netdev_priv(netdev);
        if (protocol == cpu_to_be16(ETH_P_8021Q)) {
@@ -1494,6 +1496,7 @@ qlcnic_tso_check(struct net_device *netdev,
        tx_ring->producer = producer;
        barrier();
+        adapter->stats.lso_frames++;
 }
 static int
@@ -1573,6 +1576,7 @@ qlcnic_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
        if (unlikely(no_of_desc + 2 > qlcnic_tx_avail(tx_ring))) {
                netif_stop_queue(netdev);
+                adapter->stats.xmit_off++;
                return NETDEV_TX_BUSY;
        }
@@ -1880,6 +1884,7 @@ static int qlcnic_process_cmd_ring(struct qlcnic_adapter *adapter)
                        if (qlcnic_tx_avail(tx_ring) > TX_STOP_THRESH) {
                                netif_wake_queue(netdev);
                                adapter->tx_timeo_cnt = 0;
+                                adapter->stats.xmit_on++;
                        }
                        __netif_tx_unlock(tx_ring->txq);
                }
diff --git a/drivers/net/qlge/qlge_ethtool.c b/drivers/net/qlge/qlge_ethtool.c
index 05b8bde9980d..7dbff87480dc 100644
--- a/drivers/net/qlge/qlge_ethtool.c
+++ b/drivers/net/qlge/qlge_ethtool.c
@@ -405,7 +405,7 @@ static int ql_set_wol(struct net_device *ndev, struct ethtool_wolinfo *wol)
                u32 wol = 0;
                status = ql_mb_wol_mode(qdev, wol);
                netif_err(qdev, drv, qdev->ndev, "WOL %s (wol code 0x%x)\n",
-                          status == 0 ? "cleared sucessfully" : "clear failed",
+                          status == 0 ? "cleared successfully" : "clear failed",
                          wol);
        }
diff --git a/drivers/net/qlge/qlge_main.c b/drivers/net/qlge/qlge_main.c
index c26ec5d740f6..fd34f266c0a8 100644
--- a/drivers/net/qlge/qlge_main.c
+++ b/drivers/net/qlge/qlge_main.c
@@ -3855,7 +3855,7 @@ int ql_wol(struct ql_adapter *qdev)
                status = ql_mb_wol_mode(qdev, wol);
                netif_err(qdev, drv, qdev->ndev,
                          "WOL %s (wol code 0x%x) on %s\n",
-                          (status == 0) ? "Sucessfully set" : "Failed",
+                          (status == 0) ? "Successfully set" : "Failed",
                          wol, qdev->ndev->name);
        }
diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
index dfc3573c91bb..9d3ebf3e975e 100644
--- a/drivers/net/r8169.c
+++ b/drivers/net/r8169.c
@@ -4270,7 +4270,7 @@ static netdev_tx_t rtl8169_start_xmit(struct sk_buff *skb,
        tp->cur_tx += frags + 1;
-        smp_wmb();
+        wmb();
        RTL_W8(TxPoll, NPQ);    /* set polling bit */
@@ -4621,7 +4621,7 @@ static int rtl8169_poll(struct napi_struct *napi, int budget)
                 * until it does.
                 */
                tp->intr_mask = 0xffff;
-                smp_wmb();
+                wmb();
                RTL_W16(IntrMask, tp->intr_event);
        }
diff --git a/drivers/net/s2io.c b/drivers/net/s2io.c
index 43bc66aa8405..df70657260dd 100644
--- a/drivers/net/s2io.c
+++ b/drivers/net/s2io.c
@@ -923,8 +923,8 @@ static int init_shared_mem(struct s2io_nic *nic)
        tmp_v_addr = mac_control->stats_mem;
        mac_control->stats_info = (struct stat_block *)tmp_v_addr;
        memset(tmp_v_addr, 0, size);
-        DBG_PRINT(INIT_DBG, "%s: Ring Mem PHY: 0x%llx\n", dev->name,
+        DBG_PRINT(INIT_DBG, "%s: Ring Mem PHY: 0x%llx\n",
-                  (unsigned long long)tmp_p_addr);
+                dev_name(&nic->pdev->dev), (unsigned long long)tmp_p_addr);
        mac_control->stats_info->sw_stat.mem_allocated += mem_allocated;
        return SUCCESS;
 }
@@ -3480,7 +3480,7 @@ static void s2io_reset(struct s2io_nic *sp)
        struct swStat *swstats;
        DBG_PRINT(INIT_DBG, "%s: Resetting XFrame card %s\n",
-                  __func__, sp->dev->name);
+                  __func__, pci_name(sp->pdev));
        /* Back up  the PCI-X CMD reg, dont want to lose MMRBC, OST settings */
        pci_read_config_word(sp->pdev, PCIX_COMMAND_REGISTER, &(pci_cmd));
diff --git a/drivers/net/sfc/regs.h b/drivers/net/sfc/regs.h
index 89d606fe9248..18a3be428348 100644
--- a/drivers/net/sfc/regs.h
+++ b/drivers/net/sfc/regs.h
@@ -95,7 +95,7 @@
 #define FRF_AA_INT_ACK_KER_FIELD_LBN 0
 #define FRF_AA_INT_ACK_KER_FIELD_WIDTH 32
-/* INT_ISR0_REG: Function 0 Interrupt Acknowlege Status register */
+/* INT_ISR0_REG: Function 0 Interrupt Acknowledge Status register */
 #define FR_BZ_INT_ISR0 0x00000090
 #define FRF_BZ_INT_ISR_REG_LBN 0
 #define FRF_BZ_INT_ISR_REG_WIDTH 64
diff --git a/drivers/net/skfp/ess.c b/drivers/net/skfp/ess.c
index a85efcfd9d0e..e8387d25f24a 100644
--- a/drivers/net/skfp/ess.c
+++ b/drivers/net/skfp/ess.c
@@ -557,7 +557,7 @@ static void ess_send_alc_req(struct s_smc *smc)
        /*
         * send never allocation request where the requested payload and
-         * overhead is zero or deallocate bandwidht when no bandwidth is
+         * overhead is zero or deallocate bandwidth when no bandwidth is
         * parsed
         */
        if (!smc->mib.fddiESSPayload) {
diff --git a/drivers/net/sky2.c b/drivers/net/sky2.c
index 653bdd76ef46..d8ec4c11fd49 100644
--- a/drivers/net/sky2.c
+++ b/drivers/net/sky2.c
@@ -4863,6 +4863,7 @@ static int sky2_resume(struct pci_dev *pdev)
        if (!hw)
                return 0;
+        rtnl_lock();
        err = pci_set_power_state(pdev, PCI_D0);
        if (err)
                goto out;
@@ -4884,7 +4885,6 @@ static int sky2_resume(struct pci_dev *pdev)
        sky2_write32(hw, B0_IMSK, Y2_IS_BASE);
        napi_enable(&hw->napi);
-        rtnl_lock();
        for (i = 0; i < hw->ports; i++) {
                err = sky2_reattach(hw->dev[i]);
                if (err)
diff --git a/drivers/net/smc91x.h b/drivers/net/smc91x.h
index 54799544bda3..8d2772cc42f2 100644
--- a/drivers/net/smc91x.h
+++ b/drivers/net/smc91x.h
@@ -330,6 +330,48 @@ static inline void LPD7_SMC_outsw (unsigned char* a, int r,
 #include <unit/smc91111.h>
+#elif defined(CONFIG_ARCH_MSM)
+#define SMC_CAN_USE_8BIT        0
+#define SMC_CAN_USE_16BIT       1
+#define SMC_CAN_USE_32BIT       0
+#define SMC_NOWAIT              1
+#define SMC_inw(a, r)           readw((a) + (r))
+#define SMC_outw(v, a, r)       writew(v, (a) + (r))
+#define SMC_insw(a, r, p, l)    readsw((a) + (r), p, l)
+#define SMC_outsw(a, r, p, l)   writesw((a) + (r), p, l)
+#define SMC_IRQ_FLAGS           IRQF_TRIGGER_HIGH
+#elif defined(CONFIG_COLDFIRE)
+#define SMC_CAN_USE_8BIT        0
+#define SMC_CAN_USE_16BIT       1
+#define SMC_CAN_USE_32BIT       0
+#define SMC_NOWAIT              1
+static inline void mcf_insw(void *a, unsigned char *p, int l)
+{
+        u16 *wp = (u16 *) p;
+        while (l-- > 0)
+                *wp++ = readw(a);
+}
+static inline void mcf_outsw(void *a, unsigned char *p, int l)
+{
+        u16 *wp = (u16 *) p;
+        while (l-- > 0)
+                writew(*wp++, a);
+}
+#define SMC_inw(a, r)           _swapw(readw((a) + (r)))
+#define SMC_outw(v, a, r)       writew(_swapw(v), (a) + (r))
+#define SMC_insw(a, r, p, l)    mcf_insw(a + r, p, l)
+#define SMC_outsw(a, r, p, l)   mcf_outsw(a + r, p, l)
+#define SMC_IRQ_FLAGS           (IRQF_DISABLED)
 #else
 /*
diff --git a/drivers/net/smsc9420.c b/drivers/net/smsc9420.c
index 30110a11d737..34fa10d8ad40 100644
--- a/drivers/net/smsc9420.c
+++ b/drivers/net/smsc9420.c
@@ -1347,7 +1347,7 @@ static int smsc9420_open(struct net_device *dev)
        netif_carrier_off(dev);
-        /* disable, mask and acknowlege all interrupts */
+        /* disable, mask and acknowledge all interrupts */
        spin_lock_irqsave(&pd->int_lock, flags);
        int_cfg = smsc9420_reg_read(pd, INT_CFG) & (~INT_CFG_IRQ_EN_);
        smsc9420_reg_write(pd, INT_CFG, int_cfg);
diff --git a/drivers/net/spider_net.c b/drivers/net/spider_net.c
index 2f8a8c32021e..5ba9d989f8fc 100644
--- a/drivers/net/spider_net.c
+++ b/drivers/net/spider_net.c
@@ -474,7 +474,7 @@ spider_net_prepare_rx_descr(struct spider_net_card *card,
 * spider_net_enable_rxchtails - sets RX dmac chain tail addresses
 * @card: card structure
 *
- * spider_net_enable_rxchtails sets the RX DMAC chain tail adresses in the
+ * spider_net_enable_rxchtails sets the RX DMAC chain tail addresses in the
 * chip by writing to the appropriate register. DMA is enabled in
 * spider_net_enable_rxdmac.
 */
@@ -1820,7 +1820,7 @@ spider_net_enable_card(struct spider_net_card *card)
        spider_net_write_reg(card, SPIDER_NET_ECMODE, SPIDER_NET_ECMODE_VALUE);
-        /* set chain tail adress for RX chains and
+        /* set chain tail address for RX chains and
         * enable DMA */
        spider_net_enable_rxchtails(card);
        spider_net_enable_rxdmac(card);
diff --git a/drivers/net/sungem.c b/drivers/net/sungem.c
index 4344017bfaef..70196bc5fe61 100644
--- a/drivers/net/sungem.c
+++ b/drivers/net/sungem.c
@@ -782,7 +782,7 @@ static int gem_rx(struct gem *gp, int work_to_do)
                        break;
                /* When writing back RX descriptor, GEM writes status
-                 * then buffer address, possibly in seperate transactions.
+                 * then buffer address, possibly in separate transactions.
                 * If we don't wait for the chip to write both, we could
                 * post a new buffer to this descriptor then have GEM spam
                 * on the buffer address.  We sync on the RX completion
diff --git a/drivers/net/tehuti.c b/drivers/net/tehuti.c
index 0c9780217c87..f5493092521a 100644
--- a/drivers/net/tehuti.c
+++ b/drivers/net/tehuti.c
@@ -1851,7 +1851,7 @@ static void bdx_tx_push_desc(struct bdx_priv *priv, void *data, int size)
 * @data - desc's data
 * @size - desc's size
 *
- * NOTE: this func does check for available space and, if neccessary, waits for
+ * NOTE: this func does check for available space and, if necessary, waits for
 *   NIC to read existing data before writing new one.
 */
 static void bdx_tx_push_desc_safe(struct bdx_priv *priv, void *data, int size)
diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
index 0fa7688ab483..22cf1c446de3 100644
--- a/drivers/net/tg3.c
+++ b/drivers/net/tg3.c
@@ -5279,7 +5279,7 @@ static void tg3_poll_controller(struct net_device *dev)
        struct tg3 *tp = netdev_priv(dev);
        for (i = 0; i < tp->irq_cnt; i++)
-                tg3_interrupt(tp->napi[i].irq_vec, dev);
+                tg3_interrupt(tp->napi[i].irq_vec, &tp->napi[i]);
 }
 #endif
@@ -9776,7 +9776,7 @@ static int tg3_set_settings(struct net_device *dev, struct ethtool_cmd *cmd)
                           ADVERTISED_Pause |
                           ADVERTISED_Asym_Pause;
-                if (!(tp->tg3_flags2 & TG3_FLAG_10_100_ONLY))
+                if (!(tp->tg3_flags & TG3_FLAG_10_100_ONLY))
                        mask |= ADVERTISED_1000baseT_Half |
                                ADVERTISED_1000baseT_Full;
diff --git a/drivers/net/tokenring/tms380tr.c b/drivers/net/tokenring/tms380tr.c
index 21a01753312a..ee71bcfb3753 100644
--- a/drivers/net/tokenring/tms380tr.c
+++ b/drivers/net/tokenring/tms380tr.c
@@ -693,7 +693,7 @@ static netdev_tx_t tms380tr_hardware_send_packet(struct sk_buff *skb,
 * NOTE: This function should be used whenever the status of any TPL must be
 * modified by the driver, because the compiler may otherwise change the
 * order of instructions such that writing the TPL status may be executed at
- * an undesireable time. When this function is used, the status is always
+ * an undesirable time. When this function is used, the status is always
 * written when the function is called.
 */
 static void tms380tr_write_tpl_status(TPL *tpl, unsigned int Status)
@@ -2264,7 +2264,7 @@ static void tms380tr_rcv_status_irq(struct net_device *dev)
 * This function should be used whenever the status of any RPL must be
 * modified by the driver, because the compiler may otherwise change the
 * order of instructions such that writing the RPL status may be executed
- * at an undesireable time. When this function is used, the status is
+ * at an undesirable time. When this function is used, the status is
 * always written when the function is called.
 */
 static void tms380tr_write_rpl_status(RPL *rpl, unsigned int Status)
diff --git a/drivers/net/tulip/eeprom.c b/drivers/net/tulip/eeprom.c
index 93f4e8309f81..49f05d1431f5 100644
--- a/drivers/net/tulip/eeprom.c
+++ b/drivers/net/tulip/eeprom.c
@@ -143,6 +143,12 @@ static void __devinit tulip_build_fake_mediatable(struct tulip_private *tp)
 void __devinit tulip_parse_eeprom(struct net_device *dev)
 {
+        /*
+          dev is not registered at this point, so logging messages can't
+          use dev_<level> or netdev_<level> but dev->name is good via a
+          hack in the caller
+        */
        /* The last media info list parsed, for multiport boards.  */
        static struct mediatable *last_mediatable;
        static unsigned char *last_ee_data;
@@ -161,15 +167,14 @@ void __devinit tulip_parse_eeprom(struct net_device *dev)
                if (ee_data[0] == 0xff) {
                        if (last_mediatable) {
                                controller_index++;
-                                dev_info(&dev->dev,
+                                pr_info("%s: Controller %d of multiport board\n",
-                                         "Controller %d of multiport board\n",
+                                        dev->name, controller_index);
-                                         controller_index);
                                tp->mtable = last_mediatable;
                                ee_data = last_ee_data;
                                goto subsequent_board;
                        } else
-                                dev_info(&dev->dev,
+                                pr_info("%s: Missing EEPROM, this interface may not work correctly!\n",
-                                         "Missing EEPROM, this interface may not work correctly!\n");
+                                        dev->name);
                        return;
                }
          /* Do a fix-up based on the vendor half of the station address prefix. */
@@ -181,15 +186,14 @@ void __devinit tulip_parse_eeprom(struct net_device *dev)
                          i++;                  /* An Accton EN1207, not an outlaw Maxtech. */
                  memcpy(ee_data + 26, eeprom_fixups[i].newtable,
                                 sizeof(eeprom_fixups[i].newtable));
-                  dev_info(&dev->dev,
+                  pr_info("%s: Old format EEPROM on '%s' board.  Using substitute media control info\n",
-                           "Old format EEPROM on '%s' board.  Using substitute media control info\n",
+                          dev->name, eeprom_fixups[i].name);
-                           eeprom_fixups[i].name);
                  break;
                }
          }
          if (eeprom_fixups[i].name == NULL) { /* No fixup found. */
-                  dev_info(&dev->dev,
+                  pr_info("%s: Old style EEPROM with no media selection information\n",
-                           "Old style EEPROM with no media selection information\n");
+                          dev->name);
                return;
          }
        }
@@ -217,8 +221,8 @@ subsequent_board:
                /* there is no phy information, don't even try to build mtable */
                if (count == 0) {
                        if (tulip_debug > 0)
-                                dev_warn(&dev->dev,
+                                pr_warning("%s: no phy info, aborting mtable build\n",
-                                         "no phy info, aborting mtable build\n");
+                                           dev->name);
                        return;
                }
@@ -234,8 +238,10 @@ subsequent_board:
                mtable->has_nonmii = mtable->has_mii = mtable->has_reset = 0;
                mtable->csr15dir = mtable->csr15val = 0;
-                dev_info(&dev->dev, "EEPROM default media type %s\n",
+                pr_info("%s: EEPROM default media type %s\n",
-                         media & 0x0800 ? "Autosense" : medianame[media & MEDIA_MASK]);
+                        dev->name,
+                        media & 0x0800 ? "Autosense"
+                                       : medianame[media & MEDIA_MASK]);
                for (i = 0; i < count; i++) {
                        struct medialeaf *leaf = &mtable->mleaf[i];
@@ -298,17 +304,17 @@ subsequent_board:
                        }
                        if (tulip_debug > 1  &&  leaf->media == 11) {
                                unsigned char *bp = leaf->leafdata;
-                                dev_info(&dev->dev,
+                                pr_info("%s: MII interface PHY %d, setup/reset sequences %d/%d long, capabilities %02x %02x\n",
-                                         "MII interface PHY %d, setup/reset sequences %d/%d long, capabilities %02x %02x\n",
+                                        dev->name,
-                                         bp[0], bp[1], bp[2 + bp[1]*2],
+                                        bp[0], bp[1], bp[2 + bp[1]*2],
-                                         bp[5 + bp[2 + bp[1]*2]*2],
+                                        bp[5 + bp[2 + bp[1]*2]*2],
-                                         bp[4 + bp[2 + bp[1]*2]*2]);
+                                        bp[4 + bp[2 + bp[1]*2]*2]);
                        }
-                        dev_info(&dev->dev,
+                        pr_info("%s: Index #%d - Media %s (#%d) described by a %s (%d) block\n",
-                                 "Index #%d - Media %s (#%d) described by a %s (%d) block\n",
+                                dev->name,
-                                 i, medianame[leaf->media & 15], leaf->media,
+                                i, medianame[leaf->media & 15], leaf->media,
-                                 leaf->type < ARRAY_SIZE(block_name) ? block_name[leaf->type] : "<unknown>",
+                                leaf->type < ARRAY_SIZE(block_name) ? block_name[leaf->type] : "<unknown>",
-                                 leaf->type);
+                                leaf->type);
                }
                if (new_advertise)
                        tp->sym_advertise = new_advertise;
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index ce1efa4c0b0d..96c39bddc78c 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -1437,7 +1437,7 @@ static int tun_chr_close(struct inode *inode, struct file *file)
                __tun_detach(tun);
-                /* If desireable, unregister the netdevice. */
+                /* If desirable, unregister the netdevice. */
                if (!(tun->flags & TUN_PERSIST)) {
                        rtnl_lock();
                        if (dev->reg_state == NETREG_REGISTERED)
diff --git a/drivers/net/typhoon.c b/drivers/net/typhoon.c
index e3ddcb8f29df..cd24e5f2b2a2 100644
--- a/drivers/net/typhoon.c
+++ b/drivers/net/typhoon.c
@@ -480,7 +480,7 @@ typhoon_hello(struct typhoon *tp)
                typhoon_inc_cmd_index(&ring->lastWrite, 1);
                INIT_COMMAND_NO_RESPONSE(cmd, TYPHOON_CMD_HELLO_RESP);
-                smp_wmb();
+                wmb();
                iowrite32(ring->lastWrite, tp->ioaddr + TYPHOON_REG_CMD_READY);
                spin_unlock(&tp->command_lock);
        }
@@ -1311,13 +1311,15 @@ typhoon_init_interface(struct typhoon *tp)
        tp->txlo_dma_addr = le32_to_cpu(iface->txLoAddr);
        tp->card_state = Sleeping;
-        smp_wmb();
        tp->offload = TYPHOON_OFFLOAD_IP_CHKSUM | TYPHOON_OFFLOAD_TCP_CHKSUM;
        tp->offload |= TYPHOON_OFFLOAD_UDP_CHKSUM | TSO_OFFLOAD_ON;
        spin_lock_init(&tp->command_lock);
        spin_lock_init(&tp->state_lock);
+        /* Force the writes to the shared memory area out before continuing. */
+        wmb();
 }
 static void
@@ -2096,7 +2098,7 @@ typhoon_tx_timeout(struct net_device *dev)
        if(typhoon_reset(tp->ioaddr, WaitNoSleep) < 0) {
                netdev_warn(dev, "could not reset in tx timeout\n");
-                goto truely_dead;
+                goto truly_dead;
        }
        /* If we ever start using the Hi ring, it will need cleaning too */
@@ -2105,13 +2107,13 @@ typhoon_tx_timeout(struct net_device *dev)
        if(typhoon_start_runtime(tp) < 0) {
                netdev_err(dev, "could not start runtime in tx timeout\n");
-                goto truely_dead;
+                goto truly_dead;
        }
        netif_wake_queue(dev);
        return;
-truely_dead:
+truly_dead:
        /* Reset the hardware, and turn off carrier to avoid more timeouts */
        typhoon_reset(tp->ioaddr, NoWait);
        netif_carrier_off(dev);
diff --git a/drivers/net/ucc_geth.c b/drivers/net/ucc_geth.c
index 23a97518bc1f..1b0aef37e495 100644
--- a/drivers/net/ucc_geth.c
+++ b/drivers/net/ucc_geth.c
@@ -430,7 +430,7 @@ static void hw_add_addr_in_hash(struct ucc_geth_private *ugeth,
            ucc_fast_get_qe_cr_subblock(ugeth->ug_info->uf_info.ucc_num);
        /* Ethernet frames are defined in Little Endian mode,
-        therefor to insert */
+        therefore to insert */
        /* the address to the hash (Big Endian mode), we reverse the bytes.*/
        set_mac_addr(&p_82xx_addr_filt->taddr.h, p_enet_addr);
diff --git a/drivers/net/usb/asix.c b/drivers/net/usb/asix.c
index 20e34608fa4a..9e05639435f2 100644
--- a/drivers/net/usb/asix.c
+++ b/drivers/net/usb/asix.c
@@ -54,6 +54,7 @@ static const char driver_name [] = "asix";
 #define AX_CMD_WRITE_IPG0               0x12
 #define AX_CMD_WRITE_IPG1               0x13
 #define AX_CMD_READ_NODE_ID             0x13
+#define AX_CMD_WRITE_NODE_ID            0x14
 #define AX_CMD_WRITE_IPG2               0x14
 #define AX_CMD_WRITE_MULTI_FILTER       0x16
 #define AX88172_CMD_READ_NODE_ID        0x17
@@ -165,6 +166,7 @@ static const char driver_name [] = "asix";
 /* This structure cannot exceed sizeof(unsigned long [5]) AKA 20 bytes */
 struct asix_data {
        u8 multi_filter[AX_MCAST_FILTER_SIZE];
+        u8 mac_addr[ETH_ALEN];
        u8 phymode;
        u8 ledmode;
        u8 eeprom_len;
@@ -732,6 +734,30 @@ static int asix_ioctl (struct net_device *net, struct ifreq *rq, int cmd)
        return generic_mii_ioctl(&dev->mii, if_mii(rq), cmd, NULL);
 }
+static int asix_set_mac_address(struct net_device *net, void *p)
+{
+        struct usbnet *dev = netdev_priv(net);
+        struct asix_data *data = (struct asix_data *)&dev->data;
+        struct sockaddr *addr = p;
+        if (netif_running(net))
+                return -EBUSY;
+        if (!is_valid_ether_addr(addr->sa_data))
+                return -EADDRNOTAVAIL;
+        memcpy(net->dev_addr, addr->sa_data, ETH_ALEN);
+        /* We use the 20 byte dev->data
+         * for our 6 byte mac buffer
+         * to avoid allocating memory that
+         * is tricky to free later */
+        memcpy(data->mac_addr, addr->sa_data, ETH_ALEN);
+        asix_write_cmd_async(dev, AX_CMD_WRITE_NODE_ID, 0, 0, ETH_ALEN,
+                                                        data->mac_addr);
+        return 0;
+}
 /* We need to override some ethtool_ops so we require our
   own structure so we don't interfere with other usbnet
   devices that may be connected at the same time. */
@@ -919,7 +945,7 @@ static const struct net_device_ops ax88772_netdev_ops = {
        .ndo_start_xmit         = usbnet_start_xmit,
        .ndo_tx_timeout         = usbnet_tx_timeout,
        .ndo_change_mtu         = usbnet_change_mtu,
-        .ndo_set_mac_address    = eth_mac_addr,
+        .ndo_set_mac_address    = asix_set_mac_address,
        .ndo_validate_addr      = eth_validate_addr,
        .ndo_do_ioctl           = asix_ioctl,
        .ndo_set_multicast_list = asix_set_multicast,
@@ -1213,7 +1239,7 @@ static const struct net_device_ops ax88178_netdev_ops = {
        .ndo_stop               = usbnet_stop,
        .ndo_start_xmit         = usbnet_start_xmit,
        .ndo_tx_timeout         = usbnet_tx_timeout,
-        .ndo_set_mac_address    = eth_mac_addr,
+        .ndo_set_mac_address    = asix_set_mac_address,
        .ndo_validate_addr      = eth_validate_addr,
        .ndo_set_multicast_list = asix_set_multicast,
        .ndo_do_ioctl           = asix_ioctl,
diff --git a/drivers/net/usb/pegasus.h b/drivers/net/usb/pegasus.h
index 5d02f0200737..b90d8766ab74 100644
--- a/drivers/net/usb/pegasus.h
+++ b/drivers/net/usb/pegasus.h
@@ -177,7 +177,7 @@ PEGASUS_DEV( "USB 10/100 Fast Ethernet", VENDOR_ABOCOM, 0x400c,
 PEGASUS_DEV( "USB 10/100 Fast Ethernet", VENDOR_ABOCOM, 0xabc1,
                DEFAULT_GPIO_RESET )
 PEGASUS_DEV( "USB 10/100 Fast Ethernet", VENDOR_ABOCOM, 0x200c,
-                DEFAULT_GPIO_RESET | PEGASUS_II )       
+                DEFAULT_GPIO_RESET | PEGASUS_II )
 PEGASUS_DEV( "Accton USB 10/100 Ethernet Adapter", VENDOR_ACCTON, 0x1046,
                DEFAULT_GPIO_RESET )
 PEGASUS_DEV( "SpeedStream USB 10/100 Ethernet", VENDOR_ACCTON, 0x5046,
@@ -208,6 +208,8 @@ PEGASUS_DEV( "Allied Telesyn Int. AT-USB100", VENDOR_ALLIEDTEL, 0xb100,
 */
 PEGASUS_DEV_CLASS( "Belkin F5D5050 USB Ethernet", VENDOR_BELKIN, 0x0121, 0x00,
                DEFAULT_GPIO_RESET | PEGASUS_II )
+PEGASUS_DEV( "Belkin F5U122 10/100 USB Ethernet", VENDOR_BELKIN, 0x0122,
+                DEFAULT_GPIO_RESET | PEGASUS_II )
 PEGASUS_DEV( "Billionton USB-100", VENDOR_BILLIONTON, 0x0986,
                DEFAULT_GPIO_RESET )
 PEGASUS_DEV( "Billionton USBLP-100", VENDOR_BILLIONTON, 0x0987,
@@ -249,7 +251,7 @@ PEGASUS_DEV( "GIGABYTE GN-BR402W Wireless Router", VENDOR_GIGABYTE, 0x8002,
 PEGASUS_DEV( "Hawking UF100 10/100 Ethernet", VENDOR_HAWKING, 0x400c,
                DEFAULT_GPIO_RESET | PEGASUS_II )
 PEGASUS_DEV( "HP hn210c Ethernet USB", VENDOR_HP, 0x811c,
-                DEFAULT_GPIO_RESET | PEGASUS_II )       
+                DEFAULT_GPIO_RESET | PEGASUS_II )
 PEGASUS_DEV( "IO DATA USB ET/TX", VENDOR_IODATA, 0x0904,
                DEFAULT_GPIO_RESET )
 PEGASUS_DEV( "IO DATA USB ET/TX-S", VENDOR_IODATA, 0x0913,
diff --git a/drivers/net/wan/cosa.c b/drivers/net/wan/cosa.c
index b36bf96eb502..f0bd70fb650c 100644
--- a/drivers/net/wan/cosa.c
+++ b/drivers/net/wan/cosa.c
@@ -811,7 +811,7 @@ static ssize_t cosa_read(struct file *file,
        cosa_enable_rx(chan);
        spin_lock_irqsave(&cosa->lock, flags);
        add_wait_queue(&chan->rxwaitq, &wait);
-        while(!chan->rx_status) {
+        while (!chan->rx_status) {
                current->state = TASK_INTERRUPTIBLE;
                spin_unlock_irqrestore(&cosa->lock, flags);
                schedule();
@@ -896,7 +896,7 @@ static ssize_t cosa_write(struct file *file,
        spin_lock_irqsave(&cosa->lock, flags);
        add_wait_queue(&chan->txwaitq, &wait);
-        while(!chan->tx_status) {
+        while (!chan->tx_status) {
                current->state = TASK_INTERRUPTIBLE;
                spin_unlock_irqrestore(&cosa->lock, flags);
                schedule();
@@ -1153,7 +1153,7 @@ static int cosa_ioctl_common(struct cosa_data *cosa,
        struct channel_data *channel, unsigned int cmd, unsigned long arg)
 {
        void __user *argp = (void __user *)arg;
-        switch(cmd) {
+        switch (cmd) {
        case COSAIORSET:        /* Reset the device */
                if (!capable(CAP_NET_ADMIN))
                        return -EACCES;
@@ -1704,7 +1704,7 @@ static inline void tx_interrupt(struct cosa_data *cosa, int status)
                        spin_unlock_irqrestore(&cosa->lock, flags);
                        return;
                }
-                while(1) {
+                while (1) {
                        cosa->txchan++;
                        i++;
                        if (cosa->txchan >= cosa->nchannels)
@@ -2010,7 +2010,7 @@ again:
 static void debug_status_in(struct cosa_data *cosa, int status)
 {
        char *s;
-        switch(status & SR_CMD_FROM_SRP_MASK) {
+        switch (status & SR_CMD_FROM_SRP_MASK) {
        case SR_UP_REQUEST:
                s = "RX_REQ";
                break;
diff --git a/drivers/net/wan/hdlc_cisco.c b/drivers/net/wan/hdlc_cisco.c
index f1bff98acd1f..1ceccf1ca6c7 100644
--- a/drivers/net/wan/hdlc_cisco.c
+++ b/drivers/net/wan/hdlc_cisco.c
@@ -141,7 +141,7 @@ static __be16 cisco_type_trans(struct sk_buff *skb, struct net_device *dev)
            data->address != CISCO_UNICAST)
                return cpu_to_be16(ETH_P_HDLC);
-        switch(data->protocol) {
+        switch (data->protocol) {
        case cpu_to_be16(ETH_P_IP):
        case cpu_to_be16(ETH_P_IPX):
        case cpu_to_be16(ETH_P_IPV6):
@@ -190,7 +190,7 @@ static int cisco_rx(struct sk_buff *skb)
                cisco_data = (struct cisco_packet*)(skb->data + sizeof
                                                    (struct hdlc_header));
-                switch(ntohl (cisco_data->type)) {
+                switch (ntohl (cisco_data->type)) {
                case CISCO_ADDR_REQ: /* Stolen from syncppp.c :-) */
                        in_dev = dev->ip_ptr;
                        addr = 0;
@@ -245,8 +245,8 @@ static int cisco_rx(struct sk_buff *skb)
                        dev_kfree_skb_any(skb);
                        return NET_RX_SUCCESS;
-                } /* switch(keepalive type) */
+                } /* switch (keepalive type) */
-        } /* switch(protocol) */
+        } /* switch (protocol) */
        printk(KERN_INFO "%s: Unsupported protocol %x\n", dev->name,
               ntohs(data->protocol));
diff --git a/drivers/net/wan/hdlc_x25.c b/drivers/net/wan/hdlc_x25.c
index aa9248f8eb1a..6e1ca256effd 100644
--- a/drivers/net/wan/hdlc_x25.c
+++ b/drivers/net/wan/hdlc_x25.c
@@ -202,10 +202,10 @@ static int x25_ioctl(struct net_device *dev, struct ifreq *ifr)
                return 0; /* return protocol only, no settable parameters */
        case IF_PROTO_X25:
-                if(!capable(CAP_NET_ADMIN))
+                if (!capable(CAP_NET_ADMIN))
                        return -EPERM;
-                if(dev->flags & IFF_UP)
+                if (dev->flags & IFF_UP)
                        return -EBUSY;
                result=hdlc->attach(dev, ENCODING_NRZ,PARITY_CRC16_PR1_CCITT);
diff --git a/drivers/net/wimax/i2400m/fw.c b/drivers/net/wimax/i2400m/fw.c
index e803a7dc6502..25c24f0368d8 100644
--- a/drivers/net/wimax/i2400m/fw.c
+++ b/drivers/net/wimax/i2400m/fw.c
@@ -612,7 +612,7 @@ ssize_t i2400m_bm_cmd(struct i2400m *i2400m,
                goto error_wait_for_ack;
        }
        rx_bytes = result;
-        /* verify the ack and read more if neccessary [result is the
+        /* verify the ack and read more if necessary [result is the
         * final amount of bytes we get in the ack]  */
        result = __i2400m_bm_ack_verify(i2400m, opcode, ack, ack_size, flags);
        if (result < 0)
diff --git a/drivers/net/wimax/i2400m/i2400m.h b/drivers/net/wimax/i2400m/i2400m.h
index 04df9bbe340f..820b128705ec 100644
--- a/drivers/net/wimax/i2400m/i2400m.h
+++ b/drivers/net/wimax/i2400m/i2400m.h
@@ -627,7 +627,7 @@ enum i2400m_bm_cmd_flags {
 * @I2400M_BRI_NO_REBOOT: Do not reboot the device and proceed
 *     directly to wait for a reboot barker from the device.
 * @I2400M_BRI_MAC_REINIT: We need to reinitialize the boot
- *     rom after reading the MAC adress. This is quite a dirty hack,
+ *     rom after reading the MAC address. This is quite a dirty hack,
 *     if you ask me -- the device requires the bootrom to be
 *     intialized after reading the MAC address.
 */
diff --git a/drivers/net/wimax/i2400m/sdio.c b/drivers/net/wimax/i2400m/sdio.c
index 76a50ac02ebb..14f876b1358b 100644
--- a/drivers/net/wimax/i2400m/sdio.c
+++ b/drivers/net/wimax/i2400m/sdio.c
@@ -304,7 +304,7 @@ error_kzalloc:
 *
 * The device will be fully reset internally, but won't be
 * disconnected from the bus (so no reenumeration will
- * happen). Firmware upload will be neccessary.
+ * happen). Firmware upload will be necessary.
 *
 * The device will send a reboot barker that will trigger the driver
 * to reinitialize the state via __i2400m_dev_reset_handle.
@@ -314,7 +314,7 @@ error_kzalloc:
 *
 * The device will be fully reset internally, disconnected from the
 * bus an a reenumeration will happen. Firmware upload will be
- * neccessary. Thus, we don't do any locking or struct
+ * necessary. Thus, we don't do any locking or struct
 * reinitialization, as we are going to be fully disconnected and
 * reenumerated.
 *
diff --git a/drivers/net/wimax/i2400m/usb.c b/drivers/net/wimax/i2400m/usb.c
index 98f4f8c5fb68..99f04c475898 100644
--- a/drivers/net/wimax/i2400m/usb.c
+++ b/drivers/net/wimax/i2400m/usb.c
@@ -246,7 +246,7 @@ error_kzalloc:
 *
 * The device will be fully reset internally, but won't be
 * disconnected from the USB bus (so no reenumeration will
- * happen). Firmware upload will be neccessary.
+ * happen). Firmware upload will be necessary.
 *
 * The device will send a reboot barker in the notification endpoint
 * that will trigger the driver to reinitialize the state
@@ -257,7 +257,7 @@ error_kzalloc:
 *
 * The device will be fully reset internally, disconnected from the
 * USB bus an a reenumeration will happen. Firmware upload will be
- * neccessary. Thus, we don't do any locking or struct
+ * necessary. Thus, we don't do any locking or struct
 * reinitialization, as we are going to be fully disconnected and
 * reenumerated.
 *
diff --git a/drivers/net/wireless/airo.c b/drivers/net/wireless/airo.c
index 698d5672a070..dc5018a6d9ed 100644
--- a/drivers/net/wireless/airo.c
+++ b/drivers/net/wireless/airo.c
@@ -5255,7 +5255,8 @@ static int set_wep_key(struct airo_info *ai, u16 index, const char *key,
        WepKeyRid wkr;
        int rc;
-        WARN_ON(keylen == 0);
+        if (WARN_ON(keylen == 0))
+                return -1;
        memset(&wkr, 0, sizeof(wkr));
        wkr.len = cpu_to_le16(sizeof(wkr));
diff --git a/drivers/net/wireless/ath/ar9170/ar9170.h b/drivers/net/wireless/ath/ar9170/ar9170.h
index 8c8ce67971e9..dc662b76a1c8 100644
--- a/drivers/net/wireless/ath/ar9170/ar9170.h
+++ b/drivers/net/wireless/ath/ar9170/ar9170.h
@@ -166,6 +166,7 @@ struct ar9170 {
        struct ath_common common;
        struct mutex mutex;
        enum ar9170_device_state state;
+        bool registered;
        unsigned long bad_hw_nagger;
        int (*open)(struct ar9170 *);
diff --git a/drivers/net/wireless/ath/ar9170/main.c b/drivers/net/wireless/ath/ar9170/main.c
index a6452af9c6c5..257c734733d1 100644
--- a/drivers/net/wireless/ath/ar9170/main.c
+++ b/drivers/net/wireless/ath/ar9170/main.c
@@ -2512,7 +2512,7 @@ void *ar9170_alloc(size_t priv_size)
        /*
         * this buffer is used for rx stream reconstruction.
         * Under heavy load this device (or the transport layer?)
-         * tends to split the streams into seperate rx descriptors.
+         * tends to split the streams into separate rx descriptors.
         */
        skb = __dev_alloc_skb(AR9170_MAX_RX_BUFFER_SIZE, GFP_KERNEL);
@@ -2701,7 +2701,8 @@ int ar9170_register(struct ar9170 *ar, struct device *pdev)
        dev_info(pdev, "Atheros AR9170 is registered as '%s'\n",
                 wiphy_name(ar->hw->wiphy));
-        return err;
+        ar->registered = true;
+        return 0;
 err_unreg:
        ieee80211_unregister_hw(ar->hw);
@@ -2712,11 +2713,14 @@ err_out:
 void ar9170_unregister(struct ar9170 *ar)
 {
+        if (ar->registered) {
 #ifdef CONFIG_AR9170_LEDS
-        ar9170_unregister_leds(ar);
+                ar9170_unregister_leds(ar);
 #endif /* CONFIG_AR9170_LEDS */
-        kfree_skb(ar->rx_failover);
        ieee80211_unregister_hw(ar->hw);
+        }
+        kfree_skb(ar->rx_failover);
        mutex_destroy(&ar->mutex);
 }
diff --git a/drivers/net/wireless/ath/ar9170/usb.c b/drivers/net/wireless/ath/ar9170/usb.c
index 0f361186b78f..4e30197afff6 100644
--- a/drivers/net/wireless/ath/ar9170/usb.c
+++ b/drivers/net/wireless/ath/ar9170/usb.c
@@ -582,43 +582,6 @@ static int ar9170_usb_upload(struct ar9170_usb *aru, const void *data,
        return 0;
 }
-static int ar9170_usb_request_firmware(struct ar9170_usb *aru)
-{
-        int err = 0;
-        err = request_firmware(&aru->firmware, "ar9170.fw",
-                               &aru->udev->dev);
-        if (!err) {
-                aru->init_values = NULL;
-                return 0;
-        }
-        if (aru->req_one_stage_fw) {
-                dev_err(&aru->udev->dev, "ar9170.fw firmware file "
-                        "not found and is required for this device\n");
-                return -EINVAL;
-        }
-        dev_err(&aru->udev->dev, "ar9170.fw firmware file "
-                "not found, trying old firmware...\n");
-        err = request_firmware(&aru->init_values, "ar9170-1.fw",
-                               &aru->udev->dev);
-        if (err) {
-                dev_err(&aru->udev->dev, "file with init values not found.\n");
-                return err;
-        }
-        err = request_firmware(&aru->firmware, "ar9170-2.fw", &aru->udev->dev);
-        if (err) {
-                release_firmware(aru->init_values);
-                dev_err(&aru->udev->dev, "firmware file not found.\n");
-                return err;
-        }
-        return err;
-}
 static int ar9170_usb_reset(struct ar9170_usb *aru)
 {
        int ret, lock = (aru->intf->condition != USB_INTERFACE_BINDING);
@@ -757,6 +720,103 @@ err_out:
        return err;
 }
+static void ar9170_usb_firmware_failed(struct ar9170_usb *aru)
+{
+        struct device *parent = aru->udev->dev.parent;
+        /* unbind anything failed */
+        if (parent)
+                down(&parent->sem);
+        device_release_driver(&aru->udev->dev);
+        if (parent)
+                up(&parent->sem);
+}
+static void ar9170_usb_firmware_finish(const struct firmware *fw, void *context)
+{
+        struct ar9170_usb *aru = context;
+        int err;
+        aru->firmware = fw;
+        if (!fw) {
+                dev_err(&aru->udev->dev, "firmware file not found.\n");
+                goto err_freefw;
+        }
+        err = ar9170_usb_init_device(aru);
+        if (err)
+                goto err_freefw;
+        err = ar9170_usb_open(&aru->common);
+        if (err)
+                goto err_unrx;
+        err = ar9170_register(&aru->common, &aru->udev->dev);
+        ar9170_usb_stop(&aru->common);
+        if (err)
+                goto err_unrx;
+        return;
+ err_unrx:
+        ar9170_usb_cancel_urbs(aru);
+ err_freefw:
+        ar9170_usb_firmware_failed(aru);
+}
+static void ar9170_usb_firmware_inits(const struct firmware *fw,
+                                      void *context)
+{
+        struct ar9170_usb *aru = context;
+        int err;
+        if (!fw) {
+                dev_err(&aru->udev->dev, "file with init values not found.\n");
+                ar9170_usb_firmware_failed(aru);
+                return;
+        }
+        aru->init_values = fw;
+        /* ok so we have the init values -- get code for two-stage */
+        err = request_firmware_nowait(THIS_MODULE, 1, "ar9170-2.fw",
+                                      &aru->udev->dev, GFP_KERNEL, aru,
+                                      ar9170_usb_firmware_finish);
+        if (err)
+                ar9170_usb_firmware_failed(aru);
+}
+static void ar9170_usb_firmware_step2(const struct firmware *fw, void *context)
+{
+        struct ar9170_usb *aru = context;
+        int err;
+        if (fw) {
+                ar9170_usb_firmware_finish(fw, context);
+                return;
+        }
+        if (aru->req_one_stage_fw) {
+                dev_err(&aru->udev->dev, "ar9170.fw firmware file "
+                        "not found and is required for this device\n");
+                ar9170_usb_firmware_failed(aru);
+                return;
+        }
+        dev_err(&aru->udev->dev, "ar9170.fw firmware file "
+                "not found, trying old firmware...\n");
+        err = request_firmware_nowait(THIS_MODULE, 1, "ar9170-1.fw",
+                                      &aru->udev->dev, GFP_KERNEL, aru,
+                                      ar9170_usb_firmware_inits);
+        if (err)
+                ar9170_usb_firmware_failed(aru);
+}
 static bool ar9170_requires_one_stage(const struct usb_device_id *id)
 {
        if (!id->driver_info)
@@ -814,33 +874,9 @@ static int ar9170_usb_probe(struct usb_interface *intf,
        if (err)
                goto err_freehw;
-        err = ar9170_usb_request_firmware(aru);
+        return request_firmware_nowait(THIS_MODULE, 1, "ar9170.fw",
-        if (err)
+                                       &aru->udev->dev, GFP_KERNEL, aru,
-                goto err_freehw;
+                                       ar9170_usb_firmware_step2);
-        err = ar9170_usb_init_device(aru);
-        if (err)
-                goto err_freefw;
-        err = ar9170_usb_open(ar);
-        if (err)
-                goto err_unrx;
-        err = ar9170_register(ar, &udev->dev);
-        ar9170_usb_stop(ar);
-        if (err)
-                goto err_unrx;
-        return 0;
-err_unrx:
-        ar9170_usb_cancel_urbs(aru);
-err_freefw:
-        release_firmware(aru->init_values);
-        release_firmware(aru->firmware);
 err_freehw:
        usb_set_intfdata(intf, NULL);
        usb_put_dev(udev);
@@ -860,12 +896,12 @@ static void ar9170_usb_disconnect(struct usb_interface *intf)
        ar9170_unregister(&aru->common);
        ar9170_usb_cancel_urbs(aru);
-        release_firmware(aru->init_values);
-        release_firmware(aru->firmware);
        usb_put_dev(aru->udev);
        usb_set_intfdata(intf, NULL);
        ieee80211_free_hw(aru->common.hw);
+        release_firmware(aru->init_values);
+        release_firmware(aru->firmware);
 }
 #ifdef CONFIG_PM
diff --git a/drivers/net/wireless/ath/ath5k/eeprom.c b/drivers/net/wireless/ath/ath5k/eeprom.c
index 6a3f4da7fb48..10b52262b232 100644
--- a/drivers/net/wireless/ath/ath5k/eeprom.c
+++ b/drivers/net/wireless/ath/ath5k/eeprom.c
@@ -429,8 +429,8 @@ static int ath5k_eeprom_read_modes(struct ath5k_hw *ah, u32 *offset,
                        ee->ee_margin_tx_rx[mode] = (val >> 8) & 0x3f;
                AR5K_EEPROM_READ(o++, val);
-                ee->ee_i_cal[mode] = (val >> 8) & 0x3f;
+                ee->ee_i_cal[mode] = (val >> 5) & 0x3f;
-                ee->ee_q_cal[mode] = (val >> 3) & 0x1f;
+                ee->ee_q_cal[mode] = val & 0x1f;
                if (ah->ah_ee_version >= AR5K_EEPROM_VERSION_4_2) {
                        AR5K_EEPROM_READ(o++, val);
diff --git a/drivers/net/wireless/ath/ath5k/phy.c b/drivers/net/wireless/ath/ath5k/phy.c
index 72474c0ccaff..eff3323efb4b 100644
--- a/drivers/net/wireless/ath/ath5k/phy.c
+++ b/drivers/net/wireless/ath/ath5k/phy.c
@@ -1386,38 +1386,39 @@ static int ath5k_hw_rf511x_calibrate(struct ath5k_hw *ah,
                goto done;
        /* Calibration has finished, get the results and re-run */
+        /* work around empty results which can apparently happen on 5212 */
        for (i = 0; i <= 10; i++) {
                iq_corr = ath5k_hw_reg_read(ah, AR5K_PHY_IQRES_CAL_CORR);
                i_pwr = ath5k_hw_reg_read(ah, AR5K_PHY_IQRES_CAL_PWR_I);
                q_pwr = ath5k_hw_reg_read(ah, AR5K_PHY_IQRES_CAL_PWR_Q);
+                ATH5K_DBG_UNLIMIT(ah->ah_sc, ATH5K_DEBUG_CALIBRATE,
+                        "iq_corr:%x i_pwr:%x q_pwr:%x", iq_corr, i_pwr, q_pwr);
+                if (i_pwr && q_pwr)
+                        break;
        }
        i_coffd = ((i_pwr >> 1) + (q_pwr >> 1)) >> 7;
        q_coffd = q_pwr >> 7;
-        /* No correction */
+        /* protect against divide by 0 and loss of sign bits */
-        if (i_coffd == 0 || q_coffd == 0)
+        if (i_coffd == 0 || q_coffd < 2)
                goto done;
-        i_coff = ((-iq_corr) / i_coffd);
+        i_coff = (-iq_corr) / i_coffd;
+        i_coff = clamp(i_coff, -32, 31); /* signed 6 bit */
-        /* Boundary check */
-        if (i_coff > 31)
-                i_coff = 31;
-        if (i_coff < -32)
-                i_coff = -32;
-        q_coff = (((s32)i_pwr / q_coffd) - 128);
+        q_coff = (i_pwr / q_coffd) - 128;
+        q_coff = clamp(q_coff, -16, 15); /* signed 5 bit */
-        /* Boundary check */
+        ATH5K_DBG_UNLIMIT(ah->ah_sc, ATH5K_DEBUG_CALIBRATE,
-        if (q_coff > 15)
+                        "new I:%d Q:%d (i_coffd:%x q_coffd:%x)",
-                q_coff = 15;
+                        i_coff, q_coff, i_coffd, q_coffd);
-        if (q_coff < -16)
-                q_coff = -16;
-        /* Commit new I/Q value */
+        /* Commit new I/Q values (set enable bit last to match HAL sources) */
-        AR5K_REG_ENABLE_BITS(ah, AR5K_PHY_IQ, AR5K_PHY_IQ_CORR_ENABLE |
+        AR5K_REG_WRITE_BITS(ah, AR5K_PHY_IQ, AR5K_PHY_IQ_CORR_Q_I_COFF, i_coff);
-                ((u32)q_coff) | ((u32)i_coff << AR5K_PHY_IQ_CORR_Q_I_COFF_S));
+        AR5K_REG_WRITE_BITS(ah, AR5K_PHY_IQ, AR5K_PHY_IQ_CORR_Q_Q_COFF, q_coff);
+        AR5K_REG_ENABLE_BITS(ah, AR5K_PHY_IQ, AR5K_PHY_IQ_CORR_ENABLE);
        /* Re-enable calibration -if we don't we'll commit
         * the same values again and again */
@@ -1873,7 +1874,7 @@ ath5k_hw_set_antenna_mode(struct ath5k_hw *ah, u8 ant_mode)
                break;
        case AR5K_ANTMODE_FIXED_A:
                def_ant = 1;
-                tx_ant = 0;
+                tx_ant = 1;
                use_def_for_tx = true;
                update_def_on_tx = false;
                use_def_for_rts = true;
@@ -1882,7 +1883,7 @@ ath5k_hw_set_antenna_mode(struct ath5k_hw *ah, u8 ant_mode)
                break;
        case AR5K_ANTMODE_FIXED_B:
                def_ant = 2;
-                tx_ant = 0;
+                tx_ant = 2;
                use_def_for_tx = true;
                update_def_on_tx = false;
                use_def_for_rts = true;
diff --git a/drivers/net/wireless/ath/ath5k/reg.h b/drivers/net/wireless/ath/ath5k/reg.h
index 4cb9c5df9f46..1464f89b249c 100644
--- a/drivers/net/wireless/ath/ath5k/reg.h
+++ b/drivers/net/wireless/ath/ath5k/reg.h
@@ -2187,6 +2187,7 @@
 */
 #define AR5K_PHY_IQ                     0x9920                  /* Register Address */
 #define AR5K_PHY_IQ_CORR_Q_Q_COFF       0x0000001f      /* Mask for q correction info */
+#define AR5K_PHY_IQ_CORR_Q_Q_COFF_S     0
 #define AR5K_PHY_IQ_CORR_Q_I_COFF       0x000007e0      /* Mask for i correction info */
 #define AR5K_PHY_IQ_CORR_Q_I_COFF_S     5
 #define AR5K_PHY_IQ_CORR_ENABLE         0x00000800      /* Enable i/q correction */
diff --git a/drivers/net/wireless/ath/ath5k/reset.c b/drivers/net/wireless/ath/ath5k/reset.c
index a35a7db0fc4c..cbf28e379843 100644
--- a/drivers/net/wireless/ath/ath5k/reset.c
+++ b/drivers/net/wireless/ath/ath5k/reset.c
@@ -851,12 +851,15 @@ static void ath5k_hw_commit_eeprom_settings(struct ath5k_hw *ah,
                                AR5K_PHY_OFDM_SELFCORR_CYPWR_THR1,
                                AR5K_INIT_CYCRSSI_THR1);
-        /* I/Q correction
+        /* I/Q correction (set enable bit last to match HAL sources) */
-         * TODO: Per channel i/q infos ? */
+        /* TODO: Per channel i/q infos ? */
-        AR5K_REG_ENABLE_BITS(ah, AR5K_PHY_IQ,
+        if (ah->ah_ee_version >= AR5K_EEPROM_VERSION_4_0) {
-                AR5K_PHY_IQ_CORR_ENABLE |
+                AR5K_REG_WRITE_BITS(ah, AR5K_PHY_IQ, AR5K_PHY_IQ_CORR_Q_I_COFF,
-                (ee->ee_i_cal[ee_mode] << AR5K_PHY_IQ_CORR_Q_I_COFF_S) |
+                            ee->ee_i_cal[ee_mode]);
-                ee->ee_q_cal[ee_mode]);
+                AR5K_REG_WRITE_BITS(ah, AR5K_PHY_IQ, AR5K_PHY_IQ_CORR_Q_Q_COFF,
+                            ee->ee_q_cal[ee_mode]);
+                AR5K_REG_ENABLE_BITS(ah, AR5K_PHY_IQ, AR5K_PHY_IQ_CORR_ENABLE);
+        }
        /* Heavy clipping -disable for now */
        if (ah->ah_ee_version >= AR5K_EEPROM_VERSION_5_1)
@@ -1379,11 +1382,10 @@ int ath5k_hw_reset(struct ath5k_hw *ah, enum nl80211_iftype op_mode,
                ath5k_hw_set_sleep_clock(ah, true);
        /*
-         * Disable beacons and reset the register
+         * Disable beacons and reset the TSF
         */
-        AR5K_REG_DISABLE_BITS(ah, AR5K_BEACON, AR5K_BEACON_ENABLE |
+        AR5K_REG_DISABLE_BITS(ah, AR5K_BEACON, AR5K_BEACON_ENABLE);
-                        AR5K_BEACON_RESET_TSF);
+        ath5k_hw_reset_tsf(ah);
        return 0;
 }
diff --git a/drivers/net/wireless/ath/ath9k/rc.c b/drivers/net/wireless/ath/ath9k/rc.c
index ac34a055c713..0e79e58cf4c9 100644
--- a/drivers/net/wireless/ath/ath9k/rc.c
+++ b/drivers/net/wireless/ath/ath9k/rc.c
@@ -1323,7 +1323,7 @@ static void ath_rate_init(void *priv, struct ieee80211_supported_band *sband,
 static void ath_rate_update(void *priv, struct ieee80211_supported_band *sband,
                            struct ieee80211_sta *sta, void *priv_sta,
-                            u32 changed)
+                            u32 changed, enum nl80211_channel_type oper_chan_type)
 {
        struct ath_softc *sc = priv;
        struct ath_rate_priv *ath_rc_priv = priv_sta;
@@ -1340,8 +1340,8 @@ static void ath_rate_update(void *priv, struct ieee80211_supported_band *sband,
                if (sc->sc_ah->opmode != NL80211_IFTYPE_STATION)
                        return;
-                if (sc->hw->conf.channel_type == NL80211_CHAN_HT40MINUS ||
+                if (oper_chan_type == NL80211_CHAN_HT40MINUS ||
-                    sc->hw->conf.channel_type == NL80211_CHAN_HT40PLUS)
+                    oper_chan_type == NL80211_CHAN_HT40PLUS)
                        oper_cw40 = true;
                oper_sgi40 = (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_40) ?
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index 47294f90bbe5..b2c8207f7bc1 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -2258,7 +2258,7 @@ void ath_tx_node_cleanup(struct ath_softc *sc, struct ath_node *an)
                if (ATH_TXQ_SETUP(sc, i)) {
                        txq = &sc->tx.txq[i];
-                        spin_lock(&txq->axq_lock);
+                        spin_lock_bh(&txq->axq_lock);
                        list_for_each_entry_safe(ac,
                                        ac_tmp, &txq->axq_acq, list) {
@@ -2279,7 +2279,7 @@ void ath_tx_node_cleanup(struct ath_softc *sc, struct ath_node *an)
                                }
                        }
-                        spin_unlock(&txq->axq_lock);
+                        spin_unlock_bh(&txq->axq_lock);
                }
        }
 }
diff --git a/drivers/net/wireless/ipw2x00/ipw2200.c b/drivers/net/wireless/ipw2x00/ipw2200.c
index 63c2a7ade5fb..5c7aa1b1eb56 100644
--- a/drivers/net/wireless/ipw2x00/ipw2200.c
+++ b/drivers/net/wireless/ipw2x00/ipw2200.c
@@ -3177,14 +3177,27 @@ static int ipw_load_firmware(struct ipw_priv *priv, u8 * data, size_t len)
        int total_nr = 0;
        int i;
        struct pci_pool *pool;
-        u32 *virts[CB_NUMBER_OF_ELEMENTS_SMALL];
+        void **virts;
-        dma_addr_t phys[CB_NUMBER_OF_ELEMENTS_SMALL];
+        dma_addr_t *phys;
        IPW_DEBUG_TRACE("<< : \n");
+        virts = kmalloc(sizeof(void *) * CB_NUMBER_OF_ELEMENTS_SMALL,
+                        GFP_KERNEL);
+        if (!virts)
+                return -ENOMEM;
+        phys = kmalloc(sizeof(dma_addr_t) * CB_NUMBER_OF_ELEMENTS_SMALL,
+                        GFP_KERNEL);
+        if (!phys) {
+                kfree(virts);
+                return -ENOMEM;
+        }
        pool = pci_pool_create("ipw2200", priv->pci_dev, CB_MAX_LENGTH, 0, 0);
        if (!pool) {
                IPW_ERROR("pci_pool_create failed\n");
+                kfree(phys);
+                kfree(virts);
                return -ENOMEM;
        }
@@ -3254,6 +3267,8 @@ static int ipw_load_firmware(struct ipw_priv *priv, u8 * data, size_t len)
                pci_pool_free(pool, virts[i], phys[i]);
        pci_pool_destroy(pool);
+        kfree(phys);
+        kfree(virts);
        return ret;
 }
diff --git a/drivers/net/wireless/ipw2x00/libipw.h b/drivers/net/wireless/ipw2x00/libipw.h
index bf45391172f3..a6d5e42647e4 100644
--- a/drivers/net/wireless/ipw2x00/libipw.h
+++ b/drivers/net/wireless/ipw2x00/libipw.h
@@ -797,7 +797,7 @@ struct libipw_device {
        /* Probe / Beacon management */
        struct list_head network_free_list;
        struct list_head network_list;
-        struct libipw_network *networks;
+        struct libipw_network *networks[MAX_NETWORK_COUNT];
        int scans;
        int scan_age;
diff --git a/drivers/net/wireless/ipw2x00/libipw_module.c b/drivers/net/wireless/ipw2x00/libipw_module.c
index 1ae0b2b02c38..2fa55867bd8b 100644
--- a/drivers/net/wireless/ipw2x00/libipw_module.c
+++ b/drivers/net/wireless/ipw2x00/libipw_module.c
@@ -67,16 +67,17 @@ void *libipw_wiphy_privid = &libipw_wiphy_privid;
 static int libipw_networks_allocate(struct libipw_device *ieee)
 {
-        if (ieee->networks)
+        int i, j;
-                return 0;
+        for (i = 0; i < MAX_NETWORK_COUNT; i++) {
-        ieee->networks =
+                ieee->networks[i] = kzalloc(sizeof(struct libipw_network),
-            kzalloc(MAX_NETWORK_COUNT * sizeof(struct libipw_network),
+                                            GFP_KERNEL);
-                    GFP_KERNEL);
+                if (!ieee->networks[i]) {
-        if (!ieee->networks) {
+                        LIBIPW_ERROR("Out of memory allocating beacons\n");
-                printk(KERN_WARNING "%s: Out of memory allocating beacons\n",
+                        for (j = 0; j < i; j++)
-                       ieee->dev->name);
+                                kfree(ieee->networks[j]);
-                return -ENOMEM;
+                        return -ENOMEM;
+                }
        }
        return 0;
@@ -97,15 +98,11 @@ static inline void libipw_networks_free(struct libipw_device *ieee)
 {
        int i;
-        if (!ieee->networks)
+        for (i = 0; i < MAX_NETWORK_COUNT; i++) {
-                return;
+                if (ieee->networks[i]->ibss_dfs)
+                        kfree(ieee->networks[i]->ibss_dfs);
-        for (i = 0; i < MAX_NETWORK_COUNT; i++)
+                kfree(ieee->networks[i]);
-                if (ieee->networks[i].ibss_dfs)
+        }
-                        kfree(ieee->networks[i].ibss_dfs);
-        kfree(ieee->networks);
-        ieee->networks = NULL;
 }
 void libipw_networks_age(struct libipw_device *ieee,
@@ -130,7 +127,7 @@ static void libipw_networks_initialize(struct libipw_device *ieee)
        INIT_LIST_HEAD(&ieee->network_free_list);
        INIT_LIST_HEAD(&ieee->network_list);
        for (i = 0; i < MAX_NETWORK_COUNT; i++)
-                list_add_tail(&ieee->networks[i].list,
+                list_add_tail(&ieee->networks[i]->list,
                              &ieee->network_free_list);
 }
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945.c b/drivers/net/wireless/iwlwifi/iwl-3945.c
index 303cc8193adc..e0678d921055 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945.c
+++ b/drivers/net/wireless/iwlwifi/iwl-3945.c
@@ -184,7 +184,7 @@ static int iwl3945_hwrate_to_plcp_idx(u8 plcp)
 {
        int idx;
-        for (idx = 0; idx < IWL_RATE_COUNT; idx++)
+        for (idx = 0; idx < IWL_RATE_COUNT_3945; idx++)
                if (iwl3945_rates[idx].plcp == plcp)
                        return idx;
        return -1;
@@ -805,7 +805,7 @@ void iwl3945_hw_build_tx_cmd_rate(struct iwl_priv *priv,
                                  int sta_id, int tx_id)
 {
        u16 hw_value = ieee80211_get_tx_rate(priv->hw, info)->hw_value;
-        u16 rate_index = min(hw_value & 0xffff, IWL_RATE_COUNT - 1);
+        u16 rate_index = min(hw_value & 0xffff, IWL_RATE_COUNT_3945);
        u16 rate_mask;
        int rate;
        u8 rts_retry_limit;
@@ -2146,7 +2146,7 @@ static void iwl3945_hw_reg_init_channel_groups(struct iwl_priv *priv)
                /* fill in channel group's nominal powers for each rate */
                for (rate_index = 0;
-                     rate_index < IWL_RATE_COUNT; rate_index++, clip_pwrs++) {
+                     rate_index < IWL_RATE_COUNT_3945; rate_index++, clip_pwrs++) {
                        switch (rate_index) {
                        case IWL_RATE_36M_INDEX_TABLE:
                                if (i == 0)     /* B/G */
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index 6aeb82b6992f..818367b57bab 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -1463,59 +1463,66 @@ static void iwl_nic_start(struct iwl_priv *priv)
 }
+static void iwl_ucode_callback(const struct firmware *ucode_raw, void *context);
+static int iwl_mac_setup_register(struct iwl_priv *priv);
+static int __must_check iwl_request_firmware(struct iwl_priv *priv, bool first)
+{
+        const char *name_pre = priv->cfg->fw_name_pre;
+        if (first)
+                priv->fw_index = priv->cfg->ucode_api_max;
+        else
+                priv->fw_index--;
+        if (priv->fw_index < priv->cfg->ucode_api_min) {
+                IWL_ERR(priv, "no suitable firmware found!\n");
+                return -ENOENT;
+        }
+        sprintf(priv->firmware_name, "%s%d%s",
+                name_pre, priv->fw_index, ".ucode");
+        IWL_DEBUG_INFO(priv, "attempting to load firmware '%s'\n",
+                       priv->firmware_name);
+        return request_firmware_nowait(THIS_MODULE, 1, priv->firmware_name,
+                                       &priv->pci_dev->dev, GFP_KERNEL, priv,
+                                       iwl_ucode_callback);
+}
 /**
- * iwl_read_ucode - Read uCode images from disk file.
+ * iwl_ucode_callback - callback when firmware was loaded
 *
- * Copy into buffers for card to fetch via bus-mastering
+ * If loaded successfully, copies the firmware into buffers
+ * for the card to fetch (via DMA).
 */
-static int iwl_read_ucode(struct iwl_priv *priv)
+static void iwl_ucode_callback(const struct firmware *ucode_raw, void *context)
 {
+        struct iwl_priv *priv = context;
        struct iwl_ucode_header *ucode;
-        int ret = -EINVAL, index;
-        const struct firmware *ucode_raw;
-        const char *name_pre = priv->cfg->fw_name_pre;
        const unsigned int api_max = priv->cfg->ucode_api_max;
        const unsigned int api_min = priv->cfg->ucode_api_min;
-        char buf[25];
        u8 *src;
        size_t len;
        u32 api_ver, build;
        u32 inst_size, data_size, init_size, init_data_size, boot_size;
+        int err;
        u16 eeprom_ver;
-        /* Ask kernel firmware_class module to get the boot firmware off disk.
+        if (!ucode_raw) {
-         * request_firmware() is synchronous, file is in memory on return. */
+                IWL_ERR(priv, "request for firmware file '%s' failed.\n",
-        for (index = api_max; index >= api_min; index--) {
+                        priv->firmware_name);
-                sprintf(buf, "%s%d%s", name_pre, index, ".ucode");
+                goto try_again;
-                ret = request_firmware(&ucode_raw, buf, &priv->pci_dev->dev);
-                if (ret < 0) {
-                        IWL_ERR(priv, "%s firmware file req failed: %d\n",
-                                  buf, ret);
-                        if (ret == -ENOENT)
-                                continue;
-                        else
-                                goto error;
-                } else {
-                        if (index < api_max)
-                                IWL_ERR(priv, "Loaded firmware %s, "
-                                        "which is deprecated. "
-                                        "Please use API v%u instead.\n",
-                                          buf, api_max);
-                        IWL_DEBUG_INFO(priv, "Got firmware '%s' file (%zd bytes) from disk\n",
-                                       buf, ucode_raw->size);
-                        break;
-                }
        }
-        if (ret < 0)
+        IWL_DEBUG_INFO(priv, "Loaded firmware file '%s' (%zd bytes).\n",
-                goto error;
+                       priv->firmware_name, ucode_raw->size);
        /* Make sure that we got at least the v1 header! */
        if (ucode_raw->size < priv->cfg->ops->ucode->get_header_size(1)) {
                IWL_ERR(priv, "File size way too small!\n");
-                ret = -EINVAL;
+                goto try_again;
-                goto err_release;
        }
        /* Data from ucode file:  header followed by uCode images */
@@ -1540,10 +1547,9 @@ static int iwl_read_ucode(struct iwl_priv *priv)
                IWL_ERR(priv, "Driver unable to support your firmware API. "
                          "Driver supports v%u, firmware is v%u.\n",
                          api_max, api_ver);
-                priv->ucode_ver = 0;
+                goto try_again;
-                ret = -EINVAL;
-                goto err_release;
        }
        if (api_ver != api_max)
                IWL_ERR(priv, "Firmware has old API version. Expected v%u, "
                          "got v%u. New firmware can be obtained "
@@ -1585,6 +1591,12 @@ static int iwl_read_ucode(struct iwl_priv *priv)
        IWL_DEBUG_INFO(priv, "f/w package hdr boot inst size = %u\n",
                       boot_size);
+        /*
+         * For any of the failures below (before allocating pci memory)
+         * we will try to load a version with a smaller API -- maybe the
+         * user just got a corrupted version of the latest API.
+         */
        /* Verify size of file vs. image size info in file's header */
        if (ucode_raw->size !=
                priv->cfg->ops->ucode->get_header_size(api_ver) +
@@ -1594,41 +1606,35 @@ static int iwl_read_ucode(struct iwl_priv *priv)
                IWL_DEBUG_INFO(priv,
                        "uCode file size %d does not match expected size\n",
                        (int)ucode_raw->size);
-                ret = -EINVAL;
+                goto try_again;
-                goto err_release;
        }
        /* Verify that uCode images will fit in card's SRAM */
        if (inst_size > priv->hw_params.max_inst_size) {
                IWL_DEBUG_INFO(priv, "uCode instr len %d too large to fit in\n",
                               inst_size);
-                ret = -EINVAL;
+                goto try_again;
-                goto err_release;
        }
        if (data_size > priv->hw_params.max_data_size) {
                IWL_DEBUG_INFO(priv, "uCode data len %d too large to fit in\n",
                                data_size);
-                ret = -EINVAL;
+                goto try_again;
-                goto err_release;
        }
        if (init_size > priv->hw_params.max_inst_size) {
                IWL_INFO(priv, "uCode init instr len %d too large to fit in\n",
                        init_size);
-                ret = -EINVAL;
+                goto try_again;
-                goto err_release;
        }
        if (init_data_size > priv->hw_params.max_data_size) {
                IWL_INFO(priv, "uCode init data len %d too large to fit in\n",
                      init_data_size);
-                ret = -EINVAL;
+                goto try_again;
-                goto err_release;
        }
        if (boot_size > priv->hw_params.max_bsm_size) {
                IWL_INFO(priv, "uCode boot instr len %d too large to fit in\n",
                        boot_size);
-                ret = -EINVAL;
+                goto try_again;
-                goto err_release;
        }
        /* Allocate ucode buffers for card's bus-master loading ... */
@@ -1712,20 +1718,36 @@ static int iwl_read_ucode(struct iwl_priv *priv)
        IWL_DEBUG_INFO(priv, "Copying (but not loading) boot instr len %Zd\n", len);
        memcpy(priv->ucode_boot.v_addr, src, len);
+        /**************************************************
+         * This is still part of probe() in a sense...
+         *
+         * 9. Setup and register with mac80211 and debugfs
+         **************************************************/
+        err = iwl_mac_setup_register(priv);
+        if (err)
+                goto out_unbind;
+        err = iwl_dbgfs_register(priv, DRV_NAME);
+        if (err)
+                IWL_ERR(priv, "failed to create debugfs files. Ignoring error: %d\n", err);
        /* We have our copies now, allow OS release its copies */
        release_firmware(ucode_raw);
-        return 0;
+        return;
+ try_again:
+        /* try next, if any */
+        if (iwl_request_firmware(priv, false))
+                goto out_unbind;
+        release_firmware(ucode_raw);
+        return;
 err_pci_alloc:
        IWL_ERR(priv, "failed to allocate pci memory\n");
-        ret = -ENOMEM;
        iwl_dealloc_ucode_pci(priv);
+ out_unbind:
- err_release:
+        device_release_driver(&priv->pci_dev->dev);
        release_firmware(ucode_raw);
- error:
-        return ret;
 }
 static const char *desc_lookup_text[] = {
@@ -2631,7 +2653,7 @@ static int iwl_mac_setup_register(struct iwl_priv *priv)
         */
        hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
-        hw->wiphy->max_scan_ssids = PROBE_OPTION_MAX + 1;
+        hw->wiphy->max_scan_ssids = PROBE_OPTION_MAX;
        /* we create the 802.11 header and a zero-length SSID element */
        hw->wiphy->max_scan_ie_len = IWL_MAX_PROBE_REQUEST - 24 - 2;
@@ -2667,21 +2689,7 @@ static int iwl_mac_start(struct ieee80211_hw *hw)
        /* we should be verifying the device is ready to be opened */
        mutex_lock(&priv->mutex);
-        /* fetch ucode file from disk, alloc and copy to bus-master buffers ...
-         * ucode filename and max sizes are card-specific. */
-        if (!priv->ucode_code.len) {
-                ret = iwl_read_ucode(priv);
-                if (ret) {
-                        IWL_ERR(priv, "Could not read microcode: %d\n", ret);
-                        mutex_unlock(&priv->mutex);
-                        return ret;
-                }
-        }
        ret = __iwl_up(priv);
        mutex_unlock(&priv->mutex);
        if (ret)
@@ -3654,17 +3662,10 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
        iwl_power_initialize(priv);
        iwl_tt_initialize(priv);
-        /**************************************************
+        err = iwl_request_firmware(priv, true);
-         * 9. Setup and register with mac80211 and debugfs
-         **************************************************/
-        err = iwl_mac_setup_register(priv);
        if (err)
                goto out_remove_sysfs;
-        err = iwl_dbgfs_register(priv, DRV_NAME);
-        if (err)
-                IWL_ERR(priv, "failed to create debugfs files. Ignoring error: %d\n", err);
        return 0;
 out_remove_sysfs:
diff --git a/drivers/net/wireless/iwlwifi/iwl-dev.h b/drivers/net/wireless/iwlwifi/iwl-dev.h
index ab891b958042..6054c5fba0c1 100644
--- a/drivers/net/wireless/iwlwifi/iwl-dev.h
+++ b/drivers/net/wireless/iwlwifi/iwl-dev.h
@@ -1132,6 +1132,7 @@ struct iwl_priv {
        u8   rev_id;
        /* uCode images, save to reload in case of failure */
+        int fw_index;                   /* firmware we're trying to load */
        u32 ucode_ver;                  /* version of ucode, copy of
                                           iwl_ucode.ver */
        struct fw_desc ucode_code;      /* runtime inst */
@@ -1142,6 +1143,7 @@ struct iwl_priv {
        struct fw_desc ucode_boot;      /* bootstrap inst */
        enum ucode_type ucode_type;
        u8 ucode_write_complete;        /* the image write is complete */
+        char firmware_name[25];
        struct iwl_rxon_time_cmd rxon_timing;
diff --git a/drivers/net/wireless/iwlwifi/iwl-scan.c b/drivers/net/wireless/iwlwifi/iwl-scan.c
index dd9ff2ed645a..bd2f7c420563 100644
--- a/drivers/net/wireless/iwlwifi/iwl-scan.c
+++ b/drivers/net/wireless/iwlwifi/iwl-scan.c
@@ -638,20 +638,9 @@ u16 iwl_fill_probe_req(struct iwl_priv *priv, struct ieee80211_mgmt *frame,
        if (left < 0)
                return 0;
        *pos++ = WLAN_EID_SSID;
-        if (!priv->is_internal_short_scan &&
+        *pos++ = 0;
-            priv->scan_request->n_ssids) {
-                struct cfg80211_ssid *ssid =
+        len += 2;
-                        priv->scan_request->ssids;
-                /* Broadcast if ssid_len is 0 */
-                *pos++ = ssid->ssid_len;
-                memcpy(pos, ssid->ssid, ssid->ssid_len);
-                pos += ssid->ssid_len;
-                len += 2 + ssid->ssid_len;
-        } else {
-                *pos++ = 0;
-                len += 2;
-        }
        if (WARN_ON(left < ie_len))
                return len;
@@ -780,26 +769,20 @@ static void iwl_bg_request_scan(struct work_struct *data)
        if (priv->is_internal_short_scan) {
                IWL_DEBUG_SCAN(priv, "Start internal passive scan.\n");
        } else if (priv->scan_request->n_ssids) {
+                int i, p = 0;
                IWL_DEBUG_SCAN(priv, "Kicking off active scan\n");
-                /*
+                for (i = 0; i < priv->scan_request->n_ssids; i++) {
-                 * The first SSID to scan is stuffed into the probe request
+                        /* always does wildcard anyway */
-                 * template and the remaining ones are handled through the
+                        if (!priv->scan_request->ssids[i].ssid_len)
-                 * direct_scan array.
+                                continue;
-                 */
+                        scan->direct_scan[p].id = WLAN_EID_SSID;
-                if (priv->scan_request->n_ssids > 1) {
+                        scan->direct_scan[p].len =
-                        int i, p = 0;
+                                priv->scan_request->ssids[i].ssid_len;
-                        for (i = 1; i < priv->scan_request->n_ssids; i++) {
+                        memcpy(scan->direct_scan[p].ssid,
-                                if (!priv->scan_request->ssids[i].ssid_len)
+                               priv->scan_request->ssids[i].ssid,
-                                        continue;
+                               priv->scan_request->ssids[i].ssid_len);
-                                scan->direct_scan[p].id = WLAN_EID_SSID;
+                        n_probes++;
-                                scan->direct_scan[p].len =
+                        p++;
-                                        priv->scan_request->ssids[i].ssid_len;
-                                memcpy(scan->direct_scan[p].ssid,
-                                       priv->scan_request->ssids[i].ssid,
-                                       priv->scan_request->ssids[i].ssid_len);
-                                n_probes++;
-                                p++;
-                        }
                }
                is_active = true;
        } else
diff --git a/drivers/net/wireless/iwmc3200wifi/lmac.h b/drivers/net/wireless/iwmc3200wifi/lmac.h
index a3a79b5e2898..a855a99e49b8 100644
--- a/drivers/net/wireless/iwmc3200wifi/lmac.h
+++ b/drivers/net/wireless/iwmc3200wifi/lmac.h
@@ -262,7 +262,7 @@ struct iwm_ct_kill_cfg_cmd {
 /* Power Management */
 #define POWER_TABLE_CMD                 0x77
-#define SAVE_RESTORE_ADRESS_CMD         0x78
+#define SAVE_RESTORE_ADDRESS_CMD                0x78
 #define REPLY_WATERMARK_CMD             0x79
 #define PM_DEBUG_STATISTIC_NOTIFIC      0x7B
 #define PD_FLUSH_N_NOTIFICATION         0x7C
diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c
index 9f6d6bf06b8e..2887047069f2 100644
--- a/drivers/net/wireless/rndis_wlan.c
+++ b/drivers/net/wireless/rndis_wlan.c
@@ -1496,51 +1496,67 @@ static void set_multicast_list(struct usbnet *usbdev)
 {
        struct rndis_wlan_private *priv = get_rndis_wlan_priv(usbdev);
        struct dev_mc_list *mclist;
-        __le32 filter;
+        __le32 filter, basefilter;
-        int ret, i, size;
+        int ret;
-        char *buf;
+        char *mc_addrs = NULL;
+        int mc_count;
-        filter = RNDIS_PACKET_TYPE_DIRECTED | RNDIS_PACKET_TYPE_BROADCAST;
+        basefilter = filter = RNDIS_PACKET_TYPE_DIRECTED |
+                              RNDIS_PACKET_TYPE_BROADCAST;
-        netif_addr_lock_bh(usbdev->net);
        if (usbdev->net->flags & IFF_PROMISC) {
                filter |= RNDIS_PACKET_TYPE_PROMISCUOUS |
                        RNDIS_PACKET_TYPE_ALL_LOCAL;
-        } else if (usbdev->net->flags & IFF_ALLMULTI ||
+        } else if (usbdev->net->flags & IFF_ALLMULTI) {
-                   netdev_mc_count(usbdev->net) > priv->multicast_size) {
+                filter |= RNDIS_PACKET_TYPE_ALL_MULTICAST;
+        }
+        if (filter != basefilter)
+                goto set_filter;
+        /*
+         * mc_list should be accessed holding the lock, so copy addresses to
+         * local buffer first.
+         */
+        netif_addr_lock_bh(usbdev->net);
+        mc_count = netdev_mc_count(usbdev->net);
+        if (mc_count > priv->multicast_size) {
                filter |= RNDIS_PACKET_TYPE_ALL_MULTICAST;
-        } else if (!netdev_mc_empty(usbdev->net)) {
+        } else if (mc_count) {
-                size = min(priv->multicast_size, netdev_mc_count(usbdev->net));
+                int i = 0;
-                buf = kmalloc(size * ETH_ALEN, GFP_KERNEL);
-                if (!buf) {
+                mc_addrs = kmalloc(mc_count * ETH_ALEN, GFP_ATOMIC);
+                if (!mc_addrs) {
                        netdev_warn(usbdev->net,
                                    "couldn't alloc %d bytes of memory\n",
-                                    size * ETH_ALEN);
+                                    mc_count * ETH_ALEN);
                        netif_addr_unlock_bh(usbdev->net);
                        return;
                }
-                i = 0;
+                netdev_for_each_mc_addr(mclist, usbdev->net)
-                netdev_for_each_mc_addr(mclist, usbdev->net) {
+                        memcpy(mc_addrs + i++ * ETH_ALEN,
-                        if (i == size)
+                               mclist->dmi_addr, ETH_ALEN);
-                                break;
+        }
-                        memcpy(buf + i++ * ETH_ALEN, mclist->dmi_addr, ETH_ALEN);
+        netif_addr_unlock_bh(usbdev->net);
-                }
-                ret = rndis_set_oid(usbdev, OID_802_3_MULTICAST_LIST, buf,
+        if (filter != basefilter)
-                                                                i * ETH_ALEN);
+                goto set_filter;
-                if (ret == 0 && i > 0)
+        if (mc_count) {
+                ret = rndis_set_oid(usbdev, OID_802_3_MULTICAST_LIST, mc_addrs,
+                                    mc_count * ETH_ALEN);
+                kfree(mc_addrs);
+                if (ret == 0)
                        filter |= RNDIS_PACKET_TYPE_MULTICAST;
                else
                        filter |= RNDIS_PACKET_TYPE_ALL_MULTICAST;
                netdev_dbg(usbdev->net, "OID_802_3_MULTICAST_LIST(%d, max: %d) -> %d\n",
-                           i, priv->multicast_size, ret);
+                           mc_count, priv->multicast_size, ret);
-                kfree(buf);
        }
-        netif_addr_unlock_bh(usbdev->net);
+set_filter:
        ret = rndis_set_oid(usbdev, OID_GEN_CURRENT_PACKET_FILTER, &filter,
                                                        sizeof(filter));
        if (ret < 0) {
diff --git a/drivers/net/wireless/rt2x00/rt2500usb.c b/drivers/net/wireless/rt2x00/rt2500usb.c
index ee34c137e7cd..9b04964deced 100644
--- a/drivers/net/wireless/rt2x00/rt2500usb.c
+++ b/drivers/net/wireless/rt2x00/rt2500usb.c
@@ -368,7 +368,7 @@ static int rt2500usb_config_key(struct rt2x00_dev *rt2x00dev,
                /*
                 * The encryption key doesn't fit within the CSR cache,
-                 * this means we should allocate it seperately and use
+                 * this means we should allocate it separately and use
                 * rt2x00usb_vendor_request() to send the key to the hardware.
                 */
                reg = KEY_ENTRY(key->hw_key_idx);
@@ -382,7 +382,7 @@ static int rt2500usb_config_key(struct rt2x00_dev *rt2x00dev,
                /*
                 * The driver does not support the IV/EIV generation
                 * in hardware. However it demands the data to be provided
-                 * both seperately as well as inside the frame.
+                 * both separately as well as inside the frame.
                 * We already provided the CONFIG_CRYPTO_COPY_IV to rt2x00lib
                 * to ensure rt2x00lib will not strip the data from the
                 * frame after the copy, now we must tell mac80211
diff --git a/drivers/net/wireless/rt2x00/rt2800pci.c b/drivers/net/wireless/rt2x00/rt2800pci.c
index aca8c124f434..91cce2d0f6db 100644
--- a/drivers/net/wireless/rt2x00/rt2800pci.c
+++ b/drivers/net/wireless/rt2x00/rt2800pci.c
@@ -1225,7 +1225,7 @@ MODULE_LICENSE("GPL");
 #ifdef CONFIG_RT2800PCI_SOC
 static int rt2800soc_probe(struct platform_device *pdev)
 {
-        return rt2x00soc_probe(pdev, rt2800pci_ops);
+        return rt2x00soc_probe(pdev, &rt2800pci_ops);
 }
 static struct platform_driver rt2800soc_driver = {
diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c
index 5e4ee2023fcf..d27d7d5d850c 100644
--- a/drivers/net/wireless/rt2x00/rt2800usb.c
+++ b/drivers/net/wireless/rt2x00/rt2800usb.c
@@ -99,7 +99,7 @@ static int rt2800usb_check_firmware(struct rt2x00_dev *rt2x00dev,
         * There are 2 variations of the rt2870 firmware.
         * a) size: 4kb
         * b) size: 8kb
-         * Note that (b) contains 2 seperate firmware blobs of 4k
+         * Note that (b) contains 2 separate firmware blobs of 4k
         * within the file. The first blob is the same firmware as (a),
         * but the second blob is for the additional chipsets.
         */
@@ -117,7 +117,7 @@ static int rt2800usb_check_firmware(struct rt2x00_dev *rt2x00dev,
        /*
         * 8kb firmware files must be checked as if it were
-         * 2 seperate firmware files.
+         * 2 separate firmware files.
         */
        while (offset < len) {
                if (!rt2800usb_check_crc(data + offset, 4096))
diff --git a/drivers/net/wireless/rt2x00/rt2x00debug.c b/drivers/net/wireless/rt2x00/rt2x00debug.c
index 70c04c282efc..28a1c46ec4eb 100644
--- a/drivers/net/wireless/rt2x00/rt2x00debug.c
+++ b/drivers/net/wireless/rt2x00/rt2x00debug.c
@@ -109,7 +109,7 @@ struct rt2x00debug_intf {
        /*
         * HW crypto statistics.
-         * All statistics are stored seperately per cipher type.
+         * All statistics are stored separately per cipher type.
         */
        struct rt2x00debug_crypto crypto_stats[CIPHER_MAX];
diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
index b93731b79903..dd5ab8fe2321 100644
--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
@@ -394,7 +394,7 @@ void rt2x00lib_rxdone(struct rt2x00_dev *rt2x00dev,
        /*
         * Hardware might have stripped the IV/EIV/ICV data,
         * in that case it is possible that the data was
-         * provided seperately (through hardware descriptor)
+         * provided separately (through hardware descriptor)
         * in which case we should reinsert the data into the frame.
         */
        if ((rxdesc.dev_flags & RXDONE_CRYPTO_IV) &&
diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.c b/drivers/net/wireless/rt2x00/rt2x00queue.c
index 0b4801a14601..5b6b789cad3d 100644
--- a/drivers/net/wireless/rt2x00/rt2x00queue.c
+++ b/drivers/net/wireless/rt2x00/rt2x00queue.c
@@ -497,7 +497,7 @@ int rt2x00queue_write_tx_frame(struct data_queue *queue, struct sk_buff *skb,
        /*
         * When hardware encryption is supported, and this frame
         * is to be encrypted, we should strip the IV/EIV data from
-         * the frame so we can provide it to the driver seperately.
+         * the frame so we can provide it to the driver separately.
         */
        if (test_bit(ENTRY_TXD_ENCRYPT, &txdesc.flags) &&
            !test_bit(ENTRY_TXD_ENCRYPT_IV, &txdesc.flags)) {
diff --git a/drivers/net/wireless/rt2x00/rt2x00soc.c b/drivers/net/wireless/rt2x00/rt2x00soc.c
index 4efdc96010f6..111c0ff5c6c7 100644
--- a/drivers/net/wireless/rt2x00/rt2x00soc.c
+++ b/drivers/net/wireless/rt2x00/rt2x00soc.c
@@ -112,6 +112,7 @@ exit_free_device:
        return retval;
 }
+EXPORT_SYMBOL_GPL(rt2x00soc_probe);
 int rt2x00soc_remove(struct platform_device *pdev)
 {
diff --git a/drivers/net/wireless/rt2x00/rt2x00soc.h b/drivers/net/wireless/rt2x00/rt2x00soc.h
index 4739edfe2f00..474cbfc1efc7 100644
--- a/drivers/net/wireless/rt2x00/rt2x00soc.h
+++ b/drivers/net/wireless/rt2x00/rt2x00soc.h
@@ -26,8 +26,6 @@
 #ifndef RT2X00SOC_H
 #define RT2X00SOC_H
-#define KSEG1ADDR(__ptr) __ptr
 /*
 * SoC driver handlers.
 */
diff --git a/drivers/net/wireless/rt2x00/rt61pci.c b/drivers/net/wireless/rt2x00/rt61pci.c
index e2da928dd9f0..177472742172 100644
--- a/drivers/net/wireless/rt2x00/rt61pci.c
+++ b/drivers/net/wireless/rt2x00/rt61pci.c
@@ -476,7 +476,7 @@ static int rt61pci_config_pairwise_key(struct rt2x00_dev *rt2x00dev,
                 * The driver does not support the IV/EIV generation
                 * in hardware. However it doesn't support the IV/EIV
                 * inside the ieee80211 frame either, but requires it
-                 * to be provided seperately for the descriptor.
+                 * to be provided separately for the descriptor.
                 * rt2x00lib will cut the IV/EIV data out of all frames
                 * given to us by mac80211, but we must tell mac80211
                 * to generate the IV/EIV data.
diff --git a/drivers/net/wireless/rt2x00/rt73usb.c b/drivers/net/wireless/rt2x00/rt73usb.c
index f39a8ed17841..290d70bc5d22 100644
--- a/drivers/net/wireless/rt2x00/rt73usb.c
+++ b/drivers/net/wireless/rt2x00/rt73usb.c
@@ -339,7 +339,7 @@ static int rt73usb_config_shared_key(struct rt2x00_dev *rt2x00dev,
                 * The driver does not support the IV/EIV generation
                 * in hardware. However it doesn't support the IV/EIV
                 * inside the ieee80211 frame either, but requires it
-                 * to be provided seperately for the descriptor.
+                 * to be provided separately for the descriptor.
                 * rt2x00lib will cut the IV/EIV data out of all frames
                 * given to us by mac80211, but we must tell mac80211
                 * to generate the IV/EIV data.
@@ -439,7 +439,7 @@ static int rt73usb_config_pairwise_key(struct rt2x00_dev *rt2x00dev,
                 * The driver does not support the IV/EIV generation
                 * in hardware. However it doesn't support the IV/EIV
                 * inside the ieee80211 frame either, but requires it
-                 * to be provided seperately for the descriptor.
+                 * to be provided separately for the descriptor.
                 * rt2x00lib will cut the IV/EIV data out of all frames
                 * given to us by mac80211, but we must tell mac80211
                 * to generate the IV/EIV data.
@@ -1661,7 +1661,7 @@ static void rt73usb_fill_rxdone(struct queue_entry *entry,
                /*
                 * Hardware has stripped IV/EIV data from 802.11 frame during
-                 * decryption. It has provided the data seperately but rt2x00lib
+                 * decryption. It has provided the data separately but rt2x00lib
                 * should decide if it should be reinserted.
                 */
                rxdesc->flags |= RX_FLAG_IV_STRIPPED;
@@ -2352,6 +2352,8 @@ static struct usb_device_id rt73usb_device_table[] = {
        { USB_DEVICE(0x0411, 0x00f4), USB_DEVICE_DATA(&rt73usb_ops) },
        { USB_DEVICE(0x0411, 0x0116), USB_DEVICE_DATA(&rt73usb_ops) },
        { USB_DEVICE(0x0411, 0x0119), USB_DEVICE_DATA(&rt73usb_ops) },
+        /* CEIVA */
+        { USB_DEVICE(0x178d, 0x02be), USB_DEVICE_DATA(&rt73usb_ops) },
        /* CNet */
        { USB_DEVICE(0x1371, 0x9022), USB_DEVICE_DATA(&rt73usb_ops) },
        { USB_DEVICE(0x1371, 0x9032), USB_DEVICE_DATA(&rt73usb_ops) },
diff --git a/drivers/net/wireless/zd1211rw/zd_mac.c b/drivers/net/wireless/zd1211rw/zd_mac.c
index 2d555cc30508..00e09e26c826 100644
--- a/drivers/net/wireless/zd1211rw/zd_mac.c
+++ b/drivers/net/wireless/zd1211rw/zd_mac.c
@@ -350,7 +350,7 @@ static void zd_mac_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb,
        first_idx = info->status.rates[0].idx;
        ZD_ASSERT(0<=first_idx && first_idx<ARRAY_SIZE(zd_retry_rates));
        retries = &zd_retry_rates[first_idx];
-        ZD_ASSERT(0<=retry && retry<=retries->count);
+        ZD_ASSERT(1 <= retry && retry <= retries->count);
        info->status.rates[0].idx = retries->rate[0];
        info->status.rates[0].count = 1; // (retry > 1 ? 2 : 1);
@@ -360,7 +360,7 @@ static void zd_mac_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb,
                info->status.rates[i].count = 1; // ((i==retry-1) && success ? 1:2);
        }
        for (; i<IEEE80211_TX_MAX_RATES && i<retry; i++) {
-                info->status.rates[i].idx = retries->rate[retry-1];
+                info->status.rates[i].idx = retries->rate[retry - 1];
                info->status.rates[i].count = 1; // (success ? 1:2);
        }
        if (i<IEEE80211_TX_MAX_RATES)
@@ -374,7 +374,7 @@ static void zd_mac_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb,
 * zd_mac_tx_failed - callback for failed frames
 * @dev: the mac80211 wireless device
 *
- * This function is called if a frame couldn't be successfully be
+ * This function is called if a frame couldn't be successfully
 * transferred. The first frame from the tx queue, will be selected and
 * reported as error to the upper layers.
 */
@@ -424,12 +424,10 @@ void zd_mac_tx_failed(struct urb *urb)
                first_idx = info->status.rates[0].idx;
                ZD_ASSERT(0<=first_idx && first_idx<ARRAY_SIZE(zd_retry_rates));
                retries = &zd_retry_rates[first_idx];
-                if (retry < 0 || retry > retries->count) {
+                if (retry <= 0 || retry > retries->count)
                        continue;
-                }
-                ZD_ASSERT(0<=retry && retry<=retries->count);
+                final_idx = retries->rate[retry - 1];
-                final_idx = retries->rate[retry-1];
                final_rate = zd_rates[final_idx].hw_value;
                if (final_rate != tx_status->rate) {