107 files changed, 1570 insertions, 839 deletions
diff --git a/drivers/net/3c509.c b/drivers/net/3c509.c
index fbb371921991..682aad897081 100644
--- a/drivers/net/3c509.c
+++ b/drivers/net/3c509.c
@@ -480,9 +480,13 @@ static int pnp_registered;
 #ifdef CONFIG_EISA
 static struct eisa_device_id el3_eisa_ids[] = {
+                { "TCM5090" },
+                { "TCM5091" },
                { "TCM5092" },
                { "TCM5093" },
+                { "TCM5094" },
                { "TCM5095" },
+                { "TCM5098" },
                { "" }
 };
 MODULE_DEVICE_TABLE(eisa, el3_eisa_ids);
diff --git a/drivers/net/8139too.c b/drivers/net/8139too.c
index 29df398b7727..1fc45431a620 100644
--- a/drivers/net/8139too.c
+++ b/drivers/net/8139too.c
@@ -1383,6 +1383,11 @@ static void rtl8139_hw_start (struct net_device *dev)
        RTL_W32_F (MAC0 + 0, le32_to_cpu (*(__le32 *) (dev->dev_addr + 0)));
        RTL_W32_F (MAC0 + 4, le16_to_cpu (*(__le16 *) (dev->dev_addr + 4)));
+        tp->cur_rx = 0;
+        /* init Rx ring buffer DMA address */
+        RTL_W32_F (RxBuf, tp->rx_ring_dma);
        /* Must enable Tx/Rx before setting transfer thresholds! */
        RTL_W8 (ChipCmd, CmdRxEnb | CmdTxEnb);
@@ -1390,8 +1395,6 @@ static void rtl8139_hw_start (struct net_device *dev)
        RTL_W32 (RxConfig, tp->rx_config);
        RTL_W32 (TxConfig, rtl8139_tx_config);
-        tp->cur_rx = 0;
        rtl_check_media (dev, 1);
        if (tp->chipset >= CH_8139B) {
@@ -1406,9 +1409,6 @@ static void rtl8139_hw_start (struct net_device *dev)
        /* Lock Config[01234] and BMCR register writes */
        RTL_W8 (Cfg9346, Cfg9346_Lock);
-        /* init Rx ring buffer DMA address */
-        RTL_W32_F (RxBuf, tp->rx_ring_dma);
        /* init Tx buffer DMA addresses */
        for (i = 0; i < NUM_TX_DESC; i++)
                RTL_W32_F (TxAddr0 + (i * 4), tp->tx_bufs_dma + (tp->tx_buf[i] - tp->tx_bufs));
diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
index 9e921544ba20..214a92d1ef75 100644
--- a/drivers/net/Kconfig
+++ b/drivers/net/Kconfig
@@ -28,9 +28,9 @@ if NETDEVICES
 config COMPAT_NET_DEV_OPS
       default y
-       bool "Enable older network device API compatiablity"
+       bool "Enable older network device API compatibility"
       ---help---
-          This option enables kernel compatiability with older network devices
+          This option enables kernel compatibility with older network devices
          that do not use net_device_ops interface.
          If unsure, say Y.
diff --git a/drivers/net/Makefile b/drivers/net/Makefile
index 1fc4602a6ff2..a1c25cb4669f 100644
--- a/drivers/net/Makefile
+++ b/drivers/net/Makefile
@@ -102,7 +102,7 @@ obj-$(CONFIG_HAMACHI) += hamachi.o
 obj-$(CONFIG_NET) += Space.o loopback.o
 obj-$(CONFIG_SEEQ8005) += seeq8005.o
 obj-$(CONFIG_NET_SB1000) += sb1000.o
-obj-$(CONFIG_MAC8390) += mac8390.o 8390.o
+obj-$(CONFIG_MAC8390) += mac8390.o
 obj-$(CONFIG_APNE) += apne.o 8390.o
 obj-$(CONFIG_PCMCIA_PCNET) += 8390.o
 obj-$(CONFIG_HP100) += hp100.o
diff --git a/drivers/net/arm/ixp4xx_eth.c b/drivers/net/arm/ixp4xx_eth.c
index 448487e22fa3..a740053d3af3 100644
--- a/drivers/net/arm/ixp4xx_eth.c
+++ b/drivers/net/arm/ixp4xx_eth.c
@@ -338,12 +338,12 @@ static int ixp4xx_mdio_register(void)
        if (cpu_is_ixp43x()) {
                /* IXP43x lacks NPE-B and uses NPE-C for MII PHY access */
                if (!(ixp4xx_read_feature_bits() & IXP4XX_FEATURE_NPEC_ETH))
-                        return -ENOSYS;
+                        return -ENODEV;
                mdio_regs = (struct eth_regs __iomem *)IXP4XX_EthC_BASE_VIRT;
        } else {
                /* All MII PHY accesses use NPE-B Ethernet registers */
                if (!(ixp4xx_read_feature_bits() & IXP4XX_FEATURE_NPEB_ETH0))
-                        return -ENOSYS;
+                        return -ENODEV;
                mdio_regs = (struct eth_regs __iomem *)IXP4XX_EthB_BASE_VIRT;
        }
@@ -1174,7 +1174,7 @@ static int __devinit eth_init_one(struct platform_device *pdev)
                regs_phys  = IXP4XX_EthC_BASE_PHYS;
                break;
        default:
-                err = -ENOSYS;
+                err = -ENODEV;
                goto err_free;
        }
@@ -1189,15 +1189,10 @@ static int __devinit eth_init_one(struct platform_device *pdev)
                goto err_free;
        }
-        if (register_netdev(dev)) {
-                err = -EIO;
-                goto err_npe_rel;
-        }
        port->mem_res = request_mem_region(regs_phys, REGS_SIZE, dev->name);
        if (!port->mem_res) {
                err = -EBUSY;
-                goto err_unreg;
+                goto err_npe_rel;
        }
        port->plat = plat;
@@ -1215,20 +1210,25 @@ static int __devinit eth_init_one(struct platform_device *pdev)
        snprintf(phy_id, BUS_ID_SIZE, PHY_ID_FMT, "0", plat->phy);
        port->phydev = phy_connect(dev, phy_id, &ixp4xx_adjust_link, 0,
                                   PHY_INTERFACE_MODE_MII);
-        if (IS_ERR(port->phydev)) {
+        if ((err = IS_ERR(port->phydev)))
-                printk(KERN_ERR "%s: Could not attach to PHY\n", dev->name);
+                goto err_free_mem;
-                return PTR_ERR(port->phydev);
-        }
        port->phydev->irq = PHY_POLL;
+        if ((err = register_netdev(dev)))
+                goto err_phy_dis;
        printk(KERN_INFO "%s: MII PHY %i on %s\n", dev->name, plat->phy,
               npe_name(port->npe));
        return 0;
-err_unreg:
+err_phy_dis:
-        unregister_netdev(dev);
+        phy_disconnect(port->phydev);
+err_free_mem:
+        npe_port_tab[NPE_ID(port->id)] = NULL;
+        platform_set_drvdata(pdev, NULL);
+        release_resource(port->mem_res);
 err_npe_rel:
        npe_release(port->npe);
 err_free:
@@ -1242,6 +1242,7 @@ static int __devexit eth_remove_one(struct platform_device *pdev)
        struct port *port = netdev_priv(dev);
        unregister_netdev(dev);
+        phy_disconnect(port->phydev);
        npe_port_tab[NPE_ID(port->id)] = NULL;
        platform_set_drvdata(pdev, NULL);
        npe_release(port->npe);
diff --git a/drivers/net/atl1e/atl1e_main.c b/drivers/net/atl1e/atl1e_main.c
index fb57b750866b..1342418fb209 100644
--- a/drivers/net/atl1e/atl1e_main.c
+++ b/drivers/net/atl1e/atl1e_main.c
@@ -37,6 +37,7 @@ char atl1e_driver_version[] = DRV_VERSION;
 */
 static struct pci_device_id atl1e_pci_tbl[] = {
        {PCI_DEVICE(PCI_VENDOR_ID_ATTANSIC, PCI_DEVICE_ID_ATTANSIC_L1E)},
+        {PCI_DEVICE(PCI_VENDOR_ID_ATTANSIC, 0x1066)},
        /* required last entry */
        { 0 }
 };
diff --git a/drivers/net/atlx/atl1.c b/drivers/net/atlx/atl1.c
index 0ab22540bf59..4e817126e280 100644
--- a/drivers/net/atlx/atl1.c
+++ b/drivers/net/atlx/atl1.c
@@ -82,6 +82,12 @@
 #include "atl1.h"
+#define ATLX_DRIVER_VERSION "2.1.3"
+MODULE_AUTHOR("Xiong Huang <xiong.huang@atheros.com>, \
+        Chris Snook <csnook@redhat.com>, Jay Cliburn <jcliburn@gmail.com>");
+MODULE_LICENSE("GPL");
+MODULE_VERSION(ATLX_DRIVER_VERSION);
 /* Temporary hack for merging atl1 and atl2 */
 #include "atlx.c"
diff --git a/drivers/net/atlx/atlx.h b/drivers/net/atlx/atlx.h
index 297a03da6b7f..14054b75aa62 100644
--- a/drivers/net/atlx/atlx.h
+++ b/drivers/net/atlx/atlx.h
@@ -29,12 +29,6 @@
 #include <linux/module.h>
 #include <linux/types.h>
-#define ATLX_DRIVER_VERSION "2.1.3"
-MODULE_AUTHOR("Xiong Huang <xiong.huang@atheros.com>, \
-        Chris Snook <csnook@redhat.com>, Jay Cliburn <jcliburn@gmail.com>");
-MODULE_LICENSE("GPL");
-MODULE_VERSION(ATLX_DRIVER_VERSION);
 #define ATLX_ERR_PHY                    2
 #define ATLX_ERR_PHY_SPEED              7
 #define ATLX_ERR_PHY_RES                8
diff --git a/drivers/net/benet/be.h b/drivers/net/benet/be.h
index c49ddd08b2aa..b4bb06fdf307 100644
--- a/drivers/net/benet/be.h
+++ b/drivers/net/benet/be.h
@@ -35,8 +35,22 @@
 #define DRV_VER                 "2.0.348"
 #define DRV_NAME                "be2net"
 #define BE_NAME                 "ServerEngines BladeEngine2 10Gbps NIC"
+#define OC_NAME                 "Emulex OneConnect 10Gbps NIC"
 #define DRV_DESC                BE_NAME "Driver"
+#define BE_VENDOR_ID            0x19a2
+#define BE_DEVICE_ID1           0x211
+#define OC_DEVICE_ID1           0x700
+#define OC_DEVICE_ID2           0x701
+static inline char *nic_name(struct pci_dev *pdev)
+{
+        if (pdev->device == OC_DEVICE_ID1 || pdev->device == OC_DEVICE_ID2)
+                return OC_NAME;
+        else
+                return BE_NAME;
+}
 /* Number of bytes of an RX frame that are copied to skb->data */
 #define BE_HDR_LEN              64
 #define BE_MAX_JUMBO_FRAME_SIZE 9018
diff --git a/drivers/net/benet/be_main.c b/drivers/net/benet/be_main.c
index 30d0c81c989e..5c378b5e8e41 100644
--- a/drivers/net/benet/be_main.c
+++ b/drivers/net/benet/be_main.c
@@ -28,10 +28,10 @@ static unsigned int rx_frag_size = 2048;
 module_param(rx_frag_size, uint, S_IRUGO);
 MODULE_PARM_DESC(rx_frag_size, "Size of a fragment that holds rcvd data.");
-#define BE_VENDOR_ID            0x19a2
-#define BE2_DEVICE_ID_1         0x0211
 static DEFINE_PCI_DEVICE_TABLE(be_dev_ids) = {
-        { PCI_DEVICE(BE_VENDOR_ID, BE2_DEVICE_ID_1) },
+        { PCI_DEVICE(BE_VENDOR_ID, BE_DEVICE_ID1) },
+        { PCI_DEVICE(BE_VENDOR_ID, OC_DEVICE_ID1) },
+        { PCI_DEVICE(BE_VENDOR_ID, OC_DEVICE_ID2) },
        { 0 }
 };
 MODULE_DEVICE_TABLE(pci, be_dev_ids);
@@ -1859,7 +1859,7 @@ static int __devinit be_probe(struct pci_dev *pdev,
        if (status != 0)
                goto stats_clean;
-        dev_info(&pdev->dev, BE_NAME " port %d\n", adapter->port_num);
+        dev_info(&pdev->dev, "%s port %d\n", nic_name(pdev), adapter->port_num);
        return 0;
 stats_clean:
@@ -1873,7 +1873,7 @@ rel_reg:
 disable_dev:
        pci_disable_device(pdev);
 do_none:
-        dev_warn(&pdev->dev, BE_NAME " initialization failed\n");
+        dev_err(&pdev->dev, "%s initialization failed\n", nic_name(pdev));
        return status;
 }
diff --git a/drivers/net/bfin_mac.c b/drivers/net/bfin_mac.c
index 9f971ed6b58d..b4da18213324 100644
--- a/drivers/net/bfin_mac.c
+++ b/drivers/net/bfin_mac.c
@@ -979,22 +979,7 @@ static int bfin_mac_open(struct net_device *dev)
        return 0;
 }
-static const struct net_device_ops bfin_mac_netdev_ops = {
-        .ndo_open               = bfin_mac_open,
-        .ndo_stop               = bfin_mac_close,
-        .ndo_start_xmit         = bfin_mac_hard_start_xmit,
-        .ndo_set_mac_address    = bfin_mac_set_mac_address,
-        .ndo_tx_timeout         = bfin_mac_timeout,
-        .ndo_set_multicast_list = bfin_mac_set_multicast_list,
-        .ndo_validate_addr      = eth_validate_addr,
-        .ndo_change_mtu         = eth_change_mtu,
-#ifdef CONFIG_NET_POLL_CONTROLLER
-        .ndo_poll_controller    = bfin_mac_poll,
-#endif
-};
 /*
- *
 * this makes the board clean up everything that it can
 * and not talk to the outside world.   Caused by
 * an 'ifconfig ethX down'
@@ -1019,6 +1004,20 @@ static int bfin_mac_close(struct net_device *dev)
        return 0;
 }
+static const struct net_device_ops bfin_mac_netdev_ops = {
+        .ndo_open               = bfin_mac_open,
+        .ndo_stop               = bfin_mac_close,
+        .ndo_start_xmit         = bfin_mac_hard_start_xmit,
+        .ndo_set_mac_address    = bfin_mac_set_mac_address,
+        .ndo_tx_timeout         = bfin_mac_timeout,
+        .ndo_set_multicast_list = bfin_mac_set_multicast_list,
+        .ndo_validate_addr      = eth_validate_addr,
+        .ndo_change_mtu         = eth_change_mtu,
+#ifdef CONFIG_NET_POLL_CONTROLLER
+        .ndo_poll_controller    = bfin_mac_poll,
+#endif
+};
 static int __devinit bfin_mac_probe(struct platform_device *pdev)
 {
        struct net_device *ndev;
diff --git a/drivers/net/bnx2.c b/drivers/net/bnx2.c
index d47839184a06..b0cb29d4cc01 100644
--- a/drivers/net/bnx2.c
+++ b/drivers/net/bnx2.c
@@ -54,8 +54,8 @@
 #define DRV_MODULE_NAME         "bnx2"
 #define PFX DRV_MODULE_NAME     ": "
-#define DRV_MODULE_VERSION      "2.0.0"
+#define DRV_MODULE_VERSION      "2.0.1"
-#define DRV_MODULE_RELDATE      "April 2, 2009"
+#define DRV_MODULE_RELDATE      "May 6, 2009"
 #define FW_MIPS_FILE_06         "bnx2/bnx2-mips-06-4.6.16.fw"
 #define FW_RV2P_FILE_06         "bnx2/bnx2-rv2p-06-4.6.16.fw"
 #define FW_MIPS_FILE_09         "bnx2/bnx2-mips-09-4.6.17.fw"
@@ -2600,6 +2600,7 @@ bnx2_get_hw_tx_cons(struct bnx2_napi *bnapi)
        /* Tell compiler that status block fields can change. */
        barrier();
        cons = *bnapi->hw_tx_cons_ptr;
+        barrier();
        if (unlikely((cons & MAX_TX_DESC_CNT) == MAX_TX_DESC_CNT))
                cons++;
        return cons;
@@ -2879,6 +2880,7 @@ bnx2_get_hw_rx_cons(struct bnx2_napi *bnapi)
        /* Tell compiler that status block fields can change. */
        barrier();
        cons = *bnapi->hw_rx_cons_ptr;
+        barrier();
        if (unlikely((cons & MAX_RX_DESC_CNT) == MAX_RX_DESC_CNT))
                cons++;
        return cons;
diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c
index 8c2e5ab51f08..faf094abef7f 100644
--- a/drivers/net/bonding/bond_3ad.c
+++ b/drivers/net/bonding/bond_3ad.c
@@ -1465,6 +1465,12 @@ static struct aggregator *ad_agg_selection_test(struct aggregator *best,
        return best;
 }
+static int agg_device_up(const struct aggregator *agg)
+{
+        return (netif_running(agg->slave->dev) &&
+                netif_carrier_ok(agg->slave->dev));
+}
 /**
 * ad_agg_selection_logic - select an aggregation group for a team
 * @aggregator: the aggregator we're looking at
@@ -1496,14 +1502,13 @@ static void ad_agg_selection_logic(struct aggregator *agg)
        struct port *port;
        origin = agg;
        active = __get_active_agg(agg);
-        best = active;
+        best = (active && agg_device_up(active)) ? active : NULL;
        do {
                agg->is_active = 0;
-                if (agg->num_of_ports)
+                if (agg->num_of_ports && agg_device_up(agg))
                        best = ad_agg_selection_test(best, agg);
        } while ((agg = __get_next_agg(agg)));
diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c
index 553a89919778..46d312bedfb8 100644
--- a/drivers/net/bonding/bond_alb.c
+++ b/drivers/net/bonding/bond_alb.c
@@ -1706,10 +1706,8 @@ void bond_alb_handle_active_change(struct bonding *bond, struct slave *new_slave
 * Called with RTNL
 */
 int bond_alb_set_mac_address(struct net_device *bond_dev, void *addr)
-        __releases(&bond->curr_slave_lock)
-        __releases(&bond->lock)
        __acquires(&bond->lock)
-        __acquires(&bond->curr_slave_lock)
+        __releases(&bond->lock)
 {
        struct bonding *bond = netdev_priv(bond_dev);
        struct sockaddr *sa = addr;
@@ -1745,9 +1743,6 @@ int bond_alb_set_mac_address(struct net_device *bond_dev, void *addr)
                }
        }
-        write_unlock_bh(&bond->curr_slave_lock);
-        read_unlock(&bond->lock);
        if (swap_slave) {
                alb_swap_mac_addr(bond, swap_slave, bond->curr_active_slave);
                alb_fasten_mac_swap(bond, swap_slave, bond->curr_active_slave);
@@ -1755,16 +1750,15 @@ int bond_alb_set_mac_address(struct net_device *bond_dev, void *addr)
                alb_set_slave_mac_addr(bond->curr_active_slave, bond_dev->dev_addr,
                                       bond->alb_info.rlb_enabled);
+                read_lock(&bond->lock);
                alb_send_learning_packets(bond->curr_active_slave, bond_dev->dev_addr);
                if (bond->alb_info.rlb_enabled) {
                        /* inform clients mac address has changed */
                        rlb_req_update_slave_clients(bond, bond->curr_active_slave);
                }
+                read_unlock(&bond->lock);
        }
-        read_lock(&bond->lock);
-        write_lock_bh(&bond->curr_slave_lock);
        return 0;
 }
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 63369b6b14d4..74824028f85c 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -2213,33 +2213,24 @@ static int bond_slave_info_query(struct net_device *bond_dev, struct ifslave *in
 {
        struct bonding *bond = netdev_priv(bond_dev);
        struct slave *slave;
-        int i, found = 0;
+        int i, res = -ENODEV;
-        if (info->slave_id < 0) {
-                return -ENODEV;
-        }
        read_lock(&bond->lock);
        bond_for_each_slave(bond, slave, i) {
                if (i == (int)info->slave_id) {
-                        found = 1;
+                        res = 0;
+                        strcpy(info->slave_name, slave->dev->name);
+                        info->link = slave->link;
+                        info->state = slave->state;
+                        info->link_failure_count = slave->link_failure_count;
                        break;
                }
        }
        read_unlock(&bond->lock);
-        if (found) {
+        return res;
-                strcpy(info->slave_name, slave->dev->name);
-                info->link = slave->link;
-                info->state = slave->state;
-                info->link_failure_count = slave->link_failure_count;
-        } else {
-                return -ENODEV;
-        }
-        return 0;
 }
 /*-------------------------------- Monitoring -------------------------------*/
@@ -5167,16 +5158,15 @@ int bond_create(char *name, struct bond_params *params)
        up_write(&bonding_rwsem);
        rtnl_unlock(); /* allows sysfs registration of net device */
        res = bond_create_sysfs_entry(netdev_priv(bond_dev));
-        if (res < 0) {
+        if (res < 0)
-                rtnl_lock();
+                goto out_unreg;
-                down_write(&bonding_rwsem);
-                bond_deinit(bond_dev);
-                unregister_netdevice(bond_dev);
-                goto out_rtnl;
-        }
        return 0;
+out_unreg:
+        rtnl_lock();
+        down_write(&bonding_rwsem);
+        unregister_netdevice(bond_dev);
 out_bond:
        bond_deinit(bond_dev);
 out_netdev:
@@ -5191,7 +5181,6 @@ static int __init bonding_init(void)
 {
        int i;
        int res;
-        struct bonding *bond;
        printk(KERN_INFO "%s", version);
@@ -5222,13 +5211,6 @@ static int __init bonding_init(void)
        goto out;
 err:
-        list_for_each_entry(bond, &bond_dev_list, bond_list) {
-                bond_work_cancel_all(bond);
-                destroy_workqueue(bond->wq);
-        }
-        bond_destroy_sysfs();
        rtnl_lock();
        bond_free_all();
        rtnl_unlock();
diff --git a/drivers/net/cxgb3/adapter.h b/drivers/net/cxgb3/adapter.h
index 714df2b675e6..c888e97c9671 100644
--- a/drivers/net/cxgb3/adapter.h
+++ b/drivers/net/cxgb3/adapter.h
@@ -85,8 +85,8 @@ struct fl_pg_chunk {
        struct page *page;
        void *va;
        unsigned int offset;
-        u64 *p_cnt;
+        unsigned long *p_cnt;
-        DECLARE_PCI_UNMAP_ADDR(mapping);
+        dma_addr_t mapping;
 };
 struct rx_desc;
diff --git a/drivers/net/cxgb3/cxgb3_main.c b/drivers/net/cxgb3/cxgb3_main.c
index ab0e5febef83..17858b9a5830 100644
--- a/drivers/net/cxgb3/cxgb3_main.c
+++ b/drivers/net/cxgb3/cxgb3_main.c
@@ -1117,8 +1117,8 @@ static void cxgb_down(struct adapter *adapter)
        spin_unlock_irq(&adapter->work_lock);
        free_irq_resources(adapter);
-        flush_workqueue(cxgb3_wq);      /* wait for external IRQ handler */
        quiesce_rx(adapter);
+        flush_workqueue(cxgb3_wq);      /* wait for external IRQ handler */
 }
 static void schedule_chk_task(struct adapter *adap)
@@ -1187,6 +1187,9 @@ static int offload_close(struct t3cdev *tdev)
        sysfs_remove_group(&tdev->lldev->dev.kobj, &offload_attr_group);
+        /* Flush work scheduled while releasing TIDs */
+        flush_scheduled_work();
        tdev->lldev = NULL;
        cxgb3_set_dummy_ops(tdev);
        t3_tp_set_offload_mode(adapter, 0);
@@ -1232,6 +1235,10 @@ static int cxgb_close(struct net_device *dev)
        struct port_info *pi = netdev_priv(dev);
        struct adapter *adapter = pi->adapter;
+        
+        if (!adapter->open_device_map)
+                return 0;
        /* Stop link fault interrupts */
        t3_xgm_intr_disable(adapter, pi->port_id);
        t3_read_reg(adapter, A_XGM_INT_STATUS + pi->mac.offset);
@@ -1247,8 +1254,7 @@ static int cxgb_close(struct net_device *dev)
        spin_unlock_irq(&adapter->work_lock);
        if (!(adapter->open_device_map & PORT_MASK))
-                cancel_rearming_delayed_workqueue(cxgb3_wq,
+                cancel_delayed_work_sync(&adapter->adap_check_task);
-                                                  &adapter->adap_check_task);
        if (!adapter->open_device_map)
                cxgb_down(adapter);
@@ -2490,13 +2496,16 @@ static void check_link_status(struct adapter *adapter)
        for_each_port(adapter, i) {
                struct net_device *dev = adapter->port[i];
                struct port_info *p = netdev_priv(dev);
+                int link_fault;
                spin_lock_irq(&adapter->work_lock);
-                if (p->link_fault) {
+                link_fault = p->link_fault;
-                        spin_unlock_irq(&adapter->work_lock);
+                spin_unlock_irq(&adapter->work_lock);
+                if (link_fault) {
+                        t3_link_fault(adapter, i);
                        continue;
                }
-                spin_unlock_irq(&adapter->work_lock);
                if (!(p->phy.caps & SUPPORTED_IRQ) && netif_running(dev)) {
                        t3_xgm_intr_disable(adapter, i);
@@ -2554,9 +2563,7 @@ static void t3_adap_check_task(struct work_struct *work)
        adapter->check_task_cnt++;
-        /* Check link status for PHYs without interrupts */
+        check_link_status(adapter);
-        if (p->linkpoll_period)
-                check_link_status(adapter);
        /* Accumulate MAC stats if needed */
        if (!p->linkpoll_period ||
@@ -2680,21 +2687,6 @@ void t3_os_ext_intr_handler(struct adapter *adapter)
        spin_unlock(&adapter->work_lock);
 }
-static void link_fault_task(struct work_struct *work)
-{
-        struct adapter *adapter = container_of(work, struct adapter,
-                                               link_fault_handler_task);
-        int i;
-        for_each_port(adapter, i) {
-                struct net_device *netdev = adapter->port[i];
-                struct port_info *pi = netdev_priv(netdev);
-                if (pi->link_fault)
-                        t3_link_fault(adapter, i);
-        }
-}
 void t3_os_link_fault_handler(struct adapter *adapter, int port_id)
 {
        struct net_device *netdev = adapter->port[port_id];
@@ -2702,7 +2694,6 @@ void t3_os_link_fault_handler(struct adapter *adapter, int port_id)
        spin_lock(&adapter->work_lock);
        pi->link_fault = 1;
-        queue_work(cxgb3_wq, &adapter->link_fault_handler_task);
        spin_unlock(&adapter->work_lock);
 }
@@ -2838,6 +2829,9 @@ static pci_ers_result_t t3_io_error_detected(struct pci_dev *pdev,
        struct adapter *adapter = pci_get_drvdata(pdev);
        int ret;
+        if (state == pci_channel_io_perm_failure)
+                return PCI_ERS_RESULT_DISCONNECT;
        ret = t3_adapter_error(adapter, 0);
        /* Request a slot reset. */
@@ -2932,8 +2926,13 @@ static int __devinit cxgb_enable_msix(struct adapter *adap)
        while ((err = pci_enable_msix(adap->pdev, entries, vectors)) > 0)
                vectors = err;
-        if (!err && vectors < (adap->params.nports + 1))
+        if (err < 0)
+                pci_disable_msix(adap->pdev);
+        if (!err && vectors < (adap->params.nports + 1)) {
+                pci_disable_msix(adap->pdev);
                err = -1;
+        }
        if (!err) {
                for (i = 0; i < vectors; ++i)
@@ -3082,7 +3081,6 @@ static int __devinit init_one(struct pci_dev *pdev,
        INIT_LIST_HEAD(&adapter->adapter_list);
        INIT_WORK(&adapter->ext_intr_handler_task, ext_intr_task);
-        INIT_WORK(&adapter->link_fault_handler_task, link_fault_task);
        INIT_WORK(&adapter->fatal_error_handler_task, fatal_error_task);
        INIT_DELAYED_WORK(&adapter->adap_check_task, t3_adap_check_task);
diff --git a/drivers/net/cxgb3/sge.c b/drivers/net/cxgb3/sge.c
index 26d3587f3399..b3ee2bc1a005 100644
--- a/drivers/net/cxgb3/sge.c
+++ b/drivers/net/cxgb3/sge.c
@@ -355,7 +355,7 @@ static void clear_rx_desc(struct pci_dev *pdev, const struct sge_fl *q,
                (*d->pg_chunk.p_cnt)--;
                if (!*d->pg_chunk.p_cnt)
                        pci_unmap_page(pdev,
-                                       pci_unmap_addr(&d->pg_chunk, mapping),
+                                       d->pg_chunk.mapping,
                                       q->alloc_size, PCI_DMA_FROMDEVICE);
                put_page(d->pg_chunk.page);
@@ -454,7 +454,7 @@ static int alloc_pg_chunk(struct adapter *adapter, struct sge_fl *q,
                q->pg_chunk.offset = 0;
                mapping = pci_map_page(adapter->pdev, q->pg_chunk.page,
                                       0, q->alloc_size, PCI_DMA_FROMDEVICE);
-                pci_unmap_addr_set(&q->pg_chunk, mapping, mapping);
+                q->pg_chunk.mapping = mapping;
        }
        sd->pg_chunk = q->pg_chunk;
@@ -511,8 +511,7 @@ static int refill_fl(struct adapter *adap, struct sge_fl *q, int n, gfp_t gfp)
 nomem:                          q->alloc_failed++;
                                break;
                        }
-                        mapping = pci_unmap_addr(&sd->pg_chunk, mapping) +
+                        mapping = sd->pg_chunk.mapping + sd->pg_chunk.offset;
-                                                 sd->pg_chunk.offset;
                        pci_unmap_addr_set(sd, dma_addr, mapping);
                        add_one_rx_chunk(mapping, d, q->gen);
@@ -881,7 +880,7 @@ recycle:
        (*sd->pg_chunk.p_cnt)--;
        if (!*sd->pg_chunk.p_cnt)
                pci_unmap_page(adap->pdev,
-                               pci_unmap_addr(&sd->pg_chunk, mapping),
+                               sd->pg_chunk.mapping,
                               fl->alloc_size,
                               PCI_DMA_FROMDEVICE);
        if (!skb) {
@@ -2096,7 +2095,7 @@ static void lro_add_page(struct adapter *adap, struct sge_qset *qs,
        (*sd->pg_chunk.p_cnt)--;
        if (!*sd->pg_chunk.p_cnt)
                pci_unmap_page(adap->pdev,
-                               pci_unmap_addr(&sd->pg_chunk, mapping),
+                               sd->pg_chunk.mapping,
                               fl->alloc_size,
                               PCI_DMA_FROMDEVICE);
diff --git a/drivers/net/cxgb3/t3_hw.c b/drivers/net/cxgb3/t3_hw.c
index 31ed31a3428b..4950d5d789ae 100644
--- a/drivers/net/cxgb3/t3_hw.c
+++ b/drivers/net/cxgb3/t3_hw.c
@@ -1202,7 +1202,6 @@ void t3_link_changed(struct adapter *adapter, int port_id)
        struct cphy *phy = &pi->phy;
        struct cmac *mac = &pi->mac;
        struct link_config *lc = &pi->link_config;
-        int force_link_down = 0;
        phy->ops->get_link_status(phy, &link_ok, &speed, &duplex, &fc);
@@ -1218,14 +1217,9 @@ void t3_link_changed(struct adapter *adapter, int port_id)
                status = t3_read_reg(adapter, A_XGM_INT_STATUS + mac->offset);
                if (status & F_LINKFAULTCHANGE) {
                        mac->stats.link_faults++;
-                        force_link_down = 1;
+                        pi->link_fault = 1;
                }
                t3_open_rx_traffic(mac, rx_cfg, rx_hash_high, rx_hash_low);
-                if (force_link_down) {
-                        t3_os_link_fault_handler(adapter, port_id);
-                        return;
-                }
        }
        if (lc->requested_fc & PAUSE_AUTONEG)
@@ -1280,6 +1274,11 @@ void t3_link_fault(struct adapter *adapter, int port_id)
                                 A_XGM_INT_STATUS + mac->offset);
        link_fault &= F_LINKFAULTCHANGE;
+        link_ok = lc->link_ok;
+        speed = lc->speed;
+        duplex = lc->duplex;
+        fc = lc->fc;
        phy->ops->get_link_status(phy, &link_ok, &speed, &duplex, &fc);
        if (link_fault) {
@@ -1292,9 +1291,6 @@ void t3_link_fault(struct adapter *adapter, int port_id)
                /* Account link faults only when the phy reports a link up */
                if (link_ok)
                        mac->stats.link_faults++;
-                msleep(1000);
-                t3_os_link_fault_handler(adapter, port_id);
        } else {
                if (link_ok)
                        t3_write_reg(adapter, A_XGM_XAUI_ACT_CTRL + mac->offset,
@@ -3788,7 +3784,7 @@ int t3_prep_adapter(struct adapter *adapter, const struct adapter_info *ai,
        adapter->params.info = ai;
        adapter->params.nports = ai->nports0 + ai->nports1;
-        adapter->params.chan_map = !!ai->nports0 | (!!ai->nports1 << 1);
+        adapter->params.chan_map = (!!ai->nports0) | (!!ai->nports1 << 1);
        adapter->params.rev = t3_read_reg(adapter, A_PL_REV);
        /*
         * We used to only run the "adapter check task" once a second if
diff --git a/drivers/net/e100.c b/drivers/net/e100.c
index 5c0b457c7868..0f9ee1348552 100644
--- a/drivers/net/e100.c
+++ b/drivers/net/e100.c
@@ -2728,7 +2728,7 @@ static void __devexit e100_remove(struct pci_dev *pdev)
 #define E100_82552_SMARTSPEED   0x14   /* SmartSpeed Ctrl register */
 #define E100_82552_REV_ANEG     0x0200 /* Reverse auto-negotiation */
 #define E100_82552_ANEG_NOW     0x0400 /* Auto-negotiate now */
-static int e100_suspend(struct pci_dev *pdev, pm_message_t state)
+static void __e100_shutdown(struct pci_dev *pdev, bool *enable_wake)
 {
        struct net_device *netdev = pci_get_drvdata(pdev);
        struct nic *nic = netdev_priv(netdev);
@@ -2749,19 +2749,32 @@ static int e100_suspend(struct pci_dev *pdev, pm_message_t state)
                                   E100_82552_SMARTSPEED, smartspeed |
                                   E100_82552_REV_ANEG | E100_82552_ANEG_NOW);
                }
-                if (pci_enable_wake(pdev, PCI_D3cold, true))
+                *enable_wake = true;
-                        pci_enable_wake(pdev, PCI_D3hot, true);
        } else {
-                pci_enable_wake(pdev, PCI_D3hot, false);
+                *enable_wake = false;
        }
        pci_disable_device(pdev);
-        pci_set_power_state(pdev, PCI_D3hot);
+}
-        return 0;
+static int __e100_power_off(struct pci_dev *pdev, bool wake)
+{
+        if (wake) {
+                return pci_prepare_to_sleep(pdev);
+        } else {
+                pci_wake_from_d3(pdev, false);
+                return pci_set_power_state(pdev, PCI_D3hot);
+        }
 }
 #ifdef CONFIG_PM
+static int e100_suspend(struct pci_dev *pdev, pm_message_t state)
+{
+        bool wake;
+        __e100_shutdown(pdev, &wake);
+        return __e100_power_off(pdev, wake);
+}
 static int e100_resume(struct pci_dev *pdev)
 {
        struct net_device *netdev = pci_get_drvdata(pdev);
@@ -2792,7 +2805,10 @@ static int e100_resume(struct pci_dev *pdev)
 static void e100_shutdown(struct pci_dev *pdev)
 {
-        e100_suspend(pdev, PMSG_SUSPEND);
+        bool wake;
+        __e100_shutdown(pdev, &wake);
+        if (system_state == SYSTEM_POWER_OFF)
+                __e100_power_off(pdev, wake);
 }
 /* ------------------ PCI Error Recovery infrastructure  -------------- */
diff --git a/drivers/net/e1000/e1000_main.c b/drivers/net/e1000/e1000_main.c
index ef12931d302a..fffb006b7d95 100644
--- a/drivers/net/e1000/e1000_main.c
+++ b/drivers/net/e1000/e1000_main.c
@@ -3738,7 +3738,7 @@ static irqreturn_t e1000_intr(int irq, void *data)
        struct e1000_hw *hw = &adapter->hw;
        u32 rctl, icr = er32(ICR);
-        if (unlikely((!icr) || test_bit(__E1000_RESETTING, &adapter->flags)))
+        if (unlikely((!icr) || test_bit(__E1000_DOWN, &adapter->flags)))
                return IRQ_NONE;  /* Not our interrupt */
        /* IMS will not auto-mask if INT_ASSERTED is not set, and if it is
@@ -3834,7 +3834,6 @@ static bool e1000_clean_tx_irq(struct e1000_adapter *adapter,
        struct e1000_buffer *buffer_info;
        unsigned int i, eop;
        unsigned int count = 0;
-        bool cleaned = false;
        unsigned int total_tx_bytes=0, total_tx_packets=0;
        i = tx_ring->next_to_clean;
@@ -3843,7 +3842,8 @@ static bool e1000_clean_tx_irq(struct e1000_adapter *adapter,
        while ((eop_desc->upper.data & cpu_to_le32(E1000_TXD_STAT_DD)) &&
               (count < tx_ring->count)) {
-                for (cleaned = false; !cleaned; count++) {
+                bool cleaned = false;
+                for ( ; !cleaned; count++) {
                        tx_desc = E1000_TX_DESC(*tx_ring, i);
                        buffer_info = &tx_ring->buffer_info[i];
                        cleaned = (i == eop);
@@ -3871,7 +3871,7 @@ static bool e1000_clean_tx_irq(struct e1000_adapter *adapter,
        tx_ring->next_to_clean = i;
 #define TX_WAKE_THRESHOLD 32
-        if (unlikely(cleaned && netif_carrier_ok(netdev) &&
+        if (unlikely(count && netif_carrier_ok(netdev) &&
                     E1000_DESC_UNUSED(tx_ring) >= TX_WAKE_THRESHOLD)) {
                /* Make sure that anybody stopping the queue after this
                 * sees the new next_to_clean.
@@ -4027,8 +4027,9 @@ static bool e1000_clean_rx_irq(struct e1000_adapter *adapter,
                                 PCI_DMA_FROMDEVICE);
                length = le16_to_cpu(rx_desc->length);
+                /* !EOP means multiple descriptors were used to store a single
-                if (unlikely(!(status & E1000_RXD_STAT_EOP))) {
+                 * packet, also make sure the frame isn't just CRC only */
+                if (unlikely(!(status & E1000_RXD_STAT_EOP) || (length <= 4))) {
                        /* All receives must fit into a single buffer */
                        E1000_DBG("%s: Receive packet consumed multiple"
                                  " buffers\n", netdev->name);
diff --git a/drivers/net/e1000e/netdev.c b/drivers/net/e1000e/netdev.c
index 1693ed116b16..ca82f19a7ed1 100644
--- a/drivers/net/e1000e/netdev.c
+++ b/drivers/net/e1000e/netdev.c
@@ -621,7 +621,6 @@ static bool e1000_clean_tx_irq(struct e1000_adapter *adapter)
        struct e1000_buffer *buffer_info;
        unsigned int i, eop;
        unsigned int count = 0;
-        bool cleaned = false;
        unsigned int total_tx_bytes = 0, total_tx_packets = 0;
        i = tx_ring->next_to_clean;
@@ -630,7 +629,8 @@ static bool e1000_clean_tx_irq(struct e1000_adapter *adapter)
        while ((eop_desc->upper.data & cpu_to_le32(E1000_TXD_STAT_DD)) &&
               (count < tx_ring->count)) {
-                for (cleaned = 0; !cleaned; count++) {
+                bool cleaned = false;
+                for (; !cleaned; count++) {
                        tx_desc = E1000_TX_DESC(*tx_ring, i);
                        buffer_info = &tx_ring->buffer_info[i];
                        cleaned = (i == eop);
@@ -661,8 +661,8 @@ static bool e1000_clean_tx_irq(struct e1000_adapter *adapter)
        tx_ring->next_to_clean = i;
 #define TX_WAKE_THRESHOLD 32
-        if (cleaned && netif_carrier_ok(netdev) &&
+        if (count && netif_carrier_ok(netdev) &&
-                     e1000_desc_unused(tx_ring) >= TX_WAKE_THRESHOLD) {
+            e1000_desc_unused(tx_ring) >= TX_WAKE_THRESHOLD) {
                /* Make sure that anybody stopping the queue after this
                 * sees the new next_to_clean.
                 */
diff --git a/drivers/net/ehea/ehea.h b/drivers/net/ehea/ehea.h
index 6e317caf429c..16a41389575a 100644
--- a/drivers/net/ehea/ehea.h
+++ b/drivers/net/ehea/ehea.h
@@ -40,7 +40,7 @@
 #include <asm/io.h>
 #define DRV_NAME        "ehea"
-#define DRV_VERSION     "EHEA_0100"
+#define DRV_VERSION     "EHEA_0101"
 /* eHEA capability flags */
 #define DLPAR_PORT_ADD_REM 1
diff --git a/drivers/net/ehea/ehea_main.c b/drivers/net/ehea/ehea_main.c
index 604c844d0769..b22dab9153f6 100644
--- a/drivers/net/ehea/ehea_main.c
+++ b/drivers/net/ehea/ehea_main.c
@@ -545,14 +545,17 @@ static inline struct sk_buff *get_skb_by_index(struct sk_buff **skb_array,
        x &= (arr_len - 1);
        pref = skb_array[x];
-        prefetchw(pref);
+        if (pref) {
-        prefetchw(pref + EHEA_CACHE_LINE);
+                prefetchw(pref);
+                prefetchw(pref + EHEA_CACHE_LINE);
-        pref = (skb_array[x]->data);
-        prefetch(pref);
+                pref = (skb_array[x]->data);
-        prefetch(pref + EHEA_CACHE_LINE);
+                prefetch(pref);
-        prefetch(pref + EHEA_CACHE_LINE * 2);
+                prefetch(pref + EHEA_CACHE_LINE);
-        prefetch(pref + EHEA_CACHE_LINE * 3);
+                prefetch(pref + EHEA_CACHE_LINE * 2);
+                prefetch(pref + EHEA_CACHE_LINE * 3);
+        }
        skb = skb_array[skb_index];
        skb_array[skb_index] = NULL;
        return skb;
@@ -569,12 +572,14 @@ static inline struct sk_buff *get_skb_by_index_ll(struct sk_buff **skb_array,
        x &= (arr_len - 1);
        pref = skb_array[x];
-        prefetchw(pref);
+        if (pref) {
-        prefetchw(pref + EHEA_CACHE_LINE);
+                prefetchw(pref);
+                prefetchw(pref + EHEA_CACHE_LINE);
-        pref = (skb_array[x]->data);
+                pref = (skb_array[x]->data);
-        prefetchw(pref);
+                prefetchw(pref);
-        prefetchw(pref + EHEA_CACHE_LINE);
+                prefetchw(pref + EHEA_CACHE_LINE);
+        }
        skb = skb_array[wqe_index];
        skb_array[wqe_index] = NULL;
diff --git a/drivers/net/forcedeth.c b/drivers/net/forcedeth.c
index 11d5db16ed9c..9f6a68fb7b45 100644
--- a/drivers/net/forcedeth.c
+++ b/drivers/net/forcedeth.c
@@ -897,6 +897,12 @@ enum {
 };
 static int phy_cross = NV_CROSSOVER_DETECTION_DISABLED;
+/*
+ * Power down phy when interface is down (persists through reboot;
+ * older Linux and other OSes may not power it up again)
+ */
+static int phy_power_down = 0;
 static inline struct fe_priv *get_nvpriv(struct net_device *dev)
 {
        return netdev_priv(dev);
@@ -1485,7 +1491,10 @@ static int phy_init(struct net_device *dev)
        /* restart auto negotiation, power down phy */
        mii_control = mii_rw(dev, np->phyaddr, MII_BMCR, MII_READ);
-        mii_control |= (BMCR_ANRESTART | BMCR_ANENABLE | BMCR_PDOWN);
+        mii_control |= (BMCR_ANRESTART | BMCR_ANENABLE);
+        if (phy_power_down) {
+                mii_control |= BMCR_PDOWN;
+        }
        if (mii_rw(dev, np->phyaddr, MII_BMCR, mii_control)) {
                return PHY_ERROR;
        }
@@ -1880,6 +1889,7 @@ static void nv_init_tx(struct net_device *dev)
        np->tx_pkts_in_progress = 0;
        np->tx_change_owner = NULL;
        np->tx_end_flip = NULL;
+        np->tx_stop = 0;
        for (i = 0; i < np->tx_ring_size; i++) {
                if (!nv_optimized(np)) {
@@ -2530,6 +2540,8 @@ static void nv_tx_timeout(struct net_device *dev)
        struct fe_priv *np = netdev_priv(dev);
        u8 __iomem *base = get_hwbase(dev);
        u32 status;
+        union ring_type put_tx;
+        int saved_tx_limit;
        if (np->msi_flags & NV_MSI_X_ENABLED)
                status = readl(base + NvRegMSIXIrqStatus) & NVREG_IRQSTAT_MASK;
@@ -2589,24 +2601,32 @@ static void nv_tx_timeout(struct net_device *dev)
        /* 1) stop tx engine */
        nv_stop_tx(dev);
-        /* 2) check that the packets were not sent already: */
+        /* 2) complete any outstanding tx and do not give HW any limited tx pkts */
+        saved_tx_limit = np->tx_limit;
+        np->tx_limit = 0; /* prevent giving HW any limited pkts */
+        np->tx_stop = 0;  /* prevent waking tx queue */
        if (!nv_optimized(np))
                nv_tx_done(dev, np->tx_ring_size);
        else
                nv_tx_done_optimized(dev, np->tx_ring_size);
-        /* 3) if there are dead entries: clear everything */
+        /* save current HW postion */
-        if (np->get_tx_ctx != np->put_tx_ctx) {
+        if (np->tx_change_owner)
-                printk(KERN_DEBUG "%s: tx_timeout: dead entries!\n", dev->name);
+                put_tx.ex = np->tx_change_owner->first_tx_desc;
-                nv_drain_tx(dev);
+        else
-                nv_init_tx(dev);
+                put_tx = np->put_tx;
-                setup_hw_rings(dev, NV_SETUP_TX_RING);
-        }
-        netif_wake_queue(dev);
+        /* 3) clear all tx state */
+        nv_drain_tx(dev);
+        nv_init_tx(dev);
-        /* 4) restart tx engine */
+        /* 4) restore state to current HW position */
+        np->get_tx = np->put_tx = put_tx;
+        np->tx_limit = saved_tx_limit;
+        /* 5) restart tx engine */
        nv_start_tx(dev);
+        netif_wake_queue(dev);
        spin_unlock_irq(&np->lock);
 }
@@ -5502,7 +5522,7 @@ static int nv_close(struct net_device *dev)
        nv_drain_rxtx(dev);
-        if (np->wolenabled) {
+        if (np->wolenabled || !phy_power_down) {
                writel(NVREG_PFF_ALWAYS|NVREG_PFF_MYADDR, base + NvRegPacketFilterFlags);
                nv_start_rx(dev);
        } else {
@@ -6356,6 +6376,8 @@ module_param(dma_64bit, int, 0);
 MODULE_PARM_DESC(dma_64bit, "High DMA is enabled by setting to 1 and disabled by setting to 0.");
 module_param(phy_cross, int, 0);
 MODULE_PARM_DESC(phy_cross, "Phy crossover detection for Realtek 8201 phy is enabled by setting to 1 and disabled by setting to 0.");
+module_param(phy_power_down, int, 0);
+MODULE_PARM_DESC(phy_power_down, "Power down phy and disable link when interface is down (1), or leave phy powered up (0).");
 MODULE_AUTHOR("Manfred Spraul <manfred@colorfullife.com>");
 MODULE_DESCRIPTION("Reverse Engineered nForce ethernet driver");
diff --git a/drivers/net/gianfar.c b/drivers/net/gianfar.c
index b2c49679bba7..a0519184e54e 100644
--- a/drivers/net/gianfar.c
+++ b/drivers/net/gianfar.c
@@ -1885,8 +1885,17 @@ int gfar_clean_rx_ring(struct net_device *dev, int rx_work_limit)
                        if (unlikely(!newskb))
                                newskb = skb;
-                        else if (skb)
+                        else if (skb) {
+                                /*
+                                 * We need to reset ->data to what it
+                                 * was before gfar_new_skb() re-aligned
+                                 * it to an RXBUF_ALIGNMENT boundary
+                                 * before we put the skb back on the
+                                 * recycle list.
+                                 */
+                                skb->data = skb->head + NET_SKB_PAD;
                                __skb_queue_head(&priv->rx_recycle, skb);
+                        }
                } else {
                        /* Increment the number of packets */
                        dev->stats.rx_packets++;
diff --git a/drivers/net/gianfar.h b/drivers/net/gianfar.h
index 0642d52aef5c..cf352961ae9b 100644
--- a/drivers/net/gianfar.h
+++ b/drivers/net/gianfar.h
@@ -259,7 +259,7 @@ extern const char gfar_driver_version[];
 (IEVENT_RXC | IEVENT_BSY | IEVENT_EBERR | IEVENT_MSRO | \
 IEVENT_BABT | IEVENT_TXC | IEVENT_TXE | IEVENT_LC \
 | IEVENT_CRL | IEVENT_XFUN | IEVENT_DPE | IEVENT_PERR \
- | IEVENT_MAG)
+ | IEVENT_MAG | IEVENT_BABR)
 #define IMASK_INIT_CLEAR        0x00000000
 #define IMASK_BABR              0x80000000
diff --git a/drivers/net/igb/igb_main.c b/drivers/net/igb/igb_main.c
index 08c801490c72..e25343588fc7 100644
--- a/drivers/net/igb/igb_main.c
+++ b/drivers/net/igb/igb_main.c
@@ -2006,7 +2006,7 @@ static void igb_setup_rctl(struct igb_adapter *adapter)
        struct e1000_hw *hw = &adapter->hw;
        u32 rctl;
        u32 srrctl = 0;
-        int i, j;
+        int i;
        rctl = rd32(E1000_RCTL);
@@ -2071,8 +2071,6 @@ static void igb_setup_rctl(struct igb_adapter *adapter)
        if (adapter->vfs_allocated_count) {
                u32 vmolr;
-                j = adapter->rx_ring[0].reg_idx;
                /* set all queue drop enable bits */
                wr32(E1000_QDE, ALL_QUEUES);
                srrctl |= E1000_SRRCTL_DROP_EN;
@@ -2080,16 +2078,16 @@ static void igb_setup_rctl(struct igb_adapter *adapter)
                /* disable queue 0 to prevent tail write w/o re-config */
                wr32(E1000_RXDCTL(0), 0);
-                vmolr = rd32(E1000_VMOLR(j));
+                vmolr = rd32(E1000_VMOLR(adapter->vfs_allocated_count));
                if (rctl & E1000_RCTL_LPE)
                        vmolr |= E1000_VMOLR_LPE;
-                if (adapter->num_rx_queues > 0)
+                if (adapter->num_rx_queues > 1)
                        vmolr |= E1000_VMOLR_RSSE;
-                wr32(E1000_VMOLR(j), vmolr);
+                wr32(E1000_VMOLR(adapter->vfs_allocated_count), vmolr);
        }
        for (i = 0; i < adapter->num_rx_queues; i++) {
-                j = adapter->rx_ring[i].reg_idx;
+                int j = adapter->rx_ring[i].reg_idx;
                wr32(E1000_SRRCTL(j), srrctl);
        }
diff --git a/drivers/net/ixgbe/ixgbe_common.c b/drivers/net/ixgbe/ixgbe_common.c
index 5567519676d5..186a65069b33 100644
--- a/drivers/net/ixgbe/ixgbe_common.c
+++ b/drivers/net/ixgbe/ixgbe_common.c
@@ -50,7 +50,6 @@ static u16 ixgbe_calc_eeprom_checksum(struct ixgbe_hw *hw);
 static void ixgbe_enable_rar(struct ixgbe_hw *hw, u32 index);
 static void ixgbe_disable_rar(struct ixgbe_hw *hw, u32 index);
 static s32 ixgbe_mta_vector(struct ixgbe_hw *hw, u8 *mc_addr);
-static void ixgbe_add_mc_addr(struct ixgbe_hw *hw, u8 *mc_addr);
 static void ixgbe_add_uc_addr(struct ixgbe_hw *hw, u8 *addr, u32 vmdq);
 /**
@@ -1377,8 +1376,7 @@ s32 ixgbe_update_uc_addr_list_generic(struct ixgbe_hw *hw, u8 *addr_list,
         * Clear accounting of old secondary address list,
         * don't count RAR[0]
         */
-        uc_addr_in_use = hw->addr_ctrl.rar_used_count -
+        uc_addr_in_use = hw->addr_ctrl.rar_used_count - 1;
-                         hw->addr_ctrl.mc_addr_in_rar_count - 1;
        hw->addr_ctrl.rar_used_count -= uc_addr_in_use;
        hw->addr_ctrl.overflow_promisc = 0;
@@ -1493,40 +1491,6 @@ static void ixgbe_set_mta(struct ixgbe_hw *hw, u8 *mc_addr)
 }
 /**
- *  ixgbe_add_mc_addr - Adds a multicast address.
- *  @hw: pointer to hardware structure
- *  @mc_addr: new multicast address
- *
- *  Adds it to unused receive address register or to the multicast table.
- **/
-static void ixgbe_add_mc_addr(struct ixgbe_hw *hw, u8 *mc_addr)
-{
-        u32 rar_entries = hw->mac.num_rar_entries;
-        u32 rar;
-        hw_dbg(hw, " MC Addr =%.2X %.2X %.2X %.2X %.2X %.2X\n",
-               mc_addr[0], mc_addr[1], mc_addr[2],
-               mc_addr[3], mc_addr[4], mc_addr[5]);
-        /*
-         * Place this multicast address in the RAR if there is room,
-         * else put it in the MTA
-         */
-        if (hw->addr_ctrl.rar_used_count < rar_entries) {
-                /* use RAR from the end up for multicast */
-                rar = rar_entries - hw->addr_ctrl.mc_addr_in_rar_count - 1;
-                hw->mac.ops.set_rar(hw, rar, mc_addr, 0, IXGBE_RAH_AV);
-                hw_dbg(hw, "Added a multicast address to RAR[%d]\n", rar);
-                hw->addr_ctrl.rar_used_count++;
-                hw->addr_ctrl.mc_addr_in_rar_count++;
-        } else {
-                ixgbe_set_mta(hw, mc_addr);
-        }
-        hw_dbg(hw, "ixgbe_add_mc_addr Complete\n");
-}
-/**
 *  ixgbe_update_mc_addr_list_generic - Updates MAC list of multicast addresses
 *  @hw: pointer to hardware structure
 *  @mc_addr_list: the list of new multicast addresses
@@ -1542,7 +1506,6 @@ s32 ixgbe_update_mc_addr_list_generic(struct ixgbe_hw *hw, u8 *mc_addr_list,
                                      u32 mc_addr_count, ixgbe_mc_addr_itr next)
 {
        u32 i;
-        u32 rar_entries = hw->mac.num_rar_entries;
        u32 vmdq;
        /*
@@ -1550,18 +1513,8 @@ s32 ixgbe_update_mc_addr_list_generic(struct ixgbe_hw *hw, u8 *mc_addr_list,
         * use.
         */
        hw->addr_ctrl.num_mc_addrs = mc_addr_count;
-        hw->addr_ctrl.rar_used_count -= hw->addr_ctrl.mc_addr_in_rar_count;
-        hw->addr_ctrl.mc_addr_in_rar_count = 0;
        hw->addr_ctrl.mta_in_use = 0;
-        /* Zero out the other receive addresses. */
-        hw_dbg(hw, "Clearing RAR[%d-%d]\n", hw->addr_ctrl.rar_used_count,
-                  rar_entries - 1);
-        for (i = hw->addr_ctrl.rar_used_count; i < rar_entries; i++) {
-                IXGBE_WRITE_REG(hw, IXGBE_RAL(i), 0);
-                IXGBE_WRITE_REG(hw, IXGBE_RAH(i), 0);
-        }
        /* Clear the MTA */
        hw_dbg(hw, " Clearing MTA\n");
        for (i = 0; i < hw->mac.mcft_size; i++)
@@ -1570,7 +1523,7 @@ s32 ixgbe_update_mc_addr_list_generic(struct ixgbe_hw *hw, u8 *mc_addr_list,
        /* Add the new addresses */
        for (i = 0; i < mc_addr_count; i++) {
                hw_dbg(hw, " Adding the multicast addresses:\n");
-                ixgbe_add_mc_addr(hw, next(hw, &mc_addr_list, &vmdq));
+                ixgbe_set_mta(hw, next(hw, &mc_addr_list, &vmdq));
        }
        /* Enable mta */
diff --git a/drivers/net/ixgbe/ixgbe_dcb_82599.c b/drivers/net/ixgbe/ixgbe_dcb_82599.c
index 470b676c1dae..f4417fc3b0fd 100644
--- a/drivers/net/ixgbe/ixgbe_dcb_82599.c
+++ b/drivers/net/ixgbe/ixgbe_dcb_82599.c
@@ -290,7 +290,7 @@ s32 ixgbe_dcb_config_tx_data_arbiter_82599(struct ixgbe_hw *hw,
 s32 ixgbe_dcb_config_pfc_82599(struct ixgbe_hw *hw,
                               struct ixgbe_dcb_config *dcb_config)
 {
-        u32 i, reg;
+        u32 i, reg, rx_pba_size;
        /* If PFC is disabled globally then fall back to LFC. */
        if (!dcb_config->pfc_mode_enable) {
@@ -301,17 +301,23 @@ s32 ixgbe_dcb_config_pfc_82599(struct ixgbe_hw *hw,
        /* Configure PFC Tx thresholds per TC */
        for (i = 0; i < MAX_TRAFFIC_CLASS; i++) {
-                /* Config and remember Tx */
+                if (dcb_config->rx_pba_cfg == pba_equal)
+                        rx_pba_size = IXGBE_RXPBSIZE_64KB;
+                else
+                        rx_pba_size = (i < 4) ? IXGBE_RXPBSIZE_80KB
+                                              : IXGBE_RXPBSIZE_48KB;
+                reg = ((rx_pba_size >> 5) & 0xFFE0);
                if (dcb_config->tc_config[i].dcb_pfc == pfc_enabled_full ||
-                    dcb_config->tc_config[i].dcb_pfc == pfc_enabled_tx) {
+                    dcb_config->tc_config[i].dcb_pfc == pfc_enabled_tx)
-                        reg = hw->fc.high_water | IXGBE_FCRTH_FCEN;
+                        reg |= IXGBE_FCRTL_XONE;
-                        IXGBE_WRITE_REG(hw, IXGBE_FCRTH_82599(i), reg);
+                IXGBE_WRITE_REG(hw, IXGBE_FCRTL_82599(i), reg);
-                        reg = hw->fc.low_water | IXGBE_FCRTL_XONE;
-                        IXGBE_WRITE_REG(hw, IXGBE_FCRTL_82599(i), reg);
+                reg = ((rx_pba_size >> 2) & 0xFFE0);
-                } else {
+                if (dcb_config->tc_config[i].dcb_pfc == pfc_enabled_full ||
-                        IXGBE_WRITE_REG(hw, IXGBE_FCRTH_82599(i), 0);
+                    dcb_config->tc_config[i].dcb_pfc == pfc_enabled_tx)
-                        IXGBE_WRITE_REG(hw, IXGBE_FCRTL_82599(i), 0);
+                        reg |= IXGBE_FCRTH_FCEN;
-                }
+                IXGBE_WRITE_REG(hw, IXGBE_FCRTH_82599(i), reg);
        }
        /* Configure pause time (2 TCs per register) */
diff --git a/drivers/net/ixgbe/ixgbe_main.c b/drivers/net/ixgbe/ixgbe_main.c
index febde45cf9fa..07e778d3e5d2 100644
--- a/drivers/net/ixgbe/ixgbe_main.c
+++ b/drivers/net/ixgbe/ixgbe_main.c
@@ -2841,11 +2841,55 @@ static inline bool ixgbe_cache_ring_dcb(struct ixgbe_adapter *adapter)
                        }
                        ret = true;
                } else if (adapter->hw.mac.type == ixgbe_mac_82599EB) {
-                        for (i = 0; i < dcb_i; i++) {
+                        if (dcb_i == 8) {
-                                adapter->rx_ring[i].reg_idx = i << 4;
+                                /*
-                                adapter->tx_ring[i].reg_idx = i << 4;
+                                 * Tx TC0 starts at: descriptor queue 0
+                                 * Tx TC1 starts at: descriptor queue 32
+                                 * Tx TC2 starts at: descriptor queue 64
+                                 * Tx TC3 starts at: descriptor queue 80
+                                 * Tx TC4 starts at: descriptor queue 96
+                                 * Tx TC5 starts at: descriptor queue 104
+                                 * Tx TC6 starts at: descriptor queue 112
+                                 * Tx TC7 starts at: descriptor queue 120
+                                 *
+                                 * Rx TC0-TC7 are offset by 16 queues each
+                                 */
+                                for (i = 0; i < 3; i++) {
+                                        adapter->tx_ring[i].reg_idx = i << 5;
+                                        adapter->rx_ring[i].reg_idx = i << 4;
+                                }
+                                for ( ; i < 5; i++) {
+                                        adapter->tx_ring[i].reg_idx =
+                                                                 ((i + 2) << 4);
+                                        adapter->rx_ring[i].reg_idx = i << 4;
+                                }
+                                for ( ; i < dcb_i; i++) {
+                                        adapter->tx_ring[i].reg_idx =
+                                                                 ((i + 8) << 3);
+                                        adapter->rx_ring[i].reg_idx = i << 4;
+                                }
+                                ret = true;
+                        } else if (dcb_i == 4) {
+                                /*
+                                 * Tx TC0 starts at: descriptor queue 0
+                                 * Tx TC1 starts at: descriptor queue 64
+                                 * Tx TC2 starts at: descriptor queue 96
+                                 * Tx TC3 starts at: descriptor queue 112
+                                 *
+                                 * Rx TC0-TC3 are offset by 32 queues each
+                                 */
+                                adapter->tx_ring[0].reg_idx = 0;
+                                adapter->tx_ring[1].reg_idx = 64;
+                                adapter->tx_ring[2].reg_idx = 96;
+                                adapter->tx_ring[3].reg_idx = 112;
+                                for (i = 0 ; i < dcb_i; i++)
+                                        adapter->rx_ring[i].reg_idx = i << 5;
+                                ret = true;
+                        } else {
+                                ret = false;
                        }
-                        ret = true;
                } else {
                        ret = false;
                }
@@ -3602,6 +3646,8 @@ static int ixgbe_resume(struct pci_dev *pdev)
        ixgbe_reset(adapter);
+        IXGBE_WRITE_REG(&adapter->hw, IXGBE_WUS, ~0);
        if (netif_running(netdev)) {
                err = ixgbe_open(adapter->netdev);
                if (err)
@@ -3946,7 +3992,7 @@ static void ixgbe_sfp_config_module_task(struct work_struct *work)
        }
        hw->mac.ops.setup_sfp(hw);
-        if (!adapter->flags & IXGBE_FLAG_IN_SFP_LINK_TASK)
+        if (!(adapter->flags & IXGBE_FLAG_IN_SFP_LINK_TASK))
                /* This will also work for DA Twinax connections */
                schedule_work(&adapter->multispeed_fiber_task);
        adapter->flags &= ~IXGBE_FLAG_IN_SFP_MOD_TASK;
@@ -4531,7 +4577,6 @@ static int __devinit ixgbe_probe(struct pci_dev *pdev,
        const struct ixgbe_info *ii = ixgbe_info_tbl[ent->driver_data];
        static int cards_found;
        int i, err, pci_using_dac;
-        u16 pm_value = 0;
        u32 part_num, eec;
        err = pci_enable_device(pdev);
@@ -4719,11 +4764,8 @@ static int __devinit ixgbe_probe(struct pci_dev *pdev,
        switch (pdev->device) {
        case IXGBE_DEV_ID_82599_KX4:
-#define IXGBE_PCIE_PMCSR 0x44
+                adapter->wol = (IXGBE_WUFC_MAG | IXGBE_WUFC_EX |
-                adapter->wol = IXGBE_WUFC_MAG;
+                                IXGBE_WUFC_MC | IXGBE_WUFC_BC);
-                pci_read_config_word(pdev, IXGBE_PCIE_PMCSR, &pm_value);
-                pci_write_config_word(pdev, IXGBE_PCIE_PMCSR,
-                                      (pm_value | (1 << 8)));
                break;
        default:
                adapter->wol = 0;
diff --git a/drivers/net/mac8390.c b/drivers/net/mac8390.c
index 8e884869a05b..22e74a0e0361 100644
--- a/drivers/net/mac8390.c
+++ b/drivers/net/mac8390.c
@@ -304,7 +304,7 @@ struct net_device * __init mac8390_probe(int unit)
        if (!MACH_IS_MAC)
                return ERR_PTR(-ENODEV);
-        dev = alloc_ei_netdev();
+        dev = ____alloc_ei_netdev(0);
        if (!dev)
                return ERR_PTR(-ENOMEM);
@@ -481,15 +481,15 @@ void cleanup_module(void)
 static const struct net_device_ops mac8390_netdev_ops = {
        .ndo_open               = mac8390_open,
        .ndo_stop               = mac8390_close,
-        .ndo_start_xmit         = ei_start_xmit,
+        .ndo_start_xmit         = __ei_start_xmit,
-        .ndo_tx_timeout         = ei_tx_timeout,
+        .ndo_tx_timeout         = __ei_tx_timeout,
-        .ndo_get_stats          = ei_get_stats,
+        .ndo_get_stats          = __ei_get_stats,
-        .ndo_set_multicast_list = ei_set_multicast_list,
+        .ndo_set_multicast_list = __ei_set_multicast_list,
        .ndo_validate_addr      = eth_validate_addr,
        .ndo_set_mac_address    = eth_mac_addr,
        .ndo_change_mtu         = eth_change_mtu,
 #ifdef CONFIG_NET_POLL_CONTROLLER
-        .ndo_poll_controller    = ei_poll,
+        .ndo_poll_controller    = __ei_poll,
 #endif
 };
diff --git a/drivers/net/macb.c b/drivers/net/macb.c
index 46073de290cf..e82aee41d77e 100644
--- a/drivers/net/macb.c
+++ b/drivers/net/macb.c
@@ -316,10 +316,11 @@ static void macb_tx(struct macb *bp)
        dev_dbg(&bp->pdev->dev, "macb_tx status = %02lx\n",
                (unsigned long)status);
-        if (status & MACB_BIT(UND)) {
+        if (status & (MACB_BIT(UND) | MACB_BIT(TSR_RLE))) {
                int i;
-                printk(KERN_ERR "%s: TX underrun, resetting buffers\n",
+                printk(KERN_ERR "%s: TX %s, resetting buffers\n",
-                        bp->dev->name);
+                        bp->dev->name, status & MACB_BIT(UND) ?
+                        "underrun" : "retry limit exceeded");
                /* Transfer ongoing, disable transmitter, to avoid confusion */
                if (status & MACB_BIT(TGO))
@@ -520,27 +521,10 @@ static int macb_poll(struct napi_struct *napi, int budget)
        macb_writel(bp, RSR, status);
        work_done = 0;
-        if (!status) {
-                /*
-                 * This may happen if an interrupt was pending before
-                 * this function was called last time, and no packets
-                 * have been received since.
-                 */
-                napi_complete(napi);
-                goto out;
-        }
        dev_dbg(&bp->pdev->dev, "poll: status = %08lx, budget = %d\n",
                (unsigned long)status, budget);
-        if (!(status & MACB_BIT(REC))) {
-                dev_warn(&bp->pdev->dev,
-                         "No RX buffers complete, status = %02lx\n",
-                         (unsigned long)status);
-                napi_complete(napi);
-                goto out;
-        }
        work_done = macb_rx(bp, budget);
        if (work_done < budget)
                napi_complete(napi);
@@ -549,7 +533,6 @@ static int macb_poll(struct napi_struct *napi, int budget)
         * We've done what we can to clean the buffers. Make sure we
         * get notified when new packets arrive.
         */
-out:
        macb_writel(bp, IER, MACB_RX_INT_FLAGS);
        /* TODO: Handle errors */
@@ -590,7 +573,8 @@ static irqreturn_t macb_interrupt(int irq, void *dev_id)
                        }
                }
-                if (status & (MACB_BIT(TCOMP) | MACB_BIT(ISR_TUND)))
+                if (status & (MACB_BIT(TCOMP) | MACB_BIT(ISR_TUND) |
+                            MACB_BIT(ISR_RLE)))
                        macb_tx(bp);
                /*
diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
index 70d3ef4a2c5f..214a8cf2b708 100644
--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
@@ -376,7 +376,8 @@ static u32 macvlan_ethtool_get_rx_csum(struct net_device *dev)
        const struct macvlan_dev *vlan = netdev_priv(dev);
        struct net_device *lowerdev = vlan->lowerdev;
-        if (lowerdev->ethtool_ops->get_rx_csum == NULL)
+        if (lowerdev->ethtool_ops == NULL ||
+            lowerdev->ethtool_ops->get_rx_csum == NULL)
                return 0;
        return lowerdev->ethtool_ops->get_rx_csum(lowerdev);
 }
@@ -387,7 +388,8 @@ static int macvlan_ethtool_get_settings(struct net_device *dev,
        const struct macvlan_dev *vlan = netdev_priv(dev);
        struct net_device *lowerdev = vlan->lowerdev;
-        if (!lowerdev->ethtool_ops->get_settings)
+        if (!lowerdev->ethtool_ops ||
+            !lowerdev->ethtool_ops->get_settings)
                return -EOPNOTSUPP;
        return lowerdev->ethtool_ops->get_settings(lowerdev, cmd);
@@ -398,7 +400,8 @@ static u32 macvlan_ethtool_get_flags(struct net_device *dev)
        const struct macvlan_dev *vlan = netdev_priv(dev);
        struct net_device *lowerdev = vlan->lowerdev;
-        if (!lowerdev->ethtool_ops->get_flags)
+        if (!lowerdev->ethtool_ops ||
+            !lowerdev->ethtool_ops->get_flags)
                return 0;
        return lowerdev->ethtool_ops->get_flags(lowerdev);
 }
diff --git a/drivers/net/meth.c b/drivers/net/meth.c
index aa08987f6e81..dbd3436912b8 100644
--- a/drivers/net/meth.c
+++ b/drivers/net/meth.c
@@ -127,11 +127,11 @@ static unsigned long mdio_read(struct meth_private *priv, unsigned long phyreg)
 static int mdio_probe(struct meth_private *priv)
 {
        int i;
-        unsigned long p2, p3;
+        unsigned long p2, p3, flags;
        /* check if phy is detected already */
        if(priv->phy_addr>=0&&priv->phy_addr<32)
                return 0;
-        spin_lock(&priv->meth_lock);
+        spin_lock_irqsave(&priv->meth_lock, flags);
        for (i=0;i<32;++i){
                priv->phy_addr=i;
                p2=mdio_read(priv,2);
@@ -157,7 +157,7 @@ static int mdio_probe(struct meth_private *priv)
                        break;
                }
        }
-        spin_unlock(&priv->meth_lock);
+        spin_unlock_irqrestore(&priv->meth_lock, flags);
        if(priv->phy_addr<32) {
                return 0;
        }
@@ -373,14 +373,14 @@ static int meth_release(struct net_device *dev)
 static void meth_rx(struct net_device* dev, unsigned long int_status)
 {
        struct sk_buff *skb;
-        unsigned long status;
+        unsigned long status, flags;
        struct meth_private *priv = netdev_priv(dev);
        unsigned long fifo_rptr = (int_status & METH_INT_RX_RPTR_MASK) >> 8;
-        spin_lock(&priv->meth_lock);
+        spin_lock_irqsave(&priv->meth_lock, flags);
        priv->dma_ctrl &= ~METH_DMA_RX_INT_EN;
        mace->eth.dma_ctrl = priv->dma_ctrl;
-        spin_unlock(&priv->meth_lock);
+        spin_unlock_irqrestore(&priv->meth_lock, flags);
        if (int_status & METH_INT_RX_UNDERFLOW) {
                fifo_rptr = (fifo_rptr - 1) & 0x0f;
@@ -452,12 +452,12 @@ static void meth_rx(struct net_device* dev, unsigned long int_status)
                mace->eth.rx_fifo = priv->rx_ring_dmas[priv->rx_write];
                ADVANCE_RX_PTR(priv->rx_write);
        }
-        spin_lock(&priv->meth_lock);
+        spin_lock_irqsave(&priv->meth_lock, flags);
        /* In case there was underflow, and Rx DMA was disabled */
        priv->dma_ctrl |= METH_DMA_RX_INT_EN | METH_DMA_RX_EN;
        mace->eth.dma_ctrl = priv->dma_ctrl;
        mace->eth.int_stat = METH_INT_RX_THRESHOLD;
-        spin_unlock(&priv->meth_lock);
+        spin_unlock_irqrestore(&priv->meth_lock, flags);
 }
 static int meth_tx_full(struct net_device *dev)
@@ -470,11 +470,11 @@ static int meth_tx_full(struct net_device *dev)
 static void meth_tx_cleanup(struct net_device* dev, unsigned long int_status)
 {
        struct meth_private *priv = netdev_priv(dev);
-        unsigned long status;
+        unsigned long status, flags;
        struct sk_buff *skb;
        unsigned long rptr = (int_status&TX_INFO_RPTR) >> 16;
-        spin_lock(&priv->meth_lock);
+        spin_lock_irqsave(&priv->meth_lock, flags);
        /* Stop DMA notification */
        priv->dma_ctrl &= ~(METH_DMA_TX_INT_EN);
@@ -527,12 +527,13 @@ static void meth_tx_cleanup(struct net_device* dev, unsigned long int_status)
        }
        mace->eth.int_stat = METH_INT_TX_EMPTY | METH_INT_TX_PKT;
-        spin_unlock(&priv->meth_lock);
+        spin_unlock_irqrestore(&priv->meth_lock, flags);
 }
 static void meth_error(struct net_device* dev, unsigned status)
 {
        struct meth_private *priv = netdev_priv(dev);
+        unsigned long flags;
        printk(KERN_WARNING "meth: error status: 0x%08x\n",status);
        /* check for errors too... */
@@ -547,7 +548,7 @@ static void meth_error(struct net_device* dev, unsigned status)
                printk(KERN_WARNING "meth: Rx overflow\n");
        if (status & (METH_INT_RX_UNDERFLOW)) {
                printk(KERN_WARNING "meth: Rx underflow\n");
-                spin_lock(&priv->meth_lock);
+                spin_lock_irqsave(&priv->meth_lock, flags);
                mace->eth.int_stat = METH_INT_RX_UNDERFLOW;
                /* more underflow interrupts will be delivered,
                 * effectively throwing us into an infinite loop.
@@ -555,7 +556,7 @@ static void meth_error(struct net_device* dev, unsigned status)
                priv->dma_ctrl &= ~METH_DMA_RX_EN;
                mace->eth.dma_ctrl = priv->dma_ctrl;
                DPRINTK("Disabled meth Rx DMA temporarily\n");
-                spin_unlock(&priv->meth_lock);
+                spin_unlock_irqrestore(&priv->meth_lock, flags);
        }
        mace->eth.int_stat = METH_INT_ERROR;
 }
diff --git a/drivers/net/mlx4/en_cq.c b/drivers/net/mlx4/en_cq.c
index 91f50de84be9..a276125b709b 100644
--- a/drivers/net/mlx4/en_cq.c
+++ b/drivers/net/mlx4/en_cq.c
@@ -125,8 +125,10 @@ void mlx4_en_deactivate_cq(struct mlx4_en_priv *priv, struct mlx4_en_cq *cq)
        if (cq->is_tx)
                del_timer(&cq->timer);
-        else
+        else {
                napi_disable(&cq->napi);
+                netif_napi_del(&cq->napi);
+        }
        mlx4_cq_free(mdev->dev, &cq->mcq);
 }
diff --git a/drivers/net/mlx4/en_main.c b/drivers/net/mlx4/en_main.c
index eda72dd2120f..510633fd57f6 100644
--- a/drivers/net/mlx4/en_main.c
+++ b/drivers/net/mlx4/en_main.c
@@ -181,7 +181,7 @@ static void *mlx4_en_add(struct mlx4_dev *dev)
        mdev->workqueue = create_singlethread_workqueue("mlx4_en");
        if (!mdev->workqueue) {
                err = -ENOMEM;
-                goto err_close_nic;
+                goto err_mr;
        }
        /* At this stage all non-port specific tasks are complete:
@@ -214,9 +214,8 @@ err_free_netdev:
        flush_workqueue(mdev->workqueue);
        /* Stop event queue before we drop down to release shared SW state */
-err_close_nic:
        destroy_workqueue(mdev->workqueue);
 err_mr:
        mlx4_mr_free(dev, &mdev->mr);
 err_uar:
diff --git a/drivers/net/mlx4/en_netdev.c b/drivers/net/mlx4/en_netdev.c
index 303c23de6cac..7bcc49de1637 100644
--- a/drivers/net/mlx4/en_netdev.c
+++ b/drivers/net/mlx4/en_netdev.c
@@ -348,11 +348,9 @@ static void mlx4_en_tx_timeout(struct net_device *dev)
        if (netif_msg_timer(priv))
                mlx4_warn(mdev, "Tx timeout called on port:%d\n", priv->port);
-        if (netif_carrier_ok(dev)) {
+        priv->port_stats.tx_timeout++;
-                priv->port_stats.tx_timeout++;
+        mlx4_dbg(DRV, priv, "Scheduling watchdog\n");
-                mlx4_dbg(DRV, priv, "Scheduling watchdog\n");
+        queue_work(mdev->workqueue, &priv->watchdog_task);
-                queue_work(mdev->workqueue, &priv->watchdog_task);
-        }
 }
@@ -585,7 +583,7 @@ int mlx4_en_start_port(struct net_device *dev)
                err = mlx4_en_activate_cq(priv, cq);
                if (err) {
                        mlx4_err(mdev, "Failed activating Rx CQ\n");
-                        goto rx_err;
+                        goto cq_err;
                }
                for (j = 0; j < cq->size; j++)
                        cq->buf[j].owner_sr_opcode = MLX4_CQE_OWNER_MASK;
@@ -761,9 +759,14 @@ static void mlx4_en_restart(struct work_struct *work)
        struct net_device *dev = priv->dev;
        mlx4_dbg(DRV, priv, "Watchdog task called for port %d\n", priv->port);
-        mlx4_en_stop_port(dev);
-        if (mlx4_en_start_port(dev))
+        mutex_lock(&mdev->state_lock);
-            mlx4_err(mdev, "Failed restarting port %d\n", priv->port);
+        if (priv->port_up) {
+                mlx4_en_stop_port(dev);
+                if (mlx4_en_start_port(dev))
+                        mlx4_err(mdev, "Failed restarting port %d\n", priv->port);
+        }
+        mutex_unlock(&mdev->state_lock);
 }
@@ -1054,7 +1057,7 @@ int mlx4_en_init_netdev(struct mlx4_en_dev *mdev, int port,
         * Set driver features
         */
        dev->features |= NETIF_F_SG;
-        dev->features |= NETIF_F_HW_CSUM;
+        dev->features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM;
        dev->features |= NETIF_F_HIGHDMA;
        dev->features |= NETIF_F_HW_VLAN_TX |
                         NETIF_F_HW_VLAN_RX |
diff --git a/drivers/net/mlx4/en_port.c b/drivers/net/mlx4/en_port.c
index c5a4c0389752..a29abe845d2e 100644
--- a/drivers/net/mlx4/en_port.c
+++ b/drivers/net/mlx4/en_port.c
@@ -151,6 +151,7 @@ int mlx4_en_DUMP_ETH_STATS(struct mlx4_en_dev *mdev, u8 port, u8 reset)
        struct mlx4_cmd_mailbox *mailbox;
        u64 in_mod = reset << 8 | port;
        int err;
+        int i;
        mailbox = mlx4_alloc_cmd_mailbox(mdev->dev);
        if (IS_ERR(mailbox))
@@ -165,38 +166,18 @@ int mlx4_en_DUMP_ETH_STATS(struct mlx4_en_dev *mdev, u8 port, u8 reset)
        spin_lock_bh(&priv->stats_lock);
-        stats->rx_packets = be32_to_cpu(mlx4_en_stats->RTOTFRMS) -
+        stats->rx_packets = 0;
-                            be32_to_cpu(mlx4_en_stats->RDROP);
+        stats->rx_bytes = 0;
-        stats->tx_packets = be64_to_cpu(mlx4_en_stats->TTOT_prio_0) +
+        for (i = 0; i < priv->rx_ring_num; i++) {
-                            be64_to_cpu(mlx4_en_stats->TTOT_prio_1) +
+                stats->rx_packets += priv->rx_ring[i].packets;
-                            be64_to_cpu(mlx4_en_stats->TTOT_prio_2) +
+                stats->rx_bytes += priv->rx_ring[i].bytes;
-                            be64_to_cpu(mlx4_en_stats->TTOT_prio_3) +
+        }
-                            be64_to_cpu(mlx4_en_stats->TTOT_prio_4) +
+        stats->tx_packets = 0;
-                            be64_to_cpu(mlx4_en_stats->TTOT_prio_5) +
+        stats->tx_bytes = 0;
-                            be64_to_cpu(mlx4_en_stats->TTOT_prio_6) +
+        for (i = 0; i <= priv->tx_ring_num; i++) {
-                            be64_to_cpu(mlx4_en_stats->TTOT_prio_7) +
+                stats->tx_packets += priv->tx_ring[i].packets;
-                            be64_to_cpu(mlx4_en_stats->TTOT_novlan) +
+                stats->tx_bytes += priv->tx_ring[i].bytes;
-                            be64_to_cpu(mlx4_en_stats->TTOT_loopbk);
+        }
-        stats->rx_bytes = be64_to_cpu(mlx4_en_stats->ROCT_prio_0) +
-                          be64_to_cpu(mlx4_en_stats->ROCT_prio_1) +
-                          be64_to_cpu(mlx4_en_stats->ROCT_prio_2) +
-                          be64_to_cpu(mlx4_en_stats->ROCT_prio_3) +
-                          be64_to_cpu(mlx4_en_stats->ROCT_prio_4) +
-                          be64_to_cpu(mlx4_en_stats->ROCT_prio_5) +
-                          be64_to_cpu(mlx4_en_stats->ROCT_prio_6) +
-                          be64_to_cpu(mlx4_en_stats->ROCT_prio_7) +
-                          be64_to_cpu(mlx4_en_stats->ROCT_novlan);
-        stats->tx_bytes = be64_to_cpu(mlx4_en_stats->TTTLOCT_prio_0) +
-                          be64_to_cpu(mlx4_en_stats->TTTLOCT_prio_1) +
-                          be64_to_cpu(mlx4_en_stats->TTTLOCT_prio_2) +
-                          be64_to_cpu(mlx4_en_stats->TTTLOCT_prio_3) +
-                          be64_to_cpu(mlx4_en_stats->TTTLOCT_prio_4) +
-                          be64_to_cpu(mlx4_en_stats->TTTLOCT_prio_5) +
-                          be64_to_cpu(mlx4_en_stats->TTTLOCT_prio_6) +
-                          be64_to_cpu(mlx4_en_stats->TTTLOCT_prio_7) +
-                          be64_to_cpu(mlx4_en_stats->TTTLOCT_novlan) +
-                          be64_to_cpu(mlx4_en_stats->TTTLOCT_loopbk);
        stats->rx_errors = be64_to_cpu(mlx4_en_stats->PCS) +
                           be32_to_cpu(mlx4_en_stats->RdropLength) +
diff --git a/drivers/net/mlx4/en_resources.c b/drivers/net/mlx4/en_resources.c
index a0545209e507..65ca706c04bb 100644
--- a/drivers/net/mlx4/en_resources.c
+++ b/drivers/net/mlx4/en_resources.c
@@ -94,3 +94,9 @@ void mlx4_en_unmap_buffer(struct mlx4_buf *buf)
        vunmap(buf->direct.buf);
 }
+void mlx4_en_sqp_event(struct mlx4_qp *qp, enum mlx4_event event)
+{
+    return;
+}
diff --git a/drivers/net/mlx4/en_rx.c b/drivers/net/mlx4/en_rx.c
index 7e40741fb7d8..9ee873e872b3 100644
--- a/drivers/net/mlx4/en_rx.c
+++ b/drivers/net/mlx4/en_rx.c
@@ -436,8 +436,9 @@ int mlx4_en_activate_rx_rings(struct mlx4_en_priv *priv)
                /* Initialize page allocators */
                err = mlx4_en_init_allocator(priv, ring);
                if (err) {
-                         mlx4_err(mdev, "Failed initializing ring allocator\n");
+                        mlx4_err(mdev, "Failed initializing ring allocator\n");
-                         goto err_allocator;
+                        ring_ind--;
+                        goto err_allocator;
                }
                /* Fill Rx buffers */
@@ -467,6 +468,7 @@ int mlx4_en_activate_rx_rings(struct mlx4_en_priv *priv)
                                     ring->wqres.db.dma, &ring->srq);
                if (err){
                        mlx4_err(mdev, "Failed to allocate srq\n");
+                        ring_ind--;
                        goto err_srq;
                }
                ring->srq.event = mlx4_en_srq_event;
@@ -608,6 +610,10 @@ static struct sk_buff *mlx4_en_rx_skb(struct mlx4_en_priv *priv,
                used_frags = mlx4_en_complete_rx_desc(priv, rx_desc, skb_frags,
                                                      skb_shinfo(skb)->frags,
                                                      page_alloc, length);
+                if (unlikely(!used_frags)) {
+                        kfree_skb(skb);
+                        return NULL;
+                }
                skb_shinfo(skb)->nr_frags = used_frags;
                /* Copy headers into the skb linear buffer */
@@ -926,12 +932,6 @@ void mlx4_en_set_default_rss_map(struct mlx4_en_priv *priv,
        }
 }
-static void mlx4_en_sqp_event(struct mlx4_qp *qp, enum mlx4_event event)
-{
-    return;
-}
 static int mlx4_en_config_rss_qp(struct mlx4_en_priv *priv,
                                 int qpn, int srqn, int cqn,
                                 enum mlx4_qp_state *state,
@@ -951,7 +951,6 @@ static int mlx4_en_config_rss_qp(struct mlx4_en_priv *priv,
        if (err) {
                mlx4_err(mdev, "Failed to allocate qp #%d\n", qpn);
                goto out;
-                return err;
        }
        qp->event = mlx4_en_sqp_event;
diff --git a/drivers/net/mlx4/en_tx.c b/drivers/net/mlx4/en_tx.c
index 4afd5993e31c..e5c98a98ad37 100644
--- a/drivers/net/mlx4/en_tx.c
+++ b/drivers/net/mlx4/en_tx.c
@@ -112,6 +112,7 @@ int mlx4_en_create_tx_ring(struct mlx4_en_priv *priv,
                mlx4_err(mdev, "Failed allocating qp %d\n", ring->qpn);
                goto err_reserve;
        }
+        ring->qp.event = mlx4_en_sqp_event;
        return 0;
@@ -425,7 +426,7 @@ void mlx4_en_poll_tx_cq(unsigned long data)
        INC_PERF_COUNTER(priv->pstats.tx_poll);
-        if (!spin_trylock(&ring->comp_lock)) {
+        if (!spin_trylock_irq(&ring->comp_lock)) {
                mod_timer(&cq->timer, jiffies + MLX4_EN_TX_POLL_TIMEOUT);
                return;
        }
@@ -438,7 +439,7 @@ void mlx4_en_poll_tx_cq(unsigned long data)
        if (inflight && priv->port_up)
                mod_timer(&cq->timer, jiffies + MLX4_EN_TX_POLL_TIMEOUT);
-        spin_unlock(&ring->comp_lock);
+        spin_unlock_irq(&ring->comp_lock);
 }
 static struct mlx4_en_tx_desc *mlx4_en_bounce_to_desc(struct mlx4_en_priv *priv,
@@ -481,9 +482,9 @@ static inline void mlx4_en_xmit_poll(struct mlx4_en_priv *priv, int tx_ind)
        /* Poll the CQ every mlx4_en_TX_MODER_POLL packets */
        if ((++ring->poll_cnt & (MLX4_EN_TX_POLL_MODER - 1)) == 0)
-                if (spin_trylock(&ring->comp_lock)) {
+                if (spin_trylock_irq(&ring->comp_lock)) {
                        mlx4_en_process_tx_cq(priv->dev, cq);
-                        spin_unlock(&ring->comp_lock);
+                        spin_unlock_irq(&ring->comp_lock);
                }
 }
diff --git a/drivers/net/mlx4/main.c b/drivers/net/mlx4/main.c
index 102bac90a302..30bea9689694 100644
--- a/drivers/net/mlx4/main.c
+++ b/drivers/net/mlx4/main.c
@@ -976,7 +976,7 @@ static void mlx4_enable_msi_x(struct mlx4_dev *dev)
                                nreq = err;
                                goto retry;
                        }
+                        kfree(entries);
                        goto no_msi;
                }
diff --git a/drivers/net/mlx4/mlx4_en.h b/drivers/net/mlx4/mlx4_en.h
index e9af32d41ca4..ef840abbcd39 100644
--- a/drivers/net/mlx4/mlx4_en.h
+++ b/drivers/net/mlx4/mlx4_en.h
@@ -538,6 +538,7 @@ int mlx4_en_poll_rx_cq(struct napi_struct *napi, int budget);
 void mlx4_en_fill_qp_context(struct mlx4_en_priv *priv, int size, int stride,
                             int is_tx, int rss, int qpn, int cqn, int srqn,
                             struct mlx4_qp_context *context);
+void mlx4_en_sqp_event(struct mlx4_qp *qp, enum mlx4_event event);
 int mlx4_en_map_buffer(struct mlx4_buf *buf);
 void mlx4_en_unmap_buffer(struct mlx4_buf *buf);
diff --git a/drivers/net/mv643xx_eth.c b/drivers/net/mv643xx_eth.c
index b3185bf2c158..6bb5af35eda6 100644
--- a/drivers/net/mv643xx_eth.c
+++ b/drivers/net/mv643xx_eth.c
@@ -393,12 +393,12 @@ struct mv643xx_eth_private {
        struct work_struct tx_timeout_task;
        struct napi_struct napi;
+        u8 oom;
        u8 work_link;
        u8 work_tx;
        u8 work_tx_end;
        u8 work_rx;
        u8 work_rx_refill;
-        u8 work_rx_oom;
        int skb_size;
        struct sk_buff_head rx_recycle;
@@ -569,7 +569,7 @@ static int rxq_process(struct rx_queue *rxq, int budget)
                if (rxq->rx_curr_desc == rxq->rx_ring_size)
                        rxq->rx_curr_desc = 0;
-                dma_unmap_single(NULL, rx_desc->buf_ptr,
+                dma_unmap_single(mp->dev->dev.parent, rx_desc->buf_ptr,
                                 rx_desc->buf_size, DMA_FROM_DEVICE);
                rxq->rx_desc_count--;
                rx++;
@@ -661,7 +661,7 @@ static int rxq_refill(struct rx_queue *rxq, int budget)
                                            dma_get_cache_alignment() - 1);
                if (skb == NULL) {
-                        mp->work_rx_oom |= 1 << rxq->index;
+                        mp->oom = 1;
                        goto oom;
                }
@@ -678,8 +678,9 @@ static int rxq_refill(struct rx_queue *rxq, int budget)
                rx_desc = rxq->rx_desc_area + rx;
-                rx_desc->buf_ptr = dma_map_single(NULL, skb->data,
+                rx_desc->buf_ptr = dma_map_single(mp->dev->dev.parent,
-                                        mp->skb_size, DMA_FROM_DEVICE);
+                                                  skb->data, mp->skb_size,
+                                                  DMA_FROM_DEVICE);
                rx_desc->buf_size = mp->skb_size;
                rxq->rx_skb[rx] = skb;
                wmb();
@@ -718,6 +719,7 @@ static inline unsigned int has_tiny_unaligned_frags(struct sk_buff *skb)
 static void txq_submit_frag_skb(struct tx_queue *txq, struct sk_buff *skb)
 {
+        struct mv643xx_eth_private *mp = txq_to_mp(txq);
        int nr_frags = skb_shinfo(skb)->nr_frags;
        int frag;
@@ -746,10 +748,10 @@ static void txq_submit_frag_skb(struct tx_queue *txq, struct sk_buff *skb)
                desc->l4i_chk = 0;
                desc->byte_cnt = this_frag->size;
-                desc->buf_ptr = dma_map_page(NULL, this_frag->page,
+                desc->buf_ptr = dma_map_page(mp->dev->dev.parent,
-                                                this_frag->page_offset,
+                                             this_frag->page,
-                                                this_frag->size,
+                                             this_frag->page_offset,
-                                                DMA_TO_DEVICE);
+                                             this_frag->size, DMA_TO_DEVICE);
        }
 }
@@ -826,7 +828,8 @@ no_csum:
        desc->l4i_chk = l4i_chk;
        desc->byte_cnt = length;
-        desc->buf_ptr = dma_map_single(NULL, skb->data, length, DMA_TO_DEVICE);
+        desc->buf_ptr = dma_map_single(mp->dev->dev.parent, skb->data,
+                                       length, DMA_TO_DEVICE);
        __skb_queue_tail(&txq->tx_skb, skb);
@@ -956,10 +959,10 @@ static int txq_reclaim(struct tx_queue *txq, int budget, int force)
                }
                if (cmd_sts & TX_FIRST_DESC) {
-                        dma_unmap_single(NULL, desc->buf_ptr,
+                        dma_unmap_single(mp->dev->dev.parent, desc->buf_ptr,
                                         desc->byte_cnt, DMA_TO_DEVICE);
                } else {
-                        dma_unmap_page(NULL, desc->buf_ptr,
+                        dma_unmap_page(mp->dev->dev.parent, desc->buf_ptr,
                                       desc->byte_cnt, DMA_TO_DEVICE);
                }
@@ -1255,7 +1258,6 @@ static void mib_counters_update(struct mv643xx_eth_private *mp)
        spin_lock_bh(&mp->mib_counters_lock);
        p->good_octets_received += mib_read(mp, 0x00);
-        p->good_octets_received += (u64)mib_read(mp, 0x04) << 32;
        p->bad_octets_received += mib_read(mp, 0x08);
        p->internal_mac_transmit_err += mib_read(mp, 0x0c);
        p->good_frames_received += mib_read(mp, 0x10);
@@ -1269,7 +1271,6 @@ static void mib_counters_update(struct mv643xx_eth_private *mp)
        p->frames_512_to_1023_octets += mib_read(mp, 0x30);
        p->frames_1024_to_max_octets += mib_read(mp, 0x34);
        p->good_octets_sent += mib_read(mp, 0x38);
-        p->good_octets_sent += (u64)mib_read(mp, 0x3c) << 32;
        p->good_frames_sent += mib_read(mp, 0x40);
        p->excessive_collision += mib_read(mp, 0x44);
        p->multicast_frames_sent += mib_read(mp, 0x48);
@@ -1896,9 +1897,9 @@ static int rxq_init(struct mv643xx_eth_private *mp, int index)
                                                mp->rx_desc_sram_size);
                rxq->rx_desc_dma = mp->rx_desc_sram_addr;
        } else {
-                rxq->rx_desc_area = dma_alloc_coherent(NULL, size,
+                rxq->rx_desc_area = dma_alloc_coherent(mp->dev->dev.parent,
-                                                        &rxq->rx_desc_dma,
+                                                       size, &rxq->rx_desc_dma,
-                                                        GFP_KERNEL);
+                                                       GFP_KERNEL);
        }
        if (rxq->rx_desc_area == NULL) {
@@ -1949,7 +1950,7 @@ out_free:
        if (index == 0 && size <= mp->rx_desc_sram_size)
                iounmap(rxq->rx_desc_area);
        else
-                dma_free_coherent(NULL, size,
+                dma_free_coherent(mp->dev->dev.parent, size,
                                  rxq->rx_desc_area,
                                  rxq->rx_desc_dma);
@@ -1981,7 +1982,7 @@ static void rxq_deinit(struct rx_queue *rxq)
            rxq->rx_desc_area_size <= mp->rx_desc_sram_size)
                iounmap(rxq->rx_desc_area);
        else
-                dma_free_coherent(NULL, rxq->rx_desc_area_size,
+                dma_free_coherent(mp->dev->dev.parent, rxq->rx_desc_area_size,
                                  rxq->rx_desc_area, rxq->rx_desc_dma);
        kfree(rxq->rx_skb);
@@ -2009,9 +2010,9 @@ static int txq_init(struct mv643xx_eth_private *mp, int index)
                                                mp->tx_desc_sram_size);
                txq->tx_desc_dma = mp->tx_desc_sram_addr;
        } else {
-                txq->tx_desc_area = dma_alloc_coherent(NULL, size,
+                txq->tx_desc_area = dma_alloc_coherent(mp->dev->dev.parent,
-                                                        &txq->tx_desc_dma,
+                                                       size, &txq->tx_desc_dma,
-                                                        GFP_KERNEL);
+                                                       GFP_KERNEL);
        }
        if (txq->tx_desc_area == NULL) {
@@ -2055,7 +2056,7 @@ static void txq_deinit(struct tx_queue *txq)
            txq->tx_desc_area_size <= mp->tx_desc_sram_size)
                iounmap(txq->tx_desc_area);
        else
-                dma_free_coherent(NULL, txq->tx_desc_area_size,
+                dma_free_coherent(mp->dev->dev.parent, txq->tx_desc_area_size,
                                  txq->tx_desc_area, txq->tx_desc_dma);
 }
@@ -2167,8 +2168,10 @@ static int mv643xx_eth_poll(struct napi_struct *napi, int budget)
        mp = container_of(napi, struct mv643xx_eth_private, napi);
-        mp->work_rx_refill |= mp->work_rx_oom;
+        if (unlikely(mp->oom)) {
-        mp->work_rx_oom = 0;
+                mp->oom = 0;
+                del_timer(&mp->rx_oom);
+        }
        work_done = 0;
        while (work_done < budget) {
@@ -2182,8 +2185,10 @@ static int mv643xx_eth_poll(struct napi_struct *napi, int budget)
                        continue;
                }
-                queue_mask = mp->work_tx | mp->work_tx_end |
+                queue_mask = mp->work_tx | mp->work_tx_end | mp->work_rx;
-                                mp->work_rx | mp->work_rx_refill;
+                if (likely(!mp->oom))
+                        queue_mask |= mp->work_rx_refill;
                if (!queue_mask) {
                        if (mv643xx_eth_collect_events(mp))
                                continue;
@@ -2204,7 +2209,7 @@ static int mv643xx_eth_poll(struct napi_struct *napi, int budget)
                        txq_maybe_wake(mp->txq + queue);
                } else if (mp->work_rx & queue_mask) {
                        work_done += rxq_process(mp->rxq + queue, work_tbd);
-                } else if (mp->work_rx_refill & queue_mask) {
+                } else if (!mp->oom && (mp->work_rx_refill & queue_mask)) {
                        work_done += rxq_refill(mp->rxq + queue, work_tbd);
                } else {
                        BUG();
@@ -2212,7 +2217,7 @@ static int mv643xx_eth_poll(struct napi_struct *napi, int budget)
        }
        if (work_done < budget) {
-                if (mp->work_rx_oom)
+                if (mp->oom)
                        mod_timer(&mp->rx_oom, jiffies + (HZ / 10));
                napi_complete(napi);
                wrlp(mp, INT_MASK, INT_TX_END | INT_RX | INT_EXT);
@@ -2372,7 +2377,7 @@ static int mv643xx_eth_open(struct net_device *dev)
                rxq_refill(mp->rxq + i, INT_MAX);
        }
-        if (mp->work_rx_oom) {
+        if (mp->oom) {
                mp->rx_oom.expires = jiffies + (HZ / 10);
                add_timer(&mp->rx_oom);
        }
diff --git a/drivers/net/ne2k-pci.c b/drivers/net/ne2k-pci.c
index eb66f658f9d1..7d83896b8c26 100644
--- a/drivers/net/ne2k-pci.c
+++ b/drivers/net/ne2k-pci.c
@@ -374,18 +374,17 @@ static int __devinit ne2k_pci_init_one (struct pci_dev *pdev,
        dev->ethtool_ops = &ne2k_pci_ethtool_ops;
        NS8390_init(dev, 0);
+        memcpy(dev->dev_addr, SA_prom, 6);
+        memcpy(dev->perm_addr, dev->dev_addr, dev->addr_len);
        i = register_netdev(dev);
        if (i)
                goto err_out_free_netdev;
-        for(i = 0; i < 6; i++)
-                dev->dev_addr[i] = SA_prom[i];
        printk("%s: %s found at %#lx, IRQ %d, %pM.\n",
               dev->name, pci_clone_list[chip_idx].name, ioaddr, dev->irq,
               dev->dev_addr);
-        memcpy(dev->perm_addr, dev->dev_addr, dev->addr_len);
        return 0;
 err_out_free_netdev:
diff --git a/drivers/net/netconsole.c b/drivers/net/netconsole.c
index eceadf787a67..bf4af5248cb7 100644
--- a/drivers/net/netconsole.c
+++ b/drivers/net/netconsole.c
@@ -664,7 +664,7 @@ static int netconsole_netdev_event(struct notifier_block *this,
        struct netconsole_target *nt;
        struct net_device *dev = ptr;
-        if (!(event == NETDEV_CHANGENAME))
+        if (!(event == NETDEV_CHANGENAME || event == NETDEV_UNREGISTER))
                goto done;
        spin_lock_irqsave(&target_list_lock, flags);
@@ -675,6 +675,15 @@ static int netconsole_netdev_event(struct notifier_block *this,
                        case NETDEV_CHANGENAME:
                                strlcpy(nt->np.dev_name, dev->name, IFNAMSIZ);
                                break;
+                        case NETDEV_UNREGISTER:
+                                if (!nt->enabled)
+                                        break;
+                                netpoll_cleanup(&nt->np);
+                                nt->enabled = 0;
+                                printk(KERN_INFO "netconsole: network logging stopped"
+                                        ", interface %s unregistered\n",
+                                        dev->name);
+                                break;
                        }
                }
                netconsole_target_put(nt);
diff --git a/drivers/net/pcmcia/pcnet_cs.c b/drivers/net/pcmcia/pcnet_cs.c
index 2fbf9f9ddd37..652a36888361 100644
--- a/drivers/net/pcmcia/pcnet_cs.c
+++ b/drivers/net/pcmcia/pcnet_cs.c
@@ -1758,7 +1758,7 @@ static struct pcmcia_device_id pcnet_ids[] = {
        PCMCIA_MFC_DEVICE_CIS_PROD_ID12(0, "DAYNA COMMUNICATIONS", "LAN AND MODEM MULTIFUNCTION", 0x8fdf8f89, 0xdd5ed9e8, "DP83903.cis"),
        PCMCIA_MFC_DEVICE_CIS_PROD_ID4(0, "NSC MF LAN/Modem", 0x58fc6056, "DP83903.cis"),
        PCMCIA_MFC_DEVICE_CIS_MANF_CARD(0, 0x0175, 0x0000, "DP83903.cis"),
-        PCMCIA_DEVICE_CIS_MANF_CARD(0xc00f, 0x0002, "LA-PCM.cis"),
+        PCMCIA_DEVICE_CIS_MANF_CARD(0xc00f, 0x0002, "cis/LA-PCM.cis"),
        PCMCIA_DEVICE_CIS_PROD_ID12("KTI", "PE520 PLUS", 0xad180345, 0x9d58d392, "PE520.cis"),
        PCMCIA_DEVICE_CIS_PROD_ID12("NDC", "Ethernet", 0x01c43ae1, 0x00b2e941, "NE2K.cis"),
        PCMCIA_DEVICE_CIS_PROD_ID12("PMX   ", "PE-200", 0x34f3f1c8, 0x10b59f8c, "PE-200.cis"),
diff --git a/drivers/net/ps3_gelic_wireless.c b/drivers/net/ps3_gelic_wireless.c
index a5ac2bd58b5b..4f3ada622f9b 100644
--- a/drivers/net/ps3_gelic_wireless.c
+++ b/drivers/net/ps3_gelic_wireless.c
@@ -2101,6 +2101,9 @@ static int gelic_wl_associate_bss(struct gelic_wl_info *wl,
        if (ret) {
                pr_debug("%s: WEP/WPA setup failed %d\n", __func__,
                         ret);
+                ret = -EPERM;
+                gelic_wl_send_iwap_event(wl, NULL);
+                goto out;
        }
        /* start association */
diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
index 0b6e8c896835..3b19e0ce290f 100644
--- a/drivers/net/r8169.c
+++ b/drivers/net/r8169.c
@@ -66,7 +66,6 @@ static const int multicast_filter_limit = 32;
 #define RX_DMA_BURST    6       /* Maximum PCI burst, '6' is 1024 */
 #define TX_DMA_BURST    6       /* Maximum PCI burst, '6' is 1024 */
 #define EarlyTxThld     0x3F    /* 0x3F means NO early transmit */
-#define RxPacketMaxSize 0x3FE8  /* 16K - 1 - ETH_HLEN - VLAN - CRC... */
 #define SafeMtu         0x1c20  /* ... actually life sucks beyond ~7k */
 #define InterFrameGap   0x03    /* 3 means InterFrameGap = the shortest one */
@@ -2357,10 +2356,10 @@ static u16 rtl_rw_cpluscmd(void __iomem *ioaddr)
        return cmd;
 }
-static void rtl_set_rx_max_size(void __iomem *ioaddr)
+static void rtl_set_rx_max_size(void __iomem *ioaddr, unsigned int rx_buf_sz)
 {
        /* Low hurts. Let's disable the filtering. */
-        RTL_W16(RxMaxSize, 16383);
+        RTL_W16(RxMaxSize, rx_buf_sz);
 }
 static void rtl8169_set_magic_reg(void __iomem *ioaddr, unsigned mac_version)
@@ -2407,7 +2406,7 @@ static void rtl_hw_start_8169(struct net_device *dev)
        RTL_W8(EarlyTxThres, EarlyTxThld);
-        rtl_set_rx_max_size(ioaddr);
+        rtl_set_rx_max_size(ioaddr, tp->rx_buf_sz);
        if ((tp->mac_version == RTL_GIGA_MAC_VER_01) ||
            (tp->mac_version == RTL_GIGA_MAC_VER_02) ||
@@ -2668,7 +2667,7 @@ static void rtl_hw_start_8168(struct net_device *dev)
        RTL_W8(EarlyTxThres, EarlyTxThld);
-        rtl_set_rx_max_size(ioaddr);
+        rtl_set_rx_max_size(ioaddr, tp->rx_buf_sz);
        tp->cp_cmd |= RTL_R16(CPlusCmd) | PktCntrDisable | INTT_1;
@@ -2846,7 +2845,7 @@ static void rtl_hw_start_8101(struct net_device *dev)
        RTL_W8(EarlyTxThres, EarlyTxThld);
-        rtl_set_rx_max_size(ioaddr);
+        rtl_set_rx_max_size(ioaddr, tp->rx_buf_sz);
        tp->cp_cmd |= rtl_rw_cpluscmd(ioaddr) | PCIMulRW;
@@ -3554,54 +3553,64 @@ static irqreturn_t rtl8169_interrupt(int irq, void *dev_instance)
        int handled = 0;
        int status;
+        /* loop handling interrupts until we have no new ones or
+         * we hit a invalid/hotplug case.
+         */
        status = RTL_R16(IntrStatus);
+        while (status && status != 0xffff) {
+                handled = 1;
-        /* hotplug/major error/no more work/shared irq */
+                /* Handle all of the error cases first. These will reset
-        if ((status == 0xffff) || !status)
+                 * the chip, so just exit the loop.
-                goto out;
+                 */
+                if (unlikely(!netif_running(dev))) {
-        handled = 1;
+                        rtl8169_asic_down(ioaddr);
+                        break;
+                }
-        if (unlikely(!netif_running(dev))) {
+                /* Work around for rx fifo overflow */
-                rtl8169_asic_down(ioaddr);
+                if (unlikely(status & RxFIFOOver) &&
-                goto out;
+                (tp->mac_version == RTL_GIGA_MAC_VER_11)) {
-        }
+                        netif_stop_queue(dev);
+                        rtl8169_tx_timeout(dev);
+                        break;
+                }
-        status &= tp->intr_mask;
+                if (unlikely(status & SYSErr)) {
-        RTL_W16(IntrStatus,
+                        rtl8169_pcierr_interrupt(dev);
-                (status & RxFIFOOver) ? (status | RxOverflow) : status);
+                        break;
+                }
-        if (!(status & tp->intr_event))
+                if (status & LinkChg)
-                goto out;
+                        rtl8169_check_link_status(dev, tp, ioaddr);
-        /* Work around for rx fifo overflow */
+                /* We need to see the lastest version of tp->intr_mask to
-        if (unlikely(status & RxFIFOOver) &&
+                 * avoid ignoring an MSI interrupt and having to wait for
-            (tp->mac_version == RTL_GIGA_MAC_VER_11)) {
+                 * another event which may never come.
-                netif_stop_queue(dev);
+                 */
-                rtl8169_tx_timeout(dev);
+                smp_rmb();
-                goto out;
+                if (status & tp->intr_mask & tp->napi_event) {
-        }
+                        RTL_W16(IntrMask, tp->intr_event & ~tp->napi_event);
+                        tp->intr_mask = ~tp->napi_event;
+                        if (likely(napi_schedule_prep(&tp->napi)))
+                                __napi_schedule(&tp->napi);
+                        else if (netif_msg_intr(tp)) {
+                                printk(KERN_INFO "%s: interrupt %04x in poll\n",
+                                dev->name, status);
+                        }
+                }
-        if (unlikely(status & SYSErr)) {
+                /* We only get a new MSI interrupt when all active irq
-                rtl8169_pcierr_interrupt(dev);
+                 * sources on the chip have been acknowledged. So, ack
-                goto out;
+                 * everything we've seen and check if new sources have become
+                 * active to avoid blocking all interrupts from the chip.
+                 */
+                RTL_W16(IntrStatus,
+                        (status & RxFIFOOver) ? (status | RxOverflow) : status);
+                status = RTL_R16(IntrStatus);
        }
-        if (status & LinkChg)
-                rtl8169_check_link_status(dev, tp, ioaddr);
-        if (status & tp->napi_event) {
-                RTL_W16(IntrMask, tp->intr_event & ~tp->napi_event);
-                tp->intr_mask = ~tp->napi_event;
-                if (likely(napi_schedule_prep(&tp->napi)))
-                        __napi_schedule(&tp->napi);
-                else if (netif_msg_intr(tp)) {
-                        printk(KERN_INFO "%s: interrupt %04x in poll\n",
-                               dev->name, status);
-                }
-        }
-out:
        return IRQ_RETVAL(handled);
 }
@@ -3617,13 +3626,15 @@ static int rtl8169_poll(struct napi_struct *napi, int budget)
        if (work_done < budget) {
                napi_complete(napi);
-                tp->intr_mask = 0xffff;
-                /*
+                /* We need for force the visibility of tp->intr_mask
-                 * 20040426: the barrier is not strictly required but the
+                 * for other CPUs, as we can loose an MSI interrupt
-                 * behavior of the irq handler could be less predictable
+                 * and potentially wait for a retransmit timeout if we don't.
-                 * without it. Btw, the lack of flush for the posted pci
+                 * The posted write to IntrMask is safe, as it will
-                 * write is safe - FR
+                 * eventually make it to the chip and we won't loose anything
+                 * until it does.
                 */
+                tp->intr_mask = 0xffff;
                smp_wmb();
                RTL_W16(IntrMask, tp->intr_event);
        }
diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
index 7a837c465960..201be425643a 100644
--- a/drivers/net/tg3.c
+++ b/drivers/net/tg3.c
@@ -2190,7 +2190,14 @@ static int tg3_nvram_read_using_eeprom(struct tg3 *tp,
        if (!(tmp & EEPROM_ADDR_COMPLETE))
                return -EBUSY;
-        *val = tr32(GRC_EEPROM_DATA);
+        tmp = tr32(GRC_EEPROM_DATA);
+        /*
+         * The data will always be opposite the native endian
+         * format.  Perform a blind byteswap to compensate.
+         */
+        *val = swab32(tmp);
        return 0;
 }
@@ -10663,7 +10670,13 @@ static int tg3_nvram_write_block_using_eeprom(struct tg3 *tp,
                memcpy(&data, buf + i, 4);
-                tw32(GRC_EEPROM_DATA, be32_to_cpu(data));
+                /*
+                 * The SEEPROM interface expects the data to always be opposite
+                 * the native endian format.  We accomplish this by reversing
+                 * all the operations that would have been performed on the
+                 * data from a call to tg3_nvram_read_be32().
+                 */
+                tw32(GRC_EEPROM_DATA, swab32(be32_to_cpu(data)));
                val = tr32(GRC_EEPROM_ADDR);
                tw32(GRC_EEPROM_ADDR, val | EEPROM_ADDR_COMPLETE);
@@ -12443,13 +12456,8 @@ static int __devinit tg3_get_device_address(struct tg3 *tp)
                /* Next, try NVRAM. */
                if (!tg3_nvram_read_be32(tp, mac_offset + 0, &hi) &&
                    !tg3_nvram_read_be32(tp, mac_offset + 4, &lo)) {
-                        dev->dev_addr[0] = ((hi >> 16) & 0xff);
+                        memcpy(&dev->dev_addr[0], ((char *)&hi) + 2, 2);
-                        dev->dev_addr[1] = ((hi >> 24) & 0xff);
+                        memcpy(&dev->dev_addr[2], (char *)&lo, sizeof(lo));
-                        dev->dev_addr[2] = ((lo >>  0) & 0xff);
-                        dev->dev_addr[3] = ((lo >>  8) & 0xff);
-                        dev->dev_addr[4] = ((lo >> 16) & 0xff);
-                        dev->dev_addr[5] = ((lo >> 24) & 0xff);
                }
                /* Finally just fetch it out of the MAC control regs. */
                else {
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 16716aef184c..735bf41c654a 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -93,7 +93,6 @@ struct tun_file {
        atomic_t count;
        struct tun_struct *tun;
        struct net *net;
-        wait_queue_head_t       read_wait;
 };
 struct tun_sock;
@@ -156,6 +155,7 @@ static int tun_attach(struct tun_struct *tun, struct file *file)
        tfile->tun = tun;
        tun->tfile = tfile;
        dev_hold(tun->dev);
+        sock_hold(tun->sk);
        atomic_inc(&tfile->count);
 out:
@@ -165,11 +165,8 @@ out:
 static void __tun_detach(struct tun_struct *tun)
 {
-        struct tun_file *tfile = tun->tfile;
        /* Detach from net device */
        netif_tx_lock_bh(tun->dev);
-        tfile->tun = NULL;
        tun->tfile = NULL;
        netif_tx_unlock_bh(tun->dev);
@@ -333,12 +330,19 @@ static void tun_net_uninit(struct net_device *dev)
        /* Inform the methods they need to stop using the dev.
         */
        if (tfile) {
-                wake_up_all(&tfile->read_wait);
+                wake_up_all(&tun->socket.wait);
                if (atomic_dec_and_test(&tfile->count))
                        __tun_detach(tun);
        }
 }
+static void tun_free_netdev(struct net_device *dev)
+{
+        struct tun_struct *tun = netdev_priv(dev);
+        sock_put(tun->sk);
+}
 /* Net device open. */
 static int tun_net_open(struct net_device *dev)
 {
@@ -393,7 +397,7 @@ static int tun_net_xmit(struct sk_buff *skb, struct net_device *dev)
        /* Notify and wake up reader process */
        if (tun->flags & TUN_FASYNC)
                kill_fasync(&tun->fasync, SIGIO, POLL_IN);
-        wake_up_interruptible(&tun->tfile->read_wait);
+        wake_up_interruptible(&tun->socket.wait);
        return 0;
 drop:
@@ -490,7 +494,7 @@ static unsigned int tun_chr_poll(struct file *file, poll_table * wait)
        DBG(KERN_INFO "%s: tun_chr_poll\n", tun->dev->name);
-        poll_wait(file, &tfile->read_wait, wait);
+        poll_wait(file, &tun->socket.wait, wait);
        if (!skb_queue_empty(&tun->readq))
                mask |= POLLIN | POLLRDNORM;
@@ -763,7 +767,7 @@ static ssize_t tun_chr_aio_read(struct kiocb *iocb, const struct iovec *iv,
                goto out;
        }
-        add_wait_queue(&tfile->read_wait, &wait);
+        add_wait_queue(&tun->socket.wait, &wait);
        while (len) {
                current->state = TASK_INTERRUPTIBLE;
@@ -794,7 +798,7 @@ static ssize_t tun_chr_aio_read(struct kiocb *iocb, const struct iovec *iv,
        }
        current->state = TASK_RUNNING;
-        remove_wait_queue(&tfile->read_wait, &wait);
+        remove_wait_queue(&tun->socket.wait, &wait);
 out:
        tun_put(tun);
@@ -811,7 +815,7 @@ static void tun_setup(struct net_device *dev)
        tun->group = -1;
        dev->ethtool_ops = &tun_ethtool_ops;
-        dev->destructor = free_netdev;
+        dev->destructor = tun_free_netdev;
 }
 /* Trivial set of netlink ops to allow deleting tun or tap
@@ -848,7 +852,7 @@ static void tun_sock_write_space(struct sock *sk)
 static void tun_sock_destruct(struct sock *sk)
 {
-        dev_put(container_of(sk, struct tun_sock, sk)->tun->dev);
+        free_netdev(container_of(sk, struct tun_sock, sk)->tun->dev);
 }
 static struct proto tun_proto = {
@@ -862,7 +866,6 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
        struct sock *sk;
        struct tun_struct *tun;
        struct net_device *dev;
-        struct tun_file *tfile = file->private_data;
        int err;
        dev = __dev_get_by_name(net, ifr->ifr_name);
@@ -920,13 +923,10 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
                if (!sk)
                        goto err_free_dev;
-                /* This ref count is for tun->sk. */
+                init_waitqueue_head(&tun->socket.wait);
-                dev_hold(dev);
                sock_init_data(&tun->socket, sk);
                sk->sk_write_space = tun_sock_write_space;
-                sk->sk_destruct = tun_sock_destruct;
                sk->sk_sndbuf = INT_MAX;
-                sk->sk_sleep = &tfile->read_wait;
                tun->sk = sk;
                container_of(sk, struct tun_sock, sk)->tun = tun;
@@ -942,11 +942,13 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
                err = -EINVAL;
                err = register_netdevice(tun->dev);
                if (err < 0)
-                        goto err_free_dev;
+                        goto err_free_sk;
+                sk->sk_destruct = tun_sock_destruct;
                err = tun_attach(tun, file);
                if (err < 0)
-                        goto err_free_dev;
+                        goto failed;
        }
        DBG(KERN_INFO "%s: tun_set_iff\n", tun->dev->name);
@@ -1266,7 +1268,6 @@ static int tun_chr_open(struct inode *inode, struct file * file)
        atomic_set(&tfile->count, 0);
        tfile->tun = NULL;
        tfile->net = get_net(current->nsproxy->net_ns);
-        init_waitqueue_head(&tfile->read_wait);
        file->private_data = tfile;
        return 0;
 }
@@ -1284,14 +1285,16 @@ static int tun_chr_close(struct inode *inode, struct file *file)
                __tun_detach(tun);
                /* If desireable, unregister the netdevice. */
-                if (!(tun->flags & TUN_PERSIST)) {
+                if (!(tun->flags & TUN_PERSIST))
-                        sock_put(tun->sk);
                        unregister_netdevice(tun->dev);
-                }
                rtnl_unlock();
        }
+        tun = tfile->tun;
+        if (tun)
+                sock_put(tun->sk);
        put_net(tfile->net);
        kfree(tfile);
diff --git a/drivers/net/ucc_geth.c b/drivers/net/ucc_geth.c
index d3f39e86eb95..44f8392da117 100644
--- a/drivers/net/ucc_geth.c
+++ b/drivers/net/ucc_geth.c
@@ -1394,7 +1394,8 @@ static int adjust_enet_interface(struct ucc_geth_private *ugeth)
            (ugeth->phy_interface == PHY_INTERFACE_MODE_RGMII_RXID) ||
            (ugeth->phy_interface == PHY_INTERFACE_MODE_RGMII_TXID) ||
            (ugeth->phy_interface == PHY_INTERFACE_MODE_RTBI)) {
-                upsmr |= UCC_GETH_UPSMR_RPM;
+                if (ugeth->phy_interface != PHY_INTERFACE_MODE_RMII)
+                        upsmr |= UCC_GETH_UPSMR_RPM;
                switch (ugeth->max_speed) {
                case SPEED_10:
                        upsmr |= UCC_GETH_UPSMR_R10M;
diff --git a/drivers/net/usb/Kconfig b/drivers/net/usb/Kconfig
index 8ee21030e9ac..dfc6cf765fbd 100644
--- a/drivers/net/usb/Kconfig
+++ b/drivers/net/usb/Kconfig
@@ -180,6 +180,20 @@ config USB_NET_CDCETHER
          IEEE 802 "local assignment" bit is set in the address, a "usbX"
          name is used instead.
+config USB_NET_CDC_EEM
+        tristate "CDC EEM support"
+        depends on USB_USBNET && EXPERIMENTAL
+        help
+          This option supports devices conforming to the Communication Device
+          Class (CDC) Ethernet Emulation Model, a specification that's easy to
+          implement in device firmware.  The CDC EEM specifications are available
+          from <http://www.usb.org/>.
+          This driver creates an interface named "ethX", where X depends on
+          what other networking devices you have in use.  However, if the
+          IEEE 802 "local assignment" bit is set in the address, a "usbX"
+          name is used instead.
 config USB_NET_DM9601
        tristate "Davicom DM9601 based USB 1.1 10/100 ethernet devices"
        depends on USB_USBNET
diff --git a/drivers/net/usb/Makefile b/drivers/net/usb/Makefile
index 88a87eeb376a..c8aef62cf2b7 100644
--- a/drivers/net/usb/Makefile
+++ b/drivers/net/usb/Makefile
@@ -9,6 +9,7 @@ obj-$(CONFIG_USB_RTL8150)	+= rtl8150.o
 obj-$(CONFIG_USB_HSO)           += hso.o
 obj-$(CONFIG_USB_NET_AX8817X)   += asix.o
 obj-$(CONFIG_USB_NET_CDCETHER)  += cdc_ether.o
+obj-$(CONFIG_USB_NET_CDC_EEM)   += cdc_eem.o
 obj-$(CONFIG_USB_NET_DM9601)    += dm9601.o
 obj-$(CONFIG_USB_NET_SMSC95XX)  += smsc95xx.o
 obj-$(CONFIG_USB_NET_GL620A)    += gl620a.o
diff --git a/drivers/net/usb/cdc_eem.c b/drivers/net/usb/cdc_eem.c
new file mode 100644
index 000000000000..80e01778dd3b
--- /dev/null
+++ b/drivers/net/usb/cdc_eem.c
@@ -0,0 +1,381 @@
+/*
+ * USB CDC EEM network interface driver
+ * Copyright (C) 2009 Oberthur Technologies
+ * by Omar Laazimani, Olivier Condemine
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ */
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/ctype.h>
+#include <linux/ethtool.h>
+#include <linux/workqueue.h>
+#include <linux/mii.h>
+#include <linux/usb.h>
+#include <linux/crc32.h>
+#include <linux/usb/cdc.h>
+#include <linux/usb/usbnet.h>
+/*
+ * This driver is an implementation of the CDC "Ethernet Emulation
+ * Model" (EEM) specification, which encapsulates Ethernet frames
+ * for transport over USB using a simpler USB device model than the
+ * previous CDC "Ethernet Control Model" (ECM, or "CDC Ethernet").
+ *
+ * For details, see www.usb.org/developers/devclass_docs/CDC_EEM10.pdf
+ *
+ * This version has been tested with GIGAntIC WuaoW SIM Smart Card on 2.6.24,
+ * 2.6.27 and 2.6.30rc2 kernel.
+ * It has also been validated on Openmoko Om 2008.12 (based on 2.6.24 kernel).
+ * build on 23-April-2009
+ */
+#define EEM_HEAD        2               /* 2 byte header */
+/*-------------------------------------------------------------------------*/
+static void eem_linkcmd_complete(struct urb *urb)
+{
+        dev_kfree_skb(urb->context);
+        usb_free_urb(urb);
+}
+static void eem_linkcmd(struct usbnet *dev, struct sk_buff *skb)
+{
+        struct urb              *urb;
+        int                     status;
+        urb = usb_alloc_urb(0, GFP_ATOMIC);
+        if (!urb)
+                goto fail;
+        usb_fill_bulk_urb(urb, dev->udev, dev->out,
+                        skb->data, skb->len, eem_linkcmd_complete, skb);
+        status = usb_submit_urb(urb, GFP_ATOMIC);
+        if (status) {
+                usb_free_urb(urb);
+fail:
+                dev_kfree_skb(skb);
+                devwarn(dev, "link cmd failure\n");
+                return;
+        }
+}
+static int eem_bind(struct usbnet *dev, struct usb_interface *intf)
+{
+        int status = 0;
+        status = usbnet_get_endpoints(dev, intf);
+        if (status < 0) {
+                usb_set_intfdata(intf, NULL);
+                usb_driver_release_interface(driver_of(intf), intf);
+                return status;
+        }
+        /* no jumbogram (16K) support for now */
+        dev->net->hard_header_len += EEM_HEAD + ETH_FCS_LEN;
+        return 0;
+}
+/*
+ * EEM permits packing multiple Ethernet frames into USB transfers
+ * (a "bundle"), but for TX we don't try to do that.
+ */
+static struct sk_buff *eem_tx_fixup(struct usbnet *dev, struct sk_buff *skb,
+                                       gfp_t flags)
+{
+        struct sk_buff  *skb2 = NULL;
+        u16             len = skb->len;
+        u32             crc = 0;
+        int             padlen = 0;
+        /* When ((len + EEM_HEAD + ETH_FCS_LEN) % dev->maxpacket) is
+         * zero, stick two bytes of zero length EEM packet on the end.
+         * Else the framework would add invalid single byte padding,
+         * since it can't know whether ZLPs will be handled right by
+         * all the relevant hardware and software.
+         */
+        if (!((len + EEM_HEAD + ETH_FCS_LEN) % dev->maxpacket))
+                padlen += 2;
+        if (!skb_cloned(skb)) {
+                int     headroom = skb_headroom(skb);
+                int     tailroom = skb_tailroom(skb);
+                if ((tailroom >= ETH_FCS_LEN + padlen)
+                                && (headroom >= EEM_HEAD))
+                        goto done;
+                if ((headroom + tailroom)
+                                > (EEM_HEAD + ETH_FCS_LEN + padlen)) {
+                        skb->data = memmove(skb->head +
+                                        EEM_HEAD,
+                                        skb->data,
+                                        skb->len);
+                        skb_set_tail_pointer(skb, len);
+                        goto done;
+                }
+        }
+        skb2 = skb_copy_expand(skb, EEM_HEAD, ETH_FCS_LEN + padlen, flags);
+        if (!skb2)
+                return NULL;
+        dev_kfree_skb_any(skb);
+        skb = skb2;
+done:
+        /* we don't use the "no Ethernet CRC" option */
+        crc = crc32_le(~0, skb->data, skb->len);
+        crc = ~crc;
+        put_unaligned_le32(crc, skb_put(skb, 4));
+        /* EEM packet header format:
+         * b0..13:      length of ethernet frame
+         * b14:         bmCRC (1 == valid Ethernet CRC)
+         * b15:         bmType (0 == data)
+         */
+        len = skb->len;
+        put_unaligned_le16(BIT(14) | len, skb_push(skb, 2));
+        /* Bundle a zero length EEM packet if needed */
+        if (padlen)
+                put_unaligned_le16(0, skb_put(skb, 2));
+        return skb;
+}
+static int eem_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
+{
+        /*
+         * Our task here is to strip off framing, leaving skb with one
+         * data frame for the usbnet framework code to process.  But we
+         * may have received multiple EEM payloads, or command payloads.
+         * So we must process _everything_ as if it's a header, except
+         * maybe the last data payload
+         *
+         * REVISIT the framework needs updating so that when we consume
+         * all payloads (the last or only message was a command, or a
+         * zero length EEM packet) that is not accounted as an rx_error.
+         */
+        do {
+                struct sk_buff  *skb2 = NULL;
+                u16             header;
+                u16             len = 0;
+                /* incomplete EEM header? */
+                if (skb->len < EEM_HEAD)
+                        return 0;
+                /*
+                 * EEM packet header format:
+                 * b0..14:      EEM type dependant (Data or Command)
+                 * b15:         bmType
+                 */
+                header = get_unaligned_le16(skb->data);
+                skb_pull(skb, EEM_HEAD);
+                /*
+                 * The bmType bit helps to denote when EEM
+                 * packet is data or command :
+                 *      bmType = 0      : EEM data payload
+                 *      bmType = 1      : EEM (link) command
+                 */
+                if (header & BIT(15)) {
+                        u16     bmEEMCmd;
+                        /*
+                         * EEM (link) command packet:
+                         * b0..10:      bmEEMCmdParam
+                         * b11..13:     bmEEMCmd
+                         * b14:         bmReserved (must be 0)
+                         * b15:         1 (EEM command)
+                         */
+                        if (header & BIT(14)) {
+                                devdbg(dev, "reserved command %04x\n", header);
+                                continue;
+                        }
+                        bmEEMCmd = (header >> 11) & 0x7;
+                        switch (bmEEMCmd) {
+                        /* Responding to echo requests is mandatory. */
+                        case 0:         /* Echo command */
+                                len = header & 0x7FF;
+                                /* bogus command? */
+                                if (skb->len < len)
+                                        return 0;
+                                skb2 = skb_clone(skb, GFP_ATOMIC);
+                                if (unlikely(!skb2))
+                                        goto next;
+                                skb_trim(skb2, len);
+                                put_unaligned_le16(BIT(15) | (1 << 11) | len,
+                                                skb_push(skb2, 2));
+                                eem_linkcmd(dev, skb2);
+                                break;
+                        /*
+                         * Host may choose to ignore hints.
+                         *  - suspend: peripheral ready to suspend
+                         *  - response: suggest N millisec polling
+                         *  - response complete: suggest N sec polling
+                         */
+                        case 2:         /* Suspend hint */
+                        case 3:         /* Response hint */
+                        case 4:         /* Response complete hint */
+                                continue;
+                        /*
+                         * Hosts should never receive host-to-peripheral
+                         * or reserved command codes; or responses to an
+                         * echo command we didn't send.
+                         */
+                        case 1:         /* Echo response */
+                        case 5:         /* Tickle */
+                        default:        /* reserved */
+                                devwarn(dev, "unexpected link command %d\n",
+                                                bmEEMCmd);
+                                continue;
+                        }
+                } else {
+                        u32     crc, crc2;
+                        int     is_last;
+                        /* zero length EEM packet? */
+                        if (header == 0)
+                                continue;
+                        /*
+                         * EEM data packet header :
+                         * b0..13:      length of ethernet frame
+                         * b14:         bmCRC
+                         * b15:         0 (EEM data)
+                         */
+                        len = header & 0x3FFF;
+                        /* bogus EEM payload? */
+                        if (skb->len < len)
+                                return 0;
+                        /* bogus ethernet frame? */
+                        if (len < (ETH_HLEN + ETH_FCS_LEN))
+                                goto next;
+                        /*
+                         * Treat the last payload differently: framework
+                         * code expects our "fixup" to have stripped off
+                         * headers, so "skb" is a data packet (or error).
+                         * Else if it's not the last payload, keep "skb"
+                         * for further processing.
+                         */
+                        is_last = (len == skb->len);
+                        if (is_last)
+                                skb2 = skb;
+                        else {
+                                skb2 = skb_clone(skb, GFP_ATOMIC);
+                                if (unlikely(!skb2))
+                                        return 0;
+                        }
+                        crc = get_unaligned_le32(skb2->data
+                                        + len - ETH_FCS_LEN);
+                        skb_trim(skb2, len - ETH_FCS_LEN);
+                        /*
+                         * The bmCRC helps to denote when the CRC field in
+                         * the Ethernet frame contains a calculated CRC:
+                         *      bmCRC = 1       : CRC is calculated
+                         *      bmCRC = 0       : CRC = 0xDEADBEEF
+                         */
+                        if (header & BIT(14))
+                                crc2 = ~crc32_le(~0, skb2->data, len);
+                        else
+                                crc2 = 0xdeadbeef;
+                        if (is_last)
+                                return crc == crc2;
+                        if (unlikely(crc != crc2)) {
+                                dev->stats.rx_errors++;
+                                dev_kfree_skb_any(skb2);
+                        } else
+                                usbnet_skb_return(dev, skb2);
+                }
+next:
+                skb_pull(skb, len);
+        } while (skb->len);
+        return 1;
+}
+static const struct driver_info eem_info = {
+        .description =  "CDC EEM Device",
+        .flags =        FLAG_ETHER,
+        .bind =         eem_bind,
+        .rx_fixup =     eem_rx_fixup,
+        .tx_fixup =     eem_tx_fixup,
+};
+/*-------------------------------------------------------------------------*/
+static const struct usb_device_id products[] = {
+{
+        USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_EEM,
+                        USB_CDC_PROTO_EEM),
+        .driver_info = (unsigned long) &eem_info,
+},
+{
+        /* EMPTY == end of list */
+},
+};
+MODULE_DEVICE_TABLE(usb, products);
+static struct usb_driver eem_driver = {
+        .name =         "cdc_eem",
+        .id_table =     products,
+        .probe =        usbnet_probe,
+        .disconnect =   usbnet_disconnect,
+        .suspend =      usbnet_suspend,
+        .resume =       usbnet_resume,
+};
+static int __init eem_init(void)
+{
+        return usb_register(&eem_driver);
+}
+module_init(eem_init);
+static void __exit eem_exit(void)
+{
+        usb_deregister(&eem_driver);
+}
+module_exit(eem_exit);
+MODULE_AUTHOR("Omar Laazimani <omar.oberthur@gmail.com>");
+MODULE_DESCRIPTION("USB CDC EEM");
+MODULE_LICENSE("GPL");
diff --git a/drivers/net/usb/pegasus.c b/drivers/net/usb/pegasus.c
index a8228d87c8cf..2138535f2339 100644
--- a/drivers/net/usb/pegasus.c
+++ b/drivers/net/usb/pegasus.c
@@ -899,6 +899,7 @@ static int pegasus_start_xmit(struct sk_buff *skb, struct net_device *net)
                        /* cleanup should already have been scheduled */
                        break;
                case -ENODEV:           /* disconnect() upcoming */
+                case -EPERM:
                        netif_device_detach(pegasus->net);
                        break;
                default:
diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c
index dc1665326592..5a7283372b53 100644
--- a/drivers/net/usb/smsc95xx.c
+++ b/drivers/net/usb/smsc95xx.c
@@ -941,6 +941,16 @@ static int smsc95xx_reset(struct usbnet *dev)
        if (netif_msg_ifup(dev))
                devdbg(dev, "ID_REV = 0x%08x", read_buf);
+        /* Configure GPIO pins as LED outputs */
+        write_buf = LED_GPIO_CFG_SPD_LED | LED_GPIO_CFG_LNK_LED |
+                LED_GPIO_CFG_FDX_LED;
+        ret = smsc95xx_write_reg(dev, LED_GPIO_CFG, write_buf);
+        if (ret < 0) {
+                devwarn(dev, "Failed to write LED_GPIO_CFG register, ret=%d",
+                        ret);
+                return ret;
+        }
        /* Init Tx */
        write_buf = 0;
        ret = smsc95xx_write_reg(dev, FLOW, write_buf);
@@ -1231,6 +1241,11 @@ static const struct usb_device_id products[] = {
                USB_DEVICE(0x0424, 0x9500),
                .driver_info = (unsigned long) &smsc95xx_info,
        },
+        {
+                /* SMSC9512/9514 USB Hub & Ethernet Device */
+                USB_DEVICE(0x0424, 0xec00),
+                .driver_info = (unsigned long) &smsc95xx_info,
+        },
        { },            /* END */
 };
 MODULE_DEVICE_TABLE(usb, products);
diff --git a/drivers/net/usb/smsc95xx.h b/drivers/net/usb/smsc95xx.h
index 66b5c84f302e..86bc44977fbd 100644
--- a/drivers/net/usb/smsc95xx.h
+++ b/drivers/net/usb/smsc95xx.h
@@ -99,6 +99,9 @@
 #define PM_CTL_WUPS_MULTI_              (0x00000003)
 #define LED_GPIO_CFG                    (0x24)
+#define LED_GPIO_CFG_SPD_LED            (0x01000000)
+#define LED_GPIO_CFG_LNK_LED            (0x00100000)
+#define LED_GPIO_CFG_FDX_LED            (0x00010000)
 #define GPIO_CFG                        (0x28)
diff --git a/drivers/net/veth.c b/drivers/net/veth.c
index 015db1cece72..8e56fcf0a0e3 100644
--- a/drivers/net/veth.c
+++ b/drivers/net/veth.c
@@ -210,14 +210,11 @@ rx_drop:
 static struct net_device_stats *veth_get_stats(struct net_device *dev)
 {
-        struct veth_priv *priv;
+        struct veth_priv *priv = netdev_priv(dev);
-        struct net_device_stats *dev_stats;
+        struct net_device_stats *dev_stats = &dev->stats;
-        int cpu;
+        unsigned int cpu;
        struct veth_net_stats *stats;
-        priv = netdev_priv(dev);
-        dev_stats = &dev->stats;
        dev_stats->rx_packets = 0;
        dev_stats->tx_packets = 0;
        dev_stats->rx_bytes = 0;
@@ -225,16 +222,17 @@ static struct net_device_stats *veth_get_stats(struct net_device *dev)
        dev_stats->tx_dropped = 0;
        dev_stats->rx_dropped = 0;
-        for_each_online_cpu(cpu) {
+        if (priv->stats)
-                stats = per_cpu_ptr(priv->stats, cpu);
+                for_each_online_cpu(cpu) {
+                        stats = per_cpu_ptr(priv->stats, cpu);
-                dev_stats->rx_packets += stats->rx_packets;
+                        dev_stats->rx_packets += stats->rx_packets;
-                dev_stats->tx_packets += stats->tx_packets;
+                        dev_stats->tx_packets += stats->tx_packets;
-                dev_stats->rx_bytes += stats->rx_bytes;
+                        dev_stats->rx_bytes += stats->rx_bytes;
-                dev_stats->tx_bytes += stats->tx_bytes;
+                        dev_stats->tx_bytes += stats->tx_bytes;
-                dev_stats->tx_dropped += stats->tx_dropped;
+                        dev_stats->tx_dropped += stats->tx_dropped;
-                dev_stats->rx_dropped += stats->rx_dropped;
+                        dev_stats->rx_dropped += stats->rx_dropped;
-        }
+                }
        return dev_stats;
 }
@@ -261,6 +259,8 @@ static int veth_close(struct net_device *dev)
        netif_carrier_off(dev);
        netif_carrier_off(priv->peer);
+        free_percpu(priv->stats);
+        priv->stats = NULL;
        return 0;
 }
@@ -291,15 +291,6 @@ static int veth_dev_init(struct net_device *dev)
        return 0;
 }
-static void veth_dev_free(struct net_device *dev)
-{
-        struct veth_priv *priv;
-        priv = netdev_priv(dev);
-        free_percpu(priv->stats);
-        free_netdev(dev);
-}
 static const struct net_device_ops veth_netdev_ops = {
        .ndo_init            = veth_dev_init,
        .ndo_open            = veth_open,
@@ -317,7 +308,7 @@ static void veth_setup(struct net_device *dev)
        dev->netdev_ops = &veth_netdev_ops;
        dev->ethtool_ops = &veth_ethtool_ops;
        dev->features |= NETIF_F_LLTX;
-        dev->destructor = veth_dev_free;
+        dev->destructor = free_netdev;
 }
 /*
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 9c82a39497e5..4d1d47953fc6 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -616,10 +616,11 @@ static int virtnet_open(struct net_device *dev)
 static bool virtnet_send_command(struct virtnet_info *vi, u8 class, u8 cmd,
                                 struct scatterlist *data, int out, int in)
 {
-        struct scatterlist sg[VIRTNET_SEND_COMMAND_SG_MAX + 2];
+        struct scatterlist *s, sg[VIRTNET_SEND_COMMAND_SG_MAX + 2];
        struct virtio_net_ctrl_hdr ctrl;
        virtio_net_ctrl_ack status = ~0;
        unsigned int tmp;
+        int i;
        if (!virtio_has_feature(vi->vdev, VIRTIO_NET_F_CTRL_VQ)) {
                BUG();  /* Caller should know better */
@@ -637,7 +638,8 @@ static bool virtnet_send_command(struct virtnet_info *vi, u8 class, u8 cmd,
        sg_init_table(sg, out + in);
        sg_set_buf(&sg[0], &ctrl, sizeof(ctrl));
-        memcpy(&sg[1], data, sizeof(struct scatterlist) * (out + in - 2));
+        for_each_sg(data, s, out + in - 2, i)
+                sg_set_buf(&sg[i + 1], sg_virt(s), s->length);
        sg_set_buf(&sg[out + in - 1], &status, sizeof(status));
        if (vi->cvq->vq_ops->add_buf(vi->cvq, sg, out, in, vi) != 0)
@@ -692,7 +694,7 @@ static void virtnet_set_rx_mode(struct net_device *dev)
        promisc = ((dev->flags & IFF_PROMISC) != 0);
        allmulti = ((dev->flags & IFF_ALLMULTI) != 0);
-        sg_set_buf(sg, &promisc, sizeof(promisc));
+        sg_init_one(sg, &promisc, sizeof(promisc));
        if (!virtnet_send_command(vi, VIRTIO_NET_CTRL_RX,
                                  VIRTIO_NET_CTRL_RX_PROMISC,
@@ -700,7 +702,7 @@ static void virtnet_set_rx_mode(struct net_device *dev)
                dev_warn(&dev->dev, "Failed to %sable promisc mode.\n",
                         promisc ? "en" : "dis");
-        sg_set_buf(sg, &allmulti, sizeof(allmulti));
+        sg_init_one(sg, &allmulti, sizeof(allmulti));
        if (!virtnet_send_command(vi, VIRTIO_NET_CTRL_RX,
                                  VIRTIO_NET_CTRL_RX_ALLMULTI,
@@ -716,6 +718,8 @@ static void virtnet_set_rx_mode(struct net_device *dev)
                return;
        }
+        sg_init_table(sg, 2);
        /* Store the unicast list and count in the front of the buffer */
        mac_data->entries = dev->uc_count;
        addr = dev->uc_list;
@@ -744,24 +748,24 @@ static void virtnet_set_rx_mode(struct net_device *dev)
        kfree(buf);
 }
-static void virnet_vlan_rx_add_vid(struct net_device *dev, u16 vid)
+static void virtnet_vlan_rx_add_vid(struct net_device *dev, u16 vid)
 {
        struct virtnet_info *vi = netdev_priv(dev);
        struct scatterlist sg;
-        sg_set_buf(&sg, &vid, sizeof(vid));
+        sg_init_one(&sg, &vid, sizeof(vid));
        if (!virtnet_send_command(vi, VIRTIO_NET_CTRL_VLAN,
                                  VIRTIO_NET_CTRL_VLAN_ADD, &sg, 1, 0))
                dev_warn(&dev->dev, "Failed to add VLAN ID %d.\n", vid);
 }
-static void virnet_vlan_rx_kill_vid(struct net_device *dev, u16 vid)
+static void virtnet_vlan_rx_kill_vid(struct net_device *dev, u16 vid)
 {
        struct virtnet_info *vi = netdev_priv(dev);
        struct scatterlist sg;
-        sg_set_buf(&sg, &vid, sizeof(vid));
+        sg_init_one(&sg, &vid, sizeof(vid));
        if (!virtnet_send_command(vi, VIRTIO_NET_CTRL_VLAN,
                                  VIRTIO_NET_CTRL_VLAN_DEL, &sg, 1, 0))
@@ -794,8 +798,8 @@ static const struct net_device_ops virtnet_netdev = {
        .ndo_set_mac_address = virtnet_set_mac_address,
        .ndo_set_rx_mode     = virtnet_set_rx_mode,
        .ndo_change_mtu      = virtnet_change_mtu,
-        .ndo_vlan_rx_add_vid = virnet_vlan_rx_add_vid,
+        .ndo_vlan_rx_add_vid = virtnet_vlan_rx_add_vid,
-        .ndo_vlan_rx_kill_vid = virnet_vlan_rx_kill_vid,
+        .ndo_vlan_rx_kill_vid = virtnet_vlan_rx_kill_vid,
 #ifdef CONFIG_NET_POLL_CONTROLLER
        .ndo_poll_controller = virtnet_netpoll,
 #endif
diff --git a/drivers/net/vxge/vxge-traffic.c b/drivers/net/vxge/vxge-traffic.c
index 7be0ae10d69b..c2eeac4125f3 100644
--- a/drivers/net/vxge/vxge-traffic.c
+++ b/drivers/net/vxge/vxge-traffic.c
@@ -115,7 +115,7 @@ enum vxge_hw_status vxge_hw_vpath_intr_enable(struct __vxge_hw_vpath_handle *vp)
                VXGE_HW_KDFCCTL_ERRORS_REG_KDFCCTL_FIFO1_POISON|
                VXGE_HW_KDFCCTL_ERRORS_REG_KDFCCTL_FIFO2_POISON|
                VXGE_HW_KDFCCTL_ERRORS_REG_KDFCCTL_FIFO1_DMA_ERR|
-                VXGE_HW_KDFCCTL_ERRORS_REG_KDFCCTL_FIFO1_DMA_ERR), 0, 32),
+                VXGE_HW_KDFCCTL_ERRORS_REG_KDFCCTL_FIFO2_DMA_ERR), 0, 32),
                &vp_reg->kdfcctl_errors_mask);
        __vxge_hw_pio_mem_write32_upper(0, &vp_reg->vpath_ppif_int_mask);
diff --git a/drivers/net/wan/ixp4xx_hss.c b/drivers/net/wan/ixp4xx_hss.c
index 3bf7d3f447db..765a7f5d6aa4 100644
--- a/drivers/net/wan/ixp4xx_hss.c
+++ b/drivers/net/wan/ixp4xx_hss.c
@@ -1249,7 +1249,7 @@ static int __devinit hss_init_one(struct platform_device *pdev)
                return -ENOMEM;
        if ((port->npe = npe_request(0)) == NULL) {
-                err = -ENOSYS;
+                err = -ENODEV;
                goto err_free;
        }
@@ -1311,7 +1311,7 @@ static int __init hss_init_module(void)
        if ((ixp4xx_read_feature_bits() &
             (IXP4XX_FEATURE_HDLC | IXP4XX_FEATURE_HSS)) !=
            (IXP4XX_FEATURE_HDLC | IXP4XX_FEATURE_HSS))
-                return -ENOSYS;
+                return -ENODEV;
        spin_lock_init(&npe_lock);
diff --git a/drivers/net/wimax/i2400m/rx.c b/drivers/net/wimax/i2400m/rx.c
index 02419bfd64b5..f9fc38902322 100644
--- a/drivers/net/wimax/i2400m/rx.c
+++ b/drivers/net/wimax/i2400m/rx.c
@@ -819,10 +819,9 @@ void i2400m_roq_queue_update_ws(struct i2400m *i2400m, struct i2400m_roq *roq,
                        roq_data = (struct i2400m_roq_data *) &skb->cb;
                        i2400m_net_erx(i2400m, skb, roq_data->cs);
                }
-                else {
+                else
                        __i2400m_roq_queue(i2400m, roq, skb, sn, nsn);
-                        __i2400m_roq_update_ws(i2400m, roq, sn + 1);
+                __i2400m_roq_update_ws(i2400m, roq, sn + 1);
-                }
                i2400m_roq_log_add(i2400m, roq, I2400M_RO_TYPE_PACKET_WS,
                                   old_ws, len, sn, nsn, roq->ws);
        }
diff --git a/drivers/net/wimax/i2400m/usb.c b/drivers/net/wimax/i2400m/usb.c
index ca4151a9e222..17851321b7fd 100644
--- a/drivers/net/wimax/i2400m/usb.c
+++ b/drivers/net/wimax/i2400m/usb.c
@@ -505,27 +505,52 @@ int i2400mu_suspend(struct usb_interface *iface, pm_message_t pm_msg)
 #ifdef CONFIG_PM
        struct usb_device *usb_dev = i2400mu->usb_dev;
 #endif
+        unsigned is_autosuspend = 0;
        struct i2400m *i2400m = &i2400mu->i2400m;
+#ifdef CONFIG_PM
+        if (usb_dev->auto_pm > 0)
+                is_autosuspend = 1;
+#endif
        d_fnstart(3, dev, "(iface %p pm_msg %u)\n", iface, pm_msg.event);
        if (i2400m->updown == 0)
                goto no_firmware;
-        d_printf(1, dev, "fw up, requesting standby\n");
+        if (i2400m->state == I2400M_SS_DATA_PATH_CONNECTED && is_autosuspend) {
+                /* ugh -- the device is connected and this suspend
+                 * request is an autosuspend one (not a system standby
+                 * / hibernate).
+                 *
+                 * The only way the device can go to standby is if the
+                 * link with the base station is in IDLE mode; that
+                 * were the case, we'd be in status
+                 * I2400M_SS_CONNECTED_IDLE. But we are not.
+                 *
+                 * If we *tell* him to go power save now, it'll reset
+                 * as a precautionary measure, so if this is an
+                 * autosuspend thing, say no and it'll come back
+                 * later, when the link is IDLE
+                 */
+                result = -EBADF;
+                d_printf(1, dev, "fw up, link up, not-idle, autosuspend: "
+                         "not entering powersave\n");
+                goto error_not_now;
+        }
+        d_printf(1, dev, "fw up: entering powersave\n");
        atomic_dec(&i2400mu->do_autopm);
        result = i2400m_cmd_enter_powersave(i2400m);
        atomic_inc(&i2400mu->do_autopm);
-#ifdef CONFIG_PM
+        if (result < 0 && !is_autosuspend) {
-        if (result < 0 && usb_dev->auto_pm == 0) {
                /* System suspend, can't fail */
                dev_err(dev, "failed to suspend, will reset on resume\n");
                result = 0;
        }
-#endif
        if (result < 0)
                goto error_enter_powersave;
        i2400mu_notification_release(i2400mu);
-        d_printf(1, dev, "fw up, got standby\n");
+        d_printf(1, dev, "powersave requested\n");
 error_enter_powersave:
+error_not_now:
 no_firmware:
        d_fnend(3, dev, "(iface %p pm_msg %u) = %d\n",
                iface, pm_msg.event, result);
diff --git a/drivers/net/wireless/Kconfig b/drivers/net/wireless/Kconfig
index 8a0823588c51..3d94e7dfea69 100644
--- a/drivers/net/wireless/Kconfig
+++ b/drivers/net/wireless/Kconfig
@@ -430,6 +430,7 @@ config RTL8187
          ASUS P5B Deluxe
          Toshiba Satellite Pro series of laptops
          Asus Wireless Link
+          Linksys WUSB54GC-EU
          Thanks to Realtek for their support!
diff --git a/drivers/net/wireless/airo.c b/drivers/net/wireless/airo.c
index f21a6171c691..9eabf4d1f2e7 100644
--- a/drivers/net/wireless/airo.c
+++ b/drivers/net/wireless/airo.c
@@ -6467,6 +6467,7 @@ static int airo_get_encode(struct net_device *dev,
 {
        struct airo_info *local = dev->ml_priv;
        int index = (dwrq->flags & IW_ENCODE_INDEX) - 1;
+        int wep_key_len;
        u8 buf[16];
        if (!local->wep_capable)
@@ -6500,8 +6501,13 @@ static int airo_get_encode(struct net_device *dev,
        dwrq->flags |= index + 1;
        /* Copy the key to the user buffer */
-        dwrq->length = get_wep_key(local, index, &buf[0], sizeof(buf));
+        wep_key_len = get_wep_key(local, index, &buf[0], sizeof(buf));
-        memcpy(extra, buf, dwrq->length);
+        if (wep_key_len < 0) {
+                dwrq->length = 0;
+        } else {
+                dwrq->length = wep_key_len;
+                memcpy(extra, buf, dwrq->length);
+        }
        return 0;
 }
@@ -6614,7 +6620,7 @@ static int airo_get_encodeext(struct net_device *dev,
        struct airo_info *local = dev->ml_priv;
        struct iw_point *encoding = &wrqu->encoding;
        struct iw_encode_ext *ext = (struct iw_encode_ext *)extra;
-        int idx, max_key_len;
+        int idx, max_key_len, wep_key_len;
        u8 buf[16];
        if (!local->wep_capable)
@@ -6658,8 +6664,13 @@ static int airo_get_encodeext(struct net_device *dev,
        memset(extra, 0, 16);
        
        /* Copy the key to the user buffer */
-        ext->key_len = get_wep_key(local, idx, &buf[0], sizeof(buf));
+        wep_key_len = get_wep_key(local, idx, &buf[0], sizeof(buf));
-        memcpy(extra, buf, ext->key_len);
+        if (wep_key_len < 0) {
+                ext->key_len = 0;
+        } else {
+                ext->key_len = wep_key_len;
+                memcpy(extra, buf, ext->key_len);
+        }
        return 0;
 }
@@ -6713,11 +6724,11 @@ static int airo_set_auth(struct net_device *dev,
                                local->config.authType = AUTH_ENCRYPT;
                        } else
                                return -EINVAL;
-                        break;
                        /* Commit the changes to flags if needed */
                        if (local->config.authType != currentAuthType)
                                set_bit (FLAG_COMMIT, &local->flags);
+                        break;
                }
        case IW_AUTH_WPA_ENABLED:
diff --git a/drivers/net/wireless/ar9170/hw.h b/drivers/net/wireless/ar9170/hw.h
index 13091bd9d815..53e250a4278f 100644
--- a/drivers/net/wireless/ar9170/hw.h
+++ b/drivers/net/wireless/ar9170/hw.h
@@ -310,7 +310,7 @@ struct ar9170_tx_control {
 struct ar9170_rx_head {
        u8 plcp[12];
-};
+} __packed;
 struct ar9170_rx_tail {
        union {
@@ -318,16 +318,16 @@ struct ar9170_rx_tail {
                        u8 rssi_ant0, rssi_ant1, rssi_ant2,
                           rssi_ant0x, rssi_ant1x, rssi_ant2x,
                           rssi_combined;
-                };
+                } __packed;
                u8 rssi[7];
-        };
+        } __packed;
        u8 evm_stream0[6], evm_stream1[6];
        u8 phy_err;
        u8 SAidx, DAidx;
        u8 error;
        u8 status;
-};
+} __packed;
 #define AR9170_ENC_ALG_NONE                     0x0
 #define AR9170_ENC_ALG_WEP64                    0x1
diff --git a/drivers/net/wireless/ar9170/usb.c b/drivers/net/wireless/ar9170/usb.c
index ad296840893e..fddda477095c 100644
--- a/drivers/net/wireless/ar9170/usb.c
+++ b/drivers/net/wireless/ar9170/usb.c
@@ -59,6 +59,8 @@ static struct usb_device_id ar9170_usb_ids[] = {
        { USB_DEVICE(0x0cf3, 0x9170) },
        /* Atheros TG121N */
        { USB_DEVICE(0x0cf3, 0x1001) },
+        /* Cace Airpcap NX */
+        { USB_DEVICE(0xcace, 0x0300) },
        /* D-Link DWA 160A */
        { USB_DEVICE(0x07d1, 0x3c10) },
        /* Netgear WNDA3100 */
@@ -67,6 +69,8 @@ static struct usb_device_id ar9170_usb_ids[] = {
        { USB_DEVICE(0x0846, 0x9001) },
        /* Zydas ZD1221 */
        { USB_DEVICE(0x0ace, 0x1221) },
+        /* ZyXEL NWD271N */
+        { USB_DEVICE(0x0586, 0x3417) },
        /* Z-Com UB81 BG */
        { USB_DEVICE(0x0cde, 0x0023) },
        /* Z-Com UB82 ABG */
@@ -619,6 +623,39 @@ static int ar9170_usb_open(struct ar9170 *ar)
        return 0;
 }
+static int ar9170_usb_init_device(struct ar9170_usb *aru)
+{
+        int err;
+        err = ar9170_usb_alloc_rx_irq_urb(aru);
+        if (err)
+                goto err_out;
+        err = ar9170_usb_alloc_rx_bulk_urbs(aru);
+        if (err)
+                goto err_unrx;
+        err = ar9170_usb_upload_firmware(aru);
+        if (err) {
+                err = ar9170_echo_test(&aru->common, 0x60d43110);
+                if (err) {
+                        /* force user invention, by disabling the device */
+                        err = usb_driver_set_configuration(aru->udev, -1);
+                        dev_err(&aru->udev->dev, "device is in a bad state. "
+                                                 "please reconnect it!\n");
+                        goto err_unrx;
+                }
+        }
+        return 0;
+err_unrx:
+        ar9170_usb_cancel_urbs(aru);
+err_out:
+        return err;
+}
 static int ar9170_usb_probe(struct usb_interface *intf,
                        const struct usb_device_id *id)
 {
@@ -654,32 +691,16 @@ static int ar9170_usb_probe(struct usb_interface *intf,
        err = ar9170_usb_reset(aru);
        if (err)
-                goto err_unlock;
+                goto err_freehw;
        err = ar9170_usb_request_firmware(aru);
        if (err)
-                goto err_unlock;
+                goto err_freehw;
-        err = ar9170_usb_alloc_rx_irq_urb(aru);
+        err = ar9170_usb_init_device(aru);
        if (err)
                goto err_freefw;
-        err = ar9170_usb_alloc_rx_bulk_urbs(aru);
-        if (err)
-                goto err_unrx;
-        err = ar9170_usb_upload_firmware(aru);
-        if (err) {
-                err = ar9170_echo_test(&aru->common, 0x60d43110);
-                if (err) {
-                        /* force user invention, by disabling the device */
-                        err = usb_driver_set_configuration(aru->udev, -1);
-                        dev_err(&aru->udev->dev, "device is in a bad state. "
-                                                 "please reconnect it!\n");
-                        goto err_unrx;
-                }
-        }
        err = ar9170_usb_open(ar);
        if (err)
                goto err_unrx;
@@ -699,7 +720,7 @@ err_freefw:
        release_firmware(aru->init_values);
        release_firmware(aru->firmware);
-err_unlock:
+err_freehw:
        usb_set_intfdata(intf, NULL);
        usb_put_dev(udev);
        ieee80211_free_hw(ar->hw);
@@ -726,12 +747,65 @@ static void ar9170_usb_disconnect(struct usb_interface *intf)
        ieee80211_free_hw(aru->common.hw);
 }
+#ifdef CONFIG_PM
+static int ar9170_suspend(struct usb_interface *intf,
+                          pm_message_t  message)
+{
+        struct ar9170_usb *aru = usb_get_intfdata(intf);
+        if (!aru)
+                return -ENODEV;
+        aru->common.state = AR9170_IDLE;
+        ar9170_usb_cancel_urbs(aru);
+        return 0;
+}
+static int ar9170_resume(struct usb_interface *intf)
+{
+        struct ar9170_usb *aru = usb_get_intfdata(intf);
+        int err;
+        if (!aru)
+                return -ENODEV;
+        usb_unpoison_anchored_urbs(&aru->rx_submitted);
+        usb_unpoison_anchored_urbs(&aru->tx_submitted);
+        /*
+         * FIXME: firmware upload will fail on resume.
+         * but this is better than a hang!
+         */
+        err = ar9170_usb_init_device(aru);
+        if (err)
+                goto err_unrx;
+        err = ar9170_usb_open(&aru->common);
+        if (err)
+                goto err_unrx;
+        return 0;
+err_unrx:
+        aru->common.state = AR9170_IDLE;
+        ar9170_usb_cancel_urbs(aru);
+        return err;
+}
+#endif /* CONFIG_PM */
 static struct usb_driver ar9170_driver = {
        .name = "ar9170usb",
        .probe = ar9170_usb_probe,
        .disconnect = ar9170_usb_disconnect,
        .id_table = ar9170_usb_ids,
        .soft_unbind = 1,
+#ifdef CONFIG_PM
+        .suspend = ar9170_suspend,
+        .resume = ar9170_resume,
+#endif /* CONFIG_PM */
 };
 static int __init ar9170_init(void)
diff --git a/drivers/net/wireless/at76c50x-usb.c b/drivers/net/wireless/at76c50x-usb.c
index 0c02f1c2bd94..8d93ca4651b9 100644
--- a/drivers/net/wireless/at76c50x-usb.c
+++ b/drivers/net/wireless/at76c50x-usb.c
@@ -250,6 +250,8 @@ static struct usb_device_id dev_table[] = {
        { USB_DEVICE(0x03eb, 0x7617), USB_DEVICE_DATA(BOARD_505A) },
        /* Siemens Gigaset USB WLAN Adapter 11 */
        { USB_DEVICE(0x1690, 0x0701), USB_DEVICE_DATA(BOARD_505A) },
+        /* OQO Model 01+ Internal Wi-Fi */
+        { USB_DEVICE(0x1557, 0x0002), USB_DEVICE_DATA(BOARD_505A) },
        /*
         * at76c505amx-rfmd
         */
@@ -1871,18 +1873,18 @@ static void at76_dwork_hw_scan(struct work_struct *work)
        if (ret != CMD_STATUS_COMPLETE) {
                queue_delayed_work(priv->hw->workqueue, &priv->dwork_hw_scan,
                                   SCAN_POLL_INTERVAL);
-                goto exit;
+                mutex_unlock(&priv->mtx);
+                return;
        }
-        ieee80211_scan_completed(priv->hw, false);
        if (is_valid_ether_addr(priv->bssid))
                at76_join(priv);
-        ieee80211_wake_queues(priv->hw);
-exit:
        mutex_unlock(&priv->mtx);
+        ieee80211_scan_completed(priv->hw, false);
+        ieee80211_wake_queues(priv->hw);
 }
 static int at76_hw_scan(struct ieee80211_hw *hw,
diff --git a/drivers/net/wireless/ath5k/base.c b/drivers/net/wireless/ath5k/base.c
index a08bc8a4fb69..32df27a9c7a2 100644
--- a/drivers/net/wireless/ath5k/base.c
+++ b/drivers/net/wireless/ath5k/base.c
@@ -214,7 +214,7 @@ static struct pci_driver ath5k_pci_driver = {
 * Prototypes - MAC 802.11 stack related functions
 */
 static int ath5k_tx(struct ieee80211_hw *hw, struct sk_buff *skb);
-static int ath5k_reset(struct ath5k_softc *sc, bool stop, bool change_channel);
+static int ath5k_reset(struct ath5k_softc *sc, struct ieee80211_channel *chan);
 static int ath5k_reset_wake(struct ath5k_softc *sc);
 static int ath5k_start(struct ieee80211_hw *hw);
 static void ath5k_stop(struct ieee80211_hw *hw);
@@ -1038,16 +1038,13 @@ ath5k_chan_set(struct ath5k_softc *sc, struct ieee80211_channel *chan)
        if (chan->center_freq != sc->curchan->center_freq ||
                chan->hw_value != sc->curchan->hw_value) {
-                sc->curchan = chan;
-                sc->curband = &sc->sbands[chan->band];
                /*
                 * To switch channels clear any pending DMA operations;
                 * wait long enough for the RX fifo to drain, reset the
                 * hardware at the new frequency, and then re-enable
                 * the relevant bits of the h/w.
                 */
-                return ath5k_reset(sc, true, true);
+                return ath5k_reset(sc, chan);
        }
        return 0;
@@ -2314,7 +2311,7 @@ ath5k_init(struct ath5k_softc *sc)
        sc->imask = AR5K_INT_RXOK | AR5K_INT_RXERR | AR5K_INT_RXEOL |
                AR5K_INT_RXORN | AR5K_INT_TXDESC | AR5K_INT_TXEOL |
                AR5K_INT_FATAL | AR5K_INT_GLOBAL;
-        ret = ath5k_reset(sc, false, false);
+        ret = ath5k_reset(sc, NULL);
        if (ret)
                goto done;
@@ -2599,18 +2596,25 @@ drop_packet:
        return NETDEV_TX_OK;
 }
+/*
+ * Reset the hardware.  If chan is not NULL, then also pause rx/tx
+ * and change to the given channel.
+ */
 static int
-ath5k_reset(struct ath5k_softc *sc, bool stop, bool change_channel)
+ath5k_reset(struct ath5k_softc *sc, struct ieee80211_channel *chan)
 {
        struct ath5k_hw *ah = sc->ah;
        int ret;
        ATH5K_DBG(sc, ATH5K_DEBUG_RESET, "resetting\n");
-        if (stop) {
+        if (chan) {
                ath5k_hw_set_imr(ah, 0);
                ath5k_txq_cleanup(sc);
                ath5k_rx_stop(sc);
+                sc->curchan = chan;
+                sc->curband = &sc->sbands[chan->band];
        }
        ret = ath5k_hw_reset(ah, sc->opmode, sc->curchan, true);
        if (ret) {
@@ -2648,7 +2652,7 @@ ath5k_reset_wake(struct ath5k_softc *sc)
 {
        int ret;
-        ret = ath5k_reset(sc, true, true);
+        ret = ath5k_reset(sc, sc->curchan);
        if (!ret)
                ieee80211_wake_queues(sc->hw);
diff --git a/drivers/net/wireless/ath5k/debug.c b/drivers/net/wireless/ath5k/debug.c
index 9770bb3d40f9..4904a07e4b59 100644
--- a/drivers/net/wireless/ath5k/debug.c
+++ b/drivers/net/wireless/ath5k/debug.c
@@ -424,7 +424,7 @@ ath5k_debug_dump_bands(struct ath5k_softc *sc)
        for (b = 0; b < IEEE80211_NUM_BANDS; b++) {
                struct ieee80211_supported_band *band = &sc->sbands[b];
-                char bname[5];
+                char bname[6];
                switch (band->band) {
                case IEEE80211_BAND_2GHZ:
                        strcpy(bname, "2 GHz");
diff --git a/drivers/net/wireless/ath5k/phy.c b/drivers/net/wireless/ath5k/phy.c
index 9e2faae5ae94..b48b29dca3d2 100644
--- a/drivers/net/wireless/ath5k/phy.c
+++ b/drivers/net/wireless/ath5k/phy.c
@@ -1487,28 +1487,35 @@ ath5k_get_linear_pcdac_min(const u8 *stepL, const u8 *stepR,
 {
        s8 tmp;
        s16 min_pwrL, min_pwrR;
-        s16 pwr_i = pwrL[0];
+        s16 pwr_i;
-        do {
+        if (pwrL[0] == pwrL[1])
-                pwr_i--;
+                min_pwrL = pwrL[0];
-                tmp = (s8) ath5k_get_interpolated_value(pwr_i,
+        else {
-                                                pwrL[0], pwrL[1],
+                pwr_i = pwrL[0];
-                                                stepL[0], stepL[1]);
+                do {
+                        pwr_i--;
-        } while (tmp > 1);
+                        tmp = (s8) ath5k_get_interpolated_value(pwr_i,
+                                                        pwrL[0], pwrL[1],
-        min_pwrL = pwr_i;
+                                                        stepL[0], stepL[1]);
+                } while (tmp > 1);
-        pwr_i = pwrR[0];
-        do {
+                min_pwrL = pwr_i;
-                pwr_i--;
+        }
-                tmp = (s8) ath5k_get_interpolated_value(pwr_i,
-                                                pwrR[0], pwrR[1],
-                                                stepR[0], stepR[1]);
-        } while (tmp > 1);
-        min_pwrR = pwr_i;
+        if (pwrR[0] == pwrR[1])
+                min_pwrR = pwrR[0];
+        else {
+                pwr_i = pwrR[0];
+                do {
+                        pwr_i--;
+                        tmp = (s8) ath5k_get_interpolated_value(pwr_i,
+                                                        pwrR[0], pwrR[1],
+                                                        stepR[0], stepR[1]);
+                } while (tmp > 1);
+                min_pwrR = pwr_i;
+        }
        /* Keep the right boundary so that it works for both curves */
        return max(min_pwrL, min_pwrR);
diff --git a/drivers/net/wireless/ath5k/reset.c b/drivers/net/wireless/ath5k/reset.c
index 7a17d31b2fd9..5f72c111c2e8 100644
--- a/drivers/net/wireless/ath5k/reset.c
+++ b/drivers/net/wireless/ath5k/reset.c
@@ -26,7 +26,7 @@
 \*****************************/
 #include <linux/pci.h>          /* To determine if a card is pci-e */
-#include <linux/bitops.h>       /* For get_bitmask_order */
+#include <linux/log2.h>
 #include "ath5k.h"
 #include "reg.h"
 #include "base.h"
@@ -69,10 +69,10 @@ static inline int ath5k_hw_write_ofdm_timings(struct ath5k_hw *ah,
        /* Get exponent
         * ALGO: coef_exp = 14 - highest set bit position */
-        coef_exp = get_bitmask_order(coef_scaled);
+        coef_exp = ilog2(coef_scaled);
        /* Doesn't make sense if it's zero*/
-        if (!coef_exp)
+        if (!coef_scaled || !coef_exp)
                return -EINVAL;
        /* Note: we've shifted coef_scaled by 24 */
@@ -359,7 +359,7 @@ int ath5k_hw_nic_wakeup(struct ath5k_hw *ah, int flags, bool initial)
                        mode |= AR5K_PHY_MODE_FREQ_5GHZ;
                        if (ah->ah_radio == AR5K_RF5413)
-                                clock |= AR5K_PHY_PLL_40MHZ_5413;
+                                clock = AR5K_PHY_PLL_40MHZ_5413;
                        else
                                clock |= AR5K_PHY_PLL_40MHZ;
diff --git a/drivers/net/wireless/ath9k/recv.c b/drivers/net/wireless/ath9k/recv.c
index 71cb18d6757d..dd1f30156740 100644
--- a/drivers/net/wireless/ath9k/recv.c
+++ b/drivers/net/wireless/ath9k/recv.c
@@ -493,6 +493,7 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush)
        int hdrlen, padsize, retval;
        bool decrypt_error = false;
        u8 keyix;
+        __le16 fc;
        spin_lock_bh(&sc->rx.rxbuflock);
@@ -606,6 +607,7 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush)
                /* see if any padding is done by the hw and remove it */
                hdr = (struct ieee80211_hdr *)skb->data;
                hdrlen = ieee80211_get_hdrlen_from_skb(skb);
+                fc = hdr->frame_control;
                /* The MAC header is padded to have 32-bit boundary if the
                 * packet payload is non-zero. The general calculation for
@@ -690,7 +692,7 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush)
                        sc->rx.rxotherant = 0;
                }
-                if (ieee80211_is_beacon(hdr->frame_control) &&
+                if (ieee80211_is_beacon(fc) &&
                                (sc->sc_flags & SC_OP_WAIT_FOR_BEACON)) {
                        sc->sc_flags &= ~SC_OP_WAIT_FOR_BEACON;
                        ath9k_hw_setpower(sc->sc_ah, ATH9K_PM_NETWORK_SLEEP);
diff --git a/drivers/net/wireless/atmel.c b/drivers/net/wireless/atmel.c
index 857d84148b1d..27eef8fb7107 100644
--- a/drivers/net/wireless/atmel.c
+++ b/drivers/net/wireless/atmel.c
@@ -1502,7 +1502,6 @@ static const struct net_device_ops atmel_netdev_ops = {
        .ndo_set_mac_address    = atmel_set_mac_address,
        .ndo_start_xmit         = start_tx,
        .ndo_do_ioctl           = atmel_ioctl,
-        .ndo_change_mtu         = eth_change_mtu,
        .ndo_validate_addr      = eth_validate_addr,
 };
diff --git a/drivers/net/wireless/b43/dma.c b/drivers/net/wireless/b43/dma.c
index e228c1de6e11..eae680b53052 100644
--- a/drivers/net/wireless/b43/dma.c
+++ b/drivers/net/wireless/b43/dma.c
@@ -555,11 +555,32 @@ address_error:
        return 1;
 }
+static bool b43_rx_buffer_is_poisoned(struct b43_dmaring *ring, struct sk_buff *skb)
+{
+        unsigned char *f = skb->data + ring->frameoffset;
+        return ((f[0] & f[1] & f[2] & f[3] & f[4] & f[5] & f[6] & f[7]) == 0xFF);
+}
+static void b43_poison_rx_buffer(struct b43_dmaring *ring, struct sk_buff *skb)
+{
+        struct b43_rxhdr_fw4 *rxhdr;
+        unsigned char *frame;
+        /* This poisons the RX buffer to detect DMA failures. */
+        rxhdr = (struct b43_rxhdr_fw4 *)(skb->data);
+        rxhdr->frame_len = 0;
+        B43_WARN_ON(ring->rx_buffersize < ring->frameoffset + sizeof(struct b43_plcp_hdr6) + 2);
+        frame = skb->data + ring->frameoffset;
+        memset(frame, 0xFF, sizeof(struct b43_plcp_hdr6) + 2 /* padding */);
+}
 static int setup_rx_descbuffer(struct b43_dmaring *ring,
                               struct b43_dmadesc_generic *desc,
                               struct b43_dmadesc_meta *meta, gfp_t gfp_flags)
 {
-        struct b43_rxhdr_fw4 *rxhdr;
        dma_addr_t dmaaddr;
        struct sk_buff *skb;
@@ -568,6 +589,7 @@ static int setup_rx_descbuffer(struct b43_dmaring *ring,
        skb = __dev_alloc_skb(ring->rx_buffersize, gfp_flags);
        if (unlikely(!skb))
                return -ENOMEM;
+        b43_poison_rx_buffer(ring, skb);
        dmaaddr = map_descbuffer(ring, skb->data, ring->rx_buffersize, 0);
        if (b43_dma_mapping_error(ring, dmaaddr, ring->rx_buffersize, 0)) {
                /* ugh. try to realloc in zone_dma */
@@ -578,6 +600,7 @@ static int setup_rx_descbuffer(struct b43_dmaring *ring,
                skb = __dev_alloc_skb(ring->rx_buffersize, gfp_flags);
                if (unlikely(!skb))
                        return -ENOMEM;
+                b43_poison_rx_buffer(ring, skb);
                dmaaddr = map_descbuffer(ring, skb->data,
                                         ring->rx_buffersize, 0);
                if (b43_dma_mapping_error(ring, dmaaddr, ring->rx_buffersize, 0)) {
@@ -592,9 +615,6 @@ static int setup_rx_descbuffer(struct b43_dmaring *ring,
        ring->ops->fill_descriptor(ring, desc, dmaaddr,
                                   ring->rx_buffersize, 0, 0, 0);
-        rxhdr = (struct b43_rxhdr_fw4 *)(skb->data);
-        rxhdr->frame_len = 0;
        return 0;
 }
@@ -1483,12 +1503,17 @@ static void dma_rx(struct b43_dmaring *ring, int *slot)
                        len = le16_to_cpu(rxhdr->frame_len);
                } while (len == 0 && i++ < 5);
                if (unlikely(len == 0)) {
-                        /* recycle the descriptor buffer. */
+                        dmaaddr = meta->dmaaddr;
-                        sync_descbuffer_for_device(ring, meta->dmaaddr,
+                        goto drop_recycle_buffer;
-                                                   ring->rx_buffersize);
-                        goto drop;
                }
        }
+        if (unlikely(b43_rx_buffer_is_poisoned(ring, skb))) {
+                /* Something went wrong with the DMA.
+                 * The device did not touch the buffer and did not overwrite the poison. */
+                b43dbg(ring->dev->wl, "DMA RX: Dropping poisoned buffer.\n");
+                dmaaddr = meta->dmaaddr;
+                goto drop_recycle_buffer;
+        }
        if (unlikely(len > ring->rx_buffersize)) {
                /* The data did not fit into one descriptor buffer
                 * and is split over multiple buffers.
@@ -1501,6 +1526,7 @@ static void dma_rx(struct b43_dmaring *ring, int *slot)
                while (1) {
                        desc = ops->idx2desc(ring, *slot, &meta);
                        /* recycle the descriptor buffer. */
+                        b43_poison_rx_buffer(ring, meta->skb);
                        sync_descbuffer_for_device(ring, meta->dmaaddr,
                                                   ring->rx_buffersize);
                        *slot = next_slot(ring, *slot);
@@ -1519,8 +1545,7 @@ static void dma_rx(struct b43_dmaring *ring, int *slot)
        err = setup_rx_descbuffer(ring, desc, meta, GFP_ATOMIC);
        if (unlikely(err)) {
                b43dbg(ring->dev->wl, "DMA RX: setup_rx_descbuffer() failed\n");
-                sync_descbuffer_for_device(ring, dmaaddr, ring->rx_buffersize);
+                goto drop_recycle_buffer;
-                goto drop;
        }
        unmap_descbuffer(ring, dmaaddr, ring->rx_buffersize, 0);
@@ -1530,6 +1555,11 @@ static void dma_rx(struct b43_dmaring *ring, int *slot)
        b43_rx(ring->dev, skb, rxhdr);
 drop:
        return;
+drop_recycle_buffer:
+        /* Poison and recycle the RX buffer. */
+        b43_poison_rx_buffer(ring, skb);
+        sync_descbuffer_for_device(ring, dmaaddr, ring->rx_buffersize);
 }
 void b43_dma_rx(struct b43_dmaring *ring)
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index 4896e0831114..79b685e300c7 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -3974,6 +3974,11 @@ static void setup_struct_phy_for_init(struct b43_wldev *dev,
        phy->next_txpwr_check_time = jiffies;
        /* PHY TX errors counter. */
        atomic_set(&phy->txerr_cnt, B43_PHY_TX_BADNESS_LIMIT);
+#if B43_DEBUG
+        phy->phy_locked = 0;
+        phy->radio_locked = 0;
+#endif
 }
 static void setup_struct_wldev_for_init(struct b43_wldev *dev)
diff --git a/drivers/net/wireless/b43/phy_common.c b/drivers/net/wireless/b43/phy_common.c
index 026b61c03fb9..e176b6e0d9cf 100644
--- a/drivers/net/wireless/b43/phy_common.c
+++ b/drivers/net/wireless/b43/phy_common.c
@@ -131,12 +131,16 @@ void b43_radio_lock(struct b43_wldev *dev)
 {
        u32 macctl;
+#if B43_DEBUG
+        B43_WARN_ON(dev->phy.radio_locked);
+        dev->phy.radio_locked = 1;
+#endif
        macctl = b43_read32(dev, B43_MMIO_MACCTL);
-        B43_WARN_ON(macctl & B43_MACCTL_RADIOLOCK);
        macctl |= B43_MACCTL_RADIOLOCK;
        b43_write32(dev, B43_MMIO_MACCTL, macctl);
-        /* Commit the write and wait for the device
+        /* Commit the write and wait for the firmware
-         * to exit any radio register access. */
+         * to finish any radio register access. */
        b43_read32(dev, B43_MMIO_MACCTL);
        udelay(10);
 }
@@ -145,11 +149,15 @@ void b43_radio_unlock(struct b43_wldev *dev)
 {
        u32 macctl;
+#if B43_DEBUG
+        B43_WARN_ON(!dev->phy.radio_locked);
+        dev->phy.radio_locked = 0;
+#endif
        /* Commit any write */
        b43_read16(dev, B43_MMIO_PHY_VER);
        /* unlock */
        macctl = b43_read32(dev, B43_MMIO_MACCTL);
-        B43_WARN_ON(!(macctl & B43_MACCTL_RADIOLOCK));
        macctl &= ~B43_MACCTL_RADIOLOCK;
        b43_write32(dev, B43_MMIO_MACCTL, macctl);
 }
diff --git a/drivers/net/wireless/b43/phy_common.h b/drivers/net/wireless/b43/phy_common.h
index c9f5430d1d7d..b2d99101947b 100644
--- a/drivers/net/wireless/b43/phy_common.h
+++ b/drivers/net/wireless/b43/phy_common.h
@@ -245,8 +245,10 @@ struct b43_phy {
        atomic_t txerr_cnt;
 #ifdef CONFIG_B43_DEBUG
-        /* PHY registers locked by b43_phy_lock()? */
+        /* PHY registers locked (w.r.t. firmware) */
        bool phy_locked;
+        /* Radio registers locked (w.r.t. firmware) */
+        bool radio_locked;
 #endif /* B43_DEBUG */
 };
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945.c b/drivers/net/wireless/iwlwifi/iwl-3945.c
index 2399328e8de7..527525cc0919 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945.c
+++ b/drivers/net/wireless/iwlwifi/iwl-3945.c
@@ -1192,7 +1192,7 @@ int iwl3945_hw_nic_init(struct iwl_priv *priv)
                        return -ENOMEM;
                }
        } else
-                iwl_rx_queue_reset(priv, rxq);
+                iwl3945_rx_queue_reset(priv, rxq);
        iwl3945_rx_replenish(priv);
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945.h b/drivers/net/wireless/iwlwifi/iwl-3945.h
index ab7aaf6872c7..55188844657b 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945.h
+++ b/drivers/net/wireless/iwlwifi/iwl-3945.h
@@ -215,6 +215,7 @@ extern int iwl3945_calc_sig_qual(int rssi_dbm, int noise_dbm);
 extern int iwl3945_tx_queue_init(struct iwl_priv *priv,
                             struct iwl_tx_queue *txq, int count, u32 id);
 extern void iwl3945_rx_replenish(void *data);
+extern void iwl3945_rx_queue_reset(struct iwl_priv *priv, struct iwl_rx_queue *rxq);
 extern void iwl3945_tx_queue_free(struct iwl_priv *priv, struct iwl_tx_queue *txq);
 extern int iwl3945_send_cmd_pdu(struct iwl_priv *priv, u8 id, u16 len,
                            const void *data);
diff --git a/drivers/net/wireless/iwlwifi/iwl-5000.c b/drivers/net/wireless/iwlwifi/iwl-5000.c
index e5ca2511a81a..9452461ce864 100644
--- a/drivers/net/wireless/iwlwifi/iwl-5000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-5000.c
@@ -46,7 +46,7 @@
 #include "iwl-6000-hw.h"
 /* Highest firmware API version supported */
-#define IWL5000_UCODE_API_MAX 1
+#define IWL5000_UCODE_API_MAX 2
 #define IWL5150_UCODE_API_MAX 2
 /* Lowest firmware API version supported */
diff --git a/drivers/net/wireless/iwlwifi/iwl-6000.c b/drivers/net/wireless/iwlwifi/iwl-6000.c
index edfa5e149f71..bd438d8acf55 100644
--- a/drivers/net/wireless/iwlwifi/iwl-6000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-6000.c
@@ -101,8 +101,8 @@ struct iwl_cfg iwl6000_2agn_cfg = {
        .eeprom_ver = EEPROM_5000_EEPROM_VERSION,
        .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
        .mod_params = &iwl50_mod_params,
-        .valid_tx_ant = ANT_BC,
+        .valid_tx_ant = ANT_AB,
-        .valid_rx_ant = ANT_BC,
+        .valid_rx_ant = ANT_AB,
        .need_pll_cfg = false,
 };
@@ -117,8 +117,8 @@ struct iwl_cfg iwl6050_2agn_cfg = {
        .eeprom_ver = EEPROM_5000_EEPROM_VERSION,
        .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
        .mod_params = &iwl50_mod_params,
-        .valid_tx_ant = ANT_BC,
+        .valid_tx_ant = ANT_AB,
-        .valid_rx_ant = ANT_BC,
+        .valid_rx_ant = ANT_AB,
        .need_pll_cfg = false,
 };
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index 3889158b359c..f46ba2475776 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -669,13 +669,6 @@ static int iwl_set_mode(struct iwl_priv *priv, int mode)
        if (!iwl_is_ready_rf(priv))
                return -EAGAIN;
-        cancel_delayed_work(&priv->scan_check);
-        if (iwl_scan_cancel_timeout(priv, 100)) {
-                IWL_WARN(priv, "Aborted scan still in progress after 100ms\n");
-                IWL_DEBUG_MAC80211(priv, "leaving - scan abort failed.\n");
-                return -EAGAIN;
-        }
        iwl_commit_rxon(priv);
        return 0;
@@ -976,11 +969,9 @@ void iwl_rx_handle(struct iwl_priv *priv)
                rxq->queue[i] = NULL;
-                dma_sync_single_range_for_cpu(
+                pci_unmap_single(priv->pci_dev, rxb->real_dma_addr,
-                                &priv->pci_dev->dev, rxb->real_dma_addr,
+                                 priv->hw_params.rx_buf_size + 256,
-                                rxb->aligned_dma_addr - rxb->real_dma_addr,
+                                 PCI_DMA_FROMDEVICE);
-                                priv->hw_params.rx_buf_size,
-                                PCI_DMA_FROMDEVICE);
                pkt = (struct iwl_rx_packet *)rxb->skb->data;
                /* Reclaim a command buffer only if this packet is a response
@@ -1031,9 +1022,6 @@ void iwl_rx_handle(struct iwl_priv *priv)
                        rxb->skb = NULL;
                }
-                pci_unmap_single(priv->pci_dev, rxb->real_dma_addr,
-                                 priv->hw_params.rx_buf_size + 256,
-                                 PCI_DMA_FROMDEVICE);
                spin_lock_irqsave(&rxq->lock, flags);
                list_add_tail(&rxb->list, &priv->rxq.rx_used);
                spin_unlock_irqrestore(&rxq->lock, flags);
@@ -3641,7 +3629,9 @@ static struct pci_device_id iwl_hw_card_ids[] = {
        {IWL_PCI_DEVICE(0x0085, 0x1112, iwl6000_2ag_cfg)},
        {IWL_PCI_DEVICE(0x0082, 0x1122, iwl6000_2ag_cfg)},
        {IWL_PCI_DEVICE(0x422B, PCI_ANY_ID, iwl6000_3agn_cfg)},
+        {IWL_PCI_DEVICE(0x422C, PCI_ANY_ID, iwl6000_2agn_cfg)},
        {IWL_PCI_DEVICE(0x4238, PCI_ANY_ID, iwl6000_3agn_cfg)},
+        {IWL_PCI_DEVICE(0x4239, PCI_ANY_ID, iwl6000_2agn_cfg)},
        {IWL_PCI_DEVICE(0x0082, PCI_ANY_ID, iwl6000_2agn_cfg)},
        {IWL_PCI_DEVICE(0x0085, PCI_ANY_ID, iwl6000_3agn_cfg)},
        {IWL_PCI_DEVICE(0x0086, PCI_ANY_ID, iwl6050_3agn_cfg)},
diff --git a/drivers/net/wireless/iwlwifi/iwl-csr.h b/drivers/net/wireless/iwlwifi/iwl-csr.h
index 2f1242447b3b..6e983149b83b 100644
--- a/drivers/net/wireless/iwlwifi/iwl-csr.h
+++ b/drivers/net/wireless/iwlwifi/iwl-csr.h
@@ -223,7 +223,7 @@
 #define CSR_EEPROM_REG_MSK_DATA         (0xFFFF0000)
 /* EEPROM GP */
-#define CSR_EEPROM_GP_VALID_MSK         (0x00000006)
+#define CSR_EEPROM_GP_VALID_MSK         (0x00000007)
 #define CSR_EEPROM_GP_BAD_SIGNATURE     (0x00000000)
 #define CSR_EEPROM_GP_IF_OWNER_MSK      (0x00000180)
diff --git a/drivers/net/wireless/iwlwifi/iwl-dev.h b/drivers/net/wireless/iwlwifi/iwl-dev.h
index ec9a13846edd..cf7f0db58fcf 100644
--- a/drivers/net/wireless/iwlwifi/iwl-dev.h
+++ b/drivers/net/wireless/iwlwifi/iwl-dev.h
@@ -360,12 +360,16 @@ struct iwl_host_cmd {
 /**
 * struct iwl_rx_queue - Rx queue
+ * @bd: driver's pointer to buffer of receive buffer descriptors (rbd)
+ * @dma_addr: bus address of buffer of receive buffer descriptors (rbd)
 * @read: Shared index to newest available Rx buffer
 * @write: Shared index to oldest written Rx packet
 * @free_count: Number of pre-allocated buffers in rx_free
 * @rx_free: list of free SKBs for use
 * @rx_used: List of Rx buffers with no SKB
 * @need_update: flag to indicate we need to update read/write index
+ * @rb_stts: driver's pointer to receive buffer status
+ * @rb_stts_dma: bus address of receive buffer status
 *
 * NOTE:  rx_free and rx_used are used as a FIFO for iwl_rx_mem_buffers
 */
diff --git a/drivers/net/wireless/iwlwifi/iwl-scan.c b/drivers/net/wireless/iwlwifi/iwl-scan.c
index 23644cf884f1..6330b91e37ce 100644
--- a/drivers/net/wireless/iwlwifi/iwl-scan.c
+++ b/drivers/net/wireless/iwlwifi/iwl-scan.c
@@ -227,9 +227,6 @@ static void iwl_rx_scan_complete_notif(struct iwl_priv *priv,
        /* The HW is no longer scanning */
        clear_bit(STATUS_SCAN_HW, &priv->status);
-        /* The scan completion notification came in, so kill that timer... */
-        cancel_delayed_work(&priv->scan_check);
        IWL_DEBUG_INFO(priv, "Scan pass on %sGHz took %dms\n",
                       (priv->scan_bands & BIT(IEEE80211_BAND_2GHZ)) ?
                                                "2.4" : "5.2",
@@ -712,6 +709,8 @@ static void iwl_bg_request_scan(struct work_struct *data)
        mutex_lock(&priv->mutex);
+        cancel_delayed_work(&priv->scan_check);
        if (!iwl_is_ready(priv)) {
                IWL_WARN(priv, "request scan called when driver not ready.\n");
                goto done;
@@ -925,11 +924,13 @@ void iwl_bg_scan_completed(struct work_struct *work)
        IWL_DEBUG_SCAN(priv, "SCAN complete scan\n");
-        if (test_bit(STATUS_EXIT_PENDING, &priv->status))
+        cancel_delayed_work(&priv->scan_check);
-                return;
        ieee80211_scan_completed(priv->hw, false);
+        if (test_bit(STATUS_EXIT_PENDING, &priv->status))
+                return;
        /* Since setting the TXPOWER may have been deferred while
         * performing the scan, fire one off */
        mutex_lock(&priv->mutex);
diff --git a/drivers/net/wireless/iwlwifi/iwl-sta.c b/drivers/net/wireless/iwlwifi/iwl-sta.c
index 5798fe49c771..44ab03a12e40 100644
--- a/drivers/net/wireless/iwlwifi/iwl-sta.c
+++ b/drivers/net/wireless/iwlwifi/iwl-sta.c
@@ -719,6 +719,14 @@ static int iwl_set_tkip_dynamic_key_info(struct iwl_priv *priv,
 {
        unsigned long flags;
        int ret = 0;
+        __le16 key_flags = 0;
+        key_flags |= (STA_KEY_FLG_TKIP | STA_KEY_FLG_MAP_KEY_MSK);
+        key_flags |= cpu_to_le16(keyconf->keyidx << STA_KEY_FLG_KEYID_POS);
+        key_flags &= ~STA_KEY_FLG_INVALID;
+        if (sta_id == priv->hw_params.bcast_sta_id)
+                key_flags |= STA_KEY_MULTICAST_MSK;
        keyconf->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
        keyconf->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIC;
@@ -738,6 +746,9 @@ static int iwl_set_tkip_dynamic_key_info(struct iwl_priv *priv,
        WARN(priv->stations[sta_id].sta.key.key_offset == WEP_INVALID_OFFSET,
                "no space for a new key");
+        priv->stations[sta_id].sta.key.key_flags = key_flags;
        /* This copy is acutally not needed: we get the key with each TX */
        memcpy(priv->stations[sta_id].keyinfo.key, keyconf->key, 16);
@@ -754,9 +765,7 @@ void iwl_update_tkip_key(struct iwl_priv *priv,
 {
        u8 sta_id = IWL_INVALID_STATION;
        unsigned long flags;
-        __le16 key_flags = 0;
        int i;
-        DECLARE_MAC_BUF(mac);
        sta_id = iwl_find_station(priv, addr);
        if (sta_id == IWL_INVALID_STATION) {
@@ -771,16 +780,8 @@ void iwl_update_tkip_key(struct iwl_priv *priv,
                return;
        }
-        key_flags |= (STA_KEY_FLG_TKIP | STA_KEY_FLG_MAP_KEY_MSK);
-        key_flags |= cpu_to_le16(keyconf->keyidx << STA_KEY_FLG_KEYID_POS);
-        key_flags &= ~STA_KEY_FLG_INVALID;
-        if (sta_id == priv->hw_params.bcast_sta_id)
-                key_flags |= STA_KEY_MULTICAST_MSK;
        spin_lock_irqsave(&priv->sta_lock, flags);
-        priv->stations[sta_id].sta.key.key_flags = key_flags;
        priv->stations[sta_id].sta.key.tkip_rx_tsc_byte2 = (u8) iv32;
        for (i = 0; i < 5; i++)
diff --git a/drivers/net/wireless/iwlwifi/iwl-tx.c b/drivers/net/wireless/iwlwifi/iwl-tx.c
index 1f117a49c569..71d5b8a1a73e 100644
--- a/drivers/net/wireless/iwlwifi/iwl-tx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-tx.c
@@ -799,6 +799,22 @@ int iwl_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
        /* Copy MAC header from skb into command buffer */
        memcpy(tx_cmd->hdr, hdr, hdr_len);
+        /* Total # bytes to be transmitted */
+        len = (u16)skb->len;
+        tx_cmd->len = cpu_to_le16(len);
+        if (info->control.hw_key)
+                iwl_tx_cmd_build_hwcrypto(priv, info, tx_cmd, skb, sta_id);
+        /* TODO need this for burst mode later on */
+        iwl_tx_cmd_build_basic(priv, tx_cmd, info, hdr, sta_id);
+        /* set is_hcca to 0; it probably will never be implemented */
+        iwl_tx_cmd_build_rate(priv, tx_cmd, info, fc, sta_id, 0);
+        iwl_update_tx_stats(priv, le16_to_cpu(fc), len);
        /*
         * Use the first empty entry in this queue's command buffer array
         * to contain the Tx command and MAC header concatenated together
@@ -819,21 +835,30 @@ int iwl_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
        else
                len_org = 0;
+        /* Tell NIC about any 2-byte padding after MAC header */
+        if (len_org)
+                tx_cmd->tx_flags |= TX_CMD_FLG_MH_PAD_MSK;
        /* Physical address of this Tx command's header (not MAC header!),
         * within command buffer array. */
        txcmd_phys = pci_map_single(priv->pci_dev,
-                                    out_cmd, sizeof(struct iwl_cmd),
+                                    &out_cmd->hdr, len,
                                    PCI_DMA_BIDIRECTIONAL);
        pci_unmap_addr_set(&out_cmd->meta, mapping, txcmd_phys);
-        pci_unmap_len_set(&out_cmd->meta, len, sizeof(struct iwl_cmd));
+        pci_unmap_len_set(&out_cmd->meta, len, len);
        /* Add buffer containing Tx command and MAC(!) header to TFD's
         * first entry */
-        txcmd_phys += offsetof(struct iwl_cmd, hdr);
        priv->cfg->ops->lib->txq_attach_buf_to_tfd(priv, txq,
                                                   txcmd_phys, len, 1, 0);
-        if (info->control.hw_key)
+        if (!ieee80211_has_morefrags(hdr->frame_control)) {
-                iwl_tx_cmd_build_hwcrypto(priv, info, tx_cmd, skb, sta_id);
+                txq->need_update = 1;
+                if (qc)
+                        priv->stations[sta_id].tid[tid].seq_number = seq_number;
+        } else {
+                wait_write_ptr = 1;
+                txq->need_update = 0;
+        }
        /* Set up TFD's 2nd entry to point directly to remainder of skb,
         * if any (802.11 null frames have no payload). */
@@ -846,41 +871,29 @@ int iwl_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
                                                           0, 0);
        }
-        /* Tell NIC about any 2-byte padding after MAC header */
-        if (len_org)
-                tx_cmd->tx_flags |= TX_CMD_FLG_MH_PAD_MSK;
-        /* Total # bytes to be transmitted */
-        len = (u16)skb->len;
-        tx_cmd->len = cpu_to_le16(len);
-        /* TODO need this for burst mode later on */
-        iwl_tx_cmd_build_basic(priv, tx_cmd, info, hdr, sta_id);
-        /* set is_hcca to 0; it probably will never be implemented */
-        iwl_tx_cmd_build_rate(priv, tx_cmd, info, fc, sta_id, 0);
-        iwl_update_tx_stats(priv, le16_to_cpu(fc), len);
        scratch_phys = txcmd_phys + sizeof(struct iwl_cmd_header) +
-                offsetof(struct iwl_tx_cmd, scratch);
+                                offsetof(struct iwl_tx_cmd, scratch);
+        len = sizeof(struct iwl_tx_cmd) +
+                sizeof(struct iwl_cmd_header) + hdr_len;
+        /* take back ownership of DMA buffer to enable update */
+        pci_dma_sync_single_for_cpu(priv->pci_dev, txcmd_phys,
+                                    len, PCI_DMA_BIDIRECTIONAL);
        tx_cmd->dram_lsb_ptr = cpu_to_le32(scratch_phys);
        tx_cmd->dram_msb_ptr = iwl_get_dma_hi_addr(scratch_phys);
-        if (!ieee80211_has_morefrags(hdr->frame_control)) {
+        IWL_DEBUG_TX(priv, "sequence nr = 0X%x \n",
-                txq->need_update = 1;
+                     le16_to_cpu(out_cmd->hdr.sequence));
-                if (qc)
+        IWL_DEBUG_TX(priv, "tx_flags = 0X%x \n", le32_to_cpu(tx_cmd->tx_flags));
-                        priv->stations[sta_id].tid[tid].seq_number = seq_number;
-        } else {
-                wait_write_ptr = 1;
-                txq->need_update = 0;
-        }
        iwl_print_hex_dump(priv, IWL_DL_TX, (u8 *)tx_cmd, sizeof(*tx_cmd));
        iwl_print_hex_dump(priv, IWL_DL_TX, (u8 *)tx_cmd->hdr, hdr_len);
        /* Set up entry for this TFD in Tx byte-count array */
-        priv->cfg->ops->lib->txq_update_byte_cnt_tbl(priv, txq, len);
+        priv->cfg->ops->lib->txq_update_byte_cnt_tbl(priv, txq,
+                                                     le16_to_cpu(tx_cmd->len));
+        pci_dma_sync_single_for_device(priv->pci_dev, txcmd_phys,
+                                       len, PCI_DMA_BIDIRECTIONAL);
        /* Tell device the write index *just past* this latest filled TFD */
        q->write_ptr = iwl_queue_inc_wrap(q->write_ptr, q->n_bd);
@@ -968,18 +981,9 @@ int iwl_enqueue_hcmd(struct iwl_priv *priv, struct iwl_host_cmd *cmd)
                        INDEX_TO_SEQ(q->write_ptr));
        if (out_cmd->meta.flags & CMD_SIZE_HUGE)
                out_cmd->hdr.sequence |= SEQ_HUGE_FRAME;
-        len = (idx == TFD_CMD_SLOTS) ?
+        len = sizeof(struct iwl_cmd) - sizeof(struct iwl_cmd_meta);
-                        IWL_MAX_SCAN_SIZE : sizeof(struct iwl_cmd);
+        len += (idx == TFD_CMD_SLOTS) ?  IWL_MAX_SCAN_SIZE : 0;
-        phys_addr = pci_map_single(priv->pci_dev, out_cmd,
-                                   len, PCI_DMA_BIDIRECTIONAL);
-        pci_unmap_addr_set(&out_cmd->meta, mapping, phys_addr);
-        pci_unmap_len_set(&out_cmd->meta, len, len);
-        phys_addr += offsetof(struct iwl_cmd, hdr);
-        priv->cfg->ops->lib->txq_attach_buf_to_tfd(priv, txq,
-                                                   phys_addr, fix_size, 1,
-                                                   U32_PAD(cmd->len));
 #ifdef CONFIG_IWLWIFI_DEBUG
        switch (out_cmd->hdr.cmd) {
@@ -1007,6 +1011,15 @@ int iwl_enqueue_hcmd(struct iwl_priv *priv, struct iwl_host_cmd *cmd)
                /* Set up entry in queue's byte count circular buffer */
                priv->cfg->ops->lib->txq_update_byte_cnt_tbl(priv, txq, 0);
+        phys_addr = pci_map_single(priv->pci_dev, &out_cmd->hdr,
+                                   fix_size, PCI_DMA_BIDIRECTIONAL);
+        pci_unmap_addr_set(&out_cmd->meta, mapping, phys_addr);
+        pci_unmap_len_set(&out_cmd->meta, len, fix_size);
+        priv->cfg->ops->lib->txq_attach_buf_to_tfd(priv, txq,
+                                                   phys_addr, fix_size, 1,
+                                                   U32_PAD(cmd->len));
        /* Increment and update queue's write index */
        q->write_ptr = iwl_queue_inc_wrap(q->write_ptr, q->n_bd);
        ret = iwl_txq_update_write_ptr(priv, txq);
diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
index ce729281ff62..ff4d0e41d7c4 100644
--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -782,13 +782,6 @@ static int iwl3945_set_mode(struct iwl_priv *priv, int mode)
        if (!iwl_is_ready_rf(priv))
                return -EAGAIN;
-        cancel_delayed_work(&priv->scan_check);
-        if (iwl_scan_cancel_timeout(priv, 100)) {
-                IWL_WARN(priv, "Aborted scan still in progress after 100ms\n");
-                IWL_DEBUG_MAC80211(priv, "leaving - scan abort failed.\n");
-                return -EAGAIN;
-        }
        iwl3945_commit_rxon(priv);
        return 0;
@@ -972,7 +965,7 @@ static int iwl3945_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
        dma_addr_t phys_addr;
        dma_addr_t txcmd_phys;
        int txq_id = skb_get_queue_mapping(skb);
-        u16 len, idx, len_org, hdr_len;
+        u16 len, idx, len_org, hdr_len; /* TODO: len_org is not used */
        u8 id;
        u8 unicast;
        u8 sta_id;
@@ -1074,6 +1067,40 @@ static int iwl3945_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
        /* Copy MAC header from skb into command buffer */
        memcpy(tx->hdr, hdr, hdr_len);
+        if (info->control.hw_key)
+                iwl3945_build_tx_cmd_hwcrypto(priv, info, out_cmd, skb, sta_id);
+        /* TODO need this for burst mode later on */
+        iwl3945_build_tx_cmd_basic(priv, out_cmd, info, hdr, sta_id);
+        /* set is_hcca to 0; it probably will never be implemented */
+        iwl3945_hw_build_tx_cmd_rate(priv, out_cmd, info, hdr, sta_id, 0);
+        /* Total # bytes to be transmitted */
+        len = (u16)skb->len;
+        tx->len = cpu_to_le16(len);
+        tx->tx_flags &= ~TX_CMD_FLG_ANT_A_MSK;
+        tx->tx_flags &= ~TX_CMD_FLG_ANT_B_MSK;
+        if (!ieee80211_has_morefrags(hdr->frame_control)) {
+                txq->need_update = 1;
+                if (qc)
+                        priv->stations_39[sta_id].tid[tid].seq_number = seq_number;
+        } else {
+                wait_write_ptr = 1;
+                txq->need_update = 0;
+        }
+        IWL_DEBUG_TX(priv, "sequence nr = 0X%x \n",
+                     le16_to_cpu(out_cmd->hdr.sequence));
+        IWL_DEBUG_TX(priv, "tx_flags = 0X%x \n", le32_to_cpu(tx->tx_flags));
+        iwl_print_hex_dump(priv, IWL_DL_TX, tx, sizeof(*tx));
+        iwl_print_hex_dump(priv, IWL_DL_TX, (u8 *)tx->hdr,
+                           ieee80211_hdrlen(fc));
        /*
         * Use the first empty entry in this queue's command buffer array
         * to contain the Tx command and MAC header concatenated together
@@ -1096,22 +1123,18 @@ static int iwl3945_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
        /* Physical address of this Tx command's header (not MAC header!),
         * within command buffer array. */
-        txcmd_phys = pci_map_single(priv->pci_dev,
+        txcmd_phys = pci_map_single(priv->pci_dev, &out_cmd->hdr,
-                                    out_cmd, sizeof(struct iwl_cmd),
+                                    len, PCI_DMA_TODEVICE);
-                                    PCI_DMA_TODEVICE);
+        /* we do not map meta data ... so we can safely access address to
+         * provide to unmap command*/
        pci_unmap_addr_set(&out_cmd->meta, mapping, txcmd_phys);
-        pci_unmap_len_set(&out_cmd->meta, len, sizeof(struct iwl_cmd));
+        pci_unmap_len_set(&out_cmd->meta, len, len);
-        /* Add buffer containing Tx command and MAC(!) header to TFD's
-         * first entry */
-        txcmd_phys += offsetof(struct iwl_cmd, hdr);
        /* Add buffer containing Tx command and MAC(!) header to TFD's
         * first entry */
        priv->cfg->ops->lib->txq_attach_buf_to_tfd(priv, txq,
                                                   txcmd_phys, len, 1, 0);
-        if (info->control.hw_key)
-                iwl3945_build_tx_cmd_hwcrypto(priv, info, out_cmd, skb, sta_id);
        /* Set up TFD's 2nd entry to point directly to remainder of skb,
         * if any (802.11 null frames have no payload). */
@@ -1124,32 +1147,6 @@ static int iwl3945_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
                                                           0, U32_PAD(len));
        }
-        /* Total # bytes to be transmitted */
-        len = (u16)skb->len;
-        tx->len = cpu_to_le16(len);
-        /* TODO need this for burst mode later on */
-        iwl3945_build_tx_cmd_basic(priv, out_cmd, info, hdr, sta_id);
-        /* set is_hcca to 0; it probably will never be implemented */
-        iwl3945_hw_build_tx_cmd_rate(priv, out_cmd, info, hdr, sta_id, 0);
-        tx->tx_flags &= ~TX_CMD_FLG_ANT_A_MSK;
-        tx->tx_flags &= ~TX_CMD_FLG_ANT_B_MSK;
-        if (!ieee80211_has_morefrags(hdr->frame_control)) {
-                txq->need_update = 1;
-                if (qc)
-                        priv->stations_39[sta_id].tid[tid].seq_number = seq_number;
-        } else {
-                wait_write_ptr = 1;
-                txq->need_update = 0;
-        }
-        iwl_print_hex_dump(priv, IWL_DL_TX, tx, sizeof(*tx));
-        iwl_print_hex_dump(priv, IWL_DL_TX, (u8 *)tx->hdr,
-                           ieee80211_hdrlen(fc));
        /* Tell device the write index *just past* this latest filled TFD */
        q->write_ptr = iwl_queue_inc_wrap(q->write_ptr, q->n_bd);
@@ -1661,6 +1658,36 @@ static void iwl3945_rx_allocate(struct iwl_priv *priv)
        spin_unlock_irqrestore(&rxq->lock, flags);
 }
+void iwl3945_rx_queue_reset(struct iwl_priv *priv, struct iwl_rx_queue *rxq)
+{
+        unsigned long flags;
+        int i;
+        spin_lock_irqsave(&rxq->lock, flags);
+        INIT_LIST_HEAD(&rxq->rx_free);
+        INIT_LIST_HEAD(&rxq->rx_used);
+        /* Fill the rx_used queue with _all_ of the Rx buffers */
+        for (i = 0; i < RX_FREE_BUFFERS + RX_QUEUE_SIZE; i++) {
+                /* In the reset function, these buffers may have been allocated
+                 * to an SKB, so we need to unmap and free potential storage */
+                if (rxq->pool[i].skb != NULL) {
+                        pci_unmap_single(priv->pci_dev,
+                                         rxq->pool[i].real_dma_addr,
+                                         priv->hw_params.rx_buf_size,
+                                         PCI_DMA_FROMDEVICE);
+                        priv->alloc_rxb_skb--;
+                        dev_kfree_skb(rxq->pool[i].skb);
+                        rxq->pool[i].skb = NULL;
+                }
+                list_add_tail(&rxq->pool[i].list, &rxq->rx_used);
+        }
+        /* Set us so that we have processed and used all buffers, but have
+         * not restocked the Rx queue with fresh buffers */
+        rxq->read = rxq->write = 0;
+        rxq->free_count = 0;
+        spin_unlock_irqrestore(&rxq->lock, flags);
+}
 /*
 * this should be called while priv->lock is locked
 */
@@ -1685,6 +1712,33 @@ void iwl3945_rx_replenish(void *data)
        spin_unlock_irqrestore(&priv->lock, flags);
 }
+/* Assumes that the skb field of the buffers in 'pool' is kept accurate.
+ * If an SKB has been detached, the POOL needs to have its SKB set to NULL
+ * This free routine walks the list of POOL entries and if SKB is set to
+ * non NULL it is unmapped and freed
+ */
+static void iwl3945_rx_queue_free(struct iwl_priv *priv, struct iwl_rx_queue *rxq)
+{
+        int i;
+        for (i = 0; i < RX_QUEUE_SIZE + RX_FREE_BUFFERS; i++) {
+                if (rxq->pool[i].skb != NULL) {
+                        pci_unmap_single(priv->pci_dev,
+                                         rxq->pool[i].real_dma_addr,
+                                         priv->hw_params.rx_buf_size,
+                                         PCI_DMA_FROMDEVICE);
+                        dev_kfree_skb(rxq->pool[i].skb);
+                }
+        }
+        pci_free_consistent(priv->pci_dev, 4 * RX_QUEUE_SIZE, rxq->bd,
+                            rxq->dma_addr);
+        pci_free_consistent(priv->pci_dev, sizeof(struct iwl_rb_status),
+                            rxq->rb_stts, rxq->rb_stts_dma);
+        rxq->bd = NULL;
+        rxq->rb_stts  = NULL;
+}
 /* Convert linear signal-to-noise ratio into dB */
 static u8 ratio2dB[100] = {
 /*       0   1   2   3   4   5   6   7   8   9 */
@@ -1802,9 +1856,9 @@ static void iwl3945_rx_handle(struct iwl_priv *priv)
                rxq->queue[i] = NULL;
-                pci_dma_sync_single_for_cpu(priv->pci_dev, rxb->real_dma_addr,
+                pci_unmap_single(priv->pci_dev, rxb->real_dma_addr,
-                                            priv->hw_params.rx_buf_size,
+                                priv->hw_params.rx_buf_size,
-                                            PCI_DMA_FROMDEVICE);
+                                PCI_DMA_FROMDEVICE);
                pkt = (struct iwl_rx_packet *)rxb->skb->data;
                /* Reclaim a command buffer only if this packet is a response
@@ -1852,9 +1906,6 @@ static void iwl3945_rx_handle(struct iwl_priv *priv)
                        rxb->skb = NULL;
                }
-                pci_unmap_single(priv->pci_dev, rxb->real_dma_addr,
-                                priv->hw_params.rx_buf_size,
-                                PCI_DMA_FROMDEVICE);
                spin_lock_irqsave(&rxq->lock, flags);
                list_add_tail(&rxb->list, &priv->rxq.rx_used);
                spin_unlock_irqrestore(&rxq->lock, flags);
@@ -3240,6 +3291,8 @@ static void iwl3945_bg_request_scan(struct work_struct *data)
        mutex_lock(&priv->mutex);
+        cancel_delayed_work(&priv->scan_check);
        if (!iwl_is_ready(priv)) {
                IWL_WARN(priv, "request scan called when driver not ready.\n");
                goto done;
@@ -4075,7 +4128,7 @@ static int iwl3945_mac_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
        if (!static_key) {
                sta_id = iwl3945_hw_find_station(priv, addr);
                if (sta_id == IWL_INVALID_STATION) {
-                        IWL_DEBUG_MAC80211(priv, "leave - %pMnot in station map.\n",
+                        IWL_DEBUG_MAC80211(priv, "leave - %pM not in station map.\n",
                                            addr);
                        return -EINVAL;
                }
@@ -4913,6 +4966,8 @@ static int iwl3945_setup_mac(struct iwl_priv *priv)
        hw->wiphy->custom_regulatory = true;
+        hw->wiphy->max_scan_ssids = 1; /* WILL FIX */
        /* Default value; 4 EDCA QOS priorities */
        hw->queues = 4;
@@ -5194,12 +5249,12 @@ static void __devexit iwl3945_pci_remove(struct pci_dev *pdev)
        sysfs_remove_group(&pdev->dev.kobj, &iwl3945_attribute_group);
        iwl_rfkill_unregister(priv);
-        cancel_delayed_work(&priv->rfkill_poll);
+        cancel_delayed_work_sync(&priv->rfkill_poll);
        iwl3945_dealloc_ucode_pci(priv);
        if (priv->rxq.bd)
-                iwl_rx_queue_free(priv, &priv->rxq);
+                iwl3945_rx_queue_free(priv, &priv->rxq);
        iwl3945_hw_txq_ctx_free(priv);
        iwl3945_unset_hw_params(priv);
diff --git a/drivers/net/wireless/libertas/rx.c b/drivers/net/wireless/libertas/rx.c
index 63d7e19ce9bd..8e669775cb5d 100644
--- a/drivers/net/wireless/libertas/rx.c
+++ b/drivers/net/wireless/libertas/rx.c
@@ -170,6 +170,7 @@ int lbs_process_rxed_packet(struct lbs_private *priv, struct sk_buff *skb)
                lbs_deb_rx("rx err: frame received with bad length\n");
                dev->stats.rx_length_errors++;
                ret = 0;
+                dev_kfree_skb(skb);
                goto done;
        }
@@ -181,6 +182,7 @@ int lbs_process_rxed_packet(struct lbs_private *priv, struct sk_buff *skb)
                lbs_pr_alert("rxpd not ok\n");
                dev->stats.rx_errors++;
                ret = 0;
+                dev_kfree_skb(skb);
                goto done;
        }
diff --git a/drivers/net/wireless/mwl8k.c b/drivers/net/wireless/mwl8k.c
index 57a0268d1bae..a9a970469c2a 100644
--- a/drivers/net/wireless/mwl8k.c
+++ b/drivers/net/wireless/mwl8k.c
@@ -893,8 +893,7 @@ static int mwl8k_rxq_init(struct ieee80211_hw *hw, int index)
                rx_desc->next_rx_desc_phys_addr =
                        cpu_to_le32(rxq->rx_desc_dma
                                                + nexti * sizeof(*rx_desc));
-                rx_desc->rx_ctrl =
+                rx_desc->rx_ctrl = MWL8K_RX_CTRL_OWNED_BY_HOST;
-                        cpu_to_le32(MWL8K_RX_CTRL_OWNED_BY_HOST);
        }
        return 0;
@@ -3720,12 +3719,12 @@ err_free_reg:
        return rc;
 }
-static void __devexit mwl8k_remove(struct pci_dev *pdev)
+static void __devexit mwl8k_shutdown(struct pci_dev *pdev)
 {
        printk(KERN_ERR "===>%s(%u)\n", __func__, __LINE__);
 }
-static void __devexit mwl8k_shutdown(struct pci_dev *pdev)
+static void __devexit mwl8k_remove(struct pci_dev *pdev)
 {
        struct ieee80211_hw *hw = pci_get_drvdata(pdev);
        struct mwl8k_priv *priv;
diff --git a/drivers/net/wireless/orinoco/hw.c b/drivers/net/wireless/orinoco/hw.c
index 081428d9409e..632fac86a308 100644
--- a/drivers/net/wireless/orinoco/hw.c
+++ b/drivers/net/wireless/orinoco/hw.c
@@ -372,15 +372,13 @@ int __orinoco_hw_set_tkip_key(hermes_t *hw, int key_idx, int set_tx,
        }
        /* Wait upto 100ms for tx queue to empty */
-        k = 100;
+        for (k = 100; k > 0; k--) {
-        do {
-                k--;
                udelay(1000);
                ret = hermes_read_wordrec(hw, USER_BAP, HERMES_RID_TXQUEUEEMPTY,
                                          &xmitting);
-                if (ret)
+                if (ret || !xmitting)
                        break;
-        } while ((k > 0) && xmitting);
+        }
        if (k == 0)
                ret = -ETIMEDOUT;
diff --git a/drivers/net/wireless/p54/p54.h b/drivers/net/wireless/p54/p54.h
index 2dda5fe418b6..ecf8b6ed5a47 100644
--- a/drivers/net/wireless/p54/p54.h
+++ b/drivers/net/wireless/p54/p54.h
@@ -14,9 +14,9 @@
 * published by the Free Software Foundation.
 */
-#ifdef CONFIG_MAC80211_LEDS
+#ifdef CONFIG_P54_LEDS
 #include <linux/leds.h>
-#endif /* CONFIG_MAC80211_LEDS */
+#endif /* CONFIG_P54_LEDS */
 enum p54_control_frame_types {
        P54_CONTROL_TYPE_SETUP = 0,
@@ -116,7 +116,7 @@ enum fw_state {
        FW_STATE_RESETTING,
 };
-#ifdef CONFIG_MAC80211_LEDS
+#ifdef CONFIG_P54_LEDS
 #define P54_LED_MAX_NAME_LEN 31
@@ -129,7 +129,7 @@ struct p54_led_dev {
        unsigned int registered;
 };
-#endif /* CONFIG_MAC80211_LEDS */
+#endif /* CONFIG_P54_LEDS */
 struct p54_common {
        struct ieee80211_hw *hw;
@@ -177,10 +177,10 @@ struct p54_common {
        u8 privacy_caps;
        u8 rx_keycache_size;
        /* LED management */
-        #ifdef CONFIG_MAC80211_LEDS
+#ifdef CONFIG_P54_LEDS
        struct p54_led_dev assoc_led;
        struct p54_led_dev tx_led;
-        #endif /* CONFIG_MAC80211_LEDS */
+#endif /* CONFIG_P54_LEDS */
        u16 softled_state;              /* bit field of glowing LEDs */
 };
diff --git a/drivers/net/wireless/p54/p54common.c b/drivers/net/wireless/p54/p54common.c
index 0c1b0577d4ee..c8f0232ee5e0 100644
--- a/drivers/net/wireless/p54/p54common.c
+++ b/drivers/net/wireless/p54/p54common.c
@@ -2543,8 +2543,6 @@ struct ieee80211_hw *p54_init_common(size_t priv_data_len)
        priv->basic_rate_mask = 0x15f;
        skb_queue_head_init(&priv->tx_queue);
        dev->flags = IEEE80211_HW_RX_INCLUDES_FCS |
-                     IEEE80211_HW_SUPPORTS_PS |
-                     IEEE80211_HW_PS_NULLFUNC_STACK |
                     IEEE80211_HW_SIGNAL_DBM |
                     IEEE80211_HW_NOISE_DBM;
diff --git a/drivers/net/wireless/p54/p54spi.c b/drivers/net/wireless/p54/p54spi.c
index 2b222aaa6f0a..d1fe577de3d4 100644
--- a/drivers/net/wireless/p54/p54spi.c
+++ b/drivers/net/wireless/p54/p54spi.c
@@ -457,9 +457,10 @@ static int p54spi_wq_tx(struct p54s_priv *priv)
        struct ieee80211_tx_info *info;
        struct p54_tx_info *minfo;
        struct p54s_tx_info *dinfo;
+        unsigned long flags;
        int ret = 0;
-        spin_lock_bh(&priv->tx_lock);
+        spin_lock_irqsave(&priv->tx_lock, flags);
        while (!list_empty(&priv->tx_pending)) {
                entry = list_entry(priv->tx_pending.next,
@@ -467,7 +468,7 @@ static int p54spi_wq_tx(struct p54s_priv *priv)
                list_del_init(&entry->tx_list);
-                spin_unlock_bh(&priv->tx_lock);
+                spin_unlock_irqrestore(&priv->tx_lock, flags);
                dinfo = container_of((void *) entry, struct p54s_tx_info,
                                     tx_list);
@@ -479,16 +480,14 @@ static int p54spi_wq_tx(struct p54s_priv *priv)
                ret = p54spi_tx_frame(priv, skb);
-                spin_lock_bh(&priv->tx_lock);
                if (ret < 0) {
                        p54_free_skb(priv->hw, skb);
-                        goto out;
+                        return ret;
                }
-        }
-out:
+                spin_lock_irqsave(&priv->tx_lock, flags);
-        spin_unlock_bh(&priv->tx_lock);
+        }
+        spin_unlock_irqrestore(&priv->tx_lock, flags);
        return ret;
 }
@@ -498,12 +497,13 @@ static void p54spi_op_tx(struct ieee80211_hw *dev, struct sk_buff *skb)
        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
        struct p54_tx_info *mi = (struct p54_tx_info *) info->rate_driver_data;
        struct p54s_tx_info *di = (struct p54s_tx_info *) mi->data;
+        unsigned long flags;
        BUILD_BUG_ON(sizeof(*di) > sizeof((mi->data)));
-        spin_lock_bh(&priv->tx_lock);
+        spin_lock_irqsave(&priv->tx_lock, flags);
        list_add_tail(&di->tx_list, &priv->tx_pending);
-        spin_unlock_bh(&priv->tx_lock);
+        spin_unlock_irqrestore(&priv->tx_lock, flags);
        queue_work(priv->hw->workqueue, &priv->work);
 }
@@ -604,6 +604,7 @@ out:
 static void p54spi_op_stop(struct ieee80211_hw *dev)
 {
        struct p54s_priv *priv = dev->priv;
+        unsigned long flags;
        if (mutex_lock_interruptible(&priv->mutex)) {
                /* FIXME: how to handle this error? */
@@ -615,9 +616,9 @@ static void p54spi_op_stop(struct ieee80211_hw *dev)
        cancel_work_sync(&priv->work);
        p54spi_power_off(priv);
-        spin_lock_bh(&priv->tx_lock);
+        spin_lock_irqsave(&priv->tx_lock, flags);
        INIT_LIST_HEAD(&priv->tx_pending);
-        spin_unlock_bh(&priv->tx_lock);
+        spin_unlock_irqrestore(&priv->tx_lock, flags);
        priv->fw_state = FW_STATE_OFF;
        mutex_unlock(&priv->mutex);
diff --git a/drivers/net/wireless/p54/p54usb.c b/drivers/net/wireless/p54/p54usb.c
index da6640afc835..6cc6cbc9234f 100644
--- a/drivers/net/wireless/p54/p54usb.c
+++ b/drivers/net/wireless/p54/p54usb.c
@@ -71,6 +71,7 @@ static struct usb_device_id p54u_table[] __devinitdata = {
        {USB_DEVICE(0x1260, 0xee22)},   /* SMC 2862W-G version 2 */
        {USB_DEVICE(0x13b1, 0x000a)},   /* Linksys WUSB54G ver 2 */
        {USB_DEVICE(0x13B1, 0x000C)},   /* Linksys WUSB54AG */
+        {USB_DEVICE(0x1413, 0x5400)},   /* Telsey 802.11g USB2.0 Adapter */
        {USB_DEVICE(0x1435, 0x0427)},   /* Inventel UR054G */
        {USB_DEVICE(0x2001, 0x3704)},   /* DLink DWL-G122 rev A2 */
        {USB_DEVICE(0x413c, 0x8102)},   /* Spinnaker DUT */
diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c
index db91db776508..bebf735cd4bd 100644
--- a/drivers/net/wireless/rndis_wlan.c
+++ b/drivers/net/wireless/rndis_wlan.c
@@ -2558,6 +2558,11 @@ static int rndis_wext_bind(struct usbnet *usbdev, struct usb_interface *intf)
        mutex_init(&priv->command_lock);
        spin_lock_init(&priv->stats_lock);
+        /* because rndis_command() sleeps we need to use workqueue */
+        priv->workqueue = create_singlethread_workqueue("rndis_wlan");
+        INIT_WORK(&priv->work, rndis_wext_worker);
+        INIT_DELAYED_WORK(&priv->stats_work, rndis_update_wireless_stats);
        /* try bind rndis_host */
        retval = generic_rndis_bind(usbdev, intf, FLAG_RNDIS_PHYM_WIRELESS);
        if (retval < 0)
@@ -2603,16 +2608,17 @@ static int rndis_wext_bind(struct usbnet *usbdev, struct usb_interface *intf)
        disassociate(usbdev, 1);
        netif_carrier_off(usbdev->net);
-        /* because rndis_command() sleeps we need to use workqueue */
-        priv->workqueue = create_singlethread_workqueue("rndis_wlan");
-        INIT_DELAYED_WORK(&priv->stats_work, rndis_update_wireless_stats);
        queue_delayed_work(priv->workqueue, &priv->stats_work,
                round_jiffies_relative(STATS_UPDATE_JIFFIES));
-        INIT_WORK(&priv->work, rndis_wext_worker);
        return 0;
 fail:
+        cancel_delayed_work_sync(&priv->stats_work);
+        cancel_work_sync(&priv->work);
+        flush_workqueue(priv->workqueue);
+        destroy_workqueue(priv->workqueue);
        kfree(priv);
        return retval;
 }
diff --git a/drivers/net/wireless/rt2x00/rt2x00debug.c b/drivers/net/wireless/rt2x00/rt2x00debug.c
index 07d378ef0b46..7b3ee8c2eaef 100644
--- a/drivers/net/wireless/rt2x00/rt2x00debug.c
+++ b/drivers/net/wireless/rt2x00/rt2x00debug.c
@@ -138,7 +138,7 @@ void rt2x00debug_update_crypto(struct rt2x00_dev *rt2x00dev,
        if (cipher == CIPHER_TKIP_NO_MIC)
                cipher = CIPHER_TKIP;
-        if (cipher == CIPHER_NONE || cipher > CIPHER_MAX)
+        if (cipher == CIPHER_NONE || cipher >= CIPHER_MAX)
                return;
        /* Remove CIPHER_NONE index */
diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
index 05f94e21b423..5752aaae906b 100644
--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
@@ -646,10 +646,8 @@ static int rt2x00lib_probe_hw(struct rt2x00_dev *rt2x00dev)
         * Register HW.
         */
        status = ieee80211_register_hw(rt2x00dev->hw);
-        if (status) {
+        if (status)
-                rt2x00lib_remove_hw(rt2x00dev);
                return status;
-        }
        set_bit(DEVICE_STATE_REGISTERED_HW, &rt2x00dev->flags);
diff --git a/drivers/net/wireless/rt2x00/rt2x00pci.c b/drivers/net/wireless/rt2x00/rt2x00pci.c
index 43fa0f849003..9730b4f8fd26 100644
--- a/drivers/net/wireless/rt2x00/rt2x00pci.c
+++ b/drivers/net/wireless/rt2x00/rt2x00pci.c
@@ -369,8 +369,6 @@ int rt2x00pci_suspend(struct pci_dev *pci_dev, pm_message_t state)
        if (retval)
                return retval;
-        rt2x00pci_free_reg(rt2x00dev);
        pci_save_state(pci_dev);
        pci_disable_device(pci_dev);
        return pci_set_power_state(pci_dev, pci_choose_state(pci_dev, state));
@@ -381,7 +379,6 @@ int rt2x00pci_resume(struct pci_dev *pci_dev)
 {
        struct ieee80211_hw *hw = pci_get_drvdata(pci_dev);
        struct rt2x00_dev *rt2x00dev = hw->priv;
-        int retval;
        if (pci_set_power_state(pci_dev, PCI_D0) ||
            pci_enable_device(pci_dev) ||
@@ -390,20 +387,7 @@ int rt2x00pci_resume(struct pci_dev *pci_dev)
                return -EIO;
        }
-        retval = rt2x00pci_alloc_reg(rt2x00dev);
+        return rt2x00lib_resume(rt2x00dev);
-        if (retval)
-                return retval;
-        retval = rt2x00lib_resume(rt2x00dev);
-        if (retval)
-                goto exit_free_reg;
-        return 0;
-exit_free_reg:
-        rt2x00pci_free_reg(rt2x00dev);
-        return retval;
 }
 EXPORT_SYMBOL_GPL(rt2x00pci_resume);
 #endif /* CONFIG_PM */
diff --git a/drivers/net/wireless/rt2x00/rt2x00usb.c b/drivers/net/wireless/rt2x00/rt2x00usb.c
index 7d50ca82375e..501544882c2c 100644
--- a/drivers/net/wireless/rt2x00/rt2x00usb.c
+++ b/drivers/net/wireless/rt2x00/rt2x00usb.c
@@ -702,8 +702,6 @@ int rt2x00usb_suspend(struct usb_interface *usb_intf, pm_message_t state)
        if (retval)
                return retval;
-        rt2x00usb_free_reg(rt2x00dev);
        /*
         * Decrease usbdev refcount.
         */
@@ -717,24 +715,10 @@ int rt2x00usb_resume(struct usb_interface *usb_intf)
 {
        struct ieee80211_hw *hw = usb_get_intfdata(usb_intf);
        struct rt2x00_dev *rt2x00dev = hw->priv;
-        int retval;
        usb_get_dev(interface_to_usbdev(usb_intf));
-        retval = rt2x00usb_alloc_reg(rt2x00dev);
+        return rt2x00lib_resume(rt2x00dev);
-        if (retval)
-                return retval;
-        retval = rt2x00lib_resume(rt2x00dev);
-        if (retval)
-                goto exit_free_reg;
-        return 0;
-exit_free_reg:
-        rt2x00usb_free_reg(rt2x00dev);
-        return retval;
 }
 EXPORT_SYMBOL_GPL(rt2x00usb_resume);
 #endif /* CONFIG_PM */
diff --git a/drivers/net/wireless/rt2x00/rt73usb.c b/drivers/net/wireless/rt2x00/rt73usb.c
index 420fff42c0dd..853b2b279b64 100644
--- a/drivers/net/wireless/rt2x00/rt73usb.c
+++ b/drivers/net/wireless/rt2x00/rt73usb.c
@@ -2369,6 +2369,8 @@ static struct usb_device_id rt73usb_device_table[] = {
        /* Buffalo */
        { USB_DEVICE(0x0411, 0x00d8), USB_DEVICE_DATA(&rt73usb_ops) },
        { USB_DEVICE(0x0411, 0x00f4), USB_DEVICE_DATA(&rt73usb_ops) },
+        { USB_DEVICE(0x0411, 0x0116), USB_DEVICE_DATA(&rt73usb_ops) },
+        { USB_DEVICE(0x0411, 0x0119), USB_DEVICE_DATA(&rt73usb_ops) },
        /* CNet */
        { USB_DEVICE(0x1371, 0x9022), USB_DEVICE_DATA(&rt73usb_ops) },
        { USB_DEVICE(0x1371, 0x9032), USB_DEVICE_DATA(&rt73usb_ops) },
diff --git a/drivers/net/wireless/rtl818x/rtl8187.h b/drivers/net/wireless/rtl818x/rtl8187.h
index 9718f61809cf..edeff82a4d06 100644
--- a/drivers/net/wireless/rtl818x/rtl8187.h
+++ b/drivers/net/wireless/rtl818x/rtl8187.h
@@ -120,6 +120,12 @@ struct rtl8187_priv {
                __le64 buf;
                struct sk_buff_head queue;
        } b_tx_status; /* This queue is used by both -b and non-b devices */
+        struct mutex io_mutex;
+        union {
+                u8 bits8;
+                __le16 bits16;
+                __le32 bits32;
+        } *io_dmabuf;
 };
 void rtl8187_write_phy(struct ieee80211_hw *dev, u8 addr, u32 data);
@@ -129,10 +135,14 @@ static inline u8 rtl818x_ioread8_idx(struct rtl8187_priv *priv,
 {
        u8 val;
+        mutex_lock(&priv->io_mutex);
        usb_control_msg(priv->udev, usb_rcvctrlpipe(priv->udev, 0),
                        RTL8187_REQ_GET_REG, RTL8187_REQT_READ,
-                        (unsigned long)addr, idx & 0x03, &val,
+                        (unsigned long)addr, idx & 0x03,
-                        sizeof(val), HZ / 2);
+                        &priv->io_dmabuf->bits8, sizeof(val), HZ / 2);
+        val = priv->io_dmabuf->bits8;
+        mutex_unlock(&priv->io_mutex);
        return val;
 }
@@ -147,10 +157,14 @@ static inline u16 rtl818x_ioread16_idx(struct rtl8187_priv *priv,
 {
        __le16 val;
+        mutex_lock(&priv->io_mutex);
        usb_control_msg(priv->udev, usb_rcvctrlpipe(priv->udev, 0),
                        RTL8187_REQ_GET_REG, RTL8187_REQT_READ,
-                        (unsigned long)addr, idx & 0x03, &val,
+                        (unsigned long)addr, idx & 0x03,
-                        sizeof(val), HZ / 2);
+                        &priv->io_dmabuf->bits16, sizeof(val), HZ / 2);
+        val = priv->io_dmabuf->bits16;
+        mutex_unlock(&priv->io_mutex);
        return le16_to_cpu(val);
 }
@@ -165,10 +179,14 @@ static inline u32 rtl818x_ioread32_idx(struct rtl8187_priv *priv,
 {
        __le32 val;
+        mutex_lock(&priv->io_mutex);
        usb_control_msg(priv->udev, usb_rcvctrlpipe(priv->udev, 0),
                        RTL8187_REQ_GET_REG, RTL8187_REQT_READ,
-                        (unsigned long)addr, idx & 0x03, &val,
+                        (unsigned long)addr, idx & 0x03,
-                        sizeof(val), HZ / 2);
+                        &priv->io_dmabuf->bits32, sizeof(val), HZ / 2);
+        val = priv->io_dmabuf->bits32;
+        mutex_unlock(&priv->io_mutex);
        return le32_to_cpu(val);
 }
@@ -181,10 +199,15 @@ static inline u32 rtl818x_ioread32(struct rtl8187_priv *priv, __le32 *addr)
 static inline void rtl818x_iowrite8_idx(struct rtl8187_priv *priv,
                                        u8 *addr, u8 val, u8 idx)
 {
+        mutex_lock(&priv->io_mutex);
+        priv->io_dmabuf->bits8 = val;
        usb_control_msg(priv->udev, usb_sndctrlpipe(priv->udev, 0),
                        RTL8187_REQ_SET_REG, RTL8187_REQT_WRITE,
-                        (unsigned long)addr, idx & 0x03, &val,
+                        (unsigned long)addr, idx & 0x03,
-                        sizeof(val), HZ / 2);
+                        &priv->io_dmabuf->bits8, sizeof(val), HZ / 2);
+        mutex_unlock(&priv->io_mutex);
 }
 static inline void rtl818x_iowrite8(struct rtl8187_priv *priv, u8 *addr, u8 val)
@@ -195,12 +218,15 @@ static inline void rtl818x_iowrite8(struct rtl8187_priv *priv, u8 *addr, u8 val)
 static inline void rtl818x_iowrite16_idx(struct rtl8187_priv *priv,
                                         __le16 *addr, u16 val, u8 idx)
 {
-        __le16 buf = cpu_to_le16(val);
+        mutex_lock(&priv->io_mutex);
+        priv->io_dmabuf->bits16 = cpu_to_le16(val);
        usb_control_msg(priv->udev, usb_sndctrlpipe(priv->udev, 0),
                        RTL8187_REQ_SET_REG, RTL8187_REQT_WRITE,
-                        (unsigned long)addr, idx & 0x03, &buf, sizeof(buf),
+                        (unsigned long)addr, idx & 0x03,
-                        HZ / 2);
+                        &priv->io_dmabuf->bits16, sizeof(val), HZ / 2);
+        mutex_unlock(&priv->io_mutex);
 }
 static inline void rtl818x_iowrite16(struct rtl8187_priv *priv, __le16 *addr,
@@ -212,12 +238,15 @@ static inline void rtl818x_iowrite16(struct rtl8187_priv *priv, __le16 *addr,
 static inline void rtl818x_iowrite32_idx(struct rtl8187_priv *priv,
                                         __le32 *addr, u32 val, u8 idx)
 {
-        __le32 buf = cpu_to_le32(val);
+        mutex_lock(&priv->io_mutex);
+        priv->io_dmabuf->bits32 = cpu_to_le32(val);
        usb_control_msg(priv->udev, usb_sndctrlpipe(priv->udev, 0),
                        RTL8187_REQ_SET_REG, RTL8187_REQT_WRITE,
-                        (unsigned long)addr, idx & 0x03, &buf, sizeof(buf),
+                        (unsigned long)addr, idx & 0x03,
-                        HZ / 2);
+                        &priv->io_dmabuf->bits32, sizeof(val), HZ / 2);
+        mutex_unlock(&priv->io_mutex);
 }
 static inline void rtl818x_iowrite32(struct rtl8187_priv *priv, __le32 *addr,
diff --git a/drivers/net/wireless/rtl818x/rtl8187_dev.c b/drivers/net/wireless/rtl818x/rtl8187_dev.c
index fd81884b9c7d..d51ba0a88c23 100644
--- a/drivers/net/wireless/rtl818x/rtl8187_dev.c
+++ b/drivers/net/wireless/rtl818x/rtl8187_dev.c
@@ -71,6 +71,8 @@ static struct usb_device_id rtl8187_table[] __devinitdata = {
        {USB_DEVICE(0x18E8, 0x6232), .driver_info = DEVICE_RTL8187},
        /* AirLive */
        {USB_DEVICE(0x1b75, 0x8187), .driver_info = DEVICE_RTL8187},
+        /* Linksys */
+        {USB_DEVICE(0x1737, 0x0073), .driver_info = DEVICE_RTL8187B},
        {}
 };
@@ -1329,6 +1331,14 @@ static int __devinit rtl8187_probe(struct usb_interface *intf,
        priv = dev->priv;
        priv->is_rtl8187b = (id->driver_info == DEVICE_RTL8187B);
+        /* allocate "DMA aware" buffer for register accesses */
+        priv->io_dmabuf = kmalloc(sizeof(*priv->io_dmabuf), GFP_KERNEL);
+        if (!priv->io_dmabuf) {
+                err = -ENOMEM;
+                goto err_free_dev;
+        }
+        mutex_init(&priv->io_mutex);
        SET_IEEE80211_DEV(dev, &intf->dev);
        usb_set_intfdata(intf, dev);
        priv->udev = udev;
@@ -1495,7 +1505,7 @@ static int __devinit rtl8187_probe(struct usb_interface *intf,
        err = ieee80211_register_hw(dev);
        if (err) {
                printk(KERN_ERR "rtl8187: Cannot register device\n");
-                goto err_free_dev;
+                goto err_free_dmabuf;
        }
        mutex_init(&priv->conf_mutex);
        skb_queue_head_init(&priv->b_tx_status.queue);
@@ -1506,6 +1516,8 @@ static int __devinit rtl8187_probe(struct usb_interface *intf,
        return 0;
+ err_free_dmabuf:
+        kfree(priv->io_dmabuf);
 err_free_dev:
        ieee80211_free_hw(dev);
        usb_set_intfdata(intf, NULL);
@@ -1526,6 +1538,7 @@ static void __devexit rtl8187_disconnect(struct usb_interface *intf)
        priv = dev->priv;
        usb_reset_device(priv->udev);
        usb_put_dev(interface_to_usbdev(intf));
+        kfree(priv->io_dmabuf);
        ieee80211_free_hw(dev);
 }
diff --git a/drivers/net/wireless/rtl818x/rtl8187_rtl8225.c b/drivers/net/wireless/rtl818x/rtl8187_rtl8225.c
index 78df281b297a..a09819386a1e 100644
--- a/drivers/net/wireless/rtl818x/rtl8187_rtl8225.c
+++ b/drivers/net/wireless/rtl818x/rtl8187_rtl8225.c
@@ -88,9 +88,15 @@ static void rtl8225_write_8051(struct ieee80211_hw *dev, u8 addr, __le16 data)
        rtl818x_iowrite16(priv, &priv->map->RFPinsOutput, reg80);
        udelay(10);
+        mutex_lock(&priv->io_mutex);
+        priv->io_dmabuf->bits16 = data;
        usb_control_msg(priv->udev, usb_sndctrlpipe(priv->udev, 0),
                        RTL8187_REQ_SET_REG, RTL8187_REQT_WRITE,
-                        addr, 0x8225, &data, sizeof(data), HZ / 2);
+                        addr, 0x8225, &priv->io_dmabuf->bits16, sizeof(data),
+                        HZ / 2);
+        mutex_unlock(&priv->io_mutex);
        rtl818x_iowrite16(priv, &priv->map->RFPinsOutput, reg80 | (1 << 2));
        udelay(10);