56 files changed, 602 insertions, 308 deletions
diff --git a/drivers/net/7990.c b/drivers/net/7990.c
index 750a46f4bc58..ad6b8a5b6574 100644
--- a/drivers/net/7990.c
+++ b/drivers/net/7990.c
@@ -506,6 +506,7 @@ int lance_open (struct net_device *dev)
        return res;
 }
+EXPORT_SYMBOL_GPL(lance_open);
 int lance_close (struct net_device *dev)
 {
@@ -521,6 +522,7 @@ int lance_close (struct net_device *dev)
        return 0;
 }
+EXPORT_SYMBOL_GPL(lance_close);
 void lance_tx_timeout(struct net_device *dev)
 {
@@ -529,7 +531,7 @@ void lance_tx_timeout(struct net_device *dev)
        dev->trans_start = jiffies;
        netif_wake_queue (dev);
 }
+EXPORT_SYMBOL_GPL(lance_tx_timeout);
 int lance_start_xmit (struct sk_buff *skb, struct net_device *dev)
 {
@@ -586,6 +588,7 @@ int lance_start_xmit (struct sk_buff *skb, struct net_device *dev)
        return 0;
 }
+EXPORT_SYMBOL_GPL(lance_start_xmit);
 /* taken from the depca driver via a2065.c */
 static void lance_load_multicast (struct net_device *dev)
@@ -654,6 +657,7 @@ void lance_set_multicast (struct net_device *dev)
        if (!stopped)
                netif_start_queue (dev);
 }
+EXPORT_SYMBOL_GPL(lance_set_multicast);
 #ifdef CONFIG_NET_POLL_CONTROLLER
 void lance_poll(struct net_device *dev)
diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
index dd0ec9ebc939..f4182cfffe9d 100644
--- a/drivers/net/Kconfig
+++ b/drivers/net/Kconfig
@@ -2426,7 +2426,7 @@ config CHELSIO_T3
 config EHEA
        tristate "eHEA Ethernet support"
-        depends on IBMEBUS && INET && SPARSEMEM && MEMORY_HOTPLUG
+        depends on IBMEBUS && INET && SPARSEMEM
        select INET_LRO
        ---help---
          This driver supports the IBM pSeries eHEA ethernet adapter.
diff --git a/drivers/net/atlx/atl1.c b/drivers/net/atlx/atl1.c
index 6e4c80d41b08..99e0b4cdc56f 100644
--- a/drivers/net/atlx/atl1.c
+++ b/drivers/net/atlx/atl1.c
@@ -637,22 +637,6 @@ static s32 atl1_phy_leave_power_saving(struct atl1_hw *hw)
 }
 /*
- * Force the PHY into power saving mode using vendor magic.
- */
-#ifdef CONFIG_PM
-static void atl1_phy_enter_power_saving(struct atl1_hw *hw)
-{
-        atl1_write_phy_reg(hw, MII_DBG_ADDR, 0);
-        atl1_write_phy_reg(hw, MII_DBG_DATA, 0x124E);
-        atl1_write_phy_reg(hw, MII_DBG_ADDR, 2);
-        atl1_write_phy_reg(hw, MII_DBG_DATA, 0x3000);
-        atl1_write_phy_reg(hw, MII_DBG_ADDR, 3);
-        atl1_write_phy_reg(hw, MII_DBG_DATA, 0);
-}
-#endif
-/*
 * Resets the PHY and make all config validate
 * hw - Struct containing variables accessed by shared code
 *
@@ -2023,6 +2007,7 @@ rrd_ok:
                /* Good Receive */
                pci_unmap_page(adapter->pdev, buffer_info->dma,
                               buffer_info->length, PCI_DMA_FROMDEVICE);
+                buffer_info->dma = 0;
                skb = buffer_info->skb;
                length = le16_to_cpu(rrd->xsz.xsum_sz.pkt_size);
@@ -2859,7 +2844,6 @@ disable_wol:
        ctrl |= PCIE_PHYMISC_FORCE_RCV_DET;
        iowrite32(ctrl, hw->hw_addr + REG_PCIE_PHYMISC);
        ioread32(hw->hw_addr + REG_PCIE_PHYMISC);
-        atl1_phy_enter_power_saving(hw);
        hw->phy_configured = false;
        pci_enable_wake(pdev, pci_choose_state(pdev, state), 0);
 exit:
diff --git a/drivers/net/bnx2.c b/drivers/net/bnx2.c
index 4b46e68183e0..367b6d462708 100644
--- a/drivers/net/bnx2.c
+++ b/drivers/net/bnx2.c
@@ -5724,14 +5724,12 @@ bnx2_reset_task(struct work_struct *work)
        if (!netif_running(bp->dev))
                return;
-        bp->in_reset_task = 1;
        bnx2_netif_stop(bp);
        bnx2_init_nic(bp);
        atomic_set(&bp->intr_sem, 1);
        bnx2_netif_start(bp);
-        bp->in_reset_task = 0;
 }
 static void
@@ -5907,12 +5905,7 @@ bnx2_close(struct net_device *dev)
        struct bnx2 *bp = netdev_priv(dev);
        u32 reset_code;
-        /* Calling flush_scheduled_work() may deadlock because
+        cancel_work_sync(&bp->reset_task);
-         * linkwatch_event() may be on the workqueue and it will try to get
-         * the rtnl_lock which we are holding.
-         */
-        while (bp->in_reset_task)
-                msleep(1);
        bnx2_disable_int_sync(bp);
        bnx2_napi_disable(bp);
diff --git a/drivers/net/bnx2.h b/drivers/net/bnx2.h
index 1eaf5bb3d9c2..2377cc13bf61 100644
--- a/drivers/net/bnx2.h
+++ b/drivers/net/bnx2.h
@@ -6656,7 +6656,6 @@ struct bnx2 {
        int                     current_interval;
        struct                  timer_list timer;
        struct work_struct      reset_task;
-        int                     in_reset_task;
        /* Used to synchronize phy accesses. */
        spinlock_t              phy_lock;
diff --git a/drivers/net/bnx2x.c b/drivers/net/bnx2x.c
index 7bdb5af35951..70cba64732ca 100644
--- a/drivers/net/bnx2x.c
+++ b/drivers/net/bnx2x.c
@@ -6,7 +6,8 @@
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation.
 *
- * Written by: Eliezer Tamir <eliezert@broadcom.com>
+ * Maintained by: Eilon Greenstein <eilong@broadcom.com>
+ * Written by: Eliezer Tamir
 * Based on code from Michael Chan's bnx2 driver
 * UDP CSUM errata workaround by Arik Gendelman
 * Slowpath rework by Vladislav Zolotarov
@@ -74,7 +75,7 @@ static char version[] __devinitdata =
        "Broadcom NetXtreme II 5771X 10Gigabit Ethernet Driver "
        DRV_MODULE_NAME " " DRV_MODULE_VERSION " (" DRV_MODULE_RELDATE ")\n";
-MODULE_AUTHOR("Eliezer Tamir <eliezert@broadcom.com>");
+MODULE_AUTHOR("Eliezer Tamir");
 MODULE_DESCRIPTION("Broadcom NetXtreme II BCM57710 Driver");
 MODULE_LICENSE("GPL");
 MODULE_VERSION(DRV_MODULE_VERSION);
diff --git a/drivers/net/bnx2x.h b/drivers/net/bnx2x.h
index 4f0c0d31e7c1..8e68d06510a6 100644
--- a/drivers/net/bnx2x.h
+++ b/drivers/net/bnx2x.h
@@ -6,7 +6,8 @@
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation.
 *
- * Written by: Eliezer Tamir <eliezert@broadcom.com>
+ * Maintained by: Eilon Greenstein <eilong@broadcom.com>
+ * Written by: Eliezer Tamir
 * Based on code from Michael Chan's bnx2 driver
 */
diff --git a/drivers/net/bnx2x_init.h b/drivers/net/bnx2x_init.h
index dcaecc53bdb1..370686eef97c 100644
--- a/drivers/net/bnx2x_init.h
+++ b/drivers/net/bnx2x_init.h
@@ -6,7 +6,8 @@
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation.
 *
- * Written by: Eliezer Tamir <eliezert@broadcom.com>
+ * Maintained by: Eilon Greenstein <eilong@broadcom.com>
+ * Written by: Eliezer Tamir
 */
 #ifndef BNX2X_INIT_H
diff --git a/drivers/net/cs89x0.c b/drivers/net/cs89x0.c
index 348371fda597..fba87abe78ee 100644
--- a/drivers/net/cs89x0.c
+++ b/drivers/net/cs89x0.c
@@ -1394,7 +1394,11 @@ net_open(struct net_device *dev)
 #endif
        if (!result) {
                printk(KERN_ERR "%s: EEPROM is configured for unavailable media\n", dev->name);
-        release_irq:
+release_dma:
+#if ALLOW_DMA
+                free_dma(dev->dma);
+#endif
+release_irq:
 #if ALLOW_DMA
                release_dma_buff(lp);
 #endif
@@ -1442,12 +1446,12 @@ net_open(struct net_device *dev)
                        if ((result = detect_bnc(dev)) != DETECTED_NONE)
                                break;
                printk(KERN_ERR "%s: no media detected\n", dev->name);
-                goto release_irq;
+                goto release_dma;
        }
        switch(result) {
        case DETECTED_NONE:
                printk(KERN_ERR "%s: no network cable attached to configured media\n", dev->name);
-                goto release_irq;
+                goto release_dma;
        case DETECTED_RJ45H:
                printk(KERN_INFO "%s: using half-duplex 10Base-T (RJ-45)\n", dev->name);
                break;
diff --git a/drivers/net/ehea/ehea_main.c b/drivers/net/ehea/ehea_main.c
index 287a61918739..075fd547421e 100644
--- a/drivers/net/ehea/ehea_main.c
+++ b/drivers/net/ehea/ehea_main.c
@@ -1766,16 +1766,20 @@ static int ehea_set_mac_addr(struct net_device *dev, void *sa)
        mutex_lock(&ehea_bcmc_regs.lock);
        /* Deregister old MAC in pHYP */
-        ret = ehea_broadcast_reg_helper(port, H_DEREG_BCMC);
+        if (port->state == EHEA_PORT_UP) {
-        if (ret)
+                ret = ehea_broadcast_reg_helper(port, H_DEREG_BCMC);
-                goto out_upregs;
+                if (ret)
+                        goto out_upregs;
+        }
        port->mac_addr = cb0->port_mac_addr << 16;
        /* Register new MAC in pHYP */
-        ret = ehea_broadcast_reg_helper(port, H_REG_BCMC);
+        if (port->state == EHEA_PORT_UP) {
-        if (ret)
+                ret = ehea_broadcast_reg_helper(port, H_REG_BCMC);
-                goto out_upregs;
+                if (ret)
+                        goto out_upregs;
+        }
        ret = 0;
@@ -2601,7 +2605,8 @@ static int ehea_stop(struct net_device *dev)
        if (netif_msg_ifdown(port))
                ehea_info("disabling port %s", dev->name);
-        flush_scheduled_work();
+        cancel_work_sync(&port->reset_task);
        mutex_lock(&port->port_lock);
        netif_stop_queue(dev);
        port_napi_disable(port);
diff --git a/drivers/net/fec_mpc52xx.c b/drivers/net/fec_mpc52xx.c
index 5f9c42e7a7f1..329edd9c08fc 100644
--- a/drivers/net/fec_mpc52xx.c
+++ b/drivers/net/fec_mpc52xx.c
@@ -78,7 +78,7 @@ module_param_array_named(mac, mpc52xx_fec_mac_addr, byte, NULL, 0);
 MODULE_PARM_DESC(mac, "six hex digits, ie. 0x1,0x2,0xc0,0x01,0xba,0xbe");
 #define MPC52xx_MESSAGES_DEFAULT ( NETIF_MSG_DRV | NETIF_MSG_PROBE | \
-                NETIF_MSG_LINK | NETIF_MSG_IFDOWN | NETIF_MSG_IFDOWN )
+                NETIF_MSG_LINK | NETIF_MSG_IFDOWN | NETIF_MSG_IFUP)
 static int debug = -1;  /* the above default */
 module_param(debug, int, 0);
 MODULE_PARM_DESC(debug, "debugging messages level");
diff --git a/drivers/net/forcedeth.c b/drivers/net/forcedeth.c
index 9eca97fb0a54..2cb244763292 100644
--- a/drivers/net/forcedeth.c
+++ b/drivers/net/forcedeth.c
@@ -3273,6 +3273,20 @@ static void nv_link_irq(struct net_device *dev)
        dprintk(KERN_DEBUG "%s: link change notification done.\n", dev->name);
 }
+static void nv_msi_workaround(struct fe_priv *np)
+{
+        /* Need to toggle the msi irq mask within the ethernet device,
+         * otherwise, future interrupts will not be detected.
+         */
+        if (np->msi_flags & NV_MSI_ENABLED) {
+                u8 __iomem *base = np->base;
+                writel(0, base + NvRegMSIIrqMask);
+                writel(NVREG_MSI_VECTOR_0_ENABLED, base + NvRegMSIIrqMask);
+        }
+}
 static irqreturn_t nv_nic_irq(int foo, void *data)
 {
        struct net_device *dev = (struct net_device *) data;
@@ -3295,6 +3309,8 @@ static irqreturn_t nv_nic_irq(int foo, void *data)
                if (!(events & np->irqmask))
                        break;
+                nv_msi_workaround(np);
                spin_lock(&np->lock);
                nv_tx_done(dev);
                spin_unlock(&np->lock);
@@ -3410,6 +3426,8 @@ static irqreturn_t nv_nic_irq_optimized(int foo, void *data)
                if (!(events & np->irqmask))
                        break;
+                nv_msi_workaround(np);
                spin_lock(&np->lock);
                nv_tx_done_optimized(dev, TX_WORK_PER_LOOP);
                spin_unlock(&np->lock);
@@ -3750,6 +3768,8 @@ static irqreturn_t nv_nic_irq_test(int foo, void *data)
        if (!(events & NVREG_IRQ_TIMER))
                return IRQ_RETVAL(0);
+        nv_msi_workaround(np);
        spin_lock(&np->lock);
        np->intr_test = 1;
        spin_unlock(&np->lock);
diff --git a/drivers/net/hamradio/baycom_epp.c b/drivers/net/hamradio/baycom_epp.c
index dde9c7e6408a..00bc7fbb6b37 100644
--- a/drivers/net/hamradio/baycom_epp.c
+++ b/drivers/net/hamradio/baycom_epp.c
@@ -959,7 +959,7 @@ static int epp_close(struct net_device *dev)
        unsigned char tmp[1];
        bc->work_running = 0;
-        flush_scheduled_work();
+        cancel_delayed_work_sync(&bc->run_work);
        bc->stat = EPP_DCDBIT;
        tmp[0] = 0;
        pp->ops->epp_write_addr(pp, tmp, 1, 0);
diff --git a/drivers/net/ipg.c b/drivers/net/ipg.c
index 9b358f61ed7f..679a0826780e 100644
--- a/drivers/net/ipg.c
+++ b/drivers/net/ipg.c
@@ -577,12 +577,12 @@ static void ipg_nic_set_multicast_list(struct net_device *dev)
                /* NIC to be configured in promiscuous mode. */
                receivemode = IPG_RM_RECEIVEALLFRAMES;
        } else if ((dev->flags & IFF_ALLMULTI) ||
-                   (dev->flags & IFF_MULTICAST &
+                   ((dev->flags & IFF_MULTICAST) &&
                    (dev->mc_count > IPG_MULTICAST_HASHTABLE_SIZE))) {
                /* NIC to be configured to receive all multicast
                 * frames. */
                receivemode |= IPG_RM_RECEIVEMULTICAST;
-        } else if (dev->flags & IFF_MULTICAST & (dev->mc_count > 0)) {
+        } else if ((dev->flags & IFF_MULTICAST) && (dev->mc_count > 0)) {
                /* NIC to be configured to receive selected
                 * multicast addresses. */
                receivemode |= IPG_RM_RECEIVEMULTICASTHASH;
diff --git a/drivers/net/irda/Kconfig b/drivers/net/irda/Kconfig
index ce816ba9c40d..e6317557a531 100644
--- a/drivers/net/irda/Kconfig
+++ b/drivers/net/irda/Kconfig
@@ -329,6 +329,7 @@ config PXA_FICP
 config MCS_FIR
        tristate "MosChip MCS7780 IrDA-USB dongle"
        depends on IRDA && USB && EXPERIMENTAL
+        select CRC32
        help
          Say Y or M here if you want to build support for the MosChip
          MCS7780 IrDA-USB bridge device driver.
diff --git a/drivers/net/ixgbe/ixgbe_82598.c b/drivers/net/ixgbe/ixgbe_82598.c
index 6321b059ce13..2f38e847e2cd 100644
--- a/drivers/net/ixgbe/ixgbe_82598.c
+++ b/drivers/net/ixgbe/ixgbe_82598.c
@@ -58,8 +58,8 @@ static s32 ixgbe_reset_hw_82598(struct ixgbe_hw *hw);
 static s32 ixgbe_get_invariants_82598(struct ixgbe_hw *hw)
 {
-        hw->mac.num_rx_queues = IXGBE_82598_MAX_TX_QUEUES;
+        hw->mac.num_rx_queues = IXGBE_82598_MAX_RX_QUEUES;
-        hw->mac.num_tx_queues = IXGBE_82598_MAX_RX_QUEUES;
+        hw->mac.num_tx_queues = IXGBE_82598_MAX_TX_QUEUES;
        hw->mac.num_rx_addrs = IXGBE_82598_RAR_ENTRIES;
        /* PHY ops are filled in by default properly for Fiber only */
diff --git a/drivers/net/myri10ge/myri10ge.c b/drivers/net/myri10ge/myri10ge.c
index 36be6efc6398..e0d76c75aea0 100644
--- a/drivers/net/myri10ge/myri10ge.c
+++ b/drivers/net/myri10ge/myri10ge.c
@@ -75,7 +75,7 @@
 #include "myri10ge_mcp.h"
 #include "myri10ge_mcp_gen_header.h"
-#define MYRI10GE_VERSION_STR "1.3.2-1.287"
+#define MYRI10GE_VERSION_STR "1.3.99-1.347"
 MODULE_DESCRIPTION("Myricom 10G driver (10GbE)");
 MODULE_AUTHOR("Maintainer: help@myri.com");
diff --git a/drivers/net/pppoe.c b/drivers/net/pppoe.c
index 58a26a47af29..bafb69b6f7cb 100644
--- a/drivers/net/pppoe.c
+++ b/drivers/net/pppoe.c
@@ -341,12 +341,6 @@ static int pppoe_rcv_core(struct sock *sk, struct sk_buff *skb)
        struct pppox_sock *relay_po;
        if (sk->sk_state & PPPOX_BOUND) {
-                struct pppoe_hdr *ph = pppoe_hdr(skb);
-                int len = ntohs(ph->length);
-                skb_pull_rcsum(skb, sizeof(struct pppoe_hdr));
-                if (pskb_trim_rcsum(skb, len))
-                        goto abort_kfree;
                ppp_input(&po->chan, skb);
        } else if (sk->sk_state & PPPOX_RELAY) {
                relay_po = get_item_by_addr(&po->pppoe_relay);
@@ -357,7 +351,6 @@ static int pppoe_rcv_core(struct sock *sk, struct sk_buff *skb)
                if ((sk_pppox(relay_po)->sk_state & PPPOX_CONNECTED) == 0)
                        goto abort_put;
-                skb_pull(skb, sizeof(struct pppoe_hdr));
                if (!__pppoe_xmit(sk_pppox(relay_po), skb))
                        goto abort_put;
        } else {
@@ -388,6 +381,7 @@ static int pppoe_rcv(struct sk_buff *skb,
 {
        struct pppoe_hdr *ph;
        struct pppox_sock *po;
+        int len;
        if (!(skb = skb_share_check(skb, GFP_ATOMIC)))
                goto out;
@@ -399,10 +393,21 @@ static int pppoe_rcv(struct sk_buff *skb,
                goto drop;
        ph = pppoe_hdr(skb);
+        len = ntohs(ph->length);
+        skb_pull_rcsum(skb, sizeof(*ph));
+        if (skb->len < len)
+                goto drop;
        po = get_item(ph->sid, eth_hdr(skb)->h_source, dev->ifindex);
-        if (po != NULL)
+        if (!po)
-                return sk_receive_skb(sk_pppox(po), skb, 0);
+                goto drop;
+        if (pskb_trim_rcsum(skb, len))
+                goto drop;
+        return sk_receive_skb(sk_pppox(po), skb, 0);
 drop:
        kfree_skb(skb);
 out:
@@ -427,12 +432,12 @@ static int pppoe_disc_rcv(struct sk_buff *skb,
        if (dev_net(dev) != &init_net)
                goto abort;
-        if (!pskb_may_pull(skb, sizeof(struct pppoe_hdr)))
-                goto abort;
        if (!(skb = skb_share_check(skb, GFP_ATOMIC)))
                goto out;
+        if (!pskb_may_pull(skb, sizeof(struct pppoe_hdr)))
+                goto abort;
        ph = pppoe_hdr(skb);
        if (ph->code != PADT_CODE)
                goto abort;
@@ -937,12 +942,10 @@ static int pppoe_recvmsg(struct kiocb *iocb, struct socket *sock,
        m->msg_namelen = 0;
        if (skb) {
-                struct pppoe_hdr *ph = pppoe_hdr(skb);
+                total_len = min(total_len, skb->len);
-                const int len = ntohs(ph->length);
+                error = skb_copy_datagram_iovec(skb, 0, m->msg_iov, total_len);
-                error = memcpy_toiovec(m->msg_iov, (unsigned char *) &ph->tag[0], len);
                if (error == 0)
-                        error = len;
+                        error = total_len;
        }
        kfree_skb(skb);
diff --git a/drivers/net/pppol2tp.c b/drivers/net/pppol2tp.c
index 8db342f2fdc9..f9298827a76c 100644
--- a/drivers/net/pppol2tp.c
+++ b/drivers/net/pppol2tp.c
@@ -240,12 +240,15 @@ static inline struct pppol2tp_session *pppol2tp_sock_to_session(struct sock *sk)
        if (sk == NULL)
                return NULL;
+        sock_hold(sk);
        session = (struct pppol2tp_session *)(sk->sk_user_data);
-        if (session == NULL)
+        if (session == NULL) {
-                return NULL;
+                sock_put(sk);
+                goto out;
+        }
        BUG_ON(session->magic != L2TP_SESSION_MAGIC);
+out:
        return session;
 }
@@ -256,12 +259,15 @@ static inline struct pppol2tp_tunnel *pppol2tp_sock_to_tunnel(struct sock *sk)
        if (sk == NULL)
                return NULL;
+        sock_hold(sk);
        tunnel = (struct pppol2tp_tunnel *)(sk->sk_user_data);
-        if (tunnel == NULL)
+        if (tunnel == NULL) {
-                return NULL;
+                sock_put(sk);
+                goto out;
+        }
        BUG_ON(tunnel->magic != L2TP_TUNNEL_MAGIC);
+out:
        return tunnel;
 }
@@ -716,12 +722,14 @@ discard:
        session->stats.rx_errors++;
        kfree_skb(skb);
        sock_put(session->sock);
+        sock_put(sock);
        return 0;
 error:
        /* Put UDP header back */
        __skb_push(skb, sizeof(struct udphdr));
+        sock_put(sock);
 no_tunnel:
        return 1;
@@ -745,10 +753,13 @@ static int pppol2tp_udp_encap_recv(struct sock *sk, struct sk_buff *skb)
               "%s: received %d bytes\n", tunnel->name, skb->len);
        if (pppol2tp_recv_core(sk, skb))
-                goto pass_up;
+                goto pass_up_put;
+        sock_put(sk);
        return 0;
+pass_up_put:
+        sock_put(sk);
 pass_up:
        return 1;
 }
@@ -772,14 +783,18 @@ static int pppol2tp_recvmsg(struct kiocb *iocb, struct socket *sock,
        err = 0;
        skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT,
                                flags & MSG_DONTWAIT, &err);
-        if (skb) {
+        if (!skb)
-                err = memcpy_toiovec(msg->msg_iov, (unsigned char *) skb->data,
+                goto end;
-                                     skb->len);
-                if (err < 0)
+        if (len > skb->len)
-                        goto do_skb_free;
+                len = skb->len;
-                err = skb->len;
+        else if (len < skb->len)
-        }
+                msg->msg_flags |= MSG_TRUNC;
-do_skb_free:
+        err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, len);
+        if (likely(err == 0))
+                err = len;
        kfree_skb(skb);
 end:
        return err;
@@ -858,7 +873,7 @@ static int pppol2tp_sendmsg(struct kiocb *iocb, struct socket *sock, struct msgh
        tunnel = pppol2tp_sock_to_tunnel(session->tunnel_sock);
        if (tunnel == NULL)
-                goto error;
+                goto error_put_sess;
        /* What header length is configured for this session? */
        hdr_len = pppol2tp_l2tp_header_len(session);
@@ -870,7 +885,7 @@ static int pppol2tp_sendmsg(struct kiocb *iocb, struct socket *sock, struct msgh
                           sizeof(ppph) + total_len,
                           0, GFP_KERNEL);
        if (!skb)
-                goto error;
+                goto error_put_sess_tun;
        /* Reserve space for headers. */
        skb_reserve(skb, NET_SKB_PAD);
@@ -900,7 +915,7 @@ static int pppol2tp_sendmsg(struct kiocb *iocb, struct socket *sock, struct msgh
        error = memcpy_fromiovec(skb->data, m->msg_iov, total_len);
        if (error < 0) {
                kfree_skb(skb);
-                goto error;
+                goto error_put_sess_tun;
        }
        skb_put(skb, total_len);
@@ -947,10 +962,33 @@ static int pppol2tp_sendmsg(struct kiocb *iocb, struct socket *sock, struct msgh
                session->stats.tx_errors++;
        }
+        return error;
+error_put_sess_tun:
+        sock_put(session->tunnel_sock);
+error_put_sess:
+        sock_put(sk);
 error:
        return error;
 }
+/* Automatically called when the skb is freed.
+ */
+static void pppol2tp_sock_wfree(struct sk_buff *skb)
+{
+        sock_put(skb->sk);
+}
+/* For data skbs that we transmit, we associate with the tunnel socket
+ * but don't do accounting.
+ */
+static inline void pppol2tp_skb_set_owner_w(struct sk_buff *skb, struct sock *sk)
+{
+        sock_hold(sk);
+        skb->sk = sk;
+        skb->destructor = pppol2tp_sock_wfree;
+}
 /* Transmit function called by generic PPP driver.  Sends PPP frame
 * over PPPoL2TP socket.
 *
@@ -993,10 +1031,10 @@ static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
        sk_tun = session->tunnel_sock;
        if (sk_tun == NULL)
-                goto abort;
+                goto abort_put_sess;
        tunnel = pppol2tp_sock_to_tunnel(sk_tun);
        if (tunnel == NULL)
-                goto abort;
+                goto abort_put_sess;
        /* What header length is configured for this session? */
        hdr_len = pppol2tp_l2tp_header_len(session);
@@ -1009,7 +1047,7 @@ static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
                sizeof(struct udphdr) + hdr_len + sizeof(ppph);
        old_headroom = skb_headroom(skb);
        if (skb_cow_head(skb, headroom))
-                goto abort;
+                goto abort_put_sess_tun;
        new_headroom = skb_headroom(skb);
        skb_orphan(skb);
@@ -1069,7 +1107,7 @@ static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
        /* Get routing info from the tunnel socket */
        dst_release(skb->dst);
        skb->dst = dst_clone(__sk_dst_get(sk_tun));
-        skb->sk = sk_tun;
+        pppol2tp_skb_set_owner_w(skb, sk_tun);
        /* Queue the packet to IP for output */
        len = skb->len;
@@ -1086,8 +1124,14 @@ static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
                session->stats.tx_errors++;
        }
+        sock_put(sk_tun);
+        sock_put(sk);
        return 1;
+abort_put_sess_tun:
+        sock_put(sk_tun);
+abort_put_sess:
+        sock_put(sk);
 abort:
        /* Free the original skb */
        kfree_skb(skb);
@@ -1191,7 +1235,7 @@ static void pppol2tp_tunnel_destruct(struct sock *sk)
 {
        struct pppol2tp_tunnel *tunnel;
-        tunnel = pppol2tp_sock_to_tunnel(sk);
+        tunnel = sk->sk_user_data;
        if (tunnel == NULL)
                goto end;
@@ -1230,10 +1274,12 @@ static void pppol2tp_session_destruct(struct sock *sk)
        if (sk->sk_user_data != NULL) {
                struct pppol2tp_tunnel *tunnel;
-                session = pppol2tp_sock_to_session(sk);
+                session = sk->sk_user_data;
                if (session == NULL)
                        goto out;
+                BUG_ON(session->magic != L2TP_SESSION_MAGIC);
                /* Don't use pppol2tp_sock_to_tunnel() here to
                 * get the tunnel context because the tunnel
                 * socket might have already been closed (its
@@ -1279,6 +1325,7 @@ out:
 static int pppol2tp_release(struct socket *sock)
 {
        struct sock *sk = sock->sk;
+        struct pppol2tp_session *session;
        int error;
        if (!sk)
@@ -1296,9 +1343,18 @@ static int pppol2tp_release(struct socket *sock)
        sock_orphan(sk);
        sock->sk = NULL;
+        session = pppol2tp_sock_to_session(sk);
        /* Purge any queued data */
        skb_queue_purge(&sk->sk_receive_queue);
        skb_queue_purge(&sk->sk_write_queue);
+        if (session != NULL) {
+                struct sk_buff *skb;
+                while ((skb = skb_dequeue(&session->reorder_q))) {
+                        kfree_skb(skb);
+                        sock_put(sk);
+                }
+        }
        release_sock(sk);
@@ -1601,7 +1657,7 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
        error = ppp_register_channel(&po->chan);
        if (error)
-                goto end;
+                goto end_put_tun;
        /* This is how we get the session context from the socket. */
        sk->sk_user_data = session;
@@ -1621,6 +1677,8 @@ out_no_ppp:
        PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
               "%s: created\n", session->name);
+end_put_tun:
+        sock_put(tunnel_sock);
 end:
        release_sock(sk);
@@ -1668,6 +1726,7 @@ static int pppol2tp_getname(struct socket *sock, struct sockaddr *uaddr,
        *usockaddr_len = len;
        error = 0;
+        sock_put(sock->sk);
 end:
        return error;
@@ -1906,14 +1965,17 @@ static int pppol2tp_ioctl(struct socket *sock, unsigned int cmd,
                err = -EBADF;
                tunnel = pppol2tp_sock_to_tunnel(session->tunnel_sock);
                if (tunnel == NULL)
-                        goto end;
+                        goto end_put_sess;
                err = pppol2tp_tunnel_ioctl(tunnel, cmd, arg);
-                goto end;
+                sock_put(session->tunnel_sock);
+                goto end_put_sess;
        }
        err = pppol2tp_session_ioctl(session, cmd, arg);
+end_put_sess:
+        sock_put(sk);
 end:
        return err;
 }
@@ -2059,14 +2121,17 @@ static int pppol2tp_setsockopt(struct socket *sock, int level, int optname,
                err = -EBADF;
                tunnel = pppol2tp_sock_to_tunnel(session->tunnel_sock);
                if (tunnel == NULL)
-                        goto end;
+                        goto end_put_sess;
                err = pppol2tp_tunnel_setsockopt(sk, tunnel, optname, val);
+                sock_put(session->tunnel_sock);
        } else
                err = pppol2tp_session_setsockopt(sk, session, optname, val);
        err = 0;
+end_put_sess:
+        sock_put(sk);
 end:
        return err;
 }
@@ -2181,20 +2246,24 @@ static int pppol2tp_getsockopt(struct socket *sock, int level,
                err = -EBADF;
                tunnel = pppol2tp_sock_to_tunnel(session->tunnel_sock);
                if (tunnel == NULL)
-                        goto end;
+                        goto end_put_sess;
                err = pppol2tp_tunnel_getsockopt(sk, tunnel, optname, &val);
+                sock_put(session->tunnel_sock);
        } else
                err = pppol2tp_session_getsockopt(sk, session, optname, &val);
        err = -EFAULT;
        if (put_user(len, (int __user *) optlen))
-                goto end;
+                goto end_put_sess;
        if (copy_to_user((void __user *) optval, &val, len))
-                goto end;
+                goto end_put_sess;
        err = 0;
+end_put_sess:
+        sock_put(sk);
 end:
        return err;
 }
diff --git a/drivers/net/r6040.c b/drivers/net/r6040.c
index 169edc154928..858b191517b3 100644
--- a/drivers/net/r6040.c
+++ b/drivers/net/r6040.c
@@ -733,7 +733,7 @@ static void r6040_timer(unsigned long data)
        }
        /* Timer active again */
-        mod_timer(&lp->timer, jiffies + round_jiffies(HZ));
+        mod_timer(&lp->timer, round_jiffies(jiffies + HZ));
 }
 /* Read/set MAC address routines */
diff --git a/drivers/net/s2io.c b/drivers/net/s2io.c
index a20693e09ae8..b5c1e663417d 100644
--- a/drivers/net/s2io.c
+++ b/drivers/net/s2io.c
@@ -2861,7 +2861,8 @@ static int s2io_poll_msix(struct napi_struct *napi, int budget)
        struct config_param *config;
        struct mac_info *mac_control;
        int pkts_processed = 0;
-        u8 *addr = NULL, val8 = 0;
+        u8 __iomem *addr = NULL;
+        u8 val8 = 0;
        struct s2io_nic *nic = dev->priv;
        struct XENA_dev_config __iomem *bar0 = nic->bar0;
        int budget_org = budget;
@@ -2878,7 +2879,7 @@ static int s2io_poll_msix(struct napi_struct *napi, int budget)
        if (pkts_processed < budget_org) {
                netif_rx_complete(dev, napi);
                /*Re Enable MSI-Rx Vector*/
-                addr = (u8 *)&bar0->xmsi_mask_reg;
+                addr = (u8 __iomem *)&bar0->xmsi_mask_reg;
                addr += 7 - ring->ring_no;
                val8 = (ring->ring_no == 0) ? 0x3f : 0xbf;
                writeb(val8, addr);
@@ -4364,9 +4365,10 @@ static irqreturn_t s2io_msix_ring_handle(int irq, void *dev_id)
                return IRQ_HANDLED;
        if (sp->config.napi) {
-                u8 *addr = NULL, val8 = 0;
+                u8 __iomem *addr = NULL;
+                u8 val8 = 0;
-                addr = (u8 *)&bar0->xmsi_mask_reg;
+                addr = (u8 __iomem *)&bar0->xmsi_mask_reg;
                addr += (7 - ring->ring_no);
                val8 = (ring->ring_no == 0) ? 0x7f : 0xff;
                writeb(val8, addr);
diff --git a/drivers/net/sc92031.c b/drivers/net/sc92031.c
index b4b63805ee8f..61955f8d8011 100644
--- a/drivers/net/sc92031.c
+++ b/drivers/net/sc92031.c
@@ -972,7 +972,7 @@ static int sc92031_start_xmit(struct sk_buff *skb, struct net_device *dev)
        skb_copy_and_csum_dev(skb, priv->tx_bufs + entry * TX_BUF_SIZE);
        len = skb->len;
-        if (unlikely(len < ETH_ZLEN)) {
+        if (len < ETH_ZLEN) {
                memset(priv->tx_bufs + entry * TX_BUF_SIZE + len,
                                0, ETH_ZLEN - len);
                len = ETH_ZLEN;
diff --git a/drivers/net/sfc/falcon.c b/drivers/net/sfc/falcon.c
index d3f749c72d41..790db89db345 100644
--- a/drivers/net/sfc/falcon.c
+++ b/drivers/net/sfc/falcon.c
@@ -733,8 +733,10 @@ void falcon_fini_rx(struct efx_rx_queue *rx_queue)
                        continue;
                break;
        }
-        if (rc)
+        if (rc) {
                EFX_ERR(efx, "failed to flush rx queue %d\n", rx_queue->queue);
+                efx_schedule_reset(efx, RESET_TYPE_INVISIBLE);
+        }
        /* Remove RX descriptor ring from card */
        EFX_ZERO_OWORD(rx_desc_ptr);
diff --git a/drivers/net/sfc/falcon_xmac.c b/drivers/net/sfc/falcon_xmac.c
index dbdcee4b0f8d..55c0d9760be8 100644
--- a/drivers/net/sfc/falcon_xmac.c
+++ b/drivers/net/sfc/falcon_xmac.c
@@ -459,7 +459,7 @@ static int falcon_check_xaui_link_up(struct efx_nic *efx)
                tries--;
        }
-        EFX_ERR(efx, "Failed to bring XAUI link back up in %d tries!\n",
+        EFX_LOG(efx, "Failed to bring XAUI link back up in %d tries!\n",
                max_tries);
        return 0;
 }
diff --git a/drivers/net/sky2.c b/drivers/net/sky2.c
index 3bb60530d4d7..62436b3a18c6 100644
--- a/drivers/net/sky2.c
+++ b/drivers/net/sky2.c
@@ -4404,7 +4404,9 @@ static int sky2_resume(struct pci_dev *pdev)
                        if (err) {
                                printk(KERN_ERR PFX "%s: could not up: %d\n",
                                       dev->name, err);
+                                rtnl_lock();
                                dev_close(dev);
+                                rtnl_unlock();
                                goto out;
                        }
                }
diff --git a/drivers/net/smc911x.c b/drivers/net/smc911x.c
index 4e2800205189..e2ee91a6ae7e 100644
--- a/drivers/net/smc911x.c
+++ b/drivers/net/smc911x.c
@@ -136,7 +136,6 @@ struct smc911x_local {
        /* work queue */
        struct work_struct phy_configure;
-        int work_pending;
        int tx_throttle;
        spinlock_t lock;
@@ -960,11 +959,11 @@ static void smc911x_phy_configure(struct work_struct *work)
         * We should not be called if phy_type is zero.
         */
        if (lp->phy_type == 0)
-                 goto smc911x_phy_configure_exit_nolock;
+                return;
        if (smc911x_phy_reset(dev, phyaddr)) {
                printk("%s: PHY reset timed out\n", dev->name);
-                goto smc911x_phy_configure_exit_nolock;
+                return;
        }
        spin_lock_irqsave(&lp->lock, flags);
@@ -1033,8 +1032,6 @@ static void smc911x_phy_configure(struct work_struct *work)
 smc911x_phy_configure_exit:
        spin_unlock_irqrestore(&lp->lock, flags);
-smc911x_phy_configure_exit_nolock:
-        lp->work_pending = 0;
 }
 /*
@@ -1356,11 +1353,8 @@ static void smc911x_timeout(struct net_device *dev)
         * smc911x_phy_configure() calls msleep() which calls schedule_timeout()
         * which calls schedule().       Hence we use a work queue.
         */
-        if (lp->phy_type != 0) {
+        if (lp->phy_type != 0)
-                if (schedule_work(&lp->phy_configure)) {
+                schedule_work(&lp->phy_configure);
-                        lp->work_pending = 1;
-                }
-        }
        /* We can accept TX packets again */
        dev->trans_start = jiffies;
@@ -1531,16 +1525,8 @@ static int smc911x_close(struct net_device *dev)
        if (lp->phy_type != 0) {
                /* We need to ensure that no calls to
                 * smc911x_phy_configure are pending.
-                 * flush_scheduled_work() cannot be called because we
-                 * are running with the netlink semaphore held (from
-                 * devinet_ioctl()) and the pending work queue
-                 * contains linkwatch_event() (scheduled by
-                 * netif_carrier_off() above). linkwatch_event() also
-                 * wants the netlink semaphore.
                 */
-                while (lp->work_pending)
+                cancel_work_sync(&lp->phy_configure);
-                        schedule();
                smc911x_phy_powerdown(dev, lp->mii.phy_id);
        }
diff --git a/drivers/net/smc91x.c b/drivers/net/smc91x.c
index a188e33484e6..f2051b209da2 100644
--- a/drivers/net/smc91x.c
+++ b/drivers/net/smc91x.c
@@ -1016,15 +1016,8 @@ static void smc_phy_powerdown(struct net_device *dev)
        /* We need to ensure that no calls to smc_phy_configure are
           pending.
-           flush_scheduled_work() cannot be called because we are
-           running with the netlink semaphore held (from
-           devinet_ioctl()) and the pending work queue contains
-           linkwatch_event() (scheduled by netif_carrier_off()
-           above). linkwatch_event() also wants the netlink semaphore.
        */
-        while(lp->work_pending)
+        cancel_work_sync(&lp->phy_configure);
-                yield();
        bmcr = smc_phy_read(dev, phy, MII_BMCR);
        smc_phy_write(dev, phy, MII_BMCR, bmcr | BMCR_PDOWN);
@@ -1161,7 +1154,6 @@ static void smc_phy_configure(struct work_struct *work)
 smc_phy_configure_exit:
        SMC_SELECT_BANK(lp, 2);
        spin_unlock_irq(&lp->lock);
-        lp->work_pending = 0;
 }
 /*
@@ -1389,11 +1381,8 @@ static void smc_timeout(struct net_device *dev)
         * smc_phy_configure() calls msleep() which calls schedule_timeout()
         * which calls schedule().  Hence we use a work queue.
         */
-        if (lp->phy_type != 0) {
+        if (lp->phy_type != 0)
-                if (schedule_work(&lp->phy_configure)) {
+                schedule_work(&lp->phy_configure);
-                        lp->work_pending = 1;
-                }
-        }
        /* We can accept TX packets again */
        dev->trans_start = jiffies;
diff --git a/drivers/net/smc91x.h b/drivers/net/smc91x.h
index 69e97a1cb1c4..8606818653f8 100644
--- a/drivers/net/smc91x.h
+++ b/drivers/net/smc91x.h
@@ -93,14 +93,14 @@
 #define SMC_insw(a, r, p, l)    insw ((unsigned long *)((a) + (r)), p, l)
 # endif
 /* check if the mac in reg is valid */
-#define SMC_GET_MAC_ADDR(addr)                                  \
+#define SMC_GET_MAC_ADDR(lp, addr)                              \
        do {                                                    \
                unsigned int __v;                               \
-                __v = SMC_inw(ioaddr, ADDR0_REG);               \
+                __v = SMC_inw(ioaddr, ADDR0_REG(lp));           \
                addr[0] = __v; addr[1] = __v >> 8;              \
-                __v = SMC_inw(ioaddr, ADDR1_REG);               \
+                __v = SMC_inw(ioaddr, ADDR1_REG(lp));           \
                addr[2] = __v; addr[3] = __v >> 8;              \
-                __v = SMC_inw(ioaddr, ADDR2_REG);               \
+                __v = SMC_inw(ioaddr, ADDR2_REG(lp));           \
                addr[4] = __v; addr[5] = __v >> 8;              \
                if (*(u32 *)(&addr[0]) == 0xFFFFFFFF) {         \
                        random_ether_addr(addr);                \
diff --git a/drivers/net/sunhme.c b/drivers/net/sunhme.c
index b4e7f30ea4e8..1aa425be3067 100644
--- a/drivers/net/sunhme.c
+++ b/drivers/net/sunhme.c
@@ -111,7 +111,7 @@ static __inline__ void tx_add_log(struct happy_meal *hp, unsigned int a, unsigne
        struct hme_tx_logent *tlp;
        unsigned long flags;
-        save_and_cli(flags);
+        local_irq_save(flags);
        tlp = &tx_log[txlog_cur_entry];
        tlp->tstamp = (unsigned int)jiffies;
        tlp->tx_new = hp->tx_new;
@@ -119,7 +119,7 @@ static __inline__ void tx_add_log(struct happy_meal *hp, unsigned int a, unsigne
        tlp->action = a;
        tlp->status = s;
        txlog_cur_entry = (txlog_cur_entry + 1) & (TX_LOG_LEN - 1);
-        restore_flags(flags);
+        local_irq_restore(flags);
 }
 static __inline__ void tx_dump_log(void)
 {
diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
index 07b3f77e7626..cc4bde852542 100644
--- a/drivers/net/tg3.c
+++ b/drivers/net/tg3.c
@@ -64,8 +64,8 @@
 #define DRV_MODULE_NAME         "tg3"
 #define PFX DRV_MODULE_NAME     ": "
-#define DRV_MODULE_VERSION      "3.92"
+#define DRV_MODULE_VERSION      "3.92.1"
-#define DRV_MODULE_RELDATE      "May 2, 2008"
+#define DRV_MODULE_RELDATE      "June 9, 2008"
 #define TG3_DEF_MAC_MODE        0
 #define TG3_DEF_RX_MODE         0
@@ -1295,6 +1295,21 @@ static void tg3_frob_aux_power(struct tg3 *tp)
                                     GRC_LCLCTRL_GPIO_OUTPUT0 |
                                     GRC_LCLCTRL_GPIO_OUTPUT1),
                                    100);
+                } else if (tp->pdev->device == PCI_DEVICE_ID_TIGON3_5761) {
+                        /* The 5761 non-e device swaps GPIO 0 and GPIO 2. */
+                        u32 grc_local_ctrl = GRC_LCLCTRL_GPIO_OE0 |
+                                             GRC_LCLCTRL_GPIO_OE1 |
+                                             GRC_LCLCTRL_GPIO_OE2 |
+                                             GRC_LCLCTRL_GPIO_OUTPUT0 |
+                                             GRC_LCLCTRL_GPIO_OUTPUT1 |
+                                             tp->grc_local_ctrl;
+                        tw32_wait_f(GRC_LOCAL_CTRL, grc_local_ctrl, 100);
+                        grc_local_ctrl |= GRC_LCLCTRL_GPIO_OUTPUT2;
+                        tw32_wait_f(GRC_LOCAL_CTRL, grc_local_ctrl, 100);
+                        grc_local_ctrl &= ~GRC_LCLCTRL_GPIO_OUTPUT0;
+                        tw32_wait_f(GRC_LOCAL_CTRL, grc_local_ctrl, 100);
                } else {
                        u32 no_gpio2;
                        u32 grc_local_ctrl = 0;
@@ -3168,8 +3183,7 @@ static int tg3_setup_fiber_mii_phy(struct tg3 *tp, int force_reset)
        err |= tg3_readphy(tp, MII_BMCR, &bmcr);
        if ((tp->link_config.autoneg == AUTONEG_ENABLE) && !force_reset &&
-            (tp->tg3_flags2 & TG3_FLG2_PARALLEL_DETECT) &&
+            (tp->tg3_flags2 & TG3_FLG2_PARALLEL_DETECT)) {
-             tp->link_config.flowctrl == tp->link_config.active_flowctrl) {
                /* do nothing, just check for link up at the end */
        } else if (tp->link_config.autoneg == AUTONEG_ENABLE) {
                u32 adv, new_adv;
@@ -8599,7 +8613,7 @@ static int tg3_set_settings(struct net_device *dev, struct ethtool_cmd *cmd)
                   (cmd->speed == SPEED_1000))
                return -EINVAL;
        else if ((cmd->speed == SPEED_1000) &&
-                 (tp->tg3_flags2 & TG3_FLAG_10_100_ONLY))
+                 (tp->tg3_flags & TG3_FLAG_10_100_ONLY))
                return -EINVAL;
        tg3_full_lock(tp, 0);
@@ -11768,6 +11782,15 @@ static int __devinit tg3_get_invariants(struct tg3 *tp)
        if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5755)
                tp->grc_local_ctrl |= GRC_LCLCTRL_GPIO_UART_SEL;
+        if (tp->pdev->device == PCI_DEVICE_ID_TIGON3_5761) {
+                /* Turn off the debug UART. */
+                tp->grc_local_ctrl |= GRC_LCLCTRL_GPIO_UART_SEL;
+                if (tp->tg3_flags2 & TG3_FLG2_IS_NIC)
+                        /* Keep VMain power. */
+                        tp->grc_local_ctrl |= GRC_LCLCTRL_GPIO_OE0 |
+                                              GRC_LCLCTRL_GPIO_OUTPUT0;
+        }
        /* Force the chip into D0. */
        err = tg3_set_power_state(tp, PCI_D0);
        if (err) {
diff --git a/drivers/net/tulip/tulip_core.c b/drivers/net/tulip/tulip_core.c
index f9d13fa05d64..af8d2c436efd 100644
--- a/drivers/net/tulip/tulip_core.c
+++ b/drivers/net/tulip/tulip_core.c
@@ -731,7 +731,7 @@ static void tulip_down (struct net_device *dev)
        void __iomem *ioaddr = tp->base_addr;
        unsigned long flags;
-        flush_scheduled_work();
+        cancel_work_sync(&tp->media_work);
 #ifdef CONFIG_TULIP_NAPI
        napi_disable(&tp->napi);
@@ -1729,12 +1729,15 @@ static int tulip_suspend (struct pci_dev *pdev, pm_message_t state)
        if (!dev)
                return -EINVAL;
-        if (netif_running(dev))
+        if (!netif_running(dev))
-                tulip_down(dev);
+                goto save_state;
+        tulip_down(dev);
        netif_device_detach(dev);
        free_irq(dev->irq, dev);
+save_state:
        pci_save_state(pdev);
        pci_disable_device(pdev);
        pci_set_power_state(pdev, pci_choose_state(pdev, state));
@@ -1754,6 +1757,9 @@ static int tulip_resume(struct pci_dev *pdev)
        pci_set_power_state(pdev, PCI_D0);
        pci_restore_state(pdev);
+        if (!netif_running(dev))
+                return 0;
        if ((retval = pci_enable_device(pdev))) {
                printk (KERN_ERR "tulip: pci_enable_device failed in resume\n");
                return retval;
diff --git a/drivers/net/ucc_geth_ethtool.c b/drivers/net/ucc_geth_ethtool.c
index 299b7f176950..f5839c4a5cbd 100644
--- a/drivers/net/ucc_geth_ethtool.c
+++ b/drivers/net/ucc_geth_ethtool.c
@@ -73,6 +73,7 @@ static char tx_fw_stat_gstrings[][ETH_GSTRING_LEN] = {
        "tx-frames-ok",
        "tx-excessive-differ-frames",
        "tx-256-511-frames",
+        "tx-512-1023-frames",
        "tx-1024-1518-frames",
        "tx-jumbo-frames",
 };
@@ -308,7 +309,7 @@ static void uec_get_strings(struct net_device *netdev, u32 stringset, u8 *buf)
                buf += UEC_TX_FW_STATS_LEN * ETH_GSTRING_LEN;
        }
        if (stats_mode & UCC_GETH_STATISTICS_GATHERING_MODE_FIRMWARE_RX)
-                memcpy(buf, tx_fw_stat_gstrings, UEC_RX_FW_STATS_LEN *
+                memcpy(buf, rx_fw_stat_gstrings, UEC_RX_FW_STATS_LEN *
                                ETH_GSTRING_LEN);
 }
diff --git a/drivers/net/usb/kaweth.c b/drivers/net/usb/kaweth.c
index 0dcfc0310264..7c66b052f55a 100644
--- a/drivers/net/usb/kaweth.c
+++ b/drivers/net/usb/kaweth.c
@@ -706,7 +706,7 @@ static void kaweth_kill_urbs(struct kaweth_device *kaweth)
        usb_kill_urb(kaweth->rx_urb);
        usb_kill_urb(kaweth->tx_urb);
-        flush_scheduled_work();
+        cancel_delayed_work_sync(&kaweth->lowmem_work);
        /* a scheduled work may have resubmitted,
           we hit them again */
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index fe7cdf2a2a23..4452306d5328 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -44,9 +44,16 @@ struct virtnet_info
        /* The skb we couldn't send because buffers were full. */
        struct sk_buff *last_xmit_skb;
+        /* If we need to free in a timer, this is it. */
+        struct timer_list xmit_free_timer;
        /* Number of input buffers, and max we've ever had. */
        unsigned int num, max;
+        /* For cleaning up after transmission. */
+        struct tasklet_struct tasklet;
+        bool free_in_tasklet;
        /* Receive & send queues. */
        struct sk_buff_head recv;
        struct sk_buff_head send;
@@ -68,8 +75,13 @@ static void skb_xmit_done(struct virtqueue *svq)
        /* Suppress further interrupts. */
        svq->vq_ops->disable_cb(svq);
-        /* We were waiting for more output buffers. */
+        /* We were probably waiting for more output buffers. */
        netif_wake_queue(vi->dev);
+        /* Make sure we re-xmit last_xmit_skb: if there are no more packets
+         * queued, start_xmit won't be called. */
+        tasklet_schedule(&vi->tasklet);
 }
 static void receive_skb(struct net_device *dev, struct sk_buff *skb,
@@ -86,9 +98,7 @@ static void receive_skb(struct net_device *dev, struct sk_buff *skb,
        BUG_ON(len > MAX_PACKET_LEN);
        skb_trim(skb, len);
-        skb->protocol = eth_type_trans(skb, dev);
-        pr_debug("Receiving skb proto 0x%04x len %i type %i\n",
-                 ntohs(skb->protocol), skb->len, skb->pkt_type);
        dev->stats.rx_bytes += skb->len;
        dev->stats.rx_packets++;
@@ -98,6 +108,10 @@ static void receive_skb(struct net_device *dev, struct sk_buff *skb,
                        goto frame_err;
        }
+        skb->protocol = eth_type_trans(skb, dev);
+        pr_debug("Receiving skb proto 0x%04x len %i type %i\n",
+                 ntohs(skb->protocol), skb->len, skb->pkt_type);
        if (hdr->gso_type != VIRTIO_NET_HDR_GSO_NONE) {
                pr_debug("GSO!\n");
                switch (hdr->gso_type & ~VIRTIO_NET_HDR_GSO_ECN) {
@@ -230,9 +244,25 @@ static void free_old_xmit_skbs(struct virtnet_info *vi)
        }
 }
+/* If the virtio transport doesn't always notify us when all in-flight packets
+ * are consumed, we fall back to using this function on a timer to free them. */
+static void xmit_free(unsigned long data)
+{
+        struct virtnet_info *vi = (void *)data;
+        netif_tx_lock(vi->dev);
+        free_old_xmit_skbs(vi);
+        if (!skb_queue_empty(&vi->send))
+                mod_timer(&vi->xmit_free_timer, jiffies + (HZ/10));
+        netif_tx_unlock(vi->dev);
+}
 static int xmit_skb(struct virtnet_info *vi, struct sk_buff *skb)
 {
-        int num;
+        int num, err;
        struct scatterlist sg[2+MAX_SKB_FRAGS];
        struct virtio_net_hdr *hdr;
        const unsigned char *dest = ((struct ethhdr *)skb->data)->h_dest;
@@ -275,7 +305,25 @@ static int xmit_skb(struct virtnet_info *vi, struct sk_buff *skb)
        vnet_hdr_to_sg(sg, skb);
        num = skb_to_sgvec(skb, sg+1, 0, skb->len) + 1;
-        return vi->svq->vq_ops->add_buf(vi->svq, sg, num, 0, skb);
+        err = vi->svq->vq_ops->add_buf(vi->svq, sg, num, 0, skb);
+        if (!err && !vi->free_in_tasklet)
+                mod_timer(&vi->xmit_free_timer, jiffies + (HZ/10));
+        return err;
+}
+static void xmit_tasklet(unsigned long data)
+{
+        struct virtnet_info *vi = (void *)data;
+        netif_tx_lock_bh(vi->dev);
+        if (vi->last_xmit_skb && xmit_skb(vi, vi->last_xmit_skb) == 0) {
+                vi->svq->vq_ops->kick(vi->svq);
+                vi->last_xmit_skb = NULL;
+        }
+        if (vi->free_in_tasklet)
+                free_old_xmit_skbs(vi);
+        netif_tx_unlock_bh(vi->dev);
 }
 static int start_xmit(struct sk_buff *skb, struct net_device *dev)
@@ -287,21 +335,25 @@ again:
        free_old_xmit_skbs(vi);
        /* If we has a buffer left over from last time, send it now. */
-        if (vi->last_xmit_skb) {
+        if (unlikely(vi->last_xmit_skb)) {
                if (xmit_skb(vi, vi->last_xmit_skb) != 0) {
                        /* Drop this skb: we only queue one. */
                        vi->dev->stats.tx_dropped++;
                        kfree_skb(skb);
+                        skb = NULL;
                        goto stop_queue;
                }
                vi->last_xmit_skb = NULL;
        }
        /* Put new one in send queue and do transmit */
-        __skb_queue_head(&vi->send, skb);
+        if (likely(skb)) {
-        if (xmit_skb(vi, skb) != 0) {
+                __skb_queue_head(&vi->send, skb);
-                vi->last_xmit_skb = skb;
+                if (xmit_skb(vi, skb) != 0) {
-                goto stop_queue;
+                        vi->last_xmit_skb = skb;
+                        skb = NULL;
+                        goto stop_queue;
+                }
        }
 done:
        vi->svq->vq_ops->kick(vi->svq);
@@ -411,6 +463,10 @@ static int virtnet_probe(struct virtio_device *vdev)
        vi->vdev = vdev;
        vdev->priv = vi;
+        /* If they give us a callback when all buffers are done, we don't need
+         * the timer. */
+        vi->free_in_tasklet = virtio_has_feature(vdev,VIRTIO_F_NOTIFY_ON_EMPTY);
        /* We expect two virtqueues, receive then send. */
        vi->rvq = vdev->config->find_vq(vdev, 0, skb_recv_done);
        if (IS_ERR(vi->rvq)) {
@@ -428,6 +484,11 @@ static int virtnet_probe(struct virtio_device *vdev)
        skb_queue_head_init(&vi->recv);
        skb_queue_head_init(&vi->send);
+        tasklet_init(&vi->tasklet, xmit_tasklet, (unsigned long)vi);
+        if (!vi->free_in_tasklet)
+                setup_timer(&vi->xmit_free_timer, xmit_free, (unsigned long)vi);
        err = register_netdev(dev);
        if (err) {
                pr_debug("virtio_net: registering device failed\n");
@@ -465,6 +526,9 @@ static void virtnet_remove(struct virtio_device *vdev)
        /* Stop all the virtqueues. */
        vdev->config->reset(vdev);
+        if (!vi->free_in_tasklet)
+                del_timer_sync(&vi->xmit_free_timer);
        /* Free our skbs in send and recv queues, if any. */
        while ((skb = __skb_dequeue(&vi->recv)) != NULL) {
                kfree_skb(skb);
@@ -488,7 +552,7 @@ static struct virtio_device_id id_table[] = {
 static unsigned int features[] = {
        VIRTIO_NET_F_CSUM, VIRTIO_NET_F_GSO, VIRTIO_NET_F_MAC,
        VIRTIO_NET_F_HOST_TSO4, VIRTIO_NET_F_HOST_UFO, VIRTIO_NET_F_HOST_TSO6,
-        VIRTIO_NET_F_HOST_ECN,
+        VIRTIO_NET_F_HOST_ECN, VIRTIO_F_NOTIFY_ON_EMPTY,
 };
 static struct virtio_driver virtio_net = {
diff --git a/drivers/net/wireless/airo.c b/drivers/net/wireless/airo.c
index 4e1c690ff45f..32019fb878d8 100644
--- a/drivers/net/wireless/airo.c
+++ b/drivers/net/wireless/airo.c
@@ -2905,7 +2905,7 @@ EXPORT_SYMBOL(init_airo_card);
 static int waitbusy (struct airo_info *ai) {
        int delay = 0;
-        while ((IN4500 (ai, COMMAND) & COMMAND_BUSY) && (delay < 10000)) {
+        while ((IN4500(ai, COMMAND) & COMMAND_BUSY) && (delay < 10000)) {
                udelay (10);
                if ((++delay % 20) == 0)
                        OUT4500(ai, EVACK, EV_CLEARCOMMANDBUSY);
diff --git a/drivers/net/wireless/b43/b43.h b/drivers/net/wireless/b43/b43.h
index 37783cdd301a..dfa4bdd5597c 100644
--- a/drivers/net/wireless/b43/b43.h
+++ b/drivers/net/wireless/b43/b43.h
@@ -737,6 +737,7 @@ struct b43_wl {
        struct ieee80211_tx_control beacon_txctl;
        bool beacon0_uploaded;
        bool beacon1_uploaded;
+        bool beacon_templates_virgin; /* Never wrote the templates? */
        struct work_struct beacon_update_trigger;
        /* The current QOS parameters for the 4 queues.
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index 8fdba9415c04..6c3d9ea0a9f8 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -1544,6 +1544,30 @@ static void b43_write_probe_resp_template(struct b43_wldev *dev,
        kfree(probe_resp_data);
 }
+static void b43_upload_beacon0(struct b43_wldev *dev)
+{
+        struct b43_wl *wl = dev->wl;
+        if (wl->beacon0_uploaded)
+                return;
+        b43_write_beacon_template(dev, 0x68, 0x18);
+        /* FIXME: Probe resp upload doesn't really belong here,
+         *        but we don't use that feature anyway. */
+        b43_write_probe_resp_template(dev, 0x268, 0x4A,
+                                      &__b43_ratetable[3]);
+        wl->beacon0_uploaded = 1;
+}
+static void b43_upload_beacon1(struct b43_wldev *dev)
+{
+        struct b43_wl *wl = dev->wl;
+        if (wl->beacon1_uploaded)
+                return;
+        b43_write_beacon_template(dev, 0x468, 0x1A);
+        wl->beacon1_uploaded = 1;
+}
 static void handle_irq_beacon(struct b43_wldev *dev)
 {
        struct b43_wl *wl = dev->wl;
@@ -1568,24 +1592,27 @@ static void handle_irq_beacon(struct b43_wldev *dev)
                return;
        }
-        if (!beacon0_valid) {
+        if (unlikely(wl->beacon_templates_virgin)) {
-                if (!wl->beacon0_uploaded) {
+                /* We never uploaded a beacon before.
-                        b43_write_beacon_template(dev, 0x68, 0x18);
+                 * Upload both templates now, but only mark one valid. */
-                        b43_write_probe_resp_template(dev, 0x268, 0x4A,
+                wl->beacon_templates_virgin = 0;
-                                                      &__b43_ratetable[3]);
+                b43_upload_beacon0(dev);
-                        wl->beacon0_uploaded = 1;
+                b43_upload_beacon1(dev);
-                }
                cmd = b43_read32(dev, B43_MMIO_MACCMD);
                cmd |= B43_MACCMD_BEACON0_VALID;
                b43_write32(dev, B43_MMIO_MACCMD, cmd);
-        } else if (!beacon1_valid) {
+        } else {
-                if (!wl->beacon1_uploaded) {
+                if (!beacon0_valid) {
-                        b43_write_beacon_template(dev, 0x468, 0x1A);
+                        b43_upload_beacon0(dev);
-                        wl->beacon1_uploaded = 1;
+                        cmd = b43_read32(dev, B43_MMIO_MACCMD);
+                        cmd |= B43_MACCMD_BEACON0_VALID;
+                        b43_write32(dev, B43_MMIO_MACCMD, cmd);
+                } else if (!beacon1_valid) {
+                        b43_upload_beacon1(dev);
+                        cmd = b43_read32(dev, B43_MMIO_MACCMD);
+                        cmd |= B43_MACCMD_BEACON1_VALID;
+                        b43_write32(dev, B43_MMIO_MACCMD, cmd);
                }
-                cmd = b43_read32(dev, B43_MMIO_MACCMD);
-                cmd |= B43_MACCMD_BEACON1_VALID;
-                b43_write32(dev, B43_MMIO_MACCMD, cmd);
        }
 }
@@ -4073,6 +4100,9 @@ static int b43_op_start(struct ieee80211_hw *hw)
        wl->filter_flags = 0;
        wl->radiotap_enabled = 0;
        b43_qos_clear(wl);
+        wl->beacon0_uploaded = 0;
+        wl->beacon1_uploaded = 0;
+        wl->beacon_templates_virgin = 1;
        /* First register RFkill.
         * LEDs that are registered later depend on it. */
@@ -4241,7 +4271,9 @@ static void b43_chip_reset(struct work_struct *work)
                        goto out;
                }
        }
-      out:
+out:
+        if (err)
+                wl->current_dev = NULL; /* Failed to init the dev. */
        mutex_unlock(&wl->mutex);
        if (err)
                b43err(wl, "Controller restart FAILED\n");
@@ -4382,9 +4414,11 @@ static void b43_one_core_detach(struct ssb_device *dev)
        struct b43_wldev *wldev;
        struct b43_wl *wl;
+        /* Do not cancel ieee80211-workqueue based work here.
+         * See comment in b43_remove(). */
        wldev = ssb_get_drvdata(dev);
        wl = wldev->wl;
-        cancel_work_sync(&wldev->restart_work);
        b43_debugfs_remove_device(wldev);
        b43_wireless_core_detach(wldev);
        list_del(&wldev->list);
@@ -4569,6 +4603,10 @@ static void b43_remove(struct ssb_device *dev)
        struct b43_wl *wl = ssb_get_devtypedata(dev);
        struct b43_wldev *wldev = ssb_get_drvdata(dev);
+        /* We must cancel any work here before unregistering from ieee80211,
+         * as the ieee80211 unreg will destroy the workqueue. */
+        cancel_work_sync(&wldev->restart_work);
        B43_WARN_ON(!wl);
        if (wl->current_dev == wldev)
                ieee80211_unregister_hw(wl->hw);
diff --git a/drivers/net/wireless/b43legacy/main.c b/drivers/net/wireless/b43legacy/main.c
index 14a5eea2573e..204077c13870 100644
--- a/drivers/net/wireless/b43legacy/main.c
+++ b/drivers/net/wireless/b43legacy/main.c
@@ -3039,7 +3039,6 @@ static void b43legacy_set_pretbtt(struct b43legacy_wldev *dev)
 /* Locking: wl->mutex */
 static void b43legacy_wireless_core_exit(struct b43legacy_wldev *dev)
 {
-        struct b43legacy_wl *wl = dev->wl;
        struct b43legacy_phy *phy = &dev->phy;
        u32 macctl;
@@ -3054,12 +3053,6 @@ static void b43legacy_wireless_core_exit(struct b43legacy_wldev *dev)
        macctl |= B43legacy_MACCTL_PSM_JMP0;
        b43legacy_write32(dev, B43legacy_MMIO_MACCTL, macctl);
-        mutex_unlock(&wl->mutex);
-        /* Must unlock as it would otherwise deadlock. No races here.
-         * Cancel possibly pending workqueues. */
-        cancel_work_sync(&dev->restart_work);
-        mutex_lock(&wl->mutex);
        b43legacy_leds_exit(dev);
        b43legacy_rng_exit(dev->wl);
        b43legacy_pio_free(dev);
@@ -3486,6 +3479,8 @@ static void b43legacy_chip_reset(struct work_struct *work)
                }
        }
 out:
+        if (err)
+                wl->current_dev = NULL; /* Failed to init the dev. */
        mutex_unlock(&wl->mutex);
        if (err)
                b43legacyerr(wl, "Controller restart FAILED\n");
@@ -3618,9 +3613,11 @@ static void b43legacy_one_core_detach(struct ssb_device *dev)
        struct b43legacy_wldev *wldev;
        struct b43legacy_wl *wl;
+        /* Do not cancel ieee80211-workqueue based work here.
+         * See comment in b43legacy_remove(). */
        wldev = ssb_get_drvdata(dev);
        wl = wldev->wl;
-        cancel_work_sync(&wldev->restart_work);
        b43legacy_debugfs_remove_device(wldev);
        b43legacy_wireless_core_detach(wldev);
        list_del(&wldev->list);
@@ -3789,6 +3786,10 @@ static void b43legacy_remove(struct ssb_device *dev)
        struct b43legacy_wl *wl = ssb_get_devtypedata(dev);
        struct b43legacy_wldev *wldev = ssb_get_drvdata(dev);
+        /* We must cancel any work here before unregistering from ieee80211,
+         * as the ieee80211 unreg will destroy the workqueue. */
+        cancel_work_sync(&wldev->restart_work);
        B43legacy_WARN_ON(!wl);
        if (wl->current_dev == wldev)
                ieee80211_unregister_hw(wl->hw);
diff --git a/drivers/net/wireless/hostap/hostap_main.c b/drivers/net/wireless/hostap/hostap_main.c
index 20d387f6658c..f7aec9309d04 100644
--- a/drivers/net/wireless/hostap/hostap_main.c
+++ b/drivers/net/wireless/hostap/hostap_main.c
@@ -682,7 +682,13 @@ static int prism2_close(struct net_device *dev)
                netif_device_detach(dev);
        }
-        flush_scheduled_work();
+        cancel_work_sync(&local->reset_queue);
+        cancel_work_sync(&local->set_multicast_list_queue);
+        cancel_work_sync(&local->set_tim_queue);
+#ifndef PRISM2_NO_STATION_MODES
+        cancel_work_sync(&local->info_queue);
+#endif
+        cancel_work_sync(&local->comms_qual_update);
        module_put(local->hw_module);
diff --git a/drivers/net/wireless/ipw2200.c b/drivers/net/wireless/ipw2200.c
index d74c061994ae..6e704608947c 100644
--- a/drivers/net/wireless/ipw2200.c
+++ b/drivers/net/wireless/ipw2200.c
@@ -1753,6 +1753,8 @@ static int ipw_radio_kill_sw(struct ipw_priv *priv, int disable_radio)
                if (priv->workqueue) {
                        cancel_delayed_work(&priv->request_scan);
+                        cancel_delayed_work(&priv->request_direct_scan);
+                        cancel_delayed_work(&priv->request_passive_scan);
                        cancel_delayed_work(&priv->scan_event);
                }
                queue_work(priv->workqueue, &priv->down);
@@ -2005,6 +2007,8 @@ static void ipw_irq_tasklet(struct ipw_priv *priv)
                wake_up_interruptible(&priv->wait_command_queue);
                priv->status &= ~(STATUS_ASSOCIATED | STATUS_ASSOCIATING);
                cancel_delayed_work(&priv->request_scan);
+                cancel_delayed_work(&priv->request_direct_scan);
+                cancel_delayed_work(&priv->request_passive_scan);
                cancel_delayed_work(&priv->scan_event);
                schedule_work(&priv->link_down);
                queue_delayed_work(priv->workqueue, &priv->rf_kill, 2 * HZ);
@@ -4712,6 +4716,12 @@ static void ipw_rx_notification(struct ipw_priv *priv,
                        priv->status &= ~STATUS_SCAN_FORCED;
 #endif                          /* CONFIG_IPW2200_MONITOR */
+                        /* Do queued direct scans first */
+                        if (priv->status & STATUS_DIRECT_SCAN_PENDING) {
+                                queue_delayed_work(priv->workqueue,
+                                                   &priv->request_direct_scan, 0);
+                        }
                        if (!(priv->status & (STATUS_ASSOCIATED |
                                              STATUS_ASSOCIATING |
                                              STATUS_ROAMING |
@@ -6267,7 +6277,7 @@ static void ipw_add_scan_channels(struct ipw_priv *priv,
        }
 }
-static int ipw_request_scan_helper(struct ipw_priv *priv, int type)
+static int ipw_request_scan_helper(struct ipw_priv *priv, int type, int direct)
 {
        struct ipw_scan_request_ext scan;
        int err = 0, scan_type;
@@ -6278,22 +6288,31 @@ static int ipw_request_scan_helper(struct ipw_priv *priv, int type)
        mutex_lock(&priv->mutex);
+        if (direct && (priv->direct_scan_ssid_len == 0)) {
+                IPW_DEBUG_HC("Direct scan requested but no SSID to scan for\n");
+                priv->status &= ~STATUS_DIRECT_SCAN_PENDING;
+                goto done;
+        }
        if (priv->status & STATUS_SCANNING) {
-                IPW_DEBUG_HC("Concurrent scan requested.  Ignoring.\n");
+                IPW_DEBUG_HC("Concurrent scan requested.  Queuing.\n");
-                priv->status |= STATUS_SCAN_PENDING;
+                priv->status |= direct ? STATUS_DIRECT_SCAN_PENDING :
+                                        STATUS_SCAN_PENDING;
                goto done;
        }
        if (!(priv->status & STATUS_SCAN_FORCED) &&
            priv->status & STATUS_SCAN_ABORTING) {
                IPW_DEBUG_HC("Scan request while abort pending.  Queuing.\n");
-                priv->status |= STATUS_SCAN_PENDING;
+                priv->status |= direct ? STATUS_DIRECT_SCAN_PENDING :
+                                        STATUS_SCAN_PENDING;
                goto done;
        }
        if (priv->status & STATUS_RF_KILL_MASK) {
-                IPW_DEBUG_HC("Aborting scan due to RF Kill activation\n");
+                IPW_DEBUG_HC("Queuing scan due to RF Kill activation\n");
-                priv->status |= STATUS_SCAN_PENDING;
+                priv->status |= direct ? STATUS_DIRECT_SCAN_PENDING :
+                                        STATUS_SCAN_PENDING;
                goto done;
        }
@@ -6321,6 +6340,7 @@ static int ipw_request_scan_helper(struct ipw_priv *priv, int type)
                cpu_to_le16(20);
        scan.dwell_time[IPW_SCAN_PASSIVE_FULL_DWELL_SCAN] = cpu_to_le16(120);
+        scan.dwell_time[IPW_SCAN_ACTIVE_DIRECT_SCAN] = cpu_to_le16(20);
 #ifdef CONFIG_IPW2200_MONITOR
        if (priv->ieee->iw_mode == IW_MODE_MONITOR) {
@@ -6360,13 +6380,23 @@ static int ipw_request_scan_helper(struct ipw_priv *priv, int type)
                        cpu_to_le16(2000);
        } else {
 #endif                          /* CONFIG_IPW2200_MONITOR */
-                /* If we are roaming, then make this a directed scan for the
+                /* Honor direct scans first, otherwise if we are roaming make
-                 * current network.  Otherwise, ensure that every other scan
+                 * this a direct scan for the current network.  Finally,
-                 * is a fast channel hop scan */
+                 * ensure that every other scan is a fast channel hop scan */
-                if ((priv->status & STATUS_ROAMING)
+                if (direct) {
-                    || (!(priv->status & STATUS_ASSOCIATED)
+                        err = ipw_send_ssid(priv, priv->direct_scan_ssid,
-                        && (priv->config & CFG_STATIC_ESSID)
+                                            priv->direct_scan_ssid_len);
-                        && (le32_to_cpu(scan.full_scan_index) % 2))) {
+                        if (err) {
+                                IPW_DEBUG_HC("Attempt to send SSID command  "
+                                             "failed\n");
+                                goto done;
+                        }
+                        scan_type = IPW_SCAN_ACTIVE_BROADCAST_AND_DIRECT_SCAN;
+                } else if ((priv->status & STATUS_ROAMING)
+                           || (!(priv->status & STATUS_ASSOCIATED)
+                               && (priv->config & CFG_STATIC_ESSID)
+                               && (le32_to_cpu(scan.full_scan_index) % 2))) {
                        err = ipw_send_ssid(priv, priv->essid, priv->essid_len);
                        if (err) {
                                IPW_DEBUG_HC("Attempt to send SSID command "
@@ -6391,7 +6421,12 @@ send_request:
        }
        priv->status |= STATUS_SCANNING;
-        priv->status &= ~STATUS_SCAN_PENDING;
+        if (direct) {
+                priv->status &= ~STATUS_DIRECT_SCAN_PENDING;
+                priv->direct_scan_ssid_len = 0;
+        } else
+                priv->status &= ~STATUS_SCAN_PENDING;
        queue_delayed_work(priv->workqueue, &priv->scan_check,
                           IPW_SCAN_CHECK_WATCHDOG);
 done:
@@ -6402,15 +6437,22 @@ done:
 static void ipw_request_passive_scan(struct work_struct *work)
 {
        struct ipw_priv *priv =
-                container_of(work, struct ipw_priv, request_passive_scan);
+                container_of(work, struct ipw_priv, request_passive_scan.work);
-        ipw_request_scan_helper(priv, IW_SCAN_TYPE_PASSIVE);
+        ipw_request_scan_helper(priv, IW_SCAN_TYPE_PASSIVE, 0);
 }
 static void ipw_request_scan(struct work_struct *work)
 {
        struct ipw_priv *priv =
                container_of(work, struct ipw_priv, request_scan.work);
-        ipw_request_scan_helper(priv, IW_SCAN_TYPE_ACTIVE);
+        ipw_request_scan_helper(priv, IW_SCAN_TYPE_ACTIVE, 0);
+}
+static void ipw_request_direct_scan(struct work_struct *work)
+{
+        struct ipw_priv *priv =
+                container_of(work, struct ipw_priv, request_direct_scan.work);
+        ipw_request_scan_helper(priv, IW_SCAN_TYPE_ACTIVE, 1);
 }
 static void ipw_bg_abort_scan(struct work_struct *work)
@@ -7558,8 +7600,31 @@ static int ipw_associate(void *data)
            priv->ieee->iw_mode == IW_MODE_ADHOC &&
            priv->config & CFG_ADHOC_CREATE &&
            priv->config & CFG_STATIC_ESSID &&
-            priv->config & CFG_STATIC_CHANNEL &&
+            priv->config & CFG_STATIC_CHANNEL) {
-            !list_empty(&priv->ieee->network_free_list)) {
+                /* Use oldest network if the free list is empty */
+                if (list_empty(&priv->ieee->network_free_list)) {
+                        struct ieee80211_network *oldest = NULL;
+                        struct ieee80211_network *target;
+                        DECLARE_MAC_BUF(mac);
+                        list_for_each_entry(target, &priv->ieee->network_list, list) {
+                                if ((oldest == NULL) ||
+                                    (target->last_scanned < oldest->last_scanned))
+                                        oldest = target;
+                        }
+                        /* If there are no more slots, expire the oldest */
+                        list_del(&oldest->list);
+                        target = oldest;
+                        IPW_DEBUG_ASSOC("Expired '%s' (%s) from "
+                                        "network list.\n",
+                                        escape_essid(target->ssid,
+                                                     target->ssid_len),
+                                        print_mac(mac, target->bssid));
+                        list_add_tail(&target->list,
+                                      &priv->ieee->network_free_list);
+                }
                element = priv->ieee->network_free_list.next;
                network = list_entry(element, struct ieee80211_network, list);
                ipw_adhoc_create(priv, network);
@@ -9454,99 +9519,38 @@ static int ipw_wx_get_retry(struct net_device *dev,
        return 0;
 }
-static int ipw_request_direct_scan(struct ipw_priv *priv, char *essid,
-                                   int essid_len)
-{
-        struct ipw_scan_request_ext scan;
-        int err = 0, scan_type;
-        if (!(priv->status & STATUS_INIT) ||
-            (priv->status & STATUS_EXIT_PENDING))
-                return 0;
-        mutex_lock(&priv->mutex);
-        if (priv->status & STATUS_RF_KILL_MASK) {
-                IPW_DEBUG_HC("Aborting scan due to RF kill activation\n");
-                priv->status |= STATUS_SCAN_PENDING;
-                goto done;
-        }
-        IPW_DEBUG_HC("starting request direct scan!\n");
-        if (priv->status & (STATUS_SCANNING | STATUS_SCAN_ABORTING)) {
-                /* We should not sleep here; otherwise we will block most
-                 * of the system (for instance, we hold rtnl_lock when we
-                 * get here).
-                 */
-                err = -EAGAIN;
-                goto done;
-        }
-        memset(&scan, 0, sizeof(scan));
-        if (priv->config & CFG_SPEED_SCAN)
-                scan.dwell_time[IPW_SCAN_ACTIVE_BROADCAST_SCAN] =
-                    cpu_to_le16(30);
-        else
-                scan.dwell_time[IPW_SCAN_ACTIVE_BROADCAST_SCAN] =
-                    cpu_to_le16(20);
-        scan.dwell_time[IPW_SCAN_ACTIVE_BROADCAST_AND_DIRECT_SCAN] =
-            cpu_to_le16(20);
-        scan.dwell_time[IPW_SCAN_PASSIVE_FULL_DWELL_SCAN] = cpu_to_le16(120);
-        scan.dwell_time[IPW_SCAN_ACTIVE_DIRECT_SCAN] = cpu_to_le16(20);
-        scan.full_scan_index = cpu_to_le32(ieee80211_get_scans(priv->ieee));
-        err = ipw_send_ssid(priv, essid, essid_len);
-        if (err) {
-                IPW_DEBUG_HC("Attempt to send SSID command failed\n");
-                goto done;
-        }
-        scan_type = IPW_SCAN_ACTIVE_BROADCAST_AND_DIRECT_SCAN;
-        ipw_add_scan_channels(priv, &scan, scan_type);
-        err = ipw_send_scan_request_ext(priv, &scan);
-        if (err) {
-                IPW_DEBUG_HC("Sending scan command failed: %08X\n", err);
-                goto done;
-        }
-        priv->status |= STATUS_SCANNING;
-      done:
-        mutex_unlock(&priv->mutex);
-        return err;
-}
 static int ipw_wx_set_scan(struct net_device *dev,
                           struct iw_request_info *info,
                           union iwreq_data *wrqu, char *extra)
 {
        struct ipw_priv *priv = ieee80211_priv(dev);
        struct iw_scan_req *req = (struct iw_scan_req *)extra;
+        struct delayed_work *work = NULL;
        mutex_lock(&priv->mutex);
        priv->user_requested_scan = 1;
-        mutex_unlock(&priv->mutex);
        if (wrqu->data.length == sizeof(struct iw_scan_req)) {
                if (wrqu->data.flags & IW_SCAN_THIS_ESSID) {
-                        ipw_request_direct_scan(priv, req->essid,
+                        int len = min((int)req->essid_len,
-                                                req->essid_len);
+                                      (int)sizeof(priv->direct_scan_ssid));
-                        return 0;
+                        memcpy(priv->direct_scan_ssid, req->essid, len);
-                }
+                        priv->direct_scan_ssid_len = len;
-                if (req->scan_type == IW_SCAN_TYPE_PASSIVE) {
+                        work = &priv->request_direct_scan;
-                        queue_work(priv->workqueue,
+                } else if (req->scan_type == IW_SCAN_TYPE_PASSIVE) {
-                                   &priv->request_passive_scan);
+                        work = &priv->request_passive_scan;
-                        return 0;
                }
+        } else {
+                /* Normal active broadcast scan */
+                work = &priv->request_scan;
        }
+        mutex_unlock(&priv->mutex);
        IPW_DEBUG_WX("Start scan\n");
-        queue_delayed_work(priv->workqueue, &priv->request_scan, 0);
+        queue_delayed_work(priv->workqueue, work, 0);
        return 0;
 }
@@ -10708,6 +10712,8 @@ static void ipw_link_up(struct ipw_priv *priv)
        }
        cancel_delayed_work(&priv->request_scan);
+        cancel_delayed_work(&priv->request_direct_scan);
+        cancel_delayed_work(&priv->request_passive_scan);
        cancel_delayed_work(&priv->scan_event);
        ipw_reset_stats(priv);
        /* Ensure the rate is updated immediately */
@@ -10738,6 +10744,8 @@ static void ipw_link_down(struct ipw_priv *priv)
        /* Cancel any queued work ... */
        cancel_delayed_work(&priv->request_scan);
+        cancel_delayed_work(&priv->request_direct_scan);
+        cancel_delayed_work(&priv->request_passive_scan);
        cancel_delayed_work(&priv->adhoc_check);
        cancel_delayed_work(&priv->gather_stats);
@@ -10777,8 +10785,9 @@ static int __devinit ipw_setup_deferred_work(struct ipw_priv *priv)
        INIT_WORK(&priv->up, ipw_bg_up);
        INIT_WORK(&priv->down, ipw_bg_down);
        INIT_DELAYED_WORK(&priv->request_scan, ipw_request_scan);
+        INIT_DELAYED_WORK(&priv->request_direct_scan, ipw_request_direct_scan);
+        INIT_DELAYED_WORK(&priv->request_passive_scan, ipw_request_passive_scan);
        INIT_DELAYED_WORK(&priv->scan_event, ipw_scan_event);
-        INIT_WORK(&priv->request_passive_scan, ipw_request_passive_scan);
        INIT_DELAYED_WORK(&priv->gather_stats, ipw_bg_gather_stats);
        INIT_WORK(&priv->abort_scan, ipw_bg_abort_scan);
        INIT_WORK(&priv->roam, ipw_bg_roam);
@@ -11812,6 +11821,8 @@ static void __devexit ipw_pci_remove(struct pci_dev *pdev)
        cancel_delayed_work(&priv->adhoc_check);
        cancel_delayed_work(&priv->gather_stats);
        cancel_delayed_work(&priv->request_scan);
+        cancel_delayed_work(&priv->request_direct_scan);
+        cancel_delayed_work(&priv->request_passive_scan);
        cancel_delayed_work(&priv->scan_event);
        cancel_delayed_work(&priv->rf_kill);
        cancel_delayed_work(&priv->scan_check);
diff --git a/drivers/net/wireless/ipw2200.h b/drivers/net/wireless/ipw2200.h
index cd3295b66dd6..d4ab28b73b32 100644
--- a/drivers/net/wireless/ipw2200.h
+++ b/drivers/net/wireless/ipw2200.h
@@ -1037,6 +1037,7 @@ struct ipw_cmd {	 /* XXX */
 #define STATUS_DISASSOC_PENDING (1<<12)
 #define STATUS_STATE_PENDING    (1<<13)
+#define STATUS_DIRECT_SCAN_PENDING (1<<19)
 #define STATUS_SCAN_PENDING     (1<<20)
 #define STATUS_SCANNING         (1<<21)
 #define STATUS_SCAN_ABORTING    (1<<22)
@@ -1292,6 +1293,8 @@ struct ipw_priv {
        struct iw_public_data wireless_data;
        int user_requested_scan;
+        u8 direct_scan_ssid[IW_ESSID_MAX_SIZE];
+        u8 direct_scan_ssid_len;
        struct workqueue_struct *workqueue;
@@ -1301,8 +1304,9 @@ struct ipw_priv {
        struct work_struct system_config;
        struct work_struct rx_replenish;
        struct delayed_work request_scan;
+        struct delayed_work request_direct_scan;
+        struct delayed_work request_passive_scan;
        struct delayed_work scan_event;
-        struct work_struct request_passive_scan;
        struct work_struct adapter_restart;
        struct delayed_work rf_kill;
        struct work_struct up;
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945-led.c b/drivers/net/wireless/iwlwifi/iwl-3945-led.c
index d200d08fb086..8b1528e52d43 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945-led.c
+++ b/drivers/net/wireless/iwlwifi/iwl-3945-led.c
@@ -229,14 +229,15 @@ static int iwl3945_led_register_led(struct iwl3945_priv *priv,
        led->led_dev.brightness_set = iwl3945_led_brightness_set;
        led->led_dev.default_trigger = trigger;
+        led->priv = priv;
+        led->type = type;
        ret = led_classdev_register(device, &led->led_dev);
        if (ret) {
                IWL_ERROR("Error: failed to register led handler.\n");
                return ret;
        }
-        led->priv = priv;
-        led->type = type;
        led->registered = 1;
        if (set_led && led->led_on)
diff --git a/drivers/net/wireless/iwlwifi/iwl-4965-rs.c b/drivers/net/wireless/iwlwifi/iwl-4965-rs.c
index c9847b1a67f7..3a7f0cb710ec 100644
--- a/drivers/net/wireless/iwlwifi/iwl-4965-rs.c
+++ b/drivers/net/wireless/iwlwifi/iwl-4965-rs.c
@@ -1162,7 +1162,6 @@ static s32 rs_get_best_rate(struct iwl_priv *priv,
                        /* Higher rate not available, use the original */
                        } else {
-                                new_rate = rate;
                                break;
                        }
                }
@@ -2009,7 +2008,7 @@ static void rs_rate_scale_perform(struct iwl_priv *priv,
         * 2)  Not just finishing up a search
         * 3)  Allowing a new search
         */
-        if (!update_lq && !done_search && !lq_sta->stay_in_tbl) {
+        if (!update_lq && !done_search && !lq_sta->stay_in_tbl && window->counter) {
                /* Save current throughput to compare with "search" throughput*/
                lq_sta->last_tpt = current_tpt;
diff --git a/drivers/net/wireless/libertas/cmd.c b/drivers/net/wireless/libertas/cmd.c
index 6328b9593877..8124fd9b1353 100644
--- a/drivers/net/wireless/libertas/cmd.c
+++ b/drivers/net/wireless/libertas/cmd.c
@@ -1842,6 +1842,9 @@ static void lbs_send_confirmsleep(struct lbs_private *priv)
        spin_lock_irqsave(&priv->driver_lock, flags);
+        /* We don't get a response on the sleep-confirmation */
+        priv->dnld_sent = DNLD_RES_RECEIVED;
        /* If nothing to do, go back to sleep (?) */
        if (!__kfifo_len(priv->event_fifo) && !priv->resp_len[priv->resp_idx])
                priv->psstate = PS_STATE_SLEEP;
@@ -1904,12 +1907,12 @@ void lbs_ps_confirm_sleep(struct lbs_private *priv)
        lbs_deb_enter(LBS_DEB_HOST);
+        spin_lock_irqsave(&priv->driver_lock, flags);
        if (priv->dnld_sent) {
                allowed = 0;
                lbs_deb_host("dnld_sent was set\n");
        }
-        spin_lock_irqsave(&priv->driver_lock, flags);
        /* In-progress command? */
        if (priv->cur_cmd) {
                allowed = 0;
diff --git a/drivers/net/wireless/libertas/debugfs.c b/drivers/net/wireless/libertas/debugfs.c
index ad2fabca9116..0aa0ce3b2c42 100644
--- a/drivers/net/wireless/libertas/debugfs.c
+++ b/drivers/net/wireless/libertas/debugfs.c
@@ -312,8 +312,8 @@ static ssize_t lbs_threshold_write(uint16_t tlv_type, uint16_t event_mask,
        if (tlv_type != TLV_TYPE_BCNMISS)
                tlv->freq = freq;
-        /* The command header, the event mask, and the one TLV */
+        /* The command header, the action, the event mask, and one TLV */
-        events->hdr.size = cpu_to_le16(sizeof(events->hdr) + 2 + sizeof(*tlv));
+        events->hdr.size = cpu_to_le16(sizeof(events->hdr) + 4 + sizeof(*tlv));
        ret = lbs_cmd_with_response(priv, CMD_802_11_SUBSCRIBE_EVENT, events);
diff --git a/drivers/net/wireless/libertas/main.c b/drivers/net/wireless/libertas/main.c
index e1f066068590..acfc4bfcc262 100644
--- a/drivers/net/wireless/libertas/main.c
+++ b/drivers/net/wireless/libertas/main.c
@@ -732,8 +732,8 @@ static int lbs_thread(void *data)
                lbs_deb_thread("4: currenttxskb %p, dnld_sent %d\n",
                       priv->currenttxskb, priv->dnld_sent);
-                spin_lock_irq(&priv->driver_lock);
                /* Process any pending command response */
+                spin_lock_irq(&priv->driver_lock);
                resp_idx = priv->resp_idx;
                if (priv->resp_len[resp_idx]) {
                        spin_unlock_irq(&priv->driver_lock);
diff --git a/drivers/net/wireless/p54/p54usb.c b/drivers/net/wireless/p54/p54usb.c
index 98ddbb3b3273..1610a7308c1d 100644
--- a/drivers/net/wireless/p54/p54usb.c
+++ b/drivers/net/wireless/p54/p54usb.c
@@ -49,6 +49,7 @@ static struct usb_device_id p54u_table[] __devinitdata = {
        {USB_DEVICE(0x5041, 0x2235)},   /* Linksys WUSB54G Portable */
        /* Version 2 devices (3887) */
+        {USB_DEVICE(0x0471, 0x1230)},   /* Philips CPWUA054/00 */
        {USB_DEVICE(0x050d, 0x7050)},   /* Belkin F5D7050 ver 1000 */
        {USB_DEVICE(0x0572, 0x2000)},   /* Cohiba Proto board */
        {USB_DEVICE(0x0572, 0x2002)},   /* Cohiba Proto board */
diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c
index d0b1fb15c709..18c9931e3267 100644
--- a/drivers/net/wireless/rndis_wlan.c
+++ b/drivers/net/wireless/rndis_wlan.c
@@ -116,6 +116,7 @@ MODULE_PARM_DESC(workaround_interval,
 #define OID_802_11_ENCRYPTION_STATUS            ccpu2(0x0d01011b)
 #define OID_802_11_ADD_KEY                      ccpu2(0x0d01011d)
 #define OID_802_11_REMOVE_KEY                   ccpu2(0x0d01011e)
+#define OID_802_11_ASSOCIATION_INFORMATION      ccpu2(0x0d01011f)
 #define OID_802_11_PMKID                        ccpu2(0x0d010123)
 #define OID_802_11_NETWORK_TYPES_SUPPORTED      ccpu2(0x0d010203)
 #define OID_802_11_NETWORK_TYPE_IN_USE          ccpu2(0x0d010204)
@@ -271,6 +272,26 @@ struct ndis_config_param {
        __le32 value_length;
 } __attribute__((packed));
+struct ndis_80211_assoc_info {
+        __le32 length;
+        __le16 req_ies;
+        struct req_ie {
+                __le16 capa;
+                __le16 listen_interval;
+                u8 cur_ap_address[6];
+        } req_ie;
+        __le32 req_ie_length;
+        __le32 offset_req_ies;
+        __le16 resp_ies;
+        struct resp_ie {
+                __le16 capa;
+                __le16 status_code;
+                __le16 assoc_id;
+        } resp_ie;
+        __le32 resp_ie_length;
+        __le32 offset_resp_ies;
+} __attribute__((packed));
 /* these have to match what is in wpa_supplicant */
 enum wpa_alg { WPA_ALG_NONE, WPA_ALG_WEP, WPA_ALG_TKIP, WPA_ALG_CCMP };
 enum wpa_cipher { CIPHER_NONE, CIPHER_WEP40, CIPHER_TKIP, CIPHER_CCMP,
@@ -674,6 +695,12 @@ static int get_bssid(struct usbnet *usbdev, u8 bssid[ETH_ALEN])
        return ret;
 }
+static int get_association_info(struct usbnet *usbdev,
+                        struct ndis_80211_assoc_info *info, int len)
+{
+        return rndis_query_oid(usbdev, OID_802_11_ASSOCIATION_INFORMATION,
+                                info, &len);
+}
 static int is_associated(struct usbnet *usbdev)
 {
@@ -2182,11 +2209,40 @@ static void rndis_wext_worker(struct work_struct *work)
        struct usbnet *usbdev = priv->usbdev;
        union iwreq_data evt;
        unsigned char bssid[ETH_ALEN];
-        int ret;
+        struct ndis_80211_assoc_info *info;
+        int assoc_size = sizeof(*info) + IW_CUSTOM_MAX + 32;
+        int ret, offset;
        if (test_and_clear_bit(WORK_CONNECTION_EVENT, &priv->work_pending)) {
-                ret = get_bssid(usbdev, bssid);
+                info = kzalloc(assoc_size, GFP_KERNEL);
+                if (!info)
+                        goto get_bssid;
+                /* Get association info IEs from device and send them back to
+                 * userspace. */
+                ret = get_association_info(usbdev, info, assoc_size);
+                if (!ret) {
+                        evt.data.length = le32_to_cpu(info->req_ie_length);
+                        if (evt.data.length > 0) {
+                                offset = le32_to_cpu(info->offset_req_ies);
+                                wireless_send_event(usbdev->net,
+                                        IWEVASSOCREQIE, &evt,
+                                        (char *)info + offset);
+                        }
+                        evt.data.length = le32_to_cpu(info->resp_ie_length);
+                        if (evt.data.length > 0) {
+                                offset = le32_to_cpu(info->offset_resp_ies);
+                                wireless_send_event(usbdev->net,
+                                        IWEVASSOCRESPIE, &evt,
+                                        (char *)info + offset);
+                        }
+                }
+                kfree(info);
+get_bssid:
+                ret = get_bssid(usbdev, bssid);
                if (!ret) {
                        evt.data.flags = 0;
                        evt.data.length = 0;
@@ -2414,6 +2470,11 @@ static int bcm4320_early_init(struct usbnet *dev)
        else if (priv->param_power_save > 2)
                priv->param_power_save = 2;
+        if (priv->param_power_output < 0)
+                priv->param_power_output = 0;
+        else if (priv->param_power_output > 3)
+                priv->param_power_output = 3;
        if (priv->param_roamtrigger < -80)
                priv->param_roamtrigger = -80;
        else if (priv->param_roamtrigger > -60)
diff --git a/drivers/net/wireless/rt2x00/rt2x00.h b/drivers/net/wireless/rt2x00/rt2x00.h
index 57bdc153952f..611d98320593 100644
--- a/drivers/net/wireless/rt2x00/rt2x00.h
+++ b/drivers/net/wireless/rt2x00/rt2x00.h
@@ -328,6 +328,11 @@ static inline int rt2x00_get_link_ant_rssi(struct link *link)
        return DEFAULT_RSSI;
 }
+static inline void rt2x00_reset_link_ant_rssi(struct link *link)
+{
+        link->ant.rssi_ant = 0;
+}
 static inline int rt2x00_get_link_ant_rssi_history(struct link *link,
                                                   enum antenna ant)
 {
diff --git a/drivers/net/wireless/rt2x00/rt2x00config.c b/drivers/net/wireless/rt2x00/rt2x00config.c
index a9930a03f450..48608e8cc8b4 100644
--- a/drivers/net/wireless/rt2x00/rt2x00config.c
+++ b/drivers/net/wireless/rt2x00/rt2x00config.c
@@ -129,6 +129,7 @@ void rt2x00lib_config_antenna(struct rt2x00_dev *rt2x00dev,
         */
        rt2x00dev->ops->lib->config(rt2x00dev, &libconf, CONFIG_UPDATE_ANTENNA);
        rt2x00lib_reset_link_tuner(rt2x00dev);
+        rt2x00_reset_link_ant_rssi(&rt2x00dev->link);
        rt2x00dev->link.ant.active.rx = libconf.ant.rx;
        rt2x00dev->link.ant.active.tx = libconf.ant.tx;
diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
index b22c02737185..2673d568bcac 100644
--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
@@ -483,9 +483,9 @@ void rt2x00lib_beacondone(struct rt2x00_dev *rt2x00dev)
        if (!test_bit(DEVICE_ENABLED_RADIO, &rt2x00dev->flags))
                return;
-        ieee80211_iterate_active_interfaces(rt2x00dev->hw,
+        ieee80211_iterate_active_interfaces_atomic(rt2x00dev->hw,
-                                            rt2x00lib_beacondone_iter,
+                                                   rt2x00lib_beacondone_iter,
-                                            rt2x00dev);
+                                                   rt2x00dev);
        queue_work(rt2x00dev->hw->workqueue, &rt2x00dev->intf_work);
 }
@@ -507,7 +507,7 @@ void rt2x00lib_txdone(struct queue_entry *entry,
         * Update TX statistics.
         */
        rt2x00dev->link.qual.tx_success += success;
-        rt2x00dev->link.qual.tx_failed += txdesc->retry + fail;
+        rt2x00dev->link.qual.tx_failed += fail;
        /*
         * Initialize TX status
diff --git a/drivers/net/wireless/rt2x00/rt2x00mac.c b/drivers/net/wireless/rt2x00/rt2x00mac.c
index c206b5092070..87e280a21971 100644
--- a/drivers/net/wireless/rt2x00/rt2x00mac.c
+++ b/drivers/net/wireless/rt2x00/rt2x00mac.c
@@ -93,6 +93,7 @@ int rt2x00mac_tx(struct ieee80211_hw *hw, struct sk_buff *skb,
         */
        if (!test_bit(DEVICE_PRESENT, &rt2x00dev->flags)) {
                ieee80211_stop_queues(hw);
+                dev_kfree_skb_any(skb);
                return NETDEV_TX_OK;
        }
diff --git a/drivers/net/wireless/rtl8180_grf5101.c b/drivers/net/wireless/rtl8180_grf5101.c
index 5d47935dbac3..947ee55f18b2 100644
--- a/drivers/net/wireless/rtl8180_grf5101.c
+++ b/drivers/net/wireless/rtl8180_grf5101.c
@@ -88,7 +88,7 @@ static void grf5101_rf_set_channel(struct ieee80211_hw *dev,
        write_grf5101(dev, 0x0B, chan);
        write_grf5101(dev, 0x07, 0x1000);
-        grf5101_write_phy_antenna(dev, chan);
+        grf5101_write_phy_antenna(dev, channel);
 }
 static void grf5101_rf_stop(struct ieee80211_hw *dev)
diff --git a/drivers/net/wireless/rtl8180_max2820.c b/drivers/net/wireless/rtl8180_max2820.c
index a34dfd382b6d..6c825fd7f3b6 100644
--- a/drivers/net/wireless/rtl8180_max2820.c
+++ b/drivers/net/wireless/rtl8180_max2820.c
@@ -78,7 +78,8 @@ static void max2820_rf_set_channel(struct ieee80211_hw *dev,
                                   struct ieee80211_conf *conf)
 {
        struct rtl8180_priv *priv = dev->priv;
-        int channel = ieee80211_frequency_to_channel(conf->channel->center_freq);
+        int channel = conf ?
+                ieee80211_frequency_to_channel(conf->channel->center_freq) : 1;
        unsigned int chan_idx = channel - 1;
        u32 txpw = priv->channels[chan_idx].hw_value & 0xFF;
        u32 chan = max2820_chan[chan_idx];
@@ -87,7 +88,7 @@ static void max2820_rf_set_channel(struct ieee80211_hw *dev,
         * sa2400, for MAXIM we do this directly from BB */
        rtl8180_write_phy(dev, 3, txpw);
-        max2820_write_phy_antenna(dev, chan);
+        max2820_write_phy_antenna(dev, channel);
        write_max2820(dev, 3, chan);
 }
diff --git a/drivers/net/wireless/rtl8180_sa2400.c b/drivers/net/wireless/rtl8180_sa2400.c
index 0311b4ea124c..cea4e0ccb92d 100644
--- a/drivers/net/wireless/rtl8180_sa2400.c
+++ b/drivers/net/wireless/rtl8180_sa2400.c
@@ -86,7 +86,7 @@ static void sa2400_rf_set_channel(struct ieee80211_hw *dev,
        write_sa2400(dev, 7, txpw);
-        sa2400_write_phy_antenna(dev, chan);
+        sa2400_write_phy_antenna(dev, channel);
        write_sa2400(dev, 0, chan);
        write_sa2400(dev, 1, 0xbb50);
diff --git a/drivers/net/wireless/zd1211rw/zd_mac.c b/drivers/net/wireless/zd1211rw/zd_mac.c
index 6424e5a2c83d..418606ac1c3b 100644
--- a/drivers/net/wireless/zd1211rw/zd_mac.c
+++ b/drivers/net/wireless/zd1211rw/zd_mac.c
@@ -719,7 +719,7 @@ int zd_mac_rx(struct ieee80211_hw *hw, const u8 *buffer, unsigned int length)
        fc = le16_to_cpu(*((__le16 *) buffer));
        is_qos = ((fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA) &&
-                 ((fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_QOS_DATA);
+                 (fc & IEEE80211_STYPE_QOS_DATA);
        is_4addr = (fc & (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) ==
                   (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS);
        need_padding = is_qos ^ is_4addr;