57 files changed, 608 insertions, 200 deletions
diff --git a/drivers/net/atlx/atl2.c b/drivers/net/atlx/atl2.c
index e637e9f28fd4..937ef1afa5db 100644
--- a/drivers/net/atlx/atl2.c
+++ b/drivers/net/atlx/atl2.c
@@ -1996,13 +1996,15 @@ static int atl2_set_eeprom(struct net_device *netdev,
        if (!eeprom_buff)
                return -ENOMEM;
-        ptr = (u32 *)eeprom_buff;
+        ptr = eeprom_buff;
        if (eeprom->offset & 3) {
                /* need read/modify/write of first changed EEPROM word */
                /* only the second byte of the word is being modified */
-                if (!atl2_read_eeprom(hw, first_dword*4, &(eeprom_buff[0])))
+                if (!atl2_read_eeprom(hw, first_dword*4, &(eeprom_buff[0]))) {
-                        return -EIO;
+                        ret_val = -EIO;
+                        goto out;
+                }
                ptr++;
        }
        if (((eeprom->offset + eeprom->len) & 3)) {
@@ -2011,18 +2013,22 @@ static int atl2_set_eeprom(struct net_device *netdev,
                 * only the first byte of the word is being modified
                 */
                if (!atl2_read_eeprom(hw, last_dword * 4,
-                        &(eeprom_buff[last_dword - first_dword])))
+                                        &(eeprom_buff[last_dword - first_dword]))) {
-                        return -EIO;
+                        ret_val = -EIO;
+                        goto out;
+                }
        }
        /* Device's eeprom is always little-endian, word addressable */
        memcpy(ptr, bytes, eeprom->len);
        for (i = 0; i < last_dword - first_dword + 1; i++) {
-                if (!atl2_write_eeprom(hw, ((first_dword+i)*4), eeprom_buff[i]))
+                if (!atl2_write_eeprom(hw, ((first_dword+i)*4), eeprom_buff[i])) {
-                        return -EIO;
+                        ret_val = -EIO;
+                        goto out;
+                }
        }
+ out:
        kfree(eeprom_buff);
        return ret_val;
 }
diff --git a/drivers/net/bonding/bond_alb.h b/drivers/net/bonding/bond_alb.h
index 118c28aa471e..4b3e35878406 100644
--- a/drivers/net/bonding/bond_alb.h
+++ b/drivers/net/bonding/bond_alb.h
@@ -74,7 +74,7 @@ struct tlb_client_info {
                                 * packets to a Client that the Hash function
                                 * gave this entry index.
                                 */
-        u32 tx_bytes;           /* Each Client acumulates the BytesTx that
+        u32 tx_bytes;           /* Each Client accumulates the BytesTx that
                                 * were tranmitted to it, and after each
                                 * CallBack the LoadHistory is devided
                                 * by the balance interval
diff --git a/drivers/net/irda/via-ircc.c b/drivers/net/irda/via-ircc.c
index 67c0ad42d818..186cd28a61cc 100644
--- a/drivers/net/irda/via-ircc.c
+++ b/drivers/net/irda/via-ircc.c
@@ -75,15 +75,9 @@ static int dongle_id = 0;	/* default: probe */
 /* We can't guess the type of connected dongle, user *must* supply it. */
 module_param(dongle_id, int, 0);
-/* FIXME : we should not need this, because instances should be automatically
- * managed by the PCI layer. Especially that we seem to only be using the
- * first entry. Jean II */
-/* Max 4 instances for now */
-static struct via_ircc_cb *dev_self[] = { NULL, NULL, NULL, NULL };
 /* Some prototypes */
-static int via_ircc_open(int i, chipio_t * info, unsigned int id);
+static int via_ircc_open(struct pci_dev *pdev, chipio_t * info,
-static int via_ircc_close(struct via_ircc_cb *self);
+                         unsigned int id);
 static int via_ircc_dma_receive(struct via_ircc_cb *self);
 static int via_ircc_dma_receive_complete(struct via_ircc_cb *self,
                                         int iobase);
@@ -215,7 +209,7 @@ static int __devinit via_init_one (struct pci_dev *pcidev, const struct pci_devi
                        pci_write_config_byte(pcidev,0x42,(bTmp | 0xf0));
                        pci_write_config_byte(pcidev,0x5a,0xc0);
                        WriteLPCReg(0x28, 0x70 );
-                        if (via_ircc_open(0, &info,0x3076) == 0)
+                        if (via_ircc_open(pcidev, &info, 0x3076) == 0)
                                rc=0;
                } else
                        rc = -ENODEV; //IR not turn on   
@@ -254,7 +248,7 @@ static int __devinit via_init_one (struct pci_dev *pcidev, const struct pci_devi
                        info.irq=FirIRQ;
                        info.dma=FirDRQ1;
                        info.dma2=FirDRQ0;
-                        if (via_ircc_open(0, &info,0x3096) == 0)
+                        if (via_ircc_open(pcidev, &info, 0x3096) == 0)
                                rc=0;
                } else
                        rc = -ENODEV; //IR not turn on !!!!!
@@ -264,48 +258,10 @@ static int __devinit via_init_one (struct pci_dev *pcidev, const struct pci_devi
        return rc;
 }
-/*
- * Function via_ircc_clean ()
- *
- *    Close all configured chips
- *
- */
-static void via_ircc_clean(void)
-{
-        int i;
-        IRDA_DEBUG(3, "%s()\n", __func__);
-        for (i=0; i < ARRAY_SIZE(dev_self); i++) {
-                if (dev_self[i])
-                        via_ircc_close(dev_self[i]);
-        }
-}
-static void __devexit via_remove_one (struct pci_dev *pdev)
-{
-        IRDA_DEBUG(3, "%s()\n", __func__);
-        /* FIXME : This is ugly. We should use pci_get_drvdata(pdev);
-         * to get our driver instance and call directly via_ircc_close().
-         * See vlsi_ir for details...
-         * Jean II */
-        via_ircc_clean();
-        /* FIXME : This should be in via_ircc_close(), because here we may
-         * theoritically disable still configured devices :-( - Jean II */
-        pci_disable_device(pdev);
-}
 static void __exit via_ircc_cleanup(void)
 {
        IRDA_DEBUG(3, "%s()\n", __func__);
-        /* FIXME : This should be redundant, as pci_unregister_driver()
-         * should call via_remove_one() on each device.
-         * Jean II */
-        via_ircc_clean();
        /* Cleanup all instances of the driver */
        pci_unregister_driver (&via_driver); 
 }
@@ -324,12 +280,13 @@ static const struct net_device_ops via_ircc_fir_ops = {
 };
 /*
- * Function via_ircc_open (iobase, irq)
+ * Function via_ircc_open(pdev, iobase, irq)
 *
 *    Open driver instance
 *
 */
-static __devinit int via_ircc_open(int i, chipio_t * info, unsigned int id)
+static __devinit int via_ircc_open(struct pci_dev *pdev, chipio_t * info,
+                                   unsigned int id)
 {
        struct net_device *dev;
        struct via_ircc_cb *self;
@@ -337,9 +294,6 @@ static __devinit int via_ircc_open(int i, chipio_t * info, unsigned int id)
        IRDA_DEBUG(3, "%s()\n", __func__);
-        if (i >= ARRAY_SIZE(dev_self))
-                return -ENOMEM;
        /* Allocate new instance of the driver */
        dev = alloc_irdadev(sizeof(struct via_ircc_cb));
        if (dev == NULL) 
@@ -349,13 +303,8 @@ static __devinit int via_ircc_open(int i, chipio_t * info, unsigned int id)
        self->netdev = dev;
        spin_lock_init(&self->lock);
-        /* FIXME : We should store our driver instance in the PCI layer,
+        pci_set_drvdata(pdev, self);
-         * using pci_set_drvdata(), not in this array.
-         * See vlsi_ir for details... - Jean II */
-        /* FIXME : 'i' is always 0 (see via_init_one()) :-( - Jean II */
-        /* Need to store self somewhere */
-        dev_self[i] = self;
-        self->index = i;
        /* Initialize Resource */
        self->io.cfg_base = info->cfg_base;
        self->io.fir_base = info->fir_base;
@@ -414,7 +363,7 @@ static __devinit int via_ircc_open(int i, chipio_t * info, unsigned int id)
        /* Allocate memory if needed */
        self->rx_buff.head =
-                dma_alloc_coherent(NULL, self->rx_buff.truesize,
+                dma_alloc_coherent(&pdev->dev, self->rx_buff.truesize,
                                   &self->rx_buff_dma, GFP_KERNEL);
        if (self->rx_buff.head == NULL) {
                err = -ENOMEM;
@@ -423,7 +372,7 @@ static __devinit int via_ircc_open(int i, chipio_t * info, unsigned int id)
        memset(self->rx_buff.head, 0, self->rx_buff.truesize);
        self->tx_buff.head =
-                dma_alloc_coherent(NULL, self->tx_buff.truesize,
+                dma_alloc_coherent(&pdev->dev, self->tx_buff.truesize,
                                   &self->tx_buff_dma, GFP_KERNEL);
        if (self->tx_buff.head == NULL) {
                err = -ENOMEM;
@@ -455,33 +404,32 @@ static __devinit int via_ircc_open(int i, chipio_t * info, unsigned int id)
        via_hw_init(self);
        return 0;
 err_out4:
-        dma_free_coherent(NULL, self->tx_buff.truesize,
+        dma_free_coherent(&pdev->dev, self->tx_buff.truesize,
                          self->tx_buff.head, self->tx_buff_dma);
 err_out3:
-        dma_free_coherent(NULL, self->rx_buff.truesize,
+        dma_free_coherent(&pdev->dev, self->rx_buff.truesize,
                          self->rx_buff.head, self->rx_buff_dma);
 err_out2:
        release_region(self->io.fir_base, self->io.fir_ext);
 err_out1:
+        pci_set_drvdata(pdev, NULL);
        free_netdev(dev);
-        dev_self[i] = NULL;
        return err;
 }
 /*
- * Function via_ircc_close (self)
+ * Function via_remove_one(pdev)
 *
 *    Close driver instance
 *
 */
-static int via_ircc_close(struct via_ircc_cb *self)
+static void __devexit via_remove_one(struct pci_dev *pdev)
 {
+        struct via_ircc_cb *self = pci_get_drvdata(pdev);
        int iobase;
        IRDA_DEBUG(3, "%s()\n", __func__);
-        IRDA_ASSERT(self != NULL, return -1;);
        iobase = self->io.fir_base;
        ResetChip(iobase, 5);   //hardware reset.
@@ -493,16 +441,16 @@ static int via_ircc_close(struct via_ircc_cb *self)
                   __func__, self->io.fir_base);
        release_region(self->io.fir_base, self->io.fir_ext);
        if (self->tx_buff.head)
-                dma_free_coherent(NULL, self->tx_buff.truesize,
+                dma_free_coherent(&pdev->dev, self->tx_buff.truesize,
                                  self->tx_buff.head, self->tx_buff_dma);
        if (self->rx_buff.head)
-                dma_free_coherent(NULL, self->rx_buff.truesize,
+                dma_free_coherent(&pdev->dev, self->rx_buff.truesize,
                                  self->rx_buff.head, self->rx_buff_dma);
-        dev_self[self->index] = NULL;
+        pci_set_drvdata(pdev, NULL);
        free_netdev(self->netdev);
-        return 0;
+        pci_disable_device(pdev);
 }
 /*
diff --git a/drivers/net/mlx4/eq.c b/drivers/net/mlx4/eq.c
index 506cfd0372ec..1ad1f6029af8 100644
--- a/drivers/net/mlx4/eq.c
+++ b/drivers/net/mlx4/eq.c
@@ -603,7 +603,9 @@ int mlx4_init_eq_table(struct mlx4_dev *dev)
        }
        for (i = 0; i < dev->caps.num_comp_vectors; ++i) {
-                err = mlx4_create_eq(dev, dev->caps.num_cqs + MLX4_NUM_SPARE_EQE,
+                err = mlx4_create_eq(dev, dev->caps.num_cqs -
+                                          dev->caps.reserved_cqs +
+                                          MLX4_NUM_SPARE_EQE,
                                     (dev->flags & MLX4_FLAG_MSI_X) ? i : 0,
                                     &priv->eq_table.eq[i]);
                if (err) {
diff --git a/drivers/net/mlx4/mcg.c b/drivers/net/mlx4/mcg.c
index e71372aa9cc4..c6d336aed2d9 100644
--- a/drivers/net/mlx4/mcg.c
+++ b/drivers/net/mlx4/mcg.c
@@ -111,7 +111,7 @@ static int new_steering_entry(struct mlx4_dev *dev, u8 vep_num, u8 port,
        u32 members_count;
        struct mlx4_steer_index *new_entry;
        struct mlx4_promisc_qp *pqp;
-        struct mlx4_promisc_qp *dqp;
+        struct mlx4_promisc_qp *dqp = NULL;
        u32 prot;
        int err;
        u8 pf_num;
@@ -184,7 +184,7 @@ out_mailbox:
 out_alloc:
        if (dqp) {
                list_del(&dqp->list);
-                kfree(&dqp);
+                kfree(dqp);
        }
        list_del(&new_entry->list);
        kfree(new_entry);
@@ -469,7 +469,6 @@ static int remove_promisc_qp(struct mlx4_dev *dev, u8 vep_num, u8 port,
        /*remove from list of promisc qps */
        list_del(&pqp->list);
-        kfree(pqp);
        /* set the default entry not to include the removed one */
        mailbox = mlx4_alloc_cmd_mailbox(dev);
@@ -528,6 +527,8 @@ out_mailbox:
 out_list:
        if (back_to_list)
                list_add_tail(&pqp->list, &s_steer->promisc_qps[steer]);
+        else
+                kfree(pqp);
 out_mutex:
        mutex_unlock(&priv->mcg_table.mutex);
        return err;
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index 993c52c82aeb..e870c0698bbe 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -442,11 +442,11 @@ static int phy_attach_direct(struct net_device *dev, struct phy_device *phydev,
                             u32 flags, phy_interface_t interface)
 {
        struct device *d = &phydev->dev;
+        int err;
        /* Assume that if there is no driver, that it doesn't
         * exist, and we should use the genphy driver. */
        if (NULL == d->driver) {
-                int err;
                d->driver = &genphy_driver.driver;
                err = d->driver->probe(d);
@@ -474,7 +474,11 @@ static int phy_attach_direct(struct net_device *dev, struct phy_device *phydev,
        /* Do initial configuration here, now that
         * we have certain key parameters
         * (dev_flags and interface) */
-        return phy_init_hw(phydev);
+        err = phy_init_hw(phydev);
+        if (err)
+                phy_detach(phydev);
+        return err;
 }
 /**
diff --git a/drivers/net/starfire.c b/drivers/net/starfire.c
index a4f2bd52e546..36045f3b0327 100644
--- a/drivers/net/starfire.c
+++ b/drivers/net/starfire.c
@@ -144,11 +144,7 @@ static int full_duplex[MAX_UNITS] = {0, };
 /* Time in jiffies before concluding the transmitter is hung. */
 #define TX_TIMEOUT      (2 * HZ)
-/*
+#ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT
- * This SUCKS.
- * We need a much better method to determine if dma_addr_t is 64-bit.
- */
-#if (defined(__i386__) && defined(CONFIG_HIGHMEM64G)) || defined(__x86_64__) || defined (__ia64__) || defined(__alpha__) || (defined(CONFIG_MIPS) && ((defined(CONFIG_HIGHMEM) && defined(CONFIG_64BIT_PHYS_ADDR)) || defined(CONFIG_64BIT))) || (defined(__powerpc64__) || defined(CONFIG_PHYS_64BIT))
 /* 64-bit dma_addr_t */
 #define ADDR_64BITS     /* This chip uses 64 bit addresses. */
 #define netdrv_addr_t __le64
diff --git a/drivers/net/usb/Kconfig b/drivers/net/usb/Kconfig
index 6f600cced6e1..3ec22c307797 100644
--- a/drivers/net/usb/Kconfig
+++ b/drivers/net/usb/Kconfig
@@ -433,4 +433,19 @@ config USB_SIERRA_NET
          To compile this driver as a module, choose M here: the
          module will be called sierra_net.
+config USB_VL600
+        tristate "LG VL600 modem dongle"
+        depends on USB_NET_CDCETHER
+        select USB_ACM
+        help
+          Select this if you want to use an LG Electronics 4G/LTE usb modem
+          called VL600.  This driver only handles the ethernet
+          interface exposed by the modem firmware.  To establish a connection
+          you will first need a userspace program that sends the right
+          command to the modem through its CDC ACM port, and most
+          likely also a DHCP client.  See this thread about using the
+          4G modem from Verizon:
+          http://ubuntuforums.org/showpost.php?p=10589647&postcount=17
 endmenu
diff --git a/drivers/net/usb/Makefile b/drivers/net/usb/Makefile
index cac170301187..c7ec8a5f0a90 100644
--- a/drivers/net/usb/Makefile
+++ b/drivers/net/usb/Makefile
@@ -27,4 +27,5 @@ obj-$(CONFIG_USB_IPHETH)	+= ipheth.o
 obj-$(CONFIG_USB_SIERRA_NET)    += sierra_net.o
 obj-$(CONFIG_USB_NET_CX82310_ETH)       += cx82310_eth.o
 obj-$(CONFIG_USB_NET_CDC_NCM)   += cdc_ncm.o
+obj-$(CONFIG_USB_VL600)         += lg-vl600.o
diff --git a/drivers/net/usb/cdc_eem.c b/drivers/net/usb/cdc_eem.c
index 5f3b97668e63..8f128541656d 100644
--- a/drivers/net/usb/cdc_eem.c
+++ b/drivers/net/usb/cdc_eem.c
@@ -340,7 +340,7 @@ next:
 static const struct driver_info eem_info = {
        .description =  "CDC EEM Device",
-        .flags =        FLAG_ETHER,
+        .flags =        FLAG_ETHER | FLAG_POINTTOPOINT,
        .bind =         eem_bind,
        .rx_fixup =     eem_rx_fixup,
        .tx_fixup =     eem_tx_fixup,
diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
index 9a60e415d76b..341f7056a800 100644
--- a/drivers/net/usb/cdc_ether.c
+++ b/drivers/net/usb/cdc_ether.c
@@ -378,7 +378,7 @@ static void dumpspeed(struct usbnet *dev, __le32 *speeds)
                   __le32_to_cpu(speeds[1]) / 1000);
 }
-static void cdc_status(struct usbnet *dev, struct urb *urb)
+void usbnet_cdc_status(struct usbnet *dev, struct urb *urb)
 {
        struct usb_cdc_notification     *event;
@@ -418,8 +418,9 @@ static void cdc_status(struct usbnet *dev, struct urb *urb)
                break;
        }
 }
+EXPORT_SYMBOL_GPL(usbnet_cdc_status);
-static int cdc_bind(struct usbnet *dev, struct usb_interface *intf)
+int usbnet_cdc_bind(struct usbnet *dev, struct usb_interface *intf)
 {
        int                             status;
        struct cdc_state                *info = (void *) &dev->data;
@@ -441,6 +442,7 @@ static int cdc_bind(struct usbnet *dev, struct usb_interface *intf)
         */
        return 0;
 }
+EXPORT_SYMBOL_GPL(usbnet_cdc_bind);
 static int cdc_manage_power(struct usbnet *dev, int on)
 {
@@ -450,20 +452,20 @@ static int cdc_manage_power(struct usbnet *dev, int on)
 static const struct driver_info cdc_info = {
        .description =  "CDC Ethernet Device",
-        .flags =        FLAG_ETHER,
+        .flags =        FLAG_ETHER | FLAG_POINTTOPOINT,
        // .check_connect = cdc_check_connect,
-        .bind =         cdc_bind,
+        .bind =         usbnet_cdc_bind,
        .unbind =       usbnet_cdc_unbind,
-        .status =       cdc_status,
+        .status =       usbnet_cdc_status,
        .manage_power = cdc_manage_power,
 };
 static const struct driver_info mbm_info = {
        .description =  "Mobile Broadband Network Device",
        .flags =        FLAG_WWAN,
-        .bind =         cdc_bind,
+        .bind =         usbnet_cdc_bind,
        .unbind =       usbnet_cdc_unbind,
-        .status =       cdc_status,
+        .status =       usbnet_cdc_status,
        .manage_power = cdc_manage_power,
 };
@@ -560,6 +562,13 @@ static const struct usb_device_id	products [] = {
        .driver_info            = 0,
 },
+/* LG Electronics VL600 wants additional headers on every frame */
+{
+        USB_DEVICE_AND_INTERFACE_INFO(0x1004, 0x61aa, USB_CLASS_COMM,
+                        USB_CDC_SUBCLASS_ETHERNET, USB_CDC_PROTO_NONE),
+        .driver_info            = 0,
+},
 /*
 * WHITELIST!!!
 *
diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
index 7113168473cf..967371f04454 100644
--- a/drivers/net/usb/cdc_ncm.c
+++ b/drivers/net/usb/cdc_ncm.c
@@ -1237,7 +1237,7 @@ static int cdc_ncm_manage_power(struct usbnet *dev, int status)
 static const struct driver_info cdc_ncm_info = {
        .description = "CDC NCM",
-        .flags = FLAG_NO_SETINT | FLAG_MULTI_PACKET,
+        .flags = FLAG_POINTTOPOINT | FLAG_NO_SETINT | FLAG_MULTI_PACKET,
        .bind = cdc_ncm_bind,
        .unbind = cdc_ncm_unbind,
        .check_connect = cdc_ncm_check_connect,
diff --git a/drivers/net/usb/cdc_subset.c b/drivers/net/usb/cdc_subset.c
index ca39ace0b0eb..fc5f13d47ad9 100644
--- a/drivers/net/usb/cdc_subset.c
+++ b/drivers/net/usb/cdc_subset.c
@@ -89,6 +89,7 @@ static int always_connected (struct usbnet *dev)
 static const struct driver_info ali_m5632_info = {
        .description =  "ALi M5632",
+        .flags       = FLAG_POINTTOPOINT,
 };
 #endif
@@ -110,6 +111,7 @@ static const struct driver_info	ali_m5632_info = {
 static const struct driver_info an2720_info = {
        .description =  "AnchorChips/Cypress 2720",
+        .flags       = FLAG_POINTTOPOINT,
        // no reset available!
        // no check_connect available!
@@ -132,6 +134,7 @@ static const struct driver_info	an2720_info = {
 static const struct driver_info belkin_info = {
        .description =  "Belkin, eTEK, or compatible",
+        .flags       = FLAG_POINTTOPOINT,
 };
 #endif  /* CONFIG_USB_BELKIN */
@@ -157,6 +160,7 @@ static const struct driver_info	belkin_info = {
 static const struct driver_info epson2888_info = {
        .description =  "Epson USB Device",
        .check_connect = always_connected,
+        .flags = FLAG_POINTTOPOINT,
        .in = 4, .out = 3,
 };
@@ -173,6 +177,7 @@ static const struct driver_info	epson2888_info = {
 #define HAVE_HARDWARE
 static const struct driver_info kc2190_info = {
        .description =  "KC Technology KC-190",
+        .flags = FLAG_POINTTOPOINT,
 };
 #endif /* CONFIG_USB_KC2190 */
@@ -200,16 +205,19 @@ static const struct driver_info kc2190_info = {
 static const struct driver_info linuxdev_info = {
        .description =  "Linux Device",
        .check_connect = always_connected,
+        .flags = FLAG_POINTTOPOINT,
 };
 static const struct driver_info yopy_info = {
        .description =  "Yopy",
        .check_connect = always_connected,
+        .flags = FLAG_POINTTOPOINT,
 };
 static const struct driver_info blob_info = {
        .description =  "Boot Loader OBject",
        .check_connect = always_connected,
+        .flags = FLAG_POINTTOPOINT,
 };
 #endif  /* CONFIG_USB_ARMLINUX */
diff --git a/drivers/net/usb/gl620a.c b/drivers/net/usb/gl620a.c
index dcd57c37ef73..c4cfd1dea881 100644
--- a/drivers/net/usb/gl620a.c
+++ b/drivers/net/usb/gl620a.c
@@ -193,7 +193,7 @@ static int genelink_bind(struct usbnet *dev, struct usb_interface *intf)
 static const struct driver_info genelink_info = {
        .description =  "Genesys GeneLink",
-        .flags =        FLAG_FRAMING_GL | FLAG_NO_SETINT,
+        .flags =        FLAG_POINTTOPOINT | FLAG_FRAMING_GL | FLAG_NO_SETINT,
        .bind =         genelink_bind,
        .rx_fixup =     genelink_rx_fixup,
        .tx_fixup =     genelink_tx_fixup,
diff --git a/drivers/net/usb/lg-vl600.c b/drivers/net/usb/lg-vl600.c
new file mode 100644
index 000000000000..1d83ccfd7277
--- /dev/null
+++ b/drivers/net/usb/lg-vl600.c
@@ -0,0 +1,346 @@
+/*
+ * Ethernet interface part of the LG VL600 LTE modem (4G dongle)
+ *
+ * Copyright (C) 2011 Intel Corporation
+ * Author: Andrzej Zaborowski <balrogg@gmail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ */
+#include <linux/etherdevice.h>
+#include <linux/ethtool.h>
+#include <linux/mii.h>
+#include <linux/usb.h>
+#include <linux/usb/cdc.h>
+#include <linux/usb/usbnet.h>
+#include <linux/if_ether.h>
+#include <linux/if_arp.h>
+#include <linux/inetdevice.h>
+/*
+ * The device has a CDC ACM port for modem control (it claims to be
+ * CDC ACM anyway) and a CDC Ethernet port for actual network data.
+ * It will however ignore data on both ports that is not encapsulated
+ * in a specific way, any data returned is also encapsulated the same
+ * way.  The headers don't seem to follow any popular standard.
+ *
+ * This driver adds and strips these headers from the ethernet frames
+ * sent/received from the CDC Ethernet port.  The proprietary header
+ * replaces the standard ethernet header in a packet so only actual
+ * ethernet frames are allowed.  The headers allow some form of
+ * multiplexing by using non standard values of the .h_proto field.
+ * Windows/Mac drivers do send a couple of such frames to the device
+ * during initialisation, with protocol set to 0x0906 or 0x0b06 and (what
+ * seems to be) a flag in the .dummy_flags.  This doesn't seem necessary
+ * for modem operation but can possibly be used for GPS or other funcitons.
+ */
+struct vl600_frame_hdr {
+        __le32 len;
+        __le32 serial;
+        __le32 pkt_cnt;
+        __le32 dummy_flags;
+        __le32 dummy;
+        __le32 magic;
+} __attribute__((packed));
+struct vl600_pkt_hdr {
+        __le32 dummy[2];
+        __le32 len;
+        __be16 h_proto;
+} __attribute__((packed));
+struct vl600_state {
+        struct sk_buff *current_rx_buf;
+};
+static int vl600_bind(struct usbnet *dev, struct usb_interface *intf)
+{
+        int ret;
+        struct vl600_state *s = kzalloc(sizeof(struct vl600_state), GFP_KERNEL);
+        if (!s)
+                return -ENOMEM;
+        ret = usbnet_cdc_bind(dev, intf);
+        if (ret) {
+                kfree(s);
+                return ret;
+        }
+        dev->driver_priv = s;
+        /* ARP packets don't go through, but they're also of no use.  The
+         * subnet has only two hosts anyway: us and the gateway / DHCP
+         * server (probably simulated by modem firmware or network operator)
+         * whose address changes everytime we connect to the intarwebz and
+         * who doesn't bother answering ARP requests either.  So hardware
+         * addresses have no meaning, the destination and the source of every
+         * packet depend only on whether it is on the IN or OUT endpoint.  */
+        dev->net->flags |= IFF_NOARP;
+        return ret;
+}
+static void vl600_unbind(struct usbnet *dev, struct usb_interface *intf)
+{
+        struct vl600_state *s = dev->driver_priv;
+        if (s->current_rx_buf)
+                dev_kfree_skb(s->current_rx_buf);
+        kfree(s);
+        return usbnet_cdc_unbind(dev, intf);
+}
+static int vl600_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
+{
+        struct vl600_frame_hdr *frame;
+        struct vl600_pkt_hdr *packet;
+        struct ethhdr *ethhdr;
+        int packet_len, count;
+        struct sk_buff *buf = skb;
+        struct sk_buff *clone;
+        struct vl600_state *s = dev->driver_priv;
+        /* Frame lengths are generally 4B multiplies but every couple of
+         * hours there's an odd number of bytes sized yet correct frame,
+         * so don't require this.  */
+        /* Allow a packet (or multiple packets batched together) to be
+         * split across many frames.  We don't allow a new batch to
+         * begin in the same frame another one is ending however, and no
+         * leading or trailing pad bytes.  */
+        if (s->current_rx_buf) {
+                frame = (struct vl600_frame_hdr *) s->current_rx_buf->data;
+                if (skb->len + s->current_rx_buf->len >
+                                le32_to_cpup(&frame->len)) {
+                        netif_err(dev, ifup, dev->net, "Fragment too long\n");
+                        dev->net->stats.rx_length_errors++;
+                        goto error;
+                }
+                buf = s->current_rx_buf;
+                memcpy(skb_put(buf, skb->len), skb->data, skb->len);
+        } else if (skb->len < 4) {
+                netif_err(dev, ifup, dev->net, "Frame too short\n");
+                dev->net->stats.rx_length_errors++;
+                goto error;
+        }
+        frame = (struct vl600_frame_hdr *) buf->data;
+        /* NOTE: Should check that frame->magic == 0x53544448?
+         * Otherwise if we receive garbage at the beginning of the frame
+         * we may end up allocating a huge buffer and saving all the
+         * future incoming data into it.  */
+        if (buf->len < sizeof(*frame) ||
+                        buf->len != le32_to_cpup(&frame->len)) {
+                /* Save this fragment for later assembly */
+                if (s->current_rx_buf)
+                        return 0;
+                s->current_rx_buf = skb_copy_expand(skb, 0,
+                                le32_to_cpup(&frame->len), GFP_ATOMIC);
+                if (!s->current_rx_buf) {
+                        netif_err(dev, ifup, dev->net, "Reserving %i bytes "
+                                        "for packet assembly failed.\n",
+                                        le32_to_cpup(&frame->len));
+                        dev->net->stats.rx_errors++;
+                }
+                return 0;
+        }
+        count = le32_to_cpup(&frame->pkt_cnt);
+        skb_pull(buf, sizeof(*frame));
+        while (count--) {
+                if (buf->len < sizeof(*packet)) {
+                        netif_err(dev, ifup, dev->net, "Packet too short\n");
+                        goto error;
+                }
+                packet = (struct vl600_pkt_hdr *) buf->data;
+                packet_len = sizeof(*packet) + le32_to_cpup(&packet->len);
+                if (packet_len > buf->len) {
+                        netif_err(dev, ifup, dev->net,
+                                        "Bad packet length stored in header\n");
+                        goto error;
+                }
+                /* Packet header is same size as the ethernet header
+                 * (sizeof(*packet) == sizeof(*ethhdr)), additionally
+                 * the h_proto field is in the same place so we just leave it
+                 * alone and fill in the remaining fields.
+                 */
+                ethhdr = (struct ethhdr *) skb->data;
+                if (be16_to_cpup(&ethhdr->h_proto) == ETH_P_ARP &&
+                                buf->len > 0x26) {
+                        /* Copy the addresses from packet contents */
+                        memcpy(ethhdr->h_source,
+                                        &buf->data[sizeof(*ethhdr) + 0x8],
+                                        ETH_ALEN);
+                        memcpy(ethhdr->h_dest,
+                                        &buf->data[sizeof(*ethhdr) + 0x12],
+                                        ETH_ALEN);
+                } else {
+                        memset(ethhdr->h_source, 0, ETH_ALEN);
+                        memcpy(ethhdr->h_dest, dev->net->dev_addr, ETH_ALEN);
+                }
+                if (count) {
+                        /* Not the last packet in this batch */
+                        clone = skb_clone(buf, GFP_ATOMIC);
+                        if (!clone)
+                                goto error;
+                        skb_trim(clone, packet_len);
+                        usbnet_skb_return(dev, clone);
+                        skb_pull(buf, (packet_len + 3) & ~3);
+                } else {
+                        skb_trim(buf, packet_len);
+                        if (s->current_rx_buf) {
+                                usbnet_skb_return(dev, buf);
+                                s->current_rx_buf = NULL;
+                                return 0;
+                        }
+                        return 1;
+                }
+        }
+error:
+        if (s->current_rx_buf) {
+                dev_kfree_skb_any(s->current_rx_buf);
+                s->current_rx_buf = NULL;
+        }
+        dev->net->stats.rx_errors++;
+        return 0;
+}
+static struct sk_buff *vl600_tx_fixup(struct usbnet *dev,
+                struct sk_buff *skb, gfp_t flags)
+{
+        struct sk_buff *ret;
+        struct vl600_frame_hdr *frame;
+        struct vl600_pkt_hdr *packet;
+        static uint32_t serial = 1;
+        int orig_len = skb->len - sizeof(struct ethhdr);
+        int full_len = (skb->len + sizeof(struct vl600_frame_hdr) + 3) & ~3;
+        frame = (struct vl600_frame_hdr *) skb->data;
+        if (skb->len > sizeof(*frame) && skb->len == le32_to_cpup(&frame->len))
+                return skb; /* Already encapsulated? */
+        if (skb->len < sizeof(struct ethhdr))
+                /* Drop, device can only deal with ethernet packets */
+                return NULL;
+        if (!skb_cloned(skb)) {
+                int headroom = skb_headroom(skb);
+                int tailroom = skb_tailroom(skb);
+                if (tailroom >= full_len - skb->len - sizeof(*frame) &&
+                                headroom >= sizeof(*frame))
+                        /* There's enough head and tail room */
+                        goto encapsulate;
+                if (headroom + tailroom + skb->len >= full_len) {
+                        /* There's enough total room, just readjust */
+                        skb->data = memmove(skb->head + sizeof(*frame),
+                                        skb->data, skb->len);
+                        skb_set_tail_pointer(skb, skb->len);
+                        goto encapsulate;
+                }
+        }
+        /* Alloc a new skb with the required size */
+        ret = skb_copy_expand(skb, sizeof(struct vl600_frame_hdr), full_len -
+                        skb->len - sizeof(struct vl600_frame_hdr), flags);
+        dev_kfree_skb_any(skb);
+        if (!ret)
+                return ret;
+        skb = ret;
+encapsulate:
+        /* Packet header is same size as ethernet packet header
+         * (sizeof(*packet) == sizeof(struct ethhdr)), additionally the
+         * h_proto field is in the same place so we just leave it alone and
+         * overwrite the remaining fields.
+         */
+        packet = (struct vl600_pkt_hdr *) skb->data;
+        memset(&packet->dummy, 0, sizeof(packet->dummy));
+        packet->len = cpu_to_le32(orig_len);
+        frame = (struct vl600_frame_hdr *) skb_push(skb, sizeof(*frame));
+        memset(frame, 0, sizeof(*frame));
+        frame->len = cpu_to_le32(full_len);
+        frame->serial = cpu_to_le32(serial++);
+        frame->pkt_cnt = cpu_to_le32(1);
+        if (skb->len < full_len) /* Pad */
+                skb_put(skb, full_len - skb->len);
+        return skb;
+}
+static const struct driver_info vl600_info = {
+        .description    = "LG VL600 modem",
+        .flags          = FLAG_ETHER | FLAG_RX_ASSEMBLE,
+        .bind           = vl600_bind,
+        .unbind         = vl600_unbind,
+        .status         = usbnet_cdc_status,
+        .rx_fixup       = vl600_rx_fixup,
+        .tx_fixup       = vl600_tx_fixup,
+};
+static const struct usb_device_id products[] = {
+        {
+                USB_DEVICE_AND_INTERFACE_INFO(0x1004, 0x61aa, USB_CLASS_COMM,
+                                USB_CDC_SUBCLASS_ETHERNET, USB_CDC_PROTO_NONE),
+                .driver_info    = (unsigned long) &vl600_info,
+        },
+        {},     /* End */
+};
+MODULE_DEVICE_TABLE(usb, products);
+static struct usb_driver lg_vl600_driver = {
+        .name           = "lg-vl600",
+        .id_table       = products,
+        .probe          = usbnet_probe,
+        .disconnect     = usbnet_disconnect,
+        .suspend        = usbnet_suspend,
+        .resume         = usbnet_resume,
+};
+static int __init vl600_init(void)
+{
+        return usb_register(&lg_vl600_driver);
+}
+module_init(vl600_init);
+static void __exit vl600_exit(void)
+{
+        usb_deregister(&lg_vl600_driver);
+}
+module_exit(vl600_exit);
+MODULE_AUTHOR("Anrzej Zaborowski");
+MODULE_DESCRIPTION("LG-VL600 modem's ethernet link");
+MODULE_LICENSE("GPL");
diff --git a/drivers/net/usb/net1080.c b/drivers/net/usb/net1080.c
index ba72a7281cb0..01db4602a39e 100644
--- a/drivers/net/usb/net1080.c
+++ b/drivers/net/usb/net1080.c
@@ -560,7 +560,7 @@ static int net1080_bind(struct usbnet *dev, struct usb_interface *intf)
 static const struct driver_info net1080_info = {
        .description =  "NetChip TurboCONNECT",
-        .flags =        FLAG_FRAMING_NC,
+        .flags =        FLAG_POINTTOPOINT | FLAG_FRAMING_NC,
        .bind =         net1080_bind,
        .reset =        net1080_reset,
        .check_connect = net1080_check_connect,
diff --git a/drivers/net/usb/plusb.c b/drivers/net/usb/plusb.c
index 08ad269f6b4e..823c53751307 100644
--- a/drivers/net/usb/plusb.c
+++ b/drivers/net/usb/plusb.c
@@ -96,7 +96,7 @@ static int pl_reset(struct usbnet *dev)
 static const struct driver_info prolific_info = {
        .description =  "Prolific PL-2301/PL-2302",
-        .flags =        FLAG_NO_SETINT,
+        .flags =        FLAG_POINTTOPOINT | FLAG_NO_SETINT,
                /* some PL-2302 versions seem to fail usb_set_interface() */
        .reset =        pl_reset,
 };
diff --git a/drivers/net/usb/rndis_host.c b/drivers/net/usb/rndis_host.c
index dd8a4adf48ca..5994a25c56ac 100644
--- a/drivers/net/usb/rndis_host.c
+++ b/drivers/net/usb/rndis_host.c
@@ -573,7 +573,7 @@ EXPORT_SYMBOL_GPL(rndis_tx_fixup);
 static const struct driver_info rndis_info = {
        .description =  "RNDIS device",
-        .flags =        FLAG_ETHER | FLAG_FRAMING_RN | FLAG_NO_SETINT,
+        .flags =        FLAG_ETHER | FLAG_POINTTOPOINT | FLAG_FRAMING_RN | FLAG_NO_SETINT,
        .bind =         rndis_bind,
        .unbind =       rndis_unbind,
        .status =       rndis_status,
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index 95c41d56631c..069c1cf0fdf7 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -387,8 +387,12 @@ static int rx_submit (struct usbnet *dev, struct urb *urb, gfp_t flags)
 static inline void rx_process (struct usbnet *dev, struct sk_buff *skb)
 {
        if (dev->driver_info->rx_fixup &&
-            !dev->driver_info->rx_fixup (dev, skb))
+            !dev->driver_info->rx_fixup (dev, skb)) {
-                goto error;
+                /* With RX_ASSEMBLE, rx_fixup() must update counters */
+                if (!(dev->driver_info->flags & FLAG_RX_ASSEMBLE))
+                        dev->net->stats.rx_errors++;
+                goto done;
+        }
        // else network stack removes extra byte if we forced a short packet
        if (skb->len) {
@@ -401,8 +405,8 @@ static inline void rx_process (struct usbnet *dev, struct sk_buff *skb)
        }
        netif_dbg(dev, rx_err, dev->net, "drop\n");
-error:
        dev->net->stats.rx_errors++;
+done:
        skb_queue_tail(&dev->done, skb);
 }
@@ -1376,7 +1380,8 @@ usbnet_probe (struct usb_interface *udev, const struct usb_device_id *prod)
                // else "eth%d" when there's reasonable doubt.  userspace
                // can rename the link if it knows better.
                if ((dev->driver_info->flags & FLAG_ETHER) != 0 &&
-                    (net->dev_addr [0] & 0x02) == 0)
+                    ((dev->driver_info->flags & FLAG_POINTTOPOINT) == 0 ||
+                     (net->dev_addr [0] & 0x02) == 0))
                        strcpy (net->name, "eth%d");
                /* WLAN devices should always be named "wlan%d" */
                if ((dev->driver_info->flags & FLAG_WLAN) != 0)
diff --git a/drivers/net/usb/zaurus.c b/drivers/net/usb/zaurus.c
index 3eb0b167b5b4..241756e0e86f 100644
--- a/drivers/net/usb/zaurus.c
+++ b/drivers/net/usb/zaurus.c
@@ -102,7 +102,7 @@ static int always_connected (struct usbnet *dev)
 static const struct driver_info zaurus_sl5x00_info = {
        .description =  "Sharp Zaurus SL-5x00",
-        .flags =        FLAG_FRAMING_Z,
+        .flags =        FLAG_POINTTOPOINT | FLAG_FRAMING_Z,
        .check_connect = always_connected,
        .bind =         zaurus_bind,
        .unbind =       usbnet_cdc_unbind,
@@ -112,7 +112,7 @@ static const struct driver_info	zaurus_sl5x00_info = {
 static const struct driver_info zaurus_pxa_info = {
        .description =  "Sharp Zaurus, PXA-2xx based",
-        .flags =        FLAG_FRAMING_Z,
+        .flags =        FLAG_POINTTOPOINT | FLAG_FRAMING_Z,
        .check_connect = always_connected,
        .bind =         zaurus_bind,
        .unbind =       usbnet_cdc_unbind,
@@ -122,7 +122,7 @@ static const struct driver_info	zaurus_pxa_info = {
 static const struct driver_info olympus_mxl_info = {
        .description =  "Olympus R1000",
-        .flags =        FLAG_FRAMING_Z,
+        .flags =        FLAG_POINTTOPOINT | FLAG_FRAMING_Z,
        .check_connect = always_connected,
        .bind =         zaurus_bind,
        .unbind =       usbnet_cdc_unbind,
@@ -258,7 +258,7 @@ bad_desc:
 static const struct driver_info bogus_mdlm_info = {
        .description =  "pseudo-MDLM (BLAN) device",
-        .flags =        FLAG_FRAMING_Z,
+        .flags =        FLAG_POINTTOPOINT | FLAG_FRAMING_Z,
        .check_connect = always_connected,
        .tx_fixup =     zaurus_tx_fixup,
        .bind =         blan_mdlm_bind,
diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c
index f1b8af64569c..2d10239ce829 100644
--- a/drivers/net/wireless/ath/ath9k/hif_usb.c
+++ b/drivers/net/wireless/ath/ath9k/hif_usb.c
@@ -1040,7 +1040,7 @@ static int ath9k_hif_usb_probe(struct usb_interface *interface,
        }
        ret = ath9k_htc_hw_init(hif_dev->htc_handle,
-                                &hif_dev->udev->dev, hif_dev->device_id,
+                                &interface->dev, hif_dev->device_id,
                                hif_dev->udev->product, id->driver_info);
        if (ret) {
                ret = -EINVAL;
@@ -1158,7 +1158,7 @@ fail_resume:
 #endif
 static struct usb_driver ath9k_hif_usb_driver = {
-        .name = "ath9k_hif_usb",
+        .name = KBUILD_MODNAME,
        .probe = ath9k_hif_usb_probe,
        .disconnect = ath9k_hif_usb_disconnect,
 #ifdef CONFIG_PM
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index 338b07502f1a..c95bc5cc1a1f 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -1254,15 +1254,6 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
        ah->txchainmask = common->tx_chainmask;
        ah->rxchainmask = common->rx_chainmask;
-        if ((common->bus_ops->ath_bus_type != ATH_USB) && !ah->chip_fullsleep) {
-                ath9k_hw_abortpcurecv(ah);
-                if (!ath9k_hw_stopdmarecv(ah)) {
-                        ath_dbg(common, ATH_DBG_XMIT,
-                                "Failed to stop receive dma\n");
-                        bChannelChange = false;
-                }
-        }
        if (!ath9k_hw_setpower(ah, ATH9K_PM_AWAKE))
                return -EIO;
@@ -2546,6 +2537,7 @@ static struct {
        { AR_SREV_VERSION_9287,         "9287" },
        { AR_SREV_VERSION_9271,         "9271" },
        { AR_SREV_VERSION_9300,         "9300" },
+        { AR_SREV_VERSION_9485,         "9485" },
 };
 /* For devices with external radios */
diff --git a/drivers/net/wireless/ath/ath9k/mac.c b/drivers/net/wireless/ath/ath9k/mac.c
index 562257ac52cf..edc1cbbfecaf 100644
--- a/drivers/net/wireless/ath/ath9k/mac.c
+++ b/drivers/net/wireless/ath/ath9k/mac.c
@@ -751,28 +751,47 @@ void ath9k_hw_abortpcurecv(struct ath_hw *ah)
 }
 EXPORT_SYMBOL(ath9k_hw_abortpcurecv);
-bool ath9k_hw_stopdmarecv(struct ath_hw *ah)
+bool ath9k_hw_stopdmarecv(struct ath_hw *ah, bool *reset)
 {
 #define AH_RX_STOP_DMA_TIMEOUT 10000   /* usec */
 #define AH_RX_TIME_QUANTUM     100     /* usec */
        struct ath_common *common = ath9k_hw_common(ah);
+        u32 mac_status, last_mac_status = 0;
        int i;
+        /* Enable access to the DMA observation bus */
+        REG_WRITE(ah, AR_MACMISC,
+                  ((AR_MACMISC_DMA_OBS_LINE_8 << AR_MACMISC_DMA_OBS_S) |
+                   (AR_MACMISC_MISC_OBS_BUS_1 <<
+                    AR_MACMISC_MISC_OBS_BUS_MSB_S)));
        REG_WRITE(ah, AR_CR, AR_CR_RXD);
        /* Wait for rx enable bit to go low */
        for (i = AH_RX_STOP_DMA_TIMEOUT / AH_TIME_QUANTUM; i != 0; i--) {
                if ((REG_READ(ah, AR_CR) & AR_CR_RXE) == 0)
                        break;
+                if (!AR_SREV_9300_20_OR_LATER(ah)) {
+                        mac_status = REG_READ(ah, AR_DMADBG_7) & 0x7f0;
+                        if (mac_status == 0x1c0 && mac_status == last_mac_status) {
+                                *reset = true;
+                                break;
+                        }
+                        last_mac_status = mac_status;
+                }
                udelay(AH_TIME_QUANTUM);
        }
        if (i == 0) {
                ath_err(common,
-                        "DMA failed to stop in %d ms AR_CR=0x%08x AR_DIAG_SW=0x%08x\n",
+                        "DMA failed to stop in %d ms AR_CR=0x%08x AR_DIAG_SW=0x%08x DMADBG_7=0x%08x\n",
                        AH_RX_STOP_DMA_TIMEOUT / 1000,
                        REG_READ(ah, AR_CR),
-                        REG_READ(ah, AR_DIAG_SW));
+                        REG_READ(ah, AR_DIAG_SW),
+                        REG_READ(ah, AR_DMADBG_7));
                return false;
        } else {
                return true;
diff --git a/drivers/net/wireless/ath/ath9k/mac.h b/drivers/net/wireless/ath/ath9k/mac.h
index b2b2ff852c32..c2a59386fb9c 100644
--- a/drivers/net/wireless/ath/ath9k/mac.h
+++ b/drivers/net/wireless/ath/ath9k/mac.h
@@ -695,7 +695,7 @@ bool ath9k_hw_setrxabort(struct ath_hw *ah, bool set);
 void ath9k_hw_putrxbuf(struct ath_hw *ah, u32 rxdp);
 void ath9k_hw_startpcureceive(struct ath_hw *ah, bool is_scanning);
 void ath9k_hw_abortpcurecv(struct ath_hw *ah);
-bool ath9k_hw_stopdmarecv(struct ath_hw *ah);
+bool ath9k_hw_stopdmarecv(struct ath_hw *ah, bool *reset);
 int ath9k_hw_beaconq_setup(struct ath_hw *ah);
 /* Interrupt Handling */
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index 524825720a09..17d04ff8d678 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -1048,6 +1048,8 @@ static int ath9k_start(struct ieee80211_hw *hw)
                "Starting driver with initial channel: %d MHz\n",
                curchan->center_freq);
+        ath9k_ps_wakeup(sc);
        mutex_lock(&sc->mutex);
        /* setup initial channel */
@@ -1143,6 +1145,8 @@ static int ath9k_start(struct ieee80211_hw *hw)
 mutex_unlock:
        mutex_unlock(&sc->mutex);
+        ath9k_ps_restore(sc);
        return r;
 }
@@ -1372,7 +1376,6 @@ static void ath9k_calculate_summary_state(struct ieee80211_hw *hw,
        ath9k_calculate_iter_data(hw, vif, &iter_data);
-        ath9k_ps_wakeup(sc);
        /* Set BSSID mask. */
        memcpy(common->bssidmask, iter_data.mask, ETH_ALEN);
        ath_hw_setbssidmask(common);
@@ -1407,7 +1410,6 @@ static void ath9k_calculate_summary_state(struct ieee80211_hw *hw,
        }
        ath9k_hw_set_interrupts(ah, ah->imask);
-        ath9k_ps_restore(sc);
        /* Set up ANI */
        if ((iter_data.naps + iter_data.nadhocs) > 0) {
@@ -1453,6 +1455,7 @@ static int ath9k_add_interface(struct ieee80211_hw *hw,
        struct ath_vif *avp = (void *)vif->drv_priv;
        int ret = 0;
+        ath9k_ps_wakeup(sc);
        mutex_lock(&sc->mutex);
        switch (vif->type) {
@@ -1499,6 +1502,7 @@ static int ath9k_add_interface(struct ieee80211_hw *hw,
        ath9k_do_vif_add_setup(hw, vif);
 out:
        mutex_unlock(&sc->mutex);
+        ath9k_ps_restore(sc);
        return ret;
 }
@@ -1513,6 +1517,7 @@ static int ath9k_change_interface(struct ieee80211_hw *hw,
        ath_dbg(common, ATH_DBG_CONFIG, "Change Interface\n");
        mutex_lock(&sc->mutex);
+        ath9k_ps_wakeup(sc);
        /* See if new interface type is valid. */
        if ((new_type == NL80211_IFTYPE_ADHOC) &&
@@ -1542,6 +1547,7 @@ static int ath9k_change_interface(struct ieee80211_hw *hw,
        ath9k_do_vif_add_setup(hw, vif);
 out:
+        ath9k_ps_restore(sc);
        mutex_unlock(&sc->mutex);
        return ret;
 }
@@ -1554,6 +1560,7 @@ static void ath9k_remove_interface(struct ieee80211_hw *hw,
        ath_dbg(common, ATH_DBG_CONFIG, "Detach Interface\n");
+        ath9k_ps_wakeup(sc);
        mutex_lock(&sc->mutex);
        sc->nvifs--;
@@ -1565,6 +1572,7 @@ static void ath9k_remove_interface(struct ieee80211_hw *hw,
        ath9k_calculate_summary_state(hw, NULL);
        mutex_unlock(&sc->mutex);
+        ath9k_ps_restore(sc);
 }
 static void ath9k_enable_ps(struct ath_softc *sc)
@@ -1805,6 +1813,7 @@ static int ath9k_conf_tx(struct ieee80211_hw *hw, u16 queue,
        txq = sc->tx.txq_map[queue];
+        ath9k_ps_wakeup(sc);
        mutex_lock(&sc->mutex);
        memset(&qi, 0, sizeof(struct ath9k_tx_queue_info));
@@ -1828,6 +1837,7 @@ static int ath9k_conf_tx(struct ieee80211_hw *hw, u16 queue,
                        ath_beaconq_config(sc);
        mutex_unlock(&sc->mutex);
+        ath9k_ps_restore(sc);
        return ret;
 }
@@ -1890,6 +1900,7 @@ static void ath9k_bss_info_changed(struct ieee80211_hw *hw,
        int slottime;
        int error;
+        ath9k_ps_wakeup(sc);
        mutex_lock(&sc->mutex);
        if (changed & BSS_CHANGED_BSSID) {
@@ -1990,6 +2001,7 @@ static void ath9k_bss_info_changed(struct ieee80211_hw *hw,
        }
        mutex_unlock(&sc->mutex);
+        ath9k_ps_restore(sc);
 }
 static u64 ath9k_get_tsf(struct ieee80211_hw *hw)
diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c
index a9c3f4672aa0..b29c80def35e 100644
--- a/drivers/net/wireless/ath/ath9k/recv.c
+++ b/drivers/net/wireless/ath/ath9k/recv.c
@@ -486,12 +486,12 @@ start_recv:
 bool ath_stoprecv(struct ath_softc *sc)
 {
        struct ath_hw *ah = sc->sc_ah;
-        bool stopped;
+        bool stopped, reset = false;
        spin_lock_bh(&sc->rx.rxbuflock);
        ath9k_hw_abortpcurecv(ah);
        ath9k_hw_setrxfilter(ah, 0);
-        stopped = ath9k_hw_stopdmarecv(ah);
+        stopped = ath9k_hw_stopdmarecv(ah, &reset);
        if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA)
                ath_edma_stop_recv(sc);
@@ -506,7 +506,7 @@ bool ath_stoprecv(struct ath_softc *sc)
                        "confusing the DMA engine when we start RX up\n");
                ATH_DBG_WARN_ON_ONCE(!stopped);
        }
-        return stopped;
+        return stopped && !reset;
 }
 void ath_flushrecv(struct ath_softc *sc)
diff --git a/drivers/net/wireless/ath/carl9170/carl9170.h b/drivers/net/wireless/ath/carl9170/carl9170.h
index c6a5fae634a0..9cad061cc1d2 100644
--- a/drivers/net/wireless/ath/carl9170/carl9170.h
+++ b/drivers/net/wireless/ath/carl9170/carl9170.h
@@ -443,6 +443,7 @@ struct carl9170_ba_stats {
        u8 ampdu_len;
        u8 ampdu_ack_len;
        bool clear;
+        bool req;
 };
 struct carl9170_sta_info {
diff --git a/drivers/net/wireless/ath/carl9170/main.c b/drivers/net/wireless/ath/carl9170/main.c
index ede3d7e5a048..89fe60accf85 100644
--- a/drivers/net/wireless/ath/carl9170/main.c
+++ b/drivers/net/wireless/ath/carl9170/main.c
@@ -1355,6 +1355,7 @@ static int carl9170_op_ampdu_action(struct ieee80211_hw *hw,
                tid_info = rcu_dereference(sta_info->agg[tid]);
                sta_info->stats[tid].clear = true;
+                sta_info->stats[tid].req = false;
                if (tid_info) {
                        bitmap_zero(tid_info->bitmap, CARL9170_BAW_SIZE);
diff --git a/drivers/net/wireless/ath/carl9170/tx.c b/drivers/net/wireless/ath/carl9170/tx.c
index 0ef70b6fc512..cb70ed7ec5cc 100644
--- a/drivers/net/wireless/ath/carl9170/tx.c
+++ b/drivers/net/wireless/ath/carl9170/tx.c
@@ -383,6 +383,7 @@ static void carl9170_tx_status_process_ampdu(struct ar9170 *ar,
        if (sta_info->stats[tid].clear) {
                sta_info->stats[tid].clear = false;
+                sta_info->stats[tid].req = false;
                sta_info->stats[tid].ampdu_len = 0;
                sta_info->stats[tid].ampdu_ack_len = 0;
        }
@@ -391,10 +392,16 @@ static void carl9170_tx_status_process_ampdu(struct ar9170 *ar,
        if (txinfo->status.rates[0].count == 1)
                sta_info->stats[tid].ampdu_ack_len++;
+        if (!(txinfo->flags & IEEE80211_TX_STAT_ACK))
+                sta_info->stats[tid].req = true;
        if (super->f.mac_control & cpu_to_le16(AR9170_TX_MAC_IMM_BA)) {
                super->s.rix = sta_info->stats[tid].ampdu_len;
                super->s.cnt = sta_info->stats[tid].ampdu_ack_len;
                txinfo->flags |= IEEE80211_TX_STAT_AMPDU;
+                if (sta_info->stats[tid].req)
+                        txinfo->flags |= IEEE80211_TX_STAT_AMPDU_NO_BACK;
                sta_info->stats[tid].clear = true;
        }
        spin_unlock_bh(&tid_info->lock);
diff --git a/drivers/net/wireless/ath/regd_common.h b/drivers/net/wireless/ath/regd_common.h
index 248c670fdfbe..5c2cfe694152 100644
--- a/drivers/net/wireless/ath/regd_common.h
+++ b/drivers/net/wireless/ath/regd_common.h
@@ -195,6 +195,7 @@ static struct reg_dmn_pair_mapping regDomainPairs[] = {
        {APL9_WORLD, CTL_ETSI, CTL_ETSI},
        {APL3_FCCA, CTL_FCC, CTL_FCC},
+        {APL7_FCCA, CTL_FCC, CTL_FCC},
        {APL1_ETSIC, CTL_FCC, CTL_ETSI},
        {APL2_ETSIC, CTL_FCC, CTL_ETSI},
        {APL2_APLD, CTL_FCC, NO_CTL},
diff --git a/drivers/net/wireless/b43/dma.c b/drivers/net/wireless/b43/dma.c
index 3d5566e7af0a..ff0f5ba14b2c 100644
--- a/drivers/net/wireless/b43/dma.c
+++ b/drivers/net/wireless/b43/dma.c
@@ -1536,7 +1536,7 @@ static void dma_rx(struct b43_dmaring *ring, int *slot)
                dmaaddr = meta->dmaaddr;
                goto drop_recycle_buffer;
        }
-        if (unlikely(len > ring->rx_buffersize)) {
+        if (unlikely(len + ring->frameoffset > ring->rx_buffersize)) {
                /* The data did not fit into one descriptor buffer
                 * and is split over multiple buffers.
                 * This should never happen, as we try to allocate buffers
diff --git a/drivers/net/wireless/b43/dma.h b/drivers/net/wireless/b43/dma.h
index a01c2100f166..e8a80a1251bf 100644
--- a/drivers/net/wireless/b43/dma.h
+++ b/drivers/net/wireless/b43/dma.h
@@ -163,7 +163,7 @@ struct b43_dmadesc_generic {
 /* DMA engine tuning knobs */
 #define B43_TXRING_SLOTS                256
 #define B43_RXRING_SLOTS                64
-#define B43_DMA0_RX_BUFFERSIZE          IEEE80211_MAX_FRAME_LEN
+#define B43_DMA0_RX_BUFFERSIZE          (B43_DMA0_RX_FRAMEOFFSET + IEEE80211_MAX_FRAME_LEN)
 /* Pointer poison */
 #define B43_DMA_PTR_POISON              ((void *)ERR_PTR(-ENOMEM))
diff --git a/drivers/net/wireless/iwlegacy/Kconfig b/drivers/net/wireless/iwlegacy/Kconfig
index 2a45dd44cc12..aef65cd47661 100644
--- a/drivers/net/wireless/iwlegacy/Kconfig
+++ b/drivers/net/wireless/iwlegacy/Kconfig
@@ -1,6 +1,5 @@
 config IWLWIFI_LEGACY
-        tristate "Intel Wireless Wifi legacy devices"
+        tristate
-        depends on PCI && MAC80211
        select FW_LOADER
        select NEW_LEDS
        select LEDS_CLASS
@@ -65,7 +64,8 @@ endmenu
 config IWL4965
        tristate "Intel Wireless WiFi 4965AGN (iwl4965)"
-        depends on IWLWIFI_LEGACY
+        depends on PCI && MAC80211
+        select IWLWIFI_LEGACY
        ---help---
          This option enables support for
@@ -92,7 +92,8 @@ config IWL4965
 config IWL3945
        tristate "Intel PRO/Wireless 3945ABG/BG Network Connection (iwl3945)"
-        depends on IWLWIFI_LEGACY
+        depends on PCI && MAC80211
+        select IWLWIFI_LEGACY
        ---help---
          Select to build the driver supporting the:
diff --git a/drivers/net/wireless/iwlegacy/iwl-3945-hw.h b/drivers/net/wireless/iwlegacy/iwl-3945-hw.h
index 779d3cb86e2c..5c3a68d3af12 100644
--- a/drivers/net/wireless/iwlegacy/iwl-3945-hw.h
+++ b/drivers/net/wireless/iwlegacy/iwl-3945-hw.h
@@ -74,8 +74,6 @@
 /* RSSI to dBm */
 #define IWL39_RSSI_OFFSET       95
-#define IWL_DEFAULT_TX_POWER    0x0F
 /*
 * EEPROM related constants, enums, and structures.
 */
diff --git a/drivers/net/wireless/iwlegacy/iwl-4965-hw.h b/drivers/net/wireless/iwlegacy/iwl-4965-hw.h
index 08b189c8472d..fc6fa2886d9c 100644
--- a/drivers/net/wireless/iwlegacy/iwl-4965-hw.h
+++ b/drivers/net/wireless/iwlegacy/iwl-4965-hw.h
@@ -804,9 +804,6 @@ struct iwl4965_scd_bc_tbl {
 #define IWL4965_DEFAULT_TX_RETRY  15
-/* Limit range of txpower output target to be between these values */
-#define IWL4965_TX_POWER_TARGET_POWER_MIN       (0)     /* 0 dBm: 1 milliwatt */
 /* EEPROM */
 #define IWL4965_FIRST_AMPDU_QUEUE       10
diff --git a/drivers/net/wireless/iwlegacy/iwl-4965-tx.c b/drivers/net/wireless/iwlegacy/iwl-4965-tx.c
index 5c40502f869a..fbec88d48f1b 100644
--- a/drivers/net/wireless/iwlegacy/iwl-4965-tx.c
+++ b/drivers/net/wireless/iwlegacy/iwl-4965-tx.c
@@ -1127,12 +1127,16 @@ int iwl4965_tx_queue_reclaim(struct iwl_priv *priv, int txq_id, int index)
             q->read_ptr = iwl_legacy_queue_inc_wrap(q->read_ptr, q->n_bd)) {
                tx_info = &txq->txb[txq->q.read_ptr];
-                iwl4965_tx_status(priv, tx_info,
-                                 txq_id >= IWL4965_FIRST_AMPDU_QUEUE);
+                if (WARN_ON_ONCE(tx_info->skb == NULL))
+                        continue;
                hdr = (struct ieee80211_hdr *)tx_info->skb->data;
-                if (hdr && ieee80211_is_data_qos(hdr->frame_control))
+                if (ieee80211_is_data_qos(hdr->frame_control))
                        nfreed++;
+                iwl4965_tx_status(priv, tx_info,
+                                 txq_id >= IWL4965_FIRST_AMPDU_QUEUE);
                tx_info->skb = NULL;
                priv->cfg->ops->lib->txq_free_tfd(priv, txq);
diff --git a/drivers/net/wireless/iwlegacy/iwl-core.c b/drivers/net/wireless/iwlegacy/iwl-core.c
index d418b647be80..2b08efb3b658 100644
--- a/drivers/net/wireless/iwlegacy/iwl-core.c
+++ b/drivers/net/wireless/iwlegacy/iwl-core.c
@@ -160,6 +160,7 @@ int iwl_legacy_init_geos(struct iwl_priv *priv)
        struct ieee80211_channel *geo_ch;
        struct ieee80211_rate *rates;
        int i = 0;
+        s8 max_tx_power = 0;
        if (priv->bands[IEEE80211_BAND_2GHZ].n_bitrates ||
            priv->bands[IEEE80211_BAND_5GHZ].n_bitrates) {
@@ -235,8 +236,8 @@ int iwl_legacy_init_geos(struct iwl_priv *priv)
                        geo_ch->flags |= ch->ht40_extension_channel;
-                        if (ch->max_power_avg > priv->tx_power_device_lmt)
+                        if (ch->max_power_avg > max_tx_power)
-                                priv->tx_power_device_lmt = ch->max_power_avg;
+                                max_tx_power = ch->max_power_avg;
                } else {
                        geo_ch->flags |= IEEE80211_CHAN_DISABLED;
                }
@@ -249,6 +250,10 @@ int iwl_legacy_init_geos(struct iwl_priv *priv)
                                 geo_ch->flags);
        }
+        priv->tx_power_device_lmt = max_tx_power;
+        priv->tx_power_user_lmt = max_tx_power;
+        priv->tx_power_next = max_tx_power;
        if ((priv->bands[IEEE80211_BAND_5GHZ].n_channels == 0) &&
             priv->cfg->sku & IWL_SKU_A) {
                IWL_INFO(priv, "Incorrectly detected BG card as ABG. "
@@ -1124,11 +1129,11 @@ int iwl_legacy_set_tx_power(struct iwl_priv *priv, s8 tx_power, bool force)
        if (!priv->cfg->ops->lib->send_tx_power)
                return -EOPNOTSUPP;
-        if (tx_power < IWL4965_TX_POWER_TARGET_POWER_MIN) {
+        /* 0 dBm mean 1 milliwatt */
+        if (tx_power < 0) {
                IWL_WARN(priv,
-                         "Requested user TXPOWER %d below lower limit %d.\n",
+                         "Requested user TXPOWER %d below 1 mW.\n",
-                         tx_power,
+                         tx_power);
-                         IWL4965_TX_POWER_TARGET_POWER_MIN);
                return -EINVAL;
        }
@@ -1805,6 +1810,15 @@ iwl_legacy_mac_change_interface(struct ieee80211_hw *hw,
        mutex_lock(&priv->mutex);
+        if (!ctx->vif || !iwl_legacy_is_ready_rf(priv)) {
+                /*
+                 * Huh? But wait ... this can maybe happen when
+                 * we're in the middle of a firmware restart!
+                 */
+                err = -EBUSY;
+                goto out;
+        }
        interface_modes = ctx->interface_modes | ctx->exclusive_interface_modes;
        if (!(interface_modes & BIT(newtype))) {
@@ -1832,6 +1846,7 @@ iwl_legacy_mac_change_interface(struct ieee80211_hw *hw,
        /* success */
        iwl_legacy_teardown_interface(priv, vif, true);
        vif->type = newtype;
+        vif->p2p = newp2p;
        err = iwl_legacy_setup_interface(priv, ctx);
        WARN_ON(err);
        /*
diff --git a/drivers/net/wireless/iwlegacy/iwl-eeprom.c b/drivers/net/wireless/iwlegacy/iwl-eeprom.c
index 04c5648027df..cb346d1a9ffa 100644
--- a/drivers/net/wireless/iwlegacy/iwl-eeprom.c
+++ b/drivers/net/wireless/iwlegacy/iwl-eeprom.c
@@ -471,13 +471,6 @@ int iwl_legacy_init_channel_map(struct iwl_priv *priv)
                                             flags & EEPROM_CHANNEL_RADAR))
                                       ? "" : "not ");
-                        /* Set the tx_power_user_lmt to the highest power
-                         * supported by any channel */
-                        if (eeprom_ch_info[ch].max_power_avg >
-                                                priv->tx_power_user_lmt)
-                                priv->tx_power_user_lmt =
-                                    eeprom_ch_info[ch].max_power_avg;
                        ch_info++;
                }
        }
diff --git a/drivers/net/wireless/iwlegacy/iwl3945-base.c b/drivers/net/wireless/iwlegacy/iwl3945-base.c
index ab87e1b73529..cc7ebcee60e5 100644
--- a/drivers/net/wireless/iwlegacy/iwl3945-base.c
+++ b/drivers/net/wireless/iwlegacy/iwl3945-base.c
@@ -93,6 +93,7 @@ MODULE_LICENSE("GPL");
 struct iwl_mod_params iwl3945_mod_params = {
        .sw_crypto = 1,
        .restart_fw = 1,
+        .disable_hw_scan = 1,
        /* the rest are 0 by default */
 };
@@ -3824,10 +3825,6 @@ static int iwl3945_init_drv(struct iwl_priv *priv)
        priv->force_reset[IWL_FW_RESET].reset_duration =
                IWL_DELAY_NEXT_FORCE_FW_RELOAD;
-        priv->tx_power_user_lmt = IWL_DEFAULT_TX_POWER;
-        priv->tx_power_next = IWL_DEFAULT_TX_POWER;
        if (eeprom->version < EEPROM_3945_EEPROM_VERSION) {
                IWL_WARN(priv, "Unsupported EEPROM version: 0x%04X\n",
                         eeprom->version);
@@ -3960,8 +3957,7 @@ static int iwl3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *e
         * "the hard way", rather than using device's scan.
         */
        if (iwl3945_mod_params.disable_hw_scan) {
-                dev_printk(KERN_DEBUG, &(pdev->dev),
+                IWL_DEBUG_INFO(priv, "Disabling hw_scan\n");
-                        "sw scan support is deprecated\n");
                iwl3945_hw_ops.hw_scan = NULL;
        }
@@ -4280,8 +4276,7 @@ MODULE_PARM_DESC(swcrypto,
                "using software crypto (default 1 [software])");
 module_param_named(disable_hw_scan, iwl3945_mod_params.disable_hw_scan,
                int, S_IRUGO);
-MODULE_PARM_DESC(disable_hw_scan,
+MODULE_PARM_DESC(disable_hw_scan, "disable hardware scanning (default 1)");
-                "disable hardware scanning (default 0) (deprecated)");
 #ifdef CONFIG_IWLWIFI_LEGACY_DEBUG
 module_param_named(debug, iwlegacy_debug_level, uint, S_IRUGO | S_IWUSR);
 MODULE_PARM_DESC(debug, "debug output mask");
diff --git a/drivers/net/wireless/iwlegacy/iwl4965-base.c b/drivers/net/wireless/iwlegacy/iwl4965-base.c
index 91b3d8b9d7a5..d484c3678163 100644
--- a/drivers/net/wireless/iwlegacy/iwl4965-base.c
+++ b/drivers/net/wireless/iwlegacy/iwl4965-base.c
@@ -3140,12 +3140,6 @@ static int iwl4965_init_drv(struct iwl_priv *priv)
        iwl_legacy_init_scan_params(priv);
-        /* Set the tx_power_user_lmt to the lowest power level
-         * this value will get overwritten by channel max power avg
-         * from eeprom */
-        priv->tx_power_user_lmt = IWL4965_TX_POWER_TARGET_POWER_MIN;
-        priv->tx_power_next = IWL4965_TX_POWER_TARGET_POWER_MIN;
        ret = iwl_legacy_init_channel_map(priv);
        if (ret) {
                IWL_ERR(priv, "initializing regulatory failed: %d\n", ret);
diff --git a/drivers/net/wireless/iwlwifi/iwl-5000.c b/drivers/net/wireless/iwlwifi/iwl-5000.c
index 3ea31b659d1a..22e045b5bcee 100644
--- a/drivers/net/wireless/iwlwifi/iwl-5000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-5000.c
@@ -530,6 +530,9 @@ static struct iwl_ht_params iwl5000_ht_params = {
 struct iwl_cfg iwl5300_agn_cfg = {
        .name = "Intel(R) Ultimate N WiFi Link 5300 AGN",
        IWL_DEVICE_5000,
+        /* at least EEPROM 0x11A has wrong info */
+        .valid_tx_ant = ANT_ABC,        /* .cfg overwrite */
+        .valid_rx_ant = ANT_ABC,        /* .cfg overwrite */
        .ht_params = &iwl5000_ht_params,
 };
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-rxon.c b/drivers/net/wireless/iwlwifi/iwl-agn-rxon.c
index dfdbea6e8f99..fbbde0712fa5 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-rxon.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-rxon.c
@@ -335,7 +335,6 @@ int iwlagn_mac_config(struct ieee80211_hw *hw, u32 changed)
        struct ieee80211_channel *channel = conf->channel;
        const struct iwl_channel_info *ch_info;
        int ret = 0;
-        bool ht_changed[NUM_IWL_RXON_CTX] = {};
        IWL_DEBUG_MAC80211(priv, "changed %#x", changed);
@@ -383,10 +382,8 @@ int iwlagn_mac_config(struct ieee80211_hw *hw, u32 changed)
                for_each_context(priv, ctx) {
                        /* Configure HT40 channels */
-                        if (ctx->ht.enabled != conf_is_ht(conf)) {
+                        if (ctx->ht.enabled != conf_is_ht(conf))
                                ctx->ht.enabled = conf_is_ht(conf);
-                                ht_changed[ctx->ctxid] = true;
-                        }
                        if (ctx->ht.enabled) {
                                if (conf_is_ht40_minus(conf)) {
@@ -455,8 +452,6 @@ int iwlagn_mac_config(struct ieee80211_hw *hw, u32 changed)
                if (!memcmp(&ctx->staging, &ctx->active, sizeof(ctx->staging)))
                        continue;
                iwlagn_commit_rxon(priv, ctx);
-                if (ht_changed[ctx->ctxid])
-                        iwlagn_update_qos(priv, ctx);
        }
 out:
        mutex_unlock(&priv->mutex);
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-tx.c b/drivers/net/wireless/iwlwifi/iwl-agn-tx.c
index a709d05c5868..2dd7d54a796f 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-tx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-tx.c
@@ -1224,12 +1224,16 @@ int iwlagn_tx_queue_reclaim(struct iwl_priv *priv, int txq_id, int index)
             q->read_ptr = iwl_queue_inc_wrap(q->read_ptr, q->n_bd)) {
                tx_info = &txq->txb[txq->q.read_ptr];
-                iwlagn_tx_status(priv, tx_info,
-                                 txq_id >= IWLAGN_FIRST_AMPDU_QUEUE);
+                if (WARN_ON_ONCE(tx_info->skb == NULL))
+                        continue;
                hdr = (struct ieee80211_hdr *)tx_info->skb->data;
-                if (hdr && ieee80211_is_data_qos(hdr->frame_control))
+                if (ieee80211_is_data_qos(hdr->frame_control))
                        nfreed++;
+                iwlagn_tx_status(priv, tx_info,
+                                 txq_id >= IWLAGN_FIRST_AMPDU_QUEUE);
                tx_info->skb = NULL;
                if (priv->cfg->ops->lib->txq_inval_byte_cnt_tbl)
diff --git a/drivers/net/wireless/iwlwifi/iwl-eeprom.h b/drivers/net/wireless/iwlwifi/iwl-eeprom.h
index 98aa8af01192..20b66469d68f 100644
--- a/drivers/net/wireless/iwlwifi/iwl-eeprom.h
+++ b/drivers/net/wireless/iwlwifi/iwl-eeprom.h
@@ -241,7 +241,7 @@ struct iwl_eeprom_enhanced_txpwr {
 /* 6x00 Specific */
 #define EEPROM_6000_TX_POWER_VERSION    (4)
-#define EEPROM_6000_EEPROM_VERSION      (0x434)
+#define EEPROM_6000_EEPROM_VERSION      (0x423)
 /* 6x50 Specific */
 #define EEPROM_6050_TX_POWER_VERSION    (4)
diff --git a/drivers/net/wireless/mwl8k.c b/drivers/net/wireless/mwl8k.c
index 36952274950e..c1ceb4b23971 100644
--- a/drivers/net/wireless/mwl8k.c
+++ b/drivers/net/wireless/mwl8k.c
@@ -137,6 +137,7 @@ struct mwl8k_tx_queue {
 struct mwl8k_priv {
        struct ieee80211_hw *hw;
        struct pci_dev *pdev;
+        int irq;
        struct mwl8k_device_info *device_info;
@@ -3761,9 +3762,11 @@ static int mwl8k_start(struct ieee80211_hw *hw)
        rc = request_irq(priv->pdev->irq, mwl8k_interrupt,
                         IRQF_SHARED, MWL8K_NAME, hw);
        if (rc) {
+                priv->irq = -1;
                wiphy_err(hw->wiphy, "failed to register IRQ handler\n");
                return -EIO;
        }
+        priv->irq = priv->pdev->irq;
        /* Enable TX reclaim and RX tasklets.  */
        tasklet_enable(&priv->poll_tx_task);
@@ -3800,6 +3803,7 @@ static int mwl8k_start(struct ieee80211_hw *hw)
        if (rc) {
                iowrite32(0, priv->regs + MWL8K_HIU_A2H_INTERRUPT_MASK);
                free_irq(priv->pdev->irq, hw);
+                priv->irq = -1;
                tasklet_disable(&priv->poll_tx_task);
                tasklet_disable(&priv->poll_rx_task);
        }
@@ -3818,7 +3822,10 @@ static void mwl8k_stop(struct ieee80211_hw *hw)
        /* Disable interrupts */
        iowrite32(0, priv->regs + MWL8K_HIU_A2H_INTERRUPT_MASK);
-        free_irq(priv->pdev->irq, hw);
+        if (priv->irq != -1) {
+                free_irq(priv->pdev->irq, hw);
+                priv->irq = -1;
+        }
        /* Stop finalize join worker */
        cancel_work_sync(&priv->finalize_join_worker);
diff --git a/drivers/net/wireless/p54/p54usb.c b/drivers/net/wireless/p54/p54usb.c
index 9b344a921e74..e18358725b69 100644
--- a/drivers/net/wireless/p54/p54usb.c
+++ b/drivers/net/wireless/p54/p54usb.c
@@ -56,6 +56,7 @@ static struct usb_device_id p54u_table[] __devinitdata = {
        {USB_DEVICE(0x0846, 0x4210)},   /* Netgear WG121 the second ? */
        {USB_DEVICE(0x0846, 0x4220)},   /* Netgear WG111 */
        {USB_DEVICE(0x09aa, 0x1000)},   /* Spinnaker Proto board */
+        {USB_DEVICE(0x0bf8, 0x1007)},   /* Fujitsu E-5400 USB */
        {USB_DEVICE(0x0cde, 0x0006)},   /* Medion 40900, Roper Europe */
        {USB_DEVICE(0x0db0, 0x6826)},   /* MSI UB54G (MS-6826) */
        {USB_DEVICE(0x107b, 0x55f2)},   /* Gateway WGU-210 (Gemtek) */
@@ -68,6 +69,7 @@ static struct usb_device_id p54u_table[] __devinitdata = {
        {USB_DEVICE(0x1915, 0x2235)},   /* Linksys WUSB54G Portable OEM */
        {USB_DEVICE(0x2001, 0x3701)},   /* DLink DWL-G120 Spinnaker */
        {USB_DEVICE(0x2001, 0x3703)},   /* DLink DWL-G122 */
+        {USB_DEVICE(0x2001, 0x3762)},   /* Conceptronic C54U */
        {USB_DEVICE(0x5041, 0x2234)},   /* Linksys WUSB54G */
        {USB_DEVICE(0x5041, 0x2235)},   /* Linksys WUSB54G Portable */
diff --git a/drivers/net/wireless/p54/txrx.c b/drivers/net/wireless/p54/txrx.c
index 7834c26c2954..042842e704de 100644
--- a/drivers/net/wireless/p54/txrx.c
+++ b/drivers/net/wireless/p54/txrx.c
@@ -703,7 +703,7 @@ void p54_tx_80211(struct ieee80211_hw *dev, struct sk_buff *skb)
        struct p54_tx_info *p54info;
        struct p54_hdr *hdr;
        struct p54_tx_data *txhdr;
-        unsigned int padding, len, extra_len;
+        unsigned int padding, len, extra_len = 0;
        int i, j, ridx;
        u16 hdr_flags = 0, aid = 0;
        u8 rate, queue = 0, crypt_offset = 0;
diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c
index 4e368657a83c..37509d019910 100644
--- a/drivers/net/wireless/rt2x00/rt2800usb.c
+++ b/drivers/net/wireless/rt2x00/rt2800usb.c
@@ -730,8 +730,12 @@ static struct usb_device_id rt2800usb_device_table[] = {
        { USB_DEVICE(0x050d, 0x8053), USB_DEVICE_DATA(&rt2800usb_ops) },
        { USB_DEVICE(0x050d, 0x805c), USB_DEVICE_DATA(&rt2800usb_ops) },
        { USB_DEVICE(0x050d, 0x815c), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x050d, 0x825b), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x050d, 0x935a), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x050d, 0x935b), USB_DEVICE_DATA(&rt2800usb_ops) },
        /* Buffalo */
        { USB_DEVICE(0x0411, 0x00e8), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0411, 0x016f), USB_DEVICE_DATA(&rt2800usb_ops) },
        /* Conceptronic */
        { USB_DEVICE(0x14b2, 0x3c06), USB_DEVICE_DATA(&rt2800usb_ops) },
        { USB_DEVICE(0x14b2, 0x3c07), USB_DEVICE_DATA(&rt2800usb_ops) },
@@ -818,6 +822,7 @@ static struct usb_device_id rt2800usb_device_table[] = {
        /* Pegatron */
        { USB_DEVICE(0x1d4d, 0x000c), USB_DEVICE_DATA(&rt2800usb_ops) },
        { USB_DEVICE(0x1d4d, 0x000e), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x1d4d, 0x0011), USB_DEVICE_DATA(&rt2800usb_ops) },
        /* Philips */
        { USB_DEVICE(0x0471, 0x200f), USB_DEVICE_DATA(&rt2800usb_ops) },
        /* Planex */
@@ -899,6 +904,8 @@ static struct usb_device_id rt2800usb_device_table[] = {
        { USB_DEVICE(0x148f, 0x3572), USB_DEVICE_DATA(&rt2800usb_ops) },
        /* Sitecom */
        { USB_DEVICE(0x0df6, 0x0041), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* Toshiba */
+        { USB_DEVICE(0x0930, 0x0a07), USB_DEVICE_DATA(&rt2800usb_ops) },
        /* Zinwell */
        { USB_DEVICE(0x5a57, 0x0284), USB_DEVICE_DATA(&rt2800usb_ops) },
 #endif
@@ -961,7 +968,6 @@ static struct usb_device_id rt2800usb_device_table[] = {
        { USB_DEVICE(0x05a6, 0x0101), USB_DEVICE_DATA(&rt2800usb_ops) },
        { USB_DEVICE(0x1d4d, 0x0002), USB_DEVICE_DATA(&rt2800usb_ops) },
        { USB_DEVICE(0x1d4d, 0x0010), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x1d4d, 0x0011), USB_DEVICE_DATA(&rt2800usb_ops) },
        /* Planex */
        { USB_DEVICE(0x2019, 0x5201), USB_DEVICE_DATA(&rt2800usb_ops) },
        { USB_DEVICE(0x2019, 0xab24), USB_DEVICE_DATA(&rt2800usb_ops) },
@@ -975,8 +981,6 @@ static struct usb_device_id rt2800usb_device_table[] = {
        /* Sweex */
        { USB_DEVICE(0x177f, 0x0153), USB_DEVICE_DATA(&rt2800usb_ops) },
        { USB_DEVICE(0x177f, 0x0313), USB_DEVICE_DATA(&rt2800usb_ops) },
-        /* Toshiba */
-        { USB_DEVICE(0x0930, 0x0a07), USB_DEVICE_DATA(&rt2800usb_ops) },
        /* Zyxel */
        { USB_DEVICE(0x0586, 0x341a), USB_DEVICE_DATA(&rt2800usb_ops) },
 #endif
diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
index 9de9dbe94399..84eb6ad36377 100644
--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
@@ -1062,8 +1062,10 @@ void rt2x00lib_remove_dev(struct rt2x00_dev *rt2x00dev)
         * Stop all work.
         */
        cancel_work_sync(&rt2x00dev->intf_work);
-        cancel_work_sync(&rt2x00dev->rxdone_work);
+        if (rt2x00_is_usb(rt2x00dev)) {
-        cancel_work_sync(&rt2x00dev->txdone_work);
+                cancel_work_sync(&rt2x00dev->rxdone_work);
+                cancel_work_sync(&rt2x00dev->txdone_work);
+        }
        destroy_workqueue(rt2x00dev->workqueue);
        /*
diff --git a/drivers/net/wireless/rtlwifi/efuse.c b/drivers/net/wireless/rtlwifi/efuse.c
index f74a8701c67d..590f14f45a89 100644
--- a/drivers/net/wireless/rtlwifi/efuse.c
+++ b/drivers/net/wireless/rtlwifi/efuse.c
@@ -685,7 +685,7 @@ static int efuse_pg_packet_read(struct ieee80211_hw *hw, u8 offset, u8 *data)
        u8 efuse_data, word_cnts = 0;
        u16 efuse_addr = 0;
-        u8 hworden;
+        u8 hworden = 0;
        u8 tmpdata[8];
        if (data == NULL)
diff --git a/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.c b/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.c
index 5ef91374b230..28a6ce3bc239 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.c
@@ -303,7 +303,7 @@ static void _rtl92c_fill_h2c_command(struct ieee80211_hw *hw,
        u16 box_reg, box_extreg;
        u8 u1b_tmp;
        bool isfw_read = false;
-        u8 buf_index;
+        u8 buf_index = 0;
        bool bwrite_sucess = false;
        u8 wait_h2c_limmit = 100;
        u8 wait_writeh2c_limmit = 100;
diff --git a/drivers/net/wireless/rtlwifi/usb.c b/drivers/net/wireless/rtlwifi/usb.c
index a4b2613d6a8c..f5d85735d642 100644
--- a/drivers/net/wireless/rtlwifi/usb.c
+++ b/drivers/net/wireless/rtlwifi/usb.c
@@ -246,7 +246,7 @@ static void _rtl_usb_io_handler_init(struct device *dev,
 static void _rtl_usb_io_handler_release(struct ieee80211_hw *hw)
 {
-        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_priv __maybe_unused *rtlpriv = rtl_priv(hw);
        mutex_destroy(&rtlpriv->io.bb_mutex);
 }
diff --git a/drivers/net/wireless/wl12xx/sdio.c b/drivers/net/wireless/wl12xx/sdio.c
index 5b9dbeafec06..b1c7d031c391 100644
--- a/drivers/net/wireless/wl12xx/sdio.c
+++ b/drivers/net/wireless/wl12xx/sdio.c
@@ -340,7 +340,7 @@ module_init(wl1271_init);
 module_exit(wl1271_exit);
 MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Luciano Coelho <luciano.coelho@nokia.com>");
+MODULE_AUTHOR("Luciano Coelho <coelho@ti.com>");
 MODULE_AUTHOR("Juuso Oikarinen <juuso.oikarinen@nokia.com>");
 MODULE_FIRMWARE(WL1271_FW_NAME);
 MODULE_FIRMWARE(WL1271_AP_FW_NAME);
diff --git a/drivers/net/wireless/wl12xx/spi.c b/drivers/net/wireless/wl12xx/spi.c
index 18cf01719ae0..ffc745b17f4d 100644
--- a/drivers/net/wireless/wl12xx/spi.c
+++ b/drivers/net/wireless/wl12xx/spi.c
@@ -487,7 +487,7 @@ module_init(wl1271_init);
 module_exit(wl1271_exit);
 MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Luciano Coelho <luciano.coelho@nokia.com>");
+MODULE_AUTHOR("Luciano Coelho <coelho@ti.com>");
 MODULE_AUTHOR("Juuso Oikarinen <juuso.oikarinen@nokia.com>");
 MODULE_FIRMWARE(WL1271_FW_NAME);
 MODULE_FIRMWARE(WL1271_AP_FW_NAME);
diff --git a/drivers/net/wireless/wl12xx/testmode.c b/drivers/net/wireless/wl12xx/testmode.c
index e64403b6896d..6ec06a4a4c6d 100644
--- a/drivers/net/wireless/wl12xx/testmode.c
+++ b/drivers/net/wireless/wl12xx/testmode.c
@@ -204,7 +204,10 @@ static int wl1271_tm_cmd_nvs_push(struct wl1271 *wl, struct nlattr *tb[])
        kfree(wl->nvs);
-        wl->nvs = kzalloc(sizeof(struct wl1271_nvs_file), GFP_KERNEL);
+        if (len != sizeof(struct wl1271_nvs_file))
+                return -EINVAL;
+        wl->nvs = kzalloc(len, GFP_KERNEL);
        if (!wl->nvs) {
                wl1271_error("could not allocate memory for the nvs file");
                ret = -ENOMEM;
diff --git a/drivers/net/wireless/zd1211rw/zd_usb.c b/drivers/net/wireless/zd1211rw/zd_usb.c
index 58236e6d0921..ab607bbd6291 100644
--- a/drivers/net/wireless/zd1211rw/zd_usb.c
+++ b/drivers/net/wireless/zd1211rw/zd_usb.c
@@ -643,7 +643,7 @@ static void rx_urb_complete(struct urb *urb)
        usb = urb->context;
        rx = &usb->rx;
-        zd_usb_reset_rx_idle_timer(usb);
+        tasklet_schedule(&rx->reset_timer_tasklet);
        if (length%rx->usb_packet_size > rx->usb_packet_size-4) {
                /* If there is an old first fragment, we don't care. */
@@ -812,6 +812,7 @@ void zd_usb_disable_rx(struct zd_usb *usb)
        __zd_usb_disable_rx(usb);
        mutex_unlock(&rx->setup_mutex);
+        tasklet_kill(&rx->reset_timer_tasklet);
        cancel_delayed_work_sync(&rx->idle_work);
 }
@@ -1106,6 +1107,13 @@ static void zd_rx_idle_timer_handler(struct work_struct *work)
        zd_usb_reset_rx(usb);
 }
+static void zd_usb_reset_rx_idle_timer_tasklet(unsigned long param)
+{
+        struct zd_usb *usb = (struct zd_usb *)param;
+        zd_usb_reset_rx_idle_timer(usb);
+}
 void zd_usb_reset_rx_idle_timer(struct zd_usb *usb)
 {
        struct zd_usb_rx *rx = &usb->rx;
@@ -1127,6 +1135,7 @@ static inline void init_usb_interrupt(struct zd_usb *usb)
 static inline void init_usb_rx(struct zd_usb *usb)
 {
        struct zd_usb_rx *rx = &usb->rx;
        spin_lock_init(&rx->lock);
        mutex_init(&rx->setup_mutex);
        if (interface_to_usbdev(usb->intf)->speed == USB_SPEED_HIGH) {
@@ -1136,11 +1145,14 @@ static inline void init_usb_rx(struct zd_usb *usb)
        }
        ZD_ASSERT(rx->fragment_length == 0);
        INIT_DELAYED_WORK(&rx->idle_work, zd_rx_idle_timer_handler);
+        rx->reset_timer_tasklet.func = zd_usb_reset_rx_idle_timer_tasklet;
+        rx->reset_timer_tasklet.data = (unsigned long)usb;
 }
 static inline void init_usb_tx(struct zd_usb *usb)
 {
        struct zd_usb_tx *tx = &usb->tx;
        spin_lock_init(&tx->lock);
        atomic_set(&tx->enabled, 0);
        tx->stopped = 0;
@@ -1671,6 +1683,10 @@ static void iowrite16v_urb_complete(struct urb *urb)
        if (urb->status && !usb->cmd_error)
                usb->cmd_error = urb->status;
+        if (!usb->cmd_error &&
+                        urb->actual_length != urb->transfer_buffer_length)
+                usb->cmd_error = -EIO;
 }
 static int zd_submit_waiting_urb(struct zd_usb *usb, bool last)
@@ -1805,7 +1821,7 @@ int zd_usb_iowrite16v_async(struct zd_usb *usb, const struct zd_ioreq16 *ioreqs,
        usb_fill_int_urb(urb, udev, usb_sndintpipe(udev, EP_REGS_OUT),
                         req, req_len, iowrite16v_urb_complete, usb,
                         ep->desc.bInterval);
-        urb->transfer_flags |= URB_FREE_BUFFER | URB_SHORT_NOT_OK;
+        urb->transfer_flags |= URB_FREE_BUFFER;
        /* Submit previous URB */
        r = zd_submit_waiting_urb(usb, false);
diff --git a/drivers/net/wireless/zd1211rw/zd_usb.h b/drivers/net/wireless/zd1211rw/zd_usb.h
index b3df2c8116cc..325d0f989257 100644
--- a/drivers/net/wireless/zd1211rw/zd_usb.h
+++ b/drivers/net/wireless/zd1211rw/zd_usb.h
@@ -183,6 +183,7 @@ struct zd_usb_rx {
        spinlock_t lock;
        struct mutex setup_mutex;
        struct delayed_work idle_work;
+        struct tasklet_struct reset_timer_tasklet;
        u8 fragment[2 * USB_MAX_RX_SIZE];
        unsigned int fragment_length;
        unsigned int usb_packet_size;