89 files changed, 3206 insertions, 421 deletions
diff --git a/drivers/net/3c59x.c b/drivers/net/3c59x.c
index e1da258bbfb7..0a92436f0538 100644
--- a/drivers/net/3c59x.c
+++ b/drivers/net/3c59x.c
@@ -699,7 +699,8 @@ DEFINE_WINDOW_IO(32)
 #define DEVICE_PCI(dev) NULL
 #endif
-#define VORTEX_PCI(vp) (((vp)->gendev) ? DEVICE_PCI((vp)->gendev) : NULL)
+#define VORTEX_PCI(vp)                                                  \
+        ((struct pci_dev *) (((vp)->gendev) ? DEVICE_PCI((vp)->gendev) : NULL))
 #ifdef CONFIG_EISA
 #define DEVICE_EISA(dev) (((dev)->bus == &eisa_bus_type) ? to_eisa_device((dev)) : NULL)
@@ -707,7 +708,8 @@ DEFINE_WINDOW_IO(32)
 #define DEVICE_EISA(dev) NULL
 #endif
-#define VORTEX_EISA(vp) (((vp)->gendev) ? DEVICE_EISA((vp)->gendev) : NULL)
+#define VORTEX_EISA(vp)                                                 \
+        ((struct eisa_device *) (((vp)->gendev) ? DEVICE_EISA((vp)->gendev) : NULL))
 /* The action to take with a media selection timer tick.
   Note that we deviate from the 3Com order by checking 10base2 before AUI.
diff --git a/drivers/net/8139cp.c b/drivers/net/8139cp.c
index ac422cd332ea..dd16e83933a2 100644
--- a/drivers/net/8139cp.c
+++ b/drivers/net/8139cp.c
@@ -490,13 +490,11 @@ static inline unsigned int cp_rx_csum_ok (u32 status)
 {
        unsigned int protocol = (status >> 16) & 0x3;
-        if (likely((protocol == RxProtoTCP) && (!(status & TCPFail))))
+        if (((protocol == RxProtoTCP) && !(status & TCPFail)) ||
+            ((protocol == RxProtoUDP) && !(status & UDPFail)))
                return 1;
-        else if ((protocol == RxProtoUDP) && (!(status & UDPFail)))
+        else
-                return 1;
+                return 0;
-        else if ((protocol == RxProtoIP) && (!(status & IPFail)))
-                return 1;
-        return 0;
 }
 static int cp_rx_poll(struct napi_struct *napi, int budget)
diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
index f6668cdaac85..4f1755bddf6b 100644
--- a/drivers/net/Kconfig
+++ b/drivers/net/Kconfig
@@ -2543,10 +2543,10 @@ config PCH_GBE
        depends on PCI
        select MII
        ---help---
-          This is a gigabit ethernet driver for Topcliff PCH.
+          This is a gigabit ethernet driver for EG20T PCH.
-          Topcliff PCH is the platform controller hub that is used in Intel's
+          EG20T PCH is the platform controller hub that is used in Intel's
          general embedded platform.
-          Topcliff PCH has Gigabit Ethernet interface.
+          EG20T PCH has Gigabit Ethernet interface.
          Using this interface, it is able to access system devices connected
          to Gigabit Ethernet.
          This driver enables Gigabit Ethernet function.
@@ -2945,6 +2945,18 @@ source "drivers/s390/net/Kconfig"
 source "drivers/net/caif/Kconfig"
+config TILE_NET
+        tristate "Tilera GBE/XGBE network driver support"
+        depends on TILE
+        default y
+        select CRC32
+        help
+          This is a standard Linux network device driver for the
+          on-chip Tilera Gigabit Ethernet and XAUI interfaces.
+          To compile this driver as a module, choose M here: the module
+          will be called tile_net.
 config XEN_NETDEV_FRONTEND
        tristate "Xen network device frontend driver"
        depends on XEN
diff --git a/drivers/net/Makefile b/drivers/net/Makefile
index 652fc6b98039..b90738d13994 100644
--- a/drivers/net/Makefile
+++ b/drivers/net/Makefile
@@ -301,3 +301,4 @@ obj-$(CONFIG_CAIF) += caif/
 obj-$(CONFIG_OCTEON_MGMT_ETHERNET) += octeon/
 obj-$(CONFIG_PCH_GBE) += pch_gbe/
+obj-$(CONFIG_TILE_NET) += tile/
diff --git a/drivers/net/atl1c/atl1c_hw.c b/drivers/net/atl1c/atl1c_hw.c
index 919080b2c3a5..1bf672009948 100644
--- a/drivers/net/atl1c/atl1c_hw.c
+++ b/drivers/net/atl1c/atl1c_hw.c
@@ -82,7 +82,7 @@ static int atl1c_get_permanent_address(struct atl1c_hw *hw)
        addr[0] = addr[1] = 0;
        AT_READ_REG(hw, REG_OTP_CTRL, &otp_ctrl_data);
        if (atl1c_check_eeprom_exist(hw)) {
-                if (hw->nic_type == athr_l1c || hw->nic_type == athr_l2c_b) {
+                if (hw->nic_type == athr_l1c || hw->nic_type == athr_l2c) {
                        /* Enable OTP CLK */
                        if (!(otp_ctrl_data & OTP_CTRL_CLK_EN)) {
                                otp_ctrl_data |= OTP_CTRL_CLK_EN;
diff --git a/drivers/net/au1000_eth.c b/drivers/net/au1000_eth.c
index 43489f89c142..53eff9ba6e95 100644
--- a/drivers/net/au1000_eth.c
+++ b/drivers/net/au1000_eth.c
@@ -155,10 +155,10 @@ static void au1000_enable_mac(struct net_device *dev, int force_reset)
        spin_lock_irqsave(&aup->lock, flags);
        if (force_reset || (!aup->mac_enabled)) {
-                writel(MAC_EN_CLOCK_ENABLE, &aup->enable);
+                writel(MAC_EN_CLOCK_ENABLE, aup->enable);
                au_sync_delay(2);
                writel((MAC_EN_RESET0 | MAC_EN_RESET1 | MAC_EN_RESET2
-                                | MAC_EN_CLOCK_ENABLE), &aup->enable);
+                                | MAC_EN_CLOCK_ENABLE), aup->enable);
                au_sync_delay(2);
                aup->mac_enabled = 1;
@@ -503,9 +503,9 @@ static void au1000_reset_mac_unlocked(struct net_device *dev)
        au1000_hard_stop(dev);
-        writel(MAC_EN_CLOCK_ENABLE, &aup->enable);
+        writel(MAC_EN_CLOCK_ENABLE, aup->enable);
        au_sync_delay(2);
-        writel(0, &aup->enable);
+        writel(0, aup->enable);
        au_sync_delay(2);
        aup->tx_full = 0;
@@ -1119,7 +1119,7 @@ static int __devinit au1000_probe(struct platform_device *pdev)
        /* set a random MAC now in case platform_data doesn't provide one */
        random_ether_addr(dev->dev_addr);
-        writel(0, &aup->enable);
+        writel(0, aup->enable);
        aup->mac_enabled = 0;
        pd = pdev->dev.platform_data;
diff --git a/drivers/net/b44.c b/drivers/net/b44.c
index c6e86315b3f8..2e2b76258ab4 100644
--- a/drivers/net/b44.c
+++ b/drivers/net/b44.c
@@ -381,11 +381,11 @@ static void b44_set_flow_ctrl(struct b44 *bp, u32 local, u32 remote)
        __b44_set_flow_ctrl(bp, pause_enab);
 }
-#ifdef SSB_DRIVER_MIPS
+#ifdef CONFIG_BCM47XX
-extern char *nvram_get(char *name);
+#include <asm/mach-bcm47xx/nvram.h>
 static void b44_wap54g10_workaround(struct b44 *bp)
 {
-        const char *str;
+        char buf[20];
        u32 val;
        int err;
@@ -394,10 +394,9 @@ static void b44_wap54g10_workaround(struct b44 *bp)
         * see https://dev.openwrt.org/ticket/146
         * check and reset bit "isolate"
         */
-        str = nvram_get("boardnum");
+        if (nvram_getenv("boardnum", buf, sizeof(buf)) < 0)
-        if (!str)
                return;
-        if (simple_strtoul(str, NULL, 0) == 2) {
+        if (simple_strtoul(buf, NULL, 0) == 2) {
                err = __b44_readphy(bp, 0, MII_BMCR, &val);
                if (err)
                        goto error;
diff --git a/drivers/net/benet/be_cmds.c b/drivers/net/benet/be_cmds.c
index 36eca1ce75d4..e4465d222a7d 100644
--- a/drivers/net/benet/be_cmds.c
+++ b/drivers/net/benet/be_cmds.c
@@ -1235,7 +1235,7 @@ int be_cmd_multicast_set(struct be_adapter *adapter, u32 if_id,
                i = 0;
                netdev_for_each_mc_addr(ha, netdev)
-                        memcpy(req->mac[i].byte, ha->addr, ETH_ALEN);
+                        memcpy(req->mac[i++].byte, ha->addr, ETH_ALEN);
        } else {
                req->promiscuous = 1;
        }
diff --git a/drivers/net/benet/be_main.c b/drivers/net/benet/be_main.c
index c36cd2ffbadc..93354eee2cfd 100644
--- a/drivers/net/benet/be_main.c
+++ b/drivers/net/benet/be_main.c
@@ -2458,6 +2458,12 @@ int be_load_fw(struct be_adapter *adapter, u8 *func)
        int status, i = 0, num_imgs = 0;
        const u8 *p;
+        if (!netif_running(adapter->netdev)) {
+                dev_err(&adapter->pdev->dev,
+                        "Firmware load not allowed (interface is down)\n");
+                return -EPERM;
+        }
        strcpy(fw_file, func);
        status = request_firmware(&fw, fw_file, &adapter->pdev->dev);
diff --git a/drivers/net/bnx2x/bnx2x.h b/drivers/net/bnx2x/bnx2x.h
index 863e73a85fbe..d255428122fc 100644
--- a/drivers/net/bnx2x/bnx2x.h
+++ b/drivers/net/bnx2x/bnx2x.h
@@ -20,8 +20,8 @@
 * (you will need to reboot afterwards) */
 /* #define BNX2X_STOP_ON_ERROR */
-#define DRV_MODULE_VERSION      "1.60.00-4"
+#define DRV_MODULE_VERSION      "1.60.01-0"
-#define DRV_MODULE_RELDATE      "2010/11/01"
+#define DRV_MODULE_RELDATE      "2010/11/12"
 #define BNX2X_BC_VER            0x040200
 #define BNX2X_MULTI_QUEUE
diff --git a/drivers/net/bnx2x/bnx2x_cmn.c b/drivers/net/bnx2x/bnx2x_cmn.c
index 94d5f59d5a6f..0af361e4e3d1 100644
--- a/drivers/net/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/bnx2x/bnx2x_cmn.c
@@ -1782,15 +1782,15 @@ exit_lbl:
 }
 #endif
-static inline void bnx2x_set_pbd_gso_e2(struct sk_buff *skb,
+static inline void bnx2x_set_pbd_gso_e2(struct sk_buff *skb, u32 *parsing_data,
-                                     struct eth_tx_parse_bd_e2 *pbd,
+                                        u32 xmit_type)
-                                     u32 xmit_type)
 {
-        pbd->parsing_data |= cpu_to_le16(skb_shinfo(skb)->gso_size) <<
+        *parsing_data |= (skb_shinfo(skb)->gso_size <<
-                ETH_TX_PARSE_BD_E2_LSO_MSS_SHIFT;
+                              ETH_TX_PARSE_BD_E2_LSO_MSS_SHIFT) &
+                              ETH_TX_PARSE_BD_E2_LSO_MSS;
        if ((xmit_type & XMIT_GSO_V6) &&
            (ipv6_hdr(skb)->nexthdr == NEXTHDR_IPV6))
-                pbd->parsing_data |= ETH_TX_PARSE_BD_E2_IPV6_WITH_EXT_HDR;
+                *parsing_data |= ETH_TX_PARSE_BD_E2_IPV6_WITH_EXT_HDR;
 }
 /**
@@ -1835,15 +1835,15 @@ static inline void bnx2x_set_pbd_gso(struct sk_buff *skb,
 * @return header len
 */
 static inline  u8 bnx2x_set_pbd_csum_e2(struct bnx2x *bp, struct sk_buff *skb,
-        struct eth_tx_parse_bd_e2 *pbd,
+        u32 *parsing_data, u32 xmit_type)
-        u32 xmit_type)
 {
-        pbd->parsing_data |= cpu_to_le16(tcp_hdrlen(skb)/4) <<
+        *parsing_data |= ((tcp_hdrlen(skb)/4) <<
-                ETH_TX_PARSE_BD_E2_TCP_HDR_LENGTH_DW_SHIFT;
+                ETH_TX_PARSE_BD_E2_TCP_HDR_LENGTH_DW_SHIFT) &
+                ETH_TX_PARSE_BD_E2_TCP_HDR_LENGTH_DW;
-        pbd->parsing_data |= cpu_to_le16(((unsigned char *)tcp_hdr(skb) -
+        *parsing_data |= ((((u8 *)tcp_hdr(skb) - skb->data) / 2) <<
-                                          skb->data) / 2) <<
+                ETH_TX_PARSE_BD_E2_TCP_HDR_START_OFFSET_W_SHIFT) &
-                ETH_TX_PARSE_BD_E2_TCP_HDR_START_OFFSET_W_SHIFT;
+                ETH_TX_PARSE_BD_E2_TCP_HDR_START_OFFSET_W;
        return skb_transport_header(skb) + tcp_hdrlen(skb) - skb->data;
 }
@@ -1912,6 +1912,7 @@ netdev_tx_t bnx2x_start_xmit(struct sk_buff *skb, struct net_device *dev)
        struct eth_tx_bd *tx_data_bd, *total_pkt_bd = NULL;
        struct eth_tx_parse_bd_e1x *pbd_e1x = NULL;
        struct eth_tx_parse_bd_e2 *pbd_e2 = NULL;
+        u32 pbd_e2_parsing_data = 0;
        u16 pkt_prod, bd_prod;
        int nbd, fp_index;
        dma_addr_t mapping;
@@ -2033,8 +2034,9 @@ netdev_tx_t bnx2x_start_xmit(struct sk_buff *skb, struct net_device *dev)
                memset(pbd_e2, 0, sizeof(struct eth_tx_parse_bd_e2));
                /* Set PBD in checksum offload case */
                if (xmit_type & XMIT_CSUM)
-                        hlen = bnx2x_set_pbd_csum_e2(bp,
+                        hlen = bnx2x_set_pbd_csum_e2(bp, skb,
-                                                     skb, pbd_e2, xmit_type);
+                                                     &pbd_e2_parsing_data,
+                                                     xmit_type);
        } else {
                pbd_e1x = &fp->tx_desc_ring[bd_prod].parse_bd_e1x;
                memset(pbd_e1x, 0, sizeof(struct eth_tx_parse_bd_e1x));
@@ -2076,10 +2078,18 @@ netdev_tx_t bnx2x_start_xmit(struct sk_buff *skb, struct net_device *dev)
                        bd_prod = bnx2x_tx_split(bp, fp, tx_buf, &tx_start_bd,
                                                 hlen, bd_prod, ++nbd);
                if (CHIP_IS_E2(bp))
-                        bnx2x_set_pbd_gso_e2(skb, pbd_e2, xmit_type);
+                        bnx2x_set_pbd_gso_e2(skb, &pbd_e2_parsing_data,
+                                             xmit_type);
                else
                        bnx2x_set_pbd_gso(skb, pbd_e1x, xmit_type);
        }
+        /* Set the PBD's parsing_data field if not zero
+         * (for the chips newer than 57711).
+         */
+        if (pbd_e2_parsing_data)
+                pbd_e2->parsing_data = cpu_to_le32(pbd_e2_parsing_data);
        tx_data_bd = (struct eth_tx_bd *)tx_start_bd;
        /* Handle fragmented skb */
diff --git a/drivers/net/bnx2x/bnx2x_init_ops.h b/drivers/net/bnx2x/bnx2x_init_ops.h
index a306b0e46b61..66df29fcf751 100644
--- a/drivers/net/bnx2x/bnx2x_init_ops.h
+++ b/drivers/net/bnx2x/bnx2x_init_ops.h
@@ -838,7 +838,7 @@ static void bnx2x_qm_init_ptr_table(struct bnx2x *bp, int qm_cid_count,
 /****************************************************************************
 * SRC initializations
 ****************************************************************************/
+#ifdef BCM_CNIC
 /* called during init func stage */
 static void bnx2x_src_init_t2(struct bnx2x *bp, struct src_ent *t2,
                              dma_addr_t t2_mapping, int src_cid_count)
@@ -862,5 +862,5 @@ static void bnx2x_src_init_t2(struct bnx2x *bp, struct src_ent *t2,
                    U64_HI((u64)t2_mapping +
                           (src_cid_count-1) * sizeof(struct src_ent)));
 }
+#endif
 #endif /* BNX2X_INIT_OPS_H */
diff --git a/drivers/net/bnx2x/bnx2x_main.c b/drivers/net/bnx2x/bnx2x_main.c
index e9ad16f00b56..9709b8569666 100644
--- a/drivers/net/bnx2x/bnx2x_main.c
+++ b/drivers/net/bnx2x/bnx2x_main.c
@@ -9064,7 +9064,7 @@ static int __devinit bnx2x_init_one(struct pci_dev *pdev,
        default:
                pr_err("Unknown board_type (%ld), aborting\n",
                           ent->driver_data);
-                return ENODEV;
+                return -ENODEV;
        }
        cid_count += CNIC_CONTEXT_USE;
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index bdb68a600382..d0ea760ce419 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -171,7 +171,7 @@ MODULE_PARM_DESC(resend_igmp, "Number of IGMP membership reports to send on link
 /*----------------------------- Global variables ----------------------------*/
 #ifdef CONFIG_NET_POLL_CONTROLLER
-cpumask_var_t netpoll_block_tx;
+atomic_t netpoll_block_tx = ATOMIC_INIT(0);
 #endif
 static const char * const version =
@@ -878,8 +878,10 @@ static void __bond_resend_igmp_join_requests(struct net_device *dev)
        rcu_read_lock();
        in_dev = __in_dev_get_rcu(dev);
        if (in_dev) {
+                read_lock(&in_dev->mc_list_lock);
                for (im = in_dev->mc_list; im; im = im->next)
                        ip_mc_rejoin_group(im);
+                read_unlock(&in_dev->mc_list_lock);
        }
        rcu_read_unlock();
@@ -1574,7 +1576,7 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
        /* If this is the first slave, then we need to set the master's hardware
         * address to be the same as the slave's. */
-        if (bond->slave_cnt == 0)
+        if (is_zero_ether_addr(bond->dev->dev_addr))
                memcpy(bond->dev->dev_addr, slave_dev->dev_addr,
                       slave_dev->addr_len);
@@ -5297,13 +5299,6 @@ static int __init bonding_init(void)
        if (res)
                goto out;
-#ifdef CONFIG_NET_POLL_CONTROLLER
-        if (!alloc_cpumask_var(&netpoll_block_tx, GFP_KERNEL)) {
-                res = -ENOMEM;
-                goto out;
-        }
-#endif
        res = register_pernet_subsys(&bond_net_ops);
        if (res)
                goto out;
@@ -5332,9 +5327,6 @@ err:
        rtnl_link_unregister(&bond_link_ops);
 err_link:
        unregister_pernet_subsys(&bond_net_ops);
-#ifdef CONFIG_NET_POLL_CONTROLLER
-        free_cpumask_var(netpoll_block_tx);
-#endif
        goto out;
 }
@@ -5351,7 +5343,10 @@ static void __exit bonding_exit(void)
        unregister_pernet_subsys(&bond_net_ops);
 #ifdef CONFIG_NET_POLL_CONTROLLER
-        free_cpumask_var(netpoll_block_tx);
+        /*
+         * Make sure we don't have an imbalance on our netpoll blocking
+         */
+        WARN_ON(atomic_read(&netpoll_block_tx));
 #endif
 }
diff --git a/drivers/net/bonding/bonding.h b/drivers/net/bonding/bonding.h
index 4eedb12df6ca..c2f081352a03 100644
--- a/drivers/net/bonding/bonding.h
+++ b/drivers/net/bonding/bonding.h
@@ -119,26 +119,22 @@
 #ifdef CONFIG_NET_POLL_CONTROLLER
-extern cpumask_var_t netpoll_block_tx;
+extern atomic_t netpoll_block_tx;
 static inline void block_netpoll_tx(void)
 {
-        preempt_disable();
+        atomic_inc(&netpoll_block_tx);
-        BUG_ON(cpumask_test_and_set_cpu(smp_processor_id(),
-                                        netpoll_block_tx));
 }
 static inline void unblock_netpoll_tx(void)
 {
-        BUG_ON(!cpumask_test_and_clear_cpu(smp_processor_id(),
+        atomic_dec(&netpoll_block_tx);
-                                           netpoll_block_tx));
-        preempt_enable();
 }
 static inline int is_netpoll_tx_blocked(struct net_device *dev)
 {
        if (unlikely(dev->priv_flags & IFF_IN_NETPOLL))
-                return cpumask_test_cpu(smp_processor_id(), netpoll_block_tx);
+                return atomic_read(&netpoll_block_tx);
        return 0;
 }
 #else
diff --git a/drivers/net/caif/caif_shm_u5500.c b/drivers/net/caif/caif_shm_u5500.c
index 1cd90da86f13..32b1c6fb2de1 100644
--- a/drivers/net/caif/caif_shm_u5500.c
+++ b/drivers/net/caif/caif_shm_u5500.c
@@ -5,7 +5,7 @@
 * License terms: GNU General Public License (GPL) version 2
 */
-#define pr_fmt(fmt) KBUILD_MODNAME ":" __func__ "():" fmt
+#define pr_fmt(fmt) KBUILD_MODNAME ":" fmt
 #include <linux/version.h>
 #include <linux/init.h>
diff --git a/drivers/net/caif/caif_shmcore.c b/drivers/net/caif/caif_shmcore.c
index 19f9c0656667..80511167f35b 100644
--- a/drivers/net/caif/caif_shmcore.c
+++ b/drivers/net/caif/caif_shmcore.c
@@ -6,7 +6,7 @@
 * License terms: GNU General Public License (GPL) version 2
 */
-#define pr_fmt(fmt) KBUILD_MODNAME ":" __func__ "():" fmt
+#define pr_fmt(fmt) KBUILD_MODNAME ":" fmt
 #include <linux/spinlock.h>
 #include <linux/sched.h>
diff --git a/drivers/net/caif/caif_spi.c b/drivers/net/caif/caif_spi.c
index 8b4cea57a6c5..20da1996d354 100644
--- a/drivers/net/caif/caif_spi.c
+++ b/drivers/net/caif/caif_spi.c
@@ -635,8 +635,8 @@ int cfspi_spi_probe(struct platform_device *pdev)
        ndev = alloc_netdev(sizeof(struct cfspi),
                        "cfspi%d", cfspi_setup);
-        if (!dev)
+        if (!ndev)
-                return -ENODEV;
+                return -ENOMEM;
        cfspi = netdev_priv(ndev);
        netif_stop_queue(ndev);
diff --git a/drivers/net/cxgb4/t4_hw.c b/drivers/net/cxgb4/t4_hw.c
index bb813d94aea8..e97521c801ea 100644
--- a/drivers/net/cxgb4/t4_hw.c
+++ b/drivers/net/cxgb4/t4_hw.c
@@ -2408,7 +2408,7 @@ int t4_alloc_mac_filt(struct adapter *adap, unsigned int mbox,
                if (index < NEXACT_MAC)
                        ret++;
                else if (hash)
-                        *hash |= (1 << hash_mac_addr(addr[i]));
+                        *hash |= (1ULL << hash_mac_addr(addr[i]));
        }
        return ret;
 }
diff --git a/drivers/net/cxgb4vf/cxgb4vf_main.c b/drivers/net/cxgb4vf/cxgb4vf_main.c
index c3449bbc585a..6bf464afa90e 100644
--- a/drivers/net/cxgb4vf/cxgb4vf_main.c
+++ b/drivers/net/cxgb4vf/cxgb4vf_main.c
@@ -816,40 +816,48 @@ static struct net_device_stats *cxgb4vf_get_stats(struct net_device *dev)
 }
 /*
- * Collect up to maxaddrs worth of a netdevice's unicast addresses into an
+ * Collect up to maxaddrs worth of a netdevice's unicast addresses, starting
- * array of addrss pointers and return the number collected.
+ * at a specified offset within the list, into an array of addrss pointers and
+ * return the number collected.
 */
-static inline int collect_netdev_uc_list_addrs(const struct net_device *dev,
+static inline unsigned int collect_netdev_uc_list_addrs(const struct net_device *dev,
-                                               const u8 **addr,
+                                                        const u8 **addr,
-                                               unsigned int maxaddrs)
+                                                        unsigned int offset,
+                                                        unsigned int maxaddrs)
 {
+        unsigned int index = 0;
        unsigned int naddr = 0;
        const struct netdev_hw_addr *ha;
-        for_each_dev_addr(dev, ha) {
+        for_each_dev_addr(dev, ha)
-                addr[naddr++] = ha->addr;
+                if (index++ >= offset) {
-                if (naddr >= maxaddrs)
+                        addr[naddr++] = ha->addr;
-                        break;
+                        if (naddr >= maxaddrs)
-        }
+                                break;
+                }
        return naddr;
 }
 /*
- * Collect up to maxaddrs worth of a netdevice's multicast addresses into an
+ * Collect up to maxaddrs worth of a netdevice's multicast addresses, starting
- * array of addrss pointers and return the number collected.
+ * at a specified offset within the list, into an array of addrss pointers and
+ * return the number collected.
 */
-static inline int collect_netdev_mc_list_addrs(const struct net_device *dev,
+static inline unsigned int collect_netdev_mc_list_addrs(const struct net_device *dev,
-                                               const u8 **addr,
+                                                        const u8 **addr,
-                                               unsigned int maxaddrs)
+                                                        unsigned int offset,
+                                                        unsigned int maxaddrs)
 {
+        unsigned int index = 0;
        unsigned int naddr = 0;
        const struct netdev_hw_addr *ha;
-        netdev_for_each_mc_addr(ha, dev) {
+        netdev_for_each_mc_addr(ha, dev)
-                addr[naddr++] = ha->addr;
+                if (index++ >= offset) {
-                if (naddr >= maxaddrs)
+                        addr[naddr++] = ha->addr;
-                        break;
+                        if (naddr >= maxaddrs)
-        }
+                                break;
+                }
        return naddr;
 }
@@ -862,16 +870,20 @@ static int set_addr_filters(const struct net_device *dev, bool sleep)
        u64 mhash = 0;
        u64 uhash = 0;
        bool free = true;
-        u16 filt_idx[7];
+        unsigned int offset, naddr;
        const u8 *addr[7];
-        int ret, naddr = 0;
+        int ret;
        const struct port_info *pi = netdev_priv(dev);
        /* first do the secondary unicast addresses */
-        naddr = collect_netdev_uc_list_addrs(dev, addr, ARRAY_SIZE(addr));
+        for (offset = 0; ; offset += naddr) {
-        if (naddr > 0) {
+                naddr = collect_netdev_uc_list_addrs(dev, addr, offset,
+                                                     ARRAY_SIZE(addr));
+                if (naddr == 0)
+                        break;
                ret = t4vf_alloc_mac_filt(pi->adapter, pi->viid, free,
-                                          naddr, addr, filt_idx, &uhash, sleep);
+                                          naddr, addr, NULL, &uhash, sleep);
                if (ret < 0)
                        return ret;
@@ -879,12 +891,17 @@ static int set_addr_filters(const struct net_device *dev, bool sleep)
        }
        /* next set up the multicast addresses */
-        naddr = collect_netdev_mc_list_addrs(dev, addr, ARRAY_SIZE(addr));
+        for (offset = 0; ; offset += naddr) {
-        if (naddr > 0) {
+                naddr = collect_netdev_mc_list_addrs(dev, addr, offset,
+                                                     ARRAY_SIZE(addr));
+                if (naddr == 0)
+                        break;
                ret = t4vf_alloc_mac_filt(pi->adapter, pi->viid, free,
-                                          naddr, addr, filt_idx, &mhash, sleep);
+                                          naddr, addr, NULL, &mhash, sleep);
                if (ret < 0)
                        return ret;
+                free = false;
        }
        return t4vf_set_addr_hash(pi->adapter, pi->viid, uhash != 0,
@@ -2252,6 +2269,7 @@ static void __devinit cfg_queues(struct adapter *adapter)
 {
        struct sge *s = &adapter->sge;
        int q10g, n10g, qidx, pidx, qs;
+        size_t iqe_size;
        /*
         * We should not be called till we know how many Queue Sets we can
@@ -2296,6 +2314,13 @@ static void __devinit cfg_queues(struct adapter *adapter)
        s->ethqsets = qidx;
        /*
+         * The Ingress Queue Entry Size for our various Response Queues needs
+         * to be big enough to accommodate the largest message we can receive
+         * from the chip/firmware; which is 64 bytes ...
+         */
+        iqe_size = 64;
+        /*
         * Set up default Queue Set parameters ...  Start off with the
         * shortest interrupt holdoff timer.
         */
@@ -2303,7 +2328,7 @@ static void __devinit cfg_queues(struct adapter *adapter)
                struct sge_eth_rxq *rxq = &s->ethrxq[qs];
                struct sge_eth_txq *txq = &s->ethtxq[qs];
-                init_rspq(&rxq->rspq, 0, 0, 1024, L1_CACHE_BYTES);
+                init_rspq(&rxq->rspq, 0, 0, 1024, iqe_size);
                rxq->fl.size = 72;
                txq->q.size = 1024;
        }
@@ -2312,8 +2337,7 @@ static void __devinit cfg_queues(struct adapter *adapter)
         * The firmware event queue is used for link state changes and
         * notifications of TX DMA completions.
         */
-        init_rspq(&s->fw_evtq, SGE_TIMER_RSTRT_CNTR, 0, 512,
+        init_rspq(&s->fw_evtq, SGE_TIMER_RSTRT_CNTR, 0, 512, iqe_size);
-                  L1_CACHE_BYTES);
        /*
         * The forwarded interrupt queue is used when we're in MSI interrupt
@@ -2329,7 +2353,7 @@ static void __devinit cfg_queues(struct adapter *adapter)
         * any time ...
         */
        init_rspq(&s->intrq, SGE_TIMER_RSTRT_CNTR, 0, MSIX_ENTRIES + 1,
-                  L1_CACHE_BYTES);
+                  iqe_size);
 }
 /*
diff --git a/drivers/net/cxgb4vf/t4vf_hw.c b/drivers/net/cxgb4vf/t4vf_hw.c
index e306c20dfaee..19520afe1a12 100644
--- a/drivers/net/cxgb4vf/t4vf_hw.c
+++ b/drivers/net/cxgb4vf/t4vf_hw.c
@@ -1014,48 +1014,72 @@ int t4vf_alloc_mac_filt(struct adapter *adapter, unsigned int viid, bool free,
                        unsigned int naddr, const u8 **addr, u16 *idx,
                        u64 *hash, bool sleep_ok)
 {
-        int i, ret;
+        int offset, ret = 0;
+        unsigned nfilters = 0;
+        unsigned int rem = naddr;
        struct fw_vi_mac_cmd cmd, rpl;
-        struct fw_vi_mac_exact *p;
-        size_t len16;
-        if (naddr > ARRAY_SIZE(cmd.u.exact))
+        if (naddr > FW_CLS_TCAM_NUM_ENTRIES)
                return -EINVAL;
-        len16 = DIV_ROUND_UP(offsetof(struct fw_vi_mac_cmd,
-                                      u.exact[naddr]), 16);
-        memset(&cmd, 0, sizeof(cmd));
+        for (offset = 0; offset < naddr; /**/) {
-        cmd.op_to_viid = cpu_to_be32(FW_CMD_OP(FW_VI_MAC_CMD) |
+                unsigned int fw_naddr = (rem < ARRAY_SIZE(cmd.u.exact)
-                                     FW_CMD_REQUEST |
+                                         ? rem
-                                     FW_CMD_WRITE |
+                                         : ARRAY_SIZE(cmd.u.exact));
-                                     (free ? FW_CMD_EXEC : 0) |
+                size_t len16 = DIV_ROUND_UP(offsetof(struct fw_vi_mac_cmd,
-                                     FW_VI_MAC_CMD_VIID(viid));
+                                                     u.exact[fw_naddr]), 16);
-        cmd.freemacs_to_len16 = cpu_to_be32(FW_VI_MAC_CMD_FREEMACS(free) |
+                struct fw_vi_mac_exact *p;
-                                            FW_CMD_LEN16(len16));
+                int i;
-        for (i = 0, p = cmd.u.exact; i < naddr; i++, p++) {
+                memset(&cmd, 0, sizeof(cmd));
-                p->valid_to_idx =
+                cmd.op_to_viid = cpu_to_be32(FW_CMD_OP(FW_VI_MAC_CMD) |
-                        cpu_to_be16(FW_VI_MAC_CMD_VALID |
+                                             FW_CMD_REQUEST |
-                                    FW_VI_MAC_CMD_IDX(FW_VI_MAC_ADD_MAC));
+                                             FW_CMD_WRITE |
-                memcpy(p->macaddr, addr[i], sizeof(p->macaddr));
+                                             (free ? FW_CMD_EXEC : 0) |
-        }
+                                             FW_VI_MAC_CMD_VIID(viid));
+                cmd.freemacs_to_len16 =
+                        cpu_to_be32(FW_VI_MAC_CMD_FREEMACS(free) |
+                                    FW_CMD_LEN16(len16));
+                for (i = 0, p = cmd.u.exact; i < fw_naddr; i++, p++) {
+                        p->valid_to_idx = cpu_to_be16(
+                                FW_VI_MAC_CMD_VALID |
+                                FW_VI_MAC_CMD_IDX(FW_VI_MAC_ADD_MAC));
+                        memcpy(p->macaddr, addr[offset+i], sizeof(p->macaddr));
+                }
+                ret = t4vf_wr_mbox_core(adapter, &cmd, sizeof(cmd), &rpl,
+                                        sleep_ok);
+                if (ret && ret != -ENOMEM)
+                        break;
-        ret = t4vf_wr_mbox_core(adapter, &cmd, sizeof(cmd), &rpl, sleep_ok);
+                for (i = 0, p = rpl.u.exact; i < fw_naddr; i++, p++) {
-        if (ret)
+                        u16 index = FW_VI_MAC_CMD_IDX_GET(
-                return ret;
+                                be16_to_cpu(p->valid_to_idx));
-        for (i = 0, p = rpl.u.exact; i < naddr; i++, p++) {
+                        if (idx)
-                u16 index = FW_VI_MAC_CMD_IDX_GET(be16_to_cpu(p->valid_to_idx));
+                                idx[offset+i] =
+                                        (index >= FW_CLS_TCAM_NUM_ENTRIES
-                if (idx)
+                                         ? 0xffff
-                        idx[i] = (index >= FW_CLS_TCAM_NUM_ENTRIES
+                                         : index);
-                                  ? 0xffff
+                        if (index < FW_CLS_TCAM_NUM_ENTRIES)
-                                  : index);
+                                nfilters++;
-                if (index < FW_CLS_TCAM_NUM_ENTRIES)
+                        else if (hash)
-                        ret++;
+                                *hash |= (1ULL << hash_mac_addr(addr[offset+i]));
-                else if (hash)
+                }
-                        *hash |= (1 << hash_mac_addr(addr[i]));
+                free = false;
+                offset += fw_naddr;
+                rem -= fw_naddr;
        }
+        /*
+         * If there were no errors or we merely ran out of room in our MAC
+         * address arena, return the number of filters actually written.
+         */
+        if (ret == 0 || ret == -ENOMEM)
+                ret = nfilters;
        return ret;
 }
diff --git a/drivers/net/e1000/e1000_main.c b/drivers/net/e1000/e1000_main.c
index 4686c3983fc3..4d62f7bfa036 100644
--- a/drivers/net/e1000/e1000_main.c
+++ b/drivers/net/e1000/e1000_main.c
@@ -31,7 +31,7 @@
 char e1000_driver_name[] = "e1000";
 static char e1000_driver_string[] = "Intel(R) PRO/1000 Network Driver";
-#define DRV_VERSION "7.3.21-k6-NAPI"
+#define DRV_VERSION "7.3.21-k8-NAPI"
 const char e1000_driver_version[] = DRV_VERSION;
 static const char e1000_copyright[] = "Copyright (c) 1999-2006 Intel Corporation.";
@@ -485,9 +485,6 @@ void e1000_down(struct e1000_adapter *adapter)
        struct net_device *netdev = adapter->netdev;
        u32 rctl, tctl;
-        /* signal that we're down so the interrupt handler does not
-         * reschedule our watchdog timer */
-        set_bit(__E1000_DOWN, &adapter->flags);
        /* disable receives in the hardware */
        rctl = er32(RCTL);
@@ -508,6 +505,13 @@ void e1000_down(struct e1000_adapter *adapter)
        e1000_irq_disable(adapter);
+        /*
+         * Setting DOWN must be after irq_disable to prevent
+         * a screaming interrupt.  Setting DOWN also prevents
+         * timers and tasks from rescheduling.
+         */
+        set_bit(__E1000_DOWN, &adapter->flags);
        del_timer_sync(&adapter->tx_fifo_stall_timer);
        del_timer_sync(&adapter->watchdog_timer);
        del_timer_sync(&adapter->phy_info_timer);
diff --git a/drivers/net/ehea/ehea_ethtool.c b/drivers/net/ehea/ehea_ethtool.c
index 75b099ce49c9..1f37ee6b2a26 100644
--- a/drivers/net/ehea/ehea_ethtool.c
+++ b/drivers/net/ehea/ehea_ethtool.c
@@ -261,6 +261,13 @@ static void ehea_get_ethtool_stats(struct net_device *dev,
 }
+static int ehea_set_flags(struct net_device *dev, u32 data)
+{
+        return ethtool_op_set_flags(dev, data, ETH_FLAG_LRO
+                                        | ETH_FLAG_TXVLAN
+                                        | ETH_FLAG_RXVLAN);
+}
 const struct ethtool_ops ehea_ethtool_ops = {
        .get_settings = ehea_get_settings,
        .get_drvinfo = ehea_get_drvinfo,
@@ -273,6 +280,8 @@ const struct ethtool_ops ehea_ethtool_ops = {
        .get_ethtool_stats = ehea_get_ethtool_stats,
        .get_rx_csum = ehea_get_rx_csum,
        .set_settings = ehea_set_settings,
+        .get_flags = ethtool_op_get_flags,
+        .set_flags = ehea_set_flags,
        .nway_reset = ehea_nway_reset,          /* Restart autonegotiation */
 };
diff --git a/drivers/net/ehea/ehea_main.c b/drivers/net/ehea/ehea_main.c
index 182b2a7be8dc..b95f087cd5a9 100644
--- a/drivers/net/ehea/ehea_main.c
+++ b/drivers/net/ehea/ehea_main.c
@@ -400,6 +400,7 @@ static void ehea_refill_rq1(struct ehea_port_res *pr, int index, int nr_of_wqes)
                        skb_arr_rq1[index] = netdev_alloc_skb(dev,
                                                              EHEA_L_PKT_SIZE);
                        if (!skb_arr_rq1[index]) {
+                                ehea_info("Unable to allocate enough skb in the array\n");
                                pr->rq1_skba.os_skbs = fill_wqes - i;
                                break;
                        }
@@ -422,13 +423,20 @@ static void ehea_init_fill_rq1(struct ehea_port_res *pr, int nr_rq1a)
        struct net_device *dev = pr->port->netdev;
        int i;
-        for (i = 0; i < pr->rq1_skba.len; i++) {
+        if (nr_rq1a > pr->rq1_skba.len) {
+                ehea_error("NR_RQ1A bigger than skb array len\n");
+                return;
+        }
+        for (i = 0; i < nr_rq1a; i++) {
                skb_arr_rq1[i] = netdev_alloc_skb(dev, EHEA_L_PKT_SIZE);
-                if (!skb_arr_rq1[i])
+                if (!skb_arr_rq1[i]) {
+                        ehea_info("No enough memory to allocate skb array\n");
                        break;
+                }
        }
        /* Ring doorbell */
-        ehea_update_rq1a(pr->qp, nr_rq1a);
+        ehea_update_rq1a(pr->qp, i);
 }
 static int ehea_refill_rq_def(struct ehea_port_res *pr,
@@ -675,7 +683,7 @@ static void ehea_proc_skb(struct ehea_port_res *pr, struct ehea_cqe *cqe,
        int vlan_extracted = ((cqe->status & EHEA_CQE_VLAN_TAG_XTRACT) &&
                              pr->port->vgrp);
-        if (use_lro) {
+        if (skb->dev->features & NETIF_F_LRO) {
                if (vlan_extracted)
                        lro_vlan_hwaccel_receive_skb(&pr->lro_mgr, skb,
                                                     pr->port->vgrp,
@@ -735,8 +743,10 @@ static int ehea_proc_rwqes(struct net_device *dev,
                                        skb = netdev_alloc_skb(dev,
                                                               EHEA_L_PKT_SIZE);
-                                        if (!skb)
+                                        if (!skb) {
+                                                ehea_info("Not enough memory to allocate skb\n");
                                                break;
+                                        }
                                }
                                skb_copy_to_linear_data(skb, ((char *)cqe) + 64,
                                                 cqe->num_bytes_transfered - 4);
@@ -777,7 +787,7 @@ static int ehea_proc_rwqes(struct net_device *dev,
                }
                cqe = ehea_poll_rq1(qp, &wqe_index);
        }
-        if (use_lro)
+        if (dev->features & NETIF_F_LRO)
                lro_flush_all(&pr->lro_mgr);
        pr->rx_packets += processed;
@@ -3268,6 +3278,9 @@ struct ehea_port *ehea_setup_single_port(struct ehea_adapter *adapter,
                      | NETIF_F_LLTX;
        dev->watchdog_timeo = EHEA_WATCH_DOG_TIMEOUT;
+        if (use_lro)
+                dev->features |= NETIF_F_LRO;
        INIT_WORK(&port->reset_task, ehea_reset_port);
        ret = register_netdev(dev);
diff --git a/drivers/net/enic/enic_main.c b/drivers/net/enic/enic_main.c
index a466ef91dd43..aa28b270c045 100644
--- a/drivers/net/enic/enic_main.c
+++ b/drivers/net/enic/enic_main.c
@@ -1962,7 +1962,8 @@ static void enic_poll_controller(struct net_device *netdev)
        case VNIC_DEV_INTR_MODE_MSIX:
                for (i = 0; i < enic->rq_count; i++) {
                        intr = enic_msix_rq_intr(enic, i);
-                        enic_isr_msix_rq(enic->msix_entry[intr].vector, enic);
+                        enic_isr_msix_rq(enic->msix_entry[intr].vector,
+                                &enic->napi[i]);
                }
                intr = enic_msix_wq_intr(enic, i);
                enic_isr_msix_wq(enic->msix_entry[intr].vector, enic);
diff --git a/drivers/net/gianfar.c b/drivers/net/gianfar.c
index 49e4ce1246a7..d1bec6269173 100644
--- a/drivers/net/gianfar.c
+++ b/drivers/net/gianfar.c
@@ -577,11 +577,10 @@ static int gfar_parse_group(struct device_node *np,
                        irq_of_parse_and_map(np, 1);
                priv->gfargrp[priv->num_grps].interruptError =
                        irq_of_parse_and_map(np,2);
-                if (priv->gfargrp[priv->num_grps].interruptTransmit < 0 ||
+                if (priv->gfargrp[priv->num_grps].interruptTransmit == NO_IRQ ||
-                        priv->gfargrp[priv->num_grps].interruptReceive < 0 ||
+                    priv->gfargrp[priv->num_grps].interruptReceive  == NO_IRQ ||
-                        priv->gfargrp[priv->num_grps].interruptError < 0) {
+                    priv->gfargrp[priv->num_grps].interruptError    == NO_IRQ)
                        return -EINVAL;
-                }
        }
        priv->gfargrp[priv->num_grps].grp_id = priv->num_grps;
diff --git a/drivers/net/ifb.c b/drivers/net/ifb.c
index ab9f675c5b8b..fe337bd121aa 100644
--- a/drivers/net/ifb.c
+++ b/drivers/net/ifb.c
@@ -104,6 +104,8 @@ static void ri_tasklet(unsigned long dev)
                        rcu_read_unlock();
                        dev_kfree_skb(skb);
                        stats->tx_dropped++;
+                        if (skb_queue_len(&dp->tq) != 0)
+                                goto resched;
                        break;
                }
                rcu_read_unlock();
diff --git a/drivers/net/ipg.c b/drivers/net/ipg.c
index dc0198092343..aa93655c3aa7 100644
--- a/drivers/net/ipg.c
+++ b/drivers/net/ipg.c
@@ -88,16 +88,14 @@ static const char *ipg_brand_name[] = {
        "IC PLUS IP1000 1000/100/10 based NIC",
        "Sundance Technology ST2021 based NIC",
        "Tamarack Microelectronics TC9020/9021 based NIC",
-        "Tamarack Microelectronics TC9020/9021 based NIC",
        "D-Link NIC IP1000A"
 };
 static DEFINE_PCI_DEVICE_TABLE(ipg_pci_tbl) = {
        { PCI_VDEVICE(SUNDANCE, 0x1023), 0 },
        { PCI_VDEVICE(SUNDANCE, 0x2021), 1 },
-        { PCI_VDEVICE(SUNDANCE, 0x1021), 2 },
+        { PCI_VDEVICE(DLINK,    0x9021), 2 },
-        { PCI_VDEVICE(DLINK,    0x9021), 3 },
+        { PCI_VDEVICE(DLINK,    0x4020), 3 },
-        { PCI_VDEVICE(DLINK,    0x4020), 4 },
        { 0, }
 };
diff --git a/drivers/net/irda/sh_sir.c b/drivers/net/irda/sh_sir.c
index 00b38bccd6d0..52a7c86af663 100644
--- a/drivers/net/irda/sh_sir.c
+++ b/drivers/net/irda/sh_sir.c
@@ -258,7 +258,7 @@ static int sh_sir_set_baudrate(struct sh_sir_self *self, u32 baudrate)
        /* Baud Rate Error Correction x 10000 */
        u32 rate_err_array[] = {
-                0000, 0625, 1250, 1875,
+                   0,  625, 1250, 1875,
                2500, 3125, 3750, 4375,
                5000, 5625, 6250, 6875,
                7500, 8125, 8750, 9375,
diff --git a/drivers/net/ixgbe/ixgbe_main.c b/drivers/net/ixgbe/ixgbe_main.c
index fbad4d819608..eee0b298bd36 100644
--- a/drivers/net/ixgbe/ixgbe_main.c
+++ b/drivers/net/ixgbe/ixgbe_main.c
@@ -4771,6 +4771,9 @@ void ixgbe_clear_interrupt_scheme(struct ixgbe_adapter *adapter)
                adapter->rx_ring[i] = NULL;
        }
+        adapter->num_tx_queues = 0;
+        adapter->num_rx_queues = 0;
        ixgbe_free_q_vectors(adapter);
        ixgbe_reset_interrupt_capability(adapter);
 }
diff --git a/drivers/net/mlx4/fw.c b/drivers/net/mlx4/fw.c
index b68eee2414c2..7a7e18ba278a 100644
--- a/drivers/net/mlx4/fw.c
+++ b/drivers/net/mlx4/fw.c
@@ -289,6 +289,10 @@ int mlx4_QUERY_DEV_CAP(struct mlx4_dev *dev, struct mlx4_dev_cap *dev_cap)
                MLX4_GET(field, outbox, QUERY_DEV_CAP_LOG_BF_REG_SZ_OFFSET);
                dev_cap->bf_reg_size = 1 << (field & 0x1f);
                MLX4_GET(field, outbox, QUERY_DEV_CAP_LOG_MAX_BF_REGS_PER_PAGE_OFFSET);
+                if ((1 << (field & 0x3f)) > (PAGE_SIZE / dev_cap->bf_reg_size)) {
+                        mlx4_warn(dev, "firmware bug: log2 # of blue flame regs is invalid (%d), forcing 3\n", field & 0x1f);
+                        field = 3;
+                }
                dev_cap->bf_regs_per_page = 1 << (field & 0x3f);
                mlx4_dbg(dev, "BlueFlame available (reg size %d, regs/page %d)\n",
                         dev_cap->bf_reg_size, dev_cap->bf_regs_per_page);
diff --git a/drivers/net/pch_gbe/pch_gbe_main.c b/drivers/net/pch_gbe/pch_gbe_main.c
index 472056b47440..03a1d280105f 100644
--- a/drivers/net/pch_gbe/pch_gbe_main.c
+++ b/drivers/net/pch_gbe/pch_gbe_main.c
@@ -1,6 +1,6 @@
 /*
 * Copyright (C) 1999 - 2010 Intel Corporation.
- * Copyright (C) 2010 OKI SEMICONDUCTOR Co., LTD.
+ * Copyright (C) 2010 OKI SEMICONDUCTOR CO., LTD.
 *
 * This code was derived from the Intel e1000e Linux driver.
 *
@@ -2464,8 +2464,8 @@ static void __exit pch_gbe_exit_module(void)
 module_init(pch_gbe_init_module);
 module_exit(pch_gbe_exit_module);
-MODULE_DESCRIPTION("OKI semiconductor PCH Gigabit ethernet Driver");
+MODULE_DESCRIPTION("EG20T PCH Gigabit ethernet Driver");
-MODULE_AUTHOR("OKI semiconductor, <masa-korg@dsn.okisemi.com>");
+MODULE_AUTHOR("OKI SEMICONDUCTOR, <toshiharu-linux@dsn.okisemi.com>");
 MODULE_LICENSE("GPL");
 MODULE_VERSION(DRV_VERSION);
 MODULE_DEVICE_TABLE(pci, pch_gbe_pcidev_id);
diff --git a/drivers/net/pch_gbe/pch_gbe_param.c b/drivers/net/pch_gbe/pch_gbe_param.c
index 2510146fc560..ef0996a0eaaa 100644
--- a/drivers/net/pch_gbe/pch_gbe_param.c
+++ b/drivers/net/pch_gbe/pch_gbe_param.c
@@ -434,8 +434,8 @@ void pch_gbe_check_options(struct pch_gbe_adapter *adapter)
                        .err  = "using default of "
                                __MODULE_STRING(PCH_GBE_DEFAULT_TXD),
                        .def  = PCH_GBE_DEFAULT_TXD,
-                        .arg  = { .r = { .min = PCH_GBE_MIN_TXD } },
+                        .arg  = { .r = { .min = PCH_GBE_MIN_TXD,
-                        .arg  = { .r = { .max = PCH_GBE_MAX_TXD } }
+                                         .max = PCH_GBE_MAX_TXD } }
                };
                struct pch_gbe_tx_ring *tx_ring = adapter->tx_ring;
                tx_ring->count = TxDescriptors;
@@ -450,8 +450,8 @@ void pch_gbe_check_options(struct pch_gbe_adapter *adapter)
                        .err  = "using default of "
                                __MODULE_STRING(PCH_GBE_DEFAULT_RXD),
                        .def  = PCH_GBE_DEFAULT_RXD,
-                        .arg  = { .r = { .min = PCH_GBE_MIN_RXD } },
+                        .arg  = { .r = { .min = PCH_GBE_MIN_RXD,
-                        .arg  = { .r = { .max = PCH_GBE_MAX_RXD } }
+                                         .max = PCH_GBE_MAX_RXD } }
                };
                struct pch_gbe_rx_ring *rx_ring = adapter->rx_ring;
                rx_ring->count = RxDescriptors;
diff --git a/drivers/net/phy/Kconfig b/drivers/net/phy/Kconfig
index cb3d13e4e074..35fda5ac8120 100644
--- a/drivers/net/phy/Kconfig
+++ b/drivers/net/phy/Kconfig
@@ -64,7 +64,7 @@ config BCM63XX_PHY
 config ICPLUS_PHY
        tristate "Drivers for ICPlus PHYs"
        ---help---
-          Currently supports the IP175C PHY.
+          Currently supports the IP175C and IP1001 PHYs.
 config REALTEK_PHY
        tristate "Drivers for Realtek PHYs"
diff --git a/drivers/net/phy/icplus.c b/drivers/net/phy/icplus.c
index c1d2d251fe8b..9a09e24c30bc 100644
--- a/drivers/net/phy/icplus.c
+++ b/drivers/net/phy/icplus.c
@@ -30,7 +30,7 @@
 #include <asm/irq.h>
 #include <asm/uaccess.h>
-MODULE_DESCRIPTION("ICPlus IP175C PHY driver");
+MODULE_DESCRIPTION("ICPlus IP175C/IC1001 PHY drivers");
 MODULE_AUTHOR("Michael Barkowski");
 MODULE_LICENSE("GPL");
@@ -89,6 +89,33 @@ static int ip175c_config_init(struct phy_device *phydev)
        return 0;
 }
+static int ip1001_config_init(struct phy_device *phydev)
+{
+        int err, value;
+        /* Software Reset PHY */
+        value = phy_read(phydev, MII_BMCR);
+        value |= BMCR_RESET;
+        err = phy_write(phydev, MII_BMCR, value);
+        if (err < 0)
+                return err;
+        do {
+                value = phy_read(phydev, MII_BMCR);
+        } while (value & BMCR_RESET);
+        /* Additional delay (2ns) used to adjust RX clock phase
+         * at GMII/ RGMII interface */
+        value = phy_read(phydev, 16);
+        value |= 0x3;
+        err = phy_write(phydev, 16, value);
+        if (err < 0)
+                return err;
+        return err;
+}
 static int ip175c_read_status(struct phy_device *phydev)
 {
        if (phydev->addr == 4) /* WAN port */
@@ -121,21 +148,43 @@ static struct phy_driver ip175c_driver = {
        .driver         = { .owner = THIS_MODULE,},
 };
-static int __init ip175c_init(void)
+static struct phy_driver ip1001_driver = {
+        .phy_id         = 0x02430d90,
+        .name           = "ICPlus IP1001",
+        .phy_id_mask    = 0x0ffffff0,
+        .features       = PHY_GBIT_FEATURES | SUPPORTED_Pause |
+                          SUPPORTED_Asym_Pause,
+        .config_init    = &ip1001_config_init,
+        .config_aneg    = &genphy_config_aneg,
+        .read_status    = &genphy_read_status,
+        .suspend        = genphy_suspend,
+        .resume         = genphy_resume,
+        .driver         = { .owner = THIS_MODULE,},
+};
+static int __init icplus_init(void)
 {
+        int ret = 0;
+        ret = phy_driver_register(&ip1001_driver);
+        if (ret < 0)
+                return -ENODEV;
        return phy_driver_register(&ip175c_driver);
 }
-static void __exit ip175c_exit(void)
+static void __exit icplus_exit(void)
 {
+        phy_driver_unregister(&ip1001_driver);
        phy_driver_unregister(&ip175c_driver);
 }
-module_init(ip175c_init);
+module_init(icplus_init);
-module_exit(ip175c_exit);
+module_exit(icplus_exit);
 static struct mdio_device_id __maybe_unused icplus_tbl[] = {
        { 0x02430d80, 0x0ffffff0 },
+        { 0x02430d90, 0x0ffffff0 },
        { }
 };
diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c
index f0bd1a1aba3a..e8b9c53c304b 100644
--- a/drivers/net/phy/marvell.c
+++ b/drivers/net/phy/marvell.c
@@ -30,11 +30,14 @@
 #include <linux/ethtool.h>
 #include <linux/phy.h>
 #include <linux/marvell_phy.h>
+#include <linux/of.h>
 #include <asm/io.h>
 #include <asm/irq.h>
 #include <asm/uaccess.h>
+#define MII_MARVELL_PHY_PAGE            22
 #define MII_M1011_IEVENT                0x13
 #define MII_M1011_IEVENT_CLEAR          0x0000
@@ -80,7 +83,6 @@
 #define MII_88E1121_PHY_LED_CTRL        16
 #define MII_88E1121_PHY_LED_PAGE        3
 #define MII_88E1121_PHY_LED_DEF         0x0030
-#define MII_88E1121_PHY_PAGE            22
 #define MII_M1011_PHY_STATUS            0x11
 #define MII_M1011_PHY_STATUS_1000       0x8000
@@ -186,13 +188,94 @@ static int marvell_config_aneg(struct phy_device *phydev)
        return 0;
 }
+#ifdef CONFIG_OF_MDIO
+/*
+ * Set and/or override some configuration registers based on the
+ * marvell,reg-init property stored in the of_node for the phydev.
+ *
+ * marvell,reg-init = <reg-page reg mask value>,...;
+ *
+ * There may be one or more sets of <reg-page reg mask value>:
+ *
+ * reg-page: which register bank to use.
+ * reg: the register.
+ * mask: if non-zero, ANDed with existing register value.
+ * value: ORed with the masked value and written to the regiser.
+ *
+ */
+static int marvell_of_reg_init(struct phy_device *phydev)
+{
+        const __be32 *paddr;
+        int len, i, saved_page, current_page, page_changed, ret;
+        if (!phydev->dev.of_node)
+                return 0;
+        paddr = of_get_property(phydev->dev.of_node, "marvell,reg-init", &len);
+        if (!paddr || len < (4 * sizeof(*paddr)))
+                return 0;
+        saved_page = phy_read(phydev, MII_MARVELL_PHY_PAGE);
+        if (saved_page < 0)
+                return saved_page;
+        page_changed = 0;
+        current_page = saved_page;
+        ret = 0;
+        len /= sizeof(*paddr);
+        for (i = 0; i < len - 3; i += 4) {
+                u16 reg_page = be32_to_cpup(paddr + i);
+                u16 reg = be32_to_cpup(paddr + i + 1);
+                u16 mask = be32_to_cpup(paddr + i + 2);
+                u16 val_bits = be32_to_cpup(paddr + i + 3);
+                int val;
+                if (reg_page != current_page) {
+                        current_page = reg_page;
+                        page_changed = 1;
+                        ret = phy_write(phydev, MII_MARVELL_PHY_PAGE, reg_page);
+                        if (ret < 0)
+                                goto err;
+                }
+                val = 0;
+                if (mask) {
+                        val = phy_read(phydev, reg);
+                        if (val < 0) {
+                                ret = val;
+                                goto err;
+                        }
+                        val &= mask;
+                }
+                val |= val_bits;
+                ret = phy_write(phydev, reg, val);
+                if (ret < 0)
+                        goto err;
+        }
+err:
+        if (page_changed) {
+                i = phy_write(phydev, MII_MARVELL_PHY_PAGE, saved_page);
+                if (ret == 0)
+                        ret = i;
+        }
+        return ret;
+}
+#else
+static int marvell_of_reg_init(struct phy_device *phydev)
+{
+        return 0;
+}
+#endif /* CONFIG_OF_MDIO */
 static int m88e1121_config_aneg(struct phy_device *phydev)
 {
        int err, oldpage, mscr;
-        oldpage = phy_read(phydev, MII_88E1121_PHY_PAGE);
+        oldpage = phy_read(phydev, MII_MARVELL_PHY_PAGE);
-        err = phy_write(phydev, MII_88E1121_PHY_PAGE,
+        err = phy_write(phydev, MII_MARVELL_PHY_PAGE,
                        MII_88E1121_PHY_MSCR_PAGE);
        if (err < 0)
                return err;
@@ -218,7 +301,7 @@ static int m88e1121_config_aneg(struct phy_device *phydev)
                        return err;
        }
-        phy_write(phydev, MII_88E1121_PHY_PAGE, oldpage);
+        phy_write(phydev, MII_MARVELL_PHY_PAGE, oldpage);
        err = phy_write(phydev, MII_BMCR, BMCR_RESET);
        if (err < 0)
@@ -229,11 +312,11 @@ static int m88e1121_config_aneg(struct phy_device *phydev)
        if (err < 0)
                return err;
-        oldpage = phy_read(phydev, MII_88E1121_PHY_PAGE);
+        oldpage = phy_read(phydev, MII_MARVELL_PHY_PAGE);
-        phy_write(phydev, MII_88E1121_PHY_PAGE, MII_88E1121_PHY_LED_PAGE);
+        phy_write(phydev, MII_MARVELL_PHY_PAGE, MII_88E1121_PHY_LED_PAGE);
        phy_write(phydev, MII_88E1121_PHY_LED_CTRL, MII_88E1121_PHY_LED_DEF);
-        phy_write(phydev, MII_88E1121_PHY_PAGE, oldpage);
+        phy_write(phydev, MII_MARVELL_PHY_PAGE, oldpage);
        err = genphy_config_aneg(phydev);
@@ -244,9 +327,9 @@ static int m88e1318_config_aneg(struct phy_device *phydev)
 {
        int err, oldpage, mscr;
-        oldpage = phy_read(phydev, MII_88E1121_PHY_PAGE);
+        oldpage = phy_read(phydev, MII_MARVELL_PHY_PAGE);
-        err = phy_write(phydev, MII_88E1121_PHY_PAGE,
+        err = phy_write(phydev, MII_MARVELL_PHY_PAGE,
                        MII_88E1121_PHY_MSCR_PAGE);
        if (err < 0)
                return err;
@@ -258,7 +341,7 @@ static int m88e1318_config_aneg(struct phy_device *phydev)
        if (err < 0)
                return err;
-        err = phy_write(phydev, MII_88E1121_PHY_PAGE, oldpage);
+        err = phy_write(phydev, MII_MARVELL_PHY_PAGE, oldpage);
        if (err < 0)
                return err;
@@ -368,6 +451,9 @@ static int m88e1111_config_init(struct phy_device *phydev)
                        return err;
        }
+        err = marvell_of_reg_init(phydev);
+        if (err < 0)
+                return err;
        err = phy_write(phydev, MII_BMCR, BMCR_RESET);
        if (err < 0)
@@ -398,7 +484,7 @@ static int m88e1118_config_init(struct phy_device *phydev)
        int err;
        /* Change address */
-        err = phy_write(phydev, 0x16, 0x0002);
+        err = phy_write(phydev, MII_MARVELL_PHY_PAGE, 0x0002);
        if (err < 0)
                return err;
@@ -408,7 +494,7 @@ static int m88e1118_config_init(struct phy_device *phydev)
                return err;
        /* Change address */
-        err = phy_write(phydev, 0x16, 0x0003);
+        err = phy_write(phydev, MII_MARVELL_PHY_PAGE, 0x0003);
        if (err < 0)
                return err;
@@ -420,8 +506,42 @@ static int m88e1118_config_init(struct phy_device *phydev)
        if (err < 0)
                return err;
+        err = marvell_of_reg_init(phydev);
+        if (err < 0)
+                return err;
        /* Reset address */
-        err = phy_write(phydev, 0x16, 0x0);
+        err = phy_write(phydev, MII_MARVELL_PHY_PAGE, 0x0);
+        if (err < 0)
+                return err;
+        err = phy_write(phydev, MII_BMCR, BMCR_RESET);
+        if (err < 0)
+                return err;
+        return 0;
+}
+static int m88e1149_config_init(struct phy_device *phydev)
+{
+        int err;
+        /* Change address */
+        err = phy_write(phydev, MII_MARVELL_PHY_PAGE, 0x0002);
+        if (err < 0)
+                return err;
+        /* Enable 1000 Mbit */
+        err = phy_write(phydev, 0x15, 0x1048);
+        if (err < 0)
+                return err;
+        err = marvell_of_reg_init(phydev);
+        if (err < 0)
+                return err;
+        /* Reset address */
+        err = phy_write(phydev, MII_MARVELL_PHY_PAGE, 0x0);
        if (err < 0)
                return err;
@@ -491,6 +611,10 @@ static int m88e1145_config_init(struct phy_device *phydev)
                }
        }
+        err = marvell_of_reg_init(phydev);
+        if (err < 0)
+                return err;
        return 0;
 }
@@ -685,6 +809,19 @@ static struct phy_driver marvell_drivers[] = {
                .driver = { .owner = THIS_MODULE },
        },
        {
+                .phy_id = MARVELL_PHY_ID_88E1149R,
+                .phy_id_mask = MARVELL_PHY_ID_MASK,
+                .name = "Marvell 88E1149R",
+                .features = PHY_GBIT_FEATURES,
+                .flags = PHY_HAS_INTERRUPT,
+                .config_init = &m88e1149_config_init,
+                .config_aneg = &m88e1118_config_aneg,
+                .read_status = &genphy_read_status,
+                .ack_interrupt = &marvell_ack_interrupt,
+                .config_intr = &marvell_config_intr,
+                .driver = { .owner = THIS_MODULE },
+        },
+        {
                .phy_id = MARVELL_PHY_ID_88E1240,
                .phy_id_mask = MARVELL_PHY_ID_MASK,
                .name = "Marvell 88E1240",
@@ -735,6 +872,7 @@ static struct mdio_device_id __maybe_unused marvell_tbl[] = {
        { 0x01410e10, 0xfffffff0 },
        { 0x01410cb0, 0xfffffff0 },
        { 0x01410cd0, 0xfffffff0 },
+        { 0x01410e50, 0xfffffff0 },
        { 0x01410e30, 0xfffffff0 },
        { 0x01410e90, 0xfffffff0 },
        { }
diff --git a/drivers/net/ppp_generic.c b/drivers/net/ppp_generic.c
index 09cf56d0416a..39659976a1ac 100644
--- a/drivers/net/ppp_generic.c
+++ b/drivers/net/ppp_generic.c
@@ -2584,16 +2584,16 @@ ppp_create_interface(struct net *net, int unit, int *retp)
         */
        dev_net_set(dev, net);
-        ret = -EEXIST;
        mutex_lock(&pn->all_ppp_mutex);
        if (unit < 0) {
                unit = unit_get(&pn->units_idr, ppp);
                if (unit < 0) {
-                        *retp = unit;
+                        ret = unit;
                        goto out2;
                }
        } else {
+                ret = -EEXIST;
                if (unit_find(&pn->units_idr, unit))
                        goto out2; /* unit already exists */
                /*
@@ -2668,10 +2668,10 @@ static void ppp_shutdown_interface(struct ppp *ppp)
                ppp->closing = 1;
                ppp_unlock(ppp);
                unregister_netdev(ppp->dev);
+                unit_put(&pn->units_idr, ppp->file.index);
        } else
                ppp_unlock(ppp);
-        unit_put(&pn->units_idr, ppp->file.index);
        ppp->file.dead = 1;
        ppp->owner = NULL;
        wake_up_interruptible(&ppp->file.rwait);
@@ -2859,8 +2859,7 @@ static void __exit ppp_cleanup(void)
 * by holding all_ppp_mutex
 */
-/* associate pointer with specified number */
+static int __unit_alloc(struct idr *p, void *ptr, int n)
-static int unit_set(struct idr *p, void *ptr, int n)
 {
        int unit, err;
@@ -2871,10 +2870,24 @@ again:
        }
        err = idr_get_new_above(p, ptr, n, &unit);
-        if (err == -EAGAIN)
+        if (err < 0) {
-                goto again;
+                if (err == -EAGAIN)
+                        goto again;
+                return err;
+        }
+        return unit;
+}
+/* associate pointer with specified number */
+static int unit_set(struct idr *p, void *ptr, int n)
+{
+        int unit;
-        if (unit != n) {
+        unit = __unit_alloc(p, ptr, n);
+        if (unit < 0)
+                return unit;
+        else if (unit != n) {
                idr_remove(p, unit);
                return -EINVAL;
        }
@@ -2885,19 +2898,7 @@ again:
 /* get new free unit number and associate pointer with it */
 static int unit_get(struct idr *p, void *ptr)
 {
-        int unit, err;
+        return __unit_alloc(p, ptr, 0);
-again:
-        if (!idr_pre_get(p, GFP_KERNEL)) {
-                printk(KERN_ERR "PPP: No free memory for idr\n");
-                return -ENOMEM;
-        }
-        err = idr_get_new_above(p, ptr, 0, &unit);
-        if (err == -EAGAIN)
-                goto again;
-        return unit;
 }
 /* put unit number back to a pool */
diff --git a/drivers/net/pppoe.c b/drivers/net/pppoe.c
index d72fb0519a2a..78c0e3c9b2b5 100644
--- a/drivers/net/pppoe.c
+++ b/drivers/net/pppoe.c
@@ -948,7 +948,7 @@ static int __pppoe_xmit(struct sock *sk, struct sk_buff *skb)
 abort:
        kfree_skb(skb);
-        return 0;
+        return 1;
 }
 /************************************************************************
diff --git a/drivers/net/qlge/qlge.h b/drivers/net/qlge/qlge.h
index 22821398fc63..9787dff90d3f 100644
--- a/drivers/net/qlge/qlge.h
+++ b/drivers/net/qlge/qlge.h
@@ -2083,6 +2083,7 @@ struct ql_adapter {
        u32 mailbox_in;
        u32 mailbox_out;
        struct mbox_params idc_mbc;
+        struct mutex    mpi_mutex;
        int tx_ring_size;
        int rx_ring_size;
diff --git a/drivers/net/qlge/qlge_main.c b/drivers/net/qlge/qlge_main.c
index c30e0fe55a31..2555b1d34f34 100644
--- a/drivers/net/qlge/qlge_main.c
+++ b/drivers/net/qlge/qlge_main.c
@@ -62,15 +62,15 @@ static const u32 default_msg =
 /* NETIF_MSG_PKTDATA | */
    NETIF_MSG_HW | NETIF_MSG_WOL | 0;
-static int debug = 0x00007fff;  /* defaults above */
+static int debug = -1;  /* defaults above */
-module_param(debug, int, 0);
+module_param(debug, int, 0664);
 MODULE_PARM_DESC(debug, "Debug level (0=none,...,16=all)");
 #define MSIX_IRQ 0
 #define MSI_IRQ 1
 #define LEG_IRQ 2
 static int qlge_irq_type = MSIX_IRQ;
-module_param(qlge_irq_type, int, MSIX_IRQ);
+module_param(qlge_irq_type, int, 0664);
 MODULE_PARM_DESC(qlge_irq_type, "0 = MSI-X, 1 = MSI, 2 = Legacy.");
 static int qlge_mpi_coredump;
@@ -4629,6 +4629,7 @@ static int __devinit ql_init_device(struct pci_dev *pdev,
        INIT_DELAYED_WORK(&qdev->mpi_idc_work, ql_mpi_idc_work);
        INIT_DELAYED_WORK(&qdev->mpi_core_to_log, ql_mpi_core_to_log);
        init_completion(&qdev->ide_completion);
+        mutex_init(&qdev->mpi_mutex);
        if (!cards_found) {
                dev_info(&pdev->dev, "%s\n", DRV_STRING);
diff --git a/drivers/net/qlge/qlge_mpi.c b/drivers/net/qlge/qlge_mpi.c
index 0e7c7c7ee164..a2e919bcb3c6 100644
--- a/drivers/net/qlge/qlge_mpi.c
+++ b/drivers/net/qlge/qlge_mpi.c
@@ -534,6 +534,7 @@ static int ql_mailbox_command(struct ql_adapter *qdev, struct mbox_params *mbcp)
        int status;
        unsigned long count;
+        mutex_lock(&qdev->mpi_mutex);
        /* Begin polled mode for MPI */
        ql_write32(qdev, INTR_MASK, (INTR_MASK_PI << 16));
@@ -603,6 +604,7 @@ done:
 end:
        /* End polled mode for MPI */
        ql_write32(qdev, INTR_MASK, (INTR_MASK_PI << 16) | INTR_MASK_PI);
+        mutex_unlock(&qdev->mpi_mutex);
        return status;
 }
@@ -1099,9 +1101,7 @@ int ql_wait_fifo_empty(struct ql_adapter *qdev)
 static int ql_set_port_cfg(struct ql_adapter *qdev)
 {
        int status;
-        rtnl_lock();
        status = ql_mb_set_port_cfg(qdev);
-        rtnl_unlock();
        if (status)
                return status;
        status = ql_idc_wait(qdev);
@@ -1122,9 +1122,7 @@ void ql_mpi_port_cfg_work(struct work_struct *work)
            container_of(work, struct ql_adapter, mpi_port_cfg_work.work);
        int status;
-        rtnl_lock();
        status = ql_mb_get_port_cfg(qdev);
-        rtnl_unlock();
        if (status) {
                netif_err(qdev, drv, qdev->ndev,
                          "Bug: Failed to get port config data.\n");
@@ -1167,7 +1165,6 @@ void ql_mpi_idc_work(struct work_struct *work)
        u32 aen;
        int timeout;
-        rtnl_lock();
        aen = mbcp->mbox_out[1] >> 16;
        timeout = (mbcp->mbox_out[1] >> 8) & 0xf;
@@ -1231,7 +1228,6 @@ void ql_mpi_idc_work(struct work_struct *work)
                }
                break;
        }
-        rtnl_unlock();
 }
 void ql_mpi_work(struct work_struct *work)
@@ -1242,7 +1238,7 @@ void ql_mpi_work(struct work_struct *work)
        struct mbox_params *mbcp = &mbc;
        int err = 0;
-        rtnl_lock();
+        mutex_lock(&qdev->mpi_mutex);
        /* Begin polled mode for MPI */
        ql_write32(qdev, INTR_MASK, (INTR_MASK_PI << 16));
@@ -1259,7 +1255,7 @@ void ql_mpi_work(struct work_struct *work)
        /* End polled mode for MPI */
        ql_write32(qdev, INTR_MASK, (INTR_MASK_PI << 16) | INTR_MASK_PI);
-        rtnl_unlock();
+        mutex_unlock(&qdev->mpi_mutex);
        ql_enable_completion_interrupt(qdev, 0);
 }
diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
index 4c4d16905efb..53b13deade95 100644
--- a/drivers/net/r8169.c
+++ b/drivers/net/r8169.c
@@ -744,26 +744,36 @@ static void rtl8169_xmii_reset_enable(void __iomem *ioaddr)
        mdio_write(ioaddr, MII_BMCR, val & 0xffff);
 }
-static void rtl8169_check_link_status(struct net_device *dev,
+static void __rtl8169_check_link_status(struct net_device *dev,
                                      struct rtl8169_private *tp,
-                                      void __iomem *ioaddr)
+                                      void __iomem *ioaddr,
+                                      bool pm)
 {
        unsigned long flags;
        spin_lock_irqsave(&tp->lock, flags);
        if (tp->link_ok(ioaddr)) {
                /* This is to cancel a scheduled suspend if there's one. */
-                pm_request_resume(&tp->pci_dev->dev);
+                if (pm)
+                        pm_request_resume(&tp->pci_dev->dev);
                netif_carrier_on(dev);
                netif_info(tp, ifup, dev, "link up\n");
        } else {
                netif_carrier_off(dev);
                netif_info(tp, ifdown, dev, "link down\n");
-                pm_schedule_suspend(&tp->pci_dev->dev, 100);
+                if (pm)
+                        pm_schedule_suspend(&tp->pci_dev->dev, 100);
        }
        spin_unlock_irqrestore(&tp->lock, flags);
 }
+static void rtl8169_check_link_status(struct net_device *dev,
+                                      struct rtl8169_private *tp,
+                                      void __iomem *ioaddr)
+{
+        __rtl8169_check_link_status(dev, tp, ioaddr, false);
+}
 #define WAKE_ANY (WAKE_PHY | WAKE_MAGIC | WAKE_UCAST | WAKE_BCAST | WAKE_MCAST)
 static u32 __rtl8169_get_wol(struct rtl8169_private *tp)
@@ -4440,8 +4450,7 @@ static inline void rtl8169_rx_csum(struct sk_buff *skb, u32 opts1)
        u32 status = opts1 & RxProtoMask;
        if (((status == RxProtoTCP) && !(opts1 & TCPFail)) ||
-            ((status == RxProtoUDP) && !(opts1 & UDPFail)) ||
+            ((status == RxProtoUDP) && !(opts1 & UDPFail)))
-            ((status == RxProtoIP) && !(opts1 & IPFail)))
                skb->ip_summed = CHECKSUM_UNNECESSARY;
        else
                skb_checksum_none_assert(skb);
@@ -4601,7 +4610,7 @@ static irqreturn_t rtl8169_interrupt(int irq, void *dev_instance)
                }
                if (status & LinkChg)
-                        rtl8169_check_link_status(dev, tp, ioaddr);
+                        __rtl8169_check_link_status(dev, tp, ioaddr, true);
                /* We need to see the lastest version of tp->intr_mask to
                 * avoid ignoring an MSI interrupt and having to wait for
@@ -4891,11 +4900,7 @@ static int rtl8169_runtime_idle(struct device *device)
        struct net_device *dev = pci_get_drvdata(pdev);
        struct rtl8169_private *tp = netdev_priv(dev);
-        if (!tp->TxDescArray)
+        return tp->TxDescArray ? -EBUSY : 0;
-                return 0;
-        rtl8169_check_link_status(dev, tp, tp->mmio_addr);
-        return -EBUSY;
 }
 static const struct dev_pm_ops rtl8169_pm_ops = {
diff --git a/drivers/net/sfc/efx.c b/drivers/net/sfc/efx.c
index 05df20e47976..fb83cdd94643 100644
--- a/drivers/net/sfc/efx.c
+++ b/drivers/net/sfc/efx.c
@@ -197,7 +197,9 @@ MODULE_PARM_DESC(debug, "Bitmapped debugging message enable value");
 static void efx_remove_channels(struct efx_nic *efx);
 static void efx_remove_port(struct efx_nic *efx);
+static void efx_init_napi(struct efx_nic *efx);
 static void efx_fini_napi(struct efx_nic *efx);
+static void efx_fini_napi_channel(struct efx_channel *channel);
 static void efx_fini_struct(struct efx_nic *efx);
 static void efx_start_all(struct efx_nic *efx);
 static void efx_stop_all(struct efx_nic *efx);
@@ -335,8 +337,10 @@ void efx_process_channel_now(struct efx_channel *channel)
        /* Disable interrupts and wait for ISRs to complete */
        efx_nic_disable_interrupts(efx);
-        if (efx->legacy_irq)
+        if (efx->legacy_irq) {
                synchronize_irq(efx->legacy_irq);
+                efx->legacy_irq_enabled = false;
+        }
        if (channel->irq)
                synchronize_irq(channel->irq);
@@ -351,6 +355,8 @@ void efx_process_channel_now(struct efx_channel *channel)
        efx_channel_processed(channel);
        napi_enable(&channel->napi_str);
+        if (efx->legacy_irq)
+                efx->legacy_irq_enabled = true;
        efx_nic_enable_interrupts(efx);
 }
@@ -426,6 +432,7 @@ efx_alloc_channel(struct efx_nic *efx, int i, struct efx_channel *old_channel)
                *channel = *old_channel;
+                channel->napi_dev = NULL;
                memset(&channel->eventq, 0, sizeof(channel->eventq));
                rx_queue = &channel->rx_queue;
@@ -736,9 +743,13 @@ efx_realloc_channels(struct efx_nic *efx, u32 rxq_entries, u32 txq_entries)
        if (rc)
                goto rollback;
+        efx_init_napi(efx);
        /* Destroy old channels */
-        for (i = 0; i < efx->n_channels; i++)
+        for (i = 0; i < efx->n_channels; i++) {
+                efx_fini_napi_channel(other_channel[i]);
                efx_remove_channel(other_channel[i]);
+        }
 out:
        /* Free unused channel structures */
        for (i = 0; i < efx->n_channels; i++)
@@ -1400,6 +1411,8 @@ static void efx_start_all(struct efx_nic *efx)
                efx_start_channel(channel);
        }
+        if (efx->legacy_irq)
+                efx->legacy_irq_enabled = true;
        efx_nic_enable_interrupts(efx);
        /* Switch to event based MCDI completions after enabling interrupts.
@@ -1460,8 +1473,10 @@ static void efx_stop_all(struct efx_nic *efx)
        /* Disable interrupts and wait for ISR to complete */
        efx_nic_disable_interrupts(efx);
-        if (efx->legacy_irq)
+        if (efx->legacy_irq) {
                synchronize_irq(efx->legacy_irq);
+                efx->legacy_irq_enabled = false;
+        }
        efx_for_each_channel(channel, efx) {
                if (channel->irq)
                        synchronize_irq(channel->irq);
@@ -1593,7 +1608,7 @@ static int efx_ioctl(struct net_device *net_dev, struct ifreq *ifr, int cmd)
 *
 **************************************************************************/
-static int efx_init_napi(struct efx_nic *efx)
+static void efx_init_napi(struct efx_nic *efx)
 {
        struct efx_channel *channel;
@@ -1602,18 +1617,21 @@ static int efx_init_napi(struct efx_nic *efx)
                netif_napi_add(channel->napi_dev, &channel->napi_str,
                               efx_poll, napi_weight);
        }
-        return 0;
+}
+static void efx_fini_napi_channel(struct efx_channel *channel)
+{
+        if (channel->napi_dev)
+                netif_napi_del(&channel->napi_str);
+        channel->napi_dev = NULL;
 }
 static void efx_fini_napi(struct efx_nic *efx)
 {
        struct efx_channel *channel;
-        efx_for_each_channel(channel, efx) {
+        efx_for_each_channel(channel, efx)
-                if (channel->napi_dev)
+                efx_fini_napi_channel(channel);
-                        netif_napi_del(&channel->napi_str);
-                channel->napi_dev = NULL;
-        }
 }
 /**************************************************************************
@@ -2335,9 +2353,7 @@ static int efx_pci_probe_main(struct efx_nic *efx)
        if (rc)
                goto fail1;
-        rc = efx_init_napi(efx);
+        efx_init_napi(efx);
-        if (rc)
-                goto fail2;
        rc = efx->type->init(efx);
        if (rc) {
@@ -2368,7 +2384,6 @@ static int efx_pci_probe_main(struct efx_nic *efx)
        efx->type->fini(efx);
 fail3:
        efx_fini_napi(efx);
- fail2:
        efx_remove_all(efx);
 fail1:
        return rc;
diff --git a/drivers/net/sfc/net_driver.h b/drivers/net/sfc/net_driver.h
index 0a7e26d73b52..b137c889152b 100644
--- a/drivers/net/sfc/net_driver.h
+++ b/drivers/net/sfc/net_driver.h
@@ -621,6 +621,7 @@ struct efx_filter_state;
 * @pci_dev: The PCI device
 * @type: Controller type attributes
 * @legacy_irq: IRQ number
+ * @legacy_irq_enabled: Are IRQs enabled on NIC (INT_EN_KER register)?
 * @workqueue: Workqueue for port reconfigures and the HW monitor.
 *      Work items do not hold and must not acquire RTNL.
 * @workqueue_name: Name of workqueue
@@ -709,6 +710,7 @@ struct efx_nic {
        struct pci_dev *pci_dev;
        const struct efx_nic_type *type;
        int legacy_irq;
+        bool legacy_irq_enabled;
        struct workqueue_struct *workqueue;
        char workqueue_name[16];
        struct work_struct reset_work;
diff --git a/drivers/net/sfc/nic.c b/drivers/net/sfc/nic.c
index 41c36b9a4244..67cb0c96838c 100644
--- a/drivers/net/sfc/nic.c
+++ b/drivers/net/sfc/nic.c
@@ -1418,6 +1418,12 @@ static irqreturn_t efx_legacy_interrupt(int irq, void *dev_id)
        u32 queues;
        int syserr;
+        /* Could this be ours?  If interrupts are disabled then the
+         * channel state may not be valid.
+         */
+        if (!efx->legacy_irq_enabled)
+                return result;
        /* Read the ISR which also ACKs the interrupts */
        efx_readd(efx, &reg, FR_BZ_INT_ISR0);
        queues = EFX_EXTRACT_DWORD(reg, 0, 31);
diff --git a/drivers/net/stmmac/stmmac_main.c b/drivers/net/stmmac/stmmac_main.c
index 06bc6034ce81..2114837809e7 100644
--- a/drivers/net/stmmac/stmmac_main.c
+++ b/drivers/net/stmmac/stmmac_main.c
@@ -1509,6 +1509,8 @@ static int stmmac_probe(struct net_device *dev)
                pr_warning("\tno valid MAC address;"
                        "please, use ifconfig or nwhwconfig!\n");
+        spin_lock_init(&priv->lock);
        ret = register_netdev(dev);
        if (ret) {
                pr_err("%s: ERROR %i registering the device\n",
@@ -1520,8 +1522,6 @@ static int stmmac_probe(struct net_device *dev)
            dev->name, (dev->features & NETIF_F_SG) ? "on" : "off",
            (dev->features & NETIF_F_HW_CSUM) ? "on" : "off");
-        spin_lock_init(&priv->lock);
        return ret;
 }
diff --git a/drivers/net/tile/Makefile b/drivers/net/tile/Makefile
new file mode 100644
index 000000000000..f634f142cab4
--- /dev/null
+++ b/drivers/net/tile/Makefile
@@ -0,0 +1,10 @@
+#
+# Makefile for the TILE on-chip networking support.
+#
+obj-$(CONFIG_TILE_NET) += tile_net.o
+ifdef CONFIG_TILEGX
+tile_net-objs := tilegx.o mpipe.o iorpc_mpipe.o dma_queue.o
+else
+tile_net-objs := tilepro.o
+endif
diff --git a/drivers/net/tile/tilepro.c b/drivers/net/tile/tilepro.c
new file mode 100644
index 000000000000..0e6bac5ec65b
--- /dev/null
+++ b/drivers/net/tile/tilepro.c
@@ -0,0 +1,2406 @@
+/*
+ * Copyright 2010 Tilera Corporation. All Rights Reserved.
+ *
+ *   This program is free software; you can redistribute it and/or
+ *   modify it under the terms of the GNU General Public License
+ *   as published by the Free Software Foundation, version 2.
+ *
+ *   This program is distributed in the hope that it will be useful, but
+ *   WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, GOOD TITLE or
+ *   NON INFRINGEMENT.  See the GNU General Public License for
+ *   more details.
+ */
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/moduleparam.h>
+#include <linux/sched.h>
+#include <linux/kernel.h>      /* printk() */
+#include <linux/slab.h>        /* kmalloc() */
+#include <linux/errno.h>       /* error codes */
+#include <linux/types.h>       /* size_t */
+#include <linux/interrupt.h>
+#include <linux/in.h>
+#include <linux/netdevice.h>   /* struct device, and other headers */
+#include <linux/etherdevice.h> /* eth_type_trans */
+#include <linux/skbuff.h>
+#include <linux/ioctl.h>
+#include <linux/cdev.h>
+#include <linux/hugetlb.h>
+#include <linux/in6.h>
+#include <linux/timer.h>
+#include <linux/io.h>
+#include <asm/checksum.h>
+#include <asm/homecache.h>
+#include <hv/drv_xgbe_intf.h>
+#include <hv/drv_xgbe_impl.h>
+#include <hv/hypervisor.h>
+#include <hv/netio_intf.h>
+/* For TSO */
+#include <linux/ip.h>
+#include <linux/tcp.h>
+/* There is no singlethread_cpu, so schedule work on the current cpu. */
+#define singlethread_cpu -1
+/*
+ * First, "tile_net_init_module()" initializes all four "devices" which
+ * can be used by linux.
+ *
+ * Then, "ifconfig DEVICE up" calls "tile_net_open()", which analyzes
+ * the network cpus, then uses "tile_net_open_aux()" to initialize
+ * LIPP/LEPP, and then uses "tile_net_open_inner()" to register all
+ * the tiles, provide buffers to LIPP, allow ingress to start, and
+ * turn on hypervisor interrupt handling (and NAPI) on all tiles.
+ *
+ * If registration fails due to the link being down, then "retry_work"
+ * is used to keep calling "tile_net_open_inner()" until it succeeds.
+ *
+ * If "ifconfig DEVICE down" is called, it uses "tile_net_stop()" to
+ * stop egress, drain the LIPP buffers, unregister all the tiles, stop
+ * LIPP/LEPP, and wipe the LEPP queue.
+ *
+ * We start out with the ingress interrupt enabled on each CPU.  When
+ * this interrupt fires, we disable it, and call "napi_schedule()".
+ * This will cause "tile_net_poll()" to be called, which will pull
+ * packets from the netio queue, filtering them out, or passing them
+ * to "netif_receive_skb()".  If our budget is exhausted, we will
+ * return, knowing we will be called again later.  Otherwise, we
+ * reenable the ingress interrupt, and call "napi_complete()".
+ *
+ *
+ * NOTE: The use of "native_driver" ensures that EPP exists, and that
+ * "epp_sendv" is legal, and that "LIPP" is being used.
+ *
+ * NOTE: Failing to free completions for an arbitrarily long time
+ * (which is defined to be illegal) does in fact cause bizarre
+ * problems.  The "egress_timer" helps prevent this from happening.
+ *
+ * NOTE: The egress code can be interrupted by the interrupt handler.
+ */
+/* HACK: Allow use of "jumbo" packets. */
+/* This should be 1500 if "jumbo" is not set in LIPP. */
+/* This should be at most 10226 (10240 - 14) if "jumbo" is set in LIPP. */
+/* ISSUE: This has not been thoroughly tested (except at 1500). */
+#define TILE_NET_MTU 1500
+/* HACK: Define to support GSO. */
+/* ISSUE: This may actually hurt performance of the TCP blaster. */
+/* #define TILE_NET_GSO */
+/* Define this to collapse "duplicate" acks. */
+/* #define IGNORE_DUP_ACKS */
+/* HACK: Define this to verify incoming packets. */
+/* #define TILE_NET_VERIFY_INGRESS */
+/* Use 3000 to enable the Linux Traffic Control (QoS) layer, else 0. */
+#define TILE_NET_TX_QUEUE_LEN 0
+/* Define to dump packets (prints out the whole packet on tx and rx). */
+/* #define TILE_NET_DUMP_PACKETS */
+/* Define to enable debug spew (all PDEBUG's are enabled). */
+/* #define TILE_NET_DEBUG */
+/* Define to activate paranoia checks. */
+/* #define TILE_NET_PARANOIA */
+/* Default transmit lockup timeout period, in jiffies. */
+#define TILE_NET_TIMEOUT (5 * HZ)
+/* Default retry interval for bringing up the NetIO interface, in jiffies. */
+#define TILE_NET_RETRY_INTERVAL (5 * HZ)
+/* Number of ports (xgbe0, xgbe1, gbe0, gbe1). */
+#define TILE_NET_DEVS 4
+/* Paranoia. */
+#if NET_IP_ALIGN != LIPP_PACKET_PADDING
+#error "NET_IP_ALIGN must match LIPP_PACKET_PADDING."
+#endif
+/* Debug print. */
+#ifdef TILE_NET_DEBUG
+#define PDEBUG(fmt, args...) net_printk(fmt, ## args)
+#else
+#define PDEBUG(fmt, args...)
+#endif
+MODULE_AUTHOR("Tilera");
+MODULE_LICENSE("GPL");
+#define IS_MULTICAST(mac_addr) \
+        (((u8 *)(mac_addr))[0] & 0x01)
+#define IS_BROADCAST(mac_addr) \
+        (((u16 *)(mac_addr))[0] == 0xffff)
+/*
+ * Queue of incoming packets for a specific cpu and device.
+ *
+ * Includes a pointer to the "system" data, and the actual "user" data.
+ */
+struct tile_netio_queue {
+        netio_queue_impl_t *__system_part;
+        netio_queue_user_impl_t __user_part;
+};
+/*
+ * Statistics counters for a specific cpu and device.
+ */
+struct tile_net_stats_t {
+        u32 rx_packets;
+        u32 rx_bytes;
+        u32 tx_packets;
+        u32 tx_bytes;
+};
+/*
+ * Info for a specific cpu and device.
+ *
+ * ISSUE: There is a "dev" pointer in "napi" as well.
+ */
+struct tile_net_cpu {
+        /* The NAPI struct. */
+        struct napi_struct napi;
+        /* Packet queue. */
+        struct tile_netio_queue queue;
+        /* Statistics. */
+        struct tile_net_stats_t stats;
+        /* ISSUE: Is this needed? */
+        bool napi_enabled;
+        /* True if this tile has succcessfully registered with the IPP. */
+        bool registered;
+        /* True if the link was down last time we tried to register. */
+        bool link_down;
+        /* True if "egress_timer" is scheduled. */
+        bool egress_timer_scheduled;
+        /* Number of small sk_buffs which must still be provided. */
+        unsigned int num_needed_small_buffers;
+        /* Number of large sk_buffs which must still be provided. */
+        unsigned int num_needed_large_buffers;
+        /* A timer for handling egress completions. */
+        struct timer_list egress_timer;
+};
+/*
+ * Info for a specific device.
+ */
+struct tile_net_priv {
+        /* Our network device. */
+        struct net_device *dev;
+        /* The actual egress queue. */
+        lepp_queue_t *epp_queue;
+        /* Protects "epp_queue->cmd_tail" and "epp_queue->comp_tail" */
+        spinlock_t cmd_lock;
+        /* Protects "epp_queue->comp_head". */
+        spinlock_t comp_lock;
+        /* The hypervisor handle for this interface. */
+        int hv_devhdl;
+        /* The intr bit mask that IDs this device. */
+        u32 intr_id;
+        /* True iff "tile_net_open_aux()" has succeeded. */
+        int partly_opened;
+        /* True iff "tile_net_open_inner()" has succeeded. */
+        int fully_opened;
+        /* Effective network cpus. */
+        struct cpumask network_cpus_map;
+        /* Number of network cpus. */
+        int network_cpus_count;
+        /* Credits per network cpu. */
+        int network_cpus_credits;
+        /* Network stats. */
+        struct net_device_stats stats;
+        /* For NetIO bringup retries. */
+        struct delayed_work retry_work;
+        /* Quick access to per cpu data. */
+        struct tile_net_cpu *cpu[NR_CPUS];
+};
+/*
+ * The actual devices (xgbe0, xgbe1, gbe0, gbe1).
+ */
+static struct net_device *tile_net_devs[TILE_NET_DEVS];
+/*
+ * The "tile_net_cpu" structures for each device.
+ */
+static DEFINE_PER_CPU(struct tile_net_cpu, hv_xgbe0);
+static DEFINE_PER_CPU(struct tile_net_cpu, hv_xgbe1);
+static DEFINE_PER_CPU(struct tile_net_cpu, hv_gbe0);
+static DEFINE_PER_CPU(struct tile_net_cpu, hv_gbe1);
+/*
+ * True if "network_cpus" was specified.
+ */
+static bool network_cpus_used;
+/*
+ * The actual cpus in "network_cpus".
+ */
+static struct cpumask network_cpus_map;
+#ifdef TILE_NET_DEBUG
+/*
+ * printk with extra stuff.
+ *
+ * We print the CPU we're running in brackets.
+ */
+static void net_printk(char *fmt, ...)
+{
+        int i;
+        int len;
+        va_list args;
+        static char buf[256];
+        len = sprintf(buf, "tile_net[%2.2d]: ", smp_processor_id());
+        va_start(args, fmt);
+        i = vscnprintf(buf + len, sizeof(buf) - len - 1, fmt, args);
+        va_end(args);
+        buf[255] = '\0';
+        pr_notice(buf);
+}
+#endif
+#ifdef TILE_NET_DUMP_PACKETS
+/*
+ * Dump a packet.
+ */
+static void dump_packet(unsigned char *data, unsigned long length, char *s)
+{
+        unsigned long i;
+        static unsigned int count;
+        pr_info("dump_packet(data %p, length 0x%lx s %s count 0x%x)\n",
+               data, length, s, count++);
+        pr_info("\n");
+        for (i = 0; i < length; i++) {
+                if ((i & 0xf) == 0)
+                        sprintf(buf, "%8.8lx:", i);
+                sprintf(buf + strlen(buf), " %2.2x", data[i]);
+                if ((i & 0xf) == 0xf || i == length - 1)
+                        pr_info("%s\n", buf);
+        }
+}
+#endif
+/*
+ * Provide support for the __netio_fastio1() swint
+ * (see <hv/drv_xgbe_intf.h> for how it is used).
+ *
+ * The fastio swint2 call may clobber all the caller-saved registers.
+ * It rarely clobbers memory, but we allow for the possibility in
+ * the signature just to be on the safe side.
+ *
+ * Also, gcc doesn't seem to allow an input operand to be
+ * clobbered, so we fake it with dummy outputs.
+ *
+ * This function can't be static because of the way it is declared
+ * in the netio header.
+ */
+inline int __netio_fastio1(u32 fastio_index, u32 arg0)
+{
+        long result, clobber_r1, clobber_r10;
+        asm volatile("swint2"
+                     : "=R00" (result),
+                       "=R01" (clobber_r1), "=R10" (clobber_r10)
+                     : "R10" (fastio_index), "R01" (arg0)
+                     : "memory", "r2", "r3", "r4",
+                       "r5", "r6", "r7", "r8", "r9",
+                       "r11", "r12", "r13", "r14",
+                       "r15", "r16", "r17", "r18", "r19",
+                       "r20", "r21", "r22", "r23", "r24",
+                       "r25", "r26", "r27", "r28", "r29");
+        return result;
+}
+/*
+ * Provide a linux buffer to LIPP.
+ */
+static void tile_net_provide_linux_buffer(struct tile_net_cpu *info,
+                                          void *va, bool small)
+{
+        struct tile_netio_queue *queue = &info->queue;
+        /* Convert "va" and "small" to "linux_buffer_t". */
+        unsigned int buffer = ((unsigned int)(__pa(va) >> 7) << 1) + small;
+        __netio_fastio_free_buffer(queue->__user_part.__fastio_index, buffer);
+}
+/*
+ * Provide a linux buffer for LIPP.
+ */
+static bool tile_net_provide_needed_buffer(struct tile_net_cpu *info,
+                                           bool small)
+{
+        /* ISSUE: What should we use here? */
+        unsigned int large_size = NET_IP_ALIGN + TILE_NET_MTU + 100;
+        /* Round up to ensure to avoid "false sharing" with last cache line. */
+        unsigned int buffer_size =
+                 (((small ? LIPP_SMALL_PACKET_SIZE : large_size) +
+                   CHIP_L2_LINE_SIZE() - 1) & -CHIP_L2_LINE_SIZE());
+        /*
+         * ISSUE: Since CPAs are 38 bits, and we can only encode the
+         * high 31 bits in a "linux_buffer_t", the low 7 bits must be
+         * zero, and thus, we must align the actual "va" mod 128.
+         */
+        const unsigned long align = 128;
+        struct sk_buff *skb;
+        void *va;
+        struct sk_buff **skb_ptr;
+        /* Note that "dev_alloc_skb()" adds NET_SKB_PAD more bytes, */
+        /* and also "reserves" that many bytes. */
+        /* ISSUE: Can we "share" the NET_SKB_PAD bytes with "skb_ptr"? */
+        int len = sizeof(*skb_ptr) + align + buffer_size;
+        while (1) {
+                /* Allocate (or fail). */
+                skb = dev_alloc_skb(len);
+                if (skb == NULL)
+                        return false;
+                /* Make room for a back-pointer to 'skb'. */
+                skb_reserve(skb, sizeof(*skb_ptr));
+                /* Make sure we are aligned. */
+                skb_reserve(skb, -(long)skb->data & (align - 1));
+                /* This address is given to IPP. */
+                va = skb->data;
+                if (small)
+                        break;
+                /* ISSUE: This has never been observed! */
+                /* Large buffers must not span a huge page. */
+                if (((((long)va & ~HPAGE_MASK) + 1535) & HPAGE_MASK) == 0)
+                        break;
+                pr_err("Leaking unaligned linux buffer at %p.\n", va);
+        }
+        /* Skip two bytes to satisfy LIPP assumptions. */
+        /* Note that this aligns IP on a 16 byte boundary. */
+        /* ISSUE: Do this when the packet arrives? */
+        skb_reserve(skb, NET_IP_ALIGN);
+        /* Save a back-pointer to 'skb'. */
+        skb_ptr = va - sizeof(*skb_ptr);
+        *skb_ptr = skb;
+        /* Invalidate the packet buffer. */
+        if (!hash_default)
+                __inv_buffer(skb->data, buffer_size);
+        /* Make sure "skb_ptr" has been flushed. */
+        __insn_mf();
+#ifdef TILE_NET_PARANOIA
+#if CHIP_HAS_CBOX_HOME_MAP()
+        if (hash_default) {
+                HV_PTE pte = *virt_to_pte(current->mm, (unsigned long)va);
+                if (hv_pte_get_mode(pte) != HV_PTE_MODE_CACHE_HASH_L3)
+                        panic("Non-coherent ingress buffer!");
+        }
+#endif
+#endif
+        /* Provide the new buffer. */
+        tile_net_provide_linux_buffer(info, va, small);
+        return true;
+}
+/*
+ * Provide linux buffers for LIPP.
+ */
+static void tile_net_provide_needed_buffers(struct tile_net_cpu *info)
+{
+        while (info->num_needed_small_buffers != 0) {
+                if (!tile_net_provide_needed_buffer(info, true))
+                        goto oops;
+                info->num_needed_small_buffers--;
+        }
+        while (info->num_needed_large_buffers != 0) {
+                if (!tile_net_provide_needed_buffer(info, false))
+                        goto oops;
+                info->num_needed_large_buffers--;
+        }
+        return;
+oops:
+        /* Add a description to the page allocation failure dump. */
+        pr_notice("Could not provide a linux buffer to LIPP.\n");
+}
+/*
+ * Grab some LEPP completions, and store them in "comps", of size
+ * "comps_size", and return the number of completions which were
+ * stored, so the caller can free them.
+ *
+ * If "pending" is not NULL, it will be set to true if there might
+ * still be some pending completions caused by this tile, else false.
+ */
+static unsigned int tile_net_lepp_grab_comps(struct net_device *dev,
+                                             struct sk_buff *comps[],
+                                             unsigned int comps_size,
+                                             bool *pending)
+{
+        struct tile_net_priv *priv = netdev_priv(dev);
+        lepp_queue_t *eq = priv->epp_queue;
+        unsigned int n = 0;
+        unsigned int comp_head;
+        unsigned int comp_busy;
+        unsigned int comp_tail;
+        spin_lock(&priv->comp_lock);
+        comp_head = eq->comp_head;
+        comp_busy = eq->comp_busy;
+        comp_tail = eq->comp_tail;
+        while (comp_head != comp_busy && n < comps_size) {
+                comps[n++] = eq->comps[comp_head];
+                LEPP_QINC(comp_head);
+        }
+        if (pending != NULL)
+                *pending = (comp_head != comp_tail);
+        eq->comp_head = comp_head;
+        spin_unlock(&priv->comp_lock);
+        return n;
+}
+/*
+ * Make sure the egress timer is scheduled.
+ *
+ * Note that we use "schedule if not scheduled" logic instead of the more
+ * obvious "reschedule" logic, because "reschedule" is fairly expensive.
+ */
+static void tile_net_schedule_egress_timer(struct tile_net_cpu *info)
+{
+        if (!info->egress_timer_scheduled) {
+                mod_timer_pinned(&info->egress_timer, jiffies + 1);
+                info->egress_timer_scheduled = true;
+        }
+}
+/*
+ * The "function" for "info->egress_timer".
+ *
+ * This timer will reschedule itself as long as there are any pending
+ * completions expected (on behalf of any tile).
+ *
+ * ISSUE: Realistically, will the timer ever stop scheduling itself?
+ *
+ * ISSUE: This timer is almost never actually needed, so just use a global
+ * timer that can run on any tile.
+ *
+ * ISSUE: Maybe instead track number of expected completions, and free
+ * only that many, resetting to zero if "pending" is ever false.
+ */
+static void tile_net_handle_egress_timer(unsigned long arg)
+{
+        struct tile_net_cpu *info = (struct tile_net_cpu *)arg;
+        struct net_device *dev = info->napi.dev;
+        struct sk_buff *olds[32];
+        unsigned int wanted = 32;
+        unsigned int i, nolds = 0;
+        bool pending;
+        /* The timer is no longer scheduled. */
+        info->egress_timer_scheduled = false;
+        nolds = tile_net_lepp_grab_comps(dev, olds, wanted, &pending);
+        for (i = 0; i < nolds; i++)
+                kfree_skb(olds[i]);
+        /* Reschedule timer if needed. */
+        if (pending)
+                tile_net_schedule_egress_timer(info);
+}
+#ifdef IGNORE_DUP_ACKS
+/*
+ * Help detect "duplicate" ACKs.  These are sequential packets (for a
+ * given flow) which are exactly 66 bytes long, sharing everything but
+ * ID=2@0x12, Hsum=2@0x18, Ack=4@0x2a, WinSize=2@0x30, Csum=2@0x32,
+ * Tstamps=10@0x38.  The ID's are +1, the Hsum's are -1, the Ack's are
+ * +N, and the Tstamps are usually identical.
+ *
+ * NOTE: Apparently truly duplicate acks (with identical "ack" values),
+ * should not be collapsed, as they are used for some kind of flow control.
+ */
+static bool is_dup_ack(char *s1, char *s2, unsigned int len)
+{
+        int i;
+        unsigned long long ignorable = 0;
+        /* Identification. */
+        ignorable |= (1ULL << 0x12);
+        ignorable |= (1ULL << 0x13);
+        /* Header checksum. */
+        ignorable |= (1ULL << 0x18);
+        ignorable |= (1ULL << 0x19);
+        /* ACK. */
+        ignorable |= (1ULL << 0x2a);
+        ignorable |= (1ULL << 0x2b);
+        ignorable |= (1ULL << 0x2c);
+        ignorable |= (1ULL << 0x2d);
+        /* WinSize. */
+        ignorable |= (1ULL << 0x30);
+        ignorable |= (1ULL << 0x31);
+        /* Checksum. */
+        ignorable |= (1ULL << 0x32);
+        ignorable |= (1ULL << 0x33);
+        for (i = 0; i < len; i++, ignorable >>= 1) {
+                if ((ignorable & 1) || (s1[i] == s2[i]))
+                        continue;
+#ifdef TILE_NET_DEBUG
+                /* HACK: Mention non-timestamp diffs. */
+                if (i < 0x38 && i != 0x2f &&
+                    net_ratelimit())
+                        pr_info("Diff at 0x%x\n", i);
+#endif
+                return false;
+        }
+#ifdef TILE_NET_NO_SUPPRESS_DUP_ACKS
+        /* HACK: Do not suppress truly duplicate ACKs. */
+        /* ISSUE: Is this actually necessary or helpful? */
+        if (s1[0x2a] == s2[0x2a] &&
+            s1[0x2b] == s2[0x2b] &&
+            s1[0x2c] == s2[0x2c] &&
+            s1[0x2d] == s2[0x2d]) {
+                return false;
+        }
+#endif
+        return true;
+}
+#endif
+/*
+ * Like "tile_net_handle_packets()", but just discard packets.
+ */
+static void tile_net_discard_packets(struct net_device *dev)
+{
+        struct tile_net_priv *priv = netdev_priv(dev);
+        int my_cpu = smp_processor_id();
+        struct tile_net_cpu *info = priv->cpu[my_cpu];
+        struct tile_netio_queue *queue = &info->queue;
+        netio_queue_impl_t *qsp = queue->__system_part;
+        netio_queue_user_impl_t *qup = &queue->__user_part;
+        while (qup->__packet_receive_read !=
+               qsp->__packet_receive_queue.__packet_write) {
+                int index = qup->__packet_receive_read;
+                int index2_aux = index + sizeof(netio_pkt_t);
+                int index2 =
+                        ((index2_aux ==
+                          qsp->__packet_receive_queue.__last_packet_plus_one) ?
+                         0 : index2_aux);
+                netio_pkt_t *pkt = (netio_pkt_t *)
+                        ((unsigned long) &qsp[1] + index);
+                /* Extract the "linux_buffer_t". */
+                unsigned int buffer = pkt->__packet.word;
+                /* Convert "linux_buffer_t" to "va". */
+                void *va = __va((phys_addr_t)(buffer >> 1) << 7);
+                /* Acquire the associated "skb". */
+                struct sk_buff **skb_ptr = va - sizeof(*skb_ptr);
+                struct sk_buff *skb = *skb_ptr;
+                kfree_skb(skb);
+                /* Consume this packet. */
+                qup->__packet_receive_read = index2;
+        }
+}
+/*
+ * Handle the next packet.  Return true if "processed", false if "filtered".
+ */
+static bool tile_net_poll_aux(struct tile_net_cpu *info, int index)
+{
+        struct net_device *dev = info->napi.dev;
+        struct tile_netio_queue *queue = &info->queue;
+        netio_queue_impl_t *qsp = queue->__system_part;
+        netio_queue_user_impl_t *qup = &queue->__user_part;
+        struct tile_net_stats_t *stats = &info->stats;
+        int filter;
+        int index2_aux = index + sizeof(netio_pkt_t);
+        int index2 =
+                ((index2_aux ==
+                  qsp->__packet_receive_queue.__last_packet_plus_one) ?
+                 0 : index2_aux);
+        netio_pkt_t *pkt = (netio_pkt_t *)((unsigned long) &qsp[1] + index);
+        netio_pkt_metadata_t *metadata = NETIO_PKT_METADATA(pkt);
+        /* Extract the packet size. */
+        unsigned long len =
+                (NETIO_PKT_CUSTOM_LENGTH(pkt) +
+                 NET_IP_ALIGN - NETIO_PACKET_PADDING);
+        /* Extract the "linux_buffer_t". */
+        unsigned int buffer = pkt->__packet.word;
+        /* Extract "small" (vs "large"). */
+        bool small = ((buffer & 1) != 0);
+        /* Convert "linux_buffer_t" to "va". */
+        void *va = __va((phys_addr_t)(buffer >> 1) << 7);
+        /* Extract the packet data pointer. */
+        /* Compare to "NETIO_PKT_CUSTOM_DATA(pkt)". */
+        unsigned char *buf = va + NET_IP_ALIGN;
+#ifdef IGNORE_DUP_ACKS
+        static int other;
+        static int final;
+        static int keep;
+        static int skip;
+#endif
+        /* Invalidate the packet buffer. */
+        if (!hash_default)
+                __inv_buffer(buf, len);
+        /* ISSUE: Is this needed? */
+        dev->last_rx = jiffies;
+#ifdef TILE_NET_DUMP_PACKETS
+        dump_packet(buf, len, "rx");
+#endif /* TILE_NET_DUMP_PACKETS */
+#ifdef TILE_NET_VERIFY_INGRESS
+        if (!NETIO_PKT_L4_CSUM_CORRECT_M(metadata, pkt) &&
+            NETIO_PKT_L4_CSUM_CALCULATED_M(metadata, pkt)) {
+                /*
+                 * FIXME: This complains about UDP packets
+                 * with a "zero" checksum (bug 6624).
+                 */
+#ifdef TILE_NET_PANIC_ON_BAD
+                dump_packet(buf, len, "rx");
+                panic("Bad L4 checksum.");
+#else
+                pr_warning("Bad L4 checksum on %d byte packet.\n", len);
+#endif
+        }
+        if (!NETIO_PKT_L3_CSUM_CORRECT_M(metadata, pkt) &&
+            NETIO_PKT_L3_CSUM_CALCULATED_M(metadata, pkt)) {
+                dump_packet(buf, len, "rx");
+                panic("Bad L3 checksum.");
+        }
+        switch (NETIO_PKT_STATUS_M(metadata, pkt)) {
+        case NETIO_PKT_STATUS_OVERSIZE:
+                if (len >= 64) {
+                        dump_packet(buf, len, "rx");
+                        panic("Unexpected OVERSIZE.");
+                }
+                break;
+        case NETIO_PKT_STATUS_BAD:
+#ifdef TILE_NET_PANIC_ON_BAD
+                dump_packet(buf, len, "rx");
+                panic("Unexpected BAD packet.");
+#else
+                pr_warning("Unexpected BAD %d byte packet.\n", len);
+#endif
+        }
+#endif
+        filter = 0;
+        if (!(dev->flags & IFF_UP)) {
+                /* Filter packets received before we're up. */
+                filter = 1;
+        } else if (!(dev->flags & IFF_PROMISC)) {
+                /*
+                 * FIXME: Implement HW multicast filter.
+                 */
+                if (!IS_MULTICAST(buf) && !IS_BROADCAST(buf)) {
+                        /* Filter packets not for our address. */
+                        const u8 *mine = dev->dev_addr;
+                        filter = compare_ether_addr(mine, buf);
+                }
+        }
+#ifdef IGNORE_DUP_ACKS
+        if (len != 66) {
+                /* FIXME: Must check "is_tcp_ack(buf, len)" somehow. */
+                other++;
+        } else if (index2 ==
+                   qsp->__packet_receive_queue.__packet_write) {
+                final++;
+        } else {
+                netio_pkt_t *pkt2 = (netio_pkt_t *)
+                        ((unsigned long) &qsp[1] + index2);
+                netio_pkt_metadata_t *metadata2 =
+                        NETIO_PKT_METADATA(pkt2);
+                /* Extract the packet size. */
+                unsigned long len2 =
+                        (NETIO_PKT_CUSTOM_LENGTH(pkt2) +
+                         NET_IP_ALIGN - NETIO_PACKET_PADDING);
+                if (len2 == 66 &&
+                    NETIO_PKT_FLOW_HASH_M(metadata, pkt) ==
+                    NETIO_PKT_FLOW_HASH_M(metadata2, pkt2)) {
+                        /* Extract the "linux_buffer_t". */
+                        unsigned int buffer2 = pkt2->__packet.word;
+                        /* Convert "linux_buffer_t" to "va". */
+                        void *va2 =
+                                __va((phys_addr_t)(buffer2 >> 1) << 7);
+                        /* Extract the packet data pointer. */
+                        /* Compare to "NETIO_PKT_CUSTOM_DATA(pkt)". */
+                        unsigned char *buf2 = va2 + NET_IP_ALIGN;
+                        /* Invalidate the packet buffer. */
+                        if (!hash_default)
+                                __inv_buffer(buf2, len2);
+                        if (is_dup_ack(buf, buf2, len)) {
+                                skip++;
+                                filter = 1;
+                        } else {
+                                keep++;
+                        }
+                }
+        }
+        if (net_ratelimit())
+                pr_info("Other %d Final %d Keep %d Skip %d.\n",
+                        other, final, keep, skip);
+#endif
+        if (filter) {
+                /* ISSUE: Update "drop" statistics? */
+                tile_net_provide_linux_buffer(info, va, small);
+        } else {
+                /* Acquire the associated "skb". */
+                struct sk_buff **skb_ptr = va - sizeof(*skb_ptr);
+                struct sk_buff *skb = *skb_ptr;
+                /* Paranoia. */
+                if (skb->data != buf)
+                        panic("Corrupt linux buffer from LIPP! "
+                              "VA=%p, skb=%p, skb->data=%p\n",
+                              va, skb, skb->data);
+                /* Encode the actual packet length. */
+                skb_put(skb, len);
+                /* NOTE: This call also sets "skb->dev = dev". */
+                skb->protocol = eth_type_trans(skb, dev);
+                /* ISSUE: Discard corrupt packets? */
+                /* ISSUE: Discard packets with bad checksums? */
+                /* Avoid recomputing TCP/UDP checksums. */
+                if (NETIO_PKT_L4_CSUM_CORRECT_M(metadata, pkt))
+                        skb->ip_summed = CHECKSUM_UNNECESSARY;
+                netif_receive_skb(skb);
+                stats->rx_packets++;
+                stats->rx_bytes += len;
+                if (small)
+                        info->num_needed_small_buffers++;
+                else
+                        info->num_needed_large_buffers++;
+        }
+        /* Return four credits after every fourth packet. */
+        if (--qup->__receive_credit_remaining == 0) {
+                u32 interval = qup->__receive_credit_interval;
+                qup->__receive_credit_remaining = interval;
+                __netio_fastio_return_credits(qup->__fastio_index, interval);
+        }
+        /* Consume this packet. */
+        qup->__packet_receive_read = index2;
+        return !filter;
+}
+/*
+ * Handle some packets for the given device on the current CPU.
+ *
+ * ISSUE: The "rotting packet" race condition occurs if a packet
+ * arrives after the queue appears to be empty, and before the
+ * hypervisor interrupt is re-enabled.
+ */
+static int tile_net_poll(struct napi_struct *napi, int budget)
+{
+        struct net_device *dev = napi->dev;
+        struct tile_net_priv *priv = netdev_priv(dev);
+        int my_cpu = smp_processor_id();
+        struct tile_net_cpu *info = priv->cpu[my_cpu];
+        struct tile_netio_queue *queue = &info->queue;
+        netio_queue_impl_t *qsp = queue->__system_part;
+        netio_queue_user_impl_t *qup = &queue->__user_part;
+        unsigned int work = 0;
+        while (1) {
+                int index = qup->__packet_receive_read;
+                if (index == qsp->__packet_receive_queue.__packet_write)
+                        break;
+                if (tile_net_poll_aux(info, index)) {
+                        if (++work >= budget)
+                                goto done;
+                }
+        }
+        napi_complete(&info->napi);
+        /* Re-enable hypervisor interrupts. */
+        enable_percpu_irq(priv->intr_id);
+        /* HACK: Avoid the "rotting packet" problem. */
+        if (qup->__packet_receive_read !=
+            qsp->__packet_receive_queue.__packet_write)
+                napi_schedule(&info->napi);
+        /* ISSUE: Handle completions? */
+done:
+        tile_net_provide_needed_buffers(info);
+        return work;
+}
+/*
+ * Handle an ingress interrupt for the given device on the current cpu.
+ */
+static irqreturn_t tile_net_handle_ingress_interrupt(int irq, void *dev_ptr)
+{
+        struct net_device *dev = (struct net_device *)dev_ptr;
+        struct tile_net_priv *priv = netdev_priv(dev);
+        int my_cpu = smp_processor_id();
+        struct tile_net_cpu *info = priv->cpu[my_cpu];
+        /* Disable hypervisor interrupt. */
+        disable_percpu_irq(priv->intr_id);
+        napi_schedule(&info->napi);
+        return IRQ_HANDLED;
+}
+/*
+ * One time initialization per interface.
+ */
+static int tile_net_open_aux(struct net_device *dev)
+{
+        struct tile_net_priv *priv = netdev_priv(dev);
+        int ret;
+        int dummy;
+        unsigned int epp_lotar;
+        /*
+         * Find out where EPP memory should be homed.
+         */
+        ret = hv_dev_pread(priv->hv_devhdl, 0,
+                           (HV_VirtAddr)&epp_lotar, sizeof(epp_lotar),
+                           NETIO_EPP_SHM_OFF);
+        if (ret < 0) {
+                pr_err("could not read epp_shm_queue lotar.\n");
+                return -EIO;
+        }
+        /*
+         * Home the page on the EPP.
+         */
+        {
+                int epp_home = hv_lotar_to_cpu(epp_lotar);
+                struct page *page = virt_to_page(priv->epp_queue);
+                homecache_change_page_home(page, 0, epp_home);
+        }
+        /*
+         * Register the EPP shared memory queue.
+         */
+        {
+                netio_ipp_address_t ea = {
+                        .va = 0,
+                        .pa = __pa(priv->epp_queue),
+                        .pte = hv_pte(0),
+                        .size = PAGE_SIZE,
+                };
+                ea.pte = hv_pte_set_lotar(ea.pte, epp_lotar);
+                ea.pte = hv_pte_set_mode(ea.pte, HV_PTE_MODE_CACHE_TILE_L3);
+                ret = hv_dev_pwrite(priv->hv_devhdl, 0,
+                                    (HV_VirtAddr)&ea,
+                                    sizeof(ea),
+                                    NETIO_EPP_SHM_OFF);
+                if (ret < 0)
+                        return -EIO;
+        }
+        /*
+         * Start LIPP/LEPP.
+         */
+        if (hv_dev_pwrite(priv->hv_devhdl, 0, (HV_VirtAddr)&dummy,
+                          sizeof(dummy), NETIO_IPP_START_SHIM_OFF) < 0) {
+                pr_warning("Failed to start LIPP/LEPP.\n");
+                return -EIO;
+        }
+        return 0;
+}
+/*
+ * Register with hypervisor on each CPU.
+ *
+ * Strangely, this function does important things even if it "fails",
+ * which is especially common if the link is not up yet.  Hopefully
+ * these things are all "harmless" if done twice!
+ */
+static void tile_net_register(void *dev_ptr)
+{
+        struct net_device *dev = (struct net_device *)dev_ptr;
+        struct tile_net_priv *priv = netdev_priv(dev);
+        int my_cpu = smp_processor_id();
+        struct tile_net_cpu *info;
+        struct tile_netio_queue *queue;
+        /* Only network cpus can receive packets. */
+        int queue_id =
+                cpumask_test_cpu(my_cpu, &priv->network_cpus_map) ? 0 : 255;
+        netio_input_config_t config = {
+                .flags = 0,
+                .num_receive_packets = priv->network_cpus_credits,
+                .queue_id = queue_id
+        };
+        int ret = 0;
+        netio_queue_impl_t *queuep;
+        PDEBUG("tile_net_register(queue_id %d)\n", queue_id);
+        if (!strcmp(dev->name, "xgbe0"))
+                info = &__get_cpu_var(hv_xgbe0);
+        else if (!strcmp(dev->name, "xgbe1"))
+                info = &__get_cpu_var(hv_xgbe1);
+        else if (!strcmp(dev->name, "gbe0"))
+                info = &__get_cpu_var(hv_gbe0);
+        else if (!strcmp(dev->name, "gbe1"))
+                info = &__get_cpu_var(hv_gbe1);
+        else
+                BUG();
+        /* Initialize the egress timer. */
+        init_timer(&info->egress_timer);
+        info->egress_timer.data = (long)info;
+        info->egress_timer.function = tile_net_handle_egress_timer;
+        priv->cpu[my_cpu] = info;
+        /*
+         * Register ourselves with the IPP.
+         */
+        ret = hv_dev_pwrite(priv->hv_devhdl, 0,
+                            (HV_VirtAddr)&config,
+                            sizeof(netio_input_config_t),
+                            NETIO_IPP_INPUT_REGISTER_OFF);
+        PDEBUG("hv_dev_pwrite(NETIO_IPP_INPUT_REGISTER_OFF) returned %d\n",
+               ret);
+        if (ret < 0) {
+                printk(KERN_DEBUG "hv_dev_pwrite NETIO_IPP_INPUT_REGISTER_OFF"
+                       " failure %d\n", ret);
+                info->link_down = (ret == NETIO_LINK_DOWN);
+                return;
+        }
+        /*
+         * Get the pointer to our queue's system part.
+         */
+        ret = hv_dev_pread(priv->hv_devhdl, 0,
+                           (HV_VirtAddr)&queuep,
+                           sizeof(netio_queue_impl_t *),
+                           NETIO_IPP_INPUT_REGISTER_OFF);
+        PDEBUG("hv_dev_pread(NETIO_IPP_INPUT_REGISTER_OFF) returned %d\n",
+               ret);
+        PDEBUG("queuep %p\n", queuep);
+        if (ret <= 0) {
+                /* ISSUE: Shouldn't this be a fatal error? */
+                pr_err("hv_dev_pread NETIO_IPP_INPUT_REGISTER_OFF failure\n");
+                return;
+        }
+        queue = &info->queue;
+        queue->__system_part = queuep;
+        memset(&queue->__user_part, 0, sizeof(netio_queue_user_impl_t));
+        /* This is traditionally "config.num_receive_packets / 2". */
+        queue->__user_part.__receive_credit_interval = 4;
+        queue->__user_part.__receive_credit_remaining =
+                queue->__user_part.__receive_credit_interval;
+        /*
+         * Get a fastio index from the hypervisor.
+         * ISSUE: Shouldn't this check the result?
+         */
+        ret = hv_dev_pread(priv->hv_devhdl, 0,
+                           (HV_VirtAddr)&queue->__user_part.__fastio_index,
+                           sizeof(queue->__user_part.__fastio_index),
+                           NETIO_IPP_GET_FASTIO_OFF);
+        PDEBUG("hv_dev_pread(NETIO_IPP_GET_FASTIO_OFF) returned %d\n", ret);
+        netif_napi_add(dev, &info->napi, tile_net_poll, 64);
+        /* Now we are registered. */
+        info->registered = true;
+}
+/*
+ * Unregister with hypervisor on each CPU.
+ */
+static void tile_net_unregister(void *dev_ptr)
+{
+        struct net_device *dev = (struct net_device *)dev_ptr;
+        struct tile_net_priv *priv = netdev_priv(dev);
+        int my_cpu = smp_processor_id();
+        struct tile_net_cpu *info = priv->cpu[my_cpu];
+        int ret = 0;
+        int dummy = 0;
+        /* Do nothing if never registered. */
+        if (info == NULL)
+                return;
+        /* Do nothing if already unregistered. */
+        if (!info->registered)
+                return;
+        /*
+         * Unregister ourselves with LIPP.
+         */
+        ret = hv_dev_pwrite(priv->hv_devhdl, 0, (HV_VirtAddr)&dummy,
+                            sizeof(dummy), NETIO_IPP_INPUT_UNREGISTER_OFF);
+        PDEBUG("hv_dev_pwrite(NETIO_IPP_INPUT_UNREGISTER_OFF) returned %d\n",
+               ret);
+        if (ret < 0) {
+                /* FIXME: Just panic? */
+                pr_err("hv_dev_pwrite NETIO_IPP_INPUT_UNREGISTER_OFF"
+                       " failure %d\n", ret);
+        }
+        /*
+         * Discard all packets still in our NetIO queue.  Hopefully,
+         * once the unregister call is complete, there will be no
+         * packets still in flight on the IDN.
+         */
+        tile_net_discard_packets(dev);
+        /* Reset state. */
+        info->num_needed_small_buffers = 0;
+        info->num_needed_large_buffers = 0;
+        /* Cancel egress timer. */
+        del_timer(&info->egress_timer);
+        info->egress_timer_scheduled = false;
+        netif_napi_del(&info->napi);
+        /* Now we are unregistered. */
+        info->registered = false;
+}
+/*
+ * Helper function for "tile_net_stop()".
+ *
+ * Also used to handle registration failure in "tile_net_open_inner()",
+ * when "fully_opened" is known to be false, and the various extra
+ * steps in "tile_net_stop()" are not necessary.  ISSUE: It might be
+ * simpler if we could just call "tile_net_stop()" anyway.
+ */
+static void tile_net_stop_aux(struct net_device *dev)
+{
+        struct tile_net_priv *priv = netdev_priv(dev);
+        int dummy = 0;
+        /* Unregister all tiles, so LIPP will stop delivering packets. */
+        on_each_cpu(tile_net_unregister, (void *)dev, 1);
+        /* Stop LIPP/LEPP. */
+        if (hv_dev_pwrite(priv->hv_devhdl, 0, (HV_VirtAddr)&dummy,
+                          sizeof(dummy), NETIO_IPP_STOP_SHIM_OFF) < 0)
+                panic("Failed to stop LIPP/LEPP!\n");
+        priv->partly_opened = 0;
+}
+/*
+ * Disable ingress interrupts for the given device on the current cpu.
+ */
+static void tile_net_disable_intr(void *dev_ptr)
+{
+        struct net_device *dev = (struct net_device *)dev_ptr;
+        struct tile_net_priv *priv = netdev_priv(dev);
+        int my_cpu = smp_processor_id();
+        struct tile_net_cpu *info = priv->cpu[my_cpu];
+        /* Disable hypervisor interrupt. */
+        disable_percpu_irq(priv->intr_id);
+        /* Disable NAPI if needed. */
+        if (info != NULL && info->napi_enabled) {
+                napi_disable(&info->napi);
+                info->napi_enabled = false;
+        }
+}
+/*
+ * Enable ingress interrupts for the given device on the current cpu.
+ */
+static void tile_net_enable_intr(void *dev_ptr)
+{
+        struct net_device *dev = (struct net_device *)dev_ptr;
+        struct tile_net_priv *priv = netdev_priv(dev);
+        int my_cpu = smp_processor_id();
+        struct tile_net_cpu *info = priv->cpu[my_cpu];
+        /* Enable hypervisor interrupt. */
+        enable_percpu_irq(priv->intr_id);
+        /* Enable NAPI. */
+        napi_enable(&info->napi);
+        info->napi_enabled = true;
+}
+/*
+ * tile_net_open_inner does most of the work of bringing up the interface.
+ * It's called from tile_net_open(), and also from tile_net_retry_open().
+ * The return value is 0 if the interface was brought up, < 0 if
+ * tile_net_open() should return the return value as an error, and > 0 if
+ * tile_net_open() should return success and schedule a work item to
+ * periodically retry the bringup.
+ */
+static int tile_net_open_inner(struct net_device *dev)
+{
+        struct tile_net_priv *priv = netdev_priv(dev);
+        int my_cpu = smp_processor_id();
+        struct tile_net_cpu *info;
+        struct tile_netio_queue *queue;
+        unsigned int irq;
+        int i;
+        /*
+         * First try to register just on the local CPU, and handle any
+         * semi-expected "link down" failure specially.  Note that we
+         * do NOT call "tile_net_stop_aux()", unlike below.
+         */
+        tile_net_register(dev);
+        info = priv->cpu[my_cpu];
+        if (!info->registered) {
+                if (info->link_down)
+                        return 1;
+                return -EAGAIN;
+        }
+        /*
+         * Now register everywhere else.  If any registration fails,
+         * even for "link down" (which might not be possible), we
+         * clean up using "tile_net_stop_aux()".
+         */
+        smp_call_function(tile_net_register, (void *)dev, 1);
+        for_each_online_cpu(i) {
+                if (!priv->cpu[i]->registered) {
+                        tile_net_stop_aux(dev);
+                        return -EAGAIN;
+                }
+        }
+        queue = &info->queue;
+        /*
+         * Set the device intr bit mask.
+         * The tile_net_register above sets per tile __intr_id.
+         */
+        priv->intr_id = queue->__system_part->__intr_id;
+        BUG_ON(!priv->intr_id);
+        /*
+         * Register the device interrupt handler.
+         * The __ffs() function returns the index into the interrupt handler
+         * table from the interrupt bit mask which should have one bit
+         * and one bit only set.
+         */
+        irq = __ffs(priv->intr_id);
+        tile_irq_activate(irq, TILE_IRQ_PERCPU);
+        BUG_ON(request_irq(irq, tile_net_handle_ingress_interrupt,
+                           0, dev->name, (void *)dev) != 0);
+        /* ISSUE: How could "priv->fully_opened" ever be "true" here? */
+        if (!priv->fully_opened) {
+                int dummy = 0;
+                /* Allocate initial buffers. */
+                int max_buffers =
+                        priv->network_cpus_count * priv->network_cpus_credits;
+                info->num_needed_small_buffers =
+                        min(LIPP_SMALL_BUFFERS, max_buffers);
+                info->num_needed_large_buffers =
+                        min(LIPP_LARGE_BUFFERS, max_buffers);
+                tile_net_provide_needed_buffers(info);
+                if (info->num_needed_small_buffers != 0 ||
+                    info->num_needed_large_buffers != 0)
+                        panic("Insufficient memory for buffer stack!");
+                /* Start LIPP/LEPP and activate "ingress" at the shim. */
+                if (hv_dev_pwrite(priv->hv_devhdl, 0, (HV_VirtAddr)&dummy,
+                                  sizeof(dummy), NETIO_IPP_INPUT_INIT_OFF) < 0)
+                        panic("Failed to activate the LIPP Shim!\n");
+                priv->fully_opened = 1;
+        }
+        /* On each tile, enable the hypervisor to trigger interrupts. */
+        /* ISSUE: Do this before starting LIPP/LEPP? */
+        on_each_cpu(tile_net_enable_intr, (void *)dev, 1);
+        /* Start our transmit queue. */
+        netif_start_queue(dev);
+        return 0;
+}
+/*
+ * Called periodically to retry bringing up the NetIO interface,
+ * if it doesn't come up cleanly during tile_net_open().
+ */
+static void tile_net_open_retry(struct work_struct *w)
+{
+        struct delayed_work *dw =
+                container_of(w, struct delayed_work, work);
+        struct tile_net_priv *priv =
+                container_of(dw, struct tile_net_priv, retry_work);
+        /*
+         * Try to bring the NetIO interface up.  If it fails, reschedule
+         * ourselves to try again later; otherwise, tell Linux we now have
+         * a working link.  ISSUE: What if the return value is negative?
+         */
+        if (tile_net_open_inner(priv->dev))
+                schedule_delayed_work_on(singlethread_cpu, &priv->retry_work,
+                                         TILE_NET_RETRY_INTERVAL);
+        else
+                netif_carrier_on(priv->dev);
+}
+/*
+ * Called when a network interface is made active.
+ *
+ * Returns 0 on success, negative value on failure.
+ *
+ * The open entry point is called when a network interface is made
+ * active by the system (IFF_UP).  At this point all resources needed
+ * for transmit and receive operations are allocated, the interrupt
+ * handler is registered with the OS, the watchdog timer is started,
+ * and the stack is notified that the interface is ready.
+ *
+ * If the actual link is not available yet, then we tell Linux that
+ * we have no carrier, and we keep checking until the link comes up.
+ */
+static int tile_net_open(struct net_device *dev)
+{
+        int ret = 0;
+        struct tile_net_priv *priv = netdev_priv(dev);
+        /*
+         * We rely on priv->partly_opened to tell us if this is the
+         * first time this interface is being brought up. If it is
+         * set, the IPP was already initialized and should not be
+         * initialized again.
+         */
+        if (!priv->partly_opened) {
+                int count;
+                int credits;
+                /* Initialize LIPP/LEPP, and start the Shim. */
+                ret = tile_net_open_aux(dev);
+                if (ret < 0) {
+                        pr_err("tile_net_open_aux failed: %d\n", ret);
+                        return ret;
+                }
+                /* Analyze the network cpus. */
+                if (network_cpus_used)
+                        cpumask_copy(&priv->network_cpus_map,
+                                     &network_cpus_map);
+                else
+                        cpumask_copy(&priv->network_cpus_map, cpu_online_mask);
+                count = cpumask_weight(&priv->network_cpus_map);
+                /* Limit credits to available buffers, and apply min. */
+                credits = max(16, (LIPP_LARGE_BUFFERS / count) & ~1);
+                /* Apply "GBE" max limit. */
+                /* ISSUE: Use higher limit for XGBE? */
+                credits = min(NETIO_MAX_RECEIVE_PKTS, credits);
+                priv->network_cpus_count = count;
+                priv->network_cpus_credits = credits;
+#ifdef TILE_NET_DEBUG
+                pr_info("Using %d network cpus, with %d credits each\n",
+                       priv->network_cpus_count, priv->network_cpus_credits);
+#endif
+                priv->partly_opened = 1;
+        }
+        /*
+         * Attempt to bring up the link.
+         */
+        ret = tile_net_open_inner(dev);
+        if (ret <= 0) {
+                if (ret == 0)
+                        netif_carrier_on(dev);
+                return ret;
+        }
+        /*
+         * We were unable to bring up the NetIO interface, but we want to
+         * try again in a little bit.  Tell Linux that we have no carrier
+         * so it doesn't try to use the interface before the link comes up
+         * and then remember to try again later.
+         */
+        netif_carrier_off(dev);
+        schedule_delayed_work_on(singlethread_cpu, &priv->retry_work,
+                                 TILE_NET_RETRY_INTERVAL);
+        return 0;
+}
+/*
+ * Disables a network interface.
+ *
+ * Returns 0, this is not allowed to fail.
+ *
+ * The close entry point is called when an interface is de-activated
+ * by the OS.  The hardware is still under the drivers control, but
+ * needs to be disabled.  A global MAC reset is issued to stop the
+ * hardware, and all transmit and receive resources are freed.
+ *
+ * ISSUE: Can this can be called while "tile_net_poll()" is running?
+ */
+static int tile_net_stop(struct net_device *dev)
+{
+        struct tile_net_priv *priv = netdev_priv(dev);
+        bool pending = true;
+        PDEBUG("tile_net_stop()\n");
+        /* ISSUE: Only needed if not yet fully open. */
+        cancel_delayed_work_sync(&priv->retry_work);
+        /* Can't transmit any more. */
+        netif_stop_queue(dev);
+        /*
+         * Disable hypervisor interrupts on each tile.
+         */
+        on_each_cpu(tile_net_disable_intr, (void *)dev, 1);
+        /*
+         * Unregister the interrupt handler.
+         * The __ffs() function returns the index into the interrupt handler
+         * table from the interrupt bit mask which should have one bit
+         * and one bit only set.
+         */
+        if (priv->intr_id)
+                free_irq(__ffs(priv->intr_id), dev);
+        /*
+         * Drain all the LIPP buffers.
+         */
+        while (true) {
+                int buffer;
+                /* NOTE: This should never fail. */
+                if (hv_dev_pread(priv->hv_devhdl, 0, (HV_VirtAddr)&buffer,
+                                 sizeof(buffer), NETIO_IPP_DRAIN_OFF) < 0)
+                        break;
+                /* Stop when done. */
+                if (buffer == 0)
+                        break;
+                {
+                        /* Convert "linux_buffer_t" to "va". */
+                        void *va = __va((phys_addr_t)(buffer >> 1) << 7);
+                        /* Acquire the associated "skb". */
+                        struct sk_buff **skb_ptr = va - sizeof(*skb_ptr);
+                        struct sk_buff *skb = *skb_ptr;
+                        kfree_skb(skb);
+                }
+        }
+        /* Stop LIPP/LEPP. */
+        tile_net_stop_aux(dev);
+        priv->fully_opened = 0;
+        /*
+         * XXX: ISSUE: It appears that, in practice anyway, by the
+         * time we get here, there are no pending completions.
+         */
+        while (pending) {
+                struct sk_buff *olds[32];
+                unsigned int wanted = 32;
+                unsigned int i, nolds = 0;
+                nolds = tile_net_lepp_grab_comps(dev, olds,
+                                                 wanted, &pending);
+                /* ISSUE: We have never actually seen this debug spew. */
+                if (nolds != 0)
+                        pr_info("During tile_net_stop(), grabbed %d comps.\n",
+                               nolds);
+                for (i = 0; i < nolds; i++)
+                        kfree_skb(olds[i]);
+        }
+        /* Wipe the EPP queue. */
+        memset(priv->epp_queue, 0, sizeof(lepp_queue_t));
+        /* Evict the EPP queue. */
+        finv_buffer(priv->epp_queue, PAGE_SIZE);
+        return 0;
+}
+/*
+ * Prepare the "frags" info for the resulting LEPP command.
+ *
+ * If needed, flush the memory used by the frags.
+ */
+static unsigned int tile_net_tx_frags(lepp_frag_t *frags,
+                                      struct sk_buff *skb,
+                                      void *b_data, unsigned int b_len)
+{
+        unsigned int i, n = 0;
+        struct skb_shared_info *sh = skb_shinfo(skb);
+        phys_addr_t cpa;
+        if (b_len != 0) {
+                if (!hash_default)
+                        finv_buffer_remote(b_data, b_len);
+                cpa = __pa(b_data);
+                frags[n].cpa_lo = cpa;
+                frags[n].cpa_hi = cpa >> 32;
+                frags[n].length = b_len;
+                frags[n].hash_for_home = hash_default;
+                n++;
+        }
+        for (i = 0; i < sh->nr_frags; i++) {
+                skb_frag_t *f = &sh->frags[i];
+                unsigned long pfn = page_to_pfn(f->page);
+                /* FIXME: Compute "hash_for_home" properly. */
+                /* ISSUE: The hypervisor checks CHIP_HAS_REV1_DMA_PACKETS(). */
+                int hash_for_home = hash_default;
+                /* FIXME: Hmmm. */
+                if (!hash_default) {
+                        void *va = pfn_to_kaddr(pfn) + f->page_offset;
+                        BUG_ON(PageHighMem(f->page));
+                        finv_buffer_remote(va, f->size);
+                }
+                cpa = ((phys_addr_t)pfn << PAGE_SHIFT) + f->page_offset;
+                frags[n].cpa_lo = cpa;
+                frags[n].cpa_hi = cpa >> 32;
+                frags[n].length = f->size;
+                frags[n].hash_for_home = hash_for_home;
+                n++;
+        }
+        return n;
+}
+/*
+ * This function takes "skb", consisting of a header template and a
+ * payload, and hands it to LEPP, to emit as one or more segments,
+ * each consisting of a possibly modified header, plus a piece of the
+ * payload, via a process known as "tcp segmentation offload".
+ *
+ * Usually, "data" will contain the header template, of size "sh_len",
+ * and "sh->frags" will contain "skb->data_len" bytes of payload, and
+ * there will be "sh->gso_segs" segments.
+ *
+ * Sometimes, if "sendfile()" requires copying, we will be called with
+ * "data" containing the header and payload, with "frags" being empty.
+ *
+ * In theory, "sh->nr_frags" could be 3, but in practice, it seems
+ * that this will never actually happen.
+ *
+ * See "emulate_large_send_offload()" for some reference code, which
+ * does not handle checksumming.
+ *
+ * ISSUE: How do we make sure that high memory DMA does not migrate?
+ */
+static int tile_net_tx_tso(struct sk_buff *skb, struct net_device *dev)
+{
+        struct tile_net_priv *priv = netdev_priv(dev);
+        int my_cpu = smp_processor_id();
+        struct tile_net_cpu *info = priv->cpu[my_cpu];
+        struct tile_net_stats_t *stats = &info->stats;
+        struct skb_shared_info *sh = skb_shinfo(skb);
+        unsigned char *data = skb->data;
+        /* The ip header follows the ethernet header. */
+        struct iphdr *ih = ip_hdr(skb);
+        unsigned int ih_len = ih->ihl * 4;
+        /* Note that "nh == ih", by definition. */
+        unsigned char *nh = skb_network_header(skb);
+        unsigned int eh_len = nh - data;
+        /* The tcp header follows the ip header. */
+        struct tcphdr *th = (struct tcphdr *)(nh + ih_len);
+        unsigned int th_len = th->doff * 4;
+        /* The total number of header bytes. */
+        /* NOTE: This may be less than skb_headlen(skb). */
+        unsigned int sh_len = eh_len + ih_len + th_len;
+        /* The number of payload bytes at "skb->data + sh_len". */
+        /* This is non-zero for sendfile() without HIGHDMA. */
+        unsigned int b_len = skb_headlen(skb) - sh_len;
+        /* The total number of payload bytes. */
+        unsigned int d_len = b_len + skb->data_len;
+        /* The maximum payload size. */
+        unsigned int p_len = sh->gso_size;
+        /* The total number of segments. */
+        unsigned int num_segs = sh->gso_segs;
+        /* The temporary copy of the command. */
+        u32 cmd_body[(LEPP_MAX_CMD_SIZE + 3) / 4];
+        lepp_tso_cmd_t *cmd = (lepp_tso_cmd_t *)cmd_body;
+        /* Analyze the "frags". */
+        unsigned int num_frags =
+                tile_net_tx_frags(cmd->frags, skb, data + sh_len, b_len);
+        /* The size of the command, including frags and header. */
+        size_t cmd_size = LEPP_TSO_CMD_SIZE(num_frags, sh_len);
+        /* The command header. */
+        lepp_tso_cmd_t cmd_init = {
+                .tso = true,
+                .header_size = sh_len,
+                .ip_offset = eh_len,
+                .tcp_offset = eh_len + ih_len,
+                .payload_size = p_len,
+                .num_frags = num_frags,
+        };
+        unsigned long irqflags;
+        lepp_queue_t *eq = priv->epp_queue;
+        struct sk_buff *olds[4];
+        unsigned int wanted = 4;
+        unsigned int i, nolds = 0;
+        unsigned int cmd_head, cmd_tail, cmd_next;
+        unsigned int comp_tail;
+        unsigned int free_slots;
+        /* Paranoia. */
+        BUG_ON(skb->protocol != htons(ETH_P_IP));
+        BUG_ON(ih->protocol != IPPROTO_TCP);
+        BUG_ON(skb->ip_summed != CHECKSUM_PARTIAL);
+        BUG_ON(num_frags > LEPP_MAX_FRAGS);
+        /*--BUG_ON(num_segs != (d_len + (p_len - 1)) / p_len); */
+        BUG_ON(num_segs <= 1);
+        /* Finish preparing the command. */
+        /* Copy the command header. */
+        *cmd = cmd_init;
+        /* Copy the "header". */
+        memcpy(&cmd->frags[num_frags], data, sh_len);
+        /* Prefetch and wait, to minimize time spent holding the spinlock. */
+        prefetch_L1(&eq->comp_tail);
+        prefetch_L1(&eq->cmd_tail);
+        mb();
+        /* Enqueue the command. */
+        spin_lock_irqsave(&priv->cmd_lock, irqflags);
+        /*
+         * Handle completions if needed to make room.
+         * HACK: Spin until there is sufficient room.
+         */
+        free_slots = lepp_num_free_comp_slots(eq);
+        if (free_slots < 1) {
+spin:
+                nolds += tile_net_lepp_grab_comps(dev, olds + nolds,
+                                                  wanted - nolds, NULL);
+                if (lepp_num_free_comp_slots(eq) < 1)
+                        goto spin;
+        }
+        cmd_head = eq->cmd_head;
+        cmd_tail = eq->cmd_tail;
+        /* NOTE: The "gotos" below are untested. */
+        /* Prepare to advance, detecting full queue. */
+        cmd_next = cmd_tail + cmd_size;
+        if (cmd_tail < cmd_head && cmd_next >= cmd_head)
+                goto spin;
+        if (cmd_next > LEPP_CMD_LIMIT) {
+                cmd_next = 0;
+                if (cmd_next == cmd_head)
+                        goto spin;
+        }
+        /* Copy the command. */
+        memcpy(&eq->cmds[cmd_tail], cmd, cmd_size);
+        /* Advance. */
+        cmd_tail = cmd_next;
+        /* Record "skb" for eventual freeing. */
+        comp_tail = eq->comp_tail;
+        eq->comps[comp_tail] = skb;
+        LEPP_QINC(comp_tail);
+        eq->comp_tail = comp_tail;
+        /* Flush before allowing LEPP to handle the command. */
+        __insn_mf();
+        eq->cmd_tail = cmd_tail;
+        spin_unlock_irqrestore(&priv->cmd_lock, irqflags);
+        if (nolds == 0)
+                nolds = tile_net_lepp_grab_comps(dev, olds, wanted, NULL);
+        /* Handle completions. */
+        for (i = 0; i < nolds; i++)
+                kfree_skb(olds[i]);
+        /* Update stats. */
+        stats->tx_packets += num_segs;
+        stats->tx_bytes += (num_segs * sh_len) + d_len;
+        /* Make sure the egress timer is scheduled. */
+        tile_net_schedule_egress_timer(info);
+        return NETDEV_TX_OK;
+}
+/*
+ * Transmit a packet (called by the kernel via "hard_start_xmit" hook).
+ */
+static int tile_net_tx(struct sk_buff *skb, struct net_device *dev)
+{
+        struct tile_net_priv *priv = netdev_priv(dev);
+        int my_cpu = smp_processor_id();
+        struct tile_net_cpu *info = priv->cpu[my_cpu];
+        struct tile_net_stats_t *stats = &info->stats;
+        unsigned long irqflags;
+        struct skb_shared_info *sh = skb_shinfo(skb);
+        unsigned int len = skb->len;
+        unsigned char *data = skb->data;
+        unsigned int csum_start = skb->csum_start - skb_headroom(skb);
+        lepp_frag_t frags[LEPP_MAX_FRAGS];
+        unsigned int num_frags;
+        lepp_queue_t *eq = priv->epp_queue;
+        struct sk_buff *olds[4];
+        unsigned int wanted = 4;
+        unsigned int i, nolds = 0;
+        unsigned int cmd_size = sizeof(lepp_cmd_t);
+        unsigned int cmd_head, cmd_tail, cmd_next;
+        unsigned int comp_tail;
+        lepp_cmd_t cmds[LEPP_MAX_FRAGS];
+        unsigned int free_slots;
+        /*
+         * This is paranoia, since we think that if the link doesn't come
+         * up, telling Linux we have no carrier will keep it from trying
+         * to transmit.  If it does, though, we can't execute this routine,
+         * since data structures we depend on aren't set up yet.
+         */
+        if (!info->registered)
+                return NETDEV_TX_BUSY;
+        /* Save the timestamp. */
+        dev->trans_start = jiffies;
+#ifdef TILE_NET_PARANOIA
+#if CHIP_HAS_CBOX_HOME_MAP()
+        if (hash_default) {
+                HV_PTE pte = *virt_to_pte(current->mm, (unsigned long)data);
+                if (hv_pte_get_mode(pte) != HV_PTE_MODE_CACHE_HASH_L3)
+                        panic("Non-coherent egress buffer!");
+        }
+#endif
+#endif
+#ifdef TILE_NET_DUMP_PACKETS
+        /* ISSUE: Does not dump the "frags". */
+        dump_packet(data, skb_headlen(skb), "tx");
+#endif /* TILE_NET_DUMP_PACKETS */
+        if (sh->gso_size != 0)
+                return tile_net_tx_tso(skb, dev);
+        /* Prepare the commands. */
+        num_frags = tile_net_tx_frags(frags, skb, data, skb_headlen(skb));
+        for (i = 0; i < num_frags; i++) {
+                bool final = (i == num_frags - 1);
+                lepp_cmd_t cmd = {
+                        .cpa_lo = frags[i].cpa_lo,
+                        .cpa_hi = frags[i].cpa_hi,
+                        .length = frags[i].length,
+                        .hash_for_home = frags[i].hash_for_home,
+                        .send_completion = final,
+                        .end_of_packet = final
+                };
+                if (i == 0 && skb->ip_summed == CHECKSUM_PARTIAL) {
+                        cmd.compute_checksum = 1;
+                        cmd.checksum_data.bits.start_byte = csum_start;
+                        cmd.checksum_data.bits.count = len - csum_start;
+                        cmd.checksum_data.bits.destination_byte =
+                                csum_start + skb->csum_offset;
+                }
+                cmds[i] = cmd;
+        }
+        /* Prefetch and wait, to minimize time spent holding the spinlock. */
+        prefetch_L1(&eq->comp_tail);
+        prefetch_L1(&eq->cmd_tail);
+        mb();
+        /* Enqueue the commands. */
+        spin_lock_irqsave(&priv->cmd_lock, irqflags);
+        /*
+         * Handle completions if needed to make room.
+         * HACK: Spin until there is sufficient room.
+         */
+        free_slots = lepp_num_free_comp_slots(eq);
+        if (free_slots < 1) {
+spin:
+                nolds += tile_net_lepp_grab_comps(dev, olds + nolds,
+                                                  wanted - nolds, NULL);
+                if (lepp_num_free_comp_slots(eq) < 1)
+                        goto spin;
+        }
+        cmd_head = eq->cmd_head;
+        cmd_tail = eq->cmd_tail;
+        /* NOTE: The "gotos" below are untested. */
+        /* Copy the commands, or fail. */
+        for (i = 0; i < num_frags; i++) {
+                /* Prepare to advance, detecting full queue. */
+                cmd_next = cmd_tail + cmd_size;
+                if (cmd_tail < cmd_head && cmd_next >= cmd_head)
+                        goto spin;
+                if (cmd_next > LEPP_CMD_LIMIT) {
+                        cmd_next = 0;
+                        if (cmd_next == cmd_head)
+                                goto spin;
+                }
+                /* Copy the command. */
+                *(lepp_cmd_t *)&eq->cmds[cmd_tail] = cmds[i];
+                /* Advance. */
+                cmd_tail = cmd_next;
+        }
+        /* Record "skb" for eventual freeing. */
+        comp_tail = eq->comp_tail;
+        eq->comps[comp_tail] = skb;
+        LEPP_QINC(comp_tail);
+        eq->comp_tail = comp_tail;
+        /* Flush before allowing LEPP to handle the command. */
+        __insn_mf();
+        eq->cmd_tail = cmd_tail;
+        spin_unlock_irqrestore(&priv->cmd_lock, irqflags);
+        if (nolds == 0)
+                nolds = tile_net_lepp_grab_comps(dev, olds, wanted, NULL);
+        /* Handle completions. */
+        for (i = 0; i < nolds; i++)
+                kfree_skb(olds[i]);
+        /* HACK: Track "expanded" size for short packets (e.g. 42 < 60). */
+        stats->tx_packets++;
+        stats->tx_bytes += ((len >= ETH_ZLEN) ? len : ETH_ZLEN);
+        /* Make sure the egress timer is scheduled. */
+        tile_net_schedule_egress_timer(info);
+        return NETDEV_TX_OK;
+}
+/*
+ * Deal with a transmit timeout.
+ */
+static void tile_net_tx_timeout(struct net_device *dev)
+{
+        PDEBUG("tile_net_tx_timeout()\n");
+        PDEBUG("Transmit timeout at %ld, latency %ld\n", jiffies,
+               jiffies - dev->trans_start);
+        /* XXX: ISSUE: This doesn't seem useful for us. */
+        netif_wake_queue(dev);
+}
+/*
+ * Ioctl commands.
+ */
+static int tile_net_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
+{
+        return -EOPNOTSUPP;
+}
+/*
+ * Get System Network Statistics.
+ *
+ * Returns the address of the device statistics structure.
+ */
+static struct net_device_stats *tile_net_get_stats(struct net_device *dev)
+{
+        struct tile_net_priv *priv = netdev_priv(dev);
+        u32 rx_packets = 0;
+        u32 tx_packets = 0;
+        u32 rx_bytes = 0;
+        u32 tx_bytes = 0;
+        int i;
+        for_each_online_cpu(i) {
+                if (priv->cpu[i]) {
+                        rx_packets += priv->cpu[i]->stats.rx_packets;
+                        rx_bytes += priv->cpu[i]->stats.rx_bytes;
+                        tx_packets += priv->cpu[i]->stats.tx_packets;
+                        tx_bytes += priv->cpu[i]->stats.tx_bytes;
+                }
+        }
+        priv->stats.rx_packets = rx_packets;
+        priv->stats.rx_bytes = rx_bytes;
+        priv->stats.tx_packets = tx_packets;
+        priv->stats.tx_bytes = tx_bytes;
+        return &priv->stats;
+}
+/*
+ * Change the "mtu".
+ *
+ * The "change_mtu" method is usually not needed.
+ * If you need it, it must be like this.
+ */
+static int tile_net_change_mtu(struct net_device *dev, int new_mtu)
+{
+        PDEBUG("tile_net_change_mtu()\n");
+        /* Check ranges. */
+        if ((new_mtu < 68) || (new_mtu > 1500))
+                return -EINVAL;
+        /* Accept the value. */
+        dev->mtu = new_mtu;
+        return 0;
+}
+/*
+ * Change the Ethernet Address of the NIC.
+ *
+ * The hypervisor driver does not support changing MAC address.  However,
+ * the IPP does not do anything with the MAC address, so the address which
+ * gets used on outgoing packets, and which is accepted on incoming packets,
+ * is completely up to the NetIO program or kernel driver which is actually
+ * handling them.
+ *
+ * Returns 0 on success, negative on failure.
+ */
+static int tile_net_set_mac_address(struct net_device *dev, void *p)
+{
+        struct sockaddr *addr = p;
+        if (!is_valid_ether_addr(addr->sa_data))
+                return -EINVAL;
+        /* ISSUE: Note that "dev_addr" is now a pointer. */
+        memcpy(dev->dev_addr, addr->sa_data, dev->addr_len);
+        return 0;
+}
+/*
+ * Obtain the MAC address from the hypervisor.
+ * This must be done before opening the device.
+ */
+static int tile_net_get_mac(struct net_device *dev)
+{
+        struct tile_net_priv *priv = netdev_priv(dev);
+        char hv_dev_name[32];
+        int len;
+        __netio_getset_offset_t offset = { .word = NETIO_IPP_PARAM_OFF };
+        int ret;
+        /* For example, "xgbe0". */
+        strcpy(hv_dev_name, dev->name);
+        len = strlen(hv_dev_name);
+        /* For example, "xgbe/0". */
+        hv_dev_name[len] = hv_dev_name[len - 1];
+        hv_dev_name[len - 1] = '/';
+        len++;
+        /* For example, "xgbe/0/native_hash". */
+        strcpy(hv_dev_name + len, hash_default ? "/native_hash" : "/native");
+        /* Get the hypervisor handle for this device. */
+        priv->hv_devhdl = hv_dev_open((HV_VirtAddr)hv_dev_name, 0);
+        PDEBUG("hv_dev_open(%s) returned %d %p\n",
+               hv_dev_name, priv->hv_devhdl, &priv->hv_devhdl);
+        if (priv->hv_devhdl < 0) {
+                if (priv->hv_devhdl == HV_ENODEV)
+                        printk(KERN_DEBUG "Ignoring unconfigured device %s\n",
+                                 hv_dev_name);
+                else
+                        printk(KERN_DEBUG "hv_dev_open(%s) returned %d\n",
+                                 hv_dev_name, priv->hv_devhdl);
+                return -1;
+        }
+        /*
+         * Read the hardware address from the hypervisor.
+         * ISSUE: Note that "dev_addr" is now a pointer.
+         */
+        offset.bits.class = NETIO_PARAM;
+        offset.bits.addr = NETIO_PARAM_MAC;
+        ret = hv_dev_pread(priv->hv_devhdl, 0,
+                           (HV_VirtAddr)dev->dev_addr, dev->addr_len,
+                           offset.word);
+        PDEBUG("hv_dev_pread(NETIO_PARAM_MAC) returned %d\n", ret);
+        if (ret <= 0) {
+                printk(KERN_DEBUG "hv_dev_pread(NETIO_PARAM_MAC) %s failed\n",
+                       dev->name);
+                /*
+                 * Since the device is configured by the hypervisor but we
+                 * can't get its MAC address, we are most likely running
+                 * the simulator, so let's generate a random MAC address.
+                 */
+                random_ether_addr(dev->dev_addr);
+        }
+        return 0;
+}
+static struct net_device_ops tile_net_ops = {
+        .ndo_open = tile_net_open,
+        .ndo_stop = tile_net_stop,
+        .ndo_start_xmit = tile_net_tx,
+        .ndo_do_ioctl = tile_net_ioctl,
+        .ndo_get_stats = tile_net_get_stats,
+        .ndo_change_mtu = tile_net_change_mtu,
+        .ndo_tx_timeout = tile_net_tx_timeout,
+        .ndo_set_mac_address = tile_net_set_mac_address
+};
+/*
+ * The setup function.
+ *
+ * This uses ether_setup() to assign various fields in dev, including
+ * setting IFF_BROADCAST and IFF_MULTICAST, then sets some extra fields.
+ */
+static void tile_net_setup(struct net_device *dev)
+{
+        PDEBUG("tile_net_setup()\n");
+        ether_setup(dev);
+        dev->netdev_ops = &tile_net_ops;
+        dev->watchdog_timeo = TILE_NET_TIMEOUT;
+        /* We want lockless xmit. */
+        dev->features |= NETIF_F_LLTX;
+        /* We support hardware tx checksums. */
+        dev->features |= NETIF_F_HW_CSUM;
+        /* We support scatter/gather. */
+        dev->features |= NETIF_F_SG;
+        /* We support TSO. */
+        dev->features |= NETIF_F_TSO;
+#ifdef TILE_NET_GSO
+        /* We support GSO. */
+        dev->features |= NETIF_F_GSO;
+#endif
+        if (hash_default)
+                dev->features |= NETIF_F_HIGHDMA;
+        /* ISSUE: We should support NETIF_F_UFO. */
+        dev->tx_queue_len = TILE_NET_TX_QUEUE_LEN;
+        dev->mtu = TILE_NET_MTU;
+}
+/*
+ * Allocate the device structure, register the device, and obtain the
+ * MAC address from the hypervisor.
+ */
+static struct net_device *tile_net_dev_init(const char *name)
+{
+        int ret;
+        struct net_device *dev;
+        struct tile_net_priv *priv;
+        struct page *page;
+        /*
+         * Allocate the device structure.  This allocates "priv", calls
+         * tile_net_setup(), and saves "name".  Normally, "name" is a
+         * template, instantiated by register_netdev(), but not for us.
+         */
+        dev = alloc_netdev(sizeof(*priv), name, tile_net_setup);
+        if (!dev) {
+                pr_err("alloc_netdev(%s) failed\n", name);
+                return NULL;
+        }
+        priv = netdev_priv(dev);
+        /* Initialize "priv". */
+        memset(priv, 0, sizeof(*priv));
+        /* Save "dev" for "tile_net_open_retry()". */
+        priv->dev = dev;
+        INIT_DELAYED_WORK(&priv->retry_work, tile_net_open_retry);
+        spin_lock_init(&priv->cmd_lock);
+        spin_lock_init(&priv->comp_lock);
+        /* Allocate "epp_queue". */
+        BUG_ON(get_order(sizeof(lepp_queue_t)) != 0);
+        page = alloc_pages(GFP_KERNEL | __GFP_ZERO, 0);
+        if (!page) {
+                free_netdev(dev);
+                return NULL;
+        }
+        priv->epp_queue = page_address(page);
+        /* Register the network device. */
+        ret = register_netdev(dev);
+        if (ret) {
+                pr_err("register_netdev %s failed %d\n", dev->name, ret);
+                free_page((unsigned long)priv->epp_queue);
+                free_netdev(dev);
+                return NULL;
+        }
+        /* Get the MAC address. */
+        ret = tile_net_get_mac(dev);
+        if (ret < 0) {
+                unregister_netdev(dev);
+                free_page((unsigned long)priv->epp_queue);
+                free_netdev(dev);
+                return NULL;
+        }
+        return dev;
+}
+/*
+ * Module cleanup.
+ */
+static void tile_net_cleanup(void)
+{
+        int i;
+        for (i = 0; i < TILE_NET_DEVS; i++) {
+                if (tile_net_devs[i]) {
+                        struct net_device *dev = tile_net_devs[i];
+                        struct tile_net_priv *priv = netdev_priv(dev);
+                        unregister_netdev(dev);
+                        finv_buffer(priv->epp_queue, PAGE_SIZE);
+                        free_page((unsigned long)priv->epp_queue);
+                        free_netdev(dev);
+                }
+        }
+}
+/*
+ * Module initialization.
+ */
+static int tile_net_init_module(void)
+{
+        pr_info("Tilera IPP Net Driver\n");
+        tile_net_devs[0] = tile_net_dev_init("xgbe0");
+        tile_net_devs[1] = tile_net_dev_init("xgbe1");
+        tile_net_devs[2] = tile_net_dev_init("gbe0");
+        tile_net_devs[3] = tile_net_dev_init("gbe1");
+        return 0;
+}
+#ifndef MODULE
+/*
+ * The "network_cpus" boot argument specifies the cpus that are dedicated
+ * to handle ingress packets.
+ *
+ * The parameter should be in the form "network_cpus=m-n[,x-y]", where
+ * m, n, x, y are integer numbers that represent the cpus that can be
+ * neither a dedicated cpu nor a dataplane cpu.
+ */
+static int __init network_cpus_setup(char *str)
+{
+        int rc = cpulist_parse_crop(str, &network_cpus_map);
+        if (rc != 0) {
+                pr_warning("network_cpus=%s: malformed cpu list\n",
+                       str);
+        } else {
+                /* Remove dedicated cpus. */
+                cpumask_and(&network_cpus_map, &network_cpus_map,
+                            cpu_possible_mask);
+                if (cpumask_empty(&network_cpus_map)) {
+                        pr_warning("Ignoring network_cpus='%s'.\n",
+                               str);
+                } else {
+                        char buf[1024];
+                        cpulist_scnprintf(buf, sizeof(buf), &network_cpus_map);
+                        pr_info("Linux network CPUs: %s\n", buf);
+                        network_cpus_used = true;
+                }
+        }
+        return 0;
+}
+__setup("network_cpus=", network_cpus_setup);
+#endif
+module_init(tile_net_init_module);
+module_exit(tile_net_cleanup);
diff --git a/drivers/net/tulip/dmfe.c b/drivers/net/tulip/dmfe.c
index a9f7d5d1a269..7064e035757a 100644
--- a/drivers/net/tulip/dmfe.c
+++ b/drivers/net/tulip/dmfe.c
@@ -688,9 +688,6 @@ static netdev_tx_t dmfe_start_xmit(struct sk_buff *skb,
        DMFE_DBUG(0, "dmfe_start_xmit", 0);
-        /* Resource flag check */
-        netif_stop_queue(dev);
        /* Too large packet check */
        if (skb->len > MAX_PACKET_SIZE) {
                pr_err("big packet = %d\n", (u16)skb->len);
@@ -698,6 +695,9 @@ static netdev_tx_t dmfe_start_xmit(struct sk_buff *skb,
                return NETDEV_TX_OK;
        }
+        /* Resource flag check */
+        netif_stop_queue(dev);
        spin_lock_irqsave(&db->lock, flags);
        /* No Tx resource check, it never happen nromally */
diff --git a/drivers/net/ucc_geth.h b/drivers/net/ucc_geth.h
index 05a95586f3c5..055b87ab4f07 100644
--- a/drivers/net/ucc_geth.h
+++ b/drivers/net/ucc_geth.h
@@ -899,7 +899,8 @@ struct ucc_geth_hardware_statistics {
 #define UCC_GETH_UTFS_INIT                      512     /* Tx virtual FIFO size
                                                         */
 #define UCC_GETH_UTFET_INIT                     256     /* 1/2 utfs */
-#define UCC_GETH_UTFTT_INIT                     512
+#define UCC_GETH_UTFTT_INIT                     256     /* 1/2 utfs
+                                                           due to errata */
 /* Gigabit Ethernet (1000 Mbps) */
 #define UCC_GETH_URFS_GIGA_INIT                 4096/*2048*/    /* Rx virtual
                                                                   FIFO size */
diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
index b154a94de03e..812edf85d6d3 100644
--- a/drivers/net/usb/hso.c
+++ b/drivers/net/usb/hso.c
@@ -958,10 +958,6 @@ static void packetizeRx(struct hso_net *odev, unsigned char *ip_pkt,
                                /* Packet is complete. Inject into stack. */
                                /* We have IP packet here */
                                odev->skb_rx_buf->protocol = cpu_to_be16(ETH_P_IP);
-                                /* don't check it */
-                                odev->skb_rx_buf->ip_summed =
-                                        CHECKSUM_UNNECESSARY;
                                skb_reset_mac_header(odev->skb_rx_buf);
                                /* Ship it off to the kernel */
@@ -2994,12 +2990,14 @@ static int hso_probe(struct usb_interface *interface,
        case HSO_INTF_BULK:
                /* It's a regular bulk interface */
-                if (((port_spec & HSO_PORT_MASK) == HSO_PORT_NETWORK) &&
+                if ((port_spec & HSO_PORT_MASK) == HSO_PORT_NETWORK) {
-                    !disable_net)
+                        if (!disable_net)
-                        hso_dev = hso_create_net_device(interface, port_spec);
+                                hso_dev =
-                else
+                                    hso_create_net_device(interface, port_spec);
+                } else {
                        hso_dev =
                            hso_create_bulk_serial_device(interface, port_spec);
+                }
                if (!hso_dev)
                        goto exit;
                break;
diff --git a/drivers/net/wan/hd64572.c b/drivers/net/wan/hd64572.c
index ea476cbd38b5..e305274f83fb 100644
--- a/drivers/net/wan/hd64572.c
+++ b/drivers/net/wan/hd64572.c
@@ -293,6 +293,7 @@ static inline void sca_tx_done(port_t *port)
        struct net_device *dev = port->netdev;
        card_t* card = port->card;
        u8 stat;
+        unsigned count = 0;
        spin_lock(&port->lock);
@@ -316,10 +317,12 @@ static inline void sca_tx_done(port_t *port)
                        dev->stats.tx_bytes += readw(&desc->len);
                }
                writeb(0, &desc->stat); /* Free descriptor */
+                count++;
                port->txlast = (port->txlast + 1) % card->tx_ring_buffers;
        }
-        netif_wake_queue(dev);
+        if (count)
+                netif_wake_queue(dev);
        spin_unlock(&port->lock);
 }
diff --git a/drivers/net/wan/x25_asy.c b/drivers/net/wan/x25_asy.c
index d81ad8397885..24297b274cd4 100644
--- a/drivers/net/wan/x25_asy.c
+++ b/drivers/net/wan/x25_asy.c
@@ -498,7 +498,6 @@ norbuff:
 static int x25_asy_close(struct net_device *dev)
 {
        struct x25_asy *sl = netdev_priv(dev);
-        int err;
        spin_lock(&sl->lock);
        if (sl->tty)
@@ -507,10 +506,6 @@ static int x25_asy_close(struct net_device *dev)
        netif_stop_queue(dev);
        sl->rcount = 0;
        sl->xleft  = 0;
-        err = lapb_unregister(dev);
-        if (err != LAPB_OK)
-                printk(KERN_ERR "x25_asy_close: lapb_unregister error -%d\n",
-                        err);
        spin_unlock(&sl->lock);
        return 0;
 }
@@ -582,7 +577,7 @@ static int x25_asy_open_tty(struct tty_struct *tty)
        if (err)
                return err;
        /* Done.  We have linked the TTY line to a channel. */
-        return sl->dev->base_addr;
+        return 0;
 }
@@ -595,6 +590,7 @@ static int x25_asy_open_tty(struct tty_struct *tty)
 static void x25_asy_close_tty(struct tty_struct *tty)
 {
        struct x25_asy *sl = tty->disc_data;
+        int err;
        /* First make sure we're connected. */
        if (!sl || sl->magic != X25_ASY_MAGIC)
@@ -605,6 +601,11 @@ static void x25_asy_close_tty(struct tty_struct *tty)
                dev_close(sl->dev);
        rtnl_unlock();
+        err = lapb_unregister(sl->dev);
+        if (err != LAPB_OK)
+                printk(KERN_ERR "x25_asy_close: lapb_unregister error -%d\n",
+                        err);
        tty->disc_data = NULL;
        sl->tty = NULL;
        x25_asy_free(sl);
diff --git a/drivers/net/wireless/ath/ath5k/base.c b/drivers/net/wireless/ath/ath5k/base.c
index 8251946842e6..42ed923cdb1a 100644
--- a/drivers/net/wireless/ath/ath5k/base.c
+++ b/drivers/net/wireless/ath/ath5k/base.c
@@ -1917,7 +1917,8 @@ ath5k_beacon_send(struct ath5k_softc *sc)
                sc->bmisscount = 0;
        }
-        if (sc->opmode == NL80211_IFTYPE_AP && sc->num_ap_vifs > 1) {
+        if ((sc->opmode == NL80211_IFTYPE_AP && sc->num_ap_vifs > 1) ||
+                        sc->opmode == NL80211_IFTYPE_MESH_POINT) {
                u64 tsf = ath5k_hw_get_tsf64(ah);
                u32 tsftu = TSF_TO_TU(tsf);
                int slot = ((tsftu % sc->bintval) * ATH_BCBUF) / sc->bintval;
@@ -1949,8 +1950,9 @@ ath5k_beacon_send(struct ath5k_softc *sc)
                /* NB: hw still stops DMA, so proceed */
        }
-        /* refresh the beacon for AP mode */
+        /* refresh the beacon for AP or MESH mode */
-        if (sc->opmode == NL80211_IFTYPE_AP)
+        if (sc->opmode == NL80211_IFTYPE_AP ||
+                        sc->opmode == NL80211_IFTYPE_MESH_POINT)
                ath5k_beacon_update(sc->hw, vif);
        ath5k_hw_set_txdp(ah, sc->bhalq, bf->daddr);
@@ -2851,7 +2853,8 @@ static int ath5k_add_interface(struct ieee80211_hw *hw,
        /* Assign the vap/adhoc to a beacon xmit slot. */
        if ((avf->opmode == NL80211_IFTYPE_AP) ||
-            (avf->opmode == NL80211_IFTYPE_ADHOC)) {
+            (avf->opmode == NL80211_IFTYPE_ADHOC) ||
+            (avf->opmode == NL80211_IFTYPE_MESH_POINT)) {
                int slot;
                WARN_ON(list_empty(&sc->bcbuf));
@@ -2870,7 +2873,7 @@ static int ath5k_add_interface(struct ieee80211_hw *hw,
                sc->bslot[avf->bslot] = vif;
                if (avf->opmode == NL80211_IFTYPE_AP)
                        sc->num_ap_vifs++;
-                else
+                else if (avf->opmode == NL80211_IFTYPE_ADHOC)
                        sc->num_adhoc_vifs++;
        }
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
index c4182359bee4..a7b82f0085d2 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
@@ -55,6 +55,8 @@
 #define SUB_NUM_CTL_MODES_AT_5G_40 2    /* excluding HT40, EXT-OFDM */
 #define SUB_NUM_CTL_MODES_AT_2G_40 3    /* excluding HT40, EXT-OFDM, EXT-CCK */
+#define CTL(_tpower, _flag) ((_tpower) | ((_flag) << 6))
 static const struct ar9300_eeprom ar9300_default = {
        .eepromVersion = 2,
        .templateVersion = 2,
@@ -290,20 +292,21 @@ static const struct ar9300_eeprom ar9300_default = {
                }
         },
        .ctlPowerData_2G = {
-                 { { {60, 0}, {60, 1}, {60, 0}, {60, 0} } },
+                 { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
-                 { { {60, 0}, {60, 1}, {60, 0}, {60, 0} } },
+                 { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
-                 { { {60, 1}, {60, 0}, {60, 0}, {60, 1} } },
+                 { { CTL(60, 1), CTL(60, 0), CTL(60, 0), CTL(60, 1) } },
-                 { { {60, 1}, {60, 0}, {0, 0}, {0, 0} } },
+                 { { CTL(60, 1), CTL(60, 0), CTL(0, 0), CTL(0, 0) } },
-                 { { {60, 0}, {60, 1}, {60, 0}, {60, 0} } },
+                 { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
-                 { { {60, 0}, {60, 1}, {60, 0}, {60, 0} } },
+                 { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
-                 { { {60, 0}, {60, 1}, {60, 1}, {60, 0} } },
+                 { { CTL(60, 0), CTL(60, 1), CTL(60, 1), CTL(60, 0) } },
-                 { { {60, 0}, {60, 1}, {60, 0}, {60, 0} } },
+                 { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
-                 { { {60, 0}, {60, 1}, {60, 0}, {60, 0} } },
+                 { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
-                 { { {60, 0}, {60, 1}, {60, 0}, {60, 0} } },
+                 { { CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 0) } },
-                 { { {60, 0}, {60, 1}, {60, 1}, {60, 1} } },
+                 { { CTL(60, 0), CTL(60, 1), CTL(60, 1), CTL(60, 1) } },
+                 { { CTL(60, 0), CTL(60, 1), CTL(60, 1), CTL(60, 1) } },
         },
        .modalHeader5G = {
                /* 4 idle,t1,t2,b (4 bits per setting) */
@@ -568,56 +571,56 @@ static const struct ar9300_eeprom ar9300_default = {
        .ctlPowerData_5G = {
                {
                        {
-                                {60, 1}, {60, 1}, {60, 1}, {60, 1},
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 1),
-                                {60, 1}, {60, 1}, {60, 1}, {60, 0},
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 0),
                        }
                },
                {
                        {
-                                {60, 1}, {60, 1}, {60, 1}, {60, 1},
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 1),
-                                {60, 1}, {60, 1}, {60, 1}, {60, 0},
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 0),
                        }
                },
                {
                        {
-                                {60, 0}, {60, 1}, {60, 0}, {60, 1},
+                                CTL(60, 0), CTL(60, 1), CTL(60, 0), CTL(60, 1),
-                                {60, 1}, {60, 1}, {60, 1}, {60, 1},
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 1),
                        }
                },
                {
                        {
-                                {60, 0}, {60, 1}, {60, 1}, {60, 0},
+                                CTL(60, 0), CTL(60, 1), CTL(60, 1), CTL(60, 0),
-                                {60, 1}, {60, 0}, {60, 0}, {60, 0},
+                                CTL(60, 1), CTL(60, 0), CTL(60, 0), CTL(60, 0),
                        }
                },
                {
                        {
-                                {60, 1}, {60, 1}, {60, 1}, {60, 0},
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 0),
-                                {60, 0}, {60, 0}, {60, 0}, {60, 0},
+                                CTL(60, 0), CTL(60, 0), CTL(60, 0), CTL(60, 0),
                        }
                },
                {
                        {
-                                {60, 1}, {60, 1}, {60, 1}, {60, 1},
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 1),
-                                {60, 1}, {60, 0}, {60, 0}, {60, 0},
+                                CTL(60, 1), CTL(60, 0), CTL(60, 0), CTL(60, 0),
                        }
                },
                {
                        {
-                                {60, 1}, {60, 1}, {60, 1}, {60, 1},
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 1),
-                                {60, 1}, {60, 1}, {60, 1}, {60, 1},
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 1),
                        }
                },
                {
                        {
-                                {60, 1}, {60, 1}, {60, 0}, {60, 1},
+                                CTL(60, 1), CTL(60, 1), CTL(60, 0), CTL(60, 1),
-                                {60, 1}, {60, 1}, {60, 1}, {60, 0},
+                                CTL(60, 1), CTL(60, 1), CTL(60, 1), CTL(60, 0),
                        }
                },
                {
                        {
-                                {60, 1}, {60, 0}, {60, 1}, {60, 1},
+                                CTL(60, 1), CTL(60, 0), CTL(60, 1), CTL(60, 1),
-                                {60, 1}, {60, 1}, {60, 0}, {60, 1},
+                                CTL(60, 1), CTL(60, 1), CTL(60, 0), CTL(60, 1),
                        }
                },
         }
@@ -1827,9 +1830,9 @@ static u16 ar9003_hw_get_direct_edge_power(struct ar9300_eeprom *eep,
        struct cal_ctl_data_5g *ctl_5g = eep->ctlPowerData_5G;
        if (is2GHz)
-                return ctl_2g[idx].ctlEdges[edge].tPower;
+                return CTL_EDGE_TPOWER(ctl_2g[idx].ctlEdges[edge]);
        else
-                return ctl_5g[idx].ctlEdges[edge].tPower;
+                return CTL_EDGE_TPOWER(ctl_5g[idx].ctlEdges[edge]);
 }
 static u16 ar9003_hw_get_indirect_edge_power(struct ar9300_eeprom *eep,
@@ -1847,12 +1850,12 @@ static u16 ar9003_hw_get_indirect_edge_power(struct ar9300_eeprom *eep,
        if (is2GHz) {
                if (ath9k_hw_fbin2freq(ctl_freqbin[edge - 1], 1) < freq &&
-                    ctl_2g[idx].ctlEdges[edge - 1].flag)
+                    CTL_EDGE_FLAGS(ctl_2g[idx].ctlEdges[edge - 1]))
-                        return ctl_2g[idx].ctlEdges[edge - 1].tPower;
+                        return CTL_EDGE_TPOWER(ctl_2g[idx].ctlEdges[edge - 1]);
        } else {
                if (ath9k_hw_fbin2freq(ctl_freqbin[edge - 1], 0) < freq &&
-                    ctl_5g[idx].ctlEdges[edge - 1].flag)
+                    CTL_EDGE_FLAGS(ctl_5g[idx].ctlEdges[edge - 1]))
-                        return ctl_5g[idx].ctlEdges[edge - 1].tPower;
+                        return CTL_EDGE_TPOWER(ctl_5g[idx].ctlEdges[edge - 1]);
        }
        return AR9300_MAX_RATE_POWER;
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.h b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.h
index 3c533bb983c7..655b3033396c 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.h
+++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.h
@@ -261,17 +261,12 @@ struct cal_tgt_pow_ht {
        u8 tPow2x[14];
 } __packed;
-struct cal_ctl_edge_pwr {
-        u8 tPower:6,
-           flag:2;
-} __packed;
 struct cal_ctl_data_2g {
-        struct cal_ctl_edge_pwr ctlEdges[AR9300_NUM_BAND_EDGES_2G];
+        u8 ctlEdges[AR9300_NUM_BAND_EDGES_2G];
 } __packed;
 struct cal_ctl_data_5g {
-        struct cal_ctl_edge_pwr ctlEdges[AR9300_NUM_BAND_EDGES_5G];
+        u8 ctlEdges[AR9300_NUM_BAND_EDGES_5G];
 } __packed;
 struct ar9300_eeprom {
diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
index 170d44a35ccb..0963071e8f90 100644
--- a/drivers/net/wireless/ath/ath9k/ath9k.h
+++ b/drivers/net/wireless/ath/ath9k/ath9k.h
@@ -21,6 +21,7 @@
 #include <linux/device.h>
 #include <linux/leds.h>
 #include <linux/completion.h>
+#include <linux/pm_qos_params.h>
 #include "debug.h"
 #include "common.h"
@@ -328,7 +329,7 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush, bool hp);
 struct ath_txq *ath_txq_setup(struct ath_softc *sc, int qtype, int subtype);
 void ath_tx_cleanupq(struct ath_softc *sc, struct ath_txq *txq);
 int ath_tx_setup(struct ath_softc *sc, int haltype);
-void ath_drain_all_txq(struct ath_softc *sc, bool retry_tx);
+bool ath_drain_all_txq(struct ath_softc *sc, bool retry_tx);
 void ath_draintxq(struct ath_softc *sc,
                     struct ath_txq *txq, bool retry_tx);
 void ath_tx_node_init(struct ath_softc *sc, struct ath_node *an);
@@ -646,6 +647,8 @@ struct ath_softc {
        struct ath_descdma txsdma;
        struct ath_ant_comb ant_comb;
+        struct pm_qos_request_list pm_qos_req;
 };
 struct ath_wiphy {
@@ -675,7 +678,6 @@ static inline void ath_read_cachesize(struct ath_common *common, int *csz)
 }
 extern struct ieee80211_ops ath9k_ops;
-extern struct pm_qos_request_list ath9k_pm_qos_req;
 extern int modparam_nohwcrypt;
 extern int led_blink;
diff --git a/drivers/net/wireless/ath/ath9k/eeprom.c b/drivers/net/wireless/ath/ath9k/eeprom.c
index 1266333f586d..2bbf94d0191e 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom.c
@@ -240,16 +240,16 @@ u16 ath9k_hw_get_max_edge_power(u16 freq, struct cal_ctl_edges *pRdEdgesPower,
        for (i = 0; (i < num_band_edges) &&
                     (pRdEdgesPower[i].bChannel != AR5416_BCHAN_UNUSED); i++) {
                if (freq == ath9k_hw_fbin2freq(pRdEdgesPower[i].bChannel, is2GHz)) {
-                        twiceMaxEdgePower = pRdEdgesPower[i].tPower;
+                        twiceMaxEdgePower = CTL_EDGE_TPOWER(pRdEdgesPower[i].ctl);
                        break;
                } else if ((i > 0) &&
                           (freq < ath9k_hw_fbin2freq(pRdEdgesPower[i].bChannel,
                                                      is2GHz))) {
                        if (ath9k_hw_fbin2freq(pRdEdgesPower[i - 1].bChannel,
                                               is2GHz) < freq &&
-                            pRdEdgesPower[i - 1].flag) {
+                            CTL_EDGE_FLAGS(pRdEdgesPower[i - 1].ctl)) {
                                twiceMaxEdgePower =
-                                        pRdEdgesPower[i - 1].tPower;
+                                        CTL_EDGE_TPOWER(pRdEdgesPower[i - 1].ctl);
                        }
                        break;
                }
diff --git a/drivers/net/wireless/ath/ath9k/eeprom.h b/drivers/net/wireless/ath/ath9k/eeprom.h
index dacb45e1b906..dd59f09441a3 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom.h
+++ b/drivers/net/wireless/ath/ath9k/eeprom.h
@@ -233,6 +233,18 @@
 #define AR9287_CHECKSUM_LOCATION (AR9287_EEP_START_LOC + 1)
+#define CTL_EDGE_TPOWER(_ctl) ((_ctl) & 0x3f)
+#define CTL_EDGE_FLAGS(_ctl) (((_ctl) >> 6) & 0x03)
+#define LNA_CTL_BUF_MODE        BIT(0)
+#define LNA_CTL_ISEL_LO         BIT(1)
+#define LNA_CTL_ISEL_HI         BIT(2)
+#define LNA_CTL_BUF_IN          BIT(3)
+#define LNA_CTL_FEM_BAND        BIT(4)
+#define LNA_CTL_LOCAL_BIAS      BIT(5)
+#define LNA_CTL_FORCE_XPA       BIT(6)
+#define LNA_CTL_USE_ANT1        BIT(7)
 enum eeprom_param {
        EEP_NFTHRESH_5,
        EEP_NFTHRESH_2,
@@ -378,10 +390,7 @@ struct modal_eep_header {
        u8 xatten2Margin[AR5416_MAX_CHAINS];
        u8 ob_ch1;
        u8 db_ch1;
-        u8 useAnt1:1,
+        u8 lna_ctl;
-            force_xpaon:1,
-            local_bias:1,
-            femBandSelectUsed:1, xlnabufin:1, xlnaisel:2, xlnabufmode:1;
        u8 miscBits;
        u16 xpaBiasLvlFreq[3];
        u8 futureModal[6];
@@ -535,18 +544,10 @@ struct cal_target_power_ht {
        u8 tPow2x[8];
 } __packed;
-#ifdef __BIG_ENDIAN_BITFIELD
-struct cal_ctl_edges {
-        u8 bChannel;
-        u8 flag:2, tPower:6;
-} __packed;
-#else
 struct cal_ctl_edges {
        u8 bChannel;
-        u8 tPower:6, flag:2;
+        u8 ctl;
 } __packed;
-#endif
 struct cal_data_op_loop_ar9287 {
        u8 pwrPdg[2][5];
diff --git a/drivers/net/wireless/ath/ath9k/eeprom_9287.c b/drivers/net/wireless/ath/ath9k/eeprom_9287.c
index 966b9496a9dd..195406db3bd8 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom_9287.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom_9287.c
@@ -37,7 +37,7 @@ static bool ath9k_hw_ar9287_fill_eeprom(struct ath_hw *ah)
        int addr, eep_start_loc;
        eep_data = (u16 *)eep;
-        if (ah->hw_version.devid == 0x7015)
+        if (AR9287_HTC_DEVID(ah))
                eep_start_loc = AR9287_HTC_EEP_START_LOC;
        else
                eep_start_loc = AR9287_EEP_START_LOC;
diff --git a/drivers/net/wireless/ath/ath9k/eeprom_def.c b/drivers/net/wireless/ath/ath9k/eeprom_def.c
index 76b4d65472dd..a3ccb1b9638d 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom_def.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom_def.c
@@ -451,9 +451,10 @@ static void ath9k_hw_def_set_board_values(struct ath_hw *ah,
                ath9k_hw_analog_shift_rmw(ah, AR_AN_TOP2,
                                          AR_AN_TOP2_LOCALBIAS,
                                          AR_AN_TOP2_LOCALBIAS_S,
-                                          pModal->local_bias);
+                                          !!(pModal->lna_ctl &
+                                             LNA_CTL_LOCAL_BIAS));
                REG_RMW_FIELD(ah, AR_PHY_XPA_CFG, AR_PHY_FORCE_XPA_CFG,
-                              pModal->force_xpaon);
+                              !!(pModal->lna_ctl & LNA_CTL_FORCE_XPA));
        }
        REG_RMW_FIELD(ah, AR_PHY_SETTLING, AR_PHY_SETTLING_SWITCH,
@@ -1062,15 +1063,19 @@ static void ath9k_hw_set_def_power_per_rate_table(struct ath_hw *ah,
        case 1:
                break;
        case 2:
-                scaledPower -= REDUCE_SCALED_POWER_BY_TWO_CHAIN;
+                if (scaledPower > REDUCE_SCALED_POWER_BY_TWO_CHAIN)
+                        scaledPower -= REDUCE_SCALED_POWER_BY_TWO_CHAIN;
+                else
+                        scaledPower = 0;
                break;
        case 3:
-                scaledPower -= REDUCE_SCALED_POWER_BY_THREE_CHAIN;
+                if (scaledPower > REDUCE_SCALED_POWER_BY_THREE_CHAIN)
+                        scaledPower -= REDUCE_SCALED_POWER_BY_THREE_CHAIN;
+                else
+                        scaledPower = 0;
                break;
        }
-        scaledPower = max((u16)0, scaledPower);
        if (IS_CHAN_2GHZ(chan)) {
                numCtlModes = ARRAY_SIZE(ctlModesFor11g) -
                        SUB_NUM_CTL_MODES_AT_2G_40;
@@ -1428,9 +1433,9 @@ static u8 ath9k_hw_def_get_num_ant_config(struct ath_hw *ah,
        num_ant_config = 1;
-        if (pBase->version >= 0x0E0D)
+        if (pBase->version >= 0x0E0D &&
-                if (pModal->useAnt1)
+            (pModal->lna_ctl & LNA_CTL_USE_ANT1))
-                        num_ant_config += 1;
+                num_ant_config += 1;
        return num_ant_config;
 }
diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c
index f7ec31b4ddd3..0de3c3d3c245 100644
--- a/drivers/net/wireless/ath/ath9k/hif_usb.c
+++ b/drivers/net/wireless/ath/ath9k/hif_usb.c
@@ -36,8 +36,13 @@ static struct usb_device_id ath9k_hif_usb_ids[] = {
        { USB_DEVICE(0x13D3, 0x3327) }, /* Azurewave */
        { USB_DEVICE(0x13D3, 0x3328) }, /* Azurewave */
        { USB_DEVICE(0x13D3, 0x3346) }, /* IMC Networks */
+        { USB_DEVICE(0x13D3, 0x3348) }, /* Azurewave */
+        { USB_DEVICE(0x13D3, 0x3349) }, /* Azurewave */
+        { USB_DEVICE(0x13D3, 0x3350) }, /* Azurewave */
        { USB_DEVICE(0x04CA, 0x4605) }, /* Liteon */
        { USB_DEVICE(0x083A, 0xA704) }, /* SMC Networks */
+        { USB_DEVICE(0x040D, 0x3801) }, /* VIA */
+        { USB_DEVICE(0x1668, 0x1200) }, /* Verizon */
        { },
 };
@@ -806,6 +811,8 @@ static int ath9k_hif_usb_download_fw(struct hif_device_usb *hif_dev)
        case 0x7010:
        case 0x7015:
        case 0x9018:
+        case 0xA704:
+        case 0x1200:
                firm_offset = AR7010_FIRMWARE_TEXT;
                break;
        default:
@@ -928,6 +935,8 @@ static int ath9k_hif_usb_probe(struct usb_interface *interface,
        case 0x7010:
        case 0x7015:
        case 0x9018:
+        case 0xA704:
+        case 0x1200:
                if (le16_to_cpu(udev->descriptor.bcdDevice) == 0x0202)
                        hif_dev->fw_name = FIRMWARE_AR7010_1_1;
                else
@@ -1015,6 +1024,13 @@ static int ath9k_hif_usb_suspend(struct usb_interface *interface,
        struct hif_device_usb *hif_dev =
                (struct hif_device_usb *) usb_get_intfdata(interface);
+        /*
+         * The device has to be set to FULLSLEEP mode in case no
+         * interface is up.
+         */
+        if (!(hif_dev->flags & HIF_USB_START))
+                ath9k_htc_suspend(hif_dev->htc_handle);
        ath9k_hif_usb_dealloc_urbs(hif_dev);
        return 0;
diff --git a/drivers/net/wireless/ath/ath9k/htc.h b/drivers/net/wireless/ath/ath9k/htc.h
index 75ecf6a30d25..c3b561daa6c1 100644
--- a/drivers/net/wireless/ath/ath9k/htc.h
+++ b/drivers/net/wireless/ath/ath9k/htc.h
@@ -455,6 +455,8 @@ u32 ath9k_htc_calcrxfilter(struct ath9k_htc_priv *priv);
 void ath9k_htc_ps_wakeup(struct ath9k_htc_priv *priv);
 void ath9k_htc_ps_restore(struct ath9k_htc_priv *priv);
 void ath9k_ps_work(struct work_struct *work);
+bool ath9k_htc_setpower(struct ath9k_htc_priv *priv,
+                        enum ath9k_power_mode mode);
 void ath9k_start_rfkill_poll(struct ath9k_htc_priv *priv);
 void ath9k_init_leds(struct ath9k_htc_priv *priv);
@@ -464,6 +466,7 @@ int ath9k_htc_probe_device(struct htc_target *htc_handle, struct device *dev,
                           u16 devid, char *product);
 void ath9k_htc_disconnect_device(struct htc_target *htc_handle, bool hotunplug);
 #ifdef CONFIG_PM
+void ath9k_htc_suspend(struct htc_target *htc_handle);
 int ath9k_htc_resume(struct htc_target *htc_handle);
 #endif
 #ifdef CONFIG_ATH9K_HTC_DEBUGFS
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
index 3d7b97f1b3ae..8776f49ffd41 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
@@ -249,6 +249,8 @@ static int ath9k_init_htc_services(struct ath9k_htc_priv *priv, u16 devid)
        case 0x7010:
        case 0x7015:
        case 0x9018:
+        case 0xA704:
+        case 0x1200:
                priv->htc->credits = 45;
                break;
        default:
@@ -889,6 +891,12 @@ void ath9k_htc_disconnect_device(struct htc_target *htc_handle, bool hotunplug)
 }
 #ifdef CONFIG_PM
+void ath9k_htc_suspend(struct htc_target *htc_handle)
+{
+        ath9k_htc_setpower(htc_handle->drv_priv, ATH9K_PM_FULL_SLEEP);
+}
 int ath9k_htc_resume(struct htc_target *htc_handle)
 {
        int ret;
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_main.c b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
index 9a3be8da755d..51977caca47f 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_main.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
@@ -63,8 +63,8 @@ static enum htc_phymode ath9k_htc_get_curmode(struct ath9k_htc_priv *priv,
        return mode;
 }
-static bool ath9k_htc_setpower(struct ath9k_htc_priv *priv,
+bool ath9k_htc_setpower(struct ath9k_htc_priv *priv,
-                               enum ath9k_power_mode mode)
+                        enum ath9k_power_mode mode)
 {
        bool ret;
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
index 3d19b5bc937f..29d80ca78393 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
@@ -121,7 +121,7 @@ int ath9k_htc_tx_start(struct ath9k_htc_priv *priv, struct sk_buff *skb)
                        tx_hdr.data_type = ATH9K_HTC_NORMAL;
                }
-                if (ieee80211_is_data(fc)) {
+                if (ieee80211_is_data_qos(fc)) {
                        qc = ieee80211_get_qos_ctl(hdr);
                        tx_hdr.tidno = qc[0] & IEEE80211_QOS_CTL_TID_MASK;
                }
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index 6ebc68bca91f..c7fbe25cc128 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -2044,7 +2044,8 @@ u32 ath9k_hw_gpio_get(struct ath_hw *ah, u32 gpio)
                val = REG_READ(ah, AR7010_GPIO_IN);
                return (MS(val, AR7010_GPIO_IN_VAL) & AR_GPIO_BIT(gpio)) == 0;
        } else if (AR_SREV_9300_20_OR_LATER(ah))
-                return MS_REG_READ(AR9300, gpio) != 0;
+                return (MS(REG_READ(ah, AR_GPIO_IN), AR9300_GPIO_IN_VAL) &
+                        AR_GPIO_BIT(gpio)) != 0;
        else if (AR_SREV_9271(ah))
                return MS_REG_READ(AR9271, gpio) != 0;
        else if (AR_SREV_9287_11_OR_LATER(ah))
diff --git a/drivers/net/wireless/ath/ath9k/init.c b/drivers/net/wireless/ath/ath9k/init.c
index 6a0d99eff404..14b8ab386daf 100644
--- a/drivers/net/wireless/ath/ath9k/init.c
+++ b/drivers/net/wireless/ath/ath9k/init.c
@@ -15,7 +15,6 @@
 */
 #include <linux/slab.h>
-#include <linux/pm_qos_params.h>
 #include "ath9k.h"
@@ -180,8 +179,6 @@ static const struct ath_ops ath9k_common_ops = {
        .write = ath9k_iowrite32,
 };
-struct pm_qos_request_list ath9k_pm_qos_req;
 /**************************/
 /*     Initialization     */
 /**************************/
@@ -664,6 +661,8 @@ void ath9k_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw)
                hw->flags |= IEEE80211_HW_MFP_CAPABLE;
        hw->wiphy->interface_modes =
+                BIT(NL80211_IFTYPE_P2P_GO) |
+                BIT(NL80211_IFTYPE_P2P_CLIENT) |
                BIT(NL80211_IFTYPE_AP) |
                BIT(NL80211_IFTYPE_WDS) |
                BIT(NL80211_IFTYPE_STATION) |
@@ -759,7 +758,7 @@ int ath9k_init_device(u16 devid, struct ath_softc *sc, u16 subsysid,
        ath_init_leds(sc);
        ath_start_rfkill_poll(sc);
-        pm_qos_add_request(&ath9k_pm_qos_req, PM_QOS_CPU_DMA_LATENCY,
+        pm_qos_add_request(&sc->pm_qos_req, PM_QOS_CPU_DMA_LATENCY,
                           PM_QOS_DEFAULT_VALUE);
        return 0;
@@ -817,8 +816,6 @@ void ath9k_deinit_device(struct ath_softc *sc)
        ath9k_ps_wakeup(sc);
-        pm_qos_remove_request(&ath9k_pm_qos_req);
        wiphy_rfkill_stop_polling(sc->hw->wiphy);
        ath_deinit_leds(sc);
@@ -832,6 +829,7 @@ void ath9k_deinit_device(struct ath_softc *sc)
        }
        ieee80211_unregister_hw(hw);
+        pm_qos_remove_request(&sc->pm_qos_req);
        ath_rx_cleanup(sc);
        ath_tx_cleanup(sc);
        ath9k_deinit_softc(sc);
diff --git a/drivers/net/wireless/ath/ath9k/mac.c b/drivers/net/wireless/ath/ath9k/mac.c
index 8c13479b17cd..c996963ab339 100644
--- a/drivers/net/wireless/ath/ath9k/mac.c
+++ b/drivers/net/wireless/ath/ath9k/mac.c
@@ -703,8 +703,7 @@ int ath9k_hw_rxprocdesc(struct ath_hw *ah, struct ath_desc *ds,
                        rs->rs_phyerr = phyerr;
                } else if (ads.ds_rxstatus8 & AR_DecryptCRCErr)
                        rs->rs_status |= ATH9K_RXERR_DECRYPT;
-                else if ((ads.ds_rxstatus8 & AR_MichaelErr) &&
+                else if (ads.ds_rxstatus8 & AR_MichaelErr)
-                         rs->rs_keyix != ATH9K_RXKEYIX_INVALID)
                        rs->rs_status |= ATH9K_RXERR_MIC;
                else if (ads.ds_rxstatus8 & AR_KeyMiss)
                        rs->rs_status |= ATH9K_RXERR_DECRYPT;
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index 25d3ef4c338e..c0c3464d3a86 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -15,7 +15,6 @@
 */
 #include <linux/nl80211.h>
-#include <linux/pm_qos_params.h>
 #include "ath9k.h"
 #include "btcoex.h"
@@ -245,11 +244,12 @@ int ath_set_channel(struct ath_softc *sc, struct ieee80211_hw *hw,
         * the relevant bits of the h/w.
         */
        ath9k_hw_set_interrupts(ah, 0);
-        ath_drain_all_txq(sc, false);
+        stopped = ath_drain_all_txq(sc, false);
        spin_lock_bh(&sc->rx.pcu_lock);
-        stopped = ath_stoprecv(sc);
+        if (!ath_stoprecv(sc))
+                stopped = false;
        /* XXX: do not flush receive queue here. We don't want
         * to flush data frames already in queue because of
@@ -1244,7 +1244,7 @@ static int ath9k_start(struct ieee80211_hw *hw)
                        ath9k_btcoex_timer_resume(sc);
        }
-        pm_qos_update_request(&ath9k_pm_qos_req, 55);
+        pm_qos_update_request(&sc->pm_qos_req, 55);
 mutex_unlock:
        mutex_unlock(&sc->mutex);
@@ -1423,7 +1423,7 @@ static void ath9k_stop(struct ieee80211_hw *hw)
        sc->sc_flags |= SC_OP_INVALID;
-        pm_qos_update_request(&ath9k_pm_qos_req, PM_QOS_DEFAULT_VALUE);
+        pm_qos_update_request(&sc->pm_qos_req, PM_QOS_DEFAULT_VALUE);
        mutex_unlock(&sc->mutex);
@@ -1520,7 +1520,6 @@ static void ath9k_remove_interface(struct ieee80211_hw *hw,
        struct ath_softc *sc = aphy->sc;
        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
        struct ath_vif *avp = (void *)vif->drv_priv;
-        int i;
        ath_print(common, ATH_DBG_CONFIG, "Detach Interface\n");
@@ -1534,21 +1533,24 @@ static void ath9k_remove_interface(struct ieee80211_hw *hw,
        if ((sc->sc_ah->opmode == NL80211_IFTYPE_AP) ||
            (sc->sc_ah->opmode == NL80211_IFTYPE_ADHOC) ||
            (sc->sc_ah->opmode == NL80211_IFTYPE_MESH_POINT)) {
+                /* Disable SWBA interrupt */
+                sc->sc_ah->imask &= ~ATH9K_INT_SWBA;
                ath9k_ps_wakeup(sc);
+                ath9k_hw_set_interrupts(sc->sc_ah, sc->sc_ah->imask);
                ath9k_hw_stoptxdma(sc->sc_ah, sc->beacon.beaconq);
                ath9k_ps_restore(sc);
+                tasklet_kill(&sc->bcon_tasklet);
        }
        ath_beacon_return(sc, avp);
        sc->sc_flags &= ~SC_OP_BEACONS;
-        for (i = 0; i < ARRAY_SIZE(sc->beacon.bslot); i++) {
+        if (sc->nbcnvifs) {
-                if (sc->beacon.bslot[i] == vif) {
+                /* Re-enable SWBA interrupt */
-                        printk(KERN_DEBUG "%s: vif had allocated beacon "
+                sc->sc_ah->imask |= ATH9K_INT_SWBA;
-                               "slot\n", __func__);
+                ath9k_ps_wakeup(sc);
-                        sc->beacon.bslot[i] = NULL;
+                ath9k_hw_set_interrupts(sc->sc_ah, sc->sc_ah->imask);
-                        sc->beacon.bslot_aphy[i] = NULL;
+                ath9k_ps_restore(sc);
-                }
        }
        sc->nvifs--;
diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c
index c76ea53c20ce..fdc2ec52b42f 100644
--- a/drivers/net/wireless/ath/ath9k/recv.c
+++ b/drivers/net/wireless/ath/ath9k/recv.c
@@ -518,7 +518,7 @@ bool ath_stoprecv(struct ath_softc *sc)
        bool stopped;
        spin_lock_bh(&sc->rx.rxbuflock);
-        ath9k_hw_stoppcurecv(ah);
+        ath9k_hw_abortpcurecv(ah);
        ath9k_hw_setrxfilter(ah, 0);
        stopped = ath9k_hw_stopdmarecv(ah);
@@ -838,6 +838,10 @@ static bool ath9k_rx_accept(struct ath_common *common,
                            struct ath_rx_status *rx_stats,
                            bool *decrypt_error)
 {
+#define is_mc_or_valid_tkip_keyix ((is_mc ||                    \
+                (rx_stats->rs_keyix != ATH9K_RXKEYIX_INVALID && \
+                test_bit(rx_stats->rs_keyix, common->tkip_keymap))))
        struct ath_hw *ah = common->ah;
        __le16 fc;
        u8 rx_status_len = ah->caps.rx_status_len;
@@ -879,15 +883,18 @@ static bool ath9k_rx_accept(struct ath_common *common,
                if (rx_stats->rs_status & ATH9K_RXERR_DECRYPT) {
                        *decrypt_error = true;
                } else if (rx_stats->rs_status & ATH9K_RXERR_MIC) {
+                        bool is_mc;
                        /*
                         * The MIC error bit is only valid if the frame
                         * is not a control frame or fragment, and it was
                         * decrypted using a valid TKIP key.
                         */
+                        is_mc = !!is_multicast_ether_addr(hdr->addr1);
                        if (!ieee80211_is_ctl(fc) &&
                            !ieee80211_has_morefrags(fc) &&
                            !(le16_to_cpu(hdr->seq_ctrl) & IEEE80211_SCTL_FRAG) &&
-                            test_bit(rx_stats->rs_keyix, common->tkip_keymap))
+                            is_mc_or_valid_tkip_keyix)
                                rxs->flag |= RX_FLAG_MMIC_ERROR;
                        else
                                rx_stats->rs_status &= ~ATH9K_RXERR_MIC;
diff --git a/drivers/net/wireless/ath/ath9k/reg.h b/drivers/net/wireless/ath/ath9k/reg.h
index fa05b711e5cd..2c6a22fbb0f0 100644
--- a/drivers/net/wireless/ath/ath9k/reg.h
+++ b/drivers/net/wireless/ath/ath9k/reg.h
@@ -866,7 +866,13 @@
 #define AR_DEVID_7010(_ah) \
        (((_ah)->hw_version.devid == 0x7010) || \
         ((_ah)->hw_version.devid == 0x7015) || \
-         ((_ah)->hw_version.devid == 0x9018))
+         ((_ah)->hw_version.devid == 0x9018) || \
+         ((_ah)->hw_version.devid == 0xA704) || \
+         ((_ah)->hw_version.devid == 0x1200))
+#define AR9287_HTC_DEVID(_ah) \
+        (((_ah)->hw_version.devid == 0x7015) || \
+         ((_ah)->hw_version.devid == 0x1200))
 #define AR_RADIO_SREV_MAJOR                   0xf0
 #define AR_RAD5133_SREV_MAJOR                 0xc0
@@ -978,11 +984,13 @@ enum {
 #define AR9287_GPIO_IN_VAL_S                     11
 #define AR9271_GPIO_IN_VAL                       0xFFFF0000
 #define AR9271_GPIO_IN_VAL_S                     16
-#define AR9300_GPIO_IN_VAL                       0x0001FFFF
-#define AR9300_GPIO_IN_VAL_S                     0
 #define AR7010_GPIO_IN_VAL                       0x0000FFFF
 #define AR7010_GPIO_IN_VAL_S                     0
+#define AR_GPIO_IN                               0x404c
+#define AR9300_GPIO_IN_VAL                       0x0001FFFF
+#define AR9300_GPIO_IN_VAL_S                     0
 #define AR_GPIO_OE_OUT                           (AR_SREV_9300_20_OR_LATER(ah) ? 0x4050 : 0x404c)
 #define AR_GPIO_OE_OUT_DRV                       0x3
 #define AR_GPIO_OE_OUT_DRV_NO                    0x0
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index f2ade2402ce2..aff04789f794 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -1120,7 +1120,7 @@ void ath_draintxq(struct ath_softc *sc, struct ath_txq *txq, bool retry_tx)
        }
 }
-void ath_drain_all_txq(struct ath_softc *sc, bool retry_tx)
+bool ath_drain_all_txq(struct ath_softc *sc, bool retry_tx)
 {
        struct ath_hw *ah = sc->sc_ah;
        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
@@ -1128,7 +1128,7 @@ void ath_drain_all_txq(struct ath_softc *sc, bool retry_tx)
        int i, npend = 0;
        if (sc->sc_flags & SC_OP_INVALID)
-                return;
+                return true;
        /* Stop beacon queue */
        ath9k_hw_stoptxdma(sc->sc_ah, sc->beacon.beaconq);
@@ -1142,25 +1142,15 @@ void ath_drain_all_txq(struct ath_softc *sc, bool retry_tx)
                }
        }
-        if (npend) {
+        if (npend)
-                int r;
+                ath_print(common, ATH_DBG_FATAL, "Failed to stop TX DMA!\n");
-                ath_print(common, ATH_DBG_FATAL,
-                          "Failed to stop TX DMA. Resetting hardware!\n");
-                spin_lock_bh(&sc->sc_resetlock);
-                r = ath9k_hw_reset(ah, sc->sc_ah->curchan, ah->caldata, false);
-                if (r)
-                        ath_print(common, ATH_DBG_FATAL,
-                                  "Unable to reset hardware; reset status %d\n",
-                                  r);
-                spin_unlock_bh(&sc->sc_resetlock);
-        }
        for (i = 0; i < ATH9K_NUM_TX_QUEUES; i++) {
                if (ATH_TXQ_SETUP(sc, i))
                        ath_draintxq(sc, &sc->tx.txq[i], retry_tx);
        }
+        return !npend;
 }
 void ath_tx_cleanupq(struct ath_softc *sc, struct ath_txq *txq)
diff --git a/drivers/net/wireless/ath/carl9170/fw.c b/drivers/net/wireless/ath/carl9170/fw.c
index ae6c006bbc56..546b4e4ec5ea 100644
--- a/drivers/net/wireless/ath/carl9170/fw.c
+++ b/drivers/net/wireless/ath/carl9170/fw.c
@@ -291,7 +291,8 @@ static int carl9170_fw(struct ar9170 *ar, const __u8 *data, size_t len)
                if (SUPP(CARL9170FW_WLANTX_CAB)) {
                        ar->hw->wiphy->interface_modes |=
-                                BIT(NL80211_IFTYPE_AP);
+                                BIT(NL80211_IFTYPE_AP) |
+                                BIT(NL80211_IFTYPE_P2P_GO);
                }
        }
diff --git a/drivers/net/wireless/ath/carl9170/main.c b/drivers/net/wireless/ath/carl9170/main.c
index 980ae70ea424..dc7b30b170d0 100644
--- a/drivers/net/wireless/ath/carl9170/main.c
+++ b/drivers/net/wireless/ath/carl9170/main.c
@@ -647,7 +647,7 @@ init:
        }
 unlock:
-        if (err && (vif_id != -1)) {
+        if (err && (vif_id >= 0)) {
                vif_priv->active = false;
                bitmap_release_region(&ar->vif_bitmap, vif_id, 0);
                ar->vifs--;
@@ -1631,7 +1631,8 @@ void *carl9170_alloc(size_t priv_size)
         * supports these modes. The code which will add the
         * additional interface_modes is in fw.c.
         */
-        hw->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION);
+        hw->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
+                                     BIT(NL80211_IFTYPE_P2P_CLIENT);
        hw->flags |= IEEE80211_HW_RX_INCLUDES_FCS |
                     IEEE80211_HW_REPORTS_TX_ACK_STATUS |
diff --git a/drivers/net/wireless/ath/carl9170/tx.c b/drivers/net/wireless/ath/carl9170/tx.c
index b575c865142d..7e6506a77bbb 100644
--- a/drivers/net/wireless/ath/carl9170/tx.c
+++ b/drivers/net/wireless/ath/carl9170/tx.c
@@ -810,7 +810,7 @@ static int carl9170_tx_prepare(struct ar9170 *ar, struct sk_buff *skb)
        mac_tmp = cpu_to_le16(AR9170_TX_MAC_HW_DURATION |
                              AR9170_TX_MAC_BACKOFF);
-        mac_tmp |= cpu_to_le16((hw_queue << AR9170_TX_MAC_QOS_S) &&
+        mac_tmp |= cpu_to_le16((hw_queue << AR9170_TX_MAC_QOS_S) &
                               AR9170_TX_MAC_QOS);
        no_ack = !!(info->flags & IEEE80211_TX_CTL_NO_ACK);
diff --git a/drivers/net/wireless/ath/carl9170/usb.c b/drivers/net/wireless/ath/carl9170/usb.c
index 3317039cd28f..7504ed14c725 100644
--- a/drivers/net/wireless/ath/carl9170/usb.c
+++ b/drivers/net/wireless/ath/carl9170/usb.c
@@ -553,12 +553,12 @@ static int carl9170_usb_flush(struct ar9170 *ar)
                usb_free_urb(urb);
        }
-        ret = usb_wait_anchor_empty_timeout(&ar->tx_cmd, HZ);
+        ret = usb_wait_anchor_empty_timeout(&ar->tx_cmd, 1000);
        if (ret == 0)
                err = -ETIMEDOUT;
        /* lets wait a while until the tx - queues are dried out */
-        ret = usb_wait_anchor_empty_timeout(&ar->tx_anch, HZ);
+        ret = usb_wait_anchor_empty_timeout(&ar->tx_anch, 1000);
        if (ret == 0)
                err = -ETIMEDOUT;
diff --git a/drivers/net/wireless/b43/sdio.c b/drivers/net/wireless/b43/sdio.c
index 9a55338d957f..09e2dfd7b175 100644
--- a/drivers/net/wireless/b43/sdio.c
+++ b/drivers/net/wireless/b43/sdio.c
@@ -163,6 +163,7 @@ static int b43_sdio_probe(struct sdio_func *func,
 err_free_ssb:
        kfree(sdio);
 err_disable_func:
+        sdio_claim_host(func);
        sdio_disable_func(func);
 err_release_host:
        sdio_release_host(func);
diff --git a/drivers/net/wireless/libertas/if_sdio.c b/drivers/net/wireless/libertas/if_sdio.c
index e5685dc317a8..b4de0ca10feb 100644
--- a/drivers/net/wireless/libertas/if_sdio.c
+++ b/drivers/net/wireless/libertas/if_sdio.c
@@ -1170,7 +1170,6 @@ static void if_sdio_remove(struct sdio_func *func)
        lbs_deb_sdio("call remove card\n");
        lbs_stop_card(card->priv);
        lbs_remove_card(card->priv);
-        card->priv->surpriseremoved = 1;
        flush_workqueue(card->workqueue);
        destroy_workqueue(card->workqueue);
diff --git a/drivers/net/wireless/libertas/if_spi.c b/drivers/net/wireless/libertas/if_spi.c
index 79bcb4e5d2ca..ecd4d04b2c3c 100644
--- a/drivers/net/wireless/libertas/if_spi.c
+++ b/drivers/net/wireless/libertas/if_spi.c
@@ -1055,7 +1055,6 @@ static int __devexit libertas_spi_remove(struct spi_device *spi)
        lbs_stop_card(priv);
        lbs_remove_card(priv); /* will call free_netdev */
-        priv->surpriseremoved = 1;
        free_irq(spi->irq, card);
        if_spi_terminate_spi_thread(card);
        if (card->pdata->teardown)
diff --git a/drivers/net/wireless/libertas/main.c b/drivers/net/wireless/libertas/main.c
index 46b88b118c99..fcd1bbfc632d 100644
--- a/drivers/net/wireless/libertas/main.c
+++ b/drivers/net/wireless/libertas/main.c
@@ -915,8 +915,6 @@ void lbs_remove_card(struct lbs_private *priv)
        lbs_free_adapter(priv);
        lbs_cfg_free(priv);
-        priv->dev = NULL;
        free_netdev(dev);
        lbs_deb_leave(LBS_DEB_MAIN);
diff --git a/drivers/net/wireless/orinoco/main.c b/drivers/net/wireless/orinoco/main.c
index e8e2d0f4763d..f3d396e7544b 100644
--- a/drivers/net/wireless/orinoco/main.c
+++ b/drivers/net/wireless/orinoco/main.c
@@ -1392,10 +1392,9 @@ static void orinoco_process_scan_results(struct work_struct *work)
                                orinoco_add_hostscan_results(priv, buf, len);
                        kfree(buf);
-                } else if (priv->scan_request) {
+                } else {
                        /* Either abort or complete the scan */
-                        cfg80211_scan_done(priv->scan_request, (len < 0));
+                        orinoco_scan_done(priv, (len < 0));
-                        priv->scan_request = NULL;
                }
                spin_lock_irqsave(&priv->scan_lock, flags);
@@ -1684,6 +1683,8 @@ static int __orinoco_down(struct orinoco_private *priv)
                hermes_write_regn(hw, EVACK, 0xffff);
        }
+        orinoco_scan_done(priv, true);
        /* firmware will have to reassociate */
        netif_carrier_off(dev);
        priv->last_linkstatus = 0xffff;
@@ -1762,10 +1763,7 @@ void orinoco_reset(struct work_struct *work)
        orinoco_unlock(priv, &flags);
        /* Scanning support: Notify scan cancellation */
-        if (priv->scan_request) {
+        orinoco_scan_done(priv, true);
-                cfg80211_scan_done(priv->scan_request, 1);
-                priv->scan_request = NULL;
-        }
        if (priv->hard_reset) {
                err = (*priv->hard_reset)(priv);
@@ -1813,6 +1811,12 @@ static int __orinoco_commit(struct orinoco_private *priv)
        struct net_device *dev = priv->ndev;
        int err = 0;
+        /* If we've called commit, we are reconfiguring or bringing the
+         * interface up. Maintaining countermeasures across this would
+         * be confusing, so note that we've disabled them. The port will
+         * be enabled later in orinoco_commit or __orinoco_up. */
+        priv->tkip_cm_active = 0;
        err = orinoco_hw_program_rids(priv);
        /* FIXME: what about netif_tx_lock */
diff --git a/drivers/net/wireless/orinoco/orinoco_cs.c b/drivers/net/wireless/orinoco/orinoco_cs.c
index 71b3d68b9403..32954c4b243a 100644
--- a/drivers/net/wireless/orinoco/orinoco_cs.c
+++ b/drivers/net/wireless/orinoco/orinoco_cs.c
@@ -151,20 +151,20 @@ orinoco_cs_config(struct pcmcia_device *link)
                goto failed;
        }
-        ret = pcmcia_request_irq(link, orinoco_interrupt);
-        if (ret)
-                goto failed;
-        /* We initialize the hermes structure before completing PCMCIA
-         * configuration just in case the interrupt handler gets
-         * called. */
        mem = ioport_map(link->resource[0]->start,
                        resource_size(link->resource[0]));
        if (!mem)
                goto failed;
+        /* We initialize the hermes structure before completing PCMCIA
+         * configuration just in case the interrupt handler gets
+         * called. */
        hermes_struct_init(hw, mem, HERMES_16BIT_REGSPACING);
+        ret = pcmcia_request_irq(link, orinoco_interrupt);
+        if (ret)
+                goto failed;
        ret = pcmcia_enable_device(link);
        if (ret)
                goto failed;
diff --git a/drivers/net/wireless/orinoco/orinoco_usb.c b/drivers/net/wireless/orinoco/orinoco_usb.c
index a38a7bd25f19..b9aedf18a046 100644
--- a/drivers/net/wireless/orinoco/orinoco_usb.c
+++ b/drivers/net/wireless/orinoco/orinoco_usb.c
@@ -57,7 +57,6 @@
 #include <linux/fcntl.h>
 #include <linux/spinlock.h>
 #include <linux/list.h>
-#include <linux/smp_lock.h>
 #include <linux/usb.h>
 #include <linux/timer.h>
diff --git a/drivers/net/wireless/orinoco/scan.c b/drivers/net/wireless/orinoco/scan.c
index 4300d9db7d8c..86cb54c842e7 100644
--- a/drivers/net/wireless/orinoco/scan.c
+++ b/drivers/net/wireless/orinoco/scan.c
@@ -229,3 +229,11 @@ void orinoco_add_hostscan_results(struct orinoco_private *priv,
                priv->scan_request = NULL;
        }
 }
+void orinoco_scan_done(struct orinoco_private *priv, bool abort)
+{
+        if (priv->scan_request) {
+                cfg80211_scan_done(priv->scan_request, abort);
+                priv->scan_request = NULL;
+        }
+}
diff --git a/drivers/net/wireless/orinoco/scan.h b/drivers/net/wireless/orinoco/scan.h
index 2dc4e046dbdb..27281fb0a6dc 100644
--- a/drivers/net/wireless/orinoco/scan.h
+++ b/drivers/net/wireless/orinoco/scan.h
@@ -16,5 +16,6 @@ void orinoco_add_extscan_result(struct orinoco_private *priv,
 void orinoco_add_hostscan_results(struct orinoco_private *dev,
                                  unsigned char *buf,
                                  size_t len);
+void orinoco_scan_done(struct orinoco_private *priv, bool abort);
 #endif /* _ORINOCO_SCAN_H_ */
diff --git a/drivers/net/wireless/orinoco/spectrum_cs.c b/drivers/net/wireless/orinoco/spectrum_cs.c
index fb859a5ad2eb..db34c282e59b 100644
--- a/drivers/net/wireless/orinoco/spectrum_cs.c
+++ b/drivers/net/wireless/orinoco/spectrum_cs.c
@@ -214,21 +214,21 @@ spectrum_cs_config(struct pcmcia_device *link)
                goto failed;
        }
-        ret = pcmcia_request_irq(link, orinoco_interrupt);
-        if (ret)
-                goto failed;
-        /* We initialize the hermes structure before completing PCMCIA
-         * configuration just in case the interrupt handler gets
-         * called. */
        mem = ioport_map(link->resource[0]->start,
                        resource_size(link->resource[0]));
        if (!mem)
                goto failed;
+        /* We initialize the hermes structure before completing PCMCIA
+         * configuration just in case the interrupt handler gets
+         * called. */
        hermes_struct_init(hw, mem, HERMES_16BIT_REGSPACING);
        hw->eeprom_pda = true;
+        ret = pcmcia_request_irq(link, orinoco_interrupt);
+        if (ret)
+                goto failed;
        ret = pcmcia_enable_device(link);
        if (ret)
                goto failed;
diff --git a/drivers/net/wireless/orinoco/wext.c b/drivers/net/wireless/orinoco/wext.c
index 93505f93bf97..e5afabee60d1 100644
--- a/drivers/net/wireless/orinoco/wext.c
+++ b/drivers/net/wireless/orinoco/wext.c
@@ -911,10 +911,10 @@ static int orinoco_ioctl_set_auth(struct net_device *dev,
                 */
                if (param->value) {
                        priv->tkip_cm_active = 1;
-                        ret = hermes_enable_port(hw, 0);
+                        ret = hermes_disable_port(hw, 0);
                } else {
                        priv->tkip_cm_active = 0;
-                        ret = hermes_disable_port(hw, 0);
+                        ret = hermes_enable_port(hw, 0);
                }
                break;
diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
index 458bb57914a3..cdbeec9f83ea 100644
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -66,8 +66,8 @@ struct netfront_cb {
 #define GRANT_INVALID_REF       0
-#define NET_TX_RING_SIZE __RING_SIZE((struct xen_netif_tx_sring *)0, PAGE_SIZE)
+#define NET_TX_RING_SIZE __CONST_RING_SIZE(xen_netif_tx, PAGE_SIZE)
-#define NET_RX_RING_SIZE __RING_SIZE((struct xen_netif_rx_sring *)0, PAGE_SIZE)
+#define NET_RX_RING_SIZE __CONST_RING_SIZE(xen_netif_rx, PAGE_SIZE)
 #define TX_MAX_TARGET min_t(int, NET_RX_RING_SIZE, 256)
 struct netfront_info {