10 files changed, 85 insertions, 17 deletions

diff --git a/drivers/isdn/hardware/avm/b1isa.c b/drivers/isdn/hardware/avm/b1isa.c
index 1e288eeb5e2a..6461a32bc838 100644
--- a/drivers/isdn/hardware/avm/b1isa.c
+++ b/drivers/isdn/hardware/avm/b1isa.c
@@ -233,10 +233,8 @@ static void __exit b1isa_exit(void)
         int i;
 
         for (i = 0; i < MAX_CARDS; i++) {
-                if (!io[i])
-                        break;
-
-                b1isa_remove(&isa_dev[i]);
+                if (isa_dev[i].resource[0].start)
+                        b1isa_remove(&isa_dev[i]);
         }
         unregister_capi_driver(&capi_driver_b1isa);
 }
diff --git a/drivers/isdn/hysdn/hysdn_net.c b/drivers/isdn/hysdn/hysdn_net.c
index 5b4ae67339af..7ee5bd9f2bb4 100644
--- a/drivers/isdn/hysdn/hysdn_net.c
+++ b/drivers/isdn/hysdn/hysdn_net.c
@@ -83,12 +83,12 @@ net_open(struct net_device *dev)
 
         /* Fill in the MAC-level header (if not already set) */
         if (!card->mac_addr[0]) {
-                for (i = 0; i < ETH_ALEN - sizeof(unsigned long); i++)
+                for (i = 0; i < ETH_ALEN; i++)
                         dev->dev_addr[i] = 0xfc;
                 if ((in_dev = dev->ip_ptr) != NULL) {
                         struct in_ifaddr *ifa = in_dev->ifa_list;
                         if (ifa != NULL)
-                                memcpy(dev->dev_addr + (ETH_ALEN - sizeof(unsigned long)), &ifa->ifa_local, sizeof(unsigned long));
+                                memcpy(dev->dev_addr + (ETH_ALEN - sizeof(ifa->ifa_local)), &ifa->ifa_local, sizeof(ifa->ifa_local));
                 }
         } else
                 memcpy(dev->dev_addr, card->mac_addr, ETH_ALEN);
diff --git a/drivers/net/bnx2.c b/drivers/net/bnx2.c
index 182f2410c23d..0e2218dadb3d 100644
--- a/drivers/net/bnx2.c
+++ b/drivers/net/bnx2.c
@@ -3147,6 +3147,28 @@ bnx2_has_work(struct bnx2_napi *bnapi)
         return 0;
 }
 
+static void
+bnx2_chk_missed_msi(struct bnx2 *bp)
+{
+        struct bnx2_napi *bnapi = &bp->bnx2_napi[0];
+        u32 msi_ctrl;
+
+        if (bnx2_has_work(bnapi)) {
+                msi_ctrl = REG_RD(bp, BNX2_PCICFG_MSI_CONTROL);
+                if (!(msi_ctrl & BNX2_PCICFG_MSI_CONTROL_ENABLE))
+                        return;
+
+                if (bnapi->last_status_idx == bp->idle_chk_status_idx) {
+                        REG_WR(bp, BNX2_PCICFG_MSI_CONTROL, msi_ctrl &
+                               ~BNX2_PCICFG_MSI_CONTROL_ENABLE);
+                        REG_WR(bp, BNX2_PCICFG_MSI_CONTROL, msi_ctrl);
+                        bnx2_msi(bp->irq_tbl[0].vector, bnapi);
+                }
+        }
+
+        bp->idle_chk_status_idx = bnapi->last_status_idx;
+}
+
 static void bnx2_poll_link(struct bnx2 *bp, struct bnx2_napi *bnapi)
 {
         struct status_block *sblk = bnapi->status_blk.msi;
@@ -3221,14 +3243,15 @@ static int bnx2_poll(struct napi_struct *napi, int budget)
 
                 work_done = bnx2_poll_work(bp, bnapi, work_done, budget);
 
-                if (unlikely(work_done >= budget))
-                        break;
-
                 /* bnapi->last_status_idx is used below to tell the hw how
                  * much work has been processed, so we must read it before
                  * checking for more work.
                  */
                 bnapi->last_status_idx = sblk->status_idx;
+
+                if (unlikely(work_done >= budget))
+                        break;
+
                 rmb();
                 if (likely(!bnx2_has_work(bnapi))) {
                         netif_rx_complete(bp->dev, napi);
@@ -4581,6 +4604,8 @@ bnx2_init_chip(struct bnx2 *bp)
         for (i = 0; i < BNX2_MAX_MSIX_VEC; i++)
                 bp->bnx2_napi[i].last_status_idx = 0;
 
+        bp->idle_chk_status_idx = 0xffff;
+
         bp->rx_mode = BNX2_EMAC_RX_MODE_SORT_MODE;
 
         /* Set up how to generate a link change interrupt. */
@@ -5729,6 +5754,10 @@ bnx2_timer(unsigned long data)
         if (atomic_read(&bp->intr_sem) != 0)
                 goto bnx2_restart_timer;
 
+        if ((bp->flags & (BNX2_FLAG_USING_MSI | BNX2_FLAG_ONE_SHOT_MSI)) ==
+             BNX2_FLAG_USING_MSI)
+                bnx2_chk_missed_msi(bp);
+
         bnx2_send_heart_beat(bp);
 
         bp->stats_blk->stat_FwRxDrop =
diff --git a/drivers/net/bnx2.h b/drivers/net/bnx2.h
index 0763108fa1c5..2f43c45b7ad6 100644
--- a/drivers/net/bnx2.h
+++ b/drivers/net/bnx2.h
@@ -378,6 +378,9 @@ struct l2_fhdr {
  *  pci_config_l definition
  *  offset: 0000
  */
+#define BNX2_PCICFG_MSI_CONTROL                         0x00000058
+#define BNX2_PCICFG_MSI_CONTROL_ENABLE                   (1L<<16)
+
 #define BNX2_PCICFG_MISC_CONFIG                         0x00000068
 #define BNX2_PCICFG_MISC_CONFIG_TARGET_BYTE_SWAP         (1L<<2)
 #define BNX2_PCICFG_MISC_CONFIG_TARGET_MB_WORD_SWAP      (1L<<3)
@@ -6882,6 +6885,9 @@ struct bnx2 {
 
         u8                      num_tx_rings;
         u8                      num_rx_rings;
+
+        u32                     idle_chk_status_idx;
+
 };
 
 #define REG_RD(bp, offset)                                      \
diff --git a/drivers/net/enc28j60.c b/drivers/net/enc28j60.c
index 32c19790d013..d3c8e742e9ea 100644
--- a/drivers/net/enc28j60.c
+++ b/drivers/net/enc28j60.c
@@ -566,6 +566,17 @@ static u16 erxrdpt_workaround(u16 next_packet_ptr, u16 start, u16 end)
         return erxrdpt;
 }
 
+/*
+ * Calculate wrap around when reading beyond the end of the RX buffer
+ */
+static u16 rx_packet_start(u16 ptr)
+{
+        if (ptr + RSV_SIZE > RXEND_INIT)
+                return (ptr + RSV_SIZE) - (RXEND_INIT - RXSTART_INIT + 1);
+        else
+                return ptr + RSV_SIZE;
+}
+
 static void nolock_rxfifo_init(struct enc28j60_net *priv, u16 start, u16 end)
 {
         u16 erxrdpt;
@@ -936,8 +947,9 @@ static void enc28j60_hw_rx(struct net_device *ndev)
                         skb->dev = ndev;
                         skb_reserve(skb, NET_IP_ALIGN);
                         /* copy the packet from the receive buffer */
-                        enc28j60_mem_read(priv, priv->next_pk_ptr + sizeof(rsv),
-                                        len, skb_put(skb, len));
+                        enc28j60_mem_read(priv,
+                                rx_packet_start(priv->next_pk_ptr),
+                                len, skb_put(skb, len));
                         if (netif_msg_pktdata(priv))
                                 dump_packet(__func__, skb->len, skb->data);
                         skb->protocol = eth_type_trans(skb, ndev);
diff --git a/drivers/net/netx-eth.c b/drivers/net/netx-eth.c
index b418771f6811..1861d5bbd96b 100644
--- a/drivers/net/netx-eth.c
+++ b/drivers/net/netx-eth.c
@@ -400,6 +400,8 @@ static int netx_eth_drv_probe(struct platform_device *pdev)
         priv->xmac_base = priv->xc->xmac_base;
         priv->sram_base = priv->xc->sram_base;
 
+        spin_lock_init(&priv->lock);
+
         ret = pfifo_request(PFIFO_MASK(priv->id));
         if (ret) {
                 printk("unable to request PFIFO\n");
diff --git a/drivers/net/wireless/ipw2x00/ipw2200.c b/drivers/net/wireless/ipw2x00/ipw2200.c
index 48fa6df3a774..23728eb6110a 100644
--- a/drivers/net/wireless/ipw2x00/ipw2200.c
+++ b/drivers/net/wireless/ipw2x00/ipw2200.c
@@ -3895,6 +3895,7 @@ static int ipw_disassociate(void *data)
         if (!(priv->status & (STATUS_ASSOCIATED | STATUS_ASSOCIATING)))
                 return 0;
         ipw_send_disassociate(data, 0);
+        netif_carrier_off(priv->net_dev);
         return 1;
 }
 
@@ -10155,6 +10156,9 @@ static int ipw_tx_skb(struct ipw_priv *priv, struct ieee80211_txb *txb,
         u16 remaining_bytes;
         int fc;
 
+        if (!(priv->status & STATUS_ASSOCIATED))
+                goto drop;
+
         hdr_len = ieee80211_get_hdrlen(le16_to_cpu(hdr->frame_ctl));
         switch (priv->ieee->iw_mode) {
         case IW_MODE_ADHOC:
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.c b/drivers/net/wireless/iwlwifi/iwl-core.c
index 1b021ca74e25..d00dfe4edc3b 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.c
+++ b/drivers/net/wireless/iwlwifi/iwl-core.c
@@ -238,7 +238,6 @@ int iwl_hw_nic_init(struct iwl_priv *priv)
 }
 EXPORT_SYMBOL(iwl_hw_nic_init);
 
-
 void iwl_reset_qos(struct iwl_priv *priv)
 {
         u16 cw_min = 15;
diff --git a/drivers/net/wireless/iwlwifi/iwl-sta.c b/drivers/net/wireless/iwlwifi/iwl-sta.c
index f86a8ca2aa3b..4a2479a1622a 100644
--- a/drivers/net/wireless/iwlwifi/iwl-sta.c
+++ b/drivers/net/wireless/iwlwifi/iwl-sta.c
@@ -494,7 +494,7 @@ static int iwl_get_free_ucode_key_index(struct iwl_priv *priv)
                 if (!test_and_set_bit(i, &priv->ucode_key_table))
                         return i;
 
-        return -1;
+        return WEP_INVALID_OFFSET;
 }
 
 int iwl_send_static_wepkey_cmd(struct iwl_priv *priv, u8 send_if_empty)
@@ -639,6 +639,9 @@ static int iwl_set_wep_dynamic_key_info(struct iwl_priv *priv,
         /* else, we are overriding an existing key => no need to allocated room
          * in uCode. */
 
+        WARN(priv->stations[sta_id].sta.key.key_offset == WEP_INVALID_OFFSET,
+                "no space for new kew");
+
         priv->stations[sta_id].sta.key.key_flags = key_flags;
         priv->stations[sta_id].sta.sta.modify_mask = STA_MODIFY_KEY_MASK;
         priv->stations[sta_id].sta.mode = STA_CONTROL_MODIFY_MSK;
@@ -656,6 +659,7 @@ static int iwl_set_ccmp_dynamic_key_info(struct iwl_priv *priv,
 {
         unsigned long flags;
         __le16 key_flags = 0;
+        int ret;
 
         key_flags |= (STA_KEY_FLG_CCMP | STA_KEY_FLG_MAP_KEY_MSK);
         key_flags |= cpu_to_le16(keyconf->keyidx << STA_KEY_FLG_KEYID_POS);
@@ -683,14 +687,18 @@ static int iwl_set_ccmp_dynamic_key_info(struct iwl_priv *priv,
         /* else, we are overriding an existing key => no need to allocated room
          * in uCode. */
 
+        WARN(priv->stations[sta_id].sta.key.key_offset == WEP_INVALID_OFFSET,
+                "no space for new kew");
+
         priv->stations[sta_id].sta.key.key_flags = key_flags;
         priv->stations[sta_id].sta.sta.modify_mask = STA_MODIFY_KEY_MASK;
         priv->stations[sta_id].sta.mode = STA_CONTROL_MODIFY_MSK;
 
+        ret = iwl_send_add_sta(priv, &priv->stations[sta_id].sta, CMD_ASYNC);
+
         spin_unlock_irqrestore(&priv->sta_lock, flags);
 
-        IWL_DEBUG_INFO("hwcrypto: modify ucode station key info\n");
-        return iwl_send_add_sta(priv, &priv->stations[sta_id].sta, CMD_ASYNC);
+        return ret;
 }
 
 static int iwl_set_tkip_dynamic_key_info(struct iwl_priv *priv,
@@ -715,7 +723,10 @@ static int iwl_set_tkip_dynamic_key_info(struct iwl_priv *priv,
         /* else, we are overriding an existing key => no need to allocated room
          * in uCode. */
 
-        /* This copy is actually not needed: we get the key with each TX */
+        WARN(priv->stations[sta_id].sta.key.key_offset == WEP_INVALID_OFFSET,
+                "no space for new kew");
+
+        /* This copy is acutally not needed: we get the key with each TX */
         memcpy(priv->stations[sta_id].keyinfo.key, keyconf->key, 16);
 
         memcpy(priv->stations[sta_id].sta.key.key, keyconf->key, 16);
@@ -802,6 +813,13 @@ int iwl_remove_dynamic_key(struct iwl_priv *priv,
                 return 0;
         }
 
+        if (priv->stations[sta_id].sta.key.key_offset == WEP_INVALID_OFFSET) {
+                IWL_WARNING("Removing wrong key %d 0x%x\n",
+                            keyconf->keyidx, key_flags);
+                spin_unlock_irqrestore(&priv->sta_lock, flags);
+                return 0;
+        }
+
         if (!test_and_clear_bit(priv->stations[sta_id].sta.key.key_offset,
                 &priv->ucode_key_table))
                 IWL_ERROR("index %d not used in uCode key table.\n",
diff --git a/drivers/net/wireless/zd1211rw/zd_mac.c b/drivers/net/wireless/zd1211rw/zd_mac.c
index 07513e48b8f2..9caa96a13586 100644
--- a/drivers/net/wireless/zd1211rw/zd_mac.c
+++ b/drivers/net/wireless/zd1211rw/zd_mac.c
@@ -615,7 +615,7 @@ static int filter_ack(struct ieee80211_hw *hw, struct ieee80211_hdr *rx_hdr,
                 struct ieee80211_hdr *tx_hdr;
 
                 tx_hdr = (struct ieee80211_hdr *)skb->data;
-                if (likely(!compare_ether_addr(tx_hdr->addr2, rx_hdr->addr1)))
+                if (likely(!memcmp(tx_hdr->addr2, rx_hdr->addr1, ETH_ALEN)))
                 {
                         __skb_unlink(skb, q);
                         tx_status(hw, skb, stats->signal, 1);