Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (34 commits)
  virtio_net: Add schedule check to napi_enable call
  x25: Do not reference freed memory.
  pch_can: fix tseg1/tseg2 setting issue
  isdn: hysdn: Kill (partially buggy) CVS regision log reporting.
  can: softing_cs needs slab.h
  pch_gbe: Fix the issue which a driver locks when rx offload is set by ethtool
  netfilter: nf_conntrack: set conntrack templates again if we return NF_REPEAT
  pch_can: fix module reload issue with MSI
  pch_can: fix rmmod issue
  pch_can: fix 800k comms issue
  net: Fix lockdep regression caused by initializing netdev queues too early.
  net/caif: Fix dangling list pointer in freed object on error.
  USB CDC NCM errata updates for cdc_ncm host driver
  CDC NCM errata updates for cdc.h
  ixgbe: update version string
  ixgbe: cleanup variable initialization
  ixgbe: limit VF access to network traffic
  ixgbe: fix for 82599 erratum on Header Splitting
  ixgbe: fix variable set but not used warnings by gcc 4.6
  e1000: add support for Marvell Alaska M88E1118R PHY
  ...

23 files changed, 240 insertions, 129 deletions

diff --git a/drivers/net/benet/be_cmds.c b/drivers/net/benet/be_cmds.c
index 0c7811faf72c..a179cc6d79f2 100644
--- a/drivers/net/benet/be_cmds.c
+++ b/drivers/net/benet/be_cmds.c
@@ -1786,6 +1786,10 @@ int be_cmd_get_seeprom_data(struct be_adapter *adapter,
         spin_lock_bh(&adapter->mcc_lock);
 
         wrb = wrb_from_mccq(adapter);
+        if (!wrb) {
+                status = -EBUSY;
+                goto err;
+        }
         req = nonemb_cmd->va;
         sge = nonembedded_sgl(wrb);
 
@@ -1801,6 +1805,7 @@ int be_cmd_get_seeprom_data(struct be_adapter *adapter,
 
         status = be_mcc_notify_wait(adapter);
 
+err:
         spin_unlock_bh(&adapter->mcc_lock);
         return status;
 }
diff --git a/drivers/net/bnx2x/bnx2x_main.c b/drivers/net/bnx2x/bnx2x_main.c
index f40740e68ea5..d584d32c747d 100644
--- a/drivers/net/bnx2x/bnx2x_main.c
+++ b/drivers/net/bnx2x/bnx2x_main.c
@@ -4276,9 +4276,12 @@ void bnx2x_set_storm_rx_mode(struct bnx2x *bp)
                 def_q_filters |= BNX2X_ACCEPT_UNICAST | BNX2X_ACCEPT_BROADCAST |
                                 BNX2X_ACCEPT_MULTICAST;
 #ifdef BCM_CNIC
-                cl_id = bnx2x_fcoe(bp, cl_id);
-                bnx2x_rxq_set_mac_filters(bp, cl_id, BNX2X_ACCEPT_UNICAST |
-                                          BNX2X_ACCEPT_MULTICAST);
+                if (!NO_FCOE(bp)) {
+                        cl_id = bnx2x_fcoe(bp, cl_id);
+                        bnx2x_rxq_set_mac_filters(bp, cl_id,
+                                                  BNX2X_ACCEPT_UNICAST |
+                                                  BNX2X_ACCEPT_MULTICAST);
+                }
 #endif
                 break;
 
@@ -4286,18 +4289,29 @@ void bnx2x_set_storm_rx_mode(struct bnx2x *bp)
                 def_q_filters |= BNX2X_ACCEPT_UNICAST | BNX2X_ACCEPT_BROADCAST |
                                 BNX2X_ACCEPT_ALL_MULTICAST;
 #ifdef BCM_CNIC
-                cl_id = bnx2x_fcoe(bp, cl_id);
-                bnx2x_rxq_set_mac_filters(bp, cl_id, BNX2X_ACCEPT_UNICAST |
-                                          BNX2X_ACCEPT_MULTICAST);
+                /*
+                 *  Prevent duplication of multicast packets by configuring FCoE
+                 *  L2 Client to receive only matched unicast frames.
+                 */
+                if (!NO_FCOE(bp)) {
+                        cl_id = bnx2x_fcoe(bp, cl_id);
+                        bnx2x_rxq_set_mac_filters(bp, cl_id,
+                                                  BNX2X_ACCEPT_UNICAST);
+                }
 #endif
                 break;
 
         case BNX2X_RX_MODE_PROMISC:
                 def_q_filters |= BNX2X_PROMISCUOUS_MODE;
 #ifdef BCM_CNIC
-                cl_id = bnx2x_fcoe(bp, cl_id);
-                bnx2x_rxq_set_mac_filters(bp, cl_id, BNX2X_ACCEPT_UNICAST |
-                                          BNX2X_ACCEPT_MULTICAST);
+                /*
+                 *  Prevent packets duplication by configuring DROP_ALL for FCoE
+                 *  L2 Client.
+                 */
+                if (!NO_FCOE(bp)) {
+                        cl_id = bnx2x_fcoe(bp, cl_id);
+                        bnx2x_rxq_set_mac_filters(bp, cl_id, BNX2X_ACCEPT_NONE);
+                }
 #endif
                 /* pass management unicast packets as well */
                 llh_mask |= NIG_LLH0_BRB1_DRV_MASK_REG_LLH0_BRB1_DRV_MASK_UNCST;
diff --git a/drivers/net/can/pch_can.c b/drivers/net/can/pch_can.c
index c42e97268248..e54712b22c27 100644
--- a/drivers/net/can/pch_can.c
+++ b/drivers/net/can/pch_can.c
@@ -185,7 +185,7 @@ struct pch_can_priv {
 
 static struct can_bittiming_const pch_can_bittiming_const = {
         .name = KBUILD_MODNAME,
-        .tseg1_min = 1,
+        .tseg1_min = 2,
         .tseg1_max = 16,
         .tseg2_min = 1,
         .tseg2_max = 8,
@@ -959,13 +959,13 @@ static void __devexit pch_can_remove(struct pci_dev *pdev)
         struct pch_can_priv *priv = netdev_priv(ndev);
 
         unregister_candev(priv->ndev);
-        pci_iounmap(pdev, priv->regs);
         if (priv->use_msi)
                 pci_disable_msi(priv->dev);
         pci_release_regions(pdev);
         pci_disable_device(pdev);
         pci_set_drvdata(pdev, NULL);
         pch_can_reset(priv);
+        pci_iounmap(pdev, priv->regs);
         free_candev(priv->ndev);
 }
 
@@ -1238,6 +1238,7 @@ static int __devinit pch_can_probe(struct pci_dev *pdev,
                 priv->use_msi = 0;
         } else {
                 netdev_err(ndev, "PCH CAN opened with MSI\n");
+                pci_set_master(pdev);
                 priv->use_msi = 1;
         }
 
diff --git a/drivers/net/can/softing/softing_cs.c b/drivers/net/can/softing/softing_cs.c
index 300fe75dd1a7..c11bb4de8630 100644
--- a/drivers/net/can/softing/softing_cs.c
+++ b/drivers/net/can/softing/softing_cs.c
@@ -19,6 +19,7 @@
 
 #include <linux/module.h>
 #include <linux/kernel.h>
+#include <linux/slab.h>
 
 #include <pcmcia/cistpl.h>
 #include <pcmcia/ds.h>
diff --git a/drivers/net/e1000/e1000_hw.c b/drivers/net/e1000/e1000_hw.c
index aed223b1b897..7501d977d992 100644
--- a/drivers/net/e1000/e1000_hw.c
+++ b/drivers/net/e1000/e1000_hw.c
@@ -124,6 +124,7 @@ static s32 e1000_set_phy_type(struct e1000_hw *hw)
         case M88E1000_I_PHY_ID:
         case M88E1011_I_PHY_ID:
         case M88E1111_I_PHY_ID:
+        case M88E1118_E_PHY_ID:
                 hw->phy_type = e1000_phy_m88;
                 break;
         case IGP01E1000_I_PHY_ID:
@@ -3222,7 +3223,8 @@ static s32 e1000_detect_gig_phy(struct e1000_hw *hw)
                 break;
         case e1000_ce4100:
                 if ((hw->phy_id == RTL8211B_PHY_ID) ||
-                    (hw->phy_id == RTL8201N_PHY_ID))
+                    (hw->phy_id == RTL8201N_PHY_ID) ||
+                    (hw->phy_id == M88E1118_E_PHY_ID))
                         match = true;
                 break;
         case e1000_82541:
diff --git a/drivers/net/e1000/e1000_hw.h b/drivers/net/e1000/e1000_hw.h
index 196eeda2dd6c..c70b23d52284 100644
--- a/drivers/net/e1000/e1000_hw.h
+++ b/drivers/net/e1000/e1000_hw.h
@@ -2917,6 +2917,7 @@ struct e1000_host_command_info {
 #define M88E1000_14_PHY_ID M88E1000_E_PHY_ID
 #define M88E1011_I_REV_4   0x04
 #define M88E1111_I_PHY_ID  0x01410CC0
+#define M88E1118_E_PHY_ID  0x01410E40
 #define L1LXT971A_PHY_ID   0x001378E0
 
 #define RTL8211B_PHY_ID    0x001CC910
diff --git a/drivers/net/e1000e/netdev.c b/drivers/net/e1000e/netdev.c
index 1c18f26b0812..3065870cf2a7 100644
--- a/drivers/net/e1000e/netdev.c
+++ b/drivers/net/e1000e/netdev.c
@@ -4309,7 +4309,6 @@ link_up:
                          * to get done, so reset controller to flush Tx.
                          * (Do the reset outside of interrupt context).
                          */
-                        adapter->tx_timeout_count++;
                         schedule_work(&adapter->reset_task);
                         /* return immediately since reset is imminent */
                         return;
diff --git a/drivers/net/ixgbe/ixgbe_common.c b/drivers/net/ixgbe/ixgbe_common.c
index d5ede2df3e42..ebbda7d15254 100644
--- a/drivers/net/ixgbe/ixgbe_common.c
+++ b/drivers/net/ixgbe/ixgbe_common.c
@@ -1370,6 +1370,9 @@ s32 ixgbe_init_rx_addrs_generic(struct ixgbe_hw *hw)
                 hw_dbg(hw, " New MAC Addr =%pM\n", hw->mac.addr);
 
                 hw->mac.ops.set_rar(hw, 0, hw->mac.addr, 0, IXGBE_RAH_AV);
+
+                /*  clear VMDq pool/queue selection for RAR 0 */
+                hw->mac.ops.clear_vmdq(hw, 0, IXGBE_CLEAR_VMDQ_ALL);
         }
         hw->addr_ctrl.overflow_promisc = 0;
 
diff --git a/drivers/net/ixgbe/ixgbe_fcoe.c b/drivers/net/ixgbe/ixgbe_fcoe.c
index 6342d4859790..8753980668c7 100644
--- a/drivers/net/ixgbe/ixgbe_fcoe.c
+++ b/drivers/net/ixgbe/ixgbe_fcoe.c
@@ -165,7 +165,7 @@ int ixgbe_fcoe_ddp_get(struct net_device *netdev, u16 xid,
         unsigned int thisoff = 0;
         unsigned int thislen = 0;
         u32 fcbuff, fcdmarw, fcfltrw;
-        dma_addr_t addr;
+        dma_addr_t addr = 0;
 
         if (!netdev || !sgl)
                 return 0;
diff --git a/drivers/net/ixgbe/ixgbe_main.c b/drivers/net/ixgbe/ixgbe_main.c
index 602078b84892..fbae703b46d7 100644
--- a/drivers/net/ixgbe/ixgbe_main.c
+++ b/drivers/net/ixgbe/ixgbe_main.c
@@ -52,7 +52,7 @@ char ixgbe_driver_name[] = "ixgbe";
 static const char ixgbe_driver_string[] =
                               "Intel(R) 10 Gigabit PCI Express Network Driver";
 
-#define DRV_VERSION "3.0.12-k2"
+#define DRV_VERSION "3.2.9-k2"
 const char ixgbe_driver_version[] = DRV_VERSION;
 static char ixgbe_copyright[] = "Copyright (c) 1999-2010 Intel Corporation.";
 
@@ -3176,9 +3176,16 @@ static void ixgbe_set_rx_buffer_len(struct ixgbe_adapter *adapter)
         u32 mhadd, hlreg0;
 
         /* Decide whether to use packet split mode or not */
+        /* On by default */
+        adapter->flags |= IXGBE_FLAG_RX_PS_ENABLED;
+
         /* Do not use packet split if we're in SR-IOV Mode */
-        if (!adapter->num_vfs)
-                adapter->flags |= IXGBE_FLAG_RX_PS_ENABLED;
+        if (adapter->num_vfs)
+                adapter->flags &= ~IXGBE_FLAG_RX_PS_ENABLED;
+
+        /* Disable packet split due to 82599 erratum #45 */
+        if (hw->mac.type == ixgbe_mac_82599EB)
+                adapter->flags &= ~IXGBE_FLAG_RX_PS_ENABLED;
 
         /* Set the RX buffer length according to the mode */
         if (adapter->flags & IXGBE_FLAG_RX_PS_ENABLED) {
@@ -4863,16 +4870,13 @@ static int ixgbe_alloc_q_vectors(struct ixgbe_adapter *adapter)
 {
         int q_idx, num_q_vectors;
         struct ixgbe_q_vector *q_vector;
-        int napi_vectors;
         int (*poll)(struct napi_struct *, int);
 
         if (adapter->flags & IXGBE_FLAG_MSIX_ENABLED) {
                 num_q_vectors = adapter->num_msix_vectors - NON_Q_VECTORS;
-                napi_vectors = adapter->num_rx_queues;
                 poll = &ixgbe_clean_rxtx_many;
         } else {
                 num_q_vectors = 1;
-                napi_vectors = 1;
                 poll = &ixgbe_poll;
         }
 
diff --git a/drivers/net/ixgbe/ixgbe_sriov.c b/drivers/net/ixgbe/ixgbe_sriov.c
index 47b15738b009..187b3a16ec1f 100644
--- a/drivers/net/ixgbe/ixgbe_sriov.c
+++ b/drivers/net/ixgbe/ixgbe_sriov.c
@@ -110,12 +110,10 @@ static int ixgbe_set_vf_vlan(struct ixgbe_adapter *adapter, int add, int vid,
         return adapter->hw.mac.ops.set_vfta(&adapter->hw, vid, vf, (bool)add);
 }
 
-
 static void ixgbe_set_vmolr(struct ixgbe_hw *hw, u32 vf, bool aupe)
 {
         u32 vmolr = IXGBE_READ_REG(hw, IXGBE_VMOLR(vf));
         vmolr |= (IXGBE_VMOLR_ROMPE |
-                  IXGBE_VMOLR_ROPE |
                   IXGBE_VMOLR_BAM);
         if (aupe)
                 vmolr |= IXGBE_VMOLR_AUPE;
diff --git a/drivers/net/ixgbe/ixgbe_x540.c b/drivers/net/ixgbe/ixgbe_x540.c
index 3a8923993ce3..f2518b01067d 100644
--- a/drivers/net/ixgbe/ixgbe_x540.c
+++ b/drivers/net/ixgbe/ixgbe_x540.c
@@ -133,17 +133,17 @@ static s32 ixgbe_reset_hw_X540(struct ixgbe_hw *hw)
         }
 
         ctrl = IXGBE_READ_REG(hw, IXGBE_CTRL);
-        IXGBE_WRITE_REG(hw, IXGBE_CTRL, (ctrl | IXGBE_CTRL_RST));
+        IXGBE_WRITE_REG(hw, IXGBE_CTRL, (ctrl | reset_bit));
         IXGBE_WRITE_FLUSH(hw);
 
         /* Poll for reset bit to self-clear indicating reset is complete */
         for (i = 0; i < 10; i++) {
                 udelay(1);
                 ctrl = IXGBE_READ_REG(hw, IXGBE_CTRL);
-                if (!(ctrl & IXGBE_CTRL_RST))
+                if (!(ctrl & reset_bit))
                         break;
         }
-        if (ctrl & IXGBE_CTRL_RST) {
+        if (ctrl & reset_bit) {
                 status = IXGBE_ERR_RESET_FAILED;
                 hw_dbg(hw, "Reset polling failed to complete.\n");
         }
diff --git a/drivers/net/pch_gbe/pch_gbe_main.c b/drivers/net/pch_gbe/pch_gbe_main.c
index 1bf12339441b..4c9a7d4f3fca 100644
--- a/drivers/net/pch_gbe/pch_gbe_main.c
+++ b/drivers/net/pch_gbe/pch_gbe_main.c
@@ -519,7 +519,9 @@ static void pch_gbe_reset_task(struct work_struct *work)
         struct pch_gbe_adapter *adapter;
         adapter = container_of(work, struct pch_gbe_adapter, reset_task);
 
+        rtnl_lock();
         pch_gbe_reinit_locked(adapter);
+        rtnl_unlock();
 }
 
 /**
@@ -528,14 +530,8 @@ static void pch_gbe_reset_task(struct work_struct *work)
  */
 void pch_gbe_reinit_locked(struct pch_gbe_adapter *adapter)
 {
-        struct net_device *netdev = adapter->netdev;
-
-        rtnl_lock();
-        if (netif_running(netdev)) {
-                pch_gbe_down(adapter);
-                pch_gbe_up(adapter);
-        }
-        rtnl_unlock();
+        pch_gbe_down(adapter);
+        pch_gbe_up(adapter);
 }
 
 /**
diff --git a/drivers/net/sis900.c b/drivers/net/sis900.c
index 5976d1d51df1..640e368ebeee 100644
--- a/drivers/net/sis900.c
+++ b/drivers/net/sis900.c
@@ -1777,6 +1777,7 @@ static int sis900_rx(struct net_device *net_dev)
                                               "cur_rx:%4.4d, dirty_rx:%4.4d\n",
                                               net_dev->name, sis_priv->cur_rx,
                                               sis_priv->dirty_rx);
+                                dev_kfree_skb(skb);
                                 break;
                         }
 
diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
index 04e8ce14a1d0..7113168473cf 100644
--- a/drivers/net/usb/cdc_ncm.c
+++ b/drivers/net/usb/cdc_ncm.c
@@ -1,7 +1,7 @@
 /*
  * cdc_ncm.c
  *
- * Copyright (C) ST-Ericsson 2010
+ * Copyright (C) ST-Ericsson 2010-2011
  * Contact: Alexey Orishko <alexey.orishko@stericsson.com>
  * Original author: Hans Petter Selasky <hans.petter.selasky@stericsson.com>
  *
@@ -54,7 +54,7 @@
 #include <linux/usb/usbnet.h>
 #include <linux/usb/cdc.h>
 
-#define DRIVER_VERSION                          "17-Jan-2011"
+#define DRIVER_VERSION                          "7-Feb-2011"
 
 /* CDC NCM subclass 3.2.1 */
 #define USB_CDC_NCM_NDP16_LENGTH_MIN            0x10
@@ -77,6 +77,9 @@
  */
 #define CDC_NCM_DPT_DATAGRAMS_MAX               32
 
+/* Maximum amount of IN datagrams in NTB */
+#define CDC_NCM_DPT_DATAGRAMS_IN_MAX            0 /* unlimited */
+
 /* Restart the timer, if amount of datagrams is less than given value */
 #define CDC_NCM_RESTART_TIMER_DATAGRAM_CNT      3
 
@@ -85,11 +88,6 @@
         (sizeof(struct usb_cdc_ncm_nth16) + sizeof(struct usb_cdc_ncm_ndp16) + \
         (CDC_NCM_DPT_DATAGRAMS_MAX + 1) * sizeof(struct usb_cdc_ncm_dpe16))
 
-struct connection_speed_change {
-        __le32  USBitRate; /* holds 3GPP downlink value, bits per second */
-        __le32  DSBitRate; /* holds 3GPP uplink value, bits per second */
-} __attribute__ ((packed));
-
 struct cdc_ncm_data {
         struct usb_cdc_ncm_nth16 nth16;
         struct usb_cdc_ncm_ndp16 ndp16;
@@ -198,10 +196,10 @@ static u8 cdc_ncm_setup(struct cdc_ncm_ctx *ctx)
 {
         struct usb_cdc_notification req;
         u32 val;
-        __le16 max_datagram_size;
         u8 flags;
         u8 iface_no;
         int err;
+        u16 ntb_fmt_supported;
 
         iface_no = ctx->control->cur_altsetting->desc.bInterfaceNumber;
 
@@ -223,6 +221,9 @@ static u8 cdc_ncm_setup(struct cdc_ncm_ctx *ctx)
         ctx->tx_remainder = le16_to_cpu(ctx->ncm_parm.wNdpOutPayloadRemainder);
         ctx->tx_modulus = le16_to_cpu(ctx->ncm_parm.wNdpOutDivisor);
         ctx->tx_ndp_modulus = le16_to_cpu(ctx->ncm_parm.wNdpOutAlignment);
+        /* devices prior to NCM Errata shall set this field to zero */
+        ctx->tx_max_datagrams = le16_to_cpu(ctx->ncm_parm.wNtbOutMaxDatagrams);
+        ntb_fmt_supported = le16_to_cpu(ctx->ncm_parm.bmNtbFormatsSupported);
 
         if (ctx->func_desc != NULL)
                 flags = ctx->func_desc->bmNetworkCapabilities;
@@ -231,22 +232,58 @@ static u8 cdc_ncm_setup(struct cdc_ncm_ctx *ctx)
 
         pr_debug("dwNtbInMaxSize=%u dwNtbOutMaxSize=%u "
                  "wNdpOutPayloadRemainder=%u wNdpOutDivisor=%u "
-                 "wNdpOutAlignment=%u flags=0x%x\n",
+                 "wNdpOutAlignment=%u wNtbOutMaxDatagrams=%u flags=0x%x\n",
                  ctx->rx_max, ctx->tx_max, ctx->tx_remainder, ctx->tx_modulus,
-                 ctx->tx_ndp_modulus, flags);
+                 ctx->tx_ndp_modulus, ctx->tx_max_datagrams, flags);
 
-        /* max count of tx datagrams without terminating NULL entry */
-        ctx->tx_max_datagrams = CDC_NCM_DPT_DATAGRAMS_MAX;
+        /* max count of tx datagrams */
+        if ((ctx->tx_max_datagrams == 0) ||
+                        (ctx->tx_max_datagrams > CDC_NCM_DPT_DATAGRAMS_MAX))
+                ctx->tx_max_datagrams = CDC_NCM_DPT_DATAGRAMS_MAX;
 
         /* verify maximum size of received NTB in bytes */
-        if ((ctx->rx_max <
-            (CDC_NCM_MIN_HDR_SIZE + CDC_NCM_MIN_DATAGRAM_SIZE)) ||
-            (ctx->rx_max > CDC_NCM_NTB_MAX_SIZE_RX)) {
+        if (ctx->rx_max < USB_CDC_NCM_NTB_MIN_IN_SIZE) {
+                pr_debug("Using min receive length=%d\n",
+                                                USB_CDC_NCM_NTB_MIN_IN_SIZE);
+                ctx->rx_max = USB_CDC_NCM_NTB_MIN_IN_SIZE;
+        }
+
+        if (ctx->rx_max > CDC_NCM_NTB_MAX_SIZE_RX) {
                 pr_debug("Using default maximum receive length=%d\n",
                                                 CDC_NCM_NTB_MAX_SIZE_RX);
                 ctx->rx_max = CDC_NCM_NTB_MAX_SIZE_RX;
         }
 
+        /* inform device about NTB input size changes */
+        if (ctx->rx_max != le32_to_cpu(ctx->ncm_parm.dwNtbInMaxSize)) {
+                req.bmRequestType = USB_TYPE_CLASS | USB_DIR_OUT |
+                                                        USB_RECIP_INTERFACE;
+                req.bNotificationType = USB_CDC_SET_NTB_INPUT_SIZE;
+                req.wValue = 0;
+                req.wIndex = cpu_to_le16(iface_no);
+
+                if (flags & USB_CDC_NCM_NCAP_NTB_INPUT_SIZE) {
+                        struct usb_cdc_ncm_ndp_input_size ndp_in_sz;
+
+                        req.wLength = 8;
+                        ndp_in_sz.dwNtbInMaxSize = cpu_to_le32(ctx->rx_max);
+                        ndp_in_sz.wNtbInMaxDatagrams =
+                                        cpu_to_le16(CDC_NCM_DPT_DATAGRAMS_MAX);
+                        ndp_in_sz.wReserved = 0;
+                        err = cdc_ncm_do_request(ctx, &req, &ndp_in_sz, 0, NULL,
+                                                                        1000);
+                } else {
+                        __le32 dwNtbInMaxSize = cpu_to_le32(ctx->rx_max);
+
+                        req.wLength = 4;
+                        err = cdc_ncm_do_request(ctx, &req, &dwNtbInMaxSize, 0,
+                                                                NULL, 1000);
+                }
+
+                if (err)
+                        pr_debug("Setting NTB Input Size failed\n");
+        }
+
         /* verify maximum size of transmitted NTB in bytes */
         if ((ctx->tx_max <
             (CDC_NCM_MIN_HDR_SIZE + CDC_NCM_MIN_DATAGRAM_SIZE)) ||
@@ -297,47 +334,84 @@ static u8 cdc_ncm_setup(struct cdc_ncm_ctx *ctx)
         /* additional configuration */
 
         /* set CRC Mode */
-        req.bmRequestType = USB_TYPE_CLASS | USB_DIR_OUT | USB_RECIP_INTERFACE;
-        req.bNotificationType = USB_CDC_SET_CRC_MODE;
-        req.wValue = cpu_to_le16(USB_CDC_NCM_CRC_NOT_APPENDED);
-        req.wIndex = cpu_to_le16(iface_no);
-        req.wLength = 0;
-
-        err = cdc_ncm_do_request(ctx, &req, NULL, 0, NULL, 1000);
-        if (err)
-                pr_debug("Setting CRC mode off failed\n");
+        if (flags & USB_CDC_NCM_NCAP_CRC_MODE) {
+                req.bmRequestType = USB_TYPE_CLASS | USB_DIR_OUT |
+                                                        USB_RECIP_INTERFACE;
+                req.bNotificationType = USB_CDC_SET_CRC_MODE;
+                req.wValue = cpu_to_le16(USB_CDC_NCM_CRC_NOT_APPENDED);
+                req.wIndex = cpu_to_le16(iface_no);
+                req.wLength = 0;
+
+                err = cdc_ncm_do_request(ctx, &req, NULL, 0, NULL, 1000);
+                if (err)
+                        pr_debug("Setting CRC mode off failed\n");
+        }
 
-        /* set NTB format */
-        req.bmRequestType = USB_TYPE_CLASS | USB_DIR_OUT | USB_RECIP_INTERFACE;
-        req.bNotificationType = USB_CDC_SET_NTB_FORMAT;
-        req.wValue = cpu_to_le16(USB_CDC_NCM_NTB16_FORMAT);
-        req.wIndex = cpu_to_le16(iface_no);
-        req.wLength = 0;
+        /* set NTB format, if both formats are supported */
+        if (ntb_fmt_supported & USB_CDC_NCM_NTH32_SIGN) {
+                req.bmRequestType = USB_TYPE_CLASS | USB_DIR_OUT |
+                                                        USB_RECIP_INTERFACE;
+                req.bNotificationType = USB_CDC_SET_NTB_FORMAT;
+                req.wValue = cpu_to_le16(USB_CDC_NCM_NTB16_FORMAT);
+                req.wIndex = cpu_to_le16(iface_no);
+                req.wLength = 0;
+
+                err = cdc_ncm_do_request(ctx, &req, NULL, 0, NULL, 1000);
+                if (err)
+                        pr_debug("Setting NTB format to 16-bit failed\n");
+        }
 
-        err = cdc_ncm_do_request(ctx, &req, NULL, 0, NULL, 1000);
-        if (err)
-                pr_debug("Setting NTB format to 16-bit failed\n");
+        ctx->max_datagram_size = CDC_NCM_MIN_DATAGRAM_SIZE;
 
         /* set Max Datagram Size (MTU) */
-        req.bmRequestType = USB_TYPE_CLASS | USB_DIR_IN | USB_RECIP_INTERFACE;
-        req.bNotificationType = USB_CDC_GET_MAX_DATAGRAM_SIZE;
-        req.wValue = 0;
-        req.wIndex = cpu_to_le16(iface_no);
-        req.wLength = cpu_to_le16(2);
+        if (flags & USB_CDC_NCM_NCAP_MAX_DATAGRAM_SIZE) {
+                __le16 max_datagram_size;
+                u16 eth_max_sz = le16_to_cpu(ctx->ether_desc->wMaxSegmentSize);
+
+                req.bmRequestType = USB_TYPE_CLASS | USB_DIR_IN |
+                                                        USB_RECIP_INTERFACE;
+                req.bNotificationType = USB_CDC_GET_MAX_DATAGRAM_SIZE;
+                req.wValue = 0;
+                req.wIndex = cpu_to_le16(iface_no);
+                req.wLength = cpu_to_le16(2);
+
+                err = cdc_ncm_do_request(ctx, &req, &max_datagram_size, 0, NULL,
+                                                                        1000);
+                if (err) {
+                        pr_debug("GET_MAX_DATAGRAM_SIZE failed, use size=%u\n",
+                                                CDC_NCM_MIN_DATAGRAM_SIZE);
+                } else {
+                        ctx->max_datagram_size = le16_to_cpu(max_datagram_size);
+                        /* Check Eth descriptor value */
+                        if (eth_max_sz < CDC_NCM_MAX_DATAGRAM_SIZE) {
+                                if (ctx->max_datagram_size > eth_max_sz)
+                                        ctx->max_datagram_size = eth_max_sz;
+                        } else {
+                                if (ctx->max_datagram_size >
+                                                CDC_NCM_MAX_DATAGRAM_SIZE)
+                                        ctx->max_datagram_size =
+                                                CDC_NCM_MAX_DATAGRAM_SIZE;
+                        }
 
-        err = cdc_ncm_do_request(ctx, &req, &max_datagram_size, 0, NULL, 1000);
-        if (err) {
-                pr_debug(" GET_MAX_DATAGRAM_SIZE failed, using size=%u\n",
-                         CDC_NCM_MIN_DATAGRAM_SIZE);
-                /* use default */
-                ctx->max_datagram_size = CDC_NCM_MIN_DATAGRAM_SIZE;
-        } else {
-                ctx->max_datagram_size = le16_to_cpu(max_datagram_size);
+                        if (ctx->max_datagram_size < CDC_NCM_MIN_DATAGRAM_SIZE)
+                                ctx->max_datagram_size =
+                                        CDC_NCM_MIN_DATAGRAM_SIZE;
+
+                        /* if value changed, update device */
+                        req.bmRequestType = USB_TYPE_CLASS | USB_DIR_OUT |
+                                                        USB_RECIP_INTERFACE;
+                        req.bNotificationType = USB_CDC_SET_MAX_DATAGRAM_SIZE;
+                        req.wValue = 0;
+                        req.wIndex = cpu_to_le16(iface_no);
+                        req.wLength = 2;
+                        max_datagram_size = cpu_to_le16(ctx->max_datagram_size);
+
+                        err = cdc_ncm_do_request(ctx, &req, &max_datagram_size,
+                                                                0, NULL, 1000);
+                        if (err)
+                                pr_debug("SET_MAX_DATAGRAM_SIZE failed\n");
+                }
 
-                if (ctx->max_datagram_size < CDC_NCM_MIN_DATAGRAM_SIZE)
-                        ctx->max_datagram_size = CDC_NCM_MIN_DATAGRAM_SIZE;
-                else if (ctx->max_datagram_size > CDC_NCM_MAX_DATAGRAM_SIZE)
-                        ctx->max_datagram_size = CDC_NCM_MAX_DATAGRAM_SIZE;
         }
 
         if (ctx->netdev->mtu != (ctx->max_datagram_size - ETH_HLEN))
@@ -466,19 +540,13 @@ static int cdc_ncm_bind(struct usbnet *dev, struct usb_interface *intf)
 
                         ctx->ether_desc =
                                         (const struct usb_cdc_ether_desc *)buf;
-
                         dev->hard_mtu =
                                 le16_to_cpu(ctx->ether_desc->wMaxSegmentSize);
 
-                        if (dev->hard_mtu <
-                            (CDC_NCM_MIN_DATAGRAM_SIZE - ETH_HLEN))
-                                dev->hard_mtu =
-                                        CDC_NCM_MIN_DATAGRAM_SIZE - ETH_HLEN;
-
-                        else if (dev->hard_mtu >
-                                 (CDC_NCM_MAX_DATAGRAM_SIZE - ETH_HLEN))
-                                dev->hard_mtu =
-                                        CDC_NCM_MAX_DATAGRAM_SIZE - ETH_HLEN;
+                        if (dev->hard_mtu < CDC_NCM_MIN_DATAGRAM_SIZE)
+                                dev->hard_mtu = CDC_NCM_MIN_DATAGRAM_SIZE;
+                        else if (dev->hard_mtu > CDC_NCM_MAX_DATAGRAM_SIZE)
+                                dev->hard_mtu = CDC_NCM_MAX_DATAGRAM_SIZE;
                         break;
 
                 case USB_CDC_NCM_TYPE:
@@ -628,13 +696,13 @@ cdc_ncm_fill_tx_frame(struct cdc_ncm_ctx *ctx, struct sk_buff *skb)
         u32 offset;
         u32 last_offset;
         u16 n = 0;
-        u8 timeout = 0;
+        u8 ready2send = 0;
 
         /* if there is a remaining skb, it gets priority */
         if (skb != NULL)
                 swap(skb, ctx->tx_rem_skb);
         else
-                timeout = 1;
+                ready2send = 1;
 
         /*
          * +----------------+
@@ -682,9 +750,10 @@ cdc_ncm_fill_tx_frame(struct cdc_ncm_ctx *ctx, struct sk_buff *skb)
 
         for (; n < ctx->tx_max_datagrams; n++) {
                 /* check if end of transmit buffer is reached */
-                if (offset >= ctx->tx_max)
+                if (offset >= ctx->tx_max) {
+                        ready2send = 1;
                         break;
-
+                }
                 /* compute maximum buffer size */
                 rem = ctx->tx_max - offset;
 
@@ -711,9 +780,7 @@ cdc_ncm_fill_tx_frame(struct cdc_ncm_ctx *ctx, struct sk_buff *skb)
                                 }
                                 ctx->tx_rem_skb = skb;
                                 skb = NULL;
-
-                                /* loop one more time */
-                                timeout = 1;
+                                ready2send = 1;
                         }
                         break;
                 }
@@ -756,7 +823,7 @@ cdc_ncm_fill_tx_frame(struct cdc_ncm_ctx *ctx, struct sk_buff *skb)
                 ctx->tx_curr_last_offset = last_offset;
                 goto exit_no_skb;
 
-        } else if ((n < ctx->tx_max_datagrams) && (timeout == 0)) {
+        } else if ((n < ctx->tx_max_datagrams) && (ready2send == 0)) {
                 /* wait for more frames */
                 /* push variables */
                 ctx->tx_curr_skb = skb_out;
@@ -813,7 +880,7 @@ cdc_ncm_fill_tx_frame(struct cdc_ncm_ctx *ctx, struct sk_buff *skb)
                                         cpu_to_le16(sizeof(ctx->tx_ncm.nth16));
         ctx->tx_ncm.nth16.wSequence = cpu_to_le16(ctx->tx_seq);
         ctx->tx_ncm.nth16.wBlockLength = cpu_to_le16(last_offset);
-        ctx->tx_ncm.nth16.wFpIndex = ALIGN(sizeof(struct usb_cdc_ncm_nth16),
+        ctx->tx_ncm.nth16.wNdpIndex = ALIGN(sizeof(struct usb_cdc_ncm_nth16),
                                                         ctx->tx_ndp_modulus);
 
         memcpy(skb_out->data, &(ctx->tx_ncm.nth16), sizeof(ctx->tx_ncm.nth16));
@@ -825,13 +892,13 @@ cdc_ncm_fill_tx_frame(struct cdc_ncm_ctx *ctx, struct sk_buff *skb)
         rem = sizeof(ctx->tx_ncm.ndp16) + ((ctx->tx_curr_frame_num + 1) *
                                         sizeof(struct usb_cdc_ncm_dpe16));
         ctx->tx_ncm.ndp16.wLength = cpu_to_le16(rem);
-        ctx->tx_ncm.ndp16.wNextFpIndex = 0; /* reserved */
+        ctx->tx_ncm.ndp16.wNextNdpIndex = 0; /* reserved */
 
-        memcpy(((u8 *)skb_out->data) + ctx->tx_ncm.nth16.wFpIndex,
+        memcpy(((u8 *)skb_out->data) + ctx->tx_ncm.nth16.wNdpIndex,
                                                 &(ctx->tx_ncm.ndp16),
                                                 sizeof(ctx->tx_ncm.ndp16));
 
-        memcpy(((u8 *)skb_out->data) + ctx->tx_ncm.nth16.wFpIndex +
+        memcpy(((u8 *)skb_out->data) + ctx->tx_ncm.nth16.wNdpIndex +
                                         sizeof(ctx->tx_ncm.ndp16),
                                         &(ctx->tx_ncm.dpe16),
                                         (ctx->tx_curr_frame_num + 1) *
@@ -961,7 +1028,7 @@ static int cdc_ncm_rx_fixup(struct usbnet *dev, struct sk_buff *skb_in)
                 goto error;
         }
 
-        temp = le16_to_cpu(ctx->rx_ncm.nth16.wFpIndex);
+        temp = le16_to_cpu(ctx->rx_ncm.nth16.wNdpIndex);
         if ((temp + sizeof(ctx->rx_ncm.ndp16)) > actlen) {
                 pr_debug("invalid DPT16 index\n");
                 goto error;
@@ -1048,10 +1115,10 @@ error:
 
 static void
 cdc_ncm_speed_change(struct cdc_ncm_ctx *ctx,
-                     struct connection_speed_change *data)
+                     struct usb_cdc_speed_change *data)
 {
-        uint32_t rx_speed = le32_to_cpu(data->USBitRate);
-        uint32_t tx_speed = le32_to_cpu(data->DSBitRate);
+        uint32_t rx_speed = le32_to_cpu(data->DLBitRRate);
+        uint32_t tx_speed = le32_to_cpu(data->ULBitRate);
 
         /*
          * Currently the USB-NET API does not support reporting the actual
@@ -1092,7 +1159,7 @@ static void cdc_ncm_status(struct usbnet *dev, struct urb *urb)
         /* test for split data in 8-byte chunks */
         if (test_and_clear_bit(EVENT_STS_SPLIT, &dev->flags)) {
                 cdc_ncm_speed_change(ctx,
-                      (struct connection_speed_change *)urb->transfer_buffer);
+                      (struct usb_cdc_speed_change *)urb->transfer_buffer);
                 return;
         }
 
@@ -1120,12 +1187,12 @@ static void cdc_ncm_status(struct usbnet *dev, struct urb *urb)
                 break;
 
         case USB_CDC_NOTIFY_SPEED_CHANGE:
-                if (urb->actual_length <
-                    (sizeof(*event) + sizeof(struct connection_speed_change)))
+                if (urb->actual_length < (sizeof(*event) +
+                                        sizeof(struct usb_cdc_speed_change)))
                         set_bit(EVENT_STS_SPLIT, &dev->flags);
                 else
                         cdc_ncm_speed_change(ctx,
-                                (struct connection_speed_change *) &event[1]);
+                                (struct usb_cdc_speed_change *) &event[1]);
                 break;
 
         default:
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 90a23e410d1b..82dba5aaf423 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -446,6 +446,20 @@ static void skb_recv_done(struct virtqueue *rvq)
         }
 }
 
+static void virtnet_napi_enable(struct virtnet_info *vi)
+{
+        napi_enable(&vi->napi);
+
+        /* If all buffers were filled by other side before we napi_enabled, we
+         * won't get another interrupt, so process any outstanding packets
+         * now.  virtnet_poll wants re-enable the queue, so we disable here.
+         * We synchronize against interrupts via NAPI_STATE_SCHED */
+        if (napi_schedule_prep(&vi->napi)) {
+                virtqueue_disable_cb(vi->rvq);
+                __napi_schedule(&vi->napi);
+        }
+}
+
 static void refill_work(struct work_struct *work)
 {
         struct virtnet_info *vi;
@@ -454,7 +468,7 @@ static void refill_work(struct work_struct *work)
         vi = container_of(work, struct virtnet_info, refill.work);
         napi_disable(&vi->napi);
         still_empty = !try_fill_recv(vi, GFP_KERNEL);
-        napi_enable(&vi->napi);
+        virtnet_napi_enable(vi);
 
         /* In theory, this can happen: if we don't get any buffers in
          * we will *never* try to fill again. */
@@ -638,16 +652,7 @@ static int virtnet_open(struct net_device *dev)
 {
         struct virtnet_info *vi = netdev_priv(dev);
 
-        napi_enable(&vi->napi);
-
-        /* If all buffers were filled by other side before we napi_enabled, we
-         * won't get another interrupt, so process any outstanding packets
-         * now.  virtnet_poll wants re-enable the queue, so we disable here.
-         * We synchronize against interrupts via NAPI_STATE_SCHED */
-        if (napi_schedule_prep(&vi->napi)) {
-                virtqueue_disable_cb(vi->rvq);
-                __napi_schedule(&vi->napi);
-        }
+        virtnet_napi_enable(vi);
         return 0;
 }
 
diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
index 3681caf54282..23838e37d45f 100644
--- a/drivers/net/wireless/ath/ath9k/ath9k.h
+++ b/drivers/net/wireless/ath/ath9k/ath9k.h
@@ -218,6 +218,7 @@ struct ath_frame_info {
 struct ath_buf_state {
         u8 bf_type;
         u8 bfs_paprd;
+        unsigned long bfs_paprd_timestamp;
         enum ath9k_internal_frame_type bfs_ftype;
 };
 
@@ -593,7 +594,6 @@ struct ath_softc {
         struct work_struct paprd_work;
         struct work_struct hw_check_work;
         struct completion paprd_complete;
-        bool paprd_pending;
 
         u32 intrstatus;
         u32 sc_flags; /* SC_OP_* */
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index 9040c2ff1909..da5c64597c1f 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -342,7 +342,6 @@ static bool ath_paprd_send_frame(struct ath_softc *sc, struct sk_buff *skb, int
         tx_info->control.rates[1].idx = -1;
 
         init_completion(&sc->paprd_complete);
-        sc->paprd_pending = true;
         txctl.paprd = BIT(chain);
 
         if (ath_tx_start(hw, skb, &txctl) != 0) {
@@ -353,7 +352,6 @@ static bool ath_paprd_send_frame(struct ath_softc *sc, struct sk_buff *skb, int
 
         time_left = wait_for_completion_timeout(&sc->paprd_complete,
                         msecs_to_jiffies(ATH_PAPRD_TIMEOUT));
-        sc->paprd_pending = false;
 
         if (!time_left)
                 ath_dbg(ath9k_hw_common(sc->sc_ah), ATH_DBG_CALIBRATE,
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index 33a37edbaf79..07b7804aec5b 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -1725,6 +1725,9 @@ static void ath_tx_start_dma(struct ath_softc *sc, struct ath_buf *bf,
                         ar9003_hw_set_paprd_txdesc(sc->sc_ah, bf->bf_desc,
                                                    bf->bf_state.bfs_paprd);
 
+                if (txctl->paprd)
+                        bf->bf_state.bfs_paprd_timestamp = jiffies;
+
                 ath_tx_send_normal(sc, txctl->txq, tid, &bf_head);
         }
 
@@ -1886,7 +1889,9 @@ static void ath_tx_complete_buf(struct ath_softc *sc, struct ath_buf *bf,
         bf->bf_buf_addr = 0;
 
         if (bf->bf_state.bfs_paprd) {
-                if (!sc->paprd_pending)
+                if (time_after(jiffies,
+                                bf->bf_state.bfs_paprd_timestamp +
+                                msecs_to_jiffies(ATH_PAPRD_TIMEOUT)))
                         dev_kfree_skb_any(skb);
                 else
                         complete(&sc->paprd_complete);
diff --git a/drivers/net/wireless/ath/carl9170/rx.c b/drivers/net/wireless/ath/carl9170/rx.c
index 939a0e96ed1f..84866a4b8350 100644
--- a/drivers/net/wireless/ath/carl9170/rx.c
+++ b/drivers/net/wireless/ath/carl9170/rx.c
@@ -564,7 +564,7 @@ static void carl9170_ps_beacon(struct ar9170 *ar, void *data, unsigned int len)
         cam = ieee80211_check_tim(tim_ie, tim_len, ar->common.curaid);
 
         /* 2. Maybe the AP wants to send multicast/broadcast data? */
-        cam = !!(tim_ie->bitmap_ctrl & 0x01);
+        cam |= !!(tim_ie->bitmap_ctrl & 0x01);
 
         if (!cam) {
                 /* back to low-power land. */
diff --git a/drivers/net/wireless/iwlwifi/iwl-6000.c b/drivers/net/wireless/iwlwifi/iwl-6000.c
index af505bcd7ae0..ef36aff1bb43 100644
--- a/drivers/net/wireless/iwlwifi/iwl-6000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-6000.c
@@ -681,6 +681,8 @@ struct iwl_cfg iwl6000i_2bg_cfg = {
         .fw_name_pre = IWL6050_FW_PRE,                          \
         .ucode_api_max = IWL6050_UCODE_API_MAX,                 \
         .ucode_api_min = IWL6050_UCODE_API_MIN,                 \
+        .valid_tx_ant = ANT_AB,         /* .cfg overwrite */    \
+        .valid_rx_ant = ANT_AB,         /* .cfg overwrite */    \
         .ops = &iwl6050_ops,                                    \
         .eeprom_ver = EEPROM_6050_EEPROM_VERSION,               \
         .eeprom_calib_ver = EEPROM_6050_TX_POWER_VERSION,       \
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index 36335b1b54d4..c1cfd9952e52 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -1157,6 +1157,9 @@ static void iwl_irq_tasklet_legacy(struct iwl_priv *priv)
         /* only Re-enable if disabled by irq */
         if (test_bit(STATUS_INT_ENABLED, &priv->status))
                 iwl_enable_interrupts(priv);
+        /* Re-enable RF_KILL if it occurred */
+        else if (handled & CSR_INT_BIT_RF_KILL)
+                iwl_enable_rfkill_int(priv);
 
 #ifdef CONFIG_IWLWIFI_DEBUG
         if (iwl_get_debug_level(priv) & (IWL_DL_ISR)) {
@@ -1371,6 +1374,9 @@ static void iwl_irq_tasklet(struct iwl_priv *priv)
         /* only Re-enable if disabled by irq */
         if (test_bit(STATUS_INT_ENABLED, &priv->status))
                 iwl_enable_interrupts(priv);
+        /* Re-enable RF_KILL if it occurred */
+        else if (handled & CSR_INT_BIT_RF_KILL)
+                iwl_enable_rfkill_int(priv);
 }
 
 /* the threshold ratio of actual_ack_cnt to expected_ack_cnt in percent */
diff --git a/drivers/net/wireless/wl1251/main.c b/drivers/net/wireless/wl1251/main.c
index 012e1a4016fe..40372bac9482 100644
--- a/drivers/net/wireless/wl1251/main.c
+++ b/drivers/net/wireless/wl1251/main.c
@@ -1039,6 +1039,9 @@ static void wl1251_op_bss_info_changed(struct ieee80211_hw *hw,
 
         if (changed & BSS_CHANGED_BEACON) {
                 beacon = ieee80211_beacon_get(hw, vif);
+                if (!beacon)
+                        goto out_sleep;
+
                 ret = wl1251_cmd_template_set(wl, CMD_BEACON, beacon->data,
                                               beacon->len);