Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (22 commits)
  be2net: set proper value to version field in req hdr
  xfrm: Fix xfrm_state_clone leak
  ipcomp: Avoid duplicate calls to ipcomp_destroy
  ethtool: allow non-admin user to read GRO settings.
  ixgbe: fix WOL register setup for 82599
  ixgbe: Fix - Do not allow Rx FC on 82598 at 1G due to errata
  sfc: Fix SFE4002 initialisation
  mac80211: fix handling of null-rate control in rate_control_get_rate
  inet: Remove bogus IGMPv3 report handling
  iwlwifi: fix AMSDU Rx after paged Rx patch
  tcp: fix ICMP-RTO war
  via-velocity: Fix races on shared interrupts
  via-velocity: Take spinlock on set coalesce
  via-velocity: Remove unused IRQ status parameter from rx_srv and tx_srv
  rtl8187: Add new device ID
  iwmc3200wifi: Test of wrong pointer after kzalloc in iwm_mlme_update_bss_table()
  ath9k: Fix sequence numbers for PAE frames
  mac80211: fix deferred hardware scan requests
  iwlwifi: Fix to set correct ht configuration
  mac80211: Fix probe request filtering in IBSS mode
  ...

14 files changed, 70 insertions, 31 deletions

diff --git a/drivers/net/benet/be_cmds.c b/drivers/net/benet/be_cmds.c
index fee6eee7ae5b..006cb2efcd22 100644
--- a/drivers/net/benet/be_cmds.c
+++ b/drivers/net/benet/be_cmds.c
@@ -296,6 +296,7 @@ static void be_cmd_hdr_prepare(struct be_cmd_req_hdr *req_hdr,
         req_hdr->opcode = opcode;
         req_hdr->subsystem = subsystem;
         req_hdr->request_length = cpu_to_le32(cmd_len - sizeof(*req_hdr));
+        req_hdr->version = 0;
 }
 
 static void be_cmd_page_addrs_prepare(struct phys_addr *pages, u32 max_pages,
diff --git a/drivers/net/ixgbe/ixgbe_82598.c b/drivers/net/ixgbe/ixgbe_82598.c
index 3103f4165311..35a06b47587b 100644
--- a/drivers/net/ixgbe/ixgbe_82598.c
+++ b/drivers/net/ixgbe/ixgbe_82598.c
@@ -357,12 +357,34 @@ static s32 ixgbe_fc_enable_82598(struct ixgbe_hw *hw, s32 packetbuf_num)
         u32 fctrl_reg;
         u32 rmcs_reg;
         u32 reg;
+        u32 link_speed = 0;
+        bool link_up;
 
 #ifdef CONFIG_DCB
         if (hw->fc.requested_mode == ixgbe_fc_pfc)
                 goto out;
 
 #endif /* CONFIG_DCB */
+        /*
+         * On 82598 having Rx FC on causes resets while doing 1G
+         * so if it's on turn it off once we know link_speed. For
+         * more details see 82598 Specification update.
+         */
+        hw->mac.ops.check_link(hw, &link_speed, &link_up, false);
+        if (link_up && link_speed == IXGBE_LINK_SPEED_1GB_FULL) {
+                switch (hw->fc.requested_mode) {
+                case ixgbe_fc_full:
+                        hw->fc.requested_mode = ixgbe_fc_tx_pause;
+                        break;
+                case ixgbe_fc_rx_pause:
+                        hw->fc.requested_mode = ixgbe_fc_none;
+                        break;
+                default:
+                        /* no change */
+                        break;
+                }
+        }
+
         /* Negotiate the fc mode to use */
         ret_val = ixgbe_fc_autoneg(hw);
         if (ret_val)
diff --git a/drivers/net/ixgbe/ixgbe_main.c b/drivers/net/ixgbe/ixgbe_main.c
index 7b7c8486c0bf..951b73cf5ca2 100644
--- a/drivers/net/ixgbe/ixgbe_main.c
+++ b/drivers/net/ixgbe/ixgbe_main.c
@@ -5763,6 +5763,10 @@ static int __devinit ixgbe_probe(struct pci_dev *pdev,
         if (err)
                 goto err_sw_init;
 
+        /* Make it possible the adapter to be woken up via WOL */
+        if (adapter->hw.mac.type == ixgbe_mac_82599EB)
+                IXGBE_WRITE_REG(&adapter->hw, IXGBE_WUS, ~0);
+
         /*
          * If there is a fan on this device and it has failed log the
          * failure.
diff --git a/drivers/net/sfc/efx.c b/drivers/net/sfc/efx.c
index 103e8b0e2a0d..46997e177ee3 100644
--- a/drivers/net/sfc/efx.c
+++ b/drivers/net/sfc/efx.c
@@ -2284,6 +2284,7 @@ static int __devinit efx_pci_probe(struct pci_dev *pci_dev,
  fail2:
         efx_fini_struct(efx);
  fail1:
+        WARN_ON(rc > 0);
         EFX_LOG(efx, "initialisation failed. rc=%d\n", rc);
         free_netdev(net_dev);
         return rc;
diff --git a/drivers/net/sfc/qt202x_phy.c b/drivers/net/sfc/qt202x_phy.c
index e0d13a451019..67eec7a6e487 100644
--- a/drivers/net/sfc/qt202x_phy.c
+++ b/drivers/net/sfc/qt202x_phy.c
@@ -320,7 +320,7 @@ static int qt202x_reset_phy(struct efx_nic *efx)
 
         falcon_board(efx)->type->init_phy(efx);
 
-        return rc;
+        return 0;
 
  fail:
         EFX_ERR(efx, "PHY reset timed out\n");
diff --git a/drivers/net/via-velocity.c b/drivers/net/via-velocity.c
index c93f58f5c6f2..317aa34b21cf 100644
--- a/drivers/net/via-velocity.c
+++ b/drivers/net/via-velocity.c
@@ -1877,13 +1877,12 @@ static void velocity_error(struct velocity_info *vptr, int status)
 /**
  *      tx_srv          -       transmit interrupt service
  *      @vptr; Velocity
- *      @status:
  *
  *      Scan the queues looking for transmitted packets that
  *      we can complete and clean up. Update any statistics as
  *      necessary/
  */
-static int velocity_tx_srv(struct velocity_info *vptr, u32 status)
+static int velocity_tx_srv(struct velocity_info *vptr)
 {
         struct tx_desc *td;
         int qnum;
@@ -2090,14 +2089,12 @@ static int velocity_receive_frame(struct velocity_info *vptr, int idx)
 /**
  *      velocity_rx_srv         -       service RX interrupt
  *      @vptr: velocity
- *      @status: adapter status (unused)
  *
  *      Walk the receive ring of the velocity adapter and remove
  *      any received packets from the receive queue. Hand the ring
  *      slots back to the adapter for reuse.
  */
-static int velocity_rx_srv(struct velocity_info *vptr, int status,
-                int budget_left)
+static int velocity_rx_srv(struct velocity_info *vptr, int budget_left)
 {
         struct net_device_stats *stats = &vptr->dev->stats;
         int rd_curr = vptr->rx.curr;
@@ -2151,32 +2148,24 @@ static int velocity_poll(struct napi_struct *napi, int budget)
         struct velocity_info *vptr = container_of(napi,
                         struct velocity_info, napi);
         unsigned int rx_done;
-        u32 isr_status;
-
-        spin_lock(&vptr->lock);
-        isr_status = mac_read_isr(vptr->mac_regs);
-
-        /* Ack the interrupt */
-        mac_write_isr(vptr->mac_regs, isr_status);
-        if (isr_status & (~(ISR_PRXI | ISR_PPRXI | ISR_PTXI | ISR_PPTXI)))
-                velocity_error(vptr, isr_status);
+        unsigned long flags;
 
+        spin_lock_irqsave(&vptr->lock, flags);
         /*
          * Do rx and tx twice for performance (taken from the VIA
          * out-of-tree driver).
          */
-        rx_done = velocity_rx_srv(vptr, isr_status, budget / 2);
-        velocity_tx_srv(vptr, isr_status);
-        rx_done += velocity_rx_srv(vptr, isr_status, budget - rx_done);
-        velocity_tx_srv(vptr, isr_status);
-
-        spin_unlock(&vptr->lock);
+        rx_done = velocity_rx_srv(vptr, budget / 2);
+        velocity_tx_srv(vptr);
+        rx_done += velocity_rx_srv(vptr, budget - rx_done);
+        velocity_tx_srv(vptr);
 
         /* If budget not fully consumed, exit the polling mode */
         if (rx_done < budget) {
                 napi_complete(napi);
                 mac_enable_int(vptr->mac_regs);
         }
+        spin_unlock_irqrestore(&vptr->lock, flags);
 
         return rx_done;
 }
@@ -2206,10 +2195,17 @@ static irqreturn_t velocity_intr(int irq, void *dev_instance)
                 return IRQ_NONE;
         }
 
+        /* Ack the interrupt */
+        mac_write_isr(vptr->mac_regs, isr_status);
+
         if (likely(napi_schedule_prep(&vptr->napi))) {
                 mac_disable_int(vptr->mac_regs);
                 __napi_schedule(&vptr->napi);
         }
+
+        if (isr_status & (~(ISR_PRXI | ISR_PPRXI | ISR_PTXI | ISR_PPTXI)))
+                velocity_error(vptr, isr_status);
+
         spin_unlock(&vptr->lock);
 
         return IRQ_HANDLED;
@@ -3100,7 +3096,7 @@ static int velocity_resume(struct pci_dev *pdev)
         velocity_init_registers(vptr, VELOCITY_INIT_WOL);
         mac_disable_int(vptr->mac_regs);
 
-        velocity_tx_srv(vptr, 0);
+        velocity_tx_srv(vptr);
 
         for (i = 0; i < vptr->tx.numq; i++) {
                 if (vptr->tx.used[i])
@@ -3344,6 +3340,7 @@ static int velocity_set_coalesce(struct net_device *dev,
 {
         struct velocity_info *vptr = netdev_priv(dev);
         int max_us = 0x3f * 64;
+        unsigned long flags;
 
         /* 6 bits of  */
         if (ecmd->tx_coalesce_usecs > max_us)
@@ -3365,6 +3362,7 @@ static int velocity_set_coalesce(struct net_device *dev,
                         ecmd->tx_coalesce_usecs);
 
         /* Setup the interrupt suppression and queue timers */
+        spin_lock_irqsave(&vptr->lock, flags);
         mac_disable_int(vptr->mac_regs);
         setup_adaptive_interrupts(vptr);
         setup_queue_timers(vptr);
@@ -3372,6 +3370,7 @@ static int velocity_set_coalesce(struct net_device *dev,
         mac_write_int_mask(vptr->int_mask, vptr->mac_regs);
         mac_clear_isr(vptr->mac_regs);
         mac_enable_int(vptr->mac_regs);
+        spin_unlock_irqrestore(&vptr->lock, flags);
 
         return 0;
 }
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index fa12b9060b0b..29bf33692f71 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -1615,7 +1615,7 @@ static int ath_tx_setup_buffer(struct ieee80211_hw *hw, struct ath_buf *bf,
                 bf->bf_frmlen -= padsize;
         }
 
-        if (conf_is_ht(&hw->conf) && !is_pae(skb))
+        if (conf_is_ht(&hw->conf))
                 bf->bf_state.bf_type |= BUF_HT;
 
         bf->bf_flags = setup_tx_flags(sc, skb, txctl->txq);
@@ -1701,7 +1701,7 @@ static void ath_tx_start_dma(struct ath_softc *sc, struct ath_buf *bf,
                         goto tx_done;
                 }
 
-                if (tx_info->flags & IEEE80211_TX_CTL_AMPDU) {
+                if ((tx_info->flags & IEEE80211_TX_CTL_AMPDU) && !is_pae(skb)) {
                         /*
                          * Try aggregation if it's a unicast data frame
                          * and the destination is HT capable.
diff --git a/drivers/net/wireless/b43/b43.h b/drivers/net/wireless/b43/b43.h
index fe3bf9491997..c484cc253892 100644
--- a/drivers/net/wireless/b43/b43.h
+++ b/drivers/net/wireless/b43/b43.h
@@ -115,6 +115,7 @@
 #define B43_MMIO_TSF_2                  0x636   /* core rev < 3 only */
 #define B43_MMIO_TSF_3                  0x638   /* core rev < 3 only */
 #define B43_MMIO_RNG                    0x65A
+#define B43_MMIO_IFSSLOT                0x684   /* Interframe slot time */
 #define B43_MMIO_IFSCTL                 0x688 /* Interframe space control */
 #define  B43_MMIO_IFSCTL_USE_EDCF       0x0004
 #define B43_MMIO_POWERUP_DELAY          0x6A8
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index 4c41cfe44f26..490fb45d1d05 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -628,10 +628,17 @@ static void b43_upload_card_macaddress(struct b43_wldev *dev)
 static void b43_set_slot_time(struct b43_wldev *dev, u16 slot_time)
 {
         /* slot_time is in usec. */
-        if (dev->phy.type != B43_PHYTYPE_G)
+        /* This test used to exit for all but a G PHY. */
+        if (b43_current_band(dev->wl) == IEEE80211_BAND_5GHZ)
                 return;
-        b43_write16(dev, 0x684, 510 + slot_time);
-        b43_shm_write16(dev, B43_SHM_SHARED, 0x0010, slot_time);
+        b43_write16(dev, B43_MMIO_IFSSLOT, 510 + slot_time);
+        /* Shared memory location 0x0010 is the slot time and should be
+         * set to slot_time; however, this register is initially 0 and changing
+         * the value adversely affects the transmit rate for BCM4311
+         * devices. Until this behavior is unterstood, delete this step
+         *
+         * b43_shm_write16(dev, B43_SHM_SHARED, 0x0010, slot_time);
+         */
 }
 
 static void b43_short_slot_timing_enable(struct b43_wldev *dev)
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.c b/drivers/net/wireless/iwlwifi/iwl-core.c
index 5461f105bd2d..d10bea64fce3 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.c
+++ b/drivers/net/wireless/iwlwifi/iwl-core.c
@@ -2744,6 +2744,7 @@ int iwl_mac_config(struct ieee80211_hw *hw, u32 changed)
                 if ((le16_to_cpu(priv->staging_rxon.channel) != ch))
                         priv->staging_rxon.flags = 0;
 
+                iwl_set_rxon_ht(priv, ht_conf);
                 iwl_set_rxon_channel(priv, conf->channel);
 
                 iwl_set_flags_for_band(priv, conf->channel->band);
diff --git a/drivers/net/wireless/iwlwifi/iwl-rx.c b/drivers/net/wireless/iwlwifi/iwl-rx.c
index 6f36b6e79f5e..2dbce85404aa 100644
--- a/drivers/net/wireless/iwlwifi/iwl-rx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-rx.c
@@ -928,7 +928,10 @@ static void iwl_pass_packet_to_mac80211(struct iwl_priv *priv,
         if (ieee80211_is_mgmt(fc) ||
             ieee80211_has_protected(fc) ||
             ieee80211_has_morefrags(fc) ||
-            le16_to_cpu(hdr->seq_ctrl) & IEEE80211_SCTL_FRAG)
+            le16_to_cpu(hdr->seq_ctrl) & IEEE80211_SCTL_FRAG ||
+            (ieee80211_is_data_qos(fc) &&
+             *ieee80211_get_qos_ctl(hdr) &
+             IEEE80211_QOS_CONTROL_A_MSDU_PRESENT))
                 ret = skb_linearize(skb);
         else
                 ret = __pskb_pull_tail(skb, min_t(u16, IWL_LINK_HDR_MAX, len)) ?
diff --git a/drivers/net/wireless/iwmc3200wifi/rx.c b/drivers/net/wireless/iwmc3200wifi/rx.c
index 6d6ed7485175..f727b4a83196 100644
--- a/drivers/net/wireless/iwmc3200wifi/rx.c
+++ b/drivers/net/wireless/iwmc3200wifi/rx.c
@@ -794,7 +794,7 @@ static int iwm_mlme_update_bss_table(struct iwm_priv *iwm, u8 *buf,
         }
 
         bss->bss = kzalloc(bss_len, GFP_KERNEL);
-        if (!bss) {
+        if (!bss->bss) {
                 kfree(bss);
                 IWM_ERR(iwm, "Couldn't allocate bss\n");
                 return -ENOMEM;
diff --git a/drivers/net/wireless/rtl818x/rtl8187_dev.c b/drivers/net/wireless/rtl818x/rtl8187_dev.c
index bc5726dd5fe4..7ba3052b0708 100644
--- a/drivers/net/wireless/rtl818x/rtl8187_dev.c
+++ b/drivers/net/wireless/rtl818x/rtl8187_dev.c
@@ -65,6 +65,7 @@ static struct usb_device_id rtl8187_table[] __devinitdata = {
         /* Sitecom */
         {USB_DEVICE(0x0df6, 0x000d), .driver_info = DEVICE_RTL8187},
         {USB_DEVICE(0x0df6, 0x0028), .driver_info = DEVICE_RTL8187B},
+        {USB_DEVICE(0x0df6, 0x0029), .driver_info = DEVICE_RTL8187B},
         /* Sphairon Access Systems GmbH */
         {USB_DEVICE(0x114B, 0x0150), .driver_info = DEVICE_RTL8187},
         /* Dick Smith Electronics */
diff --git a/drivers/ssb/main.c b/drivers/ssb/main.c
index 5681ebed9c65..03dfd27c4bfb 100644
--- a/drivers/ssb/main.c
+++ b/drivers/ssb/main.c
@@ -494,8 +494,7 @@ static int ssb_devices_register(struct ssb_bus *bus)
 #endif
                         break;
                 case SSB_BUSTYPE_SDIO:
-#ifdef CONFIG_SSB_SDIO
-                        sdev->irq = bus->host_sdio->dev.irq;
+#ifdef CONFIG_SSB_SDIOHOST
                         dev->parent = &bus->host_sdio->dev;
 #endif
                         break;