From c593cb62fda646cb07458121bc7f0d499ac47550 Mon Sep 17 00:00:00 2001
From: "Eric W. Biederman" <ebiederm@xmission.com>
Date: Wed, 3 Feb 2010 23:13:24 -0800
Subject: [PATCH] --- yaml --- r: 180611 b: refs/heads/master c:
 7c0ff870d1ed287504a61ed865f3d728c757436b h: refs/heads/master i:   180609:
 590e19e03d591223ee6ec071b4c351d3edbb4c8c   180607:
 27b6b1ca9c70bd2cbcf8d43e97e20b16c081188b v: v3

---
 [refs]                                        |  2 +-
 trunk/arch/ia64/include/asm/elf.h             |  4 +-
 trunk/arch/x86/include/asm/elf.h              |  5 ++-
 trunk/arch/x86/kernel/process_64.c            |  1 -
 trunk/drivers/md/dm-log-userspace-transfer.c  | 10 ++---
 trunk/drivers/md/dm-raid1.c                   |  2 +-
 trunk/drivers/md/dm-region-hash.c             |  5 ++-
 trunk/drivers/md/dm-snap-persistent.c         |  2 +-
 trunk/drivers/md/dm-stripe.c                  |  2 +-
 trunk/drivers/md/dm-sysfs.c                   |  8 ++++
 trunk/drivers/md/dm.c                         | 21 ++--------
 trunk/drivers/net/benet/be_cmds.c             |  1 -
 trunk/drivers/net/ixgbe/ixgbe_82598.c         | 22 ----------
 trunk/drivers/net/ixgbe/ixgbe_main.c          |  4 --
 trunk/drivers/net/sfc/efx.c                   |  1 -
 trunk/drivers/net/sfc/qt202x_phy.c            |  2 +-
 trunk/drivers/net/via-velocity.c              | 41 ++++++++++---------
 trunk/drivers/net/wireless/ath/ath9k/xmit.c   |  4 +-
 trunk/drivers/net/wireless/b43/b43.h          |  1 -
 trunk/drivers/net/wireless/b43/main.c         | 13 ++----
 trunk/drivers/net/wireless/iwlwifi/iwl-core.c |  1 -
 trunk/drivers/net/wireless/iwlwifi/iwl-rx.c   |  5 +--
 trunk/drivers/net/wireless/iwmc3200wifi/rx.c  |  2 +-
 .../net/wireless/rtl818x/rtl8187_dev.c        |  1 -
 trunk/drivers/ssb/main.c                      |  3 +-
 trunk/fs/sysfs/inode.c                        | 35 ++++++++--------
 trunk/net/core/ethtool.c                      |  1 -
 trunk/net/ipv4/igmp.c                         |  2 +-
 trunk/net/ipv4/ipcomp.c                       |  6 ++-
 trunk/net/ipv4/tcp_input.c                    |  6 ++-
 trunk/net/ipv6/ipcomp6.c                      |  6 ++-
 trunk/net/mac80211/ibss.c                     |  2 +-
 trunk/net/mac80211/rate.c                     |  3 --
 trunk/net/mac80211/scan.c                     | 18 ++++----
 trunk/net/xfrm/xfrm_state.c                   | 12 ++++--
 35 files changed, 108 insertions(+), 146 deletions(-)

diff --git a/[refs] b/[refs]
index 01c0fc2368e3..ff89b556ad53 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 5d677670477f92006406d9d77cb42391fad17fcd
+refs/heads/master: 7c0ff870d1ed287504a61ed865f3d728c757436b
diff --git a/trunk/arch/ia64/include/asm/elf.h b/trunk/arch/ia64/include/asm/elf.h
index 4c41656ede87..e14108b19c09 100644
--- a/trunk/arch/ia64/include/asm/elf.h
+++ b/trunk/arch/ia64/include/asm/elf.h
@@ -201,9 +201,7 @@ extern void ia64_elf_core_copy_regs (struct pt_regs *src, elf_gregset_t dst);
    relevant until we have real hardware to play with... */
 #define ELF_PLATFORM	NULL
 
-#define SET_PERSONALITY(ex)	\
-	set_personality((current->personality & ~PER_MASK) | PER_LINUX)
-
+#define SET_PERSONALITY(ex)	set_personality(PER_LINUX)
 #define elf_read_implies_exec(ex, executable_stack)					\
 	((executable_stack!=EXSTACK_DISABLE_X) && ((ex).e_flags & EF_IA_64_LINUX_EXECUTABLE_STACK) != 0)
 
diff --git a/trunk/arch/x86/include/asm/elf.h b/trunk/arch/x86/include/asm/elf.h
index f2ad2163109d..1994d3f58443 100644
--- a/trunk/arch/x86/include/asm/elf.h
+++ b/trunk/arch/x86/include/asm/elf.h
@@ -170,7 +170,10 @@ static inline void elf_common_init(struct thread_struct *t,
 }
 
 #define ELF_PLAT_INIT(_r, load_addr)			\
-	elf_common_init(&current->thread, _r, 0)
+do {							\
+	elf_common_init(&current->thread, _r, 0);	\
+	clear_thread_flag(TIF_IA32);			\
+} while (0)
 
 #define	COMPAT_ELF_PLAT_INIT(regs, load_addr)		\
 	elf_common_init(&current->thread, regs, __USER_DS)
diff --git a/trunk/arch/x86/kernel/process_64.c b/trunk/arch/x86/kernel/process_64.c
index 126f0b493d04..41a26a82470a 100644
--- a/trunk/arch/x86/kernel/process_64.c
+++ b/trunk/arch/x86/kernel/process_64.c
@@ -527,7 +527,6 @@ void set_personality_ia32(void)
 
 	/* Make sure to be in 32bit mode */
 	set_thread_flag(TIF_IA32);
-	current->personality |= force_personality32;
 
 	/* Prepare the first "return" to user space */
 	current_thread_info()->status |= TS_COMPAT;
diff --git a/trunk/drivers/md/dm-log-userspace-transfer.c b/trunk/drivers/md/dm-log-userspace-transfer.c
index f1c8cae70b4b..54abf9e303b7 100644
--- a/trunk/drivers/md/dm-log-userspace-transfer.c
+++ b/trunk/drivers/md/dm-log-userspace-transfer.c
@@ -172,15 +172,11 @@ int dm_consult_userspace(const char *uuid, uint64_t luid, int request_type,
 {
 	int r = 0;
 	size_t dummy = 0;
-	int overhead_size = sizeof(struct dm_ulog_request) + sizeof(struct cn_msg);
+	int overhead_size =
+		sizeof(struct dm_ulog_request *) + sizeof(struct cn_msg);
 	struct dm_ulog_request *tfr = prealloced_ulog_tfr;
 	struct receiving_pkg pkg;
 
-	/*
-	 * Given the space needed to hold the 'struct cn_msg' and
-	 * 'struct dm_ulog_request' - do we have enough payload
-	 * space remaining?
-	 */
 	if (data_size > (DM_ULOG_PREALLOCED_SIZE - overhead_size)) {
 		DMINFO("Size of tfr exceeds preallocated size");
 		return -EINVAL;
@@ -195,7 +191,7 @@ int dm_consult_userspace(const char *uuid, uint64_t luid, int request_type,
 	 */
 	mutex_lock(&dm_ulog_lock);
 
-	memset(tfr, 0, DM_ULOG_PREALLOCED_SIZE - sizeof(struct cn_msg));
+	memset(tfr, 0, DM_ULOG_PREALLOCED_SIZE - overhead_size);
 	memcpy(tfr->uuid, uuid, DM_UUID_LEN);
 	tfr->luid = luid;
 	tfr->seq = dm_ulog_seq++;
diff --git a/trunk/drivers/md/dm-raid1.c b/trunk/drivers/md/dm-raid1.c
index 6c1046df81f6..ad779bd13aec 100644
--- a/trunk/drivers/md/dm-raid1.c
+++ b/trunk/drivers/md/dm-raid1.c
@@ -724,7 +724,7 @@ static void do_writes(struct mirror_set *ms, struct bio_list *writes)
 	/*
 	 * Dispatch io.
 	 */
-	if (unlikely(ms->log_failure) && errors_handled(ms)) {
+	if (unlikely(ms->log_failure)) {
 		spin_lock_irq(&ms->lock);
 		bio_list_merge(&ms->failures, &sync);
 		spin_unlock_irq(&ms->lock);
diff --git a/trunk/drivers/md/dm-region-hash.c b/trunk/drivers/md/dm-region-hash.c
index 168bd38f5006..5f19ceb6fe91 100644
--- a/trunk/drivers/md/dm-region-hash.c
+++ b/trunk/drivers/md/dm-region-hash.c
@@ -660,9 +660,10 @@ void dm_rh_recovery_end(struct dm_region *reg, int success)
 	spin_lock_irq(&rh->region_lock);
 	if (success)
 		list_add(&reg->list, &reg->rh->recovered_regions);
-	else
+	else {
+		reg->state = DM_RH_NOSYNC;
 		list_add(&reg->list, &reg->rh->failed_recovered_regions);
-
+	}
 	spin_unlock_irq(&rh->region_lock);
 
 	rh->wakeup_workers(rh->context);
diff --git a/trunk/drivers/md/dm-snap-persistent.c b/trunk/drivers/md/dm-snap-persistent.c
index c097d8a4823d..7d08879689ac 100644
--- a/trunk/drivers/md/dm-snap-persistent.c
+++ b/trunk/drivers/md/dm-snap-persistent.c
@@ -254,7 +254,7 @@ static int chunk_io(struct pstore *ps, void *area, chunk_t chunk, int rw,
 	 * Issue the synchronous I/O from a different thread
 	 * to avoid generic_make_request recursion.
 	 */
-	INIT_WORK_ON_STACK(&req.work, do_metadata);
+	INIT_WORK(&req.work, do_metadata);
 	queue_work(ps->metadata_wq, &req.work);
 	flush_workqueue(ps->metadata_wq);
 
diff --git a/trunk/drivers/md/dm-stripe.c b/trunk/drivers/md/dm-stripe.c
index bd58703ee8f6..e0efc1adcaff 100644
--- a/trunk/drivers/md/dm-stripe.c
+++ b/trunk/drivers/md/dm-stripe.c
@@ -110,7 +110,7 @@ static int stripe_ctr(struct dm_target *ti, unsigned int argc, char **argv)
 	}
 
 	stripes = simple_strtoul(argv[0], &end, 10);
-	if (!stripes || *end) {
+	if (*end) {
 		ti->error = "Invalid stripe count";
 		return -EINVAL;
 	}
diff --git a/trunk/drivers/md/dm-sysfs.c b/trunk/drivers/md/dm-sysfs.c
index f91b40942e07..f53392df7b97 100644
--- a/trunk/drivers/md/dm-sysfs.c
+++ b/trunk/drivers/md/dm-sysfs.c
@@ -79,6 +79,13 @@ static struct sysfs_ops dm_sysfs_ops = {
 	.show	= dm_attr_show,
 };
 
+/*
+ * The sysfs structure is embedded in md struct, nothing to do here
+ */
+static void dm_sysfs_release(struct kobject *kobj)
+{
+}
+
 /*
  * dm kobject is embedded in mapped_device structure
  * no need to define release function here
@@ -86,6 +93,7 @@ static struct sysfs_ops dm_sysfs_ops = {
 static struct kobj_type dm_ktype = {
 	.sysfs_ops	= &dm_sysfs_ops,
 	.default_attrs	= dm_attrs,
+	.release	= dm_sysfs_release
 };
 
 /*
diff --git a/trunk/drivers/md/dm.c b/trunk/drivers/md/dm.c
index aa4e2aa86d49..3167480b532c 100644
--- a/trunk/drivers/md/dm.c
+++ b/trunk/drivers/md/dm.c
@@ -1595,15 +1595,10 @@ static int dm_prep_fn(struct request_queue *q, struct request *rq)
 	return BLKPREP_OK;
 }
 
-/*
- * Returns:
- * 0  : the request has been processed (not requeued)
- * !0 : the request has been requeued
- */
-static int map_request(struct dm_target *ti, struct request *clone,
-		       struct mapped_device *md)
+static void map_request(struct dm_target *ti, struct request *clone,
+			struct mapped_device *md)
 {
-	int r, requeued = 0;
+	int r;
 	struct dm_rq_target_io *tio = clone->end_io_data;
 
 	/*
@@ -1630,7 +1625,6 @@ static int map_request(struct dm_target *ti, struct request *clone,
 	case DM_MAPIO_REQUEUE:
 		/* The target wants to requeue the I/O */
 		dm_requeue_unmapped_request(clone);
-		requeued = 1;
 		break;
 	default:
 		if (r > 0) {
@@ -1642,8 +1636,6 @@ static int map_request(struct dm_target *ti, struct request *clone,
 		dm_kill_unmapped_request(clone, r);
 		break;
 	}
-
-	return requeued;
 }
 
 /*
@@ -1685,17 +1677,12 @@ static void dm_request_fn(struct request_queue *q)
 		atomic_inc(&md->pending[rq_data_dir(clone)]);
 
 		spin_unlock(q->queue_lock);
-		if (map_request(ti, clone, md))
-			goto requeued;
-
+		map_request(ti, clone, md);
 		spin_lock_irq(q->queue_lock);
 	}
 
 	goto out;
 
-requeued:
-	spin_lock_irq(q->queue_lock);
-
 plug_and_out:
 	if (!elv_queue_empty(q))
 		/* Some requests still remain, retry later */
diff --git a/trunk/drivers/net/benet/be_cmds.c b/trunk/drivers/net/benet/be_cmds.c
index 006cb2efcd22..fee6eee7ae5b 100644
--- a/trunk/drivers/net/benet/be_cmds.c
+++ b/trunk/drivers/net/benet/be_cmds.c
@@ -296,7 +296,6 @@ static void be_cmd_hdr_prepare(struct be_cmd_req_hdr *req_hdr,
 	req_hdr->opcode = opcode;
 	req_hdr->subsystem = subsystem;
 	req_hdr->request_length = cpu_to_le32(cmd_len - sizeof(*req_hdr));
-	req_hdr->version = 0;
 }
 
 static void be_cmd_page_addrs_prepare(struct phys_addr *pages, u32 max_pages,
diff --git a/trunk/drivers/net/ixgbe/ixgbe_82598.c b/trunk/drivers/net/ixgbe/ixgbe_82598.c
index 35a06b47587b..3103f4165311 100644
--- a/trunk/drivers/net/ixgbe/ixgbe_82598.c
+++ b/trunk/drivers/net/ixgbe/ixgbe_82598.c
@@ -357,34 +357,12 @@ static s32 ixgbe_fc_enable_82598(struct ixgbe_hw *hw, s32 packetbuf_num)
 	u32 fctrl_reg;
 	u32 rmcs_reg;
 	u32 reg;
-	u32 link_speed = 0;
-	bool link_up;
 
 #ifdef CONFIG_DCB
 	if (hw->fc.requested_mode == ixgbe_fc_pfc)
 		goto out;
 
 #endif /* CONFIG_DCB */
-	/*
-	 * On 82598 having Rx FC on causes resets while doing 1G
-	 * so if it's on turn it off once we know link_speed. For
-	 * more details see 82598 Specification update.
-	 */
-	hw->mac.ops.check_link(hw, &link_speed, &link_up, false);
-	if (link_up && link_speed == IXGBE_LINK_SPEED_1GB_FULL) {
-		switch (hw->fc.requested_mode) {
-		case ixgbe_fc_full:
-			hw->fc.requested_mode = ixgbe_fc_tx_pause;
-			break;
-		case ixgbe_fc_rx_pause:
-			hw->fc.requested_mode = ixgbe_fc_none;
-			break;
-		default:
-			/* no change */
-			break;
-		}
-	}
-
 	/* Negotiate the fc mode to use */
 	ret_val = ixgbe_fc_autoneg(hw);
 	if (ret_val)
diff --git a/trunk/drivers/net/ixgbe/ixgbe_main.c b/trunk/drivers/net/ixgbe/ixgbe_main.c
index 951b73cf5ca2..7b7c8486c0bf 100644
--- a/trunk/drivers/net/ixgbe/ixgbe_main.c
+++ b/trunk/drivers/net/ixgbe/ixgbe_main.c
@@ -5763,10 +5763,6 @@ static int __devinit ixgbe_probe(struct pci_dev *pdev,
 	if (err)
 		goto err_sw_init;
 
-	/* Make it possible the adapter to be woken up via WOL */
-	if (adapter->hw.mac.type == ixgbe_mac_82599EB)
-		IXGBE_WRITE_REG(&adapter->hw, IXGBE_WUS, ~0);
-
 	/*
 	 * If there is a fan on this device and it has failed log the
 	 * failure.
diff --git a/trunk/drivers/net/sfc/efx.c b/trunk/drivers/net/sfc/efx.c
index 46997e177ee3..103e8b0e2a0d 100644
--- a/trunk/drivers/net/sfc/efx.c
+++ b/trunk/drivers/net/sfc/efx.c
@@ -2284,7 +2284,6 @@ static int __devinit efx_pci_probe(struct pci_dev *pci_dev,
  fail2:
 	efx_fini_struct(efx);
  fail1:
-	WARN_ON(rc > 0);
 	EFX_LOG(efx, "initialisation failed. rc=%d\n", rc);
 	free_netdev(net_dev);
 	return rc;
diff --git a/trunk/drivers/net/sfc/qt202x_phy.c b/trunk/drivers/net/sfc/qt202x_phy.c
index 67eec7a6e487..e0d13a451019 100644
--- a/trunk/drivers/net/sfc/qt202x_phy.c
+++ b/trunk/drivers/net/sfc/qt202x_phy.c
@@ -320,7 +320,7 @@ static int qt202x_reset_phy(struct efx_nic *efx)
 
 	falcon_board(efx)->type->init_phy(efx);
 
-	return 0;
+	return rc;
 
  fail:
 	EFX_ERR(efx, "PHY reset timed out\n");
diff --git a/trunk/drivers/net/via-velocity.c b/trunk/drivers/net/via-velocity.c
index 317aa34b21cf..c93f58f5c6f2 100644
--- a/trunk/drivers/net/via-velocity.c
+++ b/trunk/drivers/net/via-velocity.c
@@ -1877,12 +1877,13 @@ static void velocity_error(struct velocity_info *vptr, int status)
 /**
  *	tx_srv		-	transmit interrupt service
  *	@vptr; Velocity
+ *	@status:
  *
  *	Scan the queues looking for transmitted packets that
  *	we can complete and clean up. Update any statistics as
  *	necessary/
  */
-static int velocity_tx_srv(struct velocity_info *vptr)
+static int velocity_tx_srv(struct velocity_info *vptr, u32 status)
 {
 	struct tx_desc *td;
 	int qnum;
@@ -2089,12 +2090,14 @@ static int velocity_receive_frame(struct velocity_info *vptr, int idx)
 /**
  *	velocity_rx_srv		-	service RX interrupt
  *	@vptr: velocity
+ *	@status: adapter status (unused)
  *
  *	Walk the receive ring of the velocity adapter and remove
  *	any received packets from the receive queue. Hand the ring
  *	slots back to the adapter for reuse.
  */
-static int velocity_rx_srv(struct velocity_info *vptr, int budget_left)
+static int velocity_rx_srv(struct velocity_info *vptr, int status,
+		int budget_left)
 {
 	struct net_device_stats *stats = &vptr->dev->stats;
 	int rd_curr = vptr->rx.curr;
@@ -2148,24 +2151,32 @@ static int velocity_poll(struct napi_struct *napi, int budget)
 	struct velocity_info *vptr = container_of(napi,
 			struct velocity_info, napi);
 	unsigned int rx_done;
-	unsigned long flags;
+	u32 isr_status;
+
+	spin_lock(&vptr->lock);
+	isr_status = mac_read_isr(vptr->mac_regs);
+
+	/* Ack the interrupt */
+	mac_write_isr(vptr->mac_regs, isr_status);
+	if (isr_status & (~(ISR_PRXI | ISR_PPRXI | ISR_PTXI | ISR_PPTXI)))
+		velocity_error(vptr, isr_status);
 
-	spin_lock_irqsave(&vptr->lock, flags);
 	/*
 	 * Do rx and tx twice for performance (taken from the VIA
 	 * out-of-tree driver).
 	 */
-	rx_done = velocity_rx_srv(vptr, budget / 2);
-	velocity_tx_srv(vptr);
-	rx_done += velocity_rx_srv(vptr, budget - rx_done);
-	velocity_tx_srv(vptr);
+	rx_done = velocity_rx_srv(vptr, isr_status, budget / 2);
+	velocity_tx_srv(vptr, isr_status);
+	rx_done += velocity_rx_srv(vptr, isr_status, budget - rx_done);
+	velocity_tx_srv(vptr, isr_status);
+
+	spin_unlock(&vptr->lock);
 
 	/* If budget not fully consumed, exit the polling mode */
 	if (rx_done < budget) {
 		napi_complete(napi);
 		mac_enable_int(vptr->mac_regs);
 	}
-	spin_unlock_irqrestore(&vptr->lock, flags);
 
 	return rx_done;
 }
@@ -2195,17 +2206,10 @@ static irqreturn_t velocity_intr(int irq, void *dev_instance)
 		return IRQ_NONE;
 	}
 
-	/* Ack the interrupt */
-	mac_write_isr(vptr->mac_regs, isr_status);
-
 	if (likely(napi_schedule_prep(&vptr->napi))) {
 		mac_disable_int(vptr->mac_regs);
 		__napi_schedule(&vptr->napi);
 	}
-
-	if (isr_status & (~(ISR_PRXI | ISR_PPRXI | ISR_PTXI | ISR_PPTXI)))
-		velocity_error(vptr, isr_status);
-
 	spin_unlock(&vptr->lock);
 
 	return IRQ_HANDLED;
@@ -3096,7 +3100,7 @@ static int velocity_resume(struct pci_dev *pdev)
 	velocity_init_registers(vptr, VELOCITY_INIT_WOL);
 	mac_disable_int(vptr->mac_regs);
 
-	velocity_tx_srv(vptr);
+	velocity_tx_srv(vptr, 0);
 
 	for (i = 0; i < vptr->tx.numq; i++) {
 		if (vptr->tx.used[i])
@@ -3340,7 +3344,6 @@ static int velocity_set_coalesce(struct net_device *dev,
 {
 	struct velocity_info *vptr = netdev_priv(dev);
 	int max_us = 0x3f * 64;
-	unsigned long flags;
 
 	/* 6 bits of  */
 	if (ecmd->tx_coalesce_usecs > max_us)
@@ -3362,7 +3365,6 @@ static int velocity_set_coalesce(struct net_device *dev,
 			ecmd->tx_coalesce_usecs);
 
 	/* Setup the interrupt suppression and queue timers */
-	spin_lock_irqsave(&vptr->lock, flags);
 	mac_disable_int(vptr->mac_regs);
 	setup_adaptive_interrupts(vptr);
 	setup_queue_timers(vptr);
@@ -3370,7 +3372,6 @@ static int velocity_set_coalesce(struct net_device *dev,
 	mac_write_int_mask(vptr->int_mask, vptr->mac_regs);
 	mac_clear_isr(vptr->mac_regs);
 	mac_enable_int(vptr->mac_regs);
-	spin_unlock_irqrestore(&vptr->lock, flags);
 
 	return 0;
 }
diff --git a/trunk/drivers/net/wireless/ath/ath9k/xmit.c b/trunk/drivers/net/wireless/ath/ath9k/xmit.c
index 29bf33692f71..fa12b9060b0b 100644
--- a/trunk/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/trunk/drivers/net/wireless/ath/ath9k/xmit.c
@@ -1615,7 +1615,7 @@ static int ath_tx_setup_buffer(struct ieee80211_hw *hw, struct ath_buf *bf,
 		bf->bf_frmlen -= padsize;
 	}
 
-	if (conf_is_ht(&hw->conf))
+	if (conf_is_ht(&hw->conf) && !is_pae(skb))
 		bf->bf_state.bf_type |= BUF_HT;
 
 	bf->bf_flags = setup_tx_flags(sc, skb, txctl->txq);
@@ -1701,7 +1701,7 @@ static void ath_tx_start_dma(struct ath_softc *sc, struct ath_buf *bf,
 			goto tx_done;
 		}
 
-		if ((tx_info->flags & IEEE80211_TX_CTL_AMPDU) && !is_pae(skb)) {
+		if (tx_info->flags & IEEE80211_TX_CTL_AMPDU) {
 			/*
 			 * Try aggregation if it's a unicast data frame
 			 * and the destination is HT capable.
diff --git a/trunk/drivers/net/wireless/b43/b43.h b/trunk/drivers/net/wireless/b43/b43.h
index c484cc253892..fe3bf9491997 100644
--- a/trunk/drivers/net/wireless/b43/b43.h
+++ b/trunk/drivers/net/wireless/b43/b43.h
@@ -115,7 +115,6 @@
 #define B43_MMIO_TSF_2			0x636	/* core rev < 3 only */
 #define B43_MMIO_TSF_3			0x638	/* core rev < 3 only */
 #define B43_MMIO_RNG			0x65A
-#define B43_MMIO_IFSSLOT		0x684	/* Interframe slot time */
 #define B43_MMIO_IFSCTL			0x688 /* Interframe space control */
 #define  B43_MMIO_IFSCTL_USE_EDCF	0x0004
 #define B43_MMIO_POWERUP_DELAY		0x6A8
diff --git a/trunk/drivers/net/wireless/b43/main.c b/trunk/drivers/net/wireless/b43/main.c
index 490fb45d1d05..4c41cfe44f26 100644
--- a/trunk/drivers/net/wireless/b43/main.c
+++ b/trunk/drivers/net/wireless/b43/main.c
@@ -628,17 +628,10 @@ static void b43_upload_card_macaddress(struct b43_wldev *dev)
 static void b43_set_slot_time(struct b43_wldev *dev, u16 slot_time)
 {
 	/* slot_time is in usec. */
-	/* This test used to exit for all but a G PHY. */
-	if (b43_current_band(dev->wl) == IEEE80211_BAND_5GHZ)
+	if (dev->phy.type != B43_PHYTYPE_G)
 		return;
-	b43_write16(dev, B43_MMIO_IFSSLOT, 510 + slot_time);
-	/* Shared memory location 0x0010 is the slot time and should be
-	 * set to slot_time; however, this register is initially 0 and changing
-	 * the value adversely affects the transmit rate for BCM4311
-	 * devices. Until this behavior is unterstood, delete this step
-	 *
-	 * b43_shm_write16(dev, B43_SHM_SHARED, 0x0010, slot_time);
-	 */
+	b43_write16(dev, 0x684, 510 + slot_time);
+	b43_shm_write16(dev, B43_SHM_SHARED, 0x0010, slot_time);
 }
 
 static void b43_short_slot_timing_enable(struct b43_wldev *dev)
diff --git a/trunk/drivers/net/wireless/iwlwifi/iwl-core.c b/trunk/drivers/net/wireless/iwlwifi/iwl-core.c
index d10bea64fce3..5461f105bd2d 100644
--- a/trunk/drivers/net/wireless/iwlwifi/iwl-core.c
+++ b/trunk/drivers/net/wireless/iwlwifi/iwl-core.c
@@ -2744,7 +2744,6 @@ int iwl_mac_config(struct ieee80211_hw *hw, u32 changed)
 		if ((le16_to_cpu(priv->staging_rxon.channel) != ch))
 			priv->staging_rxon.flags = 0;
 
-		iwl_set_rxon_ht(priv, ht_conf);
 		iwl_set_rxon_channel(priv, conf->channel);
 
 		iwl_set_flags_for_band(priv, conf->channel->band);
diff --git a/trunk/drivers/net/wireless/iwlwifi/iwl-rx.c b/trunk/drivers/net/wireless/iwlwifi/iwl-rx.c
index 2dbce85404aa..6f36b6e79f5e 100644
--- a/trunk/drivers/net/wireless/iwlwifi/iwl-rx.c
+++ b/trunk/drivers/net/wireless/iwlwifi/iwl-rx.c
@@ -928,10 +928,7 @@ static void iwl_pass_packet_to_mac80211(struct iwl_priv *priv,
 	if (ieee80211_is_mgmt(fc) ||
 	    ieee80211_has_protected(fc) ||
 	    ieee80211_has_morefrags(fc) ||
-	    le16_to_cpu(hdr->seq_ctrl) & IEEE80211_SCTL_FRAG ||
-	    (ieee80211_is_data_qos(fc) &&
-	     *ieee80211_get_qos_ctl(hdr) &
-	     IEEE80211_QOS_CONTROL_A_MSDU_PRESENT))
+	    le16_to_cpu(hdr->seq_ctrl) & IEEE80211_SCTL_FRAG)
 		ret = skb_linearize(skb);
 	else
 		ret = __pskb_pull_tail(skb, min_t(u16, IWL_LINK_HDR_MAX, len)) ?
diff --git a/trunk/drivers/net/wireless/iwmc3200wifi/rx.c b/trunk/drivers/net/wireless/iwmc3200wifi/rx.c
index f727b4a83196..6d6ed7485175 100644
--- a/trunk/drivers/net/wireless/iwmc3200wifi/rx.c
+++ b/trunk/drivers/net/wireless/iwmc3200wifi/rx.c
@@ -794,7 +794,7 @@ static int iwm_mlme_update_bss_table(struct iwm_priv *iwm, u8 *buf,
 	}
 
 	bss->bss = kzalloc(bss_len, GFP_KERNEL);
-	if (!bss->bss) {
+	if (!bss) {
 		kfree(bss);
 		IWM_ERR(iwm, "Couldn't allocate bss\n");
 		return -ENOMEM;
diff --git a/trunk/drivers/net/wireless/rtl818x/rtl8187_dev.c b/trunk/drivers/net/wireless/rtl818x/rtl8187_dev.c
index 7ba3052b0708..bc5726dd5fe4 100644
--- a/trunk/drivers/net/wireless/rtl818x/rtl8187_dev.c
+++ b/trunk/drivers/net/wireless/rtl818x/rtl8187_dev.c
@@ -65,7 +65,6 @@ static struct usb_device_id rtl8187_table[] __devinitdata = {
 	/* Sitecom */
 	{USB_DEVICE(0x0df6, 0x000d), .driver_info = DEVICE_RTL8187},
 	{USB_DEVICE(0x0df6, 0x0028), .driver_info = DEVICE_RTL8187B},
-	{USB_DEVICE(0x0df6, 0x0029), .driver_info = DEVICE_RTL8187B},
 	/* Sphairon Access Systems GmbH */
 	{USB_DEVICE(0x114B, 0x0150), .driver_info = DEVICE_RTL8187},
 	/* Dick Smith Electronics */
diff --git a/trunk/drivers/ssb/main.c b/trunk/drivers/ssb/main.c
index 03dfd27c4bfb..5681ebed9c65 100644
--- a/trunk/drivers/ssb/main.c
+++ b/trunk/drivers/ssb/main.c
@@ -494,7 +494,8 @@ static int ssb_devices_register(struct ssb_bus *bus)
 #endif
 			break;
 		case SSB_BUSTYPE_SDIO:
-#ifdef CONFIG_SSB_SDIOHOST
+#ifdef CONFIG_SSB_SDIO
+			sdev->irq = bus->host_sdio->dev.irq;
 			dev->parent = &bus->host_sdio->dev;
 #endif
 			break;
diff --git a/trunk/fs/sysfs/inode.c b/trunk/fs/sysfs/inode.c
index 220b758523ae..6a06a1d1ea7b 100644
--- a/trunk/fs/sysfs/inode.c
+++ b/trunk/fs/sysfs/inode.c
@@ -81,24 +81,23 @@ int sysfs_sd_setattr(struct sysfs_dirent *sd, struct iattr * iattr)
 		if (!sd_attrs)
 			return -ENOMEM;
 		sd->s_iattr = sd_attrs;
-	} else {
-		/* attributes were changed at least once in past */
-		iattrs = &sd_attrs->ia_iattr;
-
-		if (ia_valid & ATTR_UID)
-			iattrs->ia_uid = iattr->ia_uid;
-		if (ia_valid & ATTR_GID)
-			iattrs->ia_gid = iattr->ia_gid;
-		if (ia_valid & ATTR_ATIME)
-			iattrs->ia_atime = iattr->ia_atime;
-		if (ia_valid & ATTR_MTIME)
-			iattrs->ia_mtime = iattr->ia_mtime;
-		if (ia_valid & ATTR_CTIME)
-			iattrs->ia_ctime = iattr->ia_ctime;
-		if (ia_valid & ATTR_MODE) {
-			umode_t mode = iattr->ia_mode;
-			iattrs->ia_mode = sd->s_mode = mode;
-		}
+	}
+	/* attributes were changed at least once in past */
+	iattrs = &sd_attrs->ia_iattr;
+
+	if (ia_valid & ATTR_UID)
+		iattrs->ia_uid = iattr->ia_uid;
+	if (ia_valid & ATTR_GID)
+		iattrs->ia_gid = iattr->ia_gid;
+	if (ia_valid & ATTR_ATIME)
+		iattrs->ia_atime = iattr->ia_atime;
+	if (ia_valid & ATTR_MTIME)
+		iattrs->ia_mtime = iattr->ia_mtime;
+	if (ia_valid & ATTR_CTIME)
+		iattrs->ia_ctime = iattr->ia_ctime;
+	if (ia_valid & ATTR_MODE) {
+		umode_t mode = iattr->ia_mode;
+		iattrs->ia_mode = sd->s_mode = mode;
 	}
 	return 0;
 }
diff --git a/trunk/net/core/ethtool.c b/trunk/net/core/ethtool.c
index 236a9988ea91..d8aee584e8d1 100644
--- a/trunk/net/core/ethtool.c
+++ b/trunk/net/core/ethtool.c
@@ -927,7 +927,6 @@ int dev_ethtool(struct net *net, struct ifreq *ifr)
 	case ETHTOOL_GPERMADDR:
 	case ETHTOOL_GUFO:
 	case ETHTOOL_GGSO:
-	case ETHTOOL_GGRO:
 	case ETHTOOL_GFLAGS:
 	case ETHTOOL_GPFLAGS:
 	case ETHTOOL_GRXFH:
diff --git a/trunk/net/ipv4/igmp.c b/trunk/net/ipv4/igmp.c
index a42f658e756a..76c08402c933 100644
--- a/trunk/net/ipv4/igmp.c
+++ b/trunk/net/ipv4/igmp.c
@@ -946,6 +946,7 @@ int igmp_rcv(struct sk_buff *skb)
 		break;
 	case IGMP_HOST_MEMBERSHIP_REPORT:
 	case IGMPV2_HOST_MEMBERSHIP_REPORT:
+	case IGMPV3_HOST_MEMBERSHIP_REPORT:
 		/* Is it our report looped back? */
 		if (skb_rtable(skb)->fl.iif == 0)
 			break;
@@ -959,7 +960,6 @@ int igmp_rcv(struct sk_buff *skb)
 		in_dev_put(in_dev);
 		return pim_rcv_v1(skb);
 #endif
-	case IGMPV3_HOST_MEMBERSHIP_REPORT:
 	case IGMP_DVMRP:
 	case IGMP_TRACE:
 	case IGMP_HOST_LEAVE_MESSAGE:
diff --git a/trunk/net/ipv4/ipcomp.c b/trunk/net/ipv4/ipcomp.c
index 544ce0876f12..38fbf04150ae 100644
--- a/trunk/net/ipv4/ipcomp.c
+++ b/trunk/net/ipv4/ipcomp.c
@@ -124,12 +124,16 @@ static int ipcomp4_init_state(struct xfrm_state *x)
 	if (x->props.mode == XFRM_MODE_TUNNEL) {
 		err = ipcomp_tunnel_attach(x);
 		if (err)
-			goto out;
+			goto error_tunnel;
 	}
 
 	err = 0;
 out:
 	return err;
+
+error_tunnel:
+	ipcomp_destroy(x);
+	goto out;
 }
 
 static const struct xfrm_type ipcomp_type = {
diff --git a/trunk/net/ipv4/tcp_input.c b/trunk/net/ipv4/tcp_input.c
index 3fddc69ccccc..28e029632493 100644
--- a/trunk/net/ipv4/tcp_input.c
+++ b/trunk/net/ipv4/tcp_input.c
@@ -5783,9 +5783,11 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
 
 				/* tcp_ack considers this ACK as duplicate
 				 * and does not calculate rtt.
-				 * Force it here.
+				 * Fix it at least with timestamps.
 				 */
-				tcp_ack_update_rtt(sk, 0, 0);
+				if (tp->rx_opt.saw_tstamp &&
+				    tp->rx_opt.rcv_tsecr && !tp->srtt)
+					tcp_ack_saw_tstamp(sk, 0);
 
 				if (tp->rx_opt.tstamp_ok)
 					tp->advmss -= TCPOLEN_TSTAMP_ALIGNED;
diff --git a/trunk/net/ipv6/ipcomp6.c b/trunk/net/ipv6/ipcomp6.c
index 002e6eef9120..2f2a5ca2c878 100644
--- a/trunk/net/ipv6/ipcomp6.c
+++ b/trunk/net/ipv6/ipcomp6.c
@@ -154,12 +154,16 @@ static int ipcomp6_init_state(struct xfrm_state *x)
 	if (x->props.mode == XFRM_MODE_TUNNEL) {
 		err = ipcomp6_tunnel_attach(x);
 		if (err)
-			goto out;
+			goto error_tunnel;
 	}
 
 	err = 0;
 out:
 	return err;
+error_tunnel:
+	ipcomp_destroy(x);
+
+	goto out;
 }
 
 static const struct xfrm_type ipcomp6_type =
diff --git a/trunk/net/mac80211/ibss.c b/trunk/net/mac80211/ibss.c
index 22f0c2aa7a89..1f2db647bb5c 100644
--- a/trunk/net/mac80211/ibss.c
+++ b/trunk/net/mac80211/ibss.c
@@ -647,7 +647,7 @@ static void ieee80211_rx_mgmt_probe_req(struct ieee80211_sub_if_data *sdata,
 	}
 	if (pos[1] != 0 &&
 	    (pos[1] != ifibss->ssid_len ||
-	     memcmp(pos + 2, ifibss->ssid, ifibss->ssid_len))) {
+	     !memcmp(pos + 2, ifibss->ssid, ifibss->ssid_len))) {
 		/* Ignore ProbeReq for foreign SSID */
 		return;
 	}
diff --git a/trunk/net/mac80211/rate.c b/trunk/net/mac80211/rate.c
index 12a2bff7dcdb..b9007f80cb92 100644
--- a/trunk/net/mac80211/rate.c
+++ b/trunk/net/mac80211/rate.c
@@ -245,9 +245,6 @@ void rate_control_get_rate(struct ieee80211_sub_if_data *sdata,
 		info->control.rates[i].count = 1;
 	}
 
-	if (sdata->local->hw.flags & IEEE80211_HW_HAS_RATE_CONTROL)
-		return;
-
 	if (sta && sdata->force_unicast_rateidx > -1) {
 		info->control.rates[0].idx = sdata->force_unicast_rateidx;
 	} else {
diff --git a/trunk/net/mac80211/scan.c b/trunk/net/mac80211/scan.c
index bc17cf7d68db..f934c9620b73 100644
--- a/trunk/net/mac80211/scan.c
+++ b/trunk/net/mac80211/scan.c
@@ -439,16 +439,6 @@ static int __ieee80211_start_scan(struct ieee80211_sub_if_data *sdata,
 	if (local->scan_req)
 		return -EBUSY;
 
-	if (req != local->int_scan_req &&
-	    sdata->vif.type == NL80211_IFTYPE_STATION &&
-	    !list_empty(&ifmgd->work_list)) {
-		/* actually wait for the work it's doing to finish/time out */
-		set_bit(IEEE80211_STA_REQ_SCAN, &ifmgd->request);
-		local->scan_req = req;
-		local->scan_sdata = sdata;
-		return 0;
-	}
-
 	if (local->ops->hw_scan) {
 		u8 *ies;
 
@@ -473,6 +463,14 @@ static int __ieee80211_start_scan(struct ieee80211_sub_if_data *sdata,
 	local->scan_req = req;
 	local->scan_sdata = sdata;
 
+	if (req != local->int_scan_req &&
+	    sdata->vif.type == NL80211_IFTYPE_STATION &&
+	    !list_empty(&ifmgd->work_list)) {
+		/* actually wait for the work it's doing to finish/time out */
+		set_bit(IEEE80211_STA_REQ_SCAN, &ifmgd->request);
+		return 0;
+	}
+
 	if (local->ops->hw_scan)
 		__set_bit(SCAN_HW_SCANNING, &local->scanning);
 	else
diff --git a/trunk/net/xfrm/xfrm_state.c b/trunk/net/xfrm/xfrm_state.c
index f445ea1c5f52..b36cc344474b 100644
--- a/trunk/net/xfrm/xfrm_state.c
+++ b/trunk/net/xfrm/xfrm_state.c
@@ -1102,7 +1102,7 @@ static struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig, int *errp)
 	int err = -ENOMEM;
 	struct xfrm_state *x = xfrm_state_alloc(net);
 	if (!x)
-		goto out;
+		goto error;
 
 	memcpy(&x->id, &orig->id, sizeof(x->id));
 	memcpy(&x->sel, &orig->sel, sizeof(x->sel));
@@ -1160,10 +1160,16 @@ static struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig, int *errp)
 	return x;
 
  error:
-	xfrm_state_put(x);
-out:
 	if (errp)
 		*errp = err;
+	if (x) {
+		kfree(x->aalg);
+		kfree(x->ealg);
+		kfree(x->calg);
+		kfree(x->encap);
+		kfree(x->coaddr);
+	}
+	kfree(x);
 	return NULL;
 }