Merge tag 'asoc-fix-v3.19-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus

ASoC: Fixes for v3.19

A few last minute fixes for v3.19, all driver specific.  None of them
stand out particularly - it's all the standard people who are affected
will care stuff.

The Samsung fix is a DT only fix for the audio controller, it's being
merged via the ASoC tree due to process messups (the submitter sent it
at the end of a tangentally related series rather than separately to the
ARM folks) in order to make sure that it gets to people sooner.

19 files changed, 293 insertions, 117 deletions

diff --git a/drivers/net/can/c_can/c_can.c b/drivers/net/can/c_can/c_can.c
index f94a9fa60488..c672c4dcffac 100644
--- a/drivers/net/can/c_can/c_can.c
+++ b/drivers/net/can/c_can/c_can.c
@@ -615,6 +615,9 @@ static void c_can_stop(struct net_device *dev)
 
         c_can_irq_control(priv, false);
 
+        /* put ctrl to init on stop to end ongoing transmission */
+        priv->write_reg(priv, C_CAN_CTRL_REG, CONTROL_INIT);
+
         /* deactivate pins */
         pinctrl_pm_select_sleep_state(dev->dev.parent);
         priv->can.state = CAN_STATE_STOPPED;
diff --git a/drivers/net/can/usb/kvaser_usb.c b/drivers/net/can/usb/kvaser_usb.c
index c32cd61073bc..7af379ca861b 100644
--- a/drivers/net/can/usb/kvaser_usb.c
+++ b/drivers/net/can/usb/kvaser_usb.c
@@ -587,7 +587,7 @@ static int kvaser_usb_simple_msg_async(struct kvaser_usb_net_priv *priv,
                           usb_sndbulkpipe(dev->udev,
                                           dev->bulk_out->bEndpointAddress),
                           buf, msg->len,
-                          kvaser_usb_simple_msg_callback, priv);
+                          kvaser_usb_simple_msg_callback, netdev);
         usb_anchor_urb(urb, &priv->tx_submitted);
 
         err = usb_submit_urb(urb, GFP_ATOMIC);
@@ -662,11 +662,6 @@ static void kvaser_usb_rx_error(const struct kvaser_usb *dev,
         priv = dev->nets[channel];
         stats = &priv->netdev->stats;
 
-        if (status & M16C_STATE_BUS_RESET) {
-                kvaser_usb_unlink_tx_urbs(priv);
-                return;
-        }
-
         skb = alloc_can_err_skb(priv->netdev, &cf);
         if (!skb) {
                 stats->rx_dropped++;
@@ -677,7 +672,7 @@ static void kvaser_usb_rx_error(const struct kvaser_usb *dev,
 
         netdev_dbg(priv->netdev, "Error status: 0x%02x\n", status);
 
-        if (status & M16C_STATE_BUS_OFF) {
+        if (status & (M16C_STATE_BUS_OFF | M16C_STATE_BUS_RESET)) {
                 cf->can_id |= CAN_ERR_BUSOFF;
 
                 priv->can.can_stats.bus_off++;
@@ -703,9 +698,7 @@ static void kvaser_usb_rx_error(const struct kvaser_usb *dev,
                 }
 
                 new_state = CAN_STATE_ERROR_PASSIVE;
-        }
-
-        if (status == M16C_STATE_BUS_ERROR) {
+        } else if (status & M16C_STATE_BUS_ERROR) {
                 if ((priv->can.state < CAN_STATE_ERROR_WARNING) &&
                     ((txerr >= 96) || (rxerr >= 96))) {
                         cf->can_id |= CAN_ERR_CRTL;
@@ -715,7 +708,8 @@ static void kvaser_usb_rx_error(const struct kvaser_usb *dev,
 
                         priv->can.can_stats.error_warning++;
                         new_state = CAN_STATE_ERROR_WARNING;
-                } else if (priv->can.state > CAN_STATE_ERROR_ACTIVE) {
+                } else if ((priv->can.state > CAN_STATE_ERROR_ACTIVE) &&
+                           ((txerr < 96) && (rxerr < 96))) {
                         cf->can_id |= CAN_ERR_PROT;
                         cf->data[2] = CAN_ERR_PROT_ACTIVE;
 
@@ -1590,7 +1584,7 @@ static int kvaser_usb_probe(struct usb_interface *intf,
 {
         struct kvaser_usb *dev;
         int err = -ENOMEM;
-        int i;
+        int i, retry = 3;
 
         dev = devm_kzalloc(&intf->dev, sizeof(*dev), GFP_KERNEL);
         if (!dev)
@@ -1608,7 +1602,15 @@ static int kvaser_usb_probe(struct usb_interface *intf,
 
         usb_set_intfdata(intf, dev);
 
-        err = kvaser_usb_get_software_info(dev);
+        /* On some x86 laptops, plugging a Kvaser device again after
+         * an unplug makes the firmware always ignore the very first
+         * command. For such a case, provide some room for retries
+         * instead of completely exiting the driver.
+         */
+        do {
+                err = kvaser_usb_get_software_info(dev);
+        } while (--retry && err == -ETIMEDOUT);
+
         if (err) {
                 dev_err(&intf->dev,
                         "Cannot get software infos, error %d\n", err);
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-common.h b/drivers/net/ethernet/amd/xgbe/xgbe-common.h
index 75b08c63d39f..29a09271b64a 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-common.h
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-common.h
@@ -767,16 +767,17 @@
 #define MTL_Q_RQOMR                     0x40
 #define MTL_Q_RQMPOCR                   0x44
 #define MTL_Q_RQDR                      0x4c
+#define MTL_Q_RQFCR                     0x50
 #define MTL_Q_IER                       0x70
 #define MTL_Q_ISR                       0x74
 
 /* MTL queue register entry bit positions and sizes */
+#define MTL_Q_RQFCR_RFA_INDEX           1
+#define MTL_Q_RQFCR_RFA_WIDTH           6
+#define MTL_Q_RQFCR_RFD_INDEX           17
+#define MTL_Q_RQFCR_RFD_WIDTH           6
 #define MTL_Q_RQOMR_EHFC_INDEX          7
 #define MTL_Q_RQOMR_EHFC_WIDTH          1
-#define MTL_Q_RQOMR_RFA_INDEX           8
-#define MTL_Q_RQOMR_RFA_WIDTH           3
-#define MTL_Q_RQOMR_RFD_INDEX           13
-#define MTL_Q_RQOMR_RFD_WIDTH           3
 #define MTL_Q_RQOMR_RQS_INDEX           16
 #define MTL_Q_RQOMR_RQS_WIDTH           9
 #define MTL_Q_RQOMR_RSF_INDEX           5
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-dev.c b/drivers/net/ethernet/amd/xgbe/xgbe-dev.c
index 53f5f66ec2ee..4c66cd1d1e60 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-dev.c
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-dev.c
@@ -2079,10 +2079,10 @@ static void xgbe_config_flow_control_threshold(struct xgbe_prv_data *pdata)
 
         for (i = 0; i < pdata->rx_q_count; i++) {
                 /* Activate flow control when less than 4k left in fifo */
-                XGMAC_MTL_IOWRITE_BITS(pdata, i, MTL_Q_RQOMR, RFA, 2);
+                XGMAC_MTL_IOWRITE_BITS(pdata, i, MTL_Q_RQFCR, RFA, 2);
 
                 /* De-activate flow control when more than 6k left in fifo */
-                XGMAC_MTL_IOWRITE_BITS(pdata, i, MTL_Q_RQOMR, RFD, 4);
+                XGMAC_MTL_IOWRITE_BITS(pdata, i, MTL_Q_RQFCR, RFD, 4);
         }
 }
 
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
index 1d1147c93d59..e468ed3f210f 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
@@ -3175,7 +3175,7 @@ static int bnx2x_poll(struct napi_struct *napi, int budget)
                 }
 #endif
                 if (!bnx2x_fp_lock_napi(fp))
-                        return work_done;
+                        return budget;
 
                 for_each_cos_in_tx_queue(fp, cos)
                         if (bnx2x_tx_queue_has_work(fp->txdata_ptr[cos]))
diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c b/drivers/net/ethernet/cisco/enic/enic_main.c
index b29e027c476e..e356afa44e7d 100644
--- a/drivers/net/ethernet/cisco/enic/enic_main.c
+++ b/drivers/net/ethernet/cisco/enic/enic_main.c
@@ -1335,7 +1335,7 @@ static int enic_poll_msix_rq(struct napi_struct *napi, int budget)
         int err;
 
         if (!enic_poll_lock_napi(&enic->rq[rq]))
-                return work_done;
+                return budget;
         /* Service RQ
          */
 
diff --git a/drivers/net/ethernet/marvell/mv643xx_eth.c b/drivers/net/ethernet/marvell/mv643xx_eth.c
index a62fc38f045e..1c75829eb166 100644
--- a/drivers/net/ethernet/marvell/mv643xx_eth.c
+++ b/drivers/net/ethernet/marvell/mv643xx_eth.c
@@ -192,6 +192,10 @@ static char mv643xx_eth_driver_version[] = "1.4";
 #define IS_TSO_HEADER(txq, addr) \
         ((addr >= txq->tso_hdrs_dma) && \
          (addr < txq->tso_hdrs_dma + txq->tx_ring_size * TSO_HEADER_SIZE))
+
+#define DESC_DMA_MAP_SINGLE 0
+#define DESC_DMA_MAP_PAGE 1
+
 /*
  * RX/TX descriptors.
  */
@@ -362,6 +366,7 @@ struct tx_queue {
         dma_addr_t tso_hdrs_dma;
 
         struct tx_desc *tx_desc_area;
+        char *tx_desc_mapping; /* array to track the type of the dma mapping */
         dma_addr_t tx_desc_dma;
         int tx_desc_area_size;
 
@@ -750,6 +755,7 @@ txq_put_data_tso(struct net_device *dev, struct tx_queue *txq,
         if (txq->tx_curr_desc == txq->tx_ring_size)
                 txq->tx_curr_desc = 0;
         desc = &txq->tx_desc_area[tx_index];
+        txq->tx_desc_mapping[tx_index] = DESC_DMA_MAP_SINGLE;
 
         desc->l4i_chk = 0;
         desc->byte_cnt = length;
@@ -879,14 +885,13 @@ static void txq_submit_frag_skb(struct tx_queue *txq, struct sk_buff *skb)
                 skb_frag_t *this_frag;
                 int tx_index;
                 struct tx_desc *desc;
-                void *addr;
 
                 this_frag = &skb_shinfo(skb)->frags[frag];
-                addr = page_address(this_frag->page.p) + this_frag->page_offset;
                 tx_index = txq->tx_curr_desc++;
                 if (txq->tx_curr_desc == txq->tx_ring_size)
                         txq->tx_curr_desc = 0;
                 desc = &txq->tx_desc_area[tx_index];
+                txq->tx_desc_mapping[tx_index] = DESC_DMA_MAP_PAGE;
 
                 /*
                  * The last fragment will generate an interrupt
@@ -902,8 +907,9 @@ static void txq_submit_frag_skb(struct tx_queue *txq, struct sk_buff *skb)
 
                 desc->l4i_chk = 0;
                 desc->byte_cnt = skb_frag_size(this_frag);
-                desc->buf_ptr = dma_map_single(mp->dev->dev.parent, addr,
-                                               desc->byte_cnt, DMA_TO_DEVICE);
+                desc->buf_ptr = skb_frag_dma_map(mp->dev->dev.parent,
+                                                 this_frag, 0, desc->byte_cnt,
+                                                 DMA_TO_DEVICE);
         }
 }
 
@@ -936,6 +942,7 @@ static int txq_submit_skb(struct tx_queue *txq, struct sk_buff *skb,
         if (txq->tx_curr_desc == txq->tx_ring_size)
                 txq->tx_curr_desc = 0;
         desc = &txq->tx_desc_area[tx_index];
+        txq->tx_desc_mapping[tx_index] = DESC_DMA_MAP_SINGLE;
 
         if (nr_frags) {
                 txq_submit_frag_skb(txq, skb);
@@ -1047,9 +1054,12 @@ static int txq_reclaim(struct tx_queue *txq, int budget, int force)
                 int tx_index;
                 struct tx_desc *desc;
                 u32 cmd_sts;
+                char desc_dma_map;
 
                 tx_index = txq->tx_used_desc;
                 desc = &txq->tx_desc_area[tx_index];
+                desc_dma_map = txq->tx_desc_mapping[tx_index];
+
                 cmd_sts = desc->cmd_sts;
 
                 if (cmd_sts & BUFFER_OWNED_BY_DMA) {
@@ -1065,9 +1075,19 @@ static int txq_reclaim(struct tx_queue *txq, int budget, int force)
                 reclaimed++;
                 txq->tx_desc_count--;
 
-                if (!IS_TSO_HEADER(txq, desc->buf_ptr))
-                        dma_unmap_single(mp->dev->dev.parent, desc->buf_ptr,
-                                         desc->byte_cnt, DMA_TO_DEVICE);
+                if (!IS_TSO_HEADER(txq, desc->buf_ptr)) {
+
+                        if (desc_dma_map == DESC_DMA_MAP_PAGE)
+                                dma_unmap_page(mp->dev->dev.parent,
+                                               desc->buf_ptr,
+                                               desc->byte_cnt,
+                                               DMA_TO_DEVICE);
+                        else
+                                dma_unmap_single(mp->dev->dev.parent,
+                                                 desc->buf_ptr,
+                                                 desc->byte_cnt,
+                                                 DMA_TO_DEVICE);
+                }
 
                 if (cmd_sts & TX_ENABLE_INTERRUPT) {
                         struct sk_buff *skb = __skb_dequeue(&txq->tx_skb);
@@ -1996,6 +2016,7 @@ static int txq_init(struct mv643xx_eth_private *mp, int index)
         struct tx_queue *txq = mp->txq + index;
         struct tx_desc *tx_desc;
         int size;
+        int ret;
         int i;
 
         txq->index = index;
@@ -2048,18 +2069,34 @@ static int txq_init(struct mv643xx_eth_private *mp, int index)
                                         nexti * sizeof(struct tx_desc);
         }
 
+        txq->tx_desc_mapping = kcalloc(txq->tx_ring_size, sizeof(char),
+                                       GFP_KERNEL);
+        if (!txq->tx_desc_mapping) {
+                ret = -ENOMEM;
+                goto err_free_desc_area;
+        }
+
         /* Allocate DMA buffers for TSO MAC/IP/TCP headers */
         txq->tso_hdrs = dma_alloc_coherent(mp->dev->dev.parent,
                                            txq->tx_ring_size * TSO_HEADER_SIZE,
                                            &txq->tso_hdrs_dma, GFP_KERNEL);
         if (txq->tso_hdrs == NULL) {
-                dma_free_coherent(mp->dev->dev.parent, txq->tx_desc_area_size,
-                                  txq->tx_desc_area, txq->tx_desc_dma);
-                return -ENOMEM;
+                ret = -ENOMEM;
+                goto err_free_desc_mapping;
         }
         skb_queue_head_init(&txq->tx_skb);
 
         return 0;
+
+err_free_desc_mapping:
+        kfree(txq->tx_desc_mapping);
+err_free_desc_area:
+        if (index == 0 && size <= mp->tx_desc_sram_size)
+                iounmap(txq->tx_desc_area);
+        else
+                dma_free_coherent(mp->dev->dev.parent, txq->tx_desc_area_size,
+                                  txq->tx_desc_area, txq->tx_desc_dma);
+        return ret;
 }
 
 static void txq_deinit(struct tx_queue *txq)
@@ -2077,6 +2114,8 @@ static void txq_deinit(struct tx_queue *txq)
         else
                 dma_free_coherent(mp->dev->dev.parent, txq->tx_desc_area_size,
                                   txq->tx_desc_area, txq->tx_desc_dma);
+        kfree(txq->tx_desc_mapping);
+
         if (txq->tso_hdrs)
                 dma_free_coherent(mp->dev->dev.parent,
                                   txq->tx_ring_size * TSO_HEADER_SIZE,
diff --git a/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c b/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
index 613037584d08..c531c8ae1be4 100644
--- a/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
+++ b/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
@@ -2388,7 +2388,10 @@ static int netxen_nic_poll(struct napi_struct *napi, int budget)
 
         work_done = netxen_process_rcv_ring(sds_ring, budget);
 
-        if ((work_done < budget) && tx_complete) {
+        if (!tx_complete)
+                work_done = budget;
+
+        if (work_done < budget) {
                 napi_complete(&sds_ring->napi);
                 if (test_bit(__NX_DEV_UP, &adapter->state))
                         netxen_nic_enable_int(sds_ring);
diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
index 6576243222af..04283fe0e6a7 100644
--- a/drivers/net/ethernet/renesas/sh_eth.c
+++ b/drivers/net/ethernet/renesas/sh_eth.c
@@ -396,6 +396,9 @@ static const u16 sh_eth_offset_fast_sh3_sh2[SH_ETH_MAX_REGISTER_OFFSET] = {
         [TSU_ADRL31]    = 0x01fc,
 };
 
+static void sh_eth_rcv_snd_disable(struct net_device *ndev);
+static struct net_device_stats *sh_eth_get_stats(struct net_device *ndev);
+
 static bool sh_eth_is_gether(struct sh_eth_private *mdp)
 {
         return mdp->reg_offset == sh_eth_offset_gigabit;
@@ -1120,6 +1123,7 @@ static void sh_eth_ring_format(struct net_device *ndev)
         int rx_ringsize = sizeof(*rxdesc) * mdp->num_rx_ring;
         int tx_ringsize = sizeof(*txdesc) * mdp->num_tx_ring;
         int skbuff_size = mdp->rx_buf_sz + SH_ETH_RX_ALIGN - 1;
+        dma_addr_t dma_addr;
 
         mdp->cur_rx = 0;
         mdp->cur_tx = 0;
@@ -1133,7 +1137,6 @@ static void sh_eth_ring_format(struct net_device *ndev)
                 /* skb */
                 mdp->rx_skbuff[i] = NULL;
                 skb = netdev_alloc_skb(ndev, skbuff_size);
-                mdp->rx_skbuff[i] = skb;
                 if (skb == NULL)
                         break;
                 sh_eth_set_receive_align(skb);
@@ -1142,9 +1145,15 @@ static void sh_eth_ring_format(struct net_device *ndev)
                 rxdesc = &mdp->rx_ring[i];
                 /* The size of the buffer is a multiple of 16 bytes. */
                 rxdesc->buffer_length = ALIGN(mdp->rx_buf_sz, 16);
-                dma_map_single(&ndev->dev, skb->data, rxdesc->buffer_length,
-                               DMA_FROM_DEVICE);
-                rxdesc->addr = virt_to_phys(skb->data);
+                dma_addr = dma_map_single(&ndev->dev, skb->data,
+                                          rxdesc->buffer_length,
+                                          DMA_FROM_DEVICE);
+                if (dma_mapping_error(&ndev->dev, dma_addr)) {
+                        kfree_skb(skb);
+                        break;
+                }
+                mdp->rx_skbuff[i] = skb;
+                rxdesc->addr = dma_addr;
                 rxdesc->status = cpu_to_edmac(mdp, RD_RACT | RD_RFP);
 
                 /* Rx descriptor address set */
@@ -1316,8 +1325,10 @@ static int sh_eth_dev_init(struct net_device *ndev, bool start)
                      RFLR);
 
         sh_eth_write(ndev, sh_eth_read(ndev, EESR), EESR);
-        if (start)
+        if (start) {
+                mdp->irq_enabled = true;
                 sh_eth_write(ndev, mdp->cd->eesipr_value, EESIPR);
+        }
 
         /* PAUSE Prohibition */
         val = (sh_eth_read(ndev, ECMR) & ECMR_DM) |
@@ -1356,6 +1367,33 @@ static int sh_eth_dev_init(struct net_device *ndev, bool start)
         return ret;
 }
 
+static void sh_eth_dev_exit(struct net_device *ndev)
+{
+        struct sh_eth_private *mdp = netdev_priv(ndev);
+        int i;
+
+        /* Deactivate all TX descriptors, so DMA should stop at next
+         * packet boundary if it's currently running
+         */
+        for (i = 0; i < mdp->num_tx_ring; i++)
+                mdp->tx_ring[i].status &= ~cpu_to_edmac(mdp, TD_TACT);
+
+        /* Disable TX FIFO egress to MAC */
+        sh_eth_rcv_snd_disable(ndev);
+
+        /* Stop RX DMA at next packet boundary */
+        sh_eth_write(ndev, 0, EDRRR);
+
+        /* Aside from TX DMA, we can't tell when the hardware is
+         * really stopped, so we need to reset to make sure.
+         * Before doing that, wait for long enough to *probably*
+         * finish transmitting the last packet and poll stats.
+         */
+        msleep(2); /* max frame time at 10 Mbps < 1250 us */
+        sh_eth_get_stats(ndev);
+        sh_eth_reset(ndev);
+}
+
 /* free Tx skb function */
 static int sh_eth_txfree(struct net_device *ndev)
 {
@@ -1400,6 +1438,7 @@ static int sh_eth_rx(struct net_device *ndev, u32 intr_status, int *quota)
         u16 pkt_len = 0;
         u32 desc_status;
         int skbuff_size = mdp->rx_buf_sz + SH_ETH_RX_ALIGN - 1;
+        dma_addr_t dma_addr;
 
         boguscnt = min(boguscnt, *quota);
         limit = boguscnt;
@@ -1447,9 +1486,9 @@ static int sh_eth_rx(struct net_device *ndev, u32 intr_status, int *quota)
                         mdp->rx_skbuff[entry] = NULL;
                         if (mdp->cd->rpadir)
                                 skb_reserve(skb, NET_IP_ALIGN);
-                        dma_sync_single_for_cpu(&ndev->dev, rxdesc->addr,
-                                                ALIGN(mdp->rx_buf_sz, 16),
-                                                DMA_FROM_DEVICE);
+                        dma_unmap_single(&ndev->dev, rxdesc->addr,
+                                         ALIGN(mdp->rx_buf_sz, 16),
+                                         DMA_FROM_DEVICE);
                         skb_put(skb, pkt_len);
                         skb->protocol = eth_type_trans(skb, ndev);
                         netif_receive_skb(skb);
@@ -1469,15 +1508,20 @@ static int sh_eth_rx(struct net_device *ndev, u32 intr_status, int *quota)
 
                 if (mdp->rx_skbuff[entry] == NULL) {
                         skb = netdev_alloc_skb(ndev, skbuff_size);
-                        mdp->rx_skbuff[entry] = skb;
                         if (skb == NULL)
                                 break;  /* Better luck next round. */
                         sh_eth_set_receive_align(skb);
-                        dma_map_single(&ndev->dev, skb->data,
-                                       rxdesc->buffer_length, DMA_FROM_DEVICE);
+                        dma_addr = dma_map_single(&ndev->dev, skb->data,
+                                                  rxdesc->buffer_length,
+                                                  DMA_FROM_DEVICE);
+                        if (dma_mapping_error(&ndev->dev, dma_addr)) {
+                                kfree_skb(skb);
+                                break;
+                        }
+                        mdp->rx_skbuff[entry] = skb;
 
                         skb_checksum_none_assert(skb);
-                        rxdesc->addr = virt_to_phys(skb->data);
+                        rxdesc->addr = dma_addr;
                 }
                 if (entry >= mdp->num_rx_ring - 1)
                         rxdesc->status |=
@@ -1573,7 +1617,6 @@ ignore_link:
                 if (intr_status & EESR_RFRMER) {
                         /* Receive Frame Overflow int */
                         ndev->stats.rx_frame_errors++;
-                        netif_err(mdp, rx_err, ndev, "Receive Abort\n");
                 }
         }
 
@@ -1592,13 +1635,11 @@ ignore_link:
         if (intr_status & EESR_RDE) {
                 /* Receive Descriptor Empty int */
                 ndev->stats.rx_over_errors++;
-                netif_err(mdp, rx_err, ndev, "Receive Descriptor Empty\n");
         }
 
         if (intr_status & EESR_RFE) {
                 /* Receive FIFO Overflow int */
                 ndev->stats.rx_fifo_errors++;
-                netif_err(mdp, rx_err, ndev, "Receive FIFO Overflow\n");
         }
 
         if (!mdp->cd->no_ade && (intr_status & EESR_ADE)) {
@@ -1653,7 +1694,12 @@ static irqreturn_t sh_eth_interrupt(int irq, void *netdev)
         if (intr_status & (EESR_RX_CHECK | cd->tx_check | cd->eesr_err_check))
                 ret = IRQ_HANDLED;
         else
-                goto other_irq;
+                goto out;
+
+        if (!likely(mdp->irq_enabled)) {
+                sh_eth_write(ndev, 0, EESIPR);
+                goto out;
+        }
 
         if (intr_status & EESR_RX_CHECK) {
                 if (napi_schedule_prep(&mdp->napi)) {
@@ -1684,7 +1730,7 @@ static irqreturn_t sh_eth_interrupt(int irq, void *netdev)
                 sh_eth_error(ndev, intr_status);
         }
 
-other_irq:
+out:
         spin_unlock(&mdp->lock);
 
         return ret;
@@ -1712,7 +1758,8 @@ static int sh_eth_poll(struct napi_struct *napi, int budget)
         napi_complete(napi);
 
         /* Reenable Rx interrupts */
-        sh_eth_write(ndev, mdp->cd->eesipr_value, EESIPR);
+        if (mdp->irq_enabled)
+                sh_eth_write(ndev, mdp->cd->eesipr_value, EESIPR);
 out:
         return budget - quota;
 }
@@ -1968,40 +2015,50 @@ static int sh_eth_set_ringparam(struct net_device *ndev,
                 return -EINVAL;
 
         if (netif_running(ndev)) {
+                netif_device_detach(ndev);
                 netif_tx_disable(ndev);
-                /* Disable interrupts by clearing the interrupt mask. */
-                sh_eth_write(ndev, 0x0000, EESIPR);
-                /* Stop the chip's Tx and Rx processes. */
-                sh_eth_write(ndev, 0, EDTRR);
-                sh_eth_write(ndev, 0, EDRRR);
+
+                /* Serialise with the interrupt handler and NAPI, then
+                 * disable interrupts.  We have to clear the
+                 * irq_enabled flag first to ensure that interrupts
+                 * won't be re-enabled.
+                 */
+                mdp->irq_enabled = false;
                 synchronize_irq(ndev->irq);
-        }
+                napi_synchronize(&mdp->napi);
+                sh_eth_write(ndev, 0x0000, EESIPR);
 
-        /* Free all the skbuffs in the Rx queue. */
-        sh_eth_ring_free(ndev);
-        /* Free DMA buffer */
-        sh_eth_free_dma_buffer(mdp);
+                sh_eth_dev_exit(ndev);
+
+                /* Free all the skbuffs in the Rx queue. */
+                sh_eth_ring_free(ndev);
+                /* Free DMA buffer */
+                sh_eth_free_dma_buffer(mdp);
+        }
 
         /* Set new parameters */
         mdp->num_rx_ring = ring->rx_pending;
         mdp->num_tx_ring = ring->tx_pending;
 
-        ret = sh_eth_ring_init(ndev);
-        if (ret < 0) {
-                netdev_err(ndev, "%s: sh_eth_ring_init failed.\n", __func__);
-                return ret;
-        }
-        ret = sh_eth_dev_init(ndev, false);
-        if (ret < 0) {
-                netdev_err(ndev, "%s: sh_eth_dev_init failed.\n", __func__);
-                return ret;
-        }
-
         if (netif_running(ndev)) {
+                ret = sh_eth_ring_init(ndev);
+                if (ret < 0) {
+                        netdev_err(ndev, "%s: sh_eth_ring_init failed.\n",
+                                   __func__);
+                        return ret;
+                }
+                ret = sh_eth_dev_init(ndev, false);
+                if (ret < 0) {
+                        netdev_err(ndev, "%s: sh_eth_dev_init failed.\n",
+                                   __func__);
+                        return ret;
+                }
+
+                mdp->irq_enabled = true;
                 sh_eth_write(ndev, mdp->cd->eesipr_value, EESIPR);
                 /* Setting the Rx mode will start the Rx process. */
                 sh_eth_write(ndev, EDRRR_R, EDRRR);
-                netif_wake_queue(ndev);
+                netif_device_attach(ndev);
         }
 
         return 0;
@@ -2117,6 +2174,9 @@ static int sh_eth_start_xmit(struct sk_buff *skb, struct net_device *ndev)
         }
         spin_unlock_irqrestore(&mdp->lock, flags);
 
+        if (skb_padto(skb, ETH_ZLEN))
+                return NETDEV_TX_OK;
+
         entry = mdp->cur_tx % mdp->num_tx_ring;
         mdp->tx_skbuff[entry] = skb;
         txdesc = &mdp->tx_ring[entry];
@@ -2126,10 +2186,11 @@ static int sh_eth_start_xmit(struct sk_buff *skb, struct net_device *ndev)
                                  skb->len + 2);
         txdesc->addr = dma_map_single(&ndev->dev, skb->data, skb->len,
                                       DMA_TO_DEVICE);
-        if (skb->len < ETH_ZLEN)
-                txdesc->buffer_length = ETH_ZLEN;
-        else
-                txdesc->buffer_length = skb->len;
+        if (dma_mapping_error(&ndev->dev, txdesc->addr)) {
+                kfree_skb(skb);
+                return NETDEV_TX_OK;
+        }
+        txdesc->buffer_length = skb->len;
 
         if (entry >= mdp->num_tx_ring - 1)
                 txdesc->status |= cpu_to_edmac(mdp, TD_TACT | TD_TDLE);
@@ -2181,14 +2242,17 @@ static int sh_eth_close(struct net_device *ndev)
 
         netif_stop_queue(ndev);
 
-        /* Disable interrupts by clearing the interrupt mask. */
+        /* Serialise with the interrupt handler and NAPI, then disable
+         * interrupts.  We have to clear the irq_enabled flag first to
+         * ensure that interrupts won't be re-enabled.
+         */
+        mdp->irq_enabled = false;
+        synchronize_irq(ndev->irq);
+        napi_disable(&mdp->napi);
         sh_eth_write(ndev, 0x0000, EESIPR);
 
-        /* Stop the chip's Tx and Rx processes. */
-        sh_eth_write(ndev, 0, EDTRR);
-        sh_eth_write(ndev, 0, EDRRR);
+        sh_eth_dev_exit(ndev);
 
-        sh_eth_get_stats(ndev);
         /* PHY Disconnect */
         if (mdp->phydev) {
                 phy_stop(mdp->phydev);
@@ -2198,8 +2262,6 @@ static int sh_eth_close(struct net_device *ndev)
 
         free_irq(ndev->irq, ndev);
 
-        napi_disable(&mdp->napi);
-
         /* Free all the skbuffs in the Rx queue. */
         sh_eth_ring_free(ndev);
 
diff --git a/drivers/net/ethernet/renesas/sh_eth.h b/drivers/net/ethernet/renesas/sh_eth.h
index 71f5de1171bd..332d3c16d483 100644
--- a/drivers/net/ethernet/renesas/sh_eth.h
+++ b/drivers/net/ethernet/renesas/sh_eth.h
@@ -513,6 +513,7 @@ struct sh_eth_private {
         u32 rx_buf_sz;                  /* Based on MTU+slack. */
         int edmac_endian;
         struct napi_struct napi;
+        bool irq_enabled;
         /* MII transceiver section. */
         u32 phy_id;                     /* PHY ID */
         struct mii_bus *mii_bus;        /* MDIO bus control */
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 8c6b7c1651e5..cf62ff4c8c56 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -2778,6 +2778,9 @@ static int stmmac_hw_init(struct stmmac_priv *priv)
  * @addr: iobase memory address
  * Description: this is the main probe function used to
  * call the alloc_etherdev, allocate the priv structure.
+ * Return:
+ * on success the new private structure is returned, otherwise the error
+ * pointer.
  */
 struct stmmac_priv *stmmac_dvr_probe(struct device *device,
                                      struct plat_stmmacenet_data *plat_dat,
@@ -2789,7 +2792,7 @@ struct stmmac_priv *stmmac_dvr_probe(struct device *device,
 
         ndev = alloc_etherdev(sizeof(struct stmmac_priv));
         if (!ndev)
-                return NULL;
+                return ERR_PTR(-ENOMEM);
 
         SET_NETDEV_DEV(ndev, device);
 
diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
index e068d48b0f21..a39131f494ec 100644
--- a/drivers/net/ethernet/ti/cpsw.c
+++ b/drivers/net/ethernet/ti/cpsw.c
@@ -1683,6 +1683,19 @@ static int cpsw_ndo_vlan_rx_add_vid(struct net_device *ndev,
         if (vid == priv->data.default_vlan)
                 return 0;
 
+        if (priv->data.dual_emac) {
+                /* In dual EMAC, reserved VLAN id should not be used for
+                 * creating VLAN interfaces as this can break the dual
+                 * EMAC port separation
+                 */
+                int i;
+
+                for (i = 0; i < priv->data.slaves; i++) {
+                        if (vid == priv->slaves[i].port_vlan)
+                                return -EINVAL;
+                }
+        }
+
         dev_info(priv->dev, "Adding vlanid %d to vlan filter\n", vid);
         return cpsw_add_vlan_ale_entry(priv, vid);
 }
@@ -1696,6 +1709,15 @@ static int cpsw_ndo_vlan_rx_kill_vid(struct net_device *ndev,
         if (vid == priv->data.default_vlan)
                 return 0;
 
+        if (priv->data.dual_emac) {
+                int i;
+
+                for (i = 0; i < priv->data.slaves; i++) {
+                        if (vid == priv->slaves[i].port_vlan)
+                                return -EINVAL;
+                }
+        }
+
         dev_info(priv->dev, "removing vlanid %d from vlan filter\n", vid);
         ret = cpsw_ale_del_vlan(priv->ale, vid, 0);
         if (ret != 0)
diff --git a/drivers/net/ipvlan/ipvlan_core.c b/drivers/net/ipvlan/ipvlan_core.c
index a14d87783245..2e195289ddf4 100644
--- a/drivers/net/ipvlan/ipvlan_core.c
+++ b/drivers/net/ipvlan/ipvlan_core.c
@@ -377,9 +377,11 @@ static int ipvlan_process_v6_outbound(struct sk_buff *skb)
         };
 
         dst = ip6_route_output(dev_net(dev), NULL, &fl6);
-        if (IS_ERR(dst))
+        if (dst->error) {
+                ret = dst->error;
+                dst_release(dst);
                 goto err;
-
+        }
         skb_dst_drop(skb);
         skb_dst_set(skb, dst);
         err = ip6_local_out(skb);
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index 9a72640237cb..62b0bf4fdf6b 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -285,6 +285,7 @@ static int ath_reset_internal(struct ath_softc *sc, struct ath9k_channel *hchan)
 
         __ath_cancel_work(sc);
 
+        disable_irq(sc->irq);
         tasklet_disable(&sc->intr_tq);
         tasklet_disable(&sc->bcon_tasklet);
         spin_lock_bh(&sc->sc_pcu_lock);
@@ -331,6 +332,7 @@ static int ath_reset_internal(struct ath_softc *sc, struct ath9k_channel *hchan)
                 r = -EIO;
 
 out:
+        enable_irq(sc->irq);
         spin_unlock_bh(&sc->sc_pcu_lock);
         tasklet_enable(&sc->bcon_tasklet);
         tasklet_enable(&sc->intr_tq);
@@ -512,9 +514,6 @@ irqreturn_t ath_isr(int irq, void *dev)
         if (!ah || test_bit(ATH_OP_INVALID, &common->op_flags))
                 return IRQ_NONE;
 
-        if (!AR_SREV_9100(ah) && test_bit(ATH_OP_HW_RESET, &common->op_flags))
-                return IRQ_NONE;
-
         /* shared irq, not for us */
         if (!ath9k_hw_intrpend(ah))
                 return IRQ_NONE;
@@ -529,7 +528,7 @@ irqreturn_t ath_isr(int irq, void *dev)
         ath9k_debug_sync_cause(sc, sync_cause);
         status &= ah->imask;    /* discard unasked-for bits */
 
-        if (AR_SREV_9100(ah) && test_bit(ATH_OP_HW_RESET, &common->op_flags))
+        if (test_bit(ATH_OP_HW_RESET, &common->op_flags))
                 return IRQ_HANDLED;
 
         /*
diff --git a/drivers/net/wireless/iwlwifi/iwl-fw-file.h b/drivers/net/wireless/iwlwifi/iwl-fw-file.h
index 1bbe4fc47b97..660ddb1b7d8a 100644
--- a/drivers/net/wireless/iwlwifi/iwl-fw-file.h
+++ b/drivers/net/wireless/iwlwifi/iwl-fw-file.h
@@ -246,6 +246,7 @@ enum iwl_ucode_tlv_flag {
  * @IWL_UCODE_TLV_API_BASIC_DWELL: use only basic dwell time in scan command,
  *      regardless of the band or the number of the probes. FW will calculate
  *      the actual dwell time.
+ * @IWL_UCODE_TLV_API_SINGLE_SCAN_EBS: EBS is supported for single scans too.
  */
 enum iwl_ucode_tlv_api {
         IWL_UCODE_TLV_API_WOWLAN_CONFIG_TID     = BIT(0),
@@ -257,6 +258,7 @@ enum iwl_ucode_tlv_api {
         IWL_UCODE_TLV_API_SF_NO_DUMMY_NOTIF     = BIT(7),
         IWL_UCODE_TLV_API_FRAGMENTED_SCAN       = BIT(8),
         IWL_UCODE_TLV_API_BASIC_DWELL           = BIT(13),
+        IWL_UCODE_TLV_API_SINGLE_SCAN_EBS       = BIT(16),
 };
 
 /**
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h b/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h
index 201846de94e7..cfc0e65b34a5 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h
@@ -653,8 +653,11 @@ enum iwl_scan_channel_flags {
 };
 
 /* iwl_scan_channel_opt - CHANNEL_OPTIMIZATION_API_S
- * @flags: enum iwl_scan_channel_flgs
- * @non_ebs_ratio: how many regular scan iteration before EBS
+ * @flags: enum iwl_scan_channel_flags
+ * @non_ebs_ratio: defines the ratio of number of scan iterations where EBS is
+ *      involved.
+ *      1 - EBS is disabled.
+ *      2 - every second scan will be full scan(and so on).
  */
 struct iwl_scan_channel_opt {
         __le16 flags;
diff --git a/drivers/net/wireless/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
index e880f9d4717b..20915587c820 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
@@ -3343,18 +3343,16 @@ static void iwl_mvm_mac_flush(struct ieee80211_hw *hw,
                 msk |= mvmsta->tfd_queue_msk;
         }
 
-        if (drop) {
-                if (iwl_mvm_flush_tx_path(mvm, msk, true))
-                        IWL_ERR(mvm, "flush request fail\n");
-                mutex_unlock(&mvm->mutex);
-        } else {
-                mutex_unlock(&mvm->mutex);
+        msk &= ~BIT(vif->hw_queue[IEEE80211_AC_VO]);
 
-                /* this can take a while, and we may need/want other operations
-                 * to succeed while doing this, so do it without the mutex held
-                 */
-                iwl_trans_wait_tx_queue_empty(mvm->trans, msk);
-        }
+        if (iwl_mvm_flush_tx_path(mvm, msk, true))
+                IWL_ERR(mvm, "flush request fail\n");
+        mutex_unlock(&mvm->mutex);
+
+        /* this can take a while, and we may need/want other operations
+         * to succeed while doing this, so do it without the mutex held
+         */
+        iwl_trans_wait_tx_queue_empty(mvm->trans, msk);
 }
 
 const struct ieee80211_ops iwl_mvm_hw_ops = {
diff --git a/drivers/net/wireless/iwlwifi/mvm/scan.c b/drivers/net/wireless/iwlwifi/mvm/scan.c
index ec9a8e7bae1d..844bf7c4c8de 100644
--- a/drivers/net/wireless/iwlwifi/mvm/scan.c
+++ b/drivers/net/wireless/iwlwifi/mvm/scan.c
@@ -72,6 +72,8 @@
 
 #define IWL_PLCP_QUIET_THRESH 1
 #define IWL_ACTIVE_QUIET_TIME 10
+#define IWL_DENSE_EBS_SCAN_RATIO 5
+#define IWL_SPARSE_EBS_SCAN_RATIO 1
 
 struct iwl_mvm_scan_params {
         u32 max_out_time;
@@ -1105,6 +1107,12 @@ int iwl_mvm_scan_offload_stop(struct iwl_mvm *mvm, bool notify)
                 return iwl_umac_scan_stop(mvm, IWL_UMAC_SCAN_UID_SCHED_SCAN,
                                           notify);
 
+        if (mvm->scan_status == IWL_MVM_SCAN_NONE)
+                return 0;
+
+        if (iwl_mvm_is_radio_killed(mvm))
+                goto out;
+
         if (mvm->scan_status != IWL_MVM_SCAN_SCHED &&
             (!(mvm->fw->ucode_capa.api[0] & IWL_UCODE_TLV_API_LMAC_SCAN) ||
              mvm->scan_status != IWL_MVM_SCAN_OS)) {
@@ -1141,6 +1149,7 @@ int iwl_mvm_scan_offload_stop(struct iwl_mvm *mvm, bool notify)
         if (mvm->scan_status == IWL_MVM_SCAN_OS)
                 iwl_mvm_unref(mvm, IWL_MVM_REF_SCAN);
 
+out:
         mvm->scan_status = IWL_MVM_SCAN_NONE;
 
         if (notify) {
@@ -1297,18 +1306,6 @@ iwl_mvm_build_generic_unified_scan_cmd(struct iwl_mvm *mvm,
         cmd->scan_prio = cpu_to_le32(IWL_SCAN_PRIORITY_HIGH);
         cmd->iter_num = cpu_to_le32(1);
 
-        if (mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_EBS_SUPPORT &&
-            mvm->last_ebs_successful) {
-                cmd->channel_opt[0].flags =
-                        cpu_to_le16(IWL_SCAN_CHANNEL_FLAG_EBS |
-                                    IWL_SCAN_CHANNEL_FLAG_EBS_ACCURATE |
-                                    IWL_SCAN_CHANNEL_FLAG_CACHE_ADD);
-                cmd->channel_opt[1].flags =
-                        cpu_to_le16(IWL_SCAN_CHANNEL_FLAG_EBS |
-                                    IWL_SCAN_CHANNEL_FLAG_EBS_ACCURATE |
-                                    IWL_SCAN_CHANNEL_FLAG_CACHE_ADD);
-        }
-
         if (iwl_mvm_rrm_scan_needed(mvm))
                 cmd->scan_flags |=
                         cpu_to_le32(IWL_MVM_LMAC_SCAN_FLAGS_RRM_ENABLED);
@@ -1383,6 +1380,22 @@ int iwl_mvm_unified_scan_lmac(struct iwl_mvm *mvm,
         cmd->schedule[1].iterations = 0;
         cmd->schedule[1].full_scan_mul = 0;
 
+        if (mvm->fw->ucode_capa.api[0] & IWL_UCODE_TLV_API_SINGLE_SCAN_EBS &&
+            mvm->last_ebs_successful) {
+                cmd->channel_opt[0].flags =
+                        cpu_to_le16(IWL_SCAN_CHANNEL_FLAG_EBS |
+                                    IWL_SCAN_CHANNEL_FLAG_EBS_ACCURATE |
+                                    IWL_SCAN_CHANNEL_FLAG_CACHE_ADD);
+                cmd->channel_opt[0].non_ebs_ratio =
+                        cpu_to_le16(IWL_DENSE_EBS_SCAN_RATIO);
+                cmd->channel_opt[1].flags =
+                        cpu_to_le16(IWL_SCAN_CHANNEL_FLAG_EBS |
+                                    IWL_SCAN_CHANNEL_FLAG_EBS_ACCURATE |
+                                    IWL_SCAN_CHANNEL_FLAG_CACHE_ADD);
+                cmd->channel_opt[1].non_ebs_ratio =
+                        cpu_to_le16(IWL_SPARSE_EBS_SCAN_RATIO);
+        }
+
         for (i = 1; i <= req->req.n_ssids; i++)
                 ssid_bitmap |= BIT(i);
 
@@ -1483,6 +1496,22 @@ int iwl_mvm_unified_sched_scan_lmac(struct iwl_mvm *mvm,
         cmd->schedule[1].iterations = 0xff;
         cmd->schedule[1].full_scan_mul = IWL_FULL_SCAN_MULTIPLIER;
 
+        if (mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_EBS_SUPPORT &&
+            mvm->last_ebs_successful) {
+                cmd->channel_opt[0].flags =
+                        cpu_to_le16(IWL_SCAN_CHANNEL_FLAG_EBS |
+                                    IWL_SCAN_CHANNEL_FLAG_EBS_ACCURATE |
+                                    IWL_SCAN_CHANNEL_FLAG_CACHE_ADD);
+                cmd->channel_opt[0].non_ebs_ratio =
+                        cpu_to_le16(IWL_DENSE_EBS_SCAN_RATIO);
+                cmd->channel_opt[1].flags =
+                        cpu_to_le16(IWL_SCAN_CHANNEL_FLAG_EBS |
+                                    IWL_SCAN_CHANNEL_FLAG_EBS_ACCURATE |
+                                    IWL_SCAN_CHANNEL_FLAG_CACHE_ADD);
+                cmd->channel_opt[1].non_ebs_ratio =
+                        cpu_to_le16(IWL_SPARSE_EBS_SCAN_RATIO);
+        }
+
         iwl_mvm_lmac_scan_cfg_channels(mvm, req->channels, req->n_channels,
                                        ssid_bitmap, cmd);
 
diff --git a/drivers/net/wireless/iwlwifi/mvm/tx.c b/drivers/net/wireless/iwlwifi/mvm/tx.c
index 4333306ccdee..c59d07567d90 100644
--- a/drivers/net/wireless/iwlwifi/mvm/tx.c
+++ b/drivers/net/wireless/iwlwifi/mvm/tx.c
@@ -90,8 +90,6 @@ void iwl_mvm_set_tx_cmd(struct iwl_mvm *mvm, struct sk_buff *skb,
 
         if (ieee80211_is_probe_resp(fc))
                 tx_flags |= TX_CMD_FLG_TSF;
-        else if (ieee80211_is_back_req(fc))
-                tx_flags |= TX_CMD_FLG_ACK | TX_CMD_FLG_BAR;
 
         if (ieee80211_has_morefrags(fc))
                 tx_flags |= TX_CMD_FLG_MORE_FRAG;
@@ -100,6 +98,15 @@ void iwl_mvm_set_tx_cmd(struct iwl_mvm *mvm, struct sk_buff *skb,
                 u8 *qc = ieee80211_get_qos_ctl(hdr);
                 tx_cmd->tid_tspec = qc[0] & 0xf;
                 tx_flags &= ~TX_CMD_FLG_SEQ_CTL;
+        } else if (ieee80211_is_back_req(fc)) {
+                struct ieee80211_bar *bar = (void *)skb->data;
+                u16 control = le16_to_cpu(bar->control);
+
+                tx_flags |= TX_CMD_FLG_ACK | TX_CMD_FLG_BAR;
+                tx_cmd->tid_tspec = (control &
+                                     IEEE80211_BAR_CTRL_TID_INFO_MASK) >>
+                        IEEE80211_BAR_CTRL_TID_INFO_SHIFT;
+                WARN_ON_ONCE(tx_cmd->tid_tspec >= IWL_MAX_TID_COUNT);
         } else {
                 tx_cmd->tid_tspec = IWL_TID_NON_QOS;
                 if (info->flags & IEEE80211_TX_CTL_ASSIGN_SEQ)