50 files changed, 529 insertions, 297 deletions

diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index c9ac06cfe6b7..a5115fb7cf33 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -2471,7 +2471,8 @@ static void bond_loadbalance_arp_mon(struct work_struct *work)
                         bond_slave_state_change(bond);
                         if (BOND_MODE(bond) == BOND_MODE_XOR)
                                 bond_update_slave_arr(bond, NULL);
-                } else if (do_failover) {
+                }
+                if (do_failover) {
                         block_netpoll_tx();
                         bond_select_active_slave(bond);
                         unblock_netpoll_tx();
diff --git a/drivers/net/bonding/bond_netlink.c b/drivers/net/bonding/bond_netlink.c
index c13d83e15ace..45f09a66e6c9 100644
--- a/drivers/net/bonding/bond_netlink.c
+++ b/drivers/net/bonding/bond_netlink.c
@@ -225,7 +225,12 @@ static int bond_changelink(struct net_device *bond_dev,
 
                 bond_option_arp_ip_targets_clear(bond);
                 nla_for_each_nested(attr, data[IFLA_BOND_ARP_IP_TARGET], rem) {
-                        __be32 target = nla_get_be32(attr);
+                        __be32 target;
+
+                        if (nla_len(attr) < sizeof(target))
+                                return -EINVAL;
+
+                        target = nla_get_be32(attr);
 
                         bond_opt_initval(&newval, (__force u64)target);
                         err = __bond_opt_set(bond, BOND_OPT_ARP_TARGETS,
diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
index 02492d241e4c..2cfe5012e4e5 100644
--- a/drivers/net/can/dev.c
+++ b/drivers/net/can/dev.c
@@ -110,7 +110,7 @@ static int can_calc_bittiming(struct net_device *dev, struct can_bittiming *bt,
         long rate;
         u64 v64;
 
-        /* Use CIA recommended sample points */
+        /* Use CiA recommended sample points */
         if (bt->sample_point) {
                 sampl_pt = bt->sample_point;
         } else {
@@ -382,7 +382,7 @@ void can_free_echo_skb(struct net_device *dev, unsigned int idx)
         BUG_ON(idx >= priv->echo_skb_max);
 
         if (priv->echo_skb[idx]) {
-                kfree_skb(priv->echo_skb[idx]);
+                dev_kfree_skb_any(priv->echo_skb[idx]);
                 priv->echo_skb[idx] = NULL;
         }
 }
diff --git a/drivers/net/can/m_can/Kconfig b/drivers/net/can/m_can/Kconfig
index fca5482c09ac..04f20dd39007 100644
--- a/drivers/net/can/m_can/Kconfig
+++ b/drivers/net/can/m_can/Kconfig
@@ -1,4 +1,5 @@
 config CAN_M_CAN
+        depends on HAS_IOMEM
         tristate "Bosch M_CAN devices"
         ---help---
           Say Y here if you want to support for Bosch M_CAN controller.
diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c
index 10d571eaed85..d7bc462aafdc 100644
--- a/drivers/net/can/m_can/m_can.c
+++ b/drivers/net/can/m_can/m_can.c
@@ -105,14 +105,36 @@ enum m_can_mram_cfg {
         MRAM_CFG_NUM,
 };
 
+/* Fast Bit Timing & Prescaler Register (FBTP) */
+#define FBTR_FBRP_MASK          0x1f
+#define FBTR_FBRP_SHIFT         16
+#define FBTR_FTSEG1_SHIFT       8
+#define FBTR_FTSEG1_MASK        (0xf << FBTR_FTSEG1_SHIFT)
+#define FBTR_FTSEG2_SHIFT       4
+#define FBTR_FTSEG2_MASK        (0x7 << FBTR_FTSEG2_SHIFT)
+#define FBTR_FSJW_SHIFT         0
+#define FBTR_FSJW_MASK          0x3
+
 /* Test Register (TEST) */
 #define TEST_LBCK       BIT(4)
 
 /* CC Control Register(CCCR) */
-#define CCCR_TEST       BIT(7)
-#define CCCR_MON        BIT(5)
-#define CCCR_CCE        BIT(1)
-#define CCCR_INIT       BIT(0)
+#define CCCR_TEST               BIT(7)
+#define CCCR_CMR_MASK           0x3
+#define CCCR_CMR_SHIFT          10
+#define CCCR_CMR_CANFD          0x1
+#define CCCR_CMR_CANFD_BRS      0x2
+#define CCCR_CMR_CAN            0x3
+#define CCCR_CME_MASK           0x3
+#define CCCR_CME_SHIFT          8
+#define CCCR_CME_CAN            0
+#define CCCR_CME_CANFD          0x1
+#define CCCR_CME_CANFD_BRS      0x2
+#define CCCR_TEST               BIT(7)
+#define CCCR_MON                BIT(5)
+#define CCCR_CCE                BIT(1)
+#define CCCR_INIT               BIT(0)
+#define CCCR_CANFD              0x10
 
 /* Bit Timing & Prescaler Register (BTP) */
 #define BTR_BRP_MASK            0x3ff
@@ -204,6 +226,7 @@ enum m_can_mram_cfg {
 
 /* Rx Buffer / FIFO Element Size Configuration (RXESC) */
 #define M_CAN_RXESC_8BYTES      0x0
+#define M_CAN_RXESC_64BYTES     0x777
 
 /* Tx Buffer Configuration(TXBC) */
 #define TXBC_NDTB_OFF           16
@@ -211,6 +234,7 @@ enum m_can_mram_cfg {
 
 /* Tx Buffer Element Size Configuration(TXESC) */
 #define TXESC_TBDS_8BYTES       0x0
+#define TXESC_TBDS_64BYTES      0x7
 
 /* Tx Event FIFO Con.guration (TXEFC) */
 #define TXEFC_EFS_OFF           16
@@ -219,11 +243,11 @@ enum m_can_mram_cfg {
 /* Message RAM Configuration (in bytes) */
 #define SIDF_ELEMENT_SIZE       4
 #define XIDF_ELEMENT_SIZE       8
-#define RXF0_ELEMENT_SIZE       16
-#define RXF1_ELEMENT_SIZE       16
+#define RXF0_ELEMENT_SIZE       72
+#define RXF1_ELEMENT_SIZE       72
 #define RXB_ELEMENT_SIZE        16
 #define TXE_ELEMENT_SIZE        8
-#define TXB_ELEMENT_SIZE        16
+#define TXB_ELEMENT_SIZE        72
 
 /* Message RAM Elements */
 #define M_CAN_FIFO_ID           0x0
@@ -231,11 +255,17 @@ enum m_can_mram_cfg {
 #define M_CAN_FIFO_DATA(n)      (0x8 + ((n) << 2))
 
 /* Rx Buffer Element */
+/* R0 */
 #define RX_BUF_ESI              BIT(31)
 #define RX_BUF_XTD              BIT(30)
 #define RX_BUF_RTR              BIT(29)
+/* R1 */
+#define RX_BUF_ANMF             BIT(31)
+#define RX_BUF_EDL              BIT(21)
+#define RX_BUF_BRS              BIT(20)
 
 /* Tx Buffer Element */
+/* R0 */
 #define TX_BUF_XTD              BIT(30)
 #define TX_BUF_RTR              BIT(29)
 
@@ -296,6 +326,7 @@ static inline void m_can_config_endisable(const struct m_can_priv *priv,
         if (enable) {
                 /* enable m_can configuration */
                 m_can_write(priv, M_CAN_CCCR, cccr | CCCR_INIT);
+                udelay(5);
                 /* CCCR.CCE can only be set/reset while CCCR.INIT = '1' */
                 m_can_write(priv, M_CAN_CCCR, cccr | CCCR_INIT | CCCR_CCE);
         } else {
@@ -326,41 +357,67 @@ static inline void m_can_disable_all_interrupts(const struct m_can_priv *priv)
         m_can_write(priv, M_CAN_ILE, 0x0);
 }
 
-static void m_can_read_fifo(const struct net_device *dev, struct can_frame *cf,
-                            u32 rxfs)
+static void m_can_read_fifo(struct net_device *dev, u32 rxfs)
 {
+        struct net_device_stats *stats = &dev->stats;
         struct m_can_priv *priv = netdev_priv(dev);
-        u32 id, fgi;
+        struct canfd_frame *cf;
+        struct sk_buff *skb;
+        u32 id, fgi, dlc;
+        int i;
 
         /* calculate the fifo get index for where to read data */
         fgi = (rxfs & RXFS_FGI_MASK) >> RXFS_FGI_OFF;
+        dlc = m_can_fifo_read(priv, fgi, M_CAN_FIFO_DLC);
+        if (dlc & RX_BUF_EDL)
+                skb = alloc_canfd_skb(dev, &cf);
+        else
+                skb = alloc_can_skb(dev, (struct can_frame **)&cf);
+        if (!skb) {
+                stats->rx_dropped++;
+                return;
+        }
+
+        if (dlc & RX_BUF_EDL)
+                cf->len = can_dlc2len((dlc >> 16) & 0x0F);
+        else
+                cf->len = get_can_dlc((dlc >> 16) & 0x0F);
+
         id = m_can_fifo_read(priv, fgi, M_CAN_FIFO_ID);
         if (id & RX_BUF_XTD)
                 cf->can_id = (id & CAN_EFF_MASK) | CAN_EFF_FLAG;
         else
                 cf->can_id = (id >> 18) & CAN_SFF_MASK;
 
-        if (id & RX_BUF_RTR) {
+        if (id & RX_BUF_ESI) {
+                cf->flags |= CANFD_ESI;
+                netdev_dbg(dev, "ESI Error\n");
+        }
+
+        if (!(dlc & RX_BUF_EDL) && (id & RX_BUF_RTR)) {
                 cf->can_id |= CAN_RTR_FLAG;
         } else {
-                id = m_can_fifo_read(priv, fgi, M_CAN_FIFO_DLC);
-                cf->can_dlc = get_can_dlc((id >> 16) & 0x0F);
-                *(u32 *)(cf->data + 0) = m_can_fifo_read(priv, fgi,
-                                                         M_CAN_FIFO_DATA(0));
-                *(u32 *)(cf->data + 4) = m_can_fifo_read(priv, fgi,
-                                                         M_CAN_FIFO_DATA(1));
+                if (dlc & RX_BUF_BRS)
+                        cf->flags |= CANFD_BRS;
+
+                for (i = 0; i < cf->len; i += 4)
+                        *(u32 *)(cf->data + i) =
+                                m_can_fifo_read(priv, fgi,
+                                                M_CAN_FIFO_DATA(i / 4));
         }
 
         /* acknowledge rx fifo 0 */
         m_can_write(priv, M_CAN_RXF0A, fgi);
+
+        stats->rx_packets++;
+        stats->rx_bytes += cf->len;
+
+        netif_receive_skb(skb);
 }
 
 static int m_can_do_rx_poll(struct net_device *dev, int quota)
 {
         struct m_can_priv *priv = netdev_priv(dev);
-        struct net_device_stats *stats = &dev->stats;
-        struct sk_buff *skb;
-        struct can_frame *frame;
         u32 pkts = 0;
         u32 rxfs;
 
@@ -374,18 +431,7 @@ static int m_can_do_rx_poll(struct net_device *dev, int quota)
                 if (rxfs & RXFS_RFL)
                         netdev_warn(dev, "Rx FIFO 0 Message Lost\n");
 
-                skb = alloc_can_skb(dev, &frame);
-                if (!skb) {
-                        stats->rx_dropped++;
-                        return pkts;
-                }
-
-                m_can_read_fifo(dev, frame, rxfs);
-
-                stats->rx_packets++;
-                stats->rx_bytes += frame->can_dlc;
-
-                netif_receive_skb(skb);
+                m_can_read_fifo(dev, rxfs);
 
                 quota--;
                 pkts++;
@@ -481,11 +527,23 @@ static int m_can_handle_lec_err(struct net_device *dev,
         return 1;
 }
 
+static int __m_can_get_berr_counter(const struct net_device *dev,
+                                    struct can_berr_counter *bec)
+{
+        struct m_can_priv *priv = netdev_priv(dev);
+        unsigned int ecr;
+
+        ecr = m_can_read(priv, M_CAN_ECR);
+        bec->rxerr = (ecr & ECR_REC_MASK) >> ECR_REC_SHIFT;
+        bec->txerr = ecr & ECR_TEC_MASK;
+
+        return 0;
+}
+
 static int m_can_get_berr_counter(const struct net_device *dev,
                                   struct can_berr_counter *bec)
 {
         struct m_can_priv *priv = netdev_priv(dev);
-        unsigned int ecr;
         int err;
 
         err = clk_prepare_enable(priv->hclk);
@@ -498,9 +556,7 @@ static int m_can_get_berr_counter(const struct net_device *dev,
                 return err;
         }
 
-        ecr = m_can_read(priv, M_CAN_ECR);
-        bec->rxerr = (ecr & ECR_REC_MASK) >> ECR_REC_SHIFT;
-        bec->txerr = ecr & ECR_TEC_MASK;
+        __m_can_get_berr_counter(dev, bec);
 
         clk_disable_unprepare(priv->cclk);
         clk_disable_unprepare(priv->hclk);
@@ -544,7 +600,7 @@ static int m_can_handle_state_change(struct net_device *dev,
         if (unlikely(!skb))
                 return 0;
 
-        m_can_get_berr_counter(dev, &bec);
+        __m_can_get_berr_counter(dev, &bec);
 
         switch (new_state) {
         case CAN_STATE_ERROR_ACTIVE:
@@ -596,14 +652,14 @@ static int m_can_handle_state_errors(struct net_device *dev, u32 psr)
 
         if ((psr & PSR_EP) &&
             (priv->can.state != CAN_STATE_ERROR_PASSIVE)) {
-                netdev_dbg(dev, "entered error warning state\n");
+                netdev_dbg(dev, "entered error passive state\n");
                 work_done += m_can_handle_state_change(dev,
                                                        CAN_STATE_ERROR_PASSIVE);
         }
 
         if ((psr & PSR_BO) &&
             (priv->can.state != CAN_STATE_BUS_OFF)) {
-                netdev_dbg(dev, "entered error warning state\n");
+                netdev_dbg(dev, "entered error bus off state\n");
                 work_done += m_can_handle_state_change(dev,
                                                        CAN_STATE_BUS_OFF);
         }
@@ -615,7 +671,7 @@ static void m_can_handle_other_err(struct net_device *dev, u32 irqstatus)
 {
         if (irqstatus & IR_WDI)
                 netdev_err(dev, "Message RAM Watchdog event due to missing READY\n");
-        if (irqstatus & IR_BEU)
+        if (irqstatus & IR_ELO)
                 netdev_err(dev, "Error Logging Overflow\n");
         if (irqstatus & IR_BEU)
                 netdev_err(dev, "Bit Error Uncorrected\n");
@@ -733,10 +789,23 @@ static const struct can_bittiming_const m_can_bittiming_const = {
         .brp_inc = 1,
 };
 
+static const struct can_bittiming_const m_can_data_bittiming_const = {
+        .name = KBUILD_MODNAME,
+        .tseg1_min = 2,         /* Time segment 1 = prop_seg + phase_seg1 */
+        .tseg1_max = 16,
+        .tseg2_min = 1,         /* Time segment 2 = phase_seg2 */
+        .tseg2_max = 8,
+        .sjw_max = 4,
+        .brp_min = 1,
+        .brp_max = 32,
+        .brp_inc = 1,
+};
+
 static int m_can_set_bittiming(struct net_device *dev)
 {
         struct m_can_priv *priv = netdev_priv(dev);
         const struct can_bittiming *bt = &priv->can.bittiming;
+        const struct can_bittiming *dbt = &priv->can.data_bittiming;
         u16 brp, sjw, tseg1, tseg2;
         u32 reg_btp;
 
@@ -747,7 +816,17 @@ static int m_can_set_bittiming(struct net_device *dev)
         reg_btp = (brp << BTR_BRP_SHIFT) | (sjw << BTR_SJW_SHIFT) |
                         (tseg1 << BTR_TSEG1_SHIFT) | (tseg2 << BTR_TSEG2_SHIFT);
         m_can_write(priv, M_CAN_BTP, reg_btp);
-        netdev_dbg(dev, "setting BTP 0x%x\n", reg_btp);
+
+        if (priv->can.ctrlmode & CAN_CTRLMODE_FD) {
+                brp = dbt->brp - 1;
+                sjw = dbt->sjw - 1;
+                tseg1 = dbt->prop_seg + dbt->phase_seg1 - 1;
+                tseg2 = dbt->phase_seg2 - 1;
+                reg_btp = (brp << FBTR_FBRP_SHIFT) | (sjw << FBTR_FSJW_SHIFT) |
+                                (tseg1 << FBTR_FTSEG1_SHIFT) |
+                                (tseg2 << FBTR_FTSEG2_SHIFT);
+                m_can_write(priv, M_CAN_FBTP, reg_btp);
+        }
 
         return 0;
 }
@@ -767,8 +846,8 @@ static void m_can_chip_config(struct net_device *dev)
 
         m_can_config_endisable(priv, true);
 
-        /* RX Buffer/FIFO Element Size 8 bytes data field */
-        m_can_write(priv, M_CAN_RXESC, M_CAN_RXESC_8BYTES);
+        /* RX Buffer/FIFO Element Size 64 bytes data field */
+        m_can_write(priv, M_CAN_RXESC, M_CAN_RXESC_64BYTES);
 
         /* Accept Non-matching Frames Into FIFO 0 */
         m_can_write(priv, M_CAN_GFC, 0x0);
@@ -777,8 +856,8 @@ static void m_can_chip_config(struct net_device *dev)
         m_can_write(priv, M_CAN_TXBC, (1 << TXBC_NDTB_OFF) |
                     priv->mcfg[MRAM_TXB].off);
 
-        /* only support 8 bytes firstly */
-        m_can_write(priv, M_CAN_TXESC, TXESC_TBDS_8BYTES);
+        /* support 64 bytes payload */
+        m_can_write(priv, M_CAN_TXESC, TXESC_TBDS_64BYTES);
 
         m_can_write(priv, M_CAN_TXEFC, (1 << TXEFC_EFS_OFF) |
                     priv->mcfg[MRAM_TXE].off);
@@ -793,7 +872,8 @@ static void m_can_chip_config(struct net_device *dev)
                     RXFC_FWM_1 | priv->mcfg[MRAM_RXF1].off);
 
         cccr = m_can_read(priv, M_CAN_CCCR);
-        cccr &= ~(CCCR_TEST | CCCR_MON);
+        cccr &= ~(CCCR_TEST | CCCR_MON | (CCCR_CMR_MASK << CCCR_CMR_SHIFT) |
+                (CCCR_CME_MASK << CCCR_CME_SHIFT));
         test = m_can_read(priv, M_CAN_TEST);
         test &= ~TEST_LBCK;
 
@@ -805,6 +885,9 @@ static void m_can_chip_config(struct net_device *dev)
                 test |= TEST_LBCK;
         }
 
+        if (priv->can.ctrlmode & CAN_CTRLMODE_FD)
+                cccr |= CCCR_CME_CANFD_BRS << CCCR_CME_SHIFT;
+
         m_can_write(priv, M_CAN_CCCR, cccr);
         m_can_write(priv, M_CAN_TEST, test);
 
@@ -869,11 +952,13 @@ static struct net_device *alloc_m_can_dev(void)
 
         priv->dev = dev;
         priv->can.bittiming_const = &m_can_bittiming_const;
+        priv->can.data_bittiming_const = &m_can_data_bittiming_const;
         priv->can.do_set_mode = m_can_set_mode;
         priv->can.do_get_berr_counter = m_can_get_berr_counter;
         priv->can.ctrlmode_supported = CAN_CTRLMODE_LOOPBACK |
                                         CAN_CTRLMODE_LISTENONLY |
-                                        CAN_CTRLMODE_BERR_REPORTING;
+                                        CAN_CTRLMODE_BERR_REPORTING |
+                                        CAN_CTRLMODE_FD;
 
         return dev;
 }
@@ -956,8 +1041,9 @@ static netdev_tx_t m_can_start_xmit(struct sk_buff *skb,
                                     struct net_device *dev)
 {
         struct m_can_priv *priv = netdev_priv(dev);
-        struct can_frame *cf = (struct can_frame *)skb->data;
-        u32 id;
+        struct canfd_frame *cf = (struct canfd_frame *)skb->data;
+        u32 id, cccr;
+        int i;
 
         if (can_dropped_invalid_skb(dev, skb))
                 return NETDEV_TX_OK;
@@ -976,11 +1062,28 @@ static netdev_tx_t m_can_start_xmit(struct sk_buff *skb,
 
         /* message ram configuration */
         m_can_fifo_write(priv, 0, M_CAN_FIFO_ID, id);
-        m_can_fifo_write(priv, 0, M_CAN_FIFO_DLC, cf->can_dlc << 16);
-        m_can_fifo_write(priv, 0, M_CAN_FIFO_DATA(0), *(u32 *)(cf->data + 0));
-        m_can_fifo_write(priv, 0, M_CAN_FIFO_DATA(1), *(u32 *)(cf->data + 4));
+        m_can_fifo_write(priv, 0, M_CAN_FIFO_DLC, can_len2dlc(cf->len) << 16);
+
+        for (i = 0; i < cf->len; i += 4)
+                m_can_fifo_write(priv, 0, M_CAN_FIFO_DATA(i / 4),
+                                 *(u32 *)(cf->data + i));
+
         can_put_echo_skb(skb, dev, 0);
 
+        if (priv->can.ctrlmode & CAN_CTRLMODE_FD) {
+                cccr = m_can_read(priv, M_CAN_CCCR);
+                cccr &= ~(CCCR_CMR_MASK << CCCR_CMR_SHIFT);
+                if (can_is_canfd_skb(skb)) {
+                        if (cf->flags & CANFD_BRS)
+                                cccr |= CCCR_CMR_CANFD_BRS << CCCR_CMR_SHIFT;
+                        else
+                                cccr |= CCCR_CMR_CANFD << CCCR_CMR_SHIFT;
+                } else {
+                        cccr |= CCCR_CMR_CAN << CCCR_CMR_SHIFT;
+                }
+                m_can_write(priv, M_CAN_CCCR, cccr);
+        }
+
         /* enable first TX buffer to start transfer  */
         m_can_write(priv, M_CAN_TXBTIE, 0x1);
         m_can_write(priv, M_CAN_TXBAR, 0x1);
@@ -992,6 +1095,7 @@ static const struct net_device_ops m_can_netdev_ops = {
         .ndo_open = m_can_open,
         .ndo_stop = m_can_close,
         .ndo_start_xmit = m_can_start_xmit,
+        .ndo_change_mtu = can_change_mtu,
 };
 
 static int register_m_can_dev(struct net_device *dev)
@@ -1009,7 +1113,7 @@ static int m_can_of_parse_mram(struct platform_device *pdev,
         struct resource *res;
         void __iomem *addr;
         u32 out_val[MRAM_CFG_LEN];
-        int ret;
+        int i, start, end, ret;
 
         /* message ram could be shared */
         res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "message_ram");
@@ -1060,6 +1164,15 @@ static int m_can_of_parse_mram(struct platform_device *pdev,
                 priv->mcfg[MRAM_TXE].off, priv->mcfg[MRAM_TXE].num,
                 priv->mcfg[MRAM_TXB].off, priv->mcfg[MRAM_TXB].num);
 
+        /* initialize the entire Message RAM in use to avoid possible
+         * ECC/parity checksum errors when reading an uninitialized buffer
+         */
+        start = priv->mcfg[MRAM_SIDF].off;
+        end = priv->mcfg[MRAM_TXB].off +
+                priv->mcfg[MRAM_TXB].num * TXB_ELEMENT_SIZE;
+        for (i = start; i < end; i += 4)
+                writel(0x0, priv->mram_base + i);
+
         return 0;
 }
 
diff --git a/drivers/net/can/rcar_can.c b/drivers/net/can/rcar_can.c
index 1abe133d1594..9718248e55f1 100644
--- a/drivers/net/can/rcar_can.c
+++ b/drivers/net/can/rcar_can.c
@@ -628,6 +628,7 @@ static const struct net_device_ops rcar_can_netdev_ops = {
         .ndo_open = rcar_can_open,
         .ndo_stop = rcar_can_close,
         .ndo_start_xmit = rcar_can_start_xmit,
+        .ndo_change_mtu = can_change_mtu,
 };
 
 static void rcar_can_rx_pkt(struct rcar_can_priv *priv)
diff --git a/drivers/net/can/sja1000/kvaser_pci.c b/drivers/net/can/sja1000/kvaser_pci.c
index 8ff3424d5147..15c00faeec61 100644
--- a/drivers/net/can/sja1000/kvaser_pci.c
+++ b/drivers/net/can/sja1000/kvaser_pci.c
@@ -214,7 +214,7 @@ static int kvaser_pci_add_chan(struct pci_dev *pdev, int channel,
         struct net_device *dev;
         struct sja1000_priv *priv;
         struct kvaser_pci *board;
-        int err, init_step;
+        int err;
 
         dev = alloc_sja1000dev(sizeof(struct kvaser_pci));
         if (dev == NULL)
@@ -235,7 +235,6 @@ static int kvaser_pci_add_chan(struct pci_dev *pdev, int channel,
         if (channel == 0) {
                 board->xilinx_ver =
                         ioread8(board->res_addr + XILINX_VERINT) >> 4;
-                init_step = 2;
 
                 /* Assert PTADR# - we're in passive mode so the other bits are
                    not important */
@@ -264,8 +263,6 @@ static int kvaser_pci_add_chan(struct pci_dev *pdev, int channel,
         priv->irq_flags = IRQF_SHARED;
         dev->irq = pdev->irq;
 
-        init_step = 4;
-
         dev_info(&pdev->dev, "reg_base=%p conf_addr=%p irq=%d\n",
                  priv->reg_base, board->conf_addr, dev->irq);
 
diff --git a/drivers/net/can/usb/ems_usb.c b/drivers/net/can/usb/ems_usb.c
index 00f2534dde73..29d3f0938eb8 100644
--- a/drivers/net/can/usb/ems_usb.c
+++ b/drivers/net/can/usb/ems_usb.c
@@ -434,10 +434,9 @@ static void ems_usb_read_bulk_callback(struct urb *urb)
         if (urb->actual_length > CPC_HEADER_SIZE) {
                 struct ems_cpc_msg *msg;
                 u8 *ibuf = urb->transfer_buffer;
-                u8 msg_count, again, start;
+                u8 msg_count, start;
 
                 msg_count = ibuf[0] & ~0x80;
-                again = ibuf[0] & 0x80;
 
                 start = CPC_HEADER_SIZE;
 
diff --git a/drivers/net/can/usb/esd_usb2.c b/drivers/net/can/usb/esd_usb2.c
index b7c9e8b11460..c063a54ab8dd 100644
--- a/drivers/net/can/usb/esd_usb2.c
+++ b/drivers/net/can/usb/esd_usb2.c
@@ -464,7 +464,6 @@ static void esd_usb2_write_bulk_callback(struct urb *urb)
 {
         struct esd_tx_urb_context *context = urb->context;
         struct esd_usb2_net_priv *priv;
-        struct esd_usb2 *dev;
         struct net_device *netdev;
         size_t size = sizeof(struct esd_usb2_msg);
 
@@ -472,7 +471,6 @@ static void esd_usb2_write_bulk_callback(struct urb *urb)
 
         priv = context->priv;
         netdev = priv->netdev;
-        dev = priv->usb2;
 
         /* free up our allocated buffer */
         usb_free_coherent(urb->dev, size,
@@ -1143,6 +1141,7 @@ static void esd_usb2_disconnect(struct usb_interface *intf)
                         }
                 }
                 unlink_all_urbs(dev);
+                kfree(dev);
         }
 }
 
diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c
index 04b0f84612f0..009acc8641fc 100644
--- a/drivers/net/can/usb/gs_usb.c
+++ b/drivers/net/can/usb/gs_usb.c
@@ -718,6 +718,7 @@ static const struct net_device_ops gs_usb_netdev_ops = {
         .ndo_open = gs_can_open,
         .ndo_stop = gs_can_close,
         .ndo_start_xmit = gs_can_start_xmit,
+        .ndo_change_mtu = can_change_mtu,
 };
 
 static struct gs_can *gs_make_candev(unsigned int channel, struct usb_interface *intf)
diff --git a/drivers/net/can/xilinx_can.c b/drivers/net/can/xilinx_can.c
index 5e8b5609c067..8a998e3884ce 100644
--- a/drivers/net/can/xilinx_can.c
+++ b/drivers/net/can/xilinx_can.c
@@ -300,7 +300,8 @@ static int xcan_set_bittiming(struct net_device *ndev)
 static int xcan_chip_start(struct net_device *ndev)
 {
         struct xcan_priv *priv = netdev_priv(ndev);
-        u32 err, reg_msr, reg_sr_mask;
+        u32 reg_msr, reg_sr_mask;
+        int err;
         unsigned long timeout;
 
         /* Check if it is in reset mode */
@@ -961,6 +962,7 @@ static const struct net_device_ops xcan_netdev_ops = {
         .ndo_open       = xcan_open,
         .ndo_stop       = xcan_close,
         .ndo_start_xmit = xcan_start_xmit,
+        .ndo_change_mtu = can_change_mtu,
 };
 
 /**
diff --git a/drivers/net/dsa/bcm_sf2.c b/drivers/net/dsa/bcm_sf2.c
index b9625968daac..4f4c2a7888e5 100644
--- a/drivers/net/dsa/bcm_sf2.c
+++ b/drivers/net/dsa/bcm_sf2.c
@@ -377,6 +377,29 @@ static irqreturn_t bcm_sf2_switch_1_isr(int irq, void *dev_id)
         return IRQ_HANDLED;
 }
 
+static int bcm_sf2_sw_rst(struct bcm_sf2_priv *priv)
+{
+        unsigned int timeout = 1000;
+        u32 reg;
+
+        reg = core_readl(priv, CORE_WATCHDOG_CTRL);
+        reg |= SOFTWARE_RESET | EN_CHIP_RST | EN_SW_RESET;
+        core_writel(priv, reg, CORE_WATCHDOG_CTRL);
+
+        do {
+                reg = core_readl(priv, CORE_WATCHDOG_CTRL);
+                if (!(reg & SOFTWARE_RESET))
+                        break;
+
+                usleep_range(1000, 2000);
+        } while (timeout-- > 0);
+
+        if (timeout == 0)
+                return -ETIMEDOUT;
+
+        return 0;
+}
+
 static int bcm_sf2_sw_setup(struct dsa_switch *ds)
 {
         const char *reg_names[BCM_SF2_REGS_NUM] = BCM_SF2_REGS_NAME;
@@ -404,11 +427,18 @@ static int bcm_sf2_sw_setup(struct dsa_switch *ds)
                 *base = of_iomap(dn, i);
                 if (*base == NULL) {
                         pr_err("unable to find register: %s\n", reg_names[i]);
-                        return -ENODEV;
+                        ret = -ENOMEM;
+                        goto out_unmap;
                 }
                 base++;
         }
 
+        ret = bcm_sf2_sw_rst(priv);
+        if (ret) {
+                pr_err("unable to software reset switch: %d\n", ret);
+                goto out_unmap;
+        }
+
         /* Disable all interrupts and request them */
         intrl2_0_writel(priv, 0xffffffff, INTRL2_CPU_MASK_SET);
         intrl2_0_writel(priv, 0xffffffff, INTRL2_CPU_CLEAR);
@@ -484,7 +514,8 @@ out_free_irq0:
 out_unmap:
         base = &priv->core;
         for (i = 0; i < BCM_SF2_REGS_NUM; i++) {
-                iounmap(*base);
+                if (*base)
+                        iounmap(*base);
                 base++;
         }
         return ret;
@@ -733,29 +764,6 @@ static int bcm_sf2_sw_suspend(struct dsa_switch *ds)
         return 0;
 }
 
-static int bcm_sf2_sw_rst(struct bcm_sf2_priv *priv)
-{
-        unsigned int timeout = 1000;
-        u32 reg;
-
-        reg = core_readl(priv, CORE_WATCHDOG_CTRL);
-        reg |= SOFTWARE_RESET | EN_CHIP_RST | EN_SW_RESET;
-        core_writel(priv, reg, CORE_WATCHDOG_CTRL);
-
-        do {
-                reg = core_readl(priv, CORE_WATCHDOG_CTRL);
-                if (!(reg & SOFTWARE_RESET))
-                        break;
-
-                usleep_range(1000, 2000);
-        } while (timeout-- > 0);
-
-        if (timeout == 0)
-                return -ETIMEDOUT;
-
-        return 0;
-}
-
 static int bcm_sf2_sw_resume(struct dsa_switch *ds)
 {
         struct bcm_sf2_priv *priv = ds_to_priv(ds);
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index dbb41c1923e6..77f8f836cbbe 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -8563,7 +8563,8 @@ static int tg3_init_rings(struct tg3 *tp)
                 if (tnapi->rx_rcb)
                         memset(tnapi->rx_rcb, 0, TG3_RX_RCB_RING_BYTES(tp));
 
-                if (tg3_rx_prodring_alloc(tp, &tnapi->prodring)) {
+                if (tnapi->prodring.rx_std &&
+                    tg3_rx_prodring_alloc(tp, &tnapi->prodring)) {
                         tg3_free_rings(tp);
                         return -ENOMEM;
                 }
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c
index cca604994003..4fe33606f372 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c
@@ -1082,7 +1082,7 @@ static int cxgb4_cee_peer_getpg(struct net_device *dev, struct cee_pg *pg)
         pgid = be32_to_cpu(pcmd.u.dcb.pgid.pgid);
 
         for (i = 0; i < CXGB4_MAX_PRIORITY; i++)
-                pg->prio_pg[i] = (pgid >> (i * 4)) & 0xF;
+                pg->prio_pg[7 - i] = (pgid >> (i * 4)) & 0xF;
 
         INIT_PORT_DCB_READ_PEER_CMD(pcmd, pi->port_id);
         pcmd.u.dcb.pgrate.type = FW_PORT_DCB_TYPE_PGRATE;
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
index 8520d5529df8..279873cb6e3a 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
@@ -2442,9 +2442,13 @@ static unsigned int from_fw_linkcaps(unsigned int type, unsigned int caps)
                      SUPPORTED_10000baseKR_Full | SUPPORTED_1000baseKX_Full |
                      SUPPORTED_10000baseKX4_Full;
         else if (type == FW_PORT_TYPE_FIBER_XFI ||
-                 type == FW_PORT_TYPE_FIBER_XAUI || type == FW_PORT_TYPE_SFP)
+                 type == FW_PORT_TYPE_FIBER_XAUI || type == FW_PORT_TYPE_SFP) {
                 v |= SUPPORTED_FIBRE;
-        else if (type == FW_PORT_TYPE_BP40_BA)
+                if (caps & FW_PORT_CAP_SPEED_1G)
+                        v |= SUPPORTED_1000baseT_Full;
+                if (caps & FW_PORT_CAP_SPEED_10G)
+                        v |= SUPPORTED_10000baseT_Full;
+        } else if (type == FW_PORT_TYPE_BP40_BA)
                 v |= SUPPORTED_40000baseSR4_Full;
 
         if (caps & FW_PORT_CAP_ANEG)
diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
index 9a18e7930b31..597c463e384d 100644
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -4309,11 +4309,16 @@ static int be_ndo_bridge_setlink(struct net_device *dev, struct nlmsghdr *nlh)
                 return -EOPNOTSUPP;
 
         br_spec = nlmsg_find_attr(nlh, sizeof(struct ifinfomsg), IFLA_AF_SPEC);
+        if (!br_spec)
+                return -EINVAL;
 
         nla_for_each_nested(attr, br_spec, rem) {
                 if (nla_type(attr) != IFLA_BRIDGE_MODE)
                         continue;
 
+                if (nla_len(attr) < sizeof(mode))
+                        return -EINVAL;
+
                 mode = nla_get_u16(attr);
                 if (mode != BRIDGE_MODE_VEPA && mode != BRIDGE_MODE_VEB)
                         return -EINVAL;
@@ -4421,6 +4426,11 @@ static void be_del_vxlan_port(struct net_device *netdev, sa_family_t sa_family,
                  "Disabled VxLAN offloads for UDP port %d\n",
                  be16_to_cpu(port));
 }
+
+static bool be_gso_check(struct sk_buff *skb, struct net_device *dev)
+{
+        return vxlan_gso_check(skb);
+}
 #endif
 
 static const struct net_device_ops be_netdev_ops = {
@@ -4450,6 +4460,7 @@ static const struct net_device_ops be_netdev_ops = {
 #ifdef CONFIG_BE2NET_VXLAN
         .ndo_add_vxlan_port     = be_add_vxlan_port,
         .ndo_del_vxlan_port     = be_del_vxlan_port,
+        .ndo_gso_check          = be_gso_check,
 #endif
 };
 
diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
index a2d72a87cbde..487cd9c4ac0d 100644
--- a/drivers/net/ethernet/intel/igb/igb_main.c
+++ b/drivers/net/ethernet/intel/igb/igb_main.c
@@ -1012,7 +1012,8 @@ static void igb_free_q_vector(struct igb_adapter *adapter, int v_idx)
         /* igb_get_stats64() might access the rings on this vector,
          * we must wait a grace period before freeing it.
          */
-        kfree_rcu(q_vector, rcu);
+        if (q_vector)
+                kfree_rcu(q_vector, rcu);
 }
 
 /**
@@ -1792,8 +1793,10 @@ void igb_down(struct igb_adapter *adapter)
         adapter->flags &= ~IGB_FLAG_NEED_LINK_UPDATE;
 
         for (i = 0; i < adapter->num_q_vectors; i++) {
-                napi_synchronize(&(adapter->q_vector[i]->napi));
-                napi_disable(&(adapter->q_vector[i]->napi));
+                if (adapter->q_vector[i]) {
+                        napi_synchronize(&adapter->q_vector[i]->napi);
+                        napi_disable(&adapter->q_vector[i]->napi);
+                }
         }
 
 
@@ -3717,7 +3720,8 @@ static void igb_free_all_tx_resources(struct igb_adapter *adapter)
         int i;
 
         for (i = 0; i < adapter->num_tx_queues; i++)
-                igb_free_tx_resources(adapter->tx_ring[i]);
+                if (adapter->tx_ring[i])
+                        igb_free_tx_resources(adapter->tx_ring[i]);
 }
 
 void igb_unmap_and_free_tx_resource(struct igb_ring *ring,
@@ -3782,7 +3786,8 @@ static void igb_clean_all_tx_rings(struct igb_adapter *adapter)
         int i;
 
         for (i = 0; i < adapter->num_tx_queues; i++)
-                igb_clean_tx_ring(adapter->tx_ring[i]);
+                if (adapter->tx_ring[i])
+                        igb_clean_tx_ring(adapter->tx_ring[i]);
 }
 
 /**
@@ -3819,7 +3824,8 @@ static void igb_free_all_rx_resources(struct igb_adapter *adapter)
         int i;
 
         for (i = 0; i < adapter->num_rx_queues; i++)
-                igb_free_rx_resources(adapter->rx_ring[i]);
+                if (adapter->rx_ring[i])
+                        igb_free_rx_resources(adapter->rx_ring[i]);
 }
 
 /**
@@ -3874,7 +3880,8 @@ static void igb_clean_all_rx_rings(struct igb_adapter *adapter)
         int i;
 
         for (i = 0; i < adapter->num_rx_queues; i++)
-                igb_clean_rx_ring(adapter->rx_ring[i]);
+                if (adapter->rx_ring[i])
+                        igb_clean_rx_ring(adapter->rx_ring[i]);
 }
 
 /**
@@ -7404,6 +7411,8 @@ static int igb_resume(struct device *dev)
         pci_restore_state(pdev);
         pci_save_state(pdev);
 
+        if (!pci_device_is_present(pdev))
+                return -ENODEV;
         err = pci_enable_device_mem(pdev);
         if (err) {
                 dev_err(&pdev->dev,
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
index d2df4e3d1032..cc51554c9e99 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
@@ -3936,8 +3936,8 @@ void ixgbe_set_rx_mode(struct net_device *netdev)
                  * if SR-IOV and VMDQ are disabled - otherwise ensure
                  * that hardware VLAN filters remain enabled.
                  */
-                if (!(adapter->flags & (IXGBE_FLAG_VMDQ_ENABLED |
-                                        IXGBE_FLAG_SRIOV_ENABLED)))
+                if (adapter->flags & (IXGBE_FLAG_VMDQ_ENABLED |
+                                      IXGBE_FLAG_SRIOV_ENABLED))
                         vlnctrl |= (IXGBE_VLNCTRL_VFE | IXGBE_VLNCTRL_CFIEN);
         } else {
                 if (netdev->flags & IFF_ALLMULTI) {
@@ -7669,6 +7669,8 @@ static int ixgbe_ndo_bridge_setlink(struct net_device *dev,
                 return -EOPNOTSUPP;
 
         br_spec = nlmsg_find_attr(nlh, sizeof(struct ifinfomsg), IFLA_AF_SPEC);
+        if (!br_spec)
+                return -EINVAL;
 
         nla_for_each_nested(attr, br_spec, rem) {
                 __u16 mode;
@@ -7677,6 +7679,9 @@ static int ixgbe_ndo_bridge_setlink(struct net_device *dev,
                 if (nla_type(attr) != IFLA_BRIDGE_MODE)
                         continue;
 
+                if (nla_len(attr) < sizeof(mode))
+                        return -EINVAL;
+
                 mode = nla_get_u16(attr);
                 if (mode == BRIDGE_MODE_VEPA) {
                         reg = 0;
@@ -7979,6 +7984,7 @@ static int ixgbe_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         int i, err, pci_using_dac, expected_gts;
         unsigned int indices = MAX_TX_QUEUES;
         u8 part_str[IXGBE_PBANUM_LENGTH];
+        bool disable_dev = false;
 #ifdef IXGBE_FCOE
         u16 device_caps;
 #endif
@@ -8369,13 +8375,14 @@ err_sw_init:
         iounmap(adapter->io_addr);
         kfree(adapter->mac_table);
 err_ioremap:
+        disable_dev = !test_and_set_bit(__IXGBE_DISABLED, &adapter->state);
         free_netdev(netdev);
 err_alloc_etherdev:
         pci_release_selected_regions(pdev,
                                      pci_select_bars(pdev, IORESOURCE_MEM));
 err_pci_reg:
 err_dma:
-        if (!adapter || !test_and_set_bit(__IXGBE_DISABLED, &adapter->state))
+        if (!adapter || disable_dev)
                 pci_disable_device(pdev);
         return err;
 }
@@ -8393,6 +8400,7 @@ static void ixgbe_remove(struct pci_dev *pdev)
 {
         struct ixgbe_adapter *adapter = pci_get_drvdata(pdev);
         struct net_device *netdev = adapter->netdev;
+        bool disable_dev;
 
         ixgbe_dbg_adapter_exit(adapter);
 
@@ -8442,11 +8450,12 @@ static void ixgbe_remove(struct pci_dev *pdev)
         e_dev_info("complete\n");
 
         kfree(adapter->mac_table);
+        disable_dev = !test_and_set_bit(__IXGBE_DISABLED, &adapter->state);
         free_netdev(netdev);
 
         pci_disable_pcie_error_reporting(pdev);
 
-        if (!test_and_set_bit(__IXGBE_DISABLED, &adapter->state))
+        if (disable_dev)
                 pci_disable_device(pdev);
 }
 
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
index 02266e3de514..4d69e382b4e5 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
@@ -1693,7 +1693,7 @@ int mlx4_en_start_port(struct net_device *dev)
         mlx4_set_stats_bitmap(mdev->dev, &priv->stats_bitmap);
 
 #ifdef CONFIG_MLX4_EN_VXLAN
-        if (priv->mdev->dev->caps.flags2 & MLX4_DEV_CAP_FLAG2_VXLAN_OFFLOADS)
+        if (priv->mdev->dev->caps.tunnel_offload_mode == MLX4_TUNNEL_OFFLOAD_MODE_VXLAN)
                 vxlan_get_rx_port(dev);
 #endif
         priv->port_up = true;
@@ -2355,6 +2355,11 @@ static void mlx4_en_del_vxlan_port(struct  net_device *dev,
 
         queue_work(priv->mdev->workqueue, &priv->vxlan_del_task);
 }
+
+static bool mlx4_en_gso_check(struct sk_buff *skb, struct net_device *dev)
+{
+        return vxlan_gso_check(skb);
+}
 #endif
 
 static const struct net_device_ops mlx4_netdev_ops = {
@@ -2386,6 +2391,7 @@ static const struct net_device_ops mlx4_netdev_ops = {
 #ifdef CONFIG_MLX4_EN_VXLAN
         .ndo_add_vxlan_port     = mlx4_en_add_vxlan_port,
         .ndo_del_vxlan_port     = mlx4_en_del_vxlan_port,
+        .ndo_gso_check          = mlx4_en_gso_check,
 #endif
 };
 
@@ -2416,6 +2422,11 @@ static const struct net_device_ops mlx4_netdev_ops_master = {
         .ndo_rx_flow_steer      = mlx4_en_filter_rfs,
 #endif
         .ndo_get_phys_port_id   = mlx4_en_get_phys_port_id,
+#ifdef CONFIG_MLX4_EN_VXLAN
+        .ndo_add_vxlan_port     = mlx4_en_add_vxlan_port,
+        .ndo_del_vxlan_port     = mlx4_en_del_vxlan_port,
+        .ndo_gso_check          = mlx4_en_gso_check,
+#endif
 };
 
 int mlx4_en_init_netdev(struct mlx4_en_dev *mdev, int port,
diff --git a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
index 5d2498dcf536..cd5cf6d957c7 100644
--- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
+++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
@@ -1546,7 +1546,7 @@ static int qp_alloc_res(struct mlx4_dev *dev, int slave, int op, int cmd,
 
         switch (op) {
         case RES_OP_RESERVE:
-                count = get_param_l(&in_param);
+                count = get_param_l(&in_param) & 0xffffff;
                 align = get_param_h(&in_param);
                 err = mlx4_grant_resource(dev, slave, RES_QP, count, 0);
                 if (err)
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
index f5e29f7bdae3..a913b3ad2f89 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
@@ -503,6 +503,11 @@ static void qlcnic_del_vxlan_port(struct net_device *netdev,
 
         adapter->flags |= QLCNIC_DEL_VXLAN_PORT;
 }
+
+static bool qlcnic_gso_check(struct sk_buff *skb, struct net_device *dev)
+{
+        return vxlan_gso_check(skb);
+}
 #endif
 
 static const struct net_device_ops qlcnic_netdev_ops = {
@@ -526,6 +531,7 @@ static const struct net_device_ops qlcnic_netdev_ops = {
 #ifdef CONFIG_QLCNIC_VXLAN
         .ndo_add_vxlan_port     = qlcnic_add_vxlan_port,
         .ndo_del_vxlan_port     = qlcnic_del_vxlan_port,
+        .ndo_gso_check          = qlcnic_gso_check,
 #endif
 #ifdef CONFIG_NET_POLL_CONTROLLER
         .ndo_poll_controller = qlcnic_poll_controller,
diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
index 60e9c2cd051e..b5db6b3f939f 100644
--- a/drivers/net/ethernet/renesas/sh_eth.c
+++ b/drivers/net/ethernet/renesas/sh_eth.c
@@ -917,21 +917,13 @@ static int sh_eth_reset(struct net_device *ndev)
         return ret;
 }
 
-#if defined(CONFIG_CPU_SH4) || defined(CONFIG_ARCH_SHMOBILE)
 static void sh_eth_set_receive_align(struct sk_buff *skb)
 {
-        int reserve;
+        uintptr_t reserve = (uintptr_t)skb->data & (SH_ETH_RX_ALIGN - 1);
 
-        reserve = SH4_SKB_RX_ALIGN - ((u32)skb->data & (SH4_SKB_RX_ALIGN - 1));
         if (reserve)
-                skb_reserve(skb, reserve);
+                skb_reserve(skb, SH_ETH_RX_ALIGN - reserve);
 }
-#else
-static void sh_eth_set_receive_align(struct sk_buff *skb)
-{
-        skb_reserve(skb, SH2_SH3_SKB_RX_ALIGN);
-}
-#endif
 
 
 /* CPU <-> EDMAC endian convert */
@@ -1119,6 +1111,7 @@ static void sh_eth_ring_format(struct net_device *ndev)
         struct sh_eth_txdesc *txdesc = NULL;
         int rx_ringsize = sizeof(*rxdesc) * mdp->num_rx_ring;
         int tx_ringsize = sizeof(*txdesc) * mdp->num_tx_ring;
+        int skbuff_size = mdp->rx_buf_sz + SH_ETH_RX_ALIGN - 1;
 
         mdp->cur_rx = 0;
         mdp->cur_tx = 0;
@@ -1131,21 +1124,21 @@ static void sh_eth_ring_format(struct net_device *ndev)
         for (i = 0; i < mdp->num_rx_ring; i++) {
                 /* skb */
                 mdp->rx_skbuff[i] = NULL;
-                skb = netdev_alloc_skb(ndev, mdp->rx_buf_sz);
+                skb = netdev_alloc_skb(ndev, skbuff_size);
                 mdp->rx_skbuff[i] = skb;
                 if (skb == NULL)
                         break;
-                dma_map_single(&ndev->dev, skb->data, mdp->rx_buf_sz,
-                               DMA_FROM_DEVICE);
                 sh_eth_set_receive_align(skb);
 
                 /* RX descriptor */
                 rxdesc = &mdp->rx_ring[i];
+                /* The size of the buffer is a multiple of 16 bytes. */
+                rxdesc->buffer_length = ALIGN(mdp->rx_buf_sz, 16);
+                dma_map_single(&ndev->dev, skb->data, rxdesc->buffer_length,
+                               DMA_FROM_DEVICE);
                 rxdesc->addr = virt_to_phys(PTR_ALIGN(skb->data, 4));
                 rxdesc->status = cpu_to_edmac(mdp, RD_RACT | RD_RFP);
 
-                /* The size of the buffer is 16 byte boundary. */
-                rxdesc->buffer_length = ALIGN(mdp->rx_buf_sz, 16);
                 /* Rx descriptor address set */
                 if (i == 0) {
                         sh_eth_write(ndev, mdp->rx_desc_dma, RDLAR);
@@ -1397,6 +1390,7 @@ static int sh_eth_rx(struct net_device *ndev, u32 intr_status, int *quota)
         struct sk_buff *skb;
         u16 pkt_len = 0;
         u32 desc_status;
+        int skbuff_size = mdp->rx_buf_sz + SH_ETH_RX_ALIGN - 1;
 
         rxdesc = &mdp->rx_ring[entry];
         while (!(rxdesc->status & cpu_to_edmac(mdp, RD_RACT))) {
@@ -1448,7 +1442,7 @@ static int sh_eth_rx(struct net_device *ndev, u32 intr_status, int *quota)
                         if (mdp->cd->rpadir)
                                 skb_reserve(skb, NET_IP_ALIGN);
                         dma_sync_single_for_cpu(&ndev->dev, rxdesc->addr,
-                                                mdp->rx_buf_sz,
+                                                ALIGN(mdp->rx_buf_sz, 16),
                                                 DMA_FROM_DEVICE);
                         skb_put(skb, pkt_len);
                         skb->protocol = eth_type_trans(skb, ndev);
@@ -1468,13 +1462,13 @@ static int sh_eth_rx(struct net_device *ndev, u32 intr_status, int *quota)
                 rxdesc->buffer_length = ALIGN(mdp->rx_buf_sz, 16);
 
                 if (mdp->rx_skbuff[entry] == NULL) {
-                        skb = netdev_alloc_skb(ndev, mdp->rx_buf_sz);
+                        skb = netdev_alloc_skb(ndev, skbuff_size);
                         mdp->rx_skbuff[entry] = skb;
                         if (skb == NULL)
                                 break;  /* Better luck next round. */
-                        dma_map_single(&ndev->dev, skb->data, mdp->rx_buf_sz,
-                                       DMA_FROM_DEVICE);
                         sh_eth_set_receive_align(skb);
+                        dma_map_single(&ndev->dev, skb->data,
+                                       rxdesc->buffer_length, DMA_FROM_DEVICE);
 
                         skb_checksum_none_assert(skb);
                         rxdesc->addr = virt_to_phys(PTR_ALIGN(skb->data, 4));
@@ -2042,6 +2036,8 @@ static int sh_eth_open(struct net_device *ndev)
         if (ret)
                 goto out_free_irq;
 
+        mdp->is_opened = 1;
+
         return ret;
 
 out_free_irq:
@@ -2131,6 +2127,36 @@ static int sh_eth_start_xmit(struct sk_buff *skb, struct net_device *ndev)
         return NETDEV_TX_OK;
 }
 
+static struct net_device_stats *sh_eth_get_stats(struct net_device *ndev)
+{
+        struct sh_eth_private *mdp = netdev_priv(ndev);
+
+        if (sh_eth_is_rz_fast_ether(mdp))
+                return &ndev->stats;
+
+        if (!mdp->is_opened)
+                return &ndev->stats;
+
+        ndev->stats.tx_dropped += sh_eth_read(ndev, TROCR);
+        sh_eth_write(ndev, 0, TROCR);   /* (write clear) */
+        ndev->stats.collisions += sh_eth_read(ndev, CDCR);
+        sh_eth_write(ndev, 0, CDCR);    /* (write clear) */
+        ndev->stats.tx_carrier_errors += sh_eth_read(ndev, LCCR);
+        sh_eth_write(ndev, 0, LCCR);    /* (write clear) */
+
+        if (sh_eth_is_gether(mdp)) {
+                ndev->stats.tx_carrier_errors += sh_eth_read(ndev, CERCR);
+                sh_eth_write(ndev, 0, CERCR);   /* (write clear) */
+                ndev->stats.tx_carrier_errors += sh_eth_read(ndev, CEECR);
+                sh_eth_write(ndev, 0, CEECR);   /* (write clear) */
+        } else {
+                ndev->stats.tx_carrier_errors += sh_eth_read(ndev, CNDCR);
+                sh_eth_write(ndev, 0, CNDCR);   /* (write clear) */
+        }
+
+        return &ndev->stats;
+}
+
 /* device close function */
 static int sh_eth_close(struct net_device *ndev)
 {
@@ -2145,6 +2171,7 @@ static int sh_eth_close(struct net_device *ndev)
         sh_eth_write(ndev, 0, EDTRR);
         sh_eth_write(ndev, 0, EDRRR);
 
+        sh_eth_get_stats(ndev);
         /* PHY Disconnect */
         if (mdp->phydev) {
                 phy_stop(mdp->phydev);
@@ -2163,36 +2190,9 @@ static int sh_eth_close(struct net_device *ndev)
 
         pm_runtime_put_sync(&mdp->pdev->dev);
 
-        return 0;
-}
-
-static struct net_device_stats *sh_eth_get_stats(struct net_device *ndev)
-{
-        struct sh_eth_private *mdp = netdev_priv(ndev);
-
-        if (sh_eth_is_rz_fast_ether(mdp))
-                return &ndev->stats;
+        mdp->is_opened = 0;
 
-        pm_runtime_get_sync(&mdp->pdev->dev);
-
-        ndev->stats.tx_dropped += sh_eth_read(ndev, TROCR);
-        sh_eth_write(ndev, 0, TROCR);   /* (write clear) */
-        ndev->stats.collisions += sh_eth_read(ndev, CDCR);
-        sh_eth_write(ndev, 0, CDCR);    /* (write clear) */
-        ndev->stats.tx_carrier_errors += sh_eth_read(ndev, LCCR);
-        sh_eth_write(ndev, 0, LCCR);    /* (write clear) */
-        if (sh_eth_is_gether(mdp)) {
-                ndev->stats.tx_carrier_errors += sh_eth_read(ndev, CERCR);
-                sh_eth_write(ndev, 0, CERCR);   /* (write clear) */
-                ndev->stats.tx_carrier_errors += sh_eth_read(ndev, CEECR);
-                sh_eth_write(ndev, 0, CEECR);   /* (write clear) */
-        } else {
-                ndev->stats.tx_carrier_errors += sh_eth_read(ndev, CNDCR);
-                sh_eth_write(ndev, 0, CNDCR);   /* (write clear) */
-        }
-        pm_runtime_put_sync(&mdp->pdev->dev);
-
-        return &ndev->stats;
+        return 0;
 }
 
 /* ioctl to device function */
diff --git a/drivers/net/ethernet/renesas/sh_eth.h b/drivers/net/ethernet/renesas/sh_eth.h
index b37c427144ee..22301bf9c21d 100644
--- a/drivers/net/ethernet/renesas/sh_eth.h
+++ b/drivers/net/ethernet/renesas/sh_eth.h
@@ -162,9 +162,9 @@ enum {
 
 /* Driver's parameters */
 #if defined(CONFIG_CPU_SH4) || defined(CONFIG_ARCH_SHMOBILE)
-#define SH4_SKB_RX_ALIGN        32
+#define SH_ETH_RX_ALIGN         32
 #else
-#define SH2_SH3_SKB_RX_ALIGN    2
+#define SH_ETH_RX_ALIGN         2
 #endif
 
 /* Register's bits
@@ -522,6 +522,7 @@ struct sh_eth_private {
 
         unsigned no_ether_link:1;
         unsigned ether_link_active_low:1;
+        unsigned is_opened:1;
 };
 
 static inline void sh_eth_soft_swap(char *src, int len)
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
index db56fa7ce8f9..58a1a0a423d4 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
@@ -177,12 +177,6 @@ static int stmmac_probe_config_dt(struct platform_device *pdev,
          */
         plat->maxmtu = JUMBO_LEN;
 
-        /* Set default value for multicast hash bins */
-        plat->multicast_filter_bins = HASH_TABLE_SIZE;
-
-        /* Set default value for unicast filter entries */
-        plat->unicast_filter_entries = 1;
-
         /*
          * Currently only the properties needed on SPEAr600
          * are provided. All other properties should be added
@@ -270,16 +264,23 @@ static int stmmac_pltfr_probe(struct platform_device *pdev)
                 return PTR_ERR(addr);
 
         plat_dat = dev_get_platdata(&pdev->dev);
-        if (pdev->dev.of_node) {
-                if (!plat_dat)
-                        plat_dat = devm_kzalloc(&pdev->dev,
+
+        if (!plat_dat)
+                plat_dat = devm_kzalloc(&pdev->dev,
                                         sizeof(struct plat_stmmacenet_data),
                                         GFP_KERNEL);
-                if (!plat_dat) {
-                        pr_err("%s: ERROR: no memory", __func__);
-                        return  -ENOMEM;
-                }
+        if (!plat_dat) {
+                pr_err("%s: ERROR: no memory", __func__);
+                return  -ENOMEM;
+        }
+
+        /* Set default value for multicast hash bins */
+        plat_dat->multicast_filter_bins = HASH_TABLE_SIZE;
 
+        /* Set default value for unicast filter entries */
+        plat_dat->unicast_filter_entries = 1;
+
+        if (pdev->dev.of_node) {
                 ret = stmmac_probe_config_dt(pdev, plat_dat, &mac);
                 if (ret) {
                         pr_err("%s: main dt probe failed", __func__);
diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
index d8794488f80a..c560f9aeb55d 100644
--- a/drivers/net/ethernet/ti/cpsw.c
+++ b/drivers/net/ethernet/ti/cpsw.c
@@ -129,9 +129,9 @@ do {								\
 #define CPSW_VLAN_AWARE         BIT(1)
 #define CPSW_ALE_VLAN_AWARE     1
 
-#define CPSW_FIFO_NORMAL_MODE           (0 << 15)
-#define CPSW_FIFO_DUAL_MAC_MODE         (1 << 15)
-#define CPSW_FIFO_RATE_LIMIT_MODE       (2 << 15)
+#define CPSW_FIFO_NORMAL_MODE           (0 << 16)
+#define CPSW_FIFO_DUAL_MAC_MODE         (1 << 16)
+#define CPSW_FIFO_RATE_LIMIT_MODE       (2 << 16)
 
 #define CPSW_INTPACEEN          (0x3f << 16)
 #define CPSW_INTPRESCALE_MASK   (0x7FF << 0)
diff --git a/drivers/net/ieee802154/fakehard.c b/drivers/net/ieee802154/fakehard.c
index 9ce854f43917..6cbc56ad9ff4 100644
--- a/drivers/net/ieee802154/fakehard.c
+++ b/drivers/net/ieee802154/fakehard.c
@@ -377,17 +377,20 @@ static int ieee802154fake_probe(struct platform_device *pdev)
 
         err = wpan_phy_register(phy);
         if (err)
-                goto out;
+                goto err_phy_reg;
 
         err = register_netdev(dev);
-        if (err < 0)
-                goto out;
+        if (err)
+                goto err_netdev_reg;
 
         dev_info(&pdev->dev, "Added ieee802154 HardMAC hardware\n");
         return 0;
 
-out:
-        unregister_netdev(dev);
+err_netdev_reg:
+        wpan_phy_unregister(phy);
+err_phy_reg:
+        free_netdev(dev);
+        wpan_phy_free(phy);
         return err;
 }
 
diff --git a/drivers/net/ppp/pptp.c b/drivers/net/ppp/pptp.c
index 1aff970be33e..1dc628ffce2b 100644
--- a/drivers/net/ppp/pptp.c
+++ b/drivers/net/ppp/pptp.c
@@ -506,7 +506,9 @@ static int pptp_getname(struct socket *sock, struct sockaddr *uaddr,
         int len = sizeof(struct sockaddr_pppox);
         struct sockaddr_pppox sp;
 
-        sp.sa_family      = AF_PPPOX;
+        memset(&sp.sa_addr, 0, sizeof(sp.sa_addr));
+
+        sp.sa_family    = AF_PPPOX;
         sp.sa_protocol  = PX_PROTO_PPTP;
         sp.sa_addr.pptp = pppox_sk(sock->sk)->proto.pptp.src_addr;
 
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index 22756db53dca..b8a82b86f909 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -780,6 +780,7 @@ static const struct usb_device_id products[] = {
         {QMI_FIXED_INTF(0x413c, 0x81a4, 8)},    /* Dell Wireless 5570e HSPA+ (42Mbps) Mobile Broadband Card */
         {QMI_FIXED_INTF(0x413c, 0x81a8, 8)},    /* Dell Wireless 5808 Gobi(TM) 4G LTE Mobile Broadband Card */
         {QMI_FIXED_INTF(0x413c, 0x81a9, 8)},    /* Dell Wireless 5808e Gobi(TM) 4G LTE Mobile Broadband Card */
+        {QMI_FIXED_INTF(0x03f0, 0x581d, 4)},    /* HP lt4112 LTE/HSPA+ Gobi 4G Module (Huawei me906e) */
 
         /* 4. Gobi 1000 devices */
         {QMI_GOBI1K_DEVICE(0x05c6, 0x9212)},    /* Acer Gobi Modem Device */
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index ec2a8b41ed41..b0bc8ead47de 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -1673,6 +1673,40 @@ static const struct attribute_group virtio_net_mrg_rx_group = {
 };
 #endif
 
+static bool virtnet_fail_on_feature(struct virtio_device *vdev,
+                                    unsigned int fbit,
+                                    const char *fname, const char *dname)
+{
+        if (!virtio_has_feature(vdev, fbit))
+                return false;
+
+        dev_err(&vdev->dev, "device advertises feature %s but not %s",
+                fname, dname);
+
+        return true;
+}
+
+#define VIRTNET_FAIL_ON(vdev, fbit, dbit)                       \
+        virtnet_fail_on_feature(vdev, fbit, #fbit, dbit)
+
+static bool virtnet_validate_features(struct virtio_device *vdev)
+{
+        if (!virtio_has_feature(vdev, VIRTIO_NET_F_CTRL_VQ) &&
+            (VIRTNET_FAIL_ON(vdev, VIRTIO_NET_F_CTRL_RX,
+                             "VIRTIO_NET_F_CTRL_VQ") ||
+             VIRTNET_FAIL_ON(vdev, VIRTIO_NET_F_CTRL_VLAN,
+                             "VIRTIO_NET_F_CTRL_VQ") ||
+             VIRTNET_FAIL_ON(vdev, VIRTIO_NET_F_GUEST_ANNOUNCE,
+                             "VIRTIO_NET_F_CTRL_VQ") ||
+             VIRTNET_FAIL_ON(vdev, VIRTIO_NET_F_MQ, "VIRTIO_NET_F_CTRL_VQ") ||
+             VIRTNET_FAIL_ON(vdev, VIRTIO_NET_F_CTRL_MAC_ADDR,
+                             "VIRTIO_NET_F_CTRL_VQ"))) {
+                return false;
+        }
+
+        return true;
+}
+
 static int virtnet_probe(struct virtio_device *vdev)
 {
         int i, err;
@@ -1680,6 +1714,9 @@ static int virtnet_probe(struct virtio_device *vdev)
         struct virtnet_info *vi;
         u16 max_queue_pairs;
 
+        if (!virtnet_validate_features(vdev))
+                return -EINVAL;
+
         /* Find if host supports multiqueue virtio_net device */
         err = virtio_cread_feature(vdev, VIRTIO_NET_F_MQ,
                                    struct virtio_net_config,
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index fa9dc45b75a6..be4649a49c5e 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -67,12 +67,6 @@
 
 #define VXLAN_FLAGS 0x08000000  /* struct vxlanhdr.vx_flags required value. */
 
-/* VXLAN protocol header */
-struct vxlanhdr {
-        __be32 vx_flags;
-        __be32 vx_vni;
-};
-
 /* UDP port for VXLAN traffic.
  * The IANA assigned port is 4789, but the Linux default is 8472
  * for compatibility with early adopters.
@@ -2312,9 +2306,9 @@ static struct socket *vxlan_create_sock(struct net *net, bool ipv6,
         if (ipv6) {
                 udp_conf.family = AF_INET6;
                 udp_conf.use_udp6_tx_checksums =
-                    !!(flags & VXLAN_F_UDP_ZERO_CSUM6_TX);
+                    !(flags & VXLAN_F_UDP_ZERO_CSUM6_TX);
                 udp_conf.use_udp6_rx_checksums =
-                    !!(flags & VXLAN_F_UDP_ZERO_CSUM6_RX);
+                    !(flags & VXLAN_F_UDP_ZERO_CSUM6_RX);
         } else {
                 udp_conf.family = AF_INET;
                 udp_conf.local_ip.s_addr = INADDR_ANY;
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.c b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
index 697c4ae90af0..1e8ea5e4d4ca 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
@@ -664,6 +664,19 @@ static void ar9003_hw_override_ini(struct ath_hw *ah)
                 ah->enabled_cals |= TX_CL_CAL;
         else
                 ah->enabled_cals &= ~TX_CL_CAL;
+
+        if (AR_SREV_9340(ah) || AR_SREV_9531(ah) || AR_SREV_9550(ah)) {
+                if (ah->is_clk_25mhz) {
+                        REG_WRITE(ah, AR_RTC_DERIVED_CLK, 0x17c << 1);
+                        REG_WRITE(ah, AR_SLP32_MODE, 0x0010f3d7);
+                        REG_WRITE(ah, AR_SLP32_INC, 0x0001e7ae);
+                } else {
+                        REG_WRITE(ah, AR_RTC_DERIVED_CLK, 0x261 << 1);
+                        REG_WRITE(ah, AR_SLP32_MODE, 0x0010f400);
+                        REG_WRITE(ah, AR_SLP32_INC, 0x0001e800);
+                }
+                udelay(100);
+        }
 }
 
 static void ar9003_hw_prog_ini(struct ath_hw *ah,
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index 8be4b1453394..2ad605760e21 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -861,19 +861,6 @@ static void ath9k_hw_init_pll(struct ath_hw *ah,
         udelay(RTC_PLL_SETTLE_DELAY);
 
         REG_WRITE(ah, AR_RTC_SLEEP_CLK, AR_RTC_FORCE_DERIVED_CLK);
-
-        if (AR_SREV_9340(ah) || AR_SREV_9550(ah)) {
-                if (ah->is_clk_25mhz) {
-                        REG_WRITE(ah, AR_RTC_DERIVED_CLK, 0x17c << 1);
-                        REG_WRITE(ah, AR_SLP32_MODE, 0x0010f3d7);
-                        REG_WRITE(ah,  AR_SLP32_INC, 0x0001e7ae);
-                } else {
-                        REG_WRITE(ah, AR_RTC_DERIVED_CLK, 0x261 << 1);
-                        REG_WRITE(ah, AR_SLP32_MODE, 0x0010f400);
-                        REG_WRITE(ah,  AR_SLP32_INC, 0x0001e800);
-                }
-                udelay(100);
-        }
 }
 
 static void ath9k_hw_init_interrupt_masks(struct ath_hw *ah,
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index 30c66dfcd7a0..4f18a6be0c7d 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -974,9 +974,8 @@ void ath9k_calculate_iter_data(struct ath_softc *sc,
         struct ath_vif *avp;
 
         /*
-         * Pick the MAC address of the first interface as the new hardware
-         * MAC address. The hardware will use it together with the BSSID mask
-         * when matching addresses.
+         * The hardware will use primary station addr together with the
+         * BSSID mask when matching addresses.
          */
         memset(iter_data, 0, sizeof(*iter_data));
         memset(&iter_data->mask, 0xff, ETH_ALEN);
@@ -1205,6 +1204,8 @@ static int ath9k_add_interface(struct ieee80211_hw *hw,
                 list_add_tail(&avp->list, &avp->chanctx->vifs);
         }
 
+        ath9k_calculate_summary_state(sc, avp->chanctx);
+
         ath9k_assign_hw_queues(hw, vif);
 
         an->sc = sc;
@@ -1274,6 +1275,8 @@ static void ath9k_remove_interface(struct ieee80211_hw *hw,
 
         ath_tx_node_cleanup(sc, &avp->mcast_node);
 
+        ath9k_calculate_summary_state(sc, avp->chanctx);
+
         mutex_unlock(&sc->mutex);
 }
 
diff --git a/drivers/net/wireless/b43/phy_common.c b/drivers/net/wireless/b43/phy_common.c
index 1dfc682a8055..ee27b06074e1 100644
--- a/drivers/net/wireless/b43/phy_common.c
+++ b/drivers/net/wireless/b43/phy_common.c
@@ -300,9 +300,7 @@ void b43_phy_write(struct b43_wldev *dev, u16 reg, u16 value)
 
 void b43_phy_copy(struct b43_wldev *dev, u16 destreg, u16 srcreg)
 {
-        assert_mac_suspended(dev);
-        dev->phy.ops->phy_write(dev, destreg,
-                dev->phy.ops->phy_read(dev, srcreg));
+        b43_phy_write(dev, destreg, b43_phy_read(dev, srcreg));
 }
 
 void b43_phy_mask(struct b43_wldev *dev, u16 offset, u16 mask)
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/of.c b/drivers/net/wireless/brcm80211/brcmfmac/of.c
index f05f5270fec1..927bffd5be64 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/of.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/of.c
@@ -40,8 +40,8 @@ void brcmf_of_probe(struct brcmf_sdio_dev *sdiodev)
                 return;
 
         irq = irq_of_parse_and_map(np, 0);
-        if (irq < 0) {
-                brcmf_err("interrupt could not be mapped: err=%d\n", irq);
+        if (!irq) {
+                brcmf_err("interrupt could not be mapped\n");
                 devm_kfree(dev, sdiodev->pdata);
                 return;
         }
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/pcie.c b/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
index 8c0632ec9f7a..16fef3382019 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
@@ -19,10 +19,10 @@
 #include <linux/pci.h>
 #include <linux/vmalloc.h>
 #include <linux/delay.h>
-#include <linux/unaligned/access_ok.h>
 #include <linux/interrupt.h>
 #include <linux/bcma/bcma.h>
 #include <linux/sched.h>
+#include <asm/unaligned.h>
 
 #include <soc.h>
 #include <chipcommon.h>
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/usb.c b/drivers/net/wireless/brcm80211/brcmfmac/usb.c
index dc135915470d..875d1142c8b0 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/usb.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/usb.c
@@ -669,10 +669,12 @@ static int brcmf_usb_dl_cmd(struct brcmf_usbdev_info *devinfo, u8 cmd,
                 goto finalize;
         }
 
-        if (!brcmf_usb_ioctl_resp_wait(devinfo))
+        if (!brcmf_usb_ioctl_resp_wait(devinfo)) {
+                usb_kill_urb(devinfo->ctl_urb);
                 ret = -ETIMEDOUT;
-        else
+        } else {
                 memcpy(buffer, tmpbuf, buflen);
+        }
 
 finalize:
         kfree(tmpbuf);
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
index 28fa25b509db..39b45c038a93 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
@@ -299,6 +299,7 @@ static u16 chandef_to_chanspec(struct brcmu_d11inf *d11inf,
         primary_offset = ch->center_freq1 - ch->chan->center_freq;
         switch (ch->width) {
         case NL80211_CHAN_WIDTH_20:
+        case NL80211_CHAN_WIDTH_20_NOHT:
                 ch_inf.bw = BRCMU_CHAN_BW_20;
                 WARN_ON(primary_offset != 0);
                 break;
@@ -323,6 +324,10 @@ static u16 chandef_to_chanspec(struct brcmu_d11inf *d11inf,
                                 ch_inf.sb = BRCMU_CHAN_SB_LU;
                 }
                 break;
+        case NL80211_CHAN_WIDTH_80P80:
+        case NL80211_CHAN_WIDTH_160:
+        case NL80211_CHAN_WIDTH_5:
+        case NL80211_CHAN_WIDTH_10:
         default:
                 WARN_ON_ONCE(1);
         }
@@ -333,6 +338,7 @@ static u16 chandef_to_chanspec(struct brcmu_d11inf *d11inf,
         case IEEE80211_BAND_5GHZ:
                 ch_inf.band = BRCMU_CHAN_BAND_5G;
                 break;
+        case IEEE80211_BAND_60GHZ:
         default:
                 WARN_ON_ONCE(1);
         }
diff --git a/drivers/net/wireless/iwlwifi/iwl-fw.h b/drivers/net/wireless/iwlwifi/iwl-fw.h
index 4f6e66892acc..b894a84e8393 100644
--- a/drivers/net/wireless/iwlwifi/iwl-fw.h
+++ b/drivers/net/wireless/iwlwifi/iwl-fw.h
@@ -155,6 +155,7 @@ enum iwl_ucode_tlv_api {
  * @IWL_UCODE_TLV_CAPA_QUIET_PERIOD_SUPPORT: supports Quiet Period requests
  * @IWL_UCODE_TLV_CAPA_DQA_SUPPORT: supports dynamic queue allocation (DQA),
  *      which also implies support for the scheduler configuration command
+ * @IWL_UCODE_TLV_CAPA_HOTSPOT_SUPPORT: supports Hot Spot Command
  */
 enum iwl_ucode_tlv_capa {
         IWL_UCODE_TLV_CAPA_D0I3_SUPPORT                 = BIT(0),
@@ -163,6 +164,7 @@ enum iwl_ucode_tlv_capa {
         IWL_UCODE_TLV_CAPA_WFA_TPC_REP_IE_SUPPORT       = BIT(10),
         IWL_UCODE_TLV_CAPA_QUIET_PERIOD_SUPPORT         = BIT(11),
         IWL_UCODE_TLV_CAPA_DQA_SUPPORT                  = BIT(12),
+        IWL_UCODE_TLV_CAPA_HOTSPOT_SUPPORT              = BIT(18),
 };
 
 /* The default calibrate table size if not specified by firmware file */
diff --git a/drivers/net/wireless/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
index b62405865b25..b6d2683da3a9 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
@@ -2448,9 +2448,15 @@ static int iwl_mvm_roc(struct ieee80211_hw *hw,
 
         switch (vif->type) {
         case NL80211_IFTYPE_STATION:
-                /* Use aux roc framework (HS20) */
-                ret = iwl_mvm_send_aux_roc_cmd(mvm, channel,
-                                               vif, duration);
+                if (mvm->fw->ucode_capa.capa[0] &
+                    IWL_UCODE_TLV_CAPA_HOTSPOT_SUPPORT) {
+                        /* Use aux roc framework (HS20) */
+                        ret = iwl_mvm_send_aux_roc_cmd(mvm, channel,
+                                                       vif, duration);
+                        goto out_unlock;
+                }
+                IWL_ERR(mvm, "hotspot not supported\n");
+                ret = -EINVAL;
                 goto out_unlock;
         case NL80211_IFTYPE_P2P_DEVICE:
                 /* handle below */
diff --git a/drivers/net/wireless/iwlwifi/mvm/scan.c b/drivers/net/wireless/iwlwifi/mvm/scan.c
index b280d5d87127..7554f7053830 100644
--- a/drivers/net/wireless/iwlwifi/mvm/scan.c
+++ b/drivers/net/wireless/iwlwifi/mvm/scan.c
@@ -602,16 +602,6 @@ static int iwl_mvm_cancel_regular_scan(struct iwl_mvm *mvm)
                                                SCAN_COMPLETE_NOTIFICATION };
         int ret;
 
-        if (mvm->scan_status == IWL_MVM_SCAN_NONE)
-                return 0;
-
-        if (iwl_mvm_is_radio_killed(mvm)) {
-                ieee80211_scan_completed(mvm->hw, true);
-                iwl_mvm_unref(mvm, IWL_MVM_REF_SCAN);
-                mvm->scan_status = IWL_MVM_SCAN_NONE;
-                return 0;
-        }
-
         iwl_init_notification_wait(&mvm->notif_wait, &wait_scan_abort,
                                    scan_abort_notif,
                                    ARRAY_SIZE(scan_abort_notif),
@@ -1400,6 +1390,16 @@ int iwl_mvm_unified_sched_scan_lmac(struct iwl_mvm *mvm,
 
 int iwl_mvm_cancel_scan(struct iwl_mvm *mvm)
 {
+        if (mvm->scan_status == IWL_MVM_SCAN_NONE)
+                return 0;
+
+        if (iwl_mvm_is_radio_killed(mvm)) {
+                ieee80211_scan_completed(mvm->hw, true);
+                iwl_mvm_unref(mvm, IWL_MVM_REF_SCAN);
+                mvm->scan_status = IWL_MVM_SCAN_NONE;
+                return 0;
+        }
+
         if (mvm->fw->ucode_capa.api[0] & IWL_UCODE_TLV_API_LMAC_SCAN)
                 return iwl_mvm_scan_offload_stop(mvm, true);
         return iwl_mvm_cancel_regular_scan(mvm);
diff --git a/drivers/net/wireless/iwlwifi/pcie/trans.c b/drivers/net/wireless/iwlwifi/pcie/trans.c
index 160c3ebc48d0..dd2f3f8baa9d 100644
--- a/drivers/net/wireless/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/iwlwifi/pcie/trans.c
@@ -1894,8 +1894,7 @@ static u32 iwl_trans_pcie_dump_prph(struct iwl_trans *trans,
                 int reg;
                 __le32 *val;
 
-                prph_len += sizeof(*data) + sizeof(*prph) +
-                        num_bytes_in_chunk;
+                prph_len += sizeof(**data) + sizeof(*prph) + num_bytes_in_chunk;
 
                 (*data)->type = cpu_to_le32(IWL_FW_ERROR_DUMP_PRPH);
                 (*data)->len = cpu_to_le32(sizeof(*prph) +
diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.c b/drivers/net/wireless/rt2x00/rt2x00queue.c
index 8e68f87ab13c..66ff36447b94 100644
--- a/drivers/net/wireless/rt2x00/rt2x00queue.c
+++ b/drivers/net/wireless/rt2x00/rt2x00queue.c
@@ -158,55 +158,29 @@ void rt2x00queue_align_frame(struct sk_buff *skb)
         skb_trim(skb, frame_length);
 }
 
-void rt2x00queue_insert_l2pad(struct sk_buff *skb, unsigned int header_length)
+/*
+ * H/W needs L2 padding between the header and the paylod if header size
+ * is not 4 bytes aligned.
+ */
+void rt2x00queue_insert_l2pad(struct sk_buff *skb, unsigned int hdr_len)
 {
-        unsigned int payload_length = skb->len - header_length;
-        unsigned int header_align = ALIGN_SIZE(skb, 0);
-        unsigned int payload_align = ALIGN_SIZE(skb, header_length);
-        unsigned int l2pad = payload_length ? L2PAD_SIZE(header_length) : 0;
+        unsigned int l2pad = (skb->len > hdr_len) ? L2PAD_SIZE(hdr_len) : 0;
 
-        /*
-         * Adjust the header alignment if the payload needs to be moved more
-         * than the header.
-         */
-        if (payload_align > header_align)
-                header_align += 4;
-
-        /* There is nothing to do if no alignment is needed */
-        if (!header_align)
+        if (!l2pad)
                 return;
 
-        /* Reserve the amount of space needed in front of the frame */
-        skb_push(skb, header_align);
-
-        /*
-         * Move the header.
-         */
-        memmove(skb->data, skb->data + header_align, header_length);
-
-        /* Move the payload, if present and if required */
-        if (payload_length && payload_align)
-                memmove(skb->data + header_length + l2pad,
-                        skb->data + header_length + l2pad + payload_align,
-                        payload_length);
-
-        /* Trim the skb to the correct size */
-        skb_trim(skb, header_length + l2pad + payload_length);
+        skb_push(skb, l2pad);
+        memmove(skb->data, skb->data + l2pad, hdr_len);
 }
 
-void rt2x00queue_remove_l2pad(struct sk_buff *skb, unsigned int header_length)
+void rt2x00queue_remove_l2pad(struct sk_buff *skb, unsigned int hdr_len)
 {
-        /*
-         * L2 padding is only present if the skb contains more than just the
-         * IEEE 802.11 header.
-         */
-        unsigned int l2pad = (skb->len > header_length) ?
-                                L2PAD_SIZE(header_length) : 0;
+        unsigned int l2pad = (skb->len > hdr_len) ? L2PAD_SIZE(hdr_len) : 0;
 
         if (!l2pad)
                 return;
 
-        memmove(skb->data + l2pad, skb->data, header_length);
+        memmove(skb->data + l2pad, skb->data, hdr_len);
         skb_pull(skb, l2pad);
 }
 
diff --git a/drivers/net/wireless/rtlwifi/pci.c b/drivers/net/wireless/rtlwifi/pci.c
index 25daa8715219..846a2e6e34d8 100644
--- a/drivers/net/wireless/rtlwifi/pci.c
+++ b/drivers/net/wireless/rtlwifi/pci.c
@@ -842,7 +842,8 @@ static void _rtl_pci_rx_interrupt(struct ieee80211_hw *hw)
                         break;
                 }
                 /* handle command packet here */
-                if (rtlpriv->cfg->ops->rx_command_packet(hw, stats, skb)) {
+                if (rtlpriv->cfg->ops->rx_command_packet &&
+                    rtlpriv->cfg->ops->rx_command_packet(hw, stats, skb)) {
                                 dev_kfree_skb_any(skb);
                                 goto end;
                 }
@@ -1127,9 +1128,14 @@ static void _rtl_pci_prepare_bcn_tasklet(struct ieee80211_hw *hw)
 
         __skb_queue_tail(&ring->queue, pskb);
 
-        rtlpriv->cfg->ops->set_desc(hw, (u8 *)pdesc, true, HW_DESC_OWN,
-                                    &temp_one);
-
+        if (rtlpriv->use_new_trx_flow) {
+                temp_one = 4;
+                rtlpriv->cfg->ops->set_desc(hw, (u8 *)pbuffer_desc, true,
+                                            HW_DESC_OWN, (u8 *)&temp_one);
+        } else {
+                rtlpriv->cfg->ops->set_desc(hw, (u8 *)pdesc, true, HW_DESC_OWN,
+                                            &temp_one);
+        }
         return;
 }
 
@@ -1370,9 +1376,9 @@ static void _rtl_pci_free_tx_ring(struct ieee80211_hw *hw,
         ring->desc = NULL;
         if (rtlpriv->use_new_trx_flow) {
                 pci_free_consistent(rtlpci->pdev,
-                                    sizeof(*ring->desc) * ring->entries,
+                                    sizeof(*ring->buffer_desc) * ring->entries,
                                     ring->buffer_desc, ring->buffer_desc_dma);
-                ring->desc = NULL;
+                ring->buffer_desc = NULL;
         }
 }
 
@@ -1543,7 +1549,6 @@ int rtl_pci_reset_trx_ring(struct ieee80211_hw *hw)
                                                          true,
                                                          HW_DESC_TXBUFF_ADDR),
                                                  skb->len, PCI_DMA_TODEVICE);
-                                ring->idx = (ring->idx + 1) % ring->entries;
                                 kfree_skb(skb);
                                 ring->idx = (ring->idx + 1) % ring->entries;
                         }
@@ -2244,6 +2249,16 @@ int rtl_pci_probe(struct pci_dev *pdev,
         /*like read eeprom and so on */
         rtlpriv->cfg->ops->read_eeprom_info(hw);
 
+        if (rtlpriv->cfg->ops->init_sw_vars(hw)) {
+                RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG, "Can't init_sw_vars\n");
+                err = -ENODEV;
+                goto fail3;
+        }
+        rtlpriv->cfg->ops->init_sw_leds(hw);
+
+        /*aspm */
+        rtl_pci_init_aspm(hw);
+
         /* Init mac80211 sw */
         err = rtl_init_core(hw);
         if (err) {
@@ -2259,16 +2274,6 @@ int rtl_pci_probe(struct pci_dev *pdev,
                 goto fail3;
         }
 
-        if (rtlpriv->cfg->ops->init_sw_vars(hw)) {
-                RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG, "Can't init_sw_vars\n");
-                err = -ENODEV;
-                goto fail3;
-        }
-        rtlpriv->cfg->ops->init_sw_leds(hw);
-
-        /*aspm */
-        rtl_pci_init_aspm(hw);
-
         err = ieee80211_register_hw(hw);
         if (err) {
                 RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/hw.c b/drivers/net/wireless/rtlwifi/rtl8192se/hw.c
index 00e067044c08..5761d5b49e39 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192se/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192se/hw.c
@@ -1201,6 +1201,9 @@ static int _rtl92se_set_media_status(struct ieee80211_hw *hw,
 
         }
 
+        if (type != NL80211_IFTYPE_AP &&
+            rtlpriv->mac80211.link_state < MAC80211_LINKED)
+                bt_msr = rtl_read_byte(rtlpriv, MSR) & ~MSR_LINK_MASK;
         rtl_write_byte(rtlpriv, (MSR), bt_msr);
 
         temp = rtl_read_dword(rtlpriv, TCR);
@@ -1262,6 +1265,7 @@ void rtl92se_enable_interrupt(struct ieee80211_hw *hw)
         rtl_write_dword(rtlpriv, INTA_MASK, rtlpci->irq_mask[0]);
         /* Support Bit 32-37(Assign as Bit 0-5) interrupt setting now */
         rtl_write_dword(rtlpriv, INTA_MASK + 4, rtlpci->irq_mask[1] & 0x3F);
+        rtlpci->irq_enabled = true;
 }
 
 void rtl92se_disable_interrupt(struct ieee80211_hw *hw)
@@ -1276,8 +1280,7 @@ void rtl92se_disable_interrupt(struct ieee80211_hw *hw)
         rtlpci = rtl_pcidev(rtl_pcipriv(hw));
         rtl_write_dword(rtlpriv, INTA_MASK, 0);
         rtl_write_dword(rtlpriv, INTA_MASK + 4, 0);
-
-        synchronize_irq(rtlpci->pdev->irq);
+        rtlpci->irq_enabled = false;
 }
 
 static u8 _rtl92s_set_sysclk(struct ieee80211_hw *hw, u8 data)
diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/phy.c b/drivers/net/wireless/rtlwifi/rtl8192se/phy.c
index 77c5b5f35244..4b4612fe2fdb 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192se/phy.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192se/phy.c
@@ -399,6 +399,8 @@ static bool _rtl92s_phy_sw_chnl_step_by_step(struct ieee80211_hw *hw,
                 case 2:
                         currentcmd = &postcommoncmd[*step];
                         break;
+                default:
+                        return true;
                 }
 
                 if (currentcmd->cmdid == CMDID_END) {
diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/sw.c b/drivers/net/wireless/rtlwifi/rtl8192se/sw.c
index aadba29c167a..fb003868bdef 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192se/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192se/sw.c
@@ -236,6 +236,19 @@ static void rtl92s_deinit_sw_vars(struct ieee80211_hw *hw)
         }
 }
 
+static bool rtl92se_is_tx_desc_closed(struct ieee80211_hw *hw, u8 hw_queue,
+                                      u16 index)
+{
+        struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
+        struct rtl8192_tx_ring *ring = &rtlpci->tx_ring[hw_queue];
+        u8 *entry = (u8 *)(&ring->desc[ring->idx]);
+        u8 own = (u8)rtl92se_get_desc(entry, true, HW_DESC_OWN);
+
+        if (own)
+                return false;
+        return true;
+}
+
 static struct rtl_hal_ops rtl8192se_hal_ops = {
         .init_sw_vars = rtl92s_init_sw_vars,
         .deinit_sw_vars = rtl92s_deinit_sw_vars,
@@ -269,6 +282,7 @@ static struct rtl_hal_ops rtl8192se_hal_ops = {
         .led_control = rtl92se_led_control,
         .set_desc = rtl92se_set_desc,
         .get_desc = rtl92se_get_desc,
+        .is_tx_desc_closed = rtl92se_is_tx_desc_closed,
         .tx_polling = rtl92se_tx_polling,
         .enable_hw_sec = rtl92se_enable_hw_security_config,
         .set_key = rtl92se_set_key,
@@ -306,6 +320,8 @@ static struct rtl_hal_cfg rtl92se_hal_cfg = {
         .maps[MAC_RCR_ACRC32] = RCR_ACRC32,
         .maps[MAC_RCR_ACF] = RCR_ACF,
         .maps[MAC_RCR_AAP] = RCR_AAP,
+        .maps[MAC_HIMR] = INTA_MASK,
+        .maps[MAC_HIMRE] = INTA_MASK + 4,
 
         .maps[EFUSE_TEST] = REG_EFUSE_TEST,
         .maps[EFUSE_CTRL] = REG_EFUSE_CTRL,
diff --git a/drivers/net/wireless/rtlwifi/rtl8821ae/hw.c b/drivers/net/wireless/rtlwifi/rtl8821ae/hw.c
index 310d3163dc5b..8ec8200002c7 100644
--- a/drivers/net/wireless/rtlwifi/rtl8821ae/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8821ae/hw.c
@@ -3672,8 +3672,9 @@ static void rtl8821ae_update_hal_rate_mask(struct ieee80211_hw *hw,
                 mac->opmode == NL80211_IFTYPE_ADHOC)
                 macid = sta->aid + 1;
         if (wirelessmode == WIRELESS_MODE_N_5G ||
-            wirelessmode == WIRELESS_MODE_AC_5G)
-                ratr_bitmap = sta->supp_rates[NL80211_BAND_5GHZ];
+            wirelessmode == WIRELESS_MODE_AC_5G ||
+            wirelessmode == WIRELESS_MODE_A)
+                ratr_bitmap = sta->supp_rates[NL80211_BAND_5GHZ] << 4;
         else
                 ratr_bitmap = sta->supp_rates[NL80211_BAND_2GHZ];
 
diff --git a/drivers/net/xen-netback/xenbus.c b/drivers/net/xen-netback/xenbus.c
index 4e56a27f9689..fab0d4b42f58 100644
--- a/drivers/net/xen-netback/xenbus.c
+++ b/drivers/net/xen-netback/xenbus.c
@@ -39,7 +39,7 @@ struct backend_info {
 static int connect_rings(struct backend_info *be, struct xenvif_queue *queue);
 static void connect(struct backend_info *be);
 static int read_xenbus_vif_flags(struct backend_info *be);
-static void backend_create_xenvif(struct backend_info *be);
+static int backend_create_xenvif(struct backend_info *be);
 static void unregister_hotplug_status_watch(struct backend_info *be);
 static void set_backend_state(struct backend_info *be,
                               enum xenbus_state state);
@@ -352,7 +352,9 @@ static int netback_probe(struct xenbus_device *dev,
         be->state = XenbusStateInitWait;
 
         /* This kicks hotplug scripts, so do it immediately. */
-        backend_create_xenvif(be);
+        err = backend_create_xenvif(be);
+        if (err)
+                goto fail;
 
         return 0;
 
@@ -397,19 +399,19 @@ static int netback_uevent(struct xenbus_device *xdev,
 }
 
 
-static void backend_create_xenvif(struct backend_info *be)
+static int backend_create_xenvif(struct backend_info *be)
 {
         int err;
         long handle;
         struct xenbus_device *dev = be->dev;
 
         if (be->vif != NULL)
-                return;
+                return 0;
 
         err = xenbus_scanf(XBT_NIL, dev->nodename, "handle", "%li", &handle);
         if (err != 1) {
                 xenbus_dev_fatal(dev, err, "reading handle");
-                return;
+                return (err < 0) ? err : -EINVAL;
         }
 
         be->vif = xenvif_alloc(&dev->dev, dev->otherend_id, handle);
@@ -417,10 +419,11 @@ static void backend_create_xenvif(struct backend_info *be)
                 err = PTR_ERR(be->vif);
                 be->vif = NULL;
                 xenbus_dev_fatal(dev, err, "creating interface");
-                return;
+                return err;
         }
 
         kobject_uevent(&dev->dev.kobj, KOBJ_ONLINE);
+        return 0;
 }
 
 static void backend_disconnect(struct backend_info *be)
diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
index cca871346a0f..ece8d1804d13 100644
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -496,9 +496,6 @@ static void xennet_make_frags(struct sk_buff *skb, struct netfront_queue *queue,
                 len = skb_frag_size(frag);
                 offset = frag->page_offset;
 
-                /* Data must not cross a page boundary. */
-                BUG_ON(len + offset > PAGE_SIZE<<compound_order(page));
-
                 /* Skip unused frames from start of page */
                 page += offset >> PAGE_SHIFT;
                 offset &= ~PAGE_MASK;
@@ -506,8 +503,6 @@ static void xennet_make_frags(struct sk_buff *skb, struct netfront_queue *queue,
                 while (len > 0) {
                         unsigned long bytes;
 
-                        BUG_ON(offset >= PAGE_SIZE);
-
                         bytes = PAGE_SIZE - offset;
                         if (bytes > len)
                                 bytes = len;