45 files changed, 339 insertions, 260 deletions

diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 8b4e96e01d6c..6bbd90e1123c 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1746,6 +1746,8 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
 
         bond_compute_features(bond);
 
+        bond_update_speed_duplex(new_slave);
+
         read_lock(&bond->lock);
 
         new_slave->last_arp_rx = jiffies -
@@ -1798,8 +1800,6 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
                 new_slave->link == BOND_LINK_DOWN ? "DOWN" :
                         (new_slave->link == BOND_LINK_UP ? "UP" : "BACK"));
 
-        bond_update_speed_duplex(new_slave);
-
         if (USES_PRIMARY(bond->params.mode) && bond->params.primary[0]) {
                 /* if there is a primary slave, remember it */
                 if (strcmp(bond->params.primary, new_slave->dev->name) == 0) {
@@ -2374,8 +2374,6 @@ static void bond_miimon_commit(struct bonding *bond)
                                 bond_set_backup_slave(slave);
                         }
 
-                        bond_update_speed_duplex(slave);
-
                         pr_info("%s: link status definitely up for interface %s, %u Mbps %s duplex.\n",
                                 bond->dev->name, slave->dev->name,
                                 slave->speed, slave->duplex ? "full" : "half");
diff --git a/drivers/net/bonding/bond_sysfs.c b/drivers/net/bonding/bond_sysfs.c
index 1c9e09fbdff8..db103e03ba05 100644
--- a/drivers/net/bonding/bond_sysfs.c
+++ b/drivers/net/bonding/bond_sysfs.c
@@ -183,6 +183,11 @@ int bond_create_slave_symlinks(struct net_device *master,
         sprintf(linkname, "slave_%s", slave->name);
         ret = sysfs_create_link(&(master->dev.kobj), &(slave->dev.kobj),
                                 linkname);
+
+        /* free the master link created earlier in case of error */
+        if (ret)
+                sysfs_remove_link(&(slave->dev.kobj), "master");
+
         return ret;
 
 }
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
index a923bc4d5a1f..4046f97378c2 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
@@ -2760,6 +2760,7 @@ load_error2:
         bp->port.pmf = 0;
 load_error1:
         bnx2x_napi_disable(bp);
+        bnx2x_del_all_napi(bp);
 
         /* clear pf_load status, as it was already set */
         if (IS_PF(bp))
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_dcb.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_dcb.c
index 568205436a15..91ecd6a00d05 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_dcb.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_dcb.c
@@ -2139,12 +2139,12 @@ static u8 bnx2x_dcbnl_get_cap(struct net_device *netdev, int capid, u8 *cap)
                         break;
                 default:
                         BNX2X_ERR("Non valid capability ID\n");
-                        rval = -EINVAL;
+                        rval = 1;
                         break;
                 }
         } else {
                 DP(BNX2X_MSG_DCB, "DCB disabled\n");
-                rval = -EINVAL;
+                rval = 1;
         }
 
         DP(BNX2X_MSG_DCB, "capid %d:%x\n", capid, *cap);
@@ -2170,12 +2170,12 @@ static int bnx2x_dcbnl_get_numtcs(struct net_device *netdev, int tcid, u8 *num)
                         break;
                 default:
                         BNX2X_ERR("Non valid TC-ID\n");
-                        rval = -EINVAL;
+                        rval = 1;
                         break;
                 }
         } else {
                 DP(BNX2X_MSG_DCB, "DCB disabled\n");
-                rval = -EINVAL;
+                rval = 1;
         }
 
         return rval;
@@ -2188,7 +2188,7 @@ static int bnx2x_dcbnl_set_numtcs(struct net_device *netdev, int tcid, u8 num)
         return -EINVAL;
 }
 
-static u8  bnx2x_dcbnl_get_pfc_state(struct net_device *netdev)
+static u8 bnx2x_dcbnl_get_pfc_state(struct net_device *netdev)
 {
         struct bnx2x *bp = netdev_priv(netdev);
         DP(BNX2X_MSG_DCB, "state = %d\n", bp->dcbx_local_feat.pfc.enabled);
@@ -2390,12 +2390,12 @@ static u8 bnx2x_dcbnl_get_featcfg(struct net_device *netdev, int featid,
                         break;
                 default:
                         BNX2X_ERR("Non valid featrue-ID\n");
-                        rval = -EINVAL;
+                        rval = 1;
                         break;
                 }
         } else {
                 DP(BNX2X_MSG_DCB, "DCB disabled\n");
-                rval = -EINVAL;
+                rval = 1;
         }
 
         return rval;
@@ -2431,12 +2431,12 @@ static u8 bnx2x_dcbnl_set_featcfg(struct net_device *netdev, int featid,
                         break;
                 default:
                         BNX2X_ERR("Non valid featrue-ID\n");
-                        rval = -EINVAL;
+                        rval = 1;
                         break;
                 }
         } else {
                 DP(BNX2X_MSG_DCB, "dcbnl call not valid\n");
-                rval = -EINVAL;
+                rval = 1;
         }
 
         return rval;
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.h
index 364e37ecbc5c..198f6f1c9ad5 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.h
@@ -459,8 +459,9 @@ struct bnx2x_fw_port_stats_old {
 
 #define UPDATE_QSTAT(s, t) \
         do { \
-                qstats->t##_hi = qstats_old->t##_hi + le32_to_cpu(s.hi); \
                 qstats->t##_lo = qstats_old->t##_lo + le32_to_cpu(s.lo); \
+                qstats->t##_hi = qstats_old->t##_hi + le32_to_cpu(s.hi) \
+                        + ((qstats->t##_lo < qstats_old->t##_lo) ? 1 : 0); \
         } while (0)
 
 #define UPDATE_QSTAT_OLD(f) \
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index 93729f942358..67d2663b3974 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -4130,6 +4130,14 @@ static void tg3_phy_copper_begin(struct tg3 *tp)
                 tp->link_config.active_speed = tp->link_config.speed;
                 tp->link_config.active_duplex = tp->link_config.duplex;
 
+                if (tg3_asic_rev(tp) == ASIC_REV_5714) {
+                        /* With autoneg disabled, 5715 only links up when the
+                         * advertisement register has the configured speed
+                         * enabled.
+                         */
+                        tg3_writephy(tp, MII_ADVERTISE, ADVERTISE_ALL);
+                }
+
                 bmcr = 0;
                 switch (tp->link_config.speed) {
                 default:
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
index 4ce62031f62f..8049268ce0f2 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
@@ -497,8 +497,9 @@ int t4_memory_write(struct adapter *adap, int mtype, u32 addr, u32 len,
 }
 
 #define EEPROM_STAT_ADDR   0x7bfc
-#define VPD_BASE           0
 #define VPD_LEN            512
+#define VPD_BASE           0x400
+#define VPD_BASE_OLD       0
 
 /**
  *      t4_seeprom_wp - enable/disable EEPROM write protection
@@ -524,7 +525,7 @@ int t4_seeprom_wp(struct adapter *adapter, bool enable)
 int get_vpd_params(struct adapter *adapter, struct vpd_params *p)
 {
         u32 cclk_param, cclk_val;
-        int i, ret;
+        int i, ret, addr;
         int ec, sn;
         u8 *vpd, csum;
         unsigned int vpdr_len, kw_offset, id_len;
@@ -533,7 +534,12 @@ int get_vpd_params(struct adapter *adapter, struct vpd_params *p)
         if (!vpd)
                 return -ENOMEM;
 
-        ret = pci_read_vpd(adapter->pdev, VPD_BASE, VPD_LEN, vpd);
+        ret = pci_read_vpd(adapter->pdev, VPD_BASE, sizeof(u32), vpd);
+        if (ret < 0)
+                goto out;
+        addr = *vpd == 0x82 ? VPD_BASE : VPD_BASE_OLD;
+
+        ret = pci_read_vpd(adapter->pdev, addr, VPD_LEN, vpd);
         if (ret < 0)
                 goto out;
 
diff --git a/drivers/net/ethernet/dec/tulip/Kconfig b/drivers/net/ethernet/dec/tulip/Kconfig
index 0c37fb2cc867..1df33c799c00 100644
--- a/drivers/net/ethernet/dec/tulip/Kconfig
+++ b/drivers/net/ethernet/dec/tulip/Kconfig
@@ -108,6 +108,7 @@ config TULIP_DM910X
 config DE4X5
         tristate "Generic DECchip & DIGITAL EtherWORKS PCI/EISA"
         depends on (PCI || EISA)
+        depends on VIRT_TO_BUS || ALPHA || PPC || SPARC
         select CRC32
         ---help---
           This is support for the DIGITAL series of PCI/EISA Ethernet cards.
diff --git a/drivers/net/ethernet/freescale/fec.c b/drivers/net/ethernet/freescale/fec.c
index 069a155d16ed..911d0253dbb2 100644
--- a/drivers/net/ethernet/freescale/fec.c
+++ b/drivers/net/ethernet/freescale/fec.c
@@ -934,24 +934,28 @@ static void fec_enet_adjust_link(struct net_device *ndev)
                 goto spin_unlock;
         }
 
-        /* Duplex link change */
         if (phy_dev->link) {
-                if (fep->full_duplex != phy_dev->duplex) {
-                        fec_restart(ndev, phy_dev->duplex);
-                        /* prevent unnecessary second fec_restart() below */
+                if (!fep->link) {
                         fep->link = phy_dev->link;
                         status_change = 1;
                 }
-        }
 
-        /* Link on or off change */
-        if (phy_dev->link != fep->link) {
-                fep->link = phy_dev->link;
-                if (phy_dev->link)
+                if (fep->full_duplex != phy_dev->duplex)
+                        status_change = 1;
+
+                if (phy_dev->speed != fep->speed) {
+                        fep->speed = phy_dev->speed;
+                        status_change = 1;
+                }
+
+                /* if any of the above changed restart the FEC */
+                if (status_change)
                         fec_restart(ndev, phy_dev->duplex);
-                else
+        } else {
+                if (fep->link) {
                         fec_stop(ndev);
-                status_change = 1;
+                        status_change = 1;
+                }
         }
 
 spin_unlock:
@@ -1328,7 +1332,7 @@ static int fec_enet_ioctl(struct net_device *ndev, struct ifreq *rq, int cmd)
 static void fec_enet_free_buffers(struct net_device *ndev)
 {
         struct fec_enet_private *fep = netdev_priv(ndev);
-        int i;
+        unsigned int i;
         struct sk_buff *skb;
         struct bufdesc  *bdp;
 
@@ -1352,7 +1356,7 @@ static void fec_enet_free_buffers(struct net_device *ndev)
 static int fec_enet_alloc_buffers(struct net_device *ndev)
 {
         struct fec_enet_private *fep = netdev_priv(ndev);
-        int i;
+        unsigned int i;
         struct sk_buff *skb;
         struct bufdesc  *bdp;
 
@@ -1437,6 +1441,7 @@ fec_enet_close(struct net_device *ndev)
         struct fec_enet_private *fep = netdev_priv(ndev);
 
         /* Don't know what to do yet. */
+        napi_disable(&fep->napi);
         fep->opened = 0;
         netif_stop_queue(ndev);
         fec_stop(ndev);
@@ -1593,7 +1598,7 @@ static int fec_enet_init(struct net_device *ndev)
         struct fec_enet_private *fep = netdev_priv(ndev);
         struct bufdesc *cbd_base;
         struct bufdesc *bdp;
-        int i;
+        unsigned int i;
 
         /* Allocate memory for buffer descriptors. */
         cbd_base = dma_alloc_coherent(NULL, PAGE_SIZE, &fep->bd_dma,
diff --git a/drivers/net/ethernet/freescale/fec.h b/drivers/net/ethernet/freescale/fec.h
index f5390071efd0..eb4372962839 100644
--- a/drivers/net/ethernet/freescale/fec.h
+++ b/drivers/net/ethernet/freescale/fec.h
@@ -240,6 +240,7 @@ struct fec_enet_private {
         phy_interface_t phy_interface;
         int     link;
         int     full_duplex;
+        int     speed;
         struct  completion mdio_done;
         int     irq[FEC_IRQ_NUM];
         int     bufdesc_ex;
diff --git a/drivers/net/ethernet/freescale/fec_ptp.c b/drivers/net/ethernet/freescale/fec_ptp.c
index 1f17ca0f2201..0d8df400a479 100644
--- a/drivers/net/ethernet/freescale/fec_ptp.c
+++ b/drivers/net/ethernet/freescale/fec_ptp.c
@@ -128,6 +128,7 @@ void fec_ptp_start_cyclecounter(struct net_device *ndev)
 
         spin_unlock_irqrestore(&fep->tmreg_lock, flags);
 }
+EXPORT_SYMBOL(fec_ptp_start_cyclecounter);
 
 /**
  * fec_ptp_adjfreq - adjust ptp cycle frequency
@@ -318,6 +319,7 @@ int fec_ptp_ioctl(struct net_device *ndev, struct ifreq *ifr, int cmd)
         return copy_to_user(ifr->ifr_data, &config, sizeof(config)) ?
             -EFAULT : 0;
 }
+EXPORT_SYMBOL(fec_ptp_ioctl);
 
 /**
  * fec_time_keep - call timecounter_read every second to avoid timer overrun
@@ -383,3 +385,4 @@ void fec_ptp_init(struct net_device *ndev, struct platform_device *pdev)
                 pr_info("registered PHC device on %s\n", ndev->name);
         }
 }
+EXPORT_SYMBOL(fec_ptp_init);
diff --git a/drivers/net/ethernet/intel/igb/e1000_82575.c b/drivers/net/ethernet/intel/igb/e1000_82575.c
index b64542acfa34..12b1d8480808 100644
--- a/drivers/net/ethernet/intel/igb/e1000_82575.c
+++ b/drivers/net/ethernet/intel/igb/e1000_82575.c
@@ -1818,27 +1818,32 @@ out:
  **/
 void igb_vmdq_set_anti_spoofing_pf(struct e1000_hw *hw, bool enable, int pf)
 {
-        u32 dtxswc;
+        u32 reg_val, reg_offset;
 
         switch (hw->mac.type) {
         case e1000_82576:
+                reg_offset = E1000_DTXSWC;
+                break;
         case e1000_i350:
-                dtxswc = rd32(E1000_DTXSWC);
-                if (enable) {
-                        dtxswc |= (E1000_DTXSWC_MAC_SPOOF_MASK |
-                                   E1000_DTXSWC_VLAN_SPOOF_MASK);
-                        /* The PF can spoof - it has to in order to
-                         * support emulation mode NICs */
-                        dtxswc ^= (1 << pf | 1 << (pf + MAX_NUM_VFS));
-                } else {
-                        dtxswc &= ~(E1000_DTXSWC_MAC_SPOOF_MASK |
-                                    E1000_DTXSWC_VLAN_SPOOF_MASK);
-                }
-                wr32(E1000_DTXSWC, dtxswc);
+                reg_offset = E1000_TXSWC;
                 break;
         default:
-                break;
+                return;
+        }
+
+        reg_val = rd32(reg_offset);
+        if (enable) {
+                reg_val |= (E1000_DTXSWC_MAC_SPOOF_MASK |
+                             E1000_DTXSWC_VLAN_SPOOF_MASK);
+                /* The PF can spoof - it has to in order to
+                 * support emulation mode NICs
+                 */
+                reg_val ^= (1 << pf | 1 << (pf + MAX_NUM_VFS));
+        } else {
+                reg_val &= ~(E1000_DTXSWC_MAC_SPOOF_MASK |
+                             E1000_DTXSWC_VLAN_SPOOF_MASK);
         }
+        wr32(reg_offset, reg_val);
 }
 
 /**
diff --git a/drivers/net/ethernet/intel/igb/igb_hwmon.c b/drivers/net/ethernet/intel/igb/igb_hwmon.c
index 4623502054d5..0478a1abe541 100644
--- a/drivers/net/ethernet/intel/igb/igb_hwmon.c
+++ b/drivers/net/ethernet/intel/igb/igb_hwmon.c
@@ -39,7 +39,7 @@
 #include <linux/pci.h>
 
 #ifdef CONFIG_IGB_HWMON
-struct i2c_board_info i350_sensor_info = {
+static struct i2c_board_info i350_sensor_info = {
         I2C_BOARD_INFO("i350bb", (0Xf8 >> 1)),
 };
 
diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
index 4dbd62968c7a..8496adfc6a68 100644
--- a/drivers/net/ethernet/intel/igb/igb_main.c
+++ b/drivers/net/ethernet/intel/igb/igb_main.c
@@ -2542,8 +2542,8 @@ static void igb_probe_vfs(struct igb_adapter *adapter)
         if ((hw->mac.type == e1000_i210) || (hw->mac.type == e1000_i211))
                 return;
 
-        igb_enable_sriov(pdev, max_vfs);
         pci_sriov_set_totalvfs(pdev, 7);
+        igb_enable_sriov(pdev, max_vfs);
 
 #endif /* CONFIG_PCI_IOV */
 }
@@ -2652,7 +2652,7 @@ static int igb_sw_init(struct igb_adapter *adapter)
                 if (max_vfs > 7) {
                         dev_warn(&pdev->dev,
                                  "Maximum of 7 VFs per PF, using max\n");
-                        adapter->vfs_allocated_count = 7;
+                        max_vfs = adapter->vfs_allocated_count = 7;
                 } else
                         adapter->vfs_allocated_count = max_vfs;
                 if (adapter->vfs_allocated_count)
diff --git a/drivers/net/ethernet/intel/igb/igb_ptp.c b/drivers/net/ethernet/intel/igb/igb_ptp.c
index 0987822359f0..0a237507ee85 100644
--- a/drivers/net/ethernet/intel/igb/igb_ptp.c
+++ b/drivers/net/ethernet/intel/igb/igb_ptp.c
@@ -740,7 +740,7 @@ void igb_ptp_init(struct igb_adapter *adapter)
         case e1000_82576:
                 snprintf(adapter->ptp_caps.name, 16, "%pm", netdev->dev_addr);
                 adapter->ptp_caps.owner = THIS_MODULE;
-                adapter->ptp_caps.max_adj = 1000000000;
+                adapter->ptp_caps.max_adj = 999999881;
                 adapter->ptp_caps.n_ext_ts = 0;
                 adapter->ptp_caps.pps = 0;
                 adapter->ptp_caps.adjfreq = igb_ptp_adjfreq_82576;
diff --git a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
index c3db6cd69b68..2b6cb5ca48ee 100644
--- a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
+++ b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
@@ -944,9 +944,17 @@ free_queue_irqs:
                 free_irq(adapter->msix_entries[vector].vector,
                          adapter->q_vector[vector]);
         }
-        pci_disable_msix(adapter->pdev);
-        kfree(adapter->msix_entries);
-        adapter->msix_entries = NULL;
+        /* This failure is non-recoverable - it indicates the system is
+         * out of MSIX vector resources and the VF driver cannot run
+         * without them.  Set the number of msix vectors to zero
+         * indicating that not enough can be allocated.  The error
+         * will be returned to the user indicating device open failed.
+         * Any further attempts to force the driver to open will also
+         * fail.  The only way to recover is to unload the driver and
+         * reload it again.  If the system has recovered some MSIX
+         * vectors then it may succeed.
+         */
+        adapter->num_msix_vectors = 0;
         return err;
 }
 
@@ -2572,6 +2580,15 @@ static int ixgbevf_open(struct net_device *netdev)
         struct ixgbe_hw *hw = &adapter->hw;
         int err;
 
+        /* A previous failure to open the device because of a lack of
+         * available MSIX vector resources may have reset the number
+         * of msix vectors variable to zero.  The only way to recover
+         * is to unload/reload the driver and hope that the system has
+         * been able to recover some MSIX vector resources.
+         */
+        if (!adapter->num_msix_vectors)
+                return -ENOMEM;
+
         /* disallow open during test */
         if (test_bit(__IXGBEVF_TESTING, &adapter->state))
                 return -EBUSY;
@@ -2628,7 +2645,6 @@ static int ixgbevf_open(struct net_device *netdev)
 
 err_req_irq:
         ixgbevf_down(adapter);
-        ixgbevf_free_irq(adapter);
 err_setup_rx:
         ixgbevf_free_all_rx_resources(adapter);
 err_setup_tx:
diff --git a/drivers/net/ethernet/lantiq_etop.c b/drivers/net/ethernet/lantiq_etop.c
index 6a2127489af7..bfdb06860397 100644
--- a/drivers/net/ethernet/lantiq_etop.c
+++ b/drivers/net/ethernet/lantiq_etop.c
@@ -769,7 +769,7 @@ ltq_etop_probe(struct platform_device *pdev)
         return 0;
 
 err_free:
-        kfree(dev);
+        free_netdev(dev);
 err_out:
         return err;
 }
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
index 995d4b6d5c1e..f278b10ef714 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
@@ -1637,6 +1637,17 @@ void mlx4_en_stop_port(struct net_device *dev, int detach)
         /* Flush multicast filter */
         mlx4_SET_MCAST_FLTR(mdev->dev, priv->port, 0, 1, MLX4_MCAST_CONFIG);
 
+        /* Remove flow steering rules for the port*/
+        if (mdev->dev->caps.steering_mode ==
+            MLX4_STEERING_MODE_DEVICE_MANAGED) {
+                ASSERT_RTNL();
+                list_for_each_entry_safe(flow, tmp_flow,
+                                         &priv->ethtool_list, list) {
+                        mlx4_flow_detach(mdev->dev, flow->id);
+                        list_del(&flow->list);
+                }
+        }
+
         mlx4_en_destroy_drop_qp(priv);
 
         /* Free TX Rings */
@@ -1657,17 +1668,6 @@ void mlx4_en_stop_port(struct net_device *dev, int detach)
         if (!(mdev->dev->caps.flags2 & MLX4_DEV_CAP_FLAGS2_REASSIGN_MAC_EN))
                 mdev->mac_removed[priv->port] = 1;
 
-        /* Remove flow steering rules for the port*/
-        if (mdev->dev->caps.steering_mode ==
-            MLX4_STEERING_MODE_DEVICE_MANAGED) {
-                ASSERT_RTNL();
-                list_for_each_entry_safe(flow, tmp_flow,
-                                         &priv->ethtool_list, list) {
-                        mlx4_flow_detach(mdev->dev, flow->id);
-                        list_del(&flow->list);
-                }
-        }
-
         /* Free RX Rings */
         for (i = 0; i < priv->rx_ring_num; i++) {
                 mlx4_en_deactivate_rx_ring(priv, &priv->rx_ring[i]);
diff --git a/drivers/net/ethernet/mellanox/mlx4/eq.c b/drivers/net/ethernet/mellanox/mlx4/eq.c
index 251ae2f93116..8e3123a1df88 100644
--- a/drivers/net/ethernet/mellanox/mlx4/eq.c
+++ b/drivers/net/ethernet/mellanox/mlx4/eq.c
@@ -771,7 +771,7 @@ int mlx4_MAP_EQ_wrapper(struct mlx4_dev *dev, int slave,
         struct mlx4_slave_event_eq_info *event_eq =
                 priv->mfunc.master.slave_state[slave].event_eq;
         u32 in_modifier = vhcr->in_modifier;
-        u32 eqn = in_modifier & 0x1FF;
+        u32 eqn = in_modifier & 0x3FF;
         u64 in_param =  vhcr->in_param;
         int err = 0;
         int i;
diff --git a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
index 2995687f1aee..1391b52f443a 100644
--- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
+++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
@@ -99,6 +99,7 @@ struct res_qp {
         struct list_head        mcg_list;
         spinlock_t              mcg_spl;
         int                     local_qpn;
+        atomic_t                ref_count;
 };
 
 enum res_mtt_states {
@@ -197,6 +198,7 @@ enum res_fs_rule_states {
 
 struct res_fs_rule {
         struct res_common       com;
+        int                     qpn;
 };
 
 static void *res_tracker_lookup(struct rb_root *root, u64 res_id)
@@ -355,7 +357,7 @@ static int mpt_mask(struct mlx4_dev *dev)
         return dev->caps.num_mpts - 1;
 }
 
-static void *find_res(struct mlx4_dev *dev, int res_id,
+static void *find_res(struct mlx4_dev *dev, u64 res_id,
                       enum mlx4_resource type)
 {
         struct mlx4_priv *priv = mlx4_priv(dev);
@@ -447,6 +449,7 @@ static struct res_common *alloc_qp_tr(int id)
         ret->local_qpn = id;
         INIT_LIST_HEAD(&ret->mcg_list);
         spin_lock_init(&ret->mcg_spl);
+        atomic_set(&ret->ref_count, 0);
 
         return &ret->com;
 }
@@ -554,7 +557,7 @@ static struct res_common *alloc_xrcdn_tr(int id)
         return &ret->com;
 }
 
-static struct res_common *alloc_fs_rule_tr(u64 id)
+static struct res_common *alloc_fs_rule_tr(u64 id, int qpn)
 {
         struct res_fs_rule *ret;
 
@@ -564,7 +567,7 @@ static struct res_common *alloc_fs_rule_tr(u64 id)
 
         ret->com.res_id = id;
         ret->com.state = RES_FS_RULE_ALLOCATED;
-
+        ret->qpn = qpn;
         return &ret->com;
 }
 
@@ -602,7 +605,7 @@ static struct res_common *alloc_tr(u64 id, enum mlx4_resource type, int slave,
                 ret = alloc_xrcdn_tr(id);
                 break;
         case RES_FS_RULE:
-                ret = alloc_fs_rule_tr(id);
+                ret = alloc_fs_rule_tr(id, extra);
                 break;
         default:
                 return NULL;
@@ -671,10 +674,14 @@ undo:
 
 static int remove_qp_ok(struct res_qp *res)
 {
-        if (res->com.state == RES_QP_BUSY)
+        if (res->com.state == RES_QP_BUSY || atomic_read(&res->ref_count) ||
+            !list_empty(&res->mcg_list)) {
+                pr_err("resource tracker: fail to remove qp, state %d, ref_count %d\n",
+                       res->com.state, atomic_read(&res->ref_count));
                 return -EBUSY;
-        else if (res->com.state != RES_QP_RESERVED)
+        } else if (res->com.state != RES_QP_RESERVED) {
                 return -EPERM;
+        }
 
         return 0;
 }
@@ -3124,6 +3131,7 @@ int mlx4_QP_FLOW_STEERING_ATTACH_wrapper(struct mlx4_dev *dev, int slave,
         struct list_head *rlist = &tracker->slave_list[slave].res_list[RES_MAC];
         int err;
         int qpn;
+        struct res_qp *rqp;
         struct mlx4_net_trans_rule_hw_ctrl *ctrl;
         struct _rule_hw  *rule_header;
         int header_id;
@@ -3134,7 +3142,7 @@ int mlx4_QP_FLOW_STEERING_ATTACH_wrapper(struct mlx4_dev *dev, int slave,
 
         ctrl = (struct mlx4_net_trans_rule_hw_ctrl *)inbox->buf;
         qpn = be32_to_cpu(ctrl->qpn) & 0xffffff;
-        err = get_res(dev, slave, qpn, RES_QP, NULL);
+        err = get_res(dev, slave, qpn, RES_QP, &rqp);
         if (err) {
                 pr_err("Steering rule with qpn 0x%x rejected.\n", qpn);
                 return err;
@@ -3175,14 +3183,16 @@ int mlx4_QP_FLOW_STEERING_ATTACH_wrapper(struct mlx4_dev *dev, int slave,
         if (err)
                 goto err_put;
 
-        err = add_res_range(dev, slave, vhcr->out_param, 1, RES_FS_RULE, 0);
+        err = add_res_range(dev, slave, vhcr->out_param, 1, RES_FS_RULE, qpn);
         if (err) {
                 mlx4_err(dev, "Fail to add flow steering resources.\n ");
                 /* detach rule*/
                 mlx4_cmd(dev, vhcr->out_param, 0, 0,
                          MLX4_QP_FLOW_STEERING_DETACH, MLX4_CMD_TIME_CLASS_A,
                          MLX4_CMD_NATIVE);
+                goto err_put;
         }
+        atomic_inc(&rqp->ref_count);
 err_put:
         put_res(dev, slave, qpn, RES_QP);
         return err;
@@ -3195,20 +3205,35 @@ int mlx4_QP_FLOW_STEERING_DETACH_wrapper(struct mlx4_dev *dev, int slave,
                                          struct mlx4_cmd_info *cmd)
 {
         int err;
+        struct res_qp *rqp;
+        struct res_fs_rule *rrule;
 
         if (dev->caps.steering_mode !=
             MLX4_STEERING_MODE_DEVICE_MANAGED)
                 return -EOPNOTSUPP;
 
+        err = get_res(dev, slave, vhcr->in_param, RES_FS_RULE, &rrule);
+        if (err)
+                return err;
+        /* Release the rule form busy state before removal */
+        put_res(dev, slave, vhcr->in_param, RES_FS_RULE);
+        err = get_res(dev, slave, rrule->qpn, RES_QP, &rqp);
+        if (err)
+                return err;
+
         err = rem_res_range(dev, slave, vhcr->in_param, 1, RES_FS_RULE, 0);
         if (err) {
                 mlx4_err(dev, "Fail to remove flow steering resources.\n ");
-                return err;
+                goto out;
         }
 
         err = mlx4_cmd(dev, vhcr->in_param, 0, 0,
                        MLX4_QP_FLOW_STEERING_DETACH, MLX4_CMD_TIME_CLASS_A,
                        MLX4_CMD_NATIVE);
+        if (!err)
+                atomic_dec(&rqp->ref_count);
+out:
+        put_res(dev, slave, rrule->qpn, RES_QP);
         return err;
 }
 
@@ -3806,6 +3831,7 @@ void mlx4_delete_all_resources_for_slave(struct mlx4_dev *dev, int slave)
         mutex_lock(&priv->mfunc.master.res_tracker.slave_list[slave].mutex);
         /*VLAN*/
         rem_slave_macs(dev, slave);
+        rem_slave_fs_rule(dev, slave);
         rem_slave_qps(dev, slave);
         rem_slave_srqs(dev, slave);
         rem_slave_cqs(dev, slave);
@@ -3814,6 +3840,5 @@ void mlx4_delete_all_resources_for_slave(struct mlx4_dev *dev, int slave)
         rem_slave_mtts(dev, slave);
         rem_slave_counters(dev, slave);
         rem_slave_xrcdns(dev, slave);
-        rem_slave_fs_rule(dev, slave);
         mutex_unlock(&priv->mfunc.master.res_tracker.slave_list[slave].mutex);
 }
diff --git a/drivers/net/ethernet/nxp/lpc_eth.c b/drivers/net/ethernet/nxp/lpc_eth.c
index c4122c86f829..efa29b712d5f 100644
--- a/drivers/net/ethernet/nxp/lpc_eth.c
+++ b/drivers/net/ethernet/nxp/lpc_eth.c
@@ -1472,7 +1472,8 @@ static int lpc_eth_drv_probe(struct platform_device *pdev)
         }
         platform_set_drvdata(pdev, ndev);
 
-        if (lpc_mii_init(pldat) != 0)
+        ret = lpc_mii_init(pldat);
+        if (ret)
                 goto err_out_unregister_netdev;
 
         netdev_info(ndev, "LPC mac at 0x%08x irq %d\n",
diff --git a/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c b/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c
index 39ab4d09faaa..73ce7dd6b954 100644
--- a/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c
+++ b/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c
@@ -1726,9 +1726,9 @@ pch_gbe_clean_rx(struct pch_gbe_adapter *adapter,
 
                         skb->protocol = eth_type_trans(skb, netdev);
                         if (tcp_ip_status & PCH_GBE_RXD_ACC_STAT_TCPIPOK)
-                                skb->ip_summed = CHECKSUM_NONE;
-                        else
                                 skb->ip_summed = CHECKSUM_UNNECESSARY;
+                        else
+                                skb->ip_summed = CHECKSUM_NONE;
 
                         napi_gro_receive(&adapter->napi, skb);
                         (*work_done)++;
diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
index 33e96176e4d8..bf5e3cf97c4d 100644
--- a/drivers/net/ethernet/renesas/sh_eth.c
+++ b/drivers/net/ethernet/renesas/sh_eth.c
@@ -2220,6 +2220,7 @@ static void sh_eth_tsu_init(struct sh_eth_private *mdp)
 /* MDIO bus release function */
 static int sh_mdio_release(struct net_device *ndev)
 {
+        struct sh_eth_private *mdp = netdev_priv(ndev);
         struct mii_bus *bus = dev_get_drvdata(&ndev->dev);
 
         /* unregister mdio bus */
@@ -2234,6 +2235,9 @@ static int sh_mdio_release(struct net_device *ndev)
         /* free bitbang info */
         free_mdio_bitbang(bus);
 
+        /* free bitbang memory */
+        kfree(mdp->bitbang);
+
         return 0;
 }
 
@@ -2262,6 +2266,7 @@ static int sh_mdio_init(struct net_device *ndev, int id,
         bitbang->ctrl.ops = &bb_ops;
 
         /* MII controller setting */
+        mdp->bitbang = bitbang;
         mdp->mii_bus = alloc_mdio_bitbang(&bitbang->ctrl);
         if (!mdp->mii_bus) {
                 ret = -ENOMEM;
@@ -2441,6 +2446,11 @@ static int sh_eth_drv_probe(struct platform_device *pdev)
                 }
                 mdp->tsu_addr = ioremap(rtsu->start,
                                         resource_size(rtsu));
+                if (mdp->tsu_addr == NULL) {
+                        ret = -ENOMEM;
+                        dev_err(&pdev->dev, "TSU ioremap failed.\n");
+                        goto out_release;
+                }
                 mdp->port = devno % 2;
                 ndev->features = NETIF_F_HW_VLAN_FILTER;
         }
diff --git a/drivers/net/ethernet/renesas/sh_eth.h b/drivers/net/ethernet/renesas/sh_eth.h
index bae84fd2e73a..e6655678458e 100644
--- a/drivers/net/ethernet/renesas/sh_eth.h
+++ b/drivers/net/ethernet/renesas/sh_eth.h
@@ -705,6 +705,7 @@ struct sh_eth_private {
         const u16 *reg_offset;
         void __iomem *addr;
         void __iomem *tsu_addr;
+        struct bb_info *bitbang;
         u32 num_rx_ring;
         u32 num_tx_ring;
         dma_addr_t rx_desc_dma;
diff --git a/drivers/net/ethernet/sfc/nic.c b/drivers/net/ethernet/sfc/nic.c
index 0ad790cc473c..eaa8e874a3cb 100644
--- a/drivers/net/ethernet/sfc/nic.c
+++ b/drivers/net/ethernet/sfc/nic.c
@@ -376,7 +376,8 @@ efx_may_push_tx_desc(struct efx_tx_queue *tx_queue, unsigned int write_count)
                 return false;
 
         tx_queue->empty_read_count = 0;
-        return ((empty_read_count ^ write_count) & ~EFX_EMPTY_COUNT_VALID) == 0;
+        return ((empty_read_count ^ write_count) & ~EFX_EMPTY_COUNT_VALID) == 0
+                && tx_queue->write_count - write_count == 1;
 }
 
 /* For each entry inserted into the software descriptor ring, create a
diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
index 01ffbc486982..df32a090d08e 100644
--- a/drivers/net/ethernet/ti/cpsw.c
+++ b/drivers/net/ethernet/ti/cpsw.c
@@ -905,7 +905,7 @@ static netdev_tx_t cpsw_ndo_start_xmit(struct sk_buff *skb,
         /* If there is no more tx desc left free then we need to
          * tell the kernel to stop sending us tx frames.
          */
-        if (unlikely(cpdma_check_free_tx_desc(priv->txch)))
+        if (unlikely(!cpdma_check_free_tx_desc(priv->txch)))
                 netif_stop_queue(ndev);
 
         return NETDEV_TX_OK;
@@ -1364,7 +1364,7 @@ static int cpsw_probe_dt(struct cpsw_platform_data *data,
                 struct platform_device *mdio;
 
                 parp = of_get_property(slave_node, "phy_id", &lenp);
-                if ((parp == NULL) && (lenp != (sizeof(void *) * 2))) {
+                if ((parp == NULL) || (lenp != (sizeof(void *) * 2))) {
                         pr_err("Missing slave[%d] phy_id property\n", i);
                         ret = -EINVAL;
                         goto error_ret;
diff --git a/drivers/net/ethernet/ti/davinci_emac.c b/drivers/net/ethernet/ti/davinci_emac.c
index 52c05366599a..ae1b77aa199f 100644
--- a/drivers/net/ethernet/ti/davinci_emac.c
+++ b/drivers/net/ethernet/ti/davinci_emac.c
@@ -1102,7 +1102,7 @@ static int emac_dev_xmit(struct sk_buff *skb, struct net_device *ndev)
         /* If there is no more tx desc left free then we need to
          * tell the kernel to stop sending us tx frames.
          */
-        if (unlikely(cpdma_check_free_tx_desc(priv->txchan)))
+        if (unlikely(!cpdma_check_free_tx_desc(priv->txchan)))
                 netif_stop_queue(ndev);
 
         return NETDEV_TX_OK;
diff --git a/drivers/net/netconsole.c b/drivers/net/netconsole.c
index 37add21a3d7d..59ac143dec25 100644
--- a/drivers/net/netconsole.c
+++ b/drivers/net/netconsole.c
@@ -666,6 +666,7 @@ static int netconsole_netdev_event(struct notifier_block *this,
                 goto done;
 
         spin_lock_irqsave(&target_list_lock, flags);
+restart:
         list_for_each_entry(nt, &target_list, list) {
                 netconsole_target_get(nt);
                 if (nt->np.dev == dev) {
@@ -678,15 +679,17 @@ static int netconsole_netdev_event(struct notifier_block *this,
                         case NETDEV_UNREGISTER:
                                 /*
                                  * rtnl_lock already held
+                                 * we might sleep in __netpoll_cleanup()
                                  */
-                                if (nt->np.dev) {
-                                        __netpoll_cleanup(&nt->np);
-                                        dev_put(nt->np.dev);
-                                        nt->np.dev = NULL;
-                                }
+                                spin_unlock_irqrestore(&target_list_lock, flags);
+                                __netpoll_cleanup(&nt->np);
+                                spin_lock_irqsave(&target_list_lock, flags);
+                                dev_put(nt->np.dev);
+                                nt->np.dev = NULL;
                                 nt->enabled = 0;
                                 stopped = true;
-                                break;
+                                netconsole_target_put(nt);
+                                goto restart;
                         }
                 }
                 netconsole_target_put(nt);
diff --git a/drivers/net/usb/Kconfig b/drivers/net/usb/Kconfig
index 3b6e9b83342d..7c769d8e25ad 100644
--- a/drivers/net/usb/Kconfig
+++ b/drivers/net/usb/Kconfig
@@ -268,7 +268,7 @@ config USB_NET_SMSC75XX
         select CRC16
         select CRC32
         help
-          This option adds support for SMSC LAN95XX based USB 2.0
+          This option adds support for SMSC LAN75XX based USB 2.0
           Gigabit Ethernet adapters.
 
 config USB_NET_SMSC95XX
diff --git a/drivers/net/usb/cdc_mbim.c b/drivers/net/usb/cdc_mbim.c
index 248d2dc765a5..16c842997291 100644
--- a/drivers/net/usb/cdc_mbim.c
+++ b/drivers/net/usb/cdc_mbim.c
@@ -68,18 +68,9 @@ static int cdc_mbim_bind(struct usbnet *dev, struct usb_interface *intf)
         struct cdc_ncm_ctx *ctx;
         struct usb_driver *subdriver = ERR_PTR(-ENODEV);
         int ret = -ENODEV;
-        u8 data_altsetting = CDC_NCM_DATA_ALTSETTING_NCM;
+        u8 data_altsetting = cdc_ncm_select_altsetting(dev, intf);
         struct cdc_mbim_state *info = (void *)&dev->data;
 
-        /* see if interface supports MBIM alternate setting */
-        if (intf->num_altsetting == 2) {
-                if (!cdc_ncm_comm_intf_is_mbim(intf->cur_altsetting))
-                        usb_set_interface(dev->udev,
-                                          intf->cur_altsetting->desc.bInterfaceNumber,
-                                          CDC_NCM_COMM_ALTSETTING_MBIM);
-                data_altsetting = CDC_NCM_DATA_ALTSETTING_MBIM;
-        }
-
         /* Probably NCM, defer for cdc_ncm_bind */
         if (!cdc_ncm_comm_intf_is_mbim(intf->cur_altsetting))
                 goto err;
diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
index 61b74a2b89ac..4709fa3497cf 100644
--- a/drivers/net/usb/cdc_ncm.c
+++ b/drivers/net/usb/cdc_ncm.c
@@ -55,6 +55,14 @@
 
 #define DRIVER_VERSION                          "14-Mar-2012"
 
+#if IS_ENABLED(CONFIG_USB_NET_CDC_MBIM)
+static bool prefer_mbim = true;
+#else
+static bool prefer_mbim;
+#endif
+module_param(prefer_mbim, bool, S_IRUGO | S_IWUSR);
+MODULE_PARM_DESC(prefer_mbim, "Prefer MBIM setting on dual NCM/MBIM functions");
+
 static void cdc_ncm_txpath_bh(unsigned long param);
 static void cdc_ncm_tx_timeout_start(struct cdc_ncm_ctx *ctx);
 static enum hrtimer_restart cdc_ncm_tx_timer_cb(struct hrtimer *hr_timer);
@@ -550,9 +558,12 @@ void cdc_ncm_unbind(struct usbnet *dev, struct usb_interface *intf)
 }
 EXPORT_SYMBOL_GPL(cdc_ncm_unbind);
 
-static int cdc_ncm_bind(struct usbnet *dev, struct usb_interface *intf)
+/* Select the MBIM altsetting iff it is preferred and available,
+ * returning the number of the corresponding data interface altsetting
+ */
+u8 cdc_ncm_select_altsetting(struct usbnet *dev, struct usb_interface *intf)
 {
-        int ret;
+        struct usb_host_interface *alt;
 
         /* The MBIM spec defines a NCM compatible default altsetting,
          * which we may have matched:
@@ -568,23 +579,27 @@ static int cdc_ncm_bind(struct usbnet *dev, struct usb_interface *intf)
          *   endpoint descriptors, shall be constructed according to
          *   the rules given in section 6 (USB Device Model) of this
          *   specification."
-         *
-         * Do not bind to such interfaces, allowing cdc_mbim to handle
-         * them
          */
-#if IS_ENABLED(CONFIG_USB_NET_CDC_MBIM)
-        if ((intf->num_altsetting == 2) &&
-            !usb_set_interface(dev->udev,
-                               intf->cur_altsetting->desc.bInterfaceNumber,
-                               CDC_NCM_COMM_ALTSETTING_MBIM)) {
-                if (cdc_ncm_comm_intf_is_mbim(intf->cur_altsetting))
-                        return -ENODEV;
-                else
-                        usb_set_interface(dev->udev,
-                                          intf->cur_altsetting->desc.bInterfaceNumber,
-                                          CDC_NCM_COMM_ALTSETTING_NCM);
+        if (prefer_mbim && intf->num_altsetting == 2) {
+                alt = usb_altnum_to_altsetting(intf, CDC_NCM_COMM_ALTSETTING_MBIM);
+                if (alt && cdc_ncm_comm_intf_is_mbim(alt) &&
+                    !usb_set_interface(dev->udev,
+                                       intf->cur_altsetting->desc.bInterfaceNumber,
+                                       CDC_NCM_COMM_ALTSETTING_MBIM))
+                        return CDC_NCM_DATA_ALTSETTING_MBIM;
         }
-#endif
+        return CDC_NCM_DATA_ALTSETTING_NCM;
+}
+EXPORT_SYMBOL_GPL(cdc_ncm_select_altsetting);
+
+static int cdc_ncm_bind(struct usbnet *dev, struct usb_interface *intf)
+{
+        int ret;
+
+        /* MBIM backwards compatible function? */
+        cdc_ncm_select_altsetting(dev, intf);
+        if (cdc_ncm_comm_intf_is_mbim(intf->cur_altsetting))
+                return -ENODEV;
 
         /* NCM data altsetting is always 1 */
         ret = cdc_ncm_bind_common(dev, intf, 1);
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index efb5c7c33a28..968d5d50751d 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -139,16 +139,9 @@ static int qmi_wwan_bind(struct usbnet *dev, struct usb_interface *intf)
 
         BUILD_BUG_ON((sizeof(((struct usbnet *)0)->data) < sizeof(struct qmi_wwan_state)));
 
-        /* control and data is shared? */
-        if (intf->cur_altsetting->desc.bNumEndpoints == 3) {
-                info->control = intf;
-                info->data = intf;
-                goto shared;
-        }
-
-        /* else require a single interrupt status endpoint on control intf */
-        if (intf->cur_altsetting->desc.bNumEndpoints != 1)
-                goto err;
+        /* set up initial state */
+        info->control = intf;
+        info->data = intf;
 
         /* and a number of CDC descriptors */
         while (len > 3) {
@@ -207,25 +200,14 @@ next_desc:
                 buf += h->bLength;
         }
 
-        /* did we find all the required ones? */
-        if (!(found & (1 << USB_CDC_HEADER_TYPE)) ||
-            !(found & (1 << USB_CDC_UNION_TYPE))) {
-                dev_err(&intf->dev, "CDC functional descriptors missing\n");
-                goto err;
-        }
-
-        /* verify CDC Union */
-        if (desc->bInterfaceNumber != cdc_union->bMasterInterface0) {
-                dev_err(&intf->dev, "bogus CDC Union: master=%u\n", cdc_union->bMasterInterface0);
-                goto err;
-        }
-
-        /* need to save these for unbind */
-        info->control = intf;
-        info->data = usb_ifnum_to_if(dev->udev, cdc_union->bSlaveInterface0);
-        if (!info->data) {
-                dev_err(&intf->dev, "bogus CDC Union: slave=%u\n", cdc_union->bSlaveInterface0);
-                goto err;
+        /* Use separate control and data interfaces if we found a CDC Union */
+        if (cdc_union) {
+                info->data = usb_ifnum_to_if(dev->udev, cdc_union->bSlaveInterface0);
+                if (desc->bInterfaceNumber != cdc_union->bMasterInterface0 || !info->data) {
+                        dev_err(&intf->dev, "bogus CDC Union: master=%u, slave=%u\n",
+                                cdc_union->bMasterInterface0, cdc_union->bSlaveInterface0);
+                        goto err;
+                }
         }
 
         /* errors aren't fatal - we can live with the dynamic address */
@@ -235,11 +217,12 @@ next_desc:
         }
 
         /* claim data interface and set it up */
-        status = usb_driver_claim_interface(driver, info->data, dev);
-        if (status < 0)
-                goto err;
+        if (info->control != info->data) {
+                status = usb_driver_claim_interface(driver, info->data, dev);
+                if (status < 0)
+                        goto err;
+        }
 
-shared:
         status = qmi_wwan_register_subdriver(dev);
         if (status < 0 && info->control != info->data) {
                 usb_set_intfdata(info->data, NULL);
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_calib.c b/drivers/net/wireless/ath/ath9k/ar9003_calib.c
index 4cc13940c895..f76c3ca07a45 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_calib.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_calib.c
@@ -1023,6 +1023,7 @@ static bool ar9003_hw_init_cal(struct ath_hw *ah,
                                           AR_PHY_AGC_CONTROL_FLTR_CAL   |
                                           AR_PHY_AGC_CONTROL_PKDET_CAL;
 
+        /* Use chip chainmask only for calibration */
         ar9003_hw_set_chain_masks(ah, ah->caps.rx_chainmask, ah->caps.tx_chainmask);
 
         if (rtt) {
@@ -1150,6 +1151,9 @@ skip_tx_iqcal:
                 ar9003_hw_rtt_disable(ah);
         }
 
+        /* Revert chainmask to runtime parameters */
+        ar9003_hw_set_chain_masks(ah, ah->rxchainmask, ah->txchainmask);
+
         /* Initialize list pointers */
         ah->cal_list = ah->cal_list_last = ah->cal_list_curr = NULL;
 
diff --git a/drivers/net/wireless/ath/ath9k/link.c b/drivers/net/wireless/ath/ath9k/link.c
index ade3afb21f91..39c84ecf6a42 100644
--- a/drivers/net/wireless/ath/ath9k/link.c
+++ b/drivers/net/wireless/ath/ath9k/link.c
@@ -28,21 +28,21 @@ void ath_tx_complete_poll_work(struct work_struct *work)
         int i;
         bool needreset = false;
 
-        for (i = 0; i < ATH9K_NUM_TX_QUEUES; i++)
-                if (ATH_TXQ_SETUP(sc, i)) {
-                        txq = &sc->tx.txq[i];
-                        ath_txq_lock(sc, txq);
-                        if (txq->axq_depth) {
-                                if (txq->axq_tx_inprogress) {
-                                        needreset = true;
-                                        ath_txq_unlock(sc, txq);
-                                        break;
-                                } else {
-                                        txq->axq_tx_inprogress = true;
-                                }
+        for (i = 0; i < IEEE80211_NUM_ACS; i++) {
+                txq = sc->tx.txq_map[i];
+
+                ath_txq_lock(sc, txq);
+                if (txq->axq_depth) {
+                        if (txq->axq_tx_inprogress) {
+                                needreset = true;
+                                ath_txq_unlock(sc, txq);
+                                break;
+                        } else {
+                                txq->axq_tx_inprogress = true;
                         }
-                        ath_txq_unlock_complete(sc, txq);
                 }
+                ath_txq_unlock_complete(sc, txq);
+        }
 
         if (needreset) {
                 ath_dbg(ath9k_hw_common(sc->sc_ah), RESET,
diff --git a/drivers/net/wireless/iwlegacy/3945-mac.c b/drivers/net/wireless/iwlegacy/3945-mac.c
index 3630a41df50d..c353b5f19c8c 100644
--- a/drivers/net/wireless/iwlegacy/3945-mac.c
+++ b/drivers/net/wireless/iwlegacy/3945-mac.c
@@ -475,6 +475,7 @@ il3945_tx_skb(struct il_priv *il,
         dma_addr_t txcmd_phys;
         int txq_id = skb_get_queue_mapping(skb);
         u16 len, idx, hdr_len;
+        u16 firstlen, secondlen;
         u8 id;
         u8 unicast;
         u8 sta_id;
@@ -589,21 +590,22 @@ il3945_tx_skb(struct il_priv *il,
         len =
             sizeof(struct il3945_tx_cmd) + sizeof(struct il_cmd_header) +
             hdr_len;
-        len = (len + 3) & ~3;
+        firstlen = (len + 3) & ~3;
 
         /* Physical address of this Tx command's header (not MAC header!),
          * within command buffer array. */
         txcmd_phys =
-            pci_map_single(il->pci_dev, &out_cmd->hdr, len, PCI_DMA_TODEVICE);
+            pci_map_single(il->pci_dev, &out_cmd->hdr, firstlen,
+                           PCI_DMA_TODEVICE);
         if (unlikely(pci_dma_mapping_error(il->pci_dev, txcmd_phys)))
                 goto drop_unlock;
 
         /* Set up TFD's 2nd entry to point directly to remainder of skb,
          * if any (802.11 null frames have no payload). */
-        len = skb->len - hdr_len;
-        if (len) {
+        secondlen = skb->len - hdr_len;
+        if (secondlen > 0) {
                 phys_addr =
-                    pci_map_single(il->pci_dev, skb->data + hdr_len, len,
+                    pci_map_single(il->pci_dev, skb->data + hdr_len, secondlen,
                                    PCI_DMA_TODEVICE);
                 if (unlikely(pci_dma_mapping_error(il->pci_dev, phys_addr)))
                         goto drop_unlock;
@@ -611,12 +613,12 @@ il3945_tx_skb(struct il_priv *il,
 
         /* Add buffer containing Tx command and MAC(!) header to TFD's
          * first entry */
-        il->ops->txq_attach_buf_to_tfd(il, txq, txcmd_phys, len, 1, 0);
+        il->ops->txq_attach_buf_to_tfd(il, txq, txcmd_phys, firstlen, 1, 0);
         dma_unmap_addr_set(out_meta, mapping, txcmd_phys);
-        dma_unmap_len_set(out_meta, len, len);
-        if (len)
-                il->ops->txq_attach_buf_to_tfd(il, txq, phys_addr, len, 0,
-                                               U32_PAD(len));
+        dma_unmap_len_set(out_meta, len, firstlen);
+        if (secondlen > 0)
+                il->ops->txq_attach_buf_to_tfd(il, txq, phys_addr, secondlen, 0,
+                                               U32_PAD(secondlen));
 
         if (!ieee80211_has_morefrags(hdr->frame_control)) {
                 txq->need_update = 1;
diff --git a/drivers/net/wireless/mwifiex/cmdevt.c b/drivers/net/wireless/mwifiex/cmdevt.c
index 20a6c5555873..b5c8b962ce12 100644
--- a/drivers/net/wireless/mwifiex/cmdevt.c
+++ b/drivers/net/wireless/mwifiex/cmdevt.c
@@ -157,6 +157,20 @@ static int mwifiex_dnld_cmd_to_fw(struct mwifiex_private *priv,
                 return -1;
         }
 
+        cmd_code = le16_to_cpu(host_cmd->command);
+        cmd_size = le16_to_cpu(host_cmd->size);
+
+        if (adapter->hw_status == MWIFIEX_HW_STATUS_RESET &&
+            cmd_code != HostCmd_CMD_FUNC_SHUTDOWN &&
+            cmd_code != HostCmd_CMD_FUNC_INIT) {
+                dev_err(adapter->dev,
+                        "DNLD_CMD: FW in reset state, ignore cmd %#x\n",
+                        cmd_code);
+                mwifiex_complete_cmd(adapter, cmd_node);
+                mwifiex_insert_cmd_to_free_q(adapter, cmd_node);
+                return -1;
+        }
+
         /* Set command sequence number */
         adapter->seq_num++;
         host_cmd->seq_num = cpu_to_le16(HostCmd_SET_SEQ_NO_BSS_INFO
@@ -168,9 +182,6 @@ static int mwifiex_dnld_cmd_to_fw(struct mwifiex_private *priv,
         adapter->curr_cmd = cmd_node;
         spin_unlock_irqrestore(&adapter->mwifiex_cmd_lock, flags);
 
-        cmd_code = le16_to_cpu(host_cmd->command);
-        cmd_size = le16_to_cpu(host_cmd->size);
-
         /* Adjust skb length */
         if (cmd_node->cmd_skb->len > cmd_size)
                 /*
@@ -484,8 +495,6 @@ int mwifiex_send_cmd_sync(struct mwifiex_private *priv, uint16_t cmd_no,
 
         ret = mwifiex_send_cmd_async(priv, cmd_no, cmd_action, cmd_oid,
                                      data_buf);
-        if (!ret)
-                ret = mwifiex_wait_queue_complete(adapter);
 
         return ret;
 }
@@ -588,9 +597,10 @@ int mwifiex_send_cmd_async(struct mwifiex_private *priv, uint16_t cmd_no,
         if (cmd_no == HostCmd_CMD_802_11_SCAN) {
                 mwifiex_queue_scan_cmd(priv, cmd_node);
         } else {
-                adapter->cmd_queued = cmd_node;
                 mwifiex_insert_cmd_to_pending_q(adapter, cmd_node, true);
                 queue_work(adapter->workqueue, &adapter->main_work);
+                if (cmd_node->wait_q_enabled)
+                        ret = mwifiex_wait_queue_complete(adapter, cmd_node);
         }
 
         return ret;
diff --git a/drivers/net/wireless/mwifiex/init.c b/drivers/net/wireless/mwifiex/init.c
index e38aa9b3663d..0ff4c37ab42a 100644
--- a/drivers/net/wireless/mwifiex/init.c
+++ b/drivers/net/wireless/mwifiex/init.c
@@ -709,6 +709,14 @@ mwifiex_shutdown_drv(struct mwifiex_adapter *adapter)
                 return ret;
         }
 
+        /* cancel current command */
+        if (adapter->curr_cmd) {
+                dev_warn(adapter->dev, "curr_cmd is still in processing\n");
+                del_timer(&adapter->cmd_timer);
+                mwifiex_insert_cmd_to_free_q(adapter, adapter->curr_cmd);
+                adapter->curr_cmd = NULL;
+        }
+
         /* shut down mwifiex */
         dev_dbg(adapter->dev, "info: shutdown mwifiex...\n");
 
diff --git a/drivers/net/wireless/mwifiex/join.c b/drivers/net/wireless/mwifiex/join.c
index 246aa62a4817..2fe0ceba4400 100644
--- a/drivers/net/wireless/mwifiex/join.c
+++ b/drivers/net/wireless/mwifiex/join.c
@@ -1117,10 +1117,9 @@ mwifiex_cmd_802_11_ad_hoc_join(struct mwifiex_private *priv,
                 adhoc_join->bss_descriptor.bssid,
                 adhoc_join->bss_descriptor.ssid);
 
-        for (i = 0; bss_desc->supported_rates[i] &&
-                        i < MWIFIEX_SUPPORTED_RATES;
-                        i++)
-                        ;
+        for (i = 0; i < MWIFIEX_SUPPORTED_RATES &&
+                    bss_desc->supported_rates[i]; i++)
+                ;
         rates_size = i;
 
         /* Copy Data Rates from the Rates recorded in scan response */
diff --git a/drivers/net/wireless/mwifiex/main.h b/drivers/net/wireless/mwifiex/main.h
index 553adfb0aa81..7035ade9af74 100644
--- a/drivers/net/wireless/mwifiex/main.h
+++ b/drivers/net/wireless/mwifiex/main.h
@@ -723,7 +723,6 @@ struct mwifiex_adapter {
         u16 cmd_wait_q_required;
         struct mwifiex_wait_queue cmd_wait_q;
         u8 scan_wait_q_woken;
-        struct cmd_ctrl_node *cmd_queued;
         spinlock_t queue_lock;          /* lock for tx queues */
         struct completion fw_load;
         u8 country_code[IEEE80211_COUNTRY_STRING_LEN];
@@ -1018,7 +1017,8 @@ int mwifiex_request_set_multicast_list(struct mwifiex_private *priv,
                         struct mwifiex_multicast_list *mcast_list);
 int mwifiex_copy_mcast_addr(struct mwifiex_multicast_list *mlist,
                             struct net_device *dev);
-int mwifiex_wait_queue_complete(struct mwifiex_adapter *adapter);
+int mwifiex_wait_queue_complete(struct mwifiex_adapter *adapter,
+                                struct cmd_ctrl_node *cmd_queued);
 int mwifiex_bss_start(struct mwifiex_private *priv, struct cfg80211_bss *bss,
                       struct cfg80211_ssid *req_ssid);
 int mwifiex_cancel_hs(struct mwifiex_private *priv, int cmd_type);
diff --git a/drivers/net/wireless/mwifiex/scan.c b/drivers/net/wireless/mwifiex/scan.c
index bb60c2754a97..d215b4d3c51b 100644
--- a/drivers/net/wireless/mwifiex/scan.c
+++ b/drivers/net/wireless/mwifiex/scan.c
@@ -1388,10 +1388,13 @@ int mwifiex_scan_networks(struct mwifiex_private *priv,
                         list_del(&cmd_node->list);
                         spin_unlock_irqrestore(&adapter->scan_pending_q_lock,
                                                flags);
-                        adapter->cmd_queued = cmd_node;
                         mwifiex_insert_cmd_to_pending_q(adapter, cmd_node,
                                                         true);
                         queue_work(adapter->workqueue, &adapter->main_work);
+
+                        /* Perform internal scan synchronously */
+                        if (!priv->scan_request)
+                                mwifiex_wait_queue_complete(adapter, cmd_node);
                 } else {
                         spin_unlock_irqrestore(&adapter->scan_pending_q_lock,
                                                flags);
@@ -1946,9 +1949,6 @@ int mwifiex_request_scan(struct mwifiex_private *priv,
                 /* Normal scan */
                 ret = mwifiex_scan_networks(priv, NULL);
 
-        if (!ret)
-                ret = mwifiex_wait_queue_complete(priv->adapter);
-
         up(&priv->async_sem);
 
         return ret;
diff --git a/drivers/net/wireless/mwifiex/sta_ioctl.c b/drivers/net/wireless/mwifiex/sta_ioctl.c
index 9f33c92c90f5..13100f8de3db 100644
--- a/drivers/net/wireless/mwifiex/sta_ioctl.c
+++ b/drivers/net/wireless/mwifiex/sta_ioctl.c
@@ -54,16 +54,10 @@ int mwifiex_copy_mcast_addr(struct mwifiex_multicast_list *mlist,
  * This function waits on a cmd wait queue. It also cancels the pending
  * request after waking up, in case of errors.
  */
-int mwifiex_wait_queue_complete(struct mwifiex_adapter *adapter)
+int mwifiex_wait_queue_complete(struct mwifiex_adapter *adapter,
+                                struct cmd_ctrl_node *cmd_queued)
 {
         int status;
-        struct cmd_ctrl_node *cmd_queued;
-
-        if (!adapter->cmd_queued)
-                return 0;
-
-        cmd_queued = adapter->cmd_queued;
-        adapter->cmd_queued = NULL;
 
         dev_dbg(adapter->dev, "cmd pending\n");
         atomic_inc(&adapter->cmd_pending);
diff --git a/drivers/net/wireless/rt2x00/Kconfig b/drivers/net/wireless/rt2x00/Kconfig
index 44d6ead43341..2bf4efa33186 100644
--- a/drivers/net/wireless/rt2x00/Kconfig
+++ b/drivers/net/wireless/rt2x00/Kconfig
@@ -55,10 +55,10 @@ config RT61PCI
 
 config RT2800PCI
         tristate "Ralink rt27xx/rt28xx/rt30xx (PCI/PCIe/PCMCIA) support"
-        depends on PCI || RALINK_RT288X || RALINK_RT305X
+        depends on PCI || SOC_RT288X || SOC_RT305X
         select RT2800_LIB
         select RT2X00_LIB_PCI if PCI
-        select RT2X00_LIB_SOC if RALINK_RT288X || RALINK_RT305X
+        select RT2X00_LIB_SOC if SOC_RT288X || SOC_RT305X
         select RT2X00_LIB_FIRMWARE
         select RT2X00_LIB_CRYPTO
         select CRC_CCITT
diff --git a/drivers/net/wireless/rt2x00/rt2800pci.c b/drivers/net/wireless/rt2x00/rt2800pci.c
index 48a01aa21f1c..ded73da4de0b 100644
--- a/drivers/net/wireless/rt2x00/rt2800pci.c
+++ b/drivers/net/wireless/rt2x00/rt2800pci.c
@@ -89,7 +89,7 @@ static void rt2800pci_mcu_status(struct rt2x00_dev *rt2x00dev, const u8 token)
         rt2x00pci_register_write(rt2x00dev, H2M_MAILBOX_CID, ~0);
 }
 
-#if defined(CONFIG_RALINK_RT288X) || defined(CONFIG_RALINK_RT305X)
+#if defined(CONFIG_SOC_RT288X) || defined(CONFIG_SOC_RT305X)
 static int rt2800pci_read_eeprom_soc(struct rt2x00_dev *rt2x00dev)
 {
         void __iomem *base_addr = ioremap(0x1F040000, EEPROM_SIZE);
@@ -107,7 +107,7 @@ static inline int rt2800pci_read_eeprom_soc(struct rt2x00_dev *rt2x00dev)
 {
         return -ENOMEM;
 }
-#endif /* CONFIG_RALINK_RT288X || CONFIG_RALINK_RT305X */
+#endif /* CONFIG_SOC_RT288X || CONFIG_SOC_RT305X */
 
 #ifdef CONFIG_PCI
 static void rt2800pci_eepromregister_read(struct eeprom_93cx6 *eeprom)
@@ -1177,7 +1177,7 @@ MODULE_DEVICE_TABLE(pci, rt2800pci_device_table);
 #endif /* CONFIG_PCI */
 MODULE_LICENSE("GPL");
 
-#if defined(CONFIG_RALINK_RT288X) || defined(CONFIG_RALINK_RT305X)
+#if defined(CONFIG_SOC_RT288X) || defined(CONFIG_SOC_RT305X)
 static int rt2800soc_probe(struct platform_device *pdev)
 {
         return rt2x00soc_probe(pdev, &rt2800pci_ops);
@@ -1194,7 +1194,7 @@ static struct platform_driver rt2800soc_driver = {
         .suspend        = rt2x00soc_suspend,
         .resume         = rt2x00soc_resume,
 };
-#endif /* CONFIG_RALINK_RT288X || CONFIG_RALINK_RT305X */
+#endif /* CONFIG_SOC_RT288X || CONFIG_SOC_RT305X */
 
 #ifdef CONFIG_PCI
 static int rt2800pci_probe(struct pci_dev *pci_dev,
@@ -1217,7 +1217,7 @@ static int __init rt2800pci_init(void)
 {
         int ret = 0;
 
-#if defined(CONFIG_RALINK_RT288X) || defined(CONFIG_RALINK_RT305X)
+#if defined(CONFIG_SOC_RT288X) || defined(CONFIG_SOC_RT305X)
         ret = platform_driver_register(&rt2800soc_driver);
         if (ret)
                 return ret;
@@ -1225,7 +1225,7 @@ static int __init rt2800pci_init(void)
 #ifdef CONFIG_PCI
         ret = pci_register_driver(&rt2800pci_driver);
         if (ret) {
-#if defined(CONFIG_RALINK_RT288X) || defined(CONFIG_RALINK_RT305X)
+#if defined(CONFIG_SOC_RT288X) || defined(CONFIG_SOC_RT305X)
                 platform_driver_unregister(&rt2800soc_driver);
 #endif
                 return ret;
@@ -1240,7 +1240,7 @@ static void __exit rt2800pci_exit(void)
 #ifdef CONFIG_PCI
         pci_unregister_driver(&rt2800pci_driver);
 #endif
-#if defined(CONFIG_RALINK_RT288X) || defined(CONFIG_RALINK_RT305X)
+#if defined(CONFIG_SOC_RT288X) || defined(CONFIG_SOC_RT305X)
         platform_driver_unregister(&rt2800soc_driver);
 #endif
 }
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
index b1ccff474c79..c08d0f4c5f3d 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
@@ -1377,74 +1377,57 @@ void rtl92cu_card_disable(struct ieee80211_hw *hw)
 
 void rtl92cu_set_check_bssid(struct ieee80211_hw *hw, bool check_bssid)
 {
-        /* dummy routine needed for callback from rtl_op_configure_filter() */
-}
-
-/*========================================================================== */
-
-static void _rtl92cu_set_check_bssid(struct ieee80211_hw *hw,
-                              enum nl80211_iftype type)
-{
         struct rtl_priv *rtlpriv = rtl_priv(hw);
-        u32 reg_rcr = rtl_read_dword(rtlpriv, REG_RCR);
         struct rtl_hal *rtlhal = rtl_hal(rtlpriv);
-        struct rtl_phy *rtlphy = &(rtlpriv->phy);
-        u8 filterout_non_associated_bssid = false;
+        u32 reg_rcr = rtl_read_dword(rtlpriv, REG_RCR);
 
-        switch (type) {
-        case NL80211_IFTYPE_ADHOC:
-        case NL80211_IFTYPE_STATION:
-                filterout_non_associated_bssid = true;
-                break;
-        case NL80211_IFTYPE_UNSPECIFIED:
-        case NL80211_IFTYPE_AP:
-        default:
-                break;
-        }
-        if (filterout_non_associated_bssid) {
+        if (rtlpriv->psc.rfpwr_state != ERFON)
+                return;
+
+        if (check_bssid) {
+                u8 tmp;
                 if (IS_NORMAL_CHIP(rtlhal->version)) {
-                        switch (rtlphy->current_io_type) {
-                        case IO_CMD_RESUME_DM_BY_SCAN:
-                                reg_rcr |= (RCR_CBSSID_DATA | RCR_CBSSID_BCN);
-                                rtlpriv->cfg->ops->set_hw_reg(hw,
-                                                 HW_VAR_RCR, (u8 *)(&reg_rcr));
-                                /* enable update TSF */
-                                _rtl92cu_set_bcn_ctrl_reg(hw, 0, BIT(4));
-                                break;
-                        case IO_CMD_PAUSE_DM_BY_SCAN:
-                                reg_rcr &= ~(RCR_CBSSID_DATA | RCR_CBSSID_BCN);
-                                rtlpriv->cfg->ops->set_hw_reg(hw,
-                                                 HW_VAR_RCR, (u8 *)(&reg_rcr));
-                                /* disable update TSF */
-                                _rtl92cu_set_bcn_ctrl_reg(hw, BIT(4), 0);
-                                break;
-                        }
+                        reg_rcr |= (RCR_CBSSID_DATA | RCR_CBSSID_BCN);
+                        tmp = BIT(4);
                 } else {
-                        reg_rcr |= (RCR_CBSSID);
-                        rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_RCR,
-                                                      (u8 *)(&reg_rcr));
-                        _rtl92cu_set_bcn_ctrl_reg(hw, 0, (BIT(4)|BIT(5)));
+                        reg_rcr |= RCR_CBSSID;
+                        tmp = BIT(4) | BIT(5);
                 }
-        } else if (filterout_non_associated_bssid == false) {
+                rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_RCR,
+                                              (u8 *) (&reg_rcr));
+                _rtl92cu_set_bcn_ctrl_reg(hw, 0, tmp);
+        } else {
+                u8 tmp;
                 if (IS_NORMAL_CHIP(rtlhal->version)) {
-                        reg_rcr &= (~(RCR_CBSSID_DATA | RCR_CBSSID_BCN));
-                        rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_RCR,
-                                                      (u8 *)(&reg_rcr));
-                        _rtl92cu_set_bcn_ctrl_reg(hw, BIT(4), 0);
+                        reg_rcr &= ~(RCR_CBSSID_DATA | RCR_CBSSID_BCN);
+                        tmp = BIT(4);
                 } else {
-                        reg_rcr &= (~RCR_CBSSID);
-                        rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_RCR,
-                                                      (u8 *)(&reg_rcr));
-                        _rtl92cu_set_bcn_ctrl_reg(hw, (BIT(4)|BIT(5)), 0);
+                        reg_rcr &= ~RCR_CBSSID;
+                        tmp = BIT(4) | BIT(5);
                 }
+                reg_rcr &= (~(RCR_CBSSID_DATA | RCR_CBSSID_BCN));
+                rtlpriv->cfg->ops->set_hw_reg(hw,
+                                              HW_VAR_RCR, (u8 *) (&reg_rcr));
+                _rtl92cu_set_bcn_ctrl_reg(hw, tmp, 0);
         }
 }
 
+/*========================================================================== */
+
 int rtl92cu_set_network_type(struct ieee80211_hw *hw, enum nl80211_iftype type)
 {
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+
         if (_rtl92cu_set_media_status(hw, type))
                 return -EOPNOTSUPP;
-        _rtl92cu_set_check_bssid(hw, type);
+
+        if (rtlpriv->mac80211.link_state == MAC80211_LINKED) {
+                if (type != NL80211_IFTYPE_AP)
+                        rtl92cu_set_check_bssid(hw, true);
+        } else {
+                rtl92cu_set_check_bssid(hw, false);
+        }
+
         return 0;
 }
 
@@ -2058,8 +2041,6 @@ void rtl92cu_update_hal_rate_table(struct ieee80211_hw *hw,
                                (shortgi_rate << 4) | (shortgi_rate);
         }
         rtl_write_dword(rtlpriv, REG_ARFR0 + ratr_index * 4, ratr_value);
-        RT_TRACE(rtlpriv, COMP_RATR, DBG_DMESG, "%x\n",
-                 rtl_read_dword(rtlpriv, REG_ARFR0));
 }
 
 void rtl92cu_update_hal_rate_mask(struct ieee80211_hw *hw, u8 rssi_level)
diff --git a/drivers/net/wireless/rtlwifi/usb.c b/drivers/net/wireless/rtlwifi/usb.c
index 156b52732f3d..5847d6d0881e 100644
--- a/drivers/net/wireless/rtlwifi/usb.c
+++ b/drivers/net/wireless/rtlwifi/usb.c
@@ -851,6 +851,7 @@ static void _rtl_usb_transmit(struct ieee80211_hw *hw, struct sk_buff *skb,
         if (unlikely(!_urb)) {
                 RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
                          "Can't allocate urb. Drop skb!\n");
+                kfree_skb(skb);
                 return;
         }
         _rtl_submit_tx_urb(hw, _urb);