23 files changed, 211 insertions, 57 deletions

diff --git a/drivers/net/can/c_can/c_can_platform.c b/drivers/net/can/c_can/c_can_platform.c
index 824108cd9fd5..12430be6448a 100644
--- a/drivers/net/can/c_can/c_can_platform.c
+++ b/drivers/net/can/c_can/c_can_platform.c
@@ -287,7 +287,8 @@ static int c_can_plat_probe(struct platform_device *pdev)
                         break;
                 }
 
-                priv->raminit_ctrlreg = devm_ioremap_resource(&pdev->dev, res);
+                priv->raminit_ctrlreg = devm_ioremap(&pdev->dev, res->start,
+                                                     resource_size(res));
                 if (IS_ERR(priv->raminit_ctrlreg) || priv->instance < 0)
                         dev_info(&pdev->dev, "control memory is not used for raminit\n");
                 else
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-main.c b/drivers/net/ethernet/amd/xgbe/xgbe-main.c
index c83584a26713..5a1891faba8a 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-main.c
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-main.c
@@ -339,7 +339,8 @@ static int xgbe_probe(struct platform_device *pdev)
         /* Calculate the number of Tx and Rx rings to be created */
         pdata->tx_ring_count = min_t(unsigned int, num_online_cpus(),
                                      pdata->hw_feat.tx_ch_cnt);
-        if (netif_set_real_num_tx_queues(netdev, pdata->tx_ring_count)) {
+        ret = netif_set_real_num_tx_queues(netdev, pdata->tx_ring_count);
+        if (ret) {
                 dev_err(dev, "error setting real tx queue count\n");
                 goto err_io;
         }
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
index 4cab09d3f807..8206a293e6b4 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
@@ -346,6 +346,7 @@ struct sw_tx_bd {
         u8              flags;
 /* Set on the first BD descriptor when there is a split BD */
 #define BNX2X_TSO_SPLIT_BD              (1<<0)
+#define BNX2X_HAS_SECOND_PBD            (1<<1)
 };
 
 struct sw_rx_page {
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
index 4b875da1c7ed..c43e7238de21 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
@@ -227,6 +227,12 @@ static u16 bnx2x_free_tx_pkt(struct bnx2x *bp, struct bnx2x_fp_txdata *txdata,
         --nbd;
         bd_idx = TX_BD(NEXT_TX_IDX(bd_idx));
 
+        if (tx_buf->flags & BNX2X_HAS_SECOND_PBD) {
+                /* Skip second parse bd... */
+                --nbd;
+                bd_idx = TX_BD(NEXT_TX_IDX(bd_idx));
+        }
+
         /* TSO headers+data bds share a common mapping. See bnx2x_tx_split() */
         if (tx_buf->flags & BNX2X_TSO_SPLIT_BD) {
                 tx_data_bd = &txdata->tx_desc_ring[bd_idx].reg_bd;
@@ -3889,6 +3895,9 @@ netdev_tx_t bnx2x_start_xmit(struct sk_buff *skb, struct net_device *dev)
                         /* set encapsulation flag in start BD */
                         SET_FLAG(tx_start_bd->general_data,
                                  ETH_TX_START_BD_TUNNEL_EXIST, 1);
+
+                        tx_buf->flags |= BNX2X_HAS_SECOND_PBD;
+
                         nbd++;
                 } else if (xmit_type & XMIT_CSUM) {
                         /* Set PBD in checksum offload case w/o encapsulation */
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
index bd0600cf7266..25eddd90f482 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
@@ -379,6 +379,7 @@ static int bnx2x_set_settings(struct net_device *dev, struct ethtool_cmd *cmd)
                         break;
                 case PORT_FIBRE:
                 case PORT_DA:
+                case PORT_NONE:
                         if (!(bp->port.supported[0] & SUPPORTED_FIBRE ||
                               bp->port.supported[1] & SUPPORTED_FIBRE)) {
                                 DP(BNX2X_MSG_ETHTOOL,
diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
index 16281ad2da12..4e615debe472 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
@@ -1149,6 +1149,11 @@ static netdev_tx_t bcmgenet_xmit(struct sk_buff *skb, struct net_device *dev)
                 goto out;
         }
 
+        if (skb_padto(skb, ETH_ZLEN)) {
+                ret = NETDEV_TX_OK;
+                goto out;
+        }
+
         /* set the SKB transmit checksum */
         if (priv->desc_64b_en) {
                 ret = bcmgenet_put_tx_csum(dev, skb);
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_cq.c b/drivers/net/ethernet/mellanox/mlx4/en_cq.c
index 14c00048bbec..82322b1c8411 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_cq.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_cq.c
@@ -129,14 +129,15 @@ int mlx4_en_activate_cq(struct mlx4_en_priv *priv, struct mlx4_en_cq *cq,
                                                   name);
                                 }
 
-                                cq->irq_desc =
-                                        irq_to_desc(mlx4_eq_get_irq(mdev->dev,
-                                                                    cq->vector));
                         }
                 } else {
                         cq->vector = (cq->ring + 1 + priv->port) %
                                 mdev->dev->caps.num_comp_vectors;
                 }
+
+                cq->irq_desc =
+                        irq_to_desc(mlx4_eq_get_irq(mdev->dev,
+                                                    cq->vector));
         } else {
                 /* For TX we use the same irq per
                 ring we assigned for the RX    */
diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
index 06bdc31a828d..61623e9af574 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -4240,6 +4240,8 @@ static void rtl_init_rxcfg(struct rtl8169_private *tp)
                 RTL_W32(RxConfig, RX128_INT_EN | RX_MULTI_EN | RX_DMA_BURST);
                 break;
         case RTL_GIGA_MAC_VER_40:
+                RTL_W32(RxConfig, RX128_INT_EN | RX_MULTI_EN | RX_DMA_BURST | RX_EARLY_OFF);
+                break;
         case RTL_GIGA_MAC_VER_41:
         case RTL_GIGA_MAC_VER_42:
         case RTL_GIGA_MAC_VER_43:
diff --git a/drivers/net/ethernet/sun/sunvnet.c b/drivers/net/ethernet/sun/sunvnet.c
index 1c24a8f368bd..d813bfb1a847 100644
--- a/drivers/net/ethernet/sun/sunvnet.c
+++ b/drivers/net/ethernet/sun/sunvnet.c
@@ -610,6 +610,13 @@ static int __vnet_tx_trigger(struct vnet_port *port)
         return err;
 }
 
+static inline bool port_is_up(struct vnet_port *vnet)
+{
+        struct vio_driver_state *vio = &vnet->vio;
+
+        return !!(vio->hs_state & VIO_HS_COMPLETE);
+}
+
 struct vnet_port *__tx_port_find(struct vnet *vp, struct sk_buff *skb)
 {
         unsigned int hash = vnet_hashfn(skb->data);
@@ -617,14 +624,19 @@ struct vnet_port *__tx_port_find(struct vnet *vp, struct sk_buff *skb)
         struct vnet_port *port;
 
         hlist_for_each_entry(port, hp, hash) {
+                if (!port_is_up(port))
+                        continue;
                 if (ether_addr_equal(port->raddr, skb->data))
                         return port;
         }
-        port = NULL;
-        if (!list_empty(&vp->port_list))
-                port = list_entry(vp->port_list.next, struct vnet_port, list);
-
-        return port;
+        list_for_each_entry(port, &vp->port_list, list) {
+                if (!port->switch_port)
+                        continue;
+                if (!port_is_up(port))
+                        continue;
+                return port;
+        }
+        return NULL;
 }
 
 struct vnet_port *tx_port_find(struct vnet *vp, struct sk_buff *skb)
@@ -1083,6 +1095,24 @@ static struct vnet *vnet_find_or_create(const u64 *local_mac)
         return vp;
 }
 
+static void vnet_cleanup(void)
+{
+        struct vnet *vp;
+        struct net_device *dev;
+
+        mutex_lock(&vnet_list_mutex);
+        while (!list_empty(&vnet_list)) {
+                vp = list_first_entry(&vnet_list, struct vnet, list);
+                list_del(&vp->list);
+                dev = vp->dev;
+                /* vio_unregister_driver() should have cleaned up port_list */
+                BUG_ON(!list_empty(&vp->port_list));
+                unregister_netdev(dev);
+                free_netdev(dev);
+        }
+        mutex_unlock(&vnet_list_mutex);
+}
+
 static const char *local_mac_prop = "local-mac-address";
 
 static struct vnet *vnet_find_parent(struct mdesc_handle *hp,
@@ -1240,7 +1270,6 @@ static int vnet_port_remove(struct vio_dev *vdev)
 
                 kfree(port);
 
-                unregister_netdev(vp->dev);
         }
         return 0;
 }
@@ -1268,6 +1297,7 @@ static int __init vnet_init(void)
 static void __exit vnet_exit(void)
 {
         vio_unregister_driver(&vnet_port_driver);
+        vnet_cleanup();
 }
 
 module_init(vnet_init);
diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c
index 4ed38eaecea8..d97d5f39a04e 100644
--- a/drivers/net/hyperv/netvsc.c
+++ b/drivers/net/hyperv/netvsc.c
@@ -378,8 +378,10 @@ static int netvsc_init_buf(struct hv_device *device)
 
         net_device->send_section_map =
                 kzalloc(net_device->map_words * sizeof(ulong), GFP_KERNEL);
-        if (net_device->send_section_map == NULL)
+        if (net_device->send_section_map == NULL) {
+                ret = -ENOMEM;
                 goto cleanup;
+        }
 
         goto exit;
 
diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c
index 4eaadcfcb0fe..203651ebccb0 100644
--- a/drivers/net/phy/mdio_bus.c
+++ b/drivers/net/phy/mdio_bus.c
@@ -255,6 +255,7 @@ int mdiobus_register(struct mii_bus *bus)
 
         bus->dev.parent = bus->parent;
         bus->dev.class = &mdio_bus_class;
+        bus->dev.driver = bus->parent->driver;
         bus->dev.groups = NULL;
         dev_set_name(&bus->dev, "%s", bus->id);
 
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index 35d753d22f78..22c57be4dfa0 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -355,7 +355,7 @@ int phy_device_register(struct phy_device *phydev)
         phydev->bus->phy_map[phydev->addr] = phydev;
 
         /* Run all of the fixups for this PHY */
-        err = phy_init_hw(phydev);
+        err = phy_scan_fixups(phydev);
         if (err) {
                 pr_err("PHY %d failed to initialize\n", phydev->addr);
                 goto out;
@@ -575,6 +575,7 @@ int phy_attach_direct(struct net_device *dev, struct phy_device *phydev,
                       u32 flags, phy_interface_t interface)
 {
         struct device *d = &phydev->dev;
+        struct module *bus_module;
         int err;
 
         /* Assume that if there is no driver, that it doesn't
@@ -599,6 +600,14 @@ int phy_attach_direct(struct net_device *dev, struct phy_device *phydev,
                 return -EBUSY;
         }
 
+        /* Increment the bus module reference count */
+        bus_module = phydev->bus->dev.driver ?
+                     phydev->bus->dev.driver->owner : NULL;
+        if (!try_module_get(bus_module)) {
+                dev_err(&dev->dev, "failed to get the bus module\n");
+                return -EIO;
+        }
+
         phydev->attached_dev = dev;
         dev->phydev = phydev;
 
@@ -664,6 +673,10 @@ EXPORT_SYMBOL(phy_attach);
 void phy_detach(struct phy_device *phydev)
 {
         int i;
+
+        if (phydev->bus->dev.driver)
+                module_put(phydev->bus->dev.driver->owner);
+
         phydev->attached_dev->phydev = NULL;
         phydev->attached_dev = NULL;
         phy_suspend(phydev);
diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
index e2f20f807de8..d5b77ef3a210 100644
--- a/drivers/net/ppp/ppp_generic.c
+++ b/drivers/net/ppp/ppp_generic.c
@@ -757,10 +757,15 @@ static long ppp_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
                         };
 
                         ppp_lock(ppp);
-                        if (ppp->pass_filter)
+                        if (ppp->pass_filter) {
                                 sk_unattached_filter_destroy(ppp->pass_filter);
-                        err = sk_unattached_filter_create(&ppp->pass_filter,
-                                                          &fprog);
+                                ppp->pass_filter = NULL;
+                        }
+                        if (fprog.filter != NULL)
+                                err = sk_unattached_filter_create(&ppp->pass_filter,
+                                                                  &fprog);
+                        else
+                                err = 0;
                         kfree(code);
                         ppp_unlock(ppp);
                 }
@@ -778,10 +783,15 @@ static long ppp_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
                         };
 
                         ppp_lock(ppp);
-                        if (ppp->active_filter)
+                        if (ppp->active_filter) {
                                 sk_unattached_filter_destroy(ppp->active_filter);
-                        err = sk_unattached_filter_create(&ppp->active_filter,
-                                                          &fprog);
+                                ppp->active_filter = NULL;
+                        }
+                        if (fprog.filter != NULL)
+                                err = sk_unattached_filter_create(&ppp->active_filter,
+                                                                  &fprog);
+                        else
+                                err = 0;
                         kfree(code);
                         ppp_unlock(ppp);
                 }
diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
index 9ea4bfe5d318..2a32d9167d3b 100644
--- a/drivers/net/usb/cdc_ether.c
+++ b/drivers/net/usb/cdc_ether.c
@@ -341,6 +341,22 @@ next_desc:
                 usb_driver_release_interface(driver, info->data);
                 return -ENODEV;
         }
+
+        /* Some devices don't initialise properly. In particular
+         * the packet filter is not reset. There are devices that
+         * don't do reset all the way. So the packet filter should
+         * be set to a sane initial value.
+         */
+        usb_control_msg(dev->udev,
+                        usb_sndctrlpipe(dev->udev, 0),
+                        USB_CDC_SET_ETHERNET_PACKET_FILTER,
+                        USB_TYPE_CLASS | USB_RECIP_INTERFACE,
+                        USB_CDC_PACKET_TYPE_ALL_MULTICAST | USB_CDC_PACKET_TYPE_DIRECTED | USB_CDC_PACKET_TYPE_BROADCAST,
+                        intf->cur_altsetting->desc.bInterfaceNumber,
+                        NULL,
+                        0,
+                        USB_CTRL_SET_TIMEOUT
+                );
         return 0;
 
 bad_desc:
diff --git a/drivers/net/usb/huawei_cdc_ncm.c b/drivers/net/usb/huawei_cdc_ncm.c
index 5d95a13dbe2a..735f7dadb9a0 100644
--- a/drivers/net/usb/huawei_cdc_ncm.c
+++ b/drivers/net/usb/huawei_cdc_ncm.c
@@ -194,6 +194,9 @@ static const struct usb_device_id huawei_cdc_ncm_devs[] = {
         { USB_VENDOR_AND_INTERFACE_INFO(0x12d1, 0xff, 0x02, 0x76),
           .driver_info = (unsigned long)&huawei_cdc_ncm_info,
         },
+        { USB_VENDOR_AND_INTERFACE_INFO(0x12d1, 0xff, 0x03, 0x16),
+          .driver_info = (unsigned long)&huawei_cdc_ncm_info,
+        },
 
         /* Terminating entry */
         {
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index c4638c67f6b9..22756db53dca 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -667,6 +667,7 @@ static const struct usb_device_id products[] = {
         {QMI_FIXED_INTF(0x05c6, 0x9084, 4)},
         {QMI_FIXED_INTF(0x05c6, 0x920d, 0)},
         {QMI_FIXED_INTF(0x05c6, 0x920d, 5)},
+        {QMI_FIXED_INTF(0x0846, 0x68a2, 8)},
         {QMI_FIXED_INTF(0x12d1, 0x140c, 1)},    /* Huawei E173 */
         {QMI_FIXED_INTF(0x12d1, 0x14ac, 1)},    /* Huawei E1820 */
         {QMI_FIXED_INTF(0x16d8, 0x6003, 0)},    /* CMOTech 6003 */
@@ -757,6 +758,7 @@ static const struct usb_device_id products[] = {
         {QMI_FIXED_INTF(0x1199, 0x9054, 8)},    /* Sierra Wireless Modem */
         {QMI_FIXED_INTF(0x1199, 0x9055, 8)},    /* Netgear AirCard 341U */
         {QMI_FIXED_INTF(0x1199, 0x9056, 8)},    /* Sierra Wireless Modem */
+        {QMI_FIXED_INTF(0x1199, 0x9057, 8)},
         {QMI_FIXED_INTF(0x1199, 0x9061, 8)},    /* Sierra Wireless Modem */
         {QMI_FIXED_INTF(0x1bbb, 0x011e, 4)},    /* Telekom Speedstick LTE II (Alcatel One Touch L100V LTE) */
         {QMI_FIXED_INTF(0x1bbb, 0x0203, 2)},    /* Alcatel L800MA */
diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
index 7bad2d316637..3eab74c7c554 100644
--- a/drivers/net/usb/r8152.c
+++ b/drivers/net/usb/r8152.c
@@ -282,7 +282,7 @@
 /* USB_DEV_STAT */
 #define STAT_SPEED_MASK         0x0006
 #define STAT_SPEED_HIGH         0x0000
-#define STAT_SPEED_FULL         0x0001
+#define STAT_SPEED_FULL         0x0002
 
 /* USB_TX_AGG */
 #define TX_AGG_MAX_THRESHOLD    0x03
@@ -2292,9 +2292,8 @@ static void r8152b_exit_oob(struct r8152 *tp)
         /* rx share fifo credit full threshold */
         ocp_write_dword(tp, MCU_TYPE_PLA, PLA_RXFIFO_CTRL0, RXFIFO_THR1_NORMAL);
 
-        ocp_data = ocp_read_word(tp, MCU_TYPE_USB, USB_DEV_STAT);
-        ocp_data &= STAT_SPEED_MASK;
-        if (ocp_data == STAT_SPEED_FULL) {
+        if (tp->udev->speed == USB_SPEED_FULL ||
+            tp->udev->speed == USB_SPEED_LOW) {
                 /* rx share fifo credit near full threshold */
                 ocp_write_dword(tp, MCU_TYPE_PLA, PLA_RXFIFO_CTRL1,
                                 RXFIFO_THR2_FULL);
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index ade33ef82823..9f79192c9aa0 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -339,7 +339,7 @@ static int vxlan_fdb_info(struct sk_buff *skb, struct vxlan_dev *vxlan,
         ndm->ndm_state = fdb->state;
         ndm->ndm_ifindex = vxlan->dev->ifindex;
         ndm->ndm_flags = fdb->flags;
-        ndm->ndm_type = NDA_DST;
+        ndm->ndm_type = RTN_UNICAST;
 
         if (send_eth && nla_put(skb, NDA_LLADDR, ETH_ALEN, &fdb->eth_addr))
                 goto nla_put_failure;
diff --git a/drivers/net/wan/x25_asy.c b/drivers/net/wan/x25_asy.c
index 5895f1978691..fa9fdfa128c1 100644
--- a/drivers/net/wan/x25_asy.c
+++ b/drivers/net/wan/x25_asy.c
@@ -122,8 +122,12 @@ static int x25_asy_change_mtu(struct net_device *dev, int newmtu)
 {
         struct x25_asy *sl = netdev_priv(dev);
         unsigned char *xbuff, *rbuff;
-        int len = 2 * newmtu;
+        int len;
 
+        if (newmtu > 65534)
+                return -EINVAL;
+
+        len = 2 * newmtu;
         xbuff = kmalloc(len + 4, GFP_ATOMIC);
         rbuff = kmalloc(len + 4, GFP_ATOMIC);
 
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index 66acb2cbd9df..7c28cb55610b 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -887,6 +887,15 @@ ath_tx_get_tid_subframe(struct ath_softc *sc, struct ath_txq *txq,
 
                 tx_info = IEEE80211_SKB_CB(skb);
                 tx_info->flags &= ~IEEE80211_TX_CTL_CLEAR_PS_FILT;
+
+                /*
+                 * No aggregation session is running, but there may be frames
+                 * from a previous session or a failed attempt in the queue.
+                 * Send them out as normal data frames
+                 */
+                if (!tid->active)
+                        tx_info->flags &= ~IEEE80211_TX_CTL_AMPDU;
+
                 if (!(tx_info->flags & IEEE80211_TX_CTL_AMPDU)) {
                         bf->bf_state.bf_type = 0;
                         return bf;
diff --git a/drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c b/drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c
index 725ba49576bf..8b79081d4885 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c
+++ b/drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c
@@ -1072,8 +1072,12 @@ static int iwl_mvm_mac_ctxt_cmd_ap(struct iwl_mvm *mvm,
         /* Fill the common data for all mac context types */
         iwl_mvm_mac_ctxt_cmd_common(mvm, vif, &cmd, action);
 
-        /* Also enable probe requests to pass */
-        cmd.filter_flags |= cpu_to_le32(MAC_FILTER_IN_PROBE_REQUEST);
+        /*
+         * pass probe requests and beacons from other APs (needed
+         * for ht protection)
+         */
+        cmd.filter_flags |= cpu_to_le32(MAC_FILTER_IN_PROBE_REQUEST |
+                                        MAC_FILTER_IN_BEACON);
 
         /* Fill the data specific for ap mode */
         iwl_mvm_mac_ctxt_cmd_fill_ap(mvm, vif, &cmd.ap,
@@ -1094,6 +1098,13 @@ static int iwl_mvm_mac_ctxt_cmd_go(struct iwl_mvm *mvm,
         /* Fill the common data for all mac context types */
         iwl_mvm_mac_ctxt_cmd_common(mvm, vif, &cmd, action);
 
+        /*
+         * pass probe requests and beacons from other APs (needed
+         * for ht protection)
+         */
+        cmd.filter_flags |= cpu_to_le32(MAC_FILTER_IN_PROBE_REQUEST |
+                                        MAC_FILTER_IN_BEACON);
+
         /* Fill the data specific for GO mode */
         iwl_mvm_mac_ctxt_cmd_fill_ap(mvm, vif, &cmd.go.ap,
                                      action == FW_CTXT_ACTION_ADD);
diff --git a/drivers/net/wireless/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
index 9bfb90680cdc..98556d03c1ed 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
@@ -303,13 +303,6 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
                 hw->uapsd_max_sp_len = IWL_UAPSD_MAX_SP;
         }
 
-        if (mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_UAPSD_SUPPORT &&
-            !iwlwifi_mod_params.uapsd_disable) {
-                hw->flags |= IEEE80211_HW_SUPPORTS_UAPSD;
-                hw->uapsd_queues = IWL_UAPSD_AC_INFO;
-                hw->uapsd_max_sp_len = IWL_UAPSD_MAX_SP;
-        }
-
         hw->sta_data_size = sizeof(struct iwl_mvm_sta);
         hw->vif_data_size = sizeof(struct iwl_mvm_vif);
         hw->chanctx_data_size = sizeof(u16);
diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
index 1844a47636b6..c65b636bcab9 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -1030,14 +1030,21 @@ static int xenvif_tx_check_gop(struct xenvif_queue *queue,
 {
         struct gnttab_map_grant_ref *gop_map = *gopp_map;
         u16 pending_idx = XENVIF_TX_CB(skb)->pending_idx;
+        /* This always points to the shinfo of the skb being checked, which
+         * could be either the first or the one on the frag_list
+         */
         struct skb_shared_info *shinfo = skb_shinfo(skb);
+        /* If this is non-NULL, we are currently checking the frag_list skb, and
+         * this points to the shinfo of the first one
+         */
+        struct skb_shared_info *first_shinfo = NULL;
         int nr_frags = shinfo->nr_frags;
+        const bool sharedslot = nr_frags &&
+                                frag_get_pending_idx(&shinfo->frags[0]) == pending_idx;
         int i, err;
-        struct sk_buff *first_skb = NULL;
 
         /* Check status of header. */
         err = (*gopp_copy)->status;
-        (*gopp_copy)++;
         if (unlikely(err)) {
                 if (net_ratelimit())
                         netdev_dbg(queue->vif->dev,
@@ -1045,8 +1052,12 @@ static int xenvif_tx_check_gop(struct xenvif_queue *queue,
                                    (*gopp_copy)->status,
                                    pending_idx,
                                    (*gopp_copy)->source.u.ref);
-                xenvif_idx_release(queue, pending_idx, XEN_NETIF_RSP_ERROR);
+                /* The first frag might still have this slot mapped */
+                if (!sharedslot)
+                        xenvif_idx_release(queue, pending_idx,
+                                           XEN_NETIF_RSP_ERROR);
         }
+        (*gopp_copy)++;
 
 check_frags:
         for (i = 0; i < nr_frags; i++, gop_map++) {
@@ -1062,8 +1073,19 @@ check_frags:
                                                 pending_idx,
                                                 gop_map->handle);
                         /* Had a previous error? Invalidate this fragment. */
-                        if (unlikely(err))
+                        if (unlikely(err)) {
                                 xenvif_idx_unmap(queue, pending_idx);
+                                /* If the mapping of the first frag was OK, but
+                                 * the header's copy failed, and they are
+                                 * sharing a slot, send an error
+                                 */
+                                if (i == 0 && sharedslot)
+                                        xenvif_idx_release(queue, pending_idx,
+                                                           XEN_NETIF_RSP_ERROR);
+                                else
+                                        xenvif_idx_release(queue, pending_idx,
+                                                           XEN_NETIF_RSP_OKAY);
+                        }
                         continue;
                 }
 
@@ -1075,42 +1097,53 @@ check_frags:
                                    gop_map->status,
                                    pending_idx,
                                    gop_map->ref);
+
                 xenvif_idx_release(queue, pending_idx, XEN_NETIF_RSP_ERROR);
 
                 /* Not the first error? Preceding frags already invalidated. */
                 if (err)
                         continue;
-                /* First error: invalidate preceding fragments. */
+
+                /* First error: if the header haven't shared a slot with the
+                 * first frag, release it as well.
+                 */
+                if (!sharedslot)
+                        xenvif_idx_release(queue,
+                                           XENVIF_TX_CB(skb)->pending_idx,
+                                           XEN_NETIF_RSP_OKAY);
+
+                /* Invalidate preceding fragments of this skb. */
                 for (j = 0; j < i; j++) {
                         pending_idx = frag_get_pending_idx(&shinfo->frags[j]);
                         xenvif_idx_unmap(queue, pending_idx);
+                        xenvif_idx_release(queue, pending_idx,
+                                           XEN_NETIF_RSP_OKAY);
+                }
+
+                /* And if we found the error while checking the frag_list, unmap
+                 * the first skb's frags
+                 */
+                if (first_shinfo) {
+                        for (j = 0; j < first_shinfo->nr_frags; j++) {
+                                pending_idx = frag_get_pending_idx(&first_shinfo->frags[j]);
+                                xenvif_idx_unmap(queue, pending_idx);
+                                xenvif_idx_release(queue, pending_idx,
+                                                   XEN_NETIF_RSP_OKAY);
+                        }
                 }
 
                 /* Remember the error: invalidate all subsequent fragments. */
                 err = newerr;
         }
 
-        if (skb_has_frag_list(skb)) {
-                first_skb = skb;
-                skb = shinfo->frag_list;
-                shinfo = skb_shinfo(skb);
+        if (skb_has_frag_list(skb) && !first_shinfo) {
+                first_shinfo = skb_shinfo(skb);
+                shinfo = skb_shinfo(skb_shinfo(skb)->frag_list);
                 nr_frags = shinfo->nr_frags;
 
                 goto check_frags;
         }
 
-        /* There was a mapping error in the frag_list skb. We have to unmap
-         * the first skb's frags
-         */
-        if (first_skb && err) {
-                int j;
-                shinfo = skb_shinfo(first_skb);
-                for (j = 0; j < shinfo->nr_frags; j++) {
-                        pending_idx = frag_get_pending_idx(&shinfo->frags[j]);
-                        xenvif_idx_unmap(queue, pending_idx);
-                }
-        }
-
         *gopp_map = gop_map;
         return err;
 }
@@ -1518,7 +1551,16 @@ static int xenvif_tx_submit(struct xenvif_queue *queue)
 
                 /* Check the remap error code. */
                 if (unlikely(xenvif_tx_check_gop(queue, skb, &gop_map, &gop_copy))) {
+                        /* If there was an error, xenvif_tx_check_gop is
+                         * expected to release all the frags which were mapped,
+                         * so kfree_skb shouldn't do it again
+                         */
                         skb_shinfo(skb)->nr_frags = 0;
+                        if (skb_has_frag_list(skb)) {
+                                struct sk_buff *nskb =
+                                                skb_shinfo(skb)->frag_list;
+                                skb_shinfo(nskb)->nr_frags = 0;
+                        }
                         kfree_skb(skb);
                         continue;
                 }
@@ -1822,8 +1864,6 @@ void xenvif_idx_unmap(struct xenvif_queue *queue, u16 pending_idx)
                            tx_unmap_op.status);
                 BUG();
         }
-
-        xenvif_idx_release(queue, pending_idx, XEN_NETIF_RSP_OKAY);
 }
 
 static inline int rx_work_todo(struct xenvif_queue *queue)