22 files changed, 230 insertions, 169 deletions

diff --git a/sys/dev/ath/if_ath.c b/sys/dev/ath/if_ath.c
index 4166bb73d697..26b1060b5a18 100644
--- a/sys/dev/ath/if_ath.c
+++ b/sys/dev/ath/if_ath.c
@@ -3320,6 +3320,9 @@ nextfrag:
 	 *
 	 * Note: if this fails, then the mbufs are freed but
 	 * not the node reference.
+	 *
+	 * So, we now have to free the node reference ourselves here
+	 * and return OK up to the stack.
 	 */
 	next = m->m_nextpkt;
 	if (ath_tx_start(sc, ni, bf, m)) {
@@ -3336,7 +3339,14 @@ reclaim:
 		 */
 		ath_txfrag_cleanup(sc, &frags, ni);
 		ATH_TXBUF_UNLOCK(sc);
-		retval = ENOBUFS;
+
+		/*
+		 * XXX: And free the node/return OK; ath_tx_start() may have
+		 *      modified the buffer.  We currently have no way to
+		 *      signify that the mbuf was freed but there was an error.
+		 */
+		ieee80211_free_node(ni);
+		retval = 0;
 		goto finish;
 	}
 
diff --git a/sys/dev/ath/if_athvar.h b/sys/dev/ath/if_athvar.h
index 1af99aa9c334..e3d414b3fd03 100644
--- a/sys/dev/ath/if_athvar.h
+++ b/sys/dev/ath/if_athvar.h
@@ -1035,8 +1035,8 @@ void	ath_intr(void *);
  */
 #define	ath_hal_detach(_ah) \
 	((*(_ah)->ah_detach)((_ah)))
-#define	ath_hal_reset(_ah, _opmode, _chan, _outdoor, _pstatus) \
-	((*(_ah)->ah_reset)((_ah), (_opmode), (_chan), (_outdoor), (_pstatus)))
+#define	ath_hal_reset(_ah, _opmode, _chan, _fullreset, _pstatus) \
+	((*(_ah)->ah_reset)((_ah), (_opmode), (_chan), (_fullreset), (_pstatus)))
 #define	ath_hal_macversion(_ah) \
 	(((_ah)->ah_macVersion << 4) | ((_ah)->ah_macRev))
 #define	ath_hal_getratetable(_ah, _mode) \
diff --git a/sys/dev/cxgbe/t4_main.c b/sys/dev/cxgbe/t4_main.c
index a5c7608310bd..473d5eb9fee1 100644
--- a/sys/dev/cxgbe/t4_main.c
+++ b/sys/dev/cxgbe/t4_main.c
@@ -573,6 +573,33 @@ t5_probe(device_t dev)
 	return (ENXIO);
 }
 
+static void
+t5_attribute_workaround(device_t dev)
+{
+	device_t root_port;
+	uint32_t v;
+
+	/*
+	 * The T5 chips do not properly echo the No Snoop and Relaxed
+	 * Ordering attributes when replying to a TLP from a Root
+	 * Port.  As a workaround, find the parent Root Port and
+	 * disable No Snoop and Relaxed Ordering.  Note that this
+	 * affects all devices under this root port.
+	 */
+	root_port = pci_find_pcie_root_port(dev);
+	if (root_port == NULL) {
+		device_printf(dev, "Unable to find parent root port\n");
+		return;
+	}
+
+	v = pcie_adjust_config(root_port, PCIER_DEVICE_CTL,
+	    PCIEM_CTL_RELAXED_ORD_ENABLE | PCIEM_CTL_NOSNOOP_ENABLE, 0, 2);
+	if ((v & (PCIEM_CTL_RELAXED_ORD_ENABLE | PCIEM_CTL_NOSNOOP_ENABLE)) !=
+	    0)
+		device_printf(dev, "Disabled No Snoop/Relaxed Ordering on %s\n",
+		    device_get_nameunit(root_port));
+}
+
 static int
 t4_attach(device_t dev)
 {
@@ -591,6 +618,8 @@ t4_attach(device_t dev)
 	sc->dev = dev;
 	TUNABLE_INT_FETCH("hw.cxgbe.debug_flags", &sc->debug_flags);
 
+	if ((pci_get_device(dev) & 0xff00) == 0x5400)
+		t5_attribute_workaround(dev);
 	pci_enable_busmaster(dev);
 	if (pci_find_cap(dev, PCIY_EXPRESS, &i) == 0) {
 		uint32_t v;
diff --git a/sys/dev/filemon/filemon.c b/sys/dev/filemon/filemon.c
index ef6c98c7f18d..b302de9f6924 100644
--- a/sys/dev/filemon/filemon.c
+++ b/sys/dev/filemon/filemon.c
@@ -43,7 +43,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/lock.h>
 #include <sys/malloc.h>
 #include <sys/module.h>
-#include <sys/mutex.h>
 #include <sys/poll.h>
 #include <sys/proc.h>
 #include <sys/queue.h>
diff --git a/sys/dev/flash/mx25l.c b/sys/dev/flash/mx25l.c
index 24c9323a9d33..d9aaa1c24935 100644
--- a/sys/dev/flash/mx25l.c
+++ b/sys/dev/flash/mx25l.c
@@ -107,6 +107,7 @@ struct mx25l_flash_ident flash_devices[] = {
 	{ "s25fl032",	0x01, 0x0215, 64 * 1024, 64, FL_NONE },
 	{ "s25fl064",	0x01, 0x0216, 64 * 1024, 128, FL_NONE },
 	{ "s25fl128",	0x01, 0x2018, 64 * 1024, 256, FL_NONE },
+	{ "s25fl256s",	0x01, 0x0219, 64 * 1024, 512, FL_NONE },
 	{ "SST25VF032B", 0xbf, 0x254a, 64 * 1024, 64, FL_ERASE_4K | FL_ERASE_32K },
 
 	/* Winbond -- w25x "blocks" are 64K, "sectors" are 4KiB */
diff --git a/sys/dev/iwi/if_iwi.c b/sys/dev/iwi/if_iwi.c
index c45a37ffe55e..53141e1e4495 100644
--- a/sys/dev/iwi/if_iwi.c
+++ b/sys/dev/iwi/if_iwi.c
@@ -155,7 +155,6 @@ static void	iwi_media_status(struct ifnet *, struct ifmediareq *);
 static int	iwi_newstate(struct ieee80211vap *, enum ieee80211_state, int);
 static void	iwi_wme_init(struct iwi_softc *);
 static int	iwi_wme_setparams(struct iwi_softc *);
-static void	iwi_update_wme(void *, int);
 static int	iwi_wme_update(struct ieee80211com *);
 static uint16_t	iwi_read_prom_word(struct iwi_softc *, uint8_t);
 static void	iwi_frame_intr(struct iwi_softc *, struct iwi_rx_data *, int,
@@ -286,7 +285,6 @@ iwi_attach(device_t dev)
 	TASK_INIT(&sc->sc_radiofftask, 0, iwi_radio_off, sc);
 	TASK_INIT(&sc->sc_restarttask, 0, iwi_restart, sc);
 	TASK_INIT(&sc->sc_disassoctask, 0, iwi_disassoc, sc);
-	TASK_INIT(&sc->sc_wmetask, 0, iwi_update_wme, sc);
 	TASK_INIT(&sc->sc_monitortask, 0, iwi_monitor_scan, sc);
 
 	callout_init_mtx(&sc->sc_wdtimer, &sc->sc_mtx, 0);
@@ -1060,22 +1058,12 @@ iwi_wme_setparams(struct iwi_softc *sc)
 #undef IWI_USEC
 #undef IWI_EXP2
 
-static void
-iwi_update_wme(void *arg, int npending)
-{
-	struct iwi_softc *sc = arg;
-	IWI_LOCK_DECL;
-
-	IWI_LOCK(sc);
-	(void) iwi_wme_setparams(sc);
-	IWI_UNLOCK(sc);
-}
-
 static int
 iwi_wme_update(struct ieee80211com *ic)
 {
 	struct iwi_softc *sc = ic->ic_softc;
 	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
+	IWI_LOCK_DECL;
 
 	/*
 	 * We may be called to update the WME parameters in
@@ -1085,8 +1073,11 @@ iwi_wme_update(struct ieee80211com *ic)
 	 * to the adapter as part of the work iwi_auth_and_assoc
 	 * does.
 	 */
-	if (vap->iv_state == IEEE80211_S_RUN)
-		ieee80211_runtask(ic, &sc->sc_wmetask);
+	if (vap->iv_state == IEEE80211_S_RUN) {
+		IWI_LOCK(sc);
+		iwi_wme_setparams(sc);
+		IWI_UNLOCK(sc);
+	}
 	return (0);
 }
 
diff --git a/sys/dev/iwi/if_iwivar.h b/sys/dev/iwi/if_iwivar.h
index 47848e16c822..88138cf0ed67 100644
--- a/sys/dev/iwi/if_iwivar.h
+++ b/sys/dev/iwi/if_iwivar.h
@@ -192,7 +192,6 @@ struct iwi_softc {
 	struct task		sc_radiofftask;	/* radio off processing */
 	struct task		sc_restarttask;	/* restart adapter processing */
 	struct task		sc_disassoctask;
-	struct task		sc_wmetask;	/* set wme parameters */
 	struct task		sc_monitortask;
 
 	unsigned int		sc_running : 1,	/* initialized */
diff --git a/sys/dev/iwn/if_iwn.c b/sys/dev/iwn/if_iwn.c
index 907755ba1b6f..2947db549c7a 100644
--- a/sys/dev/iwn/if_iwn.c
+++ b/sys/dev/iwn/if_iwn.c
@@ -4852,6 +4852,7 @@ iwn_xmit_task(void *arg0, int pending)
 			if_inc_counter(ni->ni_vap->iv_ifp,
 			    IFCOUNTER_OERRORS, 1);
 			ieee80211_free_node(ni);
+			m_freem(m);
 		}
 	}
 
@@ -4872,16 +4873,13 @@ iwn_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
 
 	DPRINTF(sc, IWN_DEBUG_XMIT | IWN_DEBUG_TRACE, "->%s begin\n", __func__);
 
+	IWN_LOCK(sc);
 	if ((sc->sc_flags & IWN_FLAG_RUNNING) == 0) {
 		m_freem(m);
-		return ENETDOWN;
+		IWN_UNLOCK(sc);
+		return (ENETDOWN);
 	}
 
-	/* XXX? net80211 doesn't set this on xmit'ed raw frames? */
-	m->m_pkthdr.rcvif = (void *) ni;
-
-	IWN_LOCK(sc);
-
 	/* queue frame if we have to */
 	if (sc->sc_beacon_wait) {
 		if (iwn_xmit_queue_enqueue(sc, m) != 0) {
@@ -4909,12 +4907,14 @@ iwn_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
 	}
 	if (error == 0)
 		sc->sc_tx_timer = 5;
+	else
+		m_freem(m);
 
 	IWN_UNLOCK(sc);
 
 	DPRINTF(sc, IWN_DEBUG_TRACE | IWN_DEBUG_XMIT, "->%s: end\n",__func__);
 
-	return error;
+	return (error);
 }
 
 /*
diff --git a/sys/dev/ofw/ofw_iicbus.c b/sys/dev/ofw/ofw_iicbus.c
index e7613fc9ddeb..badefed68477 100644
--- a/sys/dev/ofw/ofw_iicbus.c
+++ b/sys/dev/ofw/ofw_iicbus.c
@@ -148,10 +148,16 @@ ofw_iicbus_attach(device_t dev)
 		if (dinfo == NULL)
 			continue;
 		/*
-		 * OFW uses 7-bit I2C address format (see ePAPR),
-		 * but system expect 8-bit.
+		 * FreeBSD drivers expect I2C addresses to be expressed as
+		 * 8-bit values.  Apple OFW data contains 8-bit values, but
+		 * Linux FDT data contains 7-bit values, so shift them up to
+		 * 8-bit format.
 		 */
+#ifdef AIM
+		dinfo->opd_dinfo.addr = paddr;
+#else
 		dinfo->opd_dinfo.addr = paddr << 1;
+#endif
 		if (ofw_bus_gen_setup_devinfo(&dinfo->opd_obdinfo, child) !=
 		    0) {
 			free(dinfo, M_DEVBUF);
diff --git a/sys/dev/otus/if_otus.c b/sys/dev/otus/if_otus.c
index a61e344e6deb..0d59278050e0 100644
--- a/sys/dev/otus/if_otus.c
+++ b/sys/dev/otus/if_otus.c
@@ -155,7 +155,6 @@ static void	otus_free_txcmd(struct otus_softc *, struct otus_tx_cmd *);
 
 void		otus_next_scan(void *, int);
 static void	otus_tx_task(void *, int pending);
-static void	otus_wme_update_task(void *, int pending);
 void		otus_do_async(struct otus_softc *,
 		    void (*)(struct otus_softc *, void *), void *, int);
 int		otus_newstate(struct ieee80211vap *, enum ieee80211_state,
@@ -177,8 +176,9 @@ static int	otus_tx(struct otus_softc *, struct ieee80211_node *,
 		    const struct ieee80211_bpf_params *);
 int		otus_ioctl(struct ifnet *, u_long, caddr_t);
 int		otus_set_multi(struct otus_softc *);
-static void	otus_updateedca(struct otus_softc *sc);
-static void	otus_updateslot(struct otus_softc *sc);
+static int	otus_updateedca(struct ieee80211com *);
+static void	otus_updateedca_locked(struct otus_softc *);
+static void	otus_updateslot(struct otus_softc *);
 int		otus_init_mac(struct otus_softc *);
 uint32_t	otus_phy_get_def(struct otus_softc *, uint32_t);
 int		otus_set_board_values(struct otus_softc *,
@@ -300,7 +300,6 @@ otus_attach(device_t self)
 	TIMEOUT_TASK_INIT(taskqueue_thread, &sc->scan_to, 0, otus_next_scan, sc);
 	TIMEOUT_TASK_INIT(taskqueue_thread, &sc->calib_to, 0, otus_calibrate_to, sc);
 	TASK_INIT(&sc->tx_task, 0, otus_tx_task, sc);
-	TASK_INIT(&sc->wme_update_task, 0, otus_wme_update_task, sc);
 	mbufq_init(&sc->sc_snd, ifqmaxlen);
 
 	iface_index = 0;
@@ -345,7 +344,6 @@ otus_detach(device_t self)
 	taskqueue_drain_timeout(taskqueue_thread, &sc->scan_to);
 	taskqueue_drain_timeout(taskqueue_thread, &sc->calib_to);
 	taskqueue_drain(taskqueue_thread, &sc->tx_task);
-	taskqueue_drain(taskqueue_thread, &sc->wme_update_task);
 
 	otus_close_pipes(sc);
 #if 0
@@ -590,44 +588,6 @@ otus_set_channel(struct ieee80211com *ic)
 	OTUS_UNLOCK(sc);
 }
 
-static void
-otus_wme_update_task(void *arg, int pending)
-{
-	struct otus_softc *sc = arg;
-
-	OTUS_LOCK(sc);
-	/*
-	 * XXX TODO: take temporary copy of EDCA information
-	 * when scheduling this so we have a more time-correct view
-	 * of things.
-	 */
-	otus_updateedca(sc);
-	OTUS_UNLOCK(sc);
-}
-
-static void
-otus_wme_schedule_update(struct otus_softc *sc)
-{
-
-	taskqueue_enqueue(taskqueue_thread, &sc->wme_update_task);
-}
-
-/*
- * This is called by net80211 in RX packet context, so we
- * can't sleep here.
- *
- * TODO: have net80211 schedule an update itself for its
- * own internal taskqueue.
- */
-static int
-otus_wme_update(struct ieee80211com *ic)
-{
-	struct otus_softc *sc = ic->ic_softc;
-
-	otus_wme_schedule_update(sc);
-	return (0);
-}
-
 static int
 otus_ampdu_enable(struct ieee80211_node *ni, struct ieee80211_tx_ampdu *tap)
 {
@@ -811,7 +771,7 @@ otus_attachhook(struct otus_softc *sc)
 	ic->ic_transmit = otus_transmit;
 	ic->ic_update_chw = otus_update_chw;
 	ic->ic_ampdu_enable = otus_ampdu_enable;
-	ic->ic_wme.wme_update = otus_wme_update;
+	ic->ic_wme.wme_update = otus_updateedca;
 	ic->ic_newassoc = otus_newassoc;
 	ic->ic_node_alloc = otus_node_alloc;
 
@@ -2383,8 +2343,25 @@ otus_set_multi(struct otus_softc *sc)
 	return (r);
 }
 
+static int
+otus_updateedca(struct ieee80211com *ic)
+{
+	struct otus_softc *sc = ic->ic_softc;
+
+	OTUS_LOCK(sc);
+	/*
+	 * XXX TODO: take temporary copy of EDCA information
+	 * when scheduling this so we have a more time-correct view
+	 * of things.
+	 * XXX TODO: this can be done on the net80211 level
+	 */
+	otus_updateedca_locked(sc);
+	OTUS_UNLOCK(sc);
+	return (0);
+}
+
 static void
-otus_updateedca(struct otus_softc *sc)
+otus_updateedca_locked(struct otus_softc *sc)
 {
 #define EXP2(val)	((1 << (val)) - 1)
 #define AIFS(val)	((val) * 9 + 10)
@@ -2508,7 +2485,7 @@ otus_init_mac(struct otus_softc *sc)
 		return error;
 
 	/* Set default EDCA parameters. */
-	otus_updateedca(sc);
+	otus_updateedca_locked(sc);
 
 	return 0;
 }
@@ -3185,7 +3162,6 @@ otus_stop(struct otus_softc *sc)
 	taskqueue_drain_timeout(taskqueue_thread, &sc->scan_to);
 	taskqueue_drain_timeout(taskqueue_thread, &sc->calib_to);
 	taskqueue_drain(taskqueue_thread, &sc->tx_task);
-	taskqueue_drain(taskqueue_thread, &sc->wme_update_task);
 
 	OTUS_LOCK(sc);
 	sc->sc_running = 0;
diff --git a/sys/dev/otus/if_otusreg.h b/sys/dev/otus/if_otusreg.h
index 491e52972092..541d76731dbd 100644
--- a/sys/dev/otus/if_otusreg.h
+++ b/sys/dev/otus/if_otusreg.h
@@ -59,6 +59,8 @@
 #define AR_MAC_REG_RX_PE_DELAY		(AR_MAC_REG_BASE + 0x64c)
 #define AR_MAC_REG_DYNAMIC_SIFS_ACK	(AR_MAC_REG_BASE + 0x658)
 #define AR_MAC_REG_SNIFFER		(AR_MAC_REG_BASE + 0x674)
+#define         AR_MAC_SNIFFER_DEFAULTS	0x02000000
+#define         AR_MAC_SNIFFER_ENABLE_PROMISC	0x1
 #define AR_MAC_REG_ENCRYPTION		(AR_MAC_REG_BASE + 0x678)
 #define AR_MAC_REG_MISC_680		(AR_MAC_REG_BASE + 0x680)
 #define AR_MAC_REG_FRAMETYPE_FILTER	(AR_MAC_REG_BASE + 0x68c)
@@ -69,6 +71,11 @@
 #define AR_MAC_REG_BUSY_EXT		(AR_MAC_REG_BASE + 0x6ec)
 #define AR_MAC_REG_SLOT_TIME		(AR_MAC_REG_BASE + 0x6f0)
 #define AR_MAC_REG_CAM_MODE		(AR_MAC_REG_BASE + 0x700)
+#define         AR_MAC_CAM_DEFAULTS	(0xf << 24)
+#define         AR_MAC_CAM_IBSS		0xe0
+#define         AR_MAC_CAM_AP		0xa1
+#define         AR_MAC_CAM_STA		0x2
+#define         AR_MAC_CAM_AP_WDS	0x3
 #define AR_MAC_REG_AC0_CW		(AR_MAC_REG_BASE + 0xb00)
 #define AR_MAC_REG_AC1_CW		(AR_MAC_REG_BASE + 0xb04)
 #define AR_MAC_REG_AC2_CW		(AR_MAC_REG_BASE + 0xb08)
@@ -86,6 +93,12 @@
 #define AR_MAC_REG_AMPDU_FACTOR		(AR_MAC_REG_BASE + 0xb9c)
 #define AR_MAC_REG_FCS_SELECT		(AR_MAC_REG_BASE + 0xbb0)
 #define AR_MAC_REG_RX_CONTROL		(AR_MAC_REG_BASE + 0xc40)
+#define         AR_MAC_RX_CTRL_DEAGG		0x1
+#define         AR_MAC_RX_CTRL_SHORT_FILTER	0x2
+#define         AR_MAC_RX_CTRL_SA_DA_SEARCH	0x20
+#define         AR_MAC_RX_CTRL_PASS_TO_HOST	(1 << 28)
+#define         AR_MAC_RX_CTRL_ACK_IN_SNIFFER	(1 << 30)
+
 #define AR_MAC_REG_AMPDU_RX_THRESH	(AR_MAC_REG_BASE + 0xc50)
 #define AR_MAC_REG_OFDM_PHY_ERRORS	(AR_MAC_REG_BASE + 0xcb4)
 #define AR_MAC_REG_CCK_PHY_ERRORS	(AR_MAC_REG_BASE + 0xcb8)
@@ -1009,7 +1022,6 @@ struct otus_softc {
 	struct ieee80211_channel	*sc_curchan;
 
 	struct task			tx_task;
-	struct task			wme_update_task;
 	struct timeout_task		scan_to;
 	struct timeout_task		calib_to;
 
diff --git a/sys/dev/pci/pci.c b/sys/dev/pci/pci.c
index 39d311f65095..f5e8470de3ac 100644
--- a/sys/dev/pci/pci.c
+++ b/sys/dev/pci/pci.c
@@ -1917,6 +1917,63 @@ pci_set_max_read_req(device_t dev, int size)
 	return (size);
 }
 
+uint32_t
+pcie_read_config(device_t dev, int reg, int width)
+{
+	struct pci_devinfo *dinfo = device_get_ivars(dev);
+	int cap;
+
+	cap = dinfo->cfg.pcie.pcie_location;
+	if (cap == 0) {
+		if (width == 2)
+			return (0xffff);
+		return (0xffffffff);
+	}
+
+	return (pci_read_config(dev, cap + reg, width));
+}
+
+void
+pcie_write_config(device_t dev, int reg, uint32_t value, int width)
+{
+	struct pci_devinfo *dinfo = device_get_ivars(dev);
+	int cap;
+
+	cap = dinfo->cfg.pcie.pcie_location;
+	if (cap == 0)
+		return;
+	pci_write_config(dev, cap + reg, value, width);
+}
+
+/*
+ * Adjusts a PCI-e capability register by clearing the bits in mask
+ * and setting the bits in (value & mask).  Bits not set in mask are
+ * not adjusted.
+ *
+ * Returns the old value on success or all ones on failure.
+ */
+uint32_t
+pcie_adjust_config(device_t dev, int reg, uint32_t mask, uint32_t value,
+    int width)
+{
+	struct pci_devinfo *dinfo = device_get_ivars(dev);
+	uint32_t old, new;
+	int cap;
+
+	cap = dinfo->cfg.pcie.pcie_location;
+	if (cap == 0) {
+		if (width == 2)
+			return (0xffff);
+		return (0xffffffff);
+	}
+
+	old = pci_read_config(dev, cap + reg, width);
+	new = old & ~mask;
+	new |= (value & mask);
+	pci_write_config(dev, cap + reg, new, width);
+	return (old);
+}
+
 /*
  * Support for MSI message signalled interrupts.
  */
@@ -5374,3 +5431,44 @@ pci_get_rid_method(device_t dev, device_t child)
 
 	return (PCIB_GET_RID(device_get_parent(dev), child));
 }
+
+/* Find the upstream port of a given PCI device in a root complex. */
+device_t
+pci_find_pcie_root_port(device_t dev)
+{
+	struct pci_devinfo *dinfo;
+	devclass_t pci_class;
+	device_t pcib, bus;
+
+	pci_class = devclass_find("pci");
+	KASSERT(device_get_devclass(device_get_parent(dev)) == pci_class,
+	    ("%s: non-pci device %s", __func__, device_get_nameunit(dev)));
+
+	/*
+	 * Walk the bridge hierarchy until we find a PCI-e root
+	 * port or a non-PCI device.
+	 */
+	for (;;) {
+		bus = device_get_parent(dev);
+		KASSERT(bus != NULL, ("%s: null parent of %s", __func__,
+		    device_get_nameunit(dev)));
+
+		pcib = device_get_parent(bus);
+		KASSERT(pcib != NULL, ("%s: null bridge of %s", __func__,
+		    device_get_nameunit(bus)));
+
+		/*
+		 * pcib's parent must be a PCI bus for this to be a
+		 * PCI-PCI bridge.
+		 */
+		if (device_get_devclass(device_get_parent(pcib)) != pci_class)
+			return (NULL);
+
+		dinfo = device_get_ivars(pcib);
+		if (dinfo->cfg.pcie.pcie_location != 0 &&
+		    dinfo->cfg.pcie.pcie_type == PCIEM_TYPE_ROOT_PORT)
+			return (pcib);
+
+		dev = pcib;
+	}
+}
diff --git a/sys/dev/pci/pcivar.h b/sys/dev/pci/pcivar.h
index 7f2e95836a30..b8f64c2d9793 100644
--- a/sys/dev/pci/pcivar.h
+++ b/sys/dev/pci/pcivar.h
@@ -547,10 +547,15 @@ int	pci_msix_device_blacklisted(device_t dev);
 
 void	pci_ht_map_msi(device_t dev, uint64_t addr);
 
+device_t pci_find_pcie_root_port(device_t dev);
 int	pci_get_max_read_req(device_t dev);
 void	pci_restore_state(device_t dev);
 void	pci_save_state(device_t dev);
 int	pci_set_max_read_req(device_t dev, int size);
+uint32_t pcie_read_config(device_t dev, int reg, int width);
+void	pcie_write_config(device_t dev, int reg, uint32_t value, int width);
+uint32_t pcie_adjust_config(device_t dev, int reg, uint32_t mask,
+	    uint32_t value, int width);
 
 
 #ifdef BUS_SPACE_MAXADDR
diff --git a/sys/dev/usb/net/if_cdce.c b/sys/dev/usb/net/if_cdce.c
index 13fca9359f2b..397c4f6c779e 100644
--- a/sys/dev/usb/net/if_cdce.c
+++ b/sys/dev/usb/net/if_cdce.c
@@ -1535,6 +1535,7 @@ cdce_ncm_bulk_read_callback(struct usb_xfer *xfer, usb_error_t error)
 
 			/* check if we have a buffer */
 			if (m) {
+				m->m_len = m->m_pkthdr.len = temp + ETHER_ALIGN;
 				m_adj(m, ETHER_ALIGN);
 
 				usbd_copy_out(pc, offset, m->m_data, temp);
diff --git a/sys/dev/usb/net/if_urndis.c b/sys/dev/usb/net/if_urndis.c
index 3c24dcf1d4d7..32fa53370946 100644
--- a/sys/dev/usb/net/if_urndis.c
+++ b/sys/dev/usb/net/if_urndis.c
@@ -884,7 +884,7 @@ urndis_bulk_read_callback(struct usb_xfer *xfer, usb_error_t error)
 				DPRINTF("invalid ethernet size "
 				    "%u < %u\n", msg.rm_datalen, (unsigned)sizeof(struct ether_header));
 				goto tr_setup;
-			} else if (msg.rm_datalen > (uint32_t)MCLBYTES) {
+			} else if (msg.rm_datalen > (uint32_t)(MCLBYTES - ETHER_ALIGN)) {
 				if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
 				DPRINTF("invalid ethernet size "
 				    "%u > %u\n",
@@ -898,6 +898,7 @@ urndis_bulk_read_callback(struct usb_xfer *xfer, usb_error_t error)
 
 			/* check if we have a buffer */
 			if (m != NULL) {
+				m->m_len = m->m_pkthdr.len = msg.rm_datalen + ETHER_ALIGN;
 				m_adj(m, ETHER_ALIGN);
 
 				usbd_copy_out(pc, offset + msg.rm_dataoffset +
diff --git a/sys/dev/usb/usb_busdma.c b/sys/dev/usb/usb_busdma.c
index 1c3628888ba8..d9c198774f7a 100644
--- a/sys/dev/usb/usb_busdma.c
+++ b/sys/dev/usb/usb_busdma.c
@@ -443,9 +443,13 @@ usb_pc_common_mem_cb(void *arg, bus_dma_segment_t *segs,
 	pc->page_offset_buf = rem;
 	pc->page_offset_end += rem;
 #ifdef USB_DEBUG
-	if (rem != (USB_P2U(pc->buffer) & (USB_PAGE_SIZE - 1))) {
+	if (nseg > 1 &&
+	    ((segs->ds_addr + segs->ds_len) & (USB_PAGE_SIZE - 1)) !=
+	    ((segs + 1)->ds_addr & (USB_PAGE_SIZE - 1))) {
 		/*
-		 * This check verifies that the physical address is correct:
+		 * This check verifies there is no page offset hole
+		 * between the first and second segment. See the
+		 * BUS_DMA_KEEP_PG_OFFSET flag.
 		 */
 		DPRINTFN(0, "Page offset was not preserved\n");
 		error = 1;
diff --git a/sys/dev/usb/wlan/if_rum.c b/sys/dev/usb/wlan/if_rum.c
index de7b8806e800..9d2203da5494 100644
--- a/sys/dev/usb/wlan/if_rum.c
+++ b/sys/dev/usb/wlan/if_rum.c
@@ -216,8 +216,6 @@ static void		rum_get_tsf(struct rum_softc *, uint64_t *);
 static void		rum_update_slot_cb(struct rum_softc *,
 			    union sec_param *, uint8_t);
 static void		rum_update_slot(struct ieee80211com *);
-static void		rum_wme_update_cb(struct rum_softc *,
-			    union sec_param *, uint8_t);
 static int		rum_wme_update(struct ieee80211com *);
 static void		rum_set_bssid(struct rum_softc *, const uint8_t *);
 static void		rum_set_macaddr(struct rum_softc *, const uint8_t *);
@@ -2083,14 +2081,15 @@ rum_update_slot(struct ieee80211com *ic)
 	rum_cmd_sleepable(ic->ic_softc, NULL, 0, 0, rum_update_slot_cb);
 }
 
-static void
-rum_wme_update_cb(struct rum_softc *sc, union sec_param *data, uint8_t rvp_id)
+static int
+rum_wme_update(struct ieee80211com *ic)
 {
-	struct ieee80211com *ic = &sc->sc_ic;
 	const struct wmeParams *chanp =
 	    ic->ic_wme.wme_chanParams.cap_wmeParams;
+	struct rum_softc *sc = ic->ic_softc;
 	int error = 0;
 
+	RUM_LOCK(sc);
 	error = rum_write(sc, RT2573_AIFSN_CSR,
 	    chanp[WME_AC_VO].wmep_aifsn  << 12 |
 	    chanp[WME_AC_VI].wmep_aifsn  <<  8 |
@@ -2125,21 +2124,14 @@ rum_wme_update_cb(struct rum_softc *sc, union sec_param *data, uint8_t rvp_id)
 
 	memcpy(sc->wme_params, chanp, sizeof(*chanp) * WME_NUM_AC);
 
-	return;
-
 print_err:
-	device_printf(sc->sc_dev, "%s: WME update failed, error %d\n",
-	    __func__, error);
-}
-
-static int
-rum_wme_update(struct ieee80211com *ic)
-{
-	struct rum_softc *sc = ic->ic_softc;
-
-	rum_cmd_sleepable(sc, NULL, 0, 0, rum_wme_update_cb);
+	RUM_UNLOCK(sc);
+	if (error != 0) {
+		device_printf(sc->sc_dev, "%s: WME update failed, error %d\n",
+		    __func__, error);
+	}
 
-	return (0);
+	return (error);
 }
 
 static void
diff --git a/sys/dev/usb/wlan/if_rumvar.h b/sys/dev/usb/wlan/if_rumvar.h
index 9fa733e4c5f9..d4944680803d 100644
--- a/sys/dev/usb/wlan/if_rumvar.h
+++ b/sys/dev/usb/wlan/if_rumvar.h
@@ -73,7 +73,6 @@ typedef STAILQ_HEAD(, rum_tx_data) rum_txdhead;
 
 union sec_param {
 	struct ieee80211_key		key;
-	struct wmeParams		wme_params[WME_NUM_AC];
 	uint8_t				macaddr[IEEE80211_ADDR_LEN];
 	struct ieee80211vap		*vap;
 };
diff --git a/sys/dev/usb/wlan/if_run.c b/sys/dev/usb/wlan/if_run.c
index d5b52887ba3f..bb52a09322cb 100644
--- a/sys/dev/usb/wlan/if_run.c
+++ b/sys/dev/usb/wlan/if_run.c
@@ -381,7 +381,6 @@ static struct ieee80211_node *run_node_alloc(struct ieee80211vap *,
 static int	run_media_change(struct ifnet *);
 static int	run_newstate(struct ieee80211vap *, enum ieee80211_state, int);
 static int	run_wme_update(struct ieee80211com *);
-static void	run_wme_update_cb(void *);
 static void	run_key_set_cb(void *);
 static int	run_key_set(struct ieee80211vap *, struct ieee80211_key *);
 static void	run_key_delete_cb(void *);
@@ -2174,19 +2173,16 @@ run_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
 	return(rvp->newstate(vap, nstate, arg));
 }
 
-/* ARGSUSED */
-static void
-run_wme_update_cb(void *arg)
+static int
+run_wme_update(struct ieee80211com *ic)
 {
-	struct ieee80211com *ic = arg;
 	struct run_softc *sc = ic->ic_softc;
 	const struct wmeParams *ac =
 	    ic->ic_wme.wme_chanParams.cap_wmeParams;
 	int aci, error = 0;
 
-	RUN_LOCK_ASSERT(sc, MA_OWNED);
-
 	/* update MAC TX configuration registers */
+	RUN_LOCK(sc);
 	for (aci = 0; aci < WME_NUM_AC; aci++) {
 		error = run_write(sc, RT2860_EDCA_AC_CFG(aci),
 		    ac[aci].wmep_logcwmax << 16 |
@@ -2224,33 +2220,11 @@ run_wme_update_cb(void *arg)
 	    ac[WME_AC_VI].wmep_txopLimit);
 
 err:
+	RUN_UNLOCK(sc);
 	if (error)
 		DPRINTF("WME update failed\n");
 
-	return;
-}
-
-static int
-run_wme_update(struct ieee80211com *ic)
-{
-	struct run_softc *sc = ic->ic_softc;
-
-	/* sometime called wothout lock */
-	if (mtx_owned(&ic->ic_comlock.mtx)) {
-		uint32_t i = RUN_CMDQ_GET(&sc->cmdq_store);
-		DPRINTF("cmdq_store=%d\n", i);
-		sc->cmdq[i].func = run_wme_update_cb;
-		sc->cmdq[i].arg0 = ic;
-		ieee80211_runtask(ic, &sc->cmdq_task);
-		return (0);
-	}
-
-	RUN_LOCK(sc);
-	run_wme_update_cb(ic);
-	RUN_UNLOCK(sc);
-
-	/* return whatever, upper layer doesn't care anyway */
-	return (0);
+	return (error);
 }
 
 static void
diff --git a/sys/dev/usb/wlan/if_urtwn.c b/sys/dev/usb/wlan/if_urtwn.c
index 0cd1cf342a50..9bc8911be95b 100644
--- a/sys/dev/usb/wlan/if_urtwn.c
+++ b/sys/dev/usb/wlan/if_urtwn.c
@@ -1473,32 +1473,11 @@ urtwn_ra_init(struct urtwn_softc *sc)
 	return (0);
 }
 
-void
+static void
 urtwn_tsf_sync_enable(struct urtwn_softc *sc)
 {
-	struct ieee80211com *ic = &sc->sc_ic;
-	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
-	struct ieee80211_node *ni = vap->iv_bss;
-
-	uint64_t tsf;
-
-	/* Enable TSF synchronization. */
 	urtwn_write_1(sc, R92C_BCN_CTRL,
 	    urtwn_read_1(sc, R92C_BCN_CTRL) & ~R92C_BCN_CTRL_DIS_TSF_UDT0);
-
-	urtwn_write_1(sc, R92C_BCN_CTRL,
-	    urtwn_read_1(sc, R92C_BCN_CTRL) & ~R92C_BCN_CTRL_EN_BCN);
-
-	/* Set initial TSF. */
-	memcpy(&tsf, ni->ni_tstamp.data, 8);
-	tsf = le64toh(tsf);
-	tsf = tsf - (tsf % (vap->iv_bss->ni_intval * IEEE80211_DUR_TU));
-	tsf -= IEEE80211_DUR_TU;
-	urtwn_write_4(sc, R92C_TSFTR + 0, tsf);
-	urtwn_write_4(sc, R92C_TSFTR + 4, tsf >> 32);
-
-	urtwn_write_1(sc, R92C_BCN_CTRL,
-	    urtwn_read_1(sc, R92C_BCN_CTRL) | R92C_BCN_CTRL_EN_BCN);
 }
 
 static void
diff --git a/sys/dev/vnic/thunder_mdio_fdt.c b/sys/dev/vnic/thunder_mdio_fdt.c
index cd2d1cff9f09..b24be1dc3ee6 100644
--- a/sys/dev/vnic/thunder_mdio_fdt.c
+++ b/sys/dev/vnic/thunder_mdio_fdt.c
@@ -58,8 +58,8 @@ DEFINE_CLASS_1(thunder_mdio, thunder_mdio_fdt_driver, thunder_mdio_fdt_methods,
 
 static devclass_t thunder_mdio_fdt_devclass;
 
-DRIVER_MODULE(thunder_mdio, ofwbus, thunder_mdio_fdt_driver,
-    thunder_mdio_fdt_devclass, 0, 0);
+EARLY_DRIVER_MODULE(thunder_mdio, ofwbus, thunder_mdio_fdt_driver,
+    thunder_mdio_fdt_devclass, 0, 0, BUS_PASS_BUS + BUS_PASS_ORDER_MIDDLE);
 
 static int
 thunder_mdio_fdt_probe(device_t dev)
diff --git a/sys/dev/xen/netfront/netfront.c b/sys/dev/xen/netfront/netfront.c
index dd1015d72d82..cef6370493c2 100644
--- a/sys/dev/xen/netfront/netfront.c
+++ b/sys/dev/xen/netfront/netfront.c
@@ -31,7 +31,6 @@ __FBSDID("$FreeBSD$");
 #include "opt_inet6.h"
 
 #include <sys/param.h>
-#include <sys/systm.h>
 #include <sys/sockio.h>
 #include <sys/limits.h>
 #include <sys/mbuf.h>
@@ -40,22 +39,17 @@ __FBSDID("$FreeBSD$");
 #include <sys/kernel.h>
 #include <sys/socket.h>
 #include <sys/sysctl.h>
-#include <sys/queue.h>
-#include <sys/lock.h>
-#include <sys/sx.h>
 
 #include <net/if.h>
 #include <net/if_var.h>
 #include <net/if_arp.h>
 #include <net/ethernet.h>
-#include <net/if_dl.h>
 #include <net/if_media.h>
 
 #include <net/bpf.h>
 
 #include <net/if_types.h>
 
-#include <netinet/in_systm.h>
 #include <netinet/in.h>
 #include <netinet/ip.h>
 #include <netinet/if_ether.h>
@@ -65,16 +59,7 @@ __FBSDID("$FreeBSD$");
 #include <vm/vm.h>
 #include <vm/pmap.h>
 
-#include <machine/clock.h>      /* for DELAY */
-#include <machine/bus.h>
-#include <machine/resource.h>
-#include <machine/frame.h>
-#include <machine/vmparam.h>
-
 #include <sys/bus.h>
-#include <sys/rman.h>
-
-#include <machine/intr_machdep.h>
 
 #include <xen/xen-os.h>
 #include <xen/hypervisor.h>