213 files changed, 2133 insertions, 1289 deletions
diff --git a/Documentation/networking/device_drivers/intel/e100.rst b/Documentation/networking/device_drivers/intel/e100.rst
index 2b9f4887beda..caf023cc88de 100644
--- a/Documentation/networking/device_drivers/intel/e100.rst
+++ b/Documentation/networking/device_drivers/intel/e100.rst
@@ -1,8 +1,8 @@
 .. SPDX-License-Identifier: GPL-2.0+
-==============================================================
+=============================================================
-Linux* Base Driver for the Intel(R) PRO/100 Family of Adapters
+Linux Base Driver for the Intel(R) PRO/100 Family of Adapters
-==============================================================
+=============================================================
 June 1, 2018
@@ -21,7 +21,7 @@ Contents
 In This Release
 ===============
-This file describes the Linux* Base Driver for the Intel(R) PRO/100 Family of
+This file describes the Linux Base Driver for the Intel(R) PRO/100 Family of
 Adapters. This driver includes support for Itanium(R)2-based systems.
 For questions related to hardware requirements, refer to the documentation
@@ -138,9 +138,9 @@ version 1.6 or later is required for this functionality.
 The latest release of ethtool can be found from
 https://www.kernel.org/pub/software/network/ethtool/
-Enabling Wake on LAN* (WoL)
+Enabling Wake on LAN (WoL)
---------------------------
+--------------------------
-WoL is provided through the ethtool* utility.  For instructions on
+WoL is provided through the ethtool utility.  For instructions on
 enabling WoL with ethtool, refer to the ethtool man page.  WoL will be
 enabled on the system during the next shut down or reboot.  For this
 driver version, in order to enable WoL, the e100 driver must be loaded
diff --git a/Documentation/networking/device_drivers/intel/e1000.rst b/Documentation/networking/device_drivers/intel/e1000.rst
index 956560b6e745..4aaae0f7d6ba 100644
--- a/Documentation/networking/device_drivers/intel/e1000.rst
+++ b/Documentation/networking/device_drivers/intel/e1000.rst
@@ -1,8 +1,8 @@
 .. SPDX-License-Identifier: GPL-2.0+
-===========================================================
+==========================================================
-Linux* Base Driver for Intel(R) Ethernet Network Connection
+Linux Base Driver for Intel(R) Ethernet Network Connection
-===========================================================
+==========================================================
 Intel Gigabit Linux driver.
 Copyright(c) 1999 - 2013 Intel Corporation.
@@ -438,10 +438,10 @@ ethtool
  The latest release of ethtool can be found from
  https://www.kernel.org/pub/software/network/ethtool/
-Enabling Wake on LAN* (WoL)
+Enabling Wake on LAN (WoL)
---------------------------
+--------------------------
-  WoL is configured through the ethtool* utility.
+  WoL is configured through the ethtool utility.
  WoL will be enabled on the system during the next shut down or reboot.
  For this driver version, in order to enable WoL, the e1000 driver must be
diff --git a/Documentation/networking/device_drivers/intel/e1000e.rst b/Documentation/networking/device_drivers/intel/e1000e.rst
index 01999f05509c..f49cd370e7bf 100644
--- a/Documentation/networking/device_drivers/intel/e1000e.rst
+++ b/Documentation/networking/device_drivers/intel/e1000e.rst
@@ -1,8 +1,8 @@
 .. SPDX-License-Identifier: GPL-2.0+
-======================================================
+=====================================================
-Linux* Driver for Intel(R) Ethernet Network Connection
+Linux Driver for Intel(R) Ethernet Network Connection
-======================================================
+=====================================================
 Intel Gigabit Linux driver.
 Copyright(c) 2008-2018 Intel Corporation.
@@ -338,7 +338,7 @@ and higher cannot be forced. Use the autonegotiation advertising setting to
 manually set devices for 1 Gbps and higher.
 Speed, duplex, and autonegotiation advertising are configured through the
-ethtool* utility.
+ethtool utility.
 Caution: Only experienced network administrators should force speed and duplex
 or change autonegotiation advertising manually. The settings at the switch must
@@ -351,9 +351,9 @@ will not attempt to auto-negotiate with its link partner since those adapters
 operate only in full duplex and only at their native speed.
-Enabling Wake on LAN* (WoL)
+Enabling Wake on LAN (WoL)
---------------------------
+--------------------------
-WoL is configured through the ethtool* utility.
+WoL is configured through the ethtool utility.
 WoL will be enabled on the system during the next shut down or reboot. For
 this driver version, in order to enable WoL, the e1000e driver must be loaded
diff --git a/Documentation/networking/device_drivers/intel/fm10k.rst b/Documentation/networking/device_drivers/intel/fm10k.rst
index ac3269e34f55..4d279e64e221 100644
--- a/Documentation/networking/device_drivers/intel/fm10k.rst
+++ b/Documentation/networking/device_drivers/intel/fm10k.rst
@@ -1,8 +1,8 @@
 .. SPDX-License-Identifier: GPL-2.0+
-==============================================================
+=============================================================
-Linux* Base Driver for Intel(R) Ethernet Multi-host Controller
+Linux Base Driver for Intel(R) Ethernet Multi-host Controller
-==============================================================
+=============================================================
 August 20, 2018
 Copyright(c) 2015-2018 Intel Corporation.
@@ -120,8 +120,8 @@ rx-flow-hash tcp4|udp4|ah4|esp4|sctp4|tcp6|udp6|ah6|esp6|sctp6 m|v|t|s|d|f|n|r
 Known Issues/Troubleshooting
 ============================
-Enabling SR-IOV in a 64-bit Microsoft* Windows Server* 2012/R2 guest OS under Linux KVM
+Enabling SR-IOV in a 64-bit Microsoft Windows Server 2012/R2 guest OS under Linux KVM
---------------------------------------------------------------------------------------
+-------------------------------------------------------------------------------------
 KVM Hypervisor/VMM supports direct assignment of a PCIe device to a VM. This
 includes traditional PCIe devices, as well as SR-IOV-capable devices based on
 the Intel Ethernet Controller XL710.
diff --git a/Documentation/networking/device_drivers/intel/i40e.rst b/Documentation/networking/device_drivers/intel/i40e.rst
index 848fd388fa6e..8a9b18573688 100644
--- a/Documentation/networking/device_drivers/intel/i40e.rst
+++ b/Documentation/networking/device_drivers/intel/i40e.rst
@@ -1,8 +1,8 @@
 .. SPDX-License-Identifier: GPL-2.0+
-==================================================================
+=================================================================
-Linux* Base Driver for the Intel(R) Ethernet Controller 700 Series
+Linux Base Driver for the Intel(R) Ethernet Controller 700 Series
-==================================================================
+=================================================================
 Intel 40 Gigabit Linux driver.
 Copyright(c) 1999-2018 Intel Corporation.
@@ -384,7 +384,7 @@ NOTE: You cannot set the speed for devices based on the Intel(R) Ethernet
 Network Adapter XXV710 based devices.
 Speed, duplex, and autonegotiation advertising are configured through the
-ethtool* utility.
+ethtool utility.
 Caution: Only experienced network administrators should force speed and duplex
 or change autonegotiation advertising manually. The settings at the switch must
diff --git a/Documentation/networking/device_drivers/intel/iavf.rst b/Documentation/networking/device_drivers/intel/iavf.rst
index cfc08842e32c..84ac7e75f363 100644
--- a/Documentation/networking/device_drivers/intel/iavf.rst
+++ b/Documentation/networking/device_drivers/intel/iavf.rst
@@ -1,8 +1,8 @@
 .. SPDX-License-Identifier: GPL-2.0+
-==================================================================
+=================================================================
-Linux* Base Driver for Intel(R) Ethernet Adaptive Virtual Function
+Linux Base Driver for Intel(R) Ethernet Adaptive Virtual Function
-==================================================================
+=================================================================
 Intel Ethernet Adaptive Virtual Function Linux driver.
 Copyright(c) 2013-2018 Intel Corporation.
@@ -19,7 +19,7 @@ Contents
 Overview
 ========
-This file describes the iavf Linux* Base Driver. This driver was formerly
+This file describes the iavf Linux Base Driver. This driver was formerly
 called i40evf.
 The iavf driver supports the below mentioned virtual function devices and
diff --git a/Documentation/networking/device_drivers/intel/ice.rst b/Documentation/networking/device_drivers/intel/ice.rst
index c220aa2711c6..ee43ea57d443 100644
--- a/Documentation/networking/device_drivers/intel/ice.rst
+++ b/Documentation/networking/device_drivers/intel/ice.rst
@@ -1,8 +1,8 @@
 .. SPDX-License-Identifier: GPL-2.0+
-===================================================================
+==================================================================
-Linux* Base Driver for the Intel(R) Ethernet Connection E800 Series
+Linux Base Driver for the Intel(R) Ethernet Connection E800 Series
-===================================================================
+==================================================================
 Intel ice Linux driver.
 Copyright(c) 2018 Intel Corporation.
diff --git a/Documentation/networking/device_drivers/intel/igb.rst b/Documentation/networking/device_drivers/intel/igb.rst
index fc8cfaa5dcfa..87e560fe5eaa 100644
--- a/Documentation/networking/device_drivers/intel/igb.rst
+++ b/Documentation/networking/device_drivers/intel/igb.rst
@@ -1,8 +1,8 @@
 .. SPDX-License-Identifier: GPL-2.0+
-===========================================================
+==========================================================
-Linux* Base Driver for Intel(R) Ethernet Network Connection
+Linux Base Driver for Intel(R) Ethernet Network Connection
-===========================================================
+==========================================================
 Intel Gigabit Linux driver.
 Copyright(c) 1999-2018 Intel Corporation.
@@ -129,9 +129,9 @@ version is required for this functionality. Download it at:
 https://www.kernel.org/pub/software/network/ethtool/
-Enabling Wake on LAN* (WoL)
+Enabling Wake on LAN (WoL)
---------------------------
+--------------------------
-WoL is configured through the ethtool* utility.
+WoL is configured through the ethtool utility.
 WoL will be enabled on the system during the next shut down or reboot. For
 this driver version, in order to enable WoL, the igb driver must be loaded
diff --git a/Documentation/networking/device_drivers/intel/igbvf.rst b/Documentation/networking/device_drivers/intel/igbvf.rst
index 9cddabe8108e..557fc020ef31 100644
--- a/Documentation/networking/device_drivers/intel/igbvf.rst
+++ b/Documentation/networking/device_drivers/intel/igbvf.rst
@@ -1,8 +1,8 @@
 .. SPDX-License-Identifier: GPL-2.0+
-============================================================
+===========================================================
-Linux* Base Virtual Function Driver for Intel(R) 1G Ethernet
+Linux Base Virtual Function Driver for Intel(R) 1G Ethernet
-============================================================
+===========================================================
 Intel Gigabit Virtual Function Linux driver.
 Copyright(c) 1999-2018 Intel Corporation.
diff --git a/Documentation/networking/device_drivers/intel/ixgbe.rst b/Documentation/networking/device_drivers/intel/ixgbe.rst
index c7d25483fedb..f1d5233e5e51 100644
--- a/Documentation/networking/device_drivers/intel/ixgbe.rst
+++ b/Documentation/networking/device_drivers/intel/ixgbe.rst
@@ -1,8 +1,8 @@
 .. SPDX-License-Identifier: GPL-2.0+
-=============================================================================
+===========================================================================
-Linux* Base Driver for the Intel(R) Ethernet 10 Gigabit PCI Express Adapters
+Linux Base Driver for the Intel(R) Ethernet 10 Gigabit PCI Express Adapters
-=============================================================================
+===========================================================================
 Intel 10 Gigabit Linux driver.
 Copyright(c) 1999-2018 Intel Corporation.
@@ -519,8 +519,8 @@ The offload is also supported for ixgbe's VFs, but the VF must be set as
 Known Issues/Troubleshooting
 ============================
-Enabling SR-IOV in a 64-bit Microsoft* Windows Server* 2012/R2 guest OS
+Enabling SR-IOV in a 64-bit Microsoft Windows Server 2012/R2 guest OS
-----------------------------------------------------------------------
+---------------------------------------------------------------------
 Linux KVM Hypervisor/VMM supports direct assignment of a PCIe device to a VM.
 This includes traditional PCIe devices, as well as SR-IOV-capable devices based
 on the Intel Ethernet Controller XL710.
diff --git a/Documentation/networking/device_drivers/intel/ixgbevf.rst b/Documentation/networking/device_drivers/intel/ixgbevf.rst
index 5d4977360157..76bbde736f21 100644
--- a/Documentation/networking/device_drivers/intel/ixgbevf.rst
+++ b/Documentation/networking/device_drivers/intel/ixgbevf.rst
@@ -1,8 +1,8 @@
 .. SPDX-License-Identifier: GPL-2.0+
-=============================================================
+============================================================
-Linux* Base Virtual Function Driver for Intel(R) 10G Ethernet
+Linux Base Virtual Function Driver for Intel(R) 10G Ethernet
-=============================================================
+============================================================
 Intel 10 Gigabit Virtual Function Linux driver.
 Copyright(c) 1999-2018 Intel Corporation.
diff --git a/Documentation/networking/device_drivers/pensando/ionic.rst b/Documentation/networking/device_drivers/pensando/ionic.rst
index 13935896bee6..c17d680cf334 100644
--- a/Documentation/networking/device_drivers/pensando/ionic.rst
+++ b/Documentation/networking/device_drivers/pensando/ionic.rst
@@ -1,8 +1,8 @@
 .. SPDX-License-Identifier: GPL-2.0+
-==========================================================
+========================================================
-Linux* Driver for the Pensando(R) Ethernet adapter family
+Linux Driver for the Pensando(R) Ethernet adapter family
-==========================================================
+========================================================
 Pensando Linux Ethernet driver.
 Copyright(c) 2019 Pensando Systems, Inc
diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
index 49e95f438ed7..8d4ad1d1ae26 100644
--- a/Documentation/networking/ip-sysctl.txt
+++ b/Documentation/networking/ip-sysctl.txt
@@ -207,8 +207,8 @@ TCP variables:
 somaxconn - INTEGER
        Limit of socket listen() backlog, known in userspace as SOMAXCONN.
-        Defaults to 128.  See also tcp_max_syn_backlog for additional tuning
+        Defaults to 4096. (Was 128 before linux-5.4)
-        for TCP sockets.
+        See also tcp_max_syn_backlog for additional tuning for TCP sockets.
 tcp_abort_on_overflow - BOOLEAN
        If listening service is too slow to accept new connections,
@@ -408,11 +408,14 @@ tcp_max_orphans - INTEGER
        up to ~64K of unswappable memory.
 tcp_max_syn_backlog - INTEGER
-        Maximal number of remembered connection requests, which have not
+        Maximal number of remembered connection requests (SYN_RECV),
-        received an acknowledgment from connecting client.
+        which have not received an acknowledgment from connecting client.
+        This is a per-listener limit.
        The minimal value is 128 for low memory machines, and it will
        increase in proportion to the memory of machine.
        If server suffers from overload, try increasing this number.
+        Remember to also check /proc/sys/net/core/somaxconn
+        A SYN_RECV request socket consumes about 304 bytes of memory.
 tcp_max_tw_buckets - INTEGER
        Maximal number of timewait sockets held by system simultaneously.
diff --git a/MAINTAINERS b/MAINTAINERS
index f97f35163033..cba1095547fd 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -11408,7 +11408,6 @@ F:	include/trace/events/tcp.h
 NETWORKING [TLS]
 M:      Boris Pismenny <borisp@mellanox.com>
 M:      Aviad Yehezkel <aviadye@mellanox.com>
-M:      Dave Watson <davejwatson@fb.com>
 M:      John Fastabend <john.fastabend@gmail.com>
 M:      Daniel Borkmann <daniel@iogearbox.net>
 M:      Jakub Kicinski <jakub.kicinski@netronome.com>
diff --git a/drivers/crypto/chelsio/chtls/chtls_cm.c b/drivers/crypto/chelsio/chtls/chtls_cm.c
index 774d991d7cca..aca75237bbcf 100644
--- a/drivers/crypto/chelsio/chtls/chtls_cm.c
+++ b/drivers/crypto/chelsio/chtls/chtls_cm.c
@@ -1297,7 +1297,7 @@ static void make_established(struct sock *sk, u32 snd_isn, unsigned int opt)
        tp->write_seq = snd_isn;
        tp->snd_nxt = snd_isn;
        tp->snd_una = snd_isn;
-        inet_sk(sk)->inet_id = tp->write_seq ^ jiffies;
+        inet_sk(sk)->inet_id = prandom_u32();
        assign_rxopt(sk, opt);
        if (tp->rcv_wnd > (RCV_BUFSIZ_M << 10))
diff --git a/drivers/crypto/chelsio/chtls/chtls_io.c b/drivers/crypto/chelsio/chtls/chtls_io.c
index 0891ab829b1b..98bc5a4cd5e7 100644
--- a/drivers/crypto/chelsio/chtls/chtls_io.c
+++ b/drivers/crypto/chelsio/chtls/chtls_io.c
@@ -1702,7 +1702,7 @@ int chtls_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,
                return peekmsg(sk, msg, len, nonblock, flags);
        if (sk_can_busy_loop(sk) &&
-            skb_queue_empty(&sk->sk_receive_queue) &&
+            skb_queue_empty_lockless(&sk->sk_receive_queue) &&
            sk->sk_state == TCP_ESTABLISHED)
                sk_busy_loop(sk, nonblock);
diff --git a/drivers/isdn/capi/capi.c b/drivers/isdn/capi/capi.c
index c92b405b7646..ba8619524231 100644
--- a/drivers/isdn/capi/capi.c
+++ b/drivers/isdn/capi/capi.c
@@ -744,7 +744,7 @@ capi_poll(struct file *file, poll_table *wait)
        poll_wait(file, &(cdev->recvwait), wait);
        mask = EPOLLOUT | EPOLLWRNORM;
-        if (!skb_queue_empty(&cdev->recvqueue))
+        if (!skb_queue_empty_lockless(&cdev->recvqueue))
                mask |= EPOLLIN | EPOLLRDNORM;
        return mask;
 }
diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c
index 8c79bad2a9a5..4f2e6910c623 100644
--- a/drivers/net/bonding/bond_alb.c
+++ b/drivers/net/bonding/bond_alb.c
@@ -952,7 +952,7 @@ static int alb_upper_dev_walk(struct net_device *upper, void *_data)
        struct bond_vlan_tag *tags;
        if (is_vlan_dev(upper) &&
-            bond->nest_level == vlan_get_encap_level(upper) - 1) {
+            bond->dev->lower_level == upper->lower_level - 1) {
                if (upper->addr_assign_type == NET_ADDR_STOLEN) {
                        alb_send_lp_vid(slave, mac_addr,
                                        vlan_dev_vlan_proto(upper),
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 21d8fcc83c9c..480f9459b402 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1733,8 +1733,6 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev,
                goto err_upper_unlink;
        }
-        bond->nest_level = dev_get_nest_level(bond_dev) + 1;
        /* If the mode uses primary, then the following is handled by
         * bond_change_active_slave().
         */
@@ -1816,7 +1814,8 @@ err_detach:
        slave_disable_netpoll(new_slave);
 err_close:
-        slave_dev->priv_flags &= ~IFF_BONDING;
+        if (!netif_is_bond_master(slave_dev))
+                slave_dev->priv_flags &= ~IFF_BONDING;
        dev_close(slave_dev);
 err_restore_mac:
@@ -1956,9 +1955,6 @@ static int __bond_release_one(struct net_device *bond_dev,
        if (!bond_has_slaves(bond)) {
                bond_set_carrier(bond);
                eth_hw_addr_random(bond_dev);
-                bond->nest_level = SINGLE_DEPTH_NESTING;
-        } else {
-                bond->nest_level = dev_get_nest_level(bond_dev) + 1;
        }
        unblock_netpoll_tx();
@@ -2017,7 +2013,8 @@ static int __bond_release_one(struct net_device *bond_dev,
        else
                dev_set_mtu(slave_dev, slave->original_mtu);
-        slave_dev->priv_flags &= ~IFF_BONDING;
+        if (!netif_is_bond_master(slave_dev))
+                slave_dev->priv_flags &= ~IFF_BONDING;
        bond_free_slave(slave);
@@ -3442,13 +3439,6 @@ static void bond_fold_stats(struct rtnl_link_stats64 *_res,
        }
 }
-static int bond_get_nest_level(struct net_device *bond_dev)
-{
-        struct bonding *bond = netdev_priv(bond_dev);
-        return bond->nest_level;
-}
 static void bond_get_stats(struct net_device *bond_dev,
                           struct rtnl_link_stats64 *stats)
 {
@@ -3457,7 +3447,7 @@ static void bond_get_stats(struct net_device *bond_dev,
        struct list_head *iter;
        struct slave *slave;
-        spin_lock_nested(&bond->stats_lock, bond_get_nest_level(bond_dev));
+        spin_lock(&bond->stats_lock);
        memcpy(stats, &bond->bond_stats, sizeof(*stats));
        rcu_read_lock();
@@ -4268,7 +4258,6 @@ static const struct net_device_ops bond_netdev_ops = {
        .ndo_neigh_setup        = bond_neigh_setup,
        .ndo_vlan_rx_add_vid    = bond_vlan_rx_add_vid,
        .ndo_vlan_rx_kill_vid   = bond_vlan_rx_kill_vid,
-        .ndo_get_lock_subclass  = bond_get_nest_level,
 #ifdef CONFIG_NET_POLL_CONTROLLER
        .ndo_netpoll_setup      = bond_netpoll_setup,
        .ndo_netpoll_cleanup    = bond_netpoll_cleanup,
@@ -4296,7 +4285,6 @@ void bond_setup(struct net_device *bond_dev)
        struct bonding *bond = netdev_priv(bond_dev);
        spin_lock_init(&bond->mode_lock);
-        spin_lock_init(&bond->stats_lock);
        bond->params = bonding_defaults;
        /* Initialize pointers */
@@ -4365,6 +4353,7 @@ static void bond_uninit(struct net_device *bond_dev)
        list_del(&bond->bond_list);
+        lockdep_unregister_key(&bond->stats_lock_key);
        bond_debug_unregister(bond);
 }
@@ -4768,8 +4757,9 @@ static int bond_init(struct net_device *bond_dev)
        if (!bond->wq)
                return -ENOMEM;
-        bond->nest_level = SINGLE_DEPTH_NESTING;
+        spin_lock_init(&bond->stats_lock);
-        netdev_lockdep_set_classes(bond_dev);
+        lockdep_register_key(&bond->stats_lock_key);
+        lockdep_set_class(&bond->stats_lock, &bond->stats_lock_key);
        list_add_tail(&bond->bond_list, &bn->dev_list);
diff --git a/drivers/net/dsa/bcm_sf2.c b/drivers/net/dsa/bcm_sf2.c
index 26509fa37a50..d44651ad520c 100644
--- a/drivers/net/dsa/bcm_sf2.c
+++ b/drivers/net/dsa/bcm_sf2.c
@@ -37,22 +37,11 @@ static void bcm_sf2_imp_setup(struct dsa_switch *ds, int port)
        unsigned int i;
        u32 reg, offset;
-        if (priv->type == BCM7445_DEVICE_ID)
-                offset = CORE_STS_OVERRIDE_IMP;
-        else
-                offset = CORE_STS_OVERRIDE_IMP2;
        /* Enable the port memories */
        reg = core_readl(priv, CORE_MEM_PSM_VDD_CTRL);
        reg &= ~P_TXQ_PSM_VDD(port);
        core_writel(priv, reg, CORE_MEM_PSM_VDD_CTRL);
-        /* Enable Broadcast, Multicast, Unicast forwarding to IMP port */
-        reg = core_readl(priv, CORE_IMP_CTL);
-        reg |= (RX_BCST_EN | RX_MCST_EN | RX_UCST_EN);
-        reg &= ~(RX_DIS | TX_DIS);
-        core_writel(priv, reg, CORE_IMP_CTL);
        /* Enable forwarding */
        core_writel(priv, SW_FWDG_EN, CORE_SWMODE);
@@ -71,10 +60,27 @@ static void bcm_sf2_imp_setup(struct dsa_switch *ds, int port)
        b53_brcm_hdr_setup(ds, port);
-        /* Force link status for IMP port */
+        if (port == 8) {
-        reg = core_readl(priv, offset);
+                if (priv->type == BCM7445_DEVICE_ID)
-        reg |= (MII_SW_OR | LINK_STS);
+                        offset = CORE_STS_OVERRIDE_IMP;
-        core_writel(priv, reg, offset);
+                else
+                        offset = CORE_STS_OVERRIDE_IMP2;
+                /* Force link status for IMP port */
+                reg = core_readl(priv, offset);
+                reg |= (MII_SW_OR | LINK_STS);
+                core_writel(priv, reg, offset);
+                /* Enable Broadcast, Multicast, Unicast forwarding to IMP port */
+                reg = core_readl(priv, CORE_IMP_CTL);
+                reg |= (RX_BCST_EN | RX_MCST_EN | RX_UCST_EN);
+                reg &= ~(RX_DIS | TX_DIS);
+                core_writel(priv, reg, CORE_IMP_CTL);
+        } else {
+                reg = core_readl(priv, CORE_G_PCTL_PORT(port));
+                reg &= ~(RX_DIS | TX_DIS);
+                core_writel(priv, reg, CORE_G_PCTL_PORT(port));
+        }
 }
 static void bcm_sf2_gphy_enable_set(struct dsa_switch *ds, bool enable)
diff --git a/drivers/net/dsa/sja1105/Kconfig b/drivers/net/dsa/sja1105/Kconfig
index f40b248f0b23..ffac0ea4e8d5 100644
--- a/drivers/net/dsa/sja1105/Kconfig
+++ b/drivers/net/dsa/sja1105/Kconfig
@@ -26,8 +26,8 @@ config NET_DSA_SJA1105_PTP
 config NET_DSA_SJA1105_TAS
        bool "Support for the Time-Aware Scheduler on NXP SJA1105"
-        depends on NET_DSA_SJA1105
+        depends on NET_DSA_SJA1105 && NET_SCH_TAPRIO
-        depends on NET_SCH_TAPRIO
+        depends on NET_SCH_TAPRIO=y || NET_DSA_SJA1105=m
        help
          This enables support for the TTEthernet-based egress scheduling
          engine in the SJA1105 DSA driver, which is controlled using a
diff --git a/drivers/net/ethernet/arc/emac_rockchip.c b/drivers/net/ethernet/arc/emac_rockchip.c
index 42d2e1b02c44..664d664e0925 100644
--- a/drivers/net/ethernet/arc/emac_rockchip.c
+++ b/drivers/net/ethernet/arc/emac_rockchip.c
@@ -256,6 +256,9 @@ static int emac_rockchip_remove(struct platform_device *pdev)
        if (priv->regulator)
                regulator_disable(priv->regulator);
+        if (priv->soc_data->need_div_macclk)
+                clk_disable_unprepare(priv->macclk);
        free_netdev(ndev);
        return err;
 }
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index b4a8cf620a0c..04ec909e06df 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -10382,7 +10382,8 @@ static void bnxt_cleanup_pci(struct bnxt *bp)
 {
        bnxt_unmap_bars(bp, bp->pdev);
        pci_release_regions(bp->pdev);
-        pci_disable_device(bp->pdev);
+        if (pci_is_enabled(bp->pdev))
+                pci_disable_device(bp->pdev);
 }
 static void bnxt_init_dflt_coal(struct bnxt *bp)
@@ -10669,14 +10670,11 @@ static void bnxt_fw_reset_task(struct work_struct *work)
                bp->fw_reset_state = BNXT_FW_RESET_STATE_RESET_FW;
        }
        /* fall through */
-        case BNXT_FW_RESET_STATE_RESET_FW: {
+        case BNXT_FW_RESET_STATE_RESET_FW:
-                u32 wait_dsecs = bp->fw_health->post_reset_wait_dsecs;
                bnxt_reset_all(bp);
                bp->fw_reset_state = BNXT_FW_RESET_STATE_ENABLE_DEV;
-                bnxt_queue_fw_reset_work(bp, wait_dsecs * HZ / 10);
+                bnxt_queue_fw_reset_work(bp, bp->fw_reset_min_dsecs * HZ / 10);
                return;
-        }
        case BNXT_FW_RESET_STATE_ENABLE_DEV:
                if (test_bit(BNXT_STATE_FW_FATAL_COND, &bp->state) &&
                    bp->fw_health) {
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c
index e664392dccc0..7151244f8c7d 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c
@@ -29,25 +29,20 @@ static int bnxt_fw_reporter_diagnose(struct devlink_health_reporter *reporter,
        val = bnxt_fw_health_readl(bp, BNXT_FW_HEALTH_REG);
        health_status = val & 0xffff;
-        if (health_status == BNXT_FW_STATUS_HEALTHY) {
+        if (health_status < BNXT_FW_STATUS_HEALTHY) {
-                rc = devlink_fmsg_string_pair_put(fmsg, "FW status",
+                rc = devlink_fmsg_string_pair_put(fmsg, "Description",
-                                                  "Healthy;");
+                                                  "Not yet completed initialization");
-                if (rc)
-                        return rc;
-        } else if (health_status < BNXT_FW_STATUS_HEALTHY) {
-                rc = devlink_fmsg_string_pair_put(fmsg, "FW status",
-                                                  "Not yet completed initialization;");
                if (rc)
                        return rc;
        } else if (health_status > BNXT_FW_STATUS_HEALTHY) {
-                rc = devlink_fmsg_string_pair_put(fmsg, "FW status",
+                rc = devlink_fmsg_string_pair_put(fmsg, "Description",
-                                                  "Encountered fatal error and cannot recover;");
+                                                  "Encountered fatal error and cannot recover");
                if (rc)
                        return rc;
        }
        if (val >> 16) {
-                rc = devlink_fmsg_u32_pair_put(fmsg, "Error", val >> 16);
+                rc = devlink_fmsg_u32_pair_put(fmsg, "Error code", val >> 16);
                if (rc)
                        return rc;
        }
@@ -215,25 +210,68 @@ enum bnxt_dl_param_id {
 static const struct bnxt_dl_nvm_param nvm_params[] = {
        {DEVLINK_PARAM_GENERIC_ID_ENABLE_SRIOV, NVM_OFF_ENABLE_SRIOV,
-         BNXT_NVM_SHARED_CFG, 1},
+         BNXT_NVM_SHARED_CFG, 1, 1},
        {DEVLINK_PARAM_GENERIC_ID_IGNORE_ARI, NVM_OFF_IGNORE_ARI,
-         BNXT_NVM_SHARED_CFG, 1},
+         BNXT_NVM_SHARED_CFG, 1, 1},
        {DEVLINK_PARAM_GENERIC_ID_MSIX_VEC_PER_PF_MAX,
-         NVM_OFF_MSIX_VEC_PER_PF_MAX, BNXT_NVM_SHARED_CFG, 10},
+         NVM_OFF_MSIX_VEC_PER_PF_MAX, BNXT_NVM_SHARED_CFG, 10, 4},
        {DEVLINK_PARAM_GENERIC_ID_MSIX_VEC_PER_PF_MIN,
-         NVM_OFF_MSIX_VEC_PER_PF_MIN, BNXT_NVM_SHARED_CFG, 7},
+         NVM_OFF_MSIX_VEC_PER_PF_MIN, BNXT_NVM_SHARED_CFG, 7, 4},
        {BNXT_DEVLINK_PARAM_ID_GRE_VER_CHECK, NVM_OFF_DIS_GRE_VER_CHECK,
-         BNXT_NVM_SHARED_CFG, 1},
+         BNXT_NVM_SHARED_CFG, 1, 1},
 };
+union bnxt_nvm_data {
+        u8      val8;
+        __le32  val32;
+};
+static void bnxt_copy_to_nvm_data(union bnxt_nvm_data *dst,
+                                  union devlink_param_value *src,
+                                  int nvm_num_bits, int dl_num_bytes)
+{
+        u32 val32 = 0;
+        if (nvm_num_bits == 1) {
+                dst->val8 = src->vbool;
+                return;
+        }
+        if (dl_num_bytes == 4)
+                val32 = src->vu32;
+        else if (dl_num_bytes == 2)
+                val32 = (u32)src->vu16;
+        else if (dl_num_bytes == 1)
+                val32 = (u32)src->vu8;
+        dst->val32 = cpu_to_le32(val32);
+}
+static void bnxt_copy_from_nvm_data(union devlink_param_value *dst,
+                                    union bnxt_nvm_data *src,
+                                    int nvm_num_bits, int dl_num_bytes)
+{
+        u32 val32;
+        if (nvm_num_bits == 1) {
+                dst->vbool = src->val8;
+                return;
+        }
+        val32 = le32_to_cpu(src->val32);
+        if (dl_num_bytes == 4)
+                dst->vu32 = val32;
+        else if (dl_num_bytes == 2)
+                dst->vu16 = (u16)val32;
+        else if (dl_num_bytes == 1)
+                dst->vu8 = (u8)val32;
+}
 static int bnxt_hwrm_nvm_req(struct bnxt *bp, u32 param_id, void *msg,
                             int msg_len, union devlink_param_value *val)
 {
        struct hwrm_nvm_get_variable_input *req = msg;
-        void *data_addr = NULL, *buf = NULL;
        struct bnxt_dl_nvm_param nvm_param;
-        int bytesize, idx = 0, rc, i;
+        union bnxt_nvm_data *data;
        dma_addr_t data_dma_addr;
+        int idx = 0, rc, i;
        /* Get/Set NVM CFG parameter is supported only on PFs */
        if (BNXT_VF(bp))
@@ -254,47 +292,31 @@ static int bnxt_hwrm_nvm_req(struct bnxt *bp, u32 param_id, void *msg,
        else if (nvm_param.dir_type == BNXT_NVM_FUNC_CFG)
                idx = bp->pf.fw_fid - BNXT_FIRST_PF_FID;
-        bytesize = roundup(nvm_param.num_bits, BITS_PER_BYTE) / BITS_PER_BYTE;
+        data = dma_alloc_coherent(&bp->pdev->dev, sizeof(*data),
-        switch (bytesize) {
+                                  &data_dma_addr, GFP_KERNEL);
-        case 1:
+        if (!data)
-                if (nvm_param.num_bits == 1)
-                        buf = &val->vbool;
-                else
-                        buf = &val->vu8;
-                break;
-        case 2:
-                buf = &val->vu16;
-                break;
-        case 4:
-                buf = &val->vu32;
-                break;
-        default:
-                return -EFAULT;
-        }
-        data_addr = dma_alloc_coherent(&bp->pdev->dev, bytesize,
-                                       &data_dma_addr, GFP_KERNEL);
-        if (!data_addr)
                return -ENOMEM;
        req->dest_data_addr = cpu_to_le64(data_dma_addr);
-        req->data_len = cpu_to_le16(nvm_param.num_bits);
+        req->data_len = cpu_to_le16(nvm_param.nvm_num_bits);
        req->option_num = cpu_to_le16(nvm_param.offset);
        req->index_0 = cpu_to_le16(idx);
        if (idx)
                req->dimensions = cpu_to_le16(1);
        if (req->req_type == cpu_to_le16(HWRM_NVM_SET_VARIABLE)) {
-                memcpy(data_addr, buf, bytesize);
+                bnxt_copy_to_nvm_data(data, val, nvm_param.nvm_num_bits,
+                                      nvm_param.dl_num_bytes);
                rc = hwrm_send_message(bp, msg, msg_len, HWRM_CMD_TIMEOUT);
        } else {
                rc = hwrm_send_message_silent(bp, msg, msg_len,
                                              HWRM_CMD_TIMEOUT);
+                if (!rc)
+                        bnxt_copy_from_nvm_data(val, data,
+                                                nvm_param.nvm_num_bits,
+                                                nvm_param.dl_num_bytes);
        }
-        if (!rc && req->req_type == cpu_to_le16(HWRM_NVM_GET_VARIABLE))
+        dma_free_coherent(&bp->pdev->dev, sizeof(*data), data, data_dma_addr);
-                memcpy(buf, data_addr, bytesize);
-        dma_free_coherent(&bp->pdev->dev, bytesize, data_addr, data_dma_addr);
        if (rc == -EACCES)
                netdev_err(bp->dev, "PF does not have admin privileges to modify NVM config\n");
        return rc;
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.h b/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.h
index b97e0baeb42d..2f4fd0a7d04b 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.h
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.h
@@ -52,7 +52,8 @@ struct bnxt_dl_nvm_param {
        u16 id;
        u16 offset;
        u16 dir_type;
-        u16 num_bits;
+        u16 nvm_num_bits;
+        u8 dl_num_bytes;
 };
 void bnxt_devlink_health_report(struct bnxt *bp, unsigned long event);
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.c
index a4dead4ab0ed..86b528d8364c 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.c
@@ -695,10 +695,10 @@ static void uld_init(struct adapter *adap, struct cxgb4_lld_info *lld)
        lld->write_cmpl_support = adap->params.write_cmpl_support;
 }
-static void uld_attach(struct adapter *adap, unsigned int uld)
+static int uld_attach(struct adapter *adap, unsigned int uld)
 {
-        void *handle;
        struct cxgb4_lld_info lli;
+        void *handle;
        uld_init(adap, &lli);
        uld_queue_init(adap, uld, &lli);
@@ -708,7 +708,7 @@ static void uld_attach(struct adapter *adap, unsigned int uld)
                dev_warn(adap->pdev_dev,
                         "could not attach to the %s driver, error %ld\n",
                         adap->uld[uld].name, PTR_ERR(handle));
-                return;
+                return PTR_ERR(handle);
        }
        adap->uld[uld].handle = handle;
@@ -716,22 +716,22 @@ static void uld_attach(struct adapter *adap, unsigned int uld)
        if (adap->flags & CXGB4_FULL_INIT_DONE)
                adap->uld[uld].state_change(handle, CXGB4_STATE_UP);
+        return 0;
 }
-/**
+/* cxgb4_register_uld - register an upper-layer driver
- *      cxgb4_register_uld - register an upper-layer driver
+ * @type: the ULD type
- *      @type: the ULD type
+ * @p: the ULD methods
- *      @p: the ULD methods
 *
- *      Registers an upper-layer driver with this driver and notifies the ULD
+ * Registers an upper-layer driver with this driver and notifies the ULD
- *      about any presently available devices that support its type.  Returns
+ * about any presently available devices that support its type.
- *      %-EBUSY if a ULD of the same type is already registered.
 */
 void cxgb4_register_uld(enum cxgb4_uld type,
                        const struct cxgb4_uld_info *p)
 {
-        int ret = 0;
        struct adapter *adap;
+        int ret = 0;
        if (type >= CXGB4_ULD_MAX)
                return;
@@ -763,8 +763,12 @@ void cxgb4_register_uld(enum cxgb4_uld type,
                if (ret)
                        goto free_irq;
                adap->uld[type] = *p;
-                uld_attach(adap, type);
+                ret = uld_attach(adap, type);
+                if (ret)
+                        goto free_txq;
                continue;
+free_txq:
+                release_sge_txq_uld(adap, type);
 free_irq:
                if (adap->flags & CXGB4_FULL_INIT_DONE)
                        quiesce_rx_uld(adap, type);
diff --git a/drivers/net/ethernet/chelsio/cxgb4/sge.c b/drivers/net/ethernet/chelsio/cxgb4/sge.c
index b3da81e90132..928bfea5457b 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/sge.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/sge.c
@@ -3791,15 +3791,11 @@ int t4_sge_alloc_eth_txq(struct adapter *adap, struct sge_eth_txq *txq,
         * write the CIDX Updates into the Status Page at the end of the
         * TX Queue.
         */
-        c.autoequiqe_to_viid = htonl((dbqt
+        c.autoequiqe_to_viid = htonl(FW_EQ_ETH_CMD_AUTOEQUEQE_F |
-                                      ? FW_EQ_ETH_CMD_AUTOEQUIQE_F
-                                      : FW_EQ_ETH_CMD_AUTOEQUEQE_F) |
                                     FW_EQ_ETH_CMD_VIID_V(pi->viid));
        c.fetchszm_to_iqid =
-                htonl(FW_EQ_ETH_CMD_HOSTFCMODE_V(dbqt
+                htonl(FW_EQ_ETH_CMD_HOSTFCMODE_V(HOSTFCMODE_STATUS_PAGE_X) |
-                                                 ? HOSTFCMODE_INGRESS_QUEUE_X
-                                                 : HOSTFCMODE_STATUS_PAGE_X) |
                      FW_EQ_ETH_CMD_PCIECHN_V(pi->tx_chan) |
                      FW_EQ_ETH_CMD_FETCHRO_F | FW_EQ_ETH_CMD_IQID_V(iqid));
diff --git a/drivers/net/ethernet/cortina/gemini.h b/drivers/net/ethernet/cortina/gemini.h
index 0b12f89bf89a..9fdf77d5eb37 100644
--- a/drivers/net/ethernet/cortina/gemini.h
+++ b/drivers/net/ethernet/cortina/gemini.h
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: GPL-2.0
+/* SPDX-License-Identifier: GPL-2.0 */
 /* Register definitions for Gemini GMAC Ethernet device driver
 *
 * Copyright (C) 2006 Storlink, Corp.
diff --git a/drivers/net/ethernet/faraday/ftgmac100.c b/drivers/net/ethernet/faraday/ftgmac100.c
index 9b7af94a40bb..96e9565f1e08 100644
--- a/drivers/net/ethernet/faraday/ftgmac100.c
+++ b/drivers/net/ethernet/faraday/ftgmac100.c
@@ -727,6 +727,18 @@ static netdev_tx_t ftgmac100_hard_start_xmit(struct sk_buff *skb,
         */
        nfrags = skb_shinfo(skb)->nr_frags;
+        /* Setup HW checksumming */
+        csum_vlan = 0;
+        if (skb->ip_summed == CHECKSUM_PARTIAL &&
+            !ftgmac100_prep_tx_csum(skb, &csum_vlan))
+                goto drop;
+        /* Add VLAN tag */
+        if (skb_vlan_tag_present(skb)) {
+                csum_vlan |= FTGMAC100_TXDES1_INS_VLANTAG;
+                csum_vlan |= skb_vlan_tag_get(skb) & 0xffff;
+        }
        /* Get header len */
        len = skb_headlen(skb);
@@ -753,19 +765,6 @@ static netdev_tx_t ftgmac100_hard_start_xmit(struct sk_buff *skb,
        if (nfrags == 0)
                f_ctl_stat |= FTGMAC100_TXDES0_LTS;
        txdes->txdes3 = cpu_to_le32(map);
-        /* Setup HW checksumming */
-        csum_vlan = 0;
-        if (skb->ip_summed == CHECKSUM_PARTIAL &&
-            !ftgmac100_prep_tx_csum(skb, &csum_vlan))
-                goto drop;
-        /* Add VLAN tag */
-        if (skb_vlan_tag_present(skb)) {
-                csum_vlan |= FTGMAC100_TXDES1_INS_VLANTAG;
-                csum_vlan |= skb_vlan_tag_get(skb) & 0xffff;
-        }
        txdes->txdes1 = cpu_to_le32(csum_vlan);
        /* Next descriptor */
diff --git a/drivers/net/ethernet/freescale/dpaa2/dpaa2-ptp.h b/drivers/net/ethernet/freescale/dpaa2/dpaa2-ptp.h
index ff2e177395d4..df2458a5e9ef 100644
--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-ptp.h
+++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-ptp.h
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: GPL-2.0
+/* SPDX-License-Identifier: GPL-2.0 */
 /*
 * Copyright 2018 NXP
 */
diff --git a/drivers/net/ethernet/freescale/dpaa2/dprtc-cmd.h b/drivers/net/ethernet/freescale/dpaa2/dprtc-cmd.h
index 720cd50f5895..4ac05bfef338 100644
--- a/drivers/net/ethernet/freescale/dpaa2/dprtc-cmd.h
+++ b/drivers/net/ethernet/freescale/dpaa2/dprtc-cmd.h
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: GPL-2.0
+/* SPDX-License-Identifier: GPL-2.0 */
 /*
 * Copyright 2013-2016 Freescale Semiconductor Inc.
 * Copyright 2016-2018 NXP
diff --git a/drivers/net/ethernet/freescale/dpaa2/dprtc.h b/drivers/net/ethernet/freescale/dpaa2/dprtc.h
index be7914c1634d..311c184e1aef 100644
--- a/drivers/net/ethernet/freescale/dpaa2/dprtc.h
+++ b/drivers/net/ethernet/freescale/dpaa2/dprtc.h
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: GPL-2.0
+/* SPDX-License-Identifier: GPL-2.0 */
 /*
 * Copyright 2013-2016 Freescale Semiconductor Inc.
 * Copyright 2016-2018 NXP
diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index d4d4c72adf49..22c01b224baa 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -3558,7 +3558,7 @@ fec_probe(struct platform_device *pdev)
        for (i = 0; i < irq_cnt; i++) {
                snprintf(irq_name, sizeof(irq_name), "int%d", i);
-                irq = platform_get_irq_byname(pdev, irq_name);
+                irq = platform_get_irq_byname_optional(pdev, irq_name);
                if (irq < 0)
                        irq = platform_get_irq(pdev, i);
                if (irq < 0) {
diff --git a/drivers/net/ethernet/freescale/fec_ptp.c b/drivers/net/ethernet/freescale/fec_ptp.c
index 19e2365be7d8..945643c02615 100644
--- a/drivers/net/ethernet/freescale/fec_ptp.c
+++ b/drivers/net/ethernet/freescale/fec_ptp.c
@@ -600,9 +600,9 @@ void fec_ptp_init(struct platform_device *pdev, int irq_idx)
        INIT_DELAYED_WORK(&fep->time_keep, fec_time_keep);
-        irq = platform_get_irq_byname(pdev, "pps");
+        irq = platform_get_irq_byname_optional(pdev, "pps");
        if (irq < 0)
-                irq = platform_get_irq(pdev, irq_idx);
+                irq = platform_get_irq_optional(pdev, irq_idx);
        /* Failure to get an irq is not fatal,
         * only the PTP_CLOCK_PPS clock events should stop
         */
diff --git a/drivers/net/ethernet/google/gve/gve_rx.c b/drivers/net/ethernet/google/gve/gve_rx.c
index 59564ac99d2a..edec61dfc868 100644
--- a/drivers/net/ethernet/google/gve/gve_rx.c
+++ b/drivers/net/ethernet/google/gve/gve_rx.c
@@ -289,6 +289,8 @@ static bool gve_rx(struct gve_rx_ring *rx, struct gve_rx_desc *rx_desc,
        len = be16_to_cpu(rx_desc->len) - GVE_RX_PAD;
        page_info = &rx->data.page_info[idx];
+        dma_sync_single_for_cpu(&priv->pdev->dev, rx->data.qpl->page_buses[idx],
+                                PAGE_SIZE, DMA_FROM_DEVICE);
        /* gvnic can only receive into registered segments. If the buffer
         * can't be recycled, our only choice is to copy the data out of
diff --git a/drivers/net/ethernet/google/gve/gve_tx.c b/drivers/net/ethernet/google/gve/gve_tx.c
index 778b87b5a06c..0a9a7ee2a866 100644
--- a/drivers/net/ethernet/google/gve/gve_tx.c
+++ b/drivers/net/ethernet/google/gve/gve_tx.c
@@ -390,7 +390,21 @@ static void gve_tx_fill_seg_desc(union gve_tx_desc *seg_desc,
        seg_desc->seg.seg_addr = cpu_to_be64(addr);
 }
-static int gve_tx_add_skb(struct gve_tx_ring *tx, struct sk_buff *skb)
+static void gve_dma_sync_for_device(struct device *dev, dma_addr_t *page_buses,
+                                    u64 iov_offset, u64 iov_len)
+{
+        dma_addr_t dma;
+        u64 addr;
+        for (addr = iov_offset; addr < iov_offset + iov_len;
+             addr += PAGE_SIZE) {
+                dma = page_buses[addr / PAGE_SIZE];
+                dma_sync_single_for_device(dev, dma, PAGE_SIZE, DMA_TO_DEVICE);
+        }
+}
+static int gve_tx_add_skb(struct gve_tx_ring *tx, struct sk_buff *skb,
+                          struct device *dev)
 {
        int pad_bytes, hlen, hdr_nfrags, payload_nfrags, l4_hdr_offset;
        union gve_tx_desc *pkt_desc, *seg_desc;
@@ -432,6 +446,9 @@ static int gve_tx_add_skb(struct gve_tx_ring *tx, struct sk_buff *skb)
        skb_copy_bits(skb, 0,
                      tx->tx_fifo.base + info->iov[hdr_nfrags - 1].iov_offset,
                      hlen);
+        gve_dma_sync_for_device(dev, tx->tx_fifo.qpl->page_buses,
+                                info->iov[hdr_nfrags - 1].iov_offset,
+                                info->iov[hdr_nfrags - 1].iov_len);
        copy_offset = hlen;
        for (i = payload_iov; i < payload_nfrags + payload_iov; i++) {
@@ -445,6 +462,9 @@ static int gve_tx_add_skb(struct gve_tx_ring *tx, struct sk_buff *skb)
                skb_copy_bits(skb, copy_offset,
                              tx->tx_fifo.base + info->iov[i].iov_offset,
                              info->iov[i].iov_len);
+                gve_dma_sync_for_device(dev, tx->tx_fifo.qpl->page_buses,
+                                        info->iov[i].iov_offset,
+                                        info->iov[i].iov_len);
                copy_offset += info->iov[i].iov_len;
        }
@@ -473,7 +493,7 @@ netdev_tx_t gve_tx(struct sk_buff *skb, struct net_device *dev)
                gve_tx_put_doorbell(priv, tx->q_resources, tx->req);
                return NETDEV_TX_BUSY;
        }
-        nsegs = gve_tx_add_skb(tx, skb);
+        nsegs = gve_tx_add_skb(tx, skb, &priv->pdev->dev);
        netdev_tx_sent_queue(tx->netdev_txq, skb->len);
        skb_tx_timestamp(skb);
diff --git a/drivers/net/ethernet/hisilicon/hip04_eth.c b/drivers/net/ethernet/hisilicon/hip04_eth.c
index c84167447abe..4606a7e4a6d1 100644
--- a/drivers/net/ethernet/hisilicon/hip04_eth.c
+++ b/drivers/net/ethernet/hisilicon/hip04_eth.c
@@ -237,6 +237,7 @@ struct hip04_priv {
        dma_addr_t rx_phys[RX_DESC_NUM];
        unsigned int rx_head;
        unsigned int rx_buf_size;
+        unsigned int rx_cnt_remaining;
        struct device_node *phy_node;
        struct phy_device *phy;
@@ -575,7 +576,6 @@ static int hip04_rx_poll(struct napi_struct *napi, int budget)
        struct hip04_priv *priv = container_of(napi, struct hip04_priv, napi);
        struct net_device *ndev = priv->ndev;
        struct net_device_stats *stats = &ndev->stats;
-        unsigned int cnt = hip04_recv_cnt(priv);
        struct rx_desc *desc;
        struct sk_buff *skb;
        unsigned char *buf;
@@ -588,8 +588,8 @@ static int hip04_rx_poll(struct napi_struct *napi, int budget)
        /* clean up tx descriptors */
        tx_remaining = hip04_tx_reclaim(ndev, false);
+        priv->rx_cnt_remaining += hip04_recv_cnt(priv);
-        while (cnt && !last) {
+        while (priv->rx_cnt_remaining && !last) {
                buf = priv->rx_buf[priv->rx_head];
                skb = build_skb(buf, priv->rx_buf_size);
                if (unlikely(!skb)) {
@@ -635,11 +635,13 @@ refill:
                hip04_set_recv_desc(priv, phys);
                priv->rx_head = RX_NEXT(priv->rx_head);
-                if (rx >= budget)
+                if (rx >= budget) {
+                        --priv->rx_cnt_remaining;
                        goto done;
+                }
-                if (--cnt == 0)
+                if (--priv->rx_cnt_remaining == 0)
-                        cnt = hip04_recv_cnt(priv);
+                        priv->rx_cnt_remaining += hip04_recv_cnt(priv);
        }
        if (!(priv->reg_inten & RCV_INT)) {
@@ -724,6 +726,7 @@ static int hip04_mac_open(struct net_device *ndev)
        int i;
        priv->rx_head = 0;
+        priv->rx_cnt_remaining = 0;
        priv->tx_head = 0;
        priv->tx_tail = 0;
        hip04_reset_ppe(priv);
@@ -1038,7 +1041,6 @@ static int hip04_remove(struct platform_device *pdev)
        hip04_free_ring(ndev, d);
        unregister_netdev(ndev);
-        free_irq(ndev->irq, ndev);
        of_node_put(priv->phy_node);
        cancel_work_sync(&priv->tx_timeout_task);
        free_netdev(ndev);
diff --git a/drivers/net/ethernet/intel/e1000/e1000_ethtool.c b/drivers/net/ethernet/intel/e1000/e1000_ethtool.c
index 71d3d8854d8f..be56e631d693 100644
--- a/drivers/net/ethernet/intel/e1000/e1000_ethtool.c
+++ b/drivers/net/ethernet/intel/e1000/e1000_ethtool.c
@@ -607,6 +607,7 @@ static int e1000_set_ringparam(struct net_device *netdev,
        for (i = 0; i < adapter->num_rx_queues; i++)
                rxdr[i].count = rxdr->count;
+        err = 0;
        if (netif_running(adapter->netdev)) {
                /* Try to get new resources before deleting old */
                err = e1000_setup_all_rx_resources(adapter);
@@ -627,14 +628,13 @@ static int e1000_set_ringparam(struct net_device *netdev,
                adapter->rx_ring = rxdr;
                adapter->tx_ring = txdr;
                err = e1000_up(adapter);
-                if (err)
-                        goto err_setup;
        }
        kfree(tx_old);
        kfree(rx_old);
        clear_bit(__E1000_RESETTING, &adapter->flags);
-        return 0;
+        return err;
 err_setup_tx:
        e1000_free_all_rx_resources(adapter);
 err_setup_rx:
@@ -646,7 +646,6 @@ err_alloc_rx:
 err_alloc_tx:
        if (netif_running(adapter->netdev))
                e1000_up(adapter);
-err_setup:
        clear_bit(__E1000_RESETTING, &adapter->flags);
        return err;
 }
diff --git a/drivers/net/ethernet/intel/i40e/i40e_xsk.c b/drivers/net/ethernet/intel/i40e/i40e_xsk.c
index b1c3227ae4ab..a05dfecdd9b4 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_xsk.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_xsk.c
@@ -157,11 +157,6 @@ static int i40e_xsk_umem_disable(struct i40e_vsi *vsi, u16 qid)
                err = i40e_queue_pair_enable(vsi, qid);
                if (err)
                        return err;
-                /* Kick start the NAPI context so that receiving will start */
-                err = i40e_xsk_wakeup(vsi->netdev, qid, XDP_WAKEUP_RX);
-                if (err)
-                        return err;
        }
        return 0;
diff --git a/drivers/net/ethernet/intel/igb/e1000_82575.c b/drivers/net/ethernet/intel/igb/e1000_82575.c
index 3ec2ce0725d5..8a6ef3514129 100644
--- a/drivers/net/ethernet/intel/igb/e1000_82575.c
+++ b/drivers/net/ethernet/intel/igb/e1000_82575.c
@@ -466,7 +466,7 @@ static s32 igb_init_mac_params_82575(struct e1000_hw *hw)
                        ? igb_setup_copper_link_82575
                        : igb_setup_serdes_link_82575;
-        if (mac->type == e1000_82580) {
+        if (mac->type == e1000_82580 || mac->type == e1000_i350) {
                switch (hw->device_id) {
                /* feature not supported on these id's */
                case E1000_DEV_ID_DH89XXCC_SGMII:
diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
index 105b0624081a..9148c62d9ac5 100644
--- a/drivers/net/ethernet/intel/igb/igb_main.c
+++ b/drivers/net/ethernet/intel/igb/igb_main.c
@@ -753,7 +753,8 @@ u32 igb_rd32(struct e1000_hw *hw, u32 reg)
                struct net_device *netdev = igb->netdev;
                hw->hw_addr = NULL;
                netdev_err(netdev, "PCIe link lost\n");
-                WARN(1, "igb: Failed to read reg 0x%x!\n", reg);
+                WARN(pci_device_is_present(igb->pdev),
+                     "igb: Failed to read reg 0x%x!\n", reg);
        }
        return value;
@@ -2064,7 +2065,8 @@ static void igb_check_swap_media(struct igb_adapter *adapter)
        if ((hw->phy.media_type == e1000_media_type_copper) &&
            (!(connsw & E1000_CONNSW_AUTOSENSE_EN))) {
                swap_now = true;
-        } else if (!(connsw & E1000_CONNSW_SERDESD)) {
+        } else if ((hw->phy.media_type != e1000_media_type_copper) &&
+                   !(connsw & E1000_CONNSW_SERDESD)) {
                /* copper signal takes time to appear */
                if (adapter->copper_tries < 4) {
                        adapter->copper_tries++;
@@ -2370,7 +2372,7 @@ void igb_reset(struct igb_adapter *adapter)
                adapter->ei.get_invariants(hw);
                adapter->flags &= ~IGB_FLAG_MEDIA_RESET;
        }
-        if ((mac->type == e1000_82575) &&
+        if ((mac->type == e1000_82575 || mac->type == e1000_i350) &&
            (adapter->flags & IGB_FLAG_MAS_ENABLE)) {
                igb_enable_mas(adapter);
        }
diff --git a/drivers/net/ethernet/intel/igc/igc_main.c b/drivers/net/ethernet/intel/igc/igc_main.c
index 63b62d74f961..8e424dfab12e 100644
--- a/drivers/net/ethernet/intel/igc/igc_main.c
+++ b/drivers/net/ethernet/intel/igc/igc_main.c
@@ -4047,7 +4047,8 @@ u32 igc_rd32(struct igc_hw *hw, u32 reg)
                hw->hw_addr = NULL;
                netif_device_detach(netdev);
                netdev_err(netdev, "PCIe link lost, device now detached\n");
-                WARN(1, "igc: Failed to read reg 0x%x!\n", reg);
+                WARN(pci_device_is_present(igc->pdev),
+                     "igc: Failed to read reg 0x%x!\n", reg);
        }
        return value;
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
index 1ce2397306b9..91b3780ddb04 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
@@ -4310,7 +4310,6 @@ static void ixgbe_set_rx_buffer_len(struct ixgbe_adapter *adapter)
                if (test_bit(__IXGBE_RX_FCOE, &rx_ring->state))
                        set_bit(__IXGBE_RX_3K_BUFFER, &rx_ring->state);
-                clear_bit(__IXGBE_RX_BUILD_SKB_ENABLED, &rx_ring->state);
                if (adapter->flags2 & IXGBE_FLAG2_RX_LEGACY)
                        continue;
diff --git a/drivers/net/ethernet/marvell/mvneta_bm.h b/drivers/net/ethernet/marvell/mvneta_bm.h
index c8425d35c049..e47783ce77e0 100644
--- a/drivers/net/ethernet/marvell/mvneta_bm.h
+++ b/drivers/net/ethernet/marvell/mvneta_bm.h
@@ -160,16 +160,23 @@ static inline u32 mvneta_bm_pool_get_bp(struct mvneta_bm *priv,
                             (bm_pool->id << MVNETA_BM_POOL_ACCESS_OFFS));
 }
 #else
-void mvneta_bm_pool_destroy(struct mvneta_bm *priv,
+static inline void mvneta_bm_pool_destroy(struct mvneta_bm *priv,
-                            struct mvneta_bm_pool *bm_pool, u8 port_map) {}
+                                          struct mvneta_bm_pool *bm_pool,
-void mvneta_bm_bufs_free(struct mvneta_bm *priv, struct mvneta_bm_pool *bm_pool,
+                                          u8 port_map) {}
-                         u8 port_map) {}
+static inline void mvneta_bm_bufs_free(struct mvneta_bm *priv,
-int mvneta_bm_construct(struct hwbm_pool *hwbm_pool, void *buf) { return 0; }
+                                       struct mvneta_bm_pool *bm_pool,
-int mvneta_bm_pool_refill(struct mvneta_bm *priv,
+                                       u8 port_map) {}
-                          struct mvneta_bm_pool *bm_pool) {return 0; }
+static inline int mvneta_bm_construct(struct hwbm_pool *hwbm_pool, void *buf)
-struct mvneta_bm_pool *mvneta_bm_pool_use(struct mvneta_bm *priv, u8 pool_id,
+{ return 0; }
-                                          enum mvneta_bm_type type, u8 port_id,
+static inline int mvneta_bm_pool_refill(struct mvneta_bm *priv,
-                                          int pkt_size) { return NULL; }
+                                        struct mvneta_bm_pool *bm_pool)
+{ return 0; }
+static inline struct mvneta_bm_pool *mvneta_bm_pool_use(struct mvneta_bm *priv,
+                                                        u8 pool_id,
+                                                        enum mvneta_bm_type type,
+                                                        u8 port_id,
+                                                        int pkt_size)
+{ return NULL; }
 static inline void mvneta_bm_pool_put_bp(struct mvneta_bm *priv,
                                         struct mvneta_bm_pool *bm_pool,
@@ -178,7 +185,8 @@ static inline void mvneta_bm_pool_put_bp(struct mvneta_bm *priv,
 static inline u32 mvneta_bm_pool_get_bp(struct mvneta_bm *priv,
                                        struct mvneta_bm_pool *bm_pool)
 { return 0; }
-struct mvneta_bm *mvneta_bm_get(struct device_node *node) { return NULL; }
+static inline struct mvneta_bm *mvneta_bm_get(struct device_node *node)
-void mvneta_bm_put(struct mvneta_bm *priv) {}
+{ return NULL; }
+static inline void mvneta_bm_put(struct mvneta_bm *priv) {}
 #endif /* CONFIG_MVNETA_BM */
 #endif
diff --git a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
index 4356f3a58002..1187ef1375e2 100644
--- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
+++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
@@ -471,12 +471,31 @@ void mlx4_init_quotas(struct mlx4_dev *dev)
                priv->mfunc.master.res_tracker.res_alloc[RES_MPT].quota[pf];
 }
-static int get_max_gauranteed_vfs_counter(struct mlx4_dev *dev)
+static int
+mlx4_calc_res_counter_guaranteed(struct mlx4_dev *dev,
+                                 struct resource_allocator *res_alloc,
+                                 int vf)
 {
-        /* reduce the sink counter */
+        struct mlx4_active_ports actv_ports;
-        return (dev->caps.max_counters - 1 -
+        int ports, counters_guaranteed;
-                (MLX4_PF_COUNTERS_PER_PORT * MLX4_MAX_PORTS))
-                / MLX4_MAX_PORTS;
+        /* For master, only allocate according to the number of phys ports */
+        if (vf == mlx4_master_func_num(dev))
+                return MLX4_PF_COUNTERS_PER_PORT * dev->caps.num_ports;
+        /* calculate real number of ports for the VF */
+        actv_ports = mlx4_get_active_ports(dev, vf);
+        ports = bitmap_weight(actv_ports.ports, dev->caps.num_ports);
+        counters_guaranteed = ports * MLX4_VF_COUNTERS_PER_PORT;
+        /* If we do not have enough counters for this VF, do not
+         * allocate any for it. '-1' to reduce the sink counter.
+         */
+        if ((res_alloc->res_reserved + counters_guaranteed) >
+            (dev->caps.max_counters - 1))
+                return 0;
+        return counters_guaranteed;
 }
 int mlx4_init_resource_tracker(struct mlx4_dev *dev)
@@ -484,7 +503,6 @@ int mlx4_init_resource_tracker(struct mlx4_dev *dev)
        struct mlx4_priv *priv = mlx4_priv(dev);
        int i, j;
        int t;
-        int max_vfs_guarantee_counter = get_max_gauranteed_vfs_counter(dev);
        priv->mfunc.master.res_tracker.slave_list =
                kcalloc(dev->num_slaves, sizeof(struct slave_list),
@@ -603,16 +621,8 @@ int mlx4_init_resource_tracker(struct mlx4_dev *dev)
                                break;
                        case RES_COUNTER:
                                res_alloc->quota[t] = dev->caps.max_counters;
-                                if (t == mlx4_master_func_num(dev))
+                                res_alloc->guaranteed[t] =
-                                        res_alloc->guaranteed[t] =
+                                        mlx4_calc_res_counter_guaranteed(dev, res_alloc, t);
-                                                MLX4_PF_COUNTERS_PER_PORT *
-                                                MLX4_MAX_PORTS;
-                                else if (t <= max_vfs_guarantee_counter)
-                                        res_alloc->guaranteed[t] =
-                                                MLX4_VF_COUNTERS_PER_PORT *
-                                                MLX4_MAX_PORTS;
-                                else
-                                        res_alloc->guaranteed[t] = 0;
                                break;
                        default:
                                break;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h
index 8d76452cacdc..f1a7bc46f1c0 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h
@@ -345,7 +345,7 @@ struct mlx5e_tx_wqe_info {
        u8  num_wqebbs;
        u8  num_dma;
 #ifdef CONFIG_MLX5_EN_TLS
-        skb_frag_t *resync_dump_frag;
+        struct page *resync_dump_frag_page;
 #endif
 };
@@ -410,6 +410,7 @@ struct mlx5e_txqsq {
        struct device             *pdev;
        __be32                     mkey_be;
        unsigned long              state;
+        unsigned int               hw_mtu;
        struct hwtstamp_config    *tstamp;
        struct mlx5_clock         *clock;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/hv_vhca_stats.c b/drivers/net/ethernet/mellanox/mlx5/core/en/hv_vhca_stats.c
index b3a249b2a482..ac44bbe95c5c 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/hv_vhca_stats.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/hv_vhca_stats.c
@@ -141,7 +141,7 @@ int mlx5e_hv_vhca_stats_create(struct mlx5e_priv *priv)
                                    "Failed to create hv vhca stats agent, err = %ld\n",
                                    PTR_ERR(agent));
-                kfree(priv->stats_agent.buf);
+                kvfree(priv->stats_agent.buf);
                return IS_ERR_OR_NULL(agent);
        }
@@ -157,5 +157,5 @@ void mlx5e_hv_vhca_stats_destroy(struct mlx5e_priv *priv)
                return;
        mlx5_hv_vhca_agent_destroy(priv->stats_agent.agent);
-        kfree(priv->stats_agent.buf);
+        kvfree(priv->stats_agent.buf);
 }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c
index f8ee18b4da6f..13af72556987 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c
@@ -97,15 +97,19 @@ static int mlx5e_route_lookup_ipv4(struct mlx5e_priv *priv,
        if (ret)
                return ret;
-        if (mlx5_lag_is_multipath(mdev) && rt->rt_gw_family != AF_INET)
+        if (mlx5_lag_is_multipath(mdev) && rt->rt_gw_family != AF_INET) {
+                ip_rt_put(rt);
                return -ENETUNREACH;
+        }
 #else
        return -EOPNOTSUPP;
 #endif
        ret = get_route_and_out_devs(priv, rt->dst.dev, route_dev, out_dev);
-        if (ret < 0)
+        if (ret < 0) {
+                ip_rt_put(rt);
                return ret;
+        }
        if (!(*out_ttl))
                *out_ttl = ip4_dst_hoplimit(&rt->dst);
@@ -149,8 +153,10 @@ static int mlx5e_route_lookup_ipv6(struct mlx5e_priv *priv,
                *out_ttl = ip6_dst_hoplimit(dst);
        ret = get_route_and_out_devs(priv, dst->dev, route_dev, out_dev);
-        if (ret < 0)
+        if (ret < 0) {
+                dst_release(dst);
                return ret;
+        }
 #else
        return -EOPNOTSUPP;
 #endif
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/txrx.h b/drivers/net/ethernet/mellanox/mlx5/core/en/txrx.h
index 87be96747902..7c8796d9743f 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/txrx.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/txrx.h
@@ -15,15 +15,14 @@
 #else
 /* TLS offload requires additional stop_room for:
 *  - a resync SKB.
- * kTLS offload requires additional stop_room for:
+ * kTLS offload requires fixed additional stop_room for:
- * - static params WQE,
+ * - a static params WQE, and a progress params WQE.
- * - progress params WQE, and
+ * The additional MTU-depending room for the resync DUMP WQEs
- * - resync DUMP per frag.
+ * will be calculated and added in runtime.
 */
 #define MLX5E_SQ_TLS_ROOM  \
        (MLX5_SEND_WQE_MAX_WQEBBS + \
-         MLX5E_KTLS_STATIC_WQEBBS + MLX5E_KTLS_PROGRESS_WQEBBS + \
+         MLX5E_KTLS_STATIC_WQEBBS + MLX5E_KTLS_PROGRESS_WQEBBS)
-         MAX_SKB_FRAGS * MLX5E_KTLS_MAX_DUMP_WQEBBS)
 #endif
 #define INL_HDR_START_SZ (sizeof(((struct mlx5_wqe_eth_seg *)NULL)->inline_hdr.start))
@@ -92,7 +91,7 @@ mlx5e_fill_sq_frag_edge(struct mlx5e_txqsq *sq, struct mlx5_wq_cyc *wq,
        /* fill sq frag edge with nops to avoid wqe wrapping two pages */
        for (; wi < edge_wi; wi++) {
-                wi->skb        = NULL;
+                memset(wi, 0, sizeof(*wi));
                wi->num_wqebbs = 1;
                mlx5e_post_nop(wq, sq->sqn, &sq->pc);
        }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls.c
index d2ff74d52720..46725cd743a3 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls.c
@@ -38,7 +38,7 @@ static int mlx5e_ktls_add(struct net_device *netdev, struct sock *sk,
                return -ENOMEM;
        tx_priv->expected_seq = start_offload_tcp_sn;
-        tx_priv->crypto_info  = crypto_info;
+        tx_priv->crypto_info  = *(struct tls12_crypto_info_aes_gcm_128 *)crypto_info;
        mlx5e_set_ktls_tx_priv_ctx(tls_ctx, tx_priv);
        /* tc and underlay_qpn values are not in use for tls tis */
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls.h b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls.h
index b7298f9ee3d3..a3efa29a4629 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls.h
@@ -21,7 +21,14 @@
         MLX5_ST_SZ_BYTES(tls_progress_params))
 #define MLX5E_KTLS_PROGRESS_WQEBBS \
        (DIV_ROUND_UP(MLX5E_KTLS_PROGRESS_WQE_SZ, MLX5_SEND_WQE_BB))
-#define MLX5E_KTLS_MAX_DUMP_WQEBBS 2
+struct mlx5e_dump_wqe {
+        struct mlx5_wqe_ctrl_seg ctrl;
+        struct mlx5_wqe_data_seg data;
+};
+#define MLX5E_KTLS_DUMP_WQEBBS \
+        (DIV_ROUND_UP(sizeof(struct mlx5e_dump_wqe), MLX5_SEND_WQE_BB))
 enum {
        MLX5E_TLS_PROGRESS_PARAMS_AUTH_STATE_NO_OFFLOAD     = 0,
@@ -37,7 +44,7 @@ enum {
 struct mlx5e_ktls_offload_context_tx {
        struct tls_offload_context_tx *tx_ctx;
-        struct tls_crypto_info *crypto_info;
+        struct tls12_crypto_info_aes_gcm_128 crypto_info;
        u32 expected_seq;
        u32 tisn;
        u32 key_id;
@@ -86,14 +93,28 @@ struct sk_buff *mlx5e_ktls_handle_tx_skb(struct net_device *netdev,
                                         struct mlx5e_tx_wqe **wqe, u16 *pi);
 void mlx5e_ktls_tx_handle_resync_dump_comp(struct mlx5e_txqsq *sq,
                                           struct mlx5e_tx_wqe_info *wi,
-                                           struct mlx5e_sq_dma *dma);
+                                           u32 *dma_fifo_cc);
+static inline u8
+mlx5e_ktls_dumps_num_wqebbs(struct mlx5e_txqsq *sq, unsigned int nfrags,
+                            unsigned int sync_len)
+{
+        /* Given the MTU and sync_len, calculates an upper bound for the
+         * number of WQEBBs needed for the TX resync DUMP WQEs of a record.
+         */
+        return MLX5E_KTLS_DUMP_WQEBBS *
+                (nfrags + DIV_ROUND_UP(sync_len, sq->hw_mtu));
+}
 #else
 static inline void mlx5e_ktls_build_netdev(struct mlx5e_priv *priv)
 {
 }
+static inline void
+mlx5e_ktls_tx_handle_resync_dump_comp(struct mlx5e_txqsq *sq,
+                                      struct mlx5e_tx_wqe_info *wi,
+                                      u32 *dma_fifo_cc) {}
 #endif
 #endif /* __MLX5E_TLS_H__ */
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_tx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_tx.c
index d195366461c9..778dab1af8fc 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_tx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_tx.c
@@ -24,17 +24,12 @@ enum {
 static void
 fill_static_params_ctx(void *ctx, struct mlx5e_ktls_offload_context_tx *priv_tx)
 {
-        struct tls_crypto_info *crypto_info = priv_tx->crypto_info;
+        struct tls12_crypto_info_aes_gcm_128 *info = &priv_tx->crypto_info;
-        struct tls12_crypto_info_aes_gcm_128 *info;
        char *initial_rn, *gcm_iv;
        u16 salt_sz, rec_seq_sz;
        char *salt, *rec_seq;
        u8 tls_version;
-        if (WARN_ON(crypto_info->cipher_type != TLS_CIPHER_AES_GCM_128))
-                return;
-        info = (struct tls12_crypto_info_aes_gcm_128 *)crypto_info;
        EXTRACT_INFO_FIELDS;
        gcm_iv      = MLX5_ADDR_OF(tls_static_params, ctx, gcm_iv);
@@ -108,16 +103,15 @@ build_progress_params(struct mlx5e_tx_wqe *wqe, u16 pc, u32 sqn,
 }
 static void tx_fill_wi(struct mlx5e_txqsq *sq,
-                       u16 pi, u8 num_wqebbs,
+                       u16 pi, u8 num_wqebbs, u32 num_bytes,
-                       skb_frag_t *resync_dump_frag,
+                       struct page *page)
-                       u32 num_bytes)
 {
        struct mlx5e_tx_wqe_info *wi = &sq->db.wqe_info[pi];
-        wi->skb              = NULL;
+        memset(wi, 0, sizeof(*wi));
-        wi->num_wqebbs       = num_wqebbs;
+        wi->num_wqebbs = num_wqebbs;
-        wi->resync_dump_frag = resync_dump_frag;
+        wi->num_bytes  = num_bytes;
-        wi->num_bytes        = num_bytes;
+        wi->resync_dump_frag_page = page;
 }
 void mlx5e_ktls_tx_offload_set_pending(struct mlx5e_ktls_offload_context_tx *priv_tx)
@@ -145,7 +139,7 @@ post_static_params(struct mlx5e_txqsq *sq,
        umr_wqe = mlx5e_sq_fetch_wqe(sq, MLX5E_KTLS_STATIC_UMR_WQE_SZ, &pi);
        build_static_params(umr_wqe, sq->pc, sq->sqn, priv_tx, fence);
-        tx_fill_wi(sq, pi, MLX5E_KTLS_STATIC_WQEBBS, NULL, 0);
+        tx_fill_wi(sq, pi, MLX5E_KTLS_STATIC_WQEBBS, 0, NULL);
        sq->pc += MLX5E_KTLS_STATIC_WQEBBS;
 }
@@ -159,7 +153,7 @@ post_progress_params(struct mlx5e_txqsq *sq,
        wqe = mlx5e_sq_fetch_wqe(sq, MLX5E_KTLS_PROGRESS_WQE_SZ, &pi);
        build_progress_params(wqe, sq->pc, sq->sqn, priv_tx, fence);
-        tx_fill_wi(sq, pi, MLX5E_KTLS_PROGRESS_WQEBBS, NULL, 0);
+        tx_fill_wi(sq, pi, MLX5E_KTLS_PROGRESS_WQEBBS, 0, NULL);
        sq->pc += MLX5E_KTLS_PROGRESS_WQEBBS;
 }
@@ -169,6 +163,14 @@ mlx5e_ktls_tx_post_param_wqes(struct mlx5e_txqsq *sq,
                              bool skip_static_post, bool fence_first_post)
 {
        bool progress_fence = skip_static_post || !fence_first_post;
+        struct mlx5_wq_cyc *wq = &sq->wq;
+        u16 contig_wqebbs_room, pi;
+        pi = mlx5_wq_cyc_ctr2ix(wq, sq->pc);
+        contig_wqebbs_room = mlx5_wq_cyc_get_contig_wqebbs(wq, pi);
+        if (unlikely(contig_wqebbs_room <
+                     MLX5E_KTLS_STATIC_WQEBBS + MLX5E_KTLS_PROGRESS_WQEBBS))
+                mlx5e_fill_sq_frag_edge(sq, wq, pi, contig_wqebbs_room);
        if (!skip_static_post)
                post_static_params(sq, priv_tx, fence_first_post);
@@ -180,29 +182,36 @@ struct tx_sync_info {
        u64 rcd_sn;
        s32 sync_len;
        int nr_frags;
-        skb_frag_t *frags[MAX_SKB_FRAGS];
+        skb_frag_t frags[MAX_SKB_FRAGS];
+};
+enum mlx5e_ktls_sync_retval {
+        MLX5E_KTLS_SYNC_DONE,
+        MLX5E_KTLS_SYNC_FAIL,
+        MLX5E_KTLS_SYNC_SKIP_NO_DATA,
 };
-static bool tx_sync_info_get(struct mlx5e_ktls_offload_context_tx *priv_tx,
+static enum mlx5e_ktls_sync_retval
-                             u32 tcp_seq, struct tx_sync_info *info)
+tx_sync_info_get(struct mlx5e_ktls_offload_context_tx *priv_tx,
+                 u32 tcp_seq, struct tx_sync_info *info)
 {
        struct tls_offload_context_tx *tx_ctx = priv_tx->tx_ctx;
+        enum mlx5e_ktls_sync_retval ret = MLX5E_KTLS_SYNC_DONE;
        struct tls_record_info *record;
        int remaining, i = 0;
        unsigned long flags;
-        bool ret = true;
        spin_lock_irqsave(&tx_ctx->lock, flags);
        record = tls_get_record(tx_ctx, tcp_seq, &info->rcd_sn);
        if (unlikely(!record)) {
-                ret = false;
+                ret = MLX5E_KTLS_SYNC_FAIL;
                goto out;
        }
        if (unlikely(tcp_seq < tls_record_start_seq(record))) {
-                if (!tls_record_is_start_marker(record))
+                ret = tls_record_is_start_marker(record) ?
-                        ret = false;
+                        MLX5E_KTLS_SYNC_SKIP_NO_DATA : MLX5E_KTLS_SYNC_FAIL;
                goto out;
        }
@@ -211,13 +220,13 @@ static bool tx_sync_info_get(struct mlx5e_ktls_offload_context_tx *priv_tx,
        while (remaining > 0) {
                skb_frag_t *frag = &record->frags[i];
-                __skb_frag_ref(frag);
+                get_page(skb_frag_page(frag));
                remaining -= skb_frag_size(frag);
-                info->frags[i++] = frag;
+                info->frags[i++] = *frag;
        }
        /* reduce the part which will be sent with the original SKB */
        if (remaining < 0)
-                skb_frag_size_add(info->frags[i - 1], remaining);
+                skb_frag_size_add(&info->frags[i - 1], remaining);
        info->nr_frags = i;
 out:
        spin_unlock_irqrestore(&tx_ctx->lock, flags);
@@ -229,17 +238,12 @@ tx_post_resync_params(struct mlx5e_txqsq *sq,
                      struct mlx5e_ktls_offload_context_tx *priv_tx,
                      u64 rcd_sn)
 {
-        struct tls_crypto_info *crypto_info = priv_tx->crypto_info;
+        struct tls12_crypto_info_aes_gcm_128 *info = &priv_tx->crypto_info;
-        struct tls12_crypto_info_aes_gcm_128 *info;
        __be64 rn_be = cpu_to_be64(rcd_sn);
        bool skip_static_post;
        u16 rec_seq_sz;
        char *rec_seq;
-        if (WARN_ON(crypto_info->cipher_type != TLS_CIPHER_AES_GCM_128))
-                return;
-        info = (struct tls12_crypto_info_aes_gcm_128 *)crypto_info;
        rec_seq = info->rec_seq;
        rec_seq_sz = sizeof(info->rec_seq);
@@ -250,11 +254,6 @@ tx_post_resync_params(struct mlx5e_txqsq *sq,
        mlx5e_ktls_tx_post_param_wqes(sq, priv_tx, skip_static_post, true);
 }
-struct mlx5e_dump_wqe {
-        struct mlx5_wqe_ctrl_seg ctrl;
-        struct mlx5_wqe_data_seg data;
-};
 static int
 tx_post_resync_dump(struct mlx5e_txqsq *sq, skb_frag_t *frag, u32 tisn, bool first)
 {
@@ -262,7 +261,6 @@ tx_post_resync_dump(struct mlx5e_txqsq *sq, skb_frag_t *frag, u32 tisn, bool fir
        struct mlx5_wqe_data_seg *dseg;
        struct mlx5e_dump_wqe *wqe;
        dma_addr_t dma_addr = 0;
-        u8  num_wqebbs;
        u16 ds_cnt;
        int fsz;
        u16 pi;
@@ -270,7 +268,6 @@ tx_post_resync_dump(struct mlx5e_txqsq *sq, skb_frag_t *frag, u32 tisn, bool fir
        wqe = mlx5e_sq_fetch_wqe(sq, sizeof(*wqe), &pi);
        ds_cnt = sizeof(*wqe) / MLX5_SEND_WQE_DS;
-        num_wqebbs = DIV_ROUND_UP(ds_cnt, MLX5_SEND_WQEBB_NUM_DS);
        cseg = &wqe->ctrl;
        dseg = &wqe->data;
@@ -291,24 +288,27 @@ tx_post_resync_dump(struct mlx5e_txqsq *sq, skb_frag_t *frag, u32 tisn, bool fir
        dseg->byte_count = cpu_to_be32(fsz);
        mlx5e_dma_push(sq, dma_addr, fsz, MLX5E_DMA_MAP_PAGE);
-        tx_fill_wi(sq, pi, num_wqebbs, frag, fsz);
+        tx_fill_wi(sq, pi, MLX5E_KTLS_DUMP_WQEBBS, fsz, skb_frag_page(frag));
-        sq->pc += num_wqebbs;
+        sq->pc += MLX5E_KTLS_DUMP_WQEBBS;
-        WARN(num_wqebbs > MLX5E_KTLS_MAX_DUMP_WQEBBS,
-             "unexpected DUMP num_wqebbs, %d > %d",
-             num_wqebbs, MLX5E_KTLS_MAX_DUMP_WQEBBS);
        return 0;
 }
 void mlx5e_ktls_tx_handle_resync_dump_comp(struct mlx5e_txqsq *sq,
                                           struct mlx5e_tx_wqe_info *wi,
-                                           struct mlx5e_sq_dma *dma)
+                                           u32 *dma_fifo_cc)
 {
-        struct mlx5e_sq_stats *stats = sq->stats;
+        struct mlx5e_sq_stats *stats;
+        struct mlx5e_sq_dma *dma;
+        if (!wi->resync_dump_frag_page)
+                return;
+        dma = mlx5e_dma_get(sq, (*dma_fifo_cc)++);
+        stats = sq->stats;
        mlx5e_tx_dma_unmap(sq->pdev, dma);
-        __skb_frag_unref(wi->resync_dump_frag);
+        put_page(wi->resync_dump_frag_page);
        stats->tls_dump_packets++;
        stats->tls_dump_bytes += wi->num_bytes;
 }
@@ -318,25 +318,31 @@ static void tx_post_fence_nop(struct mlx5e_txqsq *sq)
        struct mlx5_wq_cyc *wq = &sq->wq;
        u16 pi = mlx5_wq_cyc_ctr2ix(wq, sq->pc);
-        tx_fill_wi(sq, pi, 1, NULL, 0);
+        tx_fill_wi(sq, pi, 1, 0, NULL);
        mlx5e_post_nop_fence(wq, sq->sqn, &sq->pc);
 }
-static struct sk_buff *
+static enum mlx5e_ktls_sync_retval
 mlx5e_ktls_tx_handle_ooo(struct mlx5e_ktls_offload_context_tx *priv_tx,
                         struct mlx5e_txqsq *sq,
-                         struct sk_buff *skb,
+                         int datalen,
                         u32 seq)
 {
        struct mlx5e_sq_stats *stats = sq->stats;
        struct mlx5_wq_cyc *wq = &sq->wq;
+        enum mlx5e_ktls_sync_retval ret;
        struct tx_sync_info info = {};
        u16 contig_wqebbs_room, pi;
        u8 num_wqebbs;
-        int i;
+        int i = 0;
-        if (!tx_sync_info_get(priv_tx, seq, &info)) {
+        ret = tx_sync_info_get(priv_tx, seq, &info);
+        if (unlikely(ret != MLX5E_KTLS_SYNC_DONE)) {
+                if (ret == MLX5E_KTLS_SYNC_SKIP_NO_DATA) {
+                        stats->tls_skip_no_sync_data++;
+                        return MLX5E_KTLS_SYNC_SKIP_NO_DATA;
+                }
                /* We might get here if a retransmission reaches the driver
                 * after the relevant record is acked.
                 * It should be safe to drop the packet in this case
@@ -346,13 +352,8 @@ mlx5e_ktls_tx_handle_ooo(struct mlx5e_ktls_offload_context_tx *priv_tx,
        }
        if (unlikely(info.sync_len < 0)) {
-                u32 payload;
+                if (likely(datalen <= -info.sync_len))
-                int headln;
+                        return MLX5E_KTLS_SYNC_DONE;
-                headln = skb_transport_offset(skb) + tcp_hdrlen(skb);
-                payload = skb->len - headln;
-                if (likely(payload <= -info.sync_len))
-                        return skb;
                stats->tls_drop_bypass_req++;
                goto err_out;
@@ -360,30 +361,62 @@ mlx5e_ktls_tx_handle_ooo(struct mlx5e_ktls_offload_context_tx *priv_tx,
        stats->tls_ooo++;
-        num_wqebbs = MLX5E_KTLS_STATIC_WQEBBS + MLX5E_KTLS_PROGRESS_WQEBBS +
+        tx_post_resync_params(sq, priv_tx, info.rcd_sn);
-                (info.nr_frags ? info.nr_frags * MLX5E_KTLS_MAX_DUMP_WQEBBS : 1);
+        /* If no dump WQE was sent, we need to have a fence NOP WQE before the
+         * actual data xmit.
+         */
+        if (!info.nr_frags) {
+                tx_post_fence_nop(sq);
+                return MLX5E_KTLS_SYNC_DONE;
+        }
+        num_wqebbs = mlx5e_ktls_dumps_num_wqebbs(sq, info.nr_frags, info.sync_len);
        pi = mlx5_wq_cyc_ctr2ix(wq, sq->pc);
        contig_wqebbs_room = mlx5_wq_cyc_get_contig_wqebbs(wq, pi);
        if (unlikely(contig_wqebbs_room < num_wqebbs))
                mlx5e_fill_sq_frag_edge(sq, wq, pi, contig_wqebbs_room);
        tx_post_resync_params(sq, priv_tx, info.rcd_sn);
-        for (i = 0; i < info.nr_frags; i++)
+        for (; i < info.nr_frags; i++) {
-                if (tx_post_resync_dump(sq, info.frags[i], priv_tx->tisn, !i))
+                unsigned int orig_fsz, frag_offset = 0, n = 0;
-                        goto err_out;
+                skb_frag_t *f = &info.frags[i];
-        /* If no dump WQE was sent, we need to have a fence NOP WQE before the
+                orig_fsz = skb_frag_size(f);
-         * actual data xmit.
-         */
-        if (!info.nr_frags)
-                tx_post_fence_nop(sq);
-        return skb;
+                do {
+                        bool fence = !(i || frag_offset);
+                        unsigned int fsz;
+                        n++;
+                        fsz = min_t(unsigned int, sq->hw_mtu, orig_fsz - frag_offset);
+                        skb_frag_size_set(f, fsz);
+                        if (tx_post_resync_dump(sq, f, priv_tx->tisn, fence)) {
+                                page_ref_add(skb_frag_page(f), n - 1);
+                                goto err_out;
+                        }
+                        skb_frag_off_add(f, fsz);
+                        frag_offset += fsz;
+                } while (frag_offset < orig_fsz);
+                page_ref_add(skb_frag_page(f), n - 1);
+        }
+        return MLX5E_KTLS_SYNC_DONE;
 err_out:
-        dev_kfree_skb_any(skb);
+        for (; i < info.nr_frags; i++)
-        return NULL;
+                /* The put_page() here undoes the page ref obtained in tx_sync_info_get().
+                 * Page refs obtained for the DUMP WQEs above (by page_ref_add) will be
+                 * released only upon their completions (or in mlx5e_free_txqsq_descs,
+                 * if channel closes).
+                 */
+                put_page(skb_frag_page(&info.frags[i]));
+        return MLX5E_KTLS_SYNC_FAIL;
 }
 struct sk_buff *mlx5e_ktls_handle_tx_skb(struct net_device *netdev,
@@ -419,10 +452,15 @@ struct sk_buff *mlx5e_ktls_handle_tx_skb(struct net_device *netdev,
        seq = ntohl(tcp_hdr(skb)->seq);
        if (unlikely(priv_tx->expected_seq != seq)) {
-                skb = mlx5e_ktls_tx_handle_ooo(priv_tx, sq, skb, seq);
+                enum mlx5e_ktls_sync_retval ret =
-                if (unlikely(!skb))
+                        mlx5e_ktls_tx_handle_ooo(priv_tx, sq, datalen, seq);
+                if (likely(ret == MLX5E_KTLS_SYNC_DONE))
+                        *wqe = mlx5e_sq_fetch_wqe(sq, sizeof(**wqe), pi);
+                else if (ret == MLX5E_KTLS_SYNC_FAIL)
+                        goto err_out;
+                else /* ret == MLX5E_KTLS_SYNC_SKIP_NO_DATA */
                        goto out;
-                *wqe = mlx5e_sq_fetch_wqe(sq, sizeof(**wqe), pi);
        }
        priv_tx->expected_seq = seq + datalen;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
index c5a9c20d7f00..327c93a7bd55 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
@@ -1021,7 +1021,7 @@ static bool ext_link_mode_requested(const unsigned long *adver)
 {
 #define MLX5E_MIN_PTYS_EXT_LINK_MODE_BIT ETHTOOL_LINK_MODE_50000baseKR_Full_BIT
        int size = __ETHTOOL_LINK_MODE_MASK_NBITS - MLX5E_MIN_PTYS_EXT_LINK_MODE_BIT;
-        __ETHTOOL_DECLARE_LINK_MODE_MASK(modes);
+        __ETHTOOL_DECLARE_LINK_MODE_MASK(modes) = {0,};
        bitmap_set(modes, MLX5E_MIN_PTYS_EXT_LINK_MODE_BIT, size);
        return bitmap_intersects(modes, adver, __ETHTOOL_LINK_MODE_MASK_NBITS);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
index 7569287f8f3c..772bfdbdeb9c 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
@@ -1128,6 +1128,7 @@ static int mlx5e_alloc_txqsq(struct mlx5e_channel *c,
        sq->txq_ix    = txq_ix;
        sq->uar_map   = mdev->mlx5e_res.bfreg.map;
        sq->min_inline_mode = params->tx_min_inline_mode;
+        sq->hw_mtu    = MLX5E_SW2HW_MTU(params, params->sw_mtu);
        sq->stats     = &c->priv->channel_stats[c->ix].sq[tc];
        sq->stop_room = MLX5E_SQ_STOP_ROOM;
        INIT_WORK(&sq->recover_work, mlx5e_tx_err_cqe_work);
@@ -1135,10 +1136,14 @@ static int mlx5e_alloc_txqsq(struct mlx5e_channel *c,
                set_bit(MLX5E_SQ_STATE_VLAN_NEED_L2_INLINE, &sq->state);
        if (MLX5_IPSEC_DEV(c->priv->mdev))
                set_bit(MLX5E_SQ_STATE_IPSEC, &sq->state);
+#ifdef CONFIG_MLX5_EN_TLS
        if (mlx5_accel_is_tls_device(c->priv->mdev)) {
                set_bit(MLX5E_SQ_STATE_TLS, &sq->state);
-                sq->stop_room += MLX5E_SQ_TLS_ROOM;
+                sq->stop_room += MLX5E_SQ_TLS_ROOM +
+                        mlx5e_ktls_dumps_num_wqebbs(sq, MAX_SKB_FRAGS,
+                                                    TLS_MAX_PAYLOAD_SIZE);
        }
+#endif
        param->wq.db_numa_node = cpu_to_node(c->cpu);
        err = mlx5_wq_cyc_create(mdev, &param->wq, sqc_wq, wq, &sq->wq_ctrl);
@@ -1349,9 +1354,13 @@ static void mlx5e_deactivate_txqsq(struct mlx5e_txqsq *sq)
        /* last doorbell out, godspeed .. */
        if (mlx5e_wqc_has_room_for(wq, sq->cc, sq->pc, 1)) {
                u16 pi = mlx5_wq_cyc_ctr2ix(wq, sq->pc);
+                struct mlx5e_tx_wqe_info *wi;
                struct mlx5e_tx_wqe *nop;
-                sq->db.wqe_info[pi].skb = NULL;
+                wi = &sq->db.wqe_info[pi];
+                memset(wi, 0, sizeof(*wi));
+                wi->num_wqebbs = 1;
                nop = mlx5e_post_nop(wq, sq->sqn, &sq->pc);
                mlx5e_notify_hw(wq, sq->pc, sq->uar_map, &nop->ctrl);
        }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
index 95892a3b63a1..cd9bb7c7b341 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
@@ -611,8 +611,8 @@ static void mlx5e_rep_update_flows(struct mlx5e_priv *priv,
        mutex_lock(&esw->offloads.encap_tbl_lock);
        encap_connected = !!(e->flags & MLX5_ENCAP_ENTRY_VALID);
-        if (e->compl_result || (encap_connected == neigh_connected &&
+        if (e->compl_result < 0 || (encap_connected == neigh_connected &&
-                                ether_addr_equal(e->h_dest, ha)))
+                                    ether_addr_equal(e->h_dest, ha)))
                goto unlock;
        mlx5e_take_all_encap_flows(e, &flow_list);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
index d6a547238de0..82cffb3a9964 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
@@ -1386,8 +1386,11 @@ int mlx5e_poll_rx_cq(struct mlx5e_cq *cq, int budget)
        if (unlikely(!test_bit(MLX5E_RQ_STATE_ENABLED, &rq->state)))
                return 0;
-        if (rq->cqd.left)
+        if (rq->cqd.left) {
                work_done += mlx5e_decompress_cqes_cont(rq, cqwq, 0, budget);
+                if (rq->cqd.left || work_done >= budget)
+                        goto out;
+        }
        cqe = mlx5_cqwq_get_cqe(cqwq);
        if (!cqe) {
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c b/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c
index 840ec945ccba..bbff8d8ded76 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c
@@ -35,6 +35,7 @@
 #include <linux/udp.h>
 #include <net/udp.h>
 #include "en.h"
+#include "en/port.h"
 enum {
        MLX5E_ST_LINK_STATE,
@@ -80,22 +81,12 @@ static int mlx5e_test_link_state(struct mlx5e_priv *priv)
 static int mlx5e_test_link_speed(struct mlx5e_priv *priv)
 {
-        u32 out[MLX5_ST_SZ_DW(ptys_reg)];
+        u32 speed;
-        u32 eth_proto_oper;
-        int i;
        if (!netif_carrier_ok(priv->netdev))
                return 1;
-        if (mlx5_query_port_ptys(priv->mdev, out, sizeof(out), MLX5_PTYS_EN, 1))
+        return mlx5e_port_linkspeed(priv->mdev, &speed);
-                return 1;
-        eth_proto_oper = MLX5_GET(ptys_reg, out, eth_proto_oper);
-        for (i = 0; i < MLX5E_LINK_MODES_NUMBER; i++) {
-                if (eth_proto_oper & MLX5E_PROT_MASK(i))
-                        return 0;
-        }
-        return 1;
 }
 struct mlx5ehdr {
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c
index ac6fdcda7019..7e6ebd0505cc 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c
@@ -52,11 +52,12 @@ static const struct counter_desc sw_stats_desc[] = {
        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_tls_encrypted_bytes) },
        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_tls_ctx) },
        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_tls_ooo) },
+        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_tls_dump_packets) },
+        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_tls_dump_bytes) },
        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_tls_resync_bytes) },
+        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_tls_skip_no_sync_data) },
        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_tls_drop_no_sync_data) },
        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_tls_drop_bypass_req) },
-        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_tls_dump_packets) },
-        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_tls_dump_bytes) },
 #endif
        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_lro_packets) },
@@ -288,11 +289,12 @@ static void mlx5e_grp_sw_update_stats(struct mlx5e_priv *priv)
                        s->tx_tls_encrypted_bytes   += sq_stats->tls_encrypted_bytes;
                        s->tx_tls_ctx               += sq_stats->tls_ctx;
                        s->tx_tls_ooo               += sq_stats->tls_ooo;
+                        s->tx_tls_dump_bytes        += sq_stats->tls_dump_bytes;
+                        s->tx_tls_dump_packets      += sq_stats->tls_dump_packets;
                        s->tx_tls_resync_bytes      += sq_stats->tls_resync_bytes;
+                        s->tx_tls_skip_no_sync_data += sq_stats->tls_skip_no_sync_data;
                        s->tx_tls_drop_no_sync_data += sq_stats->tls_drop_no_sync_data;
                        s->tx_tls_drop_bypass_req   += sq_stats->tls_drop_bypass_req;
-                        s->tx_tls_dump_bytes        += sq_stats->tls_dump_bytes;
-                        s->tx_tls_dump_packets      += sq_stats->tls_dump_packets;
 #endif
                        s->tx_cqes              += sq_stats->cqes;
                }
@@ -1472,10 +1474,12 @@ static const struct counter_desc sq_stats_desc[] = {
        { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, tls_encrypted_bytes) },
        { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, tls_ctx) },
        { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, tls_ooo) },
-        { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, tls_drop_no_sync_data) },
-        { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, tls_drop_bypass_req) },
        { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, tls_dump_packets) },
        { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, tls_dump_bytes) },
+        { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, tls_resync_bytes) },
+        { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, tls_skip_no_sync_data) },
+        { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, tls_drop_no_sync_data) },
+        { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, tls_drop_bypass_req) },
 #endif
        { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, csum_none) },
        { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, stopped) },
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h
index 79f261bf86ac..869f3502f631 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h
@@ -129,11 +129,12 @@ struct mlx5e_sw_stats {
        u64 tx_tls_encrypted_bytes;
        u64 tx_tls_ctx;
        u64 tx_tls_ooo;
+        u64 tx_tls_dump_packets;
+        u64 tx_tls_dump_bytes;
        u64 tx_tls_resync_bytes;
+        u64 tx_tls_skip_no_sync_data;
        u64 tx_tls_drop_no_sync_data;
        u64 tx_tls_drop_bypass_req;
-        u64 tx_tls_dump_packets;
-        u64 tx_tls_dump_bytes;
 #endif
        u64 rx_xsk_packets;
@@ -273,11 +274,12 @@ struct mlx5e_sq_stats {
        u64 tls_encrypted_bytes;
        u64 tls_ctx;
        u64 tls_ooo;
+        u64 tls_dump_packets;
+        u64 tls_dump_bytes;
        u64 tls_resync_bytes;
+        u64 tls_skip_no_sync_data;
        u64 tls_drop_no_sync_data;
        u64 tls_drop_bypass_req;
-        u64 tls_dump_packets;
-        u64 tls_dump_bytes;
 #endif
        /* less likely accessed in data path */
        u64 csum_none;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
index 3e78a727f3e6..fda0b37075e8 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
@@ -1278,8 +1278,10 @@ static void mlx5e_tc_del_fdb_flow(struct mlx5e_priv *priv,
        mlx5_eswitch_del_vlan_action(esw, attr);
        for (out_index = 0; out_index < MLX5_MAX_FLOW_FWD_VPORTS; out_index++)
-                if (attr->dests[out_index].flags & MLX5_ESW_DEST_ENCAP)
+                if (attr->dests[out_index].flags & MLX5_ESW_DEST_ENCAP) {
                        mlx5e_detach_encap(priv, flow, out_index);
+                        kfree(attr->parse_attr->tun_info[out_index]);
+                }
        kvfree(attr->parse_attr);
        if (attr->action & MLX5_FLOW_CONTEXT_ACTION_MOD_HDR)
@@ -1559,6 +1561,7 @@ static void mlx5e_encap_dealloc(struct mlx5e_priv *priv, struct mlx5e_encap_entr
                        mlx5_packet_reformat_dealloc(priv->mdev, e->pkt_reformat);
        }
+        kfree(e->tun_info);
        kfree(e->encap_header);
        kfree_rcu(e, rcu);
 }
@@ -2972,6 +2975,13 @@ mlx5e_encap_get(struct mlx5e_priv *priv, struct encap_key *key,
        return NULL;
 }
+static struct ip_tunnel_info *dup_tun_info(const struct ip_tunnel_info *tun_info)
+{
+        size_t tun_size = sizeof(*tun_info) + tun_info->options_len;
+        return kmemdup(tun_info, tun_size, GFP_KERNEL);
+}
 static int mlx5e_attach_encap(struct mlx5e_priv *priv,
                              struct mlx5e_tc_flow *flow,
                              struct net_device *mirred_dev,
@@ -3028,13 +3038,15 @@ static int mlx5e_attach_encap(struct mlx5e_priv *priv,
        refcount_set(&e->refcnt, 1);
        init_completion(&e->res_ready);
+        tun_info = dup_tun_info(tun_info);
+        if (!tun_info) {
+                err = -ENOMEM;
+                goto out_err_init;
+        }
        e->tun_info = tun_info;
        err = mlx5e_tc_tun_init_encap_attr(mirred_dev, priv, e, extack);
-        if (err) {
+        if (err)
-                kfree(e);
+                goto out_err_init;
-                e = NULL;
-                goto out_err;
-        }
        INIT_LIST_HEAD(&e->flows);
        hash_add_rcu(esw->offloads.encap_tbl, &e->encap_hlist, hash_key);
@@ -3075,6 +3087,12 @@ out_err:
        if (e)
                mlx5e_encap_put(priv, e);
        return err;
+out_err_init:
+        mutex_unlock(&esw->offloads.encap_tbl_lock);
+        kfree(tun_info);
+        kfree(e);
+        return err;
 }
 static int parse_tc_vlan_action(struct mlx5e_priv *priv,
@@ -3160,7 +3178,7 @@ static int add_vlan_pop_action(struct mlx5e_priv *priv,
                               struct mlx5_esw_flow_attr *attr,
                               u32 *action)
 {
-        int nest_level = vlan_get_encap_level(attr->parse_attr->filter_dev);
+        int nest_level = attr->parse_attr->filter_dev->lower_level;
        struct flow_action_entry vlan_act = {
                .id = FLOW_ACTION_VLAN_POP,
        };
@@ -3295,7 +3313,9 @@ static int parse_tc_fdb_actions(struct mlx5e_priv *priv,
                        } else if (encap) {
                                parse_attr->mirred_ifindex[attr->out_count] =
                                        out_dev->ifindex;
-                                parse_attr->tun_info[attr->out_count] = info;
+                                parse_attr->tun_info[attr->out_count] = dup_tun_info(info);
+                                if (!parse_attr->tun_info[attr->out_count])
+                                        return -ENOMEM;
                                encap = false;
                                attr->dests[attr->out_count].flags |=
                                        MLX5_ESW_DEST_ENCAP;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
index d3a67a9b4eba..67dc4f0921b6 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
@@ -403,7 +403,10 @@ netdev_tx_t mlx5e_xmit(struct sk_buff *skb, struct net_device *dev)
 static void mlx5e_dump_error_cqe(struct mlx5e_txqsq *sq,
                                 struct mlx5_err_cqe *err_cqe)
 {
-        u32 ci = mlx5_cqwq_get_ci(&sq->cq.wq);
+        struct mlx5_cqwq *wq = &sq->cq.wq;
+        u32 ci;
+        ci = mlx5_cqwq_ctr2ix(wq, wq->cc - 1);
        netdev_err(sq->channel->netdev,
                   "Error cqe on cqn 0x%x, ci 0x%x, sqn 0x%x, opcode 0x%x, syndrome 0x%x, vendor syndrome 0x%x\n",
@@ -479,14 +482,7 @@ bool mlx5e_poll_tx_cq(struct mlx5e_cq *cq, int napi_budget)
                        skb = wi->skb;
                        if (unlikely(!skb)) {
-#ifdef CONFIG_MLX5_EN_TLS
+                                mlx5e_ktls_tx_handle_resync_dump_comp(sq, wi, &dma_fifo_cc);
-                                if (wi->resync_dump_frag) {
-                                        struct mlx5e_sq_dma *dma =
-                                                mlx5e_dma_get(sq, dma_fifo_cc++);
-                                        mlx5e_ktls_tx_handle_resync_dump_comp(sq, wi, dma);
-                                }
-#endif
                                sqcc += wi->num_wqebbs;
                                continue;
                        }
@@ -542,29 +538,38 @@ void mlx5e_free_txqsq_descs(struct mlx5e_txqsq *sq)
 {
        struct mlx5e_tx_wqe_info *wi;
        struct sk_buff *skb;
+        u32 dma_fifo_cc;
+        u16 sqcc;
        u16 ci;
        int i;
-        while (sq->cc != sq->pc) {
+        sqcc = sq->cc;
-                ci = mlx5_wq_cyc_ctr2ix(&sq->wq, sq->cc);
+        dma_fifo_cc = sq->dma_fifo_cc;
+        while (sqcc != sq->pc) {
+                ci = mlx5_wq_cyc_ctr2ix(&sq->wq, sqcc);
                wi = &sq->db.wqe_info[ci];
                skb = wi->skb;
-                if (!skb) { /* nop */
+                if (!skb) {
-                        sq->cc++;
+                        mlx5e_ktls_tx_handle_resync_dump_comp(sq, wi, &dma_fifo_cc);
+                        sqcc += wi->num_wqebbs;
                        continue;
                }
                for (i = 0; i < wi->num_dma; i++) {
                        struct mlx5e_sq_dma *dma =
-                                mlx5e_dma_get(sq, sq->dma_fifo_cc++);
+                                mlx5e_dma_get(sq, dma_fifo_cc++);
                        mlx5e_tx_dma_unmap(sq->pdev, dma);
                }
                dev_kfree_skb_any(skb);
-                sq->cc += wi->num_wqebbs;
+                sqcc += wi->num_wqebbs;
        }
+        sq->dma_fifo_cc = dma_fifo_cc;
+        sq->cc = sqcc;
 }
 #ifdef CONFIG_MLX5_CORE_IPOIB
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
index 00d71db15f22..369499e88fe8 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
@@ -285,7 +285,6 @@ mlx5_eswitch_add_fwd_rule(struct mlx5_eswitch *esw,
        mlx5_eswitch_set_rule_source_port(esw, spec, attr);
-        spec->match_criteria_enable |= MLX5_MATCH_MISC_PARAMETERS;
        if (attr->outer_match_level != MLX5_MATCH_NONE)
                spec->match_criteria_enable |= MLX5_MATCH_OUTER_HEADERS;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads_termtbl.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads_termtbl.c
index 1d55a324a17e..7879e1746297 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads_termtbl.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads_termtbl.c
@@ -177,22 +177,32 @@ mlx5_eswitch_termtbl_actions_move(struct mlx5_flow_act *src,
        memset(&src->vlan[1], 0, sizeof(src->vlan[1]));
 }
+static bool mlx5_eswitch_offload_is_uplink_port(const struct mlx5_eswitch *esw,
+                                                const struct mlx5_flow_spec *spec)
+{
+        u32 port_mask, port_value;
+        if (MLX5_CAP_ESW_FLOWTABLE(esw->dev, flow_source))
+                return spec->flow_context.flow_source == MLX5_VPORT_UPLINK;
+        port_mask = MLX5_GET(fte_match_param, spec->match_criteria,
+                             misc_parameters.source_port);
+        port_value = MLX5_GET(fte_match_param, spec->match_value,
+                              misc_parameters.source_port);
+        return (port_mask & port_value & 0xffff) == MLX5_VPORT_UPLINK;
+}
 bool
 mlx5_eswitch_termtbl_required(struct mlx5_eswitch *esw,
                              struct mlx5_flow_act *flow_act,
                              struct mlx5_flow_spec *spec)
 {
-        u32 port_mask = MLX5_GET(fte_match_param, spec->match_criteria,
-                                 misc_parameters.source_port);
-        u32 port_value = MLX5_GET(fte_match_param, spec->match_value,
-                                  misc_parameters.source_port);
        if (!MLX5_CAP_ESW_FLOWTABLE_FDB(esw->dev, termination_table))
                return false;
        /* push vlan on RX */
        return (flow_act->action & MLX5_FLOW_CONTEXT_ACTION_VLAN_PUSH) &&
-                ((port_mask & port_value) == MLX5_VPORT_UPLINK);
+                mlx5_eswitch_offload_is_uplink_port(esw, spec);
 }
 struct mlx5_flow_handle *
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fpga/conn.c b/drivers/net/ethernet/mellanox/mlx5/core/fpga/conn.c
index 4c50efe4e7f1..61021133029e 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fpga/conn.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fpga/conn.c
@@ -464,8 +464,10 @@ static int mlx5_fpga_conn_create_cq(struct mlx5_fpga_conn *conn, int cq_size)
        }
        err = mlx5_vector2eqn(mdev, smp_processor_id(), &eqn, &irqn);
-        if (err)
+        if (err) {
+                kvfree(in);
                goto err_cqwq;
+        }
        cqc = MLX5_ADDR_OF(create_cq_in, in, cq_context);
        MLX5_SET(cqc, cqc, log_cq_size, ilog2(cq_size));
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c
index 579c306caa7b..3c816e81f8d9 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c
@@ -507,7 +507,8 @@ static int mlx5_cmd_set_fte(struct mlx5_core_dev *dev,
                                MLX5_SET(dest_format_struct, in_dests,
                                         destination_eswitch_owner_vhca_id,
                                         dst->dest_attr.vport.vhca_id);
-                                if (extended_dest) {
+                                if (extended_dest &&
+                                    dst->dest_attr.vport.pkt_reformat) {
                                        MLX5_SET(dest_format_struct, in_dests,
                                                 packet_reformat,
                                                 !!(dst->dest_attr.vport.flags &
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/health.c b/drivers/net/ethernet/mellanox/mlx5/core/health.c
index d685122d9ff7..c07f3154437c 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/health.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/health.c
@@ -572,7 +572,7 @@ mlx5_fw_fatal_reporter_dump(struct devlink_health_reporter *reporter,
                return -ENOMEM;
        err = mlx5_crdump_collect(dev, cr_data);
        if (err)
-                return err;
+                goto free_data;
        if (priv_ctx) {
                struct mlx5_fw_reporter_ctx *fw_reporter_ctx = priv_ctx;
diff --git a/drivers/net/ethernet/mellanox/mlxsw/core.c b/drivers/net/ethernet/mellanox/mlxsw/core.c
index 14dcc786926d..4421ab22182f 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/core.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/core.c
@@ -1186,7 +1186,7 @@ __mlxsw_core_bus_device_register(const struct mlxsw_bus_info *mlxsw_bus_info,
        if (err)
                goto err_thermal_init;
-        if (mlxsw_driver->params_register && !reload)
+        if (mlxsw_driver->params_register)
                devlink_params_publish(devlink);
        return 0;
@@ -1259,7 +1259,7 @@ void mlxsw_core_bus_device_unregister(struct mlxsw_core *mlxsw_core,
                        return;
        }
-        if (mlxsw_core->driver->params_unregister && !reload)
+        if (mlxsw_core->driver->params_unregister)
                devlink_params_unpublish(devlink);
        mlxsw_thermal_fini(mlxsw_core->thermal);
        mlxsw_hwmon_fini(mlxsw_core->hwmon);
diff --git a/drivers/net/ethernet/mscc/ocelot.c b/drivers/net/ethernet/mscc/ocelot.c
index 4d1bce4389c7..344539c0d3aa 100644
--- a/drivers/net/ethernet/mscc/ocelot.c
+++ b/drivers/net/ethernet/mscc/ocelot.c
@@ -261,8 +261,15 @@ static int ocelot_vlan_vid_add(struct net_device *dev, u16 vid, bool pvid,
                port->pvid = vid;
        /* Untagged egress vlan clasification */
-        if (untagged)
+        if (untagged && port->vid != vid) {
+                if (port->vid) {
+                        dev_err(ocelot->dev,
+                                "Port already has a native VLAN: %d\n",
+                                port->vid);
+                        return -EBUSY;
+                }
                port->vid = vid;
+        }
        ocelot_vlan_port_apply(ocelot, port);
@@ -934,7 +941,7 @@ end:
 static int ocelot_vlan_rx_add_vid(struct net_device *dev, __be16 proto,
                                  u16 vid)
 {
-        return ocelot_vlan_vid_add(dev, vid, false, true);
+        return ocelot_vlan_vid_add(dev, vid, false, false);
 }
 static int ocelot_vlan_rx_kill_vid(struct net_device *dev, __be16 proto,
diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_repr.c b/drivers/net/ethernet/netronome/nfp/nfp_net_repr.c
index 1eef446036d6..79d72c88bbef 100644
--- a/drivers/net/ethernet/netronome/nfp/nfp_net_repr.c
+++ b/drivers/net/ethernet/netronome/nfp/nfp_net_repr.c
@@ -299,22 +299,6 @@ static void nfp_repr_clean(struct nfp_repr *repr)
        nfp_port_free(repr->port);
 }
-static struct lock_class_key nfp_repr_netdev_xmit_lock_key;
-static struct lock_class_key nfp_repr_netdev_addr_lock_key;
-static void nfp_repr_set_lockdep_class_one(struct net_device *dev,
-                                           struct netdev_queue *txq,
-                                           void *_unused)
-{
-        lockdep_set_class(&txq->_xmit_lock, &nfp_repr_netdev_xmit_lock_key);
-}
-static void nfp_repr_set_lockdep_class(struct net_device *dev)
-{
-        lockdep_set_class(&dev->addr_list_lock, &nfp_repr_netdev_addr_lock_key);
-        netdev_for_each_tx_queue(dev, nfp_repr_set_lockdep_class_one, NULL);
-}
 int nfp_repr_init(struct nfp_app *app, struct net_device *netdev,
                  u32 cmsg_port_id, struct nfp_port *port,
                  struct net_device *pf_netdev)
@@ -324,8 +308,6 @@ int nfp_repr_init(struct nfp_app *app, struct net_device *netdev,
        u32 repr_cap = nn->tlv_caps.repr_cap;
        int err;
-        nfp_repr_set_lockdep_class(netdev);
        repr->port = port;
        repr->dst = metadata_dst_alloc(0, METADATA_HW_PORT_MUX, GFP_KERNEL);
        if (!repr->dst)
diff --git a/drivers/net/ethernet/pensando/ionic/ionic_lif.c b/drivers/net/ethernet/pensando/ionic/ionic_lif.c
index 72107a0627a9..20faa8d24c9f 100644
--- a/drivers/net/ethernet/pensando/ionic/ionic_lif.c
+++ b/drivers/net/ethernet/pensando/ionic/ionic_lif.c
@@ -1,6 +1,8 @@
 // SPDX-License-Identifier: GPL-2.0
 /* Copyright(c) 2017 - 2019 Pensando Systems, Inc */
+#include <linux/printk.h>
+#include <linux/dynamic_debug.h>
 #include <linux/netdevice.h>
 #include <linux/etherdevice.h>
 #include <linux/rtnetlink.h>
diff --git a/drivers/net/ethernet/pensando/ionic/ionic_main.c b/drivers/net/ethernet/pensando/ionic/ionic_main.c
index 15e432386b35..aab311413412 100644
--- a/drivers/net/ethernet/pensando/ionic/ionic_main.c
+++ b/drivers/net/ethernet/pensando/ionic/ionic_main.c
@@ -1,6 +1,8 @@
 // SPDX-License-Identifier: GPL-2.0
 /* Copyright(c) 2017 - 2019 Pensando Systems, Inc */
+#include <linux/printk.h>
+#include <linux/dynamic_debug.h>
 #include <linux/module.h>
 #include <linux/netdevice.h>
 #include <linux/utsname.h>
diff --git a/drivers/net/ethernet/qlogic/qed/qed_main.c b/drivers/net/ethernet/qlogic/qed/qed_main.c
index 2ce70097d018..38f7f40b3a4d 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_main.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_main.c
@@ -67,10 +67,9 @@
 #define QED_ROCE_QPS                    (8192)
 #define QED_ROCE_DPIS                   (8)
 #define QED_RDMA_SRQS                   QED_ROCE_QPS
-#define QED_NVM_CFG_SET_FLAGS           0xE
-#define QED_NVM_CFG_SET_PF_FLAGS        0x1E
 #define QED_NVM_CFG_GET_FLAGS           0xA
 #define QED_NVM_CFG_GET_PF_FLAGS        0x1A
+#define QED_NVM_CFG_MAX_ATTRS           50
 static char version[] =
        "QLogic FastLinQ 4xxxx Core Module qed " DRV_MODULE_VERSION "\n";
@@ -2255,6 +2254,7 @@ static int qed_nvm_flash_cfg_write(struct qed_dev *cdev, const u8 **data)
 {
        struct qed_hwfn *hwfn = QED_LEADING_HWFN(cdev);
        u8 entity_id, len, buf[32];
+        bool need_nvm_init = true;
        struct qed_ptt *ptt;
        u16 cfg_id, count;
        int rc = 0, i;
@@ -2271,8 +2271,10 @@ static int qed_nvm_flash_cfg_write(struct qed_dev *cdev, const u8 **data)
        DP_VERBOSE(cdev, NETIF_MSG_DRV,
                   "Read config ids: num_attrs = %0d\n", count);
-        /* NVM CFG ID attributes */
+        /* NVM CFG ID attributes. Start loop index from 1 to avoid additional
-        for (i = 0; i < count; i++) {
+         * arithmetic operations in the implementation.
+         */
+        for (i = 1; i <= count; i++) {
                cfg_id = *((u16 *)*data);
                *data += 2;
                entity_id = **data;
@@ -2282,8 +2284,21 @@ static int qed_nvm_flash_cfg_write(struct qed_dev *cdev, const u8 **data)
                memcpy(buf, *data, len);
                *data += len;
-                flags = entity_id ? QED_NVM_CFG_SET_PF_FLAGS :
+                flags = 0;
-                        QED_NVM_CFG_SET_FLAGS;
+                if (need_nvm_init) {
+                        flags |= QED_NVM_CFG_OPTION_INIT;
+                        need_nvm_init = false;
+                }
+                /* Commit to flash and free the resources */
+                if (!(i % QED_NVM_CFG_MAX_ATTRS) || i == count) {
+                        flags |= QED_NVM_CFG_OPTION_COMMIT |
+                                 QED_NVM_CFG_OPTION_FREE;
+                        need_nvm_init = true;
+                }
+                if (entity_id)
+                        flags |= QED_NVM_CFG_OPTION_ENTITY_SEL;
                DP_VERBOSE(cdev, NETIF_MSG_DRV,
                           "cfg_id = %d entity = %d len = %d\n", cfg_id,
diff --git a/drivers/net/ethernet/qlogic/qed/qed_sriov.c b/drivers/net/ethernet/qlogic/qed/qed_sriov.c
index 78f77b712b10..dcb5c917f373 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_sriov.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_sriov.c
@@ -2005,7 +2005,7 @@ static void qed_iov_vf_mbx_stop_vport(struct qed_hwfn *p_hwfn,
            (qed_iov_validate_active_txq(p_hwfn, vf))) {
                vf->b_malicious = true;
                DP_NOTICE(p_hwfn,
-                          "VF [%02x] - considered malicious; Unable to stop RX/TX queuess\n",
+                          "VF [%02x] - considered malicious; Unable to stop RX/TX queues\n",
                          vf->abs_vf_id);
                status = PFVF_STATUS_MALICIOUS;
                goto out;
diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c
index 350b0d949611..5064c292b873 100644
--- a/drivers/net/ethernet/realtek/r8169_main.c
+++ b/drivers/net/ethernet/realtek/r8169_main.c
@@ -1029,6 +1029,10 @@ static int r8168dp_2_mdio_read(struct rtl8169_private *tp, int reg)
 {
        int value;
+        /* Work around issue with chip reporting wrong PHY ID */
+        if (reg == MII_PHYSID2)
+                return 0xc912;
        r8168dp_2_mdio_start(tp);
        value = r8169_mdio_read(tp, reg);
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 3dfd04e0506a..4e9c848c67cc 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -2995,6 +2995,7 @@ static netdev_tx_t stmmac_tso_xmit(struct sk_buff *skb, struct net_device *dev)
        } else {
                stmmac_set_desc_addr(priv, first, des);
                tmp_pay_len = pay_len;
+                des += proto_hdr_len;
        }
        stmmac_tso_allocator(priv, des, tmp_pay_len, (nfrags == 0), queue);
diff --git a/drivers/net/fjes/fjes_main.c b/drivers/net/fjes/fjes_main.c
index bbbc1dcb6ab5..b517c1af9de0 100644
--- a/drivers/net/fjes/fjes_main.c
+++ b/drivers/net/fjes/fjes_main.c
@@ -1237,8 +1237,17 @@ static int fjes_probe(struct platform_device *plat_dev)
        adapter->open_guard = false;
        adapter->txrx_wq = alloc_workqueue(DRV_NAME "/txrx", WQ_MEM_RECLAIM, 0);
+        if (unlikely(!adapter->txrx_wq)) {
+                err = -ENOMEM;
+                goto err_free_netdev;
+        }
        adapter->control_wq = alloc_workqueue(DRV_NAME "/control",
                                              WQ_MEM_RECLAIM, 0);
+        if (unlikely(!adapter->control_wq)) {
+                err = -ENOMEM;
+                goto err_free_txrx_wq;
+        }
        INIT_WORK(&adapter->tx_stall_task, fjes_tx_stall_task);
        INIT_WORK(&adapter->raise_intr_rxdata_task,
@@ -1255,7 +1264,7 @@ static int fjes_probe(struct platform_device *plat_dev)
        hw->hw_res.irq = platform_get_irq(plat_dev, 0);
        err = fjes_hw_init(&adapter->hw);
        if (err)
-                goto err_free_netdev;
+                goto err_free_control_wq;
        /* setup MAC address (02:00:00:00:00:[epid])*/
        netdev->dev_addr[0] = 2;
@@ -1277,6 +1286,10 @@ static int fjes_probe(struct platform_device *plat_dev)
 err_hw_exit:
        fjes_hw_exit(&adapter->hw);
+err_free_control_wq:
+        destroy_workqueue(adapter->control_wq);
+err_free_txrx_wq:
+        destroy_workqueue(adapter->txrx_wq);
 err_free_netdev:
        free_netdev(netdev);
 err_out:
diff --git a/drivers/net/hamradio/bpqether.c b/drivers/net/hamradio/bpqether.c
index fbec711ff514..fbea6f232819 100644
--- a/drivers/net/hamradio/bpqether.c
+++ b/drivers/net/hamradio/bpqether.c
@@ -107,27 +107,6 @@ struct bpqdev {
 static LIST_HEAD(bpq_devices);
-/*
- * bpqether network devices are paired with ethernet devices below them, so
- * form a special "super class" of normal ethernet devices; split their locks
- * off into a separate class since they always nest.
- */
-static struct lock_class_key bpq_netdev_xmit_lock_key;
-static struct lock_class_key bpq_netdev_addr_lock_key;
-static void bpq_set_lockdep_class_one(struct net_device *dev,
-                                      struct netdev_queue *txq,
-                                      void *_unused)
-{
-        lockdep_set_class(&txq->_xmit_lock, &bpq_netdev_xmit_lock_key);
-}
-static void bpq_set_lockdep_class(struct net_device *dev)
-{
-        lockdep_set_class(&dev->addr_list_lock, &bpq_netdev_addr_lock_key);
-        netdev_for_each_tx_queue(dev, bpq_set_lockdep_class_one, NULL);
-}
 /* ------------------------------------------------------------------------ */
@@ -498,7 +477,6 @@ static int bpq_new_device(struct net_device *edev)
        err = register_netdevice(ndev);
        if (err)
                goto error;
-        bpq_set_lockdep_class(ndev);
        /* List protected by RTNL */
        list_add_rcu(&bpq->bpq_list, &bpq_devices);
diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
index 39dddcd8b3cb..963509add611 100644
--- a/drivers/net/hyperv/netvsc_drv.c
+++ b/drivers/net/hyperv/netvsc_drv.c
@@ -982,7 +982,7 @@ static int netvsc_attach(struct net_device *ndev,
        if (netif_running(ndev)) {
                ret = rndis_filter_open(nvdev);
                if (ret)
-                        return ret;
+                        goto err;
                rdev = nvdev->extension;
                if (!rdev->link_state)
@@ -990,6 +990,13 @@ static int netvsc_attach(struct net_device *ndev,
        }
        return 0;
+err:
+        netif_device_detach(ndev);
+        rndis_filter_device_remove(hdev, nvdev);
+        return ret;
 }
 static int netvsc_set_channels(struct net_device *net,
@@ -1807,8 +1814,10 @@ static int netvsc_set_features(struct net_device *ndev,
        ret = rndis_filter_set_offload_params(ndev, nvdev, &offloads);
-        if (ret)
+        if (ret) {
                features ^= NETIF_F_LRO;
+                ndev->features = features;
+        }
 syncvf:
        if (!vf_netdev)
@@ -2335,8 +2344,6 @@ static int netvsc_probe(struct hv_device *dev,
                NETIF_F_HW_VLAN_CTAG_RX;
        net->vlan_features = net->features;
-        netdev_lockdep_set_classes(net);
        /* MTU range: 68 - 1500 or 65521 */
        net->min_mtu = NETVSC_MTU_MIN;
        if (nvdev->nvsp_version >= NVSP_PROTOCOL_VERSION_2)
diff --git a/drivers/net/ipvlan/ipvlan_main.c b/drivers/net/ipvlan/ipvlan_main.c
index 887bbba4631e..ba3dfac1d904 100644
--- a/drivers/net/ipvlan/ipvlan_main.c
+++ b/drivers/net/ipvlan/ipvlan_main.c
@@ -131,8 +131,6 @@ static int ipvlan_init(struct net_device *dev)
        dev->gso_max_segs = phy_dev->gso_max_segs;
        dev->hard_header_len = phy_dev->hard_header_len;
-        netdev_lockdep_set_classes(dev);
        ipvlan->pcpu_stats = netdev_alloc_pcpu_stats(struct ipvl_pcpu_stats);
        if (!ipvlan->pcpu_stats)
                return -ENOMEM;
diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c
index cb7637364b40..afd8b2a08245 100644
--- a/drivers/net/macsec.c
+++ b/drivers/net/macsec.c
@@ -267,7 +267,6 @@ struct macsec_dev {
        struct pcpu_secy_stats __percpu *stats;
        struct list_head secys;
        struct gro_cells gro_cells;
-        unsigned int nest_level;
 };
 /**
@@ -2750,7 +2749,6 @@ static netdev_tx_t macsec_start_xmit(struct sk_buff *skb,
 #define MACSEC_FEATURES \
        (NETIF_F_SG | NETIF_F_HIGHDMA | NETIF_F_FRAGLIST)
-static struct lock_class_key macsec_netdev_addr_lock_key;
 static int macsec_dev_init(struct net_device *dev)
 {
@@ -2958,11 +2956,6 @@ static int macsec_get_iflink(const struct net_device *dev)
        return macsec_priv(dev)->real_dev->ifindex;
 }
-static int macsec_get_nest_level(struct net_device *dev)
-{
-        return macsec_priv(dev)->nest_level;
-}
 static const struct net_device_ops macsec_netdev_ops = {
        .ndo_init               = macsec_dev_init,
        .ndo_uninit             = macsec_dev_uninit,
@@ -2976,7 +2969,6 @@ static const struct net_device_ops macsec_netdev_ops = {
        .ndo_start_xmit         = macsec_start_xmit,
        .ndo_get_stats64        = macsec_get_stats64,
        .ndo_get_iflink         = macsec_get_iflink,
-        .ndo_get_lock_subclass  = macsec_get_nest_level,
 };
 static const struct device_type macsec_type = {
@@ -3001,12 +2993,10 @@ static const struct nla_policy macsec_rtnl_policy[IFLA_MACSEC_MAX + 1] = {
 static void macsec_free_netdev(struct net_device *dev)
 {
        struct macsec_dev *macsec = macsec_priv(dev);
-        struct net_device *real_dev = macsec->real_dev;
        free_percpu(macsec->stats);
        free_percpu(macsec->secy.tx_sc.stats);
-        dev_put(real_dev);
 }
 static void macsec_setup(struct net_device *dev)
@@ -3261,14 +3251,6 @@ static int macsec_newlink(struct net *net, struct net_device *dev,
        if (err < 0)
                return err;
-        dev_hold(real_dev);
-        macsec->nest_level = dev_get_nest_level(real_dev) + 1;
-        netdev_lockdep_set_classes(dev);
-        lockdep_set_class_and_subclass(&dev->addr_list_lock,
-                                       &macsec_netdev_addr_lock_key,
-                                       macsec_get_nest_level(dev));
        err = netdev_upper_dev_link(real_dev, dev, extack);
        if (err < 0)
                goto unregister;
diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
index 940192c057b6..34fc59bd1e20 100644
--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
@@ -852,8 +852,6 @@ static int macvlan_do_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
 * "super class" of normal network devices; split their locks off into a
 * separate class since they always nest.
 */
-static struct lock_class_key macvlan_netdev_addr_lock_key;
 #define ALWAYS_ON_OFFLOADS \
        (NETIF_F_SG | NETIF_F_HW_CSUM | NETIF_F_GSO_SOFTWARE | \
         NETIF_F_GSO_ROBUST | NETIF_F_GSO_ENCAP_ALL)
@@ -869,19 +867,6 @@ static struct lock_class_key macvlan_netdev_addr_lock_key;
 #define MACVLAN_STATE_MASK \
        ((1<<__LINK_STATE_NOCARRIER) | (1<<__LINK_STATE_DORMANT))
-static int macvlan_get_nest_level(struct net_device *dev)
-{
-        return ((struct macvlan_dev *)netdev_priv(dev))->nest_level;
-}
-static void macvlan_set_lockdep_class(struct net_device *dev)
-{
-        netdev_lockdep_set_classes(dev);
-        lockdep_set_class_and_subclass(&dev->addr_list_lock,
-                                       &macvlan_netdev_addr_lock_key,
-                                       macvlan_get_nest_level(dev));
-}
 static int macvlan_init(struct net_device *dev)
 {
        struct macvlan_dev *vlan = netdev_priv(dev);
@@ -900,8 +885,6 @@ static int macvlan_init(struct net_device *dev)
        dev->gso_max_segs       = lowerdev->gso_max_segs;
        dev->hard_header_len    = lowerdev->hard_header_len;
-        macvlan_set_lockdep_class(dev);
        vlan->pcpu_stats = netdev_alloc_pcpu_stats(struct vlan_pcpu_stats);
        if (!vlan->pcpu_stats)
                return -ENOMEM;
@@ -1161,7 +1144,6 @@ static const struct net_device_ops macvlan_netdev_ops = {
        .ndo_fdb_add            = macvlan_fdb_add,
        .ndo_fdb_del            = macvlan_fdb_del,
        .ndo_fdb_dump           = ndo_dflt_fdb_dump,
-        .ndo_get_lock_subclass  = macvlan_get_nest_level,
 #ifdef CONFIG_NET_POLL_CONTROLLER
        .ndo_poll_controller    = macvlan_dev_poll_controller,
        .ndo_netpoll_setup      = macvlan_dev_netpoll_setup,
@@ -1445,7 +1427,6 @@ int macvlan_common_newlink(struct net *src_net, struct net_device *dev,
        vlan->dev      = dev;
        vlan->port     = port;
        vlan->set_features = MACVLAN_FEATURES;
-        vlan->nest_level = dev_get_nest_level(lowerdev) + 1;
        vlan->mode     = MACVLAN_MODE_VEPA;
        if (data && data[IFLA_MACVLAN_MODE])
diff --git a/drivers/net/netdevsim/dev.c b/drivers/net/netdevsim/dev.c
index 56576d4f34a5..54ca6681ba31 100644
--- a/drivers/net/netdevsim/dev.c
+++ b/drivers/net/netdevsim/dev.c
@@ -806,9 +806,11 @@ static void nsim_dev_port_del_all(struct nsim_dev *nsim_dev)
 {
        struct nsim_dev_port *nsim_dev_port, *tmp;
+        mutex_lock(&nsim_dev->port_list_lock);
        list_for_each_entry_safe(nsim_dev_port, tmp,
                                 &nsim_dev->port_list, list)
                __nsim_dev_port_del(nsim_dev_port);
+        mutex_unlock(&nsim_dev->port_list_lock);
 }
 int nsim_dev_probe(struct nsim_bus_dev *nsim_bus_dev)
@@ -822,14 +824,17 @@ int nsim_dev_probe(struct nsim_bus_dev *nsim_bus_dev)
                return PTR_ERR(nsim_dev);
        dev_set_drvdata(&nsim_bus_dev->dev, nsim_dev);
+        mutex_lock(&nsim_dev->port_list_lock);
        for (i = 0; i < nsim_bus_dev->port_count; i++) {
                err = __nsim_dev_port_add(nsim_dev, i);
                if (err)
                        goto err_port_del_all;
        }
+        mutex_unlock(&nsim_dev->port_list_lock);
        return 0;
 err_port_del_all:
+        mutex_unlock(&nsim_dev->port_list_lock);
        nsim_dev_port_del_all(nsim_dev);
        nsim_dev_destroy(nsim_dev);
        return err;
diff --git a/drivers/net/phy/phylink.c b/drivers/net/phy/phylink.c
index 20e2ebe458f2..a578f7ebf715 100644
--- a/drivers/net/phy/phylink.c
+++ b/drivers/net/phy/phylink.c
@@ -87,8 +87,24 @@ struct phylink {
        phylink_printk(KERN_WARNING, pl, fmt, ##__VA_ARGS__)
 #define phylink_info(pl, fmt, ...) \
        phylink_printk(KERN_INFO, pl, fmt, ##__VA_ARGS__)
+#if defined(CONFIG_DYNAMIC_DEBUG)
 #define phylink_dbg(pl, fmt, ...) \
+do {                                                                    \
+        if ((pl)->config->type == PHYLINK_NETDEV)                       \
+                netdev_dbg((pl)->netdev, fmt, ##__VA_ARGS__);           \
+        else if ((pl)->config->type == PHYLINK_DEV)                     \
+                dev_dbg((pl)->dev, fmt, ##__VA_ARGS__);                 \
+} while (0)
+#elif defined(DEBUG)
+#define phylink_dbg(pl, fmt, ...)                                       \
        phylink_printk(KERN_DEBUG, pl, fmt, ##__VA_ARGS__)
+#else
+#define phylink_dbg(pl, fmt, ...)                                       \
+({                                                                      \
+        if (0)                                                          \
+                phylink_printk(KERN_DEBUG, pl, fmt, ##__VA_ARGS__);     \
+})
+#endif
 /**
 * phylink_set_port_modes() - set the port type modes in the ethtool mask
diff --git a/drivers/net/phy/smsc.c b/drivers/net/phy/smsc.c
index dc3d92d340c4..b73298250793 100644
--- a/drivers/net/phy/smsc.c
+++ b/drivers/net/phy/smsc.c
@@ -327,6 +327,7 @@ static struct phy_driver smsc_phy_driver[] = {
        .name           = "SMSC LAN8740",
        /* PHY_BASIC_FEATURES */
+        .flags          = PHY_RST_AFTER_CLK_EN,
        .probe          = smsc_phy_probe,
diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
index 9a1b006904a7..61824bbb5588 100644
--- a/drivers/net/ppp/ppp_generic.c
+++ b/drivers/net/ppp/ppp_generic.c
@@ -1324,8 +1324,6 @@ static int ppp_dev_init(struct net_device *dev)
 {
        struct ppp *ppp;
-        netdev_lockdep_set_classes(dev);
        ppp = netdev_priv(dev);
        /* Let the netdevice take a reference on the ppp file. This ensures
         * that ppp_destroy_interface() won't run before the device gets
diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
index e8089def5a46..8156b33ee3e7 100644
--- a/drivers/net/team/team.c
+++ b/drivers/net/team/team.c
@@ -1615,7 +1615,6 @@ static int team_init(struct net_device *dev)
        int err;
        team->dev = dev;
-        mutex_init(&team->lock);
        team_set_no_mode(team);
        team->pcpu_stats = netdev_alloc_pcpu_stats(struct team_pcpu_stats);
@@ -1642,7 +1641,8 @@ static int team_init(struct net_device *dev)
                goto err_options_register;
        netif_carrier_off(dev);
-        netdev_lockdep_set_classes(dev);
+        lockdep_register_key(&team->team_lock_key);
+        __mutex_init(&team->lock, "team->team_lock_key", &team->team_lock_key);
        return 0;
@@ -1673,6 +1673,7 @@ static void team_uninit(struct net_device *dev)
        team_queue_override_fini(team);
        mutex_unlock(&team->lock);
        netdev_change_features(dev);
+        lockdep_unregister_key(&team->team_lock_key);
 }
 static void team_destructor(struct net_device *dev)
@@ -1976,8 +1977,15 @@ static int team_del_slave(struct net_device *dev, struct net_device *port_dev)
        err = team_port_del(team, port_dev);
        mutex_unlock(&team->lock);
-        if (!err)
+        if (err)
-                netdev_change_features(dev);
+                return err;
+        if (netif_is_team_master(port_dev)) {
+                lockdep_unregister_key(&team->team_lock_key);
+                lockdep_register_key(&team->team_lock_key);
+                lockdep_set_class(&team->lock, &team->team_lock_key);
+        }
+        netdev_change_features(dev);
        return err;
 }
diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
index 32f53de5b1fe..fe630438f67b 100644
--- a/drivers/net/usb/cdc_ether.c
+++ b/drivers/net/usb/cdc_ether.c
@@ -787,6 +787,13 @@ static const struct usb_device_id	products[] = {
        .driver_info = 0,
 },
+/* ThinkPad USB-C Dock Gen 2 (based on Realtek RTL8153) */
+{
+        USB_DEVICE_AND_INTERFACE_INFO(LENOVO_VENDOR_ID, 0xa387, USB_CLASS_COMM,
+                        USB_CDC_SUBCLASS_ETHERNET, USB_CDC_PROTO_NONE),
+        .driver_info = 0,
+},
 /* NVIDIA Tegra USB 3.0 Ethernet Adapters (based on Realtek RTL8153) */
 {
        USB_DEVICE_AND_INTERFACE_INFO(NVIDIA_VENDOR_ID, 0x09ff, USB_CLASS_COMM,
diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
index 62948098191f..f24a1b0b801f 100644
--- a/drivers/net/usb/lan78xx.c
+++ b/drivers/net/usb/lan78xx.c
@@ -1264,8 +1264,11 @@ static void lan78xx_status(struct lan78xx_net *dev, struct urb *urb)
                netif_dbg(dev, link, dev->net, "PHY INTR: 0x%08x\n", intdata);
                lan78xx_defer_kevent(dev, EVENT_LINK_RESET);
-                if (dev->domain_data.phyirq > 0)
+                if (dev->domain_data.phyirq > 0) {
+                        local_irq_disable();
                        generic_handle_irq(dev->domain_data.phyirq);
+                        local_irq_enable();
+                }
        } else
                netdev_warn(dev->net,
                            "unexpected interrupt: 0x%08x\n", intdata);
diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
index cee9fef925cd..d4a95b50bda6 100644
--- a/drivers/net/usb/r8152.c
+++ b/drivers/net/usb/r8152.c
@@ -5755,6 +5755,7 @@ static const struct usb_device_id rtl8152_table[] = {
        {REALTEK_USB_DEVICE(VENDOR_ID_LENOVO,  0x7205)},
        {REALTEK_USB_DEVICE(VENDOR_ID_LENOVO,  0x720c)},
        {REALTEK_USB_DEVICE(VENDOR_ID_LENOVO,  0x7214)},
+        {REALTEK_USB_DEVICE(VENDOR_ID_LENOVO,  0xa387)},
        {REALTEK_USB_DEVICE(VENDOR_ID_LINKSYS, 0x0041)},
        {REALTEK_USB_DEVICE(VENDOR_ID_NVIDIA,  0x09ff)},
        {REALTEK_USB_DEVICE(VENDOR_ID_TPLINK,  0x0601)},
diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c
index ee52bde058df..b8228f50bc94 100644
--- a/drivers/net/vrf.c
+++ b/drivers/net/vrf.c
@@ -865,7 +865,6 @@ static int vrf_dev_init(struct net_device *dev)
        /* similarly, oper state is irrelevant; set to up to avoid confusion */
        dev->operstate = IF_OPER_UP;
-        netdev_lockdep_set_classes(dev);
        return 0;
 out_rth:
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index 3d9bcc957f7d..8869154fad88 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -2487,9 +2487,11 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
                vni = tunnel_id_to_key32(info->key.tun_id);
                ifindex = 0;
                dst_cache = &info->dst_cache;
-                if (info->options_len &&
+                if (info->key.tun_flags & TUNNEL_VXLAN_OPT) {
-                    info->key.tun_flags & TUNNEL_VXLAN_OPT)
+                        if (info->options_len < sizeof(*md))
+                                goto drop;
                        md = ip_tunnel_info_opts(info);
+                }
                ttl = info->key.ttl;
                tos = info->key.tos;
                label = info->key.label;
@@ -3566,10 +3568,13 @@ static int __vxlan_dev_create(struct net *net, struct net_device *dev,
 {
        struct vxlan_net *vn = net_generic(net, vxlan_net_id);
        struct vxlan_dev *vxlan = netdev_priv(dev);
+        struct net_device *remote_dev = NULL;
        struct vxlan_fdb *f = NULL;
        bool unregister = false;
+        struct vxlan_rdst *dst;
        int err;
+        dst = &vxlan->default_dst;
        err = vxlan_dev_configure(net, dev, conf, false, extack);
        if (err)
                return err;
@@ -3577,14 +3582,14 @@ static int __vxlan_dev_create(struct net *net, struct net_device *dev,
        dev->ethtool_ops = &vxlan_ethtool_ops;
        /* create an fdb entry for a valid default destination */
-        if (!vxlan_addr_any(&vxlan->default_dst.remote_ip)) {
+        if (!vxlan_addr_any(&dst->remote_ip)) {
                err = vxlan_fdb_create(vxlan, all_zeros_mac,
-                                       &vxlan->default_dst.remote_ip,
+                                       &dst->remote_ip,
                                       NUD_REACHABLE | NUD_PERMANENT,
                                       vxlan->cfg.dst_port,
-                                       vxlan->default_dst.remote_vni,
+                                       dst->remote_vni,
-                                       vxlan->default_dst.remote_vni,
+                                       dst->remote_vni,
-                                       vxlan->default_dst.remote_ifindex,
+                                       dst->remote_ifindex,
                                       NTF_SELF, &f);
                if (err)
                        return err;
@@ -3595,26 +3600,41 @@ static int __vxlan_dev_create(struct net *net, struct net_device *dev,
                goto errout;
        unregister = true;
+        if (dst->remote_ifindex) {
+                remote_dev = __dev_get_by_index(net, dst->remote_ifindex);
+                if (!remote_dev)
+                        goto errout;
+                err = netdev_upper_dev_link(remote_dev, dev, extack);
+                if (err)
+                        goto errout;
+        }
        err = rtnl_configure_link(dev, NULL);
        if (err)
-                goto errout;
+                goto unlink;
        if (f) {
-                vxlan_fdb_insert(vxlan, all_zeros_mac,
+                vxlan_fdb_insert(vxlan, all_zeros_mac, dst->remote_vni, f);
-                                 vxlan->default_dst.remote_vni, f);
                /* notify default fdb entry */
                err = vxlan_fdb_notify(vxlan, f, first_remote_rtnl(f),
                                       RTM_NEWNEIGH, true, extack);
                if (err) {
                        vxlan_fdb_destroy(vxlan, f, false, false);
+                        if (remote_dev)
+                                netdev_upper_dev_unlink(remote_dev, dev);
                        goto unregister;
                }
        }
        list_add(&vxlan->next, &vn->vxlan_list);
+        if (remote_dev)
+                dst->remote_dev = remote_dev;
        return 0;
+unlink:
+        if (remote_dev)
+                netdev_upper_dev_unlink(remote_dev, dev);
 errout:
        /* unregister_netdevice() destroys the default FDB entry with deletion
         * notification. But the addition notification was not sent yet, so
@@ -3932,11 +3952,12 @@ static int vxlan_changelink(struct net_device *dev, struct nlattr *tb[],
                            struct netlink_ext_ack *extack)
 {
        struct vxlan_dev *vxlan = netdev_priv(dev);
-        struct vxlan_rdst *dst = &vxlan->default_dst;
        struct net_device *lowerdev;
        struct vxlan_config conf;
+        struct vxlan_rdst *dst;
        int err;
+        dst = &vxlan->default_dst;
        err = vxlan_nl2conf(tb, data, dev, &conf, true, extack);
        if (err)
                return err;
@@ -3946,6 +3967,14 @@ static int vxlan_changelink(struct net_device *dev, struct nlattr *tb[],
        if (err)
                return err;
+        if (dst->remote_dev == lowerdev)
+                lowerdev = NULL;
+        err = netdev_adjacent_change_prepare(dst->remote_dev, lowerdev, dev,
+                                             extack);
+        if (err)
+                return err;
        /* handle default dst entry */
        if (!vxlan_addr_equal(&conf.remote_ip, &dst->remote_ip)) {
                u32 hash_index = fdb_head_index(vxlan, all_zeros_mac, conf.vni);
@@ -3962,6 +3991,8 @@ static int vxlan_changelink(struct net_device *dev, struct nlattr *tb[],
                                               NTF_SELF, true, extack);
                        if (err) {
                                spin_unlock_bh(&vxlan->hash_lock[hash_index]);
+                                netdev_adjacent_change_abort(dst->remote_dev,
+                                                             lowerdev, dev);
                                return err;
                        }
                }
@@ -3979,6 +4010,11 @@ static int vxlan_changelink(struct net_device *dev, struct nlattr *tb[],
        if (conf.age_interval != vxlan->cfg.age_interval)
                mod_timer(&vxlan->age_timer, jiffies);
+        netdev_adjacent_change_commit(dst->remote_dev, lowerdev, dev);
+        if (lowerdev && lowerdev != dst->remote_dev) {
+                dst->remote_dev = lowerdev;
+                netdev_update_lockdep_key(lowerdev);
+        }
        vxlan_config_apply(dev, &conf, lowerdev, vxlan->net, true);
        return 0;
 }
@@ -3991,6 +4027,8 @@ static void vxlan_dellink(struct net_device *dev, struct list_head *head)
        list_del(&vxlan->next);
        unregister_netdevice_queue(dev, head);
+        if (vxlan->default_dst.remote_dev)
+                netdev_upper_dev_unlink(vxlan->default_dst.remote_dev, dev);
 }
 static size_t vxlan_get_size(const struct net_device *dev)
diff --git a/drivers/net/wimax/i2400m/op-rfkill.c b/drivers/net/wimax/i2400m/op-rfkill.c
index 8efb493ceec2..5c79f052cad2 100644
--- a/drivers/net/wimax/i2400m/op-rfkill.c
+++ b/drivers/net/wimax/i2400m/op-rfkill.c
@@ -127,12 +127,12 @@ int i2400m_op_rfkill_sw_toggle(struct wimax_dev *wimax_dev,
                        "%d\n", result);
        result = 0;
 error_cmd:
-        kfree(cmd);
        kfree_skb(ack_skb);
 error_msg_to_dev:
 error_alloc:
        d_fnend(4, dev, "(wimax_dev %p state %d) = %d\n",
                wimax_dev, state, result);
+        kfree(cmd);
        return result;
 }
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/api/scan.h b/drivers/net/wireless/intel/iwlwifi/fw/api/scan.h
index 39c64850cb6f..c0750ced5ac2 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/api/scan.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/api/scan.h
@@ -520,7 +520,7 @@ struct iwl_scan_dwell {
 } __packed;
 /**
- * struct iwl_scan_config
+ * struct iwl_scan_config_v1
 * @flags:                      enum scan_config_flags
 * @tx_chains:                  valid_tx antenna - ANT_* definitions
 * @rx_chains:                  valid_rx antenna - ANT_* definitions
@@ -552,7 +552,7 @@ struct iwl_scan_config_v1 {
 #define SCAN_LB_LMAC_IDX 0
 #define SCAN_HB_LMAC_IDX 1
-struct iwl_scan_config {
+struct iwl_scan_config_v2 {
        __le32 flags;
        __le32 tx_chains;
        __le32 rx_chains;
@@ -564,6 +564,24 @@ struct iwl_scan_config {
        u8 bcast_sta_id;
        u8 channel_flags;
        u8 channel_array[];
+} __packed; /* SCAN_CONFIG_DB_CMD_API_S_2 */
+/**
+ * struct iwl_scan_config
+ * @enable_cam_mode: whether to enable CAM mode.
+ * @enable_promiscouos_mode: whether to enable promiscouos mode
+ * @bcast_sta_id: the index of the station in the fw
+ * @reserved: reserved
+ * @tx_chains: valid_tx antenna - ANT_* definitions
+ * @rx_chains: valid_rx antenna - ANT_* definitions
+ */
+struct iwl_scan_config {
+        u8 enable_cam_mode;
+        u8 enable_promiscouos_mode;
+        u8 bcast_sta_id;
+        u8 reserved;
+        __le32 tx_chains;
+        __le32 rx_chains;
 } __packed; /* SCAN_CONFIG_DB_CMD_API_S_3 */
 /**
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/file.h b/drivers/net/wireless/intel/iwlwifi/fw/file.h
index 423cc0cf8e78..0d5bc4ce5c07 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/file.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/file.h
@@ -288,6 +288,8 @@ typedef unsigned int __bitwise iwl_ucode_tlv_api_t;
 *      STA_CONTEXT_DOT11AX_API_S
 * @IWL_UCODE_TLV_CAPA_SAR_TABLE_VER: This ucode supports different sar
 *      version tables.
+ * @IWL_UCODE_TLV_API_REDUCED_SCAN_CONFIG: This ucode supports v3 of
+ *  SCAN_CONFIG_DB_CMD_API_S.
 *
 * @NUM_IWL_UCODE_TLV_API: number of bits used
 */
@@ -321,6 +323,7 @@ enum iwl_ucode_tlv_api {
        IWL_UCODE_TLV_API_WOWLAN_TCP_SYN_WAKE   = (__force iwl_ucode_tlv_api_t)53,
        IWL_UCODE_TLV_API_FTM_RTT_ACCURACY      = (__force iwl_ucode_tlv_api_t)54,
        IWL_UCODE_TLV_API_SAR_TABLE_VER         = (__force iwl_ucode_tlv_api_t)55,
+        IWL_UCODE_TLV_API_REDUCED_SCAN_CONFIG   = (__force iwl_ucode_tlv_api_t)56,
        IWL_UCODE_TLV_API_ADWELL_HB_DEF_N_AP    = (__force iwl_ucode_tlv_api_t)57,
        IWL_UCODE_TLV_API_SCAN_EXT_CHAN_VER     = (__force iwl_ucode_tlv_api_t)58,
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-csr.h b/drivers/net/wireless/intel/iwlwifi/iwl-csr.h
index cb4c5514a556..695bbaa86273 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-csr.h
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-csr.h
@@ -279,6 +279,7 @@
 *         Indicates MAC is entering a power-saving sleep power-down.
 *         Not a good time to access device-internal resources.
 */
+#define CSR_GP_CNTRL_REG_FLAG_INIT_DONE              (0x00000004)
 #define CSR_GP_CNTRL_REG_FLAG_GOING_TO_SLEEP         (0x00000010)
 #define CSR_GP_CNTRL_REG_FLAG_XTAL_ON                (0x00000400)
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-prph.h b/drivers/net/wireless/intel/iwlwifi/iwl-prph.h
index f47e0f97acf8..23c25a7665f2 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-prph.h
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-prph.h
@@ -449,6 +449,11 @@ enum {
 #define PERSISTENCE_BIT                 BIT(12)
 #define PREG_WFPM_ACCESS                BIT(12)
+#define HPM_HIPM_GEN_CFG                        0xA03458
+#define HPM_HIPM_GEN_CFG_CR_PG_EN               BIT(0)
+#define HPM_HIPM_GEN_CFG_CR_SLP_EN              BIT(1)
+#define HPM_HIPM_GEN_CFG_CR_FORCE_ACTIVE        BIT(10)
 #define UREG_DOORBELL_TO_ISR6           0xA05C04
 #define UREG_DOORBELL_TO_ISR6_NMI_BIT   BIT(0)
 #define UREG_DOORBELL_TO_ISR6_SUSPEND   BIT(18)
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
index 843d00bf2bd5..5ca50f39a023 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
@@ -1405,6 +1405,12 @@ static inline bool iwl_mvm_is_scan_ext_chan_supported(struct iwl_mvm *mvm)
                          IWL_UCODE_TLV_API_SCAN_EXT_CHAN_VER);
 }
+static inline bool iwl_mvm_is_reduced_config_scan_supported(struct iwl_mvm *mvm)
+{
+        return fw_has_api(&mvm->fw->ucode_capa,
+                          IWL_UCODE_TLV_API_REDUCED_SCAN_CONFIG);
+}
 static inline bool iwl_mvm_has_new_rx_stats_api(struct iwl_mvm *mvm)
 {
        return fw_has_api(&mvm->fw->ucode_capa,
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c
index f6b3045badbd..fcafa22ec6ce 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c
@@ -1137,11 +1137,11 @@ static void iwl_mvm_fill_scan_config_v1(struct iwl_mvm *mvm, void *config,
        iwl_mvm_fill_channels(mvm, cfg->channel_array, max_channels);
 }
-static void iwl_mvm_fill_scan_config(struct iwl_mvm *mvm, void *config,
+static void iwl_mvm_fill_scan_config_v2(struct iwl_mvm *mvm, void *config,
-                                     u32 flags, u8 channel_flags,
+                                        u32 flags, u8 channel_flags,
-                                     u32 max_channels)
+                                        u32 max_channels)
 {
-        struct iwl_scan_config *cfg = config;
+        struct iwl_scan_config_v2 *cfg = config;
        cfg->flags = cpu_to_le32(flags);
        cfg->tx_chains = cpu_to_le32(iwl_mvm_get_valid_tx_ant(mvm));
@@ -1185,7 +1185,7 @@ static void iwl_mvm_fill_scan_config(struct iwl_mvm *mvm, void *config,
        iwl_mvm_fill_channels(mvm, cfg->channel_array, max_channels);
 }
-int iwl_mvm_config_scan(struct iwl_mvm *mvm)
+static int iwl_mvm_legacy_config_scan(struct iwl_mvm *mvm)
 {
        void *cfg;
        int ret, cmd_size;
@@ -1217,7 +1217,7 @@ int iwl_mvm_config_scan(struct iwl_mvm *mvm)
        }
        if (iwl_mvm_cdb_scan_api(mvm))
-                cmd_size = sizeof(struct iwl_scan_config);
+                cmd_size = sizeof(struct iwl_scan_config_v2);
        else
                cmd_size = sizeof(struct iwl_scan_config_v1);
        cmd_size += num_channels;
@@ -1254,8 +1254,8 @@ int iwl_mvm_config_scan(struct iwl_mvm *mvm)
                        flags |= (iwl_mvm_is_scan_fragmented(hb_type)) ?
                                 SCAN_CONFIG_FLAG_SET_LMAC2_FRAGMENTED :
                                 SCAN_CONFIG_FLAG_CLEAR_LMAC2_FRAGMENTED;
-                iwl_mvm_fill_scan_config(mvm, cfg, flags, channel_flags,
+                iwl_mvm_fill_scan_config_v2(mvm, cfg, flags, channel_flags,
-                                         num_channels);
+                                            num_channels);
        } else {
                iwl_mvm_fill_scan_config_v1(mvm, cfg, flags, channel_flags,
                                            num_channels);
@@ -1277,6 +1277,30 @@ int iwl_mvm_config_scan(struct iwl_mvm *mvm)
        return ret;
 }
+int iwl_mvm_config_scan(struct iwl_mvm *mvm)
+{
+        struct iwl_scan_config cfg;
+        struct iwl_host_cmd cmd = {
+                .id = iwl_cmd_id(SCAN_CFG_CMD, IWL_ALWAYS_LONG_GROUP, 0),
+                .len[0] = sizeof(cfg),
+                .data[0] = &cfg,
+                .dataflags[0] = IWL_HCMD_DFL_NOCOPY,
+        };
+        if (!iwl_mvm_is_reduced_config_scan_supported(mvm))
+                return iwl_mvm_legacy_config_scan(mvm);
+        memset(&cfg, 0, sizeof(cfg));
+        cfg.bcast_sta_id = mvm->aux_sta.sta_id;
+        cfg.tx_chains = cpu_to_le32(iwl_mvm_get_valid_tx_ant(mvm));
+        cfg.rx_chains = cpu_to_le32(iwl_mvm_scan_rx_ant(mvm));
+        IWL_DEBUG_SCAN(mvm, "Sending UMAC scan config\n");
+        return iwl_mvm_send_cmd(mvm, &cmd);
+}
 static int iwl_mvm_scan_uid_by_status(struct iwl_mvm *mvm, int status)
 {
        int i;
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
index 0bedba4c61f2..b3768d5d852a 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
@@ -1482,6 +1482,13 @@ static void iwl_mvm_realloc_queues_after_restart(struct iwl_mvm *mvm,
                                            mvm_sta->sta_id, i);
                        txq_id = iwl_mvm_tvqm_enable_txq(mvm, mvm_sta->sta_id,
                                                         i, wdg);
+                        /*
+                         * on failures, just set it to IWL_MVM_INVALID_QUEUE
+                         * to try again later, we have no other good way of
+                         * failing here
+                         */
+                        if (txq_id < 0)
+                                txq_id = IWL_MVM_INVALID_QUEUE;
                        tid_data->txq_id = txq_id;
                        /*
@@ -1950,30 +1957,73 @@ void iwl_mvm_dealloc_int_sta(struct iwl_mvm *mvm, struct iwl_mvm_int_sta *sta)
        sta->sta_id = IWL_MVM_INVALID_STA;
 }
-static void iwl_mvm_enable_aux_snif_queue(struct iwl_mvm *mvm, u16 *queue,
+static void iwl_mvm_enable_aux_snif_queue(struct iwl_mvm *mvm, u16 queue,
                                          u8 sta_id, u8 fifo)
 {
        unsigned int wdg_timeout = iwlmvm_mod_params.tfd_q_hang_detect ?
                mvm->trans->trans_cfg->base_params->wd_timeout :
                IWL_WATCHDOG_DISABLED;
+        struct iwl_trans_txq_scd_cfg cfg = {
+                .fifo = fifo,
+                .sta_id = sta_id,
+                .tid = IWL_MAX_TID_COUNT,
+                .aggregate = false,
+                .frame_limit = IWL_FRAME_LIMIT,
+        };
+        WARN_ON(iwl_mvm_has_new_tx_api(mvm));
+        iwl_mvm_enable_txq(mvm, NULL, queue, 0, &cfg, wdg_timeout);
+}
+static int iwl_mvm_enable_aux_snif_queue_tvqm(struct iwl_mvm *mvm, u8 sta_id)
+{
+        unsigned int wdg_timeout = iwlmvm_mod_params.tfd_q_hang_detect ?
+                mvm->trans->trans_cfg->base_params->wd_timeout :
+                IWL_WATCHDOG_DISABLED;
+        WARN_ON(!iwl_mvm_has_new_tx_api(mvm));
+        return iwl_mvm_tvqm_enable_txq(mvm, sta_id, IWL_MAX_TID_COUNT,
+                                       wdg_timeout);
+}
+static int iwl_mvm_add_int_sta_with_queue(struct iwl_mvm *mvm, int macidx,
+                                          int maccolor,
+                                          struct iwl_mvm_int_sta *sta,
+                                          u16 *queue, int fifo)
+{
+        int ret;
+        /* Map queue to fifo - needs to happen before adding station */
+        if (!iwl_mvm_has_new_tx_api(mvm))
+                iwl_mvm_enable_aux_snif_queue(mvm, *queue, sta->sta_id, fifo);
+        ret = iwl_mvm_add_int_sta_common(mvm, sta, NULL, macidx, maccolor);
+        if (ret) {
+                if (!iwl_mvm_has_new_tx_api(mvm))
+                        iwl_mvm_disable_txq(mvm, NULL, *queue,
+                                            IWL_MAX_TID_COUNT, 0);
+                return ret;
+        }
+        /*
+         * For 22000 firmware and on we cannot add queue to a station unknown
+         * to firmware so enable queue here - after the station was added
+         */
        if (iwl_mvm_has_new_tx_api(mvm)) {
-                int tvqm_queue =
+                int txq;
-                        iwl_mvm_tvqm_enable_txq(mvm, sta_id,
-                                                IWL_MAX_TID_COUNT,
-                                                wdg_timeout);
-                *queue = tvqm_queue;
-        } else {
-                struct iwl_trans_txq_scd_cfg cfg = {
-                        .fifo = fifo,
-                        .sta_id = sta_id,
-                        .tid = IWL_MAX_TID_COUNT,
-                        .aggregate = false,
-                        .frame_limit = IWL_FRAME_LIMIT,
-                };
-                iwl_mvm_enable_txq(mvm, NULL, *queue, 0, &cfg, wdg_timeout);
+                txq = iwl_mvm_enable_aux_snif_queue_tvqm(mvm, sta->sta_id);
+                if (txq < 0) {
+                        iwl_mvm_rm_sta_common(mvm, sta->sta_id);
+                        return txq;
+                }
+                *queue = txq;
        }
+        return 0;
 }
 int iwl_mvm_add_aux_sta(struct iwl_mvm *mvm)
@@ -1989,59 +2039,26 @@ int iwl_mvm_add_aux_sta(struct iwl_mvm *mvm)
        if (ret)
                return ret;
-        /* Map Aux queue to fifo - needs to happen before adding Aux station */
+        ret = iwl_mvm_add_int_sta_with_queue(mvm, MAC_INDEX_AUX, 0,
-        if (!iwl_mvm_has_new_tx_api(mvm))
+                                             &mvm->aux_sta, &mvm->aux_queue,
-                iwl_mvm_enable_aux_snif_queue(mvm, &mvm->aux_queue,
+                                             IWL_MVM_TX_FIFO_MCAST);
-                                              mvm->aux_sta.sta_id,
-                                              IWL_MVM_TX_FIFO_MCAST);
-        ret = iwl_mvm_add_int_sta_common(mvm, &mvm->aux_sta, NULL,
-                                         MAC_INDEX_AUX, 0);
        if (ret) {
                iwl_mvm_dealloc_int_sta(mvm, &mvm->aux_sta);
                return ret;
        }
-        /*
-         * For 22000 firmware and on we cannot add queue to a station unknown
-         * to firmware so enable queue here - after the station was added
-         */
-        if (iwl_mvm_has_new_tx_api(mvm))
-                iwl_mvm_enable_aux_snif_queue(mvm, &mvm->aux_queue,
-                                              mvm->aux_sta.sta_id,
-                                              IWL_MVM_TX_FIFO_MCAST);
        return 0;
 }
 int iwl_mvm_add_snif_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
 {
        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
-        int ret;
        lockdep_assert_held(&mvm->mutex);
-        /* Map snif queue to fifo - must happen before adding snif station */
+        return iwl_mvm_add_int_sta_with_queue(mvm, mvmvif->id, mvmvif->color,
-        if (!iwl_mvm_has_new_tx_api(mvm))
+                                              &mvm->snif_sta, &mvm->snif_queue,
-                iwl_mvm_enable_aux_snif_queue(mvm, &mvm->snif_queue,
-                                              mvm->snif_sta.sta_id,
                                              IWL_MVM_TX_FIFO_BE);
-        ret = iwl_mvm_add_int_sta_common(mvm, &mvm->snif_sta, vif->addr,
-                                         mvmvif->id, 0);
-        if (ret)
-                return ret;
-        /*
-         * For 22000 firmware and on we cannot add queue to a station unknown
-         * to firmware so enable queue here - after the station was added
-         */
-        if (iwl_mvm_has_new_tx_api(mvm))
-                iwl_mvm_enable_aux_snif_queue(mvm, &mvm->snif_queue,
-                                              mvm->snif_sta.sta_id,
-                                              IWL_MVM_TX_FIFO_BE);
-        return 0;
 }
 int iwl_mvm_rm_snif_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
@@ -2133,6 +2150,10 @@ int iwl_mvm_send_add_bcast_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
                queue = iwl_mvm_tvqm_enable_txq(mvm, bsta->sta_id,
                                                IWL_MAX_TID_COUNT,
                                                wdg_timeout);
+                if (queue < 0) {
+                        iwl_mvm_rm_sta_common(mvm, bsta->sta_id);
+                        return queue;
+                }
                if (vif->type == NL80211_IFTYPE_AP ||
                    vif->type == NL80211_IFTYPE_ADHOC)
@@ -2307,10 +2328,8 @@ int iwl_mvm_add_mcast_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
        }
        ret = iwl_mvm_add_int_sta_common(mvm, msta, maddr,
                                         mvmvif->id, mvmvif->color);
-        if (ret) {
+        if (ret)
-                iwl_mvm_dealloc_int_sta(mvm, msta);
+                goto err;
-                return ret;
-        }
        /*
         * Enable cab queue after the ADD_STA command is sent.
@@ -2323,6 +2342,10 @@ int iwl_mvm_add_mcast_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
                int queue = iwl_mvm_tvqm_enable_txq(mvm, msta->sta_id,
                                                    0,
                                                    timeout);
+                if (queue < 0) {
+                        ret = queue;
+                        goto err;
+                }
                mvmvif->cab_queue = queue;
        } else if (!fw_has_api(&mvm->fw->ucode_capa,
                               IWL_UCODE_TLV_API_STA_TYPE))
@@ -2330,6 +2353,9 @@ int iwl_mvm_add_mcast_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
                                   timeout);
        return 0;
+err:
+        iwl_mvm_dealloc_int_sta(mvm, msta);
+        return ret;
 }
 static int __iwl_mvm_remove_sta_key(struct iwl_mvm *mvm, u8 sta_id,
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
index 6f4bb7ce71a5..040cec17d3ad 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
@@ -573,20 +573,20 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
        {IWL_PCI_DEVICE(0x2526, 0x0034, iwl9560_2ac_cfg)},
        {IWL_PCI_DEVICE(0x2526, 0x0038, iwl9560_2ac_160_cfg)},
        {IWL_PCI_DEVICE(0x2526, 0x003C, iwl9560_2ac_160_cfg)},
-        {IWL_PCI_DEVICE(0x2526, 0x0060, iwl9460_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x0060, iwl9461_2ac_cfg_soc)},
-        {IWL_PCI_DEVICE(0x2526, 0x0064, iwl9460_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x0064, iwl9461_2ac_cfg_soc)},
-        {IWL_PCI_DEVICE(0x2526, 0x00A0, iwl9460_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x00A0, iwl9462_2ac_cfg_soc)},
-        {IWL_PCI_DEVICE(0x2526, 0x00A4, iwl9460_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x00A4, iwl9462_2ac_cfg_soc)},
        {IWL_PCI_DEVICE(0x2526, 0x0210, iwl9260_2ac_cfg)},
        {IWL_PCI_DEVICE(0x2526, 0x0214, iwl9260_2ac_cfg)},
        {IWL_PCI_DEVICE(0x2526, 0x0230, iwl9560_2ac_cfg)},
        {IWL_PCI_DEVICE(0x2526, 0x0234, iwl9560_2ac_cfg)},
        {IWL_PCI_DEVICE(0x2526, 0x0238, iwl9560_2ac_cfg)},
        {IWL_PCI_DEVICE(0x2526, 0x023C, iwl9560_2ac_cfg)},
-        {IWL_PCI_DEVICE(0x2526, 0x0260, iwl9460_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x0260, iwl9461_2ac_cfg_soc)},
        {IWL_PCI_DEVICE(0x2526, 0x0264, iwl9461_2ac_cfg_soc)},
-        {IWL_PCI_DEVICE(0x2526, 0x02A0, iwl9460_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x02A0, iwl9462_2ac_cfg_soc)},
-        {IWL_PCI_DEVICE(0x2526, 0x02A4, iwl9460_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x02A4, iwl9462_2ac_cfg_soc)},
        {IWL_PCI_DEVICE(0x2526, 0x1010, iwl9260_2ac_cfg)},
        {IWL_PCI_DEVICE(0x2526, 0x1030, iwl9560_2ac_cfg)},
        {IWL_PCI_DEVICE(0x2526, 0x1210, iwl9260_2ac_cfg)},
@@ -603,7 +603,7 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
        {IWL_PCI_DEVICE(0x2526, 0x401C, iwl9260_2ac_160_cfg)},
        {IWL_PCI_DEVICE(0x2526, 0x4030, iwl9560_2ac_160_cfg)},
        {IWL_PCI_DEVICE(0x2526, 0x4034, iwl9560_2ac_160_cfg_soc)},
-        {IWL_PCI_DEVICE(0x2526, 0x40A4, iwl9460_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x40A4, iwl9462_2ac_cfg_soc)},
        {IWL_PCI_DEVICE(0x2526, 0x4234, iwl9560_2ac_cfg_soc)},
        {IWL_PCI_DEVICE(0x2526, 0x42A4, iwl9462_2ac_cfg_soc)},
        {IWL_PCI_DEVICE(0x2526, 0x6010, iwl9260_2ac_160_cfg)},
@@ -618,60 +618,61 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
        {IWL_PCI_DEVICE(0x271B, 0x0210, iwl9160_2ac_cfg)},
        {IWL_PCI_DEVICE(0x271B, 0x0214, iwl9260_2ac_cfg)},
        {IWL_PCI_DEVICE(0x271C, 0x0214, iwl9260_2ac_cfg)},
-        {IWL_PCI_DEVICE(0x2720, 0x0034, iwl9560_2ac_160_cfg)},
-        {IWL_PCI_DEVICE(0x2720, 0x0038, iwl9560_2ac_160_cfg)},
+        {IWL_PCI_DEVICE(0x2720, 0x0034, iwl9560_2ac_cfg_qu_b0_jf_b0)},
-        {IWL_PCI_DEVICE(0x2720, 0x003C, iwl9560_2ac_160_cfg)},
+        {IWL_PCI_DEVICE(0x2720, 0x0038, iwl9560_2ac_160_cfg_qu_b0_jf_b0)},
-        {IWL_PCI_DEVICE(0x2720, 0x0060, iwl9461_2ac_cfg_soc)},
+        {IWL_PCI_DEVICE(0x2720, 0x003C, iwl9560_2ac_160_cfg_qu_b0_jf_b0)},
-        {IWL_PCI_DEVICE(0x2720, 0x0064, iwl9461_2ac_cfg_soc)},
+        {IWL_PCI_DEVICE(0x2720, 0x0060, iwl9461_2ac_cfg_qu_b0_jf_b0)},
-        {IWL_PCI_DEVICE(0x2720, 0x00A0, iwl9462_2ac_cfg_soc)},
+        {IWL_PCI_DEVICE(0x2720, 0x0064, iwl9461_2ac_cfg_qu_b0_jf_b0)},
-        {IWL_PCI_DEVICE(0x2720, 0x00A4, iwl9462_2ac_cfg_soc)},
+        {IWL_PCI_DEVICE(0x2720, 0x00A0, iwl9462_2ac_cfg_qu_b0_jf_b0)},
-        {IWL_PCI_DEVICE(0x2720, 0x0230, iwl9560_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2720, 0x00A4, iwl9462_2ac_cfg_qu_b0_jf_b0)},
-        {IWL_PCI_DEVICE(0x2720, 0x0234, iwl9560_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2720, 0x0230, iwl9560_2ac_cfg_qu_b0_jf_b0)},
-        {IWL_PCI_DEVICE(0x2720, 0x0238, iwl9560_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2720, 0x0234, iwl9560_2ac_cfg_qu_b0_jf_b0)},
-        {IWL_PCI_DEVICE(0x2720, 0x023C, iwl9560_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2720, 0x0238, iwl9560_2ac_cfg_qu_b0_jf_b0)},
-        {IWL_PCI_DEVICE(0x2720, 0x0260, iwl9461_2ac_cfg_soc)},
+        {IWL_PCI_DEVICE(0x2720, 0x023C, iwl9560_2ac_cfg_qu_b0_jf_b0)},
-        {IWL_PCI_DEVICE(0x2720, 0x0264, iwl9461_2ac_cfg_soc)},
+        {IWL_PCI_DEVICE(0x2720, 0x0260, iwl9461_2ac_cfg_qu_b0_jf_b0)},
-        {IWL_PCI_DEVICE(0x2720, 0x02A0, iwl9462_2ac_cfg_soc)},
+        {IWL_PCI_DEVICE(0x2720, 0x0264, iwl9461_2ac_cfg_qu_b0_jf_b0)},
-        {IWL_PCI_DEVICE(0x2720, 0x02A4, iwl9462_2ac_cfg_soc)},
+        {IWL_PCI_DEVICE(0x2720, 0x02A0, iwl9462_2ac_cfg_qu_b0_jf_b0)},
-        {IWL_PCI_DEVICE(0x2720, 0x1010, iwl9260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2720, 0x02A4, iwl9462_2ac_cfg_qu_b0_jf_b0)},
-        {IWL_PCI_DEVICE(0x2720, 0x1030, iwl9560_2ac_cfg_soc)},
+        {IWL_PCI_DEVICE(0x2720, 0x1030, iwl9560_2ac_cfg_qu_b0_jf_b0)},
-        {IWL_PCI_DEVICE(0x2720, 0x1210, iwl9260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2720, 0x1551, killer1550s_2ac_cfg_qu_b0_jf_b0)},
-        {IWL_PCI_DEVICE(0x2720, 0x1551, iwl9560_killer_s_2ac_cfg_soc)},
+        {IWL_PCI_DEVICE(0x2720, 0x1552, killer1550i_2ac_cfg_qu_b0_jf_b0)},
-        {IWL_PCI_DEVICE(0x2720, 0x1552, iwl9560_killer_2ac_cfg_soc)},
+        {IWL_PCI_DEVICE(0x2720, 0x2030, iwl9560_2ac_160_cfg_qu_b0_jf_b0)},
-        {IWL_PCI_DEVICE(0x2720, 0x2030, iwl9560_2ac_160_cfg_soc)},
+        {IWL_PCI_DEVICE(0x2720, 0x2034, iwl9560_2ac_160_cfg_qu_b0_jf_b0)},
-        {IWL_PCI_DEVICE(0x2720, 0x2034, iwl9560_2ac_160_cfg_soc)},
+        {IWL_PCI_DEVICE(0x2720, 0x4030, iwl9560_2ac_160_cfg_qu_b0_jf_b0)},
-        {IWL_PCI_DEVICE(0x2720, 0x4030, iwl9560_2ac_160_cfg)},
+        {IWL_PCI_DEVICE(0x2720, 0x4034, iwl9560_2ac_160_cfg_qu_b0_jf_b0)},
-        {IWL_PCI_DEVICE(0x2720, 0x4034, iwl9560_2ac_160_cfg_soc)},
+        {IWL_PCI_DEVICE(0x2720, 0x40A4, iwl9462_2ac_cfg_qu_b0_jf_b0)},
-        {IWL_PCI_DEVICE(0x2720, 0x40A4, iwl9462_2ac_cfg_soc)},
+        {IWL_PCI_DEVICE(0x2720, 0x4234, iwl9560_2ac_cfg_qu_b0_jf_b0)},
-        {IWL_PCI_DEVICE(0x2720, 0x4234, iwl9560_2ac_cfg_soc)},
+        {IWL_PCI_DEVICE(0x2720, 0x42A4, iwl9462_2ac_cfg_qu_b0_jf_b0)},
-        {IWL_PCI_DEVICE(0x2720, 0x42A4, iwl9462_2ac_cfg_soc)},
+        {IWL_PCI_DEVICE(0x30DC, 0x0030, iwl9560_2ac_160_cfg_soc)},
-        {IWL_PCI_DEVICE(0x30DC, 0x0030, iwl9560_2ac_160_cfg_qu_b0_jf_b0)},
+        {IWL_PCI_DEVICE(0x30DC, 0x0034, iwl9560_2ac_cfg_soc)},
-        {IWL_PCI_DEVICE(0x30DC, 0x0034, iwl9560_2ac_cfg_qu_b0_jf_b0)},
+        {IWL_PCI_DEVICE(0x30DC, 0x0038, iwl9560_2ac_160_cfg_soc)},
-        {IWL_PCI_DEVICE(0x30DC, 0x0038, iwl9560_2ac_160_cfg_qu_b0_jf_b0)},
+        {IWL_PCI_DEVICE(0x30DC, 0x003C, iwl9560_2ac_160_cfg_soc)},
-        {IWL_PCI_DEVICE(0x30DC, 0x003C, iwl9560_2ac_160_cfg_qu_b0_jf_b0)},
+        {IWL_PCI_DEVICE(0x30DC, 0x0060, iwl9460_2ac_cfg_soc)},
-        {IWL_PCI_DEVICE(0x30DC, 0x0060, iwl9461_2ac_cfg_qu_b0_jf_b0)},
+        {IWL_PCI_DEVICE(0x30DC, 0x0064, iwl9461_2ac_cfg_soc)},
-        {IWL_PCI_DEVICE(0x30DC, 0x0064, iwl9461_2ac_cfg_qu_b0_jf_b0)},
+        {IWL_PCI_DEVICE(0x30DC, 0x00A0, iwl9462_2ac_cfg_soc)},
-        {IWL_PCI_DEVICE(0x30DC, 0x00A0, iwl9462_2ac_cfg_qu_b0_jf_b0)},
+        {IWL_PCI_DEVICE(0x30DC, 0x00A4, iwl9462_2ac_cfg_soc)},
-        {IWL_PCI_DEVICE(0x30DC, 0x00A4, iwl9462_2ac_cfg_qu_b0_jf_b0)},
+        {IWL_PCI_DEVICE(0x30DC, 0x0230, iwl9560_2ac_cfg_soc)},
-        {IWL_PCI_DEVICE(0x30DC, 0x0230, iwl9560_2ac_cfg_qu_b0_jf_b0)},
+        {IWL_PCI_DEVICE(0x30DC, 0x0234, iwl9560_2ac_cfg_soc)},
-        {IWL_PCI_DEVICE(0x30DC, 0x0234, iwl9560_2ac_cfg_qu_b0_jf_b0)},
+        {IWL_PCI_DEVICE(0x30DC, 0x0238, iwl9560_2ac_cfg_soc)},
-        {IWL_PCI_DEVICE(0x30DC, 0x0238, iwl9560_2ac_cfg_qu_b0_jf_b0)},
+        {IWL_PCI_DEVICE(0x30DC, 0x023C, iwl9560_2ac_cfg_soc)},
-        {IWL_PCI_DEVICE(0x30DC, 0x023C, iwl9560_2ac_cfg_qu_b0_jf_b0)},
+        {IWL_PCI_DEVICE(0x30DC, 0x0260, iwl9461_2ac_cfg_soc)},
-        {IWL_PCI_DEVICE(0x30DC, 0x0260, iwl9461_2ac_cfg_qu_b0_jf_b0)},
+        {IWL_PCI_DEVICE(0x30DC, 0x0264, iwl9461_2ac_cfg_soc)},
-        {IWL_PCI_DEVICE(0x30DC, 0x0264, iwl9461_2ac_cfg_qu_b0_jf_b0)},
+        {IWL_PCI_DEVICE(0x30DC, 0x02A0, iwl9462_2ac_cfg_soc)},
-        {IWL_PCI_DEVICE(0x30DC, 0x02A0, iwl9462_2ac_cfg_qu_b0_jf_b0)},
+        {IWL_PCI_DEVICE(0x30DC, 0x02A4, iwl9462_2ac_cfg_soc)},
-        {IWL_PCI_DEVICE(0x30DC, 0x02A4, iwl9462_2ac_cfg_qu_b0_jf_b0)},
+        {IWL_PCI_DEVICE(0x30DC, 0x1010, iwl9260_2ac_cfg)},
-        {IWL_PCI_DEVICE(0x30DC, 0x1030, iwl9560_2ac_cfg_qu_b0_jf_b0)},
+        {IWL_PCI_DEVICE(0x30DC, 0x1030, iwl9560_2ac_cfg_soc)},
-        {IWL_PCI_DEVICE(0x30DC, 0x1551, killer1550s_2ac_cfg_qu_b0_jf_b0)},
+        {IWL_PCI_DEVICE(0x30DC, 0x1210, iwl9260_2ac_cfg)},
-        {IWL_PCI_DEVICE(0x30DC, 0x1552, killer1550i_2ac_cfg_qu_b0_jf_b0)},
+        {IWL_PCI_DEVICE(0x30DC, 0x1551, iwl9560_killer_s_2ac_cfg_soc)},
-        {IWL_PCI_DEVICE(0x30DC, 0x2030, iwl9560_2ac_160_cfg_qu_b0_jf_b0)},
+        {IWL_PCI_DEVICE(0x30DC, 0x1552, iwl9560_killer_2ac_cfg_soc)},
-        {IWL_PCI_DEVICE(0x30DC, 0x2034, iwl9560_2ac_160_cfg_qu_b0_jf_b0)},
+        {IWL_PCI_DEVICE(0x30DC, 0x2030, iwl9560_2ac_160_cfg_soc)},
-        {IWL_PCI_DEVICE(0x30DC, 0x4030, iwl9560_2ac_160_cfg_qu_b0_jf_b0)},
+        {IWL_PCI_DEVICE(0x30DC, 0x2034, iwl9560_2ac_160_cfg_soc)},
-        {IWL_PCI_DEVICE(0x30DC, 0x4034, iwl9560_2ac_160_cfg_qu_b0_jf_b0)},
+        {IWL_PCI_DEVICE(0x30DC, 0x4030, iwl9560_2ac_160_cfg_soc)},
-        {IWL_PCI_DEVICE(0x30DC, 0x40A4, iwl9462_2ac_cfg_qu_b0_jf_b0)},
+        {IWL_PCI_DEVICE(0x30DC, 0x4034, iwl9560_2ac_160_cfg_soc)},
-        {IWL_PCI_DEVICE(0x30DC, 0x4234, iwl9560_2ac_cfg_qu_b0_jf_b0)},
+        {IWL_PCI_DEVICE(0x30DC, 0x40A4, iwl9462_2ac_cfg_soc)},
-        {IWL_PCI_DEVICE(0x30DC, 0x42A4, iwl9462_2ac_cfg_qu_b0_jf_b0)},
+        {IWL_PCI_DEVICE(0x30DC, 0x4234, iwl9560_2ac_cfg_soc)},
+        {IWL_PCI_DEVICE(0x30DC, 0x42A4, iwl9462_2ac_cfg_soc)},
        {IWL_PCI_DEVICE(0x31DC, 0x0030, iwl9560_2ac_160_cfg_shared_clk)},
        {IWL_PCI_DEVICE(0x31DC, 0x0034, iwl9560_2ac_cfg_shared_clk)},
@@ -1067,11 +1068,7 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
                }
        } else if (CSR_HW_RF_ID_TYPE_CHIP_ID(iwl_trans->hw_rf_id) ==
                   CSR_HW_RF_ID_TYPE_CHIP_ID(CSR_HW_RF_ID_TYPE_HR) &&
-                   ((cfg != &iwl_ax200_cfg_cc &&
+                   iwl_trans->hw_rev == CSR_HW_REV_TYPE_QNJ_B0) {
-                     cfg != &killer1650x_2ax_cfg &&
-                     cfg != &killer1650w_2ax_cfg &&
-                     cfg != &iwl_ax201_cfg_quz_hr) ||
-                    iwl_trans->hw_rev == CSR_HW_REV_TYPE_QNJ_B0)) {
                u32 hw_status;
                hw_status = iwl_read_prph(iwl_trans, UMAG_GEN_HW_STATUS);
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c
index df8455f14e4d..ca3bb4d65b00 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c
@@ -57,6 +57,24 @@
 #include "internal.h"
 #include "fw/dbg.h"
+static int iwl_pcie_gen2_force_power_gating(struct iwl_trans *trans)
+{
+        iwl_set_bits_prph(trans, HPM_HIPM_GEN_CFG,
+                          HPM_HIPM_GEN_CFG_CR_FORCE_ACTIVE);
+        udelay(20);
+        iwl_set_bits_prph(trans, HPM_HIPM_GEN_CFG,
+                          HPM_HIPM_GEN_CFG_CR_PG_EN |
+                          HPM_HIPM_GEN_CFG_CR_SLP_EN);
+        udelay(20);
+        iwl_clear_bits_prph(trans, HPM_HIPM_GEN_CFG,
+                            HPM_HIPM_GEN_CFG_CR_FORCE_ACTIVE);
+        iwl_trans_sw_reset(trans);
+        iwl_clear_bit(trans, CSR_GP_CNTRL, CSR_GP_CNTRL_REG_FLAG_INIT_DONE);
+        return 0;
+}
 /*
 * Start up NIC's basic functionality after it has been reset
 * (e.g. after platform boot, or shutdown via iwl_pcie_apm_stop())
@@ -92,6 +110,13 @@ int iwl_pcie_gen2_apm_init(struct iwl_trans *trans)
        iwl_pcie_apm_config(trans);
+        if (trans->trans_cfg->device_family == IWL_DEVICE_FAMILY_22000 &&
+            trans->cfg->integrated) {
+                ret = iwl_pcie_gen2_force_power_gating(trans);
+                if (ret)
+                        return ret;
+        }
        ret = iwl_finish_nic_init(trans, trans->trans_cfg);
        if (ret)
                return ret;
diff --git a/drivers/net/wireless/intersil/hostap/hostap_hw.c b/drivers/net/wireless/intersil/hostap/hostap_hw.c
index 158a3d762e55..e323e9a5999f 100644
--- a/drivers/net/wireless/intersil/hostap/hostap_hw.c
+++ b/drivers/net/wireless/intersil/hostap/hostap_hw.c
@@ -3041,30 +3041,6 @@ static void prism2_clear_set_tim_queue(local_info_t *local)
        }
 }
-/*
- * HostAP uses two layers of net devices, where the inner
- * layer gets called all the time from the outer layer.
- * This is a natural nesting, which needs a split lock type.
- */
-static struct lock_class_key hostap_netdev_xmit_lock_key;
-static struct lock_class_key hostap_netdev_addr_lock_key;
-static void prism2_set_lockdep_class_one(struct net_device *dev,
-                                         struct netdev_queue *txq,
-                                         void *_unused)
-{
-        lockdep_set_class(&txq->_xmit_lock,
-                          &hostap_netdev_xmit_lock_key);
-}
-static void prism2_set_lockdep_class(struct net_device *dev)
-{
-        lockdep_set_class(&dev->addr_list_lock,
-                          &hostap_netdev_addr_lock_key);
-        netdev_for_each_tx_queue(dev, prism2_set_lockdep_class_one, NULL);
-}
 static struct net_device *
 prism2_init_local_data(struct prism2_helper_functions *funcs, int card_idx,
                       struct device *sdev)
@@ -3223,7 +3199,6 @@ while (0)
        if (ret >= 0)
                ret = register_netdevice(dev);
-        prism2_set_lockdep_class(dev);
        rtnl_unlock();
        if (ret < 0) {
                printk(KERN_WARNING "%s: register netdevice failed!\n",
diff --git a/drivers/net/wireless/mediatek/mt76/Makefile b/drivers/net/wireless/mediatek/mt76/Makefile
index 4d03596e891f..d7a1ddc9e407 100644
--- a/drivers/net/wireless/mediatek/mt76/Makefile
+++ b/drivers/net/wireless/mediatek/mt76/Makefile
@@ -8,6 +8,8 @@ mt76-y := \
        mmio.o util.o trace.o dma.o mac80211.o debugfs.o eeprom.o \
        tx.o agg-rx.o mcu.o
+mt76-$(CONFIG_PCI) += pci.o
 mt76-usb-y := usb.o usb_trace.o
 CFLAGS_trace.o := -I$(src)
diff --git a/drivers/net/wireless/mediatek/mt76/dma.c b/drivers/net/wireless/mediatek/mt76/dma.c
index c747eb24581c..8f69d00bd940 100644
--- a/drivers/net/wireless/mediatek/mt76/dma.c
+++ b/drivers/net/wireless/mediatek/mt76/dma.c
@@ -53,8 +53,10 @@ mt76_dma_add_buf(struct mt76_dev *dev, struct mt76_queue *q,
        u32 ctrl;
        int i, idx = -1;
-        if (txwi)
+        if (txwi) {
                q->entry[q->head].txwi = DMA_DUMMY_DATA;
+                q->entry[q->head].skip_buf0 = true;
+        }
        for (i = 0; i < nbufs; i += 2, buf += 2) {
                u32 buf0 = buf[0].addr, buf1 = 0;
@@ -97,7 +99,7 @@ mt76_dma_tx_cleanup_idx(struct mt76_dev *dev, struct mt76_queue *q, int idx,
        __le32 __ctrl = READ_ONCE(q->desc[idx].ctrl);
        u32 ctrl = le32_to_cpu(__ctrl);
-        if (!e->txwi || !e->skb) {
+        if (!e->skip_buf0) {
                __le32 addr = READ_ONCE(q->desc[idx].buf0);
                u32 len = FIELD_GET(MT_DMA_CTL_SD_LEN0, ctrl);
diff --git a/drivers/net/wireless/mediatek/mt76/mt76.h b/drivers/net/wireless/mediatek/mt76/mt76.h
index 570c159515a0..8aec7ccf2d79 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76.h
+++ b/drivers/net/wireless/mediatek/mt76/mt76.h
@@ -93,8 +93,9 @@ struct mt76_queue_entry {
                struct urb *urb;
        };
        enum mt76_txq_id qid;
-        bool schedule;
+        bool skip_buf0:1;
-        bool done;
+        bool schedule:1;
+        bool done:1;
 };
 struct mt76_queue_regs {
@@ -578,6 +579,7 @@ bool __mt76_poll_msec(struct mt76_dev *dev, u32 offset, u32 mask, u32 val,
 #define mt76_poll_msec(dev, ...) __mt76_poll_msec(&((dev)->mt76), __VA_ARGS__)
 void mt76_mmio_init(struct mt76_dev *dev, void __iomem *regs);
+void mt76_pci_disable_aspm(struct pci_dev *pdev);
 static inline u16 mt76_chip(struct mt76_dev *dev)
 {
diff --git a/drivers/net/wireless/mediatek/mt76/mt76x2/pci.c b/drivers/net/wireless/mediatek/mt76/mt76x2/pci.c
index 73c3104f8858..cf611d1b817c 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76x2/pci.c
+++ b/drivers/net/wireless/mediatek/mt76/mt76x2/pci.c
@@ -81,6 +81,8 @@ mt76pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
        /* RG_SSUSB_CDR_BR_PE1D = 0x3 */
        mt76_rmw_field(dev, 0x15c58, 0x3 << 6, 0x3);
+        mt76_pci_disable_aspm(pdev);
        return 0;
 error:
diff --git a/drivers/net/wireless/mediatek/mt76/pci.c b/drivers/net/wireless/mediatek/mt76/pci.c
new file mode 100644
index 000000000000..04c5a692bc85
--- /dev/null
+++ b/drivers/net/wireless/mediatek/mt76/pci.c
@@ -0,0 +1,46 @@
+// SPDX-License-Identifier: ISC
+/*
+ * Copyright (C) 2019 Lorenzo Bianconi <lorenzo@kernel.org>
+ */
+#include <linux/pci.h>
+void mt76_pci_disable_aspm(struct pci_dev *pdev)
+{
+        struct pci_dev *parent = pdev->bus->self;
+        u16 aspm_conf, parent_aspm_conf = 0;
+        pcie_capability_read_word(pdev, PCI_EXP_LNKCTL, &aspm_conf);
+        aspm_conf &= PCI_EXP_LNKCTL_ASPMC;
+        if (parent) {
+                pcie_capability_read_word(parent, PCI_EXP_LNKCTL,
+                                          &parent_aspm_conf);
+                parent_aspm_conf &= PCI_EXP_LNKCTL_ASPMC;
+        }
+        if (!aspm_conf && (!parent || !parent_aspm_conf)) {
+                /* aspm already disabled */
+                return;
+        }
+        dev_info(&pdev->dev, "disabling ASPM %s %s\n",
+                 (aspm_conf & PCI_EXP_LNKCTL_ASPM_L0S) ? "L0s" : "",
+                 (aspm_conf & PCI_EXP_LNKCTL_ASPM_L1) ? "L1" : "");
+        if (IS_ENABLED(CONFIG_PCIEASPM)) {
+                int err;
+                err = pci_disable_link_state(pdev, aspm_conf);
+                if (!err)
+                        return;
+        }
+        /* both device and parent should have the same ASPM setting.
+         * disable ASPM in downstream component first and then upstream.
+         */
+        pcie_capability_clear_word(pdev, PCI_EXP_LNKCTL, aspm_conf);
+        if (parent)
+                pcie_capability_clear_word(parent, PCI_EXP_LNKCTL,
+                                           aspm_conf);
+}
+EXPORT_SYMBOL_GPL(mt76_pci_disable_aspm);
diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.c b/drivers/net/wireless/realtek/rtlwifi/pci.c
index 6087ec7a90a6..f88d26535978 100644
--- a/drivers/net/wireless/realtek/rtlwifi/pci.c
+++ b/drivers/net/wireless/realtek/rtlwifi/pci.c
@@ -822,7 +822,7 @@ static void _rtl_pci_rx_interrupt(struct ieee80211_hw *hw)
                hdr = rtl_get_hdr(skb);
                fc = rtl_get_fc(skb);
-                if (!stats.crc && !stats.hwerror) {
+                if (!stats.crc && !stats.hwerror && (skb->len > FCS_LEN)) {
                        memcpy(IEEE80211_SKB_RXCB(skb), &rx_status,
                               sizeof(rx_status));
@@ -859,6 +859,7 @@ static void _rtl_pci_rx_interrupt(struct ieee80211_hw *hw)
                                _rtl_pci_rx_to_mac80211(hw, skb, rx_status);
                        }
                } else {
+                        /* drop packets with errors or those too short */
                        dev_kfree_skb_any(skb);
                }
 new_trx_end:
diff --git a/drivers/net/wireless/realtek/rtlwifi/ps.c b/drivers/net/wireless/realtek/rtlwifi/ps.c
index 70f04c2f5b17..fff8dda14023 100644
--- a/drivers/net/wireless/realtek/rtlwifi/ps.c
+++ b/drivers/net/wireless/realtek/rtlwifi/ps.c
@@ -754,6 +754,9 @@ static void rtl_p2p_noa_ie(struct ieee80211_hw *hw, void *data,
                                return;
                        } else {
                                noa_num = (noa_len - 2) / 13;
+                                if (noa_num > P2P_MAX_NOA_NUM)
+                                        noa_num = P2P_MAX_NOA_NUM;
                        }
                        noa_index = ie[3];
                        if (rtlpriv->psc.p2p_ps_info.p2p_ps_mode ==
@@ -848,6 +851,9 @@ static void rtl_p2p_action_ie(struct ieee80211_hw *hw, void *data,
                                return;
                        } else {
                                noa_num = (noa_len - 2) / 13;
+                                if (noa_num > P2P_MAX_NOA_NUM)
+                                        noa_num = P2P_MAX_NOA_NUM;
                        }
                        noa_index = ie[3];
                        if (rtlpriv->psc.p2p_ps_info.p2p_ps_mode ==
diff --git a/drivers/net/wireless/virt_wifi.c b/drivers/net/wireless/virt_wifi.c
index be92e1220284..7997cc6de334 100644
--- a/drivers/net/wireless/virt_wifi.c
+++ b/drivers/net/wireless/virt_wifi.c
@@ -548,6 +548,7 @@ static int virt_wifi_newlink(struct net *src_net, struct net_device *dev,
        priv->is_connected = false;
        priv->is_up = false;
        INIT_DELAYED_WORK(&priv->connect, virt_wifi_connect_complete);
+        __module_get(THIS_MODULE);
        return 0;
 unregister_netdev:
@@ -578,6 +579,7 @@ static void virt_wifi_dellink(struct net_device *dev,
        netdev_upper_dev_unlink(priv->lowerdev, dev);
        unregister_netdevice_queue(dev, head);
+        module_put(THIS_MODULE);
        /* Deleting the wiphy is handled in the module destructor. */
 }
@@ -590,6 +592,42 @@ static struct rtnl_link_ops virt_wifi_link_ops = {
        .priv_size      = sizeof(struct virt_wifi_netdev_priv),
 };
+static bool netif_is_virt_wifi_dev(const struct net_device *dev)
+{
+        return rcu_access_pointer(dev->rx_handler) == virt_wifi_rx_handler;
+}
+static int virt_wifi_event(struct notifier_block *this, unsigned long event,
+                           void *ptr)
+{
+        struct net_device *lower_dev = netdev_notifier_info_to_dev(ptr);
+        struct virt_wifi_netdev_priv *priv;
+        struct net_device *upper_dev;
+        LIST_HEAD(list_kill);
+        if (!netif_is_virt_wifi_dev(lower_dev))
+                return NOTIFY_DONE;
+        switch (event) {
+        case NETDEV_UNREGISTER:
+                priv = rtnl_dereference(lower_dev->rx_handler_data);
+                if (!priv)
+                        return NOTIFY_DONE;
+                upper_dev = priv->upperdev;
+                upper_dev->rtnl_link_ops->dellink(upper_dev, &list_kill);
+                unregister_netdevice_many(&list_kill);
+                break;
+        }
+        return NOTIFY_DONE;
+}
+static struct notifier_block virt_wifi_notifier = {
+        .notifier_call = virt_wifi_event,
+};
 /* Acquires and releases the rtnl lock. */
 static int __init virt_wifi_init_module(void)
 {
@@ -598,14 +636,25 @@ static int __init virt_wifi_init_module(void)
        /* Guaranteed to be locallly-administered and not multicast. */
        eth_random_addr(fake_router_bssid);
+        err = register_netdevice_notifier(&virt_wifi_notifier);
+        if (err)
+                return err;
+        err = -ENOMEM;
        common_wiphy = virt_wifi_make_wiphy();
        if (!common_wiphy)
-                return -ENOMEM;
+                goto notifier;
        err = rtnl_link_register(&virt_wifi_link_ops);
        if (err)
-                virt_wifi_destroy_wiphy(common_wiphy);
+                goto destroy_wiphy;
+        return 0;
+destroy_wiphy:
+        virt_wifi_destroy_wiphy(common_wiphy);
+notifier:
+        unregister_netdevice_notifier(&virt_wifi_notifier);
        return err;
 }
@@ -615,6 +664,7 @@ static void __exit virt_wifi_cleanup_module(void)
        /* Will delete any devices that depend on the wiphy. */
        rtnl_link_unregister(&virt_wifi_link_ops);
        virt_wifi_destroy_wiphy(common_wiphy);
+        unregister_netdevice_notifier(&virt_wifi_notifier);
 }
 module_init(virt_wifi_init_module);
diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c
index 770dbcbc999e..7544be84ab35 100644
--- a/drivers/nvme/host/tcp.c
+++ b/drivers/nvme/host/tcp.c
@@ -2219,7 +2219,7 @@ static int nvme_tcp_poll(struct blk_mq_hw_ctx *hctx)
        struct nvme_tcp_queue *queue = hctx->driver_data;
        struct sock *sk = queue->sock->sk;
-        if (sk_can_busy_loop(sk) && skb_queue_empty(&sk->sk_receive_queue))
+        if (sk_can_busy_loop(sk) && skb_queue_empty_lockless(&sk->sk_receive_queue))
                sk_busy_loop(sk, true);
        nvme_tcp_try_recv(queue);
        return queue->nr_cqe;
diff --git a/include/linux/dynamic_debug.h b/include/linux/dynamic_debug.h
index 6c809440f319..4cf02ecd67de 100644
--- a/include/linux/dynamic_debug.h
+++ b/include/linux/dynamic_debug.h
@@ -204,6 +204,12 @@ static inline int ddebug_dyndbg_module_param_cb(char *param, char *val,
        do { if (0) printk(KERN_DEBUG pr_fmt(fmt), ##__VA_ARGS__); } while (0)
 #define dynamic_dev_dbg(dev, fmt, ...)                                  \
        do { if (0) dev_printk(KERN_DEBUG, dev, fmt, ##__VA_ARGS__); } while (0)
+#define dynamic_hex_dump(prefix_str, prefix_type, rowsize,              \
+                         groupsize, buf, len, ascii)                    \
+        do { if (0)                                                     \
+                print_hex_dump(KERN_DEBUG, prefix_str, prefix_type,     \
+                                rowsize, groupsize, buf, len, ascii);   \
+        } while (0)
 #endif
 #endif
diff --git a/include/linux/filter.h b/include/linux/filter.h
index 2ce57645f3cd..0367a75f873b 100644
--- a/include/linux/filter.h
+++ b/include/linux/filter.h
@@ -1099,7 +1099,6 @@ static inline void bpf_get_prog_name(const struct bpf_prog *prog, char *sym)
 #endif /* CONFIG_BPF_JIT */
-void bpf_prog_kallsyms_del_subprogs(struct bpf_prog *fp);
 void bpf_prog_kallsyms_del_all(struct bpf_prog *fp);
 #define BPF_ANC         BIT(15)
diff --git a/include/linux/gfp.h b/include/linux/gfp.h
index fb07b503dc45..61f2f6ff9467 100644
--- a/include/linux/gfp.h
+++ b/include/linux/gfp.h
@@ -325,6 +325,29 @@ static inline bool gfpflags_allow_blocking(const gfp_t gfp_flags)
        return !!(gfp_flags & __GFP_DIRECT_RECLAIM);
 }
+/**
+ * gfpflags_normal_context - is gfp_flags a normal sleepable context?
+ * @gfp_flags: gfp_flags to test
+ *
+ * Test whether @gfp_flags indicates that the allocation is from the
+ * %current context and allowed to sleep.
+ *
+ * An allocation being allowed to block doesn't mean it owns the %current
+ * context.  When direct reclaim path tries to allocate memory, the
+ * allocation context is nested inside whatever %current was doing at the
+ * time of the original allocation.  The nested allocation may be allowed
+ * to block but modifying anything %current owns can corrupt the outer
+ * context's expectations.
+ *
+ * %true result from this function indicates that the allocation context
+ * can sleep and use anything that's associated with %current.
+ */
+static inline bool gfpflags_normal_context(const gfp_t gfp_flags)
+{
+        return (gfp_flags & (__GFP_DIRECT_RECLAIM | __GFP_MEMALLOC)) ==
+                __GFP_DIRECT_RECLAIM;
+}
 #ifdef CONFIG_HIGHMEM
 #define OPT_ZONE_HIGHMEM ZONE_HIGHMEM
 #else
diff --git a/include/linux/if_macvlan.h b/include/linux/if_macvlan.h
index 2e55e4cdbd8a..a367ead4bf4b 100644
--- a/include/linux/if_macvlan.h
+++ b/include/linux/if_macvlan.h
@@ -29,7 +29,6 @@ struct macvlan_dev {
        netdev_features_t       set_features;
        enum macvlan_mode       mode;
        u16                     flags;
-        int                     nest_level;
        unsigned int            macaddr_count;
 #ifdef CONFIG_NET_POLL_CONTROLLER
        struct netpoll          *netpoll;
diff --git a/include/linux/if_team.h b/include/linux/if_team.h
index 06faa066496f..ec7e4bd07f82 100644
--- a/include/linux/if_team.h
+++ b/include/linux/if_team.h
@@ -223,6 +223,7 @@ struct team {
                atomic_t count_pending;
                struct delayed_work dw;
        } mcast_rejoin;
+        struct lock_class_key team_lock_key;
        long mode_priv[TEAM_MODE_PRIV_LONGS];
 };
diff --git a/include/linux/if_vlan.h b/include/linux/if_vlan.h
index 244278d5c222..b05e855f1ddd 100644
--- a/include/linux/if_vlan.h
+++ b/include/linux/if_vlan.h
@@ -182,7 +182,6 @@ struct vlan_dev_priv {
 #ifdef CONFIG_NET_POLL_CONTROLLER
        struct netpoll                          *netpoll;
 #endif
-        unsigned int                            nest_level;
 };
 static inline struct vlan_dev_priv *vlan_dev_priv(const struct net_device *dev)
@@ -221,11 +220,6 @@ extern void vlan_vids_del_by_dev(struct net_device *dev,
 extern bool vlan_uses_dev(const struct net_device *dev);
-static inline int vlan_get_encap_level(struct net_device *dev)
-{
-        BUG_ON(!is_vlan_dev(dev));
-        return vlan_dev_priv(dev)->nest_level;
-}
 #else
 static inline struct net_device *
 __vlan_find_dev_deep_rcu(struct net_device *real_dev,
@@ -295,11 +289,6 @@ static inline bool vlan_uses_dev(const struct net_device *dev)
 {
        return false;
 }
-static inline int vlan_get_encap_level(struct net_device *dev)
-{
-        BUG();
-        return 0;
-}
 #endif
 /**
diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h
index 138c50d5a353..0836fe232f97 100644
--- a/include/linux/mlx5/mlx5_ifc.h
+++ b/include/linux/mlx5/mlx5_ifc.h
@@ -1545,9 +1545,8 @@ struct mlx5_ifc_extended_dest_format_bits {
 };
 union mlx5_ifc_dest_format_struct_flow_counter_list_auto_bits {
-        struct mlx5_ifc_dest_format_struct_bits dest_format_struct;
+        struct mlx5_ifc_extended_dest_format_bits extended_dest_format;
        struct mlx5_ifc_flow_counter_list_bits flow_counter_list;
-        u8         reserved_at_0[0x40];
 };
 struct mlx5_ifc_fte_match_param_bits {
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 9eda1c31d1f7..c20f190b4c18 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -925,6 +925,7 @@ struct dev_ifalias {
 struct devlink;
 struct tlsdev_ops;
 /*
 * This structure defines the management hooks for network devices.
 * The following hooks can be defined; unless noted otherwise, they are
@@ -1421,7 +1422,6 @@ struct net_device_ops {
        void                    (*ndo_dfwd_del_station)(struct net_device *pdev,
                                                        void *priv);
-        int                     (*ndo_get_lock_subclass)(struct net_device *dev);
        int                     (*ndo_set_tx_maxrate)(struct net_device *dev,
                                                      int queue_index,
                                                      u32 maxrate);
@@ -1649,6 +1649,8 @@ enum netdev_priv_flags {
 *      @perm_addr:             Permanent hw address
 *      @addr_assign_type:      Hw address assignment type
 *      @addr_len:              Hardware address length
+ *      @upper_level:           Maximum depth level of upper devices.
+ *      @lower_level:           Maximum depth level of lower devices.
 *      @neigh_priv_len:        Used in neigh_alloc()
 *      @dev_id:                Used to differentiate devices that share
 *                              the same link layer address
@@ -1758,9 +1760,13 @@ enum netdev_priv_flags {
 *      @phydev:        Physical device may attach itself
 *                      for hardware timestamping
 *      @sfp_bus:       attached &struct sfp_bus structure.
- *
+ *      @qdisc_tx_busylock_key: lockdep class annotating Qdisc->busylock
- *      @qdisc_tx_busylock: lockdep class annotating Qdisc->busylock spinlock
+                                spinlock
- *      @qdisc_running_key: lockdep class annotating Qdisc->running seqcount
+ *      @qdisc_running_key:     lockdep class annotating Qdisc->running seqcount
+ *      @qdisc_xmit_lock_key:   lockdep class annotating
+ *                              netdev_queue->_xmit_lock spinlock
+ *      @addr_list_lock_key:    lockdep class annotating
+ *                              net_device->addr_list_lock spinlock
 *
 *      @proto_down:    protocol port state information can be sent to the
 *                      switch driver and used to set the phys state of the
@@ -1875,6 +1881,8 @@ struct net_device {
        unsigned char           perm_addr[MAX_ADDR_LEN];
        unsigned char           addr_assign_type;
        unsigned char           addr_len;
+        unsigned char           upper_level;
+        unsigned char           lower_level;
        unsigned short          neigh_priv_len;
        unsigned short          dev_id;
        unsigned short          dev_port;
@@ -2045,8 +2053,10 @@ struct net_device {
 #endif
        struct phy_device       *phydev;
        struct sfp_bus          *sfp_bus;
-        struct lock_class_key   *qdisc_tx_busylock;
+        struct lock_class_key   qdisc_tx_busylock_key;
-        struct lock_class_key   *qdisc_running_key;
+        struct lock_class_key   qdisc_running_key;
+        struct lock_class_key   qdisc_xmit_lock_key;
+        struct lock_class_key   addr_list_lock_key;
        bool                    proto_down;
        unsigned                wol_enabled:1;
 };
@@ -2124,23 +2134,6 @@ static inline void netdev_for_each_tx_queue(struct net_device *dev,
                f(dev, &dev->_tx[i], arg);
 }
-#define netdev_lockdep_set_classes(dev)                         \
-{                                                               \
-        static struct lock_class_key qdisc_tx_busylock_key;     \
-        static struct lock_class_key qdisc_running_key;         \
-        static struct lock_class_key qdisc_xmit_lock_key;       \
-        static struct lock_class_key dev_addr_list_lock_key;    \
-        unsigned int i;                                         \
-                                                                \
-        (dev)->qdisc_tx_busylock = &qdisc_tx_busylock_key;      \
-        (dev)->qdisc_running_key = &qdisc_running_key;          \
-        lockdep_set_class(&(dev)->addr_list_lock,               \
-                          &dev_addr_list_lock_key);             \
-        for (i = 0; i < (dev)->num_tx_queues; i++)              \
-                lockdep_set_class(&(dev)->_tx[i]._xmit_lock,    \
-                                  &qdisc_xmit_lock_key);        \
-}
 u16 netdev_pick_tx(struct net_device *dev, struct sk_buff *skb,
                     struct net_device *sb_dev);
 struct netdev_queue *netdev_core_pick_tx(struct net_device *dev,
@@ -3139,6 +3132,7 @@ static inline void netif_stop_queue(struct net_device *dev)
 }
 void netif_tx_stop_all_queues(struct net_device *dev);
+void netdev_update_lockdep_key(struct net_device *dev);
 static inline bool netif_tx_queue_stopped(const struct netdev_queue *dev_queue)
 {
@@ -4056,16 +4050,6 @@ static inline void netif_addr_lock(struct net_device *dev)
        spin_lock(&dev->addr_list_lock);
 }
-static inline void netif_addr_lock_nested(struct net_device *dev)
-{
-        int subclass = SINGLE_DEPTH_NESTING;
-        if (dev->netdev_ops->ndo_get_lock_subclass)
-                subclass = dev->netdev_ops->ndo_get_lock_subclass(dev);
-        spin_lock_nested(&dev->addr_list_lock, subclass);
-}
 static inline void netif_addr_lock_bh(struct net_device *dev)
 {
        spin_lock_bh(&dev->addr_list_lock);
@@ -4329,6 +4313,16 @@ int netdev_master_upper_dev_link(struct net_device *dev,
                                 struct netlink_ext_ack *extack);
 void netdev_upper_dev_unlink(struct net_device *dev,
                             struct net_device *upper_dev);
+int netdev_adjacent_change_prepare(struct net_device *old_dev,
+                                   struct net_device *new_dev,
+                                   struct net_device *dev,
+                                   struct netlink_ext_ack *extack);
+void netdev_adjacent_change_commit(struct net_device *old_dev,
+                                   struct net_device *new_dev,
+                                   struct net_device *dev);
+void netdev_adjacent_change_abort(struct net_device *old_dev,
+                                  struct net_device *new_dev,
+                                  struct net_device *dev);
 void netdev_adjacent_rename_links(struct net_device *dev, char *oldname);
 void *netdev_lower_dev_get_private(struct net_device *dev,
                                   struct net_device *lower_dev);
@@ -4340,7 +4334,6 @@ void netdev_lower_state_changed(struct net_device *lower_dev,
 extern u8 netdev_rss_key[NETDEV_RSS_KEY_LEN] __read_mostly;
 void netdev_rss_key_fill(void *buffer, size_t len);
-int dev_get_nest_level(struct net_device *dev);
 int skb_checksum_help(struct sk_buff *skb);
 int skb_crc32c_csum_help(struct sk_buff *skb);
 int skb_csum_hwoffload_help(struct sk_buff *skb,
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 7914fdaf4226..64a395c7f689 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -1354,7 +1354,8 @@ static inline __u32 skb_get_hash_flowi6(struct sk_buff *skb, const struct flowi6
        return skb->hash;
 }
-__u32 skb_get_hash_perturb(const struct sk_buff *skb, u32 perturb);
+__u32 skb_get_hash_perturb(const struct sk_buff *skb,
+                           const siphash_key_t *perturb);
 static inline __u32 skb_get_hash_raw(const struct sk_buff *skb)
 {
@@ -1495,6 +1496,19 @@ static inline int skb_queue_empty(const struct sk_buff_head *list)
 }
 /**
+ *      skb_queue_empty_lockless - check if a queue is empty
+ *      @list: queue head
+ *
+ *      Returns true if the queue is empty, false otherwise.
+ *      This variant can be used in lockless contexts.
+ */
+static inline bool skb_queue_empty_lockless(const struct sk_buff_head *list)
+{
+        return READ_ONCE(list->next) == (const struct sk_buff *) list;
+}
+/**
 *      skb_queue_is_last - check if skb is the last entry in the queue
 *      @list: queue head
 *      @skb: buffer
@@ -1847,9 +1861,11 @@ static inline void __skb_insert(struct sk_buff *newsk,
                                struct sk_buff *prev, struct sk_buff *next,
                                struct sk_buff_head *list)
 {
-        newsk->next = next;
+        /* see skb_queue_empty_lockless() for the opposite READ_ONCE() */
-        newsk->prev = prev;
+        WRITE_ONCE(newsk->next, next);
-        next->prev  = prev->next = newsk;
+        WRITE_ONCE(newsk->prev, prev);
+        WRITE_ONCE(next->prev, newsk);
+        WRITE_ONCE(prev->next, newsk);
        list->qlen++;
 }
@@ -1860,11 +1876,11 @@ static inline void __skb_queue_splice(const struct sk_buff_head *list,
        struct sk_buff *first = list->next;
        struct sk_buff *last = list->prev;
-        first->prev = prev;
+        WRITE_ONCE(first->prev, prev);
-        prev->next = first;
+        WRITE_ONCE(prev->next, first);
-        last->next = next;
+        WRITE_ONCE(last->next, next);
-        next->prev = last;
+        WRITE_ONCE(next->prev, last);
 }
 /**
@@ -2005,8 +2021,8 @@ static inline void __skb_unlink(struct sk_buff *skb, struct sk_buff_head *list)
        next       = skb->next;
        prev       = skb->prev;
        skb->next  = skb->prev = NULL;
-        next->prev = prev;
+        WRITE_ONCE(next->prev, prev);
-        prev->next = next;
+        WRITE_ONCE(prev->next, next);
 }
 /**
diff --git a/include/linux/socket.h b/include/linux/socket.h
index fc0bed59fc84..4049d9755cf1 100644
--- a/include/linux/socket.h
+++ b/include/linux/socket.h
@@ -263,7 +263,7 @@ struct ucred {
 #define PF_MAX          AF_MAX
 /* Maximum queue length specifiable by listen.  */
-#define SOMAXCONN       128
+#define SOMAXCONN       4096
 /* Flags we can use with send/ and recv.
   Added those for 1003.1g not all are supported yet
diff --git a/include/net/bonding.h b/include/net/bonding.h
index f7fe45689142..1afc125014da 100644
--- a/include/net/bonding.h
+++ b/include/net/bonding.h
@@ -203,7 +203,6 @@ struct bonding {
        struct   slave __rcu *primary_slave;
        struct   bond_up_slave __rcu *slave_arr; /* Array of usable slaves */
        bool     force_primary;
-        u32      nest_level;
        s32      slave_cnt; /* never change this value outside the attach/detach wrappers */
        int     (*recv_probe)(const struct sk_buff *, struct bonding *,
                              struct slave *);
@@ -239,6 +238,7 @@ struct bonding {
        struct   dentry *debug_dir;
 #endif /* CONFIG_DEBUG_FS */
        struct rtnl_link_stats64 bond_stats;
+        struct lock_class_key stats_lock_key;
 };
 #define bond_slave_get_rcu(dev) \
diff --git a/include/net/busy_poll.h b/include/net/busy_poll.h
index 127a5c4e3699..86e028388bad 100644
--- a/include/net/busy_poll.h
+++ b/include/net/busy_poll.h
@@ -122,7 +122,7 @@ static inline void skb_mark_napi_id(struct sk_buff *skb,
 static inline void sk_mark_napi_id(struct sock *sk, const struct sk_buff *skb)
 {
 #ifdef CONFIG_NET_RX_BUSY_POLL
-        sk->sk_napi_id = skb->napi_id;
+        WRITE_ONCE(sk->sk_napi_id, skb->napi_id);
 #endif
        sk_rx_queue_set(sk, skb);
 }
@@ -132,8 +132,8 @@ static inline void sk_mark_napi_id_once(struct sock *sk,
                                        const struct sk_buff *skb)
 {
 #ifdef CONFIG_NET_RX_BUSY_POLL
-        if (!sk->sk_napi_id)
+        if (!READ_ONCE(sk->sk_napi_id))
-                sk->sk_napi_id = skb->napi_id;
+                WRITE_ONCE(sk->sk_napi_id, skb->napi_id);
 #endif
 }
diff --git a/include/net/flow_dissector.h b/include/net/flow_dissector.h
index 90bd210be060..5cd12276ae21 100644
--- a/include/net/flow_dissector.h
+++ b/include/net/flow_dissector.h
@@ -4,6 +4,7 @@
 #include <linux/types.h>
 #include <linux/in6.h>
+#include <linux/siphash.h>
 #include <uapi/linux/if_ether.h>
 /**
@@ -276,7 +277,7 @@ struct flow_keys_basic {
 struct flow_keys {
        struct flow_dissector_key_control control;
 #define FLOW_KEYS_HASH_START_FIELD basic
-        struct flow_dissector_key_basic basic;
+        struct flow_dissector_key_basic basic __aligned(SIPHASH_ALIGNMENT);
        struct flow_dissector_key_tags tags;
        struct flow_dissector_key_vlan vlan;
        struct flow_dissector_key_vlan cvlan;
diff --git a/include/net/fq.h b/include/net/fq.h
index d126b5d20261..2ad85e683041 100644
--- a/include/net/fq.h
+++ b/include/net/fq.h
@@ -69,7 +69,7 @@ struct fq {
        struct list_head backlogs;
        spinlock_t lock;
        u32 flows_cnt;
-        u32 perturbation;
+        siphash_key_t   perturbation;
        u32 limit;
        u32 memory_limit;
        u32 memory_usage;
diff --git a/include/net/fq_impl.h b/include/net/fq_impl.h
index be40a4b327e3..107c0d700ed6 100644
--- a/include/net/fq_impl.h
+++ b/include/net/fq_impl.h
@@ -108,7 +108,7 @@ begin:
 static u32 fq_flow_idx(struct fq *fq, struct sk_buff *skb)
 {
-        u32 hash = skb_get_hash_perturb(skb, fq->perturbation);
+        u32 hash = skb_get_hash_perturb(skb, &fq->perturbation);
        return reciprocal_scale(hash, fq->flows_cnt);
 }
@@ -308,7 +308,7 @@ static int fq_init(struct fq *fq, int flows_cnt)
        INIT_LIST_HEAD(&fq->backlogs);
        spin_lock_init(&fq->lock);
        fq->flows_cnt = max_t(u32, flows_cnt, 1);
-        fq->perturbation = prandom_u32();
+        get_random_bytes(&fq->perturbation, sizeof(fq->perturbation));
        fq->quantum = 300;
        fq->limit = 8192;
        fq->memory_limit = 16 << 20; /* 16 MBytes */
diff --git a/include/net/hwbm.h b/include/net/hwbm.h
index 81643cf8a1c4..c81444611a22 100644
--- a/include/net/hwbm.h
+++ b/include/net/hwbm.h
@@ -21,9 +21,13 @@ void hwbm_buf_free(struct hwbm_pool *bm_pool, void *buf);
 int hwbm_pool_refill(struct hwbm_pool *bm_pool, gfp_t gfp);
 int hwbm_pool_add(struct hwbm_pool *bm_pool, unsigned int buf_num);
 #else
-void hwbm_buf_free(struct hwbm_pool *bm_pool, void *buf) {}
+static inline void hwbm_buf_free(struct hwbm_pool *bm_pool, void *buf) {}
-int hwbm_pool_refill(struct hwbm_pool *bm_pool, gfp_t gfp) { return 0; }
-int hwbm_pool_add(struct hwbm_pool *bm_pool, unsigned int buf_num)
+static inline int hwbm_pool_refill(struct hwbm_pool *bm_pool, gfp_t gfp)
+{ return 0; }
+static inline int hwbm_pool_add(struct hwbm_pool *bm_pool,
+                                unsigned int buf_num)
 { return 0; }
 #endif /* CONFIG_HWBM */
 #endif /* _HWBM_H */
diff --git a/include/net/ip.h b/include/net/ip.h
index 95bb77f95bcc..a2c61c36dc4a 100644
--- a/include/net/ip.h
+++ b/include/net/ip.h
@@ -185,7 +185,7 @@ static inline struct sk_buff *ip_fraglist_next(struct ip_fraglist_iter *iter)
 }
 struct ip_frag_state {
-        struct iphdr    *iph;
+        bool            DF;
        unsigned int    hlen;
        unsigned int    ll_rs;
        unsigned int    mtu;
@@ -196,7 +196,7 @@ struct ip_frag_state {
 };
 void ip_frag_init(struct sk_buff *skb, unsigned int hlen, unsigned int ll_rs,
-                  unsigned int mtu, struct ip_frag_state *state);
+                  unsigned int mtu, bool DF, struct ip_frag_state *state);
 struct sk_buff *ip_frag_next(struct sk_buff *skb,
                             struct ip_frag_state *state);
diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h
index 3759167f91f5..078887c8c586 100644
--- a/include/net/ip_vs.h
+++ b/include/net/ip_vs.h
@@ -889,6 +889,7 @@ struct netns_ipvs {
        struct delayed_work     defense_work;   /* Work handler */
        int                     drop_rate;
        int                     drop_counter;
+        int                     old_secure_tcp;
        atomic_t                dropentry;
        /* locks in ctl.c */
        spinlock_t              dropentry_lock;  /* drop entry handling */
diff --git a/include/net/net_namespace.h b/include/net/net_namespace.h
index 4c2cd9378699..c7e15a213ef2 100644
--- a/include/net/net_namespace.h
+++ b/include/net/net_namespace.h
@@ -342,7 +342,7 @@ static inline struct net *read_pnet(const possible_net_t *pnet)
 #define __net_initconst __initconst
 #endif
-int peernet2id_alloc(struct net *net, struct net *peer);
+int peernet2id_alloc(struct net *net, struct net *peer, gfp_t gfp);
 int peernet2id(struct net *net, struct net *peer);
 bool peernet_has_id(struct net *net, struct net *peer);
 struct net *get_net_ns_by_id(struct net *net, int id);
diff --git a/include/net/sock.h b/include/net/sock.h
index f69b58bff7e5..8f9adcfac41b 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -954,8 +954,8 @@ static inline void sk_incoming_cpu_update(struct sock *sk)
 {
        int cpu = raw_smp_processor_id();
-        if (unlikely(sk->sk_incoming_cpu != cpu))
+        if (unlikely(READ_ONCE(sk->sk_incoming_cpu) != cpu))
-                sk->sk_incoming_cpu = cpu;
+                WRITE_ONCE(sk->sk_incoming_cpu, cpu);
 }
 static inline void sock_rps_record_flow_hash(__u32 hash)
@@ -2242,12 +2242,17 @@ struct sk_buff *sk_stream_alloc_skb(struct sock *sk, int size, gfp_t gfp,
 * sk_page_frag - return an appropriate page_frag
 * @sk: socket
 *
- * If socket allocation mode allows current thread to sleep, it means its
+ * Use the per task page_frag instead of the per socket one for
- * safe to use the per task page_frag instead of the per socket one.
+ * optimization when we know that we're in the normal context and owns
+ * everything that's associated with %current.
+ *
+ * gfpflags_allow_blocking() isn't enough here as direct reclaim may nest
+ * inside other socket operations and end up recursing into sk_page_frag()
+ * while it's already in use.
 */
 static inline struct page_frag *sk_page_frag(struct sock *sk)
 {
-        if (gfpflags_allow_blocking(sk->sk_allocation))
+        if (gfpflags_normal_context(sk->sk_allocation))
                return &current->task_frag;
        return &sk->sk_frag;
diff --git a/include/net/vxlan.h b/include/net/vxlan.h
index 335283dbe9b3..373aadcfea21 100644
--- a/include/net/vxlan.h
+++ b/include/net/vxlan.h
@@ -197,6 +197,7 @@ struct vxlan_rdst {
        u8                       offloaded:1;
        __be32                   remote_vni;
        u32                      remote_ifindex;
+        struct net_device        *remote_dev;
        struct list_head         list;
        struct rcu_head          rcu;
        struct dst_cache         dst_cache;
diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
index 66088a9e9b9e..ef0e1e3e66f4 100644
--- a/kernel/bpf/core.c
+++ b/kernel/bpf/core.c
@@ -502,7 +502,7 @@ int bpf_remove_insns(struct bpf_prog *prog, u32 off, u32 cnt)
        return WARN_ON_ONCE(bpf_adj_branches(prog, off, off + cnt, off, false));
 }
-void bpf_prog_kallsyms_del_subprogs(struct bpf_prog *fp)
+static void bpf_prog_kallsyms_del_subprogs(struct bpf_prog *fp)
 {
        int i;
diff --git a/kernel/bpf/devmap.c b/kernel/bpf/devmap.c
index d27f3b60ff6d..3867864cdc2f 100644
--- a/kernel/bpf/devmap.c
+++ b/kernel/bpf/devmap.c
@@ -128,7 +128,7 @@ static int dev_map_init_map(struct bpf_dtab *dtab, union bpf_attr *attr)
                if (!dtab->n_buckets) /* Overflow check */
                        return -EINVAL;
-                cost += sizeof(struct hlist_head) * dtab->n_buckets;
+                cost += (u64) sizeof(struct hlist_head) * dtab->n_buckets;
        }
        /* if map size is larger than memlock limit, reject it */
@@ -719,6 +719,32 @@ const struct bpf_map_ops dev_map_hash_ops = {
        .map_check_btf = map_check_no_btf,
 };
+static void dev_map_hash_remove_netdev(struct bpf_dtab *dtab,
+                                       struct net_device *netdev)
+{
+        unsigned long flags;
+        u32 i;
+        spin_lock_irqsave(&dtab->index_lock, flags);
+        for (i = 0; i < dtab->n_buckets; i++) {
+                struct bpf_dtab_netdev *dev;
+                struct hlist_head *head;
+                struct hlist_node *next;
+                head = dev_map_index_hash(dtab, i);
+                hlist_for_each_entry_safe(dev, next, head, index_hlist) {
+                        if (netdev != dev->dev)
+                                continue;
+                        dtab->items--;
+                        hlist_del_rcu(&dev->index_hlist);
+                        call_rcu(&dev->rcu, __dev_map_entry_free);
+                }
+        }
+        spin_unlock_irqrestore(&dtab->index_lock, flags);
+}
 static int dev_map_notification(struct notifier_block *notifier,
                                ulong event, void *ptr)
 {
@@ -735,6 +761,11 @@ static int dev_map_notification(struct notifier_block *notifier,
                 */
                rcu_read_lock();
                list_for_each_entry_rcu(dtab, &dev_map_list, list) {
+                        if (dtab->map.map_type == BPF_MAP_TYPE_DEVMAP_HASH) {
+                                dev_map_hash_remove_netdev(dtab, netdev);
+                                continue;
+                        }
                        for (i = 0; i < dtab->map.max_entries; i++) {
                                struct bpf_dtab_netdev *dev, *odev;
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index 82eabd4e38ad..0937719b87e2 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -1326,24 +1326,32 @@ static void __bpf_prog_put_rcu(struct rcu_head *rcu)
 {
        struct bpf_prog_aux *aux = container_of(rcu, struct bpf_prog_aux, rcu);
+        kvfree(aux->func_info);
        free_used_maps(aux);
        bpf_prog_uncharge_memlock(aux->prog);
        security_bpf_prog_free(aux);
        bpf_prog_free(aux->prog);
 }
+static void __bpf_prog_put_noref(struct bpf_prog *prog, bool deferred)
+{
+        bpf_prog_kallsyms_del_all(prog);
+        btf_put(prog->aux->btf);
+        bpf_prog_free_linfo(prog);
+        if (deferred)
+                call_rcu(&prog->aux->rcu, __bpf_prog_put_rcu);
+        else
+                __bpf_prog_put_rcu(&prog->aux->rcu);
+}
 static void __bpf_prog_put(struct bpf_prog *prog, bool do_idr_lock)
 {
        if (atomic_dec_and_test(&prog->aux->refcnt)) {
                perf_event_bpf_event(prog, PERF_BPF_EVENT_PROG_UNLOAD, 0);
                /* bpf_prog_free_id() must be called first */
                bpf_prog_free_id(prog, do_idr_lock);
-                bpf_prog_kallsyms_del_all(prog);
+                __bpf_prog_put_noref(prog, true);
-                btf_put(prog->aux->btf);
-                kvfree(prog->aux->func_info);
-                bpf_prog_free_linfo(prog);
-                call_rcu(&prog->aux->rcu, __bpf_prog_put_rcu);
        }
 }
@@ -1741,11 +1749,12 @@ static int bpf_prog_load(union bpf_attr *attr, union bpf_attr __user *uattr)
        return err;
 free_used_maps:
-        bpf_prog_free_linfo(prog);
+        /* In case we have subprogs, we need to wait for a grace
-        kvfree(prog->aux->func_info);
+         * period before we can tear down JIT memory since symbols
-        btf_put(prog->aux->btf);
+         * are already exposed under kallsyms.
-        bpf_prog_kallsyms_del_subprogs(prog);
+         */
-        free_used_maps(prog->aux);
+        __bpf_prog_put_noref(prog, prog->aux->func_cnt);
+        return err;
 free_prog:
        bpf_prog_uncharge_memlock(prog);
 free_prog_sec:
diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
index 54728d2eda18..d4bcfd8f95bf 100644
--- a/net/8021q/vlan.c
+++ b/net/8021q/vlan.c
@@ -172,7 +172,6 @@ int register_vlan_dev(struct net_device *dev, struct netlink_ext_ack *extack)
        if (err < 0)
                goto out_uninit_mvrp;
-        vlan->nest_level = dev_get_nest_level(real_dev) + 1;
        err = register_netdevice(dev);
        if (err < 0)
                goto out_uninit_mvrp;
diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
index 93eadf179123..e5bff5cc6f97 100644
--- a/net/8021q/vlan_dev.c
+++ b/net/8021q/vlan_dev.c
@@ -489,36 +489,6 @@ static void vlan_dev_set_rx_mode(struct net_device *vlan_dev)
        dev_uc_sync(vlan_dev_priv(vlan_dev)->real_dev, vlan_dev);
 }
-/*
- * vlan network devices have devices nesting below it, and are a special
- * "super class" of normal network devices; split their locks off into a
- * separate class since they always nest.
- */
-static struct lock_class_key vlan_netdev_xmit_lock_key;
-static struct lock_class_key vlan_netdev_addr_lock_key;
-static void vlan_dev_set_lockdep_one(struct net_device *dev,
-                                     struct netdev_queue *txq,
-                                     void *_subclass)
-{
-        lockdep_set_class_and_subclass(&txq->_xmit_lock,
-                                       &vlan_netdev_xmit_lock_key,
-                                       *(int *)_subclass);
-}
-static void vlan_dev_set_lockdep_class(struct net_device *dev, int subclass)
-{
-        lockdep_set_class_and_subclass(&dev->addr_list_lock,
-                                       &vlan_netdev_addr_lock_key,
-                                       subclass);
-        netdev_for_each_tx_queue(dev, vlan_dev_set_lockdep_one, &subclass);
-}
-static int vlan_dev_get_lock_subclass(struct net_device *dev)
-{
-        return vlan_dev_priv(dev)->nest_level;
-}
 static const struct header_ops vlan_header_ops = {
        .create  = vlan_dev_hard_header,
        .parse   = eth_header_parse,
@@ -609,8 +579,6 @@ static int vlan_dev_init(struct net_device *dev)
        SET_NETDEV_DEVTYPE(dev, &vlan_type);
-        vlan_dev_set_lockdep_class(dev, vlan_dev_get_lock_subclass(dev));
        vlan->vlan_pcpu_stats = netdev_alloc_pcpu_stats(struct vlan_pcpu_stats);
        if (!vlan->vlan_pcpu_stats)
                return -ENOMEM;
@@ -812,7 +780,6 @@ static const struct net_device_ops vlan_netdev_ops = {
        .ndo_netpoll_cleanup    = vlan_dev_netpoll_cleanup,
 #endif
        .ndo_fix_features       = vlan_dev_fix_features,
-        .ndo_get_lock_subclass  = vlan_dev_get_lock_subclass,
        .ndo_get_iflink         = vlan_dev_get_iflink,
 };
diff --git a/net/atm/common.c b/net/atm/common.c
index b7528e77997c..0ce530af534d 100644
--- a/net/atm/common.c
+++ b/net/atm/common.c
@@ -668,7 +668,7 @@ __poll_t vcc_poll(struct file *file, struct socket *sock, poll_table *wait)
                mask |= EPOLLHUP;
        /* readable? */
-        if (!skb_queue_empty(&sk->sk_receive_queue))
+        if (!skb_queue_empty_lockless(&sk->sk_receive_queue))
                mask |= EPOLLIN | EPOLLRDNORM;
        /* writable? */
diff --git a/net/batman-adv/bat_iv_ogm.c b/net/batman-adv/bat_iv_ogm.c
index d78938e3e008..5b0b20e6da95 100644
--- a/net/batman-adv/bat_iv_ogm.c
+++ b/net/batman-adv/bat_iv_ogm.c
@@ -22,6 +22,8 @@
 #include <linux/kernel.h>
 #include <linux/kref.h>
 #include <linux/list.h>
+#include <linux/lockdep.h>
+#include <linux/mutex.h>
 #include <linux/netdevice.h>
 #include <linux/netlink.h>
 #include <linux/pkt_sched.h>
@@ -193,14 +195,18 @@ static int batadv_iv_ogm_iface_enable(struct batadv_hard_iface *hard_iface)
        unsigned char *ogm_buff;
        u32 random_seqno;
+        mutex_lock(&hard_iface->bat_iv.ogm_buff_mutex);
        /* randomize initial seqno to avoid collision */
        get_random_bytes(&random_seqno, sizeof(random_seqno));
        atomic_set(&hard_iface->bat_iv.ogm_seqno, random_seqno);
        hard_iface->bat_iv.ogm_buff_len = BATADV_OGM_HLEN;
        ogm_buff = kmalloc(hard_iface->bat_iv.ogm_buff_len, GFP_ATOMIC);
-        if (!ogm_buff)
+        if (!ogm_buff) {
+                mutex_unlock(&hard_iface->bat_iv.ogm_buff_mutex);
                return -ENOMEM;
+        }
        hard_iface->bat_iv.ogm_buff = ogm_buff;
@@ -212,35 +218,59 @@ static int batadv_iv_ogm_iface_enable(struct batadv_hard_iface *hard_iface)
        batadv_ogm_packet->reserved = 0;
        batadv_ogm_packet->tq = BATADV_TQ_MAX_VALUE;
+        mutex_unlock(&hard_iface->bat_iv.ogm_buff_mutex);
        return 0;
 }
 static void batadv_iv_ogm_iface_disable(struct batadv_hard_iface *hard_iface)
 {
+        mutex_lock(&hard_iface->bat_iv.ogm_buff_mutex);
        kfree(hard_iface->bat_iv.ogm_buff);
        hard_iface->bat_iv.ogm_buff = NULL;
+        mutex_unlock(&hard_iface->bat_iv.ogm_buff_mutex);
 }
 static void batadv_iv_ogm_iface_update_mac(struct batadv_hard_iface *hard_iface)
 {
        struct batadv_ogm_packet *batadv_ogm_packet;
-        unsigned char *ogm_buff = hard_iface->bat_iv.ogm_buff;
+        void *ogm_buff;
-        batadv_ogm_packet = (struct batadv_ogm_packet *)ogm_buff;
+        mutex_lock(&hard_iface->bat_iv.ogm_buff_mutex);
+        ogm_buff = hard_iface->bat_iv.ogm_buff;
+        if (!ogm_buff)
+                goto unlock;
+        batadv_ogm_packet = ogm_buff;
        ether_addr_copy(batadv_ogm_packet->orig,
                        hard_iface->net_dev->dev_addr);
        ether_addr_copy(batadv_ogm_packet->prev_sender,
                        hard_iface->net_dev->dev_addr);
+unlock:
+        mutex_unlock(&hard_iface->bat_iv.ogm_buff_mutex);
 }
 static void
 batadv_iv_ogm_primary_iface_set(struct batadv_hard_iface *hard_iface)
 {
        struct batadv_ogm_packet *batadv_ogm_packet;
-        unsigned char *ogm_buff = hard_iface->bat_iv.ogm_buff;
+        void *ogm_buff;
-        batadv_ogm_packet = (struct batadv_ogm_packet *)ogm_buff;
+        mutex_lock(&hard_iface->bat_iv.ogm_buff_mutex);
+        ogm_buff = hard_iface->bat_iv.ogm_buff;
+        if (!ogm_buff)
+                goto unlock;
+        batadv_ogm_packet = ogm_buff;
        batadv_ogm_packet->ttl = BATADV_TTL;
+unlock:
+        mutex_unlock(&hard_iface->bat_iv.ogm_buff_mutex);
 }
 /* when do we schedule our own ogm to be sent */
@@ -742,7 +772,11 @@ batadv_iv_ogm_slide_own_bcast_window(struct batadv_hard_iface *hard_iface)
        }
 }
-static void batadv_iv_ogm_schedule(struct batadv_hard_iface *hard_iface)
+/**
+ * batadv_iv_ogm_schedule_buff() - schedule submission of hardif ogm buffer
+ * @hard_iface: interface whose ogm buffer should be transmitted
+ */
+static void batadv_iv_ogm_schedule_buff(struct batadv_hard_iface *hard_iface)
 {
        struct batadv_priv *bat_priv = netdev_priv(hard_iface->soft_iface);
        unsigned char **ogm_buff = &hard_iface->bat_iv.ogm_buff;
@@ -753,9 +787,7 @@ static void batadv_iv_ogm_schedule(struct batadv_hard_iface *hard_iface)
        u16 tvlv_len = 0;
        unsigned long send_time;
-        if (hard_iface->if_status == BATADV_IF_NOT_IN_USE ||
+        lockdep_assert_held(&hard_iface->bat_iv.ogm_buff_mutex);
-            hard_iface->if_status == BATADV_IF_TO_BE_REMOVED)
-                return;
        /* the interface gets activated here to avoid race conditions between
         * the moment of activating the interface in
@@ -823,6 +855,17 @@ out:
                batadv_hardif_put(primary_if);
 }
+static void batadv_iv_ogm_schedule(struct batadv_hard_iface *hard_iface)
+{
+        if (hard_iface->if_status == BATADV_IF_NOT_IN_USE ||
+            hard_iface->if_status == BATADV_IF_TO_BE_REMOVED)
+                return;
+        mutex_lock(&hard_iface->bat_iv.ogm_buff_mutex);
+        batadv_iv_ogm_schedule_buff(hard_iface);
+        mutex_unlock(&hard_iface->bat_iv.ogm_buff_mutex);
+}
 /**
 * batadv_iv_orig_ifinfo_sum() - Get bcast_own sum for originator over iterface
 * @orig_node: originator which reproadcasted the OGMs directly
diff --git a/net/batman-adv/bat_v_ogm.c b/net/batman-adv/bat_v_ogm.c
index dc4f7430cb5a..8033f24f506c 100644
--- a/net/batman-adv/bat_v_ogm.c
+++ b/net/batman-adv/bat_v_ogm.c
@@ -18,6 +18,7 @@
 #include <linux/kref.h>
 #include <linux/list.h>
 #include <linux/lockdep.h>
+#include <linux/mutex.h>
 #include <linux/netdevice.h>
 #include <linux/random.h>
 #include <linux/rculist.h>
@@ -256,14 +257,12 @@ static void batadv_v_ogm_queue_on_if(struct sk_buff *skb,
 }
 /**
- * batadv_v_ogm_send() - periodic worker broadcasting the own OGM
+ * batadv_v_ogm_send_softif() - periodic worker broadcasting the own OGM
- * @work: work queue item
+ * @bat_priv: the bat priv with all the soft interface information
 */
-static void batadv_v_ogm_send(struct work_struct *work)
+static void batadv_v_ogm_send_softif(struct batadv_priv *bat_priv)
 {
        struct batadv_hard_iface *hard_iface;
-        struct batadv_priv_bat_v *bat_v;
-        struct batadv_priv *bat_priv;
        struct batadv_ogm2_packet *ogm_packet;
        struct sk_buff *skb, *skb_tmp;
        unsigned char *ogm_buff;
@@ -271,8 +270,7 @@ static void batadv_v_ogm_send(struct work_struct *work)
        u16 tvlv_len = 0;
        int ret;
-        bat_v = container_of(work, struct batadv_priv_bat_v, ogm_wq.work);
+        lockdep_assert_held(&bat_priv->bat_v.ogm_buff_mutex);
-        bat_priv = container_of(bat_v, struct batadv_priv, bat_v);
        if (atomic_read(&bat_priv->mesh_state) == BATADV_MESH_DEACTIVATING)
                goto out;
@@ -364,6 +362,23 @@ out:
 }
 /**
+ * batadv_v_ogm_send() - periodic worker broadcasting the own OGM
+ * @work: work queue item
+ */
+static void batadv_v_ogm_send(struct work_struct *work)
+{
+        struct batadv_priv_bat_v *bat_v;
+        struct batadv_priv *bat_priv;
+        bat_v = container_of(work, struct batadv_priv_bat_v, ogm_wq.work);
+        bat_priv = container_of(bat_v, struct batadv_priv, bat_v);
+        mutex_lock(&bat_priv->bat_v.ogm_buff_mutex);
+        batadv_v_ogm_send_softif(bat_priv);
+        mutex_unlock(&bat_priv->bat_v.ogm_buff_mutex);
+}
+/**
 * batadv_v_ogm_aggr_work() - OGM queue periodic task per interface
 * @work: work queue item
 *
@@ -424,11 +439,15 @@ void batadv_v_ogm_primary_iface_set(struct batadv_hard_iface *primary_iface)
        struct batadv_priv *bat_priv = netdev_priv(primary_iface->soft_iface);
        struct batadv_ogm2_packet *ogm_packet;
+        mutex_lock(&bat_priv->bat_v.ogm_buff_mutex);
        if (!bat_priv->bat_v.ogm_buff)
-                return;
+                goto unlock;
        ogm_packet = (struct batadv_ogm2_packet *)bat_priv->bat_v.ogm_buff;
        ether_addr_copy(ogm_packet->orig, primary_iface->net_dev->dev_addr);
+unlock:
+        mutex_unlock(&bat_priv->bat_v.ogm_buff_mutex);
 }
 /**
@@ -1050,6 +1069,8 @@ int batadv_v_ogm_init(struct batadv_priv *bat_priv)
        atomic_set(&bat_priv->bat_v.ogm_seqno, random_seqno);
        INIT_DELAYED_WORK(&bat_priv->bat_v.ogm_wq, batadv_v_ogm_send);
+        mutex_init(&bat_priv->bat_v.ogm_buff_mutex);
        return 0;
 }
@@ -1061,7 +1082,11 @@ void batadv_v_ogm_free(struct batadv_priv *bat_priv)
 {
        cancel_delayed_work_sync(&bat_priv->bat_v.ogm_wq);
+        mutex_lock(&bat_priv->bat_v.ogm_buff_mutex);
        kfree(bat_priv->bat_v.ogm_buff);
        bat_priv->bat_v.ogm_buff = NULL;
        bat_priv->bat_v.ogm_buff_len = 0;
+        mutex_unlock(&bat_priv->bat_v.ogm_buff_mutex);
 }
diff --git a/net/batman-adv/hard-interface.c b/net/batman-adv/hard-interface.c
index c90e47342bb0..afb52282d5bd 100644
--- a/net/batman-adv/hard-interface.c
+++ b/net/batman-adv/hard-interface.c
@@ -18,6 +18,7 @@
 #include <linux/kref.h>
 #include <linux/limits.h>
 #include <linux/list.h>
+#include <linux/mutex.h>
 #include <linux/netdevice.h>
 #include <linux/printk.h>
 #include <linux/rculist.h>
@@ -929,6 +930,7 @@ batadv_hardif_add_interface(struct net_device *net_dev)
        INIT_LIST_HEAD(&hard_iface->list);
        INIT_HLIST_HEAD(&hard_iface->neigh_list);
+        mutex_init(&hard_iface->bat_iv.ogm_buff_mutex);
        spin_lock_init(&hard_iface->neigh_list_lock);
        kref_init(&hard_iface->refcount);
diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
index 9cbed6f5a85a..5ee8e9a100f9 100644
--- a/net/batman-adv/soft-interface.c
+++ b/net/batman-adv/soft-interface.c
@@ -740,36 +740,6 @@ static int batadv_interface_kill_vid(struct net_device *dev, __be16 proto,
        return 0;
 }
-/* batman-adv network devices have devices nesting below it and are a special
- * "super class" of normal network devices; split their locks off into a
- * separate class since they always nest.
- */
-static struct lock_class_key batadv_netdev_xmit_lock_key;
-static struct lock_class_key batadv_netdev_addr_lock_key;
-/**
- * batadv_set_lockdep_class_one() - Set lockdep class for a single tx queue
- * @dev: device which owns the tx queue
- * @txq: tx queue to modify
- * @_unused: always NULL
- */
-static void batadv_set_lockdep_class_one(struct net_device *dev,
-                                         struct netdev_queue *txq,
-                                         void *_unused)
-{
-        lockdep_set_class(&txq->_xmit_lock, &batadv_netdev_xmit_lock_key);
-}
-/**
- * batadv_set_lockdep_class() - Set txq and addr_list lockdep class
- * @dev: network device to modify
- */
-static void batadv_set_lockdep_class(struct net_device *dev)
-{
-        lockdep_set_class(&dev->addr_list_lock, &batadv_netdev_addr_lock_key);
-        netdev_for_each_tx_queue(dev, batadv_set_lockdep_class_one, NULL);
-}
 /**
 * batadv_softif_init_late() - late stage initialization of soft interface
 * @dev: registered network device to modify
@@ -783,8 +753,6 @@ static int batadv_softif_init_late(struct net_device *dev)
        int ret;
        size_t cnt_len = sizeof(u64) * BATADV_CNT_NUM;
-        batadv_set_lockdep_class(dev);
        bat_priv = netdev_priv(dev);
        bat_priv->soft_iface = dev;
diff --git a/net/batman-adv/types.h b/net/batman-adv/types.h
index be7c02aa91e2..4d7f1baee7b7 100644
--- a/net/batman-adv/types.h
+++ b/net/batman-adv/types.h
@@ -17,6 +17,7 @@
 #include <linux/if.h>
 #include <linux/if_ether.h>
 #include <linux/kref.h>
+#include <linux/mutex.h>
 #include <linux/netdevice.h>
 #include <linux/netlink.h>
 #include <linux/sched.h> /* for linux/wait.h */
@@ -81,6 +82,9 @@ struct batadv_hard_iface_bat_iv {
        /** @ogm_seqno: OGM sequence number - used to identify each OGM */
        atomic_t ogm_seqno;
+        /** @ogm_buff_mutex: lock protecting ogm_buff and ogm_buff_len */
+        struct mutex ogm_buff_mutex;
 };
 /**
@@ -1539,6 +1543,9 @@ struct batadv_priv_bat_v {
        /** @ogm_seqno: OGM sequence number - used to identify each OGM */
        atomic_t ogm_seqno;
+        /** @ogm_buff_mutex: lock protecting ogm_buff and ogm_buff_len */
+        struct mutex ogm_buff_mutex;
        /** @ogm_wq: workqueue used to schedule OGM transmissions */
        struct delayed_work ogm_wq;
 };
diff --git a/net/bluetooth/6lowpan.c b/net/bluetooth/6lowpan.c
index bb55d92691b0..4febc82a7c76 100644
--- a/net/bluetooth/6lowpan.c
+++ b/net/bluetooth/6lowpan.c
@@ -571,15 +571,7 @@ static netdev_tx_t bt_xmit(struct sk_buff *skb, struct net_device *netdev)
        return err < 0 ? NET_XMIT_DROP : err;
 }
-static int bt_dev_init(struct net_device *dev)
-{
-        netdev_lockdep_set_classes(dev);
-        return 0;
-}
 static const struct net_device_ops netdev_ops = {
-        .ndo_init               = bt_dev_init,
        .ndo_start_xmit         = bt_xmit,
 };
diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c
index 94ddf19998c7..5f508c50649d 100644
--- a/net/bluetooth/af_bluetooth.c
+++ b/net/bluetooth/af_bluetooth.c
@@ -460,7 +460,7 @@ __poll_t bt_sock_poll(struct file *file, struct socket *sock,
        if (sk->sk_state == BT_LISTEN)
                return bt_accept_poll(sk);
-        if (sk->sk_err || !skb_queue_empty(&sk->sk_error_queue))
+        if (sk->sk_err || !skb_queue_empty_lockless(&sk->sk_error_queue))
                mask |= EPOLLERR |
                        (sock_flag(sk, SOCK_SELECT_ERR_QUEUE) ? EPOLLPRI : 0);
@@ -470,7 +470,7 @@ __poll_t bt_sock_poll(struct file *file, struct socket *sock,
        if (sk->sk_shutdown == SHUTDOWN_MASK)
                mask |= EPOLLHUP;
-        if (!skb_queue_empty(&sk->sk_receive_queue))
+        if (!skb_queue_empty_lockless(&sk->sk_receive_queue))
                mask |= EPOLLIN | EPOLLRDNORM;
        if (sk->sk_state == BT_CLOSED)
diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
index 681b72862c16..e804a3016902 100644
--- a/net/bridge/br_device.c
+++ b/net/bridge/br_device.c
@@ -24,8 +24,6 @@
 const struct nf_br_ops __rcu *nf_br_ops __read_mostly;
 EXPORT_SYMBOL_GPL(nf_br_ops);
-static struct lock_class_key bridge_netdev_addr_lock_key;
 /* net device transmit always called with BH disabled */
 netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev)
 {
@@ -108,11 +106,6 @@ out:
        return NETDEV_TX_OK;
 }
-static void br_set_lockdep_class(struct net_device *dev)
-{
-        lockdep_set_class(&dev->addr_list_lock, &bridge_netdev_addr_lock_key);
-}
 static int br_dev_init(struct net_device *dev)
 {
        struct net_bridge *br = netdev_priv(dev);
@@ -150,7 +143,6 @@ static int br_dev_init(struct net_device *dev)
                br_mdb_hash_fini(br);
                br_fdb_hash_fini(br);
        }
-        br_set_lockdep_class(dev);
        return err;
 }
diff --git a/net/bridge/netfilter/nf_conntrack_bridge.c b/net/bridge/netfilter/nf_conntrack_bridge.c
index 506d6141e44e..809673222382 100644
--- a/net/bridge/netfilter/nf_conntrack_bridge.c
+++ b/net/bridge/netfilter/nf_conntrack_bridge.c
@@ -95,7 +95,7 @@ slow_path:
         * This may also be a clone skbuff, we could preserve the geometry for
         * the copies but probably not worth the effort.
         */
-        ip_frag_init(skb, hlen, ll_rs, frag_max_size, &state);
+        ip_frag_init(skb, hlen, ll_rs, frag_max_size, false, &state);
        while (state.left > 0) {
                struct sk_buff *skb2;
diff --git a/net/caif/caif_socket.c b/net/caif/caif_socket.c
index 13ea920600ae..ef14da50a981 100644
--- a/net/caif/caif_socket.c
+++ b/net/caif/caif_socket.c
@@ -953,7 +953,7 @@ static __poll_t caif_poll(struct file *file,
                mask |= EPOLLRDHUP;
        /* readable? */
-        if (!skb_queue_empty(&sk->sk_receive_queue) ||
+        if (!skb_queue_empty_lockless(&sk->sk_receive_queue) ||
                (sk->sk_shutdown & RCV_SHUTDOWN))
                mask |= EPOLLIN | EPOLLRDNORM;
diff --git a/net/core/datagram.c b/net/core/datagram.c
index c210fc116103..da3c24ed129c 100644
--- a/net/core/datagram.c
+++ b/net/core/datagram.c
@@ -97,7 +97,7 @@ int __skb_wait_for_more_packets(struct sock *sk, int *err, long *timeo_p,
        if (error)
                goto out_err;
-        if (sk->sk_receive_queue.prev != skb)
+        if (READ_ONCE(sk->sk_receive_queue.prev) != skb)
                goto out;
        /* Socket shut down? */
@@ -278,7 +278,7 @@ struct sk_buff *__skb_try_recv_datagram(struct sock *sk, unsigned int flags,
                        break;
                sk_busy_loop(sk, flags & MSG_DONTWAIT);
-        } while (sk->sk_receive_queue.prev != *last);
+        } while (READ_ONCE(sk->sk_receive_queue.prev) != *last);
        error = -EAGAIN;
@@ -767,7 +767,7 @@ __poll_t datagram_poll(struct file *file, struct socket *sock,
        mask = 0;
        /* exceptional events? */
-        if (sk->sk_err || !skb_queue_empty(&sk->sk_error_queue))
+        if (sk->sk_err || !skb_queue_empty_lockless(&sk->sk_error_queue))
                mask |= EPOLLERR |
                        (sock_flag(sk, SOCK_SELECT_ERR_QUEUE) ? EPOLLPRI : 0);
@@ -777,7 +777,7 @@ __poll_t datagram_poll(struct file *file, struct socket *sock,
                mask |= EPOLLHUP;
        /* readable? */
-        if (!skb_queue_empty(&sk->sk_receive_queue))
+        if (!skb_queue_empty_lockless(&sk->sk_receive_queue))
                mask |= EPOLLIN | EPOLLRDNORM;
        /* Connection-based need to check for termination and startup */
diff --git a/net/core/dev.c b/net/core/dev.c
index bf3ed413abaf..99ac84ff398f 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -146,6 +146,7 @@
 #include "net-sysfs.h"
 #define MAX_GRO_SKBS 8
+#define MAX_NEST_DEV 8
 /* This should be increased if a protocol with a bigger head is added. */
 #define GRO_MAX_HEAD (MAX_HEADER + 128)
@@ -276,88 +277,6 @@ static RAW_NOTIFIER_HEAD(netdev_chain);
 DEFINE_PER_CPU_ALIGNED(struct softnet_data, softnet_data);
 EXPORT_PER_CPU_SYMBOL(softnet_data);
-#ifdef CONFIG_LOCKDEP
-/*
- * register_netdevice() inits txq->_xmit_lock and sets lockdep class
- * according to dev->type
- */
-static const unsigned short netdev_lock_type[] = {
-         ARPHRD_NETROM, ARPHRD_ETHER, ARPHRD_EETHER, ARPHRD_AX25,
-         ARPHRD_PRONET, ARPHRD_CHAOS, ARPHRD_IEEE802, ARPHRD_ARCNET,
-         ARPHRD_APPLETLK, ARPHRD_DLCI, ARPHRD_ATM, ARPHRD_METRICOM,
-         ARPHRD_IEEE1394, ARPHRD_EUI64, ARPHRD_INFINIBAND, ARPHRD_SLIP,
-         ARPHRD_CSLIP, ARPHRD_SLIP6, ARPHRD_CSLIP6, ARPHRD_RSRVD,
-         ARPHRD_ADAPT, ARPHRD_ROSE, ARPHRD_X25, ARPHRD_HWX25,
-         ARPHRD_PPP, ARPHRD_CISCO, ARPHRD_LAPB, ARPHRD_DDCMP,
-         ARPHRD_RAWHDLC, ARPHRD_TUNNEL, ARPHRD_TUNNEL6, ARPHRD_FRAD,
-         ARPHRD_SKIP, ARPHRD_LOOPBACK, ARPHRD_LOCALTLK, ARPHRD_FDDI,
-         ARPHRD_BIF, ARPHRD_SIT, ARPHRD_IPDDP, ARPHRD_IPGRE,
-         ARPHRD_PIMREG, ARPHRD_HIPPI, ARPHRD_ASH, ARPHRD_ECONET,
-         ARPHRD_IRDA, ARPHRD_FCPP, ARPHRD_FCAL, ARPHRD_FCPL,
-         ARPHRD_FCFABRIC, ARPHRD_IEEE80211, ARPHRD_IEEE80211_PRISM,
-         ARPHRD_IEEE80211_RADIOTAP, ARPHRD_PHONET, ARPHRD_PHONET_PIPE,
-         ARPHRD_IEEE802154, ARPHRD_VOID, ARPHRD_NONE};
-static const char *const netdev_lock_name[] = {
-        "_xmit_NETROM", "_xmit_ETHER", "_xmit_EETHER", "_xmit_AX25",
-        "_xmit_PRONET", "_xmit_CHAOS", "_xmit_IEEE802", "_xmit_ARCNET",
-        "_xmit_APPLETLK", "_xmit_DLCI", "_xmit_ATM", "_xmit_METRICOM",
-        "_xmit_IEEE1394", "_xmit_EUI64", "_xmit_INFINIBAND", "_xmit_SLIP",
-        "_xmit_CSLIP", "_xmit_SLIP6", "_xmit_CSLIP6", "_xmit_RSRVD",
-        "_xmit_ADAPT", "_xmit_ROSE", "_xmit_X25", "_xmit_HWX25",
-        "_xmit_PPP", "_xmit_CISCO", "_xmit_LAPB", "_xmit_DDCMP",
-        "_xmit_RAWHDLC", "_xmit_TUNNEL", "_xmit_TUNNEL6", "_xmit_FRAD",
-        "_xmit_SKIP", "_xmit_LOOPBACK", "_xmit_LOCALTLK", "_xmit_FDDI",
-        "_xmit_BIF", "_xmit_SIT", "_xmit_IPDDP", "_xmit_IPGRE",
-        "_xmit_PIMREG", "_xmit_HIPPI", "_xmit_ASH", "_xmit_ECONET",
-        "_xmit_IRDA", "_xmit_FCPP", "_xmit_FCAL", "_xmit_FCPL",
-        "_xmit_FCFABRIC", "_xmit_IEEE80211", "_xmit_IEEE80211_PRISM",
-        "_xmit_IEEE80211_RADIOTAP", "_xmit_PHONET", "_xmit_PHONET_PIPE",
-        "_xmit_IEEE802154", "_xmit_VOID", "_xmit_NONE"};
-static struct lock_class_key netdev_xmit_lock_key[ARRAY_SIZE(netdev_lock_type)];
-static struct lock_class_key netdev_addr_lock_key[ARRAY_SIZE(netdev_lock_type)];
-static inline unsigned short netdev_lock_pos(unsigned short dev_type)
-{
-        int i;
-        for (i = 0; i < ARRAY_SIZE(netdev_lock_type); i++)
-                if (netdev_lock_type[i] == dev_type)
-                        return i;
-        /* the last key is used by default */
-        return ARRAY_SIZE(netdev_lock_type) - 1;
-}
-static inline void netdev_set_xmit_lockdep_class(spinlock_t *lock,
-                                                 unsigned short dev_type)
-{
-        int i;
-        i = netdev_lock_pos(dev_type);
-        lockdep_set_class_and_name(lock, &netdev_xmit_lock_key[i],
-                                   netdev_lock_name[i]);
-}
-static inline void netdev_set_addr_lockdep_class(struct net_device *dev)
-{
-        int i;
-        i = netdev_lock_pos(dev->type);
-        lockdep_set_class_and_name(&dev->addr_list_lock,
-                                   &netdev_addr_lock_key[i],
-                                   netdev_lock_name[i]);
-}
-#else
-static inline void netdev_set_xmit_lockdep_class(spinlock_t *lock,
-                                                 unsigned short dev_type)
-{
-}
-static inline void netdev_set_addr_lockdep_class(struct net_device *dev)
-{
-}
-#endif
 /*******************************************************************************
 *
 *              Protocol management and registration routines
@@ -6489,6 +6408,9 @@ struct netdev_adjacent {
        /* upper master flag, there can only be one master device per list */
        bool master;
+        /* lookup ignore flag */
+        bool ignore;
        /* counter for the number of times this device was added to us */
        u16 ref_nr;
@@ -6511,7 +6433,7 @@ static struct netdev_adjacent *__netdev_find_adj(struct net_device *adj_dev,
        return NULL;
 }
-static int __netdev_has_upper_dev(struct net_device *upper_dev, void *data)
+static int ____netdev_has_upper_dev(struct net_device *upper_dev, void *data)
 {
        struct net_device *dev = data;
@@ -6532,7 +6454,7 @@ bool netdev_has_upper_dev(struct net_device *dev,
 {
        ASSERT_RTNL();
-        return netdev_walk_all_upper_dev_rcu(dev, __netdev_has_upper_dev,
+        return netdev_walk_all_upper_dev_rcu(dev, ____netdev_has_upper_dev,
                                             upper_dev);
 }
 EXPORT_SYMBOL(netdev_has_upper_dev);
@@ -6550,7 +6472,7 @@ EXPORT_SYMBOL(netdev_has_upper_dev);
 bool netdev_has_upper_dev_all_rcu(struct net_device *dev,
                                  struct net_device *upper_dev)
 {
-        return !!netdev_walk_all_upper_dev_rcu(dev, __netdev_has_upper_dev,
+        return !!netdev_walk_all_upper_dev_rcu(dev, ____netdev_has_upper_dev,
                                               upper_dev);
 }
 EXPORT_SYMBOL(netdev_has_upper_dev_all_rcu);
@@ -6594,6 +6516,22 @@ struct net_device *netdev_master_upper_dev_get(struct net_device *dev)
 }
 EXPORT_SYMBOL(netdev_master_upper_dev_get);
+static struct net_device *__netdev_master_upper_dev_get(struct net_device *dev)
+{
+        struct netdev_adjacent *upper;
+        ASSERT_RTNL();
+        if (list_empty(&dev->adj_list.upper))
+                return NULL;
+        upper = list_first_entry(&dev->adj_list.upper,
+                                 struct netdev_adjacent, list);
+        if (likely(upper->master) && !upper->ignore)
+                return upper->dev;
+        return NULL;
+}
 /**
 * netdev_has_any_lower_dev - Check if device is linked to some device
 * @dev: device
@@ -6644,6 +6582,23 @@ struct net_device *netdev_upper_get_next_dev_rcu(struct net_device *dev,
 }
 EXPORT_SYMBOL(netdev_upper_get_next_dev_rcu);
+static struct net_device *__netdev_next_upper_dev(struct net_device *dev,
+                                                  struct list_head **iter,
+                                                  bool *ignore)
+{
+        struct netdev_adjacent *upper;
+        upper = list_entry((*iter)->next, struct netdev_adjacent, list);
+        if (&upper->list == &dev->adj_list.upper)
+                return NULL;
+        *iter = &upper->list;
+        *ignore = upper->ignore;
+        return upper->dev;
+}
 static struct net_device *netdev_next_upper_dev_rcu(struct net_device *dev,
                                                    struct list_head **iter)
 {
@@ -6661,34 +6616,111 @@ static struct net_device *netdev_next_upper_dev_rcu(struct net_device *dev,
        return upper->dev;
 }
+static int __netdev_walk_all_upper_dev(struct net_device *dev,
+                                       int (*fn)(struct net_device *dev,
+                                                 void *data),
+                                       void *data)
+{
+        struct net_device *udev, *next, *now, *dev_stack[MAX_NEST_DEV + 1];
+        struct list_head *niter, *iter, *iter_stack[MAX_NEST_DEV + 1];
+        int ret, cur = 0;
+        bool ignore;
+        now = dev;
+        iter = &dev->adj_list.upper;
+        while (1) {
+                if (now != dev) {
+                        ret = fn(now, data);
+                        if (ret)
+                                return ret;
+                }
+                next = NULL;
+                while (1) {
+                        udev = __netdev_next_upper_dev(now, &iter, &ignore);
+                        if (!udev)
+                                break;
+                        if (ignore)
+                                continue;
+                        next = udev;
+                        niter = &udev->adj_list.upper;
+                        dev_stack[cur] = now;
+                        iter_stack[cur++] = iter;
+                        break;
+                }
+                if (!next) {
+                        if (!cur)
+                                return 0;
+                        next = dev_stack[--cur];
+                        niter = iter_stack[cur];
+                }
+                now = next;
+                iter = niter;
+        }
+        return 0;
+}
 int netdev_walk_all_upper_dev_rcu(struct net_device *dev,
                                  int (*fn)(struct net_device *dev,
                                            void *data),
                                  void *data)
 {
-        struct net_device *udev;
+        struct net_device *udev, *next, *now, *dev_stack[MAX_NEST_DEV + 1];
-        struct list_head *iter;
+        struct list_head *niter, *iter, *iter_stack[MAX_NEST_DEV + 1];
-        int ret;
+        int ret, cur = 0;
-        for (iter = &dev->adj_list.upper,
+        now = dev;
-             udev = netdev_next_upper_dev_rcu(dev, &iter);
+        iter = &dev->adj_list.upper;
-             udev;
-             udev = netdev_next_upper_dev_rcu(dev, &iter)) {
-                /* first is the upper device itself */
-                ret = fn(udev, data);
-                if (ret)
-                        return ret;
-                /* then look at all of its upper devices */
+        while (1) {
-                ret = netdev_walk_all_upper_dev_rcu(udev, fn, data);
+                if (now != dev) {
-                if (ret)
+                        ret = fn(now, data);
-                        return ret;
+                        if (ret)
+                                return ret;
+                }
+                next = NULL;
+                while (1) {
+                        udev = netdev_next_upper_dev_rcu(now, &iter);
+                        if (!udev)
+                                break;
+                        next = udev;
+                        niter = &udev->adj_list.upper;
+                        dev_stack[cur] = now;
+                        iter_stack[cur++] = iter;
+                        break;
+                }
+                if (!next) {
+                        if (!cur)
+                                return 0;
+                        next = dev_stack[--cur];
+                        niter = iter_stack[cur];
+                }
+                now = next;
+                iter = niter;
        }
        return 0;
 }
 EXPORT_SYMBOL_GPL(netdev_walk_all_upper_dev_rcu);
+static bool __netdev_has_upper_dev(struct net_device *dev,
+                                   struct net_device *upper_dev)
+{
+        ASSERT_RTNL();
+        return __netdev_walk_all_upper_dev(dev, ____netdev_has_upper_dev,
+                                           upper_dev);
+}
 /**
 * netdev_lower_get_next_private - Get the next ->private from the
 *                                 lower neighbour list
@@ -6785,34 +6817,119 @@ static struct net_device *netdev_next_lower_dev(struct net_device *dev,
        return lower->dev;
 }
+static struct net_device *__netdev_next_lower_dev(struct net_device *dev,
+                                                  struct list_head **iter,
+                                                  bool *ignore)
+{
+        struct netdev_adjacent *lower;
+        lower = list_entry((*iter)->next, struct netdev_adjacent, list);
+        if (&lower->list == &dev->adj_list.lower)
+                return NULL;
+        *iter = &lower->list;
+        *ignore = lower->ignore;
+        return lower->dev;
+}
 int netdev_walk_all_lower_dev(struct net_device *dev,
                              int (*fn)(struct net_device *dev,
                                        void *data),
                              void *data)
 {
-        struct net_device *ldev;
+        struct net_device *ldev, *next, *now, *dev_stack[MAX_NEST_DEV + 1];
-        struct list_head *iter;
+        struct list_head *niter, *iter, *iter_stack[MAX_NEST_DEV + 1];
-        int ret;
+        int ret, cur = 0;
-        for (iter = &dev->adj_list.lower,
+        now = dev;
-             ldev = netdev_next_lower_dev(dev, &iter);
+        iter = &dev->adj_list.lower;
-             ldev;
-             ldev = netdev_next_lower_dev(dev, &iter)) {
-                /* first is the lower device itself */
-                ret = fn(ldev, data);
-                if (ret)
-                        return ret;
-                /* then look at all of its lower devices */
+        while (1) {
-                ret = netdev_walk_all_lower_dev(ldev, fn, data);
+                if (now != dev) {
-                if (ret)
+                        ret = fn(now, data);
-                        return ret;
+                        if (ret)
+                                return ret;
+                }
+                next = NULL;
+                while (1) {
+                        ldev = netdev_next_lower_dev(now, &iter);
+                        if (!ldev)
+                                break;
+                        next = ldev;
+                        niter = &ldev->adj_list.lower;
+                        dev_stack[cur] = now;
+                        iter_stack[cur++] = iter;
+                        break;
+                }
+                if (!next) {
+                        if (!cur)
+                                return 0;
+                        next = dev_stack[--cur];
+                        niter = iter_stack[cur];
+                }
+                now = next;
+                iter = niter;
        }
        return 0;
 }
 EXPORT_SYMBOL_GPL(netdev_walk_all_lower_dev);
+static int __netdev_walk_all_lower_dev(struct net_device *dev,
+                                       int (*fn)(struct net_device *dev,
+                                                 void *data),
+                                       void *data)
+{
+        struct net_device *ldev, *next, *now, *dev_stack[MAX_NEST_DEV + 1];
+        struct list_head *niter, *iter, *iter_stack[MAX_NEST_DEV + 1];
+        int ret, cur = 0;
+        bool ignore;
+        now = dev;
+        iter = &dev->adj_list.lower;
+        while (1) {
+                if (now != dev) {
+                        ret = fn(now, data);
+                        if (ret)
+                                return ret;
+                }
+                next = NULL;
+                while (1) {
+                        ldev = __netdev_next_lower_dev(now, &iter, &ignore);
+                        if (!ldev)
+                                break;
+                        if (ignore)
+                                continue;
+                        next = ldev;
+                        niter = &ldev->adj_list.lower;
+                        dev_stack[cur] = now;
+                        iter_stack[cur++] = iter;
+                        break;
+                }
+                if (!next) {
+                        if (!cur)
+                                return 0;
+                        next = dev_stack[--cur];
+                        niter = iter_stack[cur];
+                }
+                now = next;
+                iter = niter;
+        }
+        return 0;
+}
 static struct net_device *netdev_next_lower_dev_rcu(struct net_device *dev,
                                                    struct list_head **iter)
 {
@@ -6827,28 +6944,99 @@ static struct net_device *netdev_next_lower_dev_rcu(struct net_device *dev,
        return lower->dev;
 }
-int netdev_walk_all_lower_dev_rcu(struct net_device *dev,
+static u8 __netdev_upper_depth(struct net_device *dev)
-                                  int (*fn)(struct net_device *dev,
+{
-                                            void *data),
+        struct net_device *udev;
-                                  void *data)
+        struct list_head *iter;
+        u8 max_depth = 0;
+        bool ignore;
+        for (iter = &dev->adj_list.upper,
+             udev = __netdev_next_upper_dev(dev, &iter, &ignore);
+             udev;
+             udev = __netdev_next_upper_dev(dev, &iter, &ignore)) {
+                if (ignore)
+                        continue;
+                if (max_depth < udev->upper_level)
+                        max_depth = udev->upper_level;
+        }
+        return max_depth;
+}
+static u8 __netdev_lower_depth(struct net_device *dev)
 {
        struct net_device *ldev;
        struct list_head *iter;
-        int ret;
+        u8 max_depth = 0;
+        bool ignore;
        for (iter = &dev->adj_list.lower,
-             ldev = netdev_next_lower_dev_rcu(dev, &iter);
+             ldev = __netdev_next_lower_dev(dev, &iter, &ignore);
             ldev;
-             ldev = netdev_next_lower_dev_rcu(dev, &iter)) {
+             ldev = __netdev_next_lower_dev(dev, &iter, &ignore)) {
-                /* first is the lower device itself */
+                if (ignore)
-                ret = fn(ldev, data);
+                        continue;
-                if (ret)
+                if (max_depth < ldev->lower_level)
-                        return ret;
+                        max_depth = ldev->lower_level;
+        }
-                /* then look at all of its lower devices */
+        return max_depth;
-                ret = netdev_walk_all_lower_dev_rcu(ldev, fn, data);
+}
-                if (ret)
-                        return ret;
+static int __netdev_update_upper_level(struct net_device *dev, void *data)
+{
+        dev->upper_level = __netdev_upper_depth(dev) + 1;
+        return 0;
+}
+static int __netdev_update_lower_level(struct net_device *dev, void *data)
+{
+        dev->lower_level = __netdev_lower_depth(dev) + 1;
+        return 0;
+}
+int netdev_walk_all_lower_dev_rcu(struct net_device *dev,
+                                  int (*fn)(struct net_device *dev,
+                                            void *data),
+                                  void *data)
+{
+        struct net_device *ldev, *next, *now, *dev_stack[MAX_NEST_DEV + 1];
+        struct list_head *niter, *iter, *iter_stack[MAX_NEST_DEV + 1];
+        int ret, cur = 0;
+        now = dev;
+        iter = &dev->adj_list.lower;
+        while (1) {
+                if (now != dev) {
+                        ret = fn(now, data);
+                        if (ret)
+                                return ret;
+                }
+                next = NULL;
+                while (1) {
+                        ldev = netdev_next_lower_dev_rcu(now, &iter);
+                        if (!ldev)
+                                break;
+                        next = ldev;
+                        niter = &ldev->adj_list.lower;
+                        dev_stack[cur] = now;
+                        iter_stack[cur++] = iter;
+                        break;
+                }
+                if (!next) {
+                        if (!cur)
+                                return 0;
+                        next = dev_stack[--cur];
+                        niter = iter_stack[cur];
+                }
+                now = next;
+                iter = niter;
        }
        return 0;
@@ -6952,6 +7140,7 @@ static int __netdev_adjacent_dev_insert(struct net_device *dev,
        adj->master = master;
        adj->ref_nr = 1;
        adj->private = private;
+        adj->ignore = false;
        dev_hold(adj_dev);
        pr_debug("Insert adjacency: dev %s adj_dev %s adj->ref_nr %d; dev_hold on %s\n",
@@ -7102,14 +7291,17 @@ static int __netdev_upper_dev_link(struct net_device *dev,
                return -EBUSY;
        /* To prevent loops, check if dev is not upper device to upper_dev. */
-        if (netdev_has_upper_dev(upper_dev, dev))
+        if (__netdev_has_upper_dev(upper_dev, dev))
                return -EBUSY;
+        if ((dev->lower_level + upper_dev->upper_level) > MAX_NEST_DEV)
+                return -EMLINK;
        if (!master) {
-                if (netdev_has_upper_dev(dev, upper_dev))
+                if (__netdev_has_upper_dev(dev, upper_dev))
                        return -EEXIST;
        } else {
-                master_dev = netdev_master_upper_dev_get(dev);
+                master_dev = __netdev_master_upper_dev_get(dev);
                if (master_dev)
                        return master_dev == upper_dev ? -EEXIST : -EBUSY;
        }
@@ -7131,6 +7323,13 @@ static int __netdev_upper_dev_link(struct net_device *dev,
        if (ret)
                goto rollback;
+        __netdev_update_upper_level(dev, NULL);
+        __netdev_walk_all_lower_dev(dev, __netdev_update_upper_level, NULL);
+        __netdev_update_lower_level(upper_dev, NULL);
+        __netdev_walk_all_upper_dev(upper_dev, __netdev_update_lower_level,
+                                    NULL);
        return 0;
 rollback:
@@ -7213,9 +7412,96 @@ void netdev_upper_dev_unlink(struct net_device *dev,
        call_netdevice_notifiers_info(NETDEV_CHANGEUPPER,
                                      &changeupper_info.info);
+        __netdev_update_upper_level(dev, NULL);
+        __netdev_walk_all_lower_dev(dev, __netdev_update_upper_level, NULL);
+        __netdev_update_lower_level(upper_dev, NULL);
+        __netdev_walk_all_upper_dev(upper_dev, __netdev_update_lower_level,
+                                    NULL);
 }
 EXPORT_SYMBOL(netdev_upper_dev_unlink);
+static void __netdev_adjacent_dev_set(struct net_device *upper_dev,
+                                      struct net_device *lower_dev,
+                                      bool val)
+{
+        struct netdev_adjacent *adj;
+        adj = __netdev_find_adj(lower_dev, &upper_dev->adj_list.lower);
+        if (adj)
+                adj->ignore = val;
+        adj = __netdev_find_adj(upper_dev, &lower_dev->adj_list.upper);
+        if (adj)
+                adj->ignore = val;
+}
+static void netdev_adjacent_dev_disable(struct net_device *upper_dev,
+                                        struct net_device *lower_dev)
+{
+        __netdev_adjacent_dev_set(upper_dev, lower_dev, true);
+}
+static void netdev_adjacent_dev_enable(struct net_device *upper_dev,
+                                       struct net_device *lower_dev)
+{
+        __netdev_adjacent_dev_set(upper_dev, lower_dev, false);
+}
+int netdev_adjacent_change_prepare(struct net_device *old_dev,
+                                   struct net_device *new_dev,
+                                   struct net_device *dev,
+                                   struct netlink_ext_ack *extack)
+{
+        int err;
+        if (!new_dev)
+                return 0;
+        if (old_dev && new_dev != old_dev)
+                netdev_adjacent_dev_disable(dev, old_dev);
+        err = netdev_upper_dev_link(new_dev, dev, extack);
+        if (err) {
+                if (old_dev && new_dev != old_dev)
+                        netdev_adjacent_dev_enable(dev, old_dev);
+                return err;
+        }
+        return 0;
+}
+EXPORT_SYMBOL(netdev_adjacent_change_prepare);
+void netdev_adjacent_change_commit(struct net_device *old_dev,
+                                   struct net_device *new_dev,
+                                   struct net_device *dev)
+{
+        if (!new_dev || !old_dev)
+                return;
+        if (new_dev == old_dev)
+                return;
+        netdev_adjacent_dev_enable(dev, old_dev);
+        netdev_upper_dev_unlink(old_dev, dev);
+}
+EXPORT_SYMBOL(netdev_adjacent_change_commit);
+void netdev_adjacent_change_abort(struct net_device *old_dev,
+                                  struct net_device *new_dev,
+                                  struct net_device *dev)
+{
+        if (!new_dev)
+                return;
+        if (old_dev && new_dev != old_dev)
+                netdev_adjacent_dev_enable(dev, old_dev);
+        netdev_upper_dev_unlink(new_dev, dev);
+}
+EXPORT_SYMBOL(netdev_adjacent_change_abort);
 /**
 * netdev_bonding_info_change - Dispatch event about slave change
 * @dev: device
@@ -7329,25 +7615,6 @@ void *netdev_lower_dev_get_private(struct net_device *dev,
 EXPORT_SYMBOL(netdev_lower_dev_get_private);
-int dev_get_nest_level(struct net_device *dev)
-{
-        struct net_device *lower = NULL;
-        struct list_head *iter;
-        int max_nest = -1;
-        int nest;
-        ASSERT_RTNL();
-        netdev_for_each_lower_dev(dev, lower, iter) {
-                nest = dev_get_nest_level(lower);
-                if (max_nest < nest)
-                        max_nest = nest;
-        }
-        return max_nest + 1;
-}
-EXPORT_SYMBOL(dev_get_nest_level);
 /**
 * netdev_lower_change - Dispatch event about lower device state change
 * @lower_dev: device
@@ -8154,7 +8421,8 @@ int dev_change_xdp_fd(struct net_device *dev, struct netlink_ext_ack *extack,
                        return -EINVAL;
                }
-                if (prog->aux->id == prog_id) {
+                /* prog->aux->id may be 0 for orphaned device-bound progs */
+                if (prog->aux->id && prog->aux->id == prog_id) {
                        bpf_prog_put(prog);
                        return 0;
                }
@@ -8619,7 +8887,7 @@ static void netdev_init_one_queue(struct net_device *dev,
 {
        /* Initialize queue lock */
        spin_lock_init(&queue->_xmit_lock);
-        netdev_set_xmit_lockdep_class(&queue->_xmit_lock, dev->type);
+        lockdep_set_class(&queue->_xmit_lock, &dev->qdisc_xmit_lock_key);
        queue->xmit_lock_owner = -1;
        netdev_queue_numa_node_write(queue, NUMA_NO_NODE);
        queue->dev = dev;
@@ -8666,6 +8934,43 @@ void netif_tx_stop_all_queues(struct net_device *dev)
 }
 EXPORT_SYMBOL(netif_tx_stop_all_queues);
+static void netdev_register_lockdep_key(struct net_device *dev)
+{
+        lockdep_register_key(&dev->qdisc_tx_busylock_key);
+        lockdep_register_key(&dev->qdisc_running_key);
+        lockdep_register_key(&dev->qdisc_xmit_lock_key);
+        lockdep_register_key(&dev->addr_list_lock_key);
+}
+static void netdev_unregister_lockdep_key(struct net_device *dev)
+{
+        lockdep_unregister_key(&dev->qdisc_tx_busylock_key);
+        lockdep_unregister_key(&dev->qdisc_running_key);
+        lockdep_unregister_key(&dev->qdisc_xmit_lock_key);
+        lockdep_unregister_key(&dev->addr_list_lock_key);
+}
+void netdev_update_lockdep_key(struct net_device *dev)
+{
+        struct netdev_queue *queue;
+        int i;
+        lockdep_unregister_key(&dev->qdisc_xmit_lock_key);
+        lockdep_unregister_key(&dev->addr_list_lock_key);
+        lockdep_register_key(&dev->qdisc_xmit_lock_key);
+        lockdep_register_key(&dev->addr_list_lock_key);
+        lockdep_set_class(&dev->addr_list_lock, &dev->addr_list_lock_key);
+        for (i = 0; i < dev->num_tx_queues; i++) {
+                queue = netdev_get_tx_queue(dev, i);
+                lockdep_set_class(&queue->_xmit_lock,
+                                  &dev->qdisc_xmit_lock_key);
+        }
+}
+EXPORT_SYMBOL(netdev_update_lockdep_key);
 /**
 *      register_netdevice      - register a network device
 *      @dev: device to register
@@ -8700,7 +9005,7 @@ int register_netdevice(struct net_device *dev)
        BUG_ON(!net);
        spin_lock_init(&dev->addr_list_lock);
-        netdev_set_addr_lockdep_class(dev);
+        lockdep_set_class(&dev->addr_list_lock, &dev->addr_list_lock_key);
        ret = dev_get_valid_name(net, dev, dev->name);
        if (ret < 0)
@@ -9210,8 +9515,12 @@ struct net_device *alloc_netdev_mqs(int sizeof_priv, const char *name,
        dev_net_set(dev, &init_net);
+        netdev_register_lockdep_key(dev);
        dev->gso_max_size = GSO_MAX_SIZE;
        dev->gso_max_segs = GSO_MAX_SEGS;
+        dev->upper_level = 1;
+        dev->lower_level = 1;
        INIT_LIST_HEAD(&dev->napi_list);
        INIT_LIST_HEAD(&dev->unreg_list);
@@ -9292,6 +9601,8 @@ void free_netdev(struct net_device *dev)
        free_percpu(dev->pcpu_refcnt);
        dev->pcpu_refcnt = NULL;
+        netdev_unregister_lockdep_key(dev);
        /*  Compatibility with error handling in drivers */
        if (dev->reg_state == NETREG_UNINITIALIZED) {
                netdev_freemem(dev);
@@ -9460,7 +9771,7 @@ int dev_change_net_namespace(struct net_device *dev, struct net *net, const char
        call_netdevice_notifiers(NETDEV_UNREGISTER, dev);
        rcu_barrier();
-        new_nsid = peernet2id_alloc(dev_net(dev), net);
+        new_nsid = peernet2id_alloc(dev_net(dev), net, GFP_KERNEL);
        /* If there is an ifindex conflict assign a new one */
        if (__dev_get_by_index(net, dev->ifindex))
                new_ifindex = dev_new_index(net);
diff --git a/net/core/dev_addr_lists.c b/net/core/dev_addr_lists.c
index 6393ba930097..2f949b5a1eb9 100644
--- a/net/core/dev_addr_lists.c
+++ b/net/core/dev_addr_lists.c
@@ -637,7 +637,7 @@ int dev_uc_sync(struct net_device *to, struct net_device *from)
        if (to->addr_len != from->addr_len)
                return -EINVAL;
-        netif_addr_lock_nested(to);
+        netif_addr_lock(to);
        err = __hw_addr_sync(&to->uc, &from->uc, to->addr_len);
        if (!err)
                __dev_set_rx_mode(to);
@@ -667,7 +667,7 @@ int dev_uc_sync_multiple(struct net_device *to, struct net_device *from)
        if (to->addr_len != from->addr_len)
                return -EINVAL;
-        netif_addr_lock_nested(to);
+        netif_addr_lock(to);
        err = __hw_addr_sync_multiple(&to->uc, &from->uc, to->addr_len);
        if (!err)
                __dev_set_rx_mode(to);
@@ -691,7 +691,7 @@ void dev_uc_unsync(struct net_device *to, struct net_device *from)
                return;
        netif_addr_lock_bh(from);
-        netif_addr_lock_nested(to);
+        netif_addr_lock(to);
        __hw_addr_unsync(&to->uc, &from->uc, to->addr_len);
        __dev_set_rx_mode(to);
        netif_addr_unlock(to);
@@ -858,7 +858,7 @@ int dev_mc_sync(struct net_device *to, struct net_device *from)
        if (to->addr_len != from->addr_len)
                return -EINVAL;
-        netif_addr_lock_nested(to);
+        netif_addr_lock(to);
        err = __hw_addr_sync(&to->mc, &from->mc, to->addr_len);
        if (!err)
                __dev_set_rx_mode(to);
@@ -888,7 +888,7 @@ int dev_mc_sync_multiple(struct net_device *to, struct net_device *from)
        if (to->addr_len != from->addr_len)
                return -EINVAL;
-        netif_addr_lock_nested(to);
+        netif_addr_lock(to);
        err = __hw_addr_sync_multiple(&to->mc, &from->mc, to->addr_len);
        if (!err)
                __dev_set_rx_mode(to);
@@ -912,7 +912,7 @@ void dev_mc_unsync(struct net_device *to, struct net_device *from)
                return;
        netif_addr_lock_bh(from);
-        netif_addr_lock_nested(to);
+        netif_addr_lock(to);
        __hw_addr_unsync(&to->mc, &from->mc, to->addr_len);
        __dev_set_rx_mode(to);
        netif_addr_unlock(to);
diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index c763106c73fc..cd9bc67381b2 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -1396,11 +1396,13 @@ static int ethtool_reset(struct net_device *dev, char __user *useraddr)
 static int ethtool_get_wol(struct net_device *dev, char __user *useraddr)
 {
-        struct ethtool_wolinfo wol = { .cmd = ETHTOOL_GWOL };
+        struct ethtool_wolinfo wol;
        if (!dev->ethtool_ops->get_wol)
                return -EOPNOTSUPP;
+        memset(&wol, 0, sizeof(struct ethtool_wolinfo));
+        wol.cmd = ETHTOOL_GWOL;
        dev->ethtool_ops->get_wol(dev, &wol);
        if (copy_to_user(useraddr, &wol, sizeof(wol)))
diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
index 7c09d87d3269..68eda10d0680 100644
--- a/net/core/flow_dissector.c
+++ b/net/core/flow_dissector.c
@@ -1350,30 +1350,21 @@ out_bad:
 }
 EXPORT_SYMBOL(__skb_flow_dissect);
-static u32 hashrnd __read_mostly;
+static siphash_key_t hashrnd __read_mostly;
 static __always_inline void __flow_hash_secret_init(void)
 {
        net_get_random_once(&hashrnd, sizeof(hashrnd));
 }
-static __always_inline u32 __flow_hash_words(const u32 *words, u32 length,
+static const void *flow_keys_hash_start(const struct flow_keys *flow)
-                                             u32 keyval)
 {
-        return jhash2(words, length, keyval);
+        BUILD_BUG_ON(FLOW_KEYS_HASH_OFFSET % SIPHASH_ALIGNMENT);
-}
+        return &flow->FLOW_KEYS_HASH_START_FIELD;
-static inline const u32 *flow_keys_hash_start(const struct flow_keys *flow)
-{
-        const void *p = flow;
-        BUILD_BUG_ON(FLOW_KEYS_HASH_OFFSET % sizeof(u32));
-        return (const u32 *)(p + FLOW_KEYS_HASH_OFFSET);
 }
 static inline size_t flow_keys_hash_length(const struct flow_keys *flow)
 {
        size_t diff = FLOW_KEYS_HASH_OFFSET + sizeof(flow->addrs);
-        BUILD_BUG_ON((sizeof(*flow) - FLOW_KEYS_HASH_OFFSET) % sizeof(u32));
        BUILD_BUG_ON(offsetof(typeof(*flow), addrs) !=
                     sizeof(*flow) - sizeof(flow->addrs));
@@ -1388,7 +1379,7 @@ static inline size_t flow_keys_hash_length(const struct flow_keys *flow)
                diff -= sizeof(flow->addrs.tipckey);
                break;
        }
-        return (sizeof(*flow) - diff) / sizeof(u32);
+        return sizeof(*flow) - diff;
 }
 __be32 flow_get_u32_src(const struct flow_keys *flow)
@@ -1454,14 +1445,15 @@ static inline void __flow_hash_consistentify(struct flow_keys *keys)
        }
 }
-static inline u32 __flow_hash_from_keys(struct flow_keys *keys, u32 keyval)
+static inline u32 __flow_hash_from_keys(struct flow_keys *keys,
+                                        const siphash_key_t *keyval)
 {
        u32 hash;
        __flow_hash_consistentify(keys);
-        hash = __flow_hash_words(flow_keys_hash_start(keys),
+        hash = siphash(flow_keys_hash_start(keys),
-                                 flow_keys_hash_length(keys), keyval);
+                       flow_keys_hash_length(keys), keyval);
        if (!hash)
                hash = 1;
@@ -1471,12 +1463,13 @@ static inline u32 __flow_hash_from_keys(struct flow_keys *keys, u32 keyval)
 u32 flow_hash_from_keys(struct flow_keys *keys)
 {
        __flow_hash_secret_init();
-        return __flow_hash_from_keys(keys, hashrnd);
+        return __flow_hash_from_keys(keys, &hashrnd);
 }
 EXPORT_SYMBOL(flow_hash_from_keys);
 static inline u32 ___skb_get_hash(const struct sk_buff *skb,
-                                  struct flow_keys *keys, u32 keyval)
+                                  struct flow_keys *keys,
+                                  const siphash_key_t *keyval)
 {
        skb_flow_dissect_flow_keys(skb, keys,
                                   FLOW_DISSECTOR_F_STOP_AT_FLOW_LABEL);
@@ -1524,7 +1517,7 @@ u32 __skb_get_hash_symmetric(const struct sk_buff *skb)
                           &keys, NULL, 0, 0, 0,
                           FLOW_DISSECTOR_F_STOP_AT_FLOW_LABEL);
-        return __flow_hash_from_keys(&keys, hashrnd);
+        return __flow_hash_from_keys(&keys, &hashrnd);
 }
 EXPORT_SYMBOL_GPL(__skb_get_hash_symmetric);
@@ -1544,13 +1537,14 @@ void __skb_get_hash(struct sk_buff *skb)
        __flow_hash_secret_init();
-        hash = ___skb_get_hash(skb, &keys, hashrnd);
+        hash = ___skb_get_hash(skb, &keys, &hashrnd);
        __skb_set_sw_hash(skb, hash, flow_keys_have_l4(&keys));
 }
 EXPORT_SYMBOL(__skb_get_hash);
-__u32 skb_get_hash_perturb(const struct sk_buff *skb, u32 perturb)
+__u32 skb_get_hash_perturb(const struct sk_buff *skb,
+                           const siphash_key_t *perturb)
 {
        struct flow_keys keys;
diff --git a/net/core/lwt_bpf.c b/net/core/lwt_bpf.c
index f93785e5833c..74cfb8b5ab33 100644
--- a/net/core/lwt_bpf.c
+++ b/net/core/lwt_bpf.c
@@ -88,11 +88,16 @@ static int bpf_lwt_input_reroute(struct sk_buff *skb)
        int err = -EINVAL;
        if (skb->protocol == htons(ETH_P_IP)) {
+                struct net_device *dev = skb_dst(skb)->dev;
                struct iphdr *iph = ip_hdr(skb);
+                dev_hold(dev);
+                skb_dst_drop(skb);
                err = ip_route_input_noref(skb, iph->daddr, iph->saddr,
-                                           iph->tos, skb_dst(skb)->dev);
+                                           iph->tos, dev);
+                dev_put(dev);
        } else if (skb->protocol == htons(ETH_P_IPV6)) {
+                skb_dst_drop(skb);
                err = ipv6_stub->ipv6_route_input(skb);
        } else {
                err = -EAFNOSUPPORT;
diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
index 6d3e4821b02d..39402840025e 100644
--- a/net/core/net_namespace.c
+++ b/net/core/net_namespace.c
@@ -246,11 +246,11 @@ static int __peernet2id(struct net *net, struct net *peer)
 }
 static void rtnl_net_notifyid(struct net *net, int cmd, int id, u32 portid,
-                              struct nlmsghdr *nlh);
+                              struct nlmsghdr *nlh, gfp_t gfp);
 /* This function returns the id of a peer netns. If no id is assigned, one will
 * be allocated and returned.
 */
-int peernet2id_alloc(struct net *net, struct net *peer)
+int peernet2id_alloc(struct net *net, struct net *peer, gfp_t gfp)
 {
        bool alloc = false, alive = false;
        int id;
@@ -269,7 +269,7 @@ int peernet2id_alloc(struct net *net, struct net *peer)
        id = __peernet2id_alloc(net, peer, &alloc);
        spin_unlock_bh(&net->nsid_lock);
        if (alloc && id >= 0)
-                rtnl_net_notifyid(net, RTM_NEWNSID, id, 0, NULL);
+                rtnl_net_notifyid(net, RTM_NEWNSID, id, 0, NULL, gfp);
        if (alive)
                put_net(peer);
        return id;
@@ -479,6 +479,7 @@ struct net *copy_net_ns(unsigned long flags,
        if (rv < 0) {
 put_userns:
+                key_remove_domain(net->key_domain);
                put_user_ns(user_ns);
                net_drop_ns(net);
 dec_ucounts:
@@ -533,7 +534,8 @@ static void unhash_nsid(struct net *net, struct net *last)
                        idr_remove(&tmp->netns_ids, id);
                spin_unlock_bh(&tmp->nsid_lock);
                if (id >= 0)
-                        rtnl_net_notifyid(tmp, RTM_DELNSID, id, 0, NULL);
+                        rtnl_net_notifyid(tmp, RTM_DELNSID, id, 0, NULL,
+                                          GFP_KERNEL);
                if (tmp == last)
                        break;
        }
@@ -766,7 +768,7 @@ static int rtnl_net_newid(struct sk_buff *skb, struct nlmsghdr *nlh,
        spin_unlock_bh(&net->nsid_lock);
        if (err >= 0) {
                rtnl_net_notifyid(net, RTM_NEWNSID, err, NETLINK_CB(skb).portid,
-                                  nlh);
+                                  nlh, GFP_KERNEL);
                err = 0;
        } else if (err == -ENOSPC && nsid >= 0) {
                err = -EEXIST;
@@ -1054,7 +1056,7 @@ end:
 }
 static void rtnl_net_notifyid(struct net *net, int cmd, int id, u32 portid,
-                              struct nlmsghdr *nlh)
+                              struct nlmsghdr *nlh, gfp_t gfp)
 {
        struct net_fill_args fillargs = {
                .portid = portid,
@@ -1065,7 +1067,7 @@ static void rtnl_net_notifyid(struct net *net, int cmd, int id, u32 portid,
        struct sk_buff *msg;
        int err = -ENOMEM;
-        msg = nlmsg_new(rtnl_net_get_size(), GFP_KERNEL);
+        msg = nlmsg_new(rtnl_net_get_size(), gfp);
        if (!msg)
                goto out;
@@ -1073,7 +1075,7 @@ static void rtnl_net_notifyid(struct net *net, int cmd, int id, u32 portid,
        if (err < 0)
                goto err_out;
-        rtnl_notify(msg, net, portid, RTNLGRP_NSID, nlh, 0);
+        rtnl_notify(msg, net, portid, RTNLGRP_NSID, nlh, gfp);
        return;
 err_out:
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 1ee6460f8275..c81cd80114d9 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -1523,7 +1523,7 @@ static noinline_for_stack int nla_put_ifalias(struct sk_buff *skb,
 static int rtnl_fill_link_netnsid(struct sk_buff *skb,
                                  const struct net_device *dev,
-                                  struct net *src_net)
+                                  struct net *src_net, gfp_t gfp)
 {
        bool put_iflink = false;
@@ -1531,7 +1531,7 @@ static int rtnl_fill_link_netnsid(struct sk_buff *skb,
                struct net *link_net = dev->rtnl_link_ops->get_link_net(dev);
                if (!net_eq(dev_net(dev), link_net)) {
-                        int id = peernet2id_alloc(src_net, link_net);
+                        int id = peernet2id_alloc(src_net, link_net, gfp);
                        if (nla_put_s32(skb, IFLA_LINK_NETNSID, id))
                                return -EMSGSIZE;
@@ -1589,7 +1589,7 @@ static int rtnl_fill_ifinfo(struct sk_buff *skb,
                            int type, u32 pid, u32 seq, u32 change,
                            unsigned int flags, u32 ext_filter_mask,
                            u32 event, int *new_nsid, int new_ifindex,
-                            int tgt_netnsid)
+                            int tgt_netnsid, gfp_t gfp)
 {
        struct ifinfomsg *ifm;
        struct nlmsghdr *nlh;
@@ -1681,7 +1681,7 @@ static int rtnl_fill_ifinfo(struct sk_buff *skb,
                        goto nla_put_failure;
        }
-        if (rtnl_fill_link_netnsid(skb, dev, src_net))
+        if (rtnl_fill_link_netnsid(skb, dev, src_net, gfp))
                goto nla_put_failure;
        if (new_nsid &&
@@ -2001,7 +2001,7 @@ walk_entries:
                                               NETLINK_CB(cb->skb).portid,
                                               nlh->nlmsg_seq, 0, flags,
                                               ext_filter_mask, 0, NULL, 0,
-                                               netnsid);
+                                               netnsid, GFP_KERNEL);
                        if (err < 0) {
                                if (likely(skb->len))
@@ -2355,6 +2355,7 @@ static int do_set_master(struct net_device *dev, int ifindex,
                        err = ops->ndo_del_slave(upper_dev, dev);
                        if (err)
                                return err;
+                        netdev_update_lockdep_key(dev);
                } else {
                        return -EOPNOTSUPP;
                }
@@ -3359,7 +3360,7 @@ static int rtnl_getlink(struct sk_buff *skb, struct nlmsghdr *nlh,
        err = rtnl_fill_ifinfo(nskb, dev, net,
                               RTM_NEWLINK, NETLINK_CB(skb).portid,
                               nlh->nlmsg_seq, 0, 0, ext_filter_mask,
-                               0, NULL, 0, netnsid);
+                               0, NULL, 0, netnsid, GFP_KERNEL);
        if (err < 0) {
                /* -EMSGSIZE implies BUG in if_nlmsg_size */
                WARN_ON(err == -EMSGSIZE);
@@ -3471,7 +3472,7 @@ struct sk_buff *rtmsg_ifinfo_build_skb(int type, struct net_device *dev,
        err = rtnl_fill_ifinfo(skb, dev, dev_net(dev),
                               type, 0, 0, change, 0, 0, event,
-                               new_nsid, new_ifindex, -1);
+                               new_nsid, new_ifindex, -1, flags);
        if (err < 0) {
                /* -EMSGSIZE implies BUG in if_nlmsg_size() */
                WARN_ON(err == -EMSGSIZE);
@@ -3916,7 +3917,7 @@ static int valid_fdb_dump_strict(const struct nlmsghdr *nlh,
        ndm = nlmsg_data(nlh);
        if (ndm->ndm_pad1  || ndm->ndm_pad2  || ndm->ndm_state ||
            ndm->ndm_flags || ndm->ndm_type) {
-                NL_SET_ERR_MSG(extack, "Invalid values in header for fbd dump request");
+                NL_SET_ERR_MSG(extack, "Invalid values in header for fdb dump request");
                return -EINVAL;
        }
diff --git a/net/core/sock.c b/net/core/sock.c
index a515392ba84b..ac78a570e43a 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -1127,7 +1127,7 @@ set_rcvbuf:
                break;
                }
        case SO_INCOMING_CPU:
-                sk->sk_incoming_cpu = val;
+                WRITE_ONCE(sk->sk_incoming_cpu, val);
                break;
        case SO_CNX_ADVICE:
@@ -1476,7 +1476,7 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
                break;
        case SO_INCOMING_CPU:
-                v.val = sk->sk_incoming_cpu;
+                v.val = READ_ONCE(sk->sk_incoming_cpu);
                break;
        case SO_MEMINFO:
@@ -3600,7 +3600,7 @@ bool sk_busy_loop_end(void *p, unsigned long start_time)
 {
        struct sock *sk = p;
-        return !skb_queue_empty(&sk->sk_receive_queue) ||
+        return !skb_queue_empty_lockless(&sk->sk_receive_queue) ||
               sk_busy_loop_timeout(sk, start_time);
 }
 EXPORT_SYMBOL(sk_busy_loop_end);
diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c
index d9b4200ed12d..0d8f782c25cc 100644
--- a/net/dccp/ipv4.c
+++ b/net/dccp/ipv4.c
@@ -117,7 +117,7 @@ int dccp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
                                                    inet->inet_daddr,
                                                    inet->inet_sport,
                                                    inet->inet_dport);
-        inet->inet_id = dp->dccps_iss ^ jiffies;
+        inet->inet_id = prandom_u32();
        err = dccp_connect(sk);
        rt = NULL;
diff --git a/net/decnet/af_decnet.c b/net/decnet/af_decnet.c
index 0ea75286abf4..3349ea81f901 100644
--- a/net/decnet/af_decnet.c
+++ b/net/decnet/af_decnet.c
@@ -1205,7 +1205,7 @@ static __poll_t dn_poll(struct file *file, struct socket *sock, poll_table  *wai
        struct dn_scp *scp = DN_SK(sk);
        __poll_t mask = datagram_poll(file, sock, wait);
-        if (!skb_queue_empty(&scp->other_receive_queue))
+        if (!skb_queue_empty_lockless(&scp->other_receive_queue))
                mask |= EPOLLRDBAND;
        return mask;
diff --git a/net/dsa/master.c b/net/dsa/master.c
index a8e52c9967f4..3255dfc97f86 100644
--- a/net/dsa/master.c
+++ b/net/dsa/master.c
@@ -310,8 +310,6 @@ static void dsa_master_reset_mtu(struct net_device *dev)
        rtnl_unlock();
 }
-static struct lock_class_key dsa_master_addr_list_lock_key;
 int dsa_master_setup(struct net_device *dev, struct dsa_port *cpu_dp)
 {
        int ret;
@@ -325,9 +323,6 @@ int dsa_master_setup(struct net_device *dev, struct dsa_port *cpu_dp)
        wmb();
        dev->dsa_ptr = cpu_dp;
-        lockdep_set_class(&dev->addr_list_lock,
-                          &dsa_master_addr_list_lock_key);
        ret = dsa_master_ethtool_setup(dev);
        if (ret)
                return ret;
diff --git a/net/dsa/slave.c b/net/dsa/slave.c
index 75d58229a4bd..028e65f4b5ba 100644
--- a/net/dsa/slave.c
+++ b/net/dsa/slave.c
@@ -1341,15 +1341,6 @@ static int dsa_slave_phy_setup(struct net_device *slave_dev)
        return ret;
 }
-static struct lock_class_key dsa_slave_netdev_xmit_lock_key;
-static void dsa_slave_set_lockdep_class_one(struct net_device *dev,
-                                            struct netdev_queue *txq,
-                                            void *_unused)
-{
-        lockdep_set_class(&txq->_xmit_lock,
-                          &dsa_slave_netdev_xmit_lock_key);
-}
 int dsa_slave_suspend(struct net_device *slave_dev)
 {
        struct dsa_port *dp = dsa_slave_to_port(slave_dev);
@@ -1433,9 +1424,6 @@ int dsa_slave_create(struct dsa_port *port)
        slave_dev->max_mtu = ETH_MAX_MTU;
        SET_NETDEV_DEVTYPE(slave_dev, &dsa_type);
-        netdev_for_each_tx_queue(slave_dev, dsa_slave_set_lockdep_class_one,
-                                 NULL);
        SET_NETDEV_DEV(slave_dev, port->ds->dev);
        slave_dev->dev.of_node = port->dn;
        slave_dev->vlan_features = master->vlan_features;
diff --git a/net/ieee802154/6lowpan/core.c b/net/ieee802154/6lowpan/core.c
index 3297e7fa9945..c0b107cdd715 100644
--- a/net/ieee802154/6lowpan/core.c
+++ b/net/ieee802154/6lowpan/core.c
@@ -58,13 +58,6 @@ static const struct header_ops lowpan_header_ops = {
        .create = lowpan_header_create,
 };
-static int lowpan_dev_init(struct net_device *ldev)
-{
-        netdev_lockdep_set_classes(ldev);
-        return 0;
-}
 static int lowpan_open(struct net_device *dev)
 {
        if (!open_count)
@@ -96,7 +89,6 @@ static int lowpan_get_iflink(const struct net_device *dev)
 }
 static const struct net_device_ops lowpan_netdev_ops = {
-        .ndo_init               = lowpan_dev_init,
        .ndo_start_xmit         = lowpan_xmit,
        .ndo_open               = lowpan_open,
        .ndo_stop               = lowpan_stop,
diff --git a/net/ipv4/datagram.c b/net/ipv4/datagram.c
index 9a0fe0c2fa02..4a8550c49202 100644
--- a/net/ipv4/datagram.c
+++ b/net/ipv4/datagram.c
@@ -73,7 +73,7 @@ int __ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len
        reuseport_has_conns(sk, true);
        sk->sk_state = TCP_ESTABLISHED;
        sk_set_txhash(sk);
-        inet->inet_id = jiffies;
+        inet->inet_id = prandom_u32();
        sk_dst_set(sk, &rt->dst);
        err = 0;
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index dde77f72e03e..71c78d223dfd 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -1148,7 +1148,7 @@ void fib_modify_prefix_metric(struct in_ifaddr *ifa, u32 new_metric)
        if (!(dev->flags & IFF_UP) ||
            ifa->ifa_flags & (IFA_F_SECONDARY | IFA_F_NOPREFIXROUTE) ||
            ipv4_is_zeronet(prefix) ||
-            prefix == ifa->ifa_local || ifa->ifa_prefixlen == 32)
+            (prefix == ifa->ifa_local && ifa->ifa_prefixlen == 32))
                return;
        /* add the new */
diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
index 97824864e40d..83fb00153018 100644
--- a/net/ipv4/inet_hashtables.c
+++ b/net/ipv4/inet_hashtables.c
@@ -240,7 +240,7 @@ static inline int compute_score(struct sock *sk, struct net *net,
                        return -1;
                score = sk->sk_family == PF_INET ? 2 : 1;
-                if (sk->sk_incoming_cpu == raw_smp_processor_id())
+                if (READ_ONCE(sk->sk_incoming_cpu) == raw_smp_processor_id())
                        score++;
        }
        return score;
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index 52690bb3e40f..10636fb6093e 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -509,9 +509,9 @@ static void erspan_fb_xmit(struct sk_buff *skb, struct net_device *dev)
        key = &tun_info->key;
        if (!(tun_info->key.tun_flags & TUNNEL_ERSPAN_OPT))
                goto err_free_skb;
-        md = ip_tunnel_info_opts(tun_info);
+        if (tun_info->options_len < sizeof(*md))
-        if (!md)
                goto err_free_skb;
+        md = ip_tunnel_info_opts(tun_info);
        /* ERSPAN has fixed 8 byte GRE header */
        version = md->version;
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 814b9b8882a0..3d8baaaf7086 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -645,11 +645,12 @@ void ip_fraglist_prepare(struct sk_buff *skb, struct ip_fraglist_iter *iter)
 EXPORT_SYMBOL(ip_fraglist_prepare);
 void ip_frag_init(struct sk_buff *skb, unsigned int hlen,
-                  unsigned int ll_rs, unsigned int mtu,
+                  unsigned int ll_rs, unsigned int mtu, bool DF,
                  struct ip_frag_state *state)
 {
        struct iphdr *iph = ip_hdr(skb);
+        state->DF = DF;
        state->hlen = hlen;
        state->ll_rs = ll_rs;
        state->mtu = mtu;
@@ -668,9 +669,6 @@ static void ip_frag_ipcb(struct sk_buff *from, struct sk_buff *to,
        /* Copy the flags to each fragment. */
        IPCB(to)->flags = IPCB(from)->flags;
-        if (IPCB(from)->flags & IPSKB_FRAG_PMTU)
-                state->iph->frag_off |= htons(IP_DF);
        /* ANK: dirty, but effective trick. Upgrade options only if
         * the segment to be fragmented was THE FIRST (otherwise,
         * options are already fixed) and make it ONCE
@@ -738,6 +736,8 @@ struct sk_buff *ip_frag_next(struct sk_buff *skb, struct ip_frag_state *state)
         */
        iph = ip_hdr(skb2);
        iph->frag_off = htons((state->offset >> 3));
+        if (state->DF)
+                iph->frag_off |= htons(IP_DF);
        /*
         *      Added AC : If we are fragmenting a fragment that's not the
@@ -883,7 +883,8 @@ slow_path:
         *      Fragment the datagram.
         */
-        ip_frag_init(skb, hlen, ll_rs, mtu, &state);
+        ip_frag_init(skb, hlen, ll_rs, mtu, IPCB(skb)->flags & IPSKB_FRAG_PMTU,
+                     &state);
        /*
         *      Keep copying data until we run out.
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 42187a3b82f4..d8876f0e9672 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -584,7 +584,7 @@ __poll_t tcp_poll(struct file *file, struct socket *sock, poll_table *wait)
        }
        /* This barrier is coupled with smp_wmb() in tcp_reset() */
        smp_rmb();
-        if (sk->sk_err || !skb_queue_empty(&sk->sk_error_queue))
+        if (sk->sk_err || !skb_queue_empty_lockless(&sk->sk_error_queue))
                mask |= EPOLLERR;
        return mask;
@@ -1964,7 +1964,7 @@ int tcp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, int nonblock,
        if (unlikely(flags & MSG_ERRQUEUE))
                return inet_recv_error(sk, msg, len, addr_len);
-        if (sk_can_busy_loop(sk) && skb_queue_empty(&sk->sk_receive_queue) &&
+        if (sk_can_busy_loop(sk) && skb_queue_empty_lockless(&sk->sk_receive_queue) &&
            (sk->sk_state == TCP_ESTABLISHED))
                sk_busy_loop(sk, nonblock);
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 6be568334848..67b2dc7a1727 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -303,7 +303,7 @@ int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
                                                 inet->inet_daddr);
        }
-        inet->inet_id = tp->write_seq ^ jiffies;
+        inet->inet_id = prandom_u32();
        if (tcp_fastopen_defer_connect(sk, &err))
                return err;
@@ -1450,7 +1450,7 @@ struct sock *tcp_v4_syn_recv_sock(const struct sock *sk, struct sk_buff *skb,
        inet_csk(newsk)->icsk_ext_hdr_len = 0;
        if (inet_opt)
                inet_csk(newsk)->icsk_ext_hdr_len = inet_opt->opt.optlen;
-        newinet->inet_id = newtp->write_seq ^ jiffies;
+        newinet->inet_id = prandom_u32();
        if (!dst) {
                dst = inet_csk_route_child_sock(sk, newsk, req);
@@ -2681,7 +2681,7 @@ static int __net_init tcp_sk_init(struct net *net)
        net->ipv4.tcp_death_row.sysctl_max_tw_buckets = cnt / 2;
        net->ipv4.tcp_death_row.hashinfo = &tcp_hashinfo;
-        net->ipv4.sysctl_max_syn_backlog = max(128, cnt / 256);
+        net->ipv4.sysctl_max_syn_backlog = max(128, cnt / 128);
        net->ipv4.sysctl_tcp_sack = 1;
        net->ipv4.sysctl_tcp_window_scaling = 1;
        net->ipv4.sysctl_tcp_timestamps = 1;
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 14bc654b6842..1d58ce829dca 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -388,7 +388,7 @@ static int compute_score(struct sock *sk, struct net *net,
                return -1;
        score += 4;
-        if (sk->sk_incoming_cpu == raw_smp_processor_id())
+        if (READ_ONCE(sk->sk_incoming_cpu) == raw_smp_processor_id())
                score++;
        return score;
 }
@@ -1316,6 +1316,20 @@ static void udp_set_dev_scratch(struct sk_buff *skb)
                scratch->_tsize_state |= UDP_SKB_IS_STATELESS;
 }
+static void udp_skb_csum_unnecessary_set(struct sk_buff *skb)
+{
+        /* We come here after udp_lib_checksum_complete() returned 0.
+         * This means that __skb_checksum_complete() might have
+         * set skb->csum_valid to 1.
+         * On 64bit platforms, we can set csum_unnecessary
+         * to true, but only if the skb is not shared.
+         */
+#if BITS_PER_LONG == 64
+        if (!skb_shared(skb))
+                udp_skb_scratch(skb)->csum_unnecessary = true;
+#endif
+}
 static int udp_skb_truesize(struct sk_buff *skb)
 {
        return udp_skb_scratch(skb)->_tsize_state & ~UDP_SKB_IS_STATELESS;
@@ -1550,10 +1564,7 @@ static struct sk_buff *__first_packet_length(struct sock *sk,
                        *total += skb->truesize;
                        kfree_skb(skb);
                } else {
-                        /* the csum related bits could be changed, refresh
+                        udp_skb_csum_unnecessary_set(skb);
-                         * the scratch area
-                         */
-                        udp_set_dev_scratch(skb);
                        break;
                }
        }
@@ -1577,7 +1588,7 @@ static int first_packet_length(struct sock *sk)
        spin_lock_bh(&rcvq->lock);
        skb = __first_packet_length(sk, rcvq, &total);
-        if (!skb && !skb_queue_empty(sk_queue)) {
+        if (!skb && !skb_queue_empty_lockless(sk_queue)) {
                spin_lock(&sk_queue->lock);
                skb_queue_splice_tail_init(sk_queue, rcvq);
                spin_unlock(&sk_queue->lock);
@@ -1650,7 +1661,7 @@ struct sk_buff *__skb_recv_udp(struct sock *sk, unsigned int flags,
                                return skb;
                        }
-                        if (skb_queue_empty(sk_queue)) {
+                        if (skb_queue_empty_lockless(sk_queue)) {
                                spin_unlock_bh(&queue->lock);
                                goto busy_check;
                        }
@@ -1676,7 +1687,7 @@ busy_check:
                                break;
                        sk_busy_loop(sk, flags & MSG_DONTWAIT);
-                } while (!skb_queue_empty(sk_queue));
+                } while (!skb_queue_empty_lockless(sk_queue));
                /* sk_queue is empty, reader_queue may contain peeked packets */
        } while (timeo &&
@@ -2712,7 +2723,7 @@ __poll_t udp_poll(struct file *file, struct socket *sock, poll_table *wait)
        __poll_t mask = datagram_poll(file, sock, wait);
        struct sock *sk = sock->sk;
-        if (!skb_queue_empty(&udp_sk(sk)->reader_queue))
+        if (!skb_queue_empty_lockless(&udp_sk(sk)->reader_queue))
                mask |= EPOLLIN | EPOLLRDNORM;
        /* Check for false positives due to checksum errors */
diff --git a/net/ipv6/addrconf_core.c b/net/ipv6/addrconf_core.c
index 783f3c1466da..2fc079284ca4 100644
--- a/net/ipv6/addrconf_core.c
+++ b/net/ipv6/addrconf_core.c
@@ -7,6 +7,7 @@
 #include <linux/export.h>
 #include <net/ipv6.h>
 #include <net/ipv6_stubs.h>
+#include <net/addrconf.h>
 #include <net/ip.h>
 /* if ipv6 module registers this function is used by xfrm to force all
diff --git a/net/ipv6/inet6_hashtables.c b/net/ipv6/inet6_hashtables.c
index cf60fae9533b..fbe9d4295eac 100644
--- a/net/ipv6/inet6_hashtables.c
+++ b/net/ipv6/inet6_hashtables.c
@@ -105,7 +105,7 @@ static inline int compute_score(struct sock *sk, struct net *net,
                        return -1;
                score = 1;
-                if (sk->sk_incoming_cpu == raw_smp_processor_id())
+                if (READ_ONCE(sk->sk_incoming_cpu) == raw_smp_processor_id())
                        score++;
        }
        return score;
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index 787d9f2a6e99..923034c52ce4 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -980,9 +980,9 @@ static netdev_tx_t ip6erspan_tunnel_xmit(struct sk_buff *skb,
                dsfield = key->tos;
                if (!(tun_info->key.tun_flags & TUNNEL_ERSPAN_OPT))
                        goto tx_err;
-                md = ip_tunnel_info_opts(tun_info);
+                if (tun_info->options_len < sizeof(*md))
-                if (!md)
                        goto tx_err;
+                md = ip_tunnel_info_opts(tun_info);
                tun_id = tunnel_id_to_key32(key->tun_id);
                if (md->version == 1) {
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 6324d3a8cb53..9fec580c968e 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -135,7 +135,7 @@ static int compute_score(struct sock *sk, struct net *net,
                return -1;
        score++;
-        if (sk->sk_incoming_cpu == raw_smp_processor_id())
+        if (READ_ONCE(sk->sk_incoming_cpu) == raw_smp_processor_id())
                score++;
        return score;
diff --git a/net/l2tp/l2tp_eth.c b/net/l2tp/l2tp_eth.c
index fd5ac2788e45..d3b520b9b2c9 100644
--- a/net/l2tp/l2tp_eth.c
+++ b/net/l2tp/l2tp_eth.c
@@ -56,7 +56,6 @@ static int l2tp_eth_dev_init(struct net_device *dev)
 {
        eth_hw_addr_random(dev);
        eth_broadcast_addr(dev->broadcast);
-        netdev_lockdep_set_classes(dev);
        return 0;
 }
diff --git a/net/netfilter/ipvs/ip_vs_app.c b/net/netfilter/ipvs/ip_vs_app.c
index 4515056ef1c2..f9b16f2b2219 100644
--- a/net/netfilter/ipvs/ip_vs_app.c
+++ b/net/netfilter/ipvs/ip_vs_app.c
@@ -193,21 +193,29 @@ struct ip_vs_app *register_ip_vs_app(struct netns_ipvs *ipvs, struct ip_vs_app *
        mutex_lock(&__ip_vs_app_mutex);
+        /* increase the module use count */
+        if (!ip_vs_use_count_inc()) {
+                err = -ENOENT;
+                goto out_unlock;
+        }
        list_for_each_entry(a, &ipvs->app_list, a_list) {
                if (!strcmp(app->name, a->name)) {
                        err = -EEXIST;
+                        /* decrease the module use count */
+                        ip_vs_use_count_dec();
                        goto out_unlock;
                }
        }
        a = kmemdup(app, sizeof(*app), GFP_KERNEL);
        if (!a) {
                err = -ENOMEM;
+                /* decrease the module use count */
+                ip_vs_use_count_dec();
                goto out_unlock;
        }
        INIT_LIST_HEAD(&a->incs_list);
        list_add(&a->a_list, &ipvs->app_list);
-        /* increase the module use count */
-        ip_vs_use_count_inc();
 out_unlock:
        mutex_unlock(&__ip_vs_app_mutex);
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index 8b48e7ce1c2c..3cccc88ef817 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -93,7 +93,6 @@ static bool __ip_vs_addr_is_local_v6(struct net *net,
 static void update_defense_level(struct netns_ipvs *ipvs)
 {
        struct sysinfo i;
-        static int old_secure_tcp = 0;
        int availmem;
        int nomem;
        int to_change = -1;
@@ -174,35 +173,35 @@ static void update_defense_level(struct netns_ipvs *ipvs)
        spin_lock(&ipvs->securetcp_lock);
        switch (ipvs->sysctl_secure_tcp) {
        case 0:
-                if (old_secure_tcp >= 2)
+                if (ipvs->old_secure_tcp >= 2)
                        to_change = 0;
                break;
        case 1:
                if (nomem) {
-                        if (old_secure_tcp < 2)
+                        if (ipvs->old_secure_tcp < 2)
                                to_change = 1;
                        ipvs->sysctl_secure_tcp = 2;
                } else {
-                        if (old_secure_tcp >= 2)
+                        if (ipvs->old_secure_tcp >= 2)
                                to_change = 0;
                }
                break;
        case 2:
                if (nomem) {
-                        if (old_secure_tcp < 2)
+                        if (ipvs->old_secure_tcp < 2)
                                to_change = 1;
                } else {
-                        if (old_secure_tcp >= 2)
+                        if (ipvs->old_secure_tcp >= 2)
                                to_change = 0;
                        ipvs->sysctl_secure_tcp = 1;
                }
                break;
        case 3:
-                if (old_secure_tcp < 2)
+                if (ipvs->old_secure_tcp < 2)
                        to_change = 1;
                break;
        }
-        old_secure_tcp = ipvs->sysctl_secure_tcp;
+        ipvs->old_secure_tcp = ipvs->sysctl_secure_tcp;
        if (to_change >= 0)
                ip_vs_protocol_timeout_change(ipvs,
                                              ipvs->sysctl_secure_tcp > 1);
@@ -1275,7 +1274,8 @@ ip_vs_add_service(struct netns_ipvs *ipvs, struct ip_vs_service_user_kern *u,
        struct ip_vs_service *svc = NULL;
        /* increase the module use count */
-        ip_vs_use_count_inc();
+        if (!ip_vs_use_count_inc())
+                return -ENOPROTOOPT;
        /* Lookup the scheduler by 'u->sched_name' */
        if (strcmp(u->sched_name, "none")) {
@@ -2435,9 +2435,6 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
        if (copy_from_user(arg, user, len) != 0)
                return -EFAULT;
-        /* increase the module use count */
-        ip_vs_use_count_inc();
        /* Handle daemons since they have another lock */
        if (cmd == IP_VS_SO_SET_STARTDAEMON ||
            cmd == IP_VS_SO_SET_STOPDAEMON) {
@@ -2450,13 +2447,13 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
                        ret = -EINVAL;
                        if (strscpy(cfg.mcast_ifn, dm->mcast_ifn,
                                    sizeof(cfg.mcast_ifn)) <= 0)
-                                goto out_dec;
+                                return ret;
                        cfg.syncid = dm->syncid;
                        ret = start_sync_thread(ipvs, &cfg, dm->state);
                } else {
                        ret = stop_sync_thread(ipvs, dm->state);
                }
-                goto out_dec;
+                return ret;
        }
        mutex_lock(&__ip_vs_mutex);
@@ -2551,10 +2548,6 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
  out_unlock:
        mutex_unlock(&__ip_vs_mutex);
-  out_dec:
-        /* decrease the module use count */
-        ip_vs_use_count_dec();
        return ret;
 }
diff --git a/net/netfilter/ipvs/ip_vs_pe.c b/net/netfilter/ipvs/ip_vs_pe.c
index 8e104dff7abc..166c669f0763 100644
--- a/net/netfilter/ipvs/ip_vs_pe.c
+++ b/net/netfilter/ipvs/ip_vs_pe.c
@@ -68,7 +68,8 @@ int register_ip_vs_pe(struct ip_vs_pe *pe)
        struct ip_vs_pe *tmp;
        /* increase the module use count */
-        ip_vs_use_count_inc();
+        if (!ip_vs_use_count_inc())
+                return -ENOENT;
        mutex_lock(&ip_vs_pe_mutex);
        /* Make sure that the pe with this name doesn't exist
diff --git a/net/netfilter/ipvs/ip_vs_sched.c b/net/netfilter/ipvs/ip_vs_sched.c
index 2f9d5cd5daee..d4903723be7e 100644
--- a/net/netfilter/ipvs/ip_vs_sched.c
+++ b/net/netfilter/ipvs/ip_vs_sched.c
@@ -179,7 +179,8 @@ int register_ip_vs_scheduler(struct ip_vs_scheduler *scheduler)
        }
        /* increase the module use count */
-        ip_vs_use_count_inc();
+        if (!ip_vs_use_count_inc())
+                return -ENOENT;
        mutex_lock(&ip_vs_sched_mutex);
diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c
index a4a78c4b06de..8dc892a9dc91 100644
--- a/net/netfilter/ipvs/ip_vs_sync.c
+++ b/net/netfilter/ipvs/ip_vs_sync.c
@@ -1762,6 +1762,10 @@ int start_sync_thread(struct netns_ipvs *ipvs, struct ipvs_sync_daemon_cfg *c,
        IP_VS_DBG(7, "Each ip_vs_sync_conn entry needs %zd bytes\n",
                  sizeof(struct ip_vs_sync_conn_v0));
+        /* increase the module use count */
+        if (!ip_vs_use_count_inc())
+                return -ENOPROTOOPT;
        /* Do not hold one mutex and then to block on another */
        for (;;) {
                rtnl_lock();
@@ -1892,9 +1896,6 @@ int start_sync_thread(struct netns_ipvs *ipvs, struct ipvs_sync_daemon_cfg *c,
        mutex_unlock(&ipvs->sync_mutex);
        rtnl_unlock();
-        /* increase the module use count */
-        ip_vs_use_count_inc();
        return 0;
 out:
@@ -1924,11 +1925,17 @@ out:
                }
                kfree(ti);
        }
+        /* decrease the module use count */
+        ip_vs_use_count_dec();
        return result;
 out_early:
        mutex_unlock(&ipvs->sync_mutex);
        rtnl_unlock();
+        /* decrease the module use count */
+        ip_vs_use_count_dec();
        return result;
 }
diff --git a/net/netfilter/nf_flow_table_core.c b/net/netfilter/nf_flow_table_core.c
index 132f5228b431..128245efe84a 100644
--- a/net/netfilter/nf_flow_table_core.c
+++ b/net/netfilter/nf_flow_table_core.c
@@ -202,6 +202,8 @@ int flow_offload_add(struct nf_flowtable *flow_table, struct flow_offload *flow)
 {
        int err;
+        flow->timeout = (u32)jiffies + NF_FLOW_TIMEOUT;
        err = rhashtable_insert_fast(&flow_table->rhashtable,
                                     &flow->tuplehash[0].node,
                                     nf_flow_offload_rhash_params);
@@ -218,7 +220,6 @@ int flow_offload_add(struct nf_flowtable *flow_table, struct flow_offload *flow)
                return err;
        }
-        flow->timeout = (u32)jiffies + NF_FLOW_TIMEOUT;
        return 0;
 }
 EXPORT_SYMBOL_GPL(flow_offload_add);
diff --git a/net/netfilter/nf_tables_offload.c b/net/netfilter/nf_tables_offload.c
index e546f759b7a7..ad783f4840ef 100644
--- a/net/netfilter/nf_tables_offload.c
+++ b/net/netfilter/nf_tables_offload.c
@@ -347,7 +347,7 @@ int nft_flow_rule_offload_commit(struct net *net)
                        policy = nft_trans_chain_policy(trans);
                        err = nft_flow_offload_chain(trans->ctx.chain, &policy,
-                                                     FLOW_BLOCK_BIND);
+                                                     FLOW_BLOCK_UNBIND);
                        break;
                case NFT_MSG_NEWRULE:
                        if (!(trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD))
diff --git a/net/netfilter/nft_payload.c b/net/netfilter/nft_payload.c
index 22a80eb60222..5cb2d8908d2a 100644
--- a/net/netfilter/nft_payload.c
+++ b/net/netfilter/nft_payload.c
@@ -161,13 +161,21 @@ static int nft_payload_offload_ll(struct nft_offload_ctx *ctx,
        switch (priv->offset) {
        case offsetof(struct ethhdr, h_source):
+                if (priv->len != ETH_ALEN)
+                        return -EOPNOTSUPP;
                NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_ETH_ADDRS, eth_addrs,
                                  src, ETH_ALEN, reg);
                break;
        case offsetof(struct ethhdr, h_dest):
+                if (priv->len != ETH_ALEN)
+                        return -EOPNOTSUPP;
                NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_ETH_ADDRS, eth_addrs,
                                  dst, ETH_ALEN, reg);
                break;
+        default:
+                return -EOPNOTSUPP;
        }
        return 0;
@@ -181,14 +189,23 @@ static int nft_payload_offload_ip(struct nft_offload_ctx *ctx,
        switch (priv->offset) {
        case offsetof(struct iphdr, saddr):
+                if (priv->len != sizeof(struct in_addr))
+                        return -EOPNOTSUPP;
                NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_IPV4_ADDRS, ipv4, src,
                                  sizeof(struct in_addr), reg);
                break;
        case offsetof(struct iphdr, daddr):
+                if (priv->len != sizeof(struct in_addr))
+                        return -EOPNOTSUPP;
                NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_IPV4_ADDRS, ipv4, dst,
                                  sizeof(struct in_addr), reg);
                break;
        case offsetof(struct iphdr, protocol):
+                if (priv->len != sizeof(__u8))
+                        return -EOPNOTSUPP;
                NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_BASIC, basic, ip_proto,
                                  sizeof(__u8), reg);
                nft_offload_set_dependency(ctx, NFT_OFFLOAD_DEP_TRANSPORT);
@@ -208,14 +225,23 @@ static int nft_payload_offload_ip6(struct nft_offload_ctx *ctx,
        switch (priv->offset) {
        case offsetof(struct ipv6hdr, saddr):
+                if (priv->len != sizeof(struct in6_addr))
+                        return -EOPNOTSUPP;
                NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_IPV6_ADDRS, ipv6, src,
                                  sizeof(struct in6_addr), reg);
                break;
        case offsetof(struct ipv6hdr, daddr):
+                if (priv->len != sizeof(struct in6_addr))
+                        return -EOPNOTSUPP;
                NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_IPV6_ADDRS, ipv6, dst,
                                  sizeof(struct in6_addr), reg);
                break;
        case offsetof(struct ipv6hdr, nexthdr):
+                if (priv->len != sizeof(__u8))
+                        return -EOPNOTSUPP;
                NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_BASIC, basic, ip_proto,
                                  sizeof(__u8), reg);
                nft_offload_set_dependency(ctx, NFT_OFFLOAD_DEP_TRANSPORT);
@@ -255,10 +281,16 @@ static int nft_payload_offload_tcp(struct nft_offload_ctx *ctx,
        switch (priv->offset) {
        case offsetof(struct tcphdr, source):
+                if (priv->len != sizeof(__be16))
+                        return -EOPNOTSUPP;
                NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_PORTS, tp, src,
                                  sizeof(__be16), reg);
                break;
        case offsetof(struct tcphdr, dest):
+                if (priv->len != sizeof(__be16))
+                        return -EOPNOTSUPP;
                NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_PORTS, tp, dst,
                                  sizeof(__be16), reg);
                break;
@@ -277,10 +309,16 @@ static int nft_payload_offload_udp(struct nft_offload_ctx *ctx,
        switch (priv->offset) {
        case offsetof(struct udphdr, source):
+                if (priv->len != sizeof(__be16))
+                        return -EOPNOTSUPP;
                NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_PORTS, tp, src,
                                  sizeof(__be16), reg);
                break;
        case offsetof(struct udphdr, dest):
+                if (priv->len != sizeof(__be16))
+                        return -EOPNOTSUPP;
                NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_PORTS, tp, dst,
                                  sizeof(__be16), reg);
                break;
diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
index c4f54ad2b98a..58d5373c513c 100644
--- a/net/netrom/af_netrom.c
+++ b/net/netrom/af_netrom.c
@@ -64,28 +64,6 @@ static DEFINE_SPINLOCK(nr_list_lock);
 static const struct proto_ops nr_proto_ops;
 /*
- * NETROM network devices are virtual network devices encapsulating NETROM
- * frames into AX.25 which will be sent through an AX.25 device, so form a
- * special "super class" of normal net devices; split their locks off into a
- * separate class since they always nest.
- */
-static struct lock_class_key nr_netdev_xmit_lock_key;
-static struct lock_class_key nr_netdev_addr_lock_key;
-static void nr_set_lockdep_one(struct net_device *dev,
-                               struct netdev_queue *txq,
-                               void *_unused)
-{
-        lockdep_set_class(&txq->_xmit_lock, &nr_netdev_xmit_lock_key);
-}
-static void nr_set_lockdep_key(struct net_device *dev)
-{
-        lockdep_set_class(&dev->addr_list_lock, &nr_netdev_addr_lock_key);
-        netdev_for_each_tx_queue(dev, nr_set_lockdep_one, NULL);
-}
-/*
 *      Socket removal during an interrupt is now safe.
 */
 static void nr_remove_socket(struct sock *sk)
@@ -1414,7 +1392,6 @@ static int __init nr_proto_init(void)
                        free_netdev(dev);
                        goto fail;
                }
-                nr_set_lockdep_key(dev);
                dev_nr[i] = dev;
        }
diff --git a/net/nfc/llcp_sock.c b/net/nfc/llcp_sock.c
index ccdd790e163a..28604414dec1 100644
--- a/net/nfc/llcp_sock.c
+++ b/net/nfc/llcp_sock.c
@@ -554,11 +554,11 @@ static __poll_t llcp_sock_poll(struct file *file, struct socket *sock,
        if (sk->sk_state == LLCP_LISTEN)
                return llcp_accept_poll(sk);
-        if (sk->sk_err || !skb_queue_empty(&sk->sk_error_queue))
+        if (sk->sk_err || !skb_queue_empty_lockless(&sk->sk_error_queue))
                mask |= EPOLLERR |
                        (sock_flag(sk, SOCK_SELECT_ERR_QUEUE) ? EPOLLPRI : 0);
-        if (!skb_queue_empty(&sk->sk_receive_queue))
+        if (!skb_queue_empty_lockless(&sk->sk_receive_queue))
                mask |= EPOLLIN | EPOLLRDNORM;
        if (sk->sk_state == LLCP_CLOSED)
diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c
index f30e406fbec5..d8c364d637b1 100644
--- a/net/openvswitch/datapath.c
+++ b/net/openvswitch/datapath.c
@@ -1881,7 +1881,7 @@ static struct genl_family dp_datapath_genl_family __ro_after_init = {
 /* Called with ovs_mutex or RCU read lock. */
 static int ovs_vport_cmd_fill_info(struct vport *vport, struct sk_buff *skb,
                                   struct net *net, u32 portid, u32 seq,
-                                   u32 flags, u8 cmd)
+                                   u32 flags, u8 cmd, gfp_t gfp)
 {
        struct ovs_header *ovs_header;
        struct ovs_vport_stats vport_stats;
@@ -1902,7 +1902,7 @@ static int ovs_vport_cmd_fill_info(struct vport *vport, struct sk_buff *skb,
                goto nla_put_failure;
        if (!net_eq(net, dev_net(vport->dev))) {
-                int id = peernet2id_alloc(net, dev_net(vport->dev));
+                int id = peernet2id_alloc(net, dev_net(vport->dev), gfp);
                if (nla_put_s32(skb, OVS_VPORT_ATTR_NETNSID, id))
                        goto nla_put_failure;
@@ -1943,11 +1943,12 @@ struct sk_buff *ovs_vport_cmd_build_info(struct vport *vport, struct net *net,
        struct sk_buff *skb;
        int retval;
-        skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
+        skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
        if (!skb)
                return ERR_PTR(-ENOMEM);
-        retval = ovs_vport_cmd_fill_info(vport, skb, net, portid, seq, 0, cmd);
+        retval = ovs_vport_cmd_fill_info(vport, skb, net, portid, seq, 0, cmd,
+                                         GFP_KERNEL);
        BUG_ON(retval < 0);
        return skb;
@@ -2089,7 +2090,7 @@ restart:
        err = ovs_vport_cmd_fill_info(vport, reply, genl_info_net(info),
                                      info->snd_portid, info->snd_seq, 0,
-                                      OVS_VPORT_CMD_NEW);
+                                      OVS_VPORT_CMD_NEW, GFP_KERNEL);
        new_headroom = netdev_get_fwd_headroom(vport->dev);
@@ -2150,7 +2151,7 @@ static int ovs_vport_cmd_set(struct sk_buff *skb, struct genl_info *info)
        err = ovs_vport_cmd_fill_info(vport, reply, genl_info_net(info),
                                      info->snd_portid, info->snd_seq, 0,
-                                      OVS_VPORT_CMD_SET);
+                                      OVS_VPORT_CMD_SET, GFP_KERNEL);
        BUG_ON(err < 0);
        ovs_unlock();
@@ -2190,7 +2191,7 @@ static int ovs_vport_cmd_del(struct sk_buff *skb, struct genl_info *info)
        err = ovs_vport_cmd_fill_info(vport, reply, genl_info_net(info),
                                      info->snd_portid, info->snd_seq, 0,
-                                      OVS_VPORT_CMD_DEL);
+                                      OVS_VPORT_CMD_DEL, GFP_KERNEL);
        BUG_ON(err < 0);
        /* the vport deletion may trigger dp headroom update */
@@ -2237,7 +2238,7 @@ static int ovs_vport_cmd_get(struct sk_buff *skb, struct genl_info *info)
                goto exit_unlock_free;
        err = ovs_vport_cmd_fill_info(vport, reply, genl_info_net(info),
                                      info->snd_portid, info->snd_seq, 0,
-                                      OVS_VPORT_CMD_GET);
+                                      OVS_VPORT_CMD_GET, GFP_ATOMIC);
        BUG_ON(err < 0);
        rcu_read_unlock();
@@ -2273,7 +2274,8 @@ static int ovs_vport_cmd_dump(struct sk_buff *skb, struct netlink_callback *cb)
                                                    NETLINK_CB(cb->skb).portid,
                                                    cb->nlh->nlmsg_seq,
                                                    NLM_F_MULTI,
-                                                    OVS_VPORT_CMD_GET) < 0)
+                                                    OVS_VPORT_CMD_GET,
+                                                    GFP_ATOMIC) < 0)
                                goto out;
                        j++;
diff --git a/net/openvswitch/vport-internal_dev.c b/net/openvswitch/vport-internal_dev.c
index 21c90d3a7ebf..58a7b8312c28 100644
--- a/net/openvswitch/vport-internal_dev.c
+++ b/net/openvswitch/vport-internal_dev.c
@@ -137,7 +137,7 @@ static void do_setup(struct net_device *netdev)
        netdev->priv_flags |= IFF_LIVE_ADDR_CHANGE | IFF_OPENVSWITCH |
                              IFF_NO_QUEUE;
        netdev->needs_free_netdev = true;
-        netdev->priv_destructor = internal_dev_destructor;
+        netdev->priv_destructor = NULL;
        netdev->ethtool_ops = &internal_dev_ethtool_ops;
        netdev->rtnl_link_ops = &internal_dev_link_ops;
@@ -159,7 +159,6 @@ static struct vport *internal_dev_create(const struct vport_parms *parms)
        struct internal_dev *internal_dev;
        struct net_device *dev;
        int err;
-        bool free_vport = true;
        vport = ovs_vport_alloc(0, &ovs_internal_vport_ops, parms);
        if (IS_ERR(vport)) {
@@ -190,10 +189,9 @@ static struct vport *internal_dev_create(const struct vport_parms *parms)
        rtnl_lock();
        err = register_netdevice(vport->dev);
-        if (err) {
+        if (err)
-                free_vport = false;
                goto error_unlock;
-        }
+        vport->dev->priv_destructor = internal_dev_destructor;
        dev_set_promiscuity(vport->dev, 1);
        rtnl_unlock();
@@ -207,8 +205,7 @@ error_unlock:
 error_free_netdev:
        free_netdev(dev);
 error_free_vport:
-        if (free_vport)
+        ovs_vport_free(vport);
-                ovs_vport_free(vport);
 error:
        return ERR_PTR(err);
 }
diff --git a/net/phonet/socket.c b/net/phonet/socket.c
index 96ea9f254ae9..76d499f6af9a 100644
--- a/net/phonet/socket.c
+++ b/net/phonet/socket.c
@@ -338,9 +338,9 @@ static __poll_t pn_socket_poll(struct file *file, struct socket *sock,
        if (sk->sk_state == TCP_CLOSE)
                return EPOLLERR;
-        if (!skb_queue_empty(&sk->sk_receive_queue))
+        if (!skb_queue_empty_lockless(&sk->sk_receive_queue))
                mask |= EPOLLIN | EPOLLRDNORM;
-        if (!skb_queue_empty(&pn->ctrlreq_queue))
+        if (!skb_queue_empty_lockless(&pn->ctrlreq_queue))
                mask |= EPOLLPRI;
        if (!mask && sk->sk_state == TCP_CLOSE_WAIT)
                return EPOLLHUP;
diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index f0e9ccf472a9..6a0df7c8a939 100644
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -65,28 +65,6 @@ static const struct proto_ops rose_proto_ops;
 ax25_address rose_callsign;
 /*
- * ROSE network devices are virtual network devices encapsulating ROSE
- * frames into AX.25 which will be sent through an AX.25 device, so form a
- * special "super class" of normal net devices; split their locks off into a
- * separate class since they always nest.
- */
-static struct lock_class_key rose_netdev_xmit_lock_key;
-static struct lock_class_key rose_netdev_addr_lock_key;
-static void rose_set_lockdep_one(struct net_device *dev,
-                                 struct netdev_queue *txq,
-                                 void *_unused)
-{
-        lockdep_set_class(&txq->_xmit_lock, &rose_netdev_xmit_lock_key);
-}
-static void rose_set_lockdep_key(struct net_device *dev)
-{
-        lockdep_set_class(&dev->addr_list_lock, &rose_netdev_addr_lock_key);
-        netdev_for_each_tx_queue(dev, rose_set_lockdep_one, NULL);
-}
-/*
 *      Convert a ROSE address into text.
 */
 char *rose2asc(char *buf, const rose_address *addr)
@@ -1533,7 +1511,6 @@ static int __init rose_proto_init(void)
                        free_netdev(dev);
                        goto fail;
                }
-                rose_set_lockdep_key(dev);
                dev_rose[i] = dev;
        }
diff --git a/net/rxrpc/ar-internal.h b/net/rxrpc/ar-internal.h
index ecc17dabec8f..7c7d10f2e0c1 100644
--- a/net/rxrpc/ar-internal.h
+++ b/net/rxrpc/ar-internal.h
@@ -601,6 +601,7 @@ struct rxrpc_call {
        int                     debug_id;       /* debug ID for printks */
        unsigned short          rx_pkt_offset;  /* Current recvmsg packet offset */
        unsigned short          rx_pkt_len;     /* Current recvmsg packet len */
+        bool                    rx_pkt_last;    /* Current recvmsg packet is last */
        /* Rx/Tx circular buffer, depending on phase.
         *
diff --git a/net/rxrpc/recvmsg.c b/net/rxrpc/recvmsg.c
index a4090797c9b2..8578c39ec839 100644
--- a/net/rxrpc/recvmsg.c
+++ b/net/rxrpc/recvmsg.c
@@ -267,11 +267,13 @@ static int rxrpc_verify_packet(struct rxrpc_call *call, struct sk_buff *skb,
 */
 static int rxrpc_locate_data(struct rxrpc_call *call, struct sk_buff *skb,
                             u8 *_annotation,
-                             unsigned int *_offset, unsigned int *_len)
+                             unsigned int *_offset, unsigned int *_len,
+                             bool *_last)
 {
        struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
        unsigned int offset = sizeof(struct rxrpc_wire_header);
        unsigned int len;
+        bool last = false;
        int ret;
        u8 annotation = *_annotation;
        u8 subpacket = annotation & RXRPC_RX_ANNO_SUBPACKET;
@@ -281,6 +283,8 @@ static int rxrpc_locate_data(struct rxrpc_call *call, struct sk_buff *skb,
        len = skb->len - offset;
        if (subpacket < sp->nr_subpackets - 1)
                len = RXRPC_JUMBO_DATALEN;
+        else if (sp->rx_flags & RXRPC_SKB_INCL_LAST)
+                last = true;
        if (!(annotation & RXRPC_RX_ANNO_VERIFIED)) {
                ret = rxrpc_verify_packet(call, skb, annotation, offset, len);
@@ -291,6 +295,7 @@ static int rxrpc_locate_data(struct rxrpc_call *call, struct sk_buff *skb,
        *_offset = offset;
        *_len = len;
+        *_last = last;
        call->security->locate_data(call, skb, _offset, _len);
        return 0;
 }
@@ -309,7 +314,7 @@ static int rxrpc_recvmsg_data(struct socket *sock, struct rxrpc_call *call,
        rxrpc_serial_t serial;
        rxrpc_seq_t hard_ack, top, seq;
        size_t remain;
-        bool last;
+        bool rx_pkt_last;
        unsigned int rx_pkt_offset, rx_pkt_len;
        int ix, copy, ret = -EAGAIN, ret2;
@@ -319,6 +324,7 @@ static int rxrpc_recvmsg_data(struct socket *sock, struct rxrpc_call *call,
        rx_pkt_offset = call->rx_pkt_offset;
        rx_pkt_len = call->rx_pkt_len;
+        rx_pkt_last = call->rx_pkt_last;
        if (call->state >= RXRPC_CALL_SERVER_ACK_REQUEST) {
                seq = call->rx_hard_ack;
@@ -329,6 +335,7 @@ static int rxrpc_recvmsg_data(struct socket *sock, struct rxrpc_call *call,
        /* Barriers against rxrpc_input_data(). */
        hard_ack = call->rx_hard_ack;
        seq = hard_ack + 1;
        while (top = smp_load_acquire(&call->rx_top),
               before_eq(seq, top)
               ) {
@@ -356,7 +363,8 @@ static int rxrpc_recvmsg_data(struct socket *sock, struct rxrpc_call *call,
                if (rx_pkt_offset == 0) {
                        ret2 = rxrpc_locate_data(call, skb,
                                                 &call->rxtx_annotations[ix],
-                                                 &rx_pkt_offset, &rx_pkt_len);
+                                                 &rx_pkt_offset, &rx_pkt_len,
+                                                 &rx_pkt_last);
                        trace_rxrpc_recvmsg(call, rxrpc_recvmsg_next, seq,
                                            rx_pkt_offset, rx_pkt_len, ret2);
                        if (ret2 < 0) {
@@ -396,13 +404,12 @@ static int rxrpc_recvmsg_data(struct socket *sock, struct rxrpc_call *call,
                }
                /* The whole packet has been transferred. */
-                last = sp->hdr.flags & RXRPC_LAST_PACKET;
                if (!(flags & MSG_PEEK))
                        rxrpc_rotate_rx_window(call);
                rx_pkt_offset = 0;
                rx_pkt_len = 0;
-                if (last) {
+                if (rx_pkt_last) {
                        ASSERTCMP(seq, ==, READ_ONCE(call->rx_top));
                        ret = 1;
                        goto out;
@@ -415,6 +422,7 @@ out:
        if (!(flags & MSG_PEEK)) {
                call->rx_pkt_offset = rx_pkt_offset;
                call->rx_pkt_len = rx_pkt_len;
+                call->rx_pkt_last = rx_pkt_last;
        }
 done:
        trace_rxrpc_recvmsg(call, rxrpc_recvmsg_data_return, seq,
diff --git a/net/sched/cls_bpf.c b/net/sched/cls_bpf.c
index bf10bdaf5012..8229ed4a67be 100644
--- a/net/sched/cls_bpf.c
+++ b/net/sched/cls_bpf.c
@@ -162,16 +162,20 @@ static int cls_bpf_offload_cmd(struct tcf_proto *tp, struct cls_bpf_prog *prog,
        cls_bpf.name = obj->bpf_name;
        cls_bpf.exts_integrated = obj->exts_integrated;
-        if (oldprog)
+        if (oldprog && prog)
                err = tc_setup_cb_replace(block, tp, TC_SETUP_CLSBPF, &cls_bpf,
                                          skip_sw, &oldprog->gen_flags,
                                          &oldprog->in_hw_count,
                                          &prog->gen_flags, &prog->in_hw_count,
                                          true);
-        else
+        else if (prog)
                err = tc_setup_cb_add(block, tp, TC_SETUP_CLSBPF, &cls_bpf,
                                      skip_sw, &prog->gen_flags,
                                      &prog->in_hw_count, true);
+        else
+                err = tc_setup_cb_destroy(block, tp, TC_SETUP_CLSBPF, &cls_bpf,
+                                          skip_sw, &oldprog->gen_flags,
+                                          &oldprog->in_hw_count, true);
        if (prog && err) {
                cls_bpf_offload_cmd(tp, oldprog, prog, extack);
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index 17bd8f539bc7..8769b4b8807d 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -799,9 +799,6 @@ struct Qdisc_ops pfifo_fast_ops __read_mostly = {
 };
 EXPORT_SYMBOL(pfifo_fast_ops);
-static struct lock_class_key qdisc_tx_busylock;
-static struct lock_class_key qdisc_running_key;
 struct Qdisc *qdisc_alloc(struct netdev_queue *dev_queue,
                          const struct Qdisc_ops *ops,
                          struct netlink_ext_ack *extack)
@@ -854,17 +851,9 @@ struct Qdisc *qdisc_alloc(struct netdev_queue *dev_queue,
        }
        spin_lock_init(&sch->busylock);
-        lockdep_set_class(&sch->busylock,
-                          dev->qdisc_tx_busylock ?: &qdisc_tx_busylock);
        /* seqlock has the same scope of busylock, for NOLOCK qdisc */
        spin_lock_init(&sch->seqlock);
-        lockdep_set_class(&sch->busylock,
-                          dev->qdisc_tx_busylock ?: &qdisc_tx_busylock);
        seqcount_init(&sch->running);
-        lockdep_set_class(&sch->running,
-                          dev->qdisc_running_key ?: &qdisc_running_key);
        sch->ops = ops;
        sch->flags = ops->static_flags;
@@ -875,6 +864,12 @@ struct Qdisc *qdisc_alloc(struct netdev_queue *dev_queue,
        dev_hold(dev);
        refcount_set(&sch->refcnt, 1);
+        if (sch != &noop_qdisc) {
+                lockdep_set_class(&sch->busylock, &dev->qdisc_tx_busylock_key);
+                lockdep_set_class(&sch->seqlock, &dev->qdisc_tx_busylock_key);
+                lockdep_set_class(&sch->running, &dev->qdisc_running_key);
+        }
        return sch;
 errout1:
        kfree(p);
@@ -1043,6 +1038,8 @@ static void attach_one_default_qdisc(struct net_device *dev,
        if (dev->priv_flags & IFF_NO_QUEUE)
                ops = &noqueue_qdisc_ops;
+        else if(dev->type == ARPHRD_CAN)
+                ops = &pfifo_fast_ops;
        qdisc = qdisc_create_dflt(dev_queue, ops, TC_H_ROOT, NULL);
        if (!qdisc) {
diff --git a/net/sched/sch_hhf.c b/net/sched/sch_hhf.c
index 23cd1c873a2c..be35f03b657b 100644
--- a/net/sched/sch_hhf.c
+++ b/net/sched/sch_hhf.c
@@ -5,11 +5,11 @@
 * Copyright (C) 2013 Nandita Dukkipati <nanditad@google.com>
 */
-#include <linux/jhash.h>
 #include <linux/jiffies.h>
 #include <linux/module.h>
 #include <linux/skbuff.h>
 #include <linux/vmalloc.h>
+#include <linux/siphash.h>
 #include <net/pkt_sched.h>
 #include <net/sock.h>
@@ -126,7 +126,7 @@ struct wdrr_bucket {
 struct hhf_sched_data {
        struct wdrr_bucket buckets[WDRR_BUCKET_CNT];
-        u32                perturbation;   /* hash perturbation */
+        siphash_key_t      perturbation;   /* hash perturbation */
        u32                quantum;        /* psched_mtu(qdisc_dev(sch)); */
        u32                drop_overlimit; /* number of times max qdisc packet
                                            * limit was hit
@@ -264,7 +264,7 @@ static enum wdrr_bucket_idx hhf_classify(struct sk_buff *skb, struct Qdisc *sch)
        }
        /* Get hashed flow-id of the skb. */
-        hash = skb_get_hash_perturb(skb, q->perturbation);
+        hash = skb_get_hash_perturb(skb, &q->perturbation);
        /* Check if this packet belongs to an already established HH flow. */
        flow_pos = hash & HHF_BIT_MASK;
@@ -582,7 +582,7 @@ static int hhf_init(struct Qdisc *sch, struct nlattr *opt,
        sch->limit = 1000;
        q->quantum = psched_mtu(qdisc_dev(sch));
-        q->perturbation = prandom_u32();
+        get_random_bytes(&q->perturbation, sizeof(q->perturbation));
        INIT_LIST_HEAD(&q->new_buckets);
        INIT_LIST_HEAD(&q->old_buckets);
diff --git a/net/sched/sch_sfb.c b/net/sched/sch_sfb.c
index d448fe3068e5..4074c50ac3d7 100644
--- a/net/sched/sch_sfb.c
+++ b/net/sched/sch_sfb.c
@@ -18,7 +18,7 @@
 #include <linux/errno.h>
 #include <linux/skbuff.h>
 #include <linux/random.h>
-#include <linux/jhash.h>
+#include <linux/siphash.h>
 #include <net/ip.h>
 #include <net/pkt_sched.h>
 #include <net/pkt_cls.h>
@@ -45,7 +45,7 @@ struct sfb_bucket {
 * (Section 4.4 of SFB reference : moving hash functions)
 */
 struct sfb_bins {
-        u32               perturbation; /* jhash perturbation */
+        siphash_key_t     perturbation; /* siphash key */
        struct sfb_bucket bins[SFB_LEVELS][SFB_NUMBUCKETS];
 };
@@ -217,7 +217,8 @@ static u32 sfb_compute_qlen(u32 *prob_r, u32 *avgpm_r, const struct sfb_sched_da
 static void sfb_init_perturbation(u32 slot, struct sfb_sched_data *q)
 {
-        q->bins[slot].perturbation = prandom_u32();
+        get_random_bytes(&q->bins[slot].perturbation,
+                         sizeof(q->bins[slot].perturbation));
 }
 static void sfb_swap_slot(struct sfb_sched_data *q)
@@ -314,9 +315,9 @@ static int sfb_enqueue(struct sk_buff *skb, struct Qdisc *sch,
                /* If using external classifiers, get result and record it. */
                if (!sfb_classify(skb, fl, &ret, &salt))
                        goto other_drop;
-                sfbhash = jhash_1word(salt, q->bins[slot].perturbation);
+                sfbhash = siphash_1u32(salt, &q->bins[slot].perturbation);
        } else {
-                sfbhash = skb_get_hash_perturb(skb, q->bins[slot].perturbation);
+                sfbhash = skb_get_hash_perturb(skb, &q->bins[slot].perturbation);
        }
@@ -352,7 +353,7 @@ static int sfb_enqueue(struct sk_buff *skb, struct Qdisc *sch,
                /* Inelastic flow */
                if (q->double_buffering) {
                        sfbhash = skb_get_hash_perturb(skb,
-                            q->bins[slot].perturbation);
+                            &q->bins[slot].perturbation);
                        if (!sfbhash)
                                sfbhash = 1;
                        sfb_skb_cb(skb)->hashes[slot] = sfbhash;
diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c
index 68404a9d2ce4..c787d4d46017 100644
--- a/net/sched/sch_sfq.c
+++ b/net/sched/sch_sfq.c
@@ -14,7 +14,7 @@
 #include <linux/errno.h>
 #include <linux/init.h>
 #include <linux/skbuff.h>
-#include <linux/jhash.h>
+#include <linux/siphash.h>
 #include <linux/slab.h>
 #include <linux/vmalloc.h>
 #include <net/netlink.h>
@@ -117,7 +117,7 @@ struct sfq_sched_data {
        u8              headdrop;
        u8              maxdepth;       /* limit of packets per flow */
-        u32             perturbation;
+        siphash_key_t   perturbation;
        u8              cur_depth;      /* depth of longest slot */
        u8              flags;
        unsigned short  scaled_quantum; /* SFQ_ALLOT_SIZE(quantum) */
@@ -157,7 +157,7 @@ static inline struct sfq_head *sfq_dep_head(struct sfq_sched_data *q, sfq_index
 static unsigned int sfq_hash(const struct sfq_sched_data *q,
                             const struct sk_buff *skb)
 {
-        return skb_get_hash_perturb(skb, q->perturbation) & (q->divisor - 1);
+        return skb_get_hash_perturb(skb, &q->perturbation) & (q->divisor - 1);
 }
 static unsigned int sfq_classify(struct sk_buff *skb, struct Qdisc *sch,
@@ -607,9 +607,11 @@ static void sfq_perturbation(struct timer_list *t)
        struct sfq_sched_data *q = from_timer(q, t, perturb_timer);
        struct Qdisc *sch = q->sch;
        spinlock_t *root_lock = qdisc_lock(qdisc_root_sleeping(sch));
+        siphash_key_t nkey;
+        get_random_bytes(&nkey, sizeof(nkey));
        spin_lock(root_lock);
-        q->perturbation = prandom_u32();
+        q->perturbation = nkey;
        if (!q->filter_list && q->tail)
                sfq_rehash(sch);
        spin_unlock(root_lock);
@@ -688,7 +690,7 @@ static int sfq_change(struct Qdisc *sch, struct nlattr *opt)
        del_timer(&q->perturb_timer);
        if (q->perturb_period) {
                mod_timer(&q->perturb_timer, jiffies + q->perturb_period);
-                q->perturbation = prandom_u32();
+                get_random_bytes(&q->perturbation, sizeof(q->perturbation));
        }
        sch_tree_unlock(sch);
        kfree(p);
@@ -745,7 +747,7 @@ static int sfq_init(struct Qdisc *sch, struct nlattr *opt,
        q->quantum = psched_mtu(qdisc_dev(sch));
        q->scaled_quantum = SFQ_ALLOT_SIZE(q->quantum);
        q->perturb_period = 0;
-        q->perturbation = prandom_u32();
+        get_random_bytes(&q->perturbation, sizeof(q->perturbation));
        if (opt) {
                int err = sfq_change(sch, opt);
diff --git a/net/sched/sch_taprio.c b/net/sched/sch_taprio.c
index 6719a65169d4..2121187229cd 100644
--- a/net/sched/sch_taprio.c
+++ b/net/sched/sch_taprio.c
@@ -1152,7 +1152,7 @@ EXPORT_SYMBOL_GPL(taprio_offload_free);
 * offload state (PENDING, ACTIVE, INACTIVE) so it can be visible in dump().
 * This is left as TODO.
 */
-void taprio_offload_config_changed(struct taprio_sched *q)
+static void taprio_offload_config_changed(struct taprio_sched *q)
 {
        struct sched_gate_list *oper, *admin;
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 5ca0ec0e823c..ffd3262b7a41 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -8476,7 +8476,7 @@ __poll_t sctp_poll(struct file *file, struct socket *sock, poll_table *wait)
        mask = 0;
        /* Is there any exceptional events?  */
-        if (sk->sk_err || !skb_queue_empty(&sk->sk_error_queue))
+        if (sk->sk_err || !skb_queue_empty_lockless(&sk->sk_error_queue))
                mask |= EPOLLERR |
                        (sock_flag(sk, SOCK_SELECT_ERR_QUEUE) ? EPOLLPRI : 0);
        if (sk->sk_shutdown & RCV_SHUTDOWN)
@@ -8485,7 +8485,7 @@ __poll_t sctp_poll(struct file *file, struct socket *sock, poll_table *wait)
                mask |= EPOLLHUP;
        /* Is it readable?  Reconsider this code with TCP-style support.  */
-        if (!skb_queue_empty(&sk->sk_receive_queue))
+        if (!skb_queue_empty_lockless(&sk->sk_receive_queue))
                mask |= EPOLLIN | EPOLLRDNORM;
        /* The association is either gone or not ready.  */
@@ -8871,7 +8871,7 @@ struct sk_buff *sctp_skb_recv_datagram(struct sock *sk, int flags,
                if (sk_can_busy_loop(sk)) {
                        sk_busy_loop(sk, noblock);
-                        if (!skb_queue_empty(&sk->sk_receive_queue))
+                        if (!skb_queue_empty_lockless(&sk->sk_receive_queue))
                                continue;
                }
@@ -9306,7 +9306,7 @@ void sctp_copy_sock(struct sock *newsk, struct sock *sk,
        newinet->inet_rcv_saddr = inet->inet_rcv_saddr;
        newinet->inet_dport = htons(asoc->peer.port);
        newinet->pmtudisc = inet->pmtudisc;
-        newinet->inet_id = asoc->next_tsn ^ jiffies;
+        newinet->inet_id = prandom_u32();
        newinet->uc_ttl = inet->uc_ttl;
        newinet->mc_loop = 1;
diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
index 5b932583e407..47946f489fd4 100644
--- a/net/smc/af_smc.c
+++ b/net/smc/af_smc.c
@@ -123,6 +123,12 @@ struct proto smc_proto6 = {
 };
 EXPORT_SYMBOL_GPL(smc_proto6);
+static void smc_restore_fallback_changes(struct smc_sock *smc)
+{
+        smc->clcsock->file->private_data = smc->sk.sk_socket;
+        smc->clcsock->file = NULL;
+}
 static int __smc_release(struct smc_sock *smc)
 {
        struct sock *sk = &smc->sk;
@@ -141,6 +147,7 @@ static int __smc_release(struct smc_sock *smc)
                }
                sk->sk_state = SMC_CLOSED;
                sk->sk_state_change(sk);
+                smc_restore_fallback_changes(smc);
        }
        sk->sk_prot->unhash(sk);
@@ -700,8 +707,6 @@ static int __smc_connect(struct smc_sock *smc)
        int smc_type;
        int rc = 0;
-        sock_hold(&smc->sk); /* sock put in passive closing */
        if (smc->use_fallback)
                return smc_connect_fallback(smc, smc->fallback_rsn);
@@ -846,6 +851,8 @@ static int smc_connect(struct socket *sock, struct sockaddr *addr,
        rc = kernel_connect(smc->clcsock, addr, alen, flags);
        if (rc && rc != -EINPROGRESS)
                goto out;
+        sock_hold(&smc->sk); /* sock put in passive closing */
        if (flags & O_NONBLOCK) {
                if (schedule_work(&smc->connect_work))
                        smc->connect_nonblock = 1;
@@ -1291,8 +1298,8 @@ static void smc_listen_work(struct work_struct *work)
        /* check if RDMA is available */
        if (!ism_supported) { /* SMC_TYPE_R or SMC_TYPE_B */
                /* prepare RDMA check */
-                memset(&ini, 0, sizeof(ini));
                ini.is_smcd = false;
+                ini.ism_dev = NULL;
                ini.ib_lcl = &pclc->lcl;
                rc = smc_find_rdma_device(new_smc, &ini);
                if (rc) {
diff --git a/net/smc/smc_core.c b/net/smc/smc_core.c
index 88556f0251ab..2ba97ff325a5 100644
--- a/net/smc/smc_core.c
+++ b/net/smc/smc_core.c
@@ -561,7 +561,7 @@ int smc_vlan_by_tcpsk(struct socket *clcsock, struct smc_init_info *ini)
        }
        rtnl_lock();
-        nest_lvl = dev_get_nest_level(ndev);
+        nest_lvl = ndev->lower_level;
        for (i = 0; i < nest_lvl; i++) {
                struct list_head *lower = &ndev->adj_list.lower;
diff --git a/net/smc/smc_pnet.c b/net/smc/smc_pnet.c
index bab2da8cf17a..2920b006f65c 100644
--- a/net/smc/smc_pnet.c
+++ b/net/smc/smc_pnet.c
@@ -718,7 +718,7 @@ static struct net_device *pnet_find_base_ndev(struct net_device *ndev)
        int i, nest_lvl;
        rtnl_lock();
-        nest_lvl = dev_get_nest_level(ndev);
+        nest_lvl = ndev->lower_level;
        for (i = 0; i < nest_lvl; i++) {
                struct list_head *lower = &ndev->adj_list.lower;
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index f8bbc4aab213..4b92b196cfa6 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -740,7 +740,7 @@ static __poll_t tipc_poll(struct file *file, struct socket *sock,
                /* fall through */
        case TIPC_LISTEN:
        case TIPC_CONNECTING:
-                if (!skb_queue_empty(&sk->sk_receive_queue))
+                if (!skb_queue_empty_lockless(&sk->sk_receive_queue))
                        revents |= EPOLLIN | EPOLLRDNORM;
                break;
        case TIPC_OPEN:
@@ -748,7 +748,7 @@ static __poll_t tipc_poll(struct file *file, struct socket *sock,
                        revents |= EPOLLOUT;
                if (!tipc_sk_type_connectionless(sk))
                        break;
-                if (skb_queue_empty(&sk->sk_receive_queue))
+                if (skb_queue_empty_lockless(&sk->sk_receive_queue))
                        break;
                revents |= EPOLLIN | EPOLLRDNORM;
                break;
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 67e87db5877f..0d8da809bea2 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -2599,7 +2599,7 @@ static __poll_t unix_poll(struct file *file, struct socket *sock, poll_table *wa
                mask |= EPOLLRDHUP | EPOLLIN | EPOLLRDNORM;
        /* readable? */
-        if (!skb_queue_empty(&sk->sk_receive_queue))
+        if (!skb_queue_empty_lockless(&sk->sk_receive_queue))
                mask |= EPOLLIN | EPOLLRDNORM;
        /* Connection-based need to check for termination and startup */
@@ -2628,7 +2628,7 @@ static __poll_t unix_dgram_poll(struct file *file, struct socket *sock,
        mask = 0;
        /* exceptional events? */
-        if (sk->sk_err || !skb_queue_empty(&sk->sk_error_queue))
+        if (sk->sk_err || !skb_queue_empty_lockless(&sk->sk_error_queue))
                mask |= EPOLLERR |
                        (sock_flag(sk, SOCK_SELECT_ERR_QUEUE) ? EPOLLPRI : 0);
@@ -2638,7 +2638,7 @@ static __poll_t unix_dgram_poll(struct file *file, struct socket *sock,
                mask |= EPOLLHUP;
        /* readable? */
-        if (!skb_queue_empty(&sk->sk_receive_queue))
+        if (!skb_queue_empty_lockless(&sk->sk_receive_queue))
                mask |= EPOLLIN | EPOLLRDNORM;
        /* Connection-based need to check for termination and startup */
diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
index 2ab43b2bba31..582a3e4dfce2 100644
--- a/net/vmw_vsock/af_vsock.c
+++ b/net/vmw_vsock/af_vsock.c
@@ -870,7 +870,7 @@ static __poll_t vsock_poll(struct file *file, struct socket *sock,
                 * the queue and write as long as the socket isn't shutdown for
                 * sending.
                 */
-                if (!skb_queue_empty(&sk->sk_receive_queue) ||
+                if (!skb_queue_empty_lockless(&sk->sk_receive_queue) ||
                    (sk->sk_shutdown & RCV_SHUTDOWN)) {
                        mask |= EPOLLIN | EPOLLRDNORM;
                }
diff --git a/net/wireless/chan.c b/net/wireless/chan.c
index e851cafd8e2f..fcac5c6366e1 100644
--- a/net/wireless/chan.c
+++ b/net/wireless/chan.c
@@ -204,6 +204,11 @@ bool cfg80211_chandef_valid(const struct cfg80211_chan_def *chandef)
                return false;
        }
+        /* channel 14 is only for IEEE 802.11b */
+        if (chandef->center_freq1 == 2484 &&
+            chandef->width != NL80211_CHAN_WIDTH_20_NOHT)
+                return false;
        if (cfg80211_chandef_is_edmg(chandef) &&
            !cfg80211_edmg_chandef_valid(chandef))
                return false;
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 4453dd375de9..7b72286922f7 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -393,7 +393,7 @@ const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
        [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
        [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
                                   .len = IEEE80211_MAX_MESH_ID_LEN },
-        [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
+        [NL80211_ATTR_MPATH_NEXT_HOP] = NLA_POLICY_ETH_ADDR_COMPAT,
        [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
        [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
diff --git a/net/wireless/util.c b/net/wireless/util.c
index 419eb12c1e93..5b4ed5bbc542 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -1559,7 +1559,8 @@ bool ieee80211_chandef_to_operating_class(struct cfg80211_chan_def *chandef,
        }
        if (freq == 2484) {
-                if (chandef->width > NL80211_CHAN_WIDTH_40)
+                /* channel 14 is only for IEEE 802.11b */
+                if (chandef->width != NL80211_CHAN_WIDTH_20_NOHT)
                        return false;
                *op_class = 82; /* channel 14 */
diff --git a/net/xdp/xdp_umem.c b/net/xdp/xdp_umem.c
index 16d5f353163a..3049af269fbf 100644
--- a/net/xdp/xdp_umem.c
+++ b/net/xdp/xdp_umem.c
@@ -27,6 +27,9 @@ void xdp_add_sk_umem(struct xdp_umem *umem, struct xdp_sock *xs)
 {
        unsigned long flags;
+        if (!xs->tx)
+                return;
        spin_lock_irqsave(&umem->xsk_list_lock, flags);
        list_add_rcu(&xs->list, &umem->xsk_list);
        spin_unlock_irqrestore(&umem->xsk_list_lock, flags);
@@ -36,6 +39,9 @@ void xdp_del_sk_umem(struct xdp_umem *umem, struct xdp_sock *xs)
 {
        unsigned long flags;
+        if (!xs->tx)
+                return;
        spin_lock_irqsave(&umem->xsk_list_lock, flags);
        list_del_rcu(&xs->list);
        spin_unlock_irqrestore(&umem->xsk_list_lock, flags);
diff --git a/tools/testing/selftests/bpf/test_offload.py b/tools/testing/selftests/bpf/test_offload.py
index 15a666329a34..1afa22c88e42 100755
--- a/tools/testing/selftests/bpf/test_offload.py
+++ b/tools/testing/selftests/bpf/test_offload.py
@@ -22,6 +22,7 @@ import os
 import pprint
 import random
 import re
+import stat
 import string
 import struct
 import subprocess
@@ -311,7 +312,11 @@ class DebugfsDir:
        for f in out.split():
            if f == "ports":
                continue
            p = os.path.join(path, f)
+            if not os.stat(p).st_mode & stat.S_IRUSR:
+                continue
            if os.path.isfile(p):
                _, out = cmd('cat %s/%s' % (path, f))
                dfs[f] = out.strip()
diff --git a/tools/testing/selftests/bpf/test_tc_edt.sh b/tools/testing/selftests/bpf/test_tc_edt.sh
index f38567ef694b..daa7d1b8d309 100755
--- a/tools/testing/selftests/bpf/test_tc_edt.sh
+++ b/tools/testing/selftests/bpf/test_tc_edt.sh
@@ -59,7 +59,7 @@ ip netns exec ${NS_SRC} tc filter add dev veth_src egress \
 # start the listener
 ip netns exec ${NS_DST} bash -c \
-        "nc -4 -l -s ${IP_DST} -p 9000 >/dev/null &"
+        "nc -4 -l -p 9000 >/dev/null &"
 declare -i NC_PID=$!
 sleep 1
diff --git a/tools/testing/selftests/net/fib_tests.sh b/tools/testing/selftests/net/fib_tests.sh
index c4ba0ff4a53f..76c1897e6352 100755
--- a/tools/testing/selftests/net/fib_tests.sh
+++ b/tools/testing/selftests/net/fib_tests.sh
@@ -1438,6 +1438,27 @@ ipv4_addr_metric_test()
        fi
        log_test $rc 0 "Prefix route with metric on link up"
+        # explicitly check for metric changes on edge scenarios
+        run_cmd "$IP addr flush dev dummy2"
+        run_cmd "$IP addr add dev dummy2 172.16.104.0/24 metric 259"
+        run_cmd "$IP addr change dev dummy2 172.16.104.0/24 metric 260"
+        rc=$?
+        if [ $rc -eq 0 ]; then
+                check_route "172.16.104.0/24 dev dummy2 proto kernel scope link src 172.16.104.0 metric 260"
+                rc=$?
+        fi
+        log_test $rc 0 "Modify metric of .0/24 address"
+        run_cmd "$IP addr flush dev dummy2"
+        run_cmd "$IP addr add dev dummy2 172.16.104.1/32 peer 172.16.104.2 metric 260"
+        run_cmd "$IP addr change dev dummy2 172.16.104.1/32 peer 172.16.104.2 metric 261"
+        rc=$?
+        if [ $rc -eq 0 ]; then
+                check_route "172.16.104.2 dev dummy2 proto kernel scope link src 172.16.104.1 metric 261"
+                rc=$?
+        fi
+        log_test $rc 0 "Modify metric of address with peer route"
        $IP li del dummy1
        $IP li del dummy2
        cleanup
diff --git a/tools/testing/selftests/net/l2tp.sh b/tools/testing/selftests/net/l2tp.sh
index 5782433886fc..5782433886fc 100644..100755
--- a/tools/testing/selftests/net/l2tp.sh
+++ b/tools/testing/selftests/net/l2tp.sh
diff --git a/tools/testing/selftests/net/reuseport_dualstack.c b/tools/testing/selftests/net/reuseport_dualstack.c
index fe3230c55986..fb7a59ed759e 100644
--- a/tools/testing/selftests/net/reuseport_dualstack.c
+++ b/tools/testing/selftests/net/reuseport_dualstack.c
@@ -129,7 +129,7 @@ static void test(int *rcv_fds, int count, int proto)
 {
        struct epoll_event ev;
        int epfd, i, test_fd;
-        uint16_t test_family;
+        int test_family;
        socklen_t len;
        epfd = epoll_create(1);
@@ -146,6 +146,7 @@ static void test(int *rcv_fds, int count, int proto)
        send_from_v4(proto);
        test_fd = receive_once(epfd, proto);
+        len = sizeof(test_family);
        if (getsockopt(test_fd, SOL_SOCKET, SO_DOMAIN, &test_family, &len))
                error(1, errno, "failed to read socket domain");
        if (test_family != AF_INET)