93 files changed, 828 insertions, 460 deletions

diff --git a/MAINTAINERS b/MAINTAINERS
index 66de4da2d244..2ebe195951af 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -8009,6 +8009,7 @@ Q:	http://patchwork.kernel.org/project/linux-wireless/list/
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers.git
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers-next.git
 S:      Maintained
+F:      Documentation/devicetree/bindings/net/wireless/
 F:      drivers/net/wireless/
 
 NETXEN (1/10) GbE SUPPORT
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index c5fe915870ad..a59d55e25d5f 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -12895,52 +12895,71 @@ static int __bnx2x_vlan_configure_vid(struct bnx2x *bp, u16 vid, bool add)
         return rc;
 }
 
-int bnx2x_vlan_reconfigure_vid(struct bnx2x *bp)
+static int bnx2x_vlan_configure_vid_list(struct bnx2x *bp)
 {
         struct bnx2x_vlan_entry *vlan;
         int rc = 0;
 
-        if (!bp->vlan_cnt) {
-                DP(NETIF_MSG_IFUP, "No need to re-configure vlan filters\n");
-                return 0;
-        }
-
+        /* Configure all non-configured entries */
         list_for_each_entry(vlan, &bp->vlan_reg, link) {
-                /* Prepare for cleanup in case of errors */
-                if (rc) {
-                        vlan->hw = false;
-                        continue;
-                }
-
-                if (!vlan->hw)
+                if (vlan->hw)
                         continue;
 
-                DP(NETIF_MSG_IFUP, "Re-configuring vlan 0x%04x\n", vlan->vid);
+                if (bp->vlan_cnt >= bp->vlan_credit)
+                        return -ENOBUFS;
 
                 rc = __bnx2x_vlan_configure_vid(bp, vlan->vid, true);
                 if (rc) {
-                        BNX2X_ERR("Unable to configure VLAN %d\n", vlan->vid);
-                        vlan->hw = false;
-                        rc = -EINVAL;
-                        continue;
+                        BNX2X_ERR("Unable to config VLAN %d\n", vlan->vid);
+                        return rc;
                 }
+
+                DP(NETIF_MSG_IFUP, "HW configured for VLAN %d\n", vlan->vid);
+                vlan->hw = true;
+                bp->vlan_cnt++;
         }
 
-        return rc;
+        return 0;
+}
+
+static void bnx2x_vlan_configure(struct bnx2x *bp, bool set_rx_mode)
+{
+        bool need_accept_any_vlan;
+
+        need_accept_any_vlan = !!bnx2x_vlan_configure_vid_list(bp);
+
+        if (bp->accept_any_vlan != need_accept_any_vlan) {
+                bp->accept_any_vlan = need_accept_any_vlan;
+                DP(NETIF_MSG_IFUP, "Accept all VLAN %s\n",
+                   bp->accept_any_vlan ? "raised" : "cleared");
+                if (set_rx_mode) {
+                        if (IS_PF(bp))
+                                bnx2x_set_rx_mode_inner(bp);
+                        else
+                                bnx2x_vfpf_storm_rx_mode(bp);
+                }
+        }
+}
+
+int bnx2x_vlan_reconfigure_vid(struct bnx2x *bp)
+{
+        struct bnx2x_vlan_entry *vlan;
+
+        /* The hw forgot all entries after reload */
+        list_for_each_entry(vlan, &bp->vlan_reg, link)
+                vlan->hw = false;
+        bp->vlan_cnt = 0;
+
+        /* Don't set rx mode here. Our caller will do it. */
+        bnx2x_vlan_configure(bp, false);
+
+        return 0;
 }
 
 static int bnx2x_vlan_rx_add_vid(struct net_device *dev, __be16 proto, u16 vid)
 {
         struct bnx2x *bp = netdev_priv(dev);
         struct bnx2x_vlan_entry *vlan;
-        bool hw = false;
-        int rc = 0;
-
-        if (!netif_running(bp->dev)) {
-                DP(NETIF_MSG_IFUP,
-                   "Ignoring VLAN configuration the interface is down\n");
-                return -EFAULT;
-        }
 
         DP(NETIF_MSG_IFUP, "Adding VLAN %d\n", vid);
 
@@ -12948,93 +12967,47 @@ static int bnx2x_vlan_rx_add_vid(struct net_device *dev, __be16 proto, u16 vid)
         if (!vlan)
                 return -ENOMEM;
 
-        bp->vlan_cnt++;
-        if (bp->vlan_cnt > bp->vlan_credit && !bp->accept_any_vlan) {
-                DP(NETIF_MSG_IFUP, "Accept all VLAN raised\n");
-                bp->accept_any_vlan = true;
-                if (IS_PF(bp))
-                        bnx2x_set_rx_mode_inner(bp);
-                else
-                        bnx2x_vfpf_storm_rx_mode(bp);
-        } else if (bp->vlan_cnt <= bp->vlan_credit) {
-                rc = __bnx2x_vlan_configure_vid(bp, vid, true);
-                hw = true;
-        }
-
         vlan->vid = vid;
-        vlan->hw = hw;
+        vlan->hw = false;
+        list_add_tail(&vlan->link, &bp->vlan_reg);
 
-        if (!rc) {
-                list_add(&vlan->link, &bp->vlan_reg);
-        } else {
-                bp->vlan_cnt--;
-                kfree(vlan);
-        }
-
-        DP(NETIF_MSG_IFUP, "Adding VLAN result %d\n", rc);
+        if (netif_running(dev))
+                bnx2x_vlan_configure(bp, true);
 
-        return rc;
+        return 0;
 }
 
 static int bnx2x_vlan_rx_kill_vid(struct net_device *dev, __be16 proto, u16 vid)
 {
         struct bnx2x *bp = netdev_priv(dev);
         struct bnx2x_vlan_entry *vlan;
+        bool found = false;
         int rc = 0;
 
-        if (!netif_running(bp->dev)) {
-                DP(NETIF_MSG_IFUP,
-                   "Ignoring VLAN configuration the interface is down\n");
-                return -EFAULT;
-        }
-
         DP(NETIF_MSG_IFUP, "Removing VLAN %d\n", vid);
 
-        if (!bp->vlan_cnt) {
-                BNX2X_ERR("Unable to kill VLAN %d\n", vid);
-                return -EINVAL;
-        }
-
         list_for_each_entry(vlan, &bp->vlan_reg, link)
-                if (vlan->vid == vid)
+                if (vlan->vid == vid) {
+                        found = true;
                         break;
+                }
 
-        if (vlan->vid != vid) {
+        if (!found) {
                 BNX2X_ERR("Unable to kill VLAN %d - not found\n", vid);
                 return -EINVAL;
         }
 
-        if (vlan->hw)
+        if (netif_running(dev) && vlan->hw) {
                 rc = __bnx2x_vlan_configure_vid(bp, vid, false);
+                DP(NETIF_MSG_IFUP, "HW deconfigured for VLAN %d\n", vid);
+                bp->vlan_cnt--;
+        }
 
         list_del(&vlan->link);
         kfree(vlan);
 
-        bp->vlan_cnt--;
-
-        if (bp->vlan_cnt <= bp->vlan_credit && bp->accept_any_vlan) {
-                /* Configure all non-configured entries */
-                list_for_each_entry(vlan, &bp->vlan_reg, link) {
-                        if (vlan->hw)
-                                continue;
-
-                        rc = __bnx2x_vlan_configure_vid(bp, vlan->vid, true);
-                        if (rc) {
-                                BNX2X_ERR("Unable to config VLAN %d\n",
-                                          vlan->vid);
-                                continue;
-                        }
-                        DP(NETIF_MSG_IFUP, "HW configured for VLAN %d\n",
-                           vlan->vid);
-                        vlan->hw = true;
-                }
-                DP(NETIF_MSG_IFUP, "Accept all VLAN Removed\n");
-                bp->accept_any_vlan = false;
-                if (IS_PF(bp))
-                        bnx2x_set_rx_mode_inner(bp);
-                else
-                        bnx2x_vfpf_storm_rx_mode(bp);
-        }
+        if (netif_running(dev))
+                bnx2x_vlan_configure(bp, true);
 
         DP(NETIF_MSG_IFUP, "Removing VLAN result %d\n", rc);
 
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index 72a2efff8e49..c777cde85ce4 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -286,7 +286,9 @@ static netdev_tx_t bnxt_start_xmit(struct sk_buff *skb, struct net_device *dev)
                         cpu_to_le32(DB_KEY_TX_PUSH | DB_LONG_TX_PUSH | prod);
                 txr->tx_prod = prod;
 
+                tx_buf->is_push = 1;
                 netdev_tx_sent_queue(txq, skb->len);
+                wmb();  /* Sync is_push and byte queue before pushing data */
 
                 push_len = (length + sizeof(*tx_push) + 7) / 8;
                 if (push_len > 16) {
@@ -298,7 +300,6 @@ static netdev_tx_t bnxt_start_xmit(struct sk_buff *skb, struct net_device *dev)
                                          push_len);
                 }
 
-                tx_buf->is_push = 1;
                 goto tx_done;
         }
 
@@ -1112,19 +1113,13 @@ static inline struct sk_buff *bnxt_tpa_end(struct bnxt *bp,
         if (tpa_info->hash_type != PKT_HASH_TYPE_NONE)
                 skb_set_hash(skb, tpa_info->rss_hash, tpa_info->hash_type);
 
-        if (tpa_info->flags2 & RX_CMP_FLAGS2_META_FORMAT_VLAN) {
-                netdev_features_t features = skb->dev->features;
+        if ((tpa_info->flags2 & RX_CMP_FLAGS2_META_FORMAT_VLAN) &&
+            (skb->dev->features & NETIF_F_HW_VLAN_CTAG_RX)) {
                 u16 vlan_proto = tpa_info->metadata >>
                         RX_CMP_FLAGS2_METADATA_TPID_SFT;
+                u16 vtag = tpa_info->metadata & RX_CMP_FLAGS2_METADATA_VID_MASK;
 
-                if (((features & NETIF_F_HW_VLAN_CTAG_RX) &&
-                     vlan_proto == ETH_P_8021Q) ||
-                    ((features & NETIF_F_HW_VLAN_STAG_RX) &&
-                     vlan_proto == ETH_P_8021AD)) {
-                        __vlan_hwaccel_put_tag(skb, htons(vlan_proto),
-                                               tpa_info->metadata &
-                                               RX_CMP_FLAGS2_METADATA_VID_MASK);
-                }
+                __vlan_hwaccel_put_tag(skb, htons(vlan_proto), vtag);
         }
 
         skb_checksum_none_assert(skb);
@@ -1277,19 +1272,14 @@ static int bnxt_rx_pkt(struct bnxt *bp, struct bnxt_napi *bnapi, u32 *raw_cons,
 
         skb->protocol = eth_type_trans(skb, dev);
 
-        if (rxcmp1->rx_cmp_flags2 &
-            cpu_to_le32(RX_CMP_FLAGS2_META_FORMAT_VLAN)) {
-                netdev_features_t features = skb->dev->features;
+        if ((rxcmp1->rx_cmp_flags2 &
+             cpu_to_le32(RX_CMP_FLAGS2_META_FORMAT_VLAN)) &&
+            (skb->dev->features & NETIF_F_HW_VLAN_CTAG_RX)) {
                 u32 meta_data = le32_to_cpu(rxcmp1->rx_cmp_meta_data);
+                u16 vtag = meta_data & RX_CMP_FLAGS2_METADATA_VID_MASK;
                 u16 vlan_proto = meta_data >> RX_CMP_FLAGS2_METADATA_TPID_SFT;
 
-                if (((features & NETIF_F_HW_VLAN_CTAG_RX) &&
-                     vlan_proto == ETH_P_8021Q) ||
-                    ((features & NETIF_F_HW_VLAN_STAG_RX) &&
-                     vlan_proto == ETH_P_8021AD))
-                        __vlan_hwaccel_put_tag(skb, htons(vlan_proto),
-                                               meta_data &
-                                               RX_CMP_FLAGS2_METADATA_VID_MASK);
+                __vlan_hwaccel_put_tag(skb, htons(vlan_proto), vtag);
         }
 
         skb_checksum_none_assert(skb);
@@ -5466,6 +5456,20 @@ static netdev_features_t bnxt_fix_features(struct net_device *dev,
 
         if (!bnxt_rfs_capable(bp))
                 features &= ~NETIF_F_NTUPLE;
+
+        /* Both CTAG and STAG VLAN accelaration on the RX side have to be
+         * turned on or off together.
+         */
+        if ((features & (NETIF_F_HW_VLAN_CTAG_RX | NETIF_F_HW_VLAN_STAG_RX)) !=
+            (NETIF_F_HW_VLAN_CTAG_RX | NETIF_F_HW_VLAN_STAG_RX)) {
+                if (dev->features & NETIF_F_HW_VLAN_CTAG_RX)
+                        features &= ~(NETIF_F_HW_VLAN_CTAG_RX |
+                                      NETIF_F_HW_VLAN_STAG_RX);
+                else
+                        features |= NETIF_F_HW_VLAN_CTAG_RX |
+                                    NETIF_F_HW_VLAN_STAG_RX;
+        }
+
         return features;
 }
 
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_pci_id_tbl.h b/drivers/net/ethernet/chelsio/cxgb4/t4_pci_id_tbl.h
index a2cdfc1261dc..50812a1d67bd 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4_pci_id_tbl.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4_pci_id_tbl.h
@@ -144,6 +144,7 @@ CH_PCI_DEVICE_ID_TABLE_DEFINE_BEGIN
         CH_PCI_ID_TABLE_FENTRY(0x5015), /* T502-bt */
         CH_PCI_ID_TABLE_FENTRY(0x5016), /* T580-OCP-SO */
         CH_PCI_ID_TABLE_FENTRY(0x5017), /* T520-OCP-SO */
+        CH_PCI_ID_TABLE_FENTRY(0x5018), /* T540-BT */
         CH_PCI_ID_TABLE_FENTRY(0x5080), /* Custom T540-cr */
         CH_PCI_ID_TABLE_FENTRY(0x5081), /* Custom T540-LL-cr */
         CH_PCI_ID_TABLE_FENTRY(0x5082), /* Custom T504-cr */
diff --git a/drivers/net/ethernet/ethoc.c b/drivers/net/ethernet/ethoc.c
index 41b010645100..4edb98c3c6c7 100644
--- a/drivers/net/ethernet/ethoc.c
+++ b/drivers/net/ethernet/ethoc.c
@@ -1195,7 +1195,7 @@ static int ethoc_probe(struct platform_device *pdev)
         priv->mdio = mdiobus_alloc();
         if (!priv->mdio) {
                 ret = -ENOMEM;
-                goto free;
+                goto free2;
         }
 
         priv->mdio->name = "ethoc-mdio";
@@ -1208,7 +1208,7 @@ static int ethoc_probe(struct platform_device *pdev)
         ret = mdiobus_register(priv->mdio);
         if (ret) {
                 dev_err(&netdev->dev, "failed to register MDIO bus\n");
-                goto free;
+                goto free2;
         }
 
         ret = ethoc_mdio_probe(netdev);
@@ -1241,9 +1241,10 @@ error2:
 error:
         mdiobus_unregister(priv->mdio);
         mdiobus_free(priv->mdio);
-free:
+free2:
         if (priv->clk)
                 clk_disable_unprepare(priv->clk);
+free:
         free_netdev(netdev);
 out:
         return ret;
diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index 3c0255e98535..fea0f330ddbd 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -2416,24 +2416,24 @@ fec_enet_set_coalesce(struct net_device *ndev, struct ethtool_coalesce *ec)
                 return -EOPNOTSUPP;
 
         if (ec->rx_max_coalesced_frames > 255) {
-                pr_err("Rx coalesced frames exceed hardware limiation");
+                pr_err("Rx coalesced frames exceed hardware limitation\n");
                 return -EINVAL;
         }
 
         if (ec->tx_max_coalesced_frames > 255) {
-                pr_err("Tx coalesced frame exceed hardware limiation");
+                pr_err("Tx coalesced frame exceed hardware limitation\n");
                 return -EINVAL;
         }
 
         cycle = fec_enet_us_to_itr_clock(ndev, fep->rx_time_itr);
         if (cycle > 0xFFFF) {
-                pr_err("Rx coalesed usec exceeed hardware limiation");
+                pr_err("Rx coalesced usec exceed hardware limitation\n");
                 return -EINVAL;
         }
 
         cycle = fec_enet_us_to_itr_clock(ndev, fep->tx_time_itr);
         if (cycle > 0xFFFF) {
-                pr_err("Rx coalesed usec exceeed hardware limiation");
+                pr_err("Rx coalesced usec exceed hardware limitation\n");
                 return -EINVAL;
         }
 
diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c
index 7615e0668acb..2e6785b6e8be 100644
--- a/drivers/net/ethernet/freescale/gianfar.c
+++ b/drivers/net/ethernet/freescale/gianfar.c
@@ -2440,7 +2440,8 @@ static int gfar_start_xmit(struct sk_buff *skb, struct net_device *dev)
                                                  tx_queue->tx_ring_size);
 
         if (likely(!nr_frags)) {
-                lstatus |= BD_LFLAG(TXBD_LAST | TXBD_INTERRUPT);
+                if (likely(!do_tstamp))
+                        lstatus |= BD_LFLAG(TXBD_LAST | TXBD_INTERRUPT);
         } else {
                 u32 lstatus_start = lstatus;
 
diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
index c984462fad2a..4763252bbf85 100644
--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
@@ -133,6 +133,8 @@ static int mtk_mdio_read(struct mii_bus *bus, int phy_addr, int phy_reg)
 static void mtk_phy_link_adjust(struct net_device *dev)
 {
         struct mtk_mac *mac = netdev_priv(dev);
+        u16 lcl_adv = 0, rmt_adv = 0;
+        u8 flowctrl;
         u32 mcr = MAC_MCR_MAX_RX_1536 | MAC_MCR_IPG_CFG |
                   MAC_MCR_FORCE_MODE | MAC_MCR_TX_EN |
                   MAC_MCR_RX_EN | MAC_MCR_BACKOFF_EN |
@@ -150,11 +152,30 @@ static void mtk_phy_link_adjust(struct net_device *dev)
         if (mac->phy_dev->link)
                 mcr |= MAC_MCR_FORCE_LINK;
 
-        if (mac->phy_dev->duplex)
+        if (mac->phy_dev->duplex) {
                 mcr |= MAC_MCR_FORCE_DPX;
 
-        if (mac->phy_dev->pause)
-                mcr |= MAC_MCR_FORCE_RX_FC | MAC_MCR_FORCE_TX_FC;
+                if (mac->phy_dev->pause)
+                        rmt_adv = LPA_PAUSE_CAP;
+                if (mac->phy_dev->asym_pause)
+                        rmt_adv |= LPA_PAUSE_ASYM;
+
+                if (mac->phy_dev->advertising & ADVERTISED_Pause)
+                        lcl_adv |= ADVERTISE_PAUSE_CAP;
+                if (mac->phy_dev->advertising & ADVERTISED_Asym_Pause)
+                        lcl_adv |= ADVERTISE_PAUSE_ASYM;
+
+                flowctrl = mii_resolve_flowctrl_fdx(lcl_adv, rmt_adv);
+
+                if (flowctrl & FLOW_CTRL_TX)
+                        mcr |= MAC_MCR_FORCE_TX_FC;
+                if (flowctrl & FLOW_CTRL_RX)
+                        mcr |= MAC_MCR_FORCE_RX_FC;
+
+                netif_dbg(mac->hw, link, dev, "rx pause %s, tx pause %s\n",
+                          flowctrl & FLOW_CTRL_RX ? "enabled" : "disabled",
+                          flowctrl & FLOW_CTRL_TX ? "enabled" : "disabled");
+        }
 
         mtk_w32(mac->hw, mcr, MTK_MAC_MCR(mac->id));
 
@@ -208,10 +229,16 @@ static int mtk_phy_connect(struct mtk_mac *mac)
         u32 val, ge_mode;
 
         np = of_parse_phandle(mac->of_node, "phy-handle", 0);
+        if (!np && of_phy_is_fixed_link(mac->of_node))
+                if (!of_phy_register_fixed_link(mac->of_node))
+                        np = of_node_get(mac->of_node);
         if (!np)
                 return -ENODEV;
 
         switch (of_get_phy_mode(np)) {
+        case PHY_INTERFACE_MODE_RGMII_TXID:
+        case PHY_INTERFACE_MODE_RGMII_RXID:
+        case PHY_INTERFACE_MODE_RGMII_ID:
         case PHY_INTERFACE_MODE_RGMII:
                 ge_mode = 0;
                 break;
@@ -236,7 +263,8 @@ static int mtk_phy_connect(struct mtk_mac *mac)
         mac->phy_dev->autoneg = AUTONEG_ENABLE;
         mac->phy_dev->speed = 0;
         mac->phy_dev->duplex = 0;
-        mac->phy_dev->supported &= PHY_BASIC_FEATURES;
+        mac->phy_dev->supported &= PHY_GBIT_FEATURES | SUPPORTED_Pause |
+                                   SUPPORTED_Asym_Pause;
         mac->phy_dev->advertising = mac->phy_dev->supported |
                                     ADVERTISED_Autoneg;
         phy_start_aneg(mac->phy_dev);
@@ -280,7 +308,7 @@ static int mtk_mdio_init(struct mtk_eth *eth)
         return 0;
 
 err_free_bus:
-        kfree(eth->mii_bus);
+        mdiobus_free(eth->mii_bus);
 
 err_put_node:
         of_node_put(mii_np);
@@ -295,7 +323,7 @@ static void mtk_mdio_cleanup(struct mtk_eth *eth)
 
         mdiobus_unregister(eth->mii_bus);
         of_node_put(eth->mii_bus->dev.of_node);
-        kfree(eth->mii_bus);
+        mdiobus_free(eth->mii_bus);
 }
 
 static inline void mtk_irq_disable(struct mtk_eth *eth, u32 mask)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
index fd4392999eee..f5c8d5db25a8 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
@@ -3192,10 +3192,7 @@ static void mlx5e_destroy_netdev(struct mlx5_core_dev *mdev, void *vpriv)
         flush_workqueue(priv->wq);
         if (test_bit(MLX5_INTERFACE_STATE_SHUTDOWN, &mdev->intf_state)) {
                 netif_device_detach(netdev);
-                mutex_lock(&priv->state_lock);
-                if (test_bit(MLX5E_STATE_OPENED, &priv->state))
-                        mlx5e_close_locked(netdev);
-                mutex_unlock(&priv->state_lock);
+                mlx5e_close(netdev);
         } else {
                 unregister_netdev(netdev);
         }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
index 229ab16fb8d3..b000ddc29553 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
@@ -317,7 +317,8 @@ static netdev_tx_t mlx5e_sq_xmit(struct mlx5e_sq *sq, struct sk_buff *skb)
         while ((sq->pc & wq->sz_m1) > sq->edge)
                 mlx5e_send_nop(sq, false);
 
-        sq->bf_budget = bf ? sq->bf_budget - 1 : 0;
+        if (bf)
+                sq->bf_budget--;
 
         sq->stats.packets++;
         sq->stats.bytes += num_bytes;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
index b84a6918a700..aebbd6ccb9fe 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
@@ -383,7 +383,7 @@ __esw_fdb_set_vport_rule(struct mlx5_eswitch *esw, u32 vport, bool rx_rule,
                                    match_v,
                                    MLX5_FLOW_CONTEXT_ACTION_FWD_DEST,
                                    0, &dest);
-        if (IS_ERR_OR_NULL(flow_rule)) {
+        if (IS_ERR(flow_rule)) {
                 pr_warn(
                         "FDB: Failed to add flow rule: dmac_v(%pM) dmac_c(%pM) -> vport(%d), err(%ld)\n",
                          dmac_v, dmac_c, vport, PTR_ERR(flow_rule));
@@ -457,7 +457,7 @@ static int esw_create_fdb_table(struct mlx5_eswitch *esw, int nvports)
 
         table_size = BIT(MLX5_CAP_ESW_FLOWTABLE_FDB(dev, log_max_ft_size));
         fdb = mlx5_create_flow_table(root_ns, 0, table_size, 0);
-        if (IS_ERR_OR_NULL(fdb)) {
+        if (IS_ERR(fdb)) {
                 err = PTR_ERR(fdb);
                 esw_warn(dev, "Failed to create FDB Table err %d\n", err);
                 goto out;
@@ -474,7 +474,7 @@ static int esw_create_fdb_table(struct mlx5_eswitch *esw, int nvports)
         MLX5_SET(create_flow_group_in, flow_group_in, end_flow_index, table_size - 3);
         eth_broadcast_addr(dmac);
         g = mlx5_create_flow_group(fdb, flow_group_in);
-        if (IS_ERR_OR_NULL(g)) {
+        if (IS_ERR(g)) {
                 err = PTR_ERR(g);
                 esw_warn(dev, "Failed to create flow group err(%d)\n", err);
                 goto out;
@@ -489,7 +489,7 @@ static int esw_create_fdb_table(struct mlx5_eswitch *esw, int nvports)
         eth_zero_addr(dmac);
         dmac[0] = 0x01;
         g = mlx5_create_flow_group(fdb, flow_group_in);
-        if (IS_ERR_OR_NULL(g)) {
+        if (IS_ERR(g)) {
                 err = PTR_ERR(g);
                 esw_warn(dev, "Failed to create allmulti flow group err(%d)\n", err);
                 goto out;
@@ -506,7 +506,7 @@ static int esw_create_fdb_table(struct mlx5_eswitch *esw, int nvports)
         MLX5_SET(create_flow_group_in, flow_group_in, start_flow_index, table_size - 1);
         MLX5_SET(create_flow_group_in, flow_group_in, end_flow_index, table_size - 1);
         g = mlx5_create_flow_group(fdb, flow_group_in);
-        if (IS_ERR_OR_NULL(g)) {
+        if (IS_ERR(g)) {
                 err = PTR_ERR(g);
                 esw_warn(dev, "Failed to create promisc flow group err(%d)\n", err);
                 goto out;
@@ -529,7 +529,7 @@ out:
                 }
         }
 
-        kfree(flow_group_in);
+        kvfree(flow_group_in);
         return err;
 }
 
@@ -651,6 +651,7 @@ static void update_allmulti_vports(struct mlx5_eswitch *esw,
                                         esw_fdb_set_vport_rule(esw,
                                                                mac,
                                                                vport_idx);
+                        iter_vaddr->mc_promisc = true;
                         break;
                 case MLX5_ACTION_DEL:
                         if (!iter_vaddr)
@@ -1060,7 +1061,7 @@ static void esw_vport_enable_egress_acl(struct mlx5_eswitch *esw,
                 return;
 
         acl = mlx5_create_vport_flow_table(root_ns, 0, table_size, 0, vport->vport);
-        if (IS_ERR_OR_NULL(acl)) {
+        if (IS_ERR(acl)) {
                 err = PTR_ERR(acl);
                 esw_warn(dev, "Failed to create E-Switch vport[%d] egress flow Table, err(%d)\n",
                          vport->vport, err);
@@ -1075,7 +1076,7 @@ static void esw_vport_enable_egress_acl(struct mlx5_eswitch *esw,
         MLX5_SET(create_flow_group_in, flow_group_in, end_flow_index, 0);
 
         vlan_grp = mlx5_create_flow_group(acl, flow_group_in);
-        if (IS_ERR_OR_NULL(vlan_grp)) {
+        if (IS_ERR(vlan_grp)) {
                 err = PTR_ERR(vlan_grp);
                 esw_warn(dev, "Failed to create E-Switch vport[%d] egress allowed vlans flow group, err(%d)\n",
                          vport->vport, err);
@@ -1086,7 +1087,7 @@ static void esw_vport_enable_egress_acl(struct mlx5_eswitch *esw,
         MLX5_SET(create_flow_group_in, flow_group_in, start_flow_index, 1);
         MLX5_SET(create_flow_group_in, flow_group_in, end_flow_index, 1);
         drop_grp = mlx5_create_flow_group(acl, flow_group_in);
-        if (IS_ERR_OR_NULL(drop_grp)) {
+        if (IS_ERR(drop_grp)) {
                 err = PTR_ERR(drop_grp);
                 esw_warn(dev, "Failed to create E-Switch vport[%d] egress drop flow group, err(%d)\n",
                          vport->vport, err);
@@ -1097,7 +1098,7 @@ static void esw_vport_enable_egress_acl(struct mlx5_eswitch *esw,
         vport->egress.drop_grp = drop_grp;
         vport->egress.allowed_vlans_grp = vlan_grp;
 out:
-        kfree(flow_group_in);
+        kvfree(flow_group_in);
         if (err && !IS_ERR_OR_NULL(vlan_grp))
                 mlx5_destroy_flow_group(vlan_grp);
         if (err && !IS_ERR_OR_NULL(acl))
@@ -1174,7 +1175,7 @@ static void esw_vport_enable_ingress_acl(struct mlx5_eswitch *esw,
                 return;
 
         acl = mlx5_create_vport_flow_table(root_ns, 0, table_size, 0, vport->vport);
-        if (IS_ERR_OR_NULL(acl)) {
+        if (IS_ERR(acl)) {
                 err = PTR_ERR(acl);
                 esw_warn(dev, "Failed to create E-Switch vport[%d] ingress flow Table, err(%d)\n",
                          vport->vport, err);
@@ -1192,7 +1193,7 @@ static void esw_vport_enable_ingress_acl(struct mlx5_eswitch *esw,
         MLX5_SET(create_flow_group_in, flow_group_in, end_flow_index, 0);
 
         g = mlx5_create_flow_group(acl, flow_group_in);
-        if (IS_ERR_OR_NULL(g)) {
+        if (IS_ERR(g)) {
                 err = PTR_ERR(g);
                 esw_warn(dev, "Failed to create E-Switch vport[%d] ingress untagged spoofchk flow group, err(%d)\n",
                          vport->vport, err);
@@ -1207,7 +1208,7 @@ static void esw_vport_enable_ingress_acl(struct mlx5_eswitch *esw,
         MLX5_SET(create_flow_group_in, flow_group_in, end_flow_index, 1);
 
         g = mlx5_create_flow_group(acl, flow_group_in);
-        if (IS_ERR_OR_NULL(g)) {
+        if (IS_ERR(g)) {
                 err = PTR_ERR(g);
                 esw_warn(dev, "Failed to create E-Switch vport[%d] ingress untagged flow group, err(%d)\n",
                          vport->vport, err);
@@ -1223,7 +1224,7 @@ static void esw_vport_enable_ingress_acl(struct mlx5_eswitch *esw,
         MLX5_SET(create_flow_group_in, flow_group_in, end_flow_index, 2);
 
         g = mlx5_create_flow_group(acl, flow_group_in);
-        if (IS_ERR_OR_NULL(g)) {
+        if (IS_ERR(g)) {
                 err = PTR_ERR(g);
                 esw_warn(dev, "Failed to create E-Switch vport[%d] ingress spoofchk flow group, err(%d)\n",
                          vport->vport, err);
@@ -1236,7 +1237,7 @@ static void esw_vport_enable_ingress_acl(struct mlx5_eswitch *esw,
         MLX5_SET(create_flow_group_in, flow_group_in, end_flow_index, 3);
 
         g = mlx5_create_flow_group(acl, flow_group_in);
-        if (IS_ERR_OR_NULL(g)) {
+        if (IS_ERR(g)) {
                 err = PTR_ERR(g);
                 esw_warn(dev, "Failed to create E-Switch vport[%d] ingress drop flow group, err(%d)\n",
                          vport->vport, err);
@@ -1259,7 +1260,7 @@ out:
                         mlx5_destroy_flow_table(vport->ingress.acl);
         }
 
-        kfree(flow_group_in);
+        kvfree(flow_group_in);
 }
 
 static void esw_vport_cleanup_ingress_rules(struct mlx5_eswitch *esw,
@@ -1363,7 +1364,7 @@ static int esw_vport_ingress_config(struct mlx5_eswitch *esw,
                                    match_v,
                                    MLX5_FLOW_CONTEXT_ACTION_ALLOW,
                                    0, NULL);
-        if (IS_ERR_OR_NULL(vport->ingress.allow_rule)) {
+        if (IS_ERR(vport->ingress.allow_rule)) {
                 err = PTR_ERR(vport->ingress.allow_rule);
                 pr_warn("vport[%d] configure ingress allow rule, err(%d)\n",
                         vport->vport, err);
@@ -1380,7 +1381,7 @@ static int esw_vport_ingress_config(struct mlx5_eswitch *esw,
                                    match_v,
                                    MLX5_FLOW_CONTEXT_ACTION_DROP,
                                    0, NULL);
-        if (IS_ERR_OR_NULL(vport->ingress.drop_rule)) {
+        if (IS_ERR(vport->ingress.drop_rule)) {
                 err = PTR_ERR(vport->ingress.drop_rule);
                 pr_warn("vport[%d] configure ingress drop rule, err(%d)\n",
                         vport->vport, err);
@@ -1439,7 +1440,7 @@ static int esw_vport_egress_config(struct mlx5_eswitch *esw,
                                    match_v,
                                    MLX5_FLOW_CONTEXT_ACTION_ALLOW,
                                    0, NULL);
-        if (IS_ERR_OR_NULL(vport->egress.allowed_vlan)) {
+        if (IS_ERR(vport->egress.allowed_vlan)) {
                 err = PTR_ERR(vport->egress.allowed_vlan);
                 pr_warn("vport[%d] configure egress allowed vlan rule failed, err(%d)\n",
                         vport->vport, err);
@@ -1457,7 +1458,7 @@ static int esw_vport_egress_config(struct mlx5_eswitch *esw,
                                    match_v,
                                    MLX5_FLOW_CONTEXT_ACTION_DROP,
                                    0, NULL);
-        if (IS_ERR_OR_NULL(vport->egress.drop_rule)) {
+        if (IS_ERR(vport->egress.drop_rule)) {
                 err = PTR_ERR(vport->egress.drop_rule);
                 pr_warn("vport[%d] configure egress drop rule failed, err(%d)\n",
                         vport->vport, err);
@@ -1491,14 +1492,11 @@ static void esw_enable_vport(struct mlx5_eswitch *esw, int vport_num,
 
         /* Sync with current vport context */
         vport->enabled_events = enable_events;
-        esw_vport_change_handle_locked(vport);
-
         vport->enabled = true;
 
         /* only PF is trusted by default */
         vport->trusted = (vport_num) ? false : true;
-
-        arm_vport_context_events_cmd(esw->dev, vport_num, enable_events);
+        esw_vport_change_handle_locked(vport);
 
         esw->enabled_vports++;
         esw_debug(esw->dev, "Enabled VPORT(%d)\n", vport_num);
@@ -1728,11 +1726,24 @@ void mlx5_eswitch_vport_event(struct mlx5_eswitch *esw, struct mlx5_eqe *eqe)
         (esw && MLX5_CAP_GEN(esw->dev, vport_group_manager) && mlx5_core_is_pf(esw->dev))
 #define LEGAL_VPORT(esw, vport) (vport >= 0 && vport < esw->total_vports)
 
+static void node_guid_gen_from_mac(u64 *node_guid, u8 mac[ETH_ALEN])
+{
+        ((u8 *)node_guid)[7] = mac[0];
+        ((u8 *)node_guid)[6] = mac[1];
+        ((u8 *)node_guid)[5] = mac[2];
+        ((u8 *)node_guid)[4] = 0xff;
+        ((u8 *)node_guid)[3] = 0xfe;
+        ((u8 *)node_guid)[2] = mac[3];
+        ((u8 *)node_guid)[1] = mac[4];
+        ((u8 *)node_guid)[0] = mac[5];
+}
+
 int mlx5_eswitch_set_vport_mac(struct mlx5_eswitch *esw,
                                int vport, u8 mac[ETH_ALEN])
 {
-        int err = 0;
         struct mlx5_vport *evport;
+        u64 node_guid;
+        int err = 0;
 
         if (!ESW_ALLOWED(esw))
                 return -EPERM;
@@ -1756,11 +1767,17 @@ int mlx5_eswitch_set_vport_mac(struct mlx5_eswitch *esw,
                 return err;
         }
 
+        node_guid_gen_from_mac(&node_guid, mac);
+        err = mlx5_modify_nic_vport_node_guid(esw->dev, vport, node_guid);
+        if (err)
+                mlx5_core_warn(esw->dev,
+                               "Failed to set vport %d node guid, err = %d. RDMA_CM will not function properly for this VF.\n",
+                               vport, err);
+
         mutex_lock(&esw->state_lock);
         if (evport->enabled)
                 err = esw_vport_ingress_config(esw, evport);
         mutex_unlock(&esw->state_lock);
-
         return err;
 }
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
index 8b5f0b2c0d5c..e912a3d2505e 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
@@ -1292,8 +1292,8 @@ static int update_root_ft_destroy(struct mlx5_flow_table *ft)
                                        ft->id);
                         return err;
                 }
-                root->root_ft = new_root_ft;
         }
+        root->root_ft = new_root_ft;
         return 0;
 }
 
@@ -1767,6 +1767,9 @@ static void cleanup_root_ns(struct mlx5_core_dev *dev)
 
 void mlx5_cleanup_fs(struct mlx5_core_dev *dev)
 {
+        if (MLX5_CAP_GEN(dev, port_type) != MLX5_CAP_PORT_TYPE_ETH)
+                return;
+
         cleanup_root_ns(dev);
         cleanup_single_prio_root_ns(dev, dev->priv.fdb_root_ns);
         cleanup_single_prio_root_ns(dev, dev->priv.esw_egress_root_ns);
@@ -1828,29 +1831,36 @@ int mlx5_init_fs(struct mlx5_core_dev *dev)
 {
         int err = 0;
 
+        if (MLX5_CAP_GEN(dev, port_type) != MLX5_CAP_PORT_TYPE_ETH)
+                return 0;
+
         err = mlx5_init_fc_stats(dev);
         if (err)
                 return err;
 
-        if (MLX5_CAP_GEN(dev, nic_flow_table)) {
+        if (MLX5_CAP_GEN(dev, nic_flow_table) &&
+            MLX5_CAP_FLOWTABLE_NIC_RX(dev, ft_support)) {
                 err = init_root_ns(dev);
                 if (err)
                         goto err;
         }
+
         if (MLX5_CAP_GEN(dev, eswitch_flow_table)) {
-                err = init_fdb_root_ns(dev);
-                if (err)
-                        goto err;
-        }
-        if (MLX5_CAP_ESW_EGRESS_ACL(dev, ft_support)) {
-                err = init_egress_acl_root_ns(dev);
-                if (err)
-                        goto err;
-        }
-        if (MLX5_CAP_ESW_INGRESS_ACL(dev, ft_support)) {
-                err = init_ingress_acl_root_ns(dev);
-                if (err)
-                        goto err;
+                if (MLX5_CAP_ESW_FLOWTABLE_FDB(dev, ft_support)) {
+                        err = init_fdb_root_ns(dev);
+                        if (err)
+                                goto err;
+                }
+                if (MLX5_CAP_ESW_EGRESS_ACL(dev, ft_support)) {
+                        err = init_egress_acl_root_ns(dev);
+                        if (err)
+                                goto err;
+                }
+                if (MLX5_CAP_ESW_INGRESS_ACL(dev, ft_support)) {
+                        err = init_ingress_acl_root_ns(dev);
+                        if (err)
+                                goto err;
+                }
         }
 
         return 0;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/qp.c b/drivers/net/ethernet/mellanox/mlx5/core/qp.c
index b720a274220d..b82d65802d96 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/qp.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/qp.c
@@ -418,7 +418,7 @@ int mlx5_core_xrcd_alloc(struct mlx5_core_dev *dev, u32 *xrcdn)
         if (out.hdr.status)
                 err = mlx5_cmd_status_to_err(&out.hdr);
         else
-                *xrcdn = be32_to_cpu(out.xrcdn);
+                *xrcdn = be32_to_cpu(out.xrcdn) & 0xffffff;
 
         return err;
 }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/vport.c b/drivers/net/ethernet/mellanox/mlx5/core/vport.c
index b69dadcfb897..daf44cd4c566 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/vport.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/vport.c
@@ -508,6 +508,44 @@ int mlx5_query_nic_vport_node_guid(struct mlx5_core_dev *mdev, u64 *node_guid)
 }
 EXPORT_SYMBOL_GPL(mlx5_query_nic_vport_node_guid);
 
+int mlx5_modify_nic_vport_node_guid(struct mlx5_core_dev *mdev,
+                                    u32 vport, u64 node_guid)
+{
+        int inlen = MLX5_ST_SZ_BYTES(modify_nic_vport_context_in);
+        void *nic_vport_context;
+        u8 *guid;
+        void *in;
+        int err;
+
+        if (!vport)
+                return -EINVAL;
+        if (!MLX5_CAP_GEN(mdev, vport_group_manager))
+                return -EACCES;
+        if (!MLX5_CAP_ESW(mdev, nic_vport_node_guid_modify))
+                return -ENOTSUPP;
+
+        in = mlx5_vzalloc(inlen);
+        if (!in)
+                return -ENOMEM;
+
+        MLX5_SET(modify_nic_vport_context_in, in,
+                 field_select.node_guid, 1);
+        MLX5_SET(modify_nic_vport_context_in, in, vport_number, vport);
+        MLX5_SET(modify_nic_vport_context_in, in, other_vport, !!vport);
+
+        nic_vport_context = MLX5_ADDR_OF(modify_nic_vport_context_in,
+                                         in, nic_vport_context);
+        guid = MLX5_ADDR_OF(nic_vport_context, nic_vport_context,
+                            node_guid);
+        MLX5_SET64(nic_vport_context, nic_vport_context, node_guid, node_guid);
+
+        err = mlx5_modify_nic_vport_context(mdev, in, inlen);
+
+        kvfree(in);
+
+        return err;
+}
+
 int mlx5_query_nic_vport_qkey_viol_cntr(struct mlx5_core_dev *mdev,
                                         u16 *qkey_viol_cntr)
 {
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
index 4a7273771028..6f9e3ddff4a8 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
@@ -247,15 +247,23 @@ static int mlxsw_sp_port_mtu_set(struct mlxsw_sp_port *mlxsw_sp_port, u16 mtu)
         return mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(pmtu), pmtu_pl);
 }
 
-static int mlxsw_sp_port_swid_set(struct mlxsw_sp_port *mlxsw_sp_port, u8 swid)
+static int __mlxsw_sp_port_swid_set(struct mlxsw_sp *mlxsw_sp, u8 local_port,
+                                    u8 swid)
 {
-        struct mlxsw_sp *mlxsw_sp = mlxsw_sp_port->mlxsw_sp;
         char pspa_pl[MLXSW_REG_PSPA_LEN];
 
-        mlxsw_reg_pspa_pack(pspa_pl, swid, mlxsw_sp_port->local_port);
+        mlxsw_reg_pspa_pack(pspa_pl, swid, local_port);
         return mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(pspa), pspa_pl);
 }
 
+static int mlxsw_sp_port_swid_set(struct mlxsw_sp_port *mlxsw_sp_port, u8 swid)
+{
+        struct mlxsw_sp *mlxsw_sp = mlxsw_sp_port->mlxsw_sp;
+
+        return __mlxsw_sp_port_swid_set(mlxsw_sp, mlxsw_sp_port->local_port,
+                                        swid);
+}
+
 static int mlxsw_sp_port_vp_mode_set(struct mlxsw_sp_port *mlxsw_sp_port,
                                      bool enable)
 {
@@ -305,9 +313,9 @@ mlxsw_sp_port_system_port_mapping_set(struct mlxsw_sp_port *mlxsw_sp_port)
         return mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(sspr), sspr_pl);
 }
 
-static int __mlxsw_sp_port_module_info_get(struct mlxsw_sp *mlxsw_sp,
-                                           u8 local_port, u8 *p_module,
-                                           u8 *p_width, u8 *p_lane)
+static int mlxsw_sp_port_module_info_get(struct mlxsw_sp *mlxsw_sp,
+                                         u8 local_port, u8 *p_module,
+                                         u8 *p_width, u8 *p_lane)
 {
         char pmlp_pl[MLXSW_REG_PMLP_LEN];
         int err;
@@ -322,16 +330,6 @@ static int __mlxsw_sp_port_module_info_get(struct mlxsw_sp *mlxsw_sp,
         return 0;
 }
 
-static int mlxsw_sp_port_module_info_get(struct mlxsw_sp *mlxsw_sp,
-                                         u8 local_port, u8 *p_module,
-                                         u8 *p_width)
-{
-        u8 lane;
-
-        return __mlxsw_sp_port_module_info_get(mlxsw_sp, local_port, p_module,
-                                               p_width, &lane);
-}
-
 static int mlxsw_sp_port_module_map(struct mlxsw_sp *mlxsw_sp, u8 local_port,
                                     u8 module, u8 width, u8 lane)
 {
@@ -949,17 +947,11 @@ static int mlxsw_sp_port_get_phys_port_name(struct net_device *dev, char *name,
                                             size_t len)
 {
         struct mlxsw_sp_port *mlxsw_sp_port = netdev_priv(dev);
-        u8 module, width, lane;
+        u8 module = mlxsw_sp_port->mapping.module;
+        u8 width = mlxsw_sp_port->mapping.width;
+        u8 lane = mlxsw_sp_port->mapping.lane;
         int err;
 
-        err = __mlxsw_sp_port_module_info_get(mlxsw_sp_port->mlxsw_sp,
-                                              mlxsw_sp_port->local_port,
-                                              &module, &width, &lane);
-        if (err) {
-                netdev_err(dev, "Failed to retrieve module information\n");
-                return err;
-        }
-
         if (!mlxsw_sp_port->split)
                 err = snprintf(name, len, "p%d", module + 1);
         else
@@ -1681,8 +1673,8 @@ static int mlxsw_sp_port_ets_init(struct mlxsw_sp_port *mlxsw_sp_port)
         return 0;
 }
 
-static int __mlxsw_sp_port_create(struct mlxsw_sp *mlxsw_sp, u8 local_port,
-                                  bool split, u8 module, u8 width)
+static int mlxsw_sp_port_create(struct mlxsw_sp *mlxsw_sp, u8 local_port,
+                                bool split, u8 module, u8 width, u8 lane)
 {
         struct mlxsw_sp_port *mlxsw_sp_port;
         struct net_device *dev;
@@ -1697,6 +1689,9 @@ static int __mlxsw_sp_port_create(struct mlxsw_sp *mlxsw_sp, u8 local_port,
         mlxsw_sp_port->mlxsw_sp = mlxsw_sp;
         mlxsw_sp_port->local_port = local_port;
         mlxsw_sp_port->split = split;
+        mlxsw_sp_port->mapping.module = module;
+        mlxsw_sp_port->mapping.width = width;
+        mlxsw_sp_port->mapping.lane = lane;
         bytes = DIV_ROUND_UP(VLAN_N_VID, BITS_PER_BYTE);
         mlxsw_sp_port->active_vlans = kzalloc(bytes, GFP_KERNEL);
         if (!mlxsw_sp_port->active_vlans) {
@@ -1839,28 +1834,6 @@ err_port_active_vlans_alloc:
         return err;
 }
 
-static int mlxsw_sp_port_create(struct mlxsw_sp *mlxsw_sp, u8 local_port,
-                                bool split, u8 module, u8 width, u8 lane)
-{
-        int err;
-
-        err = mlxsw_sp_port_module_map(mlxsw_sp, local_port, module, width,
-                                       lane);
-        if (err)
-                return err;
-
-        err = __mlxsw_sp_port_create(mlxsw_sp, local_port, split, module,
-                                     width);
-        if (err)
-                goto err_port_create;
-
-        return 0;
-
-err_port_create:
-        mlxsw_sp_port_module_unmap(mlxsw_sp, local_port);
-        return err;
-}
-
 static void mlxsw_sp_port_vports_fini(struct mlxsw_sp_port *mlxsw_sp_port)
 {
         struct net_device *dev = mlxsw_sp_port->dev;
@@ -1909,8 +1882,8 @@ static void mlxsw_sp_ports_remove(struct mlxsw_sp *mlxsw_sp)
 
 static int mlxsw_sp_ports_create(struct mlxsw_sp *mlxsw_sp)
 {
+        u8 module, width, lane;
         size_t alloc_size;
-        u8 module, width;
         int i;
         int err;
 
@@ -1921,13 +1894,14 @@ static int mlxsw_sp_ports_create(struct mlxsw_sp *mlxsw_sp)
 
         for (i = 1; i < MLXSW_PORT_MAX_PORTS; i++) {
                 err = mlxsw_sp_port_module_info_get(mlxsw_sp, i, &module,
-                                                    &width);
+                                                    &width, &lane);
                 if (err)
                         goto err_port_module_info_get;
                 if (!width)
                         continue;
                 mlxsw_sp->port_to_module[i] = module;
-                err = __mlxsw_sp_port_create(mlxsw_sp, i, false, module, width);
+                err = mlxsw_sp_port_create(mlxsw_sp, i, false, module, width,
+                                           lane);
                 if (err)
                         goto err_port_create;
         }
@@ -1948,12 +1922,85 @@ static u8 mlxsw_sp_cluster_base_port_get(u8 local_port)
         return local_port - offset;
 }
 
+static int mlxsw_sp_port_split_create(struct mlxsw_sp *mlxsw_sp, u8 base_port,
+                                      u8 module, unsigned int count)
+{
+        u8 width = MLXSW_PORT_MODULE_MAX_WIDTH / count;
+        int err, i;
+
+        for (i = 0; i < count; i++) {
+                err = mlxsw_sp_port_module_map(mlxsw_sp, base_port + i, module,
+                                               width, i * width);
+                if (err)
+                        goto err_port_module_map;
+        }
+
+        for (i = 0; i < count; i++) {
+                err = __mlxsw_sp_port_swid_set(mlxsw_sp, base_port + i, 0);
+                if (err)
+                        goto err_port_swid_set;
+        }
+
+        for (i = 0; i < count; i++) {
+                err = mlxsw_sp_port_create(mlxsw_sp, base_port + i, true,
+                                           module, width, i * width);
+                if (err)
+                        goto err_port_create;
+        }
+
+        return 0;
+
+err_port_create:
+        for (i--; i >= 0; i--)
+                mlxsw_sp_port_remove(mlxsw_sp, base_port + i);
+        i = count;
+err_port_swid_set:
+        for (i--; i >= 0; i--)
+                __mlxsw_sp_port_swid_set(mlxsw_sp, base_port + i,
+                                         MLXSW_PORT_SWID_DISABLED_PORT);
+        i = count;
+err_port_module_map:
+        for (i--; i >= 0; i--)
+                mlxsw_sp_port_module_unmap(mlxsw_sp, base_port + i);
+        return err;
+}
+
+static void mlxsw_sp_port_unsplit_create(struct mlxsw_sp *mlxsw_sp,
+                                         u8 base_port, unsigned int count)
+{
+        u8 local_port, module, width = MLXSW_PORT_MODULE_MAX_WIDTH;
+        int i;
+
+        /* Split by four means we need to re-create two ports, otherwise
+         * only one.
+         */
+        count = count / 2;
+
+        for (i = 0; i < count; i++) {
+                local_port = base_port + i * 2;
+                module = mlxsw_sp->port_to_module[local_port];
+
+                mlxsw_sp_port_module_map(mlxsw_sp, local_port, module, width,
+                                         0);
+        }
+
+        for (i = 0; i < count; i++)
+                __mlxsw_sp_port_swid_set(mlxsw_sp, base_port + i * 2, 0);
+
+        for (i = 0; i < count; i++) {
+                local_port = base_port + i * 2;
+                module = mlxsw_sp->port_to_module[local_port];
+
+                mlxsw_sp_port_create(mlxsw_sp, local_port, false, module,
+                                     width, 0);
+        }
+}
+
 static int mlxsw_sp_port_split(struct mlxsw_core *mlxsw_core, u8 local_port,
                                unsigned int count)
 {
         struct mlxsw_sp *mlxsw_sp = mlxsw_core_driver_priv(mlxsw_core);
         struct mlxsw_sp_port *mlxsw_sp_port;
-        u8 width = MLXSW_PORT_MODULE_MAX_WIDTH / count;
         u8 module, cur_width, base_port;
         int i;
         int err;
@@ -1965,18 +2012,14 @@ static int mlxsw_sp_port_split(struct mlxsw_core *mlxsw_core, u8 local_port,
                 return -EINVAL;
         }
 
+        module = mlxsw_sp_port->mapping.module;
+        cur_width = mlxsw_sp_port->mapping.width;
+
         if (count != 2 && count != 4) {
                 netdev_err(mlxsw_sp_port->dev, "Port can only be split into 2 or 4 ports\n");
                 return -EINVAL;
         }
 
-        err = mlxsw_sp_port_module_info_get(mlxsw_sp, local_port, &module,
-                                            &cur_width);
-        if (err) {
-                netdev_err(mlxsw_sp_port->dev, "Failed to get port's width\n");
-                return err;
-        }
-
         if (cur_width != MLXSW_PORT_MODULE_MAX_WIDTH) {
                 netdev_err(mlxsw_sp_port->dev, "Port cannot be split further\n");
                 return -EINVAL;
@@ -2001,25 +2044,16 @@ static int mlxsw_sp_port_split(struct mlxsw_core *mlxsw_core, u8 local_port,
         for (i = 0; i < count; i++)
                 mlxsw_sp_port_remove(mlxsw_sp, base_port + i);
 
-        for (i = 0; i < count; i++) {
-                err = mlxsw_sp_port_create(mlxsw_sp, base_port + i, true,
-                                           module, width, i * width);
-                if (err) {
-                        dev_err(mlxsw_sp->bus_info->dev, "Failed to create split port\n");
-                        goto err_port_create;
-                }
+        err = mlxsw_sp_port_split_create(mlxsw_sp, base_port, module, count);
+        if (err) {
+                dev_err(mlxsw_sp->bus_info->dev, "Failed to create split ports\n");
+                goto err_port_split_create;
         }
 
         return 0;
 
-err_port_create:
-        for (i--; i >= 0; i--)
-                mlxsw_sp_port_remove(mlxsw_sp, base_port + i);
-        for (i = 0; i < count / 2; i++) {
-                module = mlxsw_sp->port_to_module[base_port + i * 2];
-                mlxsw_sp_port_create(mlxsw_sp, base_port + i * 2, false,
-                                     module, MLXSW_PORT_MODULE_MAX_WIDTH, 0);
-        }
+err_port_split_create:
+        mlxsw_sp_port_unsplit_create(mlxsw_sp, base_port, count);
         return err;
 }
 
@@ -2027,10 +2061,9 @@ static int mlxsw_sp_port_unsplit(struct mlxsw_core *mlxsw_core, u8 local_port)
 {
         struct mlxsw_sp *mlxsw_sp = mlxsw_core_driver_priv(mlxsw_core);
         struct mlxsw_sp_port *mlxsw_sp_port;
-        u8 module, cur_width, base_port;
+        u8 cur_width, base_port;
         unsigned int count;
         int i;
-        int err;
 
         mlxsw_sp_port = mlxsw_sp->ports[local_port];
         if (!mlxsw_sp_port) {
@@ -2044,12 +2077,7 @@ static int mlxsw_sp_port_unsplit(struct mlxsw_core *mlxsw_core, u8 local_port)
                 return -EINVAL;
         }
 
-        err = mlxsw_sp_port_module_info_get(mlxsw_sp, local_port, &module,
-                                            &cur_width);
-        if (err) {
-                netdev_err(mlxsw_sp_port->dev, "Failed to get port's width\n");
-                return err;
-        }
+        cur_width = mlxsw_sp_port->mapping.width;
         count = cur_width == 1 ? 4 : 2;
 
         base_port = mlxsw_sp_cluster_base_port_get(local_port);
@@ -2061,14 +2089,7 @@ static int mlxsw_sp_port_unsplit(struct mlxsw_core *mlxsw_core, u8 local_port)
         for (i = 0; i < count; i++)
                 mlxsw_sp_port_remove(mlxsw_sp, base_port + i);
 
-        for (i = 0; i < count / 2; i++) {
-                module = mlxsw_sp->port_to_module[base_port + i * 2];
-                err = mlxsw_sp_port_create(mlxsw_sp, base_port + i * 2, false,
-                                           module, MLXSW_PORT_MODULE_MAX_WIDTH,
-                                           0);
-                if (err)
-                        dev_err(mlxsw_sp->bus_info->dev, "Failed to reinstantiate port\n");
-        }
+        mlxsw_sp_port_unsplit_create(mlxsw_sp, base_port, count);
 
         return 0;
 }
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.h b/drivers/net/ethernet/mellanox/mlxsw/spectrum.h
index e2c022d3e2f3..13b30eaa13d4 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.h
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.h
@@ -229,6 +229,11 @@ struct mlxsw_sp_port {
                 struct ieee_maxrate *maxrate;
                 struct ieee_pfc *pfc;
         } dcb;
+        struct {
+                u8 module;
+                u8 width;
+                u8 lane;
+        } mapping;
         /* 802.1Q bridge VLANs */
         unsigned long *active_vlans;
         unsigned long *untagged_vlans;
diff --git a/drivers/net/ethernet/qlogic/qed/qed_main.c b/drivers/net/ethernet/qlogic/qed/qed_main.c
index 753064679bde..61cc6869fa65 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_main.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_main.c
@@ -1105,6 +1105,39 @@ static int qed_get_port_type(u32 media_type)
         return port_type;
 }
 
+static int qed_get_link_data(struct qed_hwfn *hwfn,
+                             struct qed_mcp_link_params *params,
+                             struct qed_mcp_link_state *link,
+                             struct qed_mcp_link_capabilities *link_caps)
+{
+        void *p;
+
+        if (!IS_PF(hwfn->cdev)) {
+                qed_vf_get_link_params(hwfn, params);
+                qed_vf_get_link_state(hwfn, link);
+                qed_vf_get_link_caps(hwfn, link_caps);
+
+                return 0;
+        }
+
+        p = qed_mcp_get_link_params(hwfn);
+        if (!p)
+                return -ENXIO;
+        memcpy(params, p, sizeof(*params));
+
+        p = qed_mcp_get_link_state(hwfn);
+        if (!p)
+                return -ENXIO;
+        memcpy(link, p, sizeof(*link));
+
+        p = qed_mcp_get_link_capabilities(hwfn);
+        if (!p)
+                return -ENXIO;
+        memcpy(link_caps, p, sizeof(*link_caps));
+
+        return 0;
+}
+
 static void qed_fill_link(struct qed_hwfn *hwfn,
                           struct qed_link_output *if_link)
 {
@@ -1116,15 +1149,9 @@ static void qed_fill_link(struct qed_hwfn *hwfn,
         memset(if_link, 0, sizeof(*if_link));
 
         /* Prepare source inputs */
-        if (IS_PF(hwfn->cdev)) {
-                memcpy(&params, qed_mcp_get_link_params(hwfn), sizeof(params));
-                memcpy(&link, qed_mcp_get_link_state(hwfn), sizeof(link));
-                memcpy(&link_caps, qed_mcp_get_link_capabilities(hwfn),
-                       sizeof(link_caps));
-        } else {
-                qed_vf_get_link_params(hwfn, &params);
-                qed_vf_get_link_state(hwfn, &link);
-                qed_vf_get_link_caps(hwfn, &link_caps);
+        if (qed_get_link_data(hwfn, &params, &link, &link_caps)) {
+                dev_warn(&hwfn->cdev->pdev->dev, "no link data available\n");
+                return;
         }
 
         /* Set the link parameters to pass to protocol driver */
diff --git a/drivers/net/ethernet/qlogic/qed/qed_sriov.h b/drivers/net/ethernet/qlogic/qed/qed_sriov.h
index c8667c65e685..c90b2b6ad969 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_sriov.h
+++ b/drivers/net/ethernet/qlogic/qed/qed_sriov.h
@@ -12,11 +12,13 @@
 #include "qed_vf.h"
 #define QED_VF_ARRAY_LENGTH (3)
 
+#ifdef CONFIG_QED_SRIOV
 #define IS_VF(cdev)             ((cdev)->b_is_vf)
 #define IS_PF(cdev)             (!((cdev)->b_is_vf))
-#ifdef CONFIG_QED_SRIOV
 #define IS_PF_SRIOV(p_hwfn)     (!!((p_hwfn)->cdev->p_iov_info))
 #else
+#define IS_VF(cdev)             (0)
+#define IS_PF(cdev)             (1)
 #define IS_PF_SRIOV(p_hwfn)     (0)
 #endif
 #define IS_PF_SRIOV_ALLOC(p_hwfn)       (!!((p_hwfn)->pf_iov_info))
diff --git a/drivers/net/ethernet/qlogic/qede/qede_main.c b/drivers/net/ethernet/qlogic/qede/qede_main.c
index 5d00d1404bfc..5733d1888223 100644
--- a/drivers/net/ethernet/qlogic/qede/qede_main.c
+++ b/drivers/net/ethernet/qlogic/qede/qede_main.c
@@ -87,7 +87,9 @@ static const struct pci_device_id qede_pci_tbl[] = {
         {PCI_VDEVICE(QLOGIC, PCI_DEVICE_ID_57980S_100), QEDE_PRIVATE_PF},
         {PCI_VDEVICE(QLOGIC, PCI_DEVICE_ID_57980S_50), QEDE_PRIVATE_PF},
         {PCI_VDEVICE(QLOGIC, PCI_DEVICE_ID_57980S_25), QEDE_PRIVATE_PF},
+#ifdef CONFIG_QED_SRIOV
         {PCI_VDEVICE(QLOGIC, PCI_DEVICE_ID_57980S_IOV), QEDE_PRIVATE_VF},
+#endif
         { 0 }
 };
 
diff --git a/drivers/net/ethernet/sfc/mcdi_port.c b/drivers/net/ethernet/sfc/mcdi_port.c
index 7f295c4d7b80..2a9228a6e4a0 100644
--- a/drivers/net/ethernet/sfc/mcdi_port.c
+++ b/drivers/net/ethernet/sfc/mcdi_port.c
@@ -189,11 +189,12 @@ static u32 mcdi_to_ethtool_cap(u32 media, u32 cap)
 
         case MC_CMD_MEDIA_XFP:
         case MC_CMD_MEDIA_SFP_PLUS:
-                result |= SUPPORTED_FIBRE;
-                break;
-
         case MC_CMD_MEDIA_QSFP_PLUS:
                 result |= SUPPORTED_FIBRE;
+                if (cap & (1 << MC_CMD_PHY_CAP_1000FDX_LBN))
+                        result |= SUPPORTED_1000baseT_Full;
+                if (cap & (1 << MC_CMD_PHY_CAP_10000FDX_LBN))
+                        result |= SUPPORTED_10000baseT_Full;
                 if (cap & (1 << MC_CMD_PHY_CAP_40000FDX_LBN))
                         result |= SUPPORTED_40000baseCR4_Full;
                 break;
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
index 4f7283d05588..44da877d2483 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
@@ -156,7 +156,7 @@ static void dwmac4_set_filter(struct mac_device_info *hw,
                 struct netdev_hw_addr *ha;
 
                 netdev_for_each_uc_addr(ha, dev) {
-                        dwmac4_set_umac_addr(ioaddr, ha->addr, reg);
+                        dwmac4_set_umac_addr(hw, ha->addr, reg);
                         reg++;
                 }
         }
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index eac45d0c75e2..a473c182c91d 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -3450,8 +3450,6 @@ int stmmac_resume(struct device *dev)
         if (!netif_running(ndev))
                 return 0;
 
-        spin_lock_irqsave(&priv->lock, flags);
-
         /* Power Down bit, into the PM register, is cleared
          * automatically as soon as a magic packet or a Wake-up frame
          * is received. Anyway, it's better to manually clear
@@ -3459,7 +3457,9 @@ int stmmac_resume(struct device *dev)
          * from another devices (e.g. serial console).
          */
         if (device_may_wakeup(priv->device)) {
+                spin_lock_irqsave(&priv->lock, flags);
                 priv->hw->mac->pmt(priv->hw, 0);
+                spin_unlock_irqrestore(&priv->lock, flags);
                 priv->irq_wake = 0;
         } else {
                 pinctrl_pm_select_default_state(priv->device);
@@ -3473,6 +3473,8 @@ int stmmac_resume(struct device *dev)
 
         netif_device_attach(ndev);
 
+        spin_lock_irqsave(&priv->lock, flags);
+
         priv->cur_rx = 0;
         priv->dirty_rx = 0;
         priv->dirty_tx = 0;
diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
index 4b08a2f52b3e..e6bb0ecb12c7 100644
--- a/drivers/net/ethernet/ti/cpsw.c
+++ b/drivers/net/ethernet/ti/cpsw.c
@@ -1339,7 +1339,7 @@ static int cpsw_ndo_open(struct net_device *ndev)
         if (priv->coal_intvl != 0) {
                 struct ethtool_coalesce coal;
 
-                coal.rx_coalesce_usecs = (priv->coal_intvl << 4);
+                coal.rx_coalesce_usecs = priv->coal_intvl;
                 cpsw_set_coalesce(ndev, &coal);
         }
 
diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
index db8022ae415b..08885bc8d6db 100644
--- a/drivers/net/vmxnet3/vmxnet3_drv.c
+++ b/drivers/net/vmxnet3/vmxnet3_drv.c
@@ -1369,7 +1369,7 @@ vmxnet3_rq_rx_complete(struct vmxnet3_rx_queue *rq,
                                 rcdlro = (struct Vmxnet3_RxCompDescExt *)rcd;
 
                                 segCnt = rcdlro->segCnt;
-                                BUG_ON(segCnt <= 1);
+                                WARN_ON_ONCE(segCnt == 0);
                                 mss = rcdlro->mss;
                                 if (unlikely(segCnt <= 1))
                                         segCnt = 0;
diff --git a/drivers/net/vmxnet3/vmxnet3_int.h b/drivers/net/vmxnet3/vmxnet3_int.h
index c4825392d64b..3d2b64e63408 100644
--- a/drivers/net/vmxnet3/vmxnet3_int.h
+++ b/drivers/net/vmxnet3/vmxnet3_int.h
@@ -69,10 +69,10 @@
 /*
  * Version numbers
  */
-#define VMXNET3_DRIVER_VERSION_STRING   "1.4.7.0-k"
+#define VMXNET3_DRIVER_VERSION_STRING   "1.4.8.0-k"
 
 /* a 32-bit int, each byte encode a verion number in VMXNET3_DRIVER_VERSION */
-#define VMXNET3_DRIVER_VERSION_NUM      0x01040700
+#define VMXNET3_DRIVER_VERSION_NUM      0x01040800
 
 #if defined(CONFIG_PCI_MSI)
         /* RSS only makes sense if MSI-X is supported. */
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
index d0631b6cfd53..62f475e31077 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
@@ -2540,12 +2540,14 @@ brcmf_cfg80211_get_station(struct wiphy *wiphy, struct net_device *ndev,
                            const u8 *mac, struct station_info *sinfo)
 {
         struct brcmf_if *ifp = netdev_priv(ndev);
+        struct brcmf_scb_val_le scb_val;
         s32 err = 0;
         struct brcmf_sta_info_le sta_info_le;
         u32 sta_flags;
         u32 is_tdls_peer;
         s32 total_rssi;
         s32 count_rssi;
+        int rssi;
         u32 i;
 
         brcmf_dbg(TRACE, "Enter, MAC %pM\n", mac);
@@ -2629,6 +2631,20 @@ brcmf_cfg80211_get_station(struct wiphy *wiphy, struct net_device *ndev,
                         sinfo->filled |= BIT(NL80211_STA_INFO_SIGNAL);
                         total_rssi /= count_rssi;
                         sinfo->signal = total_rssi;
+                } else if (test_bit(BRCMF_VIF_STATUS_CONNECTED,
+                        &ifp->vif->sme_state)) {
+                        memset(&scb_val, 0, sizeof(scb_val));
+                        err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_RSSI,
+                                                     &scb_val, sizeof(scb_val));
+                        if (err) {
+                                brcmf_err("Could not get rssi (%d)\n", err);
+                                goto done;
+                        } else {
+                                rssi = le32_to_cpu(scb_val.val);
+                                sinfo->filled |= BIT(NL80211_STA_INFO_SIGNAL);
+                                sinfo->signal = rssi;
+                                brcmf_dbg(CONN, "RSSI %d dBm\n", rssi);
+                        }
                 }
         }
 done:
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
index 68f1ce02f4bf..2b9a2bc429d6 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
@@ -1157,6 +1157,8 @@ brcmf_msgbuf_process_rx_complete(struct brcmf_msgbuf *msgbuf, void *buf)
                 brcmu_pkt_buf_free_skb(skb);
                 return;
         }
+
+        skb->protocol = eth_type_trans(skb, ifp->ndev);
         brcmf_netif_rx(ifp, skb);
 }
 
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index 9ed0ed1bf514..4dd5adcdd29b 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -2776,6 +2776,7 @@ static int hwsim_tx_info_frame_received_nl(struct sk_buff *skb_2,
         if (!info->attrs[HWSIM_ATTR_ADDR_TRANSMITTER] ||
             !info->attrs[HWSIM_ATTR_FLAGS] ||
             !info->attrs[HWSIM_ATTR_COOKIE] ||
+            !info->attrs[HWSIM_ATTR_SIGNAL] ||
             !info->attrs[HWSIM_ATTR_TX_INFO])
                 goto out;
 
diff --git a/drivers/net/wireless/realtek/rtlwifi/core.c b/drivers/net/wireless/realtek/rtlwifi/core.c
index 0f48048b8654..3a0faa8fe9d4 100644
--- a/drivers/net/wireless/realtek/rtlwifi/core.c
+++ b/drivers/net/wireless/realtek/rtlwifi/core.c
@@ -54,7 +54,7 @@ EXPORT_SYMBOL(channel5g_80m);
 void rtl_addr_delay(u32 addr)
 {
         if (addr == 0xfe)
-                msleep(50);
+                mdelay(50);
         else if (addr == 0xfd)
                 msleep(5);
         else if (addr == 0xfc)
@@ -75,7 +75,7 @@ void rtl_rfreg_delay(struct ieee80211_hw *hw, enum radio_path rfpath, u32 addr,
                 rtl_addr_delay(addr);
         } else {
                 rtl_set_rfreg(hw, rfpath, addr, mask, data);
-                usleep_range(1, 2);
+                udelay(1);
         }
 }
 EXPORT_SYMBOL(rtl_rfreg_delay);
@@ -86,7 +86,7 @@ void rtl_bb_delay(struct ieee80211_hw *hw, u32 addr, u32 data)
                 rtl_addr_delay(addr);
         } else {
                 rtl_set_bbreg(hw, addr, MASKDWORD, data);
-                usleep_range(1, 2);
+                udelay(1);
         }
 }
 EXPORT_SYMBOL(rtl_bb_delay);
diff --git a/include/linux/mlx5/device.h b/include/linux/mlx5/device.h
index 035abdf62cfe..73a48479892d 100644
--- a/include/linux/mlx5/device.h
+++ b/include/linux/mlx5/device.h
@@ -1240,8 +1240,6 @@ struct mlx5_destroy_psv_out {
         u8                      rsvd[8];
 };
 
-#define MLX5_CMD_OP_MAX 0x920
-
 enum {
         VPORT_STATE_DOWN                = 0x0,
         VPORT_STATE_UP                  = 0x1,
@@ -1369,6 +1367,12 @@ enum mlx5_cap_type {
 #define MLX5_CAP_FLOWTABLE_MAX(mdev, cap) \
         MLX5_GET(flow_table_nic_cap, mdev->hca_caps_max[MLX5_CAP_FLOW_TABLE], cap)
 
+#define MLX5_CAP_FLOWTABLE_NIC_RX(mdev, cap) \
+        MLX5_CAP_FLOWTABLE(mdev, flow_table_properties_nic_receive.cap)
+
+#define MLX5_CAP_FLOWTABLE_NIC_RX_MAX(mdev, cap) \
+        MLX5_CAP_FLOWTABLE_MAX(mdev, flow_table_properties_nic_receive.cap)
+
 #define MLX5_CAP_ESW_FLOWTABLE(mdev, cap) \
         MLX5_GET(flow_table_eswitch_cap, \
                  mdev->hca_caps_cur[MLX5_CAP_ESWITCH_FLOW_TABLE], cap)
diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h
index 9a05cd7e5890..e955a2859009 100644
--- a/include/linux/mlx5/mlx5_ifc.h
+++ b/include/linux/mlx5/mlx5_ifc.h
@@ -205,7 +205,8 @@ enum {
         MLX5_CMD_OP_ALLOC_FLOW_COUNTER            = 0x939,
         MLX5_CMD_OP_DEALLOC_FLOW_COUNTER          = 0x93a,
         MLX5_CMD_OP_QUERY_FLOW_COUNTER            = 0x93b,
-        MLX5_CMD_OP_MODIFY_FLOW_TABLE             = 0x93c
+        MLX5_CMD_OP_MODIFY_FLOW_TABLE             = 0x93c,
+        MLX5_CMD_OP_MAX
 };
 
 struct mlx5_ifc_flow_table_fields_supported_bits {
@@ -500,7 +501,9 @@ struct mlx5_ifc_e_switch_cap_bits {
         u8         vport_svlan_insert[0x1];
         u8         vport_cvlan_insert_if_not_exist[0x1];
         u8         vport_cvlan_insert_overwrite[0x1];
-        u8         reserved_at_5[0x1b];
+        u8         reserved_at_5[0x19];
+        u8         nic_vport_node_guid_modify[0x1];
+        u8         nic_vport_port_guid_modify[0x1];
 
         u8         reserved_at_20[0x7e0];
 };
@@ -4583,7 +4586,10 @@ struct mlx5_ifc_modify_nic_vport_context_out_bits {
 };
 
 struct mlx5_ifc_modify_nic_vport_field_select_bits {
-        u8         reserved_at_0[0x19];
+        u8         reserved_at_0[0x16];
+        u8         node_guid[0x1];
+        u8         port_guid[0x1];
+        u8         reserved_at_18[0x1];
         u8         mtu[0x1];
         u8         change_event[0x1];
         u8         promisc[0x1];
diff --git a/include/linux/mlx5/qp.h b/include/linux/mlx5/qp.h
index e4e29882fdfd..266320feb160 100644
--- a/include/linux/mlx5/qp.h
+++ b/include/linux/mlx5/qp.h
@@ -559,6 +559,7 @@ struct mlx5_modify_qp_mbox_in {
         __be32                  optparam;
         u8                      rsvd0[4];
         struct mlx5_qp_context  ctx;
+        u8                      rsvd2[16];
 };
 
 struct mlx5_modify_qp_mbox_out {
diff --git a/include/linux/mlx5/vport.h b/include/linux/mlx5/vport.h
index 301da4a5e6bf..6c16c198f680 100644
--- a/include/linux/mlx5/vport.h
+++ b/include/linux/mlx5/vport.h
@@ -50,6 +50,8 @@ int mlx5_modify_nic_vport_mtu(struct mlx5_core_dev *mdev, u16 mtu);
 int mlx5_query_nic_vport_system_image_guid(struct mlx5_core_dev *mdev,
                                            u64 *system_image_guid);
 int mlx5_query_nic_vport_node_guid(struct mlx5_core_dev *mdev, u64 *node_guid);
+int mlx5_modify_nic_vport_node_guid(struct mlx5_core_dev *mdev,
+                                    u32 vport, u64 node_guid);
 int mlx5_query_nic_vport_qkey_viol_cntr(struct mlx5_core_dev *mdev,
                                         u16 *qkey_viol_cntr);
 int mlx5_query_hca_vport_gid(struct mlx5_core_dev *dev, u8 other_vport,
diff --git a/include/net/compat.h b/include/net/compat.h
index 48103cf94e97..13de0ccaa059 100644
--- a/include/net/compat.h
+++ b/include/net/compat.h
@@ -42,6 +42,7 @@ int compat_sock_get_timestampns(struct sock *, struct timespec __user *);
 
 int get_compat_msghdr(struct msghdr *, struct compat_msghdr __user *,
                       struct sockaddr __user **, struct iovec **);
+struct sock_fprog __user *get_compat_bpf_fprog(char __user *optval);
 asmlinkage long compat_sys_sendmsg(int, struct compat_msghdr __user *,
                                    unsigned int);
 asmlinkage long compat_sys_sendmmsg(int, struct compat_mmsghdr __user *,
diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h
index af4c10ebb241..cd6018a9ee24 100644
--- a/include/net/ip_vs.h
+++ b/include/net/ip_vs.h
@@ -1232,7 +1232,7 @@ void ip_vs_conn_expire_now(struct ip_vs_conn *cp);
 const char *ip_vs_state_name(__u16 proto, int state);
 
 void ip_vs_tcp_conn_listen(struct ip_vs_conn *cp);
-int ip_vs_check_template(struct ip_vs_conn *ct);
+int ip_vs_check_template(struct ip_vs_conn *ct, struct ip_vs_dest *cdest);
 void ip_vs_random_dropentry(struct netns_ipvs *ipvs);
 int ip_vs_conn_init(void);
 void ip_vs_conn_cleanup(void);
diff --git a/include/net/netfilter/nf_queue.h b/include/net/netfilter/nf_queue.h
index 9c5638ad872e..0dbce55437f2 100644
--- a/include/net/netfilter/nf_queue.h
+++ b/include/net/netfilter/nf_queue.h
@@ -28,8 +28,8 @@ struct nf_queue_handler {
                                                 struct nf_hook_ops *ops);
 };
 
-void nf_register_queue_handler(const struct nf_queue_handler *qh);
-void nf_unregister_queue_handler(void);
+void nf_register_queue_handler(struct net *net, const struct nf_queue_handler *qh);
+void nf_unregister_queue_handler(struct net *net);
 void nf_reinject(struct nf_queue_entry *entry, unsigned int verdict);
 
 void nf_queue_entry_get_refs(struct nf_queue_entry *entry);
diff --git a/include/net/netns/netfilter.h b/include/net/netns/netfilter.h
index 38aa4983e2a9..36d723579af2 100644
--- a/include/net/netns/netfilter.h
+++ b/include/net/netns/netfilter.h
@@ -5,11 +5,13 @@
 
 struct proc_dir_entry;
 struct nf_logger;
+struct nf_queue_handler;
 
 struct netns_nf {
 #if defined CONFIG_PROC_FS
         struct proc_dir_entry *proc_netfilter;
 #endif
+        const struct nf_queue_handler __rcu *queue_handler;
         const struct nf_logger __rcu *nf_loggers[NFPROTO_NUMPROTO];
 #ifdef CONFIG_SYSCTL
         struct ctl_table_header *nf_log_dir_header;
diff --git a/include/net/pkt_cls.h b/include/net/pkt_cls.h
index 0f7efa88f210..3722dda0199d 100644
--- a/include/net/pkt_cls.h
+++ b/include/net/pkt_cls.h
@@ -392,16 +392,20 @@ struct tc_cls_u32_offload {
         };
 };
 
-static inline bool tc_should_offload(struct net_device *dev, u32 flags)
+static inline bool tc_should_offload(const struct net_device *dev,
+                                     const struct tcf_proto *tp, u32 flags)
 {
+        const struct Qdisc *sch = tp->q;
+        const struct Qdisc_class_ops *cops = sch->ops->cl_ops;
+
         if (!(dev->features & NETIF_F_HW_TC))
                 return false;
-
         if (flags & TCA_CLS_FLAGS_SKIP_HW)
                 return false;
-
         if (!dev->netdev_ops->ndo_setup_tc)
                 return false;
+        if (cops && cops->tcf_cl_offload)
+                return cops->tcf_cl_offload(tp->classid);
 
         return true;
 }
diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h
index a1fd76c22a59..62d553184e91 100644
--- a/include/net/sch_generic.h
+++ b/include/net/sch_generic.h
@@ -168,6 +168,7 @@ struct Qdisc_class_ops {
 
         /* Filter manipulation */
         struct tcf_proto __rcu ** (*tcf_chain)(struct Qdisc *, unsigned long);
+        bool                    (*tcf_cl_offload)(u32 classid);
         unsigned long           (*bind_tcf)(struct Qdisc *, unsigned long,
                                         u32 classid);
         void                    (*unbind_tcf)(struct Qdisc *, unsigned long);
@@ -691,9 +692,11 @@ static inline struct sk_buff *qdisc_peek_dequeued(struct Qdisc *sch)
         /* we can reuse ->gso_skb because peek isn't called for root qdiscs */
         if (!sch->gso_skb) {
                 sch->gso_skb = sch->dequeue(sch);
-                if (sch->gso_skb)
+                if (sch->gso_skb) {
                         /* it's still part of the queue */
+                        qdisc_qstats_backlog_inc(sch, sch->gso_skb);
                         sch->q.qlen++;
+                }
         }
 
         return sch->gso_skb;
@@ -706,6 +709,7 @@ static inline struct sk_buff *qdisc_dequeue_peeked(struct Qdisc *sch)
 
         if (skb) {
                 sch->gso_skb = NULL;
+                qdisc_qstats_backlog_dec(sch, skb);
                 sch->q.qlen--;
         } else {
                 skb = sch->dequeue(sch);
diff --git a/include/uapi/linux/gtp.h b/include/uapi/linux/gtp.h
index ca1054dd8249..72a04a0e8cce 100644
--- a/include/uapi/linux/gtp.h
+++ b/include/uapi/linux/gtp.h
@@ -1,5 +1,5 @@
 #ifndef _UAPI_LINUX_GTP_H_
-#define _UAPI_LINUX_GTP_H__
+#define _UAPI_LINUX_GTP_H_
 
 enum gtp_genl_cmds {
         GTP_CMD_NEWPDP,
diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
index 780bcbe1d4de..720b7bb01d43 100644
--- a/kernel/trace/bpf_trace.c
+++ b/kernel/trace/bpf_trace.c
@@ -198,7 +198,7 @@ static u64 bpf_perf_event_read(u64 r1, u64 index, u64 r3, u64 r4, u64 r5)
         if (unlikely(index >= array->map.max_entries))
                 return -E2BIG;
 
-        file = (struct file *)array->ptrs[index];
+        file = READ_ONCE(array->ptrs[index]);
         if (unlikely(!file))
                 return -ENOENT;
 
@@ -247,7 +247,7 @@ static u64 bpf_perf_event_output(u64 r1, u64 r2, u64 flags, u64 r4, u64 size)
         if (unlikely(index >= array->map.max_entries))
                 return -E2BIG;
 
-        file = (struct file *)array->ptrs[index];
+        file = READ_ONCE(array->ptrs[index]);
         if (unlikely(!file))
                 return -ENOENT;
 
diff --git a/net/bridge/br_fdb.c b/net/bridge/br_fdb.c
index dcea4f4c62b3..c18080ad4085 100644
--- a/net/bridge/br_fdb.c
+++ b/net/bridge/br_fdb.c
@@ -279,6 +279,8 @@ void br_fdb_change_mac_address(struct net_bridge *br, const u8 *newaddr)
          * change from under us.
          */
         list_for_each_entry(v, &vg->vlan_list, vlist) {
+                if (!br_vlan_should_use(v))
+                        continue;
                 f = __br_fdb_get(br, br->dev->dev_addr, v->vid);
                 if (f && f->is_local && !f->dst)
                         fdb_delete_local(br, NULL, f);
diff --git a/net/compat.c b/net/compat.c
index 5cfd26a0006f..1cd2ec046164 100644
--- a/net/compat.c
+++ b/net/compat.c
@@ -309,8 +309,8 @@ void scm_detach_fds_compat(struct msghdr *kmsg, struct scm_cookie *scm)
         __scm_destroy(scm);
 }
 
-static int do_set_attach_filter(struct socket *sock, int level, int optname,
-                                char __user *optval, unsigned int optlen)
+/* allocate a 64-bit sock_fprog on the user stack for duration of syscall. */
+struct sock_fprog __user *get_compat_bpf_fprog(char __user *optval)
 {
         struct compat_sock_fprog __user *fprog32 = (struct compat_sock_fprog __user *)optval;
         struct sock_fprog __user *kfprog = compat_alloc_user_space(sizeof(struct sock_fprog));
@@ -323,6 +323,19 @@ static int do_set_attach_filter(struct socket *sock, int level, int optname,
             __get_user(ptr, &fprog32->filter) ||
             __put_user(len, &kfprog->len) ||
             __put_user(compat_ptr(ptr), &kfprog->filter))
+                return NULL;
+
+        return kfprog;
+}
+EXPORT_SYMBOL_GPL(get_compat_bpf_fprog);
+
+static int do_set_attach_filter(struct socket *sock, int level, int optname,
+                                char __user *optval, unsigned int optlen)
+{
+        struct sock_fprog __user *kfprog;
+
+        kfprog = get_compat_bpf_fprog(optval);
+        if (!kfprog)
                 return -EFAULT;
 
         return sock_setsockopt(sock, level, optname, (char __user *)kfprog,
@@ -354,7 +367,8 @@ static int do_set_sock_timeout(struct socket *sock, int level,
 static int compat_sock_setsockopt(struct socket *sock, int level, int optname,
                                 char __user *optval, unsigned int optlen)
 {
-        if (optname == SO_ATTACH_FILTER)
+        if (optname == SO_ATTACH_FILTER ||
+            optname == SO_ATTACH_REUSEPORT_CBPF)
                 return do_set_attach_filter(sock, level, optname,
                                             optval, optlen);
         if (optname == SO_RCVTIMEO || optname == SO_SNDTIMEO)
diff --git a/net/core/gen_stats.c b/net/core/gen_stats.c
index f96ee8b9478d..be873e4e3125 100644
--- a/net/core/gen_stats.c
+++ b/net/core/gen_stats.c
@@ -47,6 +47,7 @@ nla_put_failure:
  * @xstats_type: TLV type for backward compatibility xstats TLV
  * @lock: statistics lock
  * @d: dumping handle
+ * @padattr: padding attribute
  *
  * Initializes the dumping handle, grabs the statistic lock and appends
  * an empty TLV header to the socket buffer for use a container for all
@@ -87,6 +88,7 @@ EXPORT_SYMBOL(gnet_stats_start_copy_compat);
  * @type: TLV type for top level statistic TLV
  * @lock: statistics lock
  * @d: dumping handle
+ * @padattr: padding attribute
  *
  * Initializes the dumping handle, grabs the statistic lock and appends
  * an empty TLV header to the socket buffer for use a container for all
diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
index 2b3f76fe65f4..7a0b616557ab 100644
--- a/net/core/net-sysfs.c
+++ b/net/core/net-sysfs.c
@@ -24,6 +24,7 @@
 #include <linux/jiffies.h>
 #include <linux/pm_runtime.h>
 #include <linux/of.h>
+#include <linux/of_net.h>
 
 #include "net-sysfs.h"
 
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index d56c0559b477..0ff31d97d485 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -1618,12 +1618,12 @@ int udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
                 }
         }
 
-        if (rcu_access_pointer(sk->sk_filter)) {
-                if (udp_lib_checksum_complete(skb))
+        if (rcu_access_pointer(sk->sk_filter) &&
+            udp_lib_checksum_complete(skb))
                         goto csum_error;
-                if (sk_filter(sk, skb))
-                        goto drop;
-        }
+
+        if (sk_filter(sk, skb))
+                goto drop;
 
         udp_csum_pull_header(skb);
         if (sk_rcvqueues_full(sk, sk->sk_rcvbuf)) {
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index f4ac2842d4d9..fdc9de276ab1 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -1256,6 +1256,8 @@ static int ip6gre_tap_init(struct net_device *dev)
         if (ret)
                 return ret;
 
+        dev->priv_flags |= IFF_LIVE_ADDR_CHANGE;
+
         tunnel = netdev_priv(dev);
 
         ip6gre_tnl_link_config(tunnel, 1);
@@ -1289,6 +1291,7 @@ static void ip6gre_tap_setup(struct net_device *dev)
 
         dev->features |= NETIF_F_NETNS_LOCAL;
         dev->priv_flags &= ~IFF_TX_SKB_SHARING;
+        dev->priv_flags |= IFF_LIVE_ADDR_CHANGE;
 }
 
 static bool ip6gre_netlink_encap_parms(struct nlattr *data[],
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index cbf127ae7c67..635b8d340cdb 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1071,17 +1071,12 @@ struct dst_entry *ip6_sk_dst_lookup_flow(struct sock *sk, struct flowi6 *fl6,
                                          const struct in6_addr *final_dst)
 {
         struct dst_entry *dst = sk_dst_check(sk, inet6_sk(sk)->dst_cookie);
-        int err;
 
         dst = ip6_sk_dst_check(sk, dst, fl6);
+        if (!dst)
+                dst = ip6_dst_lookup_flow(sk, fl6, final_dst);
 
-        err = ip6_dst_lookup_tail(sock_net(sk), sk, &dst, fl6);
-        if (err)
-                return ERR_PTR(err);
-        if (final_dst)
-                fl6->daddr = *final_dst;
-
-        return xfrm_lookup_route(sock_net(sk), dst, flowi6_to_flowi(fl6), sk, 0);
+        return dst;
 }
 EXPORT_SYMBOL_GPL(ip6_sk_dst_lookup_flow);
 
diff --git a/net/ipv6/netfilter/nf_dup_ipv6.c b/net/ipv6/netfilter/nf_dup_ipv6.c
index 6989c70ae29f..4a84b5ad9ecb 100644
--- a/net/ipv6/netfilter/nf_dup_ipv6.c
+++ b/net/ipv6/netfilter/nf_dup_ipv6.c
@@ -33,6 +33,7 @@ static bool nf_dup_ipv6_route(struct net *net, struct sk_buff *skb,
         fl6.daddr = *gw;
         fl6.flowlabel = (__force __be32)(((iph->flow_lbl[0] & 0xF) << 16) |
                         (iph->flow_lbl[1] << 8) | iph->flow_lbl[2]);
+        fl6.flowi6_flags = FLOWI_FLAG_KNOWN_NH;
         dst = ip6_route_output(net, NULL, &fl6);
         if (dst->error) {
                 dst_release(dst);
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 79e33e02f11a..f36c2d076fce 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -1721,7 +1721,9 @@ static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
         destp = ntohs(inet->inet_dport);
         srcp  = ntohs(inet->inet_sport);
 
-        if (icsk->icsk_pending == ICSK_TIME_RETRANS) {
+        if (icsk->icsk_pending == ICSK_TIME_RETRANS ||
+            icsk->icsk_pending == ICSK_TIME_EARLY_RETRANS ||
+            icsk->icsk_pending == ICSK_TIME_LOSS_PROBE) {
                 timer_active    = 1;
                 timer_expires   = icsk->icsk_timeout;
         } else if (icsk->icsk_pending == ICSK_TIME_PROBE0) {
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 2da1896af934..f421c9f23c5b 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -653,12 +653,12 @@ int udpv6_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
                 }
         }
 
-        if (rcu_access_pointer(sk->sk_filter)) {
-                if (udp_lib_checksum_complete(skb))
-                        goto csum_error;
-                if (sk_filter(sk, skb))
-                        goto drop;
-        }
+        if (rcu_access_pointer(sk->sk_filter) &&
+            udp_lib_checksum_complete(skb))
+                goto csum_error;
+
+        if (sk_filter(sk, skb))
+                goto drop;
 
         udp_csum_pull_header(skb);
         if (sk_rcvqueues_full(sk, sk->sk_rcvbuf)) {
diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
index 6edfa9980314..1e40dacaa137 100644
--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -1581,7 +1581,7 @@ int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32
         /* Mark socket as an encapsulation socket. See net/ipv4/udp.c */
         tunnel->encap = encap;
         if (encap == L2TP_ENCAPTYPE_UDP) {
-                struct udp_tunnel_sock_cfg udp_cfg;
+                struct udp_tunnel_sock_cfg udp_cfg = { };
 
                 udp_cfg.sk_user_data = tunnel;
                 udp_cfg.encap_type = UDP_ENCAP_L2TPINUDP;
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index 4c6404e1ad6e..21b1fdf5d01d 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -161,6 +161,10 @@ void mesh_sta_cleanup(struct sta_info *sta)
                 del_timer_sync(&sta->mesh->plink_timer);
         }
 
+        /* make sure no readers can access nexthop sta from here on */
+        mesh_path_flush_by_nexthop(sta);
+        synchronize_net();
+
         if (changed)
                 ieee80211_mbss_info_change_notify(sdata, changed);
 }
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index c8b8ccc370eb..78b0ef32dddd 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -280,7 +280,7 @@ struct ieee80211_fast_tx {
         u8 sa_offs, da_offs, pn_offs;
         u8 band;
         u8 hdr[30 + 2 + IEEE80211_FAST_XMIT_MAX_IV +
-               sizeof(rfc1042_header)];
+               sizeof(rfc1042_header)] __aligned(2);
 
         struct rcu_head rcu_head;
 };
diff --git a/net/netfilter/ipvs/ip_vs_conn.c b/net/netfilter/ipvs/ip_vs_conn.c
index 2cb3c626cd43..096a45103f14 100644
--- a/net/netfilter/ipvs/ip_vs_conn.c
+++ b/net/netfilter/ipvs/ip_vs_conn.c
@@ -762,7 +762,7 @@ static int expire_quiescent_template(struct netns_ipvs *ipvs,
  *      If available, return 1, otherwise invalidate this connection
  *      template and return 0.
  */
-int ip_vs_check_template(struct ip_vs_conn *ct)
+int ip_vs_check_template(struct ip_vs_conn *ct, struct ip_vs_dest *cdest)
 {
         struct ip_vs_dest *dest = ct->dest;
         struct netns_ipvs *ipvs = ct->ipvs;
@@ -772,7 +772,8 @@ int ip_vs_check_template(struct ip_vs_conn *ct)
          */
         if ((dest == NULL) ||
             !(dest->flags & IP_VS_DEST_F_AVAILABLE) ||
-            expire_quiescent_template(ipvs, dest)) {
+            expire_quiescent_template(ipvs, dest) ||
+            (cdest && (dest != cdest))) {
                 IP_VS_DBG_BUF(9, "check_template: dest not available for "
                               "protocol %s s:%s:%d v:%s:%d "
                               "-> d:%s:%d\n",
diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
index 1207f20d24e4..2c1b498a7a27 100644
--- a/net/netfilter/ipvs/ip_vs_core.c
+++ b/net/netfilter/ipvs/ip_vs_core.c
@@ -321,7 +321,7 @@ ip_vs_sched_persist(struct ip_vs_service *svc,
 
         /* Check if a template already exists */
         ct = ip_vs_ct_in_get(&param);
-        if (!ct || !ip_vs_check_template(ct)) {
+        if (!ct || !ip_vs_check_template(ct, NULL)) {
                 struct ip_vs_scheduler *sched;
 
                 /*
@@ -1154,7 +1154,8 @@ struct ip_vs_conn *ip_vs_new_conn_out(struct ip_vs_service *svc,
                                                   vport, &param) < 0)
                         return NULL;
                 ct = ip_vs_ct_in_get(&param);
-                if (!ct) {
+                /* check if template exists and points to the same dest */
+                if (!ct || !ip_vs_check_template(ct, dest)) {
                         ct = ip_vs_conn_new(&param, dest->af, daddr, dport,
                                             IP_VS_CONN_F_TEMPLATE, dest, 0);
                         if (!ct) {
diff --git a/net/netfilter/nf_conntrack_ftp.c b/net/netfilter/nf_conntrack_ftp.c
index 883c691ec8d0..19efeba02abb 100644
--- a/net/netfilter/nf_conntrack_ftp.c
+++ b/net/netfilter/nf_conntrack_ftp.c
@@ -632,6 +632,7 @@ static int __init nf_conntrack_ftp_init(void)
                         if (ret) {
                                 pr_err("failed to register helper for pf: %d port: %d\n",
                                        ftp[i][j].tuple.src.l3num, ports[i]);
+                                ports_c = i;
                                 nf_conntrack_ftp_fini();
                                 return ret;
                         }
diff --git a/net/netfilter/nf_conntrack_helper.c b/net/netfilter/nf_conntrack_helper.c
index f703adb7e5f7..196cb39649e1 100644
--- a/net/netfilter/nf_conntrack_helper.c
+++ b/net/netfilter/nf_conntrack_helper.c
@@ -361,9 +361,10 @@ EXPORT_SYMBOL_GPL(nf_ct_helper_log);
 
 int nf_conntrack_helper_register(struct nf_conntrack_helper *me)
 {
-        int ret = 0;
-        struct nf_conntrack_helper *cur;
+        struct nf_conntrack_tuple_mask mask = { .src.u.all = htons(0xFFFF) };
         unsigned int h = helper_hash(&me->tuple);
+        struct nf_conntrack_helper *cur;
+        int ret = 0;
 
         BUG_ON(me->expect_policy == NULL);
         BUG_ON(me->expect_class_max >= NF_CT_MAX_EXPECT_CLASSES);
@@ -371,9 +372,7 @@ int nf_conntrack_helper_register(struct nf_conntrack_helper *me)
 
         mutex_lock(&nf_ct_helper_mutex);
         hlist_for_each_entry(cur, &nf_ct_helper_hash[h], hnode) {
-                if (strncmp(cur->name, me->name, NF_CT_HELPER_NAME_LEN) == 0 &&
-                    cur->tuple.src.l3num == me->tuple.src.l3num &&
-                    cur->tuple.dst.protonum == me->tuple.dst.protonum) {
+                if (nf_ct_tuple_src_mask_cmp(&cur->tuple, &me->tuple, &mask)) {
                         ret = -EEXIST;
                         goto out;
                 }
diff --git a/net/netfilter/nf_conntrack_irc.c b/net/netfilter/nf_conntrack_irc.c
index 8b6da2719600..f97ac61d2536 100644
--- a/net/netfilter/nf_conntrack_irc.c
+++ b/net/netfilter/nf_conntrack_irc.c
@@ -271,6 +271,7 @@ static int __init nf_conntrack_irc_init(void)
                 if (ret) {
                         pr_err("failed to register helper for pf: %u port: %u\n",
                                irc[i].tuple.src.l3num, ports[i]);
+                        ports_c = i;
                         nf_conntrack_irc_fini();
                         return ret;
                 }
diff --git a/net/netfilter/nf_conntrack_sane.c b/net/netfilter/nf_conntrack_sane.c
index 7523a575f6d1..3fcbaab83b3d 100644
--- a/net/netfilter/nf_conntrack_sane.c
+++ b/net/netfilter/nf_conntrack_sane.c
@@ -223,6 +223,7 @@ static int __init nf_conntrack_sane_init(void)
                         if (ret) {
                                 pr_err("failed to register helper for pf: %d port: %d\n",
                                        sane[i][j].tuple.src.l3num, ports[i]);
+                                ports_c = i;
                                 nf_conntrack_sane_fini();
                                 return ret;
                         }
diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c
index 3e06402739e0..f72ba5587588 100644
--- a/net/netfilter/nf_conntrack_sip.c
+++ b/net/netfilter/nf_conntrack_sip.c
@@ -1669,6 +1669,7 @@ static int __init nf_conntrack_sip_init(void)
                         if (ret) {
                                 pr_err("failed to register helper for pf: %u port: %u\n",
                                        sip[i][j].tuple.src.l3num, ports[i]);
+                                ports_c = i;
                                 nf_conntrack_sip_fini();
                                 return ret;
                         }
diff --git a/net/netfilter/nf_conntrack_standalone.c b/net/netfilter/nf_conntrack_standalone.c
index f87e84ebcec3..c026c472ea80 100644
--- a/net/netfilter/nf_conntrack_standalone.c
+++ b/net/netfilter/nf_conntrack_standalone.c
@@ -487,8 +487,6 @@ static struct ctl_table nf_ct_sysctl_table[] = {
         { }
 };
 
-#define NET_NF_CONNTRACK_MAX 2089
-
 static struct ctl_table nf_ct_netfilter_table[] = {
         {
                 .procname       = "nf_conntrack_max",
diff --git a/net/netfilter/nf_conntrack_tftp.c b/net/netfilter/nf_conntrack_tftp.c
index 36f964066461..2e65b5430fba 100644
--- a/net/netfilter/nf_conntrack_tftp.c
+++ b/net/netfilter/nf_conntrack_tftp.c
@@ -142,6 +142,7 @@ static int __init nf_conntrack_tftp_init(void)
                         if (ret) {
                                 pr_err("failed to register helper for pf: %u port: %u\n",
                                        tftp[i][j].tuple.src.l3num, ports[i]);
+                                ports_c = i;
                                 nf_conntrack_tftp_fini();
                                 return ret;
                         }
diff --git a/net/netfilter/nf_queue.c b/net/netfilter/nf_queue.c
index 5baa8e24e6ac..b19ad20a705c 100644
--- a/net/netfilter/nf_queue.c
+++ b/net/netfilter/nf_queue.c
@@ -26,23 +26,21 @@
  * Once the queue is registered it must reinject all packets it
  * receives, no matter what.
  */
-static const struct nf_queue_handler __rcu *queue_handler __read_mostly;
 
 /* return EBUSY when somebody else is registered, return EEXIST if the
  * same handler is registered, return 0 in case of success. */
-void nf_register_queue_handler(const struct nf_queue_handler *qh)
+void nf_register_queue_handler(struct net *net, const struct nf_queue_handler *qh)
 {
         /* should never happen, we only have one queueing backend in kernel */
-        WARN_ON(rcu_access_pointer(queue_handler));
-        rcu_assign_pointer(queue_handler, qh);
+        WARN_ON(rcu_access_pointer(net->nf.queue_handler));
+        rcu_assign_pointer(net->nf.queue_handler, qh);
 }
 EXPORT_SYMBOL(nf_register_queue_handler);
 
 /* The caller must flush their queue before this */
-void nf_unregister_queue_handler(void)
+void nf_unregister_queue_handler(struct net *net)
 {
-        RCU_INIT_POINTER(queue_handler, NULL);
-        synchronize_rcu();
+        RCU_INIT_POINTER(net->nf.queue_handler, NULL);
 }
 EXPORT_SYMBOL(nf_unregister_queue_handler);
 
@@ -103,7 +101,7 @@ void nf_queue_nf_hook_drop(struct net *net, struct nf_hook_ops *ops)
         const struct nf_queue_handler *qh;
 
         rcu_read_lock();
-        qh = rcu_dereference(queue_handler);
+        qh = rcu_dereference(net->nf.queue_handler);
         if (qh)
                 qh->nf_hook_drop(net, ops);
         rcu_read_unlock();
@@ -122,9 +120,10 @@ int nf_queue(struct sk_buff *skb,
         struct nf_queue_entry *entry = NULL;
         const struct nf_afinfo *afinfo;
         const struct nf_queue_handler *qh;
+        struct net *net = state->net;
 
         /* QUEUE == DROP if no one is waiting, to be safe. */
-        qh = rcu_dereference(queue_handler);
+        qh = rcu_dereference(net->nf.queue_handler);
         if (!qh) {
                 status = -ESRCH;
                 goto err;
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 4d292b933b5c..7b7aa871a174 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -2647,6 +2647,8 @@ static int nf_tables_getset(struct net *net, struct sock *nlsk,
         /* Only accept unspec with dump */
         if (nfmsg->nfgen_family == NFPROTO_UNSPEC)
                 return -EAFNOSUPPORT;
+        if (!nla[NFTA_SET_TABLE])
+                return -EINVAL;
 
         set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_NAME]);
         if (IS_ERR(set))
diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index aa93877ab6e2..5d36a0926b4a 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -557,7 +557,7 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue,
 
         if (entskb->tstamp.tv64) {
                 struct nfqnl_msg_packet_timestamp ts;
-                struct timespec64 kts = ktime_to_timespec64(skb->tstamp);
+                struct timespec64 kts = ktime_to_timespec64(entskb->tstamp);
 
                 ts.sec = cpu_to_be64(kts.tv_sec);
                 ts.usec = cpu_to_be64(kts.tv_nsec / NSEC_PER_USEC);
@@ -1482,21 +1482,29 @@ static int __net_init nfnl_queue_net_init(struct net *net)
                          net->nf.proc_netfilter, &nfqnl_file_ops))
                 return -ENOMEM;
 #endif
+        nf_register_queue_handler(net, &nfqh);
         return 0;
 }
 
 static void __net_exit nfnl_queue_net_exit(struct net *net)
 {
+        nf_unregister_queue_handler(net);
 #ifdef CONFIG_PROC_FS
         remove_proc_entry("nfnetlink_queue", net->nf.proc_netfilter);
 #endif
 }
 
+static void nfnl_queue_net_exit_batch(struct list_head *net_exit_list)
+{
+        synchronize_rcu();
+}
+
 static struct pernet_operations nfnl_queue_net_ops = {
-        .init   = nfnl_queue_net_init,
-        .exit   = nfnl_queue_net_exit,
-        .id     = &nfnl_queue_net_id,
-        .size   = sizeof(struct nfnl_queue_net),
+        .init           = nfnl_queue_net_init,
+        .exit           = nfnl_queue_net_exit,
+        .exit_batch     = nfnl_queue_net_exit_batch,
+        .id             = &nfnl_queue_net_id,
+        .size           = sizeof(struct nfnl_queue_net),
 };
 
 static int __init nfnetlink_queue_init(void)
@@ -1517,7 +1525,6 @@ static int __init nfnetlink_queue_init(void)
         }
 
         register_netdevice_notifier(&nfqnl_dev_notifier);
-        nf_register_queue_handler(&nfqh);
         return status;
 
 cleanup_netlink_notifier:
@@ -1529,7 +1536,6 @@ out:
 
 static void __exit nfnetlink_queue_fini(void)
 {
-        nf_unregister_queue_handler();
         unregister_netdevice_notifier(&nfqnl_dev_notifier);
         nfnetlink_subsys_unregister(&nfqnl_subsys);
         netlink_unregister_notifier(&nfqnl_rtnl_notifier);
diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index c69c892231d7..2675d580c490 100644
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -612,7 +612,7 @@ int xt_compat_check_entry_offsets(const void *base, const char *elems,
                 return -EINVAL;
 
         if (strcmp(t->u.user.name, XT_STANDARD_TARGET) == 0 &&
-            target_offset + sizeof(struct compat_xt_standard_target) != next_offset)
+            COMPAT_XT_ALIGN(target_offset + sizeof(struct compat_xt_standard_target)) != next_offset)
                 return -EINVAL;
 
         /* compat_xt_entry match has less strict aligment requirements,
@@ -694,7 +694,7 @@ int xt_check_entry_offsets(const void *base,
                 return -EINVAL;
 
         if (strcmp(t->u.user.name, XT_STANDARD_TARGET) == 0 &&
-            target_offset + sizeof(struct xt_standard_target) != next_offset)
+            XT_ALIGN(target_offset + sizeof(struct xt_standard_target)) != next_offset)
                 return -EINVAL;
 
         return xt_check_entry_match(elems, base + target_offset,
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 4040eb92d9c9..9bff6ef16fa7 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -93,6 +93,7 @@
 #include <net/inet_common.h>
 #endif
 #include <linux/bpf.h>
+#include <net/compat.h>
 
 #include "internal.h"
 
@@ -3940,6 +3941,27 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
 }
 
 
+#ifdef CONFIG_COMPAT
+static int compat_packet_setsockopt(struct socket *sock, int level, int optname,
+                                    char __user *optval, unsigned int optlen)
+{
+        struct packet_sock *po = pkt_sk(sock->sk);
+
+        if (level != SOL_PACKET)
+                return -ENOPROTOOPT;
+
+        if (optname == PACKET_FANOUT_DATA &&
+            po->fanout && po->fanout->type == PACKET_FANOUT_CBPF) {
+                optval = (char __user *)get_compat_bpf_fprog(optval);
+                if (!optval)
+                        return -EFAULT;
+                optlen = sizeof(struct sock_fprog);
+        }
+
+        return packet_setsockopt(sock, level, optname, optval, optlen);
+}
+#endif
+
 static int packet_notifier(struct notifier_block *this,
                            unsigned long msg, void *ptr)
 {
@@ -4416,6 +4438,9 @@ static const struct proto_ops packet_ops = {
         .shutdown =     sock_no_shutdown,
         .setsockopt =   packet_setsockopt,
         .getsockopt =   packet_getsockopt,
+#ifdef CONFIG_COMPAT
+        .compat_setsockopt = compat_packet_setsockopt,
+#endif
         .sendmsg =      packet_sendmsg,
         .recvmsg =      packet_recvmsg,
         .mmap =         packet_mmap,
diff --git a/net/rds/rds.h b/net/rds/rds.h
index 80256b08eac0..387df5f32e49 100644
--- a/net/rds/rds.h
+++ b/net/rds/rds.h
@@ -74,6 +74,7 @@ enum {
         RDS_CONN_CONNECTING,
         RDS_CONN_DISCONNECTING,
         RDS_CONN_UP,
+        RDS_CONN_RESETTING,
         RDS_CONN_ERROR,
 };
 
@@ -813,6 +814,7 @@ void rds_connect_worker(struct work_struct *);
 void rds_shutdown_worker(struct work_struct *);
 void rds_send_worker(struct work_struct *);
 void rds_recv_worker(struct work_struct *);
+void rds_connect_path_complete(struct rds_connection *conn, int curr);
 void rds_connect_complete(struct rds_connection *conn);
 
 /* transport.c */
diff --git a/net/rds/recv.c b/net/rds/recv.c
index c0be1ecd11c9..8413f6c99e13 100644
--- a/net/rds/recv.c
+++ b/net/rds/recv.c
@@ -561,5 +561,7 @@ void rds_inc_info_copy(struct rds_incoming *inc,
                 minfo.fport = inc->i_hdr.h_dport;
         }
 
+        minfo.flags = 0;
+
         rds_info_copy(iter, &minfo, sizeof(minfo));
 }
diff --git a/net/rds/send.c b/net/rds/send.c
index c9cdb358ea88..b1962f8e30f7 100644
--- a/net/rds/send.c
+++ b/net/rds/send.c
@@ -99,6 +99,7 @@ void rds_send_reset(struct rds_connection *conn)
         list_splice_init(&conn->c_retrans, &conn->c_send_queue);
         spin_unlock_irqrestore(&conn->c_lock, flags);
 }
+EXPORT_SYMBOL_GPL(rds_send_reset);
 
 static int acquire_in_xmit(struct rds_connection *conn)
 {
diff --git a/net/rds/tcp.c b/net/rds/tcp.c
index 86187dad1440..74ee126a6fe6 100644
--- a/net/rds/tcp.c
+++ b/net/rds/tcp.c
@@ -126,9 +126,81 @@ void rds_tcp_restore_callbacks(struct socket *sock,
 }
 
 /*
- * This is the only path that sets tc->t_sock.  Send and receive trust that
- * it is set.  The RDS_CONN_UP bit protects those paths from being
- * called while it isn't set.
+ * rds_tcp_reset_callbacks() switches the to the new sock and
+ * returns the existing tc->t_sock.
+ *
+ * The only functions that set tc->t_sock are rds_tcp_set_callbacks
+ * and rds_tcp_reset_callbacks.  Send and receive trust that
+ * it is set.  The absence of RDS_CONN_UP bit protects those paths
+ * from being called while it isn't set.
+ */
+void rds_tcp_reset_callbacks(struct socket *sock,
+                             struct rds_connection *conn)
+{
+        struct rds_tcp_connection *tc = conn->c_transport_data;
+        struct socket *osock = tc->t_sock;
+
+        if (!osock)
+                goto newsock;
+
+        /* Need to resolve a duelling SYN between peers.
+         * We have an outstanding SYN to this peer, which may
+         * potentially have transitioned to the RDS_CONN_UP state,
+         * so we must quiesce any send threads before resetting
+         * c_transport_data. We quiesce these threads by setting
+         * c_state to something other than RDS_CONN_UP, and then
+         * waiting for any existing threads in rds_send_xmit to
+         * complete release_in_xmit(). (Subsequent threads entering
+         * rds_send_xmit() will bail on !rds_conn_up().
+         *
+         * However an incoming syn-ack at this point would end up
+         * marking the conn as RDS_CONN_UP, and would again permit
+         * rds_send_xmi() threads through, so ideally we would
+         * synchronize on RDS_CONN_UP after lock_sock(), but cannot
+         * do that: waiting on !RDS_IN_XMIT after lock_sock() may
+         * end up deadlocking with tcp_sendmsg(), and the RDS_IN_XMIT
+         * would not get set. As a result, we set c_state to
+         * RDS_CONN_RESETTTING, to ensure that rds_tcp_state_change
+         * cannot mark rds_conn_path_up() in the window before lock_sock()
+         */
+        atomic_set(&conn->c_state, RDS_CONN_RESETTING);
+        wait_event(conn->c_waitq, !test_bit(RDS_IN_XMIT, &conn->c_flags));
+        lock_sock(osock->sk);
+        /* reset receive side state for rds_tcp_data_recv() for osock  */
+        if (tc->t_tinc) {
+                rds_inc_put(&tc->t_tinc->ti_inc);
+                tc->t_tinc = NULL;
+        }
+        tc->t_tinc_hdr_rem = sizeof(struct rds_header);
+        tc->t_tinc_data_rem = 0;
+        tc->t_sock = NULL;
+
+        write_lock_bh(&osock->sk->sk_callback_lock);
+
+        osock->sk->sk_user_data = NULL;
+        osock->sk->sk_data_ready = tc->t_orig_data_ready;
+        osock->sk->sk_write_space = tc->t_orig_write_space;
+        osock->sk->sk_state_change = tc->t_orig_state_change;
+        write_unlock_bh(&osock->sk->sk_callback_lock);
+        release_sock(osock->sk);
+        sock_release(osock);
+newsock:
+        rds_send_reset(conn);
+        lock_sock(sock->sk);
+        write_lock_bh(&sock->sk->sk_callback_lock);
+        tc->t_sock = sock;
+        sock->sk->sk_user_data = conn;
+        sock->sk->sk_data_ready = rds_tcp_data_ready;
+        sock->sk->sk_write_space = rds_tcp_write_space;
+        sock->sk->sk_state_change = rds_tcp_state_change;
+
+        write_unlock_bh(&sock->sk->sk_callback_lock);
+        release_sock(sock->sk);
+}
+
+/* Add tc to rds_tcp_tc_list and set tc->t_sock. See comments
+ * above rds_tcp_reset_callbacks for notes about synchronization
+ * with data path
  */
 void rds_tcp_set_callbacks(struct socket *sock, struct rds_connection *conn)
 {
diff --git a/net/rds/tcp.h b/net/rds/tcp.h
index 41c228300525..ec0602b0dc24 100644
--- a/net/rds/tcp.h
+++ b/net/rds/tcp.h
@@ -50,6 +50,7 @@ struct rds_tcp_statistics {
 void rds_tcp_tune(struct socket *sock);
 void rds_tcp_nonagle(struct socket *sock);
 void rds_tcp_set_callbacks(struct socket *sock, struct rds_connection *conn);
+void rds_tcp_reset_callbacks(struct socket *sock, struct rds_connection *conn);
 void rds_tcp_restore_callbacks(struct socket *sock,
                                struct rds_tcp_connection *tc);
 u32 rds_tcp_snd_nxt(struct rds_tcp_connection *tc);
diff --git a/net/rds/tcp_connect.c b/net/rds/tcp_connect.c
index fb82e0a0bf89..fba13d0305fb 100644
--- a/net/rds/tcp_connect.c
+++ b/net/rds/tcp_connect.c
@@ -60,7 +60,7 @@ void rds_tcp_state_change(struct sock *sk)
                 case TCP_SYN_RECV:
                         break;
                 case TCP_ESTABLISHED:
-                        rds_connect_complete(conn);
+                        rds_connect_path_complete(conn, RDS_CONN_CONNECTING);
                         break;
                 case TCP_CLOSE_WAIT:
                 case TCP_CLOSE:
diff --git a/net/rds/tcp_listen.c b/net/rds/tcp_listen.c
index 4bf4befe5066..686b1d03a558 100644
--- a/net/rds/tcp_listen.c
+++ b/net/rds/tcp_listen.c
@@ -78,7 +78,6 @@ int rds_tcp_accept_one(struct socket *sock)
         struct inet_sock *inet;
         struct rds_tcp_connection *rs_tcp = NULL;
         int conn_state;
-        struct sock *nsk;
 
         if (!sock) /* module unload or netns delete in progress */
                 return -ENETUNREACH;
@@ -136,26 +135,21 @@ int rds_tcp_accept_one(struct socket *sock)
                     !conn->c_outgoing) {
                         goto rst_nsk;
                 } else {
-                        atomic_set(&conn->c_state, RDS_CONN_CONNECTING);
-                        wait_event(conn->c_waitq,
-                                   !test_bit(RDS_IN_XMIT, &conn->c_flags));
-                        rds_tcp_restore_callbacks(rs_tcp->t_sock, rs_tcp);
+                        rds_tcp_reset_callbacks(new_sock, conn);
                         conn->c_outgoing = 0;
+                        /* rds_connect_path_complete() marks RDS_CONN_UP */
+                        rds_connect_path_complete(conn, RDS_CONN_DISCONNECTING);
                 }
+        } else {
+                rds_tcp_set_callbacks(new_sock, conn);
+                rds_connect_path_complete(conn, RDS_CONN_CONNECTING);
         }
-        rds_tcp_set_callbacks(new_sock, conn);
-        rds_connect_complete(conn); /* marks RDS_CONN_UP */
         new_sock = NULL;
         ret = 0;
         goto out;
 rst_nsk:
         /* reset the newly returned accept sock and bail */
-        nsk = new_sock->sk;
-        rds_tcp_stats_inc(s_tcp_listen_closed_stale);
-        nsk->sk_user_data = NULL;
-        nsk->sk_prot->disconnect(nsk, 0);
-        tcp_done(nsk);
-        new_sock = NULL;
+        kernel_sock_shutdown(new_sock, SHUT_RDWR);
         ret = 0;
 out:
         if (rs_tcp)
diff --git a/net/rds/threads.c b/net/rds/threads.c
index 454aa6d23327..4a323045719b 100644
--- a/net/rds/threads.c
+++ b/net/rds/threads.c
@@ -71,9 +71,9 @@
 struct workqueue_struct *rds_wq;
 EXPORT_SYMBOL_GPL(rds_wq);
 
-void rds_connect_complete(struct rds_connection *conn)
+void rds_connect_path_complete(struct rds_connection *conn, int curr)
 {
-        if (!rds_conn_transition(conn, RDS_CONN_CONNECTING, RDS_CONN_UP)) {
+        if (!rds_conn_transition(conn, curr, RDS_CONN_UP)) {
                 printk(KERN_WARNING "%s: Cannot transition to state UP, "
                                 "current state is %d\n",
                                 __func__,
@@ -90,6 +90,12 @@ void rds_connect_complete(struct rds_connection *conn)
         queue_delayed_work(rds_wq, &conn->c_send_w, 0);
         queue_delayed_work(rds_wq, &conn->c_recv_w, 0);
 }
+EXPORT_SYMBOL_GPL(rds_connect_path_complete);
+
+void rds_connect_complete(struct rds_connection *conn)
+{
+        rds_connect_path_complete(conn, RDS_CONN_CONNECTING);
+}
 EXPORT_SYMBOL_GPL(rds_connect_complete);
 
 /*
diff --git a/net/rxrpc/rxkad.c b/net/rxrpc/rxkad.c
index 6b726a046a7d..bab56ed649ba 100644
--- a/net/rxrpc/rxkad.c
+++ b/net/rxrpc/rxkad.c
@@ -1162,9 +1162,7 @@ static int rxkad_init(void)
         /* pin the cipher we need so that the crypto layer doesn't invoke
          * keventd to go get it */
         rxkad_ci = crypto_alloc_skcipher("pcbc(fcrypt)", 0, CRYPTO_ALG_ASYNC);
-        if (IS_ERR(rxkad_ci))
-                return PTR_ERR(rxkad_ci);
-        return 0;
+        return PTR_ERR_OR_ZERO(rxkad_ci);
 }
 
 /*
diff --git a/net/sched/act_police.c b/net/sched/act_police.c
index b884dae692a1..c557789765dc 100644
--- a/net/sched/act_police.c
+++ b/net/sched/act_police.c
@@ -38,7 +38,7 @@ struct tcf_police {
         bool                    peak_present;
 };
 #define to_police(pc)   \
-        container_of(pc, struct tcf_police, common)
+        container_of(pc->priv, struct tcf_police, common)
 
 #define POL_TAB_MASK     15
 
@@ -119,14 +119,12 @@ static int tcf_act_police_locate(struct net *net, struct nlattr *nla,
                                  struct nlattr *est, struct tc_action *a,
                                  int ovr, int bind)
 {
-        unsigned int h;
         int ret = 0, err;
         struct nlattr *tb[TCA_POLICE_MAX + 1];
         struct tc_police *parm;
         struct tcf_police *police;
         struct qdisc_rate_table *R_tab = NULL, *P_tab = NULL;
         struct tc_action_net *tn = net_generic(net, police_net_id);
-        struct tcf_hashinfo *hinfo = tn->hinfo;
         int size;
 
         if (nla == NULL)
@@ -145,7 +143,7 @@ static int tcf_act_police_locate(struct net *net, struct nlattr *nla,
 
         if (parm->index) {
                 if (tcf_hash_search(tn, a, parm->index)) {
-                        police = to_police(a->priv);
+                        police = to_police(a);
                         if (bind) {
                                 police->tcf_bindcnt += 1;
                                 police->tcf_refcnt += 1;
@@ -156,16 +154,15 @@ static int tcf_act_police_locate(struct net *net, struct nlattr *nla,
                         /* not replacing */
                         return -EEXIST;
                 }
+        } else {
+                ret = tcf_hash_create(tn, parm->index, NULL, a,
+                                      sizeof(*police), bind, false);
+                if (ret)
+                        return ret;
+                ret = ACT_P_CREATED;
         }
 
-        police = kzalloc(sizeof(*police), GFP_KERNEL);
-        if (police == NULL)
-                return -ENOMEM;
-        ret = ACT_P_CREATED;
-        police->tcf_refcnt = 1;
-        spin_lock_init(&police->tcf_lock);
-        if (bind)
-                police->tcf_bindcnt = 1;
+        police = to_police(a);
 override:
         if (parm->rate.rate) {
                 err = -ENOMEM;
@@ -237,16 +234,8 @@ override:
                 return ret;
 
         police->tcfp_t_c = ktime_get_ns();
-        police->tcf_index = parm->index ? parm->index :
-                tcf_hash_new_index(tn);
-        police->tcf_tm.install = jiffies;
-        police->tcf_tm.lastuse = jiffies;
-        h = tcf_hash(police->tcf_index, POL_TAB_MASK);
-        spin_lock_bh(&hinfo->lock);
-        hlist_add_head(&police->tcf_head, &hinfo->htab[h]);
-        spin_unlock_bh(&hinfo->lock);
+        tcf_hash_insert(tn, a);
 
-        a->priv = police;
         return ret;
 
 failure_unlock:
@@ -255,7 +244,7 @@ failure:
         qdisc_put_rtab(P_tab);
         qdisc_put_rtab(R_tab);
         if (ret == ACT_P_CREATED)
-                kfree(police);
+                tcf_hash_cleanup(a, est);
         return err;
 }
 
diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c
index 730aacafc22d..b3b7978f4182 100644
--- a/net/sched/cls_flower.c
+++ b/net/sched/cls_flower.c
@@ -171,7 +171,7 @@ static void fl_hw_destroy_filter(struct tcf_proto *tp, unsigned long cookie)
         struct tc_cls_flower_offload offload = {0};
         struct tc_to_netdev tc;
 
-        if (!tc_should_offload(dev, 0))
+        if (!tc_should_offload(dev, tp, 0))
                 return;
 
         offload.command = TC_CLSFLOWER_DESTROY;
@@ -194,7 +194,7 @@ static void fl_hw_replace_filter(struct tcf_proto *tp,
         struct tc_cls_flower_offload offload = {0};
         struct tc_to_netdev tc;
 
-        if (!tc_should_offload(dev, flags))
+        if (!tc_should_offload(dev, tp, flags))
                 return;
 
         offload.command = TC_CLSFLOWER_REPLACE;
@@ -216,7 +216,7 @@ static void fl_hw_update_stats(struct tcf_proto *tp, struct cls_fl_filter *f)
         struct tc_cls_flower_offload offload = {0};
         struct tc_to_netdev tc;
 
-        if (!tc_should_offload(dev, 0))
+        if (!tc_should_offload(dev, tp, 0))
                 return;
 
         offload.command = TC_CLSFLOWER_STATS;
diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c
index 079b43b3c5d2..ffe593efe930 100644
--- a/net/sched/cls_u32.c
+++ b/net/sched/cls_u32.c
@@ -440,7 +440,7 @@ static void u32_remove_hw_knode(struct tcf_proto *tp, u32 handle)
         offload.type = TC_SETUP_CLSU32;
         offload.cls_u32 = &u32_offload;
 
-        if (tc_should_offload(dev, 0)) {
+        if (tc_should_offload(dev, tp, 0)) {
                 offload.cls_u32->command = TC_CLSU32_DELETE_KNODE;
                 offload.cls_u32->knode.handle = handle;
                 dev->netdev_ops->ndo_setup_tc(dev, tp->q->handle,
@@ -457,20 +457,21 @@ static int u32_replace_hw_hnode(struct tcf_proto *tp,
         struct tc_to_netdev offload;
         int err;
 
+        if (!tc_should_offload(dev, tp, flags))
+                return tc_skip_sw(flags) ? -EINVAL : 0;
+
         offload.type = TC_SETUP_CLSU32;
         offload.cls_u32 = &u32_offload;
 
-        if (tc_should_offload(dev, flags)) {
-                offload.cls_u32->command = TC_CLSU32_NEW_HNODE;
-                offload.cls_u32->hnode.divisor = h->divisor;
-                offload.cls_u32->hnode.handle = h->handle;
-                offload.cls_u32->hnode.prio = h->prio;
+        offload.cls_u32->command = TC_CLSU32_NEW_HNODE;
+        offload.cls_u32->hnode.divisor = h->divisor;
+        offload.cls_u32->hnode.handle = h->handle;
+        offload.cls_u32->hnode.prio = h->prio;
 
-                err = dev->netdev_ops->ndo_setup_tc(dev, tp->q->handle,
-                                                    tp->protocol, &offload);
-                if (tc_skip_sw(flags))
-                        return err;
-        }
+        err = dev->netdev_ops->ndo_setup_tc(dev, tp->q->handle,
+                                            tp->protocol, &offload);
+        if (tc_skip_sw(flags))
+                return err;
 
         return 0;
 }
@@ -484,7 +485,7 @@ static void u32_clear_hw_hnode(struct tcf_proto *tp, struct tc_u_hnode *h)
         offload.type = TC_SETUP_CLSU32;
         offload.cls_u32 = &u32_offload;
 
-        if (tc_should_offload(dev, 0)) {
+        if (tc_should_offload(dev, tp, 0)) {
                 offload.cls_u32->command = TC_CLSU32_DELETE_HNODE;
                 offload.cls_u32->hnode.divisor = h->divisor;
                 offload.cls_u32->hnode.handle = h->handle;
@@ -507,27 +508,28 @@ static int u32_replace_hw_knode(struct tcf_proto *tp,
         offload.type = TC_SETUP_CLSU32;
         offload.cls_u32 = &u32_offload;
 
-        if (tc_should_offload(dev, flags)) {
-                offload.cls_u32->command = TC_CLSU32_REPLACE_KNODE;
-                offload.cls_u32->knode.handle = n->handle;
-                offload.cls_u32->knode.fshift = n->fshift;
+        if (!tc_should_offload(dev, tp, flags))
+                return tc_skip_sw(flags) ? -EINVAL : 0;
+
+        offload.cls_u32->command = TC_CLSU32_REPLACE_KNODE;
+        offload.cls_u32->knode.handle = n->handle;
+        offload.cls_u32->knode.fshift = n->fshift;
 #ifdef CONFIG_CLS_U32_MARK
-                offload.cls_u32->knode.val = n->val;
-                offload.cls_u32->knode.mask = n->mask;
+        offload.cls_u32->knode.val = n->val;
+        offload.cls_u32->knode.mask = n->mask;
 #else
-                offload.cls_u32->knode.val = 0;
-                offload.cls_u32->knode.mask = 0;
+        offload.cls_u32->knode.val = 0;
+        offload.cls_u32->knode.mask = 0;
 #endif
-                offload.cls_u32->knode.sel = &n->sel;
-                offload.cls_u32->knode.exts = &n->exts;
-                if (n->ht_down)
-                        offload.cls_u32->knode.link_handle = n->ht_down->handle;
-
-                err = dev->netdev_ops->ndo_setup_tc(dev, tp->q->handle,
-                                                    tp->protocol, &offload);
-                if (tc_skip_sw(flags))
-                        return err;
-        }
+        offload.cls_u32->knode.sel = &n->sel;
+        offload.cls_u32->knode.exts = &n->exts;
+        if (n->ht_down)
+                offload.cls_u32->knode.link_handle = n->ht_down->handle;
+
+        err = dev->netdev_ops->ndo_setup_tc(dev, tp->q->handle,
+                                            tp->protocol, &offload);
+        if (tc_skip_sw(flags))
+                return err;
 
         return 0;
 }
@@ -863,7 +865,7 @@ static int u32_change(struct net *net, struct sk_buff *in_skb,
         if (tb[TCA_U32_FLAGS]) {
                 flags = nla_get_u32(tb[TCA_U32_FLAGS]);
                 if (!tc_flags_valid(flags))
-                        return err;
+                        return -EINVAL;
         }
 
         n = (struct tc_u_knode *)*arg;
@@ -921,11 +923,17 @@ static int u32_change(struct net *net, struct sk_buff *in_skb,
                 ht->divisor = divisor;
                 ht->handle = handle;
                 ht->prio = tp->prio;
+
+                err = u32_replace_hw_hnode(tp, ht, flags);
+                if (err) {
+                        kfree(ht);
+                        return err;
+                }
+
                 RCU_INIT_POINTER(ht->next, tp_c->hlist);
                 rcu_assign_pointer(tp_c->hlist, ht);
                 *arg = (unsigned long)ht;
 
-                u32_replace_hw_hnode(tp, ht, flags);
                 return 0;
         }
 
diff --git a/net/sched/sch_drr.c b/net/sched/sch_drr.c
index a63e879e8975..bf8af2c43c2c 100644
--- a/net/sched/sch_drr.c
+++ b/net/sched/sch_drr.c
@@ -375,6 +375,7 @@ static int drr_enqueue(struct sk_buff *skb, struct Qdisc *sch)
                 cl->deficit = cl->quantum;
         }
 
+        qdisc_qstats_backlog_inc(sch, skb);
         sch->q.qlen++;
         return err;
 }
@@ -407,6 +408,7 @@ static struct sk_buff *drr_dequeue(struct Qdisc *sch)
 
                         bstats_update(&cl->bstats, skb);
                         qdisc_bstats_update(sch, skb);
+                        qdisc_qstats_backlog_dec(sch, skb);
                         sch->q.qlen--;
                         return skb;
                 }
@@ -428,6 +430,7 @@ static unsigned int drr_drop(struct Qdisc *sch)
                 if (cl->qdisc->ops->drop) {
                         len = cl->qdisc->ops->drop(cl->qdisc);
                         if (len > 0) {
+                                sch->qstats.backlog -= len;
                                 sch->q.qlen--;
                                 if (cl->qdisc->q.qlen == 0)
                                         list_del(&cl->alist);
@@ -463,6 +466,7 @@ static void drr_reset_qdisc(struct Qdisc *sch)
                         qdisc_reset(cl->qdisc);
                 }
         }
+        sch->qstats.backlog = 0;
         sch->q.qlen = 0;
 }
 
diff --git a/net/sched/sch_fq_codel.c b/net/sched/sch_fq_codel.c
index 6883a8971562..da250b2e06ae 100644
--- a/net/sched/sch_fq_codel.c
+++ b/net/sched/sch_fq_codel.c
@@ -199,6 +199,7 @@ static int fq_codel_enqueue(struct sk_buff *skb, struct Qdisc *sch)
         unsigned int idx, prev_backlog, prev_qlen;
         struct fq_codel_flow *flow;
         int uninitialized_var(ret);
+        unsigned int pkt_len;
         bool memory_limited;
 
         idx = fq_codel_classify(skb, sch, &ret);
@@ -230,6 +231,8 @@ static int fq_codel_enqueue(struct sk_buff *skb, struct Qdisc *sch)
         prev_backlog = sch->qstats.backlog;
         prev_qlen = sch->q.qlen;
 
+        /* save this packet length as it might be dropped by fq_codel_drop() */
+        pkt_len = qdisc_pkt_len(skb);
         /* fq_codel_drop() is quite expensive, as it performs a linear search
          * in q->backlogs[] to find a fat flow.
          * So instead of dropping a single packet, drop half of its backlog
@@ -237,14 +240,23 @@ static int fq_codel_enqueue(struct sk_buff *skb, struct Qdisc *sch)
          */
         ret = fq_codel_drop(sch, q->drop_batch_size);
 
-        q->drop_overlimit += prev_qlen - sch->q.qlen;
+        prev_qlen -= sch->q.qlen;
+        prev_backlog -= sch->qstats.backlog;
+        q->drop_overlimit += prev_qlen;
         if (memory_limited)
-                q->drop_overmemory += prev_qlen - sch->q.qlen;
-        /* As we dropped packet(s), better let upper stack know this */
-        qdisc_tree_reduce_backlog(sch, prev_qlen - sch->q.qlen,
-                                  prev_backlog - sch->qstats.backlog);
+                q->drop_overmemory += prev_qlen;
 
-        return ret == idx ? NET_XMIT_CN : NET_XMIT_SUCCESS;
+        /* As we dropped packet(s), better let upper stack know this.
+         * If we dropped a packet for this flow, return NET_XMIT_CN,
+         * but in this case, our parents wont increase their backlogs.
+         */
+        if (ret == idx) {
+                qdisc_tree_reduce_backlog(sch, prev_qlen - 1,
+                                          prev_backlog - pkt_len);
+                return NET_XMIT_CN;
+        }
+        qdisc_tree_reduce_backlog(sch, prev_qlen, prev_backlog);
+        return NET_XMIT_SUCCESS;
 }
 
 /* This is the specific function called from codel_dequeue()
@@ -649,7 +661,7 @@ static int fq_codel_dump_class_stats(struct Qdisc *sch, unsigned long cl,
                 qs.backlog = q->backlogs[idx];
                 qs.drops = flow->dropped;
         }
-        if (gnet_stats_copy_queue(d, NULL, &qs, 0) < 0)
+        if (gnet_stats_copy_queue(d, NULL, &qs, qs.qlen) < 0)
                 return -1;
         if (idx < q->flows_cnt)
                 return gnet_stats_copy_app(d, &xstats, sizeof(xstats));
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index 269dd71b3828..f9e0e9c03d0a 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -49,6 +49,7 @@ static inline int dev_requeue_skb(struct sk_buff *skb, struct Qdisc *q)
 {
         q->gso_skb = skb;
         q->qstats.requeues++;
+        qdisc_qstats_backlog_inc(q, skb);
         q->q.qlen++;    /* it's still part of the queue */
         __netif_schedule(q);
 
@@ -92,6 +93,7 @@ static struct sk_buff *dequeue_skb(struct Qdisc *q, bool *validate,
                 txq = skb_get_tx_queue(txq->dev, skb);
                 if (!netif_xmit_frozen_or_stopped(txq)) {
                         q->gso_skb = NULL;
+                        qdisc_qstats_backlog_dec(q, skb);
                         q->q.qlen--;
                 } else
                         skb = NULL;
diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c
index d783d7cc3348..1ac9f9f03fe3 100644
--- a/net/sched/sch_hfsc.c
+++ b/net/sched/sch_hfsc.c
@@ -1529,6 +1529,7 @@ hfsc_reset_qdisc(struct Qdisc *sch)
         q->eligible = RB_ROOT;
         INIT_LIST_HEAD(&q->droplist);
         qdisc_watchdog_cancel(&q->watchdog);
+        sch->qstats.backlog = 0;
         sch->q.qlen = 0;
 }
 
@@ -1559,14 +1560,6 @@ hfsc_dump_qdisc(struct Qdisc *sch, struct sk_buff *skb)
         struct hfsc_sched *q = qdisc_priv(sch);
         unsigned char *b = skb_tail_pointer(skb);
         struct tc_hfsc_qopt qopt;
-        struct hfsc_class *cl;
-        unsigned int i;
-
-        sch->qstats.backlog = 0;
-        for (i = 0; i < q->clhash.hashsize; i++) {
-                hlist_for_each_entry(cl, &q->clhash.hash[i], cl_common.hnode)
-                        sch->qstats.backlog += cl->qdisc->qstats.backlog;
-        }
 
         qopt.defcls = q->defcls;
         if (nla_put(skb, TCA_OPTIONS, sizeof(qopt), &qopt))
@@ -1604,6 +1597,7 @@ hfsc_enqueue(struct sk_buff *skb, struct Qdisc *sch)
         if (cl->qdisc->q.qlen == 1)
                 set_active(cl, qdisc_pkt_len(skb));
 
+        qdisc_qstats_backlog_inc(sch, skb);
         sch->q.qlen++;
 
         return NET_XMIT_SUCCESS;
@@ -1672,6 +1666,7 @@ hfsc_dequeue(struct Qdisc *sch)
 
         qdisc_unthrottled(sch);
         qdisc_bstats_update(sch, skb);
+        qdisc_qstats_backlog_dec(sch, skb);
         sch->q.qlen--;
 
         return skb;
@@ -1695,6 +1690,7 @@ hfsc_drop(struct Qdisc *sch)
                         }
                         cl->qstats.drops++;
                         qdisc_qstats_drop(sch);
+                        sch->qstats.backlog -= len;
                         sch->q.qlen--;
                         return len;
                 }
diff --git a/net/sched/sch_ingress.c b/net/sched/sch_ingress.c
index 10adbc617905..8fe6999b642a 100644
--- a/net/sched/sch_ingress.c
+++ b/net/sched/sch_ingress.c
@@ -27,6 +27,11 @@ static unsigned long ingress_get(struct Qdisc *sch, u32 classid)
         return TC_H_MIN(classid) + 1;
 }
 
+static bool ingress_cl_offload(u32 classid)
+{
+        return true;
+}
+
 static unsigned long ingress_bind_filter(struct Qdisc *sch,
                                          unsigned long parent, u32 classid)
 {
@@ -86,6 +91,7 @@ static const struct Qdisc_class_ops ingress_class_ops = {
         .put            =       ingress_put,
         .walk           =       ingress_walk,
         .tcf_chain      =       ingress_find_tcf,
+        .tcf_cl_offload =       ingress_cl_offload,
         .bind_tcf       =       ingress_bind_filter,
         .unbind_tcf     =       ingress_put,
 };
@@ -110,6 +116,11 @@ static unsigned long clsact_get(struct Qdisc *sch, u32 classid)
         }
 }
 
+static bool clsact_cl_offload(u32 classid)
+{
+        return TC_H_MIN(classid) == TC_H_MIN(TC_H_MIN_INGRESS);
+}
+
 static unsigned long clsact_bind_filter(struct Qdisc *sch,
                                         unsigned long parent, u32 classid)
 {
@@ -158,6 +169,7 @@ static const struct Qdisc_class_ops clsact_class_ops = {
         .put            =       ingress_put,
         .walk           =       ingress_walk,
         .tcf_chain      =       clsact_find_tcf,
+        .tcf_cl_offload =       clsact_cl_offload,
         .bind_tcf       =       clsact_bind_filter,
         .unbind_tcf     =       ingress_put,
 };
diff --git a/net/sched/sch_prio.c b/net/sched/sch_prio.c
index fee1b15506b2..4b0a82191bc4 100644
--- a/net/sched/sch_prio.c
+++ b/net/sched/sch_prio.c
@@ -85,6 +85,7 @@ prio_enqueue(struct sk_buff *skb, struct Qdisc *sch)
 
         ret = qdisc_enqueue(skb, qdisc);
         if (ret == NET_XMIT_SUCCESS) {
+                qdisc_qstats_backlog_inc(sch, skb);
                 sch->q.qlen++;
                 return NET_XMIT_SUCCESS;
         }
@@ -117,6 +118,7 @@ static struct sk_buff *prio_dequeue(struct Qdisc *sch)
                 struct sk_buff *skb = qdisc_dequeue_peeked(qdisc);
                 if (skb) {
                         qdisc_bstats_update(sch, skb);
+                        qdisc_qstats_backlog_dec(sch, skb);
                         sch->q.qlen--;
                         return skb;
                 }
@@ -135,6 +137,7 @@ static unsigned int prio_drop(struct Qdisc *sch)
         for (prio = q->bands-1; prio >= 0; prio--) {
                 qdisc = q->queues[prio];
                 if (qdisc->ops->drop && (len = qdisc->ops->drop(qdisc)) != 0) {
+                        sch->qstats.backlog -= len;
                         sch->q.qlen--;
                         return len;
                 }
@@ -151,6 +154,7 @@ prio_reset(struct Qdisc *sch)
 
         for (prio = 0; prio < q->bands; prio++)
                 qdisc_reset(q->queues[prio]);
+        sch->qstats.backlog = 0;
         sch->q.qlen = 0;
 }
 
diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c
index 8d2d8d953432..f18857febdad 100644
--- a/net/sched/sch_qfq.c
+++ b/net/sched/sch_qfq.c
@@ -1235,8 +1235,10 @@ static int qfq_enqueue(struct sk_buff *skb, struct Qdisc *sch)
                          cl->agg->lmax, qdisc_pkt_len(skb), cl->common.classid);
                 err = qfq_change_agg(sch, cl, cl->agg->class_weight,
                                      qdisc_pkt_len(skb));
-                if (err)
-                        return err;
+                if (err) {
+                        cl->qstats.drops++;
+                        return qdisc_drop(skb, sch);
+                }
         }
 
         err = qdisc_enqueue(skb, cl->qdisc);
diff --git a/net/sched/sch_red.c b/net/sched/sch_red.c
index 8c0508c0e287..91578bdd378c 100644
--- a/net/sched/sch_red.c
+++ b/net/sched/sch_red.c
@@ -97,6 +97,7 @@ static int red_enqueue(struct sk_buff *skb, struct Qdisc *sch)
 
         ret = qdisc_enqueue(skb, child);
         if (likely(ret == NET_XMIT_SUCCESS)) {
+                qdisc_qstats_backlog_inc(sch, skb);
                 sch->q.qlen++;
         } else if (net_xmit_drop_count(ret)) {
                 q->stats.pdrop++;
@@ -118,6 +119,7 @@ static struct sk_buff *red_dequeue(struct Qdisc *sch)
         skb = child->dequeue(child);
         if (skb) {
                 qdisc_bstats_update(sch, skb);
+                qdisc_qstats_backlog_dec(sch, skb);
                 sch->q.qlen--;
         } else {
                 if (!red_is_idling(&q->vars))
@@ -143,6 +145,7 @@ static unsigned int red_drop(struct Qdisc *sch)
         if (child->ops->drop && (len = child->ops->drop(child)) > 0) {
                 q->stats.other++;
                 qdisc_qstats_drop(sch);
+                sch->qstats.backlog -= len;
                 sch->q.qlen--;
                 return len;
         }
@@ -158,6 +161,7 @@ static void red_reset(struct Qdisc *sch)
         struct red_sched_data *q = qdisc_priv(sch);
 
         qdisc_reset(q->qdisc);
+        sch->qstats.backlog = 0;
         sch->q.qlen = 0;
         red_restart(&q->vars);
 }
diff --git a/net/sched/sch_tbf.c b/net/sched/sch_tbf.c
index 83b90b584fae..3161e491990b 100644
--- a/net/sched/sch_tbf.c
+++ b/net/sched/sch_tbf.c
@@ -207,6 +207,7 @@ static int tbf_enqueue(struct sk_buff *skb, struct Qdisc *sch)
                 return ret;
         }
 
+        qdisc_qstats_backlog_inc(sch, skb);
         sch->q.qlen++;
         return NET_XMIT_SUCCESS;
 }
@@ -217,6 +218,7 @@ static unsigned int tbf_drop(struct Qdisc *sch)
         unsigned int len = 0;
 
         if (q->qdisc->ops->drop && (len = q->qdisc->ops->drop(q->qdisc)) != 0) {
+                sch->qstats.backlog -= len;
                 sch->q.qlen--;
                 qdisc_qstats_drop(sch);
         }
@@ -263,6 +265,7 @@ static struct sk_buff *tbf_dequeue(struct Qdisc *sch)
                         q->t_c = now;
                         q->tokens = toks;
                         q->ptokens = ptoks;
+                        qdisc_qstats_backlog_dec(sch, skb);
                         sch->q.qlen--;
                         qdisc_unthrottled(sch);
                         qdisc_bstats_update(sch, skb);
@@ -294,6 +297,7 @@ static void tbf_reset(struct Qdisc *sch)
         struct tbf_sched_data *q = qdisc_priv(sch);
 
         qdisc_reset(q->qdisc);
+        sch->qstats.backlog = 0;
         sch->q.qlen = 0;
         q->t_c = ktime_get_ns();
         q->tokens = q->buffer;
diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c
index f795b1dd0ccd..3ad9fab1985f 100644
--- a/net/tipc/netlink_compat.c
+++ b/net/tipc/netlink_compat.c
@@ -604,7 +604,8 @@ static int tipc_nl_compat_link_dump(struct tipc_nl_compat_msg *msg,
 
         link_info.dest = nla_get_flag(link[TIPC_NLA_LINK_DEST]);
         link_info.up = htonl(nla_get_flag(link[TIPC_NLA_LINK_UP]));
-        strcpy(link_info.str, nla_data(link[TIPC_NLA_LINK_NAME]));
+        nla_strlcpy(link_info.str, nla_data(link[TIPC_NLA_LINK_NAME]),
+                    TIPC_MAX_LINK_NAME);
 
         return tipc_add_tlv(msg->rep, TIPC_TLV_LINK_INFO,
                             &link_info, sizeof(link_info));
diff --git a/net/wireless/core.c b/net/wireless/core.c
index d25c82bc1bbe..ecca3896b9f7 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -363,8 +363,6 @@ struct wiphy *wiphy_new_nm(const struct cfg80211_ops *ops, int sizeof_priv,
         WARN_ON(ops->remain_on_channel && !ops->cancel_remain_on_channel);
         WARN_ON(ops->tdls_channel_switch && !ops->tdls_cancel_channel_switch);
         WARN_ON(ops->add_tx_ts && !ops->del_tx_ts);
-        WARN_ON(ops->set_tx_power && !ops->get_tx_power);
-        WARN_ON(ops->set_antenna && !ops->get_antenna);
 
         alloc_size = sizeof(*rdev) + sizeof_priv;
 
diff --git a/net/wireless/wext-core.c b/net/wireless/wext-core.c
index 6250b1cfcde5..dbb2738e356a 100644
--- a/net/wireless/wext-core.c
+++ b/net/wireless/wext-core.c
@@ -958,8 +958,29 @@ static int wireless_process_ioctl(struct net *net, struct ifreq *ifr,
                         return private(dev, iwr, cmd, info, handler);
         }
         /* Old driver API : call driver ioctl handler */
-        if (dev->netdev_ops->ndo_do_ioctl)
-                return dev->netdev_ops->ndo_do_ioctl(dev, ifr, cmd);
+        if (dev->netdev_ops->ndo_do_ioctl) {
+#ifdef CONFIG_COMPAT
+                if (info->flags & IW_REQUEST_FLAG_COMPAT) {
+                        int ret = 0;
+                        struct iwreq iwr_lcl;
+                        struct compat_iw_point *iwp_compat = (void *) &iwr->u.data;
+
+                        memcpy(&iwr_lcl, iwr, sizeof(struct iwreq));
+                        iwr_lcl.u.data.pointer = compat_ptr(iwp_compat->pointer);
+                        iwr_lcl.u.data.length = iwp_compat->length;
+                        iwr_lcl.u.data.flags = iwp_compat->flags;
+
+                        ret = dev->netdev_ops->ndo_do_ioctl(dev, (void *) &iwr_lcl, cmd);
+
+                        iwp_compat->pointer = ptr_to_compat(iwr_lcl.u.data.pointer);
+                        iwp_compat->length = iwr_lcl.u.data.length;
+                        iwp_compat->flags = iwr_lcl.u.data.flags;
+
+                        return ret;
+                } else
+#endif
+                        return dev->netdev_ops->ndo_do_ioctl(dev, ifr, cmd);
+        }
         return -EOPNOTSUPP;
 }
 
diff --git a/tools/testing/selftests/net/reuseport_bpf.c b/tools/testing/selftests/net/reuseport_bpf.c
index 96ba386b1b7b..4a8217448f20 100644
--- a/tools/testing/selftests/net/reuseport_bpf.c
+++ b/tools/testing/selftests/net/reuseport_bpf.c
@@ -111,9 +111,9 @@ static void attach_ebpf(int fd, uint16_t mod)
         memset(&attr, 0, sizeof(attr));
         attr.prog_type = BPF_PROG_TYPE_SOCKET_FILTER;
         attr.insn_cnt = ARRAY_SIZE(prog);
-        attr.insns = (uint64_t)prog;
-        attr.license = (uint64_t)bpf_license;
-        attr.log_buf = (uint64_t)bpf_log_buf;
+        attr.insns = (unsigned long) &prog;
+        attr.license = (unsigned long) &bpf_license;
+        attr.log_buf = (unsigned long) &bpf_log_buf;
         attr.log_size = sizeof(bpf_log_buf);
         attr.log_level = 1;
         attr.kern_version = 0;
@@ -351,8 +351,8 @@ static void test_filter_no_reuseport(const struct test_params p)
         memset(&eprog, 0, sizeof(eprog));
         eprog.prog_type = BPF_PROG_TYPE_SOCKET_FILTER;
         eprog.insn_cnt = ARRAY_SIZE(ecode);
-        eprog.insns = (uint64_t)ecode;
-        eprog.license = (uint64_t)bpf_license;
+        eprog.insns = (unsigned long) &ecode;
+        eprog.license = (unsigned long) &bpf_license;
         eprog.kern_version = 0;
 
         memset(&cprog, 0, sizeof(cprog));