Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Pull networking fixes from David Miller: "Lots of fixes, here goes: 1) NULL deref in qtnfmac, from Gustavo A. R. Silva. 2) Kernel oops when fw download fails in rtlwifi, from Ping-Ke Shih. 3) Lost completion messages in AF_XDP, from Magnus Karlsson. 4) Correct bogus self-assignment in rhashtable, from Rishabh Bhatnagar. 5) Fix regression in ipv6 route append handling, from David Ahern. 6) Fix masking in __set_phy_supported(), from Heiner Kallweit. 7) Missing module owner set in x_tables icmp, from Florian Westphal. 8) liquidio's timeouts are HZ dependent, fix from Nicholas Mc Guire. 9) Link setting fixes for sh_eth and ravb, from Vladimir Zapolskiy. 10) Fix NULL deref when using chains in act_csum, from Davide Caratti. 11) XDP_REDIRECT needs to check if the interface is up and whether the MTU is sufficient. From Toshiaki Makita. 12) Net diag can do a double free when killing TCP_NEW_SYN_RECV connections, from Lorenzo Colitti. 13) nf_defrag in ipv6 can unnecessarily hold onto dst entries for a full minute, delaying device unregister. From Eric Dumazet. 14) Update MAC entries in the correct order in ixgbe, from Alexander Duyck. 15) Don't leave partial mangles bpf program in jit_subprogs, from Daniel Borkmann. 16) Fix pfmemalloc SKB state propagation, from Stefano Brivio. 17) Fix ACK handling in DCTCP congestion control, from Yuchung Cheng. 18) Use after free in tun XDP_TX, from Toshiaki Makita. 19) Stale ipv6 header pointer in ipv6 gre code, from Prashant Bhole. 20) Don't reuse remainder of RX page when XDP is set in mlx4, from Saeed Mahameed. 21) Fix window probe handling of TCP rapair sockets, from Stefan Baranoff. 22) Missing socket locking in smc_ioctl(), from Ursula Braun. 23) IPV6_ILA needs DST_CACHE, from Arnd Bergmann. 24) Spectre v1 fix in cxgb3, from Gustavo A. R. Silva. 25) Two spots in ipv6 do a rol32() on a hash value but ignore the result. Fixes from Colin Ian King" * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (176 commits) tcp: identify cryptic messages as TCP seq # bugs ptp: fix missing break in switch hv_netvsc: Fix napi reschedule while receive completion is busy MAINTAINERS: Drop inactive Vitaly Bordug's email net: cavium: Add fine-granular dependencies on PCI net: qca_spi: Fix log level if probe fails net: qca_spi: Make sure the QCA7000 reset is triggered net: qca_spi: Avoid packet drop during initial sync ipv6: fix useless rol32 call on hash ipv6: sr: fix useless rol32 call on hash net: sched: Using NULL instead of plain integer net: usb: asix: replace mii_nway_restart in resume path net: cxgb3_main: fix potential Spectre v1 lib/rhashtable: consider param->min_size when setting initial table size net/smc: reset recv timeout after clc handshake net/smc: add error handling for get_user() net/smc: optimize consumer cursor updates net/nfc: Avoid stalls when nfc_alloc_send_skb() returned NULL. ipv6: ila: select CONFIG_DST_CACHE net: usb: rtl8150: demote allmulti message to dev_dbg() ...
author: Linus Torvalds <torvalds@linux-foundation.org> 2018-07-18 22:32:54 -0400
committer: Linus Torvalds <torvalds@linux-foundation.org> 2018-07-18 22:32:54 -0400
commit: 024ddc0ce1049298bd3cae60ae45d9c5f0fb8b9c (patch)
tree: 18b44ede17871ded93577c317f3afe3db122ba33
parent: 05df204549c510c7c56e58d25098c448998a0cd5 (diff)
parent: e56b8ce363a36fb7b74b80aaa5cc9084f2c908b4 (diff)
171 files changed, 1739 insertions, 1128 deletions
diff --git a/Documentation/networking/bonding.txt b/Documentation/networking/bonding.txt
index c13214d073a4..d3e5dd26db12 100644
--- a/Documentation/networking/bonding.txt
+++ b/Documentation/networking/bonding.txt
@@ -1490,7 +1490,7 @@ To remove an ARP target:
 To configure the interval between learning packet transmits:
 # echo 12 > /sys/class/net/bond0/bonding/lp_interval
-        NOTE: the lp_inteval is the number of seconds between instances where
+        NOTE: the lp_interval is the number of seconds between instances where
 the bonding driver sends learning packets to each slaves peer switch.  The
 default interval is 1 second.
diff --git a/Documentation/networking/e100.rst b/Documentation/networking/e100.rst
index 9708f5fa76de..f81111eba9c5 100644
--- a/Documentation/networking/e100.rst
+++ b/Documentation/networking/e100.rst
@@ -47,41 +47,45 @@ Driver Configuration Parameters
 The default value for each parameter is generally the recommended setting,
 unless otherwise noted.
-Rx Descriptors: Number of receive descriptors. A receive descriptor is a data
+Rx Descriptors:
+   Number of receive descriptors. A receive descriptor is a data
   structure that describes a receive buffer and its attributes to the network
   controller. The data in the descriptor is used by the controller to write
   data from the controller to host memory. In the 3.x.x driver the valid range
   for this parameter is 64-256. The default value is 256. This parameter can be
   changed using the command::
-   ethtool -G eth? rx n
+     ethtool -G eth? rx n
   Where n is the number of desired Rx descriptors.
-Tx Descriptors: Number of transmit descriptors. A transmit descriptor is a data
+Tx Descriptors:
+   Number of transmit descriptors. A transmit descriptor is a data
   structure that describes a transmit buffer and its attributes to the network
   controller. The data in the descriptor is used by the controller to read
   data from the host memory to the controller. In the 3.x.x driver the valid
   range for this parameter is 64-256. The default value is 128. This parameter
   can be changed using the command::
-   ethtool -G eth? tx n
+     ethtool -G eth? tx n
   Where n is the number of desired Tx descriptors.
-Speed/Duplex: The driver auto-negotiates the link speed and duplex settings by
+Speed/Duplex:
+   The driver auto-negotiates the link speed and duplex settings by
   default. The ethtool utility can be used as follows to force speed/duplex.::
-   ethtool -s eth?  autoneg off speed {10|100} duplex {full|half}
+     ethtool -s eth?  autoneg off speed {10|100} duplex {full|half}
   NOTE: setting the speed/duplex to incorrect values will cause the link to
   fail.
-Event Log Message Level:  The driver uses the message level flag to log events
+Event Log Message Level:
+   The driver uses the message level flag to log events
   to syslog. The message level can be set at driver load time. It can also be
   set using the command::
-   ethtool -s eth? msglvl n
+     ethtool -s eth? msglvl n
 Additional Configurations
@@ -92,7 +96,7 @@ Configuring the Driver on Different Distributions
 Configuring a network driver to load properly when the system is started
 is distribution dependent.  Typically, the configuration process involves
-adding an alias line to /etc/modprobe.d/*.conf as well as editing other
+adding an alias line to `/etc/modprobe.d/*.conf` as well as editing other
 system startup scripts and/or configuration files.  Many popular Linux
 distributions ship with tools to make these changes for you.  To learn
 the proper way to configure a network device for your system, refer to
@@ -160,7 +164,10 @@ This results in unbalanced receive traffic.
 If you have multiple interfaces in a server, either turn on ARP
 filtering by
-(1) entering:: echo 1 > /proc/sys/net/ipv4/conf/all/arp_filter
+(1) entering::
+        echo 1 > /proc/sys/net/ipv4/conf/all/arp_filter
    (this only works if your kernel's version is higher than 2.4.5), or
 (2) installing the interfaces in separate broadcast domains (either
diff --git a/Documentation/networking/e1000.rst b/Documentation/networking/e1000.rst
index 144b87eef153..f10dd4086921 100644
--- a/Documentation/networking/e1000.rst
+++ b/Documentation/networking/e1000.rst
@@ -34,7 +34,8 @@ Command Line Parameters
 The default value for each parameter is generally the recommended setting,
 unless otherwise noted.
-NOTES:  For more information about the AutoNeg, Duplex, and Speed
+NOTES:
+        For more information about the AutoNeg, Duplex, and Speed
        parameters, see the "Speed and Duplex Configuration" section in
        this document.
@@ -45,22 +46,27 @@ NOTES:  For more information about the AutoNeg, Duplex, and Speed
 AutoNeg
 -------
 (Supported only on adapters with copper connections)
-Valid Range:   0x01-0x0F, 0x20-0x2F
-Default Value: 0x2F
+:Valid Range:   0x01-0x0F, 0x20-0x2F
+:Default Value: 0x2F
 This parameter is a bit-mask that specifies the speed and duplex settings
 advertised by the adapter.  When this parameter is used, the Speed and
 Duplex parameters must not be specified.
-NOTE:  Refer to the Speed and Duplex section of this readme for more
+NOTE:
+       Refer to the Speed and Duplex section of this readme for more
       information on the AutoNeg parameter.
 Duplex
 ------
 (Supported only on adapters with copper connections)
-Valid Range:   0-2 (0=auto-negotiate, 1=half, 2=full)
-Default Value: 0
+:Valid Range:   0-2 (0=auto-negotiate, 1=half, 2=full)
+:Default Value: 0
 This defines the direction in which data is allowed to flow.  Can be
 either one or two-directional.  If both Duplex and the link partner are
@@ -70,18 +76,22 @@ duplex.
 FlowControl
 -----------
-Valid Range:   0-3 (0=none, 1=Rx only, 2=Tx only, 3=Rx&Tx)
-Default Value: Reads flow control settings from the EEPROM
+:Valid Range:   0-3 (0=none, 1=Rx only, 2=Tx only, 3=Rx&Tx)
+:Default Value: Reads flow control settings from the EEPROM
 This parameter controls the automatic generation(Tx) and response(Rx)
 to Ethernet PAUSE frames.
 InterruptThrottleRate
 ---------------------
 (not supported on Intel(R) 82542, 82543 or 82544-based adapters)
-Valid Range:   0,1,3,4,100-100000 (0=off, 1=dynamic, 3=dynamic conservative,
-                                 4=simplified balancing)
+:Valid Range:
-Default Value: 3
+   0,1,3,4,100-100000 (0=off, 1=dynamic, 3=dynamic conservative,
+   4=simplified balancing)
+:Default Value: 3
 The driver can limit the amount of interrupts per second that the adapter
 will generate for incoming packets. It does this by writing a value to the
@@ -135,13 +145,15 @@ Setting InterruptThrottleRate to 0 turns off any interrupt moderation
 and may improve small packet latency, but is generally not suitable
 for bulk throughput traffic.
-NOTE:  InterruptThrottleRate takes precedence over the TxAbsIntDelay and
+NOTE:
+       InterruptThrottleRate takes precedence over the TxAbsIntDelay and
       RxAbsIntDelay parameters.  In other words, minimizing the receive
       and/or transmit absolute delays does not force the controller to
       generate more interrupts than what the Interrupt Throttle Rate
       allows.
-CAUTION:  If you are using the Intel(R) PRO/1000 CT Network Connection
+CAUTION:
+          If you are using the Intel(R) PRO/1000 CT Network Connection
          (controller 82547), setting InterruptThrottleRate to a value
          greater than 75,000, may hang (stop transmitting) adapters
          under certain network conditions.  If this occurs a NETDEV
@@ -151,7 +163,8 @@ CAUTION:  If you are using the Intel(R) PRO/1000 CT Network Connection
          hang, ensure that InterruptThrottleRate is set no greater
          than 75,000 and is not set to 0.
-NOTE:  When e1000 is loaded with default settings and multiple adapters
+NOTE:
+       When e1000 is loaded with default settings and multiple adapters
       are in use simultaneously, the CPU utilization may increase non-
       linearly.  In order to limit the CPU utilization without impacting
       the overall throughput, we recommend that you load the driver as
@@ -168,9 +181,11 @@ NOTE:  When e1000 is loaded with default settings and multiple adapters
 RxDescriptors
 -------------
-Valid Range:   48-256 for 82542 and 82543-based adapters
-               48-4096 for all other supported adapters
+:Valid Range:
-Default Value: 256
+ - 48-256 for 82542 and 82543-based adapters
+ - 48-4096 for all other supported adapters
+:Default Value: 256
 This value specifies the number of receive buffer descriptors allocated
 by the driver.  Increasing this value allows the driver to buffer more
@@ -180,15 +195,17 @@ Each descriptor is 16 bytes.  A receive buffer is also allocated for each
 descriptor and can be either 2048, 4096, 8192, or 16384 bytes, depending
 on the MTU setting. The maximum MTU size is 16110.
-NOTE:  MTU designates the frame size.  It only needs to be set for Jumbo
+NOTE:
+       MTU designates the frame size.  It only needs to be set for Jumbo
       Frames.  Depending on the available system resources, the request
       for a higher number of receive descriptors may be denied.  In this
       case, use a lower number.
 RxIntDelay
 ----------
-Valid Range:   0-65535 (0=off)
-Default Value: 0
+:Valid Range:   0-65535 (0=off)
+:Default Value: 0
 This value delays the generation of receive interrupts in units of 1.024
 microseconds.  Receive interrupt reduction can improve CPU efficiency if
@@ -198,7 +215,8 @@ of TCP traffic.  If the system is reporting dropped receives, this value
 may be set too high, causing the driver to run out of available receive
 descriptors.
-CAUTION:  When setting RxIntDelay to a value other than 0, adapters may
+CAUTION:
+          When setting RxIntDelay to a value other than 0, adapters may
          hang (stop transmitting) under certain network conditions.  If
          this occurs a NETDEV WATCHDOG message is logged in the system
          event log.  In addition, the controller is automatically reset,
@@ -207,9 +225,11 @@ CAUTION:  When setting RxIntDelay to a value other than 0, adapters may
 RxAbsIntDelay
 -------------
 (This parameter is supported only on 82540, 82545 and later adapters.)
-Valid Range:   0-65535 (0=off)
-Default Value: 128
+:Valid Range:   0-65535 (0=off)
+:Default Value: 128
 This value, in units of 1.024 microseconds, limits the delay in which a
 receive interrupt is generated.  Useful only if RxIntDelay is non-zero,
@@ -220,9 +240,11 @@ conditions.
 Speed
 -----
 (This parameter is supported only on adapters with copper connections.)
-Valid Settings: 0, 10, 100, 1000
-Default Value:  0 (auto-negotiate at all supported speeds)
+:Valid Settings: 0, 10, 100, 1000
+:Default Value:  0 (auto-negotiate at all supported speeds)
 Speed forces the line speed to the specified value in megabits per second
 (Mbps).  If this parameter is not specified or is set to 0 and the link
@@ -231,22 +253,26 @@ speed.  Duplex should also be set when Speed is set to either 10 or 100.
 TxDescriptors
 -------------
-Valid Range:   48-256 for 82542 and 82543-based adapters
-               48-4096 for all other supported adapters
+:Valid Range:
-Default Value: 256
+  - 48-256 for 82542 and 82543-based adapters
+  - 48-4096 for all other supported adapters
+:Default Value: 256
 This value is the number of transmit descriptors allocated by the driver.
 Increasing this value allows the driver to queue more transmits.  Each
 descriptor is 16 bytes.
-NOTE:  Depending on the available system resources, the request for a
+NOTE:
+       Depending on the available system resources, the request for a
       higher number of transmit descriptors may be denied.  In this case,
       use a lower number.
 TxIntDelay
 ----------
-Valid Range:   0-65535 (0=off)
-Default Value: 8
+:Valid Range:   0-65535 (0=off)
+:Default Value: 8
 This value delays the generation of transmit interrupts in units of
 1.024 microseconds.  Transmit interrupt reduction can improve CPU
@@ -256,9 +282,11 @@ causing the driver to run out of available transmit descriptors.
 TxAbsIntDelay
 -------------
 (This parameter is supported only on 82540, 82545 and later adapters.)
-Valid Range:   0-65535 (0=off)
-Default Value: 32
+:Valid Range:   0-65535 (0=off)
+:Default Value: 32
 This value, in units of 1.024 microseconds, limits the delay in which a
 transmit interrupt is generated.  Useful only if TxIntDelay is non-zero,
@@ -269,18 +297,21 @@ network conditions.
 XsumRX
 ------
 (This parameter is NOT supported on the 82542-based adapter.)
-Valid Range:   0-1
-Default Value: 1
+:Valid Range:   0-1
+:Default Value: 1
 A value of '1' indicates that the driver should enable IP checksum
 offload for received packets (both UDP and TCP) to the adapter hardware.
 Copybreak
 ---------
-Valid Range:   0-xxxxxxx (0=off)
-Default Value: 256
+:Valid Range:   0-xxxxxxx (0=off)
-Usage: modprobe e1000.ko copybreak=128
+:Default Value: 256
+:Usage: modprobe e1000.ko copybreak=128
 Driver copies all packets below or equaling this size to a fresh RX
 buffer before handing it up the stack.
@@ -292,8 +323,9 @@ it is also available during runtime at
 SmartPowerDownEnable
 --------------------
-Valid Range: 0-1
-Default Value:  0 (disabled)
+:Valid Range: 0-1
+:Default Value:  0 (disabled)
 Allows PHY to turn off in lower power states. The user can turn off
 this parameter in supported chipsets.
@@ -309,14 +341,14 @@ fiber interface board only links at 1000 Mbps full-duplex.
 For copper-based boards, the keywords interact as follows:
-  The default operation is auto-negotiate.  The board advertises all
+- The default operation is auto-negotiate.  The board advertises all
  supported speed and duplex combinations, and it links at the highest
  common speed and duplex mode IF the link partner is set to auto-negotiate.
-  If Speed = 1000, limited auto-negotiation is enabled and only 1000 Mbps
+- If Speed = 1000, limited auto-negotiation is enabled and only 1000 Mbps
  is advertised (The 1000BaseT spec requires auto-negotiation.)
-  If Speed = 10 or 100, then both Speed and Duplex should be set.  Auto-
+- If Speed = 10 or 100, then both Speed and Duplex should be set.  Auto-
  negotiation is disabled, and the AutoNeg parameter is ignored.  Partner
  SHOULD also be forced.
@@ -328,13 +360,15 @@ process.
 The parameter may be specified as either a decimal or hexadecimal value as
 determined by the bitmap below.
+============== ====== ====== ======= ======= ====== ====== ======= ======
 Bit position   7      6      5       4       3      2      1       0
 Decimal Value  128    64     32      16      8      4      2       1
 Hex value      80     40     20      10      8      4      2       1
 Speed (Mbps)   N/A    N/A    1000    N/A     100    100    10      10
 Duplex                       Full            Full   Half   Full    Half
+============== ====== ====== ======= ======= ====== ====== ======= ======
-Some examples of using AutoNeg:
+Some examples of using AutoNeg::
  modprobe e1000 AutoNeg=0x01 (Restricts autonegotiation to 10 Half)
  modprobe e1000 AutoNeg=1 (Same as above)
@@ -357,56 +391,59 @@ Additional Configurations
 Jumbo Frames
 ------------
-Jumbo Frames support is enabled by changing the MTU to a value larger
-than the default of 1500.  Use the ifconfig command to increase the MTU
+  Jumbo Frames support is enabled by changing the MTU to a value larger than
-size.  For example::
+  the default of 1500.  Use the ifconfig command to increase the MTU size.
+  For example::
       ifconfig eth<x> mtu 9000 up
-This setting is not saved across reboots.  It can be made permanent if
+  This setting is not saved across reboots.  It can be made permanent if
-you add::
+  you add::
       MTU=9000
-to the file /etc/sysconfig/network-scripts/ifcfg-eth<x>.  This example
+  to the file /etc/sysconfig/network-scripts/ifcfg-eth<x>.  This example
-applies to the Red Hat distributions; other distributions may store this
+  applies to the Red Hat distributions; other distributions may store this
-setting in a different location.
+  setting in a different location.
+Notes:
+  Degradation in throughput performance may be observed in some Jumbo frames
+  environments. If this is observed, increasing the application's socket buffer
+  size and/or increasing the /proc/sys/net/ipv4/tcp_*mem entry values may help.
+  See the specific application manual and /usr/src/linux*/Documentation/
+  networking/ip-sysctl.txt for more details.
-Notes: Degradation in throughput performance may be observed in some
+  - The maximum MTU setting for Jumbo Frames is 16110.  This value coincides
-Jumbo frames environments.  If this is observed, increasing the
+    with the maximum Jumbo Frames size of 16128.
-application's socket buffer size and/or increasing the
-/proc/sys/net/ipv4/tcp_*mem entry values may help.  See the specific
-application manual and /usr/src/linux*/Documentation/
-networking/ip-sysctl.txt for more details.
- The maximum MTU setting for Jumbo Frames is 16110.  This value
+  - Using Jumbo frames at 10 or 100 Mbps is not supported and may result in
-  coincides with the maximum Jumbo Frames size of 16128.
+    poor performance or loss of link.
- Using Jumbo frames at 10 or 100 Mbps is not supported and may result
+  - Adapters based on the Intel(R) 82542 and 82573V/E controller do not
-  in poor performance or loss of link.
+    support Jumbo Frames. These correspond to the following product names::
- Adapters based on the Intel(R) 82542 and 82573V/E controller do not
+     Intel(R) PRO/1000 Gigabit Server Adapter
-  support Jumbo Frames.  These correspond to the following product names:
+     Intel(R) PRO/1000 PM Network Connection
-  Intel(R) PRO/1000 Gigabit Server Adapter Intel(R) PRO/1000 PM Network
-  Connection
 ethtool
 -------
-The driver utilizes the ethtool interface for driver configuration and
-diagnostics, as well as displaying statistical information.  The ethtool
-version 1.6 or later is required for this functionality.
-The latest release of ethtool can be found from
+  The driver utilizes the ethtool interface for driver configuration and
-https://www.kernel.org/pub/software/network/ethtool/
+  diagnostics, as well as displaying statistical information.  The ethtool
+  version 1.6 or later is required for this functionality.
+  The latest release of ethtool can be found from
+  https://www.kernel.org/pub/software/network/ethtool/
 Enabling Wake on LAN* (WoL)
 ---------------------------
-WoL is configured through the ethtool* utility.
-WoL will be enabled on the system during the next shut down or reboot.
+  WoL is configured through the ethtool* utility.
-For this driver version, in order to enable WoL, the e1000 driver must be
-loaded when shutting down or rebooting the system.
+  WoL will be enabled on the system during the next shut down or reboot.
+  For this driver version, in order to enable WoL, the e1000 driver must be
+  loaded when shutting down or rebooting the system.
 Support
 =======
diff --git a/MAINTAINERS b/MAINTAINERS
index 192d7f73fd01..1505c8ea8e7b 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -2523,7 +2523,7 @@ S:	Supported
 F:      drivers/scsi/esas2r
 ATUSB IEEE 802.15.4 RADIO DRIVER
-M:      Stefan Schmidt <stefan@osg.samsung.com>
+M:      Stefan Schmidt <stefan@datenfreihafen.org>
 L:      linux-wpan@vger.kernel.org
 S:      Maintained
 F:      drivers/net/ieee802154/atusb.c
@@ -5790,7 +5790,6 @@ F:	include/linux/fsl/
 FREESCALE SOC FS_ENET DRIVER
 M:      Pantelis Antoniou <pantelis.antoniou@gmail.com>
-M:      Vitaly Bordug <vbordug@ru.mvista.com>
 L:      linuxppc-dev@lists.ozlabs.org
 L:      netdev@vger.kernel.org
 S:      Maintained
@@ -6909,7 +6908,7 @@ F:	drivers/clk/clk-versaclock5.c
 IEEE 802.15.4 SUBSYSTEM
 M:      Alexander Aring <alex.aring@gmail.com>
-M:      Stefan Schmidt <stefan@osg.samsung.com>
+M:      Stefan Schmidt <stefan@datenfreihafen.org>
 L:      linux-wpan@vger.kernel.org
 W:      http://wpan.cakelab.org/
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/sschmidt/wpan.git
@@ -8629,7 +8628,7 @@ MARVELL MWIFIEX WIRELESS DRIVER
 M:      Amitkumar Karwar <amitkarwar@gmail.com>
 M:      Nishant Sarmukadam <nishants@marvell.com>
 M:      Ganapathi Bhat <gbhat@marvell.com>
-M:      Xinming Hu <huxm@marvell.com>
+M:      Xinming Hu <huxinming820@gmail.com>
 L:      linux-wireless@vger.kernel.org
 S:      Maintained
 F:      drivers/net/wireless/marvell/mwifiex/
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_cfg.h b/drivers/net/ethernet/aquantia/atlantic/aq_cfg.h
index fc7383106946..91eb8910b1c9 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_cfg.h
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_cfg.h
@@ -63,8 +63,6 @@
 #define AQ_CFG_NAPI_WEIGHT     64U
-#define AQ_CFG_MULTICAST_ADDRESS_MAX     32U
 /*#define AQ_CFG_MAC_ADDR_PERMANENT {0x30, 0x0E, 0xE3, 0x12, 0x34, 0x56}*/
 #define AQ_NIC_FC_OFF    0U
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_hw.h b/drivers/net/ethernet/aquantia/atlantic/aq_hw.h
index a2d416b24ffc..2c6ebd91a9f2 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_hw.h
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_hw.h
@@ -98,6 +98,8 @@ struct aq_stats_s {
 #define AQ_HW_MEDIA_TYPE_TP    1U
 #define AQ_HW_MEDIA_TYPE_FIBRE 2U
+#define AQ_HW_MULTICAST_ADDRESS_MAX     32U
 struct aq_hw_s {
        atomic_t flags;
        u8 rbl_enabled:1;
@@ -177,7 +179,7 @@ struct aq_hw_ops {
                                    unsigned int packet_filter);
        int (*hw_multicast_list_set)(struct aq_hw_s *self,
-                                     u8 ar_mac[AQ_CFG_MULTICAST_ADDRESS_MAX]
+                                     u8 ar_mac[AQ_HW_MULTICAST_ADDRESS_MAX]
                                     [ETH_ALEN],
                                     u32 count);
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_main.c b/drivers/net/ethernet/aquantia/atlantic/aq_main.c
index ba5fe8c4125d..e3ae29e523f0 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_main.c
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_main.c
@@ -135,17 +135,10 @@ err_exit:
 static void aq_ndev_set_multicast_settings(struct net_device *ndev)
 {
        struct aq_nic_s *aq_nic = netdev_priv(ndev);
-        int err = 0;
-        err = aq_nic_set_packet_filter(aq_nic, ndev->flags);
+        aq_nic_set_packet_filter(aq_nic, ndev->flags);
-        if (err < 0)
-                return;
-        if (netdev_mc_count(ndev)) {
+        aq_nic_set_multicast_list(aq_nic, ndev);
-                err = aq_nic_set_multicast_list(aq_nic, ndev);
-                if (err < 0)
-                        return;
-        }
 }
 static const struct net_device_ops aq_ndev_ops = {
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
index 1a1a6380c128..7a22d0257e04 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
@@ -563,34 +563,41 @@ err_exit:
 int aq_nic_set_multicast_list(struct aq_nic_s *self, struct net_device *ndev)
 {
+        unsigned int packet_filter = self->packet_filter;
        struct netdev_hw_addr *ha = NULL;
        unsigned int i = 0U;
-        self->mc_list.count = 0U;
+        self->mc_list.count = 0;
+        if (netdev_uc_count(ndev) > AQ_HW_MULTICAST_ADDRESS_MAX) {
-        netdev_for_each_mc_addr(ha, ndev) {
+                packet_filter |= IFF_PROMISC;
-                ether_addr_copy(self->mc_list.ar[i++], ha->addr);
+        } else {
-                ++self->mc_list.count;
+                netdev_for_each_uc_addr(ha, ndev) {
+                        ether_addr_copy(self->mc_list.ar[i++], ha->addr);
-                if (i >= AQ_CFG_MULTICAST_ADDRESS_MAX)
+                        if (i >= AQ_HW_MULTICAST_ADDRESS_MAX)
-                        break;
+                                break;
+                }
        }
-        if (i >= AQ_CFG_MULTICAST_ADDRESS_MAX) {
+        if (i + netdev_mc_count(ndev) > AQ_HW_MULTICAST_ADDRESS_MAX) {
-                /* Number of filters is too big: atlantic does not support this.
+                packet_filter |= IFF_ALLMULTI;
-                 * Force all multi filter to support this.
-                 * With this we disable all UC filters and setup "all pass"
-                 * multicast mask
-                 */
-                self->packet_filter |= IFF_ALLMULTI;
-                self->aq_nic_cfg.mc_list_count = 0;
-                return self->aq_hw_ops->hw_packet_filter_set(self->aq_hw,
-                                                             self->packet_filter);
        } else {
-                return self->aq_hw_ops->hw_multicast_list_set(self->aq_hw,
+                netdev_for_each_mc_addr(ha, ndev) {
-                                                    self->mc_list.ar,
+                        ether_addr_copy(self->mc_list.ar[i++], ha->addr);
-                                                    self->mc_list.count);
+                        if (i >= AQ_HW_MULTICAST_ADDRESS_MAX)
+                                break;
+                }
+        }
+        if (i > 0 && i < AQ_HW_MULTICAST_ADDRESS_MAX) {
+                packet_filter |= IFF_MULTICAST;
+                self->mc_list.count = i;
+                self->aq_hw_ops->hw_multicast_list_set(self->aq_hw,
+                                                       self->mc_list.ar,
+                                                       self->mc_list.count);
        }
+        return aq_nic_set_packet_filter(self, packet_filter);
 }
 int aq_nic_set_mtu(struct aq_nic_s *self, int new_mtu)
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_nic.h b/drivers/net/ethernet/aquantia/atlantic/aq_nic.h
index faa533a0ec47..fecfc401f95d 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.h
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.h
@@ -75,7 +75,7 @@ struct aq_nic_s {
        struct aq_hw_link_status_s link_status;
        struct {
                u32 count;
-                u8 ar[AQ_CFG_MULTICAST_ADDRESS_MAX][ETH_ALEN];
+                u8 ar[AQ_HW_MULTICAST_ADDRESS_MAX][ETH_ALEN];
        } mc_list;
        struct pci_dev *pdev;
diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c
index 67e2f9fb9402..8cc6abadc03b 100644
--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c
+++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c
@@ -765,7 +765,7 @@ static int hw_atl_a0_hw_packet_filter_set(struct aq_hw_s *self,
 static int hw_atl_a0_hw_multicast_list_set(struct aq_hw_s *self,
                                           u8 ar_mac
-                                           [AQ_CFG_MULTICAST_ADDRESS_MAX]
+                                           [AQ_HW_MULTICAST_ADDRESS_MAX]
                                           [ETH_ALEN],
                                           u32 count)
 {
diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
index 819f6bcf9b4e..956860a69797 100644
--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
+++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
@@ -784,7 +784,7 @@ static int hw_atl_b0_hw_packet_filter_set(struct aq_hw_s *self,
 static int hw_atl_b0_hw_multicast_list_set(struct aq_hw_s *self,
                                           u8 ar_mac
-                                           [AQ_CFG_MULTICAST_ADDRESS_MAX]
+                                           [AQ_HW_MULTICAST_ADDRESS_MAX]
                                           [ETH_ALEN],
                                           u32 count)
 {
@@ -812,7 +812,7 @@ static int hw_atl_b0_hw_multicast_list_set(struct aq_hw_s *self,
                hw_atl_rpfl2_uc_flr_en_set(self,
                                           (self->aq_nic_cfg->is_mc_list_enabled),
-                                    HW_ATL_B0_MAC_MIN + i);
+                                           HW_ATL_B0_MAC_MIN + i);
        }
        err = aq_hw_err_from_flags(self);
diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
index d5fca2e5a9bc..a1f60f89e059 100644
--- a/drivers/net/ethernet/broadcom/bcmsysport.c
+++ b/drivers/net/ethernet/broadcom/bcmsysport.c
@@ -1946,8 +1946,8 @@ static int bcm_sysport_open(struct net_device *dev)
        if (!priv->is_lite)
                priv->crc_fwd = !!(umac_readl(priv, UMAC_CMD) & CMD_CRC_FWD);
        else
-                priv->crc_fwd = !!(gib_readl(priv, GIB_CONTROL) &
+                priv->crc_fwd = !((gib_readl(priv, GIB_CONTROL) &
-                                   GIB_FCS_STRIP);
+                                  GIB_FCS_STRIP) >> GIB_FCS_STRIP_SHIFT);
        phydev = of_phy_connect(dev, priv->phy_dn, bcm_sysport_adj_link,
                                0, priv->phy_interface);
diff --git a/drivers/net/ethernet/broadcom/bcmsysport.h b/drivers/net/ethernet/broadcom/bcmsysport.h
index d6e5d0cbf3a3..cf440b91fd04 100644
--- a/drivers/net/ethernet/broadcom/bcmsysport.h
+++ b/drivers/net/ethernet/broadcom/bcmsysport.h
@@ -278,7 +278,8 @@ struct bcm_rsb {
 #define  GIB_GTX_CLK_EXT_CLK            (0 << GIB_GTX_CLK_SEL_SHIFT)
 #define  GIB_GTX_CLK_125MHZ             (1 << GIB_GTX_CLK_SEL_SHIFT)
 #define  GIB_GTX_CLK_250MHZ             (2 << GIB_GTX_CLK_SEL_SHIFT)
-#define  GIB_FCS_STRIP                  (1 << 6)
+#define  GIB_FCS_STRIP_SHIFT            6
+#define  GIB_FCS_STRIP                  (1 << GIB_FCS_STRIP_SHIFT)
 #define  GIB_LCL_LOOP_EN                (1 << 7)
 #define  GIB_LCL_LOOP_TXEN              (1 << 8)
 #define  GIB_RMT_LOOP_EN                (1 << 9)
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index 176fc9f4d7de..4394c1162be4 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -5712,7 +5712,9 @@ static int bnxt_init_chip(struct bnxt *bp, bool irq_re_init)
        }
        vnic->uc_filter_count = 1;
-        vnic->rx_mask = CFA_L2_SET_RX_MASK_REQ_MASK_BCAST;
+        vnic->rx_mask = 0;
+        if (bp->dev->flags & IFF_BROADCAST)
+                vnic->rx_mask |= CFA_L2_SET_RX_MASK_REQ_MASK_BCAST;
        if ((bp->dev->flags & IFF_PROMISC) && bnxt_promisc_ok(bp))
                vnic->rx_mask |= CFA_L2_SET_RX_MASK_REQ_MASK_PROMISCUOUS;
@@ -5917,7 +5919,7 @@ unsigned int bnxt_get_max_func_irqs(struct bnxt *bp)
        return min_t(unsigned int, hw_resc->max_irqs, hw_resc->max_cp_rings);
 }
-void bnxt_set_max_func_irqs(struct bnxt *bp, unsigned int max_irqs)
+static void bnxt_set_max_func_irqs(struct bnxt *bp, unsigned int max_irqs)
 {
        bp->hw_resc.max_irqs = max_irqs;
 }
@@ -6888,7 +6890,7 @@ static int __bnxt_open_nic(struct bnxt *bp, bool irq_re_init, bool link_re_init)
                rc = bnxt_request_irq(bp);
                if (rc) {
                        netdev_err(bp->dev, "bnxt_request_irq err: %x\n", rc);
-                        goto open_err;
+                        goto open_err_irq;
                }
        }
@@ -6928,6 +6930,8 @@ static int __bnxt_open_nic(struct bnxt *bp, bool irq_re_init, bool link_re_init)
 open_err:
        bnxt_debug_dev_exit(bp);
        bnxt_disable_napi(bp);
+open_err_irq:
        bnxt_del_napi(bp);
 open_err_free_mem:
@@ -7214,13 +7218,16 @@ static void bnxt_set_rx_mode(struct net_device *dev)
        mask &= ~(CFA_L2_SET_RX_MASK_REQ_MASK_PROMISCUOUS |
                  CFA_L2_SET_RX_MASK_REQ_MASK_MCAST |
-                  CFA_L2_SET_RX_MASK_REQ_MASK_ALL_MCAST);
+                  CFA_L2_SET_RX_MASK_REQ_MASK_ALL_MCAST |
+                  CFA_L2_SET_RX_MASK_REQ_MASK_BCAST);
        if ((dev->flags & IFF_PROMISC) && bnxt_promisc_ok(bp))
                mask |= CFA_L2_SET_RX_MASK_REQ_MASK_PROMISCUOUS;
        uc_update = bnxt_uc_list_updated(bp);
+        if (dev->flags & IFF_BROADCAST)
+                mask |= CFA_L2_SET_RX_MASK_REQ_MASK_BCAST;
        if (dev->flags & IFF_ALLMULTI) {
                mask |= CFA_L2_SET_RX_MASK_REQ_MASK_ALL_MCAST;
                vnic->mc_list_count = 0;
@@ -8502,11 +8509,11 @@ int bnxt_get_max_rings(struct bnxt *bp, int *max_rx, int *max_tx, bool shared)
        int rx, tx, cp;
        _bnxt_get_max_rings(bp, &rx, &tx, &cp);
+        *max_rx = rx;
+        *max_tx = tx;
        if (!rx || !tx || !cp)
                return -ENOMEM;
-        *max_rx = rx;
-        *max_tx = tx;
        return bnxt_trim_rings(bp, max_rx, max_tx, cp, shared);
 }
@@ -8520,8 +8527,11 @@ static int bnxt_get_dflt_rings(struct bnxt *bp, int *max_rx, int *max_tx,
                /* Not enough rings, try disabling agg rings. */
                bp->flags &= ~BNXT_FLAG_AGG_RINGS;
                rc = bnxt_get_max_rings(bp, max_rx, max_tx, shared);
-                if (rc)
+                if (rc) {
+                        /* set BNXT_FLAG_AGG_RINGS back for consistency */
+                        bp->flags |= BNXT_FLAG_AGG_RINGS;
                        return rc;
+                }
                bp->flags |= BNXT_FLAG_NO_AGG_RINGS;
                bp->dev->hw_features &= ~(NETIF_F_LRO | NETIF_F_GRO_HW);
                bp->dev->features &= ~(NETIF_F_LRO | NETIF_F_GRO_HW);
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.h b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
index 9b14eb610b9f..91575ef97c8c 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
@@ -1470,7 +1470,6 @@ void bnxt_set_max_func_stat_ctxs(struct bnxt *bp, unsigned int max);
 unsigned int bnxt_get_max_func_cp_rings(struct bnxt *bp);
 void bnxt_set_max_func_cp_rings(struct bnxt *bp, unsigned int max);
 unsigned int bnxt_get_max_func_irqs(struct bnxt *bp);
-void bnxt_set_max_func_irqs(struct bnxt *bp, unsigned int max);
 int bnxt_get_avail_msix(struct bnxt *bp, int num);
 int bnxt_reserve_rings(struct bnxt *bp);
 void bnxt_tx_disable(struct bnxt *bp);
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c
index 795f45024c20..491bd40a254d 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c
@@ -27,6 +27,15 @@
 #define BNXT_FID_INVALID                        0xffff
 #define VLAN_TCI(vid, prio)     ((vid) | ((prio) << VLAN_PRIO_SHIFT))
+#define is_vlan_pcp_wildcarded(vlan_tci_mask)   \
+        ((ntohs(vlan_tci_mask) & VLAN_PRIO_MASK) == 0x0000)
+#define is_vlan_pcp_exactmatch(vlan_tci_mask)   \
+        ((ntohs(vlan_tci_mask) & VLAN_PRIO_MASK) == VLAN_PRIO_MASK)
+#define is_vlan_pcp_zero(vlan_tci)      \
+        ((ntohs(vlan_tci) & VLAN_PRIO_MASK) == 0x0000)
+#define is_vid_exactmatch(vlan_tci_mask)        \
+        ((ntohs(vlan_tci_mask) & VLAN_VID_MASK) == VLAN_VID_MASK)
 /* Return the dst fid of the func for flow forwarding
 * For PFs: src_fid is the fid of the PF
 * For VF-reps: src_fid the fid of the VF
@@ -389,6 +398,21 @@ static bool is_exactmatch(void *mask, int len)
        return true;
 }
+static bool is_vlan_tci_allowed(__be16  vlan_tci_mask,
+                                __be16  vlan_tci)
+{
+        /* VLAN priority must be either exactly zero or fully wildcarded and
+         * VLAN id must be exact match.
+         */
+        if (is_vid_exactmatch(vlan_tci_mask) &&
+            ((is_vlan_pcp_exactmatch(vlan_tci_mask) &&
+              is_vlan_pcp_zero(vlan_tci)) ||
+             is_vlan_pcp_wildcarded(vlan_tci_mask)))
+                return true;
+        return false;
+}
 static bool bits_set(void *key, int len)
 {
        const u8 *p = key;
@@ -803,9 +827,9 @@ static bool bnxt_tc_can_offload(struct bnxt *bp, struct bnxt_tc_flow *flow)
        /* Currently VLAN fields cannot be partial wildcard */
        if (bits_set(&flow->l2_key.inner_vlan_tci,
                     sizeof(flow->l2_key.inner_vlan_tci)) &&
-            !is_exactmatch(&flow->l2_mask.inner_vlan_tci,
+            !is_vlan_tci_allowed(flow->l2_mask.inner_vlan_tci,
-                           sizeof(flow->l2_mask.inner_vlan_tci))) {
+                                 flow->l2_key.inner_vlan_tci)) {
-                netdev_info(bp->dev, "Wildcard match unsupported for VLAN TCI\n");
+                netdev_info(bp->dev, "Unsupported VLAN TCI\n");
                return false;
        }
        if (bits_set(&flow->l2_key.inner_vlan_tpid,
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c
index 347e4f946eb2..840f6e505f73 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c
@@ -169,7 +169,6 @@ static int bnxt_req_msix_vecs(struct bnxt_en_dev *edev, int ulp_id,
                edev->ulp_tbl[ulp_id].msix_requested = avail_msix;
        }
        bnxt_fill_msix_vecs(bp, ent);
-        bnxt_set_max_func_irqs(bp, bnxt_get_max_func_irqs(bp) - avail_msix);
        bnxt_set_max_func_cp_rings(bp, max_cp_rings - avail_msix);
        edev->flags |= BNXT_EN_FLAG_MSIX_REQUESTED;
        return avail_msix;
@@ -192,7 +191,6 @@ static int bnxt_free_msix_vecs(struct bnxt_en_dev *edev, int ulp_id)
        msix_requested = edev->ulp_tbl[ulp_id].msix_requested;
        bnxt_set_max_func_cp_rings(bp, max_cp_rings + msix_requested);
        edev->ulp_tbl[ulp_id].msix_requested = 0;
-        bnxt_set_max_func_irqs(bp, bnxt_get_max_func_irqs(bp) + msix_requested);
        edev->flags &= ~BNXT_EN_FLAG_MSIX_REQUESTED;
        if (netif_running(dev)) {
                bnxt_close_nic(bp, true, false);
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index 3be87efdc93d..aa1374d0af93 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -6,11 +6,15 @@
 * Copyright (C) 2004 Sun Microsystems Inc.
 * Copyright (C) 2005-2016 Broadcom Corporation.
 * Copyright (C) 2016-2017 Broadcom Limited.
+ * Copyright (C) 2018 Broadcom. All Rights Reserved. The term "Broadcom"
+ * refers to Broadcom Inc. and/or its subsidiaries.
 *
 * Firmware is:
 *      Derived from proprietary unpublished source code,
 *      Copyright (C) 2000-2016 Broadcom Corporation.
 *      Copyright (C) 2016-2017 Broadcom Ltd.
+ *      Copyright (C) 2018 Broadcom. All Rights Reserved. The term "Broadcom"
+ *      refers to Broadcom Inc. and/or its subsidiaries.
 *
 *      Permission is hereby granted for the distribution of this firmware
 *      data in hexadecimal or equivalent format, provided this copyright
@@ -9290,6 +9294,15 @@ static int tg3_chip_reset(struct tg3 *tp)
        tg3_restore_clk(tp);
+        /* Increase the core clock speed to fix tx timeout issue for 5762
+         * with 100Mbps link speed.
+         */
+        if (tg3_asic_rev(tp) == ASIC_REV_5762) {
+                val = tr32(TG3_CPMU_CLCK_ORIDE_ENABLE);
+                tw32(TG3_CPMU_CLCK_ORIDE_ENABLE, val |
+                     TG3_CPMU_MAC_ORIDE_ENABLE);
+        }
        /* Reprobe ASF enable state.  */
        tg3_flag_clear(tp, ENABLE_ASF);
        tp->phy_flags &= ~(TG3_PHYFLG_1G_ON_VAUX_OK |
diff --git a/drivers/net/ethernet/broadcom/tg3.h b/drivers/net/ethernet/broadcom/tg3.h
index 1d61aa3efda1..a772a33b685c 100644
--- a/drivers/net/ethernet/broadcom/tg3.h
+++ b/drivers/net/ethernet/broadcom/tg3.h
@@ -7,6 +7,8 @@
 * Copyright (C) 2004 Sun Microsystems Inc.
 * Copyright (C) 2007-2016 Broadcom Corporation.
 * Copyright (C) 2016-2017 Broadcom Limited.
+ * Copyright (C) 2018 Broadcom. All Rights Reserved. The term "Broadcom"
+ * refers to Broadcom Inc. and/or its subsidiaries.
 */
 #ifndef _T3_H
diff --git a/drivers/net/ethernet/cadence/macb.h b/drivers/net/ethernet/cadence/macb.h
index 86659823b259..3d45f4c92cf6 100644
--- a/drivers/net/ethernet/cadence/macb.h
+++ b/drivers/net/ethernet/cadence/macb.h
@@ -166,6 +166,7 @@
 #define GEM_DCFG6               0x0294 /* Design Config 6 */
 #define GEM_DCFG7               0x0298 /* Design Config 7 */
 #define GEM_DCFG8               0x029C /* Design Config 8 */
+#define GEM_DCFG10              0x02A4 /* Design Config 10 */
 #define GEM_TXBDCTRL    0x04cc /* TX Buffer Descriptor control register */
 #define GEM_RXBDCTRL    0x04d0 /* RX Buffer Descriptor control register */
@@ -490,6 +491,12 @@
 #define GEM_SCR2CMP_OFFSET                      0
 #define GEM_SCR2CMP_SIZE                        8
+/* Bitfields in DCFG10 */
+#define GEM_TXBD_RDBUFF_OFFSET                  12
+#define GEM_TXBD_RDBUFF_SIZE                    4
+#define GEM_RXBD_RDBUFF_OFFSET                  8
+#define GEM_RXBD_RDBUFF_SIZE                    4
 /* Bitfields in TISUBN */
 #define GEM_SUBNSINCR_OFFSET                    0
 #define GEM_SUBNSINCR_SIZE                      16
@@ -635,6 +642,7 @@
 #define MACB_CAPS_USRIO_DISABLED                0x00000010
 #define MACB_CAPS_JUMBO                         0x00000020
 #define MACB_CAPS_GEM_HAS_PTP                   0x00000040
+#define MACB_CAPS_BD_RD_PREFETCH                0x00000080
 #define MACB_CAPS_FIFO_MODE                     0x10000000
 #define MACB_CAPS_GIGABIT_MODE_AVAILABLE        0x20000000
 #define MACB_CAPS_SG_DISABLED                   0x40000000
@@ -1203,6 +1211,9 @@ struct macb {
        unsigned int max_tuples;
        struct tasklet_struct   hresp_err_tasklet;
+        int     rx_bd_rd_prefetch;
+        int     tx_bd_rd_prefetch;
 };
 #ifdef CONFIG_MACB_USE_HWSTAMP
diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
index 96cc03a6d942..a6c911bb5ce2 100644
--- a/drivers/net/ethernet/cadence/macb_main.c
+++ b/drivers/net/ethernet/cadence/macb_main.c
@@ -1811,23 +1811,25 @@ static void macb_free_consistent(struct macb *bp)
 {
        struct macb_queue *queue;
        unsigned int q;
+        int size;
-        queue = &bp->queues[0];
        bp->macbgem_ops.mog_free_rx_buffers(bp);
-        if (queue->rx_ring) {
-                dma_free_coherent(&bp->pdev->dev, RX_RING_BYTES(bp),
-                                queue->rx_ring, queue->rx_ring_dma);
-                queue->rx_ring = NULL;
-        }
        for (q = 0, queue = bp->queues; q < bp->num_queues; ++q, ++queue) {
                kfree(queue->tx_skb);
                queue->tx_skb = NULL;
                if (queue->tx_ring) {
-                        dma_free_coherent(&bp->pdev->dev, TX_RING_BYTES(bp),
+                        size = TX_RING_BYTES(bp) + bp->tx_bd_rd_prefetch;
+                        dma_free_coherent(&bp->pdev->dev, size,
                                          queue->tx_ring, queue->tx_ring_dma);
                        queue->tx_ring = NULL;
                }
+                if (queue->rx_ring) {
+                        size = RX_RING_BYTES(bp) + bp->rx_bd_rd_prefetch;
+                        dma_free_coherent(&bp->pdev->dev, size,
+                                          queue->rx_ring, queue->rx_ring_dma);
+                        queue->rx_ring = NULL;
+                }
        }
 }
@@ -1874,7 +1876,7 @@ static int macb_alloc_consistent(struct macb *bp)
        int size;
        for (q = 0, queue = bp->queues; q < bp->num_queues; ++q, ++queue) {
-                size = TX_RING_BYTES(bp);
+                size = TX_RING_BYTES(bp) + bp->tx_bd_rd_prefetch;
                queue->tx_ring = dma_alloc_coherent(&bp->pdev->dev, size,
                                                    &queue->tx_ring_dma,
                                                    GFP_KERNEL);
@@ -1890,7 +1892,7 @@ static int macb_alloc_consistent(struct macb *bp)
                if (!queue->tx_skb)
                        goto out_err;
-                size = RX_RING_BYTES(bp);
+                size = RX_RING_BYTES(bp) + bp->rx_bd_rd_prefetch;
                queue->rx_ring = dma_alloc_coherent(&bp->pdev->dev, size,
                                                 &queue->rx_ring_dma, GFP_KERNEL);
                if (!queue->rx_ring)
@@ -3797,7 +3799,7 @@ static const struct macb_config np4_config = {
 static const struct macb_config zynqmp_config = {
        .caps = MACB_CAPS_GIGABIT_MODE_AVAILABLE |
                        MACB_CAPS_JUMBO |
-                        MACB_CAPS_GEM_HAS_PTP,
+                        MACB_CAPS_GEM_HAS_PTP | MACB_CAPS_BD_RD_PREFETCH,
        .dma_burst_length = 16,
        .clk_init = macb_clk_init,
        .init = macb_init,
@@ -3858,7 +3860,7 @@ static int macb_probe(struct platform_device *pdev)
        void __iomem *mem;
        const char *mac;
        struct macb *bp;
-        int err;
+        int err, val;
        regs = platform_get_resource(pdev, IORESOURCE_MEM, 0);
        mem = devm_ioremap_resource(&pdev->dev, regs);
@@ -3947,6 +3949,18 @@ static int macb_probe(struct platform_device *pdev)
        else
                dev->max_mtu = ETH_DATA_LEN;
+        if (bp->caps & MACB_CAPS_BD_RD_PREFETCH) {
+                val = GEM_BFEXT(RXBD_RDBUFF, gem_readl(bp, DCFG10));
+                if (val)
+                        bp->rx_bd_rd_prefetch = (2 << (val - 1)) *
+                                                macb_dma_desc_get_size(bp);
+                val = GEM_BFEXT(TXBD_RDBUFF, gem_readl(bp, DCFG10));
+                if (val)
+                        bp->tx_bd_rd_prefetch = (2 << (val - 1)) *
+                                                macb_dma_desc_get_size(bp);
+        }
        mac = of_get_mac_address(np);
        if (mac) {
                ether_addr_copy(bp->dev->dev_addr, mac);
diff --git a/drivers/net/ethernet/cavium/Kconfig b/drivers/net/ethernet/cavium/Kconfig
index 043e3c11c42b..92d88c5f76fb 100644
--- a/drivers/net/ethernet/cavium/Kconfig
+++ b/drivers/net/ethernet/cavium/Kconfig
@@ -15,7 +15,7 @@ if NET_VENDOR_CAVIUM
 config THUNDER_NIC_PF
        tristate "Thunder Physical function driver"
-        depends on 64BIT
+        depends on 64BIT && PCI
        select THUNDER_NIC_BGX
        ---help---
          This driver supports Thunder's NIC physical function.
@@ -28,13 +28,13 @@ config THUNDER_NIC_PF
 config THUNDER_NIC_VF
        tristate "Thunder Virtual function driver"
        imply CAVIUM_PTP
-        depends on 64BIT
+        depends on 64BIT && PCI
        ---help---
          This driver supports Thunder's NIC virtual function
 config  THUNDER_NIC_BGX
        tristate "Thunder MAC interface driver (BGX)"
-        depends on 64BIT
+        depends on 64BIT && PCI
        select PHYLIB
        select MDIO_THUNDER
        select THUNDER_NIC_RGX
@@ -44,7 +44,7 @@ config	THUNDER_NIC_BGX
 config  THUNDER_NIC_RGX
        tristate "Thunder MAC interface driver (RGX)"
-        depends on 64BIT
+        depends on 64BIT && PCI
        select PHYLIB
        select MDIO_THUNDER
        ---help---
@@ -53,7 +53,7 @@ config	THUNDER_NIC_RGX
 config CAVIUM_PTP
        tristate "Cavium PTP coprocessor as PTP clock"
-        depends on 64BIT
+        depends on 64BIT && PCI
        imply PTP_1588_CLOCK
        default y
        ---help---
@@ -65,7 +65,7 @@ config CAVIUM_PTP
 config LIQUIDIO
        tristate "Cavium LiquidIO support"
-        depends on 64BIT
+        depends on 64BIT && PCI
        depends on MAY_USE_DEVLINK
        imply PTP_1588_CLOCK
        select FW_LOADER
diff --git a/drivers/net/ethernet/cavium/liquidio/lio_main.c b/drivers/net/ethernet/cavium/liquidio/lio_main.c
index 8a815bb57177..7e8454d3b1ad 100644
--- a/drivers/net/ethernet/cavium/liquidio/lio_main.c
+++ b/drivers/net/ethernet/cavium/liquidio/lio_main.c
@@ -91,6 +91,9 @@ static int octeon_console_debug_enabled(u32 console)
 */
 #define LIO_SYNC_OCTEON_TIME_INTERVAL_MS 60000
+/* time to wait for possible in-flight requests in milliseconds */
+#define WAIT_INFLIGHT_REQUEST   msecs_to_jiffies(1000)
 struct lio_trusted_vf_ctx {
        struct completion complete;
        int status;
@@ -259,7 +262,7 @@ static inline void pcierror_quiesce_device(struct octeon_device *oct)
        force_io_queues_off(oct);
        /* To allow for in-flight requests */
-        schedule_timeout_uninterruptible(100);
+        schedule_timeout_uninterruptible(WAIT_INFLIGHT_REQUEST);
        if (wait_for_pending_requests(oct))
                dev_err(&oct->pci_dev->dev, "There were pending requests\n");
diff --git a/drivers/net/ethernet/cavium/octeon/octeon_mgmt.c b/drivers/net/ethernet/cavium/octeon/octeon_mgmt.c
index 3f6afb54a5eb..bb43ddb7539e 100644
--- a/drivers/net/ethernet/cavium/octeon/octeon_mgmt.c
+++ b/drivers/net/ethernet/cavium/octeon/octeon_mgmt.c
@@ -643,13 +643,21 @@ static int octeon_mgmt_set_mac_address(struct net_device *netdev, void *addr)
 static int octeon_mgmt_change_mtu(struct net_device *netdev, int new_mtu)
 {
        struct octeon_mgmt *p = netdev_priv(netdev);
-        int size_without_fcs = new_mtu + OCTEON_MGMT_RX_HEADROOM;
+        int max_packet = new_mtu + ETH_HLEN + ETH_FCS_LEN;
        netdev->mtu = new_mtu;
-        cvmx_write_csr(p->agl + AGL_GMX_RX_FRM_MAX, size_without_fcs);
+        /* HW lifts the limit if the frame is VLAN tagged
+         * (+4 bytes per each tag, up to two tags)
+         */
+        cvmx_write_csr(p->agl + AGL_GMX_RX_FRM_MAX, max_packet);
+        /* Set the hardware to truncate packets larger than the MTU. The jabber
+         * register must be set to a multiple of 8 bytes, so round up. JABBER is
+         * an unconditional limit, so we need to account for two possible VLAN
+         * tags.
+         */
        cvmx_write_csr(p->agl + AGL_GMX_RX_JABBER,
-                       (size_without_fcs + 7) & 0xfff8);
+                       (max_packet + 7 + VLAN_HLEN * 2) & 0xfff8);
        return 0;
 }
diff --git a/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c b/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c
index 7b795edd9d3a..a19172dbe6be 100644
--- a/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c
@@ -51,6 +51,7 @@
 #include <linux/sched.h>
 #include <linux/slab.h>
 #include <linux/uaccess.h>
+#include <linux/nospec.h>
 #include "common.h"
 #include "cxgb3_ioctl.h"
@@ -2268,6 +2269,7 @@ static int cxgb_extension_ioctl(struct net_device *dev, void __user *useraddr)
                if (t.qset_idx >= nqsets)
                        return -EINVAL;
+                t.qset_idx = array_index_nospec(t.qset_idx, nqsets);
                q = &adapter->params.sge.qset[q1 + t.qset_idx];
                t.rspq_size = q->rspq_size;
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
index 974a868a4824..3720c3e11ebb 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
@@ -8702,7 +8702,7 @@ static int t4_get_flash_params(struct adapter *adap)
        };
        unsigned int part, manufacturer;
-        unsigned int density, size;
+        unsigned int density, size = 0;
        u32 flashid = 0;
        int ret;
@@ -8772,11 +8772,6 @@ static int t4_get_flash_params(struct adapter *adap)
                case 0x22: /* 256MB */
                        size = 1 << 28;
                        break;
-                default:
-                        dev_err(adap->pdev_dev, "Micron Flash Part has bad size, ID = %#x, Density code = %#x\n",
-                                flashid, density);
-                        return -EINVAL;
                }
                break;
        }
@@ -8792,10 +8787,6 @@ static int t4_get_flash_params(struct adapter *adap)
                case 0x17: /* 64MB */
                        size = 1 << 26;
                        break;
-                default:
-                        dev_err(adap->pdev_dev, "ISSI Flash Part has bad size, ID = %#x, Density code = %#x\n",
-                                flashid, density);
-                        return -EINVAL;
                }
                break;
        }
@@ -8811,10 +8802,6 @@ static int t4_get_flash_params(struct adapter *adap)
                case 0x18: /* 16MB */
                        size = 1 << 24;
                        break;
-                default:
-                        dev_err(adap->pdev_dev, "Macronix Flash Part has bad size, ID = %#x, Density code = %#x\n",
-                                flashid, density);
-                        return -EINVAL;
                }
                break;
        }
@@ -8830,17 +8817,21 @@ static int t4_get_flash_params(struct adapter *adap)
                case 0x18: /* 16MB */
                        size = 1 << 24;
                        break;
-                default:
-                        dev_err(adap->pdev_dev, "Winbond Flash Part has bad size, ID = %#x, Density code = %#x\n",
-                                flashid, density);
-                        return -EINVAL;
                }
                break;
        }
-        default:
+        }
-                dev_err(adap->pdev_dev, "Unsupported Flash Part, ID = %#x\n",
-                        flashid);
+        /* If we didn't recognize the FLASH part, that's no real issue: the
-                return -EINVAL;
+         * Hardware/Software contract says that Hardware will _*ALWAYS*_
+         * use a FLASH part which is at least 4MB in size and has 64KB
+         * sectors.  The unrecognized FLASH part is likely to be much larger
+         * than 4MB, but that's all we really need.
+         */
+        if (size == 0) {
+                dev_warn(adap->pdev_dev, "Unknown Flash Part, ID = %#x, assuming 4MB\n",
+                         flashid);
+                size = 1 << 22;
        }
        /* Store decoded Flash size and fall through into vetting code. */
diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
index d0e196bff081..ffe7acbeaa22 100644
--- a/drivers/net/ethernet/ibm/ibmvnic.c
+++ b/drivers/net/ethernet/ibm/ibmvnic.c
@@ -329,7 +329,8 @@ static void replenish_rx_pool(struct ibmvnic_adapter *adapter,
        return;
 failure:
-        dev_info(dev, "replenish pools failure\n");
+        if (lpar_rc != H_PARAMETER && lpar_rc != H_CLOSED)
+                dev_err_ratelimited(dev, "rx: replenish packet buffer failed\n");
        pool->free_map[pool->next_free] = index;
        pool->rx_buff[index].skb = NULL;
@@ -1617,7 +1618,8 @@ static int ibmvnic_xmit(struct sk_buff *skb, struct net_device *netdev)
                                      &tx_crq);
        }
        if (lpar_rc != H_SUCCESS) {
-                dev_err(dev, "tx failed with code %ld\n", lpar_rc);
+                if (lpar_rc != H_CLOSED && lpar_rc != H_PARAMETER)
+                        dev_err_ratelimited(dev, "tx: send failed\n");
                dev_kfree_skb_any(skb);
                tx_buff->skb = NULL;
@@ -1825,8 +1827,8 @@ static int do_reset(struct ibmvnic_adapter *adapter,
                rc = ibmvnic_login(netdev);
                if (rc) {
-                        adapter->state = VNIC_PROBED;
+                        adapter->state = reset_state;
-                        return 0;
+                        return rc;
                }
                if (adapter->reset_reason == VNIC_RESET_CHANGE_PARAM ||
@@ -3204,6 +3206,25 @@ static union ibmvnic_crq *ibmvnic_next_crq(struct ibmvnic_adapter *adapter)
        return crq;
 }
+static void print_subcrq_error(struct device *dev, int rc, const char *func)
+{
+        switch (rc) {
+        case H_PARAMETER:
+                dev_warn_ratelimited(dev,
+                                     "%s failed: Send request is malformed or adapter failover pending. (rc=%d)\n",
+                                     func, rc);
+                break;
+        case H_CLOSED:
+                dev_warn_ratelimited(dev,
+                                     "%s failed: Backing queue closed. Adapter is down or failover pending. (rc=%d)\n",
+                                     func, rc);
+                break;
+        default:
+                dev_err_ratelimited(dev, "%s failed: (rc=%d)\n", func, rc);
+                break;
+        }
+}
 static int send_subcrq(struct ibmvnic_adapter *adapter, u64 remote_handle,
                       union sub_crq *sub_crq)
 {
@@ -3230,11 +3251,8 @@ static int send_subcrq(struct ibmvnic_adapter *adapter, u64 remote_handle,
                                cpu_to_be64(u64_crq[2]),
                                cpu_to_be64(u64_crq[3]));
-        if (rc) {
+        if (rc)
-                if (rc == H_CLOSED)
+                print_subcrq_error(dev, rc, __func__);
-                        dev_warn(dev, "CRQ Queue closed\n");
-                dev_err(dev, "Send error (rc=%d)\n", rc);
-        }
        return rc;
 }
@@ -3252,11 +3270,8 @@ static int send_subcrq_indirect(struct ibmvnic_adapter *adapter,
                                cpu_to_be64(remote_handle),
                                ioba, num_entries);
-        if (rc) {
+        if (rc)
-                if (rc == H_CLOSED)
+                print_subcrq_error(dev, rc, __func__);
-                        dev_warn(dev, "CRQ Queue closed\n");
-                dev_err(dev, "Send (indirect) error (rc=%d)\n", rc);
-        }
        return rc;
 }
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c
index 3f5c350716bb..0bd1294ba517 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c
@@ -1871,7 +1871,12 @@ s32 ixgbe_set_rar_generic(struct ixgbe_hw *hw, u32 index, u8 *addr, u32 vmdq,
        if (enable_addr != 0)
                rar_high |= IXGBE_RAH_AV;
+        /* Record lower 32 bits of MAC address and then make
+         * sure that write is flushed to hardware before writing
+         * the upper 16 bits and setting the valid bit.
+         */
        IXGBE_WRITE_REG(hw, IXGBE_RAL(index), rar_low);
+        IXGBE_WRITE_FLUSH(hw);
        IXGBE_WRITE_REG(hw, IXGBE_RAH(index), rar_high);
        return 0;
@@ -1903,8 +1908,13 @@ s32 ixgbe_clear_rar_generic(struct ixgbe_hw *hw, u32 index)
        rar_high = IXGBE_READ_REG(hw, IXGBE_RAH(index));
        rar_high &= ~(0x0000FFFF | IXGBE_RAH_AV);
-        IXGBE_WRITE_REG(hw, IXGBE_RAL(index), 0);
+        /* Clear the address valid bit and upper 16 bits of the address
+         * before clearing the lower bits. This way we aren't updating
+         * a live filter.
+         */
        IXGBE_WRITE_REG(hw, IXGBE_RAH(index), rar_high);
+        IXGBE_WRITE_FLUSH(hw);
+        IXGBE_WRITE_REG(hw, IXGBE_RAL(index), 0);
        /* clear VMDq pool/queue selection for this RAR */
        hw->mac.ops.clear_vmdq(hw, index, IXGBE_CLEAR_VMDQ_ALL);
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c
index c116f459945d..da4322e4daed 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c
@@ -839,7 +839,7 @@ int ixgbe_ipsec_tx(struct ixgbe_ring *tx_ring,
        }
        itd->sa_idx = xs->xso.offload_handle - IXGBE_IPSEC_BASE_TX_INDEX;
-        if (unlikely(itd->sa_idx > IXGBE_IPSEC_MAX_SA_COUNT)) {
+        if (unlikely(itd->sa_idx >= IXGBE_IPSEC_MAX_SA_COUNT)) {
                netdev_err(tx_ring->netdev, "%s: bad sa_idx=%d handle=%lu\n",
                           __func__, itd->sa_idx, xs->xso.offload_handle);
                return 0;
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_rx.c b/drivers/net/ethernet/mellanox/mlx4/en_rx.c
index 9f54ccbddea7..3360f7b9ee73 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_rx.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_rx.c
@@ -474,10 +474,10 @@ static int mlx4_en_complete_rx_desc(struct mlx4_en_priv *priv,
 {
        const struct mlx4_en_frag_info *frag_info = priv->frag_info;
        unsigned int truesize = 0;
+        bool release = true;
        int nr, frag_size;
        struct page *page;
        dma_addr_t dma;
-        bool release;
        /* Collect used fragments while replacing them in the HW descriptors */
        for (nr = 0;; frags++) {
@@ -500,7 +500,11 @@ static int mlx4_en_complete_rx_desc(struct mlx4_en_priv *priv,
                        release = page_count(page) != 1 ||
                                  page_is_pfmemalloc(page) ||
                                  page_to_nid(page) != numa_mem_id();
-                } else {
+                } else if (!priv->rx_headroom) {
+                        /* rx_headroom for non XDP setup is always 0.
+                         * When XDP is set, the above condition will
+                         * guarantee page is always released.
+                         */
                        u32 sz_align = ALIGN(frag_size, SMP_CACHE_BYTES);
                        frags->page_offset += sz_align;
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
index 6aaaf3d9ba31..77b2adb29341 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
@@ -4756,6 +4756,12 @@ static void mlxsw_sp_rt6_destroy(struct mlxsw_sp_rt6 *mlxsw_sp_rt6)
        kfree(mlxsw_sp_rt6);
 }
+static bool mlxsw_sp_fib6_rt_can_mp(const struct fib6_info *rt)
+{
+        /* RTF_CACHE routes are ignored */
+        return (rt->fib6_flags & (RTF_GATEWAY | RTF_ADDRCONF)) == RTF_GATEWAY;
+}
 static struct fib6_info *
 mlxsw_sp_fib6_entry_rt(const struct mlxsw_sp_fib6_entry *fib6_entry)
 {
@@ -4765,11 +4771,11 @@ mlxsw_sp_fib6_entry_rt(const struct mlxsw_sp_fib6_entry *fib6_entry)
 static struct mlxsw_sp_fib6_entry *
 mlxsw_sp_fib6_node_mp_entry_find(const struct mlxsw_sp_fib_node *fib_node,
-                                 const struct fib6_info *nrt, bool append)
+                                 const struct fib6_info *nrt, bool replace)
 {
        struct mlxsw_sp_fib6_entry *fib6_entry;
-        if (!append)
+        if (!mlxsw_sp_fib6_rt_can_mp(nrt) || replace)
                return NULL;
        list_for_each_entry(fib6_entry, &fib_node->entry_list, common.list) {
@@ -4784,7 +4790,8 @@ mlxsw_sp_fib6_node_mp_entry_find(const struct mlxsw_sp_fib_node *fib_node,
                        break;
                if (rt->fib6_metric < nrt->fib6_metric)
                        continue;
-                if (rt->fib6_metric == nrt->fib6_metric)
+                if (rt->fib6_metric == nrt->fib6_metric &&
+                    mlxsw_sp_fib6_rt_can_mp(rt))
                        return fib6_entry;
                if (rt->fib6_metric > nrt->fib6_metric)
                        break;
@@ -5163,7 +5170,7 @@ static struct mlxsw_sp_fib6_entry *
 mlxsw_sp_fib6_node_entry_find(const struct mlxsw_sp_fib_node *fib_node,
                              const struct fib6_info *nrt, bool replace)
 {
-        struct mlxsw_sp_fib6_entry *fib6_entry;
+        struct mlxsw_sp_fib6_entry *fib6_entry, *fallback = NULL;
        list_for_each_entry(fib6_entry, &fib_node->entry_list, common.list) {
                struct fib6_info *rt = mlxsw_sp_fib6_entry_rt(fib6_entry);
@@ -5172,13 +5179,18 @@ mlxsw_sp_fib6_node_entry_find(const struct mlxsw_sp_fib_node *fib_node,
                        continue;
                if (rt->fib6_table->tb6_id != nrt->fib6_table->tb6_id)
                        break;
-                if (replace && rt->fib6_metric == nrt->fib6_metric)
+                if (replace && rt->fib6_metric == nrt->fib6_metric) {
-                        return fib6_entry;
+                        if (mlxsw_sp_fib6_rt_can_mp(rt) ==
+                            mlxsw_sp_fib6_rt_can_mp(nrt))
+                                return fib6_entry;
+                        if (mlxsw_sp_fib6_rt_can_mp(nrt))
+                                fallback = fallback ?: fib6_entry;
+                }
                if (rt->fib6_metric > nrt->fib6_metric)
-                        return fib6_entry;
+                        return fallback ?: fib6_entry;
        }
-        return NULL;
+        return fallback;
 }
 static int
@@ -5304,8 +5316,7 @@ static void mlxsw_sp_fib6_entry_replace(struct mlxsw_sp *mlxsw_sp,
 }
 static int mlxsw_sp_router_fib6_add(struct mlxsw_sp *mlxsw_sp,
-                                    struct fib6_info *rt, bool replace,
+                                    struct fib6_info *rt, bool replace)
-                                    bool append)
 {
        struct mlxsw_sp_fib6_entry *fib6_entry;
        struct mlxsw_sp_fib_node *fib_node;
@@ -5331,7 +5342,7 @@ static int mlxsw_sp_router_fib6_add(struct mlxsw_sp *mlxsw_sp,
        /* Before creating a new entry, try to append route to an existing
         * multipath entry.
         */
-        fib6_entry = mlxsw_sp_fib6_node_mp_entry_find(fib_node, rt, append);
+        fib6_entry = mlxsw_sp_fib6_node_mp_entry_find(fib_node, rt, replace);
        if (fib6_entry) {
                err = mlxsw_sp_fib6_entry_nexthop_add(mlxsw_sp, fib6_entry, rt);
                if (err)
@@ -5339,14 +5350,6 @@ static int mlxsw_sp_router_fib6_add(struct mlxsw_sp *mlxsw_sp,
                return 0;
        }
-        /* We received an append event, yet did not find any route to
-         * append to.
-         */
-        if (WARN_ON(append)) {
-                err = -EINVAL;
-                goto err_fib6_entry_append;
-        }
        fib6_entry = mlxsw_sp_fib6_entry_create(mlxsw_sp, fib_node, rt);
        if (IS_ERR(fib6_entry)) {
                err = PTR_ERR(fib6_entry);
@@ -5364,7 +5367,6 @@ static int mlxsw_sp_router_fib6_add(struct mlxsw_sp *mlxsw_sp,
 err_fib6_node_entry_link:
        mlxsw_sp_fib6_entry_destroy(mlxsw_sp, fib6_entry);
 err_fib6_entry_create:
-err_fib6_entry_append:
 err_fib6_entry_nexthop_add:
        mlxsw_sp_fib_node_put(mlxsw_sp, fib_node);
        return err;
@@ -5715,7 +5717,7 @@ static void mlxsw_sp_router_fib6_event_work(struct work_struct *work)
        struct mlxsw_sp_fib_event_work *fib_work =
                container_of(work, struct mlxsw_sp_fib_event_work, work);
        struct mlxsw_sp *mlxsw_sp = fib_work->mlxsw_sp;
-        bool replace, append;
+        bool replace;
        int err;
        rtnl_lock();
@@ -5726,10 +5728,8 @@ static void mlxsw_sp_router_fib6_event_work(struct work_struct *work)
        case FIB_EVENT_ENTRY_APPEND: /* fall through */
        case FIB_EVENT_ENTRY_ADD:
                replace = fib_work->event == FIB_EVENT_ENTRY_REPLACE;
-                append = fib_work->event == FIB_EVENT_ENTRY_APPEND;
                err = mlxsw_sp_router_fib6_add(mlxsw_sp,
-                                               fib_work->fen6_info.rt, replace,
+                                               fib_work->fen6_info.rt, replace);
-                                               append);
                if (err)
                        mlxsw_sp_router_fib_abort(mlxsw_sp);
                mlxsw_sp_rt6_release(fib_work->fen6_info.rt);
diff --git a/drivers/net/ethernet/qlogic/qed/qed.h b/drivers/net/ethernet/qlogic/qed/qed.h
index 00db3401b898..1dfaccd151f0 100644
--- a/drivers/net/ethernet/qlogic/qed/qed.h
+++ b/drivers/net/ethernet/qlogic/qed/qed.h
@@ -502,6 +502,7 @@ enum BAR_ID {
 struct qed_nvm_image_info {
        u32 num_images;
        struct bist_nvm_image_att *image_att;
+        bool valid;
 };
 #define DRV_MODULE_VERSION                    \
diff --git a/drivers/net/ethernet/qlogic/qed/qed_debug.c b/drivers/net/ethernet/qlogic/qed/qed_debug.c
index a14e48489029..4340c4c90bcb 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_debug.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_debug.c
@@ -6723,7 +6723,7 @@ static enum dbg_status qed_parse_mcp_trace_buf(u8 *trace_buf,
                format_idx = header & MFW_TRACE_EVENTID_MASK;
                /* Skip message if its index doesn't exist in the meta data */
-                if (format_idx > s_mcp_trace_meta.formats_num) {
+                if (format_idx >= s_mcp_trace_meta.formats_num) {
                        u8 format_size =
                                (u8)((header & MFW_TRACE_PRM_SIZE_MASK) >>
                                     MFW_TRACE_PRM_SIZE_SHIFT);
diff --git a/drivers/net/ethernet/qlogic/qed/qed_main.c b/drivers/net/ethernet/qlogic/qed/qed_main.c
index 0cbc74d6ca8b..758a9a5127fa 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_main.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_main.c
@@ -371,7 +371,7 @@ static struct qed_dev *qed_probe(struct pci_dev *pdev,
                goto err2;
        }
-        DP_INFO(cdev, "qed_probe completed successffuly\n");
+        DP_INFO(cdev, "qed_probe completed successfully\n");
        return cdev;
diff --git a/drivers/net/ethernet/qlogic/qed/qed_mcp.c b/drivers/net/ethernet/qlogic/qed/qed_mcp.c
index 4e0b443c9519..9d9e533bccdc 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_mcp.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_mcp.c
@@ -592,6 +592,9 @@ int qed_mcp_nvm_wr_cmd(struct qed_hwfn *p_hwfn,
        *o_mcp_resp = mb_params.mcp_resp;
        *o_mcp_param = mb_params.mcp_param;
+        /* nvm_info needs to be updated */
+        p_hwfn->nvm_info.valid = false;
        return 0;
 }
@@ -2555,11 +2558,14 @@ int qed_mcp_bist_nvm_get_image_att(struct qed_hwfn *p_hwfn,
 int qed_mcp_nvm_info_populate(struct qed_hwfn *p_hwfn)
 {
-        struct qed_nvm_image_info *nvm_info = &p_hwfn->nvm_info;
+        struct qed_nvm_image_info nvm_info;
        struct qed_ptt *p_ptt;
        int rc;
        u32 i;
+        if (p_hwfn->nvm_info.valid)
+                return 0;
        p_ptt = qed_ptt_acquire(p_hwfn);
        if (!p_ptt) {
                DP_ERR(p_hwfn, "failed to acquire ptt\n");
@@ -2567,29 +2573,29 @@ int qed_mcp_nvm_info_populate(struct qed_hwfn *p_hwfn)
        }
        /* Acquire from MFW the amount of available images */
-        nvm_info->num_images = 0;
+        nvm_info.num_images = 0;
        rc = qed_mcp_bist_nvm_get_num_images(p_hwfn,
-                                             p_ptt, &nvm_info->num_images);
+                                             p_ptt, &nvm_info.num_images);
        if (rc == -EOPNOTSUPP) {
                DP_INFO(p_hwfn, "DRV_MSG_CODE_BIST_TEST is not supported\n");
                goto out;
-        } else if (rc || !nvm_info->num_images) {
+        } else if (rc || !nvm_info.num_images) {
                DP_ERR(p_hwfn, "Failed getting number of images\n");
                goto err0;
        }
-        nvm_info->image_att = kmalloc_array(nvm_info->num_images,
+        nvm_info.image_att = kmalloc_array(nvm_info.num_images,
-                                            sizeof(struct bist_nvm_image_att),
+                                           sizeof(struct bist_nvm_image_att),
-                                            GFP_KERNEL);
+                                           GFP_KERNEL);
-        if (!nvm_info->image_att) {
+        if (!nvm_info.image_att) {
                rc = -ENOMEM;
                goto err0;
        }
        /* Iterate over images and get their attributes */
-        for (i = 0; i < nvm_info->num_images; i++) {
+        for (i = 0; i < nvm_info.num_images; i++) {
                rc = qed_mcp_bist_nvm_get_image_att(p_hwfn, p_ptt,
-                                                    &nvm_info->image_att[i], i);
+                                                    &nvm_info.image_att[i], i);
                if (rc) {
                        DP_ERR(p_hwfn,
                               "Failed getting image index %d attributes\n", i);
@@ -2597,14 +2603,22 @@ int qed_mcp_nvm_info_populate(struct qed_hwfn *p_hwfn)
                }
                DP_VERBOSE(p_hwfn, QED_MSG_SP, "image index %d, size %x\n", i,
-                           nvm_info->image_att[i].len);
+                           nvm_info.image_att[i].len);
        }
 out:
+        /* Update hwfn's nvm_info */
+        if (nvm_info.num_images) {
+                p_hwfn->nvm_info.num_images = nvm_info.num_images;
+                kfree(p_hwfn->nvm_info.image_att);
+                p_hwfn->nvm_info.image_att = nvm_info.image_att;
+                p_hwfn->nvm_info.valid = true;
+        }
        qed_ptt_release(p_hwfn, p_ptt);
        return 0;
 err1:
-        kfree(nvm_info->image_att);
+        kfree(nvm_info.image_att);
 err0:
        qed_ptt_release(p_hwfn, p_ptt);
        return rc;
@@ -2641,6 +2655,7 @@ qed_mcp_get_nvm_image_att(struct qed_hwfn *p_hwfn,
                return -EINVAL;
        }
+        qed_mcp_nvm_info_populate(p_hwfn);
        for (i = 0; i < p_hwfn->nvm_info.num_images; i++)
                if (type == p_hwfn->nvm_info.image_att[i].image_type)
                        break;
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sysfs.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sysfs.c
index 891f03a7a33d..8d7b9bb910f2 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sysfs.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sysfs.c
@@ -1128,6 +1128,8 @@ static ssize_t qlcnic_83xx_sysfs_flash_write_handler(struct file *filp,
        struct qlcnic_adapter *adapter = dev_get_drvdata(dev);
        ret = kstrtoul(buf, 16, &data);
+        if (ret)
+                return ret;
        switch (data) {
        case QLC_83XX_FLASH_SECTOR_ERASE_CMD:
diff --git a/drivers/net/ethernet/qualcomm/qca_spi.c b/drivers/net/ethernet/qualcomm/qca_spi.c
index 5803cd6db406..206f0266463e 100644
--- a/drivers/net/ethernet/qualcomm/qca_spi.c
+++ b/drivers/net/ethernet/qualcomm/qca_spi.c
@@ -658,7 +658,7 @@ qcaspi_netdev_open(struct net_device *dev)
                return ret;
        }
-        netif_start_queue(qca->net_dev);
+        /* SPI thread takes care of TX queue */
        return 0;
 }
@@ -760,6 +760,9 @@ qcaspi_netdev_tx_timeout(struct net_device *dev)
        qca->net_dev->stats.tx_errors++;
        /* Trigger tx queue flush and QCA7000 reset */
        qca->sync = QCASPI_SYNC_UNKNOWN;
+        if (qca->spi_thread)
+                wake_up_process(qca->spi_thread);
 }
 static int
@@ -878,22 +881,22 @@ qca_spi_probe(struct spi_device *spi)
        if ((qcaspi_clkspeed < QCASPI_CLK_SPEED_MIN) ||
            (qcaspi_clkspeed > QCASPI_CLK_SPEED_MAX)) {
-                dev_info(&spi->dev, "Invalid clkspeed: %d\n",
+                dev_err(&spi->dev, "Invalid clkspeed: %d\n",
-                         qcaspi_clkspeed);
+                        qcaspi_clkspeed);
                return -EINVAL;
        }
        if ((qcaspi_burst_len < QCASPI_BURST_LEN_MIN) ||
            (qcaspi_burst_len > QCASPI_BURST_LEN_MAX)) {
-                dev_info(&spi->dev, "Invalid burst len: %d\n",
+                dev_err(&spi->dev, "Invalid burst len: %d\n",
-                         qcaspi_burst_len);
+                        qcaspi_burst_len);
                return -EINVAL;
        }
        if ((qcaspi_pluggable < QCASPI_PLUGGABLE_MIN) ||
            (qcaspi_pluggable > QCASPI_PLUGGABLE_MAX)) {
-                dev_info(&spi->dev, "Invalid pluggable: %d\n",
+                dev_err(&spi->dev, "Invalid pluggable: %d\n",
-                         qcaspi_pluggable);
+                        qcaspi_pluggable);
                return -EINVAL;
        }
@@ -955,8 +958,8 @@ qca_spi_probe(struct spi_device *spi)
        }
        if (register_netdev(qcaspi_devs)) {
-                dev_info(&spi->dev, "Unable to register net device %s\n",
+                dev_err(&spi->dev, "Unable to register net device %s\n",
-                         qcaspi_devs->name);
+                        qcaspi_devs->name);
                free_netdev(qcaspi_devs);
                return -EFAULT;
        }
diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
index f4cae2be0fda..a3f69901ac87 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -7789,6 +7789,7 @@ static int rtl_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
                NETIF_F_HW_VLAN_CTAG_RX;
        dev->vlan_features = NETIF_F_SG | NETIF_F_IP_CSUM | NETIF_F_TSO |
                NETIF_F_HIGHDMA;
+        dev->priv_flags |= IFF_LIVE_ADDR_CHANGE;
        tp->cp_cmd |= RxChkSum | RxVlan;
diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c
index 68f122140966..0d811c02ff34 100644
--- a/drivers/net/ethernet/renesas/ravb_main.c
+++ b/drivers/net/ethernet/renesas/ravb_main.c
@@ -980,6 +980,13 @@ static void ravb_adjust_link(struct net_device *ndev)
        struct ravb_private *priv = netdev_priv(ndev);
        struct phy_device *phydev = ndev->phydev;
        bool new_state = false;
+        unsigned long flags;
+        spin_lock_irqsave(&priv->lock, flags);
+        /* Disable TX and RX right over here, if E-MAC change is ignored */
+        if (priv->no_avb_link)
+                ravb_rcv_snd_disable(ndev);
        if (phydev->link) {
                if (phydev->duplex != priv->duplex) {
@@ -997,18 +1004,21 @@ static void ravb_adjust_link(struct net_device *ndev)
                        ravb_modify(ndev, ECMR, ECMR_TXF, 0);
                        new_state = true;
                        priv->link = phydev->link;
-                        if (priv->no_avb_link)
-                                ravb_rcv_snd_enable(ndev);
                }
        } else if (priv->link) {
                new_state = true;
                priv->link = 0;
                priv->speed = 0;
                priv->duplex = -1;
-                if (priv->no_avb_link)
-                        ravb_rcv_snd_disable(ndev);
        }
+        /* Enable TX and RX right over here, if E-MAC change is ignored */
+        if (priv->no_avb_link && phydev->link)
+                ravb_rcv_snd_enable(ndev);
+        mmiowb();
+        spin_unlock_irqrestore(&priv->lock, flags);
        if (new_state && netif_msg_link(priv))
                phy_print_status(phydev);
 }
@@ -1096,75 +1106,6 @@ static int ravb_phy_start(struct net_device *ndev)
        return 0;
 }
-static int ravb_get_link_ksettings(struct net_device *ndev,
-                                   struct ethtool_link_ksettings *cmd)
-{
-        struct ravb_private *priv = netdev_priv(ndev);
-        unsigned long flags;
-        if (!ndev->phydev)
-                return -ENODEV;
-        spin_lock_irqsave(&priv->lock, flags);
-        phy_ethtool_ksettings_get(ndev->phydev, cmd);
-        spin_unlock_irqrestore(&priv->lock, flags);
-        return 0;
-}
-static int ravb_set_link_ksettings(struct net_device *ndev,
-                                   const struct ethtool_link_ksettings *cmd)
-{
-        struct ravb_private *priv = netdev_priv(ndev);
-        unsigned long flags;
-        int error;
-        if (!ndev->phydev)
-                return -ENODEV;
-        spin_lock_irqsave(&priv->lock, flags);
-        /* Disable TX and RX */
-        ravb_rcv_snd_disable(ndev);
-        error = phy_ethtool_ksettings_set(ndev->phydev, cmd);
-        if (error)
-                goto error_exit;
-        if (cmd->base.duplex == DUPLEX_FULL)
-                priv->duplex = 1;
-        else
-                priv->duplex = 0;
-        ravb_set_duplex(ndev);
-error_exit:
-        mdelay(1);
-        /* Enable TX and RX */
-        ravb_rcv_snd_enable(ndev);
-        mmiowb();
-        spin_unlock_irqrestore(&priv->lock, flags);
-        return error;
-}
-static int ravb_nway_reset(struct net_device *ndev)
-{
-        struct ravb_private *priv = netdev_priv(ndev);
-        int error = -ENODEV;
-        unsigned long flags;
-        if (ndev->phydev) {
-                spin_lock_irqsave(&priv->lock, flags);
-                error = phy_start_aneg(ndev->phydev);
-                spin_unlock_irqrestore(&priv->lock, flags);
-        }
-        return error;
-}
 static u32 ravb_get_msglevel(struct net_device *ndev)
 {
        struct ravb_private *priv = netdev_priv(ndev);
@@ -1377,7 +1318,7 @@ static int ravb_set_wol(struct net_device *ndev, struct ethtool_wolinfo *wol)
 }
 static const struct ethtool_ops ravb_ethtool_ops = {
-        .nway_reset             = ravb_nway_reset,
+        .nway_reset             = phy_ethtool_nway_reset,
        .get_msglevel           = ravb_get_msglevel,
        .set_msglevel           = ravb_set_msglevel,
        .get_link               = ethtool_op_get_link,
@@ -1387,8 +1328,8 @@ static const struct ethtool_ops ravb_ethtool_ops = {
        .get_ringparam          = ravb_get_ringparam,
        .set_ringparam          = ravb_set_ringparam,
        .get_ts_info            = ravb_get_ts_info,
-        .get_link_ksettings     = ravb_get_link_ksettings,
+        .get_link_ksettings     = phy_ethtool_get_link_ksettings,
-        .set_link_ksettings     = ravb_set_link_ksettings,
+        .set_link_ksettings     = phy_ethtool_set_link_ksettings,
        .get_wol                = ravb_get_wol,
        .set_wol                = ravb_set_wol,
 };
diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
index e9007b613f17..5614fd231bbe 100644
--- a/drivers/net/ethernet/renesas/sh_eth.c
+++ b/drivers/net/ethernet/renesas/sh_eth.c
@@ -1927,8 +1927,15 @@ static void sh_eth_adjust_link(struct net_device *ndev)
 {
        struct sh_eth_private *mdp = netdev_priv(ndev);
        struct phy_device *phydev = ndev->phydev;
+        unsigned long flags;
        int new_state = 0;
+        spin_lock_irqsave(&mdp->lock, flags);
+        /* Disable TX and RX right over here, if E-MAC change is ignored */
+        if (mdp->cd->no_psr || mdp->no_ether_link)
+                sh_eth_rcv_snd_disable(ndev);
        if (phydev->link) {
                if (phydev->duplex != mdp->duplex) {
                        new_state = 1;
@@ -1947,18 +1954,21 @@ static void sh_eth_adjust_link(struct net_device *ndev)
                        sh_eth_modify(ndev, ECMR, ECMR_TXF, 0);
                        new_state = 1;
                        mdp->link = phydev->link;
-                        if (mdp->cd->no_psr || mdp->no_ether_link)
-                                sh_eth_rcv_snd_enable(ndev);
                }
        } else if (mdp->link) {
                new_state = 1;
                mdp->link = 0;
                mdp->speed = 0;
                mdp->duplex = -1;
-                if (mdp->cd->no_psr || mdp->no_ether_link)
-                        sh_eth_rcv_snd_disable(ndev);
        }
+        /* Enable TX and RX right over here, if E-MAC change is ignored */
+        if ((mdp->cd->no_psr || mdp->no_ether_link) && phydev->link)
+                sh_eth_rcv_snd_enable(ndev);
+        mmiowb();
+        spin_unlock_irqrestore(&mdp->lock, flags);
        if (new_state && netif_msg_link(mdp))
                phy_print_status(phydev);
 }
@@ -2030,60 +2040,6 @@ static int sh_eth_phy_start(struct net_device *ndev)
        return 0;
 }
-static int sh_eth_get_link_ksettings(struct net_device *ndev,
-                                     struct ethtool_link_ksettings *cmd)
-{
-        struct sh_eth_private *mdp = netdev_priv(ndev);
-        unsigned long flags;
-        if (!ndev->phydev)
-                return -ENODEV;
-        spin_lock_irqsave(&mdp->lock, flags);
-        phy_ethtool_ksettings_get(ndev->phydev, cmd);
-        spin_unlock_irqrestore(&mdp->lock, flags);
-        return 0;
-}
-static int sh_eth_set_link_ksettings(struct net_device *ndev,
-                                     const struct ethtool_link_ksettings *cmd)
-{
-        struct sh_eth_private *mdp = netdev_priv(ndev);
-        unsigned long flags;
-        int ret;
-        if (!ndev->phydev)
-                return -ENODEV;
-        spin_lock_irqsave(&mdp->lock, flags);
-        /* disable tx and rx */
-        sh_eth_rcv_snd_disable(ndev);
-        ret = phy_ethtool_ksettings_set(ndev->phydev, cmd);
-        if (ret)
-                goto error_exit;
-        if (cmd->base.duplex == DUPLEX_FULL)
-                mdp->duplex = 1;
-        else
-                mdp->duplex = 0;
-        if (mdp->cd->set_duplex)
-                mdp->cd->set_duplex(ndev);
-error_exit:
-        mdelay(1);
-        /* enable tx and rx */
-        sh_eth_rcv_snd_enable(ndev);
-        spin_unlock_irqrestore(&mdp->lock, flags);
-        return ret;
-}
 /* If it is ever necessary to increase SH_ETH_REG_DUMP_MAX_REGS, the
 * version must be bumped as well.  Just adding registers up to that
 * limit is fine, as long as the existing register indices don't
@@ -2263,22 +2219,6 @@ static void sh_eth_get_regs(struct net_device *ndev, struct ethtool_regs *regs,
        pm_runtime_put_sync(&mdp->pdev->dev);
 }
-static int sh_eth_nway_reset(struct net_device *ndev)
-{
-        struct sh_eth_private *mdp = netdev_priv(ndev);
-        unsigned long flags;
-        int ret;
-        if (!ndev->phydev)
-                return -ENODEV;
-        spin_lock_irqsave(&mdp->lock, flags);
-        ret = phy_start_aneg(ndev->phydev);
-        spin_unlock_irqrestore(&mdp->lock, flags);
-        return ret;
-}
 static u32 sh_eth_get_msglevel(struct net_device *ndev)
 {
        struct sh_eth_private *mdp = netdev_priv(ndev);
@@ -2429,7 +2369,7 @@ static int sh_eth_set_wol(struct net_device *ndev, struct ethtool_wolinfo *wol)
 static const struct ethtool_ops sh_eth_ethtool_ops = {
        .get_regs_len   = sh_eth_get_regs_len,
        .get_regs       = sh_eth_get_regs,
-        .nway_reset     = sh_eth_nway_reset,
+        .nway_reset     = phy_ethtool_nway_reset,
        .get_msglevel   = sh_eth_get_msglevel,
        .set_msglevel   = sh_eth_set_msglevel,
        .get_link       = ethtool_op_get_link,
@@ -2438,8 +2378,8 @@ static const struct ethtool_ops sh_eth_ethtool_ops = {
        .get_sset_count     = sh_eth_get_sset_count,
        .get_ringparam  = sh_eth_get_ringparam,
        .set_ringparam  = sh_eth_set_ringparam,
-        .get_link_ksettings = sh_eth_get_link_ksettings,
+        .get_link_ksettings = phy_ethtool_get_link_ksettings,
-        .set_link_ksettings = sh_eth_set_link_ksettings,
+        .set_link_ksettings = phy_ethtool_set_link_ksettings,
        .get_wol        = sh_eth_get_wol,
        .set_wol        = sh_eth_set_wol,
 };
diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c
index 23f0785c0573..7eeac3d6cfe8 100644
--- a/drivers/net/ethernet/sfc/ef10.c
+++ b/drivers/net/ethernet/sfc/ef10.c
@@ -4288,9 +4288,9 @@ static int efx_ef10_filter_pri(struct efx_ef10_filter_table *table,
        return -EPROTONOSUPPORT;
 }
-static s32 efx_ef10_filter_insert(struct efx_nic *efx,
+static s32 efx_ef10_filter_insert_locked(struct efx_nic *efx,
-                                  struct efx_filter_spec *spec,
+                                         struct efx_filter_spec *spec,
-                                  bool replace_equal)
+                                         bool replace_equal)
 {
        DECLARE_BITMAP(mc_rem_map, EFX_EF10_FILTER_SEARCH_LIMIT);
        struct efx_ef10_nic_data *nic_data = efx->nic_data;
@@ -4307,7 +4307,7 @@ static s32 efx_ef10_filter_insert(struct efx_nic *efx,
        bool is_mc_recip;
        s32 rc;
-        down_read(&efx->filter_sem);
+        WARN_ON(!rwsem_is_locked(&efx->filter_sem));
        table = efx->filter_state;
        down_write(&table->lock);
@@ -4498,10 +4498,22 @@ out_unlock:
        if (rss_locked)
                mutex_unlock(&efx->rss_lock);
        up_write(&table->lock);
-        up_read(&efx->filter_sem);
        return rc;
 }
+static s32 efx_ef10_filter_insert(struct efx_nic *efx,
+                                  struct efx_filter_spec *spec,
+                                  bool replace_equal)
+{
+        s32 ret;
+        down_read(&efx->filter_sem);
+        ret = efx_ef10_filter_insert_locked(efx, spec, replace_equal);
+        up_read(&efx->filter_sem);
+        return ret;
+}
 static void efx_ef10_filter_update_rx_scatter(struct efx_nic *efx)
 {
        /* no need to do anything here on EF10 */
@@ -5285,7 +5297,7 @@ static int efx_ef10_filter_insert_addr_list(struct efx_nic *efx,
                EFX_WARN_ON_PARANOID(ids[i] != EFX_EF10_FILTER_ID_INVALID);
                efx_filter_init_rx(&spec, EFX_FILTER_PRI_AUTO, filter_flags, 0);
                efx_filter_set_eth_local(&spec, vlan->vid, addr_list[i].addr);
-                rc = efx_ef10_filter_insert(efx, &spec, true);
+                rc = efx_ef10_filter_insert_locked(efx, &spec, true);
                if (rc < 0) {
                        if (rollback) {
                                netif_info(efx, drv, efx->net_dev,
@@ -5314,7 +5326,7 @@ static int efx_ef10_filter_insert_addr_list(struct efx_nic *efx,
                efx_filter_init_rx(&spec, EFX_FILTER_PRI_AUTO, filter_flags, 0);
                eth_broadcast_addr(baddr);
                efx_filter_set_eth_local(&spec, vlan->vid, baddr);
-                rc = efx_ef10_filter_insert(efx, &spec, true);
+                rc = efx_ef10_filter_insert_locked(efx, &spec, true);
                if (rc < 0) {
                        netif_warn(efx, drv, efx->net_dev,
                                   "Broadcast filter insert failed rc=%d\n", rc);
@@ -5370,7 +5382,7 @@ static int efx_ef10_filter_insert_def(struct efx_nic *efx,
        if (vlan->vid != EFX_FILTER_VID_UNSPEC)
                efx_filter_set_eth_local(&spec, vlan->vid, NULL);
-        rc = efx_ef10_filter_insert(efx, &spec, true);
+        rc = efx_ef10_filter_insert_locked(efx, &spec, true);
        if (rc < 0) {
                const char *um = multicast ? "Multicast" : "Unicast";
                const char *encap_name = "";
@@ -5430,7 +5442,7 @@ static int efx_ef10_filter_insert_def(struct efx_nic *efx,
                                           filter_flags, 0);
                        eth_broadcast_addr(baddr);
                        efx_filter_set_eth_local(&spec, vlan->vid, baddr);
-                        rc = efx_ef10_filter_insert(efx, &spec, true);
+                        rc = efx_ef10_filter_insert_locked(efx, &spec, true);
                        if (rc < 0) {
                                netif_warn(efx, drv, efx->net_dev,
                                           "Broadcast filter insert failed rc=%d\n",
diff --git a/drivers/net/ethernet/sfc/efx.c b/drivers/net/ethernet/sfc/efx.c
index 570ec72266f3..ce3a177081a8 100644
--- a/drivers/net/ethernet/sfc/efx.c
+++ b/drivers/net/ethernet/sfc/efx.c
@@ -1871,12 +1871,6 @@ static void efx_remove_filters(struct efx_nic *efx)
        up_write(&efx->filter_sem);
 }
-static void efx_restore_filters(struct efx_nic *efx)
-{
-        down_read(&efx->filter_sem);
-        efx->type->filter_table_restore(efx);
-        up_read(&efx->filter_sem);
-}
 /**************************************************************************
 *
@@ -2688,6 +2682,7 @@ void efx_reset_down(struct efx_nic *efx, enum reset_type method)
        efx_disable_interrupts(efx);
        mutex_lock(&efx->mac_lock);
+        down_write(&efx->filter_sem);
        mutex_lock(&efx->rss_lock);
        if (efx->port_initialized && method != RESET_TYPE_INVISIBLE &&
            method != RESET_TYPE_DATAPATH)
@@ -2745,9 +2740,8 @@ int efx_reset_up(struct efx_nic *efx, enum reset_type method, bool ok)
        if (efx->type->rx_restore_rss_contexts)
                efx->type->rx_restore_rss_contexts(efx);
        mutex_unlock(&efx->rss_lock);
-        down_read(&efx->filter_sem);
+        efx->type->filter_table_restore(efx);
-        efx_restore_filters(efx);
+        up_write(&efx->filter_sem);
-        up_read(&efx->filter_sem);
        if (efx->type->sriov_reset)
                efx->type->sriov_reset(efx);
@@ -2764,6 +2758,7 @@ fail:
        efx->port_initialized = false;
        mutex_unlock(&efx->rss_lock);
+        up_write(&efx->filter_sem);
        mutex_unlock(&efx->mac_lock);
        return rc;
@@ -3473,7 +3468,9 @@ static int efx_pci_probe_main(struct efx_nic *efx)
        efx_init_napi(efx);
+        down_write(&efx->filter_sem);
        rc = efx->type->init(efx);
+        up_write(&efx->filter_sem);
        if (rc) {
                netif_err(efx, probe, efx->net_dev,
                          "failed to initialise NIC\n");
@@ -3765,7 +3762,9 @@ static int efx_pm_resume(struct device *dev)
        rc = efx->type->reset(efx, RESET_TYPE_ALL);
        if (rc)
                return rc;
+        down_write(&efx->filter_sem);
        rc = efx->type->init(efx);
+        up_write(&efx->filter_sem);
        if (rc)
                return rc;
        rc = efx_pm_thaw(dev);
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
index 2e6e2a96b4f2..f9a61f90cfbc 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
@@ -37,7 +37,7 @@
 *              is done in the "stmmac files"
 */
-/* struct emac_variant - Descrive dwmac-sun8i hardware variant
+/* struct emac_variant - Describe dwmac-sun8i hardware variant
 * @default_syscon_value:       The default value of the EMAC register in syscon
 *                              This value is used for disabling properly EMAC
 *                              and used as a good starting value in case of the
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
index 6d141f3931eb..72da77b94ecd 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
@@ -94,7 +94,6 @@ static int dwmac1000_validate_ucast_entries(int ucast_entries)
 /**
 * stmmac_axi_setup - parse DT parameters for programming the AXI register
 * @pdev: platform device
- * @priv: driver private struct.
 * Description:
 * if required, from device-tree the AXI internal register can be tuned
 * by using platform parameters.
diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c
index 8e9d0ee1572b..31c3d77b4733 100644
--- a/drivers/net/hyperv/netvsc.c
+++ b/drivers/net/hyperv/netvsc.c
@@ -1274,6 +1274,7 @@ int netvsc_poll(struct napi_struct *napi, int budget)
        struct hv_device *device = netvsc_channel_to_device(channel);
        struct net_device *ndev = hv_get_drvdata(device);
        int work_done = 0;
+        int ret;
        /* If starting a new interval */
        if (!nvchan->desc)
@@ -1285,16 +1286,18 @@ int netvsc_poll(struct napi_struct *napi, int budget)
                nvchan->desc = hv_pkt_iter_next(channel, nvchan->desc);
        }
-        /* If send of pending receive completions suceeded
+        /* Send any pending receive completions */
-         *   and did not exhaust NAPI budget this time
+        ret = send_recv_completions(ndev, net_device, nvchan);
-         *   and not doing busy poll
+        /* If it did not exhaust NAPI budget this time
+         *  and not doing busy poll
         * then re-enable host interrupts
-         *     and reschedule if ring is not empty.
+         *  and reschedule if ring is not empty
+         *   or sending receive completion failed.
         */
-        if (send_recv_completions(ndev, net_device, nvchan) == 0 &&
+        if (work_done < budget &&
-            work_done < budget &&
            napi_complete_done(napi, work_done) &&
-            hv_end_read(&channel->inbound) &&
+            (ret || hv_end_read(&channel->inbound)) &&
            napi_schedule_prep(napi)) {
                hv_begin_read(&channel->inbound);
                __napi_schedule(napi);
diff --git a/drivers/net/hyperv/rndis_filter.c b/drivers/net/hyperv/rndis_filter.c
index 9b4e3c3787e5..408ece27131c 100644
--- a/drivers/net/hyperv/rndis_filter.c
+++ b/drivers/net/hyperv/rndis_filter.c
@@ -1338,6 +1338,7 @@ out:
        /* setting up multiple channels failed */
        net_device->max_chn = 1;
        net_device->num_chn = 1;
+        return 0;
 err_dev_remv:
        rndis_filter_device_remove(dev, net_device);
diff --git a/drivers/net/ieee802154/adf7242.c b/drivers/net/ieee802154/adf7242.c
index 64f1b1e77bc0..23a52b9293f3 100644
--- a/drivers/net/ieee802154/adf7242.c
+++ b/drivers/net/ieee802154/adf7242.c
@@ -275,6 +275,8 @@ struct adf7242_local {
        struct spi_message stat_msg;
        struct spi_transfer stat_xfer;
        struct dentry *debugfs_root;
+        struct delayed_work work;
+        struct workqueue_struct *wqueue;
        unsigned long flags;
        int tx_stat;
        bool promiscuous;
@@ -575,10 +577,26 @@ static int adf7242_cmd_rx(struct adf7242_local *lp)
        /* Wait until the ACK is sent */
        adf7242_wait_status(lp, RC_STATUS_PHY_RDY, RC_STATUS_MASK, __LINE__);
        adf7242_clear_irqstat(lp);
+        mod_delayed_work(lp->wqueue, &lp->work, msecs_to_jiffies(400));
        return adf7242_cmd(lp, CMD_RC_RX);
 }
+static void adf7242_rx_cal_work(struct work_struct *work)
+{
+        struct adf7242_local *lp =
+        container_of(work, struct adf7242_local, work.work);
+        /* Reissuing RC_RX every 400ms - to adjust for offset
+         * drift in receiver (datasheet page 61, OCL section)
+         */
+        if (!test_bit(FLAG_XMIT, &lp->flags)) {
+                adf7242_cmd(lp, CMD_RC_PHY_RDY);
+                adf7242_cmd_rx(lp);
+        }
+}
 static int adf7242_set_txpower(struct ieee802154_hw *hw, int mbm)
 {
        struct adf7242_local *lp = hw->priv;
@@ -686,7 +704,7 @@ static int adf7242_start(struct ieee802154_hw *hw)
        enable_irq(lp->spi->irq);
        set_bit(FLAG_START, &lp->flags);
-        return adf7242_cmd(lp, CMD_RC_RX);
+        return adf7242_cmd_rx(lp);
 }
 static void adf7242_stop(struct ieee802154_hw *hw)
@@ -694,6 +712,7 @@ static void adf7242_stop(struct ieee802154_hw *hw)
        struct adf7242_local *lp = hw->priv;
        disable_irq(lp->spi->irq);
+        cancel_delayed_work_sync(&lp->work);
        adf7242_cmd(lp, CMD_RC_IDLE);
        clear_bit(FLAG_START, &lp->flags);
        adf7242_clear_irqstat(lp);
@@ -719,7 +738,10 @@ static int adf7242_channel(struct ieee802154_hw *hw, u8 page, u8 channel)
        adf7242_write_reg(lp, REG_CH_FREQ1, freq >> 8);
        adf7242_write_reg(lp, REG_CH_FREQ2, freq >> 16);
-        return adf7242_cmd(lp, CMD_RC_RX);
+        if (test_bit(FLAG_START, &lp->flags))
+                return adf7242_cmd_rx(lp);
+        else
+                return adf7242_cmd(lp, CMD_RC_PHY_RDY);
 }
 static int adf7242_set_hw_addr_filt(struct ieee802154_hw *hw,
@@ -814,6 +836,7 @@ static int adf7242_xmit(struct ieee802154_hw *hw, struct sk_buff *skb)
        /* ensure existing instances of the IRQ handler have completed */
        disable_irq(lp->spi->irq);
        set_bit(FLAG_XMIT, &lp->flags);
+        cancel_delayed_work_sync(&lp->work);
        reinit_completion(&lp->tx_complete);
        adf7242_cmd(lp, CMD_RC_PHY_RDY);
        adf7242_clear_irqstat(lp);
@@ -952,6 +975,7 @@ static irqreturn_t adf7242_isr(int irq, void *data)
        unsigned int xmit;
        u8 irq1;
+        mod_delayed_work(lp->wqueue, &lp->work, msecs_to_jiffies(400));
        adf7242_read_reg(lp, REG_IRQ1_SRC1, &irq1);
        if (!(irq1 & (IRQ_RX_PKT_RCVD | IRQ_CSMA_CA)))
@@ -1241,6 +1265,9 @@ static int adf7242_probe(struct spi_device *spi)
        spi_message_add_tail(&lp->stat_xfer, &lp->stat_msg);
        spi_set_drvdata(spi, lp);
+        INIT_DELAYED_WORK(&lp->work, adf7242_rx_cal_work);
+        lp->wqueue = alloc_ordered_workqueue(dev_name(&spi->dev),
+                                             WQ_MEM_RECLAIM);
        ret = adf7242_hw_init(lp);
        if (ret)
@@ -1284,6 +1311,9 @@ static int adf7242_remove(struct spi_device *spi)
        if (!IS_ERR_OR_NULL(lp->debugfs_root))
                debugfs_remove_recursive(lp->debugfs_root);
+        cancel_delayed_work_sync(&lp->work);
+        destroy_workqueue(lp->wqueue);
        ieee802154_unregister_hw(lp->hw);
        mutex_destroy(&lp->bmux);
        ieee802154_free_hw(lp->hw);
diff --git a/drivers/net/ieee802154/at86rf230.c b/drivers/net/ieee802154/at86rf230.c
index 77abedf0b524..3d9e91579866 100644
--- a/drivers/net/ieee802154/at86rf230.c
+++ b/drivers/net/ieee802154/at86rf230.c
@@ -940,7 +940,7 @@ at86rf230_xmit(struct ieee802154_hw *hw, struct sk_buff *skb)
 static int
 at86rf230_ed(struct ieee802154_hw *hw, u8 *level)
 {
-        BUG_ON(!level);
+        WARN_ON(!level);
        *level = 0xbe;
        return 0;
 }
@@ -1121,8 +1121,7 @@ at86rf230_set_hw_addr_filt(struct ieee802154_hw *hw,
        if (changed & IEEE802154_AFILT_SADDR_CHANGED) {
                u16 addr = le16_to_cpu(filt->short_addr);
-                dev_vdbg(&lp->spi->dev,
+                dev_vdbg(&lp->spi->dev, "%s called for saddr\n", __func__);
-                         "at86rf230_set_hw_addr_filt called for saddr\n");
                __at86rf230_write(lp, RG_SHORT_ADDR_0, addr);
                __at86rf230_write(lp, RG_SHORT_ADDR_1, addr >> 8);
        }
@@ -1130,8 +1129,7 @@ at86rf230_set_hw_addr_filt(struct ieee802154_hw *hw,
        if (changed & IEEE802154_AFILT_PANID_CHANGED) {
                u16 pan = le16_to_cpu(filt->pan_id);
-                dev_vdbg(&lp->spi->dev,
+                dev_vdbg(&lp->spi->dev, "%s called for pan id\n", __func__);
-                         "at86rf230_set_hw_addr_filt called for pan id\n");
                __at86rf230_write(lp, RG_PAN_ID_0, pan);
                __at86rf230_write(lp, RG_PAN_ID_1, pan >> 8);
        }
@@ -1140,15 +1138,13 @@ at86rf230_set_hw_addr_filt(struct ieee802154_hw *hw,
                u8 i, addr[8];
                memcpy(addr, &filt->ieee_addr, 8);
-                dev_vdbg(&lp->spi->dev,
+                dev_vdbg(&lp->spi->dev, "%s called for IEEE addr\n", __func__);
-                         "at86rf230_set_hw_addr_filt called for IEEE addr\n");
                for (i = 0; i < 8; i++)
                        __at86rf230_write(lp, RG_IEEE_ADDR_0 + i, addr[i]);
        }
        if (changed & IEEE802154_AFILT_PANC_CHANGED) {
-                dev_vdbg(&lp->spi->dev,
+                dev_vdbg(&lp->spi->dev, "%s called for panc change\n", __func__);
-                         "at86rf230_set_hw_addr_filt called for panc change\n");
                if (filt->pan_coord)
                        at86rf230_write_subreg(lp, SR_AACK_I_AM_COORD, 1);
                else
@@ -1252,7 +1248,6 @@ at86rf230_set_cca_mode(struct ieee802154_hw *hw,
        return at86rf230_write_subreg(lp, SR_CCA_MODE, val);
 }
 static int
 at86rf230_set_cca_ed_level(struct ieee802154_hw *hw, s32 mbm)
 {
diff --git a/drivers/net/ieee802154/fakelb.c b/drivers/net/ieee802154/fakelb.c
index 0d673f7682ee..176395e4b7bb 100644
--- a/drivers/net/ieee802154/fakelb.c
+++ b/drivers/net/ieee802154/fakelb.c
@@ -49,7 +49,7 @@ struct fakelb_phy {
 static int fakelb_hw_ed(struct ieee802154_hw *hw, u8 *level)
 {
-        BUG_ON(!level);
+        WARN_ON(!level);
        *level = 0xbe;
        return 0;
diff --git a/drivers/net/ieee802154/mcr20a.c b/drivers/net/ieee802154/mcr20a.c
index de0d7f28a181..e428277781ac 100644
--- a/drivers/net/ieee802154/mcr20a.c
+++ b/drivers/net/ieee802154/mcr20a.c
@@ -15,10 +15,11 @@
 */
 #include <linux/kernel.h>
 #include <linux/module.h>
-#include <linux/gpio.h>
+#include <linux/gpio/consumer.h>
 #include <linux/spi/spi.h>
 #include <linux/workqueue.h>
 #include <linux/interrupt.h>
+#include <linux/irq.h>
 #include <linux/skbuff.h>
 #include <linux/of_gpio.h>
 #include <linux/regmap.h>
diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c
index b8f57e9b9379..1cd439bdf608 100644
--- a/drivers/net/phy/marvell.c
+++ b/drivers/net/phy/marvell.c
@@ -130,8 +130,9 @@
 #define MII_88E1318S_PHY_WOL_CTRL_CLEAR_WOL_STATUS              BIT(12)
 #define MII_88E1318S_PHY_WOL_CTRL_MAGIC_PACKET_MATCH_ENABLE     BIT(14)
-#define MII_88E1121_PHY_LED_CTRL        16
+#define MII_PHY_LED_CTRL                16
 #define MII_88E1121_PHY_LED_DEF         0x0030
+#define MII_88E1510_PHY_LED_DEF         0x1177
 #define MII_M1011_PHY_STATUS            0x11
 #define MII_M1011_PHY_STATUS_1000       0x8000
@@ -632,8 +633,40 @@ error:
        return err;
 }
+static void marvell_config_led(struct phy_device *phydev)
+{
+        u16 def_config;
+        int err;
+        switch (MARVELL_PHY_FAMILY_ID(phydev->phy_id)) {
+        /* Default PHY LED config: LED[0] .. Link, LED[1] .. Activity */
+        case MARVELL_PHY_FAMILY_ID(MARVELL_PHY_ID_88E1121R):
+        case MARVELL_PHY_FAMILY_ID(MARVELL_PHY_ID_88E1318S):
+                def_config = MII_88E1121_PHY_LED_DEF;
+                break;
+        /* Default PHY LED config:
+         * LED[0] .. 1000Mbps Link
+         * LED[1] .. 100Mbps Link
+         * LED[2] .. Blink, Activity
+         */
+        case MARVELL_PHY_FAMILY_ID(MARVELL_PHY_ID_88E1510):
+                def_config = MII_88E1510_PHY_LED_DEF;
+                break;
+        default:
+                return;
+        }
+        err = phy_write_paged(phydev, MII_MARVELL_LED_PAGE, MII_PHY_LED_CTRL,
+                              def_config);
+        if (err < 0)
+                pr_warn("Fail to config marvell phy LED.\n");
+}
 static int marvell_config_init(struct phy_device *phydev)
 {
+        /* Set defalut LED */
+        marvell_config_led(phydev);
        /* Set registers from marvell,reg-init DT property */
        return marvell_of_reg_init(phydev);
 }
@@ -813,21 +846,6 @@ static int m88e1111_config_init(struct phy_device *phydev)
        return genphy_soft_reset(phydev);
 }
-static int m88e1121_config_init(struct phy_device *phydev)
-{
-        int err;
-        /* Default PHY LED config: LED[0] .. Link, LED[1] .. Activity */
-        err = phy_write_paged(phydev, MII_MARVELL_LED_PAGE,
-                              MII_88E1121_PHY_LED_CTRL,
-                              MII_88E1121_PHY_LED_DEF);
-        if (err < 0)
-                return err;
-        /* Set marvell,reg-init configuration from device tree */
-        return marvell_config_init(phydev);
-}
 static int m88e1318_config_init(struct phy_device *phydev)
 {
        if (phy_interrupt_is_valid(phydev)) {
@@ -841,7 +859,7 @@ static int m88e1318_config_init(struct phy_device *phydev)
                        return err;
        }
-        return m88e1121_config_init(phydev);
+        return marvell_config_init(phydev);
 }
 static int m88e1510_config_init(struct phy_device *phydev)
@@ -2087,7 +2105,7 @@ static struct phy_driver marvell_drivers[] = {
                .features = PHY_GBIT_FEATURES,
                .flags = PHY_HAS_INTERRUPT,
                .probe = &m88e1121_probe,
-                .config_init = &m88e1121_config_init,
+                .config_init = &marvell_config_init,
                .config_aneg = &m88e1121_config_aneg,
                .read_status = &marvell_read_status,
                .ack_interrupt = &marvell_ack_interrupt,
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index bd0f339f69fd..b9f5f40a7ac1 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -1724,11 +1724,8 @@ EXPORT_SYMBOL(genphy_loopback);
 static int __set_phy_supported(struct phy_device *phydev, u32 max_speed)
 {
-        /* The default values for phydev->supported are provided by the PHY
+        phydev->supported &= ~(PHY_1000BT_FEATURES | PHY_100BT_FEATURES |
-         * driver "features" member, we want to reset to sane defaults first
+                               PHY_10BT_FEATURES);
-         * before supporting higher speeds.
-         */
-        phydev->supported &= PHY_DEFAULT_FEATURES;
        switch (max_speed) {
        default:
diff --git a/drivers/net/phy/sfp-bus.c b/drivers/net/phy/sfp-bus.c
index d437f4f5ed52..740655261e5b 100644
--- a/drivers/net/phy/sfp-bus.c
+++ b/drivers/net/phy/sfp-bus.c
@@ -349,7 +349,6 @@ static int sfp_register_bus(struct sfp_bus *bus)
        }
        if (bus->started)
                bus->socket_ops->start(bus->sfp);
-        bus->netdev->sfp_bus = bus;
        bus->registered = true;
        return 0;
 }
@@ -364,7 +363,6 @@ static void sfp_unregister_bus(struct sfp_bus *bus)
                if (bus->phydev && ops && ops->disconnect_phy)
                        ops->disconnect_phy(bus->upstream);
        }
-        bus->netdev->sfp_bus = NULL;
        bus->registered = false;
 }
@@ -436,6 +434,14 @@ void sfp_upstream_stop(struct sfp_bus *bus)
 }
 EXPORT_SYMBOL_GPL(sfp_upstream_stop);
+static void sfp_upstream_clear(struct sfp_bus *bus)
+{
+        bus->upstream_ops = NULL;
+        bus->upstream = NULL;
+        bus->netdev->sfp_bus = NULL;
+        bus->netdev = NULL;
+}
 /**
 * sfp_register_upstream() - Register the neighbouring device
 * @fwnode: firmware node for the SFP bus
@@ -461,9 +467,13 @@ struct sfp_bus *sfp_register_upstream(struct fwnode_handle *fwnode,
                bus->upstream_ops = ops;
                bus->upstream = upstream;
                bus->netdev = ndev;
+                ndev->sfp_bus = bus;
-                if (bus->sfp)
+                if (bus->sfp) {
                        ret = sfp_register_bus(bus);
+                        if (ret)
+                                sfp_upstream_clear(bus);
+                }
                rtnl_unlock();
        }
@@ -488,8 +498,7 @@ void sfp_unregister_upstream(struct sfp_bus *bus)
        rtnl_lock();
        if (bus->sfp)
                sfp_unregister_bus(bus);
-        bus->upstream = NULL;
+        sfp_upstream_clear(bus);
-        bus->netdev = NULL;
        rtnl_unlock();
        sfp_bus_put(bus);
@@ -561,6 +570,13 @@ void sfp_module_remove(struct sfp_bus *bus)
 }
 EXPORT_SYMBOL_GPL(sfp_module_remove);
+static void sfp_socket_clear(struct sfp_bus *bus)
+{
+        bus->sfp_dev = NULL;
+        bus->sfp = NULL;
+        bus->socket_ops = NULL;
+}
 struct sfp_bus *sfp_register_socket(struct device *dev, struct sfp *sfp,
                                    const struct sfp_socket_ops *ops)
 {
@@ -573,8 +589,11 @@ struct sfp_bus *sfp_register_socket(struct device *dev, struct sfp *sfp,
                bus->sfp = sfp;
                bus->socket_ops = ops;
-                if (bus->netdev)
+                if (bus->netdev) {
                        ret = sfp_register_bus(bus);
+                        if (ret)
+                                sfp_socket_clear(bus);
+                }
                rtnl_unlock();
        }
@@ -592,9 +611,7 @@ void sfp_unregister_socket(struct sfp_bus *bus)
        rtnl_lock();
        if (bus->netdev)
                sfp_unregister_bus(bus);
-        bus->sfp_dev = NULL;
+        sfp_socket_clear(bus);
-        bus->sfp = NULL;
-        bus->socket_ops = NULL;
        rtnl_unlock();
        sfp_bus_put(bus);
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index a192a017cc68..f5727baac84a 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -1688,7 +1688,7 @@ static struct sk_buff *tun_build_skb(struct tun_struct *tun,
                case XDP_TX:
                        get_page(alloc_frag->page);
                        alloc_frag->offset += buflen;
-                        if (tun_xdp_tx(tun->dev, &xdp))
+                        if (tun_xdp_tx(tun->dev, &xdp) < 0)
                                goto err_redirect;
                        rcu_read_unlock();
                        local_bh_enable();
diff --git a/drivers/net/usb/asix_devices.c b/drivers/net/usb/asix_devices.c
index 3d4f7959dabb..b1b3d8f7e67d 100644
--- a/drivers/net/usb/asix_devices.c
+++ b/drivers/net/usb/asix_devices.c
@@ -642,10 +642,12 @@ static void ax88772_restore_phy(struct usbnet *dev)
                                     priv->presvd_phy_advertise);
                /* Restore BMCR */
+                if (priv->presvd_phy_bmcr & BMCR_ANENABLE)
+                        priv->presvd_phy_bmcr |= BMCR_ANRESTART;
                asix_mdio_write_nopm(dev->net, dev->mii.phy_id, MII_BMCR,
                                     priv->presvd_phy_bmcr);
-                mii_nway_restart(&dev->mii);
                priv->presvd_phy_advertise = 0;
                priv->presvd_phy_bmcr = 0;
        }
diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
index 2e4130746c40..ed10d49eb5e0 100644
--- a/drivers/net/usb/lan78xx.c
+++ b/drivers/net/usb/lan78xx.c
@@ -3344,6 +3344,7 @@ static void lan78xx_tx_bh(struct lan78xx_net *dev)
        pkt_cnt = 0;
        count = 0;
        length = 0;
+        spin_lock_irqsave(&tqp->lock, flags);
        for (skb = tqp->next; pkt_cnt < tqp->qlen; skb = skb->next) {
                if (skb_is_gso(skb)) {
                        if (pkt_cnt) {
@@ -3352,7 +3353,8 @@ static void lan78xx_tx_bh(struct lan78xx_net *dev)
                        }
                        count = 1;
                        length = skb->len - TX_OVERHEAD;
-                        skb2 = skb_dequeue(tqp);
+                        __skb_unlink(skb, tqp);
+                        spin_unlock_irqrestore(&tqp->lock, flags);
                        goto gso_skb;
                }
@@ -3361,6 +3363,7 @@ static void lan78xx_tx_bh(struct lan78xx_net *dev)
                skb_totallen = skb->len + roundup(skb_totallen, sizeof(u32));
                pkt_cnt++;
        }
+        spin_unlock_irqrestore(&tqp->lock, flags);
        /* copy to a single skb */
        skb = alloc_skb(skb_totallen, GFP_ATOMIC);
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index 8fac8e132c5b..38502809420b 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -1253,6 +1253,7 @@ static const struct usb_device_id products[] = {
        {QMI_QUIRK_SET_DTR(0x1e0e, 0x9001, 5)}, /* SIMCom 7100E, 7230E, 7600E ++ */
        {QMI_QUIRK_SET_DTR(0x2c7c, 0x0125, 4)}, /* Quectel EC25, EC20 R2.0  Mini PCIe */
        {QMI_QUIRK_SET_DTR(0x2c7c, 0x0121, 4)}, /* Quectel EC21 Mini PCIe */
+        {QMI_QUIRK_SET_DTR(0x2c7c, 0x0191, 4)}, /* Quectel EG91 */
        {QMI_FIXED_INTF(0x2c7c, 0x0296, 4)},    /* Quectel BG96 */
        {QMI_QUIRK_SET_DTR(0x2c7c, 0x0306, 4)}, /* Quectel EP06 Mini PCIe */
diff --git a/drivers/net/usb/rtl8150.c b/drivers/net/usb/rtl8150.c
index 5f565bd574da..48ba80a8ca5c 100644
--- a/drivers/net/usb/rtl8150.c
+++ b/drivers/net/usb/rtl8150.c
@@ -681,7 +681,7 @@ static void rtl8150_set_multicast(struct net_device *netdev)
                   (netdev->flags & IFF_ALLMULTI)) {
                rx_creg &= 0xfffe;
                rx_creg |= 0x0002;
-                dev_info(&netdev->dev, "%s: allmulti set\n", netdev->name);
+                dev_dbg(&netdev->dev, "%s: allmulti set\n", netdev->name);
        } else {
                /* ~RX_MULTICAST, ~RX_PROMISCUOUS */
                rx_creg &= 0x00fc;
diff --git a/drivers/net/usb/smsc75xx.c b/drivers/net/usb/smsc75xx.c
index 7a6a1fe79309..05553d252446 100644
--- a/drivers/net/usb/smsc75xx.c
+++ b/drivers/net/usb/smsc75xx.c
@@ -82,6 +82,9 @@ static bool turbo_mode = true;
 module_param(turbo_mode, bool, 0644);
 MODULE_PARM_DESC(turbo_mode, "Enable multiple frames per Rx transaction");
+static int smsc75xx_link_ok_nopm(struct usbnet *dev);
+static int smsc75xx_phy_gig_workaround(struct usbnet *dev);
 static int __must_check __smsc75xx_read_reg(struct usbnet *dev, u32 index,
                                            u32 *data, int in_pm)
 {
@@ -852,6 +855,9 @@ static int smsc75xx_phy_initialize(struct usbnet *dev)
                return -EIO;
        }
+        /* phy workaround for gig link */
+        smsc75xx_phy_gig_workaround(dev);
        smsc75xx_mdio_write(dev->net, dev->mii.phy_id, MII_ADVERTISE,
                ADVERTISE_ALL | ADVERTISE_CSMA | ADVERTISE_PAUSE_CAP |
                ADVERTISE_PAUSE_ASYM);
@@ -987,6 +993,62 @@ static int smsc75xx_wait_ready(struct usbnet *dev, int in_pm)
        return -EIO;
 }
+static int smsc75xx_phy_gig_workaround(struct usbnet *dev)
+{
+        struct mii_if_info *mii = &dev->mii;
+        int ret = 0, timeout = 0;
+        u32 buf, link_up = 0;
+        /* Set the phy in Gig loopback */
+        smsc75xx_mdio_write(dev->net, mii->phy_id, MII_BMCR, 0x4040);
+        /* Wait for the link up */
+        do {
+                link_up = smsc75xx_link_ok_nopm(dev);
+                usleep_range(10000, 20000);
+                timeout++;
+        } while ((!link_up) && (timeout < 1000));
+        if (timeout >= 1000) {
+                netdev_warn(dev->net, "Timeout waiting for PHY link up\n");
+                return -EIO;
+        }
+        /* phy reset */
+        ret = smsc75xx_read_reg(dev, PMT_CTL, &buf);
+        if (ret < 0) {
+                netdev_warn(dev->net, "Failed to read PMT_CTL: %d\n", ret);
+                return ret;
+        }
+        buf |= PMT_CTL_PHY_RST;
+        ret = smsc75xx_write_reg(dev, PMT_CTL, buf);
+        if (ret < 0) {
+                netdev_warn(dev->net, "Failed to write PMT_CTL: %d\n", ret);
+                return ret;
+        }
+        timeout = 0;
+        do {
+                usleep_range(10000, 20000);
+                ret = smsc75xx_read_reg(dev, PMT_CTL, &buf);
+                if (ret < 0) {
+                        netdev_warn(dev->net, "Failed to read PMT_CTL: %d\n",
+                                    ret);
+                        return ret;
+                }
+                timeout++;
+        } while ((buf & PMT_CTL_PHY_RST) && (timeout < 100));
+        if (timeout >= 100) {
+                netdev_warn(dev->net, "timeout waiting for PHY Reset\n");
+                return -EIO;
+        }
+        return 0;
+}
 static int smsc75xx_reset(struct usbnet *dev)
 {
        struct smsc75xx_priv *pdata = (struct smsc75xx_priv *)(dev->data[0]);
diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
index e9c2fb318c03..836e0a47b94a 100644
--- a/drivers/net/wireless/ath/ath10k/mac.c
+++ b/drivers/net/wireless/ath/ath10k/mac.c
@@ -6058,8 +6058,19 @@ static void ath10k_sta_rc_update_wk(struct work_struct *wk)
                           ath10k_mac_max_vht_nss(vht_mcs_mask)));
        if (changed & IEEE80211_RC_BW_CHANGED) {
-                ath10k_dbg(ar, ATH10K_DBG_MAC, "mac update sta %pM peer bw %d\n",
+                enum wmi_phy_mode mode;
-                           sta->addr, bw);
+                mode = chan_to_phymode(&def);
+                ath10k_dbg(ar, ATH10K_DBG_MAC, "mac update sta %pM peer bw %d phymode %d\n",
+                                sta->addr, bw, mode);
+                err = ath10k_wmi_peer_set_param(ar, arvif->vdev_id, sta->addr,
+                                WMI_PEER_PHYMODE, mode);
+                if (err) {
+                        ath10k_warn(ar, "failed to update STA %pM peer phymode %d: %d\n",
+                                        sta->addr, mode, err);
+                        goto exit;
+                }
                err = ath10k_wmi_peer_set_param(ar, arvif->vdev_id, sta->addr,
                                                WMI_PEER_CHAN_WIDTH, bw);
@@ -6100,6 +6111,7 @@ static void ath10k_sta_rc_update_wk(struct work_struct *wk)
                                    sta->addr);
        }
+exit:
        mutex_unlock(&ar->conf_mutex);
 }
diff --git a/drivers/net/wireless/ath/ath10k/wmi.h b/drivers/net/wireless/ath/ath10k/wmi.h
index b48db54e9865..d68afb65402a 100644
--- a/drivers/net/wireless/ath/ath10k/wmi.h
+++ b/drivers/net/wireless/ath/ath10k/wmi.h
@@ -6144,6 +6144,7 @@ enum wmi_peer_param {
        WMI_PEER_NSS        = 0x5,
        WMI_PEER_USE_4ADDR  = 0x6,
        WMI_PEER_DEBUG      = 0xa,
+        WMI_PEER_PHYMODE    = 0xd,
        WMI_PEER_DUMMY_VAR  = 0xff, /* dummy parameter for STA PS workaround */
 };
diff --git a/drivers/net/wireless/ath/wcn36xx/testmode.c b/drivers/net/wireless/ath/wcn36xx/testmode.c
index 1279064a3b71..51a038022c8b 100644
--- a/drivers/net/wireless/ath/wcn36xx/testmode.c
+++ b/drivers/net/wireless/ath/wcn36xx/testmode.c
@@ -1,4 +1,4 @@
-/*
+/*
 * Copyright (c) 2018, The Linux Foundation. All rights reserved.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
index c99a191e8d69..a907d7b065fa 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
@@ -4296,6 +4296,13 @@ void brcmf_sdio_remove(struct brcmf_sdio *bus)
        brcmf_dbg(TRACE, "Enter\n");
        if (bus) {
+                /* Stop watchdog task */
+                if (bus->watchdog_tsk) {
+                        send_sig(SIGTERM, bus->watchdog_tsk, 1);
+                        kthread_stop(bus->watchdog_tsk);
+                        bus->watchdog_tsk = NULL;
+                }
                /* De-register interrupt handler */
                brcmf_sdiod_intr_unregister(bus->sdiodev);
diff --git a/drivers/net/wireless/marvell/mwifiex/usb.c b/drivers/net/wireless/marvell/mwifiex/usb.c
index 6e3cf9817730..88f4c89f89ba 100644
--- a/drivers/net/wireless/marvell/mwifiex/usb.c
+++ b/drivers/net/wireless/marvell/mwifiex/usb.c
@@ -644,11 +644,6 @@ static void mwifiex_usb_disconnect(struct usb_interface *intf)
                                         MWIFIEX_FUNC_SHUTDOWN);
        }
-        if (adapter->workqueue)
-                flush_workqueue(adapter->workqueue);
-        mwifiex_usb_free(card);
        mwifiex_dbg(adapter, FATAL,
                    "%s: removing card\n", __func__);
        mwifiex_remove_card(adapter);
@@ -1356,6 +1351,8 @@ static void mwifiex_unregister_dev(struct mwifiex_adapter *adapter)
 {
        struct usb_card_rec *card = (struct usb_card_rec *)adapter->card;
+        mwifiex_usb_free(card);
        mwifiex_usb_cleanup_tx_aggr(adapter);
        card->adapter = NULL;
diff --git a/drivers/net/wireless/mediatek/mt7601u/phy.c b/drivers/net/wireless/mediatek/mt7601u/phy.c
index 9d2f9a776ef1..b804abd464ae 100644
--- a/drivers/net/wireless/mediatek/mt7601u/phy.c
+++ b/drivers/net/wireless/mediatek/mt7601u/phy.c
@@ -986,13 +986,15 @@ static void mt7601u_agc_tune(struct mt7601u_dev *dev)
         */
        spin_lock_bh(&dev->con_mon_lock);
        avg_rssi = ewma_rssi_read(&dev->avg_rssi);
-        WARN_ON_ONCE(avg_rssi == 0);
+        spin_unlock_bh(&dev->con_mon_lock);
+        if (avg_rssi == 0)
+                return;
        avg_rssi = -avg_rssi;
        if (avg_rssi <= -70)
                val -= 0x20;
        else if (avg_rssi <= -60)
                val -= 0x10;
-        spin_unlock_bh(&dev->con_mon_lock);
        if (val != mt7601u_bbp_rr(dev, 66))
                mt7601u_bbp_wr(dev, 66, val);
diff --git a/drivers/net/wireless/quantenna/qtnfmac/cfg80211.c b/drivers/net/wireless/quantenna/qtnfmac/cfg80211.c
index 220e2b710208..ae0ca8006849 100644
--- a/drivers/net/wireless/quantenna/qtnfmac/cfg80211.c
+++ b/drivers/net/wireless/quantenna/qtnfmac/cfg80211.c
@@ -654,8 +654,7 @@ qtnf_disconnect(struct wiphy *wiphy, struct net_device *dev,
        vif = qtnf_mac_get_base_vif(mac);
        if (!vif) {
                pr_err("MAC%u: primary VIF is not configured\n", mac->macid);
-                ret = -EFAULT;
+                return -EFAULT;
-                goto out;
        }
        if (vif->wdev.iftype != NL80211_IFTYPE_STATION) {
diff --git a/drivers/net/wireless/realtek/rtlwifi/base.c b/drivers/net/wireless/realtek/rtlwifi/base.c
index 39c817eddd78..54c9f6ab0c8c 100644
--- a/drivers/net/wireless/realtek/rtlwifi/base.c
+++ b/drivers/net/wireless/realtek/rtlwifi/base.c
@@ -484,18 +484,21 @@ static void _rtl_init_deferred_work(struct ieee80211_hw *hw)
 }
-void rtl_deinit_deferred_work(struct ieee80211_hw *hw)
+void rtl_deinit_deferred_work(struct ieee80211_hw *hw, bool ips_wq)
 {
        struct rtl_priv *rtlpriv = rtl_priv(hw);
        del_timer_sync(&rtlpriv->works.watchdog_timer);
-        cancel_delayed_work(&rtlpriv->works.watchdog_wq);
+        cancel_delayed_work_sync(&rtlpriv->works.watchdog_wq);
-        cancel_delayed_work(&rtlpriv->works.ips_nic_off_wq);
+        if (ips_wq)
-        cancel_delayed_work(&rtlpriv->works.ps_work);
+                cancel_delayed_work(&rtlpriv->works.ips_nic_off_wq);
-        cancel_delayed_work(&rtlpriv->works.ps_rfon_wq);
+        else
-        cancel_delayed_work(&rtlpriv->works.fwevt_wq);
+                cancel_delayed_work_sync(&rtlpriv->works.ips_nic_off_wq);
-        cancel_delayed_work(&rtlpriv->works.c2hcmd_wq);
+        cancel_delayed_work_sync(&rtlpriv->works.ps_work);
+        cancel_delayed_work_sync(&rtlpriv->works.ps_rfon_wq);
+        cancel_delayed_work_sync(&rtlpriv->works.fwevt_wq);
+        cancel_delayed_work_sync(&rtlpriv->works.c2hcmd_wq);
 }
 EXPORT_SYMBOL_GPL(rtl_deinit_deferred_work);
diff --git a/drivers/net/wireless/realtek/rtlwifi/base.h b/drivers/net/wireless/realtek/rtlwifi/base.h
index 912f205779c3..a7ae40eaa3cd 100644
--- a/drivers/net/wireless/realtek/rtlwifi/base.h
+++ b/drivers/net/wireless/realtek/rtlwifi/base.h
@@ -121,7 +121,7 @@ void rtl_init_rfkill(struct ieee80211_hw *hw);
 void rtl_deinit_rfkill(struct ieee80211_hw *hw);
 void rtl_watch_dog_timer_callback(struct timer_list *t);
-void rtl_deinit_deferred_work(struct ieee80211_hw *hw);
+void rtl_deinit_deferred_work(struct ieee80211_hw *hw, bool ips_wq);
 bool rtl_action_proc(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx);
 int rtlwifi_rate_mapping(struct ieee80211_hw *hw, bool isht,
diff --git a/drivers/net/wireless/realtek/rtlwifi/core.c b/drivers/net/wireless/realtek/rtlwifi/core.c
index cfea57efa7f4..4bf7967590ca 100644
--- a/drivers/net/wireless/realtek/rtlwifi/core.c
+++ b/drivers/net/wireless/realtek/rtlwifi/core.c
@@ -130,7 +130,6 @@ found_alt:
                       firmware->size);
                rtlpriv->rtlhal.wowlan_fwsize = firmware->size;
        }
-        rtlpriv->rtlhal.fwsize = firmware->size;
        release_firmware(firmware);
 }
@@ -196,7 +195,7 @@ static void rtl_op_stop(struct ieee80211_hw *hw)
                /* reset sec info */
                rtl_cam_reset_sec_info(hw);
-                rtl_deinit_deferred_work(hw);
+                rtl_deinit_deferred_work(hw, false);
        }
        rtlpriv->intf_ops->adapter_stop(hw);
diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.c b/drivers/net/wireless/realtek/rtlwifi/pci.c
index ae13bcfb3bf0..5d1fda16fc8c 100644
--- a/drivers/net/wireless/realtek/rtlwifi/pci.c
+++ b/drivers/net/wireless/realtek/rtlwifi/pci.c
@@ -2377,7 +2377,7 @@ void rtl_pci_disconnect(struct pci_dev *pdev)
                ieee80211_unregister_hw(hw);
                rtlmac->mac80211_registered = 0;
        } else {
-                rtl_deinit_deferred_work(hw);
+                rtl_deinit_deferred_work(hw, false);
                rtlpriv->intf_ops->adapter_stop(hw);
        }
        rtlpriv->cfg->ops->disable_interrupt(hw);
diff --git a/drivers/net/wireless/realtek/rtlwifi/ps.c b/drivers/net/wireless/realtek/rtlwifi/ps.c
index 71af24e2e051..479a4cfc245d 100644
--- a/drivers/net/wireless/realtek/rtlwifi/ps.c
+++ b/drivers/net/wireless/realtek/rtlwifi/ps.c
@@ -71,7 +71,7 @@ bool rtl_ps_disable_nic(struct ieee80211_hw *hw)
        struct rtl_priv *rtlpriv = rtl_priv(hw);
        /*<1> Stop all timer */
-        rtl_deinit_deferred_work(hw);
+        rtl_deinit_deferred_work(hw, true);
        /*<2> Disable Interrupt */
        rtlpriv->cfg->ops->disable_interrupt(hw);
@@ -292,7 +292,7 @@ void rtl_ips_nic_on(struct ieee80211_hw *hw)
        struct rtl_ps_ctl *ppsc = rtl_psc(rtl_priv(hw));
        enum rf_pwrstate rtstate;
-        cancel_delayed_work(&rtlpriv->works.ips_nic_off_wq);
+        cancel_delayed_work_sync(&rtlpriv->works.ips_nic_off_wq);
        mutex_lock(&rtlpriv->locks.ips_mutex);
        if (ppsc->inactiveps) {
diff --git a/drivers/net/wireless/realtek/rtlwifi/usb.c b/drivers/net/wireless/realtek/rtlwifi/usb.c
index f9faffc498bc..2ac5004d7a40 100644
--- a/drivers/net/wireless/realtek/rtlwifi/usb.c
+++ b/drivers/net/wireless/realtek/rtlwifi/usb.c
@@ -1132,7 +1132,7 @@ void rtl_usb_disconnect(struct usb_interface *intf)
                ieee80211_unregister_hw(hw);
                rtlmac->mac80211_registered = 0;
        } else {
-                rtl_deinit_deferred_work(hw);
+                rtl_deinit_deferred_work(hw, false);
                rtlpriv->intf_ops->adapter_stop(hw);
        }
        /*deinit rfkill */
diff --git a/drivers/ptp/ptp_chardev.c b/drivers/ptp/ptp_chardev.c
index 547dbdac9d54..01b0e2bb3319 100644
--- a/drivers/ptp/ptp_chardev.c
+++ b/drivers/ptp/ptp_chardev.c
@@ -89,6 +89,7 @@ int ptp_set_pinfunc(struct ptp_clock *ptp, unsigned int pin,
        case PTP_PF_PHYSYNC:
                if (chan != 0)
                        return -EINVAL;
+                break;
        default:
                return -EINVAL;
        }
diff --git a/include/linux/bpf-cgroup.h b/include/linux/bpf-cgroup.h
index 79795c5fa7c3..d50c2f0a655a 100644
--- a/include/linux/bpf-cgroup.h
+++ b/include/linux/bpf-cgroup.h
@@ -2,6 +2,7 @@
 #ifndef _BPF_CGROUP_H
 #define _BPF_CGROUP_H
+#include <linux/errno.h>
 #include <linux/jump_label.h>
 #include <uapi/linux/bpf.h>
diff --git a/include/linux/filter.h b/include/linux/filter.h
index 300baad62c88..c73dd7396886 100644
--- a/include/linux/filter.h
+++ b/include/linux/filter.h
@@ -765,8 +765,8 @@ static inline bool bpf_dump_raw_ok(void)
 struct bpf_prog *bpf_patch_insn_single(struct bpf_prog *prog, u32 off,
                                       const struct bpf_insn *patch, u32 len);
-static inline int __xdp_generic_ok_fwd_dev(struct sk_buff *skb,
+static inline int xdp_ok_fwd_dev(const struct net_device *fwd,
-                                           struct net_device *fwd)
+                                 unsigned int pktlen)
 {
        unsigned int len;
@@ -774,7 +774,7 @@ static inline int __xdp_generic_ok_fwd_dev(struct sk_buff *skb,
                return -ENETDOWN;
        len = fwd->mtu + fwd->hard_header_len + VLAN_HLEN;
-        if (skb->len > len)
+        if (pktlen > len)
                return -EMSGSIZE;
        return 0;
diff --git a/include/linux/fsl/guts.h b/include/linux/fsl/guts.h
index 3efa3b861d44..941b11811f85 100644
--- a/include/linux/fsl/guts.h
+++ b/include/linux/fsl/guts.h
@@ -16,6 +16,7 @@
 #define __FSL_GUTS_H__
 #include <linux/types.h>
+#include <linux/io.h>
 /**
 * Global Utility Registers.
diff --git a/include/linux/if_bridge.h b/include/linux/if_bridge.h
index 7843b98e1c6e..c20c7e197d07 100644
--- a/include/linux/if_bridge.h
+++ b/include/linux/if_bridge.h
@@ -105,13 +105,13 @@ static inline bool br_vlan_enabled(const struct net_device *dev)
 static inline int br_vlan_get_pvid(const struct net_device *dev, u16 *p_pvid)
 {
-        return -1;
+        return -EINVAL;
 }
 static inline int br_vlan_get_info(const struct net_device *dev, u16 vid,
                                   struct bridge_vlan_info *p_vinfo)
 {
-        return -1;
+        return -EINVAL;
 }
 #endif
diff --git a/include/linux/igmp.h b/include/linux/igmp.h
index f8231854b5d6..119f53941c12 100644
--- a/include/linux/igmp.h
+++ b/include/linux/igmp.h
@@ -109,6 +109,8 @@ struct ip_mc_list {
 extern int ip_check_mc_rcu(struct in_device *dev, __be32 mc_addr, __be32 src_addr, u8 proto);
 extern int igmp_rcv(struct sk_buff *);
 extern int ip_mc_join_group(struct sock *sk, struct ip_mreqn *imr);
+extern int ip_mc_join_group_ssm(struct sock *sk, struct ip_mreqn *imr,
+                                unsigned int mode);
 extern int ip_mc_leave_group(struct sock *sk, struct ip_mreqn *imr);
 extern void ip_mc_drop_socket(struct sock *sk);
 extern int ip_mc_source(int add, int omode, struct sock *sk,
diff --git a/include/linux/marvell_phy.h b/include/linux/marvell_phy.h
index 4f5f8c21e283..1eb6f244588d 100644
--- a/include/linux/marvell_phy.h
+++ b/include/linux/marvell_phy.h
@@ -27,6 +27,8 @@
 */
 #define MARVELL_PHY_ID_88E6390          0x01410f90
+#define MARVELL_PHY_FAMILY_ID(id)       ((id) >> 4)
 /* struct phy_device dev_flags definitions */
 #define MARVELL_PHY_M1145_FLAGS_RESISTANCE      0x00000001
 #define MARVELL_PHY_M1118_DNS323_LEDS           0x00000002
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 164cdedf6012..610a201126ee 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -630,6 +630,7 @@ typedef unsigned char *sk_buff_data_t;
 *      @hash: the packet hash
 *      @queue_mapping: Queue mapping for multiqueue devices
 *      @xmit_more: More SKBs are pending for this queue
+ *      @pfmemalloc: skbuff was allocated from PFMEMALLOC reserves
 *      @ndisc_nodetype: router type (from link layer)
 *      @ooo_okay: allow the mapping of a socket to a queue to be changed
 *      @l4_hash: indicate hash is a canonical 4-tuple hash over transport
@@ -735,7 +736,7 @@ struct sk_buff {
                                peeked:1,
                                head_frag:1,
                                xmit_more:1,
-                                __unused:1; /* one bit hole */
+                                pfmemalloc:1;
        /* fields enclosed in headers_start/headers_end are copied
         * using a single memcpy() in __copy_skb_header()
@@ -754,31 +755,30 @@ struct sk_buff {
        __u8                    __pkt_type_offset[0];
        __u8                    pkt_type:3;
-        __u8                    pfmemalloc:1;
        __u8                    ignore_df:1;
        __u8                    nf_trace:1;
        __u8                    ip_summed:2;
        __u8                    ooo_okay:1;
        __u8                    l4_hash:1;
        __u8                    sw_hash:1;
        __u8                    wifi_acked_valid:1;
        __u8                    wifi_acked:1;
        __u8                    no_fcs:1;
        /* Indicates the inner headers are valid in the skbuff. */
        __u8                    encapsulation:1;
        __u8                    encap_hdr_csum:1;
        __u8                    csum_valid:1;
        __u8                    csum_complete_sw:1;
        __u8                    csum_level:2;
        __u8                    csum_not_inet:1;
        __u8                    dst_pending_confirm:1;
 #ifdef CONFIG_IPV6_NDISC_NODETYPE
        __u8                    ndisc_nodetype:2;
 #endif
        __u8                    ipvs_property:1;
        __u8                    inner_protocol_type:1;
        __u8                    remcsum_offload:1;
 #ifdef CONFIG_NET_SWITCHDEV
diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h
index 59656fc580df..7b9c82de11cc 100644
--- a/include/net/ip6_route.h
+++ b/include/net/ip6_route.h
@@ -66,6 +66,12 @@ static inline bool rt6_need_strict(const struct in6_addr *daddr)
                (IPV6_ADDR_MULTICAST | IPV6_ADDR_LINKLOCAL | IPV6_ADDR_LOOPBACK);
 }
+static inline bool rt6_qualify_for_ecmp(const struct fib6_info *f6i)
+{
+        return (f6i->fib6_flags & (RTF_GATEWAY|RTF_ADDRCONF|RTF_DYNAMIC)) ==
+               RTF_GATEWAY;
+}
 void ip6_route_input(struct sk_buff *skb);
 struct dst_entry *ip6_route_input_lookup(struct net *net,
                                         struct net_device *dev,
diff --git a/include/net/ipv6.h b/include/net/ipv6.h
index 16475c269749..8f73be494503 100644
--- a/include/net/ipv6.h
+++ b/include/net/ipv6.h
@@ -355,14 +355,7 @@ struct ipv6_txoptions *ipv6_dup_options(struct sock *sk,
 struct ipv6_txoptions *ipv6_renew_options(struct sock *sk,
                                          struct ipv6_txoptions *opt,
                                          int newtype,
-                                          struct ipv6_opt_hdr __user *newopt,
+                                          struct ipv6_opt_hdr *newopt);
-                                          int newoptlen);
-struct ipv6_txoptions *
-ipv6_renew_options_kern(struct sock *sk,
-                        struct ipv6_txoptions *opt,
-                        int newtype,
-                        struct ipv6_opt_hdr *newopt,
-                        int newoptlen);
 struct ipv6_txoptions *ipv6_fixup_options(struct ipv6_txoptions *opt_space,
                                          struct ipv6_txoptions *opt);
@@ -830,7 +823,7 @@ static inline __be32 ip6_make_flowlabel(struct net *net, struct sk_buff *skb,
         * to minimize possbility that any useful information to an
         * attacker is leaked. Only lower 20 bits are relevant.
         */
-        rol32(hash, 16);
+        hash = rol32(hash, 16);
        flowlabel = (__force __be32)hash & IPV6_FLOWLABEL_MASK;
@@ -1107,6 +1100,8 @@ void ipv6_sysctl_unregister(void);
 int ipv6_sock_mc_join(struct sock *sk, int ifindex,
                      const struct in6_addr *addr);
+int ipv6_sock_mc_join_ssm(struct sock *sk, int ifindex,
+                          const struct in6_addr *addr, unsigned int mode);
 int ipv6_sock_mc_drop(struct sock *sk, int ifindex,
                      const struct in6_addr *addr);
 #endif /* _NET_IPV6_H */
diff --git a/include/net/netfilter/nf_tables_core.h b/include/net/netfilter/nf_tables_core.h
index e0c0c2558ec4..a05134507e7b 100644
--- a/include/net/netfilter/nf_tables_core.h
+++ b/include/net/netfilter/nf_tables_core.h
@@ -65,4 +65,10 @@ extern const struct nft_expr_ops nft_payload_fast_ops;
 extern struct static_key_false nft_counters_enabled;
 extern struct static_key_false nft_trace_enabled;
+extern struct nft_set_type nft_set_rhash_type;
+extern struct nft_set_type nft_set_hash_type;
+extern struct nft_set_type nft_set_hash_fast_type;
+extern struct nft_set_type nft_set_rbtree_type;
+extern struct nft_set_type nft_set_bitmap_type;
 #endif /* _NET_NF_TABLES_CORE_H */
diff --git a/include/net/netfilter/nf_tproxy.h b/include/net/netfilter/nf_tproxy.h
index 9754a50ecde9..4cc64c8446eb 100644
--- a/include/net/netfilter/nf_tproxy.h
+++ b/include/net/netfilter/nf_tproxy.h
@@ -64,7 +64,7 @@ nf_tproxy_handle_time_wait4(struct net *net, struct sk_buff *skb,
 * belonging to established connections going through that one.
 */
 struct sock *
-nf_tproxy_get_sock_v4(struct net *net, struct sk_buff *skb, void *hp,
+nf_tproxy_get_sock_v4(struct net *net, struct sk_buff *skb,
                      const u8 protocol,
                      const __be32 saddr, const __be32 daddr,
                      const __be16 sport, const __be16 dport,
@@ -103,7 +103,7 @@ nf_tproxy_handle_time_wait6(struct sk_buff *skb, int tproto, int thoff,
                            struct sock *sk);
 struct sock *
-nf_tproxy_get_sock_v6(struct net *net, struct sk_buff *skb, int thoff, void *hp,
+nf_tproxy_get_sock_v6(struct net *net, struct sk_buff *skb, int thoff,
                      const u8 protocol,
                      const struct in6_addr *saddr, const struct in6_addr *daddr,
                      const __be16 sport, const __be16 dport,
diff --git a/include/net/tc_act/tc_csum.h b/include/net/tc_act/tc_csum.h
index 9470fd7e4350..32d2454c0479 100644
--- a/include/net/tc_act/tc_csum.h
+++ b/include/net/tc_act/tc_csum.h
@@ -7,7 +7,6 @@
 #include <linux/tc_act/tc_csum.h>
 struct tcf_csum_params {
-        int action;
        u32 update_flags;
        struct rcu_head rcu;
 };
diff --git a/include/net/tc_act/tc_tunnel_key.h b/include/net/tc_act/tc_tunnel_key.h
index efef0b4b1b2b..46b8c7f1c8d5 100644
--- a/include/net/tc_act/tc_tunnel_key.h
+++ b/include/net/tc_act/tc_tunnel_key.h
@@ -18,7 +18,6 @@
 struct tcf_tunnel_key_params {
        struct rcu_head         rcu;
        int                     tcft_action;
-        int                     action;
        struct metadata_dst     *tcft_enc_metadata;
 };
diff --git a/include/net/tcp.h b/include/net/tcp.h
index 800582b5dd54..3482d13d655b 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -828,6 +828,10 @@ struct tcp_skb_cb {
 #define TCP_SKB_CB(__skb)       ((struct tcp_skb_cb *)&((__skb)->cb[0]))
+static inline void bpf_compute_data_end_sk_skb(struct sk_buff *skb)
+{
+        TCP_SKB_CB(skb)->bpf.data_end = skb->data + skb_headlen(skb);
+}
 #if IS_ENABLED(CONFIG_IPV6)
 /* This is the variant of inet6_iif() that must be used by TCP,
@@ -908,8 +912,6 @@ enum tcp_ca_event {
        CA_EVENT_LOSS,          /* loss timeout */
        CA_EVENT_ECN_NO_CE,     /* ECT set, but not CE marked */
        CA_EVENT_ECN_IS_CE,     /* received CE marked IP packet */
-        CA_EVENT_DELAYED_ACK,   /* Delayed ack is sent */
-        CA_EVENT_NON_DELAYED_ACK,
 };
 /* Information about inbound ACK, passed to cong_ops->in_ack_event() */
diff --git a/include/net/xdp_sock.h b/include/net/xdp_sock.h
index 9fe472f2ac95..7161856bcf9c 100644
--- a/include/net/xdp_sock.h
+++ b/include/net/xdp_sock.h
@@ -60,6 +60,10 @@ struct xdp_sock {
        bool zc;
        /* Protects multiple processes in the control path */
        struct mutex mutex;
+        /* Mutual exclusion of NAPI TX thread and sendmsg error paths
+         * in the SKB destructor callback.
+         */
+        spinlock_t tx_completion_lock;
        u64 rx_dropped;
 };
diff --git a/include/uapi/linux/ethtool.h b/include/uapi/linux/ethtool.h
index 4ca65b56084f..7363f18e65a5 100644
--- a/include/uapi/linux/ethtool.h
+++ b/include/uapi/linux/ethtool.h
@@ -226,7 +226,7 @@ enum tunable_id {
        ETHTOOL_TX_COPYBREAK,
        ETHTOOL_PFC_PREVENTION_TOUT, /* timeout in msecs */
        /*
-         * Add your fresh new tubale attribute above and remember to update
+         * Add your fresh new tunable attribute above and remember to update
         * tunable_strings[] in net/core/ethtool.c
         */
        __ETHTOOL_TUNABLE_COUNT,
diff --git a/include/uapi/linux/tcp.h b/include/uapi/linux/tcp.h
index 29eb659aa77a..e3f6ed8a7064 100644
--- a/include/uapi/linux/tcp.h
+++ b/include/uapi/linux/tcp.h
@@ -127,6 +127,10 @@ enum {
 #define TCP_CM_INQ              TCP_INQ
+#define TCP_REPAIR_ON           1
+#define TCP_REPAIR_OFF          0
+#define TCP_REPAIR_OFF_NO_WP    -1      /* Turn off without window probes */
 struct tcp_repair_opt {
        __u32   opt_code;
        __u32   opt_val;
diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
index 2d49d18b793a..e016ac3afa24 100644
--- a/kernel/bpf/btf.c
+++ b/kernel/bpf/btf.c
@@ -991,16 +991,13 @@ static void btf_int_bits_seq_show(const struct btf *btf,
                                  void *data, u8 bits_offset,
                                  struct seq_file *m)
 {
+        u16 left_shift_bits, right_shift_bits;
        u32 int_data = btf_type_int(t);
        u16 nr_bits = BTF_INT_BITS(int_data);
        u16 total_bits_offset;
        u16 nr_copy_bytes;
        u16 nr_copy_bits;
-        u8 nr_upper_bits;
+        u64 print_num;
-        union {
-                u64 u64_num;
-                u8  u8_nums[8];
-        } print_num;
        total_bits_offset = bits_offset + BTF_INT_OFFSET(int_data);
        data += BITS_ROUNDDOWN_BYTES(total_bits_offset);
@@ -1008,21 +1005,20 @@ static void btf_int_bits_seq_show(const struct btf *btf,
        nr_copy_bits = nr_bits + bits_offset;
        nr_copy_bytes = BITS_ROUNDUP_BYTES(nr_copy_bits);
-        print_num.u64_num = 0;
+        print_num = 0;
-        memcpy(&print_num.u64_num, data, nr_copy_bytes);
+        memcpy(&print_num, data, nr_copy_bytes);
-        /* Ditch the higher order bits */
+#ifdef __BIG_ENDIAN_BITFIELD
-        nr_upper_bits = BITS_PER_BYTE_MASKED(nr_copy_bits);
+        left_shift_bits = bits_offset;
-        if (nr_upper_bits) {
+#else
-                /* We need to mask out some bits of the upper byte. */
+        left_shift_bits = BITS_PER_U64 - nr_copy_bits;
-                u8 mask = (1 << nr_upper_bits) - 1;
+#endif
+        right_shift_bits = BITS_PER_U64 - nr_bits;
-                print_num.u8_nums[nr_copy_bytes - 1] &= mask;
+        print_num <<= left_shift_bits;
-        }
+        print_num >>= right_shift_bits;
-        print_num.u64_num >>= bits_offset;
-        seq_printf(m, "0x%llx", print_num.u64_num);
+        seq_printf(m, "0x%llx", print_num);
 }
 static void btf_int_seq_show(const struct btf *btf, const struct btf_type *t,
diff --git a/kernel/bpf/devmap.c b/kernel/bpf/devmap.c
index 642c97f6d1b8..d361fc1e3bf3 100644
--- a/kernel/bpf/devmap.c
+++ b/kernel/bpf/devmap.c
@@ -334,10 +334,15 @@ int dev_map_enqueue(struct bpf_dtab_netdev *dst, struct xdp_buff *xdp,
 {
        struct net_device *dev = dst->dev;
        struct xdp_frame *xdpf;
+        int err;
        if (!dev->netdev_ops->ndo_xdp_xmit)
                return -EOPNOTSUPP;
+        err = xdp_ok_fwd_dev(dev, xdp->data_end - xdp->data);
+        if (unlikely(err))
+                return err;
        xdpf = convert_to_xdp_frame(xdp);
        if (unlikely(!xdpf))
                return -EOVERFLOW;
@@ -350,7 +355,7 @@ int dev_map_generic_redirect(struct bpf_dtab_netdev *dst, struct sk_buff *skb,
 {
        int err;
-        err = __xdp_generic_ok_fwd_dev(skb, dst->dev);
+        err = xdp_ok_fwd_dev(dst->dev, skb->len);
        if (unlikely(err))
                return err;
        skb->dev = dst->dev;
diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c
index 3ca2198a6d22..513d9dfcf4ee 100644
--- a/kernel/bpf/hashtab.c
+++ b/kernel/bpf/hashtab.c
@@ -747,13 +747,15 @@ static struct htab_elem *alloc_htab_elem(struct bpf_htab *htab, void *key,
                                 * old element will be freed immediately.
                                 * Otherwise return an error
                                 */
-                                atomic_dec(&htab->count);
+                                l_new = ERR_PTR(-E2BIG);
-                                return ERR_PTR(-E2BIG);
+                                goto dec_count;
                        }
                l_new = kmalloc_node(htab->elem_size, GFP_ATOMIC | __GFP_NOWARN,
                                     htab->map.numa_node);
-                if (!l_new)
+                if (!l_new) {
-                        return ERR_PTR(-ENOMEM);
+                        l_new = ERR_PTR(-ENOMEM);
+                        goto dec_count;
+                }
        }
        memcpy(l_new->key, key, key_size);
@@ -766,7 +768,8 @@ static struct htab_elem *alloc_htab_elem(struct bpf_htab *htab, void *key,
                                                  GFP_ATOMIC | __GFP_NOWARN);
                        if (!pptr) {
                                kfree(l_new);
-                                return ERR_PTR(-ENOMEM);
+                                l_new = ERR_PTR(-ENOMEM);
+                                goto dec_count;
                        }
                }
@@ -780,6 +783,9 @@ static struct htab_elem *alloc_htab_elem(struct bpf_htab *htab, void *key,
        l_new->hash = hash;
        return l_new;
+dec_count:
+        atomic_dec(&htab->count);
+        return l_new;
 }
 static int check_flags(struct bpf_htab *htab, struct htab_elem *l_old,
diff --git a/kernel/bpf/sockmap.c b/kernel/bpf/sockmap.c
index cf7b6a6dbd1f..98fb7938beea 100644
--- a/kernel/bpf/sockmap.c
+++ b/kernel/bpf/sockmap.c
@@ -312,10 +312,12 @@ static void bpf_tcp_close(struct sock *sk, long timeout)
        struct smap_psock *psock;
        struct sock *osk;
+        lock_sock(sk);
        rcu_read_lock();
        psock = smap_psock_sk(sk);
        if (unlikely(!psock)) {
                rcu_read_unlock();
+                release_sock(sk);
                return sk->sk_prot->close(sk, timeout);
        }
@@ -371,6 +373,7 @@ static void bpf_tcp_close(struct sock *sk, long timeout)
                e = psock_map_pop(sk, psock);
        }
        rcu_read_unlock();
+        release_sock(sk);
        close_fun(sk, timeout);
 }
@@ -568,7 +571,8 @@ static int free_sg(struct sock *sk, int start, struct sk_msg_buff *md)
        while (sg[i].length) {
                free += sg[i].length;
                sk_mem_uncharge(sk, sg[i].length);
-                put_page(sg_page(&sg[i]));
+                if (!md->skb)
+                        put_page(sg_page(&sg[i]));
                sg[i].length = 0;
                sg[i].page_link = 0;
                sg[i].offset = 0;
@@ -577,6 +581,8 @@ static int free_sg(struct sock *sk, int start, struct sk_msg_buff *md)
                if (i == MAX_SKB_FRAGS)
                        i = 0;
        }
+        if (md->skb)
+                consume_skb(md->skb);
        return free;
 }
@@ -1230,7 +1236,7 @@ static int smap_verdict_func(struct smap_psock *psock, struct sk_buff *skb)
         */
        TCP_SKB_CB(skb)->bpf.sk_redir = NULL;
        skb->sk = psock->sock;
-        bpf_compute_data_pointers(skb);
+        bpf_compute_data_end_sk_skb(skb);
        preempt_disable();
        rc = (*prog->bpf_func)(skb, prog->insnsi);
        preempt_enable();
@@ -1485,7 +1491,7 @@ static int smap_parse_func_strparser(struct strparser *strp,
         * any socket yet.
         */
        skb->sk = psock->sock;
-        bpf_compute_data_pointers(skb);
+        bpf_compute_data_end_sk_skb(skb);
        rc = (*prog->bpf_func)(skb, prog->insnsi);
        skb->sk = NULL;
        rcu_read_unlock();
@@ -1896,7 +1902,7 @@ static int __sock_map_ctx_update_elem(struct bpf_map *map,
                e = kzalloc(sizeof(*e), GFP_ATOMIC | __GFP_NOWARN);
                if (!e) {
                        err = -ENOMEM;
-                        goto out_progs;
+                        goto out_free;
                }
        }
@@ -2069,7 +2075,13 @@ static int sock_map_update_elem(struct bpf_map *map,
                return -EOPNOTSUPP;
        }
+        lock_sock(skops.sk);
+        preempt_disable();
+        rcu_read_lock();
        err = sock_map_ctx_update_elem(&skops, map, key, flags);
+        rcu_read_unlock();
+        preempt_enable();
+        release_sock(skops.sk);
        fput(socket->file);
        return err;
 }
@@ -2342,7 +2354,10 @@ static int sock_hash_ctx_update_elem(struct bpf_sock_ops_kern *skops,
        if (err)
                goto err;
-        /* bpf_map_update_elem() can be called in_irq() */
+        /* psock is valid here because otherwise above *ctx_update_elem would
+         * have thrown an error. It is safe to skip error check.
+         */
+        psock = smap_psock_sk(sock);
        raw_spin_lock_bh(&b->lock);
        l_old = lookup_elem_raw(head, hash, key, key_size);
        if (l_old && map_flags == BPF_NOEXIST) {
@@ -2360,12 +2375,6 @@ static int sock_hash_ctx_update_elem(struct bpf_sock_ops_kern *skops,
                goto bucket_err;
        }
-        psock = smap_psock_sk(sock);
-        if (unlikely(!psock)) {
-                err = -EINVAL;
-                goto bucket_err;
-        }
        rcu_assign_pointer(e->hash_link, l_new);
        rcu_assign_pointer(e->htab,
                           container_of(map, struct bpf_htab, map));
@@ -2388,12 +2397,10 @@ static int sock_hash_ctx_update_elem(struct bpf_sock_ops_kern *skops,
        raw_spin_unlock_bh(&b->lock);
        return 0;
 bucket_err:
+        smap_release_sock(psock, sock);
        raw_spin_unlock_bh(&b->lock);
 err:
        kfree(e);
-        psock = smap_psock_sk(sock);
-        if (psock)
-                smap_release_sock(psock, sock);
        return err;
 }
@@ -2415,7 +2422,13 @@ static int sock_hash_update_elem(struct bpf_map *map,
                return -EINVAL;
        }
+        lock_sock(skops.sk);
+        preempt_disable();
+        rcu_read_lock();
        err = sock_hash_ctx_update_elem(&skops, map, key, flags);
+        rcu_read_unlock();
+        preempt_enable();
+        release_sock(skops.sk);
        fput(socket->file);
        return err;
 }
@@ -2472,10 +2485,8 @@ struct sock  *__sock_hash_lookup_elem(struct bpf_map *map, void *key)
        b = __select_bucket(htab, hash);
        head = &b->head;
-        raw_spin_lock_bh(&b->lock);
        l = lookup_elem_raw(head, hash, key, key_size);
        sk = l ? l->sk : NULL;
-        raw_spin_unlock_bh(&b->lock);
        return sk;
 }
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index d10ecd78105f..a31a1ba0f8ea 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -735,7 +735,9 @@ static int map_update_elem(union bpf_attr *attr)
        if (bpf_map_is_dev_bound(map)) {
                err = bpf_map_offload_update_elem(map, key, value, attr->flags);
                goto out;
-        } else if (map->map_type == BPF_MAP_TYPE_CPUMAP) {
+        } else if (map->map_type == BPF_MAP_TYPE_CPUMAP ||
+                   map->map_type == BPF_MAP_TYPE_SOCKHASH ||
+                   map->map_type == BPF_MAP_TYPE_SOCKMAP) {
                err = map->ops->map_update_elem(map, key, value, attr->flags);
                goto out;
        }
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 9e2bf834f13a..63aaac52a265 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -5430,6 +5430,10 @@ static int jit_subprogs(struct bpf_verifier_env *env)
                if (insn->code != (BPF_JMP | BPF_CALL) ||
                    insn->src_reg != BPF_PSEUDO_CALL)
                        continue;
+                /* Upon error here we cannot fall back to interpreter but
+                 * need a hard reject of the program. Thus -EFAULT is
+                 * propagated in any case.
+                 */
                subprog = find_subprog(env, i + insn->imm + 1);
                if (subprog < 0) {
                        WARN_ONCE(1, "verifier bug. No program starts at insn %d\n",
@@ -5450,7 +5454,7 @@ static int jit_subprogs(struct bpf_verifier_env *env)
        func = kcalloc(env->subprog_cnt, sizeof(prog), GFP_KERNEL);
        if (!func)
-                return -ENOMEM;
+                goto out_undo_insn;
        for (i = 0; i < env->subprog_cnt; i++) {
                subprog_start = subprog_end;
@@ -5515,7 +5519,7 @@ static int jit_subprogs(struct bpf_verifier_env *env)
                tmp = bpf_int_jit_compile(func[i]);
                if (tmp != func[i] || func[i]->bpf_func != old_bpf_func) {
                        verbose(env, "JIT doesn't support bpf-to-bpf calls\n");
-                        err = -EFAULT;
+                        err = -ENOTSUPP;
                        goto out_free;
                }
                cond_resched();
@@ -5552,6 +5556,7 @@ out_free:
                if (func[i])
                        bpf_jit_free(func[i]);
        kfree(func);
+out_undo_insn:
        /* cleanup main prog to be interpreted */
        prog->jit_requested = 0;
        for (i = 0, insn = prog->insnsi; i < prog->len; i++, insn++) {
@@ -5578,6 +5583,8 @@ static int fixup_call_args(struct bpf_verifier_env *env)
                err = jit_subprogs(env);
                if (err == 0)
                        return 0;
+                if (err == -EFAULT)
+                        return err;
        }
 #ifndef CONFIG_BPF_JIT_ALWAYS_ON
        for (i = 0; i < prog->len; i++, insn++) {
diff --git a/lib/rhashtable.c b/lib/rhashtable.c
index 9427b5766134..e5c8586cf717 100644
--- a/lib/rhashtable.c
+++ b/lib/rhashtable.c
@@ -774,7 +774,7 @@ int rhashtable_walk_start_check(struct rhashtable_iter *iter)
                                skip++;
                                if (list == iter->list) {
                                        iter->p = p;
-                                        skip = skip;
+                                        iter->skip = skip;
                                        goto found;
                                }
                        }
@@ -964,8 +964,16 @@ EXPORT_SYMBOL_GPL(rhashtable_walk_stop);
 static size_t rounded_hashtable_size(const struct rhashtable_params *params)
 {
-        return max(roundup_pow_of_two(params->nelem_hint * 4 / 3),
+        size_t retsize;
-                   (unsigned long)params->min_size);
+        if (params->nelem_hint)
+                retsize = max(roundup_pow_of_two(params->nelem_hint * 4 / 3),
+                              (unsigned long)params->min_size);
+        else
+                retsize = max(HASH_DEFAULT_SIZE,
+                              (unsigned long)params->min_size);
+        return retsize;
 }
 static u32 rhashtable_jhash2(const void *key, u32 length, u32 seed)
@@ -1022,8 +1030,6 @@ int rhashtable_init(struct rhashtable *ht,
        struct bucket_table *tbl;
        size_t size;
-        size = HASH_DEFAULT_SIZE;
        if ((!params->key_len && !params->obj_hashfn) ||
            (params->obj_hashfn && !params->obj_cmpfn))
                return -EINVAL;
@@ -1050,8 +1056,7 @@ int rhashtable_init(struct rhashtable *ht,
        ht->p.min_size = max_t(u16, ht->p.min_size, HASH_MIN_SIZE);
-        if (params->nelem_hint)
+        size = rounded_hashtable_size(&ht->p);
-                size = rounded_hashtable_size(&ht->p);
        if (params->locks_mul)
                ht->p.locks_mul = roundup_pow_of_two(params->locks_mul);
@@ -1143,13 +1148,14 @@ void rhashtable_free_and_destroy(struct rhashtable *ht,
                                 void (*free_fn)(void *ptr, void *arg),
                                 void *arg)
 {
-        struct bucket_table *tbl;
+        struct bucket_table *tbl, *next_tbl;
        unsigned int i;
        cancel_work_sync(&ht->run_work);
        mutex_lock(&ht->mutex);
        tbl = rht_dereference(ht->tbl, ht);
+restart:
        if (free_fn) {
                for (i = 0; i < tbl->size; i++) {
                        struct rhash_head *pos, *next;
@@ -1166,7 +1172,12 @@ void rhashtable_free_and_destroy(struct rhashtable *ht,
                }
        }
+        next_tbl = rht_dereference(tbl->future_tbl, ht);
        bucket_table_free(tbl);
+        if (next_tbl) {
+                tbl = next_tbl;
+                goto restart;
+        }
        mutex_unlock(&ht->mutex);
 }
 EXPORT_SYMBOL_GPL(rhashtable_free_and_destroy);
diff --git a/net/batman-adv/bat_iv_ogm.c b/net/batman-adv/bat_iv_ogm.c
index be09a9883825..73bf6a93a3cf 100644
--- a/net/batman-adv/bat_iv_ogm.c
+++ b/net/batman-adv/bat_iv_ogm.c
@@ -2732,7 +2732,7 @@ static int batadv_iv_gw_dump_entry(struct sk_buff *msg, u32 portid, u32 seq,
 {
        struct batadv_neigh_ifinfo *router_ifinfo = NULL;
        struct batadv_neigh_node *router;
-        struct batadv_gw_node *curr_gw;
+        struct batadv_gw_node *curr_gw = NULL;
        int ret = 0;
        void *hdr;
@@ -2780,6 +2780,8 @@ static int batadv_iv_gw_dump_entry(struct sk_buff *msg, u32 portid, u32 seq,
        ret = 0;
 out:
+        if (curr_gw)
+                batadv_gw_node_put(curr_gw);
        if (router_ifinfo)
                batadv_neigh_ifinfo_put(router_ifinfo);
        if (router)
diff --git a/net/batman-adv/bat_v.c b/net/batman-adv/bat_v.c
index ec93337ee259..6baec4e68898 100644
--- a/net/batman-adv/bat_v.c
+++ b/net/batman-adv/bat_v.c
@@ -927,7 +927,7 @@ static int batadv_v_gw_dump_entry(struct sk_buff *msg, u32 portid, u32 seq,
 {
        struct batadv_neigh_ifinfo *router_ifinfo = NULL;
        struct batadv_neigh_node *router;
-        struct batadv_gw_node *curr_gw;
+        struct batadv_gw_node *curr_gw = NULL;
        int ret = 0;
        void *hdr;
@@ -995,6 +995,8 @@ static int batadv_v_gw_dump_entry(struct sk_buff *msg, u32 portid, u32 seq,
        ret = 0;
 out:
+        if (curr_gw)
+                batadv_gw_node_put(curr_gw);
        if (router_ifinfo)
                batadv_neigh_ifinfo_put(router_ifinfo);
        if (router)
diff --git a/net/batman-adv/debugfs.c b/net/batman-adv/debugfs.c
index 4229b01ac7b5..87479c60670e 100644
--- a/net/batman-adv/debugfs.c
+++ b/net/batman-adv/debugfs.c
@@ -19,6 +19,7 @@
 #include "debugfs.h"
 #include "main.h"
+#include <linux/dcache.h>
 #include <linux/debugfs.h>
 #include <linux/err.h>
 #include <linux/errno.h>
@@ -344,6 +345,25 @@ out:
 }
 /**
+ * batadv_debugfs_rename_hardif() - Fix debugfs path for renamed hardif
+ * @hard_iface: hard interface which was renamed
+ */
+void batadv_debugfs_rename_hardif(struct batadv_hard_iface *hard_iface)
+{
+        const char *name = hard_iface->net_dev->name;
+        struct dentry *dir;
+        struct dentry *d;
+        dir = hard_iface->debug_dir;
+        if (!dir)
+                return;
+        d = debugfs_rename(dir->d_parent, dir, dir->d_parent, name);
+        if (!d)
+                pr_err("Can't rename debugfs dir to %s\n", name);
+}
+/**
 * batadv_debugfs_del_hardif() - delete the base directory for a hard interface
 *  in debugfs.
 * @hard_iface: hard interface which is deleted.
@@ -414,6 +434,26 @@ out:
 }
 /**
+ * batadv_debugfs_rename_meshif() - Fix debugfs path for renamed softif
+ * @dev: net_device which was renamed
+ */
+void batadv_debugfs_rename_meshif(struct net_device *dev)
+{
+        struct batadv_priv *bat_priv = netdev_priv(dev);
+        const char *name = dev->name;
+        struct dentry *dir;
+        struct dentry *d;
+        dir = bat_priv->debug_dir;
+        if (!dir)
+                return;
+        d = debugfs_rename(dir->d_parent, dir, dir->d_parent, name);
+        if (!d)
+                pr_err("Can't rename debugfs dir to %s\n", name);
+}
+/**
 * batadv_debugfs_del_meshif() - Remove interface dependent debugfs entries
 * @dev: netdev struct of the soft interface
 */
diff --git a/net/batman-adv/debugfs.h b/net/batman-adv/debugfs.h
index 37b069698b04..08a592ffbee5 100644
--- a/net/batman-adv/debugfs.h
+++ b/net/batman-adv/debugfs.h
@@ -30,8 +30,10 @@ struct net_device;
 void batadv_debugfs_init(void);
 void batadv_debugfs_destroy(void);
 int batadv_debugfs_add_meshif(struct net_device *dev);
+void batadv_debugfs_rename_meshif(struct net_device *dev);
 void batadv_debugfs_del_meshif(struct net_device *dev);
 int batadv_debugfs_add_hardif(struct batadv_hard_iface *hard_iface);
+void batadv_debugfs_rename_hardif(struct batadv_hard_iface *hard_iface);
 void batadv_debugfs_del_hardif(struct batadv_hard_iface *hard_iface);
 #else
@@ -49,6 +51,10 @@ static inline int batadv_debugfs_add_meshif(struct net_device *dev)
        return 0;
 }
+static inline void batadv_debugfs_rename_meshif(struct net_device *dev)
+{
+}
 static inline void batadv_debugfs_del_meshif(struct net_device *dev)
 {
 }
@@ -60,6 +66,11 @@ int batadv_debugfs_add_hardif(struct batadv_hard_iface *hard_iface)
 }
 static inline
+void batadv_debugfs_rename_hardif(struct batadv_hard_iface *hard_iface)
+{
+}
+static inline
 void batadv_debugfs_del_hardif(struct batadv_hard_iface *hard_iface)
 {
 }
diff --git a/net/batman-adv/hard-interface.c b/net/batman-adv/hard-interface.c
index c405d15befd6..2f0d42f2f913 100644
--- a/net/batman-adv/hard-interface.c
+++ b/net/batman-adv/hard-interface.c
@@ -989,6 +989,32 @@ void batadv_hardif_remove_interfaces(void)
        rtnl_unlock();
 }
+/**
+ * batadv_hard_if_event_softif() - Handle events for soft interfaces
+ * @event: NETDEV_* event to handle
+ * @net_dev: net_device which generated an event
+ *
+ * Return: NOTIFY_* result
+ */
+static int batadv_hard_if_event_softif(unsigned long event,
+                                       struct net_device *net_dev)
+{
+        struct batadv_priv *bat_priv;
+        switch (event) {
+        case NETDEV_REGISTER:
+                batadv_sysfs_add_meshif(net_dev);
+                bat_priv = netdev_priv(net_dev);
+                batadv_softif_create_vlan(bat_priv, BATADV_NO_FLAGS);
+                break;
+        case NETDEV_CHANGENAME:
+                batadv_debugfs_rename_meshif(net_dev);
+                break;
+        }
+        return NOTIFY_DONE;
+}
 static int batadv_hard_if_event(struct notifier_block *this,
                                unsigned long event, void *ptr)
 {
@@ -997,12 +1023,8 @@ static int batadv_hard_if_event(struct notifier_block *this,
        struct batadv_hard_iface *primary_if = NULL;
        struct batadv_priv *bat_priv;
-        if (batadv_softif_is_valid(net_dev) && event == NETDEV_REGISTER) {
+        if (batadv_softif_is_valid(net_dev))
-                batadv_sysfs_add_meshif(net_dev);
+                return batadv_hard_if_event_softif(event, net_dev);
-                bat_priv = netdev_priv(net_dev);
-                batadv_softif_create_vlan(bat_priv, BATADV_NO_FLAGS);
-                return NOTIFY_DONE;
-        }
        hard_iface = batadv_hardif_get_by_netdev(net_dev);
        if (!hard_iface && (event == NETDEV_REGISTER ||
@@ -1051,6 +1073,9 @@ static int batadv_hard_if_event(struct notifier_block *this,
                if (batadv_is_wifi_hardif(hard_iface))
                        hard_iface->num_bcasts = BATADV_NUM_BCASTS_WIRELESS;
                break;
+        case NETDEV_CHANGENAME:
+                batadv_debugfs_rename_hardif(hard_iface);
+                break;
        default:
                break;
        }
diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c
index 3986551397ca..12a2b7d21376 100644
--- a/net/batman-adv/translation-table.c
+++ b/net/batman-adv/translation-table.c
@@ -1705,7 +1705,9 @@ static bool batadv_tt_global_add(struct batadv_priv *bat_priv,
                ether_addr_copy(common->addr, tt_addr);
                common->vid = vid;
-                common->flags = flags;
+                if (!is_multicast_ether_addr(common->addr))
+                        common->flags = flags & (~BATADV_TT_SYNC_MASK);
                tt_global_entry->roam_at = 0;
                /* node must store current time in case of roaming. This is
                 * needed to purge this entry out on timeout (if nobody claims
@@ -1768,7 +1770,8 @@ static bool batadv_tt_global_add(struct batadv_priv *bat_priv,
                 * TT_CLIENT_TEMP, therefore they have to be copied in the
                 * client entry
                 */
-                common->flags |= flags & (~BATADV_TT_SYNC_MASK);
+                if (!is_multicast_ether_addr(common->addr))
+                        common->flags |= flags & (~BATADV_TT_SYNC_MASK);
                /* If there is the BATADV_TT_CLIENT_ROAM flag set, there is only
                 * one originator left in the list and we previously received a
diff --git a/net/bpf/test_run.c b/net/bpf/test_run.c
index 68c3578343b4..22a78eedf4b1 100644
--- a/net/bpf/test_run.c
+++ b/net/bpf/test_run.c
@@ -96,6 +96,7 @@ int bpf_prog_test_run_skb(struct bpf_prog *prog, const union bpf_attr *kattr,
        u32 size = kattr->test.data_size_in;
        u32 repeat = kattr->test.repeat;
        u32 retval, duration;
+        int hh_len = ETH_HLEN;
        struct sk_buff *skb;
        void *data;
        int ret;
@@ -131,12 +132,22 @@ int bpf_prog_test_run_skb(struct bpf_prog *prog, const union bpf_attr *kattr,
        skb_reset_network_header(skb);
        if (is_l2)
-                __skb_push(skb, ETH_HLEN);
+                __skb_push(skb, hh_len);
        if (is_direct_pkt_access)
                bpf_compute_data_pointers(skb);
        retval = bpf_test_run(prog, skb, repeat, &duration);
-        if (!is_l2)
+        if (!is_l2) {
-                __skb_push(skb, ETH_HLEN);
+                if (skb_headroom(skb) < hh_len) {
+                        int nhead = HH_DATA_ALIGN(hh_len - skb_headroom(skb));
+                        if (pskb_expand_head(skb, nhead, 0, GFP_USER)) {
+                                kfree_skb(skb);
+                                return -ENOMEM;
+                        }
+                }
+                memset(__skb_push(skb, hh_len), 0, hh_len);
+        }
        size = skb->len;
        /* bpf program can never convert linear skb to non-linear */
        if (WARN_ON_ONCE(skb_is_nonlinear(skb)))
diff --git a/net/core/filter.c b/net/core/filter.c
index 0ca6907d7efe..06da770f543f 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -459,11 +459,21 @@ static bool convert_bpf_ld_abs(struct sock_filter *fp, struct bpf_insn **insnp)
             (!unaligned_ok && offset >= 0 &&
              offset + ip_align >= 0 &&
              offset + ip_align % size == 0))) {
+                bool ldx_off_ok = offset <= S16_MAX;
                *insn++ = BPF_MOV64_REG(BPF_REG_TMP, BPF_REG_H);
                *insn++ = BPF_ALU64_IMM(BPF_SUB, BPF_REG_TMP, offset);
-                *insn++ = BPF_JMP_IMM(BPF_JSLT, BPF_REG_TMP, size, 2 + endian);
+                *insn++ = BPF_JMP_IMM(BPF_JSLT, BPF_REG_TMP,
-                *insn++ = BPF_LDX_MEM(BPF_SIZE(fp->code), BPF_REG_A, BPF_REG_D,
+                                      size, 2 + endian + (!ldx_off_ok * 2));
-                                      offset);
+                if (ldx_off_ok) {
+                        *insn++ = BPF_LDX_MEM(BPF_SIZE(fp->code), BPF_REG_A,
+                                              BPF_REG_D, offset);
+                } else {
+                        *insn++ = BPF_MOV64_REG(BPF_REG_TMP, BPF_REG_D);
+                        *insn++ = BPF_ALU64_IMM(BPF_ADD, BPF_REG_TMP, offset);
+                        *insn++ = BPF_LDX_MEM(BPF_SIZE(fp->code), BPF_REG_A,
+                                              BPF_REG_TMP, 0);
+                }
                if (endian)
                        *insn++ = BPF_ENDIAN(BPF_FROM_BE, BPF_REG_A, size * 8);
                *insn++ = BPF_JMP_A(8);
@@ -1762,6 +1772,37 @@ static const struct bpf_func_proto bpf_skb_pull_data_proto = {
        .arg2_type      = ARG_ANYTHING,
 };
+static inline int sk_skb_try_make_writable(struct sk_buff *skb,
+                                           unsigned int write_len)
+{
+        int err = __bpf_try_make_writable(skb, write_len);
+        bpf_compute_data_end_sk_skb(skb);
+        return err;
+}
+BPF_CALL_2(sk_skb_pull_data, struct sk_buff *, skb, u32, len)
+{
+        /* Idea is the following: should the needed direct read/write
+         * test fail during runtime, we can pull in more data and redo
+         * again, since implicitly, we invalidate previous checks here.
+         *
+         * Or, since we know how much we need to make read/writeable,
+         * this can be done once at the program beginning for direct
+         * access case. By this we overcome limitations of only current
+         * headroom being accessible.
+         */
+        return sk_skb_try_make_writable(skb, len ? : skb_headlen(skb));
+}
+static const struct bpf_func_proto sk_skb_pull_data_proto = {
+        .func           = sk_skb_pull_data,
+        .gpl_only       = false,
+        .ret_type       = RET_INTEGER,
+        .arg1_type      = ARG_PTR_TO_CTX,
+        .arg2_type      = ARG_ANYTHING,
+};
 BPF_CALL_5(bpf_l3_csum_replace, struct sk_buff *, skb, u32, offset,
           u64, from, u64, to, u64, flags)
 {
@@ -2779,7 +2820,8 @@ static int bpf_skb_net_shrink(struct sk_buff *skb, u32 len_diff)
 static u32 __bpf_skb_max_len(const struct sk_buff *skb)
 {
-        return skb->dev->mtu + skb->dev->hard_header_len;
+        return skb->dev ? skb->dev->mtu + skb->dev->hard_header_len :
+                          SKB_MAX_ALLOC;
 }
 static int bpf_skb_adjust_net(struct sk_buff *skb, s32 len_diff)
@@ -2863,8 +2905,8 @@ static int bpf_skb_trim_rcsum(struct sk_buff *skb, unsigned int new_len)
        return __skb_trim_rcsum(skb, new_len);
 }
-BPF_CALL_3(bpf_skb_change_tail, struct sk_buff *, skb, u32, new_len,
+static inline int __bpf_skb_change_tail(struct sk_buff *skb, u32 new_len,
-           u64, flags)
+                                        u64 flags)
 {
        u32 max_len = __bpf_skb_max_len(skb);
        u32 min_len = __bpf_skb_min_len(skb);
@@ -2900,6 +2942,13 @@ BPF_CALL_3(bpf_skb_change_tail, struct sk_buff *, skb, u32, new_len,
                if (!ret && skb_is_gso(skb))
                        skb_gso_reset(skb);
        }
+        return ret;
+}
+BPF_CALL_3(bpf_skb_change_tail, struct sk_buff *, skb, u32, new_len,
+           u64, flags)
+{
+        int ret = __bpf_skb_change_tail(skb, new_len, flags);
        bpf_compute_data_pointers(skb);
        return ret;
@@ -2914,9 +2963,27 @@ static const struct bpf_func_proto bpf_skb_change_tail_proto = {
        .arg3_type      = ARG_ANYTHING,
 };
-BPF_CALL_3(bpf_skb_change_head, struct sk_buff *, skb, u32, head_room,
+BPF_CALL_3(sk_skb_change_tail, struct sk_buff *, skb, u32, new_len,
           u64, flags)
 {
+        int ret = __bpf_skb_change_tail(skb, new_len, flags);
+        bpf_compute_data_end_sk_skb(skb);
+        return ret;
+}
+static const struct bpf_func_proto sk_skb_change_tail_proto = {
+        .func           = sk_skb_change_tail,
+        .gpl_only       = false,
+        .ret_type       = RET_INTEGER,
+        .arg1_type      = ARG_PTR_TO_CTX,
+        .arg2_type      = ARG_ANYTHING,
+        .arg3_type      = ARG_ANYTHING,
+};
+static inline int __bpf_skb_change_head(struct sk_buff *skb, u32 head_room,
+                                        u64 flags)
+{
        u32 max_len = __bpf_skb_max_len(skb);
        u32 new_len = skb->len + head_room;
        int ret;
@@ -2941,8 +3008,16 @@ BPF_CALL_3(bpf_skb_change_head, struct sk_buff *, skb, u32, head_room,
                skb_reset_mac_header(skb);
        }
+        return ret;
+}
+BPF_CALL_3(bpf_skb_change_head, struct sk_buff *, skb, u32, head_room,
+           u64, flags)
+{
+        int ret = __bpf_skb_change_head(skb, head_room, flags);
        bpf_compute_data_pointers(skb);
-        return 0;
+        return ret;
 }
 static const struct bpf_func_proto bpf_skb_change_head_proto = {
@@ -2954,6 +3029,23 @@ static const struct bpf_func_proto bpf_skb_change_head_proto = {
        .arg3_type      = ARG_ANYTHING,
 };
+BPF_CALL_3(sk_skb_change_head, struct sk_buff *, skb, u32, head_room,
+           u64, flags)
+{
+        int ret = __bpf_skb_change_head(skb, head_room, flags);
+        bpf_compute_data_end_sk_skb(skb);
+        return ret;
+}
+static const struct bpf_func_proto sk_skb_change_head_proto = {
+        .func           = sk_skb_change_head,
+        .gpl_only       = false,
+        .ret_type       = RET_INTEGER,
+        .arg1_type      = ARG_PTR_TO_CTX,
+        .arg2_type      = ARG_ANYTHING,
+        .arg3_type      = ARG_ANYTHING,
+};
 static unsigned long xdp_get_metalen(const struct xdp_buff *xdp)
 {
        return xdp_data_meta_unsupported(xdp) ? 0 :
@@ -3046,12 +3138,16 @@ static int __bpf_tx_xdp(struct net_device *dev,
                        u32 index)
 {
        struct xdp_frame *xdpf;
-        int sent;
+        int err, sent;
        if (!dev->netdev_ops->ndo_xdp_xmit) {
                return -EOPNOTSUPP;
        }
+        err = xdp_ok_fwd_dev(dev, xdp->data_end - xdp->data);
+        if (unlikely(err))
+                return err;
        xdpf = convert_to_xdp_frame(xdp);
        if (unlikely(!xdpf))
                return -EOVERFLOW;
@@ -3285,7 +3381,8 @@ int xdp_do_generic_redirect(struct net_device *dev, struct sk_buff *skb,
                goto err;
        }
-        if (unlikely((err = __xdp_generic_ok_fwd_dev(skb, fwd))))
+        err = xdp_ok_fwd_dev(fwd, skb->len);
+        if (unlikely(err))
                goto err;
        skb->dev = fwd;
@@ -4439,10 +4536,10 @@ static const struct bpf_func_proto bpf_lwt_push_encap_proto = {
        .arg4_type      = ARG_CONST_SIZE
 };
+#if IS_ENABLED(CONFIG_IPV6_SEG6_BPF)
 BPF_CALL_4(bpf_lwt_seg6_store_bytes, struct sk_buff *, skb, u32, offset,
           const void *, from, u32, len)
 {
-#if IS_ENABLED(CONFIG_IPV6_SEG6_BPF)
        struct seg6_bpf_srh_state *srh_state =
                this_cpu_ptr(&seg6_bpf_srh_states);
        void *srh_tlvs, *srh_end, *ptr;
@@ -4468,9 +4565,6 @@ BPF_CALL_4(bpf_lwt_seg6_store_bytes, struct sk_buff *, skb, u32, offset,
        memcpy(skb->data + offset, from, len);
        return 0;
-#else /* CONFIG_IPV6_SEG6_BPF */
-        return -EOPNOTSUPP;
-#endif
 }
 static const struct bpf_func_proto bpf_lwt_seg6_store_bytes_proto = {
@@ -4486,7 +4580,6 @@ static const struct bpf_func_proto bpf_lwt_seg6_store_bytes_proto = {
 BPF_CALL_4(bpf_lwt_seg6_action, struct sk_buff *, skb,
           u32, action, void *, param, u32, param_len)
 {
-#if IS_ENABLED(CONFIG_IPV6_SEG6_BPF)
        struct seg6_bpf_srh_state *srh_state =
                this_cpu_ptr(&seg6_bpf_srh_states);
        struct ipv6_sr_hdr *srh;
@@ -4534,9 +4627,6 @@ BPF_CALL_4(bpf_lwt_seg6_action, struct sk_buff *, skb,
        default:
                return -EINVAL;
        }
-#else /* CONFIG_IPV6_SEG6_BPF */
-        return -EOPNOTSUPP;
-#endif
 }
 static const struct bpf_func_proto bpf_lwt_seg6_action_proto = {
@@ -4552,7 +4642,6 @@ static const struct bpf_func_proto bpf_lwt_seg6_action_proto = {
 BPF_CALL_3(bpf_lwt_seg6_adjust_srh, struct sk_buff *, skb, u32, offset,
           s32, len)
 {
-#if IS_ENABLED(CONFIG_IPV6_SEG6_BPF)
        struct seg6_bpf_srh_state *srh_state =
                this_cpu_ptr(&seg6_bpf_srh_states);
        void *srh_end, *srh_tlvs, *ptr;
@@ -4596,9 +4685,6 @@ BPF_CALL_3(bpf_lwt_seg6_adjust_srh, struct sk_buff *, skb, u32, offset,
        srh_state->hdrlen += len;
        srh_state->valid = 0;
        return 0;
-#else /* CONFIG_IPV6_SEG6_BPF */
-        return -EOPNOTSUPP;
-#endif
 }
 static const struct bpf_func_proto bpf_lwt_seg6_adjust_srh_proto = {
@@ -4609,6 +4695,7 @@ static const struct bpf_func_proto bpf_lwt_seg6_adjust_srh_proto = {
        .arg2_type      = ARG_ANYTHING,
        .arg3_type      = ARG_ANYTHING,
 };
+#endif /* CONFIG_IPV6_SEG6_BPF */
 bool bpf_helper_changes_pkt_data(void *func)
 {
@@ -4617,9 +4704,12 @@ bool bpf_helper_changes_pkt_data(void *func)
            func == bpf_skb_store_bytes ||
            func == bpf_skb_change_proto ||
            func == bpf_skb_change_head ||
+            func == sk_skb_change_head ||
            func == bpf_skb_change_tail ||
+            func == sk_skb_change_tail ||
            func == bpf_skb_adjust_room ||
            func == bpf_skb_pull_data ||
+            func == sk_skb_pull_data ||
            func == bpf_clone_redirect ||
            func == bpf_l3_csum_replace ||
            func == bpf_l4_csum_replace ||
@@ -4627,11 +4717,12 @@ bool bpf_helper_changes_pkt_data(void *func)
            func == bpf_xdp_adjust_meta ||
            func == bpf_msg_pull_data ||
            func == bpf_xdp_adjust_tail ||
-            func == bpf_lwt_push_encap ||
+#if IS_ENABLED(CONFIG_IPV6_SEG6_BPF)
            func == bpf_lwt_seg6_store_bytes ||
            func == bpf_lwt_seg6_adjust_srh ||
-            func == bpf_lwt_seg6_action
+            func == bpf_lwt_seg6_action ||
-            )
+#endif
+            func == bpf_lwt_push_encap)
                return true;
        return false;
@@ -4871,11 +4962,11 @@ sk_skb_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
        case BPF_FUNC_skb_load_bytes:
                return &bpf_skb_load_bytes_proto;
        case BPF_FUNC_skb_pull_data:
-                return &bpf_skb_pull_data_proto;
+                return &sk_skb_pull_data_proto;
        case BPF_FUNC_skb_change_tail:
-                return &bpf_skb_change_tail_proto;
+                return &sk_skb_change_tail_proto;
        case BPF_FUNC_skb_change_head:
-                return &bpf_skb_change_head_proto;
+                return &sk_skb_change_head_proto;
        case BPF_FUNC_get_socket_cookie:
                return &bpf_get_socket_cookie_proto;
        case BPF_FUNC_get_socket_uid:
@@ -4966,12 +5057,14 @@ static const struct bpf_func_proto *
 lwt_seg6local_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
 {
        switch (func_id) {
+#if IS_ENABLED(CONFIG_IPV6_SEG6_BPF)
        case BPF_FUNC_lwt_seg6_store_bytes:
                return &bpf_lwt_seg6_store_bytes_proto;
        case BPF_FUNC_lwt_seg6_action:
                return &bpf_lwt_seg6_action_proto;
        case BPF_FUNC_lwt_seg6_adjust_srh:
                return &bpf_lwt_seg6_adjust_srh_proto;
+#endif
        default:
                return lwt_out_func_proto(func_id, prog);
        }
diff --git a/net/core/gen_stats.c b/net/core/gen_stats.c
index b2b2323bdc84..188d693cb251 100644
--- a/net/core/gen_stats.c
+++ b/net/core/gen_stats.c
@@ -77,8 +77,20 @@ gnet_stats_start_copy_compat(struct sk_buff *skb, int type, int tc_stats_type,
                d->lock = lock;
                spin_lock_bh(lock);
        }
-        if (d->tail)
+        if (d->tail) {
-                return gnet_stats_copy(d, type, NULL, 0, padattr);
+                int ret = gnet_stats_copy(d, type, NULL, 0, padattr);
+                /* The initial attribute added in gnet_stats_copy() may be
+                 * preceded by a padding attribute, in which case d->tail will
+                 * end up pointing at the padding instead of the real attribute.
+                 * Fix this so gnet_stats_finish_copy() adjusts the length of
+                 * the right attribute.
+                 */
+                if (ret == 0 && d->tail->nla_type == padattr)
+                        d->tail = (struct nlattr *)((char *)d->tail +
+                                                    NLA_ALIGN(d->tail->nla_len));
+                return ret;
+        }
        return 0;
 }
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index eba8dae22c25..8e51f8555e11 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -858,6 +858,7 @@ static struct sk_buff *__skb_clone(struct sk_buff *n, struct sk_buff *skb)
        n->cloned = 1;
        n->nohdr = 0;
        n->peeked = 0;
+        C(pfmemalloc);
        n->destructor = NULL;
        C(tail);
        C(end);
diff --git a/net/dns_resolver/dns_key.c b/net/dns_resolver/dns_key.c
index 40c851693f77..0c9478b91fa5 100644
--- a/net/dns_resolver/dns_key.c
+++ b/net/dns_resolver/dns_key.c
@@ -86,35 +86,39 @@ dns_resolver_preparse(struct key_preparsed_payload *prep)
                opt++;
                kdebug("options: '%s'", opt);
                do {
+                        int opt_len, opt_nlen;
                        const char *eq;
-                        int opt_len, opt_nlen, opt_vlen, tmp;
+                        char optval[128];
                        next_opt = memchr(opt, '#', end - opt) ?: end;
                        opt_len = next_opt - opt;
-                        if (opt_len <= 0 || opt_len > 128) {
+                        if (opt_len <= 0 || opt_len > sizeof(optval)) {
                                pr_warn_ratelimited("Invalid option length (%d) for dns_resolver key\n",
                                                    opt_len);
                                return -EINVAL;
                        }
-                        eq = memchr(opt, '=', opt_len) ?: end;
+                        eq = memchr(opt, '=', opt_len);
-                        opt_nlen = eq - opt;
+                        if (eq) {
-                        eq++;
+                                opt_nlen = eq - opt;
-                        opt_vlen = next_opt - eq; /* will be -1 if no value */
+                                eq++;
+                                memcpy(optval, eq, next_opt - eq);
+                                optval[next_opt - eq] = '\0';
+                        } else {
+                                opt_nlen = opt_len;
+                                optval[0] = '\0';
+                        }
-                        tmp = opt_vlen >= 0 ? opt_vlen : 0;
+                        kdebug("option '%*.*s' val '%s'",
-                        kdebug("option '%*.*s' val '%*.*s'",
+                               opt_nlen, opt_nlen, opt, optval);
-                               opt_nlen, opt_nlen, opt, tmp, tmp, eq);
                        /* see if it's an error number representing a DNS error
                         * that's to be recorded as the result in this key */
                        if (opt_nlen == sizeof(DNS_ERRORNO_OPTION) - 1 &&
                            memcmp(opt, DNS_ERRORNO_OPTION, opt_nlen) == 0) {
                                kdebug("dns error number option");
-                                if (opt_vlen <= 0)
-                                        goto bad_option_value;
-                                ret = kstrtoul(eq, 10, &derrno);
+                                ret = kstrtoul(optval, 10, &derrno);
                                if (ret < 0)
                                        goto bad_option_value;
diff --git a/net/ieee802154/6lowpan/core.c b/net/ieee802154/6lowpan/core.c
index 275449b0d633..3297e7fa9945 100644
--- a/net/ieee802154/6lowpan/core.c
+++ b/net/ieee802154/6lowpan/core.c
@@ -90,12 +90,18 @@ static int lowpan_neigh_construct(struct net_device *dev, struct neighbour *n)
        return 0;
 }
+static int lowpan_get_iflink(const struct net_device *dev)
+{
+        return lowpan_802154_dev(dev)->wdev->ifindex;
+}
 static const struct net_device_ops lowpan_netdev_ops = {
        .ndo_init               = lowpan_dev_init,
        .ndo_start_xmit         = lowpan_xmit,
        .ndo_open               = lowpan_open,
        .ndo_stop               = lowpan_stop,
        .ndo_neigh_construct    = lowpan_neigh_construct,
+        .ndo_get_iflink         = lowpan_get_iflink,
 };
 static void lowpan_setup(struct net_device *ldev)
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index b21833651394..e46cdd310e5f 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -300,6 +300,7 @@ __be32 fib_compute_spec_dst(struct sk_buff *skb)
        if (!ipv4_is_zeronet(ip_hdr(skb)->saddr)) {
                struct flowi4 fl4 = {
                        .flowi4_iif = LOOPBACK_IFINDEX,
+                        .flowi4_oif = l3mdev_master_ifindex_rcu(dev),
                        .daddr = ip_hdr(skb)->saddr,
                        .flowi4_tos = RT_TOS(ip_hdr(skb)->tos),
                        .flowi4_scope = scope,
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index 85b617b655bc..b3c899a630a0 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -1200,13 +1200,14 @@ static void igmpv3_del_delrec(struct in_device *in_dev, struct ip_mc_list *im)
        spin_lock_bh(&im->lock);
        if (pmc) {
                im->interface = pmc->interface;
-                im->crcount = in_dev->mr_qrv ?: net->ipv4.sysctl_igmp_qrv;
                im->sfmode = pmc->sfmode;
                if (pmc->sfmode == MCAST_INCLUDE) {
                        im->tomb = pmc->tomb;
                        im->sources = pmc->sources;
                        for (psf = im->sources; psf; psf = psf->sf_next)
-                                psf->sf_crcount = im->crcount;
+                                psf->sf_crcount = in_dev->mr_qrv ?: net->ipv4.sysctl_igmp_qrv;
+                } else {
+                        im->crcount = in_dev->mr_qrv ?: net->ipv4.sysctl_igmp_qrv;
                }
                in_dev_put(pmc->interface);
                kfree(pmc);
@@ -1288,7 +1289,7 @@ static void igmp_group_dropped(struct ip_mc_list *im)
 #endif
 }
-static void igmp_group_added(struct ip_mc_list *im)
+static void igmp_group_added(struct ip_mc_list *im, unsigned int mode)
 {
        struct in_device *in_dev = im->interface;
 #ifdef CONFIG_IP_MULTICAST
@@ -1316,7 +1317,13 @@ static void igmp_group_added(struct ip_mc_list *im)
        }
        /* else, v3 */
-        im->crcount = in_dev->mr_qrv ?: net->ipv4.sysctl_igmp_qrv;
+        /* Based on RFC3376 5.1, for newly added INCLUDE SSM, we should
+         * not send filter-mode change record as the mode should be from
+         * IN() to IN(A).
+         */
+        if (mode == MCAST_EXCLUDE)
+                im->crcount = in_dev->mr_qrv ?: net->ipv4.sysctl_igmp_qrv;
        igmp_ifc_event(in_dev);
 #endif
 }
@@ -1381,8 +1388,7 @@ static void ip_mc_hash_remove(struct in_device *in_dev,
 /*
 *      A socket has joined a multicast group on device dev.
 */
+void __ip_mc_inc_group(struct in_device *in_dev, __be32 addr, unsigned int mode)
-void ip_mc_inc_group(struct in_device *in_dev, __be32 addr)
 {
        struct ip_mc_list *im;
 #ifdef CONFIG_IP_MULTICAST
@@ -1394,7 +1400,7 @@ void ip_mc_inc_group(struct in_device *in_dev, __be32 addr)
        for_each_pmc_rtnl(in_dev, im) {
                if (im->multiaddr == addr) {
                        im->users++;
-                        ip_mc_add_src(in_dev, &addr, MCAST_EXCLUDE, 0, NULL, 0);
+                        ip_mc_add_src(in_dev, &addr, mode, 0, NULL, 0);
                        goto out;
                }
        }
@@ -1408,8 +1414,8 @@ void ip_mc_inc_group(struct in_device *in_dev, __be32 addr)
        in_dev_hold(in_dev);
        im->multiaddr = addr;
        /* initial mode is (EX, empty) */
-        im->sfmode = MCAST_EXCLUDE;
+        im->sfmode = mode;
-        im->sfcount[MCAST_EXCLUDE] = 1;
+        im->sfcount[mode] = 1;
        refcount_set(&im->refcnt, 1);
        spin_lock_init(&im->lock);
 #ifdef CONFIG_IP_MULTICAST
@@ -1426,12 +1432,17 @@ void ip_mc_inc_group(struct in_device *in_dev, __be32 addr)
 #ifdef CONFIG_IP_MULTICAST
        igmpv3_del_delrec(in_dev, im);
 #endif
-        igmp_group_added(im);
+        igmp_group_added(im, mode);
        if (!in_dev->dead)
                ip_rt_multicast_event(in_dev);
 out:
        return;
 }
+void ip_mc_inc_group(struct in_device *in_dev, __be32 addr)
+{
+        __ip_mc_inc_group(in_dev, addr, MCAST_EXCLUDE);
+}
 EXPORT_SYMBOL(ip_mc_inc_group);
 static int ip_mc_check_iphdr(struct sk_buff *skb)
@@ -1688,7 +1699,7 @@ void ip_mc_remap(struct in_device *in_dev)
 #ifdef CONFIG_IP_MULTICAST
                igmpv3_del_delrec(in_dev, pmc);
 #endif
-                igmp_group_added(pmc);
+                igmp_group_added(pmc, pmc->sfmode);
        }
 }
@@ -1751,7 +1762,7 @@ void ip_mc_up(struct in_device *in_dev)
 #ifdef CONFIG_IP_MULTICAST
                igmpv3_del_delrec(in_dev, pmc);
 #endif
-                igmp_group_added(pmc);
+                igmp_group_added(pmc, pmc->sfmode);
        }
 }
@@ -2130,8 +2141,8 @@ static void ip_mc_clear_src(struct ip_mc_list *pmc)
 /* Join a multicast group
 */
+static int __ip_mc_join_group(struct sock *sk, struct ip_mreqn *imr,
-int ip_mc_join_group(struct sock *sk, struct ip_mreqn *imr)
+                              unsigned int mode)
 {
        __be32 addr = imr->imr_multiaddr.s_addr;
        struct ip_mc_socklist *iml, *i;
@@ -2172,15 +2183,30 @@ int ip_mc_join_group(struct sock *sk, struct ip_mreqn *imr)
        memcpy(&iml->multi, imr, sizeof(*imr));
        iml->next_rcu = inet->mc_list;
        iml->sflist = NULL;
-        iml->sfmode = MCAST_EXCLUDE;
+        iml->sfmode = mode;
        rcu_assign_pointer(inet->mc_list, iml);
-        ip_mc_inc_group(in_dev, addr);
+        __ip_mc_inc_group(in_dev, addr, mode);
        err = 0;
 done:
        return err;
 }
+/* Join ASM (Any-Source Multicast) group
+ */
+int ip_mc_join_group(struct sock *sk, struct ip_mreqn *imr)
+{
+        return __ip_mc_join_group(sk, imr, MCAST_EXCLUDE);
+}
 EXPORT_SYMBOL(ip_mc_join_group);
+/* Join SSM (Source-Specific Multicast) group
+ */
+int ip_mc_join_group_ssm(struct sock *sk, struct ip_mreqn *imr,
+                         unsigned int mode)
+{
+        return __ip_mc_join_group(sk, imr, mode);
+}
 static int ip_mc_leave_src(struct sock *sk, struct ip_mc_socklist *iml,
                           struct in_device *in_dev)
 {
diff --git a/net/ipv4/inet_fragment.c b/net/ipv4/inet_fragment.c
index c9e35b81d093..1e4cf3ab560f 100644
--- a/net/ipv4/inet_fragment.c
+++ b/net/ipv4/inet_fragment.c
@@ -90,7 +90,7 @@ static void inet_frags_free_cb(void *ptr, void *arg)
 void inet_frags_exit_net(struct netns_frags *nf)
 {
-        nf->low_thresh = 0; /* prevent creation of new frags */
+        nf->high_thresh = 0; /* prevent creation of new frags */
        rhashtable_free_and_destroy(&nf->rhashtable, inet_frags_free_cb, NULL);
 }
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index fc32fdbeefa6..64c76dcf7386 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -984,7 +984,7 @@ static int do_ip_setsockopt(struct sock *sk, int level,
                        mreq.imr_multiaddr.s_addr = mreqs.imr_multiaddr;
                        mreq.imr_address.s_addr = mreqs.imr_interface;
                        mreq.imr_ifindex = 0;
-                        err = ip_mc_join_group(sk, &mreq);
+                        err = ip_mc_join_group_ssm(sk, &mreq, MCAST_INCLUDE);
                        if (err && err != -EADDRINUSE)
                                break;
                        omode = MCAST_INCLUDE;
@@ -1061,7 +1061,7 @@ static int do_ip_setsockopt(struct sock *sk, int level,
                        mreq.imr_multiaddr = psin->sin_addr;
                        mreq.imr_address.s_addr = 0;
                        mreq.imr_ifindex = greqs.gsr_interface;
-                        err = ip_mc_join_group(sk, &mreq);
+                        err = ip_mc_join_group_ssm(sk, &mreq, MCAST_INCLUDE);
                        if (err && err != -EADDRINUSE)
                                break;
                        greqs.gsr_interface = mreq.imr_ifindex;
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index ca0dad90803a..e77872c93c20 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -1898,6 +1898,7 @@ static struct xt_match ipt_builtin_mt[] __read_mostly = {
                .checkentry = icmp_checkentry,
                .proto      = IPPROTO_ICMP,
                .family     = NFPROTO_IPV4,
+                .me         = THIS_MODULE,
        },
 };
diff --git a/net/ipv4/netfilter/nf_tproxy_ipv4.c b/net/ipv4/netfilter/nf_tproxy_ipv4.c
index 805e83ec3ad9..164714104965 100644
--- a/net/ipv4/netfilter/nf_tproxy_ipv4.c
+++ b/net/ipv4/netfilter/nf_tproxy_ipv4.c
@@ -37,7 +37,7 @@ nf_tproxy_handle_time_wait4(struct net *net, struct sk_buff *skb,
                 * to a listener socket if there's one */
                struct sock *sk2;
-                sk2 = nf_tproxy_get_sock_v4(net, skb, hp, iph->protocol,
+                sk2 = nf_tproxy_get_sock_v4(net, skb, iph->protocol,
                                            iph->saddr, laddr ? laddr : iph->daddr,
                                            hp->source, lport ? lport : hp->dest,
                                            skb->dev, NF_TPROXY_LOOKUP_LISTENER);
@@ -71,7 +71,7 @@ __be32 nf_tproxy_laddr4(struct sk_buff *skb, __be32 user_laddr, __be32 daddr)
 EXPORT_SYMBOL_GPL(nf_tproxy_laddr4);
 struct sock *
-nf_tproxy_get_sock_v4(struct net *net, struct sk_buff *skb, void *hp,
+nf_tproxy_get_sock_v4(struct net *net, struct sk_buff *skb,
                      const u8 protocol,
                      const __be32 saddr, const __be32 daddr,
                      const __be16 sport, const __be16 dport,
@@ -79,16 +79,21 @@ nf_tproxy_get_sock_v4(struct net *net, struct sk_buff *skb, void *hp,
                      const enum nf_tproxy_lookup_t lookup_type)
 {
        struct sock *sk;
-        struct tcphdr *tcph;
        switch (protocol) {
-        case IPPROTO_TCP:
+        case IPPROTO_TCP: {
+                struct tcphdr _hdr, *hp;
+                hp = skb_header_pointer(skb, ip_hdrlen(skb),
+                                        sizeof(struct tcphdr), &_hdr);
+                if (hp == NULL)
+                        return NULL;
                switch (lookup_type) {
                case NF_TPROXY_LOOKUP_LISTENER:
-                        tcph = hp;
                        sk = inet_lookup_listener(net, &tcp_hashinfo, skb,
                                                    ip_hdrlen(skb) +
-                                                      __tcp_hdrlen(tcph),
+                                                      __tcp_hdrlen(hp),
                                                    saddr, sport,
                                                    daddr, dport,
                                                    in->ifindex, 0);
@@ -110,6 +115,7 @@ nf_tproxy_get_sock_v4(struct net *net, struct sk_buff *skb, void *hp,
                        BUG();
                }
                break;
+                }
        case IPPROTO_UDP:
                sk = udp4_lib_lookup(net, saddr, sport, daddr, dport,
                                     in->ifindex);
diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
index af0a857d8352..5fa335fd3852 100644
--- a/net/ipv4/sysctl_net_ipv4.c
+++ b/net/ipv4/sysctl_net_ipv4.c
@@ -189,8 +189,9 @@ static int ipv4_ping_group_range(struct ctl_table *table, int write,
        if (write && ret == 0) {
                low = make_kgid(user_ns, urange[0]);
                high = make_kgid(user_ns, urange[1]);
-                if (!gid_valid(low) || !gid_valid(high) ||
+                if (!gid_valid(low) || !gid_valid(high))
-                    (urange[1] < urange[0]) || gid_lt(high, low)) {
+                        return -EINVAL;
+                if (urange[1] < urange[0] || gid_lt(high, low)) {
                        low = make_kgid(&init_user_ns, 1);
                        high = make_kgid(&init_user_ns, 0);
                }
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index e7b53d2a971f..4491faf83f4f 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -1998,7 +1998,7 @@ int tcp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, int nonblock,
                         * shouldn't happen.
                         */
                        if (WARN(before(*seq, TCP_SKB_CB(skb)->seq),
-                                 "recvmsg bug: copied %X seq %X rcvnxt %X fl %X\n",
+                                 "TCP recvmsg seq # bug: copied %X, seq %X, rcvnxt %X, fl %X\n",
                                 *seq, TCP_SKB_CB(skb)->seq, tp->rcv_nxt,
                                 flags))
                                break;
@@ -2013,7 +2013,7 @@ int tcp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, int nonblock,
                        if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN)
                                goto found_fin_ok;
                        WARN(!(flags & MSG_PEEK),
-                             "recvmsg bug 2: copied %X seq %X rcvnxt %X fl %X\n",
+                             "TCP recvmsg seq # bug 2: copied %X, seq %X, rcvnxt %X, fl %X\n",
                             *seq, TCP_SKB_CB(skb)->seq, tp->rcv_nxt, flags);
                }
@@ -2562,6 +2562,8 @@ int tcp_disconnect(struct sock *sk, int flags)
        tcp_clear_xmit_timers(sk);
        __skb_queue_purge(&sk->sk_receive_queue);
+        tp->copied_seq = tp->rcv_nxt;
+        tp->urg_data = 0;
        tcp_write_queue_purge(sk);
        tcp_fastopen_active_disable_ofo_check(sk);
        skb_rbtree_purge(&tp->out_of_order_queue);
@@ -2821,14 +2823,17 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
        case TCP_REPAIR:
                if (!tcp_can_repair_sock(sk))
                        err = -EPERM;
-                else if (val == 1) {
+                else if (val == TCP_REPAIR_ON) {
                        tp->repair = 1;
                        sk->sk_reuse = SK_FORCE_REUSE;
                        tp->repair_queue = TCP_NO_QUEUE;
-                } else if (val == 0) {
+                } else if (val == TCP_REPAIR_OFF) {
                        tp->repair = 0;
                        sk->sk_reuse = SK_NO_REUSE;
                        tcp_send_window_probe(sk);
+                } else if (val == TCP_REPAIR_OFF_NO_WP) {
+                        tp->repair = 0;
+                        sk->sk_reuse = SK_NO_REUSE;
                } else
                        err = -EINVAL;
@@ -3720,8 +3725,7 @@ int tcp_abort(struct sock *sk, int err)
                        struct request_sock *req = inet_reqsk(sk);
                        local_bh_disable();
-                        inet_csk_reqsk_queue_drop_and_put(req->rsk_listener,
+                        inet_csk_reqsk_queue_drop(req->rsk_listener, req);
-                                                          req);
                        local_bh_enable();
                        return 0;
                }
diff --git a/net/ipv4/tcp_dctcp.c b/net/ipv4/tcp_dctcp.c
index 5f5e5936760e..5869f89ca656 100644
--- a/net/ipv4/tcp_dctcp.c
+++ b/net/ipv4/tcp_dctcp.c
@@ -55,7 +55,6 @@ struct dctcp {
        u32 dctcp_alpha;
        u32 next_seq;
        u32 ce_state;
-        u32 delayed_ack_reserved;
        u32 loss_cwnd;
 };
@@ -96,7 +95,6 @@ static void dctcp_init(struct sock *sk)
                ca->dctcp_alpha = min(dctcp_alpha_on_init, DCTCP_MAX_ALPHA);
-                ca->delayed_ack_reserved = 0;
                ca->loss_cwnd = 0;
                ca->ce_state = 0;
@@ -134,7 +132,8 @@ static void dctcp_ce_state_0_to_1(struct sock *sk)
        /* State has changed from CE=0 to CE=1 and delayed
         * ACK has not sent yet.
         */
-        if (!ca->ce_state && ca->delayed_ack_reserved) {
+        if (!ca->ce_state &&
+            inet_csk(sk)->icsk_ack.pending & ICSK_ACK_TIMER) {
                u32 tmp_rcv_nxt;
                /* Save current rcv_nxt. */
@@ -164,7 +163,8 @@ static void dctcp_ce_state_1_to_0(struct sock *sk)
        /* State has changed from CE=1 to CE=0 and delayed
         * ACK has not sent yet.
         */
-        if (ca->ce_state && ca->delayed_ack_reserved) {
+        if (ca->ce_state &&
+            inet_csk(sk)->icsk_ack.pending & ICSK_ACK_TIMER) {
                u32 tmp_rcv_nxt;
                /* Save current rcv_nxt. */
@@ -248,25 +248,6 @@ static void dctcp_state(struct sock *sk, u8 new_state)
        }
 }
-static void dctcp_update_ack_reserved(struct sock *sk, enum tcp_ca_event ev)
-{
-        struct dctcp *ca = inet_csk_ca(sk);
-        switch (ev) {
-        case CA_EVENT_DELAYED_ACK:
-                if (!ca->delayed_ack_reserved)
-                        ca->delayed_ack_reserved = 1;
-                break;
-        case CA_EVENT_NON_DELAYED_ACK:
-                if (ca->delayed_ack_reserved)
-                        ca->delayed_ack_reserved = 0;
-                break;
-        default:
-                /* Don't care for the rest. */
-                break;
-        }
-}
 static void dctcp_cwnd_event(struct sock *sk, enum tcp_ca_event ev)
 {
        switch (ev) {
@@ -276,10 +257,6 @@ static void dctcp_cwnd_event(struct sock *sk, enum tcp_ca_event ev)
        case CA_EVENT_ECN_NO_CE:
                dctcp_ce_state_1_to_0(sk);
                break;
-        case CA_EVENT_DELAYED_ACK:
-        case CA_EVENT_NON_DELAYED_ACK:
-                dctcp_update_ack_reserved(sk, ev);
-                break;
        default:
                /* Don't care for the rest. */
                break;
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index bea17f1e8302..3b2711e33e4c 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -156,11 +156,24 @@ int tcp_twsk_unique(struct sock *sk, struct sock *sktw, void *twp)
         */
        if (tcptw->tw_ts_recent_stamp &&
            (!twp || (reuse && get_seconds() - tcptw->tw_ts_recent_stamp > 1))) {
-                tp->write_seq = tcptw->tw_snd_nxt + 65535 + 2;
+                /* In case of repair and re-using TIME-WAIT sockets we still
-                if (tp->write_seq == 0)
+                 * want to be sure that it is safe as above but honor the
-                        tp->write_seq = 1;
+                 * sequence numbers and time stamps set as part of the repair
-                tp->rx_opt.ts_recent       = tcptw->tw_ts_recent;
+                 * process.
-                tp->rx_opt.ts_recent_stamp = tcptw->tw_ts_recent_stamp;
+                 *
+                 * Without this check re-using a TIME-WAIT socket with TCP
+                 * repair would accumulate a -1 on the repair assigned
+                 * sequence number. The first time it is reused the sequence
+                 * is -1, the second time -2, etc. This fixes that issue
+                 * without appearing to create any others.
+                 */
+                if (likely(!tp->repair)) {
+                        tp->write_seq = tcptw->tw_snd_nxt + 65535 + 2;
+                        if (tp->write_seq == 0)
+                                tp->write_seq = 1;
+                        tp->rx_opt.ts_recent       = tcptw->tw_ts_recent;
+                        tp->rx_opt.ts_recent_stamp = tcptw->tw_ts_recent_stamp;
+                }
                sock_hold(sktw);
                return 1;
        }
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 8e08b409c71e..00e5a300ddb9 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -3523,8 +3523,6 @@ void tcp_send_delayed_ack(struct sock *sk)
        int ato = icsk->icsk_ack.ato;
        unsigned long timeout;
-        tcp_ca_event(sk, CA_EVENT_DELAYED_ACK);
        if (ato > TCP_DELACK_MIN) {
                const struct tcp_sock *tp = tcp_sk(sk);
                int max_ato = HZ / 2;
@@ -3581,8 +3579,6 @@ void tcp_send_ack(struct sock *sk)
        if (sk->sk_state == TCP_CLOSE)
                return;
-        tcp_ca_event(sk, CA_EVENT_NON_DELAYED_ACK);
        /* We are not putting this on the write queue, so
         * tcp_transmit_skb() will set the ownership to this
         * sock.
diff --git a/net/ipv6/Kconfig b/net/ipv6/Kconfig
index 0eff75525da1..b3885ca22d6f 100644
--- a/net/ipv6/Kconfig
+++ b/net/ipv6/Kconfig
@@ -108,6 +108,7 @@ config IPV6_MIP6
 config IPV6_ILA
        tristate "IPv6: Identifier Locator Addressing (ILA)"
        depends on NETFILTER
+        select DST_CACHE
        select LWTUNNEL
        ---help---
          Support for IPv6 Identifier Locator Addressing (ILA).
diff --git a/net/ipv6/calipso.c b/net/ipv6/calipso.c
index 1323b9679cf7..1c0bb9fb76e6 100644
--- a/net/ipv6/calipso.c
+++ b/net/ipv6/calipso.c
@@ -799,8 +799,7 @@ static int calipso_opt_update(struct sock *sk, struct ipv6_opt_hdr *hop)
 {
        struct ipv6_txoptions *old = txopt_get(inet6_sk(sk)), *txopts;
-        txopts = ipv6_renew_options_kern(sk, old, IPV6_HOPOPTS,
+        txopts = ipv6_renew_options(sk, old, IPV6_HOPOPTS, hop);
-                                         hop, hop ? ipv6_optlen(hop) : 0);
        txopt_put(old);
        if (IS_ERR(txopts))
                return PTR_ERR(txopts);
@@ -1222,8 +1221,7 @@ static int calipso_req_setattr(struct request_sock *req,
        if (IS_ERR(new))
                return PTR_ERR(new);
-        txopts = ipv6_renew_options_kern(sk, req_inet->ipv6_opt, IPV6_HOPOPTS,
+        txopts = ipv6_renew_options(sk, req_inet->ipv6_opt, IPV6_HOPOPTS, new);
-                                         new, new ? ipv6_optlen(new) : 0);
        kfree(new);
@@ -1260,8 +1258,7 @@ static void calipso_req_delattr(struct request_sock *req)
        if (calipso_opt_del(req_inet->ipv6_opt->hopopt, &new))
                return; /* Nothing to do */
-        txopts = ipv6_renew_options_kern(sk, req_inet->ipv6_opt, IPV6_HOPOPTS,
+        txopts = ipv6_renew_options(sk, req_inet->ipv6_opt, IPV6_HOPOPTS, new);
-                                         new, new ? ipv6_optlen(new) : 0);
        if (!IS_ERR(txopts)) {
                txopts = xchg(&req_inet->ipv6_opt, txopts);
diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c
index 5bc2bf3733ab..20291c2036fc 100644
--- a/net/ipv6/exthdrs.c
+++ b/net/ipv6/exthdrs.c
@@ -1015,29 +1015,21 @@ ipv6_dup_options(struct sock *sk, struct ipv6_txoptions *opt)
 }
 EXPORT_SYMBOL_GPL(ipv6_dup_options);
-static int ipv6_renew_option(void *ohdr,
+static void ipv6_renew_option(int renewtype,
-                             struct ipv6_opt_hdr __user *newopt, int newoptlen,
+                              struct ipv6_opt_hdr **dest,
-                             int inherit,
+                              struct ipv6_opt_hdr *old,
-                             struct ipv6_opt_hdr **hdr,
+                              struct ipv6_opt_hdr *new,
-                             char **p)
+                              int newtype, char **p)
 {
-        if (inherit) {
+        struct ipv6_opt_hdr *src;
-                if (ohdr) {
-                        memcpy(*p, ohdr, ipv6_optlen((struct ipv6_opt_hdr *)ohdr));
+        src = (renewtype == newtype ? new : old);
-                        *hdr = (struct ipv6_opt_hdr *)*p;
+        if (!src)
-                        *p += CMSG_ALIGN(ipv6_optlen(*hdr));
+                return;
-                }
-        } else {
+        memcpy(*p, src, ipv6_optlen(src));
-                if (newopt) {
+        *dest = (struct ipv6_opt_hdr *)*p;
-                        if (copy_from_user(*p, newopt, newoptlen))
+        *p += CMSG_ALIGN(ipv6_optlen(*dest));
-                                return -EFAULT;
-                        *hdr = (struct ipv6_opt_hdr *)*p;
-                        if (ipv6_optlen(*hdr) > newoptlen)
-                                return -EINVAL;
-                        *p += CMSG_ALIGN(newoptlen);
-                }
-        }
-        return 0;
 }
 /**
@@ -1063,13 +1055,11 @@ static int ipv6_renew_option(void *ohdr,
 */
 struct ipv6_txoptions *
 ipv6_renew_options(struct sock *sk, struct ipv6_txoptions *opt,
-                   int newtype,
+                   int newtype, struct ipv6_opt_hdr *newopt)
-                   struct ipv6_opt_hdr __user *newopt, int newoptlen)
 {
        int tot_len = 0;
        char *p;
        struct ipv6_txoptions *opt2;
-        int err;
        if (opt) {
                if (newtype != IPV6_HOPOPTS && opt->hopopt)
@@ -1082,8 +1072,8 @@ ipv6_renew_options(struct sock *sk, struct ipv6_txoptions *opt,
                        tot_len += CMSG_ALIGN(ipv6_optlen(opt->dst1opt));
        }
-        if (newopt && newoptlen)
+        if (newopt)
-                tot_len += CMSG_ALIGN(newoptlen);
+                tot_len += CMSG_ALIGN(ipv6_optlen(newopt));
        if (!tot_len)
                return NULL;
@@ -1098,29 +1088,19 @@ ipv6_renew_options(struct sock *sk, struct ipv6_txoptions *opt,
        opt2->tot_len = tot_len;
        p = (char *)(opt2 + 1);
-        err = ipv6_renew_option(opt ? opt->hopopt : NULL, newopt, newoptlen,
+        ipv6_renew_option(IPV6_HOPOPTS, &opt2->hopopt,
-                                newtype != IPV6_HOPOPTS,
+                          (opt ? opt->hopopt : NULL),
-                                &opt2->hopopt, &p);
+                          newopt, newtype, &p);
-        if (err)
+        ipv6_renew_option(IPV6_RTHDRDSTOPTS, &opt2->dst0opt,
-                goto out;
+                          (opt ? opt->dst0opt : NULL),
+                          newopt, newtype, &p);
-        err = ipv6_renew_option(opt ? opt->dst0opt : NULL, newopt, newoptlen,
+        ipv6_renew_option(IPV6_RTHDR,
-                                newtype != IPV6_RTHDRDSTOPTS,
+                          (struct ipv6_opt_hdr **)&opt2->srcrt,
-                                &opt2->dst0opt, &p);
+                          (opt ? (struct ipv6_opt_hdr *)opt->srcrt : NULL),
-        if (err)
+                          newopt, newtype, &p);
-                goto out;
+        ipv6_renew_option(IPV6_DSTOPTS, &opt2->dst1opt,
+                          (opt ? opt->dst1opt : NULL),
-        err = ipv6_renew_option(opt ? opt->srcrt : NULL, newopt, newoptlen,
+                          newopt, newtype, &p);
-                                newtype != IPV6_RTHDR,
-                                (struct ipv6_opt_hdr **)&opt2->srcrt, &p);
-        if (err)
-                goto out;
-        err = ipv6_renew_option(opt ? opt->dst1opt : NULL, newopt, newoptlen,
-                                newtype != IPV6_DSTOPTS,
-                                &opt2->dst1opt, &p);
-        if (err)
-                goto out;
        opt2->opt_nflen = (opt2->hopopt ? ipv6_optlen(opt2->hopopt) : 0) +
                          (opt2->dst0opt ? ipv6_optlen(opt2->dst0opt) : 0) +
@@ -1128,37 +1108,6 @@ ipv6_renew_options(struct sock *sk, struct ipv6_txoptions *opt,
        opt2->opt_flen = (opt2->dst1opt ? ipv6_optlen(opt2->dst1opt) : 0);
        return opt2;
-out:
-        sock_kfree_s(sk, opt2, opt2->tot_len);
-        return ERR_PTR(err);
-}
-/**
- * ipv6_renew_options_kern - replace a specific ext hdr with a new one.
- *
- * @sk: sock from which to allocate memory
- * @opt: original options
- * @newtype: option type to replace in @opt
- * @newopt: new option of type @newtype to replace (kernel-mem)
- * @newoptlen: length of @newopt
- *
- * See ipv6_renew_options().  The difference is that @newopt is
- * kernel memory, rather than user memory.
- */
-struct ipv6_txoptions *
-ipv6_renew_options_kern(struct sock *sk, struct ipv6_txoptions *opt,
-                        int newtype, struct ipv6_opt_hdr *newopt,
-                        int newoptlen)
-{
-        struct ipv6_txoptions *ret_val;
-        const mm_segment_t old_fs = get_fs();
-        set_fs(KERNEL_DS);
-        ret_val = ipv6_renew_options(sk, opt, newtype,
-                                     (struct ipv6_opt_hdr __user *)newopt,
-                                     newoptlen);
-        set_fs(old_fs);
-        return ret_val;
 }
 struct ipv6_txoptions *ipv6_fixup_options(struct ipv6_txoptions *opt_space,
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index 1fb2f3118d60..d212738e9d10 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -935,20 +935,19 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct fib6_info *rt,
 {
        struct fib6_info *leaf = rcu_dereference_protected(fn->leaf,
                                    lockdep_is_held(&rt->fib6_table->tb6_lock));
-        enum fib_event_type event = FIB_EVENT_ENTRY_ADD;
+        struct fib6_info *iter = NULL;
-        struct fib6_info *iter = NULL, *match = NULL;
        struct fib6_info __rcu **ins;
+        struct fib6_info __rcu **fallback_ins = NULL;
        int replace = (info->nlh &&
                       (info->nlh->nlmsg_flags & NLM_F_REPLACE));
-        int append = (info->nlh &&
-                       (info->nlh->nlmsg_flags & NLM_F_APPEND));
        int add = (!info->nlh ||
                   (info->nlh->nlmsg_flags & NLM_F_CREATE));
        int found = 0;
+        bool rt_can_ecmp = rt6_qualify_for_ecmp(rt);
        u16 nlflags = NLM_F_EXCL;
        int err;
-        if (append)
+        if (info->nlh && (info->nlh->nlmsg_flags & NLM_F_APPEND))
                nlflags |= NLM_F_APPEND;
        ins = &fn->leaf;
@@ -970,8 +969,13 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct fib6_info *rt,
                        nlflags &= ~NLM_F_EXCL;
                        if (replace) {
-                                found++;
+                                if (rt_can_ecmp == rt6_qualify_for_ecmp(iter)) {
-                                break;
+                                        found++;
+                                        break;
+                                }
+                                if (rt_can_ecmp)
+                                        fallback_ins = fallback_ins ?: ins;
+                                goto next_iter;
                        }
                        if (rt6_duplicate_nexthop(iter, rt)) {
@@ -986,51 +990,71 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct fib6_info *rt,
                                fib6_metric_set(iter, RTAX_MTU, rt->fib6_pmtu);
                                return -EEXIST;
                        }
+                        /* If we have the same destination and the same metric,
-                        /* first route that matches */
+                         * but not the same gateway, then the route we try to
-                        if (!match)
+                         * add is sibling to this route, increment our counter
-                                match = iter;
+                         * of siblings, and later we will add our route to the
+                         * list.
+                         * Only static routes (which don't have flag
+                         * RTF_EXPIRES) are used for ECMPv6.
+                         *
+                         * To avoid long list, we only had siblings if the
+                         * route have a gateway.
+                         */
+                        if (rt_can_ecmp &&
+                            rt6_qualify_for_ecmp(iter))
+                                rt->fib6_nsiblings++;
                }
                if (iter->fib6_metric > rt->fib6_metric)
                        break;
+next_iter:
                ins = &iter->fib6_next;
        }
+        if (fallback_ins && !found) {
+                /* No ECMP-able route found, replace first non-ECMP one */
+                ins = fallback_ins;
+                iter = rcu_dereference_protected(*ins,
+                                    lockdep_is_held(&rt->fib6_table->tb6_lock));
+                found++;
+        }
        /* Reset round-robin state, if necessary */
        if (ins == &fn->leaf)
                fn->rr_ptr = NULL;
        /* Link this route to others same route. */
-        if (append && match) {
+        if (rt->fib6_nsiblings) {
+                unsigned int fib6_nsiblings;
                struct fib6_info *sibling, *temp_sibling;
-                if (rt->fib6_flags & RTF_REJECT) {
+                /* Find the first route that have the same metric */
-                        NL_SET_ERR_MSG(extack,
+                sibling = leaf;
-                                       "Can not append a REJECT route");
+                while (sibling) {
-                        return -EINVAL;
+                        if (sibling->fib6_metric == rt->fib6_metric &&
-                } else if (match->fib6_flags & RTF_REJECT) {
+                            rt6_qualify_for_ecmp(sibling)) {
-                        NL_SET_ERR_MSG(extack,
+                                list_add_tail(&rt->fib6_siblings,
-                                       "Can not append to a REJECT route");
+                                              &sibling->fib6_siblings);
-                        return -EINVAL;
+                                break;
+                        }
+                        sibling = rcu_dereference_protected(sibling->fib6_next,
+                                    lockdep_is_held(&rt->fib6_table->tb6_lock));
                }
-                event = FIB_EVENT_ENTRY_APPEND;
-                rt->fib6_nsiblings = match->fib6_nsiblings;
-                list_add_tail(&rt->fib6_siblings, &match->fib6_siblings);
-                match->fib6_nsiblings++;
                /* For each sibling in the list, increment the counter of
                 * siblings. BUG() if counters does not match, list of siblings
                 * is broken!
                 */
+                fib6_nsiblings = 0;
                list_for_each_entry_safe(sibling, temp_sibling,
-                                         &match->fib6_siblings, fib6_siblings) {
+                                         &rt->fib6_siblings, fib6_siblings) {
                        sibling->fib6_nsiblings++;
-                        BUG_ON(sibling->fib6_nsiblings != match->fib6_nsiblings);
+                        BUG_ON(sibling->fib6_nsiblings != rt->fib6_nsiblings);
+                        fib6_nsiblings++;
                }
+                BUG_ON(fib6_nsiblings != rt->fib6_nsiblings);
-                rt6_multipath_rebalance(match);
+                rt6_multipath_rebalance(temp_sibling);
        }
        /*
@@ -1043,8 +1067,9 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct fib6_info *rt,
 add:
                nlflags |= NLM_F_CREATE;
-                err = call_fib6_entry_notifiers(info->nl_net, event, rt,
+                err = call_fib6_entry_notifiers(info->nl_net,
-                                                extack);
+                                                FIB_EVENT_ENTRY_ADD,
+                                                rt, extack);
                if (err)
                        return err;
@@ -1062,7 +1087,7 @@ add:
                }
        } else {
-                struct fib6_info *tmp;
+                int nsiblings;
                if (!found) {
                        if (add)
@@ -1077,57 +1102,48 @@ add:
                if (err)
                        return err;
-                /* if route being replaced has siblings, set tmp to
-                 * last one, otherwise tmp is current route. this is
-                 * used to set fib6_next for new route
-                 */
-                if (iter->fib6_nsiblings)
-                        tmp = list_last_entry(&iter->fib6_siblings,
-                                              struct fib6_info,
-                                              fib6_siblings);
-                else
-                        tmp = iter;
-                /* insert new route */
                atomic_inc(&rt->fib6_ref);
                rcu_assign_pointer(rt->fib6_node, fn);
-                rt->fib6_next = tmp->fib6_next;
+                rt->fib6_next = iter->fib6_next;
                rcu_assign_pointer(*ins, rt);
                if (!info->skip_notify)
                        inet6_rt_notify(RTM_NEWROUTE, rt, info, NLM_F_REPLACE);
                if (!(fn->fn_flags & RTN_RTINFO)) {
                        info->nl_net->ipv6.rt6_stats->fib_route_nodes++;
                        fn->fn_flags |= RTN_RTINFO;
                }
+                nsiblings = iter->fib6_nsiblings;
+                iter->fib6_node = NULL;
+                fib6_purge_rt(iter, fn, info->nl_net);
+                if (rcu_access_pointer(fn->rr_ptr) == iter)
+                        fn->rr_ptr = NULL;
+                fib6_info_release(iter);
-                /* delete old route */
+                if (nsiblings) {
-                rt = iter;
-                if (rt->fib6_nsiblings) {
-                        struct fib6_info *tmp;
                        /* Replacing an ECMP route, remove all siblings */
-                        list_for_each_entry_safe(iter, tmp, &rt->fib6_siblings,
+                        ins = &rt->fib6_next;
-                                                 fib6_siblings) {
+                        iter = rcu_dereference_protected(*ins,
-                                iter->fib6_node = NULL;
+                                    lockdep_is_held(&rt->fib6_table->tb6_lock));
-                                fib6_purge_rt(iter, fn, info->nl_net);
+                        while (iter) {
-                                if (rcu_access_pointer(fn->rr_ptr) == iter)
+                                if (iter->fib6_metric > rt->fib6_metric)
-                                        fn->rr_ptr = NULL;
+                                        break;
-                                fib6_info_release(iter);
+                                if (rt6_qualify_for_ecmp(iter)) {
+                                        *ins = iter->fib6_next;
-                                rt->fib6_nsiblings--;
+                                        iter->fib6_node = NULL;
-                                info->nl_net->ipv6.rt6_stats->fib_rt_entries--;
+                                        fib6_purge_rt(iter, fn, info->nl_net);
+                                        if (rcu_access_pointer(fn->rr_ptr) == iter)
+                                                fn->rr_ptr = NULL;
+                                        fib6_info_release(iter);
+                                        nsiblings--;
+                                        info->nl_net->ipv6.rt6_stats->fib_rt_entries--;
+                                } else {
+                                        ins = &iter->fib6_next;
+                                }
+                                iter = rcu_dereference_protected(*ins,
+                                        lockdep_is_held(&rt->fib6_table->tb6_lock));
                        }
+                        WARN_ON(nsiblings != 0);
                }
-                WARN_ON(rt->fib6_nsiblings != 0);
-                rt->fib6_node = NULL;
-                fib6_purge_rt(rt, fn, info->nl_net);
-                if (rcu_access_pointer(fn->rr_ptr) == rt)
-                        fn->rr_ptr = NULL;
-                fib6_info_release(rt);
        }
        return 0;
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index c8cf2fdbb13b..cd2cfb04e5d8 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -927,7 +927,6 @@ tx_err:
 static netdev_tx_t ip6erspan_tunnel_xmit(struct sk_buff *skb,
                                         struct net_device *dev)
 {
-        struct ipv6hdr *ipv6h = ipv6_hdr(skb);
        struct ip6_tnl *t = netdev_priv(dev);
        struct dst_entry *dst = skb_dst(skb);
        struct net_device_stats *stats;
@@ -1010,6 +1009,8 @@ static netdev_tx_t ip6erspan_tunnel_xmit(struct sk_buff *skb,
                        goto tx_err;
                }
        } else {
+                struct ipv6hdr *ipv6h = ipv6_hdr(skb);
                switch (skb->protocol) {
                case htons(ETH_P_IP):
                        memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index 4d780c7f0130..568ca4187cd1 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -398,6 +398,12 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
        case IPV6_DSTOPTS:
        {
                struct ipv6_txoptions *opt;
+                struct ipv6_opt_hdr *new = NULL;
+                /* hop-by-hop / destination options are privileged option */
+                retv = -EPERM;
+                if (optname != IPV6_RTHDR && !ns_capable(net->user_ns, CAP_NET_RAW))
+                        break;
                /* remove any sticky options header with a zero option
                 * length, per RFC3542.
@@ -409,17 +415,22 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
                else if (optlen < sizeof(struct ipv6_opt_hdr) ||
                         optlen & 0x7 || optlen > 8 * 255)
                        goto e_inval;
+                else {
-                /* hop-by-hop / destination options are privileged option */
+                        new = memdup_user(optval, optlen);
-                retv = -EPERM;
+                        if (IS_ERR(new)) {
-                if (optname != IPV6_RTHDR && !ns_capable(net->user_ns, CAP_NET_RAW))
+                                retv = PTR_ERR(new);
-                        break;
+                                break;
+                        }
+                        if (unlikely(ipv6_optlen(new) > optlen)) {
+                                kfree(new);
+                                goto e_inval;
+                        }
+                }
                opt = rcu_dereference_protected(np->opt,
                                                lockdep_sock_is_held(sk));
-                opt = ipv6_renew_options(sk, opt, optname,
+                opt = ipv6_renew_options(sk, opt, optname, new);
-                                         (struct ipv6_opt_hdr __user *)optval,
+                kfree(new);
-                                         optlen);
                if (IS_ERR(opt)) {
                        retv = PTR_ERR(opt);
                        break;
@@ -718,8 +729,9 @@ done:
                        struct sockaddr_in6 *psin6;
                        psin6 = (struct sockaddr_in6 *)&greqs.gsr_group;
-                        retv = ipv6_sock_mc_join(sk, greqs.gsr_interface,
+                        retv = ipv6_sock_mc_join_ssm(sk, greqs.gsr_interface,
-                                                 &psin6->sin6_addr);
+                                                     &psin6->sin6_addr,
+                                                     MCAST_INCLUDE);
                        /* prior join w/ different source is ok */
                        if (retv && retv != -EADDRINUSE)
                                break;
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index c0c74088f2af..2699be7202be 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -95,6 +95,8 @@ static int ip6_mc_add_src(struct inet6_dev *idev, const struct in6_addr *pmca,
                          int delta);
 static int ip6_mc_leave_src(struct sock *sk, struct ipv6_mc_socklist *iml,
                            struct inet6_dev *idev);
+static int __ipv6_dev_mc_inc(struct net_device *dev,
+                             const struct in6_addr *addr, unsigned int mode);
 #define MLD_QRV_DEFAULT         2
 /* RFC3810, 9.2. Query Interval */
@@ -132,7 +134,8 @@ static int unsolicited_report_interval(struct inet6_dev *idev)
        return iv > 0 ? iv : 1;
 }
-int ipv6_sock_mc_join(struct sock *sk, int ifindex, const struct in6_addr *addr)
+static int __ipv6_sock_mc_join(struct sock *sk, int ifindex,
+                               const struct in6_addr *addr, unsigned int mode)
 {
        struct net_device *dev = NULL;
        struct ipv6_mc_socklist *mc_lst;
@@ -179,7 +182,7 @@ int ipv6_sock_mc_join(struct sock *sk, int ifindex, const struct in6_addr *addr)
        }
        mc_lst->ifindex = dev->ifindex;
-        mc_lst->sfmode = MCAST_EXCLUDE;
+        mc_lst->sfmode = mode;
        rwlock_init(&mc_lst->sflock);
        mc_lst->sflist = NULL;
@@ -187,7 +190,7 @@ int ipv6_sock_mc_join(struct sock *sk, int ifindex, const struct in6_addr *addr)
         *      now add/increase the group membership on the device
         */
-        err = ipv6_dev_mc_inc(dev, addr);
+        err = __ipv6_dev_mc_inc(dev, addr, mode);
        if (err) {
                sock_kfree_s(sk, mc_lst, sizeof(*mc_lst));
@@ -199,8 +202,19 @@ int ipv6_sock_mc_join(struct sock *sk, int ifindex, const struct in6_addr *addr)
        return 0;
 }
+int ipv6_sock_mc_join(struct sock *sk, int ifindex, const struct in6_addr *addr)
+{
+        return __ipv6_sock_mc_join(sk, ifindex, addr, MCAST_EXCLUDE);
+}
 EXPORT_SYMBOL(ipv6_sock_mc_join);
+int ipv6_sock_mc_join_ssm(struct sock *sk, int ifindex,
+                          const struct in6_addr *addr, unsigned int mode)
+{
+        return __ipv6_sock_mc_join(sk, ifindex, addr, mode);
+}
 /*
 *      socket leave on multicast group
 */
@@ -646,7 +660,7 @@ bool inet6_mc_check(struct sock *sk, const struct in6_addr *mc_addr,
        return rv;
 }
-static void igmp6_group_added(struct ifmcaddr6 *mc)
+static void igmp6_group_added(struct ifmcaddr6 *mc, unsigned int mode)
 {
        struct net_device *dev = mc->idev->dev;
        char buf[MAX_ADDR_LEN];
@@ -672,7 +686,13 @@ static void igmp6_group_added(struct ifmcaddr6 *mc)
        }
        /* else v2 */
-        mc->mca_crcount = mc->idev->mc_qrv;
+        /* Based on RFC3810 6.1, for newly added INCLUDE SSM, we
+         * should not send filter-mode change record as the mode
+         * should be from IN() to IN(A).
+         */
+        if (mode == MCAST_EXCLUDE)
+                mc->mca_crcount = mc->idev->mc_qrv;
        mld_ifc_event(mc->idev);
 }
@@ -770,13 +790,14 @@ static void mld_del_delrec(struct inet6_dev *idev, struct ifmcaddr6 *im)
        spin_lock_bh(&im->mca_lock);
        if (pmc) {
                im->idev = pmc->idev;
-                im->mca_crcount = idev->mc_qrv;
                im->mca_sfmode = pmc->mca_sfmode;
                if (pmc->mca_sfmode == MCAST_INCLUDE) {
                        im->mca_tomb = pmc->mca_tomb;
                        im->mca_sources = pmc->mca_sources;
                        for (psf = im->mca_sources; psf; psf = psf->sf_next)
-                                psf->sf_crcount = im->mca_crcount;
+                                psf->sf_crcount = idev->mc_qrv;
+                } else {
+                        im->mca_crcount = idev->mc_qrv;
                }
                in6_dev_put(pmc->idev);
                kfree(pmc);
@@ -831,7 +852,8 @@ static void ma_put(struct ifmcaddr6 *mc)
 }
 static struct ifmcaddr6 *mca_alloc(struct inet6_dev *idev,
-                                   const struct in6_addr *addr)
+                                   const struct in6_addr *addr,
+                                   unsigned int mode)
 {
        struct ifmcaddr6 *mc;
@@ -849,9 +871,8 @@ static struct ifmcaddr6 *mca_alloc(struct inet6_dev *idev,
        refcount_set(&mc->mca_refcnt, 1);
        spin_lock_init(&mc->mca_lock);
-        /* initial mode is (EX, empty) */
+        mc->mca_sfmode = mode;
-        mc->mca_sfmode = MCAST_EXCLUDE;
+        mc->mca_sfcount[mode] = 1;
-        mc->mca_sfcount[MCAST_EXCLUDE] = 1;
        if (ipv6_addr_is_ll_all_nodes(&mc->mca_addr) ||
            IPV6_ADDR_MC_SCOPE(&mc->mca_addr) < IPV6_ADDR_SCOPE_LINKLOCAL)
@@ -863,7 +884,8 @@ static struct ifmcaddr6 *mca_alloc(struct inet6_dev *idev,
 /*
 *      device multicast group inc (add if not found)
 */
-int ipv6_dev_mc_inc(struct net_device *dev, const struct in6_addr *addr)
+static int __ipv6_dev_mc_inc(struct net_device *dev,
+                             const struct in6_addr *addr, unsigned int mode)
 {
        struct ifmcaddr6 *mc;
        struct inet6_dev *idev;
@@ -887,14 +909,13 @@ int ipv6_dev_mc_inc(struct net_device *dev, const struct in6_addr *addr)
                if (ipv6_addr_equal(&mc->mca_addr, addr)) {
                        mc->mca_users++;
                        write_unlock_bh(&idev->lock);
-                        ip6_mc_add_src(idev, &mc->mca_addr, MCAST_EXCLUDE, 0,
+                        ip6_mc_add_src(idev, &mc->mca_addr, mode, 0, NULL, 0);
-                                NULL, 0);
                        in6_dev_put(idev);
                        return 0;
                }
        }
-        mc = mca_alloc(idev, addr);
+        mc = mca_alloc(idev, addr, mode);
        if (!mc) {
                write_unlock_bh(&idev->lock);
                in6_dev_put(idev);
@@ -911,11 +932,16 @@ int ipv6_dev_mc_inc(struct net_device *dev, const struct in6_addr *addr)
        write_unlock_bh(&idev->lock);
        mld_del_delrec(idev, mc);
-        igmp6_group_added(mc);
+        igmp6_group_added(mc, mode);
        ma_put(mc);
        return 0;
 }
+int ipv6_dev_mc_inc(struct net_device *dev, const struct in6_addr *addr)
+{
+        return __ipv6_dev_mc_inc(dev, addr, MCAST_EXCLUDE);
+}
 /*
 *      device multicast group del
 */
@@ -1751,7 +1777,7 @@ static struct sk_buff *add_grec(struct sk_buff *skb, struct ifmcaddr6 *pmc,
                psf_next = psf->sf_next;
-                if (!is_in(pmc, psf, type, gdeleted, sdeleted)) {
+                if (!is_in(pmc, psf, type, gdeleted, sdeleted) && !crsend) {
                        psf_prev = psf;
                        continue;
                }
@@ -2066,7 +2092,7 @@ static void mld_send_initial_cr(struct inet6_dev *idev)
                if (pmc->mca_sfcount[MCAST_EXCLUDE])
                        type = MLD2_CHANGE_TO_EXCLUDE;
                else
-                        type = MLD2_CHANGE_TO_INCLUDE;
+                        type = MLD2_ALLOW_NEW_SOURCES;
                skb = add_grec(skb, pmc, type, 0, 0, 1);
                spin_unlock_bh(&pmc->mca_lock);
        }
@@ -2546,7 +2572,7 @@ void ipv6_mc_up(struct inet6_dev *idev)
        ipv6_mc_reset(idev);
        for (i = idev->mc_list; i; i = i->next) {
                mld_del_delrec(idev, i);
-                igmp6_group_added(i);
+                igmp6_group_added(i, i->mca_sfmode);
        }
        read_unlock_bh(&idev->lock);
 }
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index e640d2f3c55c..0ec273997d1d 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -811,7 +811,7 @@ static void ndisc_recv_ns(struct sk_buff *skb)
                        return;
                }
        }
-        if (ndopts.nd_opts_nonce)
+        if (ndopts.nd_opts_nonce && ndopts.nd_opts_nonce->nd_opt_len == 1)
                memcpy(&nonce, (u8 *)(ndopts.nd_opts_nonce + 1), 6);
        inc = ipv6_addr_is_multicast(daddr);
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 7eab959734bc..daf2e9e9193d 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -1909,6 +1909,7 @@ static struct xt_match ip6t_builtin_mt[] __read_mostly = {
                .checkentry = icmp6_checkentry,
                .proto      = IPPROTO_ICMPV6,
                .family     = NFPROTO_IPV6,
+                .me         = THIS_MODULE,
        },
 };
diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
index a452d99c9f52..e4d9e6976d3c 100644
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -585,6 +585,8 @@ int nf_ct_frag6_gather(struct net *net, struct sk_buff *skb, u32 user)
            fq->q.meat == fq->q.len &&
            nf_ct_frag6_reasm(fq, skb, dev))
                ret = 0;
+        else
+                skb_dst_drop(skb);
 out_unlock:
        spin_unlock_bh(&fq->q.lock);
diff --git a/net/ipv6/netfilter/nf_tproxy_ipv6.c b/net/ipv6/netfilter/nf_tproxy_ipv6.c
index bf1d6c421e3b..5dfd33af6451 100644
--- a/net/ipv6/netfilter/nf_tproxy_ipv6.c
+++ b/net/ipv6/netfilter/nf_tproxy_ipv6.c
@@ -55,7 +55,7 @@ nf_tproxy_handle_time_wait6(struct sk_buff *skb, int tproto, int thoff,
                 * to a listener socket if there's one */
                struct sock *sk2;
-                sk2 = nf_tproxy_get_sock_v6(net, skb, thoff, hp, tproto,
+                sk2 = nf_tproxy_get_sock_v6(net, skb, thoff, tproto,
                                            &iph->saddr,
                                            nf_tproxy_laddr6(skb, laddr, &iph->daddr),
                                            hp->source,
@@ -72,7 +72,7 @@ nf_tproxy_handle_time_wait6(struct sk_buff *skb, int tproto, int thoff,
 EXPORT_SYMBOL_GPL(nf_tproxy_handle_time_wait6);
 struct sock *
-nf_tproxy_get_sock_v6(struct net *net, struct sk_buff *skb, int thoff, void *hp,
+nf_tproxy_get_sock_v6(struct net *net, struct sk_buff *skb, int thoff,
                      const u8 protocol,
                      const struct in6_addr *saddr, const struct in6_addr *daddr,
                      const __be16 sport, const __be16 dport,
@@ -80,15 +80,20 @@ nf_tproxy_get_sock_v6(struct net *net, struct sk_buff *skb, int thoff, void *hp,
                      const enum nf_tproxy_lookup_t lookup_type)
 {
        struct sock *sk;
-        struct tcphdr *tcph;
        switch (protocol) {
-        case IPPROTO_TCP:
+        case IPPROTO_TCP: {
+                struct tcphdr _hdr, *hp;
+                hp = skb_header_pointer(skb, thoff,
+                                        sizeof(struct tcphdr), &_hdr);
+                if (hp == NULL)
+                        return NULL;
                switch (lookup_type) {
                case NF_TPROXY_LOOKUP_LISTENER:
-                        tcph = hp;
                        sk = inet6_lookup_listener(net, &tcp_hashinfo, skb,
-                                                   thoff + __tcp_hdrlen(tcph),
+                                                   thoff + __tcp_hdrlen(hp),
                                                   saddr, sport,
                                                   daddr, ntohs(dport),
                                                   in->ifindex, 0);
@@ -110,6 +115,7 @@ nf_tproxy_get_sock_v6(struct net *net, struct sk_buff *skb, int thoff, void *hp,
                        BUG();
                }
                break;
+                }
        case IPPROTO_UDP:
                sk = udp6_lib_lookup(net, saddr, sport, daddr, dport,
                                     in->ifindex);
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 86a0e4333d42..2ce0bd17de4f 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -3842,7 +3842,7 @@ static struct fib6_info *rt6_multipath_first_sibling(const struct fib6_info *rt)
                        lockdep_is_held(&rt->fib6_table->tb6_lock));
        while (iter) {
                if (iter->fib6_metric == rt->fib6_metric &&
-                    iter->fib6_nsiblings)
+                    rt6_qualify_for_ecmp(iter))
                        return iter;
                iter = rcu_dereference_protected(iter->fib6_next,
                                lockdep_is_held(&rt->fib6_table->tb6_lock));
@@ -4388,6 +4388,13 @@ static int ip6_route_multipath_add(struct fib6_config *cfg,
                        rt = NULL;
                        goto cleanup;
                }
+                if (!rt6_qualify_for_ecmp(rt)) {
+                        err = -EINVAL;
+                        NL_SET_ERR_MSG(extack,
+                                       "Device only routes can not be added for IPv6 using the multipath API.");
+                        fib6_info_release(rt);
+                        goto cleanup;
+                }
                rt->fib6_nh.nh_weight = rtnh->rtnh_hops + 1;
@@ -4439,7 +4446,6 @@ static int ip6_route_multipath_add(struct fib6_config *cfg,
                 */
                cfg->fc_nlinfo.nlh->nlmsg_flags &= ~(NLM_F_EXCL |
                                                     NLM_F_REPLACE);
-                cfg->fc_nlinfo.nlh->nlmsg_flags |= NLM_F_APPEND;
                nhn++;
        }
diff --git a/net/ipv6/seg6_iptunnel.c b/net/ipv6/seg6_iptunnel.c
index 19ccf0dc996c..a8854dd3e9c5 100644
--- a/net/ipv6/seg6_iptunnel.c
+++ b/net/ipv6/seg6_iptunnel.c
@@ -101,7 +101,7 @@ static __be32 seg6_make_flowlabel(struct net *net, struct sk_buff *skb,
        if (do_flowlabel > 0) {
                hash = skb_get_hash(skb);
-                rol32(hash, 16);
+                hash = rol32(hash, 16);
                flowlabel = (__force __be32)hash & IPV6_FLOWLABEL_MASK;
        } else if (!do_flowlabel && skb->protocol == htons(ETH_P_IPV6)) {
                flowlabel = ip6_flowlabel(inner_hdr);
diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
index dbd7d1fad277..f0a1c536ef15 100644
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -460,6 +460,13 @@ config NF_TABLES
 if NF_TABLES
+config NF_TABLES_SET
+        tristate "Netfilter nf_tables set infrastructure"
+        help
+          This option enables the nf_tables set infrastructure that allows to
+          look up for elements in a set and to build one-way mappings between
+          matchings and actions.
 config NF_TABLES_INET
        depends on IPV6
        select NF_TABLES_IPV4
@@ -493,24 +500,6 @@ config NFT_FLOW_OFFLOAD
          This option adds the "flow_offload" expression that you can use to
          choose what flows are placed into the hardware.
-config NFT_SET_RBTREE
-        tristate "Netfilter nf_tables rbtree set module"
-        help
-          This option adds the "rbtree" set type (Red Black tree) that is used
-          to build interval-based sets.
-config NFT_SET_HASH
-        tristate "Netfilter nf_tables hash set module"
-        help
-          This option adds the "hash" set type that is used to build one-way
-          mappings between matchings and actions.
-config NFT_SET_BITMAP
-        tristate "Netfilter nf_tables bitmap set module"
-        help
-          This option adds the "bitmap" set type that is used to build sets
-          whose keys are smaller or equal to 16 bits.
 config NFT_COUNTER
        tristate "Netfilter nf_tables counter module"
        help
diff --git a/net/netfilter/Makefile b/net/netfilter/Makefile
index 44449389e527..8a76dced974d 100644
--- a/net/netfilter/Makefile
+++ b/net/netfilter/Makefile
@@ -78,7 +78,11 @@ nf_tables-objs := nf_tables_core.o nf_tables_api.o nft_chain_filter.o \
                  nft_bitwise.o nft_byteorder.o nft_payload.o nft_lookup.o \
                  nft_dynset.o nft_meta.o nft_rt.o nft_exthdr.o
+nf_tables_set-objs := nf_tables_set_core.o \
+                      nft_set_hash.o nft_set_bitmap.o nft_set_rbtree.o
 obj-$(CONFIG_NF_TABLES)         += nf_tables.o
+obj-$(CONFIG_NF_TABLES_SET)     += nf_tables_set.o
 obj-$(CONFIG_NFT_COMPAT)        += nft_compat.o
 obj-$(CONFIG_NFT_CONNLIMIT)     += nft_connlimit.o
 obj-$(CONFIG_NFT_NUMGEN)        += nft_numgen.o
@@ -91,9 +95,6 @@ obj-$(CONFIG_NFT_QUEUE)		+= nft_queue.o
 obj-$(CONFIG_NFT_QUOTA)         += nft_quota.o
 obj-$(CONFIG_NFT_REJECT)        += nft_reject.o
 obj-$(CONFIG_NFT_REJECT_INET)   += nft_reject_inet.o
-obj-$(CONFIG_NFT_SET_RBTREE)    += nft_set_rbtree.o
-obj-$(CONFIG_NFT_SET_HASH)      += nft_set_hash.o
-obj-$(CONFIG_NFT_SET_BITMAP)    += nft_set_bitmap.o
 obj-$(CONFIG_NFT_COUNTER)       += nft_counter.o
 obj-$(CONFIG_NFT_LOG)           += nft_log.o
 obj-$(CONFIG_NFT_MASQ)          += nft_masq.o
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 3465da2a98bd..3d5280425027 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -2043,7 +2043,7 @@ int nf_conntrack_set_hashsize(const char *val, const struct kernel_param *kp)
                return -EOPNOTSUPP;
        /* On boot, we can set this without any fancy locking. */
-        if (!nf_conntrack_htable_size)
+        if (!nf_conntrack_hash)
                return param_set_uint(val, kp);
        rc = kstrtouint(val, 0, &hashsize);
diff --git a/net/netfilter/nf_tables_set_core.c b/net/netfilter/nf_tables_set_core.c
new file mode 100644
index 000000000000..814789644bd3
--- /dev/null
+++ b/net/netfilter/nf_tables_set_core.c
@@ -0,0 +1,28 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+#include <net/netfilter/nf_tables_core.h>
+static int __init nf_tables_set_module_init(void)
+{
+        nft_register_set(&nft_set_hash_fast_type);
+        nft_register_set(&nft_set_hash_type);
+        nft_register_set(&nft_set_rhash_type);
+        nft_register_set(&nft_set_bitmap_type);
+        nft_register_set(&nft_set_rbtree_type);
+        return 0;
+}
+static void __exit nf_tables_set_module_exit(void)
+{
+        nft_unregister_set(&nft_set_rbtree_type);
+        nft_unregister_set(&nft_set_bitmap_type);
+        nft_unregister_set(&nft_set_rhash_type);
+        nft_unregister_set(&nft_set_hash_type);
+        nft_unregister_set(&nft_set_hash_fast_type);
+}
+module_init(nf_tables_set_module_init);
+module_exit(nf_tables_set_module_exit);
+MODULE_LICENSE("GPL");
+MODULE_ALIAS_NFT_SET();
diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c
index 8d1ff654e5af..32535eea51b2 100644
--- a/net/netfilter/nft_compat.c
+++ b/net/netfilter/nft_compat.c
@@ -832,10 +832,18 @@ nft_target_select_ops(const struct nft_ctx *ctx,
        rev = ntohl(nla_get_be32(tb[NFTA_TARGET_REV]));
        family = ctx->family;
+        if (strcmp(tg_name, XT_ERROR_TARGET) == 0 ||
+            strcmp(tg_name, XT_STANDARD_TARGET) == 0 ||
+            strcmp(tg_name, "standard") == 0)
+                return ERR_PTR(-EINVAL);
        /* Re-use the existing target if it's already loaded. */
        list_for_each_entry(nft_target, &nft_target_list, head) {
                struct xt_target *target = nft_target->ops.data;
+                if (!target->target)
+                        continue;
                if (nft_target_cmp(target, tg_name, rev, family))
                        return &nft_target->ops;
        }
@@ -844,6 +852,11 @@ nft_target_select_ops(const struct nft_ctx *ctx,
        if (IS_ERR(target))
                return ERR_PTR(-ENOENT);
+        if (!target->target) {
+                err = -EINVAL;
+                goto err;
+        }
        if (target->targetsize > nla_len(tb[NFTA_TARGET_INFO])) {
                err = -EINVAL;
                goto err;
diff --git a/net/netfilter/nft_set_bitmap.c b/net/netfilter/nft_set_bitmap.c
index d6626e01c7ee..128bc16f52dd 100644
--- a/net/netfilter/nft_set_bitmap.c
+++ b/net/netfilter/nft_set_bitmap.c
@@ -296,7 +296,7 @@ static bool nft_bitmap_estimate(const struct nft_set_desc *desc, u32 features,
        return true;
 }
-static struct nft_set_type nft_bitmap_type __read_mostly = {
+struct nft_set_type nft_set_bitmap_type __read_mostly = {
        .owner          = THIS_MODULE,
        .ops            = {
                .privsize       = nft_bitmap_privsize,
@@ -314,20 +314,3 @@ static struct nft_set_type nft_bitmap_type __read_mostly = {
                .get            = nft_bitmap_get,
        },
 };
-static int __init nft_bitmap_module_init(void)
-{
-        return nft_register_set(&nft_bitmap_type);
-}
-static void __exit nft_bitmap_module_exit(void)
-{
-        nft_unregister_set(&nft_bitmap_type);
-}
-module_init(nft_bitmap_module_init);
-module_exit(nft_bitmap_module_exit);
-MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>");
-MODULE_ALIAS_NFT_SET();
diff --git a/net/netfilter/nft_set_hash.c b/net/netfilter/nft_set_hash.c
index 6f9a1365a09f..72ef35b51cac 100644
--- a/net/netfilter/nft_set_hash.c
+++ b/net/netfilter/nft_set_hash.c
@@ -654,7 +654,7 @@ static bool nft_hash_fast_estimate(const struct nft_set_desc *desc, u32 features
        return true;
 }
-static struct nft_set_type nft_rhash_type __read_mostly = {
+struct nft_set_type nft_set_rhash_type __read_mostly = {
        .owner          = THIS_MODULE,
        .features       = NFT_SET_MAP | NFT_SET_OBJECT |
                          NFT_SET_TIMEOUT | NFT_SET_EVAL,
@@ -677,7 +677,7 @@ static struct nft_set_type nft_rhash_type __read_mostly = {
        },
 };
-static struct nft_set_type nft_hash_type __read_mostly = {
+struct nft_set_type nft_set_hash_type __read_mostly = {
        .owner          = THIS_MODULE,
        .features       = NFT_SET_MAP | NFT_SET_OBJECT,
        .ops            = {
@@ -697,7 +697,7 @@ static struct nft_set_type nft_hash_type __read_mostly = {
        },
 };
-static struct nft_set_type nft_hash_fast_type __read_mostly = {
+struct nft_set_type nft_set_hash_fast_type __read_mostly = {
        .owner          = THIS_MODULE,
        .features       = NFT_SET_MAP | NFT_SET_OBJECT,
        .ops            = {
@@ -716,26 +716,3 @@ static struct nft_set_type nft_hash_fast_type __read_mostly = {
                .get            = nft_hash_get,
        },
 };
-static int __init nft_hash_module_init(void)
-{
-        if (nft_register_set(&nft_hash_fast_type) ||
-            nft_register_set(&nft_hash_type) ||
-            nft_register_set(&nft_rhash_type))
-                return 1;
-        return 0;
-}
-static void __exit nft_hash_module_exit(void)
-{
-        nft_unregister_set(&nft_rhash_type);
-        nft_unregister_set(&nft_hash_type);
-        nft_unregister_set(&nft_hash_fast_type);
-}
-module_init(nft_hash_module_init);
-module_exit(nft_hash_module_exit);
-MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
-MODULE_ALIAS_NFT_SET();
diff --git a/net/netfilter/nft_set_rbtree.c b/net/netfilter/nft_set_rbtree.c
index 7f3a9a211034..1f8f257cb518 100644
--- a/net/netfilter/nft_set_rbtree.c
+++ b/net/netfilter/nft_set_rbtree.c
@@ -462,7 +462,7 @@ static bool nft_rbtree_estimate(const struct nft_set_desc *desc, u32 features,
        return true;
 }
-static struct nft_set_type nft_rbtree_type __read_mostly = {
+struct nft_set_type nft_set_rbtree_type __read_mostly = {
        .owner          = THIS_MODULE,
        .features       = NFT_SET_INTERVAL | NFT_SET_MAP | NFT_SET_OBJECT | NFT_SET_TIMEOUT,
        .ops            = {
@@ -481,20 +481,3 @@ static struct nft_set_type nft_rbtree_type __read_mostly = {
                .get            = nft_rbtree_get,
        },
 };
-static int __init nft_rbtree_module_init(void)
-{
-        return nft_register_set(&nft_rbtree_type);
-}
-static void __exit nft_rbtree_module_exit(void)
-{
-        nft_unregister_set(&nft_rbtree_type);
-}
-module_init(nft_rbtree_module_init);
-module_exit(nft_rbtree_module_exit);
-MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
-MODULE_ALIAS_NFT_SET();
diff --git a/net/netfilter/xt_TPROXY.c b/net/netfilter/xt_TPROXY.c
index 58fce4e749a9..d76550a8b642 100644
--- a/net/netfilter/xt_TPROXY.c
+++ b/net/netfilter/xt_TPROXY.c
@@ -61,7 +61,7 @@ tproxy_tg4(struct net *net, struct sk_buff *skb, __be32 laddr, __be16 lport,
         * addresses, this happens if the redirect already happened
         * and the current packet belongs to an already established
         * connection */
-        sk = nf_tproxy_get_sock_v4(net, skb, hp, iph->protocol,
+        sk = nf_tproxy_get_sock_v4(net, skb, iph->protocol,
                                   iph->saddr, iph->daddr,
                                   hp->source, hp->dest,
                                   skb->dev, NF_TPROXY_LOOKUP_ESTABLISHED);
@@ -77,7 +77,7 @@ tproxy_tg4(struct net *net, struct sk_buff *skb, __be32 laddr, __be16 lport,
        else if (!sk)
                /* no, there's no established connection, check if
                 * there's a listener on the redirected addr/port */
-                sk = nf_tproxy_get_sock_v4(net, skb, hp, iph->protocol,
+                sk = nf_tproxy_get_sock_v4(net, skb, iph->protocol,
                                           iph->saddr, laddr,
                                           hp->source, lport,
                                           skb->dev, NF_TPROXY_LOOKUP_LISTENER);
@@ -150,7 +150,7 @@ tproxy_tg6_v1(struct sk_buff *skb, const struct xt_action_param *par)
         * addresses, this happens if the redirect already happened
         * and the current packet belongs to an already established
         * connection */
-        sk = nf_tproxy_get_sock_v6(xt_net(par), skb, thoff, hp, tproto,
+        sk = nf_tproxy_get_sock_v6(xt_net(par), skb, thoff, tproto,
                                   &iph->saddr, &iph->daddr,
                                   hp->source, hp->dest,
                                   xt_in(par), NF_TPROXY_LOOKUP_ESTABLISHED);
@@ -171,7 +171,7 @@ tproxy_tg6_v1(struct sk_buff *skb, const struct xt_action_param *par)
        else if (!sk)
                /* no there's no established connection, check if
                 * there's a listener on the redirected addr/port */
-                sk = nf_tproxy_get_sock_v6(xt_net(par), skb, thoff, hp,
+                sk = nf_tproxy_get_sock_v6(xt_net(par), skb, thoff,
                                           tproto, &iph->saddr, laddr,
                                           hp->source, lport,
                                           xt_in(par), NF_TPROXY_LOOKUP_LISTENER);
diff --git a/net/nfc/llcp_commands.c b/net/nfc/llcp_commands.c
index 2ceefa183cee..6a196e438b6c 100644
--- a/net/nfc/llcp_commands.c
+++ b/net/nfc/llcp_commands.c
@@ -752,11 +752,14 @@ int nfc_llcp_send_ui_frame(struct nfc_llcp_sock *sock, u8 ssap, u8 dsap,
                pr_debug("Fragment %zd bytes remaining %zd",
                         frag_len, remaining_len);
-                pdu = nfc_alloc_send_skb(sock->dev, &sock->sk, MSG_DONTWAIT,
+                pdu = nfc_alloc_send_skb(sock->dev, &sock->sk, 0,
                                         frag_len + LLCP_HEADER_SIZE, &err);
                if (pdu == NULL) {
-                        pr_err("Could not allocate PDU\n");
+                        pr_err("Could not allocate PDU (error=%d)\n", err);
-                        continue;
+                        len -= remaining_len;
+                        if (len == 0)
+                                len = err;
+                        break;
                }
                pdu = llcp_add_header(pdu, dsap, ssap, LLCP_PDU_UI);
diff --git a/net/nsh/nsh.c b/net/nsh/nsh.c
index 9696ef96b719..1a30e165eeb4 100644
--- a/net/nsh/nsh.c
+++ b/net/nsh/nsh.c
@@ -104,7 +104,7 @@ static struct sk_buff *nsh_gso_segment(struct sk_buff *skb,
        __skb_pull(skb, nsh_len);
        skb_reset_mac_header(skb);
-        skb_reset_mac_len(skb);
+        skb->mac_len = proto == htons(ETH_P_TEB) ? ETH_HLEN : 0;
        skb->protocol = proto;
        features &= NETIF_F_SG;
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 57634bc3da74..9b27d0cd766d 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -2878,6 +2878,8 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
                        goto out_free;
        } else if (reserve) {
                skb_reserve(skb, -reserve);
+                if (len < reserve)
+                        skb_reset_network_header(skb);
        }
        /* Returns -EFAULT on error */
diff --git a/net/qrtr/qrtr.c b/net/qrtr/qrtr.c
index 2aa07b547b16..86e1e37eb4e8 100644
--- a/net/qrtr/qrtr.c
+++ b/net/qrtr/qrtr.c
@@ -191,8 +191,13 @@ static int qrtr_node_enqueue(struct qrtr_node *node, struct sk_buff *skb,
        hdr->type = cpu_to_le32(type);
        hdr->src_node_id = cpu_to_le32(from->sq_node);
        hdr->src_port_id = cpu_to_le32(from->sq_port);
-        hdr->dst_node_id = cpu_to_le32(to->sq_node);
+        if (to->sq_port == QRTR_PORT_CTRL) {
-        hdr->dst_port_id = cpu_to_le32(to->sq_port);
+                hdr->dst_node_id = cpu_to_le32(node->nid);
+                hdr->dst_port_id = cpu_to_le32(QRTR_NODE_BCAST);
+        } else {
+                hdr->dst_node_id = cpu_to_le32(to->sq_node);
+                hdr->dst_port_id = cpu_to_le32(to->sq_port);
+        }
        hdr->size = cpu_to_le32(len);
        hdr->confirm_rx = 0;
@@ -764,6 +769,10 @@ static int qrtr_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
        node = NULL;
        if (addr->sq_node == QRTR_NODE_BCAST) {
                enqueue_fn = qrtr_bcast_enqueue;
+                if (addr->sq_port != QRTR_PORT_CTRL) {
+                        release_sock(sk);
+                        return -ENOTCONN;
+                }
        } else if (addr->sq_node == ipc->us.sq_node) {
                enqueue_fn = qrtr_local_enqueue;
        } else {
diff --git a/net/sched/act_csum.c b/net/sched/act_csum.c
index 526a8e491626..6e7124e57918 100644
--- a/net/sched/act_csum.c
+++ b/net/sched/act_csum.c
@@ -91,7 +91,7 @@ static int tcf_csum_init(struct net *net, struct nlattr *nla,
        }
        params_old = rtnl_dereference(p->params);
-        params_new->action = parm->action;
+        p->tcf_action = parm->action;
        params_new->update_flags = parm->update_flags;
        rcu_assign_pointer(p->params, params_new);
        if (params_old)
@@ -561,7 +561,7 @@ static int tcf_csum(struct sk_buff *skb, const struct tc_action *a,
        tcf_lastuse_update(&p->tcf_tm);
        bstats_cpu_update(this_cpu_ptr(p->common.cpu_bstats), skb);
-        action = params->action;
+        action = READ_ONCE(p->tcf_action);
        if (unlikely(action == TC_ACT_SHOT))
                goto drop_stats;
@@ -599,11 +599,11 @@ static int tcf_csum_dump(struct sk_buff *skb, struct tc_action *a, int bind,
                .index   = p->tcf_index,
                .refcnt  = p->tcf_refcnt - ref,
                .bindcnt = p->tcf_bindcnt - bind,
+                .action  = p->tcf_action,
        };
        struct tcf_t t;
        params = rtnl_dereference(p->params);
-        opt.action = params->action;
        opt.update_flags = params->update_flags;
        if (nla_put(skb, TCA_CSUM_PARMS, sizeof(opt), &opt))
diff --git a/net/sched/act_tunnel_key.c b/net/sched/act_tunnel_key.c
index 626dac81a48a..9bc6c2ae98a5 100644
--- a/net/sched/act_tunnel_key.c
+++ b/net/sched/act_tunnel_key.c
@@ -36,7 +36,7 @@ static int tunnel_key_act(struct sk_buff *skb, const struct tc_action *a,
        tcf_lastuse_update(&t->tcf_tm);
        bstats_cpu_update(this_cpu_ptr(t->common.cpu_bstats), skb);
-        action = params->action;
+        action = READ_ONCE(t->tcf_action);
        switch (params->tcft_action) {
        case TCA_TUNNEL_KEY_ACT_RELEASE:
@@ -182,7 +182,7 @@ static int tunnel_key_init(struct net *net, struct nlattr *nla,
        params_old = rtnl_dereference(t->params);
-        params_new->action = parm->action;
+        t->tcf_action = parm->action;
        params_new->tcft_action = parm->t_action;
        params_new->tcft_enc_metadata = metadata;
@@ -254,13 +254,13 @@ static int tunnel_key_dump(struct sk_buff *skb, struct tc_action *a,
                .index    = t->tcf_index,
                .refcnt   = t->tcf_refcnt - ref,
                .bindcnt  = t->tcf_bindcnt - bind,
+                .action   = t->tcf_action,
        };
        struct tcf_t tm;
        params = rtnl_dereference(t->params);
        opt.t_action = params->tcft_action;
-        opt.action = params->action;
        if (nla_put(skb, TCA_TUNNEL_KEY_PARMS, sizeof(opt), &opt))
                goto nla_put_failure;
diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
index cdc3c87c53e6..f74513a7c7a8 100644
--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -1053,7 +1053,7 @@ static void tfilter_notify_chain(struct net *net, struct sk_buff *oskb,
        for (tp = rtnl_dereference(chain->filter_chain);
             tp; tp = rtnl_dereference(tp->next))
                tfilter_notify(net, oskb, n, tp, block,
-                               q, parent, 0, event, false);
+                               q, parent, NULL, event, false);
 }
 static int tc_new_tfilter(struct sk_buff *skb, struct nlmsghdr *n,
@@ -1444,7 +1444,7 @@ static bool tcf_chain_dump(struct tcf_chain *chain, struct Qdisc *q, u32 parent,
                        memset(&cb->args[1], 0,
                               sizeof(cb->args) - sizeof(cb->args[0]));
                if (cb->args[1] == 0) {
-                        if (tcf_fill_node(net, skb, tp, block, q, parent, 0,
+                        if (tcf_fill_node(net, skb, tp, block, q, parent, NULL,
                                          NETLINK_CB(cb->skb).portid,
                                          cb->nlh->nlmsg_seq, NLM_F_MULTI,
                                          RTM_NEWTFILTER) <= 0)
diff --git a/net/sched/sch_fq_codel.c b/net/sched/sch_fq_codel.c
index cd2e0e342fb6..6c0a9d5dbf94 100644
--- a/net/sched/sch_fq_codel.c
+++ b/net/sched/sch_fq_codel.c
@@ -479,24 +479,28 @@ static int fq_codel_init(struct Qdisc *sch, struct nlattr *opt,
        q->cparams.mtu = psched_mtu(qdisc_dev(sch));
        if (opt) {
-                int err = fq_codel_change(sch, opt, extack);
+                err = fq_codel_change(sch, opt, extack);
                if (err)
-                        return err;
+                        goto init_failure;
        }
        err = tcf_block_get(&q->block, &q->filter_list, sch, extack);
        if (err)
-                return err;
+                goto init_failure;
        if (!q->flows) {
                q->flows = kvcalloc(q->flows_cnt,
                                    sizeof(struct fq_codel_flow),
                                    GFP_KERNEL);
-                if (!q->flows)
+                if (!q->flows) {
-                        return -ENOMEM;
+                        err = -ENOMEM;
+                        goto init_failure;
+                }
                q->backlogs = kvcalloc(q->flows_cnt, sizeof(u32), GFP_KERNEL);
-                if (!q->backlogs)
+                if (!q->backlogs) {
-                        return -ENOMEM;
+                        err = -ENOMEM;
+                        goto alloc_failure;
+                }
                for (i = 0; i < q->flows_cnt; i++) {
                        struct fq_codel_flow *flow = q->flows + i;
@@ -509,6 +513,13 @@ static int fq_codel_init(struct Qdisc *sch, struct nlattr *opt,
        else
                sch->flags &= ~TCQ_F_CAN_BYPASS;
        return 0;
+alloc_failure:
+        kvfree(q->flows);
+        q->flows = NULL;
+init_failure:
+        q->flows_cnt = 0;
+        return err;
 }
 static int fq_codel_dump(struct Qdisc *sch, struct sk_buff *skb)
diff --git a/net/sctp/transport.c b/net/sctp/transport.c
index 445b7ef61677..12cac85da994 100644
--- a/net/sctp/transport.c
+++ b/net/sctp/transport.c
@@ -282,7 +282,7 @@ bool sctp_transport_update_pmtu(struct sctp_transport *t, u32 pmtu)
        if (dst) {
                /* Re-fetch, as under layers may have a higher minimum size */
-                pmtu = SCTP_TRUNC4(dst_mtu(dst));
+                pmtu = sctp_dst_mtu(dst);
                change = t->pathmtu != pmtu;
        }
        t->pathmtu = pmtu;
diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
index 3c1405df936c..05e4ffe5aabd 100644
--- a/net/smc/af_smc.c
+++ b/net/smc/af_smc.c
@@ -147,7 +147,8 @@ static int smc_release(struct socket *sock)
                smc->clcsock = NULL;
        }
        if (smc->use_fallback) {
-                sock_put(sk); /* passive closing */
+                if (sk->sk_state != SMC_LISTEN && sk->sk_state != SMC_INIT)
+                        sock_put(sk); /* passive closing */
                sk->sk_state = SMC_CLOSED;
                sk->sk_state_change(sk);
        }
@@ -417,12 +418,18 @@ static int smc_connect_decline_fallback(struct smc_sock *smc, int reason_code)
 {
        int rc;
-        if (reason_code < 0) /* error, fallback is not possible */
+        if (reason_code < 0) { /* error, fallback is not possible */
+                if (smc->sk.sk_state == SMC_INIT)
+                        sock_put(&smc->sk); /* passive closing */
                return reason_code;
+        }
        if (reason_code != SMC_CLC_DECL_REPLY) {
                rc = smc_clc_send_decline(smc, reason_code);
-                if (rc < 0)
+                if (rc < 0) {
+                        if (smc->sk.sk_state == SMC_INIT)
+                                sock_put(&smc->sk); /* passive closing */
                        return rc;
+                }
        }
        return smc_connect_fallback(smc);
 }
@@ -435,8 +442,6 @@ static int smc_connect_abort(struct smc_sock *smc, int reason_code,
                smc_lgr_forget(smc->conn.lgr);
        mutex_unlock(&smc_create_lgr_pending);
        smc_conn_free(&smc->conn);
-        if (reason_code < 0 && smc->sk.sk_state == SMC_INIT)
-                sock_put(&smc->sk); /* passive closing */
        return reason_code;
 }
@@ -1452,7 +1457,8 @@ static int smc_setsockopt(struct socket *sock, int level, int optname,
        if (optlen < sizeof(int))
                return -EINVAL;
-        get_user(val, (int __user *)optval);
+        if (get_user(val, (int __user *)optval))
+                return -EFAULT;
        lock_sock(sk);
        switch (optname) {
@@ -1520,10 +1526,13 @@ static int smc_ioctl(struct socket *sock, unsigned int cmd,
                        return -EBADF;
                return smc->clcsock->ops->ioctl(smc->clcsock, cmd, arg);
        }
+        lock_sock(&smc->sk);
        switch (cmd) {
        case SIOCINQ: /* same as FIONREAD */
-                if (smc->sk.sk_state == SMC_LISTEN)
+                if (smc->sk.sk_state == SMC_LISTEN) {
+                        release_sock(&smc->sk);
                        return -EINVAL;
+                }
                if (smc->sk.sk_state == SMC_INIT ||
                    smc->sk.sk_state == SMC_CLOSED)
                        answ = 0;
@@ -1532,8 +1541,10 @@ static int smc_ioctl(struct socket *sock, unsigned int cmd,
                break;
        case SIOCOUTQ:
                /* output queue size (not send + not acked) */
-                if (smc->sk.sk_state == SMC_LISTEN)
+                if (smc->sk.sk_state == SMC_LISTEN) {
+                        release_sock(&smc->sk);
                        return -EINVAL;
+                }
                if (smc->sk.sk_state == SMC_INIT ||
                    smc->sk.sk_state == SMC_CLOSED)
                        answ = 0;
@@ -1543,8 +1554,10 @@ static int smc_ioctl(struct socket *sock, unsigned int cmd,
                break;
        case SIOCOUTQNSD:
                /* output queue size (not send only) */
-                if (smc->sk.sk_state == SMC_LISTEN)
+                if (smc->sk.sk_state == SMC_LISTEN) {
+                        release_sock(&smc->sk);
                        return -EINVAL;
+                }
                if (smc->sk.sk_state == SMC_INIT ||
                    smc->sk.sk_state == SMC_CLOSED)
                        answ = 0;
@@ -1552,8 +1565,10 @@ static int smc_ioctl(struct socket *sock, unsigned int cmd,
                        answ = smc_tx_prepared_sends(&smc->conn);
                break;
        case SIOCATMARK:
-                if (smc->sk.sk_state == SMC_LISTEN)
+                if (smc->sk.sk_state == SMC_LISTEN) {
+                        release_sock(&smc->sk);
                        return -EINVAL;
+                }
                if (smc->sk.sk_state == SMC_INIT ||
                    smc->sk.sk_state == SMC_CLOSED) {
                        answ = 0;
@@ -1569,8 +1584,10 @@ static int smc_ioctl(struct socket *sock, unsigned int cmd,
                }
                break;
        default:
+                release_sock(&smc->sk);
                return -ENOIOCTLCMD;
        }
+        release_sock(&smc->sk);
        return put_user(answ, (int __user *)arg);
 }
diff --git a/net/smc/smc_clc.c b/net/smc/smc_clc.c
index 717449b1da0b..ae5d168653ce 100644
--- a/net/smc/smc_clc.c
+++ b/net/smc/smc_clc.c
@@ -250,6 +250,7 @@ out:
 int smc_clc_wait_msg(struct smc_sock *smc, void *buf, int buflen,
                     u8 expected_type)
 {
+        long rcvtimeo = smc->clcsock->sk->sk_rcvtimeo;
        struct sock *clc_sk = smc->clcsock->sk;
        struct smc_clc_msg_hdr *clcm = buf;
        struct msghdr msg = {NULL, 0};
@@ -306,7 +307,6 @@ int smc_clc_wait_msg(struct smc_sock *smc, void *buf, int buflen,
        memset(&msg, 0, sizeof(struct msghdr));
        iov_iter_kvec(&msg.msg_iter, READ | ITER_KVEC, &vec, 1, datlen);
        krflags = MSG_WAITALL;
-        smc->clcsock->sk->sk_rcvtimeo = CLC_WAIT_TIME;
        len = sock_recvmsg(smc->clcsock, &msg, krflags);
        if (len < datlen || !smc_clc_msg_hdr_valid(clcm)) {
                smc->sk.sk_err = EPROTO;
@@ -322,6 +322,7 @@ int smc_clc_wait_msg(struct smc_sock *smc, void *buf, int buflen,
        }
 out:
+        smc->clcsock->sk->sk_rcvtimeo = rcvtimeo;
        return reason_code;
 }
diff --git a/net/smc/smc_close.c b/net/smc/smc_close.c
index fa41d9881741..ac961dfb1ea1 100644
--- a/net/smc/smc_close.c
+++ b/net/smc/smc_close.c
@@ -107,6 +107,8 @@ static void smc_close_active_abort(struct smc_sock *smc)
        }
        switch (sk->sk_state) {
        case SMC_INIT:
+                sk->sk_state = SMC_PEERABORTWAIT;
+                break;
        case SMC_ACTIVE:
                sk->sk_state = SMC_PEERABORTWAIT;
                release_sock(sk);
diff --git a/net/smc/smc_tx.c b/net/smc/smc_tx.c
index cee666400752..f82886b7d1d8 100644
--- a/net/smc/smc_tx.c
+++ b/net/smc/smc_tx.c
@@ -495,7 +495,8 @@ out:
 void smc_tx_consumer_update(struct smc_connection *conn, bool force)
 {
-        union smc_host_cursor cfed, cons;
+        union smc_host_cursor cfed, cons, prod;
+        int sender_free = conn->rmb_desc->len;
        int to_confirm;
        smc_curs_write(&cons,
@@ -505,11 +506,18 @@ void smc_tx_consumer_update(struct smc_connection *conn, bool force)
                       smc_curs_read(&conn->rx_curs_confirmed, conn),
                       conn);
        to_confirm = smc_curs_diff(conn->rmb_desc->len, &cfed, &cons);
+        if (to_confirm > conn->rmbe_update_limit) {
+                smc_curs_write(&prod,
+                               smc_curs_read(&conn->local_rx_ctrl.prod, conn),
+                               conn);
+                sender_free = conn->rmb_desc->len -
+                              smc_curs_diff(conn->rmb_desc->len, &prod, &cfed);
+        }
        if (conn->local_rx_ctrl.prod_flags.cons_curs_upd_req ||
            force ||
            ((to_confirm > conn->rmbe_update_limit) &&
-             ((to_confirm > (conn->rmb_desc->len / 2)) ||
+             ((sender_free <= (conn->rmb_desc->len / 2)) ||
              conn->local_rx_ctrl.prod_flags.write_blocked))) {
                if ((smc_cdc_get_slot_and_msg_send(conn) < 0) &&
                    conn->alert_token_local) { /* connection healthy */
diff --git a/net/tipc/discover.c b/net/tipc/discover.c
index 9f666e0650e2..2830709957bd 100644
--- a/net/tipc/discover.c
+++ b/net/tipc/discover.c
@@ -133,6 +133,8 @@ static void disc_dupl_alert(struct tipc_bearer *b, u32 node_addr,
 }
 /* tipc_disc_addr_trial(): - handle an address uniqueness trial from peer
+ * Returns true if message should be dropped by caller, i.e., if it is a
+ * trial message or we are inside trial period. Otherwise false.
 */
 static bool tipc_disc_addr_trial_msg(struct tipc_discoverer *d,
                                     struct tipc_media_addr *maddr,
@@ -168,8 +170,9 @@ static bool tipc_disc_addr_trial_msg(struct tipc_discoverer *d,
                msg_set_type(buf_msg(d->skb), DSC_REQ_MSG);
        }
+        /* Accept regular link requests/responses only after trial period */
        if (mtyp != DSC_TRIAL_MSG)
-                return false;
+                return trial;
        sugg_addr = tipc_node_try_addr(net, peer_id, src);
        if (sugg_addr)
@@ -284,7 +287,6 @@ static void tipc_disc_timeout(struct timer_list *t)
 {
        struct tipc_discoverer *d = from_timer(d, t, timer);
        struct tipc_net *tn = tipc_net(d->net);
-        u32 self = tipc_own_addr(d->net);
        struct tipc_media_addr maddr;
        struct sk_buff *skb = NULL;
        struct net *net = d->net;
@@ -298,12 +300,14 @@ static void tipc_disc_timeout(struct timer_list *t)
                goto exit;
        }
-        /* Did we just leave the address trial period ? */
+        /* Trial period over ? */
-        if (!self && !time_before(jiffies, tn->addr_trial_end)) {
+        if (!time_before(jiffies, tn->addr_trial_end)) {
-                self = tn->trial_addr;
+                /* Did we just leave it ? */
-                tipc_net_finalize(net, self);
+                if (!tipc_own_addr(net))
-                msg_set_prevnode(buf_msg(d->skb), self);
+                        tipc_net_finalize(net, tn->trial_addr);
                msg_set_type(buf_msg(d->skb), DSC_REQ_MSG);
+                msg_set_prevnode(buf_msg(d->skb), tipc_own_addr(net));
        }
        /* Adjust timeout interval according to discovery phase */
diff --git a/net/tipc/net.c b/net/tipc/net.c
index 4fbaa0464405..a7f6964c3a4b 100644
--- a/net/tipc/net.c
+++ b/net/tipc/net.c
@@ -121,12 +121,17 @@ int tipc_net_init(struct net *net, u8 *node_id, u32 addr)
 void tipc_net_finalize(struct net *net, u32 addr)
 {
-        tipc_set_node_addr(net, addr);
+        struct tipc_net *tn = tipc_net(net);
-        smp_mb();
-        tipc_named_reinit(net);
+        spin_lock_bh(&tn->node_list_lock);
-        tipc_sk_reinit(net);
+        if (!tipc_own_addr(net)) {
-        tipc_nametbl_publish(net, TIPC_CFG_SRV, addr, addr,
+                tipc_set_node_addr(net, addr);
-                             TIPC_CLUSTER_SCOPE, 0, addr);
+                tipc_named_reinit(net);
+                tipc_sk_reinit(net);
+                tipc_nametbl_publish(net, TIPC_CFG_SRV, addr, addr,
+                                     TIPC_CLUSTER_SCOPE, 0, addr);
+        }
+        spin_unlock_bh(&tn->node_list_lock);
 }
 void tipc_net_stop(struct net *net)
diff --git a/net/tipc/node.c b/net/tipc/node.c
index 6a44eb812baf..0453bd451ce8 100644
--- a/net/tipc/node.c
+++ b/net/tipc/node.c
@@ -797,6 +797,7 @@ static u32 tipc_node_suggest_addr(struct net *net, u32 addr)
 }
 /* tipc_node_try_addr(): Check if addr can be used by peer, suggest other if not
+ * Returns suggested address if any, otherwise 0
 */
 u32 tipc_node_try_addr(struct net *net, u8 *id, u32 addr)
 {
@@ -819,12 +820,14 @@ u32 tipc_node_try_addr(struct net *net, u8 *id, u32 addr)
        if (n) {
                addr = n->addr;
                tipc_node_put(n);
+                return addr;
        }
-        /* Even this node may be in trial phase */
+        /* Even this node may be in conflict */
        if (tn->trial_addr == addr)
                return tipc_node_suggest_addr(net, addr);
-        return addr;
+        return 0;
 }
 void tipc_node_check_dest(struct net *net, u32 addr,
diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
index d2380548f8f6..4618f1c31137 100644
--- a/net/tls/tls_sw.c
+++ b/net/tls/tls_sw.c
@@ -440,7 +440,7 @@ alloc_encrypted:
                        ret = tls_push_record(sk, msg->msg_flags, record_type);
                        if (!ret)
                                continue;
-                        if (ret == -EAGAIN)
+                        if (ret < 0)
                                goto send_end;
                        copied -= try_to_copy;
@@ -701,6 +701,10 @@ static int decrypt_skb(struct sock *sk, struct sk_buff *skb,
        nsg = skb_to_sgvec(skb, &sgin[1],
                           rxm->offset + tls_ctx->rx.prepend_size,
                           rxm->full_len - tls_ctx->rx.prepend_size);
+        if (nsg < 0) {
+                ret = nsg;
+                goto out;
+        }
        tls_make_aad(ctx->rx_aad_ciphertext,
                     rxm->full_len - tls_ctx->rx.overhead_size,
@@ -712,6 +716,7 @@ static int decrypt_skb(struct sock *sk, struct sk_buff *skb,
                                rxm->full_len - tls_ctx->rx.overhead_size,
                                skb, sk->sk_allocation);
+out:
        if (sgin != &sgin_arr[0])
                kfree(sgin);
diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c
index 59fb7d3c36a3..72335c2e8108 100644
--- a/net/xdp/xsk.c
+++ b/net/xdp/xsk.c
@@ -199,8 +199,11 @@ static void xsk_destruct_skb(struct sk_buff *skb)
 {
        u64 addr = (u64)(long)skb_shinfo(skb)->destructor_arg;
        struct xdp_sock *xs = xdp_sk(skb->sk);
+        unsigned long flags;
+        spin_lock_irqsave(&xs->tx_completion_lock, flags);
        WARN_ON_ONCE(xskq_produce_addr(xs->umem->cq, addr));
+        spin_unlock_irqrestore(&xs->tx_completion_lock, flags);
        sock_wfree(skb);
 }
@@ -215,9 +218,6 @@ static int xsk_generic_xmit(struct sock *sk, struct msghdr *m,
        struct sk_buff *skb;
        int err = 0;
-        if (unlikely(!xs->tx))
-                return -ENOBUFS;
        mutex_lock(&xs->mutex);
        while (xskq_peek_desc(xs->tx, &desc)) {
@@ -230,22 +230,13 @@ static int xsk_generic_xmit(struct sock *sk, struct msghdr *m,
                        goto out;
                }
-                if (xskq_reserve_addr(xs->umem->cq)) {
+                if (xskq_reserve_addr(xs->umem->cq))
-                        err = -EAGAIN;
-                        goto out;
-                }
-                len = desc.len;
-                if (unlikely(len > xs->dev->mtu)) {
-                        err = -EMSGSIZE;
                        goto out;
-                }
-                if (xs->queue_id >= xs->dev->real_num_tx_queues) {
+                if (xs->queue_id >= xs->dev->real_num_tx_queues)
-                        err = -ENXIO;
                        goto out;
-                }
+                len = desc.len;
                skb = sock_alloc_send_skb(sk, len, 1, &err);
                if (unlikely(!skb)) {
                        err = -EAGAIN;
@@ -268,15 +259,15 @@ static int xsk_generic_xmit(struct sock *sk, struct msghdr *m,
                skb->destructor = xsk_destruct_skb;
                err = dev_direct_xmit(skb, xs->queue_id);
+                xskq_discard_desc(xs->tx);
                /* Ignore NET_XMIT_CN as packet might have been sent */
                if (err == NET_XMIT_DROP || err == NETDEV_TX_BUSY) {
-                        err = -EAGAIN;
+                        /* SKB completed but not sent */
-                        /* SKB consumed by dev_direct_xmit() */
+                        err = -EBUSY;
                        goto out;
                }
                sent_frame = true;
-                xskq_discard_desc(xs->tx);
        }
 out:
@@ -297,6 +288,8 @@ static int xsk_sendmsg(struct socket *sock, struct msghdr *m, size_t total_len)
                return -ENXIO;
        if (unlikely(!(xs->dev->flags & IFF_UP)))
                return -ENETDOWN;
+        if (unlikely(!xs->tx))
+                return -ENOBUFS;
        if (need_wait)
                return -EOPNOTSUPP;
@@ -755,6 +748,7 @@ static int xsk_create(struct net *net, struct socket *sock, int protocol,
        xs = xdp_sk(sk);
        mutex_init(&xs->mutex);
+        spin_lock_init(&xs->tx_completion_lock);
        local_bh_disable();
        sock_prot_inuse_add(net, &xsk_proto, 1);
diff --git a/net/xdp/xsk_queue.h b/net/xdp/xsk_queue.h
index ef6a6f0ec949..52ecaf770642 100644
--- a/net/xdp/xsk_queue.h
+++ b/net/xdp/xsk_queue.h
@@ -62,14 +62,9 @@ static inline u32 xskq_nb_avail(struct xsk_queue *q, u32 dcnt)
        return (entries > dcnt) ? dcnt : entries;
 }
-static inline u32 xskq_nb_free_lazy(struct xsk_queue *q, u32 producer)
-{
-        return q->nentries - (producer - q->cons_tail);
-}
 static inline u32 xskq_nb_free(struct xsk_queue *q, u32 producer, u32 dcnt)
 {
-        u32 free_entries = xskq_nb_free_lazy(q, producer);
+        u32 free_entries = q->nentries - (producer - q->cons_tail);
        if (free_entries >= dcnt)
                return free_entries;
@@ -129,7 +124,7 @@ static inline int xskq_produce_addr(struct xsk_queue *q, u64 addr)
 {
        struct xdp_umem_ring *ring = (struct xdp_umem_ring *)q->ring;
-        if (xskq_nb_free(q, q->prod_tail, LAZY_UPDATE_THRESHOLD) == 0)
+        if (xskq_nb_free(q, q->prod_tail, 1) == 0)
                return -ENOSPC;
        ring->desc[q->prod_tail++ & q->ring_mask] = addr;
diff --git a/samples/bpf/.gitignore b/samples/bpf/.gitignore
new file mode 100644
index 000000000000..8ae4940025f8
--- /dev/null
+++ b/samples/bpf/.gitignore
@@ -0,0 +1,49 @@
+cpustat
+fds_example
+lathist
+load_sock_ops
+lwt_len_hist
+map_perf_test
+offwaketime
+per_socket_stats_example
+sampleip
+sock_example
+sockex1
+sockex2
+sockex3
+spintest
+syscall_nrs.h
+syscall_tp
+task_fd_query
+tc_l2_redirect
+test_cgrp2_array_pin
+test_cgrp2_attach
+test_cgrp2_attach2
+test_cgrp2_sock
+test_cgrp2_sock2
+test_current_task_under_cgroup
+test_lru_dist
+test_map_in_map
+test_overhead
+test_probe_write_user
+trace_event
+trace_output
+tracex1
+tracex2
+tracex3
+tracex4
+tracex5
+tracex6
+tracex7
+xdp1
+xdp2
+xdp_adjust_tail
+xdp_fwd
+xdp_monitor
+xdp_redirect
+xdp_redirect_cpu
+xdp_redirect_map
+xdp_router_ipv4
+xdp_rxq_info
+xdp_tx_iptunnel
+xdpsock
diff --git a/samples/bpf/parse_varlen.c b/samples/bpf/parse_varlen.c
index 95c16324760c..0b6f22feb2c9 100644
--- a/samples/bpf/parse_varlen.c
+++ b/samples/bpf/parse_varlen.c
@@ -6,6 +6,7 @@
 */
 #define KBUILD_MODNAME "foo"
 #include <linux/if_ether.h>
+#include <linux/if_vlan.h>
 #include <linux/ip.h>
 #include <linux/ipv6.h>
 #include <linux/in.h>
@@ -108,11 +109,6 @@ static int parse_ipv6(void *data, uint64_t nh_off, void *data_end)
        return 0;
 }
-struct vlan_hdr {
-        uint16_t h_vlan_TCI;
-        uint16_t h_vlan_encapsulated_proto;
-};
 SEC("varlen")
 int handle_ingress(struct __sk_buff *skb)
 {
diff --git a/samples/bpf/test_overhead_user.c b/samples/bpf/test_overhead_user.c
index 6caf47afa635..9d6dcaa9db92 100644
--- a/samples/bpf/test_overhead_user.c
+++ b/samples/bpf/test_overhead_user.c
@@ -6,6 +6,7 @@
 */
 #define _GNU_SOURCE
 #include <sched.h>
+#include <errno.h>
 #include <stdio.h>
 #include <sys/types.h>
 #include <asm/unistd.h>
@@ -44,8 +45,13 @@ static void test_task_rename(int cpu)
                exit(1);
        }
        start_time = time_get_ns();
-        for (i = 0; i < MAX_CNT; i++)
+        for (i = 0; i < MAX_CNT; i++) {
-                write(fd, buf, sizeof(buf));
+                if (write(fd, buf, sizeof(buf)) < 0) {
+                        printf("task rename failed: %s\n", strerror(errno));
+                        close(fd);
+                        return;
+                }
+        }
        printf("task_rename:%d: %lld events per sec\n",
               cpu, MAX_CNT * 1000000000ll / (time_get_ns() - start_time));
        close(fd);
@@ -63,8 +69,13 @@ static void test_urandom_read(int cpu)
                exit(1);
        }
        start_time = time_get_ns();
-        for (i = 0; i < MAX_CNT; i++)
+        for (i = 0; i < MAX_CNT; i++) {
-                read(fd, buf, sizeof(buf));
+                if (read(fd, buf, sizeof(buf)) < 0) {
+                        printf("failed to read from /dev/urandom: %s\n", strerror(errno));
+                        close(fd);
+                        return;
+                }
+        }
        printf("urandom_read:%d: %lld events per sec\n",
               cpu, MAX_CNT * 1000000000ll / (time_get_ns() - start_time));
        close(fd);
diff --git a/samples/bpf/trace_event_user.c b/samples/bpf/trace_event_user.c
index 1fa1becfa641..d08046ab81f0 100644
--- a/samples/bpf/trace_event_user.c
+++ b/samples/bpf/trace_event_user.c
@@ -122,6 +122,16 @@ static void print_stacks(void)
        }
 }
+static inline int generate_load(void)
+{
+        if (system("dd if=/dev/zero of=/dev/null count=5000k status=none") < 0) {
+                printf("failed to generate some load with dd: %s\n", strerror(errno));
+                return -1;
+        }
+        return 0;
+}
 static void test_perf_event_all_cpu(struct perf_event_attr *attr)
 {
        int nr_cpus = sysconf(_SC_NPROCESSORS_CONF);
@@ -142,7 +152,11 @@ static void test_perf_event_all_cpu(struct perf_event_attr *attr)
                assert(ioctl(pmu_fd[i], PERF_EVENT_IOC_SET_BPF, prog_fd[0]) == 0);
                assert(ioctl(pmu_fd[i], PERF_EVENT_IOC_ENABLE) == 0);
        }
-        system("dd if=/dev/zero of=/dev/null count=5000k status=none");
+        if (generate_load() < 0) {
+                error = 1;
+                goto all_cpu_err;
+        }
        print_stacks();
 all_cpu_err:
        for (i--; i >= 0; i--) {
@@ -156,7 +170,7 @@ all_cpu_err:
 static void test_perf_event_task(struct perf_event_attr *attr)
 {
-        int pmu_fd;
+        int pmu_fd, error = 0;
        /* per task perf event, enable inherit so the "dd ..." command can be traced properly.
         * Enabling inherit will cause bpf_perf_prog_read_time helper failure.
@@ -171,10 +185,17 @@ static void test_perf_event_task(struct perf_event_attr *attr)
        }
        assert(ioctl(pmu_fd, PERF_EVENT_IOC_SET_BPF, prog_fd[0]) == 0);
        assert(ioctl(pmu_fd, PERF_EVENT_IOC_ENABLE) == 0);
-        system("dd if=/dev/zero of=/dev/null count=5000k status=none");
+        if (generate_load() < 0) {
+                error = 1;
+                goto err;
+        }
        print_stacks();
+err:
        ioctl(pmu_fd, PERF_EVENT_IOC_DISABLE);
        close(pmu_fd);
+        if (error)
+                int_exit(0);
 }
 static void test_bpf_perf_event(void)
diff --git a/samples/bpf/xdp2skb_meta.sh b/samples/bpf/xdp2skb_meta.sh
index b9c9549c4c27..4bde9d066c46 100755
--- a/samples/bpf/xdp2skb_meta.sh
+++ b/samples/bpf/xdp2skb_meta.sh
@@ -16,8 +16,8 @@
 BPF_FILE=xdp2skb_meta_kern.o
 DIR=$(dirname $0)
-export TC=/usr/sbin/tc
+[ -z "$TC" ] && TC=tc
-export IP=/usr/sbin/ip
+[ -z "$IP" ] && IP=ip
 function usage() {
    echo ""
@@ -53,7 +53,7 @@ function _call_cmd() {
    local allow_fail="$2"
    shift 2
    if [[ -n "$VERBOSE" ]]; then
-        echo "$(basename $cmd) $@"
+        echo "$cmd $@"
    fi
    if [[ -n "$DRYRUN" ]]; then
        return
diff --git a/samples/bpf/xdpsock_user.c b/samples/bpf/xdpsock_user.c
index d69c8d78d3fd..5904b1543831 100644
--- a/samples/bpf/xdpsock_user.c
+++ b/samples/bpf/xdpsock_user.c
@@ -729,7 +729,7 @@ static void kick_tx(int fd)
        int ret;
        ret = sendto(fd, NULL, 0, MSG_DONTWAIT, NULL, 0);
-        if (ret >= 0 || errno == ENOBUFS || errno == EAGAIN)
+        if (ret >= 0 || errno == ENOBUFS || errno == EAGAIN || errno == EBUSY)
                return;
        lassert(0);
 }
diff --git a/scripts/tags.sh b/scripts/tags.sh
index 412a70cce558..26de7d5aa5c8 100755
--- a/scripts/tags.sh
+++ b/scripts/tags.sh
@@ -152,6 +152,7 @@ regex_asm=(
 )
 regex_c=(
        '/^SYSCALL_DEFINE[0-9](\([[:alnum:]_]*\).*/sys_\1/'
+        '/^BPF_CALL_[0-9](\([[:alnum:]_]*\).*/\1/'
        '/^COMPAT_SYSCALL_DEFINE[0-9](\([[:alnum:]_]*\).*/compat_sys_\1/'
        '/^TRACE_EVENT(\([[:alnum:]_]*\).*/trace_\1/'
        '/^TRACE_EVENT(\([[:alnum:]_]*\).*/trace_\1_rcuidle/'
diff --git a/tools/testing/selftests/bpf/test_verifier.c b/tools/testing/selftests/bpf/test_verifier.c
index 2ecd27b670d7..f5f7bcc96046 100644
--- a/tools/testing/selftests/bpf/test_verifier.c
+++ b/tools/testing/selftests/bpf/test_verifier.c
@@ -4975,6 +4975,24 @@ static struct bpf_test tests[] = {
                .prog_type = BPF_PROG_TYPE_LWT_XMIT,
        },
        {
+                "make headroom for LWT_XMIT",
+                .insns = {
+                        BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
+                        BPF_MOV64_IMM(BPF_REG_2, 34),
+                        BPF_MOV64_IMM(BPF_REG_3, 0),
+                        BPF_EMIT_CALL(BPF_FUNC_skb_change_head),
+                        /* split for s390 to succeed */
+                        BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
+                        BPF_MOV64_IMM(BPF_REG_2, 42),
+                        BPF_MOV64_IMM(BPF_REG_3, 0),
+                        BPF_EMIT_CALL(BPF_FUNC_skb_change_head),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .result = ACCEPT,
+                .prog_type = BPF_PROG_TYPE_LWT_XMIT,
+        },
+        {
                "invalid access of tc_classid for LWT_IN",
                .insns = {
                        BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
@@ -12554,8 +12572,11 @@ static void do_test_single(struct bpf_test *test, bool unpriv,
        }
        if (fd_prog >= 0) {
+                __u8 tmp[TEST_DATA_LEN << 2];
+                __u32 size_tmp = sizeof(tmp);
                err = bpf_prog_test_run(fd_prog, 1, test->data,
-                                        sizeof(test->data), NULL, NULL,
+                                        sizeof(test->data), tmp, &size_tmp,
                                        &retval, NULL);
                if (err && errno != 524/*ENOTSUPP*/ && errno != EPERM) {
                        printf("Unexpected bpf_prog_test_run error\n");
diff --git a/tools/testing/selftests/net/fib_tests.sh b/tools/testing/selftests/net/fib_tests.sh
index 78245d60d8bc..0f45633bd634 100755
--- a/tools/testing/selftests/net/fib_tests.sh
+++ b/tools/testing/selftests/net/fib_tests.sh
@@ -740,13 +740,6 @@ ipv6_rt_add()
        run_cmd "$IP -6 ro add unreachable 2001:db8:104::/64"
        log_test $? 2 "Attempt to add duplicate route - reject route"
-        # iproute2 prepend only sets NLM_F_CREATE
-        # - adds a new route; does NOT convert existing route to ECMP
-        add_route6 "2001:db8:104::/64" "via 2001:db8:101::2"
-        run_cmd "$IP -6 ro prepend 2001:db8:104::/64 via 2001:db8:103::2"
-        check_route6 "2001:db8:104::/64 via 2001:db8:101::2 dev veth1 metric 1024 2001:db8:104::/64 via 2001:db8:103::2 dev veth3 metric 1024"
-        log_test $? 0 "Add new route for existing prefix (w/o NLM_F_EXCL)"
        # route append with same prefix adds a new route
        # - iproute2 sets NLM_F_CREATE | NLM_F_APPEND
        add_route6 "2001:db8:104::/64" "via 2001:db8:101::2"
@@ -754,27 +747,6 @@ ipv6_rt_add()
        check_route6 "2001:db8:104::/64 metric 1024 nexthop via 2001:db8:101::2 dev veth1 weight 1 nexthop via 2001:db8:103::2 dev veth3 weight 1"
        log_test $? 0 "Append nexthop to existing route - gw"
-        add_route6 "2001:db8:104::/64" "via 2001:db8:101::2"
-        run_cmd "$IP -6 ro append 2001:db8:104::/64 dev veth3"
-        check_route6 "2001:db8:104::/64 metric 1024 nexthop via 2001:db8:101::2 dev veth1 weight 1 nexthop dev veth3 weight 1"
-        log_test $? 0 "Append nexthop to existing route - dev only"
-        # multipath route can not have a nexthop that is a reject route
-        add_route6 "2001:db8:104::/64" "via 2001:db8:101::2"
-        run_cmd "$IP -6 ro append unreachable 2001:db8:104::/64"
-        log_test $? 2 "Append nexthop to existing route - reject route"
-        # reject route can not be converted to multipath route
-        run_cmd "$IP -6 ro flush 2001:db8:104::/64"
-        run_cmd "$IP -6 ro add unreachable 2001:db8:104::/64"
-        run_cmd "$IP -6 ro append 2001:db8:104::/64 via 2001:db8:103::2"
-        log_test $? 2 "Append nexthop to existing reject route - gw"
-        run_cmd "$IP -6 ro flush 2001:db8:104::/64"
-        run_cmd "$IP -6 ro add unreachable 2001:db8:104::/64"
-        run_cmd "$IP -6 ro append 2001:db8:104::/64 dev veth3"
-        log_test $? 2 "Append nexthop to existing reject route - dev only"
        # insert mpath directly
        add_route6 "2001:db8:104::/64" "nexthop via 2001:db8:101::2 nexthop via 2001:db8:103::2"
        check_route6  "2001:db8:104::/64 metric 1024 nexthop via 2001:db8:101::2 dev veth1 weight 1 nexthop via 2001:db8:103::2 dev veth3 weight 1"
@@ -819,13 +791,6 @@ ipv6_rt_replace_single()
        check_route6 "2001:db8:104::/64 metric 1024 nexthop via 2001:db8:101::3 dev veth1 weight 1 nexthop via 2001:db8:103::2 dev veth3 weight 1"
        log_test $? 0 "Single path with multipath"
-        # single path with reject
-        #
-        add_initial_route6 "nexthop via 2001:db8:101::2"
-        run_cmd "$IP -6 ro replace unreachable 2001:db8:104::/64"
-        check_route6 "unreachable 2001:db8:104::/64 dev lo metric 1024"
-        log_test $? 0 "Single path with reject route"
        # single path with single path using MULTIPATH attribute
        #
        add_initial_route6 "via 2001:db8:101::2"
@@ -873,12 +838,6 @@ ipv6_rt_replace_mpath()
        check_route6 "2001:db8:104::/64 via 2001:db8:101::3 dev veth1 metric 1024"
        log_test $? 0 "Multipath with single path via multipath attribute"
-        # multipath with reject
-        add_initial_route6 "nexthop via 2001:db8:101::2 nexthop via 2001:db8:103::2"
-        run_cmd "$IP -6 ro replace unreachable 2001:db8:104::/64"
-        check_route6 "unreachable 2001:db8:104::/64 dev lo metric 1024"
-        log_test $? 0 "Multipath with reject route"
        # route replace fails - invalid nexthop 1
        add_initial_route6 "nexthop via 2001:db8:101::2 nexthop via 2001:db8:103::2"
        run_cmd "$IP -6 ro replace 2001:db8:104::/64 nexthop via 2001:db8:111::3 nexthop via 2001:db8:103::3"
diff --git a/tools/testing/selftests/net/udpgso_bench.sh b/tools/testing/selftests/net/udpgso_bench.sh
index 792fa4d0285e..850767befa47 100755
--- a/tools/testing/selftests/net/udpgso_bench.sh
+++ b/tools/testing/selftests/net/udpgso_bench.sh
@@ -35,9 +35,6 @@ run_udp() {
        echo "udp gso"
        run_in_netns ${args} -S
-        echo "udp gso zerocopy"
-        run_in_netns ${args} -S -z
 }
 run_tcp() {
author	Linus Torvalds <torvalds@linux-foundation.org>	2018-07-18 22:32:54 -0400
committer	Linus Torvalds <torvalds@linux-foundation.org>	2018-07-18 22:32:54 -0400
commit	024ddc0ce1049298bd3cae60ae45d9c5f0fb8b9c (patch)
tree	18b44ede17871ded93577c317f3afe3db122ba33
parent	05df204549c510c7c56e58d25098c448998a0cd5 (diff)
parent	e56b8ce363a36fb7b74b80aaa5cc9084f2c908b4 (diff)