Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Pull networking fixes from David Miller:

 1) Fix route leak in xfrm_bundle_create().

 2) In mac80211, validate user rate mask before configuring it. From
    Johannes Berg.

 3) Properly enforce memory limits in fair queueing code, from Toke
    Hoiland-Jorgensen.

 4) Fix lockdep splat in inet_csk_route_req(), from Eric Dumazet.

 5) Fix TSO header allocation and management in mvpp2 driver, from Yan
    Markman.

 6) Don't take socket lock in BH handler in strparser code, from Tom
    Herbert.

 7) Don't show sockets from other namespaces in AF_UNIX code, from
    Andrei Vagin.

 8) Fix double free in error path of tap_open(), from Girish Moodalbail.

 9) Fix TX map failure path in igb and ixgbe, from Jean-Philippe Brucker
    and Alexander Duyck.

10) Fix DCB mode programming in stmmac driver, from Jose Abreu.

11) Fix err_count handling in various tunnels (ipip, ip6_gre). From Xin
    Long.

12) Properly align SKB head before building SKB in tuntap, from Jason
    Wang.

13) Avoid matching qdiscs with a zero handle during lookups, from Cong
    Wang.

14) Fix various endianness bugs in sctp, from Xin Long.

15) Fix tc filter callback races and add selftests which trigger the
    problem, from Cong Wang.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (73 commits)
  selftests: Introduce a new test case to tc testsuite
  selftests: Introduce a new script to generate tc batch file
  net_sched: fix call_rcu() race on act_sample module removal
  net_sched: add rtnl assertion to tcf_exts_destroy()
  net_sched: use tcf_queue_work() in tcindex filter
  net_sched: use tcf_queue_work() in rsvp filter
  net_sched: use tcf_queue_work() in route filter
  net_sched: use tcf_queue_work() in u32 filter
  net_sched: use tcf_queue_work() in matchall filter
  net_sched: use tcf_queue_work() in fw filter
  net_sched: use tcf_queue_work() in flower filter
  net_sched: use tcf_queue_work() in flow filter
  net_sched: use tcf_queue_work() in cgroup filter
  net_sched: use tcf_queue_work() in bpf filter
  net_sched: use tcf_queue_work() in basic filter
  net_sched: introduce a workqueue for RCU callbacks of tc filter
  sctp: fix some type cast warnings introduced since very beginning
  sctp: fix a type cast warnings that causes a_rwnd gets the wrong value
  sctp: fix some type cast warnings introduced by transport rhashtable
  sctp: fix some type cast warnings introduced by stream reconf
  ...

22 files changed, 299 insertions, 150 deletions

diff --git a/drivers/net/can/sun4i_can.c b/drivers/net/can/sun4i_can.c
index 68ef0a4cd821..b0c80859f746 100644
--- a/drivers/net/can/sun4i_can.c
+++ b/drivers/net/can/sun4i_can.c
@@ -342,7 +342,7 @@ static int sun4i_can_start(struct net_device *dev)
 
         /* enter the selected mode */
         mod_reg_val = readl(priv->base + SUN4I_REG_MSEL_ADDR);
-        if (priv->can.ctrlmode & CAN_CTRLMODE_PRESUME_ACK)
+        if (priv->can.ctrlmode & CAN_CTRLMODE_LOOPBACK)
                 mod_reg_val |= SUN4I_MSEL_LOOPBACK_MODE;
         else if (priv->can.ctrlmode & CAN_CTRLMODE_LISTENONLY)
                 mod_reg_val |= SUN4I_MSEL_LISTEN_ONLY_MODE;
@@ -811,7 +811,6 @@ static int sun4ican_probe(struct platform_device *pdev)
         priv->can.ctrlmode_supported = CAN_CTRLMODE_BERR_REPORTING |
                                        CAN_CTRLMODE_LISTENONLY |
                                        CAN_CTRLMODE_LOOPBACK |
-                                       CAN_CTRLMODE_PRESUME_ACK |
                                        CAN_CTRLMODE_3_SAMPLES;
         priv->base = addr;
         priv->clk = clk;
diff --git a/drivers/net/can/usb/kvaser_usb.c b/drivers/net/can/usb/kvaser_usb.c
index 18cc529fb807..9b18d96ef526 100644
--- a/drivers/net/can/usb/kvaser_usb.c
+++ b/drivers/net/can/usb/kvaser_usb.c
@@ -137,6 +137,7 @@ static inline bool kvaser_is_usbcan(const struct usb_device_id *id)
 #define CMD_RESET_ERROR_COUNTER         49
 #define CMD_TX_ACKNOWLEDGE              50
 #define CMD_CAN_ERROR_EVENT             51
+#define CMD_FLUSH_QUEUE_REPLY           68
 
 #define CMD_LEAF_USB_THROTTLE           77
 #define CMD_LEAF_LOG_MESSAGE            106
@@ -1301,6 +1302,11 @@ static void kvaser_usb_handle_message(const struct kvaser_usb *dev,
                         goto warn;
                 break;
 
+        case CMD_FLUSH_QUEUE_REPLY:
+                if (dev->family != KVASER_LEAF)
+                        goto warn;
+                break;
+
         default:
 warn:           dev_warn(dev->udev->dev.parent,
                          "Unhandled message (%d)\n", msg->id);
@@ -1609,7 +1615,8 @@ static int kvaser_usb_close(struct net_device *netdev)
         if (err)
                 netdev_warn(netdev, "Cannot flush queue, error %d\n", err);
 
-        if (kvaser_usb_send_simple_msg(dev, CMD_RESET_CHIP, priv->channel))
+        err = kvaser_usb_send_simple_msg(dev, CMD_RESET_CHIP, priv->channel);
+        if (err)
                 netdev_warn(netdev, "Cannot reset card, error %d\n", err);
 
         err = kvaser_usb_stop_chip(priv);
diff --git a/drivers/net/ethernet/intel/e1000/e1000_ethtool.c b/drivers/net/ethernet/intel/e1000/e1000_ethtool.c
index ec8aa4562cc9..3b3983a1ffbb 100644
--- a/drivers/net/ethernet/intel/e1000/e1000_ethtool.c
+++ b/drivers/net/ethernet/intel/e1000/e1000_ethtool.c
@@ -1824,11 +1824,12 @@ static void e1000_get_ethtool_stats(struct net_device *netdev,
 {
         struct e1000_adapter *adapter = netdev_priv(netdev);
         int i;
-        char *p = NULL;
         const struct e1000_stats *stat = e1000_gstrings_stats;
 
         e1000_update_stats(adapter);
-        for (i = 0; i < E1000_GLOBAL_STATS_LEN; i++) {
+        for (i = 0; i < E1000_GLOBAL_STATS_LEN; i++, stat++) {
+                char *p;
+
                 switch (stat->type) {
                 case NETDEV_STATS:
                         p = (char *)netdev + stat->stat_offset;
@@ -1839,15 +1840,13 @@ static void e1000_get_ethtool_stats(struct net_device *netdev,
                 default:
                         WARN_ONCE(1, "Invalid E1000 stat type: %u index %d\n",
                                   stat->type, i);
-                        break;
+                        continue;
                 }
 
                 if (stat->sizeof_stat == sizeof(u64))
                         data[i] = *(u64 *)p;
                 else
                         data[i] = *(u32 *)p;
-
-                stat++;
         }
 /* BUG_ON(i != E1000_STATS_LEN); */
 }
diff --git a/drivers/net/ethernet/intel/e1000/e1000_main.c b/drivers/net/ethernet/intel/e1000/e1000_main.c
index 98375e1e1185..1982f7917a8d 100644
--- a/drivers/net/ethernet/intel/e1000/e1000_main.c
+++ b/drivers/net/ethernet/intel/e1000/e1000_main.c
@@ -520,8 +520,6 @@ void e1000_down(struct e1000_adapter *adapter)
         struct net_device *netdev = adapter->netdev;
         u32 rctl, tctl;
 
-        netif_carrier_off(netdev);
-
         /* disable receives in the hardware */
         rctl = er32(RCTL);
         ew32(RCTL, rctl & ~E1000_RCTL_EN);
@@ -537,6 +535,15 @@ void e1000_down(struct e1000_adapter *adapter)
         E1000_WRITE_FLUSH();
         msleep(10);
 
+        /* Set the carrier off after transmits have been disabled in the
+         * hardware, to avoid race conditions with e1000_watchdog() (which
+         * may be running concurrently to us, checking for the carrier
+         * bit to decide whether it should enable transmits again). Such
+         * a race condition would result into transmission being disabled
+         * in the hardware until the next IFF_DOWN+IFF_UP cycle.
+         */
+        netif_carrier_off(netdev);
+
         napi_disable(&adapter->napi);
 
         e1000_irq_disable(adapter);
diff --git a/drivers/net/ethernet/intel/i40e/i40e_txrx.c b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
index 2756131495f0..120c68f78951 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_txrx.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
@@ -2102,6 +2102,7 @@ static int i40e_clean_rx_irq(struct i40e_ring *rx_ring, int budget)
 
                 if (unlikely(i40e_rx_is_programming_status(qword))) {
                         i40e_clean_programming_status(rx_ring, rx_desc, qword);
+                        cleaned_count++;
                         continue;
                 }
                 size = (qword & I40E_RXD_QW1_LENGTH_PBUF_MASK) >>
@@ -2269,7 +2270,7 @@ static inline void i40e_update_enable_itr(struct i40e_vsi *vsi,
                 goto enable_int;
         }
 
-        if (ITR_IS_DYNAMIC(tx_itr_setting)) {
+        if (ITR_IS_DYNAMIC(rx_itr_setting)) {
                 rx = i40e_set_new_dynamic_itr(&q_vector->rx);
                 rxval = i40e_buildreg_itr(I40E_RX_ITR, q_vector->rx.itr);
         }
diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
index fd4a46b03cc8..ea69af267d63 100644
--- a/drivers/net/ethernet/intel/igb/igb_main.c
+++ b/drivers/net/ethernet/intel/igb/igb_main.c
@@ -5326,7 +5326,7 @@ dma_error:
                                        DMA_TO_DEVICE);
                 dma_unmap_len_set(tx_buffer, len, 0);
 
-                if (i--)
+                if (i-- == 0)
                         i += tx_ring->count;
                 tx_buffer = &tx_ring->tx_buffer_info[i];
         }
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
index 4d76afd13868..6d5f31e94358 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
@@ -8020,29 +8020,23 @@ static int ixgbe_tx_map(struct ixgbe_ring *tx_ring,
         return 0;
 dma_error:
         dev_err(tx_ring->dev, "TX DMA map failed\n");
-        tx_buffer = &tx_ring->tx_buffer_info[i];
 
         /* clear dma mappings for failed tx_buffer_info map */
-        while (tx_buffer != first) {
+        for (;;) {
+                tx_buffer = &tx_ring->tx_buffer_info[i];
                 if (dma_unmap_len(tx_buffer, len))
                         dma_unmap_page(tx_ring->dev,
                                        dma_unmap_addr(tx_buffer, dma),
                                        dma_unmap_len(tx_buffer, len),
                                        DMA_TO_DEVICE);
                 dma_unmap_len_set(tx_buffer, len, 0);
-
-                if (i--)
+                if (tx_buffer == first)
+                        break;
+                if (i == 0)
                         i += tx_ring->count;
-                tx_buffer = &tx_ring->tx_buffer_info[i];
+                i--;
         }
 
-        if (dma_unmap_len(tx_buffer, len))
-                dma_unmap_single(tx_ring->dev,
-                                 dma_unmap_addr(tx_buffer, dma),
-                                 dma_unmap_len(tx_buffer, len),
-                                 DMA_TO_DEVICE);
-        dma_unmap_len_set(tx_buffer, len, 0);
-
         dev_kfree_skb_any(first->skb);
         first->skb = NULL;
 
diff --git a/drivers/net/ethernet/marvell/mvpp2.c b/drivers/net/ethernet/marvell/mvpp2.c
index 9c86cb7cb988..a37af5813f33 100644
--- a/drivers/net/ethernet/marvell/mvpp2.c
+++ b/drivers/net/ethernet/marvell/mvpp2.c
@@ -1167,6 +1167,11 @@ struct mvpp2_bm_pool {
         u32 port_map;
 };
 
+#define IS_TSO_HEADER(txq_pcpu, addr) \
+        ((addr) >= (txq_pcpu)->tso_headers_dma && \
+         (addr) < (txq_pcpu)->tso_headers_dma + \
+         (txq_pcpu)->size * TSO_HEADER_SIZE)
+
 /* Queue modes */
 #define MVPP2_QDIST_SINGLE_MODE 0
 #define MVPP2_QDIST_MULTI_MODE  1
@@ -1534,7 +1539,7 @@ static bool mvpp2_prs_tcam_data_cmp(struct mvpp2_prs_entry *pe, int offs,
         int off = MVPP2_PRS_TCAM_DATA_BYTE(offs);
         u16 tcam_data;
 
-        tcam_data = (8 << pe->tcam.byte[off + 1]) | pe->tcam.byte[off];
+        tcam_data = (pe->tcam.byte[off + 1] << 8) | pe->tcam.byte[off];
         if (tcam_data != data)
                 return false;
         return true;
@@ -2609,8 +2614,8 @@ static void mvpp2_prs_mac_init(struct mvpp2 *priv)
         /* place holders only - no ports */
         mvpp2_prs_mac_drop_all_set(priv, 0, false);
         mvpp2_prs_mac_promisc_set(priv, 0, false);
-        mvpp2_prs_mac_multi_set(priv, MVPP2_PE_MAC_MC_ALL, 0, false);
-        mvpp2_prs_mac_multi_set(priv, MVPP2_PE_MAC_MC_IP6, 0, false);
+        mvpp2_prs_mac_multi_set(priv, 0, MVPP2_PE_MAC_MC_ALL, false);
+        mvpp2_prs_mac_multi_set(priv, 0, MVPP2_PE_MAC_MC_IP6, false);
 }
 
 /* Set default entries for various types of dsa packets */
@@ -3391,7 +3396,7 @@ mvpp2_prs_mac_da_range_find(struct mvpp2 *priv, int pmap, const u8 *da,
         struct mvpp2_prs_entry *pe;
         int tid;
 
-        pe = kzalloc(sizeof(*pe), GFP_KERNEL);
+        pe = kzalloc(sizeof(*pe), GFP_ATOMIC);
         if (!pe)
                 return NULL;
         mvpp2_prs_tcam_lu_set(pe, MVPP2_PRS_LU_MAC);
@@ -3453,7 +3458,7 @@ static int mvpp2_prs_mac_da_accept(struct mvpp2 *priv, int port,
                 if (tid < 0)
                         return tid;
 
-                pe = kzalloc(sizeof(*pe), GFP_KERNEL);
+                pe = kzalloc(sizeof(*pe), GFP_ATOMIC);
                 if (!pe)
                         return -ENOMEM;
                 mvpp2_prs_tcam_lu_set(pe, MVPP2_PRS_LU_MAC);
@@ -5321,8 +5326,9 @@ static void mvpp2_txq_bufs_free(struct mvpp2_port *port,
                 struct mvpp2_txq_pcpu_buf *tx_buf =
                         txq_pcpu->buffs + txq_pcpu->txq_get_index;
 
-                dma_unmap_single(port->dev->dev.parent, tx_buf->dma,
-                                 tx_buf->size, DMA_TO_DEVICE);
+                if (!IS_TSO_HEADER(txq_pcpu, tx_buf->dma))
+                        dma_unmap_single(port->dev->dev.parent, tx_buf->dma,
+                                         tx_buf->size, DMA_TO_DEVICE);
                 if (tx_buf->skb)
                         dev_kfree_skb_any(tx_buf->skb);
 
@@ -5609,7 +5615,7 @@ static int mvpp2_txq_init(struct mvpp2_port *port,
 
                 txq_pcpu->tso_headers =
                         dma_alloc_coherent(port->dev->dev.parent,
-                                           MVPP2_AGGR_TXQ_SIZE * TSO_HEADER_SIZE,
+                                           txq_pcpu->size * TSO_HEADER_SIZE,
                                            &txq_pcpu->tso_headers_dma,
                                            GFP_KERNEL);
                 if (!txq_pcpu->tso_headers)
@@ -5623,7 +5629,7 @@ cleanup:
                 kfree(txq_pcpu->buffs);
 
                 dma_free_coherent(port->dev->dev.parent,
-                                  MVPP2_AGGR_TXQ_SIZE * MVPP2_DESC_ALIGNED_SIZE,
+                                  txq_pcpu->size * TSO_HEADER_SIZE,
                                   txq_pcpu->tso_headers,
                                   txq_pcpu->tso_headers_dma);
         }
@@ -5647,7 +5653,7 @@ static void mvpp2_txq_deinit(struct mvpp2_port *port,
                 kfree(txq_pcpu->buffs);
 
                 dma_free_coherent(port->dev->dev.parent,
-                                  MVPP2_AGGR_TXQ_SIZE * MVPP2_DESC_ALIGNED_SIZE,
+                                  txq_pcpu->size * TSO_HEADER_SIZE,
                                   txq_pcpu->tso_headers,
                                   txq_pcpu->tso_headers_dma);
         }
@@ -6212,12 +6218,15 @@ static inline void
 tx_desc_unmap_put(struct mvpp2_port *port, struct mvpp2_tx_queue *txq,
                   struct mvpp2_tx_desc *desc)
 {
+        struct mvpp2_txq_pcpu *txq_pcpu = this_cpu_ptr(txq->pcpu);
+
         dma_addr_t buf_dma_addr =
                 mvpp2_txdesc_dma_addr_get(port, desc);
         size_t buf_sz =
                 mvpp2_txdesc_size_get(port, desc);
-        dma_unmap_single(port->dev->dev.parent, buf_dma_addr,
-                         buf_sz, DMA_TO_DEVICE);
+        if (!IS_TSO_HEADER(txq_pcpu, buf_dma_addr))
+                dma_unmap_single(port->dev->dev.parent, buf_dma_addr,
+                                 buf_sz, DMA_TO_DEVICE);
         mvpp2_txq_desc_put(txq);
 }
 
@@ -6490,7 +6499,7 @@ out:
         }
 
         /* Finalize TX processing */
-        if (txq_pcpu->count >= txq->done_pkts_coal)
+        if (!port->has_tx_irqs && txq_pcpu->count >= txq->done_pkts_coal)
                 mvpp2_txq_done(port, txq, txq_pcpu);
 
         /* Set the timer in case not all frags were processed */
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/dev.c b/drivers/net/ethernet/mellanox/mlx5/core/dev.c
index ff60cf7342ca..fc281712869b 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/dev.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/dev.c
@@ -77,35 +77,41 @@ static void add_delayed_event(struct mlx5_priv *priv,
         list_add_tail(&delayed_event->list, &priv->waiting_events_list);
 }
 
-static void fire_delayed_event_locked(struct mlx5_device_context *dev_ctx,
-                                      struct mlx5_core_dev *dev,
-                                      struct mlx5_priv *priv)
+static void delayed_event_release(struct mlx5_device_context *dev_ctx,
+                                  struct mlx5_priv *priv)
 {
+        struct mlx5_core_dev *dev = container_of(priv, struct mlx5_core_dev, priv);
         struct mlx5_delayed_event *de;
         struct mlx5_delayed_event *n;
+        struct list_head temp;
 
-        /* stop delaying events */
-        priv->is_accum_events = false;
+        INIT_LIST_HEAD(&temp);
+
+        spin_lock_irq(&priv->ctx_lock);
 
-        /* fire all accumulated events before new event comes */
-        list_for_each_entry_safe(de, n, &priv->waiting_events_list, list) {
+        priv->is_accum_events = false;
+        list_splice_init(&priv->waiting_events_list, &temp);
+        if (!dev_ctx->context)
+                goto out;
+        list_for_each_entry_safe(de, n, &priv->waiting_events_list, list)
                 dev_ctx->intf->event(dev, dev_ctx->context, de->event, de->param);
+
+out:
+        spin_unlock_irq(&priv->ctx_lock);
+
+        list_for_each_entry_safe(de, n, &temp, list) {
                 list_del(&de->list);
                 kfree(de);
         }
 }
 
-static void cleanup_delayed_evets(struct mlx5_priv *priv)
+/* accumulating events that can come after mlx5_ib calls to
+ * ib_register_device, till adding that interface to the events list.
+ */
+static void delayed_event_start(struct mlx5_priv *priv)
 {
-        struct mlx5_delayed_event *de;
-        struct mlx5_delayed_event *n;
-
         spin_lock_irq(&priv->ctx_lock);
-        priv->is_accum_events = false;
-        list_for_each_entry_safe(de, n, &priv->waiting_events_list, list) {
-                list_del(&de->list);
-                kfree(de);
-        }
+        priv->is_accum_events = true;
         spin_unlock_irq(&priv->ctx_lock);
 }
 
@@ -122,11 +128,8 @@ void mlx5_add_device(struct mlx5_interface *intf, struct mlx5_priv *priv)
                 return;
 
         dev_ctx->intf = intf;
-        /* accumulating events that can come after mlx5_ib calls to
-         * ib_register_device, till adding that interface to the events list.
-         */
 
-        priv->is_accum_events = true;
+        delayed_event_start(priv);
 
         dev_ctx->context = intf->add(dev);
         set_bit(MLX5_INTERFACE_ADDED, &dev_ctx->state);
@@ -137,8 +140,6 @@ void mlx5_add_device(struct mlx5_interface *intf, struct mlx5_priv *priv)
                 spin_lock_irq(&priv->ctx_lock);
                 list_add_tail(&dev_ctx->list, &priv->ctx_list);
 
-                fire_delayed_event_locked(dev_ctx, dev, priv);
-
 #ifdef CONFIG_INFINIBAND_ON_DEMAND_PAGING
                 if (dev_ctx->intf->pfault) {
                         if (priv->pfault) {
@@ -150,11 +151,12 @@ void mlx5_add_device(struct mlx5_interface *intf, struct mlx5_priv *priv)
                 }
 #endif
                 spin_unlock_irq(&priv->ctx_lock);
-        } else {
-                kfree(dev_ctx);
-                 /* delete all accumulated events */
-                cleanup_delayed_evets(priv);
         }
+
+        delayed_event_release(dev_ctx, priv);
+
+        if (!dev_ctx->context)
+                kfree(dev_ctx);
 }
 
 static struct mlx5_device_context *mlx5_get_device(struct mlx5_interface *intf,
@@ -205,17 +207,21 @@ static void mlx5_attach_interface(struct mlx5_interface *intf, struct mlx5_priv
         if (!dev_ctx)
                 return;
 
+        delayed_event_start(priv);
         if (intf->attach) {
                 if (test_bit(MLX5_INTERFACE_ATTACHED, &dev_ctx->state))
-                        return;
+                        goto out;
                 intf->attach(dev, dev_ctx->context);
                 set_bit(MLX5_INTERFACE_ATTACHED, &dev_ctx->state);
         } else {
                 if (test_bit(MLX5_INTERFACE_ADDED, &dev_ctx->state))
-                        return;
+                        goto out;
                 dev_ctx->context = intf->add(dev);
                 set_bit(MLX5_INTERFACE_ADDED, &dev_ctx->state);
         }
+
+out:
+        delayed_event_release(dev_ctx, priv);
 }
 
 void mlx5_attach_device(struct mlx5_core_dev *dev)
@@ -414,8 +420,14 @@ void mlx5_core_event(struct mlx5_core_dev *dev, enum mlx5_dev_event event,
         if (priv->is_accum_events)
                 add_delayed_event(priv, dev, event, param);
 
+        /* After mlx5_detach_device, the dev_ctx->intf is still set and dev_ctx is
+         * still in priv->ctx_list. In this case, only notify the dev_ctx if its
+         * ADDED or ATTACHED bit are set.
+         */
         list_for_each_entry(dev_ctx, &priv->ctx_list, list)
-                if (dev_ctx->intf->event)
+                if (dev_ctx->intf->event &&
+                    (test_bit(MLX5_INTERFACE_ADDED, &dev_ctx->state) ||
+                     test_bit(MLX5_INTERFACE_ATTACHED, &dev_ctx->state)))
                         dev_ctx->intf->event(dev, dev_ctx->context, event, param);
 
         spin_unlock_irqrestore(&priv->ctx_lock, flags);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
index c1d384fca4dc..51c4cc00a186 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
@@ -41,6 +41,11 @@
 #define MLX5E_CEE_STATE_UP    1
 #define MLX5E_CEE_STATE_DOWN  0
 
+enum {
+        MLX5E_VENDOR_TC_GROUP_NUM = 7,
+        MLX5E_LOWEST_PRIO_GROUP   = 0,
+};
+
 /* If dcbx mode is non-host set the dcbx mode to host.
  */
 static int mlx5e_dcbnl_set_dcbx_mode(struct mlx5e_priv *priv,
@@ -85,6 +90,9 @@ static int mlx5e_dcbnl_ieee_getets(struct net_device *netdev,
 {
         struct mlx5e_priv *priv = netdev_priv(netdev);
         struct mlx5_core_dev *mdev = priv->mdev;
+        u8 tc_group[IEEE_8021QAZ_MAX_TCS];
+        bool is_tc_group_6_exist = false;
+        bool is_zero_bw_ets_tc = false;
         int err = 0;
         int i;
 
@@ -96,37 +104,64 @@ static int mlx5e_dcbnl_ieee_getets(struct net_device *netdev,
                 err = mlx5_query_port_prio_tc(mdev, i, &ets->prio_tc[i]);
                 if (err)
                         return err;
-        }
 
-        for (i = 0; i < ets->ets_cap; i++) {
+                err = mlx5_query_port_tc_group(mdev, i, &tc_group[i]);
+                if (err)
+                        return err;
+
                 err = mlx5_query_port_tc_bw_alloc(mdev, i, &ets->tc_tx_bw[i]);
                 if (err)
                         return err;
+
+                if (ets->tc_tx_bw[i] < MLX5E_MAX_BW_ALLOC &&
+                    tc_group[i] == (MLX5E_LOWEST_PRIO_GROUP + 1))
+                        is_zero_bw_ets_tc = true;
+
+                if (tc_group[i] == (MLX5E_VENDOR_TC_GROUP_NUM - 1))
+                        is_tc_group_6_exist = true;
+        }
+
+        /* Report 0% ets tc if exits*/
+        if (is_zero_bw_ets_tc) {
+                for (i = 0; i < ets->ets_cap; i++)
+                        if (tc_group[i] == MLX5E_LOWEST_PRIO_GROUP)
+                                ets->tc_tx_bw[i] = 0;
+        }
+
+        /* Update tc_tsa based on fw setting*/
+        for (i = 0; i < ets->ets_cap; i++) {
                 if (ets->tc_tx_bw[i] < MLX5E_MAX_BW_ALLOC)
                         priv->dcbx.tc_tsa[i] = IEEE_8021QAZ_TSA_ETS;
+                else if (tc_group[i] == MLX5E_VENDOR_TC_GROUP_NUM &&
+                         !is_tc_group_6_exist)
+                        priv->dcbx.tc_tsa[i] = IEEE_8021QAZ_TSA_VENDOR;
         }
-
         memcpy(ets->tc_tsa, priv->dcbx.tc_tsa, sizeof(ets->tc_tsa));
 
         return err;
 }
 
-enum {
-        MLX5E_VENDOR_TC_GROUP_NUM = 7,
-        MLX5E_ETS_TC_GROUP_NUM    = 0,
-};
-
 static void mlx5e_build_tc_group(struct ieee_ets *ets, u8 *tc_group, int max_tc)
 {
         bool any_tc_mapped_to_ets = false;
+        bool ets_zero_bw = false;
         int strict_group;
         int i;
 
-        for (i = 0; i <= max_tc; i++)
-                if (ets->tc_tsa[i] == IEEE_8021QAZ_TSA_ETS)
+        for (i = 0; i <= max_tc; i++) {
+                if (ets->tc_tsa[i] == IEEE_8021QAZ_TSA_ETS) {
                         any_tc_mapped_to_ets = true;
+                        if (!ets->tc_tx_bw[i])
+                                ets_zero_bw = true;
+                }
+        }
 
-        strict_group = any_tc_mapped_to_ets ? 1 : 0;
+        /* strict group has higher priority than ets group */
+        strict_group = MLX5E_LOWEST_PRIO_GROUP;
+        if (any_tc_mapped_to_ets)
+                strict_group++;
+        if (ets_zero_bw)
+                strict_group++;
 
         for (i = 0; i <= max_tc; i++) {
                 switch (ets->tc_tsa[i]) {
@@ -137,7 +172,9 @@ static void mlx5e_build_tc_group(struct ieee_ets *ets, u8 *tc_group, int max_tc)
                         tc_group[i] = strict_group++;
                         break;
                 case IEEE_8021QAZ_TSA_ETS:
-                        tc_group[i] = MLX5E_ETS_TC_GROUP_NUM;
+                        tc_group[i] = MLX5E_LOWEST_PRIO_GROUP;
+                        if (ets->tc_tx_bw[i] && ets_zero_bw)
+                                tc_group[i] = MLX5E_LOWEST_PRIO_GROUP + 1;
                         break;
                 }
         }
@@ -146,9 +183,23 @@ static void mlx5e_build_tc_group(struct ieee_ets *ets, u8 *tc_group, int max_tc)
 static void mlx5e_build_tc_tx_bw(struct ieee_ets *ets, u8 *tc_tx_bw,
                                  u8 *tc_group, int max_tc)
 {
+        int bw_for_ets_zero_bw_tc = 0;
+        int last_ets_zero_bw_tc = -1;
+        int num_ets_zero_bw = 0;
         int i;
 
         for (i = 0; i <= max_tc; i++) {
+                if (ets->tc_tsa[i] == IEEE_8021QAZ_TSA_ETS &&
+                    !ets->tc_tx_bw[i]) {
+                        num_ets_zero_bw++;
+                        last_ets_zero_bw_tc = i;
+                }
+        }
+
+        if (num_ets_zero_bw)
+                bw_for_ets_zero_bw_tc = MLX5E_MAX_BW_ALLOC / num_ets_zero_bw;
+
+        for (i = 0; i <= max_tc; i++) {
                 switch (ets->tc_tsa[i]) {
                 case IEEE_8021QAZ_TSA_VENDOR:
                         tc_tx_bw[i] = MLX5E_MAX_BW_ALLOC;
@@ -157,12 +208,26 @@ static void mlx5e_build_tc_tx_bw(struct ieee_ets *ets, u8 *tc_tx_bw,
                         tc_tx_bw[i] = MLX5E_MAX_BW_ALLOC;
                         break;
                 case IEEE_8021QAZ_TSA_ETS:
-                        tc_tx_bw[i] = ets->tc_tx_bw[i];
+                        tc_tx_bw[i] = ets->tc_tx_bw[i] ?
+                                      ets->tc_tx_bw[i] :
+                                      bw_for_ets_zero_bw_tc;
                         break;
                 }
         }
+
+        /* Make sure the total bw for ets zero bw group is 100% */
+        if (last_ets_zero_bw_tc != -1)
+                tc_tx_bw[last_ets_zero_bw_tc] +=
+                        MLX5E_MAX_BW_ALLOC % num_ets_zero_bw;
 }
 
+/* If there are ETS BW 0,
+ *   Set ETS group # to 1 for all ETS non zero BW tcs. Their sum must be 100%.
+ *   Set group #0 to all the ETS BW 0 tcs and
+ *     equally splits the 100% BW between them
+ *   Report both group #0 and #1 as ETS type.
+ *     All the tcs in group #0 will be reported with 0% BW.
+ */
 int mlx5e_dcbnl_ieee_setets_core(struct mlx5e_priv *priv, struct ieee_ets *ets)
 {
         struct mlx5_core_dev *mdev = priv->mdev;
@@ -188,7 +253,6 @@ int mlx5e_dcbnl_ieee_setets_core(struct mlx5e_priv *priv, struct ieee_ets *ets)
                 return err;
 
         memcpy(priv->dcbx.tc_tsa, ets->tc_tsa, sizeof(ets->tc_tsa));
-
         return err;
 }
 
@@ -209,17 +273,9 @@ static int mlx5e_dbcnl_validate_ets(struct net_device *netdev,
         }
 
         /* Validate Bandwidth Sum */
-        for (i = 0; i < IEEE_8021QAZ_MAX_TCS; i++) {
-                if (ets->tc_tsa[i] == IEEE_8021QAZ_TSA_ETS) {
-                        if (!ets->tc_tx_bw[i]) {
-                                netdev_err(netdev,
-                                           "Failed to validate ETS: BW 0 is illegal\n");
-                                return -EINVAL;
-                        }
-
+        for (i = 0; i < IEEE_8021QAZ_MAX_TCS; i++)
+                if (ets->tc_tsa[i] == IEEE_8021QAZ_TSA_ETS)
                         bw_sum += ets->tc_tx_bw[i];
-                }
-        }
 
         if (bw_sum != 0 && bw_sum != 100) {
                 netdev_err(netdev,
@@ -533,8 +589,7 @@ static void mlx5e_dcbnl_getpgtccfgtx(struct net_device *netdev,
 static void mlx5e_dcbnl_getpgbwgcfgtx(struct net_device *netdev,
                                       int pgid, u8 *bw_pct)
 {
-        struct mlx5e_priv *priv = netdev_priv(netdev);
-        struct mlx5_core_dev *mdev = priv->mdev;
+        struct ieee_ets ets;
 
         if (pgid >= CEE_DCBX_MAX_PGS) {
                 netdev_err(netdev,
@@ -542,8 +597,8 @@ static void mlx5e_dcbnl_getpgbwgcfgtx(struct net_device *netdev,
                 return;
         }
 
-        if (mlx5_query_port_tc_bw_alloc(mdev, pgid, bw_pct))
-                *bw_pct = 0;
+        mlx5e_dcbnl_ieee_getets(netdev, &ets);
+        *bw_pct = ets.tc_tx_bw[pgid];
 }
 
 static void mlx5e_dcbnl_setpfccfg(struct net_device *netdev,
@@ -739,8 +794,6 @@ static void mlx5e_ets_init(struct mlx5e_priv *priv)
                 ets.prio_tc[i] = i;
         }
 
-        memcpy(priv->dcbx.tc_tsa, ets.tc_tsa, sizeof(ets.tc_tsa));
-
         /* tclass[prio=0]=1, tclass[prio=1]=0, tclass[prio=i]=i (for i>1) */
         ets.prio_tc[0] = 1;
         ets.prio_tc[1] = 0;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
index 1aa2028ed995..9ba1f72060aa 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
@@ -78,9 +78,11 @@ struct mlx5e_tc_flow {
 };
 
 struct mlx5e_tc_flow_parse_attr {
+        struct ip_tunnel_info tun_info;
         struct mlx5_flow_spec spec;
         int num_mod_hdr_actions;
         void *mod_hdr_actions;
+        int mirred_ifindex;
 };
 
 enum {
@@ -322,6 +324,12 @@ static void mlx5e_tc_del_nic_flow(struct mlx5e_priv *priv,
 static void mlx5e_detach_encap(struct mlx5e_priv *priv,
                                struct mlx5e_tc_flow *flow);
 
+static int mlx5e_attach_encap(struct mlx5e_priv *priv,
+                              struct ip_tunnel_info *tun_info,
+                              struct net_device *mirred_dev,
+                              struct net_device **encap_dev,
+                              struct mlx5e_tc_flow *flow);
+
 static struct mlx5_flow_handle *
 mlx5e_tc_add_fdb_flow(struct mlx5e_priv *priv,
                       struct mlx5e_tc_flow_parse_attr *parse_attr,
@@ -329,9 +337,27 @@ mlx5e_tc_add_fdb_flow(struct mlx5e_priv *priv,
 {
         struct mlx5_eswitch *esw = priv->mdev->priv.eswitch;
         struct mlx5_esw_flow_attr *attr = flow->esw_attr;
-        struct mlx5_flow_handle *rule;
+        struct net_device *out_dev, *encap_dev = NULL;
+        struct mlx5_flow_handle *rule = NULL;
+        struct mlx5e_rep_priv *rpriv;
+        struct mlx5e_priv *out_priv;
         int err;
 
+        if (attr->action & MLX5_FLOW_CONTEXT_ACTION_ENCAP) {
+                out_dev = __dev_get_by_index(dev_net(priv->netdev),
+                                             attr->parse_attr->mirred_ifindex);
+                err = mlx5e_attach_encap(priv, &parse_attr->tun_info,
+                                         out_dev, &encap_dev, flow);
+                if (err) {
+                        rule = ERR_PTR(err);
+                        if (err != -EAGAIN)
+                                goto err_attach_encap;
+                }
+                out_priv = netdev_priv(encap_dev);
+                rpriv = out_priv->ppriv;
+                attr->out_rep = rpriv->rep;
+        }
+
         err = mlx5_eswitch_add_vlan_action(esw, attr);
         if (err) {
                 rule = ERR_PTR(err);
@@ -347,10 +373,14 @@ mlx5e_tc_add_fdb_flow(struct mlx5e_priv *priv,
                 }
         }
 
-        rule = mlx5_eswitch_add_offloaded_rule(esw, &parse_attr->spec, attr);
-        if (IS_ERR(rule))
-                goto err_add_rule;
-
+        /* we get here if (1) there's no error (rule being null) or when
+         * (2) there's an encap action and we're on -EAGAIN (no valid neigh)
+         */
+        if (rule != ERR_PTR(-EAGAIN)) {
+                rule = mlx5_eswitch_add_offloaded_rule(esw, &parse_attr->spec, attr);
+                if (IS_ERR(rule))
+                        goto err_add_rule;
+        }
         return rule;
 
 err_add_rule:
@@ -361,6 +391,7 @@ err_mod_hdr:
 err_add_vlan:
         if (attr->action & MLX5_FLOW_CONTEXT_ACTION_ENCAP)
                 mlx5e_detach_encap(priv, flow);
+err_attach_encap:
         return rule;
 }
 
@@ -389,6 +420,8 @@ static void mlx5e_tc_del_fdb_flow(struct mlx5e_priv *priv,
 void mlx5e_tc_encap_flows_add(struct mlx5e_priv *priv,
                               struct mlx5e_encap_entry *e)
 {
+        struct mlx5_eswitch *esw = priv->mdev->priv.eswitch;
+        struct mlx5_esw_flow_attr *esw_attr;
         struct mlx5e_tc_flow *flow;
         int err;
 
@@ -404,10 +437,9 @@ void mlx5e_tc_encap_flows_add(struct mlx5e_priv *priv,
         mlx5e_rep_queue_neigh_stats_work(priv);
 
         list_for_each_entry(flow, &e->flows, encap) {
-                flow->esw_attr->encap_id = e->encap_id;
-                flow->rule = mlx5e_tc_add_fdb_flow(priv,
-                                                   flow->esw_attr->parse_attr,
-                                                   flow);
+                esw_attr = flow->esw_attr;
+                esw_attr->encap_id = e->encap_id;
+                flow->rule = mlx5_eswitch_add_offloaded_rule(esw, &esw_attr->parse_attr->spec, esw_attr);
                 if (IS_ERR(flow->rule)) {
                         err = PTR_ERR(flow->rule);
                         mlx5_core_warn(priv->mdev, "Failed to update cached encapsulation flow, %d\n",
@@ -421,15 +453,13 @@ void mlx5e_tc_encap_flows_add(struct mlx5e_priv *priv,
 void mlx5e_tc_encap_flows_del(struct mlx5e_priv *priv,
                               struct mlx5e_encap_entry *e)
 {
+        struct mlx5_eswitch *esw = priv->mdev->priv.eswitch;
         struct mlx5e_tc_flow *flow;
-        struct mlx5_fc *counter;
 
         list_for_each_entry(flow, &e->flows, encap) {
                 if (flow->flags & MLX5E_TC_FLOW_OFFLOADED) {
                         flow->flags &= ~MLX5E_TC_FLOW_OFFLOADED;
-                        counter = mlx5_flow_rule_counter(flow->rule);
-                        mlx5_del_flow_rules(flow->rule);
-                        mlx5_fc_destroy(priv->mdev, counter);
+                        mlx5_eswitch_del_offloaded_rule(esw, flow->rule, flow->esw_attr);
                 }
         }
 
@@ -1942,7 +1972,7 @@ static int parse_tc_fdb_actions(struct mlx5e_priv *priv, struct tcf_exts *exts,
 
                 if (is_tcf_mirred_egress_redirect(a)) {
                         int ifindex = tcf_mirred_ifindex(a);
-                        struct net_device *out_dev, *encap_dev = NULL;
+                        struct net_device *out_dev;
                         struct mlx5e_priv *out_priv;
 
                         out_dev = __dev_get_by_index(dev_net(priv->netdev), ifindex);
@@ -1955,17 +1985,13 @@ static int parse_tc_fdb_actions(struct mlx5e_priv *priv, struct tcf_exts *exts,
                                 rpriv = out_priv->ppriv;
                                 attr->out_rep = rpriv->rep;
                         } else if (encap) {
-                                err = mlx5e_attach_encap(priv, info,
-                                                         out_dev, &encap_dev, flow);
-                                if (err && err != -EAGAIN)
-                                        return err;
+                                parse_attr->mirred_ifindex = ifindex;
+                                parse_attr->tun_info = *info;
+                                attr->parse_attr = parse_attr;
                                 attr->action |= MLX5_FLOW_CONTEXT_ACTION_ENCAP |
                                         MLX5_FLOW_CONTEXT_ACTION_FWD_DEST |
                                         MLX5_FLOW_CONTEXT_ACTION_COUNT;
-                                out_priv = netdev_priv(encap_dev);
-                                rpriv = out_priv->ppriv;
-                                attr->out_rep = rpriv->rep;
-                                attr->parse_attr = parse_attr;
+                                /* attr->out_rep is resolved when we handle encap */
                         } else {
                                 pr_err("devices %s %s not on same switch HW, can't offload forwarding\n",
                                        priv->netdev->name, out_dev->name);
@@ -2047,7 +2073,7 @@ int mlx5e_configure_flower(struct mlx5e_priv *priv,
         if (flow->flags & MLX5E_TC_FLOW_ESWITCH) {
                 err = parse_tc_fdb_actions(priv, f->exts, parse_attr, flow);
                 if (err < 0)
-                        goto err_handle_encap_flow;
+                        goto err_free;
                 flow->rule = mlx5e_tc_add_fdb_flow(priv, parse_attr, flow);
         } else {
                 err = parse_tc_nic_actions(priv, f->exts, parse_attr, flow);
@@ -2058,10 +2084,13 @@ int mlx5e_configure_flower(struct mlx5e_priv *priv,
 
         if (IS_ERR(flow->rule)) {
                 err = PTR_ERR(flow->rule);
-                goto err_free;
+                if (err != -EAGAIN)
+                        goto err_free;
         }
 
-        flow->flags |= MLX5E_TC_FLOW_OFFLOADED;
+        if (err != -EAGAIN)
+                flow->flags |= MLX5E_TC_FLOW_OFFLOADED;
+
         err = rhashtable_insert_fast(&tc->ht, &flow->node,
                                      tc->ht_params);
         if (err)
@@ -2075,16 +2104,6 @@ int mlx5e_configure_flower(struct mlx5e_priv *priv,
 err_del_rule:
         mlx5e_tc_del_flow(priv, flow);
 
-err_handle_encap_flow:
-        if (err == -EAGAIN) {
-                err = rhashtable_insert_fast(&tc->ht, &flow->node,
-                                             tc->ht_params);
-                if (err)
-                        mlx5e_tc_del_flow(priv, flow);
-                else
-                        return 0;
-        }
-
 err_free:
         kvfree(parse_attr);
         kfree(flow);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/health.c b/drivers/net/ethernet/mellanox/mlx5/core/health.c
index 8aea0a065e56..db86e1506c8b 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/health.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/health.c
@@ -356,10 +356,11 @@ void mlx5_drain_health_wq(struct mlx5_core_dev *dev)
 void mlx5_drain_health_recovery(struct mlx5_core_dev *dev)
 {
         struct mlx5_core_health *health = &dev->priv.health;
+        unsigned long flags;
 
-        spin_lock(&health->wq_lock);
+        spin_lock_irqsave(&health->wq_lock, flags);
         set_bit(MLX5_DROP_NEW_RECOVERY_WORK, &health->flags);
-        spin_unlock(&health->wq_lock);
+        spin_unlock_irqrestore(&health->wq_lock, flags);
         cancel_delayed_work_sync(&dev->priv.health.recover_work);
 }
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/port.c b/drivers/net/ethernet/mellanox/mlx5/core/port.c
index 1975d4388d4f..e07061f565d6 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/port.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/port.c
@@ -677,6 +677,27 @@ int mlx5_set_port_tc_group(struct mlx5_core_dev *mdev, u8 *tc_group)
 }
 EXPORT_SYMBOL_GPL(mlx5_set_port_tc_group);
 
+int mlx5_query_port_tc_group(struct mlx5_core_dev *mdev,
+                             u8 tc, u8 *tc_group)
+{
+        u32 out[MLX5_ST_SZ_DW(qetc_reg)];
+        void *ets_tcn_conf;
+        int err;
+
+        err = mlx5_query_port_qetcr_reg(mdev, out, sizeof(out));
+        if (err)
+                return err;
+
+        ets_tcn_conf = MLX5_ADDR_OF(qetc_reg, out,
+                                    tc_configuration[tc]);
+
+        *tc_group = MLX5_GET(ets_tcn_config_reg, ets_tcn_conf,
+                             group);
+
+        return 0;
+}
+EXPORT_SYMBOL_GPL(mlx5_query_port_tc_group);
+
 int mlx5_set_port_tc_bw_alloc(struct mlx5_core_dev *mdev, u8 *tc_bw)
 {
         u32 in[MLX5_ST_SZ_DW(qetc_reg)] = {0};
diff --git a/drivers/net/ethernet/netronome/nfp/flower/action.c b/drivers/net/ethernet/netronome/nfp/flower/action.c
index db9750695dc7..8ea9320014ee 100644
--- a/drivers/net/ethernet/netronome/nfp/flower/action.c
+++ b/drivers/net/ethernet/netronome/nfp/flower/action.c
@@ -110,6 +110,8 @@ nfp_fl_output(struct nfp_fl_output *output, const struct tc_action *action,
          */
         if (!switchdev_port_same_parent_id(in_dev, out_dev))
                 return -EOPNOTSUPP;
+        if (!nfp_netdev_is_nfp_repr(out_dev))
+                return -EOPNOTSUPP;
 
         output->port = cpu_to_be32(nfp_repr_get_port_id(out_dev));
         if (!output->port)
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-dwc-qos-eth.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-dwc-qos-eth.c
index 5efef8001edf..3256e5cbad27 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-dwc-qos-eth.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-dwc-qos-eth.c
@@ -74,7 +74,7 @@ static int dwc_eth_dwmac_config_dt(struct platform_device *pdev,
                 plat_dat->axi->axi_wr_osr_lmt--;
         }
 
-        if (of_property_read_u32(np, "read,read-requests",
+        if (of_property_read_u32(np, "snps,read-requests",
                                  &plat_dat->axi->axi_rd_osr_lmt)) {
                 /**
                  * Since the register has a reset value of 1, if property
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
index 8a280b48e3a9..6383695004a5 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
@@ -150,6 +150,13 @@ static void stmmac_mtl_setup(struct platform_device *pdev,
         plat->rx_queues_to_use = 1;
         plat->tx_queues_to_use = 1;
 
+        /* First Queue must always be in DCB mode. As MTL_QUEUE_DCB = 1 we need
+         * to always set this, otherwise Queue will be classified as AVB
+         * (because MTL_QUEUE_AVB = 0).
+         */
+        plat->rx_queues_cfg[0].mode_to_use = MTL_QUEUE_DCB;
+        plat->tx_queues_cfg[0].mode_to_use = MTL_QUEUE_DCB;
+
         rx_node = of_parse_phandle(pdev->dev.of_node, "snps,mtl-rx-config", 0);
         if (!rx_node)
                 return;
diff --git a/drivers/net/ipvlan/ipvtap.c b/drivers/net/ipvlan/ipvtap.c
index 5dea2063dbc8..0bcc07f346c3 100644
--- a/drivers/net/ipvlan/ipvtap.c
+++ b/drivers/net/ipvlan/ipvtap.c
@@ -197,8 +197,8 @@ static int ipvtap_init(void)
 {
         int err;
 
-        err = tap_create_cdev(&ipvtap_cdev, &ipvtap_major, "ipvtap");
-
+        err = tap_create_cdev(&ipvtap_cdev, &ipvtap_major, "ipvtap",
+                              THIS_MODULE);
         if (err)
                 goto out1;
 
diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c
index c2d0ea2fb019..cba5cb3b849a 100644
--- a/drivers/net/macvtap.c
+++ b/drivers/net/macvtap.c
@@ -204,8 +204,8 @@ static int macvtap_init(void)
 {
         int err;
 
-        err = tap_create_cdev(&macvtap_cdev, &macvtap_major, "macvtap");
-
+        err = tap_create_cdev(&macvtap_cdev, &macvtap_major, "macvtap",
+                              THIS_MODULE);
         if (err)
                 goto out1;
 
diff --git a/drivers/net/tap.c b/drivers/net/tap.c
index 21b71ae947fd..1b10fcc6a58d 100644
--- a/drivers/net/tap.c
+++ b/drivers/net/tap.c
@@ -517,6 +517,10 @@ static int tap_open(struct inode *inode, struct file *file)
                                              &tap_proto, 0);
         if (!q)
                 goto err;
+        if (skb_array_init(&q->skb_array, tap->dev->tx_queue_len, GFP_KERNEL)) {
+                sk_free(&q->sk);
+                goto err;
+        }
 
         RCU_INIT_POINTER(q->sock.wq, &q->wq);
         init_waitqueue_head(&q->wq.wait);
@@ -540,22 +544,18 @@ static int tap_open(struct inode *inode, struct file *file)
         if ((tap->dev->features & NETIF_F_HIGHDMA) && (tap->dev->features & NETIF_F_SG))
                 sock_set_flag(&q->sk, SOCK_ZEROCOPY);
 
-        err = -ENOMEM;
-        if (skb_array_init(&q->skb_array, tap->dev->tx_queue_len, GFP_KERNEL))
-                goto err_array;
-
         err = tap_set_queue(tap, file, q);
-        if (err)
-                goto err_queue;
+        if (err) {
+                /* tap_sock_destruct() will take care of freeing skb_array */
+                goto err_put;
+        }
 
         dev_put(tap->dev);
 
         rtnl_unlock();
         return err;
 
-err_queue:
-        skb_array_cleanup(&q->skb_array);
-err_array:
+err_put:
         sock_put(&q->sk);
 err:
         if (tap)
@@ -1249,8 +1249,8 @@ static int tap_list_add(dev_t major, const char *device_name)
         return 0;
 }
 
-int tap_create_cdev(struct cdev *tap_cdev,
-                    dev_t *tap_major, const char *device_name)
+int tap_create_cdev(struct cdev *tap_cdev, dev_t *tap_major,
+                    const char *device_name, struct module *module)
 {
         int err;
 
@@ -1259,6 +1259,7 @@ int tap_create_cdev(struct cdev *tap_cdev,
                 goto out1;
 
         cdev_init(tap_cdev, &tap_fops);
+        tap_cdev->owner = module;
         err = cdev_add(tap_cdev, *tap_major, TAP_NUM_DEVS);
         if (err)
                 goto out2;
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index e21bf90b819f..5550f56cb895 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -1286,6 +1286,7 @@ static struct sk_buff *tun_build_skb(struct tun_struct *tun,
         buflen += SKB_DATA_ALIGN(len + pad);
         rcu_read_unlock();
 
+        alloc_frag->offset = ALIGN((u64)alloc_frag->offset, SMP_CACHE_BYTES);
         if (unlikely(!skb_page_frag_refill(buflen, alloc_frag, GFP_KERNEL)))
                 return ERR_PTR(-ENOMEM);
 
@@ -2028,7 +2029,7 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
                 if (!dev)
                         return -ENOMEM;
                 err = dev_get_valid_name(net, dev, name);
-                if (err)
+                if (err < 0)
                         goto err_free_dev;
 
                 dev_net_set(dev, net);
diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
index 52ea80bcd639..3e7a3ac3a362 100644
--- a/drivers/net/usb/cdc_ether.c
+++ b/drivers/net/usb/cdc_ether.c
@@ -561,6 +561,7 @@ static const struct driver_info wwan_info = {
 #define HP_VENDOR_ID            0x03f0
 #define MICROSOFT_VENDOR_ID     0x045e
 #define UBLOX_VENDOR_ID         0x1546
+#define TPLINK_VENDOR_ID        0x2357
 
 static const struct usb_device_id       products[] = {
 /* BLACKLIST !!
@@ -813,6 +814,13 @@ static const struct usb_device_id	products[] = {
         .driver_info = 0,
 },
 
+        /* TP-LINK UE300 USB 3.0 Ethernet Adapters (based on Realtek RTL8153) */
+{
+        USB_DEVICE_AND_INTERFACE_INFO(TPLINK_VENDOR_ID, 0x0601, USB_CLASS_COMM,
+                        USB_CDC_SUBCLASS_ETHERNET, USB_CDC_PROTO_NONE),
+        .driver_info = 0,
+},
+
 /* WHITELIST!!!
  *
  * CDC Ether uses two interfaces, not necessarily consecutive.
@@ -864,6 +872,12 @@ static const struct usb_device_id	products[] = {
                         USB_CDC_SUBCLASS_ETHERNET, USB_CDC_PROTO_NONE),
         .driver_info = (kernel_ulong_t)&wwan_info,
 }, {
+        /* Huawei ME906 and ME909 */
+        USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0x15c1, USB_CLASS_COMM,
+                                      USB_CDC_SUBCLASS_ETHERNET,
+                                      USB_CDC_PROTO_NONE),
+        .driver_info = (unsigned long)&wwan_info,
+}, {
         /* ZTE modules */
         USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, USB_CLASS_COMM,
                                       USB_CDC_SUBCLASS_ETHERNET,
diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
index 941ece08ba78..d51d9abf7986 100644
--- a/drivers/net/usb/r8152.c
+++ b/drivers/net/usb/r8152.c
@@ -615,6 +615,7 @@ enum rtl8152_flags {
 #define VENDOR_ID_LENOVO                0x17ef
 #define VENDOR_ID_LINKSYS               0x13b1
 #define VENDOR_ID_NVIDIA                0x0955
+#define VENDOR_ID_TPLINK                0x2357
 
 #define MCU_TYPE_PLA                    0x0100
 #define MCU_TYPE_USB                    0x0000
@@ -5319,6 +5320,7 @@ static const struct usb_device_id rtl8152_table[] = {
         {REALTEK_USB_DEVICE(VENDOR_ID_LENOVO,  0x7214)},
         {REALTEK_USB_DEVICE(VENDOR_ID_LINKSYS, 0x0041)},
         {REALTEK_USB_DEVICE(VENDOR_ID_NVIDIA,  0x09ff)},
+        {REALTEK_USB_DEVICE(VENDOR_ID_TPLINK,  0x0601)},
         {}
 };