26 files changed, 182 insertions, 86 deletions
diff --git a/MAINTAINERS b/MAINTAINERS
index af0cb69f6a3e..bf1d20695cbf 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -6671,7 +6671,7 @@ F:	include/net/ieee802154_netdev.h
 F:      Documentation/networking/ieee802154.txt
 IFE PROTOCOL
-M:      Yotam Gigi <yotamg@mellanox.com>
+M:      Yotam Gigi <yotam.gi@gmail.com>
 M:      Jamal Hadi Salim <jhs@mojatatu.com>
 F:      net/ife
 F:      include/net/ife.h
@@ -8743,7 +8743,7 @@ Q:	http://patchwork.ozlabs.org/project/netdev/list/
 F:      drivers/net/ethernet/mellanox/mlxsw/
 MELLANOX FIRMWARE FLASH LIBRARY (mlxfw)
-M:      Yotam Gigi <yotamg@mellanox.com>
+M:      mlxsw@mellanox.com
 L:      netdev@vger.kernel.org
 S:      Supported
 W:      http://www.mellanox.com
@@ -10890,7 +10890,7 @@ S:	Maintained
 F:      drivers/block/ps3vram.c
 PSAMPLE PACKET SAMPLING SUPPORT:
-M:      Yotam Gigi <yotamg@mellanox.com>
+M:      Yotam Gigi <yotam.gi@gmail.com>
 S:      Maintained
 F:      net/psample
 F:      include/net/psample.h
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_enet.c b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
index 36520634c96a..e77192683dba 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_enet.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
@@ -2369,8 +2369,8 @@ static int hns_nic_dev_probe(struct platform_device *pdev)
                        priv->enet_ver = AE_VERSION_2;
                ae_node = of_parse_phandle(dev->of_node, "ae-handle", 0);
-                if (IS_ERR_OR_NULL(ae_node)) {
+                if (!ae_node) {
-                        ret = PTR_ERR(ae_node);
+                        ret = -ENODEV;
                        dev_err(dev, "not find ae-handle\n");
                        goto out_read_prop_fail;
                }
diff --git a/drivers/net/ethernet/mellanox/mlxsw/i2c.c b/drivers/net/ethernet/mellanox/mlxsw/i2c.c
index 12c3a4449120..c0dcfa05b077 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/i2c.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/i2c.c
@@ -294,7 +294,7 @@ mlxsw_i2c_write(struct device *dev, size_t in_mbox_size, u8 *in_mbox, int num,
                write_tran.len = MLXSW_I2C_ADDR_WIDTH + chunk_size;
                mlxsw_i2c_set_slave_addr(tran_buf, off);
                memcpy(&tran_buf[MLXSW_I2C_ADDR_BUF_SIZE], in_mbox +
-                       chunk_size * i, chunk_size);
+                       MLXSW_I2C_BLK_MAX * i, chunk_size);
                j = 0;
                end = jiffies + timeout;
diff --git a/drivers/net/ethernet/mellanox/mlxsw/reg.h b/drivers/net/ethernet/mellanox/mlxsw/reg.h
index 4afc8486eb9a..5acfbe5b8b9d 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/reg.h
+++ b/drivers/net/ethernet/mellanox/mlxsw/reg.h
@@ -5827,6 +5827,29 @@ MLXSW_ITEM32(reg, mtmp, mtr, 0x08, 30, 1);
 */
 MLXSW_ITEM32(reg, mtmp, max_temperature, 0x08, 0, 16);
+/* reg_mtmp_tee
+ * Temperature Event Enable.
+ * 0 - Do not generate event
+ * 1 - Generate event
+ * 2 - Generate single event
+ * Access: RW
+ */
+MLXSW_ITEM32(reg, mtmp, tee, 0x0C, 30, 2);
+#define MLXSW_REG_MTMP_THRESH_HI 0x348  /* 105 Celsius */
+/* reg_mtmp_temperature_threshold_hi
+ * High threshold for Temperature Warning Event. In 0.125 Celsius.
+ * Access: RW
+ */
+MLXSW_ITEM32(reg, mtmp, temperature_threshold_hi, 0x0C, 0, 16);
+/* reg_mtmp_temperature_threshold_lo
+ * Low threshold for Temperature Warning Event. In 0.125 Celsius.
+ * Access: RW
+ */
+MLXSW_ITEM32(reg, mtmp, temperature_threshold_lo, 0x10, 0, 16);
 #define MLXSW_REG_MTMP_SENSOR_NAME_SIZE 8
 /* reg_mtmp_sensor_name
@@ -5843,6 +5866,8 @@ static inline void mlxsw_reg_mtmp_pack(char *payload, u8 sensor_index,
        mlxsw_reg_mtmp_sensor_index_set(payload, sensor_index);
        mlxsw_reg_mtmp_mte_set(payload, max_temp_enable);
        mlxsw_reg_mtmp_mtr_set(payload, max_temp_reset);
+        mlxsw_reg_mtmp_temperature_threshold_hi_set(payload,
+                                                    MLXSW_REG_MTMP_THRESH_HI);
 }
 static inline void mlxsw_reg_mtmp_unpack(char *payload, unsigned int *p_temp,
diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c
index 15cbcdba618a..4d02b27df044 100644
--- a/drivers/net/phy/marvell.c
+++ b/drivers/net/phy/marvell.c
@@ -681,9 +681,11 @@ static int m88e1116r_config_init(struct phy_device *phydev)
        if (err < 0)
                return err;
-        err = m88e1121_config_aneg_rgmii_delays(phydev);
+        if (phy_interface_is_rgmii(phydev)) {
-        if (err < 0)
+                err = m88e1121_config_aneg_rgmii_delays(phydev);
-                return err;
+                if (err < 0)
+                        return err;
+        }
        err = genphy_soft_reset(phydev);
        if (err < 0)
diff --git a/drivers/net/tap.c b/drivers/net/tap.c
index 1b10fcc6a58d..6c0c84c33e1f 100644
--- a/drivers/net/tap.c
+++ b/drivers/net/tap.c
@@ -1032,6 +1032,8 @@ static long tap_ioctl(struct file *file, unsigned int cmd,
        case TUNSETSNDBUF:
                if (get_user(s, sp))
                        return -EFAULT;
+                if (s <= 0)
+                        return -EINVAL;
                q->sk.sk_sndbuf = s;
                return 0;
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 5550f56cb895..42bb820a56c9 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -2429,6 +2429,10 @@ static long __tun_chr_ioctl(struct file *file, unsigned int cmd,
                        ret = -EFAULT;
                        break;
                }
+                if (sndbuf <= 0) {
+                        ret = -EINVAL;
+                        break;
+                }
                tun->sndbuf = sndbuf;
                tun_set_sndbuf(tun);
diff --git a/drivers/net/wan/lapbether.c b/drivers/net/wan/lapbether.c
index 63f749078a1f..0e3f8ed84660 100644
--- a/drivers/net/wan/lapbether.c
+++ b/drivers/net/wan/lapbether.c
@@ -346,7 +346,6 @@ out:
 fail:
        dev_put(dev);
        free_netdev(ndev);
-        kfree(lapbeth);
        goto out;
 }
diff --git a/drivers/net/wireless/ath/ath10k/htt_rx.c b/drivers/net/wireless/ath/ath10k/htt_rx.c
index a3f5dc78353f..0aeeb233af78 100644
--- a/drivers/net/wireless/ath/ath10k/htt_rx.c
+++ b/drivers/net/wireless/ath/ath10k/htt_rx.c
@@ -550,6 +550,11 @@ static int ath10k_htt_rx_crypto_param_len(struct ath10k *ar,
                return IEEE80211_TKIP_IV_LEN;
        case HTT_RX_MPDU_ENCRYPT_AES_CCM_WPA2:
                return IEEE80211_CCMP_HDR_LEN;
+        case HTT_RX_MPDU_ENCRYPT_AES_CCM256_WPA2:
+                return IEEE80211_CCMP_256_HDR_LEN;
+        case HTT_RX_MPDU_ENCRYPT_AES_GCMP_WPA2:
+        case HTT_RX_MPDU_ENCRYPT_AES_GCMP256_WPA2:
+                return IEEE80211_GCMP_HDR_LEN;
        case HTT_RX_MPDU_ENCRYPT_WEP128:
        case HTT_RX_MPDU_ENCRYPT_WAPI:
                break;
@@ -575,6 +580,11 @@ static int ath10k_htt_rx_crypto_tail_len(struct ath10k *ar,
                return IEEE80211_TKIP_ICV_LEN;
        case HTT_RX_MPDU_ENCRYPT_AES_CCM_WPA2:
                return IEEE80211_CCMP_MIC_LEN;
+        case HTT_RX_MPDU_ENCRYPT_AES_CCM256_WPA2:
+                return IEEE80211_CCMP_256_MIC_LEN;
+        case HTT_RX_MPDU_ENCRYPT_AES_GCMP_WPA2:
+        case HTT_RX_MPDU_ENCRYPT_AES_GCMP256_WPA2:
+                return IEEE80211_GCMP_MIC_LEN;
        case HTT_RX_MPDU_ENCRYPT_WEP128:
        case HTT_RX_MPDU_ENCRYPT_WAPI:
                break;
@@ -1051,9 +1061,21 @@ static void ath10k_htt_rx_h_undecap_raw(struct ath10k *ar,
        hdr = (void *)msdu->data;
        /* Tail */
-        if (status->flag & RX_FLAG_IV_STRIPPED)
+        if (status->flag & RX_FLAG_IV_STRIPPED) {
                skb_trim(msdu, msdu->len -
                         ath10k_htt_rx_crypto_tail_len(ar, enctype));
+        } else {
+                /* MIC */
+                if ((status->flag & RX_FLAG_MIC_STRIPPED) &&
+                    enctype == HTT_RX_MPDU_ENCRYPT_AES_CCM_WPA2)
+                        skb_trim(msdu, msdu->len - 8);
+                /* ICV */
+                if (status->flag & RX_FLAG_ICV_STRIPPED &&
+                    enctype != HTT_RX_MPDU_ENCRYPT_AES_CCM_WPA2)
+                        skb_trim(msdu, msdu->len -
+                                 ath10k_htt_rx_crypto_tail_len(ar, enctype));
+        }
        /* MMIC */
        if ((status->flag & RX_FLAG_MMIC_STRIPPED) &&
@@ -1075,7 +1097,8 @@ static void ath10k_htt_rx_h_undecap_raw(struct ath10k *ar,
 static void ath10k_htt_rx_h_undecap_nwifi(struct ath10k *ar,
                                          struct sk_buff *msdu,
                                          struct ieee80211_rx_status *status,
-                                          const u8 first_hdr[64])
+                                          const u8 first_hdr[64],
+                                          enum htt_rx_mpdu_encrypt_type enctype)
 {
        struct ieee80211_hdr *hdr;
        struct htt_rx_desc *rxd;
@@ -1083,6 +1106,7 @@ static void ath10k_htt_rx_h_undecap_nwifi(struct ath10k *ar,
        u8 da[ETH_ALEN];
        u8 sa[ETH_ALEN];
        int l3_pad_bytes;
+        int bytes_aligned = ar->hw_params.decap_align_bytes;
        /* Delivered decapped frame:
         * [nwifi 802.11 header] <-- replaced with 802.11 hdr
@@ -1111,6 +1135,14 @@ static void ath10k_htt_rx_h_undecap_nwifi(struct ath10k *ar,
        /* push original 802.11 header */
        hdr = (struct ieee80211_hdr *)first_hdr;
        hdr_len = ieee80211_hdrlen(hdr->frame_control);
+        if (!(status->flag & RX_FLAG_IV_STRIPPED)) {
+                memcpy(skb_push(msdu,
+                                ath10k_htt_rx_crypto_param_len(ar, enctype)),
+                       (void *)hdr + round_up(hdr_len, bytes_aligned),
+                        ath10k_htt_rx_crypto_param_len(ar, enctype));
+        }
        memcpy(skb_push(msdu, hdr_len), hdr, hdr_len);
        /* original 802.11 header has a different DA and in
@@ -1171,6 +1203,7 @@ static void ath10k_htt_rx_h_undecap_eth(struct ath10k *ar,
        u8 sa[ETH_ALEN];
        int l3_pad_bytes;
        struct htt_rx_desc *rxd;
+        int bytes_aligned = ar->hw_params.decap_align_bytes;
        /* Delivered decapped frame:
         * [eth header] <-- replaced with 802.11 hdr & rfc1042/llc
@@ -1199,6 +1232,14 @@ static void ath10k_htt_rx_h_undecap_eth(struct ath10k *ar,
        /* push original 802.11 header */
        hdr = (struct ieee80211_hdr *)first_hdr;
        hdr_len = ieee80211_hdrlen(hdr->frame_control);
+        if (!(status->flag & RX_FLAG_IV_STRIPPED)) {
+                memcpy(skb_push(msdu,
+                                ath10k_htt_rx_crypto_param_len(ar, enctype)),
+                       (void *)hdr + round_up(hdr_len, bytes_aligned),
+                        ath10k_htt_rx_crypto_param_len(ar, enctype));
+        }
        memcpy(skb_push(msdu, hdr_len), hdr, hdr_len);
        /* original 802.11 header has a different DA and in
@@ -1212,12 +1253,14 @@ static void ath10k_htt_rx_h_undecap_eth(struct ath10k *ar,
 static void ath10k_htt_rx_h_undecap_snap(struct ath10k *ar,
                                         struct sk_buff *msdu,
                                         struct ieee80211_rx_status *status,
-                                         const u8 first_hdr[64])
+                                         const u8 first_hdr[64],
+                                         enum htt_rx_mpdu_encrypt_type enctype)
 {
        struct ieee80211_hdr *hdr;
        size_t hdr_len;
        int l3_pad_bytes;
        struct htt_rx_desc *rxd;
+        int bytes_aligned = ar->hw_params.decap_align_bytes;
        /* Delivered decapped frame:
         * [amsdu header] <-- replaced with 802.11 hdr
@@ -1233,6 +1276,14 @@ static void ath10k_htt_rx_h_undecap_snap(struct ath10k *ar,
        hdr = (struct ieee80211_hdr *)first_hdr;
        hdr_len = ieee80211_hdrlen(hdr->frame_control);
+        if (!(status->flag & RX_FLAG_IV_STRIPPED)) {
+                memcpy(skb_push(msdu,
+                                ath10k_htt_rx_crypto_param_len(ar, enctype)),
+                       (void *)hdr + round_up(hdr_len, bytes_aligned),
+                        ath10k_htt_rx_crypto_param_len(ar, enctype));
+        }
        memcpy(skb_push(msdu, hdr_len), hdr, hdr_len);
 }
@@ -1267,13 +1318,15 @@ static void ath10k_htt_rx_h_undecap(struct ath10k *ar,
                                            is_decrypted);
                break;
        case RX_MSDU_DECAP_NATIVE_WIFI:
-                ath10k_htt_rx_h_undecap_nwifi(ar, msdu, status, first_hdr);
+                ath10k_htt_rx_h_undecap_nwifi(ar, msdu, status, first_hdr,
+                                              enctype);
                break;
        case RX_MSDU_DECAP_ETHERNET2_DIX:
                ath10k_htt_rx_h_undecap_eth(ar, msdu, status, first_hdr, enctype);
                break;
        case RX_MSDU_DECAP_8023_SNAP_LLC:
-                ath10k_htt_rx_h_undecap_snap(ar, msdu, status, first_hdr);
+                ath10k_htt_rx_h_undecap_snap(ar, msdu, status, first_hdr,
+                                             enctype);
                break;
        }
 }
@@ -1316,7 +1369,8 @@ static void ath10k_htt_rx_h_csum_offload(struct sk_buff *msdu)
 static void ath10k_htt_rx_h_mpdu(struct ath10k *ar,
                                 struct sk_buff_head *amsdu,
-                                 struct ieee80211_rx_status *status)
+                                 struct ieee80211_rx_status *status,
+                                 bool fill_crypt_header)
 {
        struct sk_buff *first;
        struct sk_buff *last;
@@ -1326,7 +1380,6 @@ static void ath10k_htt_rx_h_mpdu(struct ath10k *ar,
        enum htt_rx_mpdu_encrypt_type enctype;
        u8 first_hdr[64];
        u8 *qos;
-        size_t hdr_len;
        bool has_fcs_err;
        bool has_crypto_err;
        bool has_tkip_err;
@@ -1351,15 +1404,17 @@ static void ath10k_htt_rx_h_mpdu(struct ath10k *ar,
         * decapped header. It'll be used for undecapping of each MSDU.
         */
        hdr = (void *)rxd->rx_hdr_status;
-        hdr_len = ieee80211_hdrlen(hdr->frame_control);
+        memcpy(first_hdr, hdr, RX_HTT_HDR_STATUS_LEN);
-        memcpy(first_hdr, hdr, hdr_len);
        /* Each A-MSDU subframe will use the original header as the base and be
         * reported as a separate MSDU so strip the A-MSDU bit from QoS Ctl.
         */
        hdr = (void *)first_hdr;
-        qos = ieee80211_get_qos_ctl(hdr);
-        qos[0] &= ~IEEE80211_QOS_CTL_A_MSDU_PRESENT;
+        if (ieee80211_is_data_qos(hdr->frame_control)) {
+                qos = ieee80211_get_qos_ctl(hdr);
+                qos[0] &= ~IEEE80211_QOS_CTL_A_MSDU_PRESENT;
+        }
        /* Some attention flags are valid only in the last MSDU. */
        last = skb_peek_tail(amsdu);
@@ -1406,9 +1461,14 @@ static void ath10k_htt_rx_h_mpdu(struct ath10k *ar,
                status->flag |= RX_FLAG_DECRYPTED;
                if (likely(!is_mgmt))
-                        status->flag |= RX_FLAG_IV_STRIPPED |
+                        status->flag |= RX_FLAG_MMIC_STRIPPED;
-                                        RX_FLAG_MMIC_STRIPPED;
-}
+                if (fill_crypt_header)
+                        status->flag |= RX_FLAG_MIC_STRIPPED |
+                                        RX_FLAG_ICV_STRIPPED;
+                else
+                        status->flag |= RX_FLAG_IV_STRIPPED;
+        }
        skb_queue_walk(amsdu, msdu) {
                ath10k_htt_rx_h_csum_offload(msdu);
@@ -1424,6 +1484,9 @@ static void ath10k_htt_rx_h_mpdu(struct ath10k *ar,
                if (is_mgmt)
                        continue;
+                if (fill_crypt_header)
+                        continue;
                hdr = (void *)msdu->data;
                hdr->frame_control &= ~__cpu_to_le16(IEEE80211_FCTL_PROTECTED);
        }
@@ -1434,6 +1497,9 @@ static void ath10k_htt_rx_h_deliver(struct ath10k *ar,
                                    struct ieee80211_rx_status *status)
 {
        struct sk_buff *msdu;
+        struct sk_buff *first_subframe;
+        first_subframe = skb_peek(amsdu);
        while ((msdu = __skb_dequeue(amsdu))) {
                /* Setup per-MSDU flags */
@@ -1442,6 +1508,13 @@ static void ath10k_htt_rx_h_deliver(struct ath10k *ar,
                else
                        status->flag |= RX_FLAG_AMSDU_MORE;
+                if (msdu == first_subframe) {
+                        first_subframe = NULL;
+                        status->flag &= ~RX_FLAG_ALLOW_SAME_PN;
+                } else {
+                        status->flag |= RX_FLAG_ALLOW_SAME_PN;
+                }
                ath10k_process_rx(ar, status, msdu);
        }
 }
@@ -1584,7 +1657,7 @@ static int ath10k_htt_rx_handle_amsdu(struct ath10k_htt *htt)
                ath10k_htt_rx_h_unchain(ar, &amsdu);
        ath10k_htt_rx_h_filter(ar, &amsdu, rx_status);
-        ath10k_htt_rx_h_mpdu(ar, &amsdu, rx_status);
+        ath10k_htt_rx_h_mpdu(ar, &amsdu, rx_status, true);
        ath10k_htt_rx_h_deliver(ar, &amsdu, rx_status);
        return num_msdus;
@@ -1745,8 +1818,7 @@ static void ath10k_htt_rx_delba(struct ath10k *ar, struct htt_resp *resp)
 }
 static int ath10k_htt_rx_extract_amsdu(struct sk_buff_head *list,
-                                       struct sk_buff_head *amsdu,
+                                       struct sk_buff_head *amsdu)
-                                       int budget_left)
 {
        struct sk_buff *msdu;
        struct htt_rx_desc *rxd;
@@ -1757,9 +1829,8 @@ static int ath10k_htt_rx_extract_amsdu(struct sk_buff_head *list,
        if (WARN_ON(!skb_queue_empty(amsdu)))
                return -EINVAL;
-        while ((msdu = __skb_dequeue(list)) && budget_left) {
+        while ((msdu = __skb_dequeue(list))) {
                __skb_queue_tail(amsdu, msdu);
-                budget_left--;
                rxd = (void *)msdu->data - sizeof(*rxd);
                if (rxd->msdu_end.common.info0 &
@@ -1850,8 +1921,7 @@ static int ath10k_htt_rx_h_rx_offload(struct ath10k *ar,
        return num_msdu;
 }
-static int ath10k_htt_rx_in_ord_ind(struct ath10k *ar, struct sk_buff *skb,
+static int ath10k_htt_rx_in_ord_ind(struct ath10k *ar, struct sk_buff *skb)
-                                    int budget_left)
 {
        struct ath10k_htt *htt = &ar->htt;
        struct htt_resp *resp = (void *)skb->data;
@@ -1908,9 +1978,9 @@ static int ath10k_htt_rx_in_ord_ind(struct ath10k *ar, struct sk_buff *skb,
        if (offload)
                num_msdus = ath10k_htt_rx_h_rx_offload(ar, &list);
-        while (!skb_queue_empty(&list) && budget_left) {
+        while (!skb_queue_empty(&list)) {
                __skb_queue_head_init(&amsdu);
-                ret = ath10k_htt_rx_extract_amsdu(&list, &amsdu, budget_left);
+                ret = ath10k_htt_rx_extract_amsdu(&list, &amsdu);
                switch (ret) {
                case 0:
                        /* Note: The in-order indication may report interleaved
@@ -1920,10 +1990,9 @@ static int ath10k_htt_rx_in_ord_ind(struct ath10k *ar, struct sk_buff *skb,
                         * should still give an idea about rx rate to the user.
                         */
                        num_msdus += skb_queue_len(&amsdu);
-                        budget_left -= skb_queue_len(&amsdu);
                        ath10k_htt_rx_h_ppdu(ar, &amsdu, status, vdev_id);
                        ath10k_htt_rx_h_filter(ar, &amsdu, status);
-                        ath10k_htt_rx_h_mpdu(ar, &amsdu, status);
+                        ath10k_htt_rx_h_mpdu(ar, &amsdu, status, false);
                        ath10k_htt_rx_h_deliver(ar, &amsdu, status);
                        break;
                case -EAGAIN:
@@ -2563,8 +2632,7 @@ int ath10k_htt_txrx_compl_task(struct ath10k *ar, int budget)
                }
                spin_lock_bh(&htt->rx_ring.lock);
-                num_rx_msdus = ath10k_htt_rx_in_ord_ind(ar, skb,
+                num_rx_msdus = ath10k_htt_rx_in_ord_ind(ar, skb);
-                                                        (budget - quota));
                spin_unlock_bh(&htt->rx_ring.lock);
                if (num_rx_msdus < 0) {
                        resched_napi = true;
diff --git a/drivers/net/wireless/ath/ath10k/rx_desc.h b/drivers/net/wireless/ath/ath10k/rx_desc.h
index c1022a1cf855..28da14398951 100644
--- a/drivers/net/wireless/ath/ath10k/rx_desc.h
+++ b/drivers/net/wireless/ath/ath10k/rx_desc.h
@@ -239,6 +239,9 @@ enum htt_rx_mpdu_encrypt_type {
        HTT_RX_MPDU_ENCRYPT_WAPI             = 5,
        HTT_RX_MPDU_ENCRYPT_AES_CCM_WPA2     = 6,
        HTT_RX_MPDU_ENCRYPT_NONE             = 7,
+        HTT_RX_MPDU_ENCRYPT_AES_CCM256_WPA2  = 8,
+        HTT_RX_MPDU_ENCRYPT_AES_GCMP_WPA2    = 9,
+        HTT_RX_MPDU_ENCRYPT_AES_GCMP256_WPA2 = 10,
 };
 #define RX_MPDU_START_INFO0_PEER_IDX_MASK     0x000007ff
diff --git a/drivers/net/wireless/ath/wcn36xx/main.c b/drivers/net/wireless/ath/wcn36xx/main.c
index 35bd50bcbbd5..b83f01d6e3dd 100644
--- a/drivers/net/wireless/ath/wcn36xx/main.c
+++ b/drivers/net/wireless/ath/wcn36xx/main.c
@@ -812,7 +812,6 @@ static void wcn36xx_bss_info_changed(struct ieee80211_hw *hw,
                        if (!sta) {
                                wcn36xx_err("sta %pM is not found\n",
                                              bss_conf->bssid);
-                                rcu_read_unlock();
                                goto out;
                        }
                        sta_priv = wcn36xx_sta_to_priv(sta);
diff --git a/include/net/tcp.h b/include/net/tcp.h
index 33599d17522d..e6d0002a1b0b 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -1771,12 +1771,12 @@ static inline void tcp_highest_sack_reset(struct sock *sk)
        tcp_sk(sk)->highest_sack = tcp_write_queue_head(sk);
 }
-/* Called when old skb is about to be deleted (to be combined with new skb) */
+/* Called when old skb is about to be deleted and replaced by new skb */
-static inline void tcp_highest_sack_combine(struct sock *sk,
+static inline void tcp_highest_sack_replace(struct sock *sk,
                                            struct sk_buff *old,
                                            struct sk_buff *new)
 {
-        if (tcp_sk(sk)->sacked_out && (old == tcp_sk(sk)->highest_sack))
+        if (old == tcp_highest_sack(sk))
                tcp_sk(sk)->highest_sack = new;
 }
diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
index 0d7948ce2128..7bf4c750dd3a 100644
--- a/include/uapi/linux/bpf.h
+++ b/include/uapi/linux/bpf.h
@@ -788,7 +788,6 @@ struct xdp_md {
 enum sk_action {
        SK_DROP = 0,
        SK_PASS,
-        SK_REDIRECT,
 };
 #define BPF_TAG_SIZE    8
diff --git a/kernel/bpf/sockmap.c b/kernel/bpf/sockmap.c
index 66f00a2b27f4..dbd7b322a86b 100644
--- a/kernel/bpf/sockmap.c
+++ b/kernel/bpf/sockmap.c
@@ -101,13 +101,19 @@ static inline void bpf_compute_data_end_sk_skb(struct sk_buff *skb)
        TCP_SKB_CB(skb)->bpf.data_end = skb->data + skb_headlen(skb);
 }
+enum __sk_action {
+        __SK_DROP = 0,
+        __SK_PASS,
+        __SK_REDIRECT,
+};
 static int smap_verdict_func(struct smap_psock *psock, struct sk_buff *skb)
 {
        struct bpf_prog *prog = READ_ONCE(psock->bpf_verdict);
        int rc;
        if (unlikely(!prog))
-                return SK_DROP;
+                return __SK_DROP;
        skb_orphan(skb);
        /* We need to ensure that BPF metadata for maps is also cleared
@@ -122,8 +128,10 @@ static int smap_verdict_func(struct smap_psock *psock, struct sk_buff *skb)
        preempt_enable();
        skb->sk = NULL;
+        /* Moving return codes from UAPI namespace into internal namespace */
        return rc == SK_PASS ?
-                (TCP_SKB_CB(skb)->bpf.map ? SK_REDIRECT : SK_PASS) : SK_DROP;
+                (TCP_SKB_CB(skb)->bpf.map ? __SK_REDIRECT : __SK_PASS) :
+                __SK_DROP;
 }
 static void smap_do_verdict(struct smap_psock *psock, struct sk_buff *skb)
@@ -133,7 +141,7 @@ static void smap_do_verdict(struct smap_psock *psock, struct sk_buff *skb)
        rc = smap_verdict_func(psock, skb);
        switch (rc) {
-        case SK_REDIRECT:
+        case __SK_REDIRECT:
                sk = do_sk_redirect_map(skb);
                if (likely(sk)) {
                        struct smap_psock *peer = smap_psock_sk(sk);
@@ -149,7 +157,7 @@ static void smap_do_verdict(struct smap_psock *psock, struct sk_buff *skb)
                        }
                }
        /* Fall through and free skb otherwise */
-        case SK_DROP:
+        case __SK_DROP:
        default:
                kfree_skb(skb);
        }
diff --git a/net/ife/ife.c b/net/ife/ife.c
index f360341c72eb..7d1ec76e7f43 100644
--- a/net/ife/ife.c
+++ b/net/ife/ife.c
@@ -137,6 +137,6 @@ int ife_tlv_meta_encode(void *skbdata, u16 attrtype, u16 dlen, const void *dval)
 EXPORT_SYMBOL_GPL(ife_tlv_meta_encode);
 MODULE_AUTHOR("Jamal Hadi Salim <jhs@mojatatu.com>");
-MODULE_AUTHOR("Yotam Gigi <yotamg@mellanox.com>");
+MODULE_AUTHOR("Yotam Gigi <yotam.gi@gmail.com>");
 MODULE_DESCRIPTION("Inter-FE LFB action");
 MODULE_LICENSE("GPL");
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index ae60dd3faed0..823003eef3a2 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -2062,6 +2062,7 @@ static int tcp_mtu_probe(struct sock *sk)
        nskb->ip_summed = skb->ip_summed;
        tcp_insert_write_queue_before(nskb, skb, sk);
+        tcp_highest_sack_replace(sk, skb, nskb);
        len = 0;
        tcp_for_write_queue_from_safe(skb, next, sk) {
@@ -2665,7 +2666,7 @@ static bool tcp_collapse_retrans(struct sock *sk, struct sk_buff *skb)
                else if (!skb_shift(skb, next_skb, next_skb_size))
                        return false;
        }
-        tcp_highest_sack_combine(sk, next_skb, skb);
+        tcp_highest_sack_replace(sk, next_skb, skb);
        tcp_unlink_write_queue(next_skb, sk);
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 4a96ebbf8eda..8a1c846d3df9 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -3335,6 +3335,7 @@ static void addrconf_permanent_addr(struct net_device *dev)
                if ((ifp->flags & IFA_F_PERMANENT) &&
                    fixup_permanent_addr(idev, ifp) < 0) {
                        write_unlock_bh(&idev->lock);
+                        in6_ifa_hold(ifp);
                        ipv6_del_addr(ifp);
                        write_lock_bh(&idev->lock);
diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
index f50452b919d5..0c2738349442 100644
--- a/net/l2tp/l2tp_ppp.c
+++ b/net/l2tp/l2tp_ppp.c
@@ -584,6 +584,7 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
        u32 tunnel_id, peer_tunnel_id;
        u32 session_id, peer_session_id;
        bool drop_refcnt = false;
+        bool drop_tunnel = false;
        int ver = 2;
        int fd;
@@ -652,7 +653,9 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
        if (tunnel_id == 0)
                goto end;
-        tunnel = l2tp_tunnel_find(sock_net(sk), tunnel_id);
+        tunnel = l2tp_tunnel_get(sock_net(sk), tunnel_id);
+        if (tunnel)
+                drop_tunnel = true;
        /* Special case: create tunnel context if session_id and
         * peer_session_id is 0. Otherwise look up tunnel using supplied
@@ -781,6 +784,8 @@ out_no_ppp:
 end:
        if (drop_refcnt)
                l2tp_session_dec_refcount(session);
+        if (drop_tunnel)
+                l2tp_tunnel_dec_refcount(tunnel);
        release_sock(sk);
        return error;
diff --git a/net/psample/psample.c b/net/psample/psample.c
index 3a6ad0f438dc..64f95624f219 100644
--- a/net/psample/psample.c
+++ b/net/psample/psample.c
@@ -296,6 +296,6 @@ static void __exit psample_module_exit(void)
 module_init(psample_module_init);
 module_exit(psample_module_exit);
-MODULE_AUTHOR("Yotam Gigi <yotamg@mellanox.com>");
+MODULE_AUTHOR("Yotam Gigi <yotam.gi@gmail.com>");
 MODULE_DESCRIPTION("netlink channel for packet sampling");
 MODULE_LICENSE("GPL v2");
diff --git a/net/sched/act_sample.c b/net/sched/act_sample.c
index a9f9a2ccc664..8b5abcd2f32f 100644
--- a/net/sched/act_sample.c
+++ b/net/sched/act_sample.c
@@ -271,6 +271,6 @@ static void __exit sample_cleanup_module(void)
 module_init(sample_init_module);
 module_exit(sample_cleanup_module);
-MODULE_AUTHOR("Yotam Gigi <yotamg@mellanox.com>");
+MODULE_AUTHOR("Yotam Gigi <yotam.gi@gmail.com>");
 MODULE_DESCRIPTION("Packet sampling action");
 MODULE_LICENSE("GPL v2");
diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
index 231181c602ed..b2d310745487 100644
--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -280,8 +280,8 @@ static void tcf_block_put_final(struct work_struct *work)
        struct tcf_block *block = container_of(work, struct tcf_block, work);
        struct tcf_chain *chain, *tmp;
-        /* At this point, all the chains should have refcnt == 1. */
        rtnl_lock();
+        /* Only chain 0 should be still here. */
        list_for_each_entry_safe(chain, tmp, &block->chain_list, list)
                tcf_chain_put(chain);
        rtnl_unlock();
@@ -289,23 +289,17 @@ static void tcf_block_put_final(struct work_struct *work)
 }
 /* XXX: Standalone actions are not allowed to jump to any chain, and bound
- * actions should be all removed after flushing. However, filters are destroyed
+ * actions should be all removed after flushing. However, filters are now
- * in RCU callbacks, we have to hold the chains first, otherwise we would
+ * destroyed in tc filter workqueue with RTNL lock, they can not race here.
- * always race with RCU callbacks on this list without proper locking.
 */
-static void tcf_block_put_deferred(struct work_struct *work)
+void tcf_block_put(struct tcf_block *block)
 {
-        struct tcf_block *block = container_of(work, struct tcf_block, work);
+        struct tcf_chain *chain, *tmp;
-        struct tcf_chain *chain;
-        rtnl_lock();
+        if (!block)
-        /* Hold a refcnt for all chains, except 0, in case they are gone. */
+                return;
-        list_for_each_entry(chain, &block->chain_list, list)
-                if (chain->index)
-                        tcf_chain_hold(chain);
-        /* No race on the list, because no chain could be destroyed. */
+        list_for_each_entry_safe(chain, tmp, &block->chain_list, list)
-        list_for_each_entry(chain, &block->chain_list, list)
                tcf_chain_flush(chain);
        INIT_WORK(&block->work, tcf_block_put_final);
@@ -314,21 +308,6 @@ static void tcf_block_put_deferred(struct work_struct *work)
         */
        rcu_barrier();
        tcf_queue_work(&block->work);
-        rtnl_unlock();
-}
-void tcf_block_put(struct tcf_block *block)
-{
-        if (!block)
-                return;
-        INIT_WORK(&block->work, tcf_block_put_deferred);
-        /* Wait for existing RCU callbacks to cool down, make sure their works
-         * have been queued before this. We can not flush pending works here
-         * because we are holding the RTNL lock.
-         */
-        rcu_barrier();
-        tcf_queue_work(&block->work);
 }
 EXPORT_SYMBOL(tcf_block_put);
diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c
index 31a2e6d34dba..73ad8c8ef344 100644
--- a/net/xfrm/xfrm_output.c
+++ b/net/xfrm/xfrm_output.c
@@ -105,6 +105,9 @@ static int xfrm_output_one(struct sk_buff *skb, int err)
                if (xfrm_offload(skb)) {
                        x->type_offload->encap(x, skb);
                } else {
+                        /* Inner headers are invalid now. */
+                        skb->encapsulation = 0;
                        err = x->type->output(x, skb);
                        if (err == -EINPROGRESS)
                                goto out;
@@ -208,7 +211,6 @@ int xfrm_output(struct sock *sk, struct sk_buff *skb)
        int err;
        secpath_reset(skb);
-        skb->encapsulation = 0;
        if (xfrm_dev_offload_ok(skb, x)) {
                struct sec_path *sp;
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 2746b62a8944..8cafb3c0a4ac 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -2076,7 +2076,6 @@ make_dummy_bundle:
        xdst->num_xfrms = num_xfrms;
        memcpy(xdst->pols, pols, sizeof(struct xfrm_policy *) * num_pols);
-        dst_hold(&xdst->u.dst);
        return xdst;
 inc_error:
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index 12213477cd3a..1f5cee2269af 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -2069,6 +2069,7 @@ int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen
        if (err >= 0) {
                xfrm_sk_policy_insert(sk, err, pol);
                xfrm_pol_put(pol);
+                __sk_dst_reset(sk);
                err = 0;
        }
diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h
index c174971afbe6..01cc7ba39924 100644
--- a/tools/include/uapi/linux/bpf.h
+++ b/tools/include/uapi/linux/bpf.h
@@ -576,7 +576,7 @@ union bpf_attr {
 *     @map: pointer to sockmap
 *     @key: key to lookup sock in map
 *     @flags: reserved for future use
- *     Return: SK_REDIRECT
+ *     Return: SK_PASS
 *
 * int bpf_sock_map_update(skops, map, key, flags)
 *      @skops: pointer to bpf_sock_ops
@@ -789,7 +789,6 @@ struct xdp_md {
 enum sk_action {
        SK_DROP = 0,
        SK_PASS,
-        SK_REDIRECT,
 };
 #define BPF_TAG_SIZE    8
diff --git a/tools/testing/selftests/tc-testing/tdc.py b/tools/testing/selftests/tc-testing/tdc.py
index 5f11f5d7456e..a8981c5d0aaf 100755
--- a/tools/testing/selftests/tc-testing/tdc.py
+++ b/tools/testing/selftests/tc-testing/tdc.py
@@ -152,11 +152,11 @@ def ns_create():
        exec_cmd(cmd, False)
        cmd = 'ip link set $DEV0 up'
        exec_cmd(cmd, False)
-        cmd = 'ip -s $NS link set $DEV1 up'
+        cmd = 'ip -n $NS link set $DEV1 up'
        exec_cmd(cmd, False)
        cmd = 'ip link set $DEV2 netns $NS'
        exec_cmd(cmd, False)
-        cmd = 'ip -s $NS link set $DEV2 up'
+        cmd = 'ip -n $NS link set $DEV2 up'
        exec_cmd(cmd, False)