108 files changed, 1291 insertions, 523 deletions

diff --git a/Documentation/DocBook/device-drivers.tmpl b/Documentation/DocBook/device-drivers.tmpl
index de79efdad46c..8c68768ebee5 100644
--- a/Documentation/DocBook/device-drivers.tmpl
+++ b/Documentation/DocBook/device-drivers.tmpl
@@ -128,16 +128,44 @@ X!Edrivers/base/interface.c
 !Edrivers/base/platform.c
 !Edrivers/base/bus.c
      </sect1>
-     <sect1><title>Device Drivers DMA Management</title>
+     <sect1>
+       <title>Buffer Sharing and Synchronization</title>
+       <para>
+         The dma-buf subsystem provides the framework for sharing buffers
+         for hardware (DMA) access across multiple device drivers and
+         subsystems, and for synchronizing asynchronous hardware access.
+       </para>
+       <para>
+         This is used, for example, by drm "prime" multi-GPU support, but
+         is of course not limited to GPU use cases.
+       </para>
+       <para>
+         The three main components of this are: (1) dma-buf, representing
+         a sg_table and exposed to userspace as a file descriptor to allow
+         passing between devices, (2) fence, which provides a mechanism
+         to signal when one device as finished access, and (3) reservation,
+         which manages the shared or exclusive fence(s) associated with
+         the buffer.
+       </para>
+       <sect2><title>dma-buf</title>
 !Edrivers/dma-buf/dma-buf.c
+!Iinclude/linux/dma-buf.h
+       </sect2>
+       <sect2><title>reservation</title>
+!Pdrivers/dma-buf/reservation.c Reservation Object Overview
+!Edrivers/dma-buf/reservation.c
+!Iinclude/linux/reservation.h
+       </sect2>
+       <sect2><title>fence</title>
 !Edrivers/dma-buf/fence.c
-!Edrivers/dma-buf/seqno-fence.c
 !Iinclude/linux/fence.h
+!Edrivers/dma-buf/seqno-fence.c
 !Iinclude/linux/seqno-fence.h
-!Edrivers/dma-buf/reservation.c
-!Iinclude/linux/reservation.h
 !Edrivers/dma-buf/sync_file.c
 !Iinclude/linux/sync_file.h
+       </sect2>
+     </sect1>
+     <sect1><title>Device Drivers DMA Management</title>
 !Edrivers/base/dma-coherent.c
 !Edrivers/base/dma-mapping.c
      </sect1>
diff --git a/Documentation/networking/dsa/dsa.txt b/Documentation/networking/dsa/dsa.txt
index 631b0f7ae16f..9d05ed7f7da5 100644
--- a/Documentation/networking/dsa/dsa.txt
+++ b/Documentation/networking/dsa/dsa.txt
@@ -369,8 +369,6 @@ does not allocate any driver private context space.
 Switch configuration
 --------------------
 
-- priv_size: additional size needed by the switch driver for its private context
-
 - tag_protocol: this is to indicate what kind of tagging protocol is supported,
   should be a valid value from the dsa_tag_protocol enum
 
@@ -416,11 +414,6 @@ PHY devices and link management
   to the switch port MDIO registers. If unavailable return a negative error
   code.
 
-- poll_link: Function invoked by DSA to query the link state of the switch
-  builtin Ethernet PHYs, per port. This function is responsible for calling
-  netif_carrier_{on,off} when appropriate, and can be used to poll all ports in a
-  single call. Executes from workqueue context.
-
 - adjust_link: Function invoked by the PHY library when a slave network device
   is attached to a PHY device. This function is responsible for appropriately
   configuring the switch port link parameters: speed, duplex, pause based on
@@ -542,6 +535,16 @@ Bridge layer
 Bridge VLAN filtering
 ---------------------
 
+- port_vlan_filtering: bridge layer function invoked when the bridge gets
+  configured for turning on or off VLAN filtering. If nothing specific needs to
+  be done at the hardware level, this callback does not need to be implemented.
+  When VLAN filtering is turned on, the hardware must be programmed with
+  rejecting 802.1Q frames which have VLAN IDs outside of the programmed allowed
+  VLAN ID map/rules.  If there is no PVID programmed into the switch port,
+  untagged frames must be rejected as well. When turned off the switch must
+  accept any 802.1Q frames irrespective of their VLAN ID, and untagged frames are
+  allowed.
+
 - port_vlan_prepare: bridge layer function invoked when the bridge prepares the
   configuration of a VLAN on the given port. If the operation is not supported
   by the hardware, this function should return -EOPNOTSUPP to inform the bridge
diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
index 6c7f365b1515..9ae929395b24 100644
--- a/Documentation/networking/ip-sysctl.txt
+++ b/Documentation/networking/ip-sysctl.txt
@@ -1036,15 +1036,17 @@ proxy_arp_pvlan - BOOLEAN
 
 shared_media - BOOLEAN
         Send(router) or accept(host) RFC1620 shared media redirects.
-        Overrides ip_secure_redirects.
+        Overrides secure_redirects.
         shared_media for the interface will be enabled if at least one of
         conf/{all,interface}/shared_media is set to TRUE,
         it will be disabled otherwise
         default TRUE
 
 secure_redirects - BOOLEAN
-        Accept ICMP redirect messages only for gateways,
-        listed in default gateway list.
+        Accept ICMP redirect messages only to gateways listed in the
+        interface's current gateway list. Even if disabled, RFC1122 redirect
+        rules still apply.
+        Overridden by shared_media.
         secure_redirects for the interface will be enabled if at least one of
         conf/{all,interface}/secure_redirects is set to TRUE,
         it will be disabled otherwise
diff --git a/MAINTAINERS b/MAINTAINERS
index 7304d2e37a98..ed42cb65a19b 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -7989,6 +7989,7 @@ Q:	http://patchwork.ozlabs.org/project/netdev/list/
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git
 S:      Odd Fixes
+F:      Documentation/devicetree/bindings/net/
 F:      drivers/net/
 F:      include/linux/if_*
 F:      include/linux/netdevice.h
@@ -8944,6 +8945,7 @@ M:	Linus Walleij <linus.walleij@linaro.org>
 L:      linux-gpio@vger.kernel.org
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl.git
 S:      Maintained
+F:      Documentation/devicetree/bindings/pinctrl/
 F:      drivers/pinctrl/
 F:      include/linux/pinctrl/
 
diff --git a/arch/s390/configs/default_defconfig b/arch/s390/configs/default_defconfig
index 0ac42cc4f880..d5ec71b2ed02 100644
--- a/arch/s390/configs/default_defconfig
+++ b/arch/s390/configs/default_defconfig
@@ -1,8 +1,7 @@
 CONFIG_SYSVIPC=y
 CONFIG_POSIX_MQUEUE=y
-CONFIG_FHANDLE=y
 CONFIG_AUDIT=y
-CONFIG_NO_HZ=y
+CONFIG_NO_HZ_IDLE=y
 CONFIG_HIGH_RES_TIMERS=y
 CONFIG_BSD_PROCESS_ACCT=y
 CONFIG_BSD_PROCESS_ACCT_V3=y
@@ -13,19 +12,19 @@ CONFIG_TASK_IO_ACCOUNTING=y
 CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_NUMA_BALANCING=y
-CONFIG_CGROUP_FREEZER=y
-CONFIG_CGROUP_PIDS=y
-CONFIG_CGROUP_DEVICE=y
-CONFIG_CPUSETS=y
-CONFIG_CGROUP_CPUACCT=y
 CONFIG_MEMCG=y
 CONFIG_MEMCG_SWAP=y
-CONFIG_MEMCG_KMEM=y
-CONFIG_CGROUP_HUGETLB=y
-CONFIG_CGROUP_PERF=y
+CONFIG_BLK_CGROUP=y
 CONFIG_CFS_BANDWIDTH=y
 CONFIG_RT_GROUP_SCHED=y
-CONFIG_BLK_CGROUP=y
+CONFIG_CGROUP_PIDS=y
+CONFIG_CGROUP_FREEZER=y
+CONFIG_CGROUP_HUGETLB=y
+CONFIG_CPUSETS=y
+CONFIG_CGROUP_DEVICE=y
+CONFIG_CGROUP_CPUACCT=y
+CONFIG_CGROUP_PERF=y
+CONFIG_CHECKPOINT_RESTORE=y
 CONFIG_NAMESPACES=y
 CONFIG_USER_NS=y
 CONFIG_SCHED_AUTOGROUP=y
@@ -55,7 +54,6 @@ CONFIG_UNIXWARE_DISKLABEL=y
 CONFIG_CFQ_GROUP_IOSCHED=y
 CONFIG_DEFAULT_DEADLINE=y
 CONFIG_LIVEPATCH=y
-CONFIG_MARCH_Z196=y
 CONFIG_TUNE_ZEC12=y
 CONFIG_NR_CPUS=256
 CONFIG_NUMA=y
@@ -65,6 +63,15 @@ CONFIG_MEMORY_HOTPLUG=y
 CONFIG_MEMORY_HOTREMOVE=y
 CONFIG_KSM=y
 CONFIG_TRANSPARENT_HUGEPAGE=y
+CONFIG_CLEANCACHE=y
+CONFIG_FRONTSWAP=y
+CONFIG_CMA=y
+CONFIG_MEM_SOFT_DIRTY=y
+CONFIG_ZPOOL=m
+CONFIG_ZBUD=m
+CONFIG_ZSMALLOC=m
+CONFIG_ZSMALLOC_STAT=y
+CONFIG_IDLE_PAGE_TRACKING=y
 CONFIG_PCI=y
 CONFIG_PCI_DEBUG=y
 CONFIG_HOTPLUG_PCI=y
@@ -452,6 +459,7 @@ CONFIG_HW_RANDOM_VIRTIO=m
 CONFIG_RAW_DRIVER=m
 CONFIG_HANGCHECK_TIMER=m
 CONFIG_TN3270_FS=y
+# CONFIG_HWMON is not set
 CONFIG_WATCHDOG=y
 CONFIG_WATCHDOG_NOWAYOUT=y
 CONFIG_SOFT_WATCHDOG=m
@@ -537,6 +545,8 @@ CONFIG_DLM=m
 CONFIG_PRINTK_TIME=y
 CONFIG_DYNAMIC_DEBUG=y
 CONFIG_DEBUG_INFO=y
+CONFIG_DEBUG_INFO_DWARF4=y
+CONFIG_GDB_SCRIPTS=y
 CONFIG_FRAME_WARN=1024
 CONFIG_READABLE_ASM=y
 CONFIG_UNUSED_SYMBOLS=y
@@ -555,13 +565,17 @@ CONFIG_SLUB_DEBUG_ON=y
 CONFIG_SLUB_STATS=y
 CONFIG_DEBUG_STACK_USAGE=y
 CONFIG_DEBUG_VM=y
+CONFIG_DEBUG_VM_VMACACHE=y
 CONFIG_DEBUG_VM_RB=y
+CONFIG_DEBUG_VM_PGFLAGS=y
 CONFIG_DEBUG_MEMORY_INIT=y
 CONFIG_MEMORY_NOTIFIER_ERROR_INJECT=m
 CONFIG_DEBUG_PER_CPU_MAPS=y
 CONFIG_DEBUG_SHIRQ=y
 CONFIG_DETECT_HUNG_TASK=y
+CONFIG_WQ_WATCHDOG=y
 CONFIG_PANIC_ON_OOPS=y
+CONFIG_DEBUG_TIMEKEEPING=y
 CONFIG_TIMER_STATS=y
 CONFIG_DEBUG_RT_MUTEXES=y
 CONFIG_DEBUG_WW_MUTEX_SLOWPATH=y
@@ -596,6 +610,8 @@ CONFIG_FTRACE_SYSCALLS=y
 CONFIG_STACK_TRACER=y
 CONFIG_BLK_DEV_IO_TRACE=y
 CONFIG_UPROBE_EVENT=y
+CONFIG_FUNCTION_PROFILER=y
+CONFIG_TRACE_ENUM_MAP_FILE=y
 CONFIG_LKDTM=m
 CONFIG_TEST_LIST_SORT=y
 CONFIG_KPROBES_SANITY_TEST=y
@@ -607,7 +623,6 @@ CONFIG_TEST_STRING_HELPERS=y
 CONFIG_TEST_KSTRTOX=y
 CONFIG_DMA_API_DEBUG=y
 CONFIG_TEST_BPF=m
-# CONFIG_STRICT_DEVMEM is not set
 CONFIG_S390_PTDUMP=y
 CONFIG_ENCRYPTED_KEYS=m
 CONFIG_SECURITY=y
@@ -651,7 +666,6 @@ CONFIG_CRYPTO_SEED=m
 CONFIG_CRYPTO_SERPENT=m
 CONFIG_CRYPTO_TEA=m
 CONFIG_CRYPTO_TWOFISH=m
-CONFIG_CRYPTO_ZLIB=y
 CONFIG_CRYPTO_LZO=m
 CONFIG_CRYPTO_LZ4=m
 CONFIG_CRYPTO_LZ4HC=m
@@ -664,7 +678,7 @@ CONFIG_CRYPTO_SHA512_S390=m
 CONFIG_CRYPTO_DES_S390=m
 CONFIG_CRYPTO_AES_S390=m
 CONFIG_CRYPTO_GHASH_S390=m
-CONFIG_ASYMMETRIC_KEY_TYPE=m
+CONFIG_ASYMMETRIC_KEY_TYPE=y
 CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE=m
 CONFIG_X509_CERTIFICATE_PARSER=m
 CONFIG_CRC7=m
diff --git a/arch/s390/configs/gcov_defconfig b/arch/s390/configs/gcov_defconfig
index a31dcd56f7c0..f46a35115d2d 100644
--- a/arch/s390/configs/gcov_defconfig
+++ b/arch/s390/configs/gcov_defconfig
@@ -1,8 +1,7 @@
 CONFIG_SYSVIPC=y
 CONFIG_POSIX_MQUEUE=y
-CONFIG_FHANDLE=y
 CONFIG_AUDIT=y
-CONFIG_NO_HZ=y
+CONFIG_NO_HZ_IDLE=y
 CONFIG_HIGH_RES_TIMERS=y
 CONFIG_BSD_PROCESS_ACCT=y
 CONFIG_BSD_PROCESS_ACCT_V3=y
@@ -13,17 +12,17 @@ CONFIG_TASK_IO_ACCOUNTING=y
 CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_NUMA_BALANCING=y
-CONFIG_CGROUP_FREEZER=y
-CONFIG_CGROUP_PIDS=y
-CONFIG_CGROUP_DEVICE=y
-CONFIG_CPUSETS=y
-CONFIG_CGROUP_CPUACCT=y
 CONFIG_MEMCG=y
 CONFIG_MEMCG_SWAP=y
-CONFIG_MEMCG_KMEM=y
+CONFIG_BLK_CGROUP=y
+CONFIG_CGROUP_PIDS=y
+CONFIG_CGROUP_FREEZER=y
 CONFIG_CGROUP_HUGETLB=y
+CONFIG_CPUSETS=y
+CONFIG_CGROUP_DEVICE=y
+CONFIG_CGROUP_CPUACCT=y
 CONFIG_CGROUP_PERF=y
-CONFIG_BLK_CGROUP=y
+CONFIG_CHECKPOINT_RESTORE=y
 CONFIG_NAMESPACES=y
 CONFIG_USER_NS=y
 CONFIG_SCHED_AUTOGROUP=y
@@ -53,7 +52,6 @@ CONFIG_SOLARIS_X86_PARTITION=y
 CONFIG_UNIXWARE_DISKLABEL=y
 CONFIG_CFQ_GROUP_IOSCHED=y
 CONFIG_DEFAULT_DEADLINE=y
-CONFIG_MARCH_Z196=y
 CONFIG_TUNE_ZEC12=y
 CONFIG_NR_CPUS=256
 CONFIG_NUMA=y
@@ -62,6 +60,14 @@ CONFIG_MEMORY_HOTPLUG=y
 CONFIG_MEMORY_HOTREMOVE=y
 CONFIG_KSM=y
 CONFIG_TRANSPARENT_HUGEPAGE=y
+CONFIG_CLEANCACHE=y
+CONFIG_FRONTSWAP=y
+CONFIG_CMA=y
+CONFIG_ZSWAP=y
+CONFIG_ZBUD=m
+CONFIG_ZSMALLOC=m
+CONFIG_ZSMALLOC_STAT=y
+CONFIG_IDLE_PAGE_TRACKING=y
 CONFIG_PCI=y
 CONFIG_HOTPLUG_PCI=y
 CONFIG_HOTPLUG_PCI_S390=y
@@ -530,6 +536,8 @@ CONFIG_NLS_UTF8=m
 CONFIG_DLM=m
 CONFIG_PRINTK_TIME=y
 CONFIG_DEBUG_INFO=y
+CONFIG_DEBUG_INFO_DWARF4=y
+CONFIG_GDB_SCRIPTS=y
 # CONFIG_ENABLE_MUST_CHECK is not set
 CONFIG_FRAME_WARN=1024
 CONFIG_UNUSED_SYMBOLS=y
@@ -547,13 +555,13 @@ CONFIG_LATENCYTOP=y
 CONFIG_DEBUG_STRICT_USER_COPY_CHECKS=y
 CONFIG_BLK_DEV_IO_TRACE=y
 # CONFIG_KPROBE_EVENT is not set
+CONFIG_TRACE_ENUM_MAP_FILE=y
 CONFIG_LKDTM=m
 CONFIG_RBTREE_TEST=m
 CONFIG_INTERVAL_TREE_TEST=m
 CONFIG_PERCPU_TEST=m
 CONFIG_ATOMIC64_SELFTEST=y
 CONFIG_TEST_BPF=m
-# CONFIG_STRICT_DEVMEM is not set
 CONFIG_S390_PTDUMP=y
 CONFIG_ENCRYPTED_KEYS=m
 CONFIG_SECURITY=y
@@ -597,8 +605,6 @@ CONFIG_CRYPTO_SEED=m
 CONFIG_CRYPTO_SERPENT=m
 CONFIG_CRYPTO_TEA=m
 CONFIG_CRYPTO_TWOFISH=m
-CONFIG_CRYPTO_ZLIB=y
-CONFIG_CRYPTO_LZO=m
 CONFIG_CRYPTO_LZ4=m
 CONFIG_CRYPTO_LZ4HC=m
 CONFIG_CRYPTO_USER_API_HASH=m
@@ -610,7 +616,7 @@ CONFIG_CRYPTO_SHA512_S390=m
 CONFIG_CRYPTO_DES_S390=m
 CONFIG_CRYPTO_AES_S390=m
 CONFIG_CRYPTO_GHASH_S390=m
-CONFIG_ASYMMETRIC_KEY_TYPE=m
+CONFIG_ASYMMETRIC_KEY_TYPE=y
 CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE=m
 CONFIG_X509_CERTIFICATE_PARSER=m
 CONFIG_CRC7=m
diff --git a/arch/s390/configs/performance_defconfig b/arch/s390/configs/performance_defconfig
index 7b73bf353345..ba0f2a58b8cd 100644
--- a/arch/s390/configs/performance_defconfig
+++ b/arch/s390/configs/performance_defconfig
@@ -1,8 +1,7 @@
 CONFIG_SYSVIPC=y
 CONFIG_POSIX_MQUEUE=y
-CONFIG_FHANDLE=y
 CONFIG_AUDIT=y
-CONFIG_NO_HZ=y
+CONFIG_NO_HZ_IDLE=y
 CONFIG_HIGH_RES_TIMERS=y
 CONFIG_BSD_PROCESS_ACCT=y
 CONFIG_BSD_PROCESS_ACCT_V3=y
@@ -14,17 +13,17 @@ CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_NUMA_BALANCING=y
 # CONFIG_NUMA_BALANCING_DEFAULT_ENABLED is not set
-CONFIG_CGROUP_FREEZER=y
-CONFIG_CGROUP_PIDS=y
-CONFIG_CGROUP_DEVICE=y
-CONFIG_CPUSETS=y
-CONFIG_CGROUP_CPUACCT=y
 CONFIG_MEMCG=y
 CONFIG_MEMCG_SWAP=y
-CONFIG_MEMCG_KMEM=y
+CONFIG_BLK_CGROUP=y
+CONFIG_CGROUP_PIDS=y
+CONFIG_CGROUP_FREEZER=y
 CONFIG_CGROUP_HUGETLB=y
+CONFIG_CPUSETS=y
+CONFIG_CGROUP_DEVICE=y
+CONFIG_CGROUP_CPUACCT=y
 CONFIG_CGROUP_PERF=y
-CONFIG_BLK_CGROUP=y
+CONFIG_CHECKPOINT_RESTORE=y
 CONFIG_NAMESPACES=y
 CONFIG_USER_NS=y
 CONFIG_SCHED_AUTOGROUP=y
@@ -53,7 +52,6 @@ CONFIG_UNIXWARE_DISKLABEL=y
 CONFIG_CFQ_GROUP_IOSCHED=y
 CONFIG_DEFAULT_DEADLINE=y
 CONFIG_LIVEPATCH=y
-CONFIG_MARCH_Z196=y
 CONFIG_TUNE_ZEC12=y
 CONFIG_NR_CPUS=512
 CONFIG_NUMA=y
@@ -62,6 +60,14 @@ CONFIG_MEMORY_HOTPLUG=y
 CONFIG_MEMORY_HOTREMOVE=y
 CONFIG_KSM=y
 CONFIG_TRANSPARENT_HUGEPAGE=y
+CONFIG_CLEANCACHE=y
+CONFIG_FRONTSWAP=y
+CONFIG_CMA=y
+CONFIG_ZSWAP=y
+CONFIG_ZBUD=m
+CONFIG_ZSMALLOC=m
+CONFIG_ZSMALLOC_STAT=y
+CONFIG_IDLE_PAGE_TRACKING=y
 CONFIG_PCI=y
 CONFIG_HOTPLUG_PCI=y
 CONFIG_HOTPLUG_PCI_S390=y
@@ -447,6 +453,7 @@ CONFIG_HW_RANDOM_VIRTIO=m
 CONFIG_RAW_DRIVER=m
 CONFIG_HANGCHECK_TIMER=m
 CONFIG_TN3270_FS=y
+# CONFIG_HWMON is not set
 CONFIG_WATCHDOG=y
 CONFIG_WATCHDOG_NOWAYOUT=y
 CONFIG_SOFT_WATCHDOG=m
@@ -530,6 +537,8 @@ CONFIG_NLS_UTF8=m
 CONFIG_DLM=m
 CONFIG_PRINTK_TIME=y
 CONFIG_DEBUG_INFO=y
+CONFIG_DEBUG_INFO_DWARF4=y
+CONFIG_GDB_SCRIPTS=y
 # CONFIG_ENABLE_MUST_CHECK is not set
 CONFIG_FRAME_WARN=1024
 CONFIG_UNUSED_SYMBOLS=y
@@ -546,11 +555,12 @@ CONFIG_FTRACE_SYSCALLS=y
 CONFIG_STACK_TRACER=y
 CONFIG_BLK_DEV_IO_TRACE=y
 CONFIG_UPROBE_EVENT=y
+CONFIG_FUNCTION_PROFILER=y
+CONFIG_TRACE_ENUM_MAP_FILE=y
 CONFIG_LKDTM=m
 CONFIG_PERCPU_TEST=m
 CONFIG_ATOMIC64_SELFTEST=y
 CONFIG_TEST_BPF=m
-# CONFIG_STRICT_DEVMEM is not set
 CONFIG_S390_PTDUMP=y
 CONFIG_ENCRYPTED_KEYS=m
 CONFIG_SECURITY=y
@@ -594,8 +604,6 @@ CONFIG_CRYPTO_SEED=m
 CONFIG_CRYPTO_SERPENT=m
 CONFIG_CRYPTO_TEA=m
 CONFIG_CRYPTO_TWOFISH=m
-CONFIG_CRYPTO_ZLIB=y
-CONFIG_CRYPTO_LZO=m
 CONFIG_CRYPTO_LZ4=m
 CONFIG_CRYPTO_LZ4HC=m
 CONFIG_CRYPTO_USER_API_HASH=m
@@ -607,7 +615,7 @@ CONFIG_CRYPTO_SHA512_S390=m
 CONFIG_CRYPTO_DES_S390=m
 CONFIG_CRYPTO_AES_S390=m
 CONFIG_CRYPTO_GHASH_S390=m
-CONFIG_ASYMMETRIC_KEY_TYPE=m
+CONFIG_ASYMMETRIC_KEY_TYPE=y
 CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE=m
 CONFIG_X509_CERTIFICATE_PARSER=m
 CONFIG_CRC7=m
diff --git a/arch/s390/configs/zfcpdump_defconfig b/arch/s390/configs/zfcpdump_defconfig
index 1719843a55a2..4366a3e3e754 100644
--- a/arch/s390/configs/zfcpdump_defconfig
+++ b/arch/s390/configs/zfcpdump_defconfig
@@ -1,5 +1,5 @@
 # CONFIG_SWAP is not set
-CONFIG_NO_HZ=y
+CONFIG_NO_HZ_IDLE=y
 CONFIG_HIGH_RES_TIMERS=y
 CONFIG_BLK_DEV_INITRD=y
 CONFIG_CC_OPTIMIZE_FOR_SIZE=y
@@ -7,7 +7,6 @@ CONFIG_CC_OPTIMIZE_FOR_SIZE=y
 CONFIG_PARTITION_ADVANCED=y
 CONFIG_IBM_PARTITION=y
 CONFIG_DEFAULT_DEADLINE=y
-CONFIG_MARCH_Z196=y
 CONFIG_TUNE_ZEC12=y
 # CONFIG_COMPAT is not set
 CONFIG_NR_CPUS=2
@@ -64,7 +63,6 @@ CONFIG_PANIC_ON_OOPS=y
 # CONFIG_SCHED_DEBUG is not set
 CONFIG_RCU_CPU_STALL_TIMEOUT=60
 # CONFIG_FTRACE is not set
-# CONFIG_STRICT_DEVMEM is not set
 # CONFIG_PFAULT is not set
 # CONFIG_S390_HYPFS_FS is not set
 # CONFIG_VIRTUALIZATION is not set
diff --git a/arch/s390/defconfig b/arch/s390/defconfig
index e24f2af4c73b..3f571ea89509 100644
--- a/arch/s390/defconfig
+++ b/arch/s390/defconfig
@@ -1,8 +1,8 @@
 CONFIG_SYSVIPC=y
 CONFIG_POSIX_MQUEUE=y
-CONFIG_FHANDLE=y
+CONFIG_USELIB=y
 CONFIG_AUDIT=y
-CONFIG_NO_HZ=y
+CONFIG_NO_HZ_IDLE=y
 CONFIG_HIGH_RES_TIMERS=y
 CONFIG_TASKSTATS=y
 CONFIG_TASK_DELAY_ACCT=y
@@ -11,19 +11,19 @@ CONFIG_TASK_IO_ACCOUNTING=y
 CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_CGROUPS=y
-CONFIG_CGROUP_FREEZER=y
-CONFIG_CGROUP_PIDS=y
-CONFIG_CGROUP_DEVICE=y
-CONFIG_CPUSETS=y
-CONFIG_CGROUP_CPUACCT=y
 CONFIG_MEMCG=y
 CONFIG_MEMCG_SWAP=y
-CONFIG_MEMCG_KMEM=y
-CONFIG_CGROUP_HUGETLB=y
-CONFIG_CGROUP_PERF=y
+CONFIG_BLK_CGROUP=y
 CONFIG_CGROUP_SCHED=y
 CONFIG_RT_GROUP_SCHED=y
-CONFIG_BLK_CGROUP=y
+CONFIG_CGROUP_PIDS=y
+CONFIG_CGROUP_FREEZER=y
+CONFIG_CGROUP_HUGETLB=y
+CONFIG_CPUSETS=y
+CONFIG_CGROUP_DEVICE=y
+CONFIG_CGROUP_CPUACCT=y
+CONFIG_CGROUP_PERF=y
+CONFIG_CHECKPOINT_RESTORE=y
 CONFIG_NAMESPACES=y
 CONFIG_USER_NS=y
 CONFIG_BLK_DEV_INITRD=y
@@ -44,7 +44,6 @@ CONFIG_PARTITION_ADVANCED=y
 CONFIG_IBM_PARTITION=y
 CONFIG_DEFAULT_DEADLINE=y
 CONFIG_LIVEPATCH=y
-CONFIG_MARCH_Z196=y
 CONFIG_NR_CPUS=256
 CONFIG_NUMA=y
 CONFIG_HZ_100=y
@@ -52,6 +51,14 @@ CONFIG_MEMORY_HOTPLUG=y
 CONFIG_MEMORY_HOTREMOVE=y
 CONFIG_KSM=y
 CONFIG_TRANSPARENT_HUGEPAGE=y
+CONFIG_CLEANCACHE=y
+CONFIG_FRONTSWAP=y
+CONFIG_CMA=y
+CONFIG_ZSWAP=y
+CONFIG_ZBUD=m
+CONFIG_ZSMALLOC=m
+CONFIG_ZSMALLOC_STAT=y
+CONFIG_IDLE_PAGE_TRACKING=y
 CONFIG_CRASH_DUMP=y
 CONFIG_BINFMT_MISC=m
 CONFIG_HIBERNATION=y
@@ -61,7 +68,6 @@ CONFIG_UNIX=y
 CONFIG_NET_KEY=y
 CONFIG_INET=y
 CONFIG_IP_MULTICAST=y
-# CONFIG_INET_LRO is not set
 CONFIG_L2TP=m
 CONFIG_L2TP_DEBUGFS=m
 CONFIG_VLAN_8021Q=y
@@ -144,6 +150,9 @@ CONFIG_TMPFS=y
 CONFIG_TMPFS_POSIX_ACL=y
 CONFIG_HUGETLBFS=y
 # CONFIG_NETWORK_FILESYSTEMS is not set
+CONFIG_DEBUG_INFO=y
+CONFIG_DEBUG_INFO_DWARF4=y
+CONFIG_GDB_SCRIPTS=y
 CONFIG_UNUSED_SYMBOLS=y
 CONFIG_DEBUG_SECTION_MISMATCH=y
 CONFIG_DEBUG_FORCE_WEAK_PER_CPU=y
@@ -158,20 +167,21 @@ CONFIG_LOCK_STAT=y
 CONFIG_DEBUG_LOCKDEP=y
 CONFIG_DEBUG_ATOMIC_SLEEP=y
 CONFIG_DEBUG_LIST=y
-CONFIG_DEBUG_PI_LIST=y
 CONFIG_DEBUG_SG=y
 CONFIG_DEBUG_NOTIFIERS=y
 CONFIG_RCU_CPU_STALL_TIMEOUT=60
 CONFIG_RCU_TRACE=y
 CONFIG_LATENCYTOP=y
 CONFIG_DEBUG_STRICT_USER_COPY_CHECKS=y
-CONFIG_TRACER_SNAPSHOT=y
+CONFIG_SCHED_TRACER=y
+CONFIG_FTRACE_SYSCALLS=y
 CONFIG_TRACER_SNAPSHOT_PER_CPU_SWAP=y
 CONFIG_STACK_TRACER=y
 CONFIG_BLK_DEV_IO_TRACE=y
 CONFIG_UPROBE_EVENT=y
+CONFIG_FUNCTION_PROFILER=y
+CONFIG_TRACE_ENUM_MAP_FILE=y
 CONFIG_KPROBES_SANITY_TEST=y
-# CONFIG_STRICT_DEVMEM is not set
 CONFIG_S390_PTDUMP=y
 CONFIG_CRYPTO_CRYPTD=m
 CONFIG_CRYPTO_AUTHENC=m
@@ -212,8 +222,6 @@ CONFIG_CRYPTO_SERPENT=m
 CONFIG_CRYPTO_TEA=m
 CONFIG_CRYPTO_TWOFISH=m
 CONFIG_CRYPTO_DEFLATE=m
-CONFIG_CRYPTO_ZLIB=m
-CONFIG_CRYPTO_LZO=m
 CONFIG_CRYPTO_LZ4=m
 CONFIG_CRYPTO_LZ4HC=m
 CONFIG_CRYPTO_ANSI_CPRNG=m
diff --git a/arch/s390/mm/fault.c b/arch/s390/mm/fault.c
index 7a3144017301..19288c1b36d3 100644
--- a/arch/s390/mm/fault.c
+++ b/arch/s390/mm/fault.c
@@ -250,6 +250,7 @@ static noinline void do_sigsegv(struct pt_regs *regs, int si_code)
 
         report_user_fault(regs, SIGSEGV, 1);
         si.si_signo = SIGSEGV;
+        si.si_errno = 0;
         si.si_code = si_code;
         si.si_addr = (void __user *)(regs->int_parm_long & __FAIL_ADDR_MASK);
         force_sig_info(SIGSEGV, &si, current);
diff --git a/arch/s390/net/bpf_jit.h b/arch/s390/net/bpf_jit.h
index f010c93a88b1..fda605dbc1b4 100644
--- a/arch/s390/net/bpf_jit.h
+++ b/arch/s390/net/bpf_jit.h
@@ -37,7 +37,7 @@ extern u8 sk_load_word[], sk_load_half[], sk_load_byte[];
  *            |               |     |
  *            +---------------+     |
  *            | 8 byte skbp   |     |
- * R15+170 -> +---------------+     |
+ * R15+176 -> +---------------+     |
  *            | 8 byte hlen   |     |
  * R15+168 -> +---------------+     |
  *            | 4 byte align  |     |
@@ -58,7 +58,7 @@ extern u8 sk_load_word[], sk_load_half[], sk_load_byte[];
 #define STK_OFF         (STK_SPACE - STK_160_UNUSED)
 #define STK_OFF_TMP     160     /* Offset of tmp buffer on stack */
 #define STK_OFF_HLEN    168     /* Offset of SKB header length on stack */
-#define STK_OFF_SKBP    170     /* Offset of SKB pointer on stack */
+#define STK_OFF_SKBP    176     /* Offset of SKB pointer on stack */
 
 #define STK_OFF_R6      (160 - 11 * 8)  /* Offset of r6 on stack */
 #define STK_OFF_TCCNT   (160 - 12 * 8)  /* Offset of tail_call_cnt on stack */
diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c
index 9133b0ec000b..bee281f3163d 100644
--- a/arch/s390/net/bpf_jit_comp.c
+++ b/arch/s390/net/bpf_jit_comp.c
@@ -45,7 +45,7 @@ struct bpf_jit {
         int labels[1];          /* Labels for local jumps */
 };
 
-#define BPF_SIZE_MAX    0x7ffff /* Max size for program (20 bit signed displ) */
+#define BPF_SIZE_MAX    0xffff  /* Max size for program (16 bit branches) */
 
 #define SEEN_SKB        1       /* skb access */
 #define SEEN_MEM        2       /* use mem[] for temporary storage */
@@ -450,7 +450,7 @@ static void bpf_jit_prologue(struct bpf_jit *jit)
                 emit_load_skb_data_hlen(jit);
         if (jit->seen & SEEN_SKB_CHANGE)
                 /* stg %b1,ST_OFF_SKBP(%r0,%r15) */
-                EMIT6_DISP_LH(0xe3000000, 0x0024, REG_W1, REG_0, REG_15,
+                EMIT6_DISP_LH(0xe3000000, 0x0024, BPF_REG_1, REG_0, REG_15,
                               STK_OFF_SKBP);
 }
 
diff --git a/arch/sparc/include/asm/head_64.h b/arch/sparc/include/asm/head_64.h
index 10e9dabc4c41..f0700cfeedd7 100644
--- a/arch/sparc/include/asm/head_64.h
+++ b/arch/sparc/include/asm/head_64.h
@@ -15,6 +15,10 @@
 
 #define PTREGS_OFF      (STACK_BIAS + STACKFRAME_SZ)
 
+#define RTRAP_PSTATE            (PSTATE_TSO|PSTATE_PEF|PSTATE_PRIV|PSTATE_IE)
+#define RTRAP_PSTATE_IRQOFF     (PSTATE_TSO|PSTATE_PEF|PSTATE_PRIV)
+#define RTRAP_PSTATE_AG_IRQOFF  (PSTATE_TSO|PSTATE_PEF|PSTATE_PRIV|PSTATE_AG)
+
 #define __CHEETAH_ID    0x003e0014
 #define __JALAPENO_ID   0x003e0016
 #define __SERRANO_ID    0x003e0022
diff --git a/arch/sparc/include/asm/ttable.h b/arch/sparc/include/asm/ttable.h
index 71b5a67522ab..781b9f1dbdc2 100644
--- a/arch/sparc/include/asm/ttable.h
+++ b/arch/sparc/include/asm/ttable.h
@@ -589,8 +589,8 @@ user_rtt_fill_64bit:					\
          restored;                                      \
         nop; nop; nop; nop; nop; nop;                   \
         nop; nop; nop; nop; nop;                        \
-        ba,a,pt %xcc, user_rtt_fill_fixup;              \
-        ba,a,pt %xcc, user_rtt_fill_fixup;              \
+        ba,a,pt %xcc, user_rtt_fill_fixup_dax;          \
+        ba,a,pt %xcc, user_rtt_fill_fixup_mna;          \
         ba,a,pt %xcc, user_rtt_fill_fixup;
 
 
@@ -652,8 +652,8 @@ user_rtt_fill_32bit:					\
          restored;                                      \
         nop; nop; nop; nop; nop;                        \
         nop; nop; nop;                                  \
-        ba,a,pt %xcc, user_rtt_fill_fixup;              \
-        ba,a,pt %xcc, user_rtt_fill_fixup;              \
+        ba,a,pt %xcc, user_rtt_fill_fixup_dax;          \
+        ba,a,pt %xcc, user_rtt_fill_fixup_mna;          \
         ba,a,pt %xcc, user_rtt_fill_fixup;
 
 
diff --git a/arch/sparc/kernel/Makefile b/arch/sparc/kernel/Makefile
index 7cf9c6ea3f1f..fdb13327fded 100644
--- a/arch/sparc/kernel/Makefile
+++ b/arch/sparc/kernel/Makefile
@@ -21,6 +21,7 @@ CFLAGS_REMOVE_perf_event.o := -pg
 CFLAGS_REMOVE_pcr.o := -pg
 endif
 
+obj-$(CONFIG_SPARC64)   += urtt_fill.o
 obj-$(CONFIG_SPARC32)   += entry.o wof.o wuf.o
 obj-$(CONFIG_SPARC32)   += etrap_32.o
 obj-$(CONFIG_SPARC32)   += rtrap_32.o
diff --git a/arch/sparc/kernel/rtrap_64.S b/arch/sparc/kernel/rtrap_64.S
index d08bdaffdbfc..216948ca4382 100644
--- a/arch/sparc/kernel/rtrap_64.S
+++ b/arch/sparc/kernel/rtrap_64.S
@@ -14,10 +14,6 @@
 #include <asm/visasm.h>
 #include <asm/processor.h>
 
-#define         RTRAP_PSTATE            (PSTATE_TSO|PSTATE_PEF|PSTATE_PRIV|PSTATE_IE)
-#define         RTRAP_PSTATE_IRQOFF     (PSTATE_TSO|PSTATE_PEF|PSTATE_PRIV)
-#define         RTRAP_PSTATE_AG_IRQOFF  (PSTATE_TSO|PSTATE_PEF|PSTATE_PRIV|PSTATE_AG)
-
 #ifdef CONFIG_CONTEXT_TRACKING
 # define SCHEDULE_USER schedule_user
 #else
@@ -242,52 +238,17 @@ rt_continue:	ldx			[%sp + PTREGS_OFF + PT_V9_G1], %g1
                  wrpr                   %g1, %cwp
                 ba,a,pt                 %xcc, user_rtt_fill_64bit
 
-user_rtt_fill_fixup:
-                rdpr    %cwp, %g1
-                add     %g1, 1, %g1
-                wrpr    %g1, 0x0, %cwp
-
-                rdpr    %wstate, %g2
-                sll     %g2, 3, %g2
-                wrpr    %g2, 0x0, %wstate
-
-                /* We know %canrestore and %otherwin are both zero.  */
-
-                sethi   %hi(sparc64_kern_pri_context), %g2
-                ldx     [%g2 + %lo(sparc64_kern_pri_context)], %g2
-                mov     PRIMARY_CONTEXT, %g1
-
-661:            stxa    %g2, [%g1] ASI_DMMU
-                .section .sun4v_1insn_patch, "ax"
-                .word   661b
-                stxa    %g2, [%g1] ASI_MMU
-                .previous
-
-                sethi   %hi(KERNBASE), %g1
-                flush   %g1
+user_rtt_fill_fixup_dax:
+                ba,pt   %xcc, user_rtt_fill_fixup_common
+                 mov    1, %g3
 
-                or      %g4, FAULT_CODE_WINFIXUP, %g4
-                stb     %g4, [%g6 + TI_FAULT_CODE]
-                stx     %g5, [%g6 + TI_FAULT_ADDR]
+user_rtt_fill_fixup_mna:
+                ba,pt   %xcc, user_rtt_fill_fixup_common
+                 mov    2, %g3
 
-                mov     %g6, %l1
-                wrpr    %g0, 0x0, %tl
-
-661:            nop
-                .section                .sun4v_1insn_patch, "ax"
-                .word                   661b
-                SET_GL(0)
-                .previous
-
-                wrpr    %g0, RTRAP_PSTATE, %pstate
-
-                mov     %l1, %g6
-                ldx     [%g6 + TI_TASK], %g4
-                LOAD_PER_CPU_BASE(%g5, %g6, %g1, %g2, %g3)
-                call    do_sparc64_fault
-                 add    %sp, PTREGS_OFF, %o0
-                ba,pt   %xcc, rtrap
-                 nop
+user_rtt_fill_fixup:
+                ba,pt   %xcc, user_rtt_fill_fixup_common
+                 clr    %g3
 
 user_rtt_pre_restore:
                 add                     %g1, 1, %g1
diff --git a/arch/sparc/kernel/signal32.c b/arch/sparc/kernel/signal32.c
index 3c25241fa5cb..91cc2f4ae4d9 100644
--- a/arch/sparc/kernel/signal32.c
+++ b/arch/sparc/kernel/signal32.c
@@ -138,12 +138,24 @@ int copy_siginfo_from_user32(siginfo_t *to, compat_siginfo_t __user *from)
         return 0;
 }
 
+/* Checks if the fp is valid.  We always build signal frames which are
+ * 16-byte aligned, therefore we can always enforce that the restore
+ * frame has that property as well.
+ */
+static bool invalid_frame_pointer(void __user *fp, int fplen)
+{
+        if ((((unsigned long) fp) & 15) ||
+            ((unsigned long)fp) > 0x100000000ULL - fplen)
+                return true;
+        return false;
+}
+
 void do_sigreturn32(struct pt_regs *regs)
 {
         struct signal_frame32 __user *sf;
         compat_uptr_t fpu_save;
         compat_uptr_t rwin_save;
-        unsigned int psr;
+        unsigned int psr, ufp;
         unsigned int pc, npc;
         sigset_t set;
         compat_sigset_t seta;
@@ -158,11 +170,16 @@ void do_sigreturn32(struct pt_regs *regs)
         sf = (struct signal_frame32 __user *) regs->u_regs[UREG_FP];
 
         /* 1. Make sure we are not getting garbage from the user */
-        if (!access_ok(VERIFY_READ, sf, sizeof(*sf)) ||
-            (((unsigned long) sf) & 3))
+        if (invalid_frame_pointer(sf, sizeof(*sf)))
+                goto segv;
+
+        if (get_user(ufp, &sf->info.si_regs.u_regs[UREG_FP]))
+                goto segv;
+
+        if (ufp & 0x7)
                 goto segv;
 
-        if (get_user(pc, &sf->info.si_regs.pc) ||
+        if (__get_user(pc, &sf->info.si_regs.pc) ||
             __get_user(npc, &sf->info.si_regs.npc))
                 goto segv;
 
@@ -227,7 +244,7 @@ segv:
 asmlinkage void do_rt_sigreturn32(struct pt_regs *regs)
 {
         struct rt_signal_frame32 __user *sf;
-        unsigned int psr, pc, npc;
+        unsigned int psr, pc, npc, ufp;
         compat_uptr_t fpu_save;
         compat_uptr_t rwin_save;
         sigset_t set;
@@ -242,11 +259,16 @@ asmlinkage void do_rt_sigreturn32(struct pt_regs *regs)
         sf = (struct rt_signal_frame32 __user *) regs->u_regs[UREG_FP];
 
         /* 1. Make sure we are not getting garbage from the user */
-        if (!access_ok(VERIFY_READ, sf, sizeof(*sf)) ||
-            (((unsigned long) sf) & 3))
+        if (invalid_frame_pointer(sf, sizeof(*sf)))
                 goto segv;
 
-        if (get_user(pc, &sf->regs.pc) || 
+        if (get_user(ufp, &sf->regs.u_regs[UREG_FP]))
+                goto segv;
+
+        if (ufp & 0x7)
+                goto segv;
+
+        if (__get_user(pc, &sf->regs.pc) || 
             __get_user(npc, &sf->regs.npc))
                 goto segv;
 
@@ -307,14 +329,6 @@ segv:
         force_sig(SIGSEGV, current);
 }
 
-/* Checks if the fp is valid */
-static int invalid_frame_pointer(void __user *fp, int fplen)
-{
-        if ((((unsigned long) fp) & 7) || ((unsigned long)fp) > 0x100000000ULL - fplen)
-                return 1;
-        return 0;
-}
-
 static void __user *get_sigframe(struct ksignal *ksig, struct pt_regs *regs, unsigned long framesize)
 {
         unsigned long sp;
diff --git a/arch/sparc/kernel/signal_32.c b/arch/sparc/kernel/signal_32.c
index 52aa5e4ce5e7..c3c12efe0bc0 100644
--- a/arch/sparc/kernel/signal_32.c
+++ b/arch/sparc/kernel/signal_32.c
@@ -60,10 +60,22 @@ struct rt_signal_frame {
 #define SF_ALIGNEDSZ  (((sizeof(struct signal_frame) + 7) & (~7)))
 #define RT_ALIGNEDSZ  (((sizeof(struct rt_signal_frame) + 7) & (~7)))
 
+/* Checks if the fp is valid.  We always build signal frames which are
+ * 16-byte aligned, therefore we can always enforce that the restore
+ * frame has that property as well.
+ */
+static inline bool invalid_frame_pointer(void __user *fp, int fplen)
+{
+        if ((((unsigned long) fp) & 15) || !__access_ok((unsigned long)fp, fplen))
+                return true;
+
+        return false;
+}
+
 asmlinkage void do_sigreturn(struct pt_regs *regs)
 {
+        unsigned long up_psr, pc, npc, ufp;
         struct signal_frame __user *sf;
-        unsigned long up_psr, pc, npc;
         sigset_t set;
         __siginfo_fpu_t __user *fpu_save;
         __siginfo_rwin_t __user *rwin_save;
@@ -77,10 +89,13 @@ asmlinkage void do_sigreturn(struct pt_regs *regs)
         sf = (struct signal_frame __user *) regs->u_regs[UREG_FP];
 
         /* 1. Make sure we are not getting garbage from the user */
-        if (!access_ok(VERIFY_READ, sf, sizeof(*sf)))
+        if (!invalid_frame_pointer(sf, sizeof(*sf)))
+                goto segv_and_exit;
+
+        if (get_user(ufp, &sf->info.si_regs.u_regs[UREG_FP]))
                 goto segv_and_exit;
 
-        if (((unsigned long) sf) & 3)
+        if (ufp & 0x7)
                 goto segv_and_exit;
 
         err = __get_user(pc,  &sf->info.si_regs.pc);
@@ -127,7 +142,7 @@ segv_and_exit:
 asmlinkage void do_rt_sigreturn(struct pt_regs *regs)
 {
         struct rt_signal_frame __user *sf;
-        unsigned int psr, pc, npc;
+        unsigned int psr, pc, npc, ufp;
         __siginfo_fpu_t __user *fpu_save;
         __siginfo_rwin_t __user *rwin_save;
         sigset_t set;
@@ -135,8 +150,13 @@ asmlinkage void do_rt_sigreturn(struct pt_regs *regs)
 
         synchronize_user_stack();
         sf = (struct rt_signal_frame __user *) regs->u_regs[UREG_FP];
-        if (!access_ok(VERIFY_READ, sf, sizeof(*sf)) ||
-            (((unsigned long) sf) & 0x03))
+        if (!invalid_frame_pointer(sf, sizeof(*sf)))
+                goto segv;
+
+        if (get_user(ufp, &sf->regs.u_regs[UREG_FP]))
+                goto segv;
+
+        if (ufp & 0x7)
                 goto segv;
 
         err = __get_user(pc, &sf->regs.pc);
@@ -178,15 +198,6 @@ segv:
         force_sig(SIGSEGV, current);
 }
 
-/* Checks if the fp is valid */
-static inline int invalid_frame_pointer(void __user *fp, int fplen)
-{
-        if ((((unsigned long) fp) & 7) || !__access_ok((unsigned long)fp, fplen))
-                return 1;
-
-        return 0;
-}
-
 static inline void __user *get_sigframe(struct ksignal *ksig, struct pt_regs *regs, unsigned long framesize)
 {
         unsigned long sp = regs->u_regs[UREG_FP];
diff --git a/arch/sparc/kernel/signal_64.c b/arch/sparc/kernel/signal_64.c
index 39aaec173f66..5ee930c48f4c 100644
--- a/arch/sparc/kernel/signal_64.c
+++ b/arch/sparc/kernel/signal_64.c
@@ -234,6 +234,17 @@ do_sigsegv:
         goto out;
 }
 
+/* Checks if the fp is valid.  We always build rt signal frames which
+ * are 16-byte aligned, therefore we can always enforce that the
+ * restore frame has that property as well.
+ */
+static bool invalid_frame_pointer(void __user *fp)
+{
+        if (((unsigned long) fp) & 15)
+                return true;
+        return false;
+}
+
 struct rt_signal_frame {
         struct sparc_stackf     ss;
         siginfo_t               info;
@@ -246,8 +257,8 @@ struct rt_signal_frame {
 
 void do_rt_sigreturn(struct pt_regs *regs)
 {
+        unsigned long tpc, tnpc, tstate, ufp;
         struct rt_signal_frame __user *sf;
-        unsigned long tpc, tnpc, tstate;
         __siginfo_fpu_t __user *fpu_save;
         __siginfo_rwin_t __user *rwin_save;
         sigset_t set;
@@ -261,10 +272,16 @@ void do_rt_sigreturn(struct pt_regs *regs)
                 (regs->u_regs [UREG_FP] + STACK_BIAS);
 
         /* 1. Make sure we are not getting garbage from the user */
-        if (((unsigned long) sf) & 3)
+        if (invalid_frame_pointer(sf))
+                goto segv;
+
+        if (get_user(ufp, &sf->regs.u_regs[UREG_FP]))
                 goto segv;
 
-        err = get_user(tpc, &sf->regs.tpc);
+        if ((ufp + STACK_BIAS) & 0x7)
+                goto segv;
+
+        err = __get_user(tpc, &sf->regs.tpc);
         err |= __get_user(tnpc, &sf->regs.tnpc);
         if (test_thread_flag(TIF_32BIT)) {
                 tpc &= 0xffffffff;
@@ -308,14 +325,6 @@ segv:
         force_sig(SIGSEGV, current);
 }
 
-/* Checks if the fp is valid */
-static int invalid_frame_pointer(void __user *fp)
-{
-        if (((unsigned long) fp) & 15)
-                return 1;
-        return 0;
-}
-
 static inline void __user *get_sigframe(struct ksignal *ksig, struct pt_regs *regs, unsigned long framesize)
 {
         unsigned long sp = regs->u_regs[UREG_FP] + STACK_BIAS;
diff --git a/arch/sparc/kernel/sigutil_32.c b/arch/sparc/kernel/sigutil_32.c
index 0f6eebe71e6c..e5fe8cef9a69 100644
--- a/arch/sparc/kernel/sigutil_32.c
+++ b/arch/sparc/kernel/sigutil_32.c
@@ -48,6 +48,10 @@ int save_fpu_state(struct pt_regs *regs, __siginfo_fpu_t __user *fpu)
 int restore_fpu_state(struct pt_regs *regs, __siginfo_fpu_t __user *fpu)
 {
         int err;
+
+        if (((unsigned long) fpu) & 3)
+                return -EFAULT;
+
 #ifdef CONFIG_SMP
         if (test_tsk_thread_flag(current, TIF_USEDFPU))
                 regs->psr &= ~PSR_EF;
@@ -97,7 +101,10 @@ int restore_rwin_state(__siginfo_rwin_t __user *rp)
         struct thread_info *t = current_thread_info();
         int i, wsaved, err;
 
-        __get_user(wsaved, &rp->wsaved);
+        if (((unsigned long) rp) & 3)
+                return -EFAULT;
+
+        get_user(wsaved, &rp->wsaved);
         if (wsaved > NSWINS)
                 return -EFAULT;
 
diff --git a/arch/sparc/kernel/sigutil_64.c b/arch/sparc/kernel/sigutil_64.c
index 387834a9c56a..36aadcbeac69 100644
--- a/arch/sparc/kernel/sigutil_64.c
+++ b/arch/sparc/kernel/sigutil_64.c
@@ -37,7 +37,10 @@ int restore_fpu_state(struct pt_regs *regs, __siginfo_fpu_t __user *fpu)
         unsigned long fprs;
         int err;
 
-        err = __get_user(fprs, &fpu->si_fprs);
+        if (((unsigned long) fpu) & 7)
+                return -EFAULT;
+
+        err = get_user(fprs, &fpu->si_fprs);
         fprs_write(0);
         regs->tstate &= ~TSTATE_PEF;
         if (fprs & FPRS_DL)
@@ -72,7 +75,10 @@ int restore_rwin_state(__siginfo_rwin_t __user *rp)
         struct thread_info *t = current_thread_info();
         int i, wsaved, err;
 
-        __get_user(wsaved, &rp->wsaved);
+        if (((unsigned long) rp) & 7)
+                return -EFAULT;
+
+        get_user(wsaved, &rp->wsaved);
         if (wsaved > NSWINS)
                 return -EFAULT;
 
diff --git a/arch/sparc/kernel/urtt_fill.S b/arch/sparc/kernel/urtt_fill.S
new file mode 100644
index 000000000000..5604a2b051d4
--- /dev/null
+++ b/arch/sparc/kernel/urtt_fill.S
@@ -0,0 +1,98 @@
+#include <asm/thread_info.h>
+#include <asm/trap_block.h>
+#include <asm/spitfire.h>
+#include <asm/ptrace.h>
+#include <asm/head.h>
+
+                .text
+                .align  8
+                .globl  user_rtt_fill_fixup_common
+user_rtt_fill_fixup_common:
+                rdpr    %cwp, %g1
+                add     %g1, 1, %g1
+                wrpr    %g1, 0x0, %cwp
+
+                rdpr    %wstate, %g2
+                sll     %g2, 3, %g2
+                wrpr    %g2, 0x0, %wstate
+
+                /* We know %canrestore and %otherwin are both zero.  */
+
+                sethi   %hi(sparc64_kern_pri_context), %g2
+                ldx     [%g2 + %lo(sparc64_kern_pri_context)], %g2
+                mov     PRIMARY_CONTEXT, %g1
+
+661:            stxa    %g2, [%g1] ASI_DMMU
+                .section .sun4v_1insn_patch, "ax"
+                .word   661b
+                stxa    %g2, [%g1] ASI_MMU
+                .previous
+
+                sethi   %hi(KERNBASE), %g1
+                flush   %g1
+
+                mov     %g4, %l4
+                mov     %g5, %l5
+                brnz,pn %g3, 1f
+                 mov    %g3, %l3
+
+                or      %g4, FAULT_CODE_WINFIXUP, %g4
+                stb     %g4, [%g6 + TI_FAULT_CODE]
+                stx     %g5, [%g6 + TI_FAULT_ADDR]
+1:
+                mov     %g6, %l1
+                wrpr    %g0, 0x0, %tl
+
+661:            nop
+                .section                .sun4v_1insn_patch, "ax"
+                .word                   661b
+                SET_GL(0)
+                .previous
+
+                wrpr    %g0, RTRAP_PSTATE, %pstate
+
+                mov     %l1, %g6
+                ldx     [%g6 + TI_TASK], %g4
+                LOAD_PER_CPU_BASE(%g5, %g6, %g1, %g2, %g3)
+
+                brnz,pn %l3, 1f
+                 nop
+
+                call    do_sparc64_fault
+                 add    %sp, PTREGS_OFF, %o0
+                ba,pt   %xcc, rtrap
+                 nop
+
+1:              cmp     %g3, 2
+                bne,pn  %xcc, 2f
+                 nop
+
+                sethi   %hi(tlb_type), %g1
+                lduw    [%g1 + %lo(tlb_type)], %g1
+                cmp     %g1, 3
+                bne,pt  %icc, 1f
+                 add    %sp, PTREGS_OFF, %o0
+                mov     %l4, %o2
+                call    sun4v_do_mna
+                 mov    %l5, %o1
+                ba,a,pt %xcc, rtrap
+1:              mov     %l4, %o1
+                mov     %l5, %o2
+                call    mem_address_unaligned
+                 nop
+                ba,a,pt %xcc, rtrap
+
+2:              sethi   %hi(tlb_type), %g1
+                mov     %l4, %o1
+                lduw    [%g1 + %lo(tlb_type)], %g1
+                mov     %l5, %o2
+                cmp     %g1, 3
+                bne,pt  %icc, 1f
+                 add    %sp, PTREGS_OFF, %o0
+                call    sun4v_data_access_exception
+                 nop
+                ba,a,pt %xcc, rtrap
+
+1:              call    spitfire_data_access_exception
+                 nop
+                ba,a,pt %xcc, rtrap
diff --git a/arch/sparc/mm/init_64.c b/arch/sparc/mm/init_64.c
index 652683cb4b4b..14bb0d5ed3c6 100644
--- a/arch/sparc/mm/init_64.c
+++ b/arch/sparc/mm/init_64.c
@@ -2824,9 +2824,10 @@ void hugetlb_setup(struct pt_regs *regs)
          * the Data-TLB for huge pages.
          */
         if (tlb_type == cheetah_plus) {
+                bool need_context_reload = false;
                 unsigned long ctx;
 
-                spin_lock(&ctx_alloc_lock);
+                spin_lock_irq(&ctx_alloc_lock);
                 ctx = mm->context.sparc64_ctx_val;
                 ctx &= ~CTX_PGSZ_MASK;
                 ctx |= CTX_PGSZ_BASE << CTX_PGSZ0_SHIFT;
@@ -2845,9 +2846,12 @@ void hugetlb_setup(struct pt_regs *regs)
                          * also executing in this address space.
                          */
                         mm->context.sparc64_ctx_val = ctx;
-                        on_each_cpu(context_reload, mm, 0);
+                        need_context_reload = true;
                 }
-                spin_unlock(&ctx_alloc_lock);
+                spin_unlock_irq(&ctx_alloc_lock);
+
+                if (need_context_reload)
+                        on_each_cpu(context_reload, mm, 0);
         }
 }
 #endif
diff --git a/crypto/asymmetric_keys/Kconfig b/crypto/asymmetric_keys/Kconfig
index e28e912000a7..331f6baf2df8 100644
--- a/crypto/asymmetric_keys/Kconfig
+++ b/crypto/asymmetric_keys/Kconfig
@@ -13,6 +13,7 @@ config ASYMMETRIC_PUBLIC_KEY_SUBTYPE
         tristate "Asymmetric public-key crypto algorithm subtype"
         select MPILIB
         select CRYPTO_HASH_INFO
+        select CRYPTO_AKCIPHER
         help
           This option provides support for asymmetric public key type handling.
           If signature generation and/or verification are to be used,
diff --git a/drivers/atm/firestream.c b/drivers/atm/firestream.c
index a969a7e443be..85aaf2222587 100644
--- a/drivers/atm/firestream.c
+++ b/drivers/atm/firestream.c
@@ -181,13 +181,17 @@ static char *res_strings[] = {
         "reserved 27", 
         "reserved 28", 
         "reserved 29", 
-        "reserved 30", 
+        "reserved 30", /* FIXME: The strings between 30-40 might be wrong. */
         "reassembly abort: no buffers", 
         "receive buffer overflow", 
         "change in GFC", 
         "receive buffer full", 
         "low priority discard - no receive descriptor", 
         "low priority discard - missing end of packet", 
+        "reserved 37",
+        "reserved 38",
+        "reserved 39",
+        "reseverd 40",
         "reserved 41", 
         "reserved 42", 
         "reserved 43", 
diff --git a/drivers/atm/iphase.c b/drivers/atm/iphase.c
index 7d00f2994738..809dd1e02091 100644
--- a/drivers/atm/iphase.c
+++ b/drivers/atm/iphase.c
@@ -1128,7 +1128,7 @@ static int rx_pkt(struct atm_dev *dev)
         /* make the ptr point to the corresponding buffer desc entry */  
         buf_desc_ptr += desc;     
         if (!desc || (desc > iadev->num_rx_desc) || 
-                      ((buf_desc_ptr->vc_index & 0xffff) > iadev->num_vc)) { 
+                      ((buf_desc_ptr->vc_index & 0xffff) >= iadev->num_vc)) {
             free_desc(dev, desc);
             IF_ERR(printk("IA: bad descriptor desc = %d \n", desc);)
             return -1;
diff --git a/drivers/crypto/ccp/ccp-crypto-aes-xts.c b/drivers/crypto/ccp/ccp-crypto-aes-xts.c
index 52c7395cb8d8..0d0d4529ee36 100644
--- a/drivers/crypto/ccp/ccp-crypto-aes-xts.c
+++ b/drivers/crypto/ccp/ccp-crypto-aes-xts.c
@@ -122,6 +122,7 @@ static int ccp_aes_xts_crypt(struct ablkcipher_request *req,
         struct ccp_ctx *ctx = crypto_tfm_ctx(req->base.tfm);
         struct ccp_aes_req_ctx *rctx = ablkcipher_request_ctx(req);
         unsigned int unit;
+        u32 unit_size;
         int ret;
 
         if (!ctx->u.aes.key_len)
@@ -133,11 +134,17 @@ static int ccp_aes_xts_crypt(struct ablkcipher_request *req,
         if (!req->info)
                 return -EINVAL;
 
-        for (unit = 0; unit < ARRAY_SIZE(unit_size_map); unit++)
-                if (!(req->nbytes & (unit_size_map[unit].size - 1)))
-                        break;
+        unit_size = CCP_XTS_AES_UNIT_SIZE__LAST;
+        if (req->nbytes <= unit_size_map[0].size) {
+                for (unit = 0; unit < ARRAY_SIZE(unit_size_map); unit++) {
+                        if (!(req->nbytes & (unit_size_map[unit].size - 1))) {
+                                unit_size = unit_size_map[unit].value;
+                                break;
+                        }
+                }
+        }
 
-        if ((unit_size_map[unit].value == CCP_XTS_AES_UNIT_SIZE__LAST) ||
+        if ((unit_size == CCP_XTS_AES_UNIT_SIZE__LAST) ||
             (ctx->u.aes.key_len != AES_KEYSIZE_128)) {
                 /* Use the fallback to process the request for any
                  * unsupported unit sizes or key sizes
@@ -158,7 +165,7 @@ static int ccp_aes_xts_crypt(struct ablkcipher_request *req,
         rctx->cmd.engine = CCP_ENGINE_XTS_AES_128;
         rctx->cmd.u.xts.action = (encrypt) ? CCP_AES_ACTION_ENCRYPT
                                            : CCP_AES_ACTION_DECRYPT;
-        rctx->cmd.u.xts.unit_size = unit_size_map[unit].value;
+        rctx->cmd.u.xts.unit_size = unit_size;
         rctx->cmd.u.xts.key = &ctx->u.aes.key_sg;
         rctx->cmd.u.xts.key_len = ctx->u.aes.key_len;
         rctx->cmd.u.xts.iv = &rctx->iv_sg;
diff --git a/drivers/crypto/omap-sham.c b/drivers/crypto/omap-sham.c
index 6eefaa2fe58f..63464e86f2b1 100644
--- a/drivers/crypto/omap-sham.c
+++ b/drivers/crypto/omap-sham.c
@@ -1986,7 +1986,7 @@ err_algs:
                                         &dd->pdata->algs_info[i].algs_list[j]);
 err_pm:
         pm_runtime_disable(dev);
-        if (dd->polling_mode)
+        if (!dd->polling_mode)
                 dma_release_channel(dd->dma_lch);
 data_err:
         dev_err(dev, "initialization failed.\n");
diff --git a/drivers/dma-buf/dma-buf.c b/drivers/dma-buf/dma-buf.c
index 4a2c07ee6677..6355ab38d630 100644
--- a/drivers/dma-buf/dma-buf.c
+++ b/drivers/dma-buf/dma-buf.c
@@ -33,6 +33,7 @@
 #include <linux/seq_file.h>
 #include <linux/poll.h>
 #include <linux/reservation.h>
+#include <linux/mm.h>
 
 #include <uapi/linux/dma-buf.h>
 
@@ -90,7 +91,7 @@ static int dma_buf_mmap_internal(struct file *file, struct vm_area_struct *vma)
         dmabuf = file->private_data;
 
         /* check for overflowing the buffer's size */
-        if (vma->vm_pgoff + ((vma->vm_end - vma->vm_start) >> PAGE_SHIFT) >
+        if (vma->vm_pgoff + vma_pages(vma) >
             dmabuf->size >> PAGE_SHIFT)
                 return -EINVAL;
 
@@ -723,11 +724,11 @@ int dma_buf_mmap(struct dma_buf *dmabuf, struct vm_area_struct *vma,
                 return -EINVAL;
 
         /* check for offset overflow */
-        if (pgoff + ((vma->vm_end - vma->vm_start) >> PAGE_SHIFT) < pgoff)
+        if (pgoff + vma_pages(vma) < pgoff)
                 return -EOVERFLOW;
 
         /* check for overflowing the buffer's size */
-        if (pgoff + ((vma->vm_end - vma->vm_start) >> PAGE_SHIFT) >
+        if (pgoff + vma_pages(vma) >
             dmabuf->size >> PAGE_SHIFT)
                 return -EINVAL;
 
diff --git a/drivers/dma-buf/reservation.c b/drivers/dma-buf/reservation.c
index c0bd5722c997..9566a62ad8e3 100644
--- a/drivers/dma-buf/reservation.c
+++ b/drivers/dma-buf/reservation.c
@@ -35,6 +35,17 @@
 #include <linux/reservation.h>
 #include <linux/export.h>
 
+/**
+ * DOC: Reservation Object Overview
+ *
+ * The reservation object provides a mechanism to manage shared and
+ * exclusive fences associated with a buffer.  A reservation object
+ * can have attached one exclusive fence (normally associated with
+ * write operations) or N shared fences (read operations).  The RCU
+ * mechanism is used to protect read access to fences from locked
+ * write-side updates.
+ */
+
 DEFINE_WW_CLASS(reservation_ww_class);
 EXPORT_SYMBOL(reservation_ww_class);
 
@@ -43,9 +54,17 @@ EXPORT_SYMBOL(reservation_seqcount_class);
 
 const char reservation_seqcount_string[] = "reservation_seqcount";
 EXPORT_SYMBOL(reservation_seqcount_string);
-/*
- * Reserve space to add a shared fence to a reservation_object,
- * must be called with obj->lock held.
+
+/**
+ * reservation_object_reserve_shared - Reserve space to add a shared
+ * fence to a reservation_object.
+ * @obj: reservation object
+ *
+ * Should be called before reservation_object_add_shared_fence().  Must
+ * be called with obj->lock held.
+ *
+ * RETURNS
+ * Zero for success, or -errno
  */
 int reservation_object_reserve_shared(struct reservation_object *obj)
 {
@@ -180,7 +199,11 @@ done:
                 fence_put(old_fence);
 }
 
-/*
+/**
+ * reservation_object_add_shared_fence - Add a fence to a shared slot
+ * @obj: the reservation object
+ * @fence: the shared fence to add
+ *
  * Add a fence to a shared slot, obj->lock must be held, and
  * reservation_object_reserve_shared_fence has been called.
  */
@@ -200,6 +223,13 @@ void reservation_object_add_shared_fence(struct reservation_object *obj,
 }
 EXPORT_SYMBOL(reservation_object_add_shared_fence);
 
+/**
+ * reservation_object_add_excl_fence - Add an exclusive fence.
+ * @obj: the reservation object
+ * @fence: the shared fence to add
+ *
+ * Add a fence to the exclusive slot.  The obj->lock must be held.
+ */
 void reservation_object_add_excl_fence(struct reservation_object *obj,
                                        struct fence *fence)
 {
@@ -233,6 +263,18 @@ void reservation_object_add_excl_fence(struct reservation_object *obj,
 }
 EXPORT_SYMBOL(reservation_object_add_excl_fence);
 
+/**
+ * reservation_object_get_fences_rcu - Get an object's shared and exclusive
+ * fences without update side lock held
+ * @obj: the reservation object
+ * @pfence_excl: the returned exclusive fence (or NULL)
+ * @pshared_count: the number of shared fences returned
+ * @pshared: the array of shared fence ptrs returned (array is krealloc'd to
+ * the required size, and must be freed by caller)
+ *
+ * RETURNS
+ * Zero or -errno
+ */
 int reservation_object_get_fences_rcu(struct reservation_object *obj,
                                       struct fence **pfence_excl,
                                       unsigned *pshared_count,
@@ -319,6 +361,18 @@ unlock:
 }
 EXPORT_SYMBOL_GPL(reservation_object_get_fences_rcu);
 
+/**
+ * reservation_object_wait_timeout_rcu - Wait on reservation's objects
+ * shared and/or exclusive fences.
+ * @obj: the reservation object
+ * @wait_all: if true, wait on all fences, else wait on just exclusive fence
+ * @intr: if true, do interruptible wait
+ * @timeout: timeout value in jiffies or zero to return immediately
+ *
+ * RETURNS
+ * Returns -ERESTARTSYS if interrupted, 0 if the wait timed out, or
+ * greater than zer on success.
+ */
 long reservation_object_wait_timeout_rcu(struct reservation_object *obj,
                                          bool wait_all, bool intr,
                                          unsigned long timeout)
@@ -416,6 +470,16 @@ reservation_object_test_signaled_single(struct fence *passed_fence)
         return ret;
 }
 
+/**
+ * reservation_object_test_signaled_rcu - Test if a reservation object's
+ * fences have been signaled.
+ * @obj: the reservation object
+ * @test_all: if true, test all fences, otherwise only test the exclusive
+ * fence
+ *
+ * RETURNS
+ * true if all fences signaled, else false
+ */
 bool reservation_object_test_signaled_rcu(struct reservation_object *obj,
                                           bool test_all)
 {
diff --git a/drivers/gpio/gpio-lpc32xx.c b/drivers/gpio/gpio-lpc32xx.c
index d39014daeef9..fc5f197906ac 100644
--- a/drivers/gpio/gpio-lpc32xx.c
+++ b/drivers/gpio/gpio-lpc32xx.c
@@ -29,7 +29,6 @@
 
 #include <mach/hardware.h>
 #include <mach/platform.h>
-#include <mach/irqs.h>
 
 #define LPC32XX_GPIO_P3_INP_STATE               _GPREG(0x000)
 #define LPC32XX_GPIO_P3_OUTP_SET                _GPREG(0x004)
@@ -371,61 +370,16 @@ static int lpc32xx_gpio_request(struct gpio_chip *chip, unsigned pin)
 
 static int lpc32xx_gpio_to_irq_p01(struct gpio_chip *chip, unsigned offset)
 {
-        return IRQ_LPC32XX_P0_P1_IRQ;
+        return -ENXIO;
 }
 
-static const char lpc32xx_gpio_to_irq_gpio_p3_table[] = {
-        IRQ_LPC32XX_GPIO_00,
-        IRQ_LPC32XX_GPIO_01,
-        IRQ_LPC32XX_GPIO_02,
-        IRQ_LPC32XX_GPIO_03,
-        IRQ_LPC32XX_GPIO_04,
-        IRQ_LPC32XX_GPIO_05,
-};
-
 static int lpc32xx_gpio_to_irq_gpio_p3(struct gpio_chip *chip, unsigned offset)
 {
-        if (offset < ARRAY_SIZE(lpc32xx_gpio_to_irq_gpio_p3_table))
-                return lpc32xx_gpio_to_irq_gpio_p3_table[offset];
         return -ENXIO;
 }
 
-static const char lpc32xx_gpio_to_irq_gpi_p3_table[] = {
-        IRQ_LPC32XX_GPI_00,
-        IRQ_LPC32XX_GPI_01,
-        IRQ_LPC32XX_GPI_02,
-        IRQ_LPC32XX_GPI_03,
-        IRQ_LPC32XX_GPI_04,
-        IRQ_LPC32XX_GPI_05,
-        IRQ_LPC32XX_GPI_06,
-        IRQ_LPC32XX_GPI_07,
-        IRQ_LPC32XX_GPI_08,
-        IRQ_LPC32XX_GPI_09,
-        -ENXIO, /* 10 */
-        -ENXIO, /* 11 */
-        -ENXIO, /* 12 */
-        -ENXIO, /* 13 */
-        -ENXIO, /* 14 */
-        -ENXIO, /* 15 */
-        -ENXIO, /* 16 */
-        -ENXIO, /* 17 */
-        -ENXIO, /* 18 */
-        IRQ_LPC32XX_GPI_19,
-        -ENXIO, /* 20 */
-        -ENXIO, /* 21 */
-        -ENXIO, /* 22 */
-        -ENXIO, /* 23 */
-        -ENXIO, /* 24 */
-        -ENXIO, /* 25 */
-        -ENXIO, /* 26 */
-        -ENXIO, /* 27 */
-        IRQ_LPC32XX_GPI_28,
-};
-
 static int lpc32xx_gpio_to_irq_gpi_p3(struct gpio_chip *chip, unsigned offset)
 {
-        if (offset < ARRAY_SIZE(lpc32xx_gpio_to_irq_gpi_p3_table))
-                return lpc32xx_gpio_to_irq_gpi_p3_table[offset];
         return -ENXIO;
 }
 
diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index d407f904a31c..24f60d28f0c0 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -20,6 +20,7 @@
 #include <linux/cdev.h>
 #include <linux/fs.h>
 #include <linux/uaccess.h>
+#include <linux/compat.h>
 #include <uapi/linux/gpio.h>
 
 #include "gpiolib.h"
@@ -316,7 +317,7 @@ static long gpio_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
 {
         struct gpio_device *gdev = filp->private_data;
         struct gpio_chip *chip = gdev->chip;
-        int __user *ip = (int __user *)arg;
+        void __user *ip = (void __user *)arg;
 
         /* We fail any subsequent ioctl():s when the chip is gone */
         if (!chip)
@@ -388,6 +389,14 @@ static long gpio_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
         return -EINVAL;
 }
 
+#ifdef CONFIG_COMPAT
+static long gpio_ioctl_compat(struct file *filp, unsigned int cmd,
+                              unsigned long arg)
+{
+        return gpio_ioctl(filp, cmd, (unsigned long)compat_ptr(arg));
+}
+#endif
+
 /**
  * gpio_chrdev_open() - open the chardev for ioctl operations
  * @inode: inode for this chardev
@@ -431,7 +440,9 @@ static const struct file_operations gpio_fileops = {
         .owner = THIS_MODULE,
         .llseek = noop_llseek,
         .unlocked_ioctl = gpio_ioctl,
-        .compat_ioctl = gpio_ioctl,
+#ifdef CONFIG_COMPAT
+        .compat_ioctl = gpio_ioctl_compat,
+#endif
 };
 
 static void gpiodevice_release(struct device *dev)
@@ -618,6 +629,8 @@ int gpiochip_add_data(struct gpio_chip *chip, void *data)
                 goto err_free_label;
         }
 
+        spin_unlock_irqrestore(&gpio_lock, flags);
+
         for (i = 0; i < chip->ngpio; i++) {
                 struct gpio_desc *desc = &gdev->descs[i];
 
@@ -649,8 +662,6 @@ int gpiochip_add_data(struct gpio_chip *chip, void *data)
                 }
         }
 
-        spin_unlock_irqrestore(&gpio_lock, flags);
-
 #ifdef CONFIG_PINCTRL
         INIT_LIST_HEAD(&gdev->pin_ranges);
 #endif
@@ -1356,10 +1367,13 @@ done:
 /*
  * This descriptor validation needs to be inserted verbatim into each
  * function taking a descriptor, so we need to use a preprocessor
- * macro to avoid endless duplication.
+ * macro to avoid endless duplication. If the desc is NULL it is an
+ * optional GPIO and calls should just bail out.
  */
 #define VALIDATE_DESC(desc) do { \
-        if (!desc || !desc->gdev) { \
+        if (!desc) \
+                return 0; \
+        if (!desc->gdev) { \
                 pr_warn("%s: invalid GPIO\n", __func__); \
                 return -EINVAL; \
         } \
@@ -1370,7 +1384,9 @@ done:
         } } while (0)
 
 #define VALIDATE_DESC_VOID(desc) do { \
-        if (!desc || !desc->gdev) { \
+        if (!desc) \
+                return; \
+        if (!desc->gdev) { \
                 pr_warn("%s: invalid GPIO\n", __func__); \
                 return; \
         } \
@@ -2066,17 +2082,30 @@ EXPORT_SYMBOL_GPL(gpiod_to_irq);
  */
 int gpiochip_lock_as_irq(struct gpio_chip *chip, unsigned int offset)
 {
-        if (offset >= chip->ngpio)
-                return -EINVAL;
+        struct gpio_desc *desc;
+
+        desc = gpiochip_get_desc(chip, offset);
+        if (IS_ERR(desc))
+                return PTR_ERR(desc);
+
+        /* Flush direction if something changed behind our back */
+        if (chip->get_direction) {
+                int dir = chip->get_direction(chip, offset);
+
+                if (dir)
+                        clear_bit(FLAG_IS_OUT, &desc->flags);
+                else
+                        set_bit(FLAG_IS_OUT, &desc->flags);
+        }
 
-        if (test_bit(FLAG_IS_OUT, &chip->gpiodev->descs[offset].flags)) {
+        if (test_bit(FLAG_IS_OUT, &desc->flags)) {
                 chip_err(chip,
                           "%s: tried to flag a GPIO set as output for IRQ\n",
                           __func__);
                 return -EIO;
         }
 
-        set_bit(FLAG_USED_AS_IRQ, &chip->gpiodev->descs[offset].flags);
+        set_bit(FLAG_USED_AS_IRQ, &desc->flags);
         return 0;
 }
 EXPORT_SYMBOL_GPL(gpiochip_lock_as_irq);
diff --git a/drivers/net/ethernet/arc/emac_mdio.c b/drivers/net/ethernet/arc/emac_mdio.c
index 16419f550eff..058460bdd5a6 100644
--- a/drivers/net/ethernet/arc/emac_mdio.c
+++ b/drivers/net/ethernet/arc/emac_mdio.c
@@ -141,7 +141,7 @@ int arc_mdio_probe(struct arc_emac_priv *priv)
         priv->bus = bus;
         bus->priv = priv;
         bus->parent = priv->dev;
-        bus->name = "Synopsys MII Bus",
+        bus->name = "Synopsys MII Bus";
         bus->read = &arc_mdio_read;
         bus->write = &arc_mdio_write;
         bus->reset = &arc_mdio_reset;
diff --git a/drivers/net/ethernet/atheros/alx/alx.h b/drivers/net/ethernet/atheros/alx/alx.h
index 8fc93c5f6abc..d02c4240b7df 100644
--- a/drivers/net/ethernet/atheros/alx/alx.h
+++ b/drivers/net/ethernet/atheros/alx/alx.h
@@ -96,6 +96,10 @@ struct alx_priv {
         unsigned int rx_ringsz;
         unsigned int rxbuf_size;
 
+        struct page  *rx_page;
+        unsigned int rx_page_offset;
+        unsigned int rx_frag_size;
+
         struct napi_struct napi;
         struct alx_tx_queue txq;
         struct alx_rx_queue rxq;
diff --git a/drivers/net/ethernet/atheros/alx/main.c b/drivers/net/ethernet/atheros/alx/main.c
index 9fe8b5e310d1..c98acdc0d14f 100644
--- a/drivers/net/ethernet/atheros/alx/main.c
+++ b/drivers/net/ethernet/atheros/alx/main.c
@@ -70,6 +70,35 @@ static void alx_free_txbuf(struct alx_priv *alx, int entry)
         }
 }
 
+static struct sk_buff *alx_alloc_skb(struct alx_priv *alx, gfp_t gfp)
+{
+        struct sk_buff *skb;
+        struct page *page;
+
+        if (alx->rx_frag_size > PAGE_SIZE)
+                return __netdev_alloc_skb(alx->dev, alx->rxbuf_size, gfp);
+
+        page = alx->rx_page;
+        if (!page) {
+                alx->rx_page = page = alloc_page(gfp);
+                if (unlikely(!page))
+                        return NULL;
+                alx->rx_page_offset = 0;
+        }
+
+        skb = build_skb(page_address(page) + alx->rx_page_offset,
+                        alx->rx_frag_size);
+        if (likely(skb)) {
+                alx->rx_page_offset += alx->rx_frag_size;
+                if (alx->rx_page_offset >= PAGE_SIZE)
+                        alx->rx_page = NULL;
+                else
+                        get_page(page);
+        }
+        return skb;
+}
+
+
 static int alx_refill_rx_ring(struct alx_priv *alx, gfp_t gfp)
 {
         struct alx_rx_queue *rxq = &alx->rxq;
@@ -86,7 +115,7 @@ static int alx_refill_rx_ring(struct alx_priv *alx, gfp_t gfp)
         while (!cur_buf->skb && next != rxq->read_idx) {
                 struct alx_rfd *rfd = &rxq->rfd[cur];
 
-                skb = __netdev_alloc_skb(alx->dev, alx->rxbuf_size, gfp);
+                skb = alx_alloc_skb(alx, gfp);
                 if (!skb)
                         break;
                 dma = dma_map_single(&alx->hw.pdev->dev,
@@ -124,6 +153,7 @@ static int alx_refill_rx_ring(struct alx_priv *alx, gfp_t gfp)
                 alx_write_mem16(&alx->hw, ALX_RFD_PIDX, cur);
         }
 
+
         return count;
 }
 
@@ -592,6 +622,11 @@ static void alx_free_rings(struct alx_priv *alx)
         kfree(alx->txq.bufs);
         kfree(alx->rxq.bufs);
 
+        if (alx->rx_page) {
+                put_page(alx->rx_page);
+                alx->rx_page = NULL;
+        }
+
         dma_free_coherent(&alx->hw.pdev->dev,
                           alx->descmem.size,
                           alx->descmem.virt,
@@ -646,6 +681,7 @@ static int alx_request_irq(struct alx_priv *alx)
                                   alx->dev->name, alx);
                 if (!err)
                         goto out;
+
                 /* fall back to legacy interrupt */
                 pci_disable_msi(alx->hw.pdev);
         }
@@ -689,6 +725,7 @@ static int alx_init_sw(struct alx_priv *alx)
         struct pci_dev *pdev = alx->hw.pdev;
         struct alx_hw *hw = &alx->hw;
         int err;
+        unsigned int head_size;
 
         err = alx_identify_hw(alx);
         if (err) {
@@ -704,7 +741,12 @@ static int alx_init_sw(struct alx_priv *alx)
 
         hw->smb_timer = 400;
         hw->mtu = alx->dev->mtu;
+
         alx->rxbuf_size = ALX_MAX_FRAME_LEN(hw->mtu);
+        head_size = SKB_DATA_ALIGN(alx->rxbuf_size + NET_SKB_PAD) +
+                    SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
+        alx->rx_frag_size = roundup_pow_of_two(head_size);
+
         alx->tx_ringsz = 256;
         alx->rx_ringsz = 512;
         hw->imt = 200;
@@ -806,6 +848,7 @@ static int alx_change_mtu(struct net_device *netdev, int mtu)
 {
         struct alx_priv *alx = netdev_priv(netdev);
         int max_frame = ALX_MAX_FRAME_LEN(mtu);
+        unsigned int head_size;
 
         if ((max_frame < ALX_MIN_FRAME_SIZE) ||
             (max_frame > ALX_MAX_FRAME_SIZE))
@@ -817,6 +860,9 @@ static int alx_change_mtu(struct net_device *netdev, int mtu)
         netdev->mtu = mtu;
         alx->hw.mtu = mtu;
         alx->rxbuf_size = max(max_frame, ALX_DEF_RXBUF_SIZE);
+        head_size = SKB_DATA_ALIGN(alx->rxbuf_size + NET_SKB_PAD) +
+                    SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
+        alx->rx_frag_size = roundup_pow_of_two(head_size);
         netdev_update_features(netdev);
         if (netif_running(netdev))
                 alx_reinit(alx);
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index 0a5b770cefaa..c5fe915870ad 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -13941,14 +13941,14 @@ static int bnx2x_init_one(struct pci_dev *pdev,
                 bp->doorbells = bnx2x_vf_doorbells(bp);
                 rc = bnx2x_vf_pci_alloc(bp);
                 if (rc)
-                        goto init_one_exit;
+                        goto init_one_freemem;
         } else {
                 doorbell_size = BNX2X_L2_MAX_CID(bp) * (1 << BNX2X_DB_SHIFT);
                 if (doorbell_size > pci_resource_len(pdev, 2)) {
                         dev_err(&bp->pdev->dev,
                                 "Cannot map doorbells, bar size too small, aborting\n");
                         rc = -ENOMEM;
-                        goto init_one_exit;
+                        goto init_one_freemem;
                 }
                 bp->doorbells = ioremap_nocache(pci_resource_start(pdev, 2),
                                                 doorbell_size);
@@ -13957,19 +13957,19 @@ static int bnx2x_init_one(struct pci_dev *pdev,
                 dev_err(&bp->pdev->dev,
                         "Cannot map doorbell space, aborting\n");
                 rc = -ENOMEM;
-                goto init_one_exit;
+                goto init_one_freemem;
         }
 
         if (IS_VF(bp)) {
                 rc = bnx2x_vfpf_acquire(bp, tx_count, rx_count);
                 if (rc)
-                        goto init_one_exit;
+                        goto init_one_freemem;
         }
 
         /* Enable SRIOV if capability found in configuration space */
         rc = bnx2x_iov_init_one(bp, int_mode, BNX2X_MAX_NUM_OF_VFS);
         if (rc)
-                goto init_one_exit;
+                goto init_one_freemem;
 
         /* calc qm_cid_count */
         bp->qm_cid_count = bnx2x_set_qm_cid_count(bp);
@@ -13988,7 +13988,7 @@ static int bnx2x_init_one(struct pci_dev *pdev,
         rc = bnx2x_set_int_mode(bp);
         if (rc) {
                 dev_err(&pdev->dev, "Cannot set interrupts\n");
-                goto init_one_exit;
+                goto init_one_freemem;
         }
         BNX2X_DEV_INFO("set interrupts successfully\n");
 
@@ -13996,7 +13996,7 @@ static int bnx2x_init_one(struct pci_dev *pdev,
         rc = register_netdev(dev);
         if (rc) {
                 dev_err(&pdev->dev, "Cannot register net device\n");
-                goto init_one_exit;
+                goto init_one_freemem;
         }
         BNX2X_DEV_INFO("device name after netdev register %s\n", dev->name);
 
@@ -14029,6 +14029,9 @@ static int bnx2x_init_one(struct pci_dev *pdev,
 
         return 0;
 
+init_one_freemem:
+        bnx2x_free_mem_bp(bp);
+
 init_one_exit:
         bnx2x_disable_pcie_error_reporting(bp);
 
diff --git a/drivers/net/ethernet/ezchip/nps_enet.c b/drivers/net/ethernet/ezchip/nps_enet.c
index 085f9125cf42..06f031715b57 100644
--- a/drivers/net/ethernet/ezchip/nps_enet.c
+++ b/drivers/net/ethernet/ezchip/nps_enet.c
@@ -205,8 +205,10 @@ static int nps_enet_poll(struct napi_struct *napi, int budget)
                  * re-adding ourselves to the poll list.
                  */
 
-                if (priv->tx_skb && !tx_ctrl_ct)
+                if (priv->tx_skb && !tx_ctrl_ct) {
+                        nps_enet_reg_set(priv, NPS_ENET_REG_BUF_INT_ENABLE, 0);
                         napi_reschedule(napi);
+                }
         }
 
         return work_done;
diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index ca2cccc594fd..3c0255e98535 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -1197,10 +1197,8 @@ fec_enet_tx_queue(struct net_device *ndev, u16 queue_id)
                                          fec16_to_cpu(bdp->cbd_datlen),
                                          DMA_TO_DEVICE);
                 bdp->cbd_bufaddr = cpu_to_fec32(0);
-                if (!skb) {
-                        bdp = fec_enet_get_nextdesc(bdp, &txq->bd);
-                        continue;
-                }
+                if (!skb)
+                        goto skb_done;
 
                 /* Check for errors. */
                 if (status & (BD_ENET_TX_HB | BD_ENET_TX_LC |
@@ -1239,7 +1237,7 @@ fec_enet_tx_queue(struct net_device *ndev, u16 queue_id)
 
                 /* Free the sk buffer associated with this last transmit */
                 dev_kfree_skb_any(skb);
-
+skb_done:
                 /* Make sure the update to bdp and tx_skbuff are performed
                  * before dirty_tx
                  */
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c b/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c
index 3d746c887873..67a648c7d3a9 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c
@@ -46,7 +46,6 @@ static u32 hns_nic_get_link(struct net_device *net_dev)
         u32 link_stat = priv->link;
         struct hnae_handle *h;
 
-        assert(priv && priv->ae_handle);
         h = priv->ae_handle;
 
         if (priv->phy) {
@@ -646,8 +645,6 @@ static void hns_nic_get_drvinfo(struct net_device *net_dev,
 {
         struct hns_nic_priv *priv = netdev_priv(net_dev);
 
-        assert(priv);
-
         strncpy(drvinfo->version, HNAE_DRIVER_VERSION,
                 sizeof(drvinfo->version));
         drvinfo->version[sizeof(drvinfo->version) - 1] = '\0';
@@ -720,8 +717,6 @@ static int hns_set_pauseparam(struct net_device *net_dev,
         struct hnae_handle *h;
         struct hnae_ae_ops *ops;
 
-        assert(priv || priv->ae_handle);
-
         h = priv->ae_handle;
         ops = h->dev->ops;
 
@@ -780,8 +775,6 @@ static int hns_set_coalesce(struct net_device *net_dev,
         struct hnae_ae_ops *ops;
         int ret;
 
-        assert(priv || priv->ae_handle);
-
         ops = priv->ae_handle->dev->ops;
 
         if (ec->tx_coalesce_usecs != ec->rx_coalesce_usecs)
@@ -1111,8 +1104,6 @@ void hns_get_regs(struct net_device *net_dev, struct ethtool_regs *cmd,
         struct hns_nic_priv *priv = netdev_priv(net_dev);
         struct hnae_ae_ops *ops;
 
-        assert(priv || priv->ae_handle);
-
         ops = priv->ae_handle->dev->ops;
 
         cmd->version = HNS_CHIP_VERSION;
@@ -1135,8 +1126,6 @@ static int hns_get_regs_len(struct net_device *net_dev)
         struct hns_nic_priv *priv = netdev_priv(net_dev);
         struct hnae_ae_ops *ops;
 
-        assert(priv || priv->ae_handle);
-
         ops = priv->ae_handle->dev->ops;
         if (!ops->get_regs_len) {
                 netdev_err(net_dev, "ops->get_regs_len is null!\n");
diff --git a/drivers/net/ethernet/marvell/mvneta_bm.c b/drivers/net/ethernet/marvell/mvneta_bm.c
index 01fccec632ec..466939f8f0cf 100644
--- a/drivers/net/ethernet/marvell/mvneta_bm.c
+++ b/drivers/net/ethernet/marvell/mvneta_bm.c
@@ -189,6 +189,7 @@ struct mvneta_bm_pool *mvneta_bm_pool_use(struct mvneta_bm *priv, u8 pool_id,
                         SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
                 hwbm_pool->construct = mvneta_bm_construct;
                 hwbm_pool->priv = new_pool;
+                spin_lock_init(&hwbm_pool->lock);
 
                 /* Create new pool */
                 err = mvneta_bm_pool_create(priv, new_pool);
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
index c761194bb323..fc95affaf76b 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
@@ -362,7 +362,7 @@ static void mlx4_en_get_ethtool_stats(struct net_device *dev,
 
         for (i = 0; i < NUM_MAIN_STATS; i++, bitmap_iterator_inc(&it))
                 if (bitmap_iterator_test(&it))
-                        data[index++] = ((unsigned long *)&priv->stats)[i];
+                        data[index++] = ((unsigned long *)&dev->stats)[i];
 
         for (i = 0; i < NUM_PORT_STATS; i++, bitmap_iterator_inc(&it))
                 if (bitmap_iterator_test(&it))
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
index 92e0624f4cf0..19ceced6736c 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
@@ -1296,15 +1296,16 @@ static void mlx4_en_tx_timeout(struct net_device *dev)
 }
 
 
-static struct net_device_stats *mlx4_en_get_stats(struct net_device *dev)
+static struct rtnl_link_stats64 *
+mlx4_en_get_stats64(struct net_device *dev, struct rtnl_link_stats64 *stats)
 {
         struct mlx4_en_priv *priv = netdev_priv(dev);
 
         spin_lock_bh(&priv->stats_lock);
-        memcpy(&priv->ret_stats, &priv->stats, sizeof(priv->stats));
+        netdev_stats_to_stats64(stats, &dev->stats);
         spin_unlock_bh(&priv->stats_lock);
 
-        return &priv->ret_stats;
+        return stats;
 }
 
 static void mlx4_en_set_default_moderation(struct mlx4_en_priv *priv)
@@ -1876,7 +1877,6 @@ static void mlx4_en_clear_stats(struct net_device *dev)
         if (mlx4_en_DUMP_ETH_STATS(mdev, priv->port, 1))
                 en_dbg(HW, priv, "Failed dumping statistics\n");
 
-        memset(&priv->stats, 0, sizeof(priv->stats));
         memset(&priv->pstats, 0, sizeof(priv->pstats));
         memset(&priv->pkstats, 0, sizeof(priv->pkstats));
         memset(&priv->port_stats, 0, sizeof(priv->port_stats));
@@ -1892,6 +1892,11 @@ static void mlx4_en_clear_stats(struct net_device *dev)
                 priv->tx_ring[i]->bytes = 0;
                 priv->tx_ring[i]->packets = 0;
                 priv->tx_ring[i]->tx_csum = 0;
+                priv->tx_ring[i]->tx_dropped = 0;
+                priv->tx_ring[i]->queue_stopped = 0;
+                priv->tx_ring[i]->wake_queue = 0;
+                priv->tx_ring[i]->tso_packets = 0;
+                priv->tx_ring[i]->xmit_more = 0;
         }
         for (i = 0; i < priv->rx_ring_num; i++) {
                 priv->rx_ring[i]->bytes = 0;
@@ -2482,7 +2487,7 @@ static const struct net_device_ops mlx4_netdev_ops = {
         .ndo_stop               = mlx4_en_close,
         .ndo_start_xmit         = mlx4_en_xmit,
         .ndo_select_queue       = mlx4_en_select_queue,
-        .ndo_get_stats          = mlx4_en_get_stats,
+        .ndo_get_stats64        = mlx4_en_get_stats64,
         .ndo_set_rx_mode        = mlx4_en_set_rx_mode,
         .ndo_set_mac_address    = mlx4_en_set_mac,
         .ndo_validate_addr      = eth_validate_addr,
@@ -2514,7 +2519,7 @@ static const struct net_device_ops mlx4_netdev_ops_master = {
         .ndo_stop               = mlx4_en_close,
         .ndo_start_xmit         = mlx4_en_xmit,
         .ndo_select_queue       = mlx4_en_select_queue,
-        .ndo_get_stats          = mlx4_en_get_stats,
+        .ndo_get_stats64        = mlx4_en_get_stats64,
         .ndo_set_rx_mode        = mlx4_en_set_rx_mode,
         .ndo_set_mac_address    = mlx4_en_set_mac,
         .ndo_validate_addr      = eth_validate_addr,
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_port.c b/drivers/net/ethernet/mellanox/mlx4/en_port.c
index 20b6c2e678b8..5aa8b751f417 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_port.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_port.c
@@ -152,8 +152,9 @@ int mlx4_en_DUMP_ETH_STATS(struct mlx4_en_dev *mdev, u8 port, u8 reset)
         struct mlx4_counter tmp_counter_stats;
         struct mlx4_en_stat_out_mbox *mlx4_en_stats;
         struct mlx4_en_stat_out_flow_control_mbox *flowstats;
-        struct mlx4_en_priv *priv = netdev_priv(mdev->pndev[port]);
-        struct net_device_stats *stats = &priv->stats;
+        struct net_device *dev = mdev->pndev[port];
+        struct mlx4_en_priv *priv = netdev_priv(dev);
+        struct net_device_stats *stats = &dev->stats;
         struct mlx4_cmd_mailbox *mailbox;
         u64 in_mod = reset << 8 | port;
         int err;
@@ -188,6 +189,7 @@ int mlx4_en_DUMP_ETH_STATS(struct mlx4_en_dev *mdev, u8 port, u8 reset)
         }
         stats->tx_packets = 0;
         stats->tx_bytes = 0;
+        stats->tx_dropped = 0;
         priv->port_stats.tx_chksum_offload = 0;
         priv->port_stats.queue_stopped = 0;
         priv->port_stats.wake_queue = 0;
@@ -199,6 +201,7 @@ int mlx4_en_DUMP_ETH_STATS(struct mlx4_en_dev *mdev, u8 port, u8 reset)
 
                 stats->tx_packets += ring->packets;
                 stats->tx_bytes += ring->bytes;
+                stats->tx_dropped += ring->tx_dropped;
                 priv->port_stats.tx_chksum_offload += ring->tx_csum;
                 priv->port_stats.queue_stopped     += ring->queue_stopped;
                 priv->port_stats.wake_queue        += ring->wake_queue;
@@ -237,21 +240,12 @@ int mlx4_en_DUMP_ETH_STATS(struct mlx4_en_dev *mdev, u8 port, u8 reset)
         stats->multicast = en_stats_adder(&mlx4_en_stats->MCAST_prio_0,
                                           &mlx4_en_stats->MCAST_prio_1,
                                           NUM_PRIORITIES);
-        stats->collisions = 0;
         stats->rx_dropped = be32_to_cpu(mlx4_en_stats->RDROP) +
                             sw_rx_dropped;
         stats->rx_length_errors = be32_to_cpu(mlx4_en_stats->RdropLength);
-        stats->rx_over_errors = 0;
         stats->rx_crc_errors = be32_to_cpu(mlx4_en_stats->RCRC);
-        stats->rx_frame_errors = 0;
         stats->rx_fifo_errors = be32_to_cpu(mlx4_en_stats->RdropOvflw);
-        stats->rx_missed_errors = 0;
-        stats->tx_aborted_errors = 0;
-        stats->tx_carrier_errors = 0;
-        stats->tx_fifo_errors = 0;
-        stats->tx_heartbeat_errors = 0;
-        stats->tx_window_errors = 0;
-        stats->tx_dropped = be32_to_cpu(mlx4_en_stats->TDROP);
+        stats->tx_dropped += be32_to_cpu(mlx4_en_stats->TDROP);
 
         /* RX stats */
         priv->pkstats.rx_multicast_packets = stats->multicast;
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_tx.c b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
index f6e61570cb2c..76aa4d27183c 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_tx.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
@@ -726,12 +726,12 @@ netdev_tx_t mlx4_en_xmit(struct sk_buff *skb, struct net_device *dev)
         bool inline_ok;
         u32 ring_cons;
 
-        if (!priv->port_up)
-                goto tx_drop;
-
         tx_ind = skb_get_queue_mapping(skb);
         ring = priv->tx_ring[tx_ind];
 
+        if (!priv->port_up)
+                goto tx_drop;
+
         /* fetch ring->cons far ahead before needing it to avoid stall */
         ring_cons = ACCESS_ONCE(ring->cons);
 
@@ -1030,7 +1030,7 @@ tx_drop_unmap:
 
 tx_drop:
         dev_kfree_skb_any(skb);
-        priv->stats.tx_dropped++;
+        ring->tx_dropped++;
         return NETDEV_TX_OK;
 }
 
diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
index cc84e09f324a..467d47ed2c39 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
+++ b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
@@ -270,6 +270,7 @@ struct mlx4_en_tx_ring {
         unsigned long           tx_csum;
         unsigned long           tso_packets;
         unsigned long           xmit_more;
+        unsigned int            tx_dropped;
         struct mlx4_bf          bf;
         unsigned long           queue_stopped;
 
@@ -482,8 +483,6 @@ struct mlx4_en_priv {
         struct mlx4_en_port_profile *prof;
         struct net_device *dev;
         unsigned long active_vlans[BITS_TO_LONGS(VLAN_N_VID)];
-        struct net_device_stats stats;
-        struct net_device_stats ret_stats;
         struct mlx4_en_port_state port_state;
         spinlock_t stats_lock;
         struct ethtool_flow_id ethtool_rules[MAX_NUM_OF_FS_RULES];
diff --git a/drivers/net/ethernet/qlogic/qed/qed_dcbx.c b/drivers/net/ethernet/qlogic/qed/qed_dcbx.c
index cbf58e1f9333..21ec1c2df2c7 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_dcbx.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_dcbx.c
@@ -192,9 +192,10 @@ qed_dcbx_process_tlv(struct qed_hwfn *p_hwfn,
                      struct dcbx_app_priority_entry *p_tbl,
                      u32 pri_tc_tbl, int count, bool dcbx_enabled)
 {
-        u8 tc, priority, priority_map;
+        u8 tc, priority_map;
         enum dcbx_protocol_type type;
         u16 protocol_id;
+        int priority;
         bool enable;
         int i;
 
@@ -221,7 +222,7 @@ qed_dcbx_process_tlv(struct qed_hwfn *p_hwfn,
                          * indication, but we only got here if there was an
                          * app tlv for the protocol, so dcbx must be enabled.
                          */
-                        enable = !!(type == DCBX_PROTOCOL_ETH);
+                        enable = !(type == DCBX_PROTOCOL_ETH);
 
                         qed_dcbx_update_app_info(p_data, p_hwfn, enable, true,
                                                  priority, tc, type);
diff --git a/drivers/net/ethernet/qlogic/qed/qed_dev.c b/drivers/net/ethernet/qlogic/qed/qed_dev.c
index 089016f46f26..2d89e8c16b32 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_dev.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_dev.c
@@ -155,12 +155,14 @@ void qed_resc_free(struct qed_dev *cdev)
         }
 }
 
-static int qed_init_qm_info(struct qed_hwfn *p_hwfn)
+static int qed_init_qm_info(struct qed_hwfn *p_hwfn, bool b_sleepable)
 {
         u8 num_vports, vf_offset = 0, i, vport_id, num_ports, curr_queue = 0;
         struct qed_qm_info *qm_info = &p_hwfn->qm_info;
         struct init_qm_port_params *p_qm_port;
         u16 num_pqs, multi_cos_tcs = 1;
+        u8 pf_wfq = qm_info->pf_wfq;
+        u32 pf_rl = qm_info->pf_rl;
         u16 num_vfs = 0;
 
 #ifdef CONFIG_QED_SRIOV
@@ -182,23 +184,28 @@ static int qed_init_qm_info(struct qed_hwfn *p_hwfn)
 
         /* PQs will be arranged as follows: First per-TC PQ then pure-LB quete.
          */
-        qm_info->qm_pq_params = kzalloc(sizeof(*qm_info->qm_pq_params) *
-                                        num_pqs, GFP_KERNEL);
+        qm_info->qm_pq_params = kcalloc(num_pqs,
+                                        sizeof(struct init_qm_pq_params),
+                                        b_sleepable ? GFP_KERNEL : GFP_ATOMIC);
         if (!qm_info->qm_pq_params)
                 goto alloc_err;
 
-        qm_info->qm_vport_params = kzalloc(sizeof(*qm_info->qm_vport_params) *
-                                           num_vports, GFP_KERNEL);
+        qm_info->qm_vport_params = kcalloc(num_vports,
+                                           sizeof(struct init_qm_vport_params),
+                                           b_sleepable ? GFP_KERNEL
+                                                       : GFP_ATOMIC);
         if (!qm_info->qm_vport_params)
                 goto alloc_err;
 
-        qm_info->qm_port_params = kzalloc(sizeof(*qm_info->qm_port_params) *
-                                          MAX_NUM_PORTS, GFP_KERNEL);
+        qm_info->qm_port_params = kcalloc(MAX_NUM_PORTS,
+                                          sizeof(struct init_qm_port_params),
+                                          b_sleepable ? GFP_KERNEL
+                                                      : GFP_ATOMIC);
         if (!qm_info->qm_port_params)
                 goto alloc_err;
 
-        qm_info->wfq_data = kcalloc(num_vports, sizeof(*qm_info->wfq_data),
-                                    GFP_KERNEL);
+        qm_info->wfq_data = kcalloc(num_vports, sizeof(struct qed_wfq_data),
+                                    b_sleepable ? GFP_KERNEL : GFP_ATOMIC);
         if (!qm_info->wfq_data)
                 goto alloc_err;
 
@@ -264,10 +271,10 @@ static int qed_init_qm_info(struct qed_hwfn *p_hwfn)
         for (i = 0; i < qm_info->num_vports; i++)
                 qm_info->qm_vport_params[i].vport_wfq = 1;
 
-        qm_info->pf_wfq = 0;
-        qm_info->pf_rl = 0;
         qm_info->vport_rl_en = 1;
         qm_info->vport_wfq_en = 1;
+        qm_info->pf_rl = pf_rl;
+        qm_info->pf_wfq = pf_wfq;
 
         return 0;
 
@@ -299,7 +306,7 @@ int qed_qm_reconf(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt)
         qed_qm_info_free(p_hwfn);
 
         /* initialize qed's qm data structure */
-        rc = qed_init_qm_info(p_hwfn);
+        rc = qed_init_qm_info(p_hwfn, false);
         if (rc)
                 return rc;
 
@@ -388,7 +395,7 @@ int qed_resc_alloc(struct qed_dev *cdev)
                         goto alloc_err;
 
                 /* Prepare and process QM requirements */
-                rc = qed_init_qm_info(p_hwfn);
+                rc = qed_init_qm_info(p_hwfn, true);
                 if (rc)
                         goto alloc_err;
 
@@ -581,7 +588,14 @@ static void qed_calc_hw_mode(struct qed_hwfn *p_hwfn)
 
         hw_mode |= 1 << MODE_ASIC;
 
+        if (p_hwfn->cdev->num_hwfns > 1)
+                hw_mode |= 1 << MODE_100G;
+
         p_hwfn->hw_info.hw_mode = hw_mode;
+
+        DP_VERBOSE(p_hwfn, (NETIF_MSG_PROBE | NETIF_MSG_IFUP),
+                   "Configuring function for hw_mode: 0x%08x\n",
+                   p_hwfn->hw_info.hw_mode);
 }
 
 /* Init run time data for all PFs on an engine. */
@@ -821,6 +835,11 @@ int qed_hw_init(struct qed_dev *cdev,
         u32 load_code, param;
         int rc, mfw_rc, i;
 
+        if ((int_mode == QED_INT_MODE_MSI) && (cdev->num_hwfns > 1)) {
+                DP_NOTICE(cdev, "MSI mode is not supported for CMT devices\n");
+                return -EINVAL;
+        }
+
         if (IS_PF(cdev)) {
                 rc = qed_init_fw_data(cdev, bin_fw_data);
                 if (rc != 0)
@@ -2086,6 +2105,13 @@ void qed_configure_vp_wfq_on_link_change(struct qed_dev *cdev, u32 min_pf_rate)
 {
         int i;
 
+        if (cdev->num_hwfns > 1) {
+                DP_VERBOSE(cdev,
+                           NETIF_MSG_LINK,
+                           "WFQ configuration is not supported for this device\n");
+                return;
+        }
+
         for_each_hwfn(cdev, i) {
                 struct qed_hwfn *p_hwfn = &cdev->hwfns[i];
 
diff --git a/drivers/net/ethernet/qlogic/qed/qed_main.c b/drivers/net/ethernet/qlogic/qed/qed_main.c
index 8b22f87033ce..753064679bde 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_main.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_main.c
@@ -413,15 +413,17 @@ static int qed_set_int_mode(struct qed_dev *cdev, bool force_mode)
                 /* Fallthrough */
 
         case QED_INT_MODE_MSI:
-                rc = pci_enable_msi(cdev->pdev);
-                if (!rc) {
-                        int_params->out.int_mode = QED_INT_MODE_MSI;
-                        goto out;
-                }
+                if (cdev->num_hwfns == 1) {
+                        rc = pci_enable_msi(cdev->pdev);
+                        if (!rc) {
+                                int_params->out.int_mode = QED_INT_MODE_MSI;
+                                goto out;
+                        }
 
-                DP_NOTICE(cdev, "Failed to enable MSI\n");
-                if (force_mode)
-                        goto out;
+                        DP_NOTICE(cdev, "Failed to enable MSI\n");
+                        if (force_mode)
+                                goto out;
+                }
                 /* Fallthrough */
 
         case QED_INT_MODE_INTA:
diff --git a/drivers/net/ethernet/qlogic/qede/qede_ethtool.c b/drivers/net/ethernet/qlogic/qede/qede_ethtool.c
index 1bc75358cbc4..ad3cae3b7243 100644
--- a/drivers/net/ethernet/qlogic/qede/qede_ethtool.c
+++ b/drivers/net/ethernet/qlogic/qede/qede_ethtool.c
@@ -230,7 +230,10 @@ static int qede_get_sset_count(struct net_device *dev, int stringset)
         case ETH_SS_PRIV_FLAGS:
                 return QEDE_PRI_FLAG_LEN;
         case ETH_SS_TEST:
-                return QEDE_ETHTOOL_TEST_MAX;
+                if (!IS_VF(edev))
+                        return QEDE_ETHTOOL_TEST_MAX;
+                else
+                        return 0;
         default:
                 DP_VERBOSE(edev, QED_MSG_DEBUG,
                            "Unsupported stringset 0x%08x\n", stringset);
diff --git a/drivers/net/ethernet/qlogic/qede/qede_main.c b/drivers/net/ethernet/qlogic/qede/qede_main.c
index 337e839ca586..5d00d1404bfc 100644
--- a/drivers/net/ethernet/qlogic/qede/qede_main.c
+++ b/drivers/net/ethernet/qlogic/qede/qede_main.c
@@ -1824,7 +1824,7 @@ static int qede_set_vf_rate(struct net_device *dev, int vfidx,
 {
         struct qede_dev *edev = netdev_priv(dev);
 
-        return edev->ops->iov->set_rate(edev->cdev, vfidx, max_tx_rate,
+        return edev->ops->iov->set_rate(edev->cdev, vfidx, min_tx_rate,
                                         max_tx_rate);
 }
 
@@ -2091,6 +2091,29 @@ static void qede_vlan_mark_nonconfigured(struct qede_dev *edev)
         edev->accept_any_vlan = false;
 }
 
+int qede_set_features(struct net_device *dev, netdev_features_t features)
+{
+        struct qede_dev *edev = netdev_priv(dev);
+        netdev_features_t changes = features ^ dev->features;
+        bool need_reload = false;
+
+        /* No action needed if hardware GRO is disabled during driver load */
+        if (changes & NETIF_F_GRO) {
+                if (dev->features & NETIF_F_GRO)
+                        need_reload = !edev->gro_disable;
+                else
+                        need_reload = edev->gro_disable;
+        }
+
+        if (need_reload && netif_running(edev->ndev)) {
+                dev->features = features;
+                qede_reload(edev, NULL, NULL);
+                return 1;
+        }
+
+        return 0;
+}
+
 #ifdef CONFIG_QEDE_VXLAN
 static void qede_add_vxlan_port(struct net_device *dev,
                                 sa_family_t sa_family, __be16 port)
@@ -2175,6 +2198,7 @@ static const struct net_device_ops qede_netdev_ops = {
 #endif
         .ndo_vlan_rx_add_vid = qede_vlan_rx_add_vid,
         .ndo_vlan_rx_kill_vid = qede_vlan_rx_kill_vid,
+        .ndo_set_features = qede_set_features,
         .ndo_get_stats64 = qede_get_stats64,
 #ifdef CONFIG_QED_SRIOV
         .ndo_set_vf_link_state = qede_set_vf_link_state,
diff --git a/drivers/net/ethernet/qlogic/qlge/qlge_main.c b/drivers/net/ethernet/qlogic/qlge/qlge_main.c
index 83d72106471c..fd5d1c93b55b 100644
--- a/drivers/net/ethernet/qlogic/qlge/qlge_main.c
+++ b/drivers/net/ethernet/qlogic/qlge/qlge_main.c
@@ -4846,7 +4846,6 @@ static void ql_eeh_close(struct net_device *ndev)
         }
 
         /* Disabling the timer */
-        del_timer_sync(&qdev->timer);
         ql_cancel_all_work_sync(qdev);
 
         for (i = 0; i < qdev->rss_ring_count; i++)
@@ -4873,6 +4872,7 @@ static pci_ers_result_t qlge_io_error_detected(struct pci_dev *pdev,
                 return PCI_ERS_RESULT_CAN_RECOVER;
         case pci_channel_io_frozen:
                 netif_device_detach(ndev);
+                del_timer_sync(&qdev->timer);
                 if (netif_running(ndev))
                         ql_eeh_close(ndev);
                 pci_disable_device(pdev);
@@ -4880,6 +4880,7 @@ static pci_ers_result_t qlge_io_error_detected(struct pci_dev *pdev,
         case pci_channel_io_perm_failure:
                 dev_err(&pdev->dev,
                         "%s: pci_channel_io_perm_failure.\n", __func__);
+                del_timer_sync(&qdev->timer);
                 ql_eeh_close(ndev);
                 set_bit(QL_EEH_FATAL, &qdev->flags);
                 return PCI_ERS_RESULT_DISCONNECT;
diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c
index 1681084cc96f..1f309127457d 100644
--- a/drivers/net/ethernet/sfc/ef10.c
+++ b/drivers/net/ethernet/sfc/ef10.c
@@ -619,6 +619,17 @@ fail:
         return rc;
 }
 
+static void efx_ef10_forget_old_piobufs(struct efx_nic *efx)
+{
+        struct efx_channel *channel;
+        struct efx_tx_queue *tx_queue;
+
+        /* All our existing PIO buffers went away */
+        efx_for_each_channel(channel, efx)
+                efx_for_each_channel_tx_queue(tx_queue, channel)
+                        tx_queue->piobuf = NULL;
+}
+
 #else /* !EFX_USE_PIO */
 
 static int efx_ef10_alloc_piobufs(struct efx_nic *efx, unsigned int n)
@@ -635,6 +646,10 @@ static void efx_ef10_free_piobufs(struct efx_nic *efx)
 {
 }
 
+static void efx_ef10_forget_old_piobufs(struct efx_nic *efx)
+{
+}
+
 #endif /* EFX_USE_PIO */
 
 static void efx_ef10_remove(struct efx_nic *efx)
@@ -1018,6 +1033,7 @@ static void efx_ef10_reset_mc_allocations(struct efx_nic *efx)
         nic_data->must_realloc_vis = true;
         nic_data->must_restore_filters = true;
         nic_data->must_restore_piobufs = true;
+        efx_ef10_forget_old_piobufs(efx);
         nic_data->rx_rss_context = EFX_EF10_RSS_CONTEXT_INVALID;
 
         /* Driver-created vswitches and vports must be re-created */
diff --git a/drivers/net/ethernet/sfc/efx.c b/drivers/net/ethernet/sfc/efx.c
index 0705ec869487..097f363f1630 100644
--- a/drivers/net/ethernet/sfc/efx.c
+++ b/drivers/net/ethernet/sfc/efx.c
@@ -1726,14 +1726,33 @@ static int efx_probe_filters(struct efx_nic *efx)
 
 #ifdef CONFIG_RFS_ACCEL
         if (efx->type->offload_features & NETIF_F_NTUPLE) {
-                efx->rps_flow_id = kcalloc(efx->type->max_rx_ip_filters,
-                                           sizeof(*efx->rps_flow_id),
-                                           GFP_KERNEL);
-                if (!efx->rps_flow_id) {
+                struct efx_channel *channel;
+                int i, success = 1;
+
+                efx_for_each_channel(channel, efx) {
+                        channel->rps_flow_id =
+                                kcalloc(efx->type->max_rx_ip_filters,
+                                        sizeof(*channel->rps_flow_id),
+                                        GFP_KERNEL);
+                        if (!channel->rps_flow_id)
+                                success = 0;
+                        else
+                                for (i = 0;
+                                     i < efx->type->max_rx_ip_filters;
+                                     ++i)
+                                        channel->rps_flow_id[i] =
+                                                RPS_FLOW_ID_INVALID;
+                }
+
+                if (!success) {
+                        efx_for_each_channel(channel, efx)
+                                kfree(channel->rps_flow_id);
                         efx->type->filter_table_remove(efx);
                         rc = -ENOMEM;
                         goto out_unlock;
                 }
+
+                efx->rps_expire_index = efx->rps_expire_channel = 0;
         }
 #endif
 out_unlock:
@@ -1744,7 +1763,10 @@ out_unlock:
 static void efx_remove_filters(struct efx_nic *efx)
 {
 #ifdef CONFIG_RFS_ACCEL
-        kfree(efx->rps_flow_id);
+        struct efx_channel *channel;
+
+        efx_for_each_channel(channel, efx)
+                kfree(channel->rps_flow_id);
 #endif
         down_write(&efx->filter_sem);
         efx->type->filter_table_remove(efx);
diff --git a/drivers/net/ethernet/sfc/net_driver.h b/drivers/net/ethernet/sfc/net_driver.h
index 38c422321cda..d13ddf9703ff 100644
--- a/drivers/net/ethernet/sfc/net_driver.h
+++ b/drivers/net/ethernet/sfc/net_driver.h
@@ -403,6 +403,8 @@ enum efx_sync_events_state {
  * @event_test_cpu: Last CPU to handle interrupt or test event for this channel
  * @irq_count: Number of IRQs since last adaptive moderation decision
  * @irq_mod_score: IRQ moderation score
+ * @rps_flow_id: Flow IDs of filters allocated for accelerated RFS,
+ *      indexed by filter ID
  * @n_rx_tobe_disc: Count of RX_TOBE_DISC errors
  * @n_rx_ip_hdr_chksum_err: Count of RX IP header checksum errors
  * @n_rx_tcp_udp_chksum_err: Count of RX TCP and UDP checksum errors
@@ -446,6 +448,8 @@ struct efx_channel {
         unsigned int irq_mod_score;
 #ifdef CONFIG_RFS_ACCEL
         unsigned int rfs_filters_added;
+#define RPS_FLOW_ID_INVALID 0xFFFFFFFF
+        u32 *rps_flow_id;
 #endif
 
         unsigned n_rx_tobe_disc;
@@ -889,9 +893,9 @@ struct vfdi_status;
  * @filter_sem: Filter table rw_semaphore, for freeing the table
  * @filter_lock: Filter table lock, for mere content changes
  * @filter_state: Architecture-dependent filter table state
- * @rps_flow_id: Flow IDs of filters allocated for accelerated RFS,
- *      indexed by filter ID
- * @rps_expire_index: Next index to check for expiry in @rps_flow_id
+ * @rps_expire_channel: Next channel to check for expiry
+ * @rps_expire_index: Next index to check for expiry in
+ *      @rps_expire_channel's @rps_flow_id
  * @active_queues: Count of RX and TX queues that haven't been flushed and drained.
  * @rxq_flush_pending: Count of number of receive queues that need to be flushed.
  *      Decremented when the efx_flush_rx_queue() is called.
@@ -1035,7 +1039,7 @@ struct efx_nic {
         spinlock_t filter_lock;
         void *filter_state;
 #ifdef CONFIG_RFS_ACCEL
-        u32 *rps_flow_id;
+        unsigned int rps_expire_channel;
         unsigned int rps_expire_index;
 #endif
 
diff --git a/drivers/net/ethernet/sfc/rx.c b/drivers/net/ethernet/sfc/rx.c
index 8956995b2fe7..02b0b5272c14 100644
--- a/drivers/net/ethernet/sfc/rx.c
+++ b/drivers/net/ethernet/sfc/rx.c
@@ -842,33 +842,18 @@ int efx_filter_rfs(struct net_device *net_dev, const struct sk_buff *skb,
         struct efx_nic *efx = netdev_priv(net_dev);
         struct efx_channel *channel;
         struct efx_filter_spec spec;
-        const __be16 *ports;
-        __be16 ether_type;
-        int nhoff;
+        struct flow_keys fk;
         int rc;
 
-        /* The core RPS/RFS code has already parsed and validated
-         * VLAN, IP and transport headers.  We assume they are in the
-         * header area.
-         */
-
-        if (skb->protocol == htons(ETH_P_8021Q)) {
-                const struct vlan_hdr *vh =
-                        (const struct vlan_hdr *)skb->data;
+        if (flow_id == RPS_FLOW_ID_INVALID)
+                return -EINVAL;
 
-                /* We can't filter on the IP 5-tuple and the vlan
-                 * together, so just strip the vlan header and filter
-                 * on the IP part.
-                 */
-                EFX_BUG_ON_PARANOID(skb_headlen(skb) < sizeof(*vh));
-                ether_type = vh->h_vlan_encapsulated_proto;
-                nhoff = sizeof(struct vlan_hdr);
-        } else {
-                ether_type = skb->protocol;
-                nhoff = 0;
-        }
+        if (!skb_flow_dissect_flow_keys(skb, &fk, 0))
+                return -EPROTONOSUPPORT;
 
-        if (ether_type != htons(ETH_P_IP) && ether_type != htons(ETH_P_IPV6))
+        if (fk.basic.n_proto != htons(ETH_P_IP) && fk.basic.n_proto != htons(ETH_P_IPV6))
+                return -EPROTONOSUPPORT;
+        if (fk.control.flags & FLOW_DIS_IS_FRAGMENT)
                 return -EPROTONOSUPPORT;
 
         efx_filter_init_rx(&spec, EFX_FILTER_PRI_HINT,
@@ -878,56 +863,41 @@ int efx_filter_rfs(struct net_device *net_dev, const struct sk_buff *skb,
                 EFX_FILTER_MATCH_ETHER_TYPE | EFX_FILTER_MATCH_IP_PROTO |
                 EFX_FILTER_MATCH_LOC_HOST | EFX_FILTER_MATCH_LOC_PORT |
                 EFX_FILTER_MATCH_REM_HOST | EFX_FILTER_MATCH_REM_PORT;
-        spec.ether_type = ether_type;
-
-        if (ether_type == htons(ETH_P_IP)) {
-                const struct iphdr *ip =
-                        (const struct iphdr *)(skb->data + nhoff);
-
-                EFX_BUG_ON_PARANOID(skb_headlen(skb) < nhoff + sizeof(*ip));
-                if (ip_is_fragment(ip))
-                        return -EPROTONOSUPPORT;
-                spec.ip_proto = ip->protocol;
-                spec.rem_host[0] = ip->saddr;
-                spec.loc_host[0] = ip->daddr;
-                EFX_BUG_ON_PARANOID(skb_headlen(skb) < nhoff + 4 * ip->ihl + 4);
-                ports = (const __be16 *)(skb->data + nhoff + 4 * ip->ihl);
+        spec.ether_type = fk.basic.n_proto;
+        spec.ip_proto = fk.basic.ip_proto;
+
+        if (fk.basic.n_proto == htons(ETH_P_IP)) {
+                spec.rem_host[0] = fk.addrs.v4addrs.src;
+                spec.loc_host[0] = fk.addrs.v4addrs.dst;
         } else {
-                const struct ipv6hdr *ip6 =
-                        (const struct ipv6hdr *)(skb->data + nhoff);
-
-                EFX_BUG_ON_PARANOID(skb_headlen(skb) <
-                                    nhoff + sizeof(*ip6) + 4);
-                spec.ip_proto = ip6->nexthdr;
-                memcpy(spec.rem_host, &ip6->saddr, sizeof(ip6->saddr));
-                memcpy(spec.loc_host, &ip6->daddr, sizeof(ip6->daddr));
-                ports = (const __be16 *)(ip6 + 1);
+                memcpy(spec.rem_host, &fk.addrs.v6addrs.src, sizeof(struct in6_addr));
+                memcpy(spec.loc_host, &fk.addrs.v6addrs.dst, sizeof(struct in6_addr));
         }
 
-        spec.rem_port = ports[0];
-        spec.loc_port = ports[1];
+        spec.rem_port = fk.ports.src;
+        spec.loc_port = fk.ports.dst;
 
         rc = efx->type->filter_rfs_insert(efx, &spec);
         if (rc < 0)
                 return rc;
 
         /* Remember this so we can check whether to expire the filter later */
-        efx->rps_flow_id[rc] = flow_id;
-        channel = efx_get_channel(efx, skb_get_rx_queue(skb));
+        channel = efx_get_channel(efx, rxq_index);
+        channel->rps_flow_id[rc] = flow_id;
         ++channel->rfs_filters_added;
 
-        if (ether_type == htons(ETH_P_IP))
+        if (spec.ether_type == htons(ETH_P_IP))
                 netif_info(efx, rx_status, efx->net_dev,
                            "steering %s %pI4:%u:%pI4:%u to queue %u [flow %u filter %d]\n",
                            (spec.ip_proto == IPPROTO_TCP) ? "TCP" : "UDP",
-                           spec.rem_host, ntohs(ports[0]), spec.loc_host,
-                           ntohs(ports[1]), rxq_index, flow_id, rc);
+                           spec.rem_host, ntohs(spec.rem_port), spec.loc_host,
+                           ntohs(spec.loc_port), rxq_index, flow_id, rc);
         else
                 netif_info(efx, rx_status, efx->net_dev,
                            "steering %s [%pI6]:%u:[%pI6]:%u to queue %u [flow %u filter %d]\n",
                            (spec.ip_proto == IPPROTO_TCP) ? "TCP" : "UDP",
-                           spec.rem_host, ntohs(ports[0]), spec.loc_host,
-                           ntohs(ports[1]), rxq_index, flow_id, rc);
+                           spec.rem_host, ntohs(spec.rem_port), spec.loc_host,
+                           ntohs(spec.loc_port), rxq_index, flow_id, rc);
 
         return rc;
 }
@@ -935,24 +905,34 @@ int efx_filter_rfs(struct net_device *net_dev, const struct sk_buff *skb,
 bool __efx_filter_rfs_expire(struct efx_nic *efx, unsigned int quota)
 {
         bool (*expire_one)(struct efx_nic *efx, u32 flow_id, unsigned int index);
-        unsigned int index, size;
+        unsigned int channel_idx, index, size;
         u32 flow_id;
 
         if (!spin_trylock_bh(&efx->filter_lock))
                 return false;
 
         expire_one = efx->type->filter_rfs_expire_one;
+        channel_idx = efx->rps_expire_channel;
         index = efx->rps_expire_index;
         size = efx->type->max_rx_ip_filters;
         while (quota--) {
-                flow_id = efx->rps_flow_id[index];
-                if (expire_one(efx, flow_id, index))
+                struct efx_channel *channel = efx_get_channel(efx, channel_idx);
+                flow_id = channel->rps_flow_id[index];
+
+                if (flow_id != RPS_FLOW_ID_INVALID &&
+                    expire_one(efx, flow_id, index)) {
                         netif_info(efx, rx_status, efx->net_dev,
-                                   "expired filter %d [flow %u]\n",
-                                   index, flow_id);
-                if (++index == size)
+                                   "expired filter %d [queue %u flow %u]\n",
+                                   index, channel_idx, flow_id);
+                        channel->rps_flow_id[index] = RPS_FLOW_ID_INVALID;
+                }
+                if (++index == size) {
+                        if (++channel_idx == efx->n_channels)
+                                channel_idx = 0;
                         index = 0;
+                }
         }
+        efx->rps_expire_channel = channel_idx;
         efx->rps_expire_index = index;
 
         spin_unlock_bh(&efx->filter_lock);
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c
index 3f83c369f56c..ec295851812b 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c
@@ -297,7 +297,7 @@ int stmmac_mdio_register(struct net_device *ndev)
                 return -ENOMEM;
 
         if (mdio_bus_data->irqs)
-                memcpy(new_bus->irq, mdio_bus_data, sizeof(new_bus->irq));
+                memcpy(new_bus->irq, mdio_bus_data->irqs, sizeof(new_bus->irq));
 
 #ifdef CONFIG_OF
         if (priv->device->of_node)
diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
index a0f64cba86ba..2ace126533cd 100644
--- a/drivers/net/team/team.c
+++ b/drivers/net/team/team.c
@@ -990,7 +990,7 @@ static void team_port_disable(struct team *team,
 #define TEAM_ENC_FEATURES       (NETIF_F_HW_CSUM | NETIF_F_SG | \
                                  NETIF_F_RXCSUM | NETIF_F_ALL_TSO)
 
-static void __team_compute_features(struct team *team)
+static void ___team_compute_features(struct team *team)
 {
         struct team_port *port;
         u32 vlan_features = TEAM_VLAN_FEATURES & NETIF_F_ALL_FOR_ALL;
@@ -1021,15 +1021,20 @@ static void __team_compute_features(struct team *team)
         team->dev->priv_flags &= ~IFF_XMIT_DST_RELEASE;
         if (dst_release_flag == (IFF_XMIT_DST_RELEASE | IFF_XMIT_DST_RELEASE_PERM))
                 team->dev->priv_flags |= IFF_XMIT_DST_RELEASE;
+}
 
+static void __team_compute_features(struct team *team)
+{
+        ___team_compute_features(team);
         netdev_change_features(team->dev);
 }
 
 static void team_compute_features(struct team *team)
 {
         mutex_lock(&team->lock);
-        __team_compute_features(team);
+        ___team_compute_features(team);
         mutex_unlock(&team->lock);
+        netdev_change_features(team->dev);
 }
 
 static int team_port_enter(struct team *team, struct team_port *port)
diff --git a/drivers/net/usb/pegasus.c b/drivers/net/usb/pegasus.c
index 36cd7f016a8d..9bbe0161a2f4 100644
--- a/drivers/net/usb/pegasus.c
+++ b/drivers/net/usb/pegasus.c
@@ -473,7 +473,7 @@ static void read_bulk_callback(struct urb *urb)
                 goto goon;
         }
 
-        if (!count || count < 4)
+        if (count < 4)
                 goto goon;
 
         rx_status = buf[count - 2];
diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c
index d9d2806a47b1..dc989a8b5afb 100644
--- a/drivers/net/usb/smsc95xx.c
+++ b/drivers/net/usb/smsc95xx.c
@@ -61,6 +61,8 @@
 #define SUSPEND_ALLMODES                (SUSPEND_SUSPEND0 | SUSPEND_SUSPEND1 | \
                                          SUSPEND_SUSPEND2 | SUSPEND_SUSPEND3)
 
+#define CARRIER_CHECK_DELAY (2 * HZ)
+
 struct smsc95xx_priv {
         u32 mac_cr;
         u32 hash_hi;
@@ -69,6 +71,9 @@ struct smsc95xx_priv {
         spinlock_t mac_cr_lock;
         u8 features;
         u8 suspend_flags;
+        bool link_ok;
+        struct delayed_work carrier_check;
+        struct usbnet *dev;
 };
 
 static bool turbo_mode = true;
@@ -624,6 +629,44 @@ static void smsc95xx_status(struct usbnet *dev, struct urb *urb)
                             intdata);
 }
 
+static void set_carrier(struct usbnet *dev, bool link)
+{
+        struct smsc95xx_priv *pdata = (struct smsc95xx_priv *)(dev->data[0]);
+
+        if (pdata->link_ok == link)
+                return;
+
+        pdata->link_ok = link;
+
+        if (link)
+                usbnet_link_change(dev, 1, 0);
+        else
+                usbnet_link_change(dev, 0, 0);
+}
+
+static void check_carrier(struct work_struct *work)
+{
+        struct smsc95xx_priv *pdata = container_of(work, struct smsc95xx_priv,
+                                                carrier_check.work);
+        struct usbnet *dev = pdata->dev;
+        int ret;
+
+        if (pdata->suspend_flags != 0)
+                return;
+
+        ret = smsc95xx_mdio_read(dev->net, dev->mii.phy_id, MII_BMSR);
+        if (ret < 0) {
+                netdev_warn(dev->net, "Failed to read MII_BMSR\n");
+                return;
+        }
+        if (ret & BMSR_LSTATUS)
+                set_carrier(dev, 1);
+        else
+                set_carrier(dev, 0);
+
+        schedule_delayed_work(&pdata->carrier_check, CARRIER_CHECK_DELAY);
+}
+
 /* Enable or disable Tx & Rx checksum offload engines */
 static int smsc95xx_set_features(struct net_device *netdev,
         netdev_features_t features)
@@ -1165,13 +1208,20 @@ static int smsc95xx_bind(struct usbnet *dev, struct usb_interface *intf)
         dev->net->flags |= IFF_MULTICAST;
         dev->net->hard_header_len += SMSC95XX_TX_OVERHEAD_CSUM;
         dev->hard_mtu = dev->net->mtu + dev->net->hard_header_len;
+
+        pdata->dev = dev;
+        INIT_DELAYED_WORK(&pdata->carrier_check, check_carrier);
+        schedule_delayed_work(&pdata->carrier_check, CARRIER_CHECK_DELAY);
+
         return 0;
 }
 
 static void smsc95xx_unbind(struct usbnet *dev, struct usb_interface *intf)
 {
         struct smsc95xx_priv *pdata = (struct smsc95xx_priv *)(dev->data[0]);
+
         if (pdata) {
+                cancel_delayed_work(&pdata->carrier_check);
                 netif_dbg(dev, ifdown, dev->net, "free pdata\n");
                 kfree(pdata);
                 pdata = NULL;
@@ -1695,6 +1745,7 @@ static int smsc95xx_resume(struct usb_interface *intf)
 
         /* do this first to ensure it's cleared even in error case */
         pdata->suspend_flags = 0;
+        schedule_delayed_work(&pdata->carrier_check, CARRIER_CHECK_DELAY);
 
         if (suspend_flags & SUSPEND_ALLMODES) {
                 /* clear wake-up sources */
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 49d84e540343..e0638e556fe7 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -1925,24 +1925,11 @@ static int virtnet_probe(struct virtio_device *vdev)
 
         virtio_device_ready(vdev);
 
-        /* Last of all, set up some receive buffers. */
-        for (i = 0; i < vi->curr_queue_pairs; i++) {
-                try_fill_recv(vi, &vi->rq[i], GFP_KERNEL);
-
-                /* If we didn't even get one input buffer, we're useless. */
-                if (vi->rq[i].vq->num_free ==
-                    virtqueue_get_vring_size(vi->rq[i].vq)) {
-                        free_unused_bufs(vi);
-                        err = -ENOMEM;
-                        goto free_recv_bufs;
-                }
-        }
-
         vi->nb.notifier_call = &virtnet_cpu_callback;
         err = register_hotcpu_notifier(&vi->nb);
         if (err) {
                 pr_debug("virtio_net: registering cpu notifier failed\n");
-                goto free_recv_bufs;
+                goto free_unregister_netdev;
         }
 
         /* Assume link up if device can't report link status,
@@ -1960,10 +1947,9 @@ static int virtnet_probe(struct virtio_device *vdev)
 
         return 0;
 
-free_recv_bufs:
+free_unregister_netdev:
         vi->vdev->config->reset(vdev);
 
-        free_receive_bufs(vi);
         unregister_netdev(dev);
 free_vqs:
         cancel_delayed_work_sync(&vi->refill);
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index 8ff30c3bdfce..f999db2f97b4 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -3086,6 +3086,9 @@ static int vxlan_newlink(struct net *src_net, struct net_device *dev,
         if (data[IFLA_VXLAN_REMCSUM_NOPARTIAL])
                 conf.flags |= VXLAN_F_REMCSUM_NOPARTIAL;
 
+        if (tb[IFLA_MTU])
+                conf.mtu = nla_get_u32(tb[IFLA_MTU]);
+
         err = vxlan_dev_configure(src_net, dev, &conf);
         switch (err) {
         case -ENODEV:
diff --git a/drivers/pinctrl/mediatek/pinctrl-mtk-common.c b/drivers/pinctrl/mediatek/pinctrl-mtk-common.c
index 207b13b618cf..a607655d7830 100644
--- a/drivers/pinctrl/mediatek/pinctrl-mtk-common.c
+++ b/drivers/pinctrl/mediatek/pinctrl-mtk-common.c
@@ -1256,9 +1256,10 @@ static void mtk_eint_irq_handler(struct irq_desc *desc)
         const struct mtk_desc_pin *pin;
 
         chained_irq_enter(chip, desc);
-        for (eint_num = 0; eint_num < pctl->devdata->ap_num; eint_num += 32) {
+        for (eint_num = 0;
+             eint_num < pctl->devdata->ap_num;
+             eint_num += 32, reg += 4) {
                 status = readl(reg);
-                reg += 4;
                 while (status) {
                         offset = __ffs(status);
                         index = eint_num + offset;
diff --git a/drivers/pinctrl/nomadik/pinctrl-nomadik.c b/drivers/pinctrl/nomadik/pinctrl-nomadik.c
index ccbfc325c778..38faceff2f08 100644
--- a/drivers/pinctrl/nomadik/pinctrl-nomadik.c
+++ b/drivers/pinctrl/nomadik/pinctrl-nomadik.c
@@ -854,7 +854,7 @@ static int nmk_gpio_get_dir(struct gpio_chip *chip, unsigned offset)
 
         clk_enable(nmk_chip->clk);
 
-        dir = !!(readl(nmk_chip->addr + NMK_GPIO_DIR) & BIT(offset));
+        dir = !(readl(nmk_chip->addr + NMK_GPIO_DIR) & BIT(offset));
 
         clk_disable(nmk_chip->clk);
 
diff --git a/drivers/ptp/ptp_chardev.c b/drivers/ptp/ptp_chardev.c
index 579fd65299a0..d637c933c8a9 100644
--- a/drivers/ptp/ptp_chardev.c
+++ b/drivers/ptp/ptp_chardev.c
@@ -208,14 +208,10 @@ long ptp_ioctl(struct posix_clock *pc, unsigned int cmd, unsigned long arg)
                 break;
 
         case PTP_SYS_OFFSET:
-                sysoff = kmalloc(sizeof(*sysoff), GFP_KERNEL);
-                if (!sysoff) {
-                        err = -ENOMEM;
-                        break;
-                }
-                if (copy_from_user(sysoff, (void __user *)arg,
-                                   sizeof(*sysoff))) {
-                        err = -EFAULT;
+                sysoff = memdup_user((void __user *)arg, sizeof(*sysoff));
+                if (IS_ERR(sysoff)) {
+                        err = PTR_ERR(sysoff);
+                        sysoff = NULL;
                         break;
                 }
                 if (sysoff->n_samples > PTP_MAX_SAMPLES) {
diff --git a/drivers/scsi/aacraid/aacraid.h b/drivers/scsi/aacraid/aacraid.h
index 8f90d9e77104..969c312de1be 100644
--- a/drivers/scsi/aacraid/aacraid.h
+++ b/drivers/scsi/aacraid/aacraid.h
@@ -621,6 +621,11 @@ struct aac_driver_ident
 #define AAC_QUIRK_SCSI_32       0x0020
 
 /*
+ * SRC based adapters support the AifReqEvent functions
+ */
+#define AAC_QUIRK_SRC 0x0040
+
+/*
  *      The adapter interface specs all queues to be located in the same
  *      physically contiguous block. The host structure that defines the
  *      commuication queues will assume they are each a separate physically
diff --git a/drivers/scsi/aacraid/linit.c b/drivers/scsi/aacraid/linit.c
index a943bd230bc2..79871f3519ff 100644
--- a/drivers/scsi/aacraid/linit.c
+++ b/drivers/scsi/aacraid/linit.c
@@ -236,10 +236,10 @@ static struct aac_driver_ident aac_drivers[] = {
         { aac_rx_init, "aacraid",  "ADAPTEC ", "RAID            ", 2 }, /* Adaptec Catch All */
         { aac_rkt_init, "aacraid", "ADAPTEC ", "RAID            ", 2 }, /* Adaptec Rocket Catch All */
         { aac_nark_init, "aacraid", "ADAPTEC ", "RAID           ", 2 }, /* Adaptec NEMER/ARK Catch All */
-        { aac_src_init, "aacraid", "ADAPTEC ", "RAID            ", 2 }, /* Adaptec PMC Series 6 (Tupelo) */
-        { aac_srcv_init, "aacraid", "ADAPTEC ", "RAID            ", 2 }, /* Adaptec PMC Series 7 (Denali) */
-        { aac_srcv_init, "aacraid", "ADAPTEC ", "RAID            ", 2 }, /* Adaptec PMC Series 8 */
-        { aac_srcv_init, "aacraid", "ADAPTEC ", "RAID            ", 2 } /* Adaptec PMC Series 9 */
+        { aac_src_init, "aacraid", "ADAPTEC ", "RAID            ", 2, AAC_QUIRK_SRC }, /* Adaptec PMC Series 6 (Tupelo) */
+        { aac_srcv_init, "aacraid", "ADAPTEC ", "RAID            ", 2, AAC_QUIRK_SRC }, /* Adaptec PMC Series 7 (Denali) */
+        { aac_srcv_init, "aacraid", "ADAPTEC ", "RAID            ", 2, AAC_QUIRK_SRC }, /* Adaptec PMC Series 8 */
+        { aac_srcv_init, "aacraid", "ADAPTEC ", "RAID            ", 2, AAC_QUIRK_SRC } /* Adaptec PMC Series 9 */
 };
 
 /**
@@ -1299,7 +1299,8 @@ static int aac_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
         else
                 shost->this_id = shost->max_id;
 
-        aac_intr_normal(aac, 0, 2, 0, NULL);
+        if (aac_drivers[index].quirks & AAC_QUIRK_SRC)
+                aac_intr_normal(aac, 0, 2, 0, NULL);
 
         /*
          * dmb - we may need to move the setting of these parms somewhere else once
diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
index 6a4df5a315e9..6bff13e7afc7 100644
--- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c
+++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
@@ -7975,13 +7975,14 @@ mpt3sas_scsih_event_callback(struct MPT3SAS_ADAPTER *ioc, u8 msix_index,
                 ActiveCableEventData =
                     (Mpi26EventDataActiveCableExcept_t *) mpi_reply->EventData;
                 if (ActiveCableEventData->ReasonCode ==
-                                MPI26_EVENT_ACTIVE_CABLE_INSUFFICIENT_POWER)
+                                MPI26_EVENT_ACTIVE_CABLE_INSUFFICIENT_POWER) {
                         pr_info(MPT3SAS_FMT "Currently an active cable with ReceptacleID %d",
                             ioc->name, ActiveCableEventData->ReceptacleID);
                         pr_info("cannot be powered and devices connected to this active cable");
                         pr_info("will not be seen. This active cable");
                         pr_info("requires %d mW of power",
                             ActiveCableEventData->ActiveCablePowerRequirement);
+                }
                 break;
 
         default: /* ignore the rest */
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index b2e332af0f51..c71344aebdbb 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -821,9 +821,12 @@ void scsi_io_completion(struct scsi_cmnd *cmd, unsigned int good_bytes)
         }
 
         /*
-         * If we finished all bytes in the request we are done now.
+         * special case: failed zero length commands always need to
+         * drop down into the retry code. Otherwise, if we finished
+         * all bytes in the request we are done now.
          */
-        if (!scsi_end_request(req, error, good_bytes, 0))
+        if (!(blk_rq_bytes(req) == 0 && error) &&
+            !scsi_end_request(req, error, good_bytes, 0))
                 return;
 
         /*
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index 428c03ef02b2..f459dff30512 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -1398,11 +1398,15 @@ static int media_not_present(struct scsi_disk *sdkp,
  **/
 static unsigned int sd_check_events(struct gendisk *disk, unsigned int clearing)
 {
-        struct scsi_disk *sdkp = scsi_disk(disk);
-        struct scsi_device *sdp = sdkp->device;
+        struct scsi_disk *sdkp = scsi_disk_get(disk);
+        struct scsi_device *sdp;
         struct scsi_sense_hdr *sshdr = NULL;
         int retval;
 
+        if (!sdkp)
+                return 0;
+
+        sdp = sdkp->device;
         SCSI_LOG_HLQUEUE(3, sd_printk(KERN_INFO, sdkp, "sd_check_events\n"));
 
         /*
@@ -1459,6 +1463,7 @@ out:
         kfree(sshdr);
         retval = sdp->changed ? DISK_EVENT_MEDIA_CHANGE : 0;
         sdp->changed = 0;
+        scsi_disk_put(sdkp);
         return retval;
 }
 
diff --git a/include/linux/dma-buf.h b/include/linux/dma-buf.h
index 3fe90d494edb..4551c6f2a6c4 100644
--- a/include/linux/dma-buf.h
+++ b/include/linux/dma-buf.h
@@ -112,19 +112,24 @@ struct dma_buf_ops {
  * @file: file pointer used for sharing buffers across, and for refcounting.
  * @attachments: list of dma_buf_attachment that denotes all devices attached.
  * @ops: dma_buf_ops associated with this buffer object.
+ * @lock: used internally to serialize list manipulation, attach/detach and vmap/unmap
+ * @vmapping_counter: used internally to refcnt the vmaps
+ * @vmap_ptr: the current vmap ptr if vmapping_counter > 0
  * @exp_name: name of the exporter; useful for debugging.
  * @owner: pointer to exporter module; used for refcounting when exporter is a
  *         kernel module.
  * @list_node: node for dma_buf accounting and debugging.
  * @priv: exporter specific private data for this buffer object.
  * @resv: reservation object linked to this dma-buf
+ * @poll: for userspace poll support
+ * @cb_excl: for userspace poll support
+ * @cb_shared: for userspace poll support
  */
 struct dma_buf {
         size_t size;
         struct file *file;
         struct list_head attachments;
         const struct dma_buf_ops *ops;
-        /* mutex to serialize list manipulation, attach/detach and vmap/unmap */
         struct mutex lock;
         unsigned vmapping_counter;
         void *vmap_ptr;
@@ -188,9 +193,11 @@ struct dma_buf_export_info {
 
 /**
  * helper macro for exporters; zeros and fills in most common values
+ *
+ * @name: export-info name
  */
-#define DEFINE_DMA_BUF_EXPORT_INFO(a)   \
-        struct dma_buf_export_info a = { .exp_name = KBUILD_MODNAME, \
+#define DEFINE_DMA_BUF_EXPORT_INFO(name)        \
+        struct dma_buf_export_info name = { .exp_name = KBUILD_MODNAME, \
                                          .owner = THIS_MODULE }
 
 /**
diff --git a/include/linux/fence.h b/include/linux/fence.h
index 2b17698b60b8..2056e9fd0138 100644
--- a/include/linux/fence.h
+++ b/include/linux/fence.h
@@ -49,6 +49,8 @@ struct fence_cb;
  * @timestamp: Timestamp when the fence was signaled.
  * @status: Optional, only valid if < 0, must be set before calling
  * fence_signal, indicates that the fence has completed with an error.
+ * @child_list: list of children fences
+ * @active_list: list of active fences
  *
  * the flags member must be manipulated and read using the appropriate
  * atomic ops (bit_*), so taking the spinlock will not be needed most
diff --git a/include/linux/reservation.h b/include/linux/reservation.h
index 49d057655d62..b0f305e77b7f 100644
--- a/include/linux/reservation.h
+++ b/include/linux/reservation.h
@@ -49,12 +49,27 @@ extern struct ww_class reservation_ww_class;
 extern struct lock_class_key reservation_seqcount_class;
 extern const char reservation_seqcount_string[];
 
+/**
+ * struct reservation_object_list - a list of shared fences
+ * @rcu: for internal use
+ * @shared_count: table of shared fences
+ * @shared_max: for growing shared fence table
+ * @shared: shared fence table
+ */
 struct reservation_object_list {
         struct rcu_head rcu;
         u32 shared_count, shared_max;
         struct fence __rcu *shared[];
 };
 
+/**
+ * struct reservation_object - a reservation object manages fences for a buffer
+ * @lock: update side lock
+ * @seq: sequence count for managing RCU read-side synchronization
+ * @fence_excl: the exclusive fence, if there is one currently
+ * @fence: list of current shared fences
+ * @staged: staged copy of shared fences for RCU updates
+ */
 struct reservation_object {
         struct ww_mutex lock;
         seqcount_t seq;
@@ -68,6 +83,10 @@ struct reservation_object {
 #define reservation_object_assert_held(obj) \
         lockdep_assert_held(&(obj)->lock.base)
 
+/**
+ * reservation_object_init - initialize a reservation object
+ * @obj: the reservation object
+ */
 static inline void
 reservation_object_init(struct reservation_object *obj)
 {
@@ -79,6 +98,10 @@ reservation_object_init(struct reservation_object *obj)
         obj->staged = NULL;
 }
 
+/**
+ * reservation_object_fini - destroys a reservation object
+ * @obj: the reservation object
+ */
 static inline void
 reservation_object_fini(struct reservation_object *obj)
 {
@@ -106,6 +129,14 @@ reservation_object_fini(struct reservation_object *obj)
         ww_mutex_destroy(&obj->lock);
 }
 
+/**
+ * reservation_object_get_list - get the reservation object's
+ * shared fence list, with update-side lock held
+ * @obj: the reservation object
+ *
+ * Returns the shared fence list.  Does NOT take references to
+ * the fence.  The obj->lock must be held.
+ */
 static inline struct reservation_object_list *
 reservation_object_get_list(struct reservation_object *obj)
 {
@@ -113,6 +144,17 @@ reservation_object_get_list(struct reservation_object *obj)
                                          reservation_object_held(obj));
 }
 
+/**
+ * reservation_object_get_excl - get the reservation object's
+ * exclusive fence, with update-side lock held
+ * @obj: the reservation object
+ *
+ * Returns the exclusive fence (if any).  Does NOT take a
+ * reference.  The obj->lock must be held.
+ *
+ * RETURNS
+ * The exclusive fence or NULL
+ */
 static inline struct fence *
 reservation_object_get_excl(struct reservation_object *obj)
 {
@@ -120,6 +162,17 @@ reservation_object_get_excl(struct reservation_object *obj)
                                          reservation_object_held(obj));
 }
 
+/**
+ * reservation_object_get_excl_rcu - get the reservation object's
+ * exclusive fence, without lock held.
+ * @obj: the reservation object
+ *
+ * If there is an exclusive fence, this atomically increments it's
+ * reference count and returns it.
+ *
+ * RETURNS
+ * The exclusive fence or NULL if none
+ */
 static inline struct fence *
 reservation_object_get_excl_rcu(struct reservation_object *obj)
 {
diff --git a/include/linux/sctp.h b/include/linux/sctp.h
index dacb5e711994..de1f64318fc4 100644
--- a/include/linux/sctp.h
+++ b/include/linux/sctp.h
@@ -765,6 +765,8 @@ struct sctp_info {
         __u8    sctpi_s_disable_fragments;
         __u8    sctpi_s_v4mapped;
         __u8    sctpi_s_frag_interleave;
+        __u32   sctpi_s_type;
+        __u32   __reserved3;
 };
 
 struct sctp_infox {
diff --git a/include/net/ip6_tunnel.h b/include/net/ip6_tunnel.h
index d325c81332e3..43a5a0e4524c 100644
--- a/include/net/ip6_tunnel.h
+++ b/include/net/ip6_tunnel.h
@@ -63,6 +63,8 @@ struct ip6_tnl_encap_ops {
                             u8 *protocol, struct flowi6 *fl6);
 };
 
+#ifdef CONFIG_INET
+
 extern const struct ip6_tnl_encap_ops __rcu *
                 ip6tun_encaps[MAX_IPTUN_ENCAP_OPS];
 
@@ -138,7 +140,6 @@ struct net *ip6_tnl_get_link_net(const struct net_device *dev);
 int ip6_tnl_get_iflink(const struct net_device *dev);
 int ip6_tnl_change_mtu(struct net_device *dev, int new_mtu);
 
-#ifdef CONFIG_INET
 static inline void ip6tunnel_xmit(struct sock *sk, struct sk_buff *skb,
                                   struct net_device *dev)
 {
diff --git a/include/net/pkt_sched.h b/include/net/pkt_sched.h
index 401038d2f9b8..fea53f4d92ca 100644
--- a/include/net/pkt_sched.h
+++ b/include/net/pkt_sched.h
@@ -61,6 +61,7 @@ psched_tdiff_bounded(psched_time_t tv1, psched_time_t tv2, psched_time_t bound)
 }
 
 struct qdisc_watchdog {
+        u64             last_expires;
         struct hrtimer  timer;
         struct Qdisc    *qdisc;
 };
diff --git a/include/uapi/linux/ethtool.h b/include/uapi/linux/ethtool.h
index 9222db8ccccc..5f030b46cff4 100644
--- a/include/uapi/linux/ethtool.h
+++ b/include/uapi/linux/ethtool.h
@@ -1353,6 +1353,15 @@ enum ethtool_link_mode_bit_indices {
         ETHTOOL_LINK_MODE_56000baseCR4_Full_BIT = 28,
         ETHTOOL_LINK_MODE_56000baseSR4_Full_BIT = 29,
         ETHTOOL_LINK_MODE_56000baseLR4_Full_BIT = 30,
+        ETHTOOL_LINK_MODE_25000baseCR_Full_BIT  = 31,
+        ETHTOOL_LINK_MODE_25000baseKR_Full_BIT  = 32,
+        ETHTOOL_LINK_MODE_25000baseSR_Full_BIT  = 33,
+        ETHTOOL_LINK_MODE_50000baseCR2_Full_BIT = 34,
+        ETHTOOL_LINK_MODE_50000baseKR2_Full_BIT = 35,
+        ETHTOOL_LINK_MODE_100000baseKR4_Full_BIT        = 36,
+        ETHTOOL_LINK_MODE_100000baseSR4_Full_BIT        = 37,
+        ETHTOOL_LINK_MODE_100000baseCR4_Full_BIT        = 38,
+        ETHTOOL_LINK_MODE_100000baseLR4_ER4_Full_BIT    = 39,
 
         /* Last allowed bit for __ETHTOOL_LINK_MODE_LEGACY_MASK is bit
          * 31. Please do NOT define any SUPPORTED_* or ADVERTISED_*
@@ -1361,7 +1370,7 @@ enum ethtool_link_mode_bit_indices {
          */
 
         __ETHTOOL_LINK_MODE_LAST
-          = ETHTOOL_LINK_MODE_56000baseLR4_Full_BIT,
+          = ETHTOOL_LINK_MODE_100000baseLR4_ER4_Full_BIT,
 };
 
 #define __ETHTOOL_LINK_MODE_LEGACY_MASK(base_name)      \
diff --git a/include/uapi/linux/pkt_cls.h b/include/uapi/linux/pkt_cls.h
index eba5914ba5d1..f4297c8a42fe 100644
--- a/include/uapi/linux/pkt_cls.h
+++ b/include/uapi/linux/pkt_cls.h
@@ -145,6 +145,8 @@ enum {
         TCA_POLICE_PEAKRATE,
         TCA_POLICE_AVRATE,
         TCA_POLICE_RESULT,
+        TCA_POLICE_TM,
+        TCA_POLICE_PAD,
         __TCA_POLICE_MAX
 #define TCA_POLICE_RESULT TCA_POLICE_RESULT
 };
@@ -173,7 +175,7 @@ enum {
         TCA_U32_DIVISOR,
         TCA_U32_SEL,
         TCA_U32_POLICE,
-        TCA_U32_ACT,   
+        TCA_U32_ACT,
         TCA_U32_INDEV,
         TCA_U32_PCNT,
         TCA_U32_MARK,
diff --git a/kernel/bpf/inode.c b/kernel/bpf/inode.c
index 04be7021f848..318858edb1cd 100644
--- a/kernel/bpf/inode.c
+++ b/kernel/bpf/inode.c
@@ -365,7 +365,6 @@ static struct file_system_type bpf_fs_type = {
         .name           = "bpf",
         .mount          = bpf_mount,
         .kill_sb        = kill_litter_super,
-        .fs_flags       = FS_USERNS_MOUNT,
 };
 
 MODULE_ALIAS_FS("bpf");
diff --git a/kernel/time/hrtimer.c b/kernel/time/hrtimer.c
index 8c7392c4fdbd..e99df0ff1d42 100644
--- a/kernel/time/hrtimer.c
+++ b/kernel/time/hrtimer.c
@@ -425,6 +425,7 @@ void destroy_hrtimer_on_stack(struct hrtimer *timer)
 {
         debug_object_free(timer, &hrtimer_debug_descr);
 }
+EXPORT_SYMBOL_GPL(destroy_hrtimer_on_stack);
 
 #else
 static inline void debug_hrtimer_init(struct hrtimer *timer) { }
diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
index 77d7d034bac3..b9cfdbfae9aa 100644
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -1841,6 +1841,9 @@ config TEST_BITMAP
 
           If unsure, say N.
 
+config TEST_UUID
+        tristate "Test functions located in the uuid module at runtime"
+
 config TEST_RHASHTABLE
         tristate "Perform selftest on resizable hash table"
         default n
diff --git a/lib/Makefile b/lib/Makefile
index 499fb354d627..ff6a7a6c6395 100644
--- a/lib/Makefile
+++ b/lib/Makefile
@@ -58,6 +58,7 @@ obj-$(CONFIG_TEST_STATIC_KEYS) += test_static_keys.o
 obj-$(CONFIG_TEST_STATIC_KEYS) += test_static_key_base.o
 obj-$(CONFIG_TEST_PRINTF) += test_printf.o
 obj-$(CONFIG_TEST_BITMAP) += test_bitmap.o
+obj-$(CONFIG_TEST_UUID) += test_uuid.o
 
 ifeq ($(CONFIG_DEBUG_KOBJECT),y)
 CFLAGS_kobject.o += -DDEBUG
diff --git a/lib/test_uuid.c b/lib/test_uuid.c
new file mode 100644
index 000000000000..547d3127a3cf
--- /dev/null
+++ b/lib/test_uuid.c
@@ -0,0 +1,133 @@
+/*
+ * Test cases for lib/uuid.c module.
+ */
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/string.h>
+#include <linux/uuid.h>
+
+struct test_uuid_data {
+        const char *uuid;
+        uuid_le le;
+        uuid_be be;
+};
+
+static const struct test_uuid_data test_uuid_test_data[] = {
+        {
+                .uuid = "c33f4995-3701-450e-9fbf-206a2e98e576",
+                .le = UUID_LE(0xc33f4995, 0x3701, 0x450e, 0x9f, 0xbf, 0x20, 0x6a, 0x2e, 0x98, 0xe5, 0x76),
+                .be = UUID_BE(0xc33f4995, 0x3701, 0x450e, 0x9f, 0xbf, 0x20, 0x6a, 0x2e, 0x98, 0xe5, 0x76),
+        },
+        {
+                .uuid = "64b4371c-77c1-48f9-8221-29f054fc023b",
+                .le = UUID_LE(0x64b4371c, 0x77c1, 0x48f9, 0x82, 0x21, 0x29, 0xf0, 0x54, 0xfc, 0x02, 0x3b),
+                .be = UUID_BE(0x64b4371c, 0x77c1, 0x48f9, 0x82, 0x21, 0x29, 0xf0, 0x54, 0xfc, 0x02, 0x3b),
+        },
+        {
+                .uuid = "0cb4ddff-a545-4401-9d06-688af53e7f84",
+                .le = UUID_LE(0x0cb4ddff, 0xa545, 0x4401, 0x9d, 0x06, 0x68, 0x8a, 0xf5, 0x3e, 0x7f, 0x84),
+                .be = UUID_BE(0x0cb4ddff, 0xa545, 0x4401, 0x9d, 0x06, 0x68, 0x8a, 0xf5, 0x3e, 0x7f, 0x84),
+        },
+};
+
+static const char * const test_uuid_wrong_data[] = {
+        "c33f4995-3701-450e-9fbf206a2e98e576 ", /* no hyphen(s) */
+        "64b4371c-77c1-48f9-8221-29f054XX023b", /* invalid character(s) */
+        "0cb4ddff-a545-4401-9d06-688af53e",     /* not enough data */
+};
+
+static unsigned total_tests __initdata;
+static unsigned failed_tests __initdata;
+
+static void __init test_uuid_failed(const char *prefix, bool wrong, bool be,
+                                    const char *data, const char *actual)
+{
+        pr_err("%s test #%u %s %s data: '%s'\n",
+               prefix,
+               total_tests,
+               wrong ? "passed on wrong" : "failed on",
+               be ? "BE" : "LE",
+               data);
+        if (actual && *actual)
+                pr_err("%s test #%u actual data: '%s'\n",
+                       prefix,
+                       total_tests,
+                       actual);
+        failed_tests++;
+}
+
+static void __init test_uuid_test(const struct test_uuid_data *data)
+{
+        uuid_le le;
+        uuid_be be;
+        char buf[48];
+
+        /* LE */
+        total_tests++;
+        if (uuid_le_to_bin(data->uuid, &le))
+                test_uuid_failed("conversion", false, false, data->uuid, NULL);
+
+        total_tests++;
+        if (uuid_le_cmp(data->le, le)) {
+                sprintf(buf, "%pUl", &le);
+                test_uuid_failed("cmp", false, false, data->uuid, buf);
+        }
+
+        /* BE */
+        total_tests++;
+        if (uuid_be_to_bin(data->uuid, &be))
+                test_uuid_failed("conversion", false, true, data->uuid, NULL);
+
+        total_tests++;
+        if (uuid_be_cmp(data->be, be)) {
+                sprintf(buf, "%pUb", &be);
+                test_uuid_failed("cmp", false, true, data->uuid, buf);
+        }
+}
+
+static void __init test_uuid_wrong(const char *data)
+{
+        uuid_le le;
+        uuid_be be;
+
+        /* LE */
+        total_tests++;
+        if (!uuid_le_to_bin(data, &le))
+                test_uuid_failed("negative", true, false, data, NULL);
+
+        /* BE */
+        total_tests++;
+        if (!uuid_be_to_bin(data, &be))
+                test_uuid_failed("negative", true, true, data, NULL);
+}
+
+static int __init test_uuid_init(void)
+{
+        unsigned int i;
+
+        for (i = 0; i < ARRAY_SIZE(test_uuid_test_data); i++)
+                test_uuid_test(&test_uuid_test_data[i]);
+
+        for (i = 0; i < ARRAY_SIZE(test_uuid_wrong_data); i++)
+                test_uuid_wrong(test_uuid_wrong_data[i]);
+
+        if (failed_tests == 0)
+                pr_info("all %u tests passed\n", total_tests);
+        else
+                pr_err("failed %u out of %u tests\n", failed_tests, total_tests);
+
+        return failed_tests ? -EINVAL : 0;
+}
+module_init(test_uuid_init);
+
+static void __exit test_uuid_exit(void)
+{
+        /* do nothing */
+}
+module_exit(test_uuid_exit);
+
+MODULE_AUTHOR("Andy Shevchenko <andriy.shevchenko@linux.intel.com>");
+MODULE_LICENSE("Dual BSD/GPL");
diff --git a/lib/uuid.c b/lib/uuid.c
index e116ae5fa00f..37687af77ff8 100644
--- a/lib/uuid.c
+++ b/lib/uuid.c
@@ -106,8 +106,8 @@ static int __uuid_to_bin(const char *uuid, __u8 b[16], const u8 ei[16])
                 return -EINVAL;
 
         for (i = 0; i < 16; i++) {
-                int hi = hex_to_bin(uuid[si[i]] + 0);
-                int lo = hex_to_bin(uuid[si[i]] + 1);
+                int hi = hex_to_bin(uuid[si[i] + 0]);
+                int lo = hex_to_bin(uuid[si[i] + 1]);
 
                 b[ei[i]] = (hi << 4) | lo;
         }
diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
index a1e273af6fc8..82a116ba590e 100644
--- a/net/8021q/vlan.c
+++ b/net/8021q/vlan.c
@@ -290,6 +290,10 @@ static void vlan_sync_address(struct net_device *dev,
         if (ether_addr_equal(vlan->real_dev_addr, dev->dev_addr))
                 return;
 
+        /* vlan continues to inherit address of lower device */
+        if (vlan_dev_inherit_address(vlandev, dev))
+                goto out;
+
         /* vlan address was different from the old address and is equal to
          * the new address */
         if (!ether_addr_equal(vlandev->dev_addr, vlan->real_dev_addr) &&
@@ -302,6 +306,7 @@ static void vlan_sync_address(struct net_device *dev,
             !ether_addr_equal(vlandev->dev_addr, dev->dev_addr))
                 dev_uc_add(dev, vlandev->dev_addr);
 
+out:
         ether_addr_copy(vlan->real_dev_addr, dev->dev_addr);
 }
 
diff --git a/net/8021q/vlan.h b/net/8021q/vlan.h
index 9d010a09ab98..cc1557978066 100644
--- a/net/8021q/vlan.h
+++ b/net/8021q/vlan.h
@@ -109,6 +109,8 @@ int vlan_check_real_dev(struct net_device *real_dev,
 void vlan_setup(struct net_device *dev);
 int register_vlan_dev(struct net_device *dev);
 void unregister_vlan_dev(struct net_device *dev, struct list_head *head);
+bool vlan_dev_inherit_address(struct net_device *dev,
+                              struct net_device *real_dev);
 
 static inline u32 vlan_get_ingress_priority(struct net_device *dev,
                                             u16 vlan_tci)
diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
index e7e62570bdb8..86ae75b77390 100644
--- a/net/8021q/vlan_dev.c
+++ b/net/8021q/vlan_dev.c
@@ -245,6 +245,17 @@ void vlan_dev_get_realdev_name(const struct net_device *dev, char *result)
         strncpy(result, vlan_dev_priv(dev)->real_dev->name, 23);
 }
 
+bool vlan_dev_inherit_address(struct net_device *dev,
+                              struct net_device *real_dev)
+{
+        if (dev->addr_assign_type != NET_ADDR_STOLEN)
+                return false;
+
+        ether_addr_copy(dev->dev_addr, real_dev->dev_addr);
+        call_netdevice_notifiers(NETDEV_CHANGEADDR, dev);
+        return true;
+}
+
 static int vlan_dev_open(struct net_device *dev)
 {
         struct vlan_dev_priv *vlan = vlan_dev_priv(dev);
@@ -255,7 +266,8 @@ static int vlan_dev_open(struct net_device *dev)
             !(vlan->flags & VLAN_FLAG_LOOSE_BINDING))
                 return -ENETDOWN;
 
-        if (!ether_addr_equal(dev->dev_addr, real_dev->dev_addr)) {
+        if (!ether_addr_equal(dev->dev_addr, real_dev->dev_addr) &&
+            !vlan_dev_inherit_address(dev, real_dev)) {
                 err = dev_uc_add(real_dev, dev->dev_addr);
                 if (err < 0)
                         goto out;
@@ -560,8 +572,10 @@ static int vlan_dev_init(struct net_device *dev)
         /* ipv6 shared card related stuff */
         dev->dev_id = real_dev->dev_id;
 
-        if (is_zero_ether_addr(dev->dev_addr))
-                eth_hw_addr_inherit(dev, real_dev);
+        if (is_zero_ether_addr(dev->dev_addr)) {
+                ether_addr_copy(dev->dev_addr, real_dev->dev_addr);
+                dev->addr_assign_type = NET_ADDR_STOLEN;
+        }
         if (is_zero_ether_addr(dev->broadcast))
                 memcpy(dev->broadcast, real_dev->broadcast, dev->addr_len);
 
diff --git a/net/atm/signaling.c b/net/atm/signaling.c
index 4fd6af47383a..adb6e3d21b1e 100644
--- a/net/atm/signaling.c
+++ b/net/atm/signaling.c
@@ -124,7 +124,7 @@ as_indicate_complete:
                 break;
         case as_addparty:
         case as_dropparty:
-                sk->sk_err_soft = msg->reply;
+                sk->sk_err_soft = -msg->reply;
                                         /* < 0 failure, otherwise ep_ref */
                 clear_bit(ATM_VF_WAITING, &vcc->flags);
                 break;
diff --git a/net/atm/svc.c b/net/atm/svc.c
index 3fa0a9ee98d1..878563a8354d 100644
--- a/net/atm/svc.c
+++ b/net/atm/svc.c
@@ -546,7 +546,7 @@ static int svc_addparty(struct socket *sock, struct sockaddr *sockaddr,
                 schedule();
         }
         finish_wait(sk_sleep(sk), &wait);
-        error = xchg(&sk->sk_err_soft, 0);
+        error = -xchg(&sk->sk_err_soft, 0);
 out:
         release_sock(sk);
         return error;
@@ -573,7 +573,7 @@ static int svc_dropparty(struct socket *sock, int ep_ref)
                 error = -EUNATCH;
                 goto out;
         }
-        error = xchg(&sk->sk_err_soft, 0);
+        error = -xchg(&sk->sk_err_soft, 0);
 out:
         release_sock(sk);
         return error;
diff --git a/net/core/hwbm.c b/net/core/hwbm.c
index 941c28486896..2cab489ae62e 100644
--- a/net/core/hwbm.c
+++ b/net/core/hwbm.c
@@ -55,18 +55,21 @@ int hwbm_pool_add(struct hwbm_pool *bm_pool, unsigned int buf_num, gfp_t gfp)
         spin_lock_irqsave(&bm_pool->lock, flags);
         if (bm_pool->buf_num == bm_pool->size) {
                 pr_warn("pool already filled\n");
+                spin_unlock_irqrestore(&bm_pool->lock, flags);
                 return bm_pool->buf_num;
         }
 
         if (buf_num + bm_pool->buf_num > bm_pool->size) {
                 pr_warn("cannot allocate %d buffers for pool\n",
                         buf_num);
+                spin_unlock_irqrestore(&bm_pool->lock, flags);
                 return 0;
         }
 
         if ((buf_num + bm_pool->buf_num) < bm_pool->buf_num) {
                 pr_warn("Adding %d buffers to the %d current buffers will overflow\n",
                         buf_num,  bm_pool->buf_num);
+                spin_unlock_irqrestore(&bm_pool->lock, flags);
                 return 0;
         }
 
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index 8604ae245960..8b02df0d354d 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -2245,10 +2245,8 @@ static void spin(struct pktgen_dev *pkt_dev, ktime_t spin_until)
         hrtimer_set_expires(&t.timer, spin_until);
 
         remaining = ktime_to_ns(hrtimer_expires_remaining(&t.timer));
-        if (remaining <= 0) {
-                pkt_dev->next_tx = ktime_add_ns(spin_until, pkt_dev->delay);
-                return;
-        }
+        if (remaining <= 0)
+                goto out;
 
         start_time = ktime_get();
         if (remaining < 100000) {
@@ -2273,7 +2271,9 @@ static void spin(struct pktgen_dev *pkt_dev, ktime_t spin_until)
         }
 
         pkt_dev->idle_acc += ktime_to_ns(ktime_sub(end_time, start_time));
+out:
         pkt_dev->next_tx = ktime_add_ns(spin_until, pkt_dev->delay);
+        destroy_hrtimer_on_stack(&t.timer);
 }
 
 static inline void set_pkt_overhead(struct pktgen_dev *pkt_dev)
diff --git a/net/ieee802154/nl802154.c b/net/ieee802154/nl802154.c
index ca207dbf673b..116187b5c267 100644
--- a/net/ieee802154/nl802154.c
+++ b/net/ieee802154/nl802154.c
@@ -1289,8 +1289,8 @@ ieee802154_llsec_parse_dev_addr(struct nlattr *nla,
                                      nl802154_dev_addr_policy))
                 return -EINVAL;
 
-        if (!attrs[NL802154_DEV_ADDR_ATTR_PAN_ID] &&
-            !attrs[NL802154_DEV_ADDR_ATTR_MODE] &&
+        if (!attrs[NL802154_DEV_ADDR_ATTR_PAN_ID] ||
+            !attrs[NL802154_DEV_ADDR_ATTR_MODE] ||
             !(attrs[NL802154_DEV_ADDR_ATTR_SHORT] ||
               attrs[NL802154_DEV_ADDR_ATTR_EXTENDED]))
                 return -EINVAL;
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index 377424ea17a4..d39e9e47a26e 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -1681,6 +1681,14 @@ static __net_init int inet_init_net(struct net *net)
          */
         net->ipv4.ping_group_range.range[0] = make_kgid(&init_user_ns, 1);
         net->ipv4.ping_group_range.range[1] = make_kgid(&init_user_ns, 0);
+
+        /* Default values for sysctl-controlled parameters.
+         * We set them here, in case sysctl is not compiled.
+         */
+        net->ipv4.sysctl_ip_default_ttl = IPDEFTTL;
+        net->ipv4.sysctl_ip_dynaddr = 0;
+        net->ipv4.sysctl_ip_early_demux = 1;
+
         return 0;
 }
 
diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
index bb0419582b8d..1cb67de106fe 100644
--- a/net/ipv4/sysctl_net_ipv4.c
+++ b/net/ipv4/sysctl_net_ipv4.c
@@ -999,10 +999,6 @@ static __net_init int ipv4_sysctl_init_net(struct net *net)
         if (!net->ipv4.sysctl_local_reserved_ports)
                 goto err_ports;
 
-        net->ipv4.sysctl_ip_default_ttl = IPDEFTTL;
-        net->ipv4.sysctl_ip_dynaddr = 0;
-        net->ipv4.sysctl_ip_early_demux = 1;
-
         return 0;
 
 err_ports:
diff --git a/net/ipv6/Kconfig b/net/ipv6/Kconfig
index 3f8411328de5..2343e4f2e0bf 100644
--- a/net/ipv6/Kconfig
+++ b/net/ipv6/Kconfig
@@ -232,6 +232,15 @@ config IPV6_GRE
 
           Saying M here will produce a module called ip6_gre. If unsure, say N.
 
+config IPV6_FOU
+        tristate
+        default NET_FOU && IPV6
+
+config IPV6_FOU_TUNNEL
+        tristate
+        default NET_FOU_IP_TUNNELS && IPV6_FOU
+        select IPV6_TUNNEL
+
 config IPV6_MULTIPLE_TABLES
         bool "IPv6: Multiple Routing Tables"
         select FIB_RULES
diff --git a/net/ipv6/Makefile b/net/ipv6/Makefile
index 7ec3129c9ace..6d8ea099213e 100644
--- a/net/ipv6/Makefile
+++ b/net/ipv6/Makefile
@@ -42,7 +42,7 @@ obj-$(CONFIG_IPV6_VTI) += ip6_vti.o
 obj-$(CONFIG_IPV6_SIT) += sit.o
 obj-$(CONFIG_IPV6_TUNNEL) += ip6_tunnel.o
 obj-$(CONFIG_IPV6_GRE) += ip6_gre.o
-obj-$(CONFIG_NET_FOU) += fou6.o
+obj-$(CONFIG_IPV6_FOU) += fou6.o
 
 obj-y += addrconf_core.o exthdrs_core.o ip6_checksum.o ip6_icmp.o
 obj-$(CONFIG_INET) += output_core.o protocol.o $(ipv6-offload)
diff --git a/net/ipv6/fou6.c b/net/ipv6/fou6.c
index c972d0b52579..9ea249b9451e 100644
--- a/net/ipv6/fou6.c
+++ b/net/ipv6/fou6.c
@@ -69,7 +69,7 @@ int gue6_build_header(struct sk_buff *skb, struct ip_tunnel_encap *e,
 }
 EXPORT_SYMBOL(gue6_build_header);
 
-#ifdef CONFIG_NET_FOU_IP_TUNNELS
+#if IS_ENABLED(CONFIG_IPV6_FOU_TUNNEL)
 
 static const struct ip6_tnl_encap_ops fou_ip6tun_ops = {
         .encap_hlen = fou_encap_hlen,
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index af503f518278..f4ac2842d4d9 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -712,6 +712,7 @@ static void ip6gre_tnl_link_config(struct ip6_tnl *t, int set_mtu)
         fl6->daddr = p->raddr;
         fl6->flowi6_oif = p->link;
         fl6->flowlabel = 0;
+        fl6->flowi6_proto = IPPROTO_GRE;
 
         if (!(p->flags&IP6_TNL_F_USE_ORIG_TCLASS))
                 fl6->flowlabel |= IPV6_TCLASS_MASK & p->flowinfo;
@@ -1027,6 +1028,8 @@ static int ip6gre_tunnel_init_common(struct net_device *dev)
 
         dev->hard_header_len = LL_MAX_HEADER + t_hlen;
         dev->mtu = ETH_DATA_LEN - t_hlen;
+        if (dev->type == ARPHRD_ETHER)
+                dev->mtu -= ETH_HLEN;
         if (!(tunnel->parms.flags & IP6_TNL_F_IGN_ENCAP_LIMIT))
                 dev->mtu -= 8;
 
diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c
index c6f5df1bed12..6c54e03fe9c1 100644
--- a/net/l2tp/l2tp_ip6.c
+++ b/net/l2tp/l2tp_ip6.c
@@ -128,6 +128,7 @@ static inline struct sock *l2tp_ip6_bind_lookup(struct net *net,
  */
 static int l2tp_ip6_recv(struct sk_buff *skb)
 {
+        struct net *net = dev_net(skb->dev);
         struct sock *sk;
         u32 session_id;
         u32 tunnel_id;
@@ -154,7 +155,7 @@ static int l2tp_ip6_recv(struct sk_buff *skb)
         }
 
         /* Ok, this is a data packet. Lookup the session. */
-        session = l2tp_session_find(&init_net, NULL, session_id);
+        session = l2tp_session_find(net, NULL, session_id);
         if (session == NULL)
                 goto discard;
 
@@ -188,14 +189,14 @@ pass_up:
                 goto discard;
 
         tunnel_id = ntohl(*(__be32 *) &skb->data[4]);
-        tunnel = l2tp_tunnel_find(&init_net, tunnel_id);
+        tunnel = l2tp_tunnel_find(net, tunnel_id);
         if (tunnel != NULL)
                 sk = tunnel->sock;
         else {
                 struct ipv6hdr *iph = ipv6_hdr(skb);
 
                 read_lock_bh(&l2tp_ip6_lock);
-                sk = __l2tp_ip6_bind_lookup(&init_net, &iph->daddr,
+                sk = __l2tp_ip6_bind_lookup(net, &iph->daddr,
                                             0, tunnel_id);
                 read_unlock_bh(&l2tp_ip6_lock);
         }
@@ -263,6 +264,7 @@ static int l2tp_ip6_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
         struct inet_sock *inet = inet_sk(sk);
         struct ipv6_pinfo *np = inet6_sk(sk);
         struct sockaddr_l2tpip6 *addr = (struct sockaddr_l2tpip6 *) uaddr;
+        struct net *net = sock_net(sk);
         __be32 v4addr = 0;
         int addr_type;
         int err;
@@ -286,7 +288,7 @@ static int l2tp_ip6_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
 
         err = -EADDRINUSE;
         read_lock_bh(&l2tp_ip6_lock);
-        if (__l2tp_ip6_bind_lookup(&init_net, &addr->l2tp_addr,
+        if (__l2tp_ip6_bind_lookup(net, &addr->l2tp_addr,
                                    sk->sk_bound_dev_if, addr->l2tp_conn_id))
                 goto out_in_use;
         read_unlock_bh(&l2tp_ip6_lock);
@@ -456,7 +458,7 @@ static int l2tp_ip6_backlog_recv(struct sock *sk, struct sk_buff *skb)
         return 0;
 
 drop:
-        IP_INC_STATS(&init_net, IPSTATS_MIB_INDISCARDS);
+        IP_INC_STATS(sock_net(sk), IPSTATS_MIB_INDISCARDS);
         kfree_skb(skb);
         return -1;
 }
diff --git a/net/lapb/lapb_in.c b/net/lapb/lapb_in.c
index 5dba899131b3..182470847fcf 100644
--- a/net/lapb/lapb_in.c
+++ b/net/lapb/lapb_in.c
@@ -444,10 +444,9 @@ static void lapb_state3_machine(struct lapb_cb *lapb, struct sk_buff *skb,
                 break;
 
         case LAPB_FRMR:
-                lapb_dbg(1, "(%p) S3 RX FRMR(%d) %02X %02X %02X %02X %02X\n",
+                lapb_dbg(1, "(%p) S3 RX FRMR(%d) %5ph\n",
                          lapb->dev, frame->pf,
-                         skb->data[0], skb->data[1], skb->data[2],
-                         skb->data[3], skb->data[4]);
+                         skb->data);
                 lapb_establish_data_link(lapb);
                 lapb_dbg(0, "(%p) S3 -> S1\n", lapb->dev);
                 lapb_requeue_frames(lapb);
diff --git a/net/lapb/lapb_out.c b/net/lapb/lapb_out.c
index ba4d015bd1a6..482c94d9d958 100644
--- a/net/lapb/lapb_out.c
+++ b/net/lapb/lapb_out.c
@@ -148,9 +148,7 @@ void lapb_transmit_buffer(struct lapb_cb *lapb, struct sk_buff *skb, int type)
                 }
         }
 
-        lapb_dbg(2, "(%p) S%d TX %02X %02X %02X\n",
-                 lapb->dev, lapb->state,
-                 skb->data[0], skb->data[1], skb->data[2]);
+        lapb_dbg(2, "(%p) S%d TX %3ph\n", lapb->dev, lapb->state, skb->data);
 
         if (!lapb_data_transmit(lapb, skb))
                 kfree_skb(skb);
diff --git a/net/lapb/lapb_subr.c b/net/lapb/lapb_subr.c
index 9d0a426eccbb..3c1914df641f 100644
--- a/net/lapb/lapb_subr.c
+++ b/net/lapb/lapb_subr.c
@@ -113,9 +113,7 @@ int lapb_decode(struct lapb_cb *lapb, struct sk_buff *skb,
 {
         frame->type = LAPB_ILLEGAL;
 
-        lapb_dbg(2, "(%p) S%d RX %02X %02X %02X\n",
-                 lapb->dev, lapb->state,
-                 skb->data[0], skb->data[1], skb->data[2]);
+        lapb_dbg(2, "(%p) S%d RX %3ph\n", lapb->dev, lapb->state, skb->data);
 
         /* We always need to look at 2 bytes, sometimes we need
          * to look at 3 and those cases are handled below.
@@ -284,10 +282,9 @@ void lapb_transmit_frmr(struct lapb_cb *lapb)
                 dptr++;
                 *dptr++ = lapb->frmr_type;
 
-                lapb_dbg(1, "(%p) S%d TX FRMR %02X %02X %02X %02X %02X\n",
+                lapb_dbg(1, "(%p) S%d TX FRMR %5ph\n",
                          lapb->dev, lapb->state,
-                         skb->data[1], skb->data[2], skb->data[3],
-                         skb->data[4], skb->data[5]);
+                         &skb->data[1]);
         } else {
                 dptr    = skb_put(skb, 4);
                 *dptr++ = LAPB_FRMR;
@@ -299,9 +296,8 @@ void lapb_transmit_frmr(struct lapb_cb *lapb)
                 dptr++;
                 *dptr++ = lapb->frmr_type;
 
-                lapb_dbg(1, "(%p) S%d TX FRMR %02X %02X %02X\n",
-                         lapb->dev, lapb->state, skb->data[1],
-                         skb->data[2], skb->data[3]);
+                lapb_dbg(1, "(%p) S%d TX FRMR %3ph\n",
+                         lapb->dev, lapb->state, &skb->data[1]);
         }
 
         lapb_transmit_buffer(lapb, skb, LAPB_RESPONSE);
diff --git a/net/openvswitch/actions.c b/net/openvswitch/actions.c
index 879185fe183f..9a3eb7a0ebf4 100644
--- a/net/openvswitch/actions.c
+++ b/net/openvswitch/actions.c
@@ -137,11 +137,23 @@ static bool is_flow_key_valid(const struct sw_flow_key *key)
         return !!key->eth.type;
 }
 
+static void update_ethertype(struct sk_buff *skb, struct ethhdr *hdr,
+                             __be16 ethertype)
+{
+        if (skb->ip_summed == CHECKSUM_COMPLETE) {
+                __be16 diff[] = { ~(hdr->h_proto), ethertype };
+
+                skb->csum = ~csum_partial((char *)diff, sizeof(diff),
+                                        ~skb->csum);
+        }
+
+        hdr->h_proto = ethertype;
+}
+
 static int push_mpls(struct sk_buff *skb, struct sw_flow_key *key,
                      const struct ovs_action_push_mpls *mpls)
 {
         __be32 *new_mpls_lse;
-        struct ethhdr *hdr;
 
         /* Networking stack do not allow simultaneous Tunnel and MPLS GSO. */
         if (skb->encapsulation)
@@ -160,9 +172,7 @@ static int push_mpls(struct sk_buff *skb, struct sw_flow_key *key,
 
         skb_postpush_rcsum(skb, new_mpls_lse, MPLS_HLEN);
 
-        hdr = eth_hdr(skb);
-        hdr->h_proto = mpls->mpls_ethertype;
-
+        update_ethertype(skb, eth_hdr(skb), mpls->mpls_ethertype);
         if (!skb->inner_protocol)
                 skb_set_inner_protocol(skb, skb->protocol);
         skb->protocol = mpls->mpls_ethertype;
@@ -193,7 +203,7 @@ static int pop_mpls(struct sk_buff *skb, struct sw_flow_key *key,
          * field correctly in the presence of VLAN tags.
          */
         hdr = (struct ethhdr *)(skb_mpls_header(skb) - ETH_HLEN);
-        hdr->h_proto = ethertype;
+        update_ethertype(skb, hdr, ethertype);
         if (eth_p_mpls(skb->protocol))
                 skb->protocol = ethertype;
 
diff --git a/net/sched/act_police.c b/net/sched/act_police.c
index 330f14e302e8..b884dae692a1 100644
--- a/net/sched/act_police.c
+++ b/net/sched/act_police.c
@@ -239,6 +239,8 @@ override:
         police->tcfp_t_c = ktime_get_ns();
         police->tcf_index = parm->index ? parm->index :
                 tcf_hash_new_index(tn);
+        police->tcf_tm.install = jiffies;
+        police->tcf_tm.lastuse = jiffies;
         h = tcf_hash(police->tcf_index, POL_TAB_MASK);
         spin_lock_bh(&hinfo->lock);
         hlist_add_head(&police->tcf_head, &hinfo->htab[h]);
@@ -268,6 +270,7 @@ static int tcf_act_police(struct sk_buff *skb, const struct tc_action *a,
         spin_lock(&police->tcf_lock);
 
         bstats_update(&police->tcf_bstats, skb);
+        tcf_lastuse_update(&police->tcf_tm);
 
         if (police->tcfp_ewma_rate &&
             police->tcf_rate_est.bps >= police->tcfp_ewma_rate) {
@@ -327,6 +330,7 @@ tcf_act_police_dump(struct sk_buff *skb, struct tc_action *a, int bind, int ref)
                 .refcnt = police->tcf_refcnt - ref,
                 .bindcnt = police->tcf_bindcnt - bind,
         };
+        struct tcf_t t;
 
         if (police->rate_present)
                 psched_ratecfg_getrate(&opt.rate, &police->rate);
@@ -340,6 +344,13 @@ tcf_act_police_dump(struct sk_buff *skb, struct tc_action *a, int bind, int ref)
         if (police->tcfp_ewma_rate &&
             nla_put_u32(skb, TCA_POLICE_AVRATE, police->tcfp_ewma_rate))
                 goto nla_put_failure;
+
+        t.install = jiffies_to_clock_t(jiffies - police->tcf_tm.install);
+        t.lastuse = jiffies_to_clock_t(jiffies - police->tcf_tm.lastuse);
+        t.expires = jiffies_to_clock_t(police->tcf_tm.expires);
+        if (nla_put_64bit(skb, TCA_POLICE_TM, sizeof(t), &t, TCA_POLICE_PAD))
+                goto nla_put_failure;
+
         return skb->len;
 
 nla_put_failure:
diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index 64f71a2155f3..ddf047df5361 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -607,6 +607,10 @@ void qdisc_watchdog_schedule_ns(struct qdisc_watchdog *wd, u64 expires, bool thr
         if (throttle)
                 qdisc_throttled(wd->qdisc);
 
+        if (wd->last_expires == expires)
+                return;
+
+        wd->last_expires = expires;
         hrtimer_start(&wd->timer,
                       ns_to_ktime(expires),
                       HRTIMER_MODE_ABS_PINNED);
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index f6bf5818ed4d..d4b4218af6b1 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -928,17 +928,10 @@ ok:
                 }
         }
         qdisc_qstats_overlimit(sch);
-        if (likely(next_event > q->now)) {
-                if (!test_bit(__QDISC_STATE_DEACTIVATED,
-                              &qdisc_root_sleeping(q->watchdog.qdisc)->state)) {
-                        ktime_t time = ns_to_ktime(next_event);
-                        qdisc_throttled(q->watchdog.qdisc);
-                        hrtimer_start(&q->watchdog.timer, time,
-                                      HRTIMER_MODE_ABS_PINNED);
-                }
-        } else {
+        if (likely(next_event > q->now))
+                qdisc_watchdog_schedule_ns(&q->watchdog, next_event, true);
+        else
                 schedule_work(&q->work);
-        }
 fin:
         return skb;
 }
diff --git a/net/sctp/sctp_diag.c b/net/sctp/sctp_diag.c
index 8e3e769dc9ea..1ce724b87618 100644
--- a/net/sctp/sctp_diag.c
+++ b/net/sctp/sctp_diag.c
@@ -356,6 +356,9 @@ static int sctp_ep_dump(struct sctp_endpoint *ep, void *p)
         if (cb->args[4] < cb->args[1])
                 goto next;
 
+        if ((r->idiag_states & ~TCPF_LISTEN) && !list_empty(&ep->asocs))
+                goto next;
+
         if (r->sdiag_family != AF_UNSPEC &&
             sk->sk_family != r->sdiag_family)
                 goto next;
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 777d0324594a..67154b848aa9 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -4220,6 +4220,7 @@ int sctp_get_sctp_info(struct sock *sk, struct sctp_association *asoc,
                 info->sctpi_s_disable_fragments = sp->disable_fragments;
                 info->sctpi_s_v4mapped = sp->v4mapped;
                 info->sctpi_s_frag_interleave = sp->frag_interleave;
+                info->sctpi_s_type = sp->type;
 
                 return 0;
         }
diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c
index 4dfc5c14f8c3..f795b1dd0ccd 100644
--- a/net/tipc/netlink_compat.c
+++ b/net/tipc/netlink_compat.c
@@ -346,9 +346,15 @@ static int tipc_nl_compat_bearer_dump(struct tipc_nl_compat_msg *msg,
                                       struct nlattr **attrs)
 {
         struct nlattr *bearer[TIPC_NLA_BEARER_MAX + 1];
+        int err;
+
+        if (!attrs[TIPC_NLA_BEARER])
+                return -EINVAL;
 
-        nla_parse_nested(bearer, TIPC_NLA_BEARER_MAX, attrs[TIPC_NLA_BEARER],
-                         NULL);
+        err = nla_parse_nested(bearer, TIPC_NLA_BEARER_MAX,
+                               attrs[TIPC_NLA_BEARER], NULL);
+        if (err)
+                return err;
 
         return tipc_add_tlv(msg->rep, TIPC_TLV_BEARER_NAME,
                             nla_data(bearer[TIPC_NLA_BEARER_NAME]),
@@ -460,14 +466,31 @@ static int tipc_nl_compat_link_stat_dump(struct tipc_nl_compat_msg *msg,
         struct nlattr *link[TIPC_NLA_LINK_MAX + 1];
         struct nlattr *prop[TIPC_NLA_PROP_MAX + 1];
         struct nlattr *stats[TIPC_NLA_STATS_MAX + 1];
+        int err;
 
-        nla_parse_nested(link, TIPC_NLA_LINK_MAX, attrs[TIPC_NLA_LINK], NULL);
+        if (!attrs[TIPC_NLA_LINK])
+                return -EINVAL;
 
-        nla_parse_nested(prop, TIPC_NLA_PROP_MAX, link[TIPC_NLA_LINK_PROP],
-                         NULL);
+        err = nla_parse_nested(link, TIPC_NLA_LINK_MAX, attrs[TIPC_NLA_LINK],
+                               NULL);
+        if (err)
+                return err;
+
+        if (!link[TIPC_NLA_LINK_PROP])
+                return -EINVAL;
 
-        nla_parse_nested(stats, TIPC_NLA_STATS_MAX, link[TIPC_NLA_LINK_STATS],
-                         NULL);
+        err = nla_parse_nested(prop, TIPC_NLA_PROP_MAX,
+                               link[TIPC_NLA_LINK_PROP], NULL);
+        if (err)
+                return err;
+
+        if (!link[TIPC_NLA_LINK_STATS])
+                return -EINVAL;
+
+        err = nla_parse_nested(stats, TIPC_NLA_STATS_MAX,
+                               link[TIPC_NLA_LINK_STATS], NULL);
+        if (err)
+                return err;
 
         name = (char *)TLV_DATA(msg->req);
         if (strcmp(name, nla_data(link[TIPC_NLA_LINK_NAME])) != 0)
@@ -569,8 +592,15 @@ static int tipc_nl_compat_link_dump(struct tipc_nl_compat_msg *msg,
 {
         struct nlattr *link[TIPC_NLA_LINK_MAX + 1];
         struct tipc_link_info link_info;
+        int err;
 
-        nla_parse_nested(link, TIPC_NLA_LINK_MAX, attrs[TIPC_NLA_LINK], NULL);
+        if (!attrs[TIPC_NLA_LINK])
+                return -EINVAL;
+
+        err = nla_parse_nested(link, TIPC_NLA_LINK_MAX, attrs[TIPC_NLA_LINK],
+                               NULL);
+        if (err)
+                return err;
 
         link_info.dest = nla_get_flag(link[TIPC_NLA_LINK_DEST]);
         link_info.up = htonl(nla_get_flag(link[TIPC_NLA_LINK_UP]));
@@ -758,12 +788,23 @@ static int tipc_nl_compat_name_table_dump(struct tipc_nl_compat_msg *msg,
         u32 node, depth, type, lowbound, upbound;
         static const char * const scope_str[] = {"", " zone", " cluster",
                                                  " node"};
+        int err;
 
-        nla_parse_nested(nt, TIPC_NLA_NAME_TABLE_MAX,
-                         attrs[TIPC_NLA_NAME_TABLE], NULL);
+        if (!attrs[TIPC_NLA_NAME_TABLE])
+                return -EINVAL;
 
-        nla_parse_nested(publ, TIPC_NLA_PUBL_MAX, nt[TIPC_NLA_NAME_TABLE_PUBL],
-                         NULL);
+        err = nla_parse_nested(nt, TIPC_NLA_NAME_TABLE_MAX,
+                               attrs[TIPC_NLA_NAME_TABLE], NULL);
+        if (err)
+                return err;
+
+        if (!nt[TIPC_NLA_NAME_TABLE_PUBL])
+                return -EINVAL;
+
+        err = nla_parse_nested(publ, TIPC_NLA_PUBL_MAX,
+                               nt[TIPC_NLA_NAME_TABLE_PUBL], NULL);
+        if (err)
+                return err;
 
         ntq = (struct tipc_name_table_query *)TLV_DATA(msg->req);
 
@@ -815,8 +856,15 @@ static int __tipc_nl_compat_publ_dump(struct tipc_nl_compat_msg *msg,
 {
         u32 type, lower, upper;
         struct nlattr *publ[TIPC_NLA_PUBL_MAX + 1];
+        int err;
 
-        nla_parse_nested(publ, TIPC_NLA_PUBL_MAX, attrs[TIPC_NLA_PUBL], NULL);
+        if (!attrs[TIPC_NLA_PUBL])
+                return -EINVAL;
+
+        err = nla_parse_nested(publ, TIPC_NLA_PUBL_MAX, attrs[TIPC_NLA_PUBL],
+                               NULL);
+        if (err)
+                return err;
 
         type = nla_get_u32(publ[TIPC_NLA_PUBL_TYPE]);
         lower = nla_get_u32(publ[TIPC_NLA_PUBL_LOWER]);
@@ -876,7 +924,13 @@ static int tipc_nl_compat_sk_dump(struct tipc_nl_compat_msg *msg,
         u32 sock_ref;
         struct nlattr *sock[TIPC_NLA_SOCK_MAX + 1];
 
-        nla_parse_nested(sock, TIPC_NLA_SOCK_MAX, attrs[TIPC_NLA_SOCK], NULL);
+        if (!attrs[TIPC_NLA_SOCK])
+                return -EINVAL;
+
+        err = nla_parse_nested(sock, TIPC_NLA_SOCK_MAX, attrs[TIPC_NLA_SOCK],
+                               NULL);
+        if (err)
+                return err;
 
         sock_ref = nla_get_u32(sock[TIPC_NLA_SOCK_REF]);
         tipc_tlv_sprintf(msg->rep, "%u:", sock_ref);
@@ -917,9 +971,15 @@ static int tipc_nl_compat_media_dump(struct tipc_nl_compat_msg *msg,
                                      struct nlattr **attrs)
 {
         struct nlattr *media[TIPC_NLA_MEDIA_MAX + 1];
+        int err;
+
+        if (!attrs[TIPC_NLA_MEDIA])
+                return -EINVAL;
 
-        nla_parse_nested(media, TIPC_NLA_MEDIA_MAX, attrs[TIPC_NLA_MEDIA],
-                         NULL);
+        err = nla_parse_nested(media, TIPC_NLA_MEDIA_MAX, attrs[TIPC_NLA_MEDIA],
+                               NULL);
+        if (err)
+                return err;
 
         return tipc_add_tlv(msg->rep, TIPC_TLV_MEDIA_NAME,
                             nla_data(media[TIPC_NLA_MEDIA_NAME]),
@@ -931,8 +991,15 @@ static int tipc_nl_compat_node_dump(struct tipc_nl_compat_msg *msg,
 {
         struct tipc_node_info node_info;
         struct nlattr *node[TIPC_NLA_NODE_MAX + 1];
+        int err;
 
-        nla_parse_nested(node, TIPC_NLA_NODE_MAX, attrs[TIPC_NLA_NODE], NULL);
+        if (!attrs[TIPC_NLA_NODE])
+                return -EINVAL;
+
+        err = nla_parse_nested(node, TIPC_NLA_NODE_MAX, attrs[TIPC_NLA_NODE],
+                               NULL);
+        if (err)
+                return err;
 
         node_info.addr = htonl(nla_get_u32(node[TIPC_NLA_NODE_ADDR]));
         node_info.up = htonl(nla_get_flag(node[TIPC_NLA_NODE_UP]));
@@ -971,8 +1038,16 @@ static int tipc_nl_compat_net_dump(struct tipc_nl_compat_msg *msg,
 {
         __be32 id;
         struct nlattr *net[TIPC_NLA_NET_MAX + 1];
+        int err;
+
+        if (!attrs[TIPC_NLA_NET])
+                return -EINVAL;
+
+        err = nla_parse_nested(net, TIPC_NLA_NET_MAX, attrs[TIPC_NLA_NET],
+                               NULL);
+        if (err)
+                return err;
 
-        nla_parse_nested(net, TIPC_NLA_NET_MAX, attrs[TIPC_NLA_NET], NULL);
         id = htonl(nla_get_u32(net[TIPC_NLA_NET_ID]));
 
         return tipc_add_tlv(msg->rep, TIPC_TLV_UNSIGNED, &id, sizeof(id));