32 files changed, 174 insertions, 119 deletions

diff --git a/MAINTAINERS b/MAINTAINERS
index af802b357b6a..e30871880fdb 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -10587,8 +10587,7 @@ F:	drivers/virtio/virtio_input.c
 F:      include/uapi/linux/virtio_input.h
 
 VIA RHINE NETWORK DRIVER
-M:      Roger Luethi <rl@hellgate.ch>
-S:      Maintained
+S:      Orphan
 F:      drivers/net/ethernet/via/via-rhine.c
 
 VIA SD/MMC CARD CONTROLLER DRIVER
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
index a3b0f7a0c61e..1f82a04ce01a 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
@@ -1774,7 +1774,7 @@ struct bnx2x {
         int                     stats_state;
 
         /* used for synchronization of concurrent threads statistics handling */
-        struct mutex            stats_lock;
+        struct semaphore        stats_lock;
 
         /* used by dmae command loader */
         struct dmae_command     stats_dmae;
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index fd52ce95127e..33501bcddc48 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -12054,7 +12054,7 @@ static int bnx2x_init_bp(struct bnx2x *bp)
         mutex_init(&bp->port.phy_mutex);
         mutex_init(&bp->fw_mb_mutex);
         mutex_init(&bp->drv_info_mutex);
-        mutex_init(&bp->stats_lock);
+        sema_init(&bp->stats_lock, 1);
         bp->drv_info_mng_owner = false;
 
         INIT_DELAYED_WORK(&bp->sp_task, bnx2x_sp_task);
@@ -13690,9 +13690,10 @@ static int bnx2x_eeh_nic_unload(struct bnx2x *bp)
         cancel_delayed_work_sync(&bp->sp_task);
         cancel_delayed_work_sync(&bp->period_task);
 
-        mutex_lock(&bp->stats_lock);
-        bp->stats_state = STATS_STATE_DISABLED;
-        mutex_unlock(&bp->stats_lock);
+        if (!down_timeout(&bp->stats_lock, HZ / 10)) {
+                bp->stats_state = STATS_STATE_DISABLED;
+                up(&bp->stats_lock);
+        }
 
         bnx2x_save_statistics(bp);
 
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c
index 266b055c2360..69d699f0730a 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c
@@ -1372,19 +1372,23 @@ void bnx2x_stats_handle(struct bnx2x *bp, enum bnx2x_stats_event event)
          * that context in case someone is in the middle of a transition.
          * For other events, wait a bit until lock is taken.
          */
-        if (!mutex_trylock(&bp->stats_lock)) {
+        if (down_trylock(&bp->stats_lock)) {
                 if (event == STATS_EVENT_UPDATE)
                         return;
 
                 DP(BNX2X_MSG_STATS,
                    "Unlikely stats' lock contention [event %d]\n", event);
-                mutex_lock(&bp->stats_lock);
+                if (unlikely(down_timeout(&bp->stats_lock, HZ / 10))) {
+                        BNX2X_ERR("Failed to take stats lock [event %d]\n",
+                                  event);
+                        return;
+                }
         }
 
         bnx2x_stats_stm[state][event].action(bp);
         bp->stats_state = bnx2x_stats_stm[state][event].next_state;
 
-        mutex_unlock(&bp->stats_lock);
+        up(&bp->stats_lock);
 
         if ((event != STATS_EVENT_UPDATE) || netif_msg_timer(bp))
                 DP(BNX2X_MSG_STATS, "state %d -> event %d -> state %d\n",
@@ -1970,7 +1974,11 @@ int bnx2x_stats_safe_exec(struct bnx2x *bp,
         /* Wait for statistics to end [while blocking further requests],
          * then run supplied function 'safely'.
          */
-        mutex_lock(&bp->stats_lock);
+        rc = down_timeout(&bp->stats_lock, HZ / 10);
+        if (unlikely(rc)) {
+                BNX2X_ERR("Failed to take statistics lock for safe execution\n");
+                goto out_no_lock;
+        }
 
         bnx2x_stats_comp(bp);
         while (bp->stats_pending && cnt--)
@@ -1988,7 +1996,7 @@ out:
         /* No need to restart statistics - if they're enabled, the timer
          * will restart the statistics.
          */
-        mutex_unlock(&bp->stats_lock);
-
+        up(&bp->stats_lock);
+out_no_lock:
         return rc;
 }
diff --git a/drivers/net/ethernet/brocade/bna/bfa_ioc.c b/drivers/net/ethernet/brocade/bna/bfa_ioc.c
index 594a2ab36d31..68f3c13c9ef6 100644
--- a/drivers/net/ethernet/brocade/bna/bfa_ioc.c
+++ b/drivers/net/ethernet/brocade/bna/bfa_ioc.c
@@ -2414,7 +2414,7 @@ bfa_ioc_boot(struct bfa_ioc *ioc, enum bfi_fwboot_type boot_type,
         if (status == BFA_STATUS_OK)
                 bfa_ioc_lpu_start(ioc);
         else
-                bfa_nw_iocpf_timeout(ioc);
+                bfa_fsm_send_event(&ioc->iocpf, IOCPF_E_TIMEOUT);
 
         return status;
 }
@@ -3029,7 +3029,7 @@ bfa_ioc_poll_fwinit(struct bfa_ioc *ioc)
         }
 
         if (ioc->iocpf.poll_time >= BFA_IOC_TOV) {
-                bfa_nw_iocpf_timeout(ioc);
+                bfa_fsm_send_event(&ioc->iocpf, IOCPF_E_TIMEOUT);
         } else {
                 ioc->iocpf.poll_time += BFA_IOC_POLL_TOV;
                 mod_timer(&ioc->iocpf_timer, jiffies +
diff --git a/drivers/net/ethernet/brocade/bna/bnad.c b/drivers/net/ethernet/brocade/bna/bnad.c
index 37072a83f9d6..caae6cb2bc1a 100644
--- a/drivers/net/ethernet/brocade/bna/bnad.c
+++ b/drivers/net/ethernet/brocade/bna/bnad.c
@@ -3701,10 +3701,6 @@ bnad_pci_probe(struct pci_dev *pdev,
         setup_timer(&bnad->bna.ioceth.ioc.sem_timer, bnad_iocpf_sem_timeout,
                                 ((unsigned long)bnad));
 
-        /* Now start the timer before calling IOC */
-        mod_timer(&bnad->bna.ioceth.ioc.iocpf_timer,
-                  jiffies + msecs_to_jiffies(BNA_IOC_TIMER_FREQ));
-
         /*
          * Start the chip
          * If the call back comes with error, we bail out.
diff --git a/drivers/net/ethernet/brocade/bna/cna_fwimg.c b/drivers/net/ethernet/brocade/bna/cna_fwimg.c
index ebf462d8082f..badea368bdc8 100644
--- a/drivers/net/ethernet/brocade/bna/cna_fwimg.c
+++ b/drivers/net/ethernet/brocade/bna/cna_fwimg.c
@@ -30,6 +30,7 @@ cna_read_firmware(struct pci_dev *pdev, u32 **bfi_image,
                         u32 *bfi_image_size, char *fw_name)
 {
         const struct firmware *fw;
+        u32 n;
 
         if (request_firmware(&fw, fw_name, &pdev->dev)) {
                 pr_alert("Can't locate firmware %s\n", fw_name);
@@ -40,6 +41,12 @@ cna_read_firmware(struct pci_dev *pdev, u32 **bfi_image,
         *bfi_image_size = fw->size/sizeof(u32);
         bfi_fw = fw;
 
+        /* Convert loaded firmware to host order as it is stored in file
+         * as sequence of LE32 integers.
+         */
+        for (n = 0; n < *bfi_image_size; n++)
+                le32_to_cpus(*bfi_image + n);
+
         return *bfi_image;
 error:
         return NULL;
diff --git a/drivers/net/ethernet/sfc/rx.c b/drivers/net/ethernet/sfc/rx.c
index c0ad95d2f63d..809ea4610a77 100644
--- a/drivers/net/ethernet/sfc/rx.c
+++ b/drivers/net/ethernet/sfc/rx.c
@@ -224,12 +224,17 @@ static void efx_unmap_rx_buffer(struct efx_nic *efx,
         }
 }
 
-static void efx_free_rx_buffer(struct efx_rx_buffer *rx_buf)
+static void efx_free_rx_buffers(struct efx_rx_queue *rx_queue,
+                                struct efx_rx_buffer *rx_buf,
+                                unsigned int num_bufs)
 {
-        if (rx_buf->page) {
-                put_page(rx_buf->page);
-                rx_buf->page = NULL;
-        }
+        do {
+                if (rx_buf->page) {
+                        put_page(rx_buf->page);
+                        rx_buf->page = NULL;
+                }
+                rx_buf = efx_rx_buf_next(rx_queue, rx_buf);
+        } while (--num_bufs);
 }
 
 /* Attempt to recycle the page if there is an RX recycle ring; the page can
@@ -278,7 +283,7 @@ static void efx_fini_rx_buffer(struct efx_rx_queue *rx_queue,
         /* If this is the last buffer in a page, unmap and free it. */
         if (rx_buf->flags & EFX_RX_BUF_LAST_IN_PAGE) {
                 efx_unmap_rx_buffer(rx_queue->efx, rx_buf);
-                efx_free_rx_buffer(rx_buf);
+                efx_free_rx_buffers(rx_queue, rx_buf, 1);
         }
         rx_buf->page = NULL;
 }
@@ -304,10 +309,7 @@ static void efx_discard_rx_packet(struct efx_channel *channel,
 
         efx_recycle_rx_pages(channel, rx_buf, n_frags);
 
-        do {
-                efx_free_rx_buffer(rx_buf);
-                rx_buf = efx_rx_buf_next(rx_queue, rx_buf);
-        } while (--n_frags);
+        efx_free_rx_buffers(rx_queue, rx_buf, n_frags);
 }
 
 /**
@@ -431,11 +433,10 @@ efx_rx_packet_gro(struct efx_channel *channel, struct efx_rx_buffer *rx_buf,
 
         skb = napi_get_frags(napi);
         if (unlikely(!skb)) {
-                while (n_frags--) {
-                        put_page(rx_buf->page);
-                        rx_buf->page = NULL;
-                        rx_buf = efx_rx_buf_next(&channel->rx_queue, rx_buf);
-                }
+                struct efx_rx_queue *rx_queue;
+
+                rx_queue = efx_channel_get_rx_queue(channel);
+                efx_free_rx_buffers(rx_queue, rx_buf, n_frags);
                 return;
         }
 
@@ -622,7 +623,10 @@ static void efx_rx_deliver(struct efx_channel *channel, u8 *eh,
 
         skb = efx_rx_mk_skb(channel, rx_buf, n_frags, eh, hdr_len);
         if (unlikely(skb == NULL)) {
-                efx_free_rx_buffer(rx_buf);
+                struct efx_rx_queue *rx_queue;
+
+                rx_queue = efx_channel_get_rx_queue(channel);
+                efx_free_rx_buffers(rx_queue, rx_buf, n_frags);
                 return;
         }
         skb_record_rx_queue(skb, channel->rx_queue.core_index);
@@ -661,8 +665,12 @@ void __efx_rx_packet(struct efx_channel *channel)
          * loopback layer, and free the rx_buf here
          */
         if (unlikely(efx->loopback_selftest)) {
+                struct efx_rx_queue *rx_queue;
+
                 efx_loopback_rx_packet(efx, eh, rx_buf->len);
-                efx_free_rx_buffer(rx_buf);
+                rx_queue = efx_channel_get_rx_queue(channel);
+                efx_free_rx_buffers(rx_queue, rx_buf,
+                                    channel->rx_pkt_n_frags);
                 goto out;
         }
 
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c b/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
index 4ec9811f49c8..65efb1468988 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
@@ -511,11 +511,9 @@ static int brcmf_msgbuf_query_dcmd(struct brcmf_pub *drvr, int ifidx,
                                      msgbuf->rx_pktids,
                                      msgbuf->ioctl_resp_pktid);
         if (msgbuf->ioctl_resp_ret_len != 0) {
-                if (!skb) {
-                        brcmf_err("Invalid packet id idx recv'd %d\n",
-                                  msgbuf->ioctl_resp_pktid);
+                if (!skb)
                         return -EBADF;
-                }
+
                 memcpy(buf, skb->data, (len < msgbuf->ioctl_resp_ret_len) ?
                                        len : msgbuf->ioctl_resp_ret_len);
         }
@@ -874,10 +872,8 @@ brcmf_msgbuf_process_txstatus(struct brcmf_msgbuf *msgbuf, void *buf)
         flowid -= BRCMF_NROF_H2D_COMMON_MSGRINGS;
         skb = brcmf_msgbuf_get_pktid(msgbuf->drvr->bus_if->dev,
                                      msgbuf->tx_pktids, idx);
-        if (!skb) {
-                brcmf_err("Invalid packet id idx recv'd %d\n", idx);
+        if (!skb)
                 return;
-        }
 
         set_bit(flowid, msgbuf->txstatus_done_map);
         commonring = msgbuf->flowrings[flowid];
@@ -1156,6 +1152,8 @@ brcmf_msgbuf_process_rx_complete(struct brcmf_msgbuf *msgbuf, void *buf)
 
         skb = brcmf_msgbuf_get_pktid(msgbuf->drvr->bus_if->dev,
                                      msgbuf->rx_pktids, idx);
+        if (!skb)
+                return;
 
         if (data_offset)
                 skb_pull(skb, data_offset);
diff --git a/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c b/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c
index 75e96db6626b..8e604a3931ca 100644
--- a/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c
+++ b/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c
@@ -471,7 +471,7 @@ static int iwl_get_radio_cfg(const struct iwl_cfg *cfg, const __le16 *nvm_sw,
         if (cfg->device_family != IWL_DEVICE_FAMILY_8000)
                 return le16_to_cpup(nvm_sw + RADIO_CFG);
 
-        return le32_to_cpup((__le32 *)(nvm_sw + RADIO_CFG_FAMILY_8000));
+        return le32_to_cpup((__le32 *)(phy_sku + RADIO_CFG_FAMILY_8000));
 
 }
 
diff --git a/drivers/net/wireless/iwlwifi/pcie/internal.h b/drivers/net/wireless/iwlwifi/pcie/internal.h
index 01996c9d98a7..376b84e54ad7 100644
--- a/drivers/net/wireless/iwlwifi/pcie/internal.h
+++ b/drivers/net/wireless/iwlwifi/pcie/internal.h
@@ -1,7 +1,7 @@
 /******************************************************************************
  *
- * Copyright(c) 2003 - 2014 Intel Corporation. All rights reserved.
- * Copyright(c) 2013 - 2014 Intel Mobile Communications GmbH
+ * Copyright(c) 2003 - 2015 Intel Corporation. All rights reserved.
+ * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  *
  * Portions of this file are derived from the ipw3945 project, as well
  * as portions of the ieee80211 subsystem header files.
@@ -320,7 +320,7 @@ struct iwl_trans_pcie {
 
         /*protect hw register */
         spinlock_t reg_lock;
-        bool cmd_in_flight;
+        bool cmd_hold_nic_awake;
         bool ref_cmd_in_flight;
 
         /* protect ref counter */
diff --git a/drivers/net/wireless/iwlwifi/pcie/trans.c b/drivers/net/wireless/iwlwifi/pcie/trans.c
index d6f6515fe663..dc179094e6a0 100644
--- a/drivers/net/wireless/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/iwlwifi/pcie/trans.c
@@ -1372,7 +1372,7 @@ static bool iwl_trans_pcie_grab_nic_access(struct iwl_trans *trans, bool silent,
 
         spin_lock_irqsave(&trans_pcie->reg_lock, *flags);
 
-        if (trans_pcie->cmd_in_flight)
+        if (trans_pcie->cmd_hold_nic_awake)
                 goto out;
 
         /* this bit wakes up the NIC */
@@ -1438,7 +1438,7 @@ static void iwl_trans_pcie_release_nic_access(struct iwl_trans *trans,
          */
         __acquire(&trans_pcie->reg_lock);
 
-        if (trans_pcie->cmd_in_flight)
+        if (trans_pcie->cmd_hold_nic_awake)
                 goto out;
 
         __iwl_trans_pcie_clear_bit(trans, CSR_GP_CNTRL,
diff --git a/drivers/net/wireless/iwlwifi/pcie/tx.c b/drivers/net/wireless/iwlwifi/pcie/tx.c
index 06952aadfd7b..5ef8044c2ea3 100644
--- a/drivers/net/wireless/iwlwifi/pcie/tx.c
+++ b/drivers/net/wireless/iwlwifi/pcie/tx.c
@@ -1039,18 +1039,14 @@ static int iwl_pcie_set_cmd_in_flight(struct iwl_trans *trans,
                 iwl_trans_pcie_ref(trans);
         }
 
-        if (trans_pcie->cmd_in_flight)
-                return 0;
-
-        trans_pcie->cmd_in_flight = true;
-
         /*
          * wake up the NIC to make sure that the firmware will see the host
          * command - we will let the NIC sleep once all the host commands
          * returned. This needs to be done only on NICs that have
          * apmg_wake_up_wa set.
          */
-        if (trans->cfg->base_params->apmg_wake_up_wa) {
+        if (trans->cfg->base_params->apmg_wake_up_wa &&
+            !trans_pcie->cmd_hold_nic_awake) {
                 __iwl_trans_pcie_set_bit(trans, CSR_GP_CNTRL,
                                          CSR_GP_CNTRL_REG_FLAG_MAC_ACCESS_REQ);
                 if (trans->cfg->device_family == IWL_DEVICE_FAMILY_8000)
@@ -1064,10 +1060,10 @@ static int iwl_pcie_set_cmd_in_flight(struct iwl_trans *trans,
                 if (ret < 0) {
                         __iwl_trans_pcie_clear_bit(trans, CSR_GP_CNTRL,
                                         CSR_GP_CNTRL_REG_FLAG_MAC_ACCESS_REQ);
-                        trans_pcie->cmd_in_flight = false;
                         IWL_ERR(trans, "Failed to wake NIC for hcmd\n");
                         return -EIO;
                 }
+                trans_pcie->cmd_hold_nic_awake = true;
         }
 
         return 0;
@@ -1085,15 +1081,14 @@ static int iwl_pcie_clear_cmd_in_flight(struct iwl_trans *trans)
                 iwl_trans_pcie_unref(trans);
         }
 
-        if (WARN_ON(!trans_pcie->cmd_in_flight))
-                return 0;
-
-        trans_pcie->cmd_in_flight = false;
+        if (trans->cfg->base_params->apmg_wake_up_wa) {
+                if (WARN_ON(!trans_pcie->cmd_hold_nic_awake))
+                        return 0;
 
-        if (trans->cfg->base_params->apmg_wake_up_wa)
+                trans_pcie->cmd_hold_nic_awake = false;
                 __iwl_trans_pcie_clear_bit(trans, CSR_GP_CNTRL,
-                                        CSR_GP_CNTRL_REG_FLAG_MAC_ACCESS_REQ);
-
+                                           CSR_GP_CNTRL_REG_FLAG_MAC_ACCESS_REQ);
+        }
         return 0;
 }
 
diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
index 4de46aa61d95..0d2594395ffb 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -1250,7 +1250,7 @@ static void xenvif_tx_build_gops(struct xenvif_queue *queue,
                         netdev_err(queue->vif->dev,
                                    "txreq.offset: %x, size: %u, end: %lu\n",
                                    txreq.offset, txreq.size,
-                                   (txreq.offset&~PAGE_MASK) + txreq.size);
+                                   (unsigned long)(txreq.offset&~PAGE_MASK) + txreq.size);
                         xenvif_fatal_tx_err(queue->vif);
                         break;
                 }
diff --git a/drivers/net/xen-netback/xenbus.c b/drivers/net/xen-netback/xenbus.c
index fee02414529e..968787abf78d 100644
--- a/drivers/net/xen-netback/xenbus.c
+++ b/drivers/net/xen-netback/xenbus.c
@@ -34,6 +34,8 @@ struct backend_info {
         enum xenbus_state frontend_state;
         struct xenbus_watch hotplug_status_watch;
         u8 have_hotplug_status_watch:1;
+
+        const char *hotplug_script;
 };
 
 static int connect_rings(struct backend_info *be, struct xenvif_queue *queue);
@@ -238,6 +240,7 @@ static int netback_remove(struct xenbus_device *dev)
                 xenvif_free(be->vif);
                 be->vif = NULL;
         }
+        kfree(be->hotplug_script);
         kfree(be);
         dev_set_drvdata(&dev->dev, NULL);
         return 0;
@@ -255,6 +258,7 @@ static int netback_probe(struct xenbus_device *dev,
         struct xenbus_transaction xbt;
         int err;
         int sg;
+        const char *script;
         struct backend_info *be = kzalloc(sizeof(struct backend_info),
                                           GFP_KERNEL);
         if (!be) {
@@ -347,6 +351,15 @@ static int netback_probe(struct xenbus_device *dev,
         if (err)
                 pr_debug("Error writing multi-queue-max-queues\n");
 
+        script = xenbus_read(XBT_NIL, dev->nodename, "script", NULL);
+        if (IS_ERR(script)) {
+                err = PTR_ERR(script);
+                xenbus_dev_fatal(dev, err, "reading script");
+                goto fail;
+        }
+
+        be->hotplug_script = script;
+
         err = xenbus_switch_state(dev, XenbusStateInitWait);
         if (err)
                 goto fail;
@@ -379,22 +392,14 @@ static int netback_uevent(struct xenbus_device *xdev,
                           struct kobj_uevent_env *env)
 {
         struct backend_info *be = dev_get_drvdata(&xdev->dev);
-        char *val;
 
-        val = xenbus_read(XBT_NIL, xdev->nodename, "script", NULL);
-        if (IS_ERR(val)) {
-                int err = PTR_ERR(val);
-                xenbus_dev_fatal(xdev, err, "reading script");
-                return err;
-        } else {
-                if (add_uevent_var(env, "script=%s", val)) {
-                        kfree(val);
-                        return -ENOMEM;
-                }
-                kfree(val);
-        }
+        if (!be)
+                return 0;
+
+        if (add_uevent_var(env, "script=%s", be->hotplug_script))
+                return -ENOMEM;
 
-        if (!be || !be->vif)
+        if (!be->vif)
                 return 0;
 
         return add_uevent_var(env, "vif=%s", be->vif->dev->name);
diff --git a/include/net/inet_connection_sock.h b/include/net/inet_connection_sock.h
index 497bc14cdb85..0320bbb7d7b5 100644
--- a/include/net/inet_connection_sock.h
+++ b/include/net/inet_connection_sock.h
@@ -98,7 +98,8 @@ struct inet_connection_sock {
         const struct tcp_congestion_ops *icsk_ca_ops;
         const struct inet_connection_sock_af_ops *icsk_af_ops;
         unsigned int              (*icsk_sync_mss)(struct sock *sk, u32 pmtu);
-        __u8                      icsk_ca_state:7,
+        __u8                      icsk_ca_state:6,
+                                  icsk_ca_setsockopt:1,
                                   icsk_ca_dst_locked:1;
         __u8                      icsk_retransmits;
         __u8                      icsk_pending;
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index 8e3668b44c29..fc57f6b82fc5 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -354,7 +354,7 @@ enum ieee80211_rssi_event_data {
 };
 
 /**
- * enum ieee80211_rssi_event - data attached to an %RSSI_EVENT
+ * struct ieee80211_rssi_event - data attached to an %RSSI_EVENT
  * @data: See &enum ieee80211_rssi_event_data
  */
 struct ieee80211_rssi_event {
@@ -388,7 +388,7 @@ enum ieee80211_mlme_event_status {
 };
 
 /**
- * enum ieee80211_mlme_event - data attached to an %MLME_EVENT
+ * struct ieee80211_mlme_event - data attached to an %MLME_EVENT
  * @data: See &enum ieee80211_mlme_event_data
  * @status: See &enum ieee80211_mlme_event_status
  * @reason: the reason code if applicable
@@ -401,9 +401,10 @@ struct ieee80211_mlme_event {
 
 /**
  * struct ieee80211_event - event to be sent to the driver
- * @type The event itself. See &enum ieee80211_event_type.
+ * @type: The event itself. See &enum ieee80211_event_type.
  * @rssi: relevant if &type is %RSSI_EVENT
  * @mlme: relevant if &type is %AUTH_EVENT
+ * @u:    union holding the above two fields
  */
 struct ieee80211_event {
         enum ieee80211_event_type type;
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index a3abe6ed111e..22fd0419b314 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -1822,7 +1822,7 @@ static void br_multicast_query_expired(struct net_bridge *br,
         if (query->startup_sent < br->multicast_startup_query_count)
                 query->startup_sent++;
 
-        RCU_INIT_POINTER(querier, NULL);
+        RCU_INIT_POINTER(querier->port, NULL);
         br_multicast_send_query(br, NULL, query);
         spin_unlock(&br->multicast_lock);
 }
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 24c7c96bf5f8..91180a7fc943 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -1117,8 +1117,6 @@ static int do_replace(struct net *net, const void __user *user,
                 return -ENOMEM;
         if (tmp.num_counters >= INT_MAX / sizeof(struct ebt_counter))
                 return -ENOMEM;
-        if (tmp.num_counters == 0)
-                return -EINVAL;
 
         tmp.name[sizeof(tmp.name) - 1] = 0;
 
@@ -2161,8 +2159,6 @@ static int compat_copy_ebt_replace_from_user(struct ebt_replace *repl,
                 return -ENOMEM;
         if (tmp.num_counters >= INT_MAX / sizeof(struct ebt_counter))
                 return -ENOMEM;
-        if (tmp.num_counters == 0)
-                return -EINVAL;
 
         memcpy(repl, &tmp, offsetof(struct ebt_replace, hook_entry));
 
diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index 1347e11f5cc9..1d00b8922902 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -359,15 +359,7 @@ static int ethtool_get_settings(struct net_device *dev, void __user *useraddr)
         int err;
         struct ethtool_cmd cmd;
 
-        if (!dev->ethtool_ops->get_settings)
-                return -EOPNOTSUPP;
-
-        if (copy_from_user(&cmd, useraddr, sizeof(cmd)))
-                return -EFAULT;
-
-        cmd.cmd = ETHTOOL_GSET;
-
-        err = dev->ethtool_ops->get_settings(dev, &cmd);
+        err = __ethtool_get_settings(dev, &cmd);
         if (err < 0)
                 return err;
 
diff --git a/net/dsa/dsa.c b/net/dsa/dsa.c
index e6f6cc3a1bcf..392e29a0227d 100644
--- a/net/dsa/dsa.c
+++ b/net/dsa/dsa.c
@@ -359,7 +359,7 @@ dsa_switch_setup(struct dsa_switch_tree *dst, int index,
          */
         ds = kzalloc(sizeof(*ds) + drv->priv_size, GFP_KERNEL);
         if (ds == NULL)
-                return NULL;
+                return ERR_PTR(-ENOMEM);
 
         ds->dst = dst;
         ds->index = index;
@@ -370,7 +370,7 @@ dsa_switch_setup(struct dsa_switch_tree *dst, int index,
 
         ret = dsa_switch_setup_one(ds, parent);
         if (ret)
-                return NULL;
+                return ERR_PTR(ret);
 
         return ds;
 }
diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
index 421a80b09b62..30b544f025ac 100644
--- a/net/ipv4/esp4.c
+++ b/net/ipv4/esp4.c
@@ -256,7 +256,8 @@ static int esp_output(struct xfrm_state *x, struct sk_buff *skb)
         aead_givcrypt_set_crypt(req, sg, sg, clen, iv);
         aead_givcrypt_set_assoc(req, asg, assoclen);
         aead_givcrypt_set_giv(req, esph->enc_data,
-                              XFRM_SKB_CB(skb)->seq.output.low);
+                              XFRM_SKB_CB(skb)->seq.output.low +
+                              ((u64)XFRM_SKB_CB(skb)->seq.output.hi << 32));
 
         ESP_SKB_CB(skb)->tmp = tmp;
         err = crypto_aead_givencrypt(req);
diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c
index 9f7269f3c54a..0c152087ca15 100644
--- a/net/ipv4/ip_vti.c
+++ b/net/ipv4/ip_vti.c
@@ -65,7 +65,6 @@ static int vti_input(struct sk_buff *skb, int nexthdr, __be32 spi,
                         goto drop;
 
                 XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4 = tunnel;
-                skb->mark = be32_to_cpu(tunnel->parms.i_key);
 
                 return xfrm_input(skb, nexthdr, spi, encap_type);
         }
@@ -91,6 +90,8 @@ static int vti_rcv_cb(struct sk_buff *skb, int err)
         struct pcpu_sw_netstats *tstats;
         struct xfrm_state *x;
         struct ip_tunnel *tunnel = XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4;
+        u32 orig_mark = skb->mark;
+        int ret;
 
         if (!tunnel)
                 return 1;
@@ -107,7 +108,11 @@ static int vti_rcv_cb(struct sk_buff *skb, int err)
         x = xfrm_input_state(skb);
         family = x->inner_mode->afinfo->family;
 
-        if (!xfrm_policy_check(NULL, XFRM_POLICY_IN, skb, family))
+        skb->mark = be32_to_cpu(tunnel->parms.i_key);
+        ret = xfrm_policy_check(NULL, XFRM_POLICY_IN, skb, family);
+        skb->mark = orig_mark;
+
+        if (!ret)
                 return -EPERM;
 
         skb_scrub_packet(skb, !net_eq(tunnel->net, dev_net(skb->dev)));
@@ -216,8 +221,6 @@ static netdev_tx_t vti_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
 
         memset(&fl, 0, sizeof(fl));
 
-        skb->mark = be32_to_cpu(tunnel->parms.o_key);
-
         switch (skb->protocol) {
         case htons(ETH_P_IP):
                 xfrm_decode_session(skb, &fl, AF_INET);
@@ -233,6 +236,9 @@ static netdev_tx_t vti_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
                 return NETDEV_TX_OK;
         }
 
+        /* override mark with tunnel output key */
+        fl.flowi_mark = be32_to_cpu(tunnel->parms.o_key);
+
         return vti_xmit(skb, dev, &fl);
 }
 
diff --git a/net/ipv4/tcp_cong.c b/net/ipv4/tcp_cong.c
index 7a5ae50c80c8..84be008c945c 100644
--- a/net/ipv4/tcp_cong.c
+++ b/net/ipv4/tcp_cong.c
@@ -187,6 +187,7 @@ static void tcp_reinit_congestion_control(struct sock *sk,
 
         tcp_cleanup_congestion_control(sk);
         icsk->icsk_ca_ops = ca;
+        icsk->icsk_ca_setsockopt = 1;
 
         if (sk->sk_state != TCP_CLOSE && icsk->icsk_ca_ops->init)
                 icsk->icsk_ca_ops->init(sk);
@@ -335,8 +336,10 @@ int tcp_set_congestion_control(struct sock *sk, const char *name)
         rcu_read_lock();
         ca = __tcp_ca_find_autoload(name);
         /* No change asking for existing value */
-        if (ca == icsk->icsk_ca_ops)
+        if (ca == icsk->icsk_ca_ops) {
+                icsk->icsk_ca_setsockopt = 1;
                 goto out;
+        }
         if (!ca)
                 err = -ENOENT;
         else if (!((ca->flags & TCP_CONG_NON_RESTRICTED) ||
diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
index b5732a54f2ad..17e7339ee5ca 100644
--- a/net/ipv4/tcp_minisocks.c
+++ b/net/ipv4/tcp_minisocks.c
@@ -420,7 +420,10 @@ void tcp_ca_openreq_child(struct sock *sk, const struct dst_entry *dst)
                 rcu_read_unlock();
         }
 
-        if (!ca_got_dst && !try_module_get(icsk->icsk_ca_ops->owner))
+        /* If no valid choice made yet, assign current system default ca. */
+        if (!ca_got_dst &&
+            (!icsk->icsk_ca_setsockopt ||
+             !try_module_get(icsk->icsk_ca_ops->owner)))
                 tcp_assign_congestion_control(sk);
 
         tcp_set_ca_state(sk, TCP_CA_Open);
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index d10b7e0112eb..1c92ea67baef 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -1345,10 +1345,8 @@ csum_copy_err:
         }
         unlock_sock_fast(sk, slow);
 
-        if (noblock)
-                return -EAGAIN;
-
-        /* starting over for a new packet */
+        /* starting over for a new packet, but check if we need to yield */
+        cond_resched();
         msg->msg_flags &= ~MSG_TRUNC;
         goto try_again;
 }
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index 31f1b5d5e2ef..7c07ce36aae2 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -248,7 +248,8 @@ static int esp6_output(struct xfrm_state *x, struct sk_buff *skb)
         aead_givcrypt_set_crypt(req, sg, sg, clen, iv);
         aead_givcrypt_set_assoc(req, asg, assoclen);
         aead_givcrypt_set_giv(req, esph->enc_data,
-                              XFRM_SKB_CB(skb)->seq.output.low);
+                              XFRM_SKB_CB(skb)->seq.output.low +
+                              ((u64)XFRM_SKB_CB(skb)->seq.output.hi << 32));
 
         ESP_SKB_CB(skb)->tmp = tmp;
         err = crypto_aead_givencrypt(req);
diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c
index ed9d681207fa..0224c032dca5 100644
--- a/net/ipv6/ip6_vti.c
+++ b/net/ipv6/ip6_vti.c
@@ -322,7 +322,6 @@ static int vti6_rcv(struct sk_buff *skb)
                 }
 
                 XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6 = t;
-                skb->mark = be32_to_cpu(t->parms.i_key);
 
                 rcu_read_unlock();
 
@@ -342,6 +341,8 @@ static int vti6_rcv_cb(struct sk_buff *skb, int err)
         struct pcpu_sw_netstats *tstats;
         struct xfrm_state *x;
         struct ip6_tnl *t = XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6;
+        u32 orig_mark = skb->mark;
+        int ret;
 
         if (!t)
                 return 1;
@@ -358,7 +359,11 @@ static int vti6_rcv_cb(struct sk_buff *skb, int err)
         x = xfrm_input_state(skb);
         family = x->inner_mode->afinfo->family;
 
-        if (!xfrm_policy_check(NULL, XFRM_POLICY_IN, skb, family))
+        skb->mark = be32_to_cpu(t->parms.i_key);
+        ret = xfrm_policy_check(NULL, XFRM_POLICY_IN, skb, family);
+        skb->mark = orig_mark;
+
+        if (!ret)
                 return -EPERM;
 
         skb_scrub_packet(skb, !net_eq(t->net, dev_net(skb->dev)));
@@ -430,6 +435,7 @@ vti6_xmit(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)
         struct net_device *tdev;
         struct xfrm_state *x;
         int err = -1;
+        int mtu;
 
         if (!dst)
                 goto tx_err_link_failure;
@@ -463,6 +469,19 @@ vti6_xmit(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)
         skb_dst_set(skb, dst);
         skb->dev = skb_dst(skb)->dev;
 
+        mtu = dst_mtu(dst);
+        if (!skb->ignore_df && skb->len > mtu) {
+                skb_dst(skb)->ops->update_pmtu(dst, NULL, skb, mtu);
+
+                if (skb->protocol == htons(ETH_P_IPV6))
+                        icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
+                else
+                        icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED,
+                                  htonl(mtu));
+
+                return -EMSGSIZE;
+        }
+
         err = dst_output(skb);
         if (net_xmit_eval(err) == 0) {
                 struct pcpu_sw_netstats *tstats = this_cpu_ptr(dev->tstats);
@@ -495,7 +514,6 @@ vti6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
         int ret;
 
         memset(&fl, 0, sizeof(fl));
-        skb->mark = be32_to_cpu(t->parms.o_key);
 
         switch (skb->protocol) {
         case htons(ETH_P_IPV6):
@@ -516,6 +534,9 @@ vti6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
                 goto tx_err;
         }
 
+        /* override mark with tunnel output key */
+        fl.flowi_mark = be32_to_cpu(t->parms.o_key);
+
         ret = vti6_xmit(skb, dev, &fl);
         if (ret < 0)
                 goto tx_err;
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index c2ec41617a35..e51fc3eee6db 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -525,10 +525,8 @@ csum_copy_err:
         }
         unlock_sock_fast(sk, slow);
 
-        if (noblock)
-                return -EAGAIN;
-
-        /* starting over for a new packet */
+        /* starting over for a new packet, but check if we need to yield */
+        cond_resched();
         msg->msg_flags &= ~MSG_TRUNC;
         goto try_again;
 }
diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c
index 526c4feb3b50..b58286ecd156 100644
--- a/net/xfrm/xfrm_input.c
+++ b/net/xfrm/xfrm_input.c
@@ -13,6 +13,8 @@
 #include <net/dst.h>
 #include <net/ip.h>
 #include <net/xfrm.h>
+#include <net/ip_tunnels.h>
+#include <net/ip6_tunnel.h>
 
 static struct kmem_cache *secpath_cachep __read_mostly;
 
@@ -186,6 +188,7 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
         struct xfrm_state *x = NULL;
         xfrm_address_t *daddr;
         struct xfrm_mode *inner_mode;
+        u32 mark = skb->mark;
         unsigned int family;
         int decaps = 0;
         int async = 0;
@@ -203,6 +206,18 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
                                    XFRM_SPI_SKB_CB(skb)->daddroff);
         family = XFRM_SPI_SKB_CB(skb)->family;
 
+        /* if tunnel is present override skb->mark value with tunnel i_key */
+        if (XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4) {
+                switch (family) {
+                case AF_INET:
+                        mark = be32_to_cpu(XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4->parms.i_key);
+                        break;
+                case AF_INET6:
+                        mark = be32_to_cpu(XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6->parms.i_key);
+                        break;
+                }
+        }
+
         /* Allocate new secpath or COW existing one. */
         if (!skb->sp || atomic_read(&skb->sp->refcnt) != 1) {
                 struct sec_path *sp;
@@ -229,7 +244,7 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
                         goto drop;
                 }
 
-                x = xfrm_state_lookup(net, skb->mark, daddr, spi, nexthdr, family);
+                x = xfrm_state_lookup(net, mark, daddr, spi, nexthdr, family);
                 if (x == NULL) {
                         XFRM_INC_STATS(net, LINUX_MIB_XFRMINNOSTATES);
                         xfrm_audit_state_notfound(skb, family, spi, seq);
diff --git a/net/xfrm/xfrm_replay.c b/net/xfrm/xfrm_replay.c
index dab57daae408..4fd725a0c500 100644
--- a/net/xfrm/xfrm_replay.c
+++ b/net/xfrm/xfrm_replay.c
@@ -99,6 +99,7 @@ static int xfrm_replay_overflow(struct xfrm_state *x, struct sk_buff *skb)
 
         if (x->type->flags & XFRM_TYPE_REPLAY_PROT) {
                 XFRM_SKB_CB(skb)->seq.output.low = ++x->replay.oseq;
+                XFRM_SKB_CB(skb)->seq.output.hi = 0;
                 if (unlikely(x->replay.oseq == 0)) {
                         x->replay.oseq--;
                         xfrm_audit_state_replay_overflow(x, skb);
@@ -177,6 +178,7 @@ static int xfrm_replay_overflow_bmp(struct xfrm_state *x, struct sk_buff *skb)
 
         if (x->type->flags & XFRM_TYPE_REPLAY_PROT) {
                 XFRM_SKB_CB(skb)->seq.output.low = ++replay_esn->oseq;
+                XFRM_SKB_CB(skb)->seq.output.hi = 0;
                 if (unlikely(replay_esn->oseq == 0)) {
                         replay_esn->oseq--;
                         xfrm_audit_state_replay_overflow(x, skb);
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index f5e39e35d73a..96688cd0f6f1 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -927,8 +927,8 @@ struct xfrm_state *xfrm_state_lookup_byspi(struct net *net, __be32 spi,
                         x->id.spi != spi)
                         continue;
 
-                spin_unlock_bh(&net->xfrm.xfrm_state_lock);
                 xfrm_state_hold(x);
+                spin_unlock_bh(&net->xfrm.xfrm_state_lock);
                 return x;
         }
         spin_unlock_bh(&net->xfrm.xfrm_state_lock);