[gentoo-commits] proj/linux-patches:4.16 commit in: /

[Mike Pagano]

commit:     54039fa3feac7ed37530054550520d924419b496
Author:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Mon Apr 30 10:30:35 2018 +0000
Commit:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Mon Apr 30 10:30:35 2018 +0000
URL:        https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=54039fa3

Linux patch 4.16.6

 0000_README             |    4 +
 1005_linux-4.16.6.patch | 3759 +++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 3763 insertions(+)

diff --git a/0000_README b/0000_README
index 344c387..d4182dc 100644
--- a/0000_README
+++ b/0000_README
@@ -63,6 +63,10 @@ Patch:  1004_linux-4.16.5.patch
 From:   http://www.kernel.org
 Desc:   Linux 4.16.5
 
+Patch:  1005_linux-4.16.6.patch
+From:   http://www.kernel.org
+Desc:   Linux 4.16.6
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.

diff --git a/1005_linux-4.16.6.patch b/1005_linux-4.16.6.patch
new file mode 100644
index 0000000..e5b7089
--- /dev/null
+++ b/1005_linux-4.16.6.patch
@@ -0,0 +1,3759 @@
+diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
+index a553d4e4a0fb..f778901c4297 100644
+--- a/Documentation/networking/ip-sysctl.txt
++++ b/Documentation/networking/ip-sysctl.txt
+@@ -1386,26 +1386,26 @@ mld_qrv - INTEGER
+ 	Default: 2 (as specified by RFC3810 9.1)
+ 	Minimum: 1 (as specified by RFC6636 4.5)
+ 
+-max_dst_opts_cnt - INTEGER
++max_dst_opts_number - INTEGER
+ 	Maximum number of non-padding TLVs allowed in a Destination
+ 	options extension header. If this value is less than zero
+ 	then unknown options are disallowed and the number of known
+ 	TLVs allowed is the absolute value of this number.
+ 	Default: 8
+ 
+-max_hbh_opts_cnt - INTEGER
++max_hbh_opts_number - INTEGER
+ 	Maximum number of non-padding TLVs allowed in a Hop-by-Hop
+ 	options extension header. If this value is less than zero
+ 	then unknown options are disallowed and the number of known
+ 	TLVs allowed is the absolute value of this number.
+ 	Default: 8
+ 
+-max dst_opts_len - INTEGER
++max_dst_opts_length - INTEGER
+ 	Maximum length allowed for a Destination options extension
+ 	header.
+ 	Default: INT_MAX (unlimited)
+ 
+-max hbh_opts_len - INTEGER
++max_hbh_length - INTEGER
+ 	Maximum length allowed for a Hop-by-Hop options extension
+ 	header.
+ 	Default: INT_MAX (unlimited)
+diff --git a/Makefile b/Makefile
+index 6678a90f355b..41f07b2b7905 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 16
+-SUBLEVEL = 5
++SUBLEVEL = 6
+ EXTRAVERSION =
+ NAME = Fearless Coyote
+ 
+diff --git a/arch/s390/kernel/perf_cpum_cf_events.c b/arch/s390/kernel/perf_cpum_cf_events.c
+index 5ee27dc9a10c..feebb2944882 100644
+--- a/arch/s390/kernel/perf_cpum_cf_events.c
++++ b/arch/s390/kernel/perf_cpum_cf_events.c
+@@ -123,7 +123,7 @@ CPUMF_EVENT_ATTR(cf_zec12, L1I_OFFBOOK_L3_SOURCED_WRITES_IV, 0x00a1);
+ CPUMF_EVENT_ATTR(cf_zec12, TX_NC_TABORT, 0x00b1);
+ CPUMF_EVENT_ATTR(cf_zec12, TX_C_TABORT_NO_SPECIAL, 0x00b2);
+ CPUMF_EVENT_ATTR(cf_zec12, TX_C_TABORT_SPECIAL, 0x00b3);
+-CPUMF_EVENT_ATTR(cf_z13, L1D_WRITES_RO_EXCL, 0x0080);
++CPUMF_EVENT_ATTR(cf_z13, L1D_RO_EXCL_WRITES, 0x0080);
+ CPUMF_EVENT_ATTR(cf_z13, DTLB1_WRITES, 0x0081);
+ CPUMF_EVENT_ATTR(cf_z13, DTLB1_MISSES, 0x0082);
+ CPUMF_EVENT_ATTR(cf_z13, DTLB1_HPAGE_WRITES, 0x0083);
+@@ -179,7 +179,7 @@ CPUMF_EVENT_ATTR(cf_z13, TX_C_TABORT_NO_SPECIAL, 0x00db);
+ CPUMF_EVENT_ATTR(cf_z13, TX_C_TABORT_SPECIAL, 0x00dc);
+ CPUMF_EVENT_ATTR(cf_z13, MT_DIAG_CYCLES_ONE_THR_ACTIVE, 0x01c0);
+ CPUMF_EVENT_ATTR(cf_z13, MT_DIAG_CYCLES_TWO_THR_ACTIVE, 0x01c1);
+-CPUMF_EVENT_ATTR(cf_z14, L1D_WRITES_RO_EXCL, 0x0080);
++CPUMF_EVENT_ATTR(cf_z14, L1D_RO_EXCL_WRITES, 0x0080);
+ CPUMF_EVENT_ATTR(cf_z14, DTLB2_WRITES, 0x0081);
+ CPUMF_EVENT_ATTR(cf_z14, DTLB2_MISSES, 0x0082);
+ CPUMF_EVENT_ATTR(cf_z14, DTLB2_HPAGE_WRITES, 0x0083);
+@@ -371,7 +371,7 @@ static struct attribute *cpumcf_zec12_pmu_event_attr[] __initdata = {
+ };
+ 
+ static struct attribute *cpumcf_z13_pmu_event_attr[] __initdata = {
+-	CPUMF_EVENT_PTR(cf_z13, L1D_WRITES_RO_EXCL),
++	CPUMF_EVENT_PTR(cf_z13, L1D_RO_EXCL_WRITES),
+ 	CPUMF_EVENT_PTR(cf_z13, DTLB1_WRITES),
+ 	CPUMF_EVENT_PTR(cf_z13, DTLB1_MISSES),
+ 	CPUMF_EVENT_PTR(cf_z13, DTLB1_HPAGE_WRITES),
+@@ -431,7 +431,7 @@ static struct attribute *cpumcf_z13_pmu_event_attr[] __initdata = {
+ };
+ 
+ static struct attribute *cpumcf_z14_pmu_event_attr[] __initdata = {
+-	CPUMF_EVENT_PTR(cf_z14, L1D_WRITES_RO_EXCL),
++	CPUMF_EVENT_PTR(cf_z14, L1D_RO_EXCL_WRITES),
+ 	CPUMF_EVENT_PTR(cf_z14, DTLB2_WRITES),
+ 	CPUMF_EVENT_PTR(cf_z14, DTLB2_MISSES),
+ 	CPUMF_EVENT_PTR(cf_z14, DTLB2_HPAGE_WRITES),
+diff --git a/arch/s390/kernel/uprobes.c b/arch/s390/kernel/uprobes.c
+index d9d1f512f019..5007fac01bb5 100644
+--- a/arch/s390/kernel/uprobes.c
++++ b/arch/s390/kernel/uprobes.c
+@@ -150,6 +150,15 @@ unsigned long arch_uretprobe_hijack_return_addr(unsigned long trampoline,
+ 	return orig;
+ }
+ 
++bool arch_uretprobe_is_alive(struct return_instance *ret, enum rp_check ctx,
++			     struct pt_regs *regs)
++{
++	if (ctx == RP_CHECK_CHAIN_CALL)
++		return user_stack_pointer(regs) <= ret->stack;
++	else
++		return user_stack_pointer(regs) < ret->stack;
++}
++
+ /* Instruction Emulation */
+ 
+ static void adjust_psw_addr(psw_t *psw, unsigned long len)
+diff --git a/drivers/acpi/acpi_video.c b/drivers/acpi/acpi_video.c
+index 76fb96966f7b..2f2e737be0f8 100644
+--- a/drivers/acpi/acpi_video.c
++++ b/drivers/acpi/acpi_video.c
+@@ -2123,6 +2123,25 @@ static int __init intel_opregion_present(void)
+ 	return opregion;
+ }
+ 
++static bool dmi_is_desktop(void)
++{
++	const char *chassis_type;
++
++	chassis_type = dmi_get_system_info(DMI_CHASSIS_TYPE);
++	if (!chassis_type)
++		return false;
++
++	if (!strcmp(chassis_type, "3") || /*  3: Desktop */
++	    !strcmp(chassis_type, "4") || /*  4: Low Profile Desktop */
++	    !strcmp(chassis_type, "5") || /*  5: Pizza Box */
++	    !strcmp(chassis_type, "6") || /*  6: Mini Tower */
++	    !strcmp(chassis_type, "7") || /*  7: Tower */
++	    !strcmp(chassis_type, "11"))  /* 11: Main Server Chassis */
++		return true;
++
++	return false;
++}
++
+ int acpi_video_register(void)
+ {
+ 	int ret = 0;
+@@ -2143,8 +2162,12 @@ int acpi_video_register(void)
+ 	 * win8 ready (where we also prefer the native backlight driver, so
+ 	 * normally the acpi_video code should not register there anyways).
+ 	 */
+-	if (only_lcd == -1)
+-		only_lcd = acpi_osi_is_win8();
++	if (only_lcd == -1) {
++		if (dmi_is_desktop() && acpi_osi_is_win8())
++			only_lcd = true;
++		else
++			only_lcd = false;
++	}
+ 
+ 	dmi_check_system(video_dmi_table);
+ 
+diff --git a/drivers/block/swim.c b/drivers/block/swim.c
+index 64e066eba72e..0e31884a9519 100644
+--- a/drivers/block/swim.c
++++ b/drivers/block/swim.c
+@@ -110,7 +110,7 @@ struct iwm {
+ /* Select values for swim_select and swim_readbit */
+ 
+ #define READ_DATA_0	0x074
+-#define TWOMEG_DRIVE	0x075
++#define ONEMEG_DRIVE	0x075
+ #define SINGLE_SIDED	0x076
+ #define DRIVE_PRESENT	0x077
+ #define DISK_IN		0x170
+@@ -118,9 +118,9 @@ struct iwm {
+ #define TRACK_ZERO	0x172
+ #define TACHO		0x173
+ #define READ_DATA_1	0x174
+-#define MFM_MODE	0x175
++#define GCR_MODE	0x175
+ #define SEEK_COMPLETE	0x176
+-#define ONEMEG_MEDIA	0x177
++#define TWOMEG_MEDIA	0x177
+ 
+ /* Bits in handshake register */
+ 
+@@ -612,7 +612,6 @@ static void setup_medium(struct floppy_state *fs)
+ 		struct floppy_struct *g;
+ 		fs->disk_in = 1;
+ 		fs->write_protected = swim_readbit(base, WRITE_PROT);
+-		fs->type = swim_readbit(base, ONEMEG_MEDIA);
+ 
+ 		if (swim_track00(base))
+ 			printk(KERN_ERR
+@@ -620,6 +619,9 @@ static void setup_medium(struct floppy_state *fs)
+ 
+ 		swim_track00(base);
+ 
++		fs->type = swim_readbit(base, TWOMEG_MEDIA) ?
++			HD_MEDIA : DD_MEDIA;
++		fs->head_number = swim_readbit(base, SINGLE_SIDED) ? 1 : 2;
+ 		get_floppy_geometry(fs, 0, &g);
+ 		fs->total_secs = g->size;
+ 		fs->secpercyl = g->head * g->sect;
+@@ -646,7 +648,7 @@ static int floppy_open(struct block_device *bdev, fmode_t mode)
+ 
+ 	swim_write(base, setup, S_IBM_DRIVE  | S_FCLK_DIV2);
+ 	udelay(10);
+-	swim_drive(base, INTERNAL_DRIVE);
++	swim_drive(base, fs->location);
+ 	swim_motor(base, ON);
+ 	swim_action(base, SETMFM);
+ 	if (fs->ejected)
+@@ -656,6 +658,8 @@ static int floppy_open(struct block_device *bdev, fmode_t mode)
+ 		goto out;
+ 	}
+ 
++	set_capacity(fs->disk, fs->total_secs);
++
+ 	if (mode & FMODE_NDELAY)
+ 		return 0;
+ 
+@@ -727,14 +731,9 @@ static int floppy_ioctl(struct block_device *bdev, fmode_t mode,
+ 		if (copy_to_user((void __user *) param, (void *) &floppy_type,
+ 				 sizeof(struct floppy_struct)))
+ 			return -EFAULT;
+-		break;
+-
+-	default:
+-		printk(KERN_DEBUG "SWIM floppy_ioctl: unknown cmd %d\n",
+-		       cmd);
+-		return -ENOSYS;
++		return 0;
+ 	}
+-	return 0;
++	return -ENOTTY;
+ }
+ 
+ static int floppy_getgeo(struct block_device *bdev, struct hd_geometry *geo)
+@@ -795,7 +794,7 @@ static struct kobject *floppy_find(dev_t dev, int *part, void *data)
+ 	struct swim_priv *swd = data;
+ 	int drive = (*part & 3);
+ 
+-	if (drive > swd->floppy_count)
++	if (drive >= swd->floppy_count)
+ 		return NULL;
+ 
+ 	*part = 0;
+@@ -813,10 +812,9 @@ static int swim_add_floppy(struct swim_priv *swd, enum drive_location location)
+ 
+ 	swim_motor(base, OFF);
+ 
+-	if (swim_readbit(base, SINGLE_SIDED))
+-		fs->head_number = 1;
+-	else
+-		fs->head_number = 2;
++	fs->type = HD_MEDIA;
++	fs->head_number = 2;
++
+ 	fs->ref_count = 0;
+ 	fs->ejected = 1;
+ 
+@@ -834,10 +832,12 @@ static int swim_floppy_init(struct swim_priv *swd)
+ 	/* scan floppy drives */
+ 
+ 	swim_drive(base, INTERNAL_DRIVE);
+-	if (swim_readbit(base, DRIVE_PRESENT))
++	if (swim_readbit(base, DRIVE_PRESENT) &&
++	    !swim_readbit(base, ONEMEG_DRIVE))
+ 		swim_add_floppy(swd, INTERNAL_DRIVE);
+ 	swim_drive(base, EXTERNAL_DRIVE);
+-	if (swim_readbit(base, DRIVE_PRESENT))
++	if (swim_readbit(base, DRIVE_PRESENT) &&
++	    !swim_readbit(base, ONEMEG_DRIVE))
+ 		swim_add_floppy(swd, EXTERNAL_DRIVE);
+ 
+ 	/* register floppy drives */
+@@ -861,7 +861,6 @@ static int swim_floppy_init(struct swim_priv *swd)
+ 							      &swd->lock);
+ 		if (!swd->unit[drive].disk->queue) {
+ 			err = -ENOMEM;
+-			put_disk(swd->unit[drive].disk);
+ 			goto exit_put_disks;
+ 		}
+ 		blk_queue_bounce_limit(swd->unit[drive].disk->queue,
+@@ -911,7 +910,7 @@ static int swim_probe(struct platform_device *dev)
+ 		goto out;
+ 	}
+ 
+-	swim_base = ioremap(res->start, resource_size(res));
++	swim_base = (struct swim __iomem *)res->start;
+ 	if (!swim_base) {
+ 		ret = -ENOMEM;
+ 		goto out_release_io;
+@@ -923,7 +922,7 @@ static int swim_probe(struct platform_device *dev)
+ 	if (!get_swim_mode(swim_base)) {
+ 		printk(KERN_INFO "SWIM device not found !\n");
+ 		ret = -ENODEV;
+-		goto out_iounmap;
++		goto out_release_io;
+ 	}
+ 
+ 	/* set platform driver data */
+@@ -931,7 +930,7 @@ static int swim_probe(struct platform_device *dev)
+ 	swd = kzalloc(sizeof(struct swim_priv), GFP_KERNEL);
+ 	if (!swd) {
+ 		ret = -ENOMEM;
+-		goto out_iounmap;
++		goto out_release_io;
+ 	}
+ 	platform_set_drvdata(dev, swd);
+ 
+@@ -945,8 +944,6 @@ static int swim_probe(struct platform_device *dev)
+ 
+ out_kfree:
+ 	kfree(swd);
+-out_iounmap:
+-	iounmap(swim_base);
+ out_release_io:
+ 	release_mem_region(res->start, resource_size(res));
+ out:
+@@ -974,8 +971,6 @@ static int swim_remove(struct platform_device *dev)
+ 	for (drive = 0; drive < swd->floppy_count; drive++)
+ 		floppy_eject(&swd->unit[drive]);
+ 
+-	iounmap(swd->base);
+-
+ 	res = platform_get_resource(dev, IORESOURCE_MEM, 0);
+ 	if (res)
+ 		release_mem_region(res->start, resource_size(res));
+diff --git a/drivers/block/swim3.c b/drivers/block/swim3.c
+index af51015d056e..469541c1e51e 100644
+--- a/drivers/block/swim3.c
++++ b/drivers/block/swim3.c
+@@ -148,7 +148,7 @@ struct swim3 {
+ #define MOTOR_ON	2
+ #define RELAX		3	/* also eject in progress */
+ #define READ_DATA_0	4
+-#define TWOMEG_DRIVE	5
++#define ONEMEG_DRIVE	5
+ #define SINGLE_SIDED	6	/* drive or diskette is 4MB type? */
+ #define DRIVE_PRESENT	7
+ #define DISK_IN		8
+@@ -156,9 +156,9 @@ struct swim3 {
+ #define TRACK_ZERO	10
+ #define TACHO		11
+ #define READ_DATA_1	12
+-#define MFM_MODE	13
++#define GCR_MODE	13
+ #define SEEK_COMPLETE	14
+-#define ONEMEG_MEDIA	15
++#define TWOMEG_MEDIA	15
+ 
+ /* Definitions of values used in writing and formatting */
+ #define DATA_ESCAPE	0x99
+diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c
+index e36d160c458f..5f7d86509f2f 100644
+--- a/drivers/cdrom/cdrom.c
++++ b/drivers/cdrom/cdrom.c
+@@ -2374,7 +2374,7 @@ static int cdrom_ioctl_media_changed(struct cdrom_device_info *cdi,
+ 	if (!CDROM_CAN(CDC_SELECT_DISC) || arg == CDSL_CURRENT)
+ 		return media_changed(cdi, 1);
+ 
+-	if ((unsigned int)arg >= cdi->capacity)
++	if (arg >= cdi->capacity)
+ 		return -EINVAL;
+ 
+ 	info = kmalloc(sizeof(*info), GFP_KERNEL);
+diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interface.c
+index 248c04090dea..255db6fe15c8 100644
+--- a/drivers/char/tpm/tpm-interface.c
++++ b/drivers/char/tpm/tpm-interface.c
+@@ -369,20 +369,40 @@ static int tpm_validate_command(struct tpm_chip *chip,
+ 	return -EINVAL;
+ }
+ 
+-/**
+- * tmp_transmit - Internal kernel interface to transmit TPM commands.
+- *
+- * @chip: TPM chip to use
+- * @buf: TPM command buffer
+- * @bufsiz: length of the TPM command buffer
+- * @flags: tpm transmit flags - bitmap
+- *
+- * Return:
+- *     0 when the operation is successful.
+- *     A negative number for system errors (errno).
+- */
+-ssize_t tpm_transmit(struct tpm_chip *chip, struct tpm_space *space,
+-		     u8 *buf, size_t bufsiz, unsigned int flags)
++static int tpm_request_locality(struct tpm_chip *chip)
++{
++	int rc;
++
++	if (!chip->ops->request_locality)
++		return 0;
++
++	rc = chip->ops->request_locality(chip, 0);
++	if (rc < 0)
++		return rc;
++
++	chip->locality = rc;
++
++	return 0;
++}
++
++static void tpm_relinquish_locality(struct tpm_chip *chip)
++{
++	int rc;
++
++	if (!chip->ops->relinquish_locality)
++		return;
++
++	rc = chip->ops->relinquish_locality(chip, chip->locality);
++	if (rc)
++		dev_err(&chip->dev, "%s: : error %d\n", __func__, rc);
++
++	chip->locality = -1;
++}
++
++static ssize_t tpm_try_transmit(struct tpm_chip *chip,
++				struct tpm_space *space,
++				u8 *buf, size_t bufsiz,
++				unsigned int flags)
+ {
+ 	struct tpm_output_header *header = (void *)buf;
+ 	int rc;
+@@ -422,8 +442,6 @@ ssize_t tpm_transmit(struct tpm_chip *chip, struct tpm_space *space,
+ 	if (!(flags & TPM_TRANSMIT_UNLOCKED))
+ 		mutex_lock(&chip->tpm_mutex);
+ 
+-	if (chip->dev.parent)
+-		pm_runtime_get_sync(chip->dev.parent);
+ 
+ 	if (chip->ops->clk_enable != NULL)
+ 		chip->ops->clk_enable(chip, true);
+@@ -431,14 +449,15 @@ ssize_t tpm_transmit(struct tpm_chip *chip, struct tpm_space *space,
+ 	/* Store the decision as chip->locality will be changed. */
+ 	need_locality = chip->locality == -1;
+ 
+-	if (!(flags & TPM_TRANSMIT_RAW) &&
+-	    need_locality && chip->ops->request_locality)  {
+-		rc = chip->ops->request_locality(chip, 0);
++	if (!(flags & TPM_TRANSMIT_RAW) && need_locality) {
++		rc = tpm_request_locality(chip);
+ 		if (rc < 0)
+ 			goto out_no_locality;
+-		chip->locality = rc;
+ 	}
+ 
++	if (chip->dev.parent)
++		pm_runtime_get_sync(chip->dev.parent);
++
+ 	rc = tpm2_prepare_space(chip, space, ordinal, buf);
+ 	if (rc)
+ 		goto out;
+@@ -499,27 +518,83 @@ ssize_t tpm_transmit(struct tpm_chip *chip, struct tpm_space *space,
+ 	rc = tpm2_commit_space(chip, space, ordinal, buf, &len);
+ 
+ out:
+-	if (need_locality && chip->ops->relinquish_locality) {
+-		chip->ops->relinquish_locality(chip, chip->locality);
+-		chip->locality = -1;
+-	}
++	if (chip->dev.parent)
++		pm_runtime_put_sync(chip->dev.parent);
++
++	if (need_locality)
++		tpm_relinquish_locality(chip);
++
+ out_no_locality:
+ 	if (chip->ops->clk_enable != NULL)
+ 		chip->ops->clk_enable(chip, false);
+ 
+-	if (chip->dev.parent)
+-		pm_runtime_put_sync(chip->dev.parent);
+-
+ 	if (!(flags & TPM_TRANSMIT_UNLOCKED))
+ 		mutex_unlock(&chip->tpm_mutex);
+ 	return rc ? rc : len;
+ }
+ 
+ /**
+- * tmp_transmit_cmd - send a tpm command to the device
++ * tpm_transmit - Internal kernel interface to transmit TPM commands.
++ *
++ * @chip: TPM chip to use
++ * @space: tpm space
++ * @buf: TPM command buffer
++ * @bufsiz: length of the TPM command buffer
++ * @flags: tpm transmit flags - bitmap
++ *
++ * A wrapper around tpm_try_transmit that handles TPM2_RC_RETRY
++ * returns from the TPM and retransmits the command after a delay up
++ * to a maximum wait of TPM2_DURATION_LONG.
++ *
++ * Note: TPM1 never returns TPM2_RC_RETRY so the retry logic is TPM2
++ * only
++ *
++ * Return:
++ *     the length of the return when the operation is successful.
++ *     A negative number for system errors (errno).
++ */
++ssize_t tpm_transmit(struct tpm_chip *chip, struct tpm_space *space,
++		     u8 *buf, size_t bufsiz, unsigned int flags)
++{
++	struct tpm_output_header *header = (struct tpm_output_header *)buf;
++	/* space for header and handles */
++	u8 save[TPM_HEADER_SIZE + 3*sizeof(u32)];
++	unsigned int delay_msec = TPM2_DURATION_SHORT;
++	u32 rc = 0;
++	ssize_t ret;
++	const size_t save_size = min(space ? sizeof(save) : TPM_HEADER_SIZE,
++				     bufsiz);
++
++	/*
++	 * Subtlety here: if we have a space, the handles will be
++	 * transformed, so when we restore the header we also have to
++	 * restore the handles.
++	 */
++	memcpy(save, buf, save_size);
++
++	for (;;) {
++		ret = tpm_try_transmit(chip, space, buf, bufsiz, flags);
++		if (ret < 0)
++			break;
++		rc = be32_to_cpu(header->return_code);
++		if (rc != TPM2_RC_RETRY)
++			break;
++		delay_msec *= 2;
++		if (delay_msec > TPM2_DURATION_LONG) {
++			dev_err(&chip->dev, "TPM is in retry loop\n");
++			break;
++		}
++		tpm_msleep(delay_msec);
++		memcpy(buf, save, save_size);
++	}
++	return ret;
++}
++/**
++ * tpm_transmit_cmd - send a tpm command to the device
+  *    The function extracts tpm out header return code
+  *
+  * @chip: TPM chip to use
++ * @space: tpm space
+  * @buf: TPM command buffer
+  * @bufsiz: length of the buffer
+  * @min_rsp_body_length: minimum expected length of response body
+diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h
+index f895fba4e20d..d73f3fb81b42 100644
+--- a/drivers/char/tpm/tpm.h
++++ b/drivers/char/tpm/tpm.h
+@@ -108,6 +108,7 @@ enum tpm2_return_codes {
+ 	TPM2_RC_COMMAND_CODE    = 0x0143,
+ 	TPM2_RC_TESTING		= 0x090A, /* RC_WARN */
+ 	TPM2_RC_REFERENCE_H0	= 0x0910,
++	TPM2_RC_RETRY		= 0x0922,
+ };
+ 
+ enum tpm2_algorithms {
+diff --git a/drivers/char/tpm/tpm_crb.c b/drivers/char/tpm/tpm_crb.c
+index 7b3c2a8aa9de..497edd9848cd 100644
+--- a/drivers/char/tpm/tpm_crb.c
++++ b/drivers/char/tpm/tpm_crb.c
+@@ -112,6 +112,25 @@ struct tpm2_crb_smc {
+ 	u32 smc_func_id;
+ };
+ 
++static bool crb_wait_for_reg_32(u32 __iomem *reg, u32 mask, u32 value,
++				unsigned long timeout)
++{
++	ktime_t start;
++	ktime_t stop;
++
++	start = ktime_get();
++	stop = ktime_add(start, ms_to_ktime(timeout));
++
++	do {
++		if ((ioread32(reg) & mask) == value)
++			return true;
++
++		usleep_range(50, 100);
++	} while (ktime_before(ktime_get(), stop));
++
++	return ((ioread32(reg) & mask) == value);
++}
++
+ /**
+  * crb_go_idle - request tpm crb device to go the idle state
+  *
+@@ -128,7 +147,7 @@ struct tpm2_crb_smc {
+  *
+  * Return: 0 always
+  */
+-static int __maybe_unused crb_go_idle(struct device *dev, struct crb_priv *priv)
++static int crb_go_idle(struct device *dev, struct crb_priv *priv)
+ {
+ 	if ((priv->sm == ACPI_TPM2_START_METHOD) ||
+ 	    (priv->sm == ACPI_TPM2_COMMAND_BUFFER_WITH_START_METHOD) ||
+@@ -136,30 +155,17 @@ static int __maybe_unused crb_go_idle(struct device *dev, struct crb_priv *priv)
+ 		return 0;
+ 
+ 	iowrite32(CRB_CTRL_REQ_GO_IDLE, &priv->regs_t->ctrl_req);
+-	/* we don't really care when this settles */
+ 
++	if (!crb_wait_for_reg_32(&priv->regs_t->ctrl_req,
++				 CRB_CTRL_REQ_GO_IDLE/* mask */,
++				 0, /* value */
++				 TPM2_TIMEOUT_C)) {
++		dev_warn(dev, "goIdle timed out\n");
++		return -ETIME;
++	}
+ 	return 0;
+ }
+ 
+-static bool crb_wait_for_reg_32(u32 __iomem *reg, u32 mask, u32 value,
+-				unsigned long timeout)
+-{
+-	ktime_t start;
+-	ktime_t stop;
+-
+-	start = ktime_get();
+-	stop = ktime_add(start, ms_to_ktime(timeout));
+-
+-	do {
+-		if ((ioread32(reg) & mask) == value)
+-			return true;
+-
+-		usleep_range(50, 100);
+-	} while (ktime_before(ktime_get(), stop));
+-
+-	return false;
+-}
+-
+ /**
+  * crb_cmd_ready - request tpm crb device to enter ready state
+  *
+@@ -175,8 +181,7 @@ static bool crb_wait_for_reg_32(u32 __iomem *reg, u32 mask, u32 value,
+  *
+  * Return: 0 on success -ETIME on timeout;
+  */
+-static int __maybe_unused crb_cmd_ready(struct device *dev,
+-					struct crb_priv *priv)
++static int crb_cmd_ready(struct device *dev, struct crb_priv *priv)
+ {
+ 	if ((priv->sm == ACPI_TPM2_START_METHOD) ||
+ 	    (priv->sm == ACPI_TPM2_COMMAND_BUFFER_WITH_START_METHOD) ||
+@@ -195,11 +200,11 @@ static int __maybe_unused crb_cmd_ready(struct device *dev,
+ 	return 0;
+ }
+ 
+-static int crb_request_locality(struct tpm_chip *chip, int loc)
++static int __crb_request_locality(struct device *dev,
++				  struct crb_priv *priv, int loc)
+ {
+-	struct crb_priv *priv = dev_get_drvdata(&chip->dev);
+ 	u32 value = CRB_LOC_STATE_LOC_ASSIGNED |
+-		CRB_LOC_STATE_TPM_REG_VALID_STS;
++		    CRB_LOC_STATE_TPM_REG_VALID_STS;
+ 
+ 	if (!priv->regs_h)
+ 		return 0;
+@@ -207,21 +212,45 @@ static int crb_request_locality(struct tpm_chip *chip, int loc)
+ 	iowrite32(CRB_LOC_CTRL_REQUEST_ACCESS, &priv->regs_h->loc_ctrl);
+ 	if (!crb_wait_for_reg_32(&priv->regs_h->loc_state, value, value,
+ 				 TPM2_TIMEOUT_C)) {
+-		dev_warn(&chip->dev, "TPM_LOC_STATE_x.requestAccess timed out\n");
++		dev_warn(dev, "TPM_LOC_STATE_x.requestAccess timed out\n");
+ 		return -ETIME;
+ 	}
+ 
+ 	return 0;
+ }
+ 
+-static void crb_relinquish_locality(struct tpm_chip *chip, int loc)
++static int crb_request_locality(struct tpm_chip *chip, int loc)
+ {
+ 	struct crb_priv *priv = dev_get_drvdata(&chip->dev);
+ 
++	return __crb_request_locality(&chip->dev, priv, loc);
++}
++
++static int __crb_relinquish_locality(struct device *dev,
++				     struct crb_priv *priv, int loc)
++{
++	u32 mask = CRB_LOC_STATE_LOC_ASSIGNED |
++		   CRB_LOC_STATE_TPM_REG_VALID_STS;
++	u32 value = CRB_LOC_STATE_TPM_REG_VALID_STS;
++
+ 	if (!priv->regs_h)
+-		return;
++		return 0;
+ 
+ 	iowrite32(CRB_LOC_CTRL_RELINQUISH, &priv->regs_h->loc_ctrl);
++	if (!crb_wait_for_reg_32(&priv->regs_h->loc_state, mask, value,
++				 TPM2_TIMEOUT_C)) {
++		dev_warn(dev, "TPM_LOC_STATE_x.requestAccess timed out\n");
++		return -ETIME;
++	}
++
++	return 0;
++}
++
++static int crb_relinquish_locality(struct tpm_chip *chip, int loc)
++{
++	struct crb_priv *priv = dev_get_drvdata(&chip->dev);
++
++	return __crb_relinquish_locality(&chip->dev, priv, loc);
+ }
+ 
+ static u8 crb_status(struct tpm_chip *chip)
+@@ -475,6 +504,10 @@ static int crb_map_io(struct acpi_device *device, struct crb_priv *priv,
+ 			dev_warn(dev, FW_BUG "Bad ACPI memory layout");
+ 	}
+ 
++	ret = __crb_request_locality(dev, priv, 0);
++	if (ret)
++		return ret;
++
+ 	priv->regs_t = crb_map_res(dev, priv, &io_res, buf->control_address,
+ 				   sizeof(struct crb_regs_tail));
+ 	if (IS_ERR(priv->regs_t))
+@@ -531,6 +564,8 @@ static int crb_map_io(struct acpi_device *device, struct crb_priv *priv,
+ 
+ 	crb_go_idle(dev, priv);
+ 
++	__crb_relinquish_locality(dev, priv, 0);
++
+ 	return ret;
+ }
+ 
+@@ -588,10 +623,14 @@ static int crb_acpi_add(struct acpi_device *device)
+ 	chip->acpi_dev_handle = device->handle;
+ 	chip->flags = TPM_CHIP_FLAG_TPM2;
+ 
+-	rc  = crb_cmd_ready(dev, priv);
++	rc = __crb_request_locality(dev, priv, 0);
+ 	if (rc)
+ 		return rc;
+ 
++	rc  = crb_cmd_ready(dev, priv);
++	if (rc)
++		goto out;
++
+ 	pm_runtime_get_noresume(dev);
+ 	pm_runtime_set_active(dev);
+ 	pm_runtime_enable(dev);
+@@ -601,12 +640,15 @@ static int crb_acpi_add(struct acpi_device *device)
+ 		crb_go_idle(dev, priv);
+ 		pm_runtime_put_noidle(dev);
+ 		pm_runtime_disable(dev);
+-		return rc;
++		goto out;
+ 	}
+ 
+-	pm_runtime_put(dev);
++	pm_runtime_put_sync(dev);
+ 
+-	return 0;
++out:
++	__crb_relinquish_locality(dev, priv, 0);
++
++	return rc;
+ }
+ 
+ static int crb_acpi_remove(struct acpi_device *device)
+diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c
+index da074e3db19b..5a1f47b43947 100644
+--- a/drivers/char/tpm/tpm_tis_core.c
++++ b/drivers/char/tpm/tpm_tis_core.c
+@@ -143,11 +143,13 @@ static bool check_locality(struct tpm_chip *chip, int l)
+ 	return false;
+ }
+ 
+-static void release_locality(struct tpm_chip *chip, int l)
++static int release_locality(struct tpm_chip *chip, int l)
+ {
+ 	struct tpm_tis_data *priv = dev_get_drvdata(&chip->dev);
+ 
+ 	tpm_tis_write8(priv, TPM_ACCESS(l), TPM_ACCESS_ACTIVE_LOCALITY);
++
++	return 0;
+ }
+ 
+ static int request_locality(struct tpm_chip *chip, int l)
+diff --git a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c
+index a38db40ce990..b2447ee3b245 100644
+--- a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c
++++ b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c
+@@ -1637,6 +1637,8 @@ static void dw_hdmi_clear_overflow(struct dw_hdmi *hdmi)
+ 	 * (and possibly on the platform). So far only i.MX6Q (v1.30a) and
+ 	 * i.MX6DL (v1.31a) have been identified as needing the workaround, with
+ 	 * 4 and 1 iterations respectively.
++	 * The Amlogic Meson GX SoCs (v2.01a) have been identified as needing
++	 * the workaround with a single iteration.
+ 	 */
+ 
+ 	switch (hdmi->version) {
+@@ -1644,6 +1646,7 @@ static void dw_hdmi_clear_overflow(struct dw_hdmi *hdmi)
+ 		count = 4;
+ 		break;
+ 	case 0x131a:
++	case 0x201a:
+ 		count = 1;
+ 		break;
+ 	default:
+diff --git a/drivers/hwmon/k10temp.c b/drivers/hwmon/k10temp.c
+index 051a72eecb24..d2cc55e21374 100644
+--- a/drivers/hwmon/k10temp.c
++++ b/drivers/hwmon/k10temp.c
+@@ -40,6 +40,10 @@ static DEFINE_MUTEX(nb_smu_ind_mutex);
+ #define PCI_DEVICE_ID_AMD_17H_DF_F3	0x1463
+ #endif
+ 
++#ifndef PCI_DEVICE_ID_AMD_17H_RR_NB
++#define PCI_DEVICE_ID_AMD_17H_RR_NB	0x15d0
++#endif
++
+ /* CPUID function 0x80000001, ebx */
+ #define CPUID_PKGTYPE_MASK	0xf0000000
+ #define CPUID_PKGTYPE_F		0x00000000
+@@ -72,6 +76,7 @@ struct k10temp_data {
+ 	struct pci_dev *pdev;
+ 	void (*read_tempreg)(struct pci_dev *pdev, u32 *regval);
+ 	int temp_offset;
++	u32 temp_adjust_mask;
+ };
+ 
+ struct tctl_offset {
+@@ -84,6 +89,7 @@ static const struct tctl_offset tctl_offset_table[] = {
+ 	{ 0x17, "AMD Ryzen 5 1600X", 20000 },
+ 	{ 0x17, "AMD Ryzen 7 1700X", 20000 },
+ 	{ 0x17, "AMD Ryzen 7 1800X", 20000 },
++	{ 0x17, "AMD Ryzen 7 2700X", 10000 },
+ 	{ 0x17, "AMD Ryzen Threadripper 1950X", 27000 },
+ 	{ 0x17, "AMD Ryzen Threadripper 1920X", 27000 },
+ 	{ 0x17, "AMD Ryzen Threadripper 1900X", 27000 },
+@@ -129,6 +135,8 @@ static ssize_t temp1_input_show(struct device *dev,
+ 
+ 	data->read_tempreg(data->pdev, &regval);
+ 	temp = (regval >> 21) * 125;
++	if (regval & data->temp_adjust_mask)
++		temp -= 49000;
+ 	if (temp > data->temp_offset)
+ 		temp -= data->temp_offset;
+ 	else
+@@ -259,12 +267,14 @@ static int k10temp_probe(struct pci_dev *pdev,
+ 	data->pdev = pdev;
+ 
+ 	if (boot_cpu_data.x86 == 0x15 && (boot_cpu_data.x86_model == 0x60 ||
+-					  boot_cpu_data.x86_model == 0x70))
++					  boot_cpu_data.x86_model == 0x70)) {
+ 		data->read_tempreg = read_tempreg_nb_f15;
+-	else if (boot_cpu_data.x86 == 0x17)
++	} else if (boot_cpu_data.x86 == 0x17) {
++		data->temp_adjust_mask = 0x80000;
+ 		data->read_tempreg = read_tempreg_nb_f17;
+-	else
++	} else {
+ 		data->read_tempreg = read_tempreg_pci;
++	}
+ 
+ 	for (i = 0; i < ARRAY_SIZE(tctl_offset_table); i++) {
+ 		const struct tctl_offset *entry = &tctl_offset_table[i];
+@@ -292,6 +302,7 @@ static const struct pci_device_id k10temp_id_table[] = {
+ 	{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_16H_NB_F3) },
+ 	{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_16H_M30H_NB_F3) },
+ 	{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_17H_DF_F3) },
++	{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_17H_RR_NB) },
+ 	{}
+ };
+ MODULE_DEVICE_TABLE(pci, k10temp_id_table);
+diff --git a/drivers/message/fusion/mptsas.c b/drivers/message/fusion/mptsas.c
+index 439ee9c5f535..c59b5da85321 100644
+--- a/drivers/message/fusion/mptsas.c
++++ b/drivers/message/fusion/mptsas.c
+@@ -1994,6 +1994,7 @@ static struct scsi_host_template mptsas_driver_template = {
+ 	.cmd_per_lun			= 7,
+ 	.use_clustering			= ENABLE_CLUSTERING,
+ 	.shost_attrs			= mptscsih_host_attrs,
++	.no_write_same			= 1,
+ };
+ 
+ static int mptsas_get_linkerrors(struct sas_phy *phy)
+diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
+index b7b113018853..718e4914e3a0 100644
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -1660,8 +1660,7 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev,
+ 	} /* switch(bond_mode) */
+ 
+ #ifdef CONFIG_NET_POLL_CONTROLLER
+-	slave_dev->npinfo = bond->dev->npinfo;
+-	if (slave_dev->npinfo) {
++	if (bond->dev->npinfo) {
+ 		if (slave_enable_netpoll(new_slave)) {
+ 			netdev_info(bond_dev, "master_dev is using netpoll, but new slave device does not support netpoll\n");
+ 			res = -EBUSY;
+diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-common.h b/drivers/net/ethernet/amd/xgbe/xgbe-common.h
+index 7ea72ef11a55..d272dc6984ac 100644
+--- a/drivers/net/ethernet/amd/xgbe/xgbe-common.h
++++ b/drivers/net/ethernet/amd/xgbe/xgbe-common.h
+@@ -1321,6 +1321,10 @@
+ #define MDIO_VEND2_AN_STAT		0x8002
+ #endif
+ 
++#ifndef MDIO_VEND2_PMA_CDR_CONTROL
++#define MDIO_VEND2_PMA_CDR_CONTROL	0x8056
++#endif
++
+ #ifndef MDIO_CTRL1_SPEED1G
+ #define MDIO_CTRL1_SPEED1G		(MDIO_CTRL1_SPEED10G & ~BMCR_SPEED100)
+ #endif
+@@ -1369,6 +1373,10 @@
+ #define XGBE_AN_CL37_TX_CONFIG_MASK	0x08
+ #define XGBE_AN_CL37_MII_CTRL_8BIT	0x0100
+ 
++#define XGBE_PMA_CDR_TRACK_EN_MASK	0x01
++#define XGBE_PMA_CDR_TRACK_EN_OFF	0x00
++#define XGBE_PMA_CDR_TRACK_EN_ON	0x01
++
+ /* Bit setting and getting macros
+  *  The get macro will extract the current bit field value from within
+  *  the variable
+diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-debugfs.c b/drivers/net/ethernet/amd/xgbe/xgbe-debugfs.c
+index 7d128be61310..b91143947ed2 100644
+--- a/drivers/net/ethernet/amd/xgbe/xgbe-debugfs.c
++++ b/drivers/net/ethernet/amd/xgbe/xgbe-debugfs.c
+@@ -519,6 +519,22 @@ void xgbe_debugfs_init(struct xgbe_prv_data *pdata)
+ 				   "debugfs_create_file failed\n");
+ 	}
+ 
++	if (pdata->vdata->an_cdr_workaround) {
++		pfile = debugfs_create_bool("an_cdr_workaround", 0600,
++					    pdata->xgbe_debugfs,
++					    &pdata->debugfs_an_cdr_workaround);
++		if (!pfile)
++			netdev_err(pdata->netdev,
++				   "debugfs_create_bool failed\n");
++
++		pfile = debugfs_create_bool("an_cdr_track_early", 0600,
++					    pdata->xgbe_debugfs,
++					    &pdata->debugfs_an_cdr_track_early);
++		if (!pfile)
++			netdev_err(pdata->netdev,
++				   "debugfs_create_bool failed\n");
++	}
++
+ 	kfree(buf);
+ }
+ 
+diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-main.c b/drivers/net/ethernet/amd/xgbe/xgbe-main.c
+index d91fa595be98..e31d9d1fb6a6 100644
+--- a/drivers/net/ethernet/amd/xgbe/xgbe-main.c
++++ b/drivers/net/ethernet/amd/xgbe/xgbe-main.c
+@@ -349,6 +349,7 @@ int xgbe_config_netdev(struct xgbe_prv_data *pdata)
+ 	XGMAC_SET_BITS(pdata->rss_options, MAC_RSSCR, UDP4TE, 1);
+ 
+ 	/* Call MDIO/PHY initialization routine */
++	pdata->debugfs_an_cdr_workaround = pdata->vdata->an_cdr_workaround;
+ 	ret = pdata->phy_if.phy_init(pdata);
+ 	if (ret)
+ 		return ret;
+diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
+index 072b9f664597..1b45cd73a258 100644
+--- a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
++++ b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
+@@ -432,11 +432,16 @@ static void xgbe_an73_disable(struct xgbe_prv_data *pdata)
+ 	xgbe_an73_set(pdata, false, false);
+ 	xgbe_an73_disable_interrupts(pdata);
+ 
++	pdata->an_start = 0;
++
+ 	netif_dbg(pdata, link, pdata->netdev, "CL73 AN disabled\n");
+ }
+ 
+ static void xgbe_an_restart(struct xgbe_prv_data *pdata)
+ {
++	if (pdata->phy_if.phy_impl.an_pre)
++		pdata->phy_if.phy_impl.an_pre(pdata);
++
+ 	switch (pdata->an_mode) {
+ 	case XGBE_AN_MODE_CL73:
+ 	case XGBE_AN_MODE_CL73_REDRV:
+@@ -453,6 +458,9 @@ static void xgbe_an_restart(struct xgbe_prv_data *pdata)
+ 
+ static void xgbe_an_disable(struct xgbe_prv_data *pdata)
+ {
++	if (pdata->phy_if.phy_impl.an_post)
++		pdata->phy_if.phy_impl.an_post(pdata);
++
+ 	switch (pdata->an_mode) {
+ 	case XGBE_AN_MODE_CL73:
+ 	case XGBE_AN_MODE_CL73_REDRV:
+@@ -505,11 +513,11 @@ static enum xgbe_an xgbe_an73_tx_training(struct xgbe_prv_data *pdata,
+ 		XMDIO_WRITE(pdata, MDIO_MMD_PMAPMD, MDIO_PMA_10GBR_PMD_CTRL,
+ 			    reg);
+ 
+-		if (pdata->phy_if.phy_impl.kr_training_post)
+-			pdata->phy_if.phy_impl.kr_training_post(pdata);
+-
+ 		netif_dbg(pdata, link, pdata->netdev,
+ 			  "KR training initiated\n");
++
++		if (pdata->phy_if.phy_impl.kr_training_post)
++			pdata->phy_if.phy_impl.kr_training_post(pdata);
+ 	}
+ 
+ 	return XGBE_AN_PAGE_RECEIVED;
+@@ -637,11 +645,11 @@ static enum xgbe_an xgbe_an73_incompat_link(struct xgbe_prv_data *pdata)
+ 			return XGBE_AN_NO_LINK;
+ 	}
+ 
+-	xgbe_an73_disable(pdata);
++	xgbe_an_disable(pdata);
+ 
+ 	xgbe_switch_mode(pdata);
+ 
+-	xgbe_an73_restart(pdata);
++	xgbe_an_restart(pdata);
+ 
+ 	return XGBE_AN_INCOMPAT_LINK;
+ }
+@@ -820,6 +828,9 @@ static void xgbe_an37_state_machine(struct xgbe_prv_data *pdata)
+ 		pdata->an_result = pdata->an_state;
+ 		pdata->an_state = XGBE_AN_READY;
+ 
++		if (pdata->phy_if.phy_impl.an_post)
++			pdata->phy_if.phy_impl.an_post(pdata);
++
+ 		netif_dbg(pdata, link, pdata->netdev, "CL37 AN result: %s\n",
+ 			  xgbe_state_as_string(pdata->an_result));
+ 	}
+@@ -903,6 +914,9 @@ static void xgbe_an73_state_machine(struct xgbe_prv_data *pdata)
+ 		pdata->kx_state = XGBE_RX_BPA;
+ 		pdata->an_start = 0;
+ 
++		if (pdata->phy_if.phy_impl.an_post)
++			pdata->phy_if.phy_impl.an_post(pdata);
++
+ 		netif_dbg(pdata, link, pdata->netdev, "CL73 AN result: %s\n",
+ 			  xgbe_state_as_string(pdata->an_result));
+ 	}
+diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-pci.c b/drivers/net/ethernet/amd/xgbe/xgbe-pci.c
+index eb23f9ba1a9a..82d1f416ee2a 100644
+--- a/drivers/net/ethernet/amd/xgbe/xgbe-pci.c
++++ b/drivers/net/ethernet/amd/xgbe/xgbe-pci.c
+@@ -456,6 +456,7 @@ static const struct xgbe_version_data xgbe_v2a = {
+ 	.irq_reissue_support		= 1,
+ 	.tx_desc_prefetch		= 5,
+ 	.rx_desc_prefetch		= 5,
++	.an_cdr_workaround		= 1,
+ };
+ 
+ static const struct xgbe_version_data xgbe_v2b = {
+@@ -470,6 +471,7 @@ static const struct xgbe_version_data xgbe_v2b = {
+ 	.irq_reissue_support		= 1,
+ 	.tx_desc_prefetch		= 5,
+ 	.rx_desc_prefetch		= 5,
++	.an_cdr_workaround		= 1,
+ };
+ 
+ static const struct pci_device_id xgbe_pci_table[] = {
+diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c b/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c
+index 3304a291aa96..aac884314000 100644
+--- a/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c
++++ b/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c
+@@ -147,6 +147,14 @@
+ /* Rate-change complete wait/retry count */
+ #define XGBE_RATECHANGE_COUNT		500
+ 
++/* CDR delay values for KR support (in usec) */
++#define XGBE_CDR_DELAY_INIT		10000
++#define XGBE_CDR_DELAY_INC		10000
++#define XGBE_CDR_DELAY_MAX		100000
++
++/* RRC frequency during link status check */
++#define XGBE_RRC_FREQUENCY		10
++
+ enum xgbe_port_mode {
+ 	XGBE_PORT_MODE_RSVD = 0,
+ 	XGBE_PORT_MODE_BACKPLANE,
+@@ -245,6 +253,10 @@ enum xgbe_sfp_speed {
+ #define XGBE_SFP_BASE_VENDOR_SN			4
+ #define XGBE_SFP_BASE_VENDOR_SN_LEN		16
+ 
++#define XGBE_SFP_EXTD_OPT1			1
++#define XGBE_SFP_EXTD_OPT1_RX_LOS		BIT(1)
++#define XGBE_SFP_EXTD_OPT1_TX_FAULT		BIT(3)
++
+ #define XGBE_SFP_EXTD_DIAG			28
+ #define XGBE_SFP_EXTD_DIAG_ADDR_CHANGE		BIT(2)
+ 
+@@ -324,6 +336,7 @@ struct xgbe_phy_data {
+ 
+ 	unsigned int sfp_gpio_address;
+ 	unsigned int sfp_gpio_mask;
++	unsigned int sfp_gpio_inputs;
+ 	unsigned int sfp_gpio_rx_los;
+ 	unsigned int sfp_gpio_tx_fault;
+ 	unsigned int sfp_gpio_mod_absent;
+@@ -355,6 +368,10 @@ struct xgbe_phy_data {
+ 	unsigned int redrv_addr;
+ 	unsigned int redrv_lane;
+ 	unsigned int redrv_model;
++
++	/* KR AN support */
++	unsigned int phy_cdr_notrack;
++	unsigned int phy_cdr_delay;
+ };
+ 
+ /* I2C, MDIO and GPIO lines are muxed, so only one device at a time */
+@@ -974,6 +991,49 @@ static void xgbe_phy_sfp_external_phy(struct xgbe_prv_data *pdata)
+ 	phy_data->sfp_phy_avail = 1;
+ }
+ 
++static bool xgbe_phy_check_sfp_rx_los(struct xgbe_phy_data *phy_data)
++{
++	u8 *sfp_extd = phy_data->sfp_eeprom.extd;
++
++	if (!(sfp_extd[XGBE_SFP_EXTD_OPT1] & XGBE_SFP_EXTD_OPT1_RX_LOS))
++		return false;
++
++	if (phy_data->sfp_gpio_mask & XGBE_GPIO_NO_RX_LOS)
++		return false;
++
++	if (phy_data->sfp_gpio_inputs & (1 << phy_data->sfp_gpio_rx_los))
++		return true;
++
++	return false;
++}
++
++static bool xgbe_phy_check_sfp_tx_fault(struct xgbe_phy_data *phy_data)
++{
++	u8 *sfp_extd = phy_data->sfp_eeprom.extd;
++
++	if (!(sfp_extd[XGBE_SFP_EXTD_OPT1] & XGBE_SFP_EXTD_OPT1_TX_FAULT))
++		return false;
++
++	if (phy_data->sfp_gpio_mask & XGBE_GPIO_NO_TX_FAULT)
++		return false;
++
++	if (phy_data->sfp_gpio_inputs & (1 << phy_data->sfp_gpio_tx_fault))
++		return true;
++
++	return false;
++}
++
++static bool xgbe_phy_check_sfp_mod_absent(struct xgbe_phy_data *phy_data)
++{
++	if (phy_data->sfp_gpio_mask & XGBE_GPIO_NO_MOD_ABSENT)
++		return false;
++
++	if (phy_data->sfp_gpio_inputs & (1 << phy_data->sfp_gpio_mod_absent))
++		return true;
++
++	return false;
++}
++
+ static bool xgbe_phy_belfuse_parse_quirks(struct xgbe_prv_data *pdata)
+ {
+ 	struct xgbe_phy_data *phy_data = pdata->phy_data;
+@@ -1019,6 +1079,10 @@ static void xgbe_phy_sfp_parse_eeprom(struct xgbe_prv_data *pdata)
+ 	if (sfp_base[XGBE_SFP_BASE_EXT_ID] != XGBE_SFP_EXT_ID_SFP)
+ 		return;
+ 
++	/* Update transceiver signals (eeprom extd/options) */
++	phy_data->sfp_tx_fault = xgbe_phy_check_sfp_tx_fault(phy_data);
++	phy_data->sfp_rx_los = xgbe_phy_check_sfp_rx_los(phy_data);
++
+ 	if (xgbe_phy_sfp_parse_quirks(pdata))
+ 		return;
+ 
+@@ -1184,7 +1248,6 @@ static int xgbe_phy_sfp_read_eeprom(struct xgbe_prv_data *pdata)
+ static void xgbe_phy_sfp_signals(struct xgbe_prv_data *pdata)
+ {
+ 	struct xgbe_phy_data *phy_data = pdata->phy_data;
+-	unsigned int gpio_input;
+ 	u8 gpio_reg, gpio_ports[2];
+ 	int ret;
+ 
+@@ -1199,23 +1262,9 @@ static void xgbe_phy_sfp_signals(struct xgbe_prv_data *pdata)
+ 		return;
+ 	}
+ 
+-	gpio_input = (gpio_ports[1] << 8) | gpio_ports[0];
+-
+-	if (phy_data->sfp_gpio_mask & XGBE_GPIO_NO_MOD_ABSENT) {
+-		/* No GPIO, just assume the module is present for now */
+-		phy_data->sfp_mod_absent = 0;
+-	} else {
+-		if (!(gpio_input & (1 << phy_data->sfp_gpio_mod_absent)))
+-			phy_data->sfp_mod_absent = 0;
+-	}
+-
+-	if (!(phy_data->sfp_gpio_mask & XGBE_GPIO_NO_RX_LOS) &&
+-	    (gpio_input & (1 << phy_data->sfp_gpio_rx_los)))
+-		phy_data->sfp_rx_los = 1;
++	phy_data->sfp_gpio_inputs = (gpio_ports[1] << 8) | gpio_ports[0];
+ 
+-	if (!(phy_data->sfp_gpio_mask & XGBE_GPIO_NO_TX_FAULT) &&
+-	    (gpio_input & (1 << phy_data->sfp_gpio_tx_fault)))
+-		phy_data->sfp_tx_fault = 1;
++	phy_data->sfp_mod_absent = xgbe_phy_check_sfp_mod_absent(phy_data);
+ }
+ 
+ static void xgbe_phy_sfp_mod_absent(struct xgbe_prv_data *pdata)
+@@ -2361,7 +2410,7 @@ static int xgbe_phy_link_status(struct xgbe_prv_data *pdata, int *an_restart)
+ 		return 1;
+ 
+ 	/* No link, attempt a receiver reset cycle */
+-	if (phy_data->rrc_count++) {
++	if (phy_data->rrc_count++ > XGBE_RRC_FREQUENCY) {
+ 		phy_data->rrc_count = 0;
+ 		xgbe_phy_rrc(pdata);
+ 	}
+@@ -2669,6 +2718,103 @@ static bool xgbe_phy_port_enabled(struct xgbe_prv_data *pdata)
+ 	return true;
+ }
+ 
++static void xgbe_phy_cdr_track(struct xgbe_prv_data *pdata)
++{
++	struct xgbe_phy_data *phy_data = pdata->phy_data;
++
++	if (!pdata->debugfs_an_cdr_workaround)
++		return;
++
++	if (!phy_data->phy_cdr_notrack)
++		return;
++
++	usleep_range(phy_data->phy_cdr_delay,
++		     phy_data->phy_cdr_delay + 500);
++
++	XMDIO_WRITE_BITS(pdata, MDIO_MMD_PMAPMD, MDIO_VEND2_PMA_CDR_CONTROL,
++			 XGBE_PMA_CDR_TRACK_EN_MASK,
++			 XGBE_PMA_CDR_TRACK_EN_ON);
++
++	phy_data->phy_cdr_notrack = 0;
++}
++
++static void xgbe_phy_cdr_notrack(struct xgbe_prv_data *pdata)
++{
++	struct xgbe_phy_data *phy_data = pdata->phy_data;
++
++	if (!pdata->debugfs_an_cdr_workaround)
++		return;
++
++	if (phy_data->phy_cdr_notrack)
++		return;
++
++	XMDIO_WRITE_BITS(pdata, MDIO_MMD_PMAPMD, MDIO_VEND2_PMA_CDR_CONTROL,
++			 XGBE_PMA_CDR_TRACK_EN_MASK,
++			 XGBE_PMA_CDR_TRACK_EN_OFF);
++
++	xgbe_phy_rrc(pdata);
++
++	phy_data->phy_cdr_notrack = 1;
++}
++
++static void xgbe_phy_kr_training_post(struct xgbe_prv_data *pdata)
++{
++	if (!pdata->debugfs_an_cdr_track_early)
++		xgbe_phy_cdr_track(pdata);
++}
++
++static void xgbe_phy_kr_training_pre(struct xgbe_prv_data *pdata)
++{
++	if (pdata->debugfs_an_cdr_track_early)
++		xgbe_phy_cdr_track(pdata);
++}
++
++static void xgbe_phy_an_post(struct xgbe_prv_data *pdata)
++{
++	struct xgbe_phy_data *phy_data = pdata->phy_data;
++
++	switch (pdata->an_mode) {
++	case XGBE_AN_MODE_CL73:
++	case XGBE_AN_MODE_CL73_REDRV:
++		if (phy_data->cur_mode != XGBE_MODE_KR)
++			break;
++
++		xgbe_phy_cdr_track(pdata);
++
++		switch (pdata->an_result) {
++		case XGBE_AN_READY:
++		case XGBE_AN_COMPLETE:
++			break;
++		default:
++			if (phy_data->phy_cdr_delay < XGBE_CDR_DELAY_MAX)
++				phy_data->phy_cdr_delay += XGBE_CDR_DELAY_INC;
++			else
++				phy_data->phy_cdr_delay = XGBE_CDR_DELAY_INIT;
++			break;
++		}
++		break;
++	default:
++		break;
++	}
++}
++
++static void xgbe_phy_an_pre(struct xgbe_prv_data *pdata)
++{
++	struct xgbe_phy_data *phy_data = pdata->phy_data;
++
++	switch (pdata->an_mode) {
++	case XGBE_AN_MODE_CL73:
++	case XGBE_AN_MODE_CL73_REDRV:
++		if (phy_data->cur_mode != XGBE_MODE_KR)
++			break;
++
++		xgbe_phy_cdr_notrack(pdata);
++		break;
++	default:
++		break;
++	}
++}
++
+ static void xgbe_phy_stop(struct xgbe_prv_data *pdata)
+ {
+ 	struct xgbe_phy_data *phy_data = pdata->phy_data;
+@@ -2680,6 +2826,9 @@ static void xgbe_phy_stop(struct xgbe_prv_data *pdata)
+ 	xgbe_phy_sfp_reset(phy_data);
+ 	xgbe_phy_sfp_mod_absent(pdata);
+ 
++	/* Reset CDR support */
++	xgbe_phy_cdr_track(pdata);
++
+ 	/* Power off the PHY */
+ 	xgbe_phy_power_off(pdata);
+ 
+@@ -2712,6 +2861,9 @@ static int xgbe_phy_start(struct xgbe_prv_data *pdata)
+ 	/* Start in highest supported mode */
+ 	xgbe_phy_set_mode(pdata, phy_data->start_mode);
+ 
++	/* Reset CDR support */
++	xgbe_phy_cdr_track(pdata);
++
+ 	/* After starting the I2C controller, we can check for an SFP */
+ 	switch (phy_data->port_mode) {
+ 	case XGBE_PORT_MODE_SFP:
+@@ -3019,6 +3171,8 @@ static int xgbe_phy_init(struct xgbe_prv_data *pdata)
+ 		}
+ 	}
+ 
++	phy_data->phy_cdr_delay = XGBE_CDR_DELAY_INIT;
++
+ 	/* Register for driving external PHYs */
+ 	mii = devm_mdiobus_alloc(pdata->dev);
+ 	if (!mii) {
+@@ -3071,4 +3225,10 @@ void xgbe_init_function_ptrs_phy_v2(struct xgbe_phy_if *phy_if)
+ 	phy_impl->an_advertising	= xgbe_phy_an_advertising;
+ 
+ 	phy_impl->an_outcome		= xgbe_phy_an_outcome;
++
++	phy_impl->an_pre		= xgbe_phy_an_pre;
++	phy_impl->an_post		= xgbe_phy_an_post;
++
++	phy_impl->kr_training_pre	= xgbe_phy_kr_training_pre;
++	phy_impl->kr_training_post	= xgbe_phy_kr_training_post;
+ }
+diff --git a/drivers/net/ethernet/amd/xgbe/xgbe.h b/drivers/net/ethernet/amd/xgbe/xgbe.h
+index ad102c8bac7b..95d4b56448c6 100644
+--- a/drivers/net/ethernet/amd/xgbe/xgbe.h
++++ b/drivers/net/ethernet/amd/xgbe/xgbe.h
+@@ -833,6 +833,7 @@ struct xgbe_hw_if {
+ /* This structure represents implementation specific routines for an
+  * implementation of a PHY. All routines are required unless noted below.
+  *   Optional routines:
++ *     an_pre, an_post
+  *     kr_training_pre, kr_training_post
+  */
+ struct xgbe_phy_impl_if {
+@@ -875,6 +876,10 @@ struct xgbe_phy_impl_if {
+ 	/* Process results of auto-negotiation */
+ 	enum xgbe_mode (*an_outcome)(struct xgbe_prv_data *);
+ 
++	/* Pre/Post auto-negotiation support */
++	void (*an_pre)(struct xgbe_prv_data *);
++	void (*an_post)(struct xgbe_prv_data *);
++
+ 	/* Pre/Post KR training enablement support */
+ 	void (*kr_training_pre)(struct xgbe_prv_data *);
+ 	void (*kr_training_post)(struct xgbe_prv_data *);
+@@ -989,6 +994,7 @@ struct xgbe_version_data {
+ 	unsigned int irq_reissue_support;
+ 	unsigned int tx_desc_prefetch;
+ 	unsigned int rx_desc_prefetch;
++	unsigned int an_cdr_workaround;
+ };
+ 
+ struct xgbe_vxlan_data {
+@@ -1257,6 +1263,9 @@ struct xgbe_prv_data {
+ 	unsigned int debugfs_xprop_reg;
+ 
+ 	unsigned int debugfs_xi2c_reg;
++
++	bool debugfs_an_cdr_workaround;
++	bool debugfs_an_cdr_track_early;
+ };
+ 
+ /* Function prototypes*/
+diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
+index c96a92118b8b..32f6d2e24d66 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
++++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
+@@ -951,9 +951,11 @@ void aq_nic_shutdown(struct aq_nic_s *self)
+ 
+ 	netif_device_detach(self->ndev);
+ 
+-	err = aq_nic_stop(self);
+-	if (err < 0)
+-		goto err_exit;
++	if (netif_running(self->ndev)) {
++		err = aq_nic_stop(self);
++		if (err < 0)
++			goto err_exit;
++	}
+ 	aq_nic_deinit(self);
+ 
+ err_exit:
+diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c
+index d3b847ec7465..c58b2c227260 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c
++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c
+@@ -48,6 +48,8 @@
+ #define FORCE_FLASHLESS 0
+ 
+ static int hw_atl_utils_ver_match(u32 ver_expected, u32 ver_actual);
++static int hw_atl_utils_mpi_set_state(struct aq_hw_s *self,
++				      enum hal_atl_utils_fw_state_e state);
+ 
+ int hw_atl_utils_initfw(struct aq_hw_s *self, const struct aq_fw_ops **fw_ops)
+ {
+@@ -247,6 +249,20 @@ int hw_atl_utils_soft_reset(struct aq_hw_s *self)
+ 
+ 	self->rbl_enabled = (boot_exit_code != 0);
+ 
++	/* FW 1.x may bootup in an invalid POWER state (WOL feature).
++	 * We should work around this by forcing its state back to DEINIT
++	 */
++	if (!hw_atl_utils_ver_match(HW_ATL_FW_VER_1X,
++				    aq_hw_read_reg(self,
++						   HW_ATL_MPI_FW_VERSION))) {
++		int err = 0;
++
++		hw_atl_utils_mpi_set_state(self, MPI_DEINIT);
++		AQ_HW_WAIT_FOR((aq_hw_read_reg(self, HW_ATL_MPI_STATE_ADR) &
++			       HW_ATL_MPI_STATE_MSK) == MPI_DEINIT,
++			       10, 1000U);
++	}
++
+ 	if (self->rbl_enabled)
+ 		return hw_atl_utils_soft_reset_rbl(self);
+ 	else
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+index 1801582076be..9442605f4fd4 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+@@ -1874,22 +1874,39 @@ static char *bnxt_parse_pkglog(int desired_field, u8 *data, size_t datalen)
+ 	return retval;
+ }
+ 
+-static char *bnxt_get_pkgver(struct net_device *dev, char *buf, size_t buflen)
++static void bnxt_get_pkgver(struct net_device *dev)
+ {
++	struct bnxt *bp = netdev_priv(dev);
+ 	u16 index = 0;
+-	u32 datalen;
++	char *pkgver;
++	u32 pkglen;
++	u8 *pkgbuf;
++	int len;
+ 
+ 	if (bnxt_find_nvram_item(dev, BNX_DIR_TYPE_PKG_LOG,
+ 				 BNX_DIR_ORDINAL_FIRST, BNX_DIR_EXT_NONE,
+-				 &index, NULL, &datalen) != 0)
+-		return NULL;
++				 &index, NULL, &pkglen) != 0)
++		return;
+ 
+-	memset(buf, 0, buflen);
+-	if (bnxt_get_nvram_item(dev, index, 0, datalen, buf) != 0)
+-		return NULL;
++	pkgbuf = kzalloc(pkglen, GFP_KERNEL);
++	if (!pkgbuf) {
++		dev_err(&bp->pdev->dev, "Unable to allocate memory for pkg version, length = %u\n",
++			pkglen);
++		return;
++	}
++
++	if (bnxt_get_nvram_item(dev, index, 0, pkglen, pkgbuf))
++		goto err;
+ 
+-	return bnxt_parse_pkglog(BNX_PKG_LOG_FIELD_IDX_PKG_VERSION, buf,
+-		datalen);
++	pkgver = bnxt_parse_pkglog(BNX_PKG_LOG_FIELD_IDX_PKG_VERSION, pkgbuf,
++				   pkglen);
++	if (pkgver && *pkgver != 0 && isdigit(*pkgver)) {
++		len = strlen(bp->fw_ver_str);
++		snprintf(bp->fw_ver_str + len, FW_VER_STR_LEN - len - 1,
++			 "/pkg %s", pkgver);
++	}
++err:
++	kfree(pkgbuf);
+ }
+ 
+ static int bnxt_get_eeprom(struct net_device *dev,
+@@ -2558,22 +2575,10 @@ void bnxt_ethtool_init(struct bnxt *bp)
+ 	struct hwrm_selftest_qlist_input req = {0};
+ 	struct bnxt_test_info *test_info;
+ 	struct net_device *dev = bp->dev;
+-	char *pkglog;
+ 	int i, rc;
+ 
+-	pkglog = kzalloc(BNX_PKG_LOG_MAX_LENGTH, GFP_KERNEL);
+-	if (pkglog) {
+-		char *pkgver;
+-		int len;
++	bnxt_get_pkgver(dev);
+ 
+-		pkgver = bnxt_get_pkgver(dev, pkglog, BNX_PKG_LOG_MAX_LENGTH);
+-		if (pkgver && *pkgver != 0 && isdigit(*pkgver)) {
+-			len = strlen(bp->fw_ver_str);
+-			snprintf(bp->fw_ver_str + len, FW_VER_STR_LEN - len - 1,
+-				 "/pkg %s", pkgver);
+-		}
+-		kfree(pkglog);
+-	}
+ 	if (bp->hwrm_spec_code < 0x10704 || !BNXT_SINGLE_PF(bp))
+ 		return;
+ 
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_nvm_defs.h b/drivers/net/ethernet/broadcom/bnxt/bnxt_nvm_defs.h
+index 73f2249555b5..83444811d3c6 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_nvm_defs.h
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_nvm_defs.h
+@@ -59,8 +59,6 @@ enum bnxt_nvm_directory_type {
+ #define BNX_DIR_ATTR_NO_CHKSUM			(1 << 0)
+ #define BNX_DIR_ATTR_PROP_STREAM		(1 << 1)
+ 
+-#define BNX_PKG_LOG_MAX_LENGTH			4096
+-
+ enum bnxnvm_pkglog_field_index {
+ 	BNX_PKG_LOG_FIELD_IDX_INSTALLED_TIMESTAMP	= 0,
+ 	BNX_PKG_LOG_FIELD_IDX_PKG_DESCRIPTION		= 1,
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+index e9309fb9084b..21a21934e5bf 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+@@ -2889,6 +2889,7 @@ int i40e_ndo_set_vf_mac(struct net_device *netdev, int vf_id, u8 *mac)
+ 	int ret = 0;
+ 	struct hlist_node *h;
+ 	int bkt;
++	u8 i;
+ 
+ 	/* validate the request */
+ 	if (vf_id >= pf->num_alloc_vfs) {
+@@ -2900,6 +2901,16 @@ int i40e_ndo_set_vf_mac(struct net_device *netdev, int vf_id, u8 *mac)
+ 
+ 	vf = &(pf->vf[vf_id]);
+ 	vsi = pf->vsi[vf->lan_vsi_idx];
++
++	/* When the VF is resetting wait until it is done.
++	 * It can take up to 200 milliseconds,
++	 * but wait for up to 300 milliseconds to be safe.
++	 */
++	for (i = 0; i < 15; i++) {
++		if (test_bit(I40E_VF_STATE_INIT, &vf->vf_states))
++			break;
++		msleep(20);
++	}
+ 	if (!test_bit(I40E_VF_STATE_INIT, &vf->vf_states)) {
+ 		dev_err(&pf->pdev->dev, "VF %d still in reset. Try again.\n",
+ 			vf_id);
+diff --git a/drivers/net/ethernet/marvell/mvpp2.c b/drivers/net/ethernet/marvell/mvpp2.c
+index 5a1668cdb461..7f1083ce23da 100644
+--- a/drivers/net/ethernet/marvell/mvpp2.c
++++ b/drivers/net/ethernet/marvell/mvpp2.c
+@@ -838,6 +838,8 @@ enum mvpp2_bm_type {
+ 
+ #define MVPP2_MIB_COUNTERS_STATS_DELAY		(1 * HZ)
+ 
++#define MVPP2_DESC_DMA_MASK	DMA_BIT_MASK(40)
++
+ /* Definitions */
+ 
+ /* Shared Packet Processor resources */
+@@ -1336,7 +1338,7 @@ static dma_addr_t mvpp2_txdesc_dma_addr_get(struct mvpp2_port *port,
+ 	if (port->priv->hw_version == MVPP21)
+ 		return tx_desc->pp21.buf_dma_addr;
+ 	else
+-		return tx_desc->pp22.buf_dma_addr_ptp & GENMASK_ULL(40, 0);
++		return tx_desc->pp22.buf_dma_addr_ptp & MVPP2_DESC_DMA_MASK;
+ }
+ 
+ static void mvpp2_txdesc_dma_addr_set(struct mvpp2_port *port,
+@@ -1354,7 +1356,7 @@ static void mvpp2_txdesc_dma_addr_set(struct mvpp2_port *port,
+ 	} else {
+ 		u64 val = (u64)addr;
+ 
+-		tx_desc->pp22.buf_dma_addr_ptp &= ~GENMASK_ULL(40, 0);
++		tx_desc->pp22.buf_dma_addr_ptp &= ~MVPP2_DESC_DMA_MASK;
+ 		tx_desc->pp22.buf_dma_addr_ptp |= val;
+ 		tx_desc->pp22.packet_offset = offset;
+ 	}
+@@ -1414,7 +1416,7 @@ static dma_addr_t mvpp2_rxdesc_dma_addr_get(struct mvpp2_port *port,
+ 	if (port->priv->hw_version == MVPP21)
+ 		return rx_desc->pp21.buf_dma_addr;
+ 	else
+-		return rx_desc->pp22.buf_dma_addr_key_hash & GENMASK_ULL(40, 0);
++		return rx_desc->pp22.buf_dma_addr_key_hash & MVPP2_DESC_DMA_MASK;
+ }
+ 
+ static unsigned long mvpp2_rxdesc_cookie_get(struct mvpp2_port *port,
+@@ -1423,7 +1425,7 @@ static unsigned long mvpp2_rxdesc_cookie_get(struct mvpp2_port *port,
+ 	if (port->priv->hw_version == MVPP21)
+ 		return rx_desc->pp21.buf_cookie;
+ 	else
+-		return rx_desc->pp22.buf_cookie_misc & GENMASK_ULL(40, 0);
++		return rx_desc->pp22.buf_cookie_misc & MVPP2_DESC_DMA_MASK;
+ }
+ 
+ static size_t mvpp2_rxdesc_size_get(struct mvpp2_port *port,
+@@ -8347,7 +8349,7 @@ static int mvpp2_probe(struct platform_device *pdev)
+ 	}
+ 
+ 	if (priv->hw_version == MVPP22) {
+-		err = dma_set_mask(&pdev->dev, DMA_BIT_MASK(40));
++		err = dma_set_mask(&pdev->dev, MVPP2_DESC_DMA_MASK);
+ 		if (err)
+ 			goto err_mg_clk;
+ 		/* Sadly, the BM pools all share the same register to
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4.h b/drivers/net/ethernet/stmicro/stmmac/dwmac4.h
+index 7761a26ec9c5..e7565416639b 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4.h
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4.h
+@@ -343,7 +343,7 @@ enum power_event {
+ #define MTL_RX_OVERFLOW_INT		BIT(16)
+ 
+ /* Default operating mode of the MAC */
+-#define GMAC_CORE_INIT (GMAC_CONFIG_JD | GMAC_CONFIG_PS | GMAC_CONFIG_ACS | \
++#define GMAC_CORE_INIT (GMAC_CONFIG_JD | GMAC_CONFIG_PS | \
+ 			GMAC_CONFIG_BE | GMAC_CONFIG_DCRS)
+ 
+ /* To dump the core regs excluding  the Address Registers */
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
+index 63795ecafc8d..26dfb75e927a 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
+@@ -30,13 +30,6 @@ static void dwmac4_core_init(struct mac_device_info *hw,
+ 
+ 	value |= GMAC_CORE_INIT;
+ 
+-	/* Clear ACS bit because Ethernet switch tagging formats such as
+-	 * Broadcom tags can look like invalid LLC/SNAP packets and cause the
+-	 * hardware to truncate packets on reception.
+-	 */
+-	if (netdev_uses_dsa(dev))
+-		value &= ~GMAC_CONFIG_ACS;
+-
+ 	if (mtu > 1500)
+ 		value |= GMAC_CONFIG_2K;
+ 	if (mtu > 2000)
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+index 7ad841434ec8..3ea343b45d93 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -3435,8 +3435,13 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue)
+ 
+ 			/* ACS is set; GMAC core strips PAD/FCS for IEEE 802.3
+ 			 * Type frames (LLC/LLC-SNAP)
++			 *
++			 * llc_snap is never checked in GMAC >= 4, so this ACS
++			 * feature is always disabled and packets need to be
++			 * stripped manually.
+ 			 */
+-			if (unlikely(status != llc_snap))
++			if (unlikely(priv->synopsys_id >= DWMAC_CORE_4_00) ||
++			    unlikely(status != llc_snap))
+ 				frame_len -= ETH_FCS_LEN;
+ 
+ 			if (netif_msg_rx_status(priv)) {
+diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
+index b2b30c9df037..33c35b2df7d5 100644
+--- a/drivers/net/ethernet/ti/cpsw.c
++++ b/drivers/net/ethernet/ti/cpsw.c
+@@ -125,7 +125,7 @@ do {								\
+ 
+ #define RX_PRIORITY_MAPPING	0x76543210
+ #define TX_PRIORITY_MAPPING	0x33221100
+-#define CPDMA_TX_PRIORITY_MAP	0x01234567
++#define CPDMA_TX_PRIORITY_MAP	0x76543210
+ 
+ #define CPSW_VLAN_AWARE		BIT(1)
+ #define CPSW_ALE_VLAN_AWARE	1
+diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c
+index 9cbb0c8a896a..7de88b33d5b9 100644
+--- a/drivers/net/macsec.c
++++ b/drivers/net/macsec.c
+@@ -3277,7 +3277,7 @@ static int macsec_newlink(struct net *net, struct net_device *dev,
+ 
+ 	err = netdev_upper_dev_link(real_dev, dev, extack);
+ 	if (err < 0)
+-		goto put_dev;
++		goto unregister;
+ 
+ 	/* need to be already registered so that ->init has run and
+ 	 * the MAC addr is set
+@@ -3316,8 +3316,7 @@ static int macsec_newlink(struct net *net, struct net_device *dev,
+ 	macsec_del_dev(macsec);
+ unlink:
+ 	netdev_upper_dev_unlink(real_dev, dev);
+-put_dev:
+-	dev_put(real_dev);
++unregister:
+ 	unregister_netdevice(dev);
+ 	return err;
+ }
+diff --git a/drivers/net/ppp/pppoe.c b/drivers/net/ppp/pppoe.c
+index 5aa59f41bf8c..71e2aef6b7a1 100644
+--- a/drivers/net/ppp/pppoe.c
++++ b/drivers/net/ppp/pppoe.c
+@@ -620,6 +620,10 @@ static int pppoe_connect(struct socket *sock, struct sockaddr *uservaddr,
+ 	lock_sock(sk);
+ 
+ 	error = -EINVAL;
++
++	if (sockaddr_len != sizeof(struct sockaddr_pppox))
++		goto end;
++
+ 	if (sp->sa_protocol != PX_PROTO_OE)
+ 		goto end;
+ 
+diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
+index befed2d22bf4..3175f7410baf 100644
+--- a/drivers/net/team/team.c
++++ b/drivers/net/team/team.c
+@@ -261,6 +261,17 @@ static void __team_option_inst_mark_removed_port(struct team *team,
+ 	}
+ }
+ 
++static bool __team_option_inst_tmp_find(const struct list_head *opts,
++					const struct team_option_inst *needle)
++{
++	struct team_option_inst *opt_inst;
++
++	list_for_each_entry(opt_inst, opts, tmp_list)
++		if (opt_inst == needle)
++			return true;
++	return false;
++}
++
+ static int __team_options_register(struct team *team,
+ 				   const struct team_option *option,
+ 				   size_t option_count)
+@@ -1061,14 +1072,11 @@ static void team_port_leave(struct team *team, struct team_port *port)
+ }
+ 
+ #ifdef CONFIG_NET_POLL_CONTROLLER
+-static int team_port_enable_netpoll(struct team *team, struct team_port *port)
++static int __team_port_enable_netpoll(struct team_port *port)
+ {
+ 	struct netpoll *np;
+ 	int err;
+ 
+-	if (!team->dev->npinfo)
+-		return 0;
+-
+ 	np = kzalloc(sizeof(*np), GFP_KERNEL);
+ 	if (!np)
+ 		return -ENOMEM;
+@@ -1082,6 +1090,14 @@ static int team_port_enable_netpoll(struct team *team, struct team_port *port)
+ 	return err;
+ }
+ 
++static int team_port_enable_netpoll(struct team_port *port)
++{
++	if (!port->team->dev->npinfo)
++		return 0;
++
++	return __team_port_enable_netpoll(port);
++}
++
+ static void team_port_disable_netpoll(struct team_port *port)
+ {
+ 	struct netpoll *np = port->np;
+@@ -1096,7 +1112,7 @@ static void team_port_disable_netpoll(struct team_port *port)
+ 	kfree(np);
+ }
+ #else
+-static int team_port_enable_netpoll(struct team *team, struct team_port *port)
++static int team_port_enable_netpoll(struct team_port *port)
+ {
+ 	return 0;
+ }
+@@ -1204,7 +1220,7 @@ static int team_port_add(struct team *team, struct net_device *port_dev)
+ 		goto err_vids_add;
+ 	}
+ 
+-	err = team_port_enable_netpoll(team, port);
++	err = team_port_enable_netpoll(port);
+ 	if (err) {
+ 		netdev_err(dev, "Failed to enable netpoll on device %s\n",
+ 			   portname);
+@@ -1901,7 +1917,7 @@ static int team_netpoll_setup(struct net_device *dev,
+ 
+ 	mutex_lock(&team->lock);
+ 	list_for_each_entry(port, &team->port_list, list) {
+-		err = team_port_enable_netpoll(team, port);
++		err = __team_port_enable_netpoll(port);
+ 		if (err) {
+ 			__team_netpoll_cleanup(team);
+ 			break;
+@@ -2562,6 +2578,14 @@ static int team_nl_cmd_options_set(struct sk_buff *skb, struct genl_info *info)
+ 			if (err)
+ 				goto team_put;
+ 			opt_inst->changed = true;
++
++			/* dumb/evil user-space can send us duplicate opt,
++			 * keep only the last one
++			 */
++			if (__team_option_inst_tmp_find(&opt_inst_list,
++							opt_inst))
++				continue;
++
+ 			list_add(&opt_inst->tmp_list, &opt_inst_list);
+ 		}
+ 		if (!opt_found) {
+diff --git a/drivers/net/tun.c b/drivers/net/tun.c
+index 28cfa642e39a..6c7bdd0c361a 100644
+--- a/drivers/net/tun.c
++++ b/drivers/net/tun.c
+@@ -1094,12 +1094,7 @@ static netdev_tx_t tun_net_xmit(struct sk_buff *skb, struct net_device *dev)
+ 		goto drop;
+ 
+ 	len = run_ebpf_filter(tun, skb, len);
+-
+-	/* Trim extra bytes since we may insert vlan proto & TCI
+-	 * in tun_put_user().
+-	 */
+-	len -= skb_vlan_tag_present(skb) ? sizeof(struct veth) : 0;
+-	if (len <= 0 || pskb_trim(skb, len))
++	if (len == 0 || pskb_trim(skb, len))
+ 		goto drop;
+ 
+ 	if (unlikely(skb_orphan_frags_rx(skb, GFP_ATOMIC)))
+diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
+index ca066b785e9f..c853e7410f5a 100644
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -1107,6 +1107,7 @@ static const struct usb_device_id products[] = {
+ 	{QMI_FIXED_INTF(0x1435, 0xd181, 3)},	/* Wistron NeWeb D18Q1 */
+ 	{QMI_FIXED_INTF(0x1435, 0xd181, 4)},	/* Wistron NeWeb D18Q1 */
+ 	{QMI_FIXED_INTF(0x1435, 0xd181, 5)},	/* Wistron NeWeb D18Q1 */
++	{QMI_FIXED_INTF(0x1435, 0xd191, 4)},	/* Wistron NeWeb D19Q1 */
+ 	{QMI_FIXED_INTF(0x16d8, 0x6003, 0)},	/* CMOTech 6003 */
+ 	{QMI_FIXED_INTF(0x16d8, 0x6007, 0)},	/* CMOTech CHE-628S */
+ 	{QMI_FIXED_INTF(0x16d8, 0x6008, 0)},	/* CMOTech CMU-301 */
+diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
+index 23374603e4d9..aa21b2225679 100644
+--- a/drivers/net/virtio_net.c
++++ b/drivers/net/virtio_net.c
+@@ -147,6 +147,17 @@ struct receive_queue {
+ 	struct xdp_rxq_info xdp_rxq;
+ };
+ 
++/* Control VQ buffers: protected by the rtnl lock */
++struct control_buf {
++	struct virtio_net_ctrl_hdr hdr;
++	virtio_net_ctrl_ack status;
++	struct virtio_net_ctrl_mq mq;
++	u8 promisc;
++	u8 allmulti;
++	__virtio16 vid;
++	u64 offloads;
++};
++
+ struct virtnet_info {
+ 	struct virtio_device *vdev;
+ 	struct virtqueue *cvq;
+@@ -192,14 +203,7 @@ struct virtnet_info {
+ 	struct hlist_node node;
+ 	struct hlist_node node_dead;
+ 
+-	/* Control VQ buffers: protected by the rtnl lock */
+-	struct virtio_net_ctrl_hdr ctrl_hdr;
+-	virtio_net_ctrl_ack ctrl_status;
+-	struct virtio_net_ctrl_mq ctrl_mq;
+-	u8 ctrl_promisc;
+-	u8 ctrl_allmulti;
+-	u16 ctrl_vid;
+-	u64 ctrl_offloads;
++	struct control_buf *ctrl;
+ 
+ 	/* Ethtool settings */
+ 	u8 duplex;
+@@ -1269,7 +1273,9 @@ static int virtnet_poll(struct napi_struct *napi, int budget)
+ {
+ 	struct receive_queue *rq =
+ 		container_of(napi, struct receive_queue, napi);
+-	unsigned int received;
++	struct virtnet_info *vi = rq->vq->vdev->priv;
++	struct send_queue *sq;
++	unsigned int received, qp;
+ 	bool xdp_xmit = false;
+ 
+ 	virtnet_poll_cleantx(rq);
+@@ -1280,8 +1286,13 @@ static int virtnet_poll(struct napi_struct *napi, int budget)
+ 	if (received < budget)
+ 		virtqueue_napi_complete(napi, rq->vq, received);
+ 
+-	if (xdp_xmit)
++	if (xdp_xmit) {
++		qp = vi->curr_queue_pairs - vi->xdp_queue_pairs +
++		     smp_processor_id();
++		sq = &vi->sq[qp];
++		virtqueue_kick(sq->vq);
+ 		xdp_do_flush_map();
++	}
+ 
+ 	return received;
+ }
+@@ -1454,25 +1465,25 @@ static bool virtnet_send_command(struct virtnet_info *vi, u8 class, u8 cmd,
+ 	/* Caller should know better */
+ 	BUG_ON(!virtio_has_feature(vi->vdev, VIRTIO_NET_F_CTRL_VQ));
+ 
+-	vi->ctrl_status = ~0;
+-	vi->ctrl_hdr.class = class;
+-	vi->ctrl_hdr.cmd = cmd;
++	vi->ctrl->status = ~0;
++	vi->ctrl->hdr.class = class;
++	vi->ctrl->hdr.cmd = cmd;
+ 	/* Add header */
+-	sg_init_one(&hdr, &vi->ctrl_hdr, sizeof(vi->ctrl_hdr));
++	sg_init_one(&hdr, &vi->ctrl->hdr, sizeof(vi->ctrl->hdr));
+ 	sgs[out_num++] = &hdr;
+ 
+ 	if (out)
+ 		sgs[out_num++] = out;
+ 
+ 	/* Add return status. */
+-	sg_init_one(&stat, &vi->ctrl_status, sizeof(vi->ctrl_status));
++	sg_init_one(&stat, &vi->ctrl->status, sizeof(vi->ctrl->status));
+ 	sgs[out_num] = &stat;
+ 
+ 	BUG_ON(out_num + 1 > ARRAY_SIZE(sgs));
+ 	virtqueue_add_sgs(vi->cvq, sgs, out_num, 1, vi, GFP_ATOMIC);
+ 
+ 	if (unlikely(!virtqueue_kick(vi->cvq)))
+-		return vi->ctrl_status == VIRTIO_NET_OK;
++		return vi->ctrl->status == VIRTIO_NET_OK;
+ 
+ 	/* Spin for a response, the kick causes an ioport write, trapping
+ 	 * into the hypervisor, so the request should be handled immediately.
+@@ -1481,7 +1492,7 @@ static bool virtnet_send_command(struct virtnet_info *vi, u8 class, u8 cmd,
+ 	       !virtqueue_is_broken(vi->cvq))
+ 		cpu_relax();
+ 
+-	return vi->ctrl_status == VIRTIO_NET_OK;
++	return vi->ctrl->status == VIRTIO_NET_OK;
+ }
+ 
+ static int virtnet_set_mac_address(struct net_device *dev, void *p)
+@@ -1593,8 +1604,8 @@ static int _virtnet_set_queues(struct virtnet_info *vi, u16 queue_pairs)
+ 	if (!vi->has_cvq || !virtio_has_feature(vi->vdev, VIRTIO_NET_F_MQ))
+ 		return 0;
+ 
+-	vi->ctrl_mq.virtqueue_pairs = cpu_to_virtio16(vi->vdev, queue_pairs);
+-	sg_init_one(&sg, &vi->ctrl_mq, sizeof(vi->ctrl_mq));
++	vi->ctrl->mq.virtqueue_pairs = cpu_to_virtio16(vi->vdev, queue_pairs);
++	sg_init_one(&sg, &vi->ctrl->mq, sizeof(vi->ctrl->mq));
+ 
+ 	if (!virtnet_send_command(vi, VIRTIO_NET_CTRL_MQ,
+ 				  VIRTIO_NET_CTRL_MQ_VQ_PAIRS_SET, &sg)) {
+@@ -1653,22 +1664,22 @@ static void virtnet_set_rx_mode(struct net_device *dev)
+ 	if (!virtio_has_feature(vi->vdev, VIRTIO_NET_F_CTRL_RX))
+ 		return;
+ 
+-	vi->ctrl_promisc = ((dev->flags & IFF_PROMISC) != 0);
+-	vi->ctrl_allmulti = ((dev->flags & IFF_ALLMULTI) != 0);
++	vi->ctrl->promisc = ((dev->flags & IFF_PROMISC) != 0);
++	vi->ctrl->allmulti = ((dev->flags & IFF_ALLMULTI) != 0);
+ 
+-	sg_init_one(sg, &vi->ctrl_promisc, sizeof(vi->ctrl_promisc));
++	sg_init_one(sg, &vi->ctrl->promisc, sizeof(vi->ctrl->promisc));
+ 
+ 	if (!virtnet_send_command(vi, VIRTIO_NET_CTRL_RX,
+ 				  VIRTIO_NET_CTRL_RX_PROMISC, sg))
+ 		dev_warn(&dev->dev, "Failed to %sable promisc mode.\n",
+-			 vi->ctrl_promisc ? "en" : "dis");
++			 vi->ctrl->promisc ? "en" : "dis");
+ 
+-	sg_init_one(sg, &vi->ctrl_allmulti, sizeof(vi->ctrl_allmulti));
++	sg_init_one(sg, &vi->ctrl->allmulti, sizeof(vi->ctrl->allmulti));
+ 
+ 	if (!virtnet_send_command(vi, VIRTIO_NET_CTRL_RX,
+ 				  VIRTIO_NET_CTRL_RX_ALLMULTI, sg))
+ 		dev_warn(&dev->dev, "Failed to %sable allmulti mode.\n",
+-			 vi->ctrl_allmulti ? "en" : "dis");
++			 vi->ctrl->allmulti ? "en" : "dis");
+ 
+ 	uc_count = netdev_uc_count(dev);
+ 	mc_count = netdev_mc_count(dev);
+@@ -1714,8 +1725,8 @@ static int virtnet_vlan_rx_add_vid(struct net_device *dev,
+ 	struct virtnet_info *vi = netdev_priv(dev);
+ 	struct scatterlist sg;
+ 
+-	vi->ctrl_vid = vid;
+-	sg_init_one(&sg, &vi->ctrl_vid, sizeof(vi->ctrl_vid));
++	vi->ctrl->vid = cpu_to_virtio16(vi->vdev, vid);
++	sg_init_one(&sg, &vi->ctrl->vid, sizeof(vi->ctrl->vid));
+ 
+ 	if (!virtnet_send_command(vi, VIRTIO_NET_CTRL_VLAN,
+ 				  VIRTIO_NET_CTRL_VLAN_ADD, &sg))
+@@ -1729,8 +1740,8 @@ static int virtnet_vlan_rx_kill_vid(struct net_device *dev,
+ 	struct virtnet_info *vi = netdev_priv(dev);
+ 	struct scatterlist sg;
+ 
+-	vi->ctrl_vid = vid;
+-	sg_init_one(&sg, &vi->ctrl_vid, sizeof(vi->ctrl_vid));
++	vi->ctrl->vid = cpu_to_virtio16(vi->vdev, vid);
++	sg_init_one(&sg, &vi->ctrl->vid, sizeof(vi->ctrl->vid));
+ 
+ 	if (!virtnet_send_command(vi, VIRTIO_NET_CTRL_VLAN,
+ 				  VIRTIO_NET_CTRL_VLAN_DEL, &sg))
+@@ -2126,9 +2137,9 @@ static int virtnet_restore_up(struct virtio_device *vdev)
+ static int virtnet_set_guest_offloads(struct virtnet_info *vi, u64 offloads)
+ {
+ 	struct scatterlist sg;
+-	vi->ctrl_offloads = cpu_to_virtio64(vi->vdev, offloads);
++	vi->ctrl->offloads = cpu_to_virtio64(vi->vdev, offloads);
+ 
+-	sg_init_one(&sg, &vi->ctrl_offloads, sizeof(vi->ctrl_offloads));
++	sg_init_one(&sg, &vi->ctrl->offloads, sizeof(vi->ctrl->offloads));
+ 
+ 	if (!virtnet_send_command(vi, VIRTIO_NET_CTRL_GUEST_OFFLOADS,
+ 				  VIRTIO_NET_CTRL_GUEST_OFFLOADS_SET, &sg)) {
+@@ -2351,6 +2362,7 @@ static void virtnet_free_queues(struct virtnet_info *vi)
+ 
+ 	kfree(vi->rq);
+ 	kfree(vi->sq);
++	kfree(vi->ctrl);
+ }
+ 
+ static void _free_receive_bufs(struct virtnet_info *vi)
+@@ -2543,6 +2555,9 @@ static int virtnet_alloc_queues(struct virtnet_info *vi)
+ {
+ 	int i;
+ 
++	vi->ctrl = kzalloc(sizeof(*vi->ctrl), GFP_KERNEL);
++	if (!vi->ctrl)
++		goto err_ctrl;
+ 	vi->sq = kzalloc(sizeof(*vi->sq) * vi->max_queue_pairs, GFP_KERNEL);
+ 	if (!vi->sq)
+ 		goto err_sq;
+@@ -2571,6 +2586,8 @@ static int virtnet_alloc_queues(struct virtnet_info *vi)
+ err_rq:
+ 	kfree(vi->sq);
+ err_sq:
++	kfree(vi->ctrl);
++err_ctrl:
+ 	return -ENOMEM;
+ }
+ 
+diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
+index e04937f44f33..9ebe2a689966 100644
+--- a/drivers/net/vmxnet3/vmxnet3_drv.c
++++ b/drivers/net/vmxnet3/vmxnet3_drv.c
+@@ -1218,6 +1218,7 @@ vmxnet3_get_hdr_len(struct vmxnet3_adapter *adapter, struct sk_buff *skb,
+ 	union {
+ 		void *ptr;
+ 		struct ethhdr *eth;
++		struct vlan_ethhdr *veth;
+ 		struct iphdr *ipv4;
+ 		struct ipv6hdr *ipv6;
+ 		struct tcphdr *tcp;
+@@ -1228,16 +1229,24 @@ vmxnet3_get_hdr_len(struct vmxnet3_adapter *adapter, struct sk_buff *skb,
+ 	if (unlikely(sizeof(struct iphdr) + sizeof(struct tcphdr) > maplen))
+ 		return 0;
+ 
++	if (skb->protocol == cpu_to_be16(ETH_P_8021Q) ||
++	    skb->protocol == cpu_to_be16(ETH_P_8021AD))
++		hlen = sizeof(struct vlan_ethhdr);
++	else
++		hlen = sizeof(struct ethhdr);
++
+ 	hdr.eth = eth_hdr(skb);
+ 	if (gdesc->rcd.v4) {
+-		BUG_ON(hdr.eth->h_proto != htons(ETH_P_IP));
+-		hdr.ptr += sizeof(struct ethhdr);
++		BUG_ON(hdr.eth->h_proto != htons(ETH_P_IP) &&
++		       hdr.veth->h_vlan_encapsulated_proto != htons(ETH_P_IP));
++		hdr.ptr += hlen;
+ 		BUG_ON(hdr.ipv4->protocol != IPPROTO_TCP);
+ 		hlen = hdr.ipv4->ihl << 2;
+ 		hdr.ptr += hdr.ipv4->ihl << 2;
+ 	} else if (gdesc->rcd.v6) {
+-		BUG_ON(hdr.eth->h_proto != htons(ETH_P_IPV6));
+-		hdr.ptr += sizeof(struct ethhdr);
++		BUG_ON(hdr.eth->h_proto != htons(ETH_P_IPV6) &&
++		       hdr.veth->h_vlan_encapsulated_proto != htons(ETH_P_IPV6));
++		hdr.ptr += hlen;
+ 		/* Use an estimated value, since we also need to handle
+ 		 * TSO case.
+ 		 */
+diff --git a/drivers/net/vmxnet3/vmxnet3_int.h b/drivers/net/vmxnet3/vmxnet3_int.h
+index 59ec34052a65..a3326463b71f 100644
+--- a/drivers/net/vmxnet3/vmxnet3_int.h
++++ b/drivers/net/vmxnet3/vmxnet3_int.h
+@@ -69,10 +69,10 @@
+ /*
+  * Version numbers
+  */
+-#define VMXNET3_DRIVER_VERSION_STRING   "1.4.13.0-k"
++#define VMXNET3_DRIVER_VERSION_STRING   "1.4.14.0-k"
+ 
+ /* a 32-bit int, each byte encode a verion number in VMXNET3_DRIVER_VERSION */
+-#define VMXNET3_DRIVER_VERSION_NUM      0x01040d00
++#define VMXNET3_DRIVER_VERSION_NUM      0x01040e00
+ 
+ #if defined(CONFIG_PCI_MSI)
+ 	/* RSS only makes sense if MSI-X is supported. */
+diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
+index ebb3f1b046f3..800a86e2d671 100644
+--- a/drivers/net/wireless/ath/ath10k/mac.c
++++ b/drivers/net/wireless/ath/ath10k/mac.c
+@@ -6028,9 +6028,8 @@ static void ath10k_sta_rc_update_wk(struct work_struct *wk)
+ 				    sta->addr, smps, err);
+ 	}
+ 
+-	if (changed & IEEE80211_RC_SUPP_RATES_CHANGED ||
+-	    changed & IEEE80211_RC_NSS_CHANGED) {
+-		ath10k_dbg(ar, ATH10K_DBG_MAC, "mac update sta %pM supp rates/nss\n",
++	if (changed & IEEE80211_RC_SUPP_RATES_CHANGED) {
++		ath10k_dbg(ar, ATH10K_DBG_MAC, "mac update sta %pM supp rates\n",
+ 			   sta->addr);
+ 
+ 		err = ath10k_station_assoc(ar, arvif->vif, sta, true);
+diff --git a/drivers/pinctrl/intel/pinctrl-intel.c b/drivers/pinctrl/intel/pinctrl-intel.c
+index 96e73e30204e..5f111f0ee7ca 100644
+--- a/drivers/pinctrl/intel/pinctrl-intel.c
++++ b/drivers/pinctrl/intel/pinctrl-intel.c
+@@ -425,18 +425,6 @@ static void __intel_gpio_set_direction(void __iomem *padcfg0, bool input)
+ 	writel(value, padcfg0);
+ }
+ 
+-static void intel_gpio_set_gpio_mode(void __iomem *padcfg0)
+-{
+-	u32 value;
+-
+-	/* Put the pad into GPIO mode */
+-	value = readl(padcfg0) & ~PADCFG0_PMODE_MASK;
+-	/* Disable SCI/SMI/NMI generation */
+-	value &= ~(PADCFG0_GPIROUTIOXAPIC | PADCFG0_GPIROUTSCI);
+-	value &= ~(PADCFG0_GPIROUTSMI | PADCFG0_GPIROUTNMI);
+-	writel(value, padcfg0);
+-}
+-
+ static int intel_gpio_request_enable(struct pinctrl_dev *pctldev,
+ 				     struct pinctrl_gpio_range *range,
+ 				     unsigned pin)
+@@ -444,6 +432,7 @@ static int intel_gpio_request_enable(struct pinctrl_dev *pctldev,
+ 	struct intel_pinctrl *pctrl = pinctrl_dev_get_drvdata(pctldev);
+ 	void __iomem *padcfg0;
+ 	unsigned long flags;
++	u32 value;
+ 
+ 	raw_spin_lock_irqsave(&pctrl->lock, flags);
+ 
+@@ -453,7 +442,13 @@ static int intel_gpio_request_enable(struct pinctrl_dev *pctldev,
+ 	}
+ 
+ 	padcfg0 = intel_get_padcfg(pctrl, pin, PADCFG0);
+-	intel_gpio_set_gpio_mode(padcfg0);
++	/* Put the pad into GPIO mode */
++	value = readl(padcfg0) & ~PADCFG0_PMODE_MASK;
++	/* Disable SCI/SMI/NMI generation */
++	value &= ~(PADCFG0_GPIROUTIOXAPIC | PADCFG0_GPIROUTSCI);
++	value &= ~(PADCFG0_GPIROUTSMI | PADCFG0_GPIROUTNMI);
++	writel(value, padcfg0);
++
+ 	/* Disable TX buffer and enable RX (this will be input) */
+ 	__intel_gpio_set_direction(padcfg0, true);
+ 
+@@ -973,8 +968,6 @@ static int intel_gpio_irq_type(struct irq_data *d, unsigned type)
+ 
+ 	raw_spin_lock_irqsave(&pctrl->lock, flags);
+ 
+-	intel_gpio_set_gpio_mode(reg);
+-
+ 	value = readl(reg);
+ 
+ 	value &= ~(PADCFG0_RXEVCFG_MASK | PADCFG0_RXINV);
+diff --git a/drivers/s390/block/dasd_alias.c b/drivers/s390/block/dasd_alias.c
+index 62f5f04d8f61..5e963fe0e38d 100644
+--- a/drivers/s390/block/dasd_alias.c
++++ b/drivers/s390/block/dasd_alias.c
+@@ -592,13 +592,22 @@ static int _schedule_lcu_update(struct alias_lcu *lcu,
+ int dasd_alias_add_device(struct dasd_device *device)
+ {
+ 	struct dasd_eckd_private *private = device->private;
+-	struct alias_lcu *lcu;
++	__u8 uaddr = private->uid.real_unit_addr;
++	struct alias_lcu *lcu = private->lcu;
+ 	unsigned long flags;
+ 	int rc;
+ 
+-	lcu = private->lcu;
+ 	rc = 0;
+ 	spin_lock_irqsave(&lcu->lock, flags);
++	/*
++	 * Check if device and lcu type differ. If so, the uac data may be
++	 * outdated and needs to be updated.
++	 */
++	if (private->uid.type !=  lcu->uac->unit[uaddr].ua_type) {
++		lcu->flags |= UPDATE_PENDING;
++		DBF_DEV_EVENT(DBF_WARNING, device, "%s",
++			      "uid type mismatch - trigger rescan");
++	}
+ 	if (!(lcu->flags & UPDATE_PENDING)) {
+ 		rc = _add_device_to_lcu(lcu, device, device);
+ 		if (rc)
+diff --git a/drivers/s390/cio/chsc.c b/drivers/s390/cio/chsc.c
+index c08fc5a8df0c..aea0b25eff29 100644
+--- a/drivers/s390/cio/chsc.c
++++ b/drivers/s390/cio/chsc.c
+@@ -452,6 +452,7 @@ static void chsc_process_sei_link_incident(struct chsc_sei_nt0_area *sei_area)
+ 
+ static void chsc_process_sei_res_acc(struct chsc_sei_nt0_area *sei_area)
+ {
++	struct channel_path *chp;
+ 	struct chp_link link;
+ 	struct chp_id chpid;
+ 	int status;
+@@ -464,10 +465,17 @@ static void chsc_process_sei_res_acc(struct chsc_sei_nt0_area *sei_area)
+ 	chpid.id = sei_area->rsid;
+ 	/* allocate a new channel path structure, if needed */
+ 	status = chp_get_status(chpid);
+-	if (status < 0)
+-		chp_new(chpid);
+-	else if (!status)
++	if (!status)
+ 		return;
++
++	if (status < 0) {
++		chp_new(chpid);
++	} else {
++		chp = chpid_to_chp(chpid);
++		mutex_lock(&chp->lock);
++		chp_update_desc(chp);
++		mutex_unlock(&chp->lock);
++	}
+ 	memset(&link, 0, sizeof(struct chp_link));
+ 	link.chpid = chpid;
+ 	if ((sei_area->vf & 0xc0) != 0) {
+diff --git a/drivers/s390/net/qeth_core.h b/drivers/s390/net/qeth_core.h
+index 959c65cf75d9..e338ce823c44 100644
+--- a/drivers/s390/net/qeth_core.h
++++ b/drivers/s390/net/qeth_core.h
+@@ -565,7 +565,6 @@ enum qeth_ip_types {
+ enum qeth_cmd_buffer_state {
+ 	BUF_STATE_FREE,
+ 	BUF_STATE_LOCKED,
+-	BUF_STATE_PROCESSED,
+ };
+ 
+ enum qeth_cq {
+@@ -609,7 +608,6 @@ struct qeth_channel {
+ 	struct qeth_cmd_buffer iob[QETH_CMD_BUFFER_NO];
+ 	atomic_t irq_pending;
+ 	int io_buf_no;
+-	int buf_no;
+ };
+ 
+ /**
+diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
+index 3653bea38470..c11a083cd956 100644
+--- a/drivers/s390/net/qeth_core_main.c
++++ b/drivers/s390/net/qeth_core_main.c
+@@ -821,7 +821,6 @@ void qeth_clear_cmd_buffers(struct qeth_channel *channel)
+ 
+ 	for (cnt = 0; cnt < QETH_CMD_BUFFER_NO; cnt++)
+ 		qeth_release_buffer(channel, &channel->iob[cnt]);
+-	channel->buf_no = 0;
+ 	channel->io_buf_no = 0;
+ }
+ EXPORT_SYMBOL_GPL(qeth_clear_cmd_buffers);
+@@ -927,7 +926,6 @@ static int qeth_setup_channel(struct qeth_channel *channel)
+ 			kfree(channel->iob[cnt].data);
+ 		return -ENOMEM;
+ 	}
+-	channel->buf_no = 0;
+ 	channel->io_buf_no = 0;
+ 	atomic_set(&channel->irq_pending, 0);
+ 	spin_lock_init(&channel->iob_lock);
+@@ -1103,11 +1101,9 @@ static void qeth_irq(struct ccw_device *cdev, unsigned long intparm,
+ {
+ 	int rc;
+ 	int cstat, dstat;
+-	struct qeth_cmd_buffer *buffer;
+ 	struct qeth_channel *channel;
+ 	struct qeth_card *card;
+ 	struct qeth_cmd_buffer *iob;
+-	__u8 index;
+ 
+ 	if (__qeth_check_irb_error(cdev, intparm, irb))
+ 		return;
+@@ -1185,25 +1181,18 @@ static void qeth_irq(struct ccw_device *cdev, unsigned long intparm,
+ 		channel->state = CH_STATE_RCD_DONE;
+ 		goto out;
+ 	}
+-	if (intparm) {
+-		buffer = (struct qeth_cmd_buffer *) __va((addr_t)intparm);
+-		buffer->state = BUF_STATE_PROCESSED;
+-	}
+ 	if (channel == &card->data)
+ 		return;
+ 	if (channel == &card->read &&
+ 	    channel->state == CH_STATE_UP)
+ 		__qeth_issue_next_read(card);
+ 
+-	iob = channel->iob;
+-	index = channel->buf_no;
+-	while (iob[index].state == BUF_STATE_PROCESSED) {
+-		if (iob[index].callback != NULL)
+-			iob[index].callback(channel, iob + index);
+-
+-		index = (index + 1) % QETH_CMD_BUFFER_NO;
++	if (intparm) {
++		iob = (struct qeth_cmd_buffer *) __va((addr_t)intparm);
++		if (iob->callback)
++			iob->callback(iob->channel, iob);
+ 	}
+-	channel->buf_no = index;
++
+ out:
+ 	wake_up(&card->wait_q);
+ 	return;
+@@ -2217,7 +2206,6 @@ int qeth_send_control_data(struct qeth_card *card, int len,
+ error:
+ 	atomic_set(&card->write.irq_pending, 0);
+ 	qeth_release_buffer(iob->channel, iob);
+-	card->write.buf_no = (card->write.buf_no + 1) % QETH_CMD_BUFFER_NO;
+ 	rc = reply->rc;
+ 	qeth_put_reply(reply);
+ 	return rc;
+@@ -3037,28 +3025,23 @@ static int qeth_send_startlan(struct qeth_card *card)
+ 	return rc;
+ }
+ 
+-static int qeth_default_setadapterparms_cb(struct qeth_card *card,
+-		struct qeth_reply *reply, unsigned long data)
++static int qeth_setadpparms_inspect_rc(struct qeth_ipa_cmd *cmd)
+ {
+-	struct qeth_ipa_cmd *cmd;
+-
+-	QETH_CARD_TEXT(card, 4, "defadpcb");
+-
+-	cmd = (struct qeth_ipa_cmd *) data;
+-	if (cmd->hdr.return_code == 0)
++	if (!cmd->hdr.return_code)
+ 		cmd->hdr.return_code =
+ 			cmd->data.setadapterparms.hdr.return_code;
+-	return 0;
++	return cmd->hdr.return_code;
+ }
+ 
+ static int qeth_query_setadapterparms_cb(struct qeth_card *card,
+ 		struct qeth_reply *reply, unsigned long data)
+ {
+-	struct qeth_ipa_cmd *cmd;
++	struct qeth_ipa_cmd *cmd = (struct qeth_ipa_cmd *) data;
+ 
+ 	QETH_CARD_TEXT(card, 3, "quyadpcb");
++	if (qeth_setadpparms_inspect_rc(cmd))
++		return 0;
+ 
+-	cmd = (struct qeth_ipa_cmd *) data;
+ 	if (cmd->data.setadapterparms.data.query_cmds_supp.lan_type & 0x7f) {
+ 		card->info.link_type =
+ 		      cmd->data.setadapterparms.data.query_cmds_supp.lan_type;
+@@ -3066,7 +3049,7 @@ static int qeth_query_setadapterparms_cb(struct qeth_card *card,
+ 	}
+ 	card->options.adp.supported_funcs =
+ 		cmd->data.setadapterparms.data.query_cmds_supp.supported_cmds;
+-	return qeth_default_setadapterparms_cb(card, reply, (unsigned long)cmd);
++	return 0;
+ }
+ 
+ static struct qeth_cmd_buffer *qeth_get_adapter_cmd(struct qeth_card *card,
+@@ -3158,22 +3141,20 @@ EXPORT_SYMBOL_GPL(qeth_query_ipassists);
+ static int qeth_query_switch_attributes_cb(struct qeth_card *card,
+ 				struct qeth_reply *reply, unsigned long data)
+ {
+-	struct qeth_ipa_cmd *cmd;
+-	struct qeth_switch_info *sw_info;
++	struct qeth_ipa_cmd *cmd = (struct qeth_ipa_cmd *) data;
+ 	struct qeth_query_switch_attributes *attrs;
++	struct qeth_switch_info *sw_info;
+ 
+ 	QETH_CARD_TEXT(card, 2, "qswiatcb");
+-	cmd = (struct qeth_ipa_cmd *) data;
+-	sw_info = (struct qeth_switch_info *)reply->param;
+-	if (cmd->data.setadapterparms.hdr.return_code == 0) {
+-		attrs = &cmd->data.setadapterparms.data.query_switch_attributes;
+-		sw_info->capabilities = attrs->capabilities;
+-		sw_info->settings = attrs->settings;
+-		QETH_CARD_TEXT_(card, 2, "%04x%04x", sw_info->capabilities,
+-							sw_info->settings);
+-	}
+-	qeth_default_setadapterparms_cb(card, reply, (unsigned long) cmd);
++	if (qeth_setadpparms_inspect_rc(cmd))
++		return 0;
+ 
++	sw_info = (struct qeth_switch_info *)reply->param;
++	attrs = &cmd->data.setadapterparms.data.query_switch_attributes;
++	sw_info->capabilities = attrs->capabilities;
++	sw_info->settings = attrs->settings;
++	QETH_CARD_TEXT_(card, 2, "%04x%04x", sw_info->capabilities,
++			sw_info->settings);
+ 	return 0;
+ }
+ 
+@@ -4211,16 +4192,13 @@ EXPORT_SYMBOL_GPL(qeth_do_send_packet);
+ static int qeth_setadp_promisc_mode_cb(struct qeth_card *card,
+ 		struct qeth_reply *reply, unsigned long data)
+ {
+-	struct qeth_ipa_cmd *cmd;
++	struct qeth_ipa_cmd *cmd = (struct qeth_ipa_cmd *) data;
+ 	struct qeth_ipacmd_setadpparms *setparms;
+ 
+ 	QETH_CARD_TEXT(card, 4, "prmadpcb");
+ 
+-	cmd = (struct qeth_ipa_cmd *) data;
+ 	setparms = &(cmd->data.setadapterparms);
+-
+-	qeth_default_setadapterparms_cb(card, reply, (unsigned long)cmd);
+-	if (cmd->hdr.return_code) {
++	if (qeth_setadpparms_inspect_rc(cmd)) {
+ 		QETH_CARD_TEXT_(card, 4, "prmrc%x", cmd->hdr.return_code);
+ 		setparms->data.mode = SET_PROMISC_MODE_OFF;
+ 	}
+@@ -4290,18 +4268,18 @@ EXPORT_SYMBOL_GPL(qeth_get_stats);
+ static int qeth_setadpparms_change_macaddr_cb(struct qeth_card *card,
+ 		struct qeth_reply *reply, unsigned long data)
+ {
+-	struct qeth_ipa_cmd *cmd;
++	struct qeth_ipa_cmd *cmd = (struct qeth_ipa_cmd *) data;
+ 
+ 	QETH_CARD_TEXT(card, 4, "chgmaccb");
++	if (qeth_setadpparms_inspect_rc(cmd))
++		return 0;
+ 
+-	cmd = (struct qeth_ipa_cmd *) data;
+ 	if (!card->options.layer2 ||
+ 	    !(card->info.mac_bits & QETH_LAYER2_MAC_READ)) {
+ 		ether_addr_copy(card->dev->dev_addr,
+ 				cmd->data.setadapterparms.data.change_addr.addr);
+ 		card->info.mac_bits |= QETH_LAYER2_MAC_READ;
+ 	}
+-	qeth_default_setadapterparms_cb(card, reply, (unsigned long) cmd);
+ 	return 0;
+ }
+ 
+@@ -4332,13 +4310,15 @@ EXPORT_SYMBOL_GPL(qeth_setadpparms_change_macaddr);
+ static int qeth_setadpparms_set_access_ctrl_cb(struct qeth_card *card,
+ 		struct qeth_reply *reply, unsigned long data)
+ {
+-	struct qeth_ipa_cmd *cmd;
++	struct qeth_ipa_cmd *cmd = (struct qeth_ipa_cmd *) data;
+ 	struct qeth_set_access_ctrl *access_ctrl_req;
+ 	int fallback = *(int *)reply->param;
+ 
+ 	QETH_CARD_TEXT(card, 4, "setaccb");
++	if (cmd->hdr.return_code)
++		return 0;
++	qeth_setadpparms_inspect_rc(cmd);
+ 
+-	cmd = (struct qeth_ipa_cmd *) data;
+ 	access_ctrl_req = &cmd->data.setadapterparms.data.set_access_ctrl;
+ 	QETH_DBF_TEXT_(SETUP, 2, "setaccb");
+ 	QETH_DBF_TEXT_(SETUP, 2, "%s", card->gdev->dev.kobj.name);
+@@ -4411,7 +4391,6 @@ static int qeth_setadpparms_set_access_ctrl_cb(struct qeth_card *card,
+ 			card->options.isolation = card->options.prev_isolation;
+ 		break;
+ 	}
+-	qeth_default_setadapterparms_cb(card, reply, (unsigned long) cmd);
+ 	return 0;
+ }
+ 
+@@ -4699,14 +4678,15 @@ static int qeth_snmp_command(struct qeth_card *card, char __user *udata)
+ static int qeth_setadpparms_query_oat_cb(struct qeth_card *card,
+ 		struct qeth_reply *reply, unsigned long data)
+ {
+-	struct qeth_ipa_cmd *cmd;
++	struct qeth_ipa_cmd *cmd = (struct qeth_ipa_cmd *)data;
+ 	struct qeth_qoat_priv *priv;
+ 	char *resdata;
+ 	int resdatalen;
+ 
+ 	QETH_CARD_TEXT(card, 3, "qoatcb");
++	if (qeth_setadpparms_inspect_rc(cmd))
++		return 0;
+ 
+-	cmd = (struct qeth_ipa_cmd *)data;
+ 	priv = (struct qeth_qoat_priv *)reply->param;
+ 	resdatalen = cmd->data.setadapterparms.hdr.cmdlength;
+ 	resdata = (char *)data + 28;
+@@ -4800,21 +4780,18 @@ static int qeth_query_oat_command(struct qeth_card *card, char __user *udata)
+ static int qeth_query_card_info_cb(struct qeth_card *card,
+ 				   struct qeth_reply *reply, unsigned long data)
+ {
+-	struct qeth_ipa_cmd *cmd;
++	struct carrier_info *carrier_info = (struct carrier_info *)reply->param;
++	struct qeth_ipa_cmd *cmd = (struct qeth_ipa_cmd *)data;
+ 	struct qeth_query_card_info *card_info;
+-	struct carrier_info *carrier_info;
+ 
+ 	QETH_CARD_TEXT(card, 2, "qcrdincb");
+-	carrier_info = (struct carrier_info *)reply->param;
+-	cmd = (struct qeth_ipa_cmd *)data;
+-	card_info = &cmd->data.setadapterparms.data.card_info;
+-	if (cmd->data.setadapterparms.hdr.return_code == 0) {
+-		carrier_info->card_type = card_info->card_type;
+-		carrier_info->port_mode = card_info->port_mode;
+-		carrier_info->port_speed = card_info->port_speed;
+-	}
++	if (qeth_setadpparms_inspect_rc(cmd))
++		return 0;
+ 
+-	qeth_default_setadapterparms_cb(card, reply, (unsigned long) cmd);
++	card_info = &cmd->data.setadapterparms.data.card_info;
++	carrier_info->card_type = card_info->card_type;
++	carrier_info->port_mode = card_info->port_mode;
++	carrier_info->port_speed = card_info->port_speed;
+ 	return 0;
+ }
+ 
+@@ -6567,10 +6544,14 @@ static int __init qeth_core_init(void)
+ 	mutex_init(&qeth_mod_mutex);
+ 
+ 	qeth_wq = create_singlethread_workqueue("qeth_wq");
++	if (!qeth_wq) {
++		rc = -ENOMEM;
++		goto out_err;
++	}
+ 
+ 	rc = qeth_register_dbf_views();
+ 	if (rc)
+-		goto out_err;
++		goto dbf_err;
+ 	qeth_core_root_dev = root_device_register("qeth");
+ 	rc = PTR_ERR_OR_ZERO(qeth_core_root_dev);
+ 	if (rc)
+@@ -6607,6 +6588,8 @@ static int __init qeth_core_init(void)
+ 	root_device_unregister(qeth_core_root_dev);
+ register_err:
+ 	qeth_unregister_dbf_views();
++dbf_err:
++	destroy_workqueue(qeth_wq);
+ out_err:
+ 	pr_err("Initializing the qeth device driver failed\n");
+ 	return rc;
+diff --git a/include/linux/fsnotify_backend.h b/include/linux/fsnotify_backend.h
+index 067d52e95f02..d7191943ecb8 100644
+--- a/include/linux/fsnotify_backend.h
++++ b/include/linux/fsnotify_backend.h
+@@ -217,12 +217,10 @@ struct fsnotify_mark_connector {
+ 	union {	/* Object pointer [lock] */
+ 		struct inode *inode;
+ 		struct vfsmount *mnt;
+-	};
+-	union {
+-		struct hlist_head list;
+ 		/* Used listing heads to free after srcu period expires */
+ 		struct fsnotify_mark_connector *destroy_next;
+ 	};
++	struct hlist_head list;
+ };
+ 
+ /*
+diff --git a/include/linux/hmm.h b/include/linux/hmm.h
+index 36dd21fe5caf..325017ad9311 100644
+--- a/include/linux/hmm.h
++++ b/include/linux/hmm.h
+@@ -498,16 +498,23 @@ struct hmm_device {
+ struct hmm_device *hmm_device_new(void *drvdata);
+ void hmm_device_put(struct hmm_device *hmm_device);
+ #endif /* CONFIG_DEVICE_PRIVATE || CONFIG_DEVICE_PUBLIC */
++#endif /* IS_ENABLED(CONFIG_HMM) */
+ 
+ /* Below are for HMM internal use only! Not to be used by device driver! */
++#if IS_ENABLED(CONFIG_HMM_MIRROR)
+ void hmm_mm_destroy(struct mm_struct *mm);
+ 
+ static inline void hmm_mm_init(struct mm_struct *mm)
+ {
+ 	mm->hmm = NULL;
+ }
++#else /* IS_ENABLED(CONFIG_HMM_MIRROR) */
++static inline void hmm_mm_destroy(struct mm_struct *mm) {}
++static inline void hmm_mm_init(struct mm_struct *mm) {}
++#endif /* IS_ENABLED(CONFIG_HMM_MIRROR) */
++
++
+ #else /* IS_ENABLED(CONFIG_HMM) */
+ static inline void hmm_mm_destroy(struct mm_struct *mm) {}
+ static inline void hmm_mm_init(struct mm_struct *mm) {}
+-#endif /* IS_ENABLED(CONFIG_HMM) */
+ #endif /* LINUX_HMM_H */
+diff --git a/include/linux/if_vlan.h b/include/linux/if_vlan.h
+index 7d30892da064..87b8c20d5b27 100644
+--- a/include/linux/if_vlan.h
++++ b/include/linux/if_vlan.h
+@@ -639,7 +639,7 @@ static inline bool skb_vlan_tagged(const struct sk_buff *skb)
+  * Returns true if the skb is tagged with multiple vlan headers, regardless
+  * of whether it is hardware accelerated or not.
+  */
+-static inline bool skb_vlan_tagged_multi(const struct sk_buff *skb)
++static inline bool skb_vlan_tagged_multi(struct sk_buff *skb)
+ {
+ 	__be16 protocol = skb->protocol;
+ 
+@@ -649,6 +649,9 @@ static inline bool skb_vlan_tagged_multi(const struct sk_buff *skb)
+ 		if (likely(!eth_type_vlan(protocol)))
+ 			return false;
+ 
++		if (unlikely(!pskb_may_pull(skb, VLAN_ETH_HLEN)))
++			return false;
++
+ 		veh = (struct vlan_ethhdr *)skb->data;
+ 		protocol = veh->h_vlan_encapsulated_proto;
+ 	}
+@@ -666,7 +669,7 @@ static inline bool skb_vlan_tagged_multi(const struct sk_buff *skb)
+  *
+  * Returns features without unsafe ones if the skb has multiple tags.
+  */
+-static inline netdev_features_t vlan_features_check(const struct sk_buff *skb,
++static inline netdev_features_t vlan_features_check(struct sk_buff *skb,
+ 						    netdev_features_t features)
+ {
+ 	if (skb_vlan_tagged_multi(skb)) {
+diff --git a/include/linux/tpm.h b/include/linux/tpm.h
+index bcdd3790e94d..06639fb6ab85 100644
+--- a/include/linux/tpm.h
++++ b/include/linux/tpm.h
+@@ -44,7 +44,7 @@ struct tpm_class_ops {
+ 	bool (*update_timeouts)(struct tpm_chip *chip,
+ 				unsigned long *timeout_cap);
+ 	int (*request_locality)(struct tpm_chip *chip, int loc);
+-	void (*relinquish_locality)(struct tpm_chip *chip, int loc);
++	int (*relinquish_locality)(struct tpm_chip *chip, int loc);
+ 	void (*clk_enable)(struct tpm_chip *chip, bool value);
+ };
+ 
+diff --git a/include/net/ife.h b/include/net/ife.h
+index 44b9c00f7223..e117617e3c34 100644
+--- a/include/net/ife.h
++++ b/include/net/ife.h
+@@ -12,7 +12,8 @@
+ void *ife_encode(struct sk_buff *skb, u16 metalen);
+ void *ife_decode(struct sk_buff *skb, u16 *metalen);
+ 
+-void *ife_tlv_meta_decode(void *skbdata, u16 *attrtype, u16 *dlen, u16 *totlen);
++void *ife_tlv_meta_decode(void *skbdata, const void *ifehdr_end, u16 *attrtype,
++			  u16 *dlen, u16 *totlen);
+ int ife_tlv_meta_encode(void *skbdata, u16 attrtype, u16 dlen,
+ 			const void *dval);
+ 
+diff --git a/include/net/llc_conn.h b/include/net/llc_conn.h
+index 5c40f118c0fa..df528a623548 100644
+--- a/include/net/llc_conn.h
++++ b/include/net/llc_conn.h
+@@ -97,6 +97,7 @@ static __inline__ char llc_backlog_type(struct sk_buff *skb)
+ 
+ struct sock *llc_sk_alloc(struct net *net, int family, gfp_t priority,
+ 			  struct proto *prot, int kern);
++void llc_sk_stop_all_timers(struct sock *sk, bool sync);
+ void llc_sk_free(struct sock *sk);
+ 
+ void llc_sk_reset(struct sock *sk);
+diff --git a/kernel/kprobes.c b/kernel/kprobes.c
+index 102160ff5c66..ea619021d901 100644
+--- a/kernel/kprobes.c
++++ b/kernel/kprobes.c
+@@ -2428,7 +2428,7 @@ static int kprobe_blacklist_seq_show(struct seq_file *m, void *v)
+ 	struct kprobe_blacklist_entry *ent =
+ 		list_entry(v, struct kprobe_blacklist_entry, list);
+ 
+-	seq_printf(m, "0x%p-0x%p\t%ps\n", (void *)ent->start_addr,
++	seq_printf(m, "0x%px-0x%px\t%ps\n", (void *)ent->start_addr,
+ 		   (void *)ent->end_addr, (void *)ent->start_addr);
+ 	return 0;
+ }
+diff --git a/kernel/trace/trace_entries.h b/kernel/trace/trace_entries.h
+index e954ae3d82c0..e3a658bac10f 100644
+--- a/kernel/trace/trace_entries.h
++++ b/kernel/trace/trace_entries.h
+@@ -356,7 +356,7 @@ FTRACE_ENTRY(hwlat, hwlat_entry,
+ 		__field(	unsigned int,		seqnum		)
+ 	),
+ 
+-	F_printk("cnt:%u\tts:%010llu.%010lu\tinner:%llu\touter:%llunmi-ts:%llu\tnmi-count:%u\n",
++	F_printk("cnt:%u\tts:%010llu.%010lu\tinner:%llu\touter:%llu\tnmi-ts:%llu\tnmi-count:%u\n",
+ 		 __entry->seqnum,
+ 		 __entry->tv_sec,
+ 		 __entry->tv_nsec,
+diff --git a/net/core/dev.c b/net/core/dev.c
+index c4aa2941dbfd..3e550507e9f0 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -2942,7 +2942,7 @@ netdev_features_t passthru_features_check(struct sk_buff *skb,
+ }
+ EXPORT_SYMBOL(passthru_features_check);
+ 
+-static netdev_features_t dflt_features_check(const struct sk_buff *skb,
++static netdev_features_t dflt_features_check(struct sk_buff *skb,
+ 					     struct net_device *dev,
+ 					     netdev_features_t features)
+ {
+diff --git a/net/core/neighbour.c b/net/core/neighbour.c
+index 7b7a14abba28..ce519861be59 100644
+--- a/net/core/neighbour.c
++++ b/net/core/neighbour.c
+@@ -55,7 +55,8 @@ static void neigh_timer_handler(struct timer_list *t);
+ static void __neigh_notify(struct neighbour *n, int type, int flags,
+ 			   u32 pid);
+ static void neigh_update_notify(struct neighbour *neigh, u32 nlmsg_pid);
+-static int pneigh_ifdown(struct neigh_table *tbl, struct net_device *dev);
++static int pneigh_ifdown_and_unlock(struct neigh_table *tbl,
++				    struct net_device *dev);
+ 
+ #ifdef CONFIG_PROC_FS
+ static const struct file_operations neigh_stat_seq_fops;
+@@ -291,8 +292,7 @@ int neigh_ifdown(struct neigh_table *tbl, struct net_device *dev)
+ {
+ 	write_lock_bh(&tbl->lock);
+ 	neigh_flush_dev(tbl, dev);
+-	pneigh_ifdown(tbl, dev);
+-	write_unlock_bh(&tbl->lock);
++	pneigh_ifdown_and_unlock(tbl, dev);
+ 
+ 	del_timer_sync(&tbl->proxy_timer);
+ 	pneigh_queue_purge(&tbl->proxy_queue);
+@@ -681,9 +681,10 @@ int pneigh_delete(struct neigh_table *tbl, struct net *net, const void *pkey,
+ 	return -ENOENT;
+ }
+ 
+-static int pneigh_ifdown(struct neigh_table *tbl, struct net_device *dev)
++static int pneigh_ifdown_and_unlock(struct neigh_table *tbl,
++				    struct net_device *dev)
+ {
+-	struct pneigh_entry *n, **np;
++	struct pneigh_entry *n, **np, *freelist = NULL;
+ 	u32 h;
+ 
+ 	for (h = 0; h <= PNEIGH_HASHMASK; h++) {
+@@ -691,16 +692,23 @@ static int pneigh_ifdown(struct neigh_table *tbl, struct net_device *dev)
+ 		while ((n = *np) != NULL) {
+ 			if (!dev || n->dev == dev) {
+ 				*np = n->next;
+-				if (tbl->pdestructor)
+-					tbl->pdestructor(n);
+-				if (n->dev)
+-					dev_put(n->dev);
+-				kfree(n);
++				n->next = freelist;
++				freelist = n;
+ 				continue;
+ 			}
+ 			np = &n->next;
+ 		}
+ 	}
++	write_unlock_bh(&tbl->lock);
++	while ((n = freelist)) {
++		freelist = n->next;
++		n->next = NULL;
++		if (tbl->pdestructor)
++			tbl->pdestructor(n);
++		if (n->dev)
++			dev_put(n->dev);
++		kfree(n);
++	}
+ 	return -ENOENT;
+ }
+ 
+@@ -2323,12 +2331,16 @@ static int neigh_dump_table(struct neigh_table *tbl, struct sk_buff *skb,
+ 
+ 	err = nlmsg_parse(nlh, sizeof(struct ndmsg), tb, NDA_MAX, NULL, NULL);
+ 	if (!err) {
+-		if (tb[NDA_IFINDEX])
++		if (tb[NDA_IFINDEX]) {
++			if (nla_len(tb[NDA_IFINDEX]) != sizeof(u32))
++				return -EINVAL;
+ 			filter_idx = nla_get_u32(tb[NDA_IFINDEX]);
+-
+-		if (tb[NDA_MASTER])
++		}
++		if (tb[NDA_MASTER]) {
++			if (nla_len(tb[NDA_MASTER]) != sizeof(u32))
++				return -EINVAL;
+ 			filter_master_idx = nla_get_u32(tb[NDA_MASTER]);
+-
++		}
+ 		if (filter_idx || filter_master_idx)
+ 			flags |= NLM_F_DUMP_FILTERED;
+ 	}
+diff --git a/net/dns_resolver/dns_key.c b/net/dns_resolver/dns_key.c
+index e1d4d898a007..ed372d550137 100644
+--- a/net/dns_resolver/dns_key.c
++++ b/net/dns_resolver/dns_key.c
+@@ -91,9 +91,9 @@ dns_resolver_preparse(struct key_preparsed_payload *prep)
+ 
+ 			next_opt = memchr(opt, '#', end - opt) ?: end;
+ 			opt_len = next_opt - opt;
+-			if (!opt_len) {
+-				printk(KERN_WARNING
+-				       "Empty option to dns_resolver key\n");
++			if (opt_len <= 0 || opt_len > 128) {
++				pr_warn_ratelimited("Invalid option length (%d) for dns_resolver key\n",
++						    opt_len);
+ 				return -EINVAL;
+ 			}
+ 
+@@ -127,10 +127,8 @@ dns_resolver_preparse(struct key_preparsed_payload *prep)
+ 			}
+ 
+ 		bad_option_value:
+-			printk(KERN_WARNING
+-			       "Option '%*.*s' to dns_resolver key:"
+-			       " bad/missing value\n",
+-			       opt_nlen, opt_nlen, opt);
++			pr_warn_ratelimited("Option '%*.*s' to dns_resolver key: bad/missing value\n",
++					    opt_nlen, opt_nlen, opt);
+ 			return -EINVAL;
+ 		} while (opt = next_opt + 1, opt < end);
+ 	}
+diff --git a/net/ife/ife.c b/net/ife/ife.c
+index 7d1ec76e7f43..13bbf8cb6a39 100644
+--- a/net/ife/ife.c
++++ b/net/ife/ife.c
+@@ -69,6 +69,9 @@ void *ife_decode(struct sk_buff *skb, u16 *metalen)
+ 	int total_pull;
+ 	u16 ifehdrln;
+ 
++	if (!pskb_may_pull(skb, skb->dev->hard_header_len + IFE_METAHDRLEN))
++		return NULL;
++
+ 	ifehdr = (struct ifeheadr *) (skb->data + skb->dev->hard_header_len);
+ 	ifehdrln = ntohs(ifehdr->metalen);
+ 	total_pull = skb->dev->hard_header_len + ifehdrln;
+@@ -92,12 +95,43 @@ struct meta_tlvhdr {
+ 	__be16 len;
+ };
+ 
++static bool __ife_tlv_meta_valid(const unsigned char *skbdata,
++				 const unsigned char *ifehdr_end)
++{
++	const struct meta_tlvhdr *tlv;
++	u16 tlvlen;
++
++	if (unlikely(skbdata + sizeof(*tlv) > ifehdr_end))
++		return false;
++
++	tlv = (const struct meta_tlvhdr *)skbdata;
++	tlvlen = ntohs(tlv->len);
++
++	/* tlv length field is inc header, check on minimum */
++	if (tlvlen < NLA_HDRLEN)
++		return false;
++
++	/* overflow by NLA_ALIGN check */
++	if (NLA_ALIGN(tlvlen) < tlvlen)
++		return false;
++
++	if (unlikely(skbdata + NLA_ALIGN(tlvlen) > ifehdr_end))
++		return false;
++
++	return true;
++}
++
+ /* Caller takes care of presenting data in network order
+  */
+-void *ife_tlv_meta_decode(void *skbdata, u16 *attrtype, u16 *dlen, u16 *totlen)
++void *ife_tlv_meta_decode(void *skbdata, const void *ifehdr_end, u16 *attrtype,
++			  u16 *dlen, u16 *totlen)
+ {
+-	struct meta_tlvhdr *tlv = (struct meta_tlvhdr *) skbdata;
++	struct meta_tlvhdr *tlv;
++
++	if (!__ife_tlv_meta_valid(skbdata, ifehdr_end))
++		return NULL;
+ 
++	tlv = (struct meta_tlvhdr *)skbdata;
+ 	*dlen = ntohs(tlv->len) - NLA_HDRLEN;
+ 	*attrtype = ntohs(tlv->type);
+ 
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index 8b8059b7af4d..1ab8733dac5f 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -2385,6 +2385,7 @@ void tcp_write_queue_purge(struct sock *sk)
+ 	INIT_LIST_HEAD(&tcp_sk(sk)->tsorted_sent_queue);
+ 	sk_mem_reclaim(sk);
+ 	tcp_clear_all_retrans_hints(tcp_sk(sk));
++	tcp_sk(sk)->packets_out = 0;
+ }
+ 
+ int tcp_disconnect(struct sock *sk, int flags)
+@@ -2434,7 +2435,6 @@ int tcp_disconnect(struct sock *sk, int flags)
+ 	icsk->icsk_backoff = 0;
+ 	tp->snd_cwnd = 2;
+ 	icsk->icsk_probes_out = 0;
+-	tp->packets_out = 0;
+ 	tp->snd_ssthresh = TCP_INFINITE_SSTHRESH;
+ 	tp->snd_cwnd_cnt = 0;
+ 	tp->window_clamp = 0;
+@@ -2830,8 +2830,10 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
+ #ifdef CONFIG_TCP_MD5SIG
+ 	case TCP_MD5SIG:
+ 	case TCP_MD5SIG_EXT:
+-		/* Read the IP->Key mappings from userspace */
+-		err = tp->af_specific->md5_parse(sk, optname, optval, optlen);
++		if ((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN))
++			err = tp->af_specific->md5_parse(sk, optname, optval, optlen);
++		else
++			err = -EINVAL;
+ 		break;
+ #endif
+ 	case TCP_USER_TIMEOUT:
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index ff6cd98ce8d5..31ca27fdde66 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -3871,11 +3871,8 @@ const u8 *tcp_parse_md5sig_option(const struct tcphdr *th)
+ 	int length = (th->doff << 2) - sizeof(*th);
+ 	const u8 *ptr = (const u8 *)(th + 1);
+ 
+-	/* If the TCP option is too short, we can short cut */
+-	if (length < TCPOLEN_MD5SIG)
+-		return NULL;
+-
+-	while (length > 0) {
++	/* If not enough data remaining, we can short cut */
++	while (length >= TCPOLEN_MD5SIG) {
+ 		int opcode = *ptr++;
+ 		int opsize;
+ 
+diff --git a/net/ipv6/route.c b/net/ipv6/route.c
+index fc74352fac12..74a2e37412b2 100644
+--- a/net/ipv6/route.c
++++ b/net/ipv6/route.c
+@@ -3862,6 +3862,7 @@ void rt6_mtu_change(struct net_device *dev, unsigned int mtu)
+ 
+ static const struct nla_policy rtm_ipv6_policy[RTA_MAX+1] = {
+ 	[RTA_GATEWAY]           = { .len = sizeof(struct in6_addr) },
++	[RTA_PREFSRC]		= { .len = sizeof(struct in6_addr) },
+ 	[RTA_OIF]               = { .type = NLA_U32 },
+ 	[RTA_IIF]		= { .type = NLA_U32 },
+ 	[RTA_PRIORITY]          = { .type = NLA_U32 },
+@@ -3873,6 +3874,7 @@ static const struct nla_policy rtm_ipv6_policy[RTA_MAX+1] = {
+ 	[RTA_EXPIRES]		= { .type = NLA_U32 },
+ 	[RTA_UID]		= { .type = NLA_U32 },
+ 	[RTA_MARK]		= { .type = NLA_U32 },
++	[RTA_TABLE]		= { .type = NLA_U32 },
+ };
+ 
+ static int rtm_to_fib6_config(struct sk_buff *skb, struct nlmsghdr *nlh,
+diff --git a/net/ipv6/seg6_iptunnel.c b/net/ipv6/seg6_iptunnel.c
+index f343e6f0fc95..5fe139484919 100644
+--- a/net/ipv6/seg6_iptunnel.c
++++ b/net/ipv6/seg6_iptunnel.c
+@@ -136,7 +136,7 @@ int seg6_do_srh_encap(struct sk_buff *skb, struct ipv6_sr_hdr *osrh, int proto)
+ 	isrh->nexthdr = proto;
+ 
+ 	hdr->daddr = isrh->segments[isrh->first_segment];
+-	set_tun_src(net, ip6_dst_idev(dst)->dev, &hdr->daddr, &hdr->saddr);
++	set_tun_src(net, dst->dev, &hdr->daddr, &hdr->saddr);
+ 
+ #ifdef CONFIG_IPV6_SEG6_HMAC
+ 	if (sr_has_hmac(isrh)) {
+diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
+index 0fbd3ee26165..40261cb68e83 100644
+--- a/net/l2tp/l2tp_core.c
++++ b/net/l2tp/l2tp_core.c
+@@ -183,6 +183,26 @@ struct l2tp_tunnel *l2tp_tunnel_get(const struct net *net, u32 tunnel_id)
+ }
+ EXPORT_SYMBOL_GPL(l2tp_tunnel_get);
+ 
++struct l2tp_tunnel *l2tp_tunnel_get_nth(const struct net *net, int nth)
++{
++	const struct l2tp_net *pn = l2tp_pernet(net);
++	struct l2tp_tunnel *tunnel;
++	int count = 0;
++
++	rcu_read_lock_bh();
++	list_for_each_entry_rcu(tunnel, &pn->l2tp_tunnel_list, list) {
++		if (++count > nth) {
++			l2tp_tunnel_inc_refcount(tunnel);
++			rcu_read_unlock_bh();
++			return tunnel;
++		}
++	}
++	rcu_read_unlock_bh();
++
++	return NULL;
++}
++EXPORT_SYMBOL_GPL(l2tp_tunnel_get_nth);
++
+ /* Lookup a session. A new reference is held on the returned session. */
+ struct l2tp_session *l2tp_session_get(const struct net *net,
+ 				      struct l2tp_tunnel *tunnel,
+@@ -335,26 +355,6 @@ int l2tp_session_register(struct l2tp_session *session,
+ }
+ EXPORT_SYMBOL_GPL(l2tp_session_register);
+ 
+-struct l2tp_tunnel *l2tp_tunnel_find_nth(const struct net *net, int nth)
+-{
+-	struct l2tp_net *pn = l2tp_pernet(net);
+-	struct l2tp_tunnel *tunnel;
+-	int count = 0;
+-
+-	rcu_read_lock_bh();
+-	list_for_each_entry_rcu(tunnel, &pn->l2tp_tunnel_list, list) {
+-		if (++count > nth) {
+-			rcu_read_unlock_bh();
+-			return tunnel;
+-		}
+-	}
+-
+-	rcu_read_unlock_bh();
+-
+-	return NULL;
+-}
+-EXPORT_SYMBOL_GPL(l2tp_tunnel_find_nth);
+-
+ /*****************************************************************************
+  * Receive data handling
+  *****************************************************************************/
+diff --git a/net/l2tp/l2tp_core.h b/net/l2tp/l2tp_core.h
+index ba33cbec71eb..c199020f8a8a 100644
+--- a/net/l2tp/l2tp_core.h
++++ b/net/l2tp/l2tp_core.h
+@@ -212,6 +212,8 @@ static inline void *l2tp_session_priv(struct l2tp_session *session)
+ }
+ 
+ struct l2tp_tunnel *l2tp_tunnel_get(const struct net *net, u32 tunnel_id);
++struct l2tp_tunnel *l2tp_tunnel_get_nth(const struct net *net, int nth);
++
+ void l2tp_tunnel_free(struct l2tp_tunnel *tunnel);
+ 
+ struct l2tp_session *l2tp_session_get(const struct net *net,
+@@ -220,7 +222,6 @@ struct l2tp_session *l2tp_session_get(const struct net *net,
+ struct l2tp_session *l2tp_session_get_nth(struct l2tp_tunnel *tunnel, int nth);
+ struct l2tp_session *l2tp_session_get_by_ifname(const struct net *net,
+ 						const char *ifname);
+-struct l2tp_tunnel *l2tp_tunnel_find_nth(const struct net *net, int nth);
+ 
+ int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id,
+ 		       u32 peer_tunnel_id, struct l2tp_tunnel_cfg *cfg,
+diff --git a/net/l2tp/l2tp_debugfs.c b/net/l2tp/l2tp_debugfs.c
+index 72e713da4733..7f1e842ef05a 100644
+--- a/net/l2tp/l2tp_debugfs.c
++++ b/net/l2tp/l2tp_debugfs.c
+@@ -47,7 +47,11 @@ struct l2tp_dfs_seq_data {
+ 
+ static void l2tp_dfs_next_tunnel(struct l2tp_dfs_seq_data *pd)
+ {
+-	pd->tunnel = l2tp_tunnel_find_nth(pd->net, pd->tunnel_idx);
++	/* Drop reference taken during previous invocation */
++	if (pd->tunnel)
++		l2tp_tunnel_dec_refcount(pd->tunnel);
++
++	pd->tunnel = l2tp_tunnel_get_nth(pd->net, pd->tunnel_idx);
+ 	pd->tunnel_idx++;
+ }
+ 
+@@ -96,7 +100,17 @@ static void *l2tp_dfs_seq_next(struct seq_file *m, void *v, loff_t *pos)
+ 
+ static void l2tp_dfs_seq_stop(struct seq_file *p, void *v)
+ {
+-	/* nothing to do */
++	struct l2tp_dfs_seq_data *pd = v;
++
++	if (!pd || pd == SEQ_START_TOKEN)
++		return;
++
++	/* Drop reference taken by last invocation of l2tp_dfs_next_tunnel() */
++	if (pd->tunnel) {
++		l2tp_tunnel_dec_refcount(pd->tunnel);
++		pd->tunnel = NULL;
++		pd->session = NULL;
++	}
+ }
+ 
+ static void l2tp_dfs_seq_tunnel_show(struct seq_file *m, void *v)
+diff --git a/net/l2tp/l2tp_netlink.c b/net/l2tp/l2tp_netlink.c
+index b05dbd9ffcb2..6616c9fd292f 100644
+--- a/net/l2tp/l2tp_netlink.c
++++ b/net/l2tp/l2tp_netlink.c
+@@ -487,14 +487,17 @@ static int l2tp_nl_cmd_tunnel_dump(struct sk_buff *skb, struct netlink_callback
+ 	struct net *net = sock_net(skb->sk);
+ 
+ 	for (;;) {
+-		tunnel = l2tp_tunnel_find_nth(net, ti);
++		tunnel = l2tp_tunnel_get_nth(net, ti);
+ 		if (tunnel == NULL)
+ 			goto out;
+ 
+ 		if (l2tp_nl_tunnel_send(skb, NETLINK_CB(cb->skb).portid,
+ 					cb->nlh->nlmsg_seq, NLM_F_MULTI,
+-					tunnel, L2TP_CMD_TUNNEL_GET) < 0)
++					tunnel, L2TP_CMD_TUNNEL_GET) < 0) {
++			l2tp_tunnel_dec_refcount(tunnel);
+ 			goto out;
++		}
++		l2tp_tunnel_dec_refcount(tunnel);
+ 
+ 		ti++;
+ 	}
+@@ -848,7 +851,7 @@ static int l2tp_nl_cmd_session_dump(struct sk_buff *skb, struct netlink_callback
+ 
+ 	for (;;) {
+ 		if (tunnel == NULL) {
+-			tunnel = l2tp_tunnel_find_nth(net, ti);
++			tunnel = l2tp_tunnel_get_nth(net, ti);
+ 			if (tunnel == NULL)
+ 				goto out;
+ 		}
+@@ -856,6 +859,7 @@ static int l2tp_nl_cmd_session_dump(struct sk_buff *skb, struct netlink_callback
+ 		session = l2tp_session_get_nth(tunnel, si);
+ 		if (session == NULL) {
+ 			ti++;
++			l2tp_tunnel_dec_refcount(tunnel);
+ 			tunnel = NULL;
+ 			si = 0;
+ 			continue;
+@@ -865,6 +869,7 @@ static int l2tp_nl_cmd_session_dump(struct sk_buff *skb, struct netlink_callback
+ 					 cb->nlh->nlmsg_seq, NLM_F_MULTI,
+ 					 session, L2TP_CMD_SESSION_GET) < 0) {
+ 			l2tp_session_dec_refcount(session);
++			l2tp_tunnel_dec_refcount(tunnel);
+ 			break;
+ 		}
+ 		l2tp_session_dec_refcount(session);
+diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
+index 3d7887cc599b..0c4530ad74be 100644
+--- a/net/l2tp/l2tp_ppp.c
++++ b/net/l2tp/l2tp_ppp.c
+@@ -619,6 +619,13 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
+ 	lock_sock(sk);
+ 
+ 	error = -EINVAL;
++
++	if (sockaddr_len != sizeof(struct sockaddr_pppol2tp) &&
++	    sockaddr_len != sizeof(struct sockaddr_pppol2tpv3) &&
++	    sockaddr_len != sizeof(struct sockaddr_pppol2tpin6) &&
++	    sockaddr_len != sizeof(struct sockaddr_pppol2tpv3in6))
++		goto end;
++
+ 	if (sp->sa_protocol != PX_PROTO_OL2TP)
+ 		goto end;
+ 
+@@ -1552,16 +1559,19 @@ struct pppol2tp_seq_data {
+ 
+ static void pppol2tp_next_tunnel(struct net *net, struct pppol2tp_seq_data *pd)
+ {
++	/* Drop reference taken during previous invocation */
++	if (pd->tunnel)
++		l2tp_tunnel_dec_refcount(pd->tunnel);
++
+ 	for (;;) {
+-		pd->tunnel = l2tp_tunnel_find_nth(net, pd->tunnel_idx);
++		pd->tunnel = l2tp_tunnel_get_nth(net, pd->tunnel_idx);
+ 		pd->tunnel_idx++;
+ 
+-		if (pd->tunnel == NULL)
+-			break;
++		/* Only accept L2TPv2 tunnels */
++		if (!pd->tunnel || pd->tunnel->version == 2)
++			return;
+ 
+-		/* Ignore L2TPv3 tunnels */
+-		if (pd->tunnel->version < 3)
+-			break;
++		l2tp_tunnel_dec_refcount(pd->tunnel);
+ 	}
+ }
+ 
+@@ -1610,7 +1620,17 @@ static void *pppol2tp_seq_next(struct seq_file *m, void *v, loff_t *pos)
+ 
+ static void pppol2tp_seq_stop(struct seq_file *p, void *v)
+ {
+-	/* nothing to do */
++	struct pppol2tp_seq_data *pd = v;
++
++	if (!pd || pd == SEQ_START_TOKEN)
++		return;
++
++	/* Drop reference taken by last invocation of pppol2tp_next_tunnel() */
++	if (pd->tunnel) {
++		l2tp_tunnel_dec_refcount(pd->tunnel);
++		pd->tunnel = NULL;
++		pd->session = NULL;
++	}
+ }
+ 
+ static void pppol2tp_seq_tunnel_show(struct seq_file *m, void *v)
+diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
+index c38d16f22d2a..cf41d9b4a0b8 100644
+--- a/net/llc/af_llc.c
++++ b/net/llc/af_llc.c
+@@ -199,9 +199,19 @@ static int llc_ui_release(struct socket *sock)
+ 		llc->laddr.lsap, llc->daddr.lsap);
+ 	if (!llc_send_disc(sk))
+ 		llc_ui_wait_for_disc(sk, sk->sk_rcvtimeo);
+-	if (!sock_flag(sk, SOCK_ZAPPED))
++	if (!sock_flag(sk, SOCK_ZAPPED)) {
++		struct llc_sap *sap = llc->sap;
++
++		/* Hold this for release_sock(), so that llc_backlog_rcv()
++		 * could still use it.
++		 */
++		llc_sap_hold(sap);
+ 		llc_sap_remove_socket(llc->sap, sk);
+-	release_sock(sk);
++		release_sock(sk);
++		llc_sap_put(sap);
++	} else {
++		release_sock(sk);
++	}
+ 	if (llc->dev)
+ 		dev_put(llc->dev);
+ 	sock_put(sk);
+diff --git a/net/llc/llc_c_ac.c b/net/llc/llc_c_ac.c
+index 163121192aca..4d78375f9872 100644
+--- a/net/llc/llc_c_ac.c
++++ b/net/llc/llc_c_ac.c
+@@ -1099,14 +1099,7 @@ int llc_conn_ac_inc_tx_win_size(struct sock *sk, struct sk_buff *skb)
+ 
+ int llc_conn_ac_stop_all_timers(struct sock *sk, struct sk_buff *skb)
+ {
+-	struct llc_sock *llc = llc_sk(sk);
+-
+-	del_timer(&llc->pf_cycle_timer.timer);
+-	del_timer(&llc->ack_timer.timer);
+-	del_timer(&llc->rej_sent_timer.timer);
+-	del_timer(&llc->busy_state_timer.timer);
+-	llc->ack_must_be_send = 0;
+-	llc->ack_pf = 0;
++	llc_sk_stop_all_timers(sk, false);
+ 	return 0;
+ }
+ 
+diff --git a/net/llc/llc_conn.c b/net/llc/llc_conn.c
+index 110e32bcb399..c0ac522b48a1 100644
+--- a/net/llc/llc_conn.c
++++ b/net/llc/llc_conn.c
+@@ -961,6 +961,26 @@ struct sock *llc_sk_alloc(struct net *net, int family, gfp_t priority, struct pr
+ 	return sk;
+ }
+ 
++void llc_sk_stop_all_timers(struct sock *sk, bool sync)
++{
++	struct llc_sock *llc = llc_sk(sk);
++
++	if (sync) {
++		del_timer_sync(&llc->pf_cycle_timer.timer);
++		del_timer_sync(&llc->ack_timer.timer);
++		del_timer_sync(&llc->rej_sent_timer.timer);
++		del_timer_sync(&llc->busy_state_timer.timer);
++	} else {
++		del_timer(&llc->pf_cycle_timer.timer);
++		del_timer(&llc->ack_timer.timer);
++		del_timer(&llc->rej_sent_timer.timer);
++		del_timer(&llc->busy_state_timer.timer);
++	}
++
++	llc->ack_must_be_send = 0;
++	llc->ack_pf = 0;
++}
++
+ /**
+  *	llc_sk_free - Frees a LLC socket
+  *	@sk - socket to free
+@@ -973,7 +993,7 @@ void llc_sk_free(struct sock *sk)
+ 
+ 	llc->state = LLC_CONN_OUT_OF_SVC;
+ 	/* Stop all (possibly) running timers */
+-	llc_conn_ac_stop_all_timers(sk, NULL);
++	llc_sk_stop_all_timers(sk, true);
+ #ifdef DEBUG_LLC_CONN_ALLOC
+ 	printk(KERN_INFO "%s: unackq=%d, txq=%d\n", __func__,
+ 		skb_queue_len(&llc->pdu_unack_q),
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index e0f3f4aeeb4f..3b43b1fcd618 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -329,11 +329,11 @@ static void packet_pick_tx_queue(struct net_device *dev, struct sk_buff *skb)
+ 	skb_set_queue_mapping(skb, queue_index);
+ }
+ 
+-/* register_prot_hook must be invoked with the po->bind_lock held,
++/* __register_prot_hook must be invoked through register_prot_hook
+  * or from a context in which asynchronous accesses to the packet
+  * socket is not possible (packet_create()).
+  */
+-static void register_prot_hook(struct sock *sk)
++static void __register_prot_hook(struct sock *sk)
+ {
+ 	struct packet_sock *po = pkt_sk(sk);
+ 
+@@ -348,8 +348,13 @@ static void register_prot_hook(struct sock *sk)
+ 	}
+ }
+ 
+-/* {,__}unregister_prot_hook() must be invoked with the po->bind_lock
+- * held.   If the sync parameter is true, we will temporarily drop
++static void register_prot_hook(struct sock *sk)
++{
++	lockdep_assert_held_once(&pkt_sk(sk)->bind_lock);
++	__register_prot_hook(sk);
++}
++
++/* If the sync parameter is true, we will temporarily drop
+  * the po->bind_lock and do a synchronize_net to make sure no
+  * asynchronous packet processing paths still refer to the elements
+  * of po->prot_hook.  If the sync parameter is false, it is the
+@@ -359,6 +364,8 @@ static void __unregister_prot_hook(struct sock *sk, bool sync)
+ {
+ 	struct packet_sock *po = pkt_sk(sk);
+ 
++	lockdep_assert_held_once(&po->bind_lock);
++
+ 	po->running = 0;
+ 
+ 	if (po->fanout)
+@@ -3008,6 +3015,7 @@ static int packet_release(struct socket *sock)
+ 
+ 	packet_flush_mclist(sk);
+ 
++	lock_sock(sk);
+ 	if (po->rx_ring.pg_vec) {
+ 		memset(&req_u, 0, sizeof(req_u));
+ 		packet_set_ring(sk, &req_u, 1, 0);
+@@ -3017,6 +3025,7 @@ static int packet_release(struct socket *sock)
+ 		memset(&req_u, 0, sizeof(req_u));
+ 		packet_set_ring(sk, &req_u, 1, 1);
+ 	}
++	release_sock(sk);
+ 
+ 	f = fanout_release(sk);
+ 
+@@ -3250,7 +3259,7 @@ static int packet_create(struct net *net, struct socket *sock, int protocol,
+ 
+ 	if (proto) {
+ 		po->prot_hook.type = proto;
+-		register_prot_hook(sk);
++		__register_prot_hook(sk);
+ 	}
+ 
+ 	mutex_lock(&net->packet.sklist_lock);
+@@ -3645,6 +3654,7 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv
+ 		union tpacket_req_u req_u;
+ 		int len;
+ 
++		lock_sock(sk);
+ 		switch (po->tp_version) {
+ 		case TPACKET_V1:
+ 		case TPACKET_V2:
+@@ -3655,12 +3665,17 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv
+ 			len = sizeof(req_u.req3);
+ 			break;
+ 		}
+-		if (optlen < len)
+-			return -EINVAL;
+-		if (copy_from_user(&req_u.req, optval, len))
+-			return -EFAULT;
+-		return packet_set_ring(sk, &req_u, 0,
+-			optname == PACKET_TX_RING);
++		if (optlen < len) {
++			ret = -EINVAL;
++		} else {
++			if (copy_from_user(&req_u.req, optval, len))
++				ret = -EFAULT;
++			else
++				ret = packet_set_ring(sk, &req_u, 0,
++						    optname == PACKET_TX_RING);
++		}
++		release_sock(sk);
++		return ret;
+ 	}
+ 	case PACKET_COPY_THRESH:
+ 	{
+@@ -3726,12 +3741,18 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv
+ 
+ 		if (optlen != sizeof(val))
+ 			return -EINVAL;
+-		if (po->rx_ring.pg_vec || po->tx_ring.pg_vec)
+-			return -EBUSY;
+ 		if (copy_from_user(&val, optval, sizeof(val)))
+ 			return -EFAULT;
+-		po->tp_loss = !!val;
+-		return 0;
++
++		lock_sock(sk);
++		if (po->rx_ring.pg_vec || po->tx_ring.pg_vec) {
++			ret = -EBUSY;
++		} else {
++			po->tp_loss = !!val;
++			ret = 0;
++		}
++		release_sock(sk);
++		return ret;
+ 	}
+ 	case PACKET_AUXDATA:
+ 	{
+@@ -3742,7 +3763,9 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv
+ 		if (copy_from_user(&val, optval, sizeof(val)))
+ 			return -EFAULT;
+ 
++		lock_sock(sk);
+ 		po->auxdata = !!val;
++		release_sock(sk);
+ 		return 0;
+ 	}
+ 	case PACKET_ORIGDEV:
+@@ -3754,7 +3777,9 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv
+ 		if (copy_from_user(&val, optval, sizeof(val)))
+ 			return -EFAULT;
+ 
++		lock_sock(sk);
+ 		po->origdev = !!val;
++		release_sock(sk);
+ 		return 0;
+ 	}
+ 	case PACKET_VNET_HDR:
+@@ -3763,15 +3788,20 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv
+ 
+ 		if (sock->type != SOCK_RAW)
+ 			return -EINVAL;
+-		if (po->rx_ring.pg_vec || po->tx_ring.pg_vec)
+-			return -EBUSY;
+ 		if (optlen < sizeof(val))
+ 			return -EINVAL;
+ 		if (copy_from_user(&val, optval, sizeof(val)))
+ 			return -EFAULT;
+ 
+-		po->has_vnet_hdr = !!val;
+-		return 0;
++		lock_sock(sk);
++		if (po->rx_ring.pg_vec || po->tx_ring.pg_vec) {
++			ret = -EBUSY;
++		} else {
++			po->has_vnet_hdr = !!val;
++			ret = 0;
++		}
++		release_sock(sk);
++		return ret;
+ 	}
+ 	case PACKET_TIMESTAMP:
+ 	{
+@@ -3809,11 +3839,17 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv
+ 
+ 		if (optlen != sizeof(val))
+ 			return -EINVAL;
+-		if (po->rx_ring.pg_vec || po->tx_ring.pg_vec)
+-			return -EBUSY;
+ 		if (copy_from_user(&val, optval, sizeof(val)))
+ 			return -EFAULT;
+-		po->tp_tx_has_off = !!val;
++
++		lock_sock(sk);
++		if (po->rx_ring.pg_vec || po->tx_ring.pg_vec) {
++			ret = -EBUSY;
++		} else {
++			po->tp_tx_has_off = !!val;
++			ret = 0;
++		}
++		release_sock(sk);
+ 		return 0;
+ 	}
+ 	case PACKET_QDISC_BYPASS:
+@@ -4210,8 +4246,6 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
+ 	/* Added to avoid minimal code churn */
+ 	struct tpacket_req *req = &req_u->req;
+ 
+-	lock_sock(sk);
+-
+ 	rb = tx_ring ? &po->tx_ring : &po->rx_ring;
+ 	rb_queue = tx_ring ? &sk->sk_write_queue : &sk->sk_receive_queue;
+ 
+@@ -4349,7 +4383,6 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
+ 	if (pg_vec)
+ 		free_pg_vec(pg_vec, order, req->tp_block_nr);
+ out:
+-	release_sock(sk);
+ 	return err;
+ }
+ 
+diff --git a/net/packet/internal.h b/net/packet/internal.h
+index a1d2b2319ae9..3bb7c5fb3bff 100644
+--- a/net/packet/internal.h
++++ b/net/packet/internal.h
+@@ -112,10 +112,12 @@ struct packet_sock {
+ 	int			copy_thresh;
+ 	spinlock_t		bind_lock;
+ 	struct mutex		pg_vec_lock;
+-	unsigned int		running:1,	/* prot_hook is attached*/
+-				auxdata:1,
++	unsigned int		running;	/* bind_lock must be held */
++	unsigned int		auxdata:1,	/* writer must hold sock lock */
+ 				origdev:1,
+-				has_vnet_hdr:1;
++				has_vnet_hdr:1,
++				tp_loss:1,
++				tp_tx_has_off:1;
+ 	int			pressure;
+ 	int			ifindex;	/* bound device		*/
+ 	__be16			num;
+@@ -125,8 +127,6 @@ struct packet_sock {
+ 	enum tpacket_versions	tp_version;
+ 	unsigned int		tp_hdrlen;
+ 	unsigned int		tp_reserve;
+-	unsigned int		tp_loss:1;
+-	unsigned int		tp_tx_has_off:1;
+ 	unsigned int		tp_tstamp;
+ 	struct net_device __rcu	*cached_dev;
+ 	int			(*xmit)(struct sk_buff *skb);
+diff --git a/net/sched/act_ife.c b/net/sched/act_ife.c
+index 5954e992685a..1d477b054f2e 100644
+--- a/net/sched/act_ife.c
++++ b/net/sched/act_ife.c
+@@ -652,7 +652,7 @@ static int find_decode_metaid(struct sk_buff *skb, struct tcf_ife_info *ife,
+ 		}
+ 	}
+ 
+-	return 0;
++	return -ENOENT;
+ }
+ 
+ static int tcf_ife_decode(struct sk_buff *skb, const struct tc_action *a,
+@@ -682,7 +682,12 @@ static int tcf_ife_decode(struct sk_buff *skb, const struct tc_action *a,
+ 		u16 mtype;
+ 		u16 dlen;
+ 
+-		curr_data = ife_tlv_meta_decode(tlv_data, &mtype, &dlen, NULL);
++		curr_data = ife_tlv_meta_decode(tlv_data, ifehdr_end, &mtype,
++						&dlen, NULL);
++		if (!curr_data) {
++			qstats_drop_inc(this_cpu_ptr(ife->common.cpu_qstats));
++			return TC_ACT_SHOT;
++		}
+ 
+ 		if (find_decode_metaid(skb, ife, mtype, dlen, curr_data)) {
+ 			/* abuse overlimits to count when we receive metadata
+diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
+index f6d3d0c1e133..07b64719d1bc 100644
+--- a/net/sctp/ipv6.c
++++ b/net/sctp/ipv6.c
+@@ -521,46 +521,49 @@ static void sctp_v6_to_addr(union sctp_addr *addr, struct in6_addr *saddr,
+ 	addr->v6.sin6_scope_id = 0;
+ }
+ 
+-/* Compare addresses exactly.
+- * v4-mapped-v6 is also in consideration.
+- */
+-static int sctp_v6_cmp_addr(const union sctp_addr *addr1,
+-			    const union sctp_addr *addr2)
++static int __sctp_v6_cmp_addr(const union sctp_addr *addr1,
++			      const union sctp_addr *addr2)
+ {
+ 	if (addr1->sa.sa_family != addr2->sa.sa_family) {
+ 		if (addr1->sa.sa_family == AF_INET &&
+ 		    addr2->sa.sa_family == AF_INET6 &&
+-		    ipv6_addr_v4mapped(&addr2->v6.sin6_addr)) {
+-			if (addr2->v6.sin6_port == addr1->v4.sin_port &&
+-			    addr2->v6.sin6_addr.s6_addr32[3] ==
+-			    addr1->v4.sin_addr.s_addr)
+-				return 1;
+-		}
++		    ipv6_addr_v4mapped(&addr2->v6.sin6_addr) &&
++		    addr2->v6.sin6_addr.s6_addr32[3] ==
++		    addr1->v4.sin_addr.s_addr)
++			return 1;
++
+ 		if (addr2->sa.sa_family == AF_INET &&
+ 		    addr1->sa.sa_family == AF_INET6 &&
+-		    ipv6_addr_v4mapped(&addr1->v6.sin6_addr)) {
+-			if (addr1->v6.sin6_port == addr2->v4.sin_port &&
+-			    addr1->v6.sin6_addr.s6_addr32[3] ==
+-			    addr2->v4.sin_addr.s_addr)
+-				return 1;
+-		}
++		    ipv6_addr_v4mapped(&addr1->v6.sin6_addr) &&
++		    addr1->v6.sin6_addr.s6_addr32[3] ==
++		    addr2->v4.sin_addr.s_addr)
++			return 1;
++
+ 		return 0;
+ 	}
+-	if (addr1->v6.sin6_port != addr2->v6.sin6_port)
+-		return 0;
++
+ 	if (!ipv6_addr_equal(&addr1->v6.sin6_addr, &addr2->v6.sin6_addr))
+ 		return 0;
++
+ 	/* If this is a linklocal address, compare the scope_id. */
+-	if (ipv6_addr_type(&addr1->v6.sin6_addr) & IPV6_ADDR_LINKLOCAL) {
+-		if (addr1->v6.sin6_scope_id && addr2->v6.sin6_scope_id &&
+-		    (addr1->v6.sin6_scope_id != addr2->v6.sin6_scope_id)) {
+-			return 0;
+-		}
+-	}
++	if ((ipv6_addr_type(&addr1->v6.sin6_addr) & IPV6_ADDR_LINKLOCAL) &&
++	    addr1->v6.sin6_scope_id && addr2->v6.sin6_scope_id &&
++	    addr1->v6.sin6_scope_id != addr2->v6.sin6_scope_id)
++		return 0;
+ 
+ 	return 1;
+ }
+ 
++/* Compare addresses exactly.
++ * v4-mapped-v6 is also in consideration.
++ */
++static int sctp_v6_cmp_addr(const union sctp_addr *addr1,
++			    const union sctp_addr *addr2)
++{
++	return __sctp_v6_cmp_addr(addr1, addr2) &&
++	       addr1->v6.sin6_port == addr2->v6.sin6_port;
++}
++
+ /* Initialize addr struct to INADDR_ANY. */
+ static void sctp_v6_inaddr_any(union sctp_addr *addr, __be16 port)
+ {
+@@ -846,8 +849,8 @@ static int sctp_inet6_cmp_addr(const union sctp_addr *addr1,
+ 			       const union sctp_addr *addr2,
+ 			       struct sctp_sock *opt)
+ {
+-	struct sctp_af *af1, *af2;
+ 	struct sock *sk = sctp_opt2sk(opt);
++	struct sctp_af *af1, *af2;
+ 
+ 	af1 = sctp_get_af_specific(addr1->sa.sa_family);
+ 	af2 = sctp_get_af_specific(addr2->sa.sa_family);
+@@ -863,10 +866,7 @@ static int sctp_inet6_cmp_addr(const union sctp_addr *addr1,
+ 	if (sctp_is_any(sk, addr1) || sctp_is_any(sk, addr2))
+ 		return 1;
+ 
+-	if (addr1->sa.sa_family != addr2->sa.sa_family)
+-		return 0;
+-
+-	return af1->cmp_addr(addr1, addr2);
++	return __sctp_v6_cmp_addr(addr1, addr2);
+ }
+ 
+ /* Verify that the provided sockaddr looks bindable.   Common verification,
+diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
+index 1e0d780855c3..afd5a935bbcb 100644
+--- a/net/smc/af_smc.c
++++ b/net/smc/af_smc.c
+@@ -1254,14 +1254,12 @@ static int smc_shutdown(struct socket *sock, int how)
+ 		rc = smc_close_shutdown_write(smc);
+ 		break;
+ 	case SHUT_RD:
+-		if (sk->sk_state == SMC_LISTEN)
+-			rc = smc_close_active(smc);
+-		else
+-			rc = 0;
+-			/* nothing more to do because peer is not involved */
++		rc = 0;
++		/* nothing more to do because peer is not involved */
+ 		break;
+ 	}
+-	rc1 = kernel_sock_shutdown(smc->clcsock, how);
++	if (smc->clcsock)
++		rc1 = kernel_sock_shutdown(smc->clcsock, how);
+ 	/* map sock_shutdown_cmd constants to sk_shutdown value range */
+ 	sk->sk_shutdown |= how + 1;
+ 
+diff --git a/net/strparser/strparser.c b/net/strparser/strparser.c
+index b9283ce5cd85..092bebc70048 100644
+--- a/net/strparser/strparser.c
++++ b/net/strparser/strparser.c
+@@ -67,7 +67,7 @@ static void strp_abort_strp(struct strparser *strp, int err)
+ 
+ static void strp_start_timer(struct strparser *strp, long timeo)
+ {
+-	if (timeo)
++	if (timeo && timeo != LONG_MAX)
+ 		mod_delayed_work(strp_wq, &strp->msg_timer_work, timeo);
+ }
+ 
+@@ -296,9 +296,9 @@ static int __strp_recv(read_descriptor_t *desc, struct sk_buff *orig_skb,
+ 					strp_start_timer(strp, timeo);
+ 				}
+ 
++				stm->accum_len += cand_len;
+ 				strp->need_bytes = stm->strp.full_len -
+ 						       stm->accum_len;
+-				stm->accum_len += cand_len;
+ 				stm->early_eaten = cand_len;
+ 				STRP_STATS_ADD(strp->stats.bytes, cand_len);
+ 				desc->count = 0; /* Stop reading socket */
+@@ -321,6 +321,7 @@ static int __strp_recv(read_descriptor_t *desc, struct sk_buff *orig_skb,
+ 		/* Hurray, we have a new message! */
+ 		cancel_delayed_work(&strp->msg_timer_work);
+ 		strp->skb_head = NULL;
++		strp->need_bytes = 0;
+ 		STRP_STATS_INCR(strp->stats.msgs);
+ 
+ 		/* Give skb to upper layer */
+@@ -410,9 +411,7 @@ void strp_data_ready(struct strparser *strp)
+ 		return;
+ 
+ 	if (strp->need_bytes) {
+-		if (strp_peek_len(strp) >= strp->need_bytes)
+-			strp->need_bytes = 0;
+-		else
++		if (strp_peek_len(strp) < strp->need_bytes)
+ 			return;
+ 	}
+ 
+diff --git a/net/tipc/netlink.c b/net/tipc/netlink.c
+index b76f13f6fea1..d4e0bbeee727 100644
+--- a/net/tipc/netlink.c
++++ b/net/tipc/netlink.c
+@@ -79,7 +79,8 @@ const struct nla_policy tipc_nl_sock_policy[TIPC_NLA_SOCK_MAX + 1] = {
+ 
+ const struct nla_policy tipc_nl_net_policy[TIPC_NLA_NET_MAX + 1] = {
+ 	[TIPC_NLA_NET_UNSPEC]		= { .type = NLA_UNSPEC },
+-	[TIPC_NLA_NET_ID]		= { .type = NLA_U32 }
++	[TIPC_NLA_NET_ID]		= { .type = NLA_U32 },
++	[TIPC_NLA_NET_ADDR]		= { .type = NLA_U32 },
+ };
+ 
+ const struct nla_policy tipc_nl_link_policy[TIPC_NLA_LINK_MAX + 1] = {
+diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
+index e0fc84daed94..ad17a985f74e 100644
+--- a/net/vmw_vsock/af_vsock.c
++++ b/net/vmw_vsock/af_vsock.c
+@@ -2018,7 +2018,13 @@ const struct vsock_transport *vsock_core_get_transport(void)
+ }
+ EXPORT_SYMBOL_GPL(vsock_core_get_transport);
+ 
++static void __exit vsock_exit(void)
++{
++	/* Do nothing.  This function makes this module removable. */
++}
++
+ module_init(vsock_init_tables);
++module_exit(vsock_exit);
+ 
+ MODULE_AUTHOR("VMware, Inc.");
+ MODULE_DESCRIPTION("VMware Virtual Socket Family");
+diff --git a/security/commoncap.c b/security/commoncap.c
+index 48620c93d697..1ce701fcb3f3 100644
+--- a/security/commoncap.c
++++ b/security/commoncap.c
+@@ -449,6 +449,8 @@ int cap_inode_getsecurity(struct inode *inode, const char *name, void **buffer,
+ 				magic |= VFS_CAP_FLAGS_EFFECTIVE;
+ 			memcpy(&cap->data, &nscap->data, sizeof(__le32) * 2 * VFS_CAP_U32);
+ 			cap->magic_etc = cpu_to_le32(magic);
++		} else {
++			size = -ENOMEM;
+ 		}
+ 	}
+ 	kfree(tmpbuf);