[gentoo-commits] proj/linux-patches:4.16 commit in: /

[Mike Pagano]

commit:     54039fa3feac7ed37530054550520d924419b496
Author:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Mon Apr 30 10:30:35 2018 +0000
Commit:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Mon Apr 30 10:30:35 2018 +0000
URL:        https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=54039fa3

Linux patch 4.16.6

 0000_README             |    4 +
 1005_linux-4.16.6.patch | 3759 +++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 3763 insertions(+)

diff --git a/0000_README b/0000_README
index 344c387..d4182dc 100644
--- a/0000_README
+++ b/0000_README
@@ -63,6 +63,10 @@ Patch:  1004_linux-4.16.5.patch
 From:   http://www.kernel.org
 Desc:   Linux 4.16.5
 
+Patch:  1005_linux-4.16.6.patch
+From:   http://www.kernel.org
+Desc:   Linux 4.16.6
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.

diff --git a/1005_linux-4.16.6.patch b/1005_linux-4.16.6.patch
new file mode 100644
index 0000000..e5b7089
--- /dev/null
+++ b/1005_linux-4.16.6.patch
@@ -0,0 +1,3759 @@
+diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
+index a553d4e4a0fb..f778901c4297 100644
+--- a/Documentation/networking/ip-sysctl.txt
++++ b/Documentation/networking/ip-sysctl.txt
+@@ -1386,26 +1386,26 @@ mld_qrv - INTEGER
+ 	Default: 2 (as specified by RFC3810 9.1)
+ 	Minimum: 1 (as specified by RFC6636 4.5)
+ 
+-max_dst_opts_cnt - INTEGER
++max_dst_opts_number - INTEGER
+ 	Maximum number of non-padding TLVs allowed in a Destination
+ 	options extension header. If this value is less than zero
+ 	then unknown options are disallowed and the number of known
+ 	TLVs allowed is the absolute value of this number.
+ 	Default: 8
+ 
+-max_hbh_opts_cnt - INTEGER
++max_hbh_opts_number - INTEGER
+ 	Maximum number of non-padding TLVs allowed in a Hop-by-Hop
+ 	options extension header. If this value is less than zero
+ 	then unknown options are disallowed and the number of known
+ 	TLVs allowed is the absolute value of this number.
+ 	Default: 8
+ 
+-max dst_opts_len - INTEGER
++max_dst_opts_length - INTEGER
+ 	Maximum length allowed for a Destination options extension
+ 	header.
+ 	Default: INT_MAX (unlimited)
+ 
+-max hbh_opts_len - INTEGER
++max_hbh_length - INTEGER
+ 	Maximum length allowed for a Hop-by-Hop options extension
+ 	header.
+ 	Default: INT_MAX (unlimited)
+diff --git a/Makefile b/Makefile
+index 6678a90f355b..41f07b2b7905 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 16
+-SUBLEVEL = 5
++SUBLEVEL = 6
+ EXTRAVERSION =
+ NAME = Fearless Coyote
+ 
+diff --git a/arch/s390/kernel/perf_cpum_cf_events.c b/arch/s390/kernel/perf_cpum_cf_events.c
+index 5ee27dc9a10c..feebb2944882 100644
+--- a/arch/s390/kernel/perf_cpum_cf_events.c
++++ b/arch/s390/kernel/perf_cpum_cf_events.c
+@@ -123,7 +123,7 @@ CPUMF_EVENT_ATTR(cf_zec12, L1I_OFFBOOK_L3_SOURCED_WRITES_IV, 0x00a1);
+ CPUMF_EVENT_ATTR(cf_zec12, TX_NC_TABORT, 0x00b1);
+ CPUMF_EVENT_ATTR(cf_zec12, TX_C_TABORT_NO_SPECIAL, 0x00b2);
+ CPUMF_EVENT_ATTR(cf_zec12, TX_C_TABORT_SPECIAL, 0x00b3);
+-CPUMF_EVENT_ATTR(cf_z13, L1D_WRITES_RO_EXCL, 0x0080);
++CPUMF_EVENT_ATTR(cf_z13, L1D_RO_EXCL_WRITES, 0x0080);
+ CPUMF_EVENT_ATTR(cf_z13, DTLB1_WRITES, 0x0081);
+ CPUMF_EVENT_ATTR(cf_z13, DTLB1_MISSES, 0x0082);
+ CPUMF_EVENT_ATTR(cf_z13, DTLB1_HPAGE_WRITES, 0x0083);
+@@ -179,7 +179,7 @@ CPUMF_EVENT_ATTR(cf_z13, TX_C_TABORT_NO_SPECIAL, 0x00db);
+ CPUMF_EVENT_ATTR(cf_z13, TX_C_TABORT_SPECIAL, 0x00dc);
+ CPUMF_EVENT_ATTR(cf_z13, MT_DIAG_CYCLES_ONE_THR_ACTIVE, 0x01c0);
+ CPUMF_EVENT_ATTR(cf_z13, MT_DIAG_CYCLES_TWO_THR_ACTIVE, 0x01c1);
+-CPUMF_EVENT_ATTR(cf_z14, L1D_WRITES_RO_EXCL, 0x0080);
++CPUMF_EVENT_ATTR(cf_z14, L1D_RO_EXCL_WRITES, 0x0080);
+ CPUMF_EVENT_ATTR(cf_z14, DTLB2_WRITES, 0x0081);
+ CPUMF_EVENT_ATTR(cf_z14, DTLB2_MISSES, 0x0082);
+ CPUMF_EVENT_ATTR(cf_z14, DTLB2_HPAGE_WRITES, 0x0083);
+@@ -371,7 +371,7 @@ static struct attribute *cpumcf_zec12_pmu_event_attr[] __initdata = {
+ };
+ 
+ static struct attribute *cpumcf_z13_pmu_event_attr[] __initdata = {
+-	CPUMF_EVENT_PTR(cf_z13, L1D_WRITES_RO_EXCL),
++	CPUMF_EVENT_PTR(cf_z13, L1D_RO_EXCL_WRITES),
+ 	CPUMF_EVENT_PTR(cf_z13, DTLB1_WRITES),
+ 	CPUMF_EVENT_PTR(cf_z13, DTLB1_MISSES),
+ 	CPUMF_EVENT_PTR(cf_z13, DTLB1_HPAGE_WRITES),
+@@ -431,7 +431,7 @@ static struct attribute *cpumcf_z13_pmu_event_attr[] __initdata = {
+ };
+ 
+ static struct attribute *cpumcf_z14_pmu_event_attr[] __initdata = {
+-	CPUMF_EVENT_PTR(cf_z14, L1D_WRITES_RO_EXCL),
++	CPUMF_EVENT_PTR(cf_z14, L1D_RO_EXCL_WRITES),
+ 	CPUMF_EVENT_PTR(cf_z14, DTLB2_WRITES),
+ 	CPUMF_EVENT_PTR(cf_z14, DTLB2_MISSES),
+ 	CPUMF_EVENT_PTR(cf_z14, DTLB2_HPAGE_WRITES),
+diff --git a/arch/s390/kernel/uprobes.c b/arch/s390/kernel/uprobes.c
+index d9d1f512f019..5007fac01bb5 100644
+--- a/arch/s390/kernel/uprobes.c
++++ b/arch/s390/kernel/uprobes.c
+@@ -150,6 +150,15 @@ unsigned long arch_uretprobe_hijack_return_addr(unsigned long trampoline,
+ 	return orig;
+ }
+ 
++bool arch_uretprobe_is_alive(struct return_instance *ret, enum rp_check ctx,
++			     struct pt_regs *regs)
++{
++	if (ctx == RP_CHECK_CHAIN_CALL)
++		return user_stack_pointer(regs) <= ret->stack;
++	else
++		return user_stack_pointer(regs) < ret->stack;
++}
++
+ /* Instruction Emulation */
+ 
+ static void adjust_psw_addr(psw_t *psw, unsigned long len)
+diff --git a/drivers/acpi/acpi_video.c b/drivers/acpi/acpi_video.c
+index 76fb96966f7b..2f2e737be0f8 100644
+--- a/drivers/acpi/acpi_video.c
++++ b/drivers/acpi/acpi_video.c
+@@ -2123,6 +2123,25 @@ static int __init intel_opregion_present(void)
+ 	return opregion;
+ }
+ 
++static bool dmi_is_desktop(void)
++{
++	const char *chassis_type;
++
++	chassis_type = dmi_get_system_info(DMI_CHASSIS_TYPE);
++	if (!chassis_type)
++		return false;
++
++	if (!strcmp(chassis_type, "3") || /*  3: Desktop */
++	    !strcmp(chassis_type, "4") || /*  4: Low Profile Desktop */
++	    !strcmp(chassis_type, "5") || /*  5: Pizza Box */
++	    !strcmp(chassis_type, "6") || /*  6: Mini Tower */
++	    !strcmp(chassis_type, "7") || /*  7: Tower */
++	    !strcmp(chassis_type, "11"))  /* 11: Main Server Chassis */
++		return true;
++
++	return false;
++}
++
+ int acpi_video_register(void)
+ {
+ 	int ret = 0;
+@@ -2143,8 +2162,12 @@ int acpi_video_register(void)
+ 	 * win8 ready (where we also prefer the native backlight driver, so
+ 	 * normally the acpi_video code should not register there anyways).
+ 	 */
+-	if (only_lcd == -1)
+-		only_lcd = acpi_osi_is_win8();
++	if (only_lcd == -1) {
++		if (dmi_is_desktop() && acpi_osi_is_win8())
++			only_lcd = true;
++		else
++			only_lcd = false;
++	}
+ 
+ 	dmi_check_system(video_dmi_table);
+ 
+diff --git a/drivers/block/swim.c b/drivers/block/swim.c
+index 64e066eba72e..0e31884a9519 100644
+--- a/drivers/block/swim.c
++++ b/drivers/block/swim.c
+@@ -110,7 +110,7 @@ struct iwm {
+ /* Select values for swim_select and swim_readbit */
+ 
+ #define READ_DATA_0	0x074
+-#define TWOMEG_DRIVE	0x075
++#define ONEMEG_DRIVE	0x075
+ #define SINGLE_SIDED	0x076
+ #define DRIVE_PRESENT	0x077
+ #define DISK_IN		0x170
+@@ -118,9 +118,9 @@ struct iwm {
+ #define TRACK_ZERO	0x172
+ #define TACHO		0x173
+ #define READ_DATA_1	0x174
+-#define MFM_MODE	0x175
++#define GCR_MODE	0x175
+ #define SEEK_COMPLETE	0x176
+-#define ONEMEG_MEDIA	0x177
++#define TWOMEG_MEDIA	0x177
+ 
+ /* Bits in handshake register */
+ 
+@@ -612,7 +612,6 @@ static void setup_medium(struct floppy_state *fs)
+ 		struct floppy_struct *g;
+ 		fs->disk_in = 1;
+ 		fs->write_protected = swim_readbit(base, WRITE_PROT);
+-		fs->type = swim_readbit(base, ONEMEG_MEDIA);
+ 
+ 		if (swim_track00(base))
+ 			printk(KERN_ERR
+@@ -620,6 +619,9 @@ static void setup_medium(struct floppy_state *fs)
+ 
+ 		swim_track00(base);
+ 
++		fs->type = swim_readbit(base, TWOMEG_MEDIA) ?
++			HD_MEDIA : DD_MEDIA;
++		fs->head_number = swim_readbit(base, SINGLE_SIDED) ? 1 : 2;
+ 		get_floppy_geometry(fs, 0, &g);
+ 		fs->total_secs = g->size;
+ 		fs->secpercyl = g->head * g->sect;
+@@ -646,7 +648,7 @@ static int floppy_open(struct block_device *bdev, fmode_t mode)
+ 
+ 	swim_write(base, setup, S_IBM_DRIVE  | S_FCLK_DIV2);
+ 	udelay(10);
+-	swim_drive(base, INTERNAL_DRIVE);
++	swim_drive(base, fs->location);
+ 	swim_motor(base, ON);
+ 	swim_action(base, SETMFM);
+ 	if (fs->ejected)
+@@ -656,6 +658,8 @@ static int floppy_open(struct block_device *bdev, fmode_t mode)
+ 		goto out;
+ 	}
+ 
++	set_capacity(fs->disk, fs->total_secs);
++
+ 	if (mode & FMODE_NDELAY)
+ 		return 0;
+ 
+@@ -727,14 +731,9 @@ static int floppy_ioctl(struct block_device *bdev, fmode_t mode,
+ 		if (copy_to_user((void __user *) param, (void *) &floppy_type,
+ 				 sizeof(struct floppy_struct)))
+ 			return -EFAULT;
+-		break;
+-
+-	default:
+-		printk(KERN_DEBUG "SWIM floppy_ioctl: unknown cmd %d\n",
+-		       cmd);
+-		return -ENOSYS;
++		return 0;
+ 	}
+-	return 0;
++	return -ENOTTY;
+ }
+ 
+ static int floppy_getgeo(struct block_device *bdev, struct hd_geometry *geo)
+@@ -795,7 +794,7 @@ static struct kobject *floppy_find(dev_t dev, int *part, void *data)
+ 	struct swim_priv *swd = data;
+ 	int drive = (*part & 3);
+ 
+-	if (drive > swd->floppy_count)
++	if (drive >= swd->floppy_count)
+ 		return NULL;
+ 
+ 	*part = 0;
+@@ -813,10 +812,9 @@ static int swim_add_floppy(struct swim_priv *swd, enum drive_location location)
+ 
+ 	swim_motor(base, OFF);
+ 
+-	if (swim_readbit(base, SINGLE_SIDED))
+-		fs->head_number = 1;
+-	else
+-		fs->head_number = 2;
++	fs->type = HD_MEDIA;
++	fs->head_number = 2;
++
+ 	fs->ref_count = 0;
+ 	fs->ejected = 1;
+ 
+@@ -834,10 +832,12 @@ static int swim_floppy_init(struct swim_priv *swd)
+ 	/* scan floppy drives */
+ 
+ 	swim_drive(base, INTERNAL_DRIVE);
+-	if (swim_readbit(base, DRIVE_PRESENT))
++	if (swim_readbit(base, DRIVE_PRESENT) &&
++	    !swim_readbit(base, ONEMEG_DRIVE))
+ 		swim_add_floppy(swd, INTERNAL_DRIVE);
+ 	swim_drive(base, EXTERNAL_DRIVE);
+-	if (swim_readbit(base, DRIVE_PRESENT))
++	if (swim_readbit(base, DRIVE_PRESENT) &&
++	    !swim_readbit(base, ONEMEG_DRIVE))
+ 		swim_add_floppy(swd, EXTERNAL_DRIVE);
+ 
+ 	/* register floppy drives */
+@@ -861,7 +861,6 @@ static int swim_floppy_init(struct swim_priv *swd)
+ 							      &swd->lock);
+ 		if (!swd->unit[drive].disk->queue) {
+ 			err = -ENOMEM;
+-			put_disk(swd->unit[drive].disk);
+ 			goto exit_put_disks;
+ 		}
+ 		blk_queue_bounce_limit(swd->unit[drive].disk->queue,
+@@ -911,7 +910,7 @@ static int swim_probe(struct platform_device *dev)
+ 		goto out;
+ 	}
+ 
+-	swim_base = ioremap(res->start, resource_size(res));
++	swim_base = (struct swim __iomem *)res->start;
+ 	if (!swim_base) {
+ 		ret = -ENOMEM;
+ 		goto out_release_io;
+@@ -923,7 +922,7 @@ static int swim_probe(struct platform_device *dev)
+ 	if (!get_swim_mode(swim_base)) {
+ 		printk(KERN_INFO "SWIM device not found !\n");
+ 		ret = -ENODEV;
+-		goto out_iounmap;
++		goto out_release_io;
+ 	}
+ 
+ 	/* set platform driver data */
+@@ -931,7 +930,7 @@ static int swim_probe(struct platform_device *dev)
+ 	swd = kzalloc(sizeof(struct swim_priv), GFP_KERNEL);
+ 	if (!swd) {
+ 		ret = -ENOMEM;
+-		goto out_iounmap;
++		goto out_release_io;
+ 	}
+ 	platform_set_drvdata(dev, swd);
+ 
+@@ -945,8 +944,6 @@ static int swim_probe(struct platform_device *dev)
+ 
+ out_kfree:
+ 	kfree(swd);
+-out_iounmap:
+-	iounmap(swim_base);
+ out_release_io:
+ 	release_mem_region(res->start, resource_size(res));
+ out:
+@@ -974,8 +971,6 @@ static int swim_remove(struct platform_device *dev)
+ 	for (drive = 0; drive < swd->floppy_count; drive++)
+ 		floppy_eject(&swd->unit[drive]);
+ 
+-	iounmap(swd->base);
+-
+ 	res = platform_get_resource(dev, IORESOURCE_MEM, 0);
+ 	if (res)
+ 		release_mem_region(res->start, resource_size(res));
+diff --git a/drivers/block/swim3.c b/drivers/block/swim3.c
+index af51015d056e..469541c1e51e 100644
+--- a/drivers/block/swim3.c
++++ b/drivers/block/swim3.c
+@@ -148,7 +148,7 @@ struct swim3 {
+ #define MOTOR_ON	2
+ #define RELAX		3	/* also eject in progress */
+ #define READ_DATA_0	4
+-#define TWOMEG_DRIVE	5
++#define ONEMEG_DRIVE	5
+ #define SINGLE_SIDED	6	/* drive or diskette is 4MB type? */
+ #define DRIVE_PRESENT	7
+ #define DISK_IN		8
+@@ -156,9 +156,9 @@ struct swim3 {
+ #define TRACK_ZERO	10
+ #define TACHO		11
+ #define READ_DATA_1	12
+-#define MFM_MODE	13
++#define GCR_MODE	13
+ #define SEEK_COMPLETE	14
+-#define ONEMEG_MEDIA	15
++#define TWOMEG_MEDIA	15
+ 
+ /* Definitions of values used in writing and formatting */
+ #define DATA_ESCAPE	0x99
+diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c
+index e36d160c458f..5f7d86509f2f 100644
+--- a/drivers/cdrom/cdrom.c
++++ b/drivers/cdrom/cdrom.c
+@@ -2374,7 +2374,7 @@ static int cdrom_ioctl_media_changed(struct cdrom_device_info *cdi,
+ 	if (!CDROM_CAN(CDC_SELECT_DISC) || arg == CDSL_CURRENT)
+ 		return media_changed(cdi, 1);
+ 
+-	if ((unsigned int)arg >= cdi->capacity)
++	if (arg >= cdi->capacity)
+ 		return -EINVAL;
+ 
+ 	info = kmalloc(sizeof(*info), GFP_KERNEL);
+diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interface.c
+index 248c04090dea..255db6fe15c8 100644
+--- a/drivers/char/tpm/tpm-interface.c
++++ b/drivers/char/tpm/tpm-interface.c
+@@ -369,20 +369,40 @@ static int tpm_validate_command(struct tpm_chip *chip,
+ 	return -EINVAL;
+ }
+ 
+-/**
+- * tmp_transmit - Internal kernel interface to transmit TPM commands.
+- *
+- * @chip: TPM chip to use
+- * @buf: TPM command buffer
+- * @bufsiz: length of the TPM command buffer
+- * @flags: tpm transmit flags - bitmap
+- *
+- * Return:
+- *     0 when the operation is successful.
+- *     A negative number for system errors (errno).
+- */
+-ssize_t tpm_transmit(struct tpm_chip *chip, struct tpm_space *space,
+-		     u8 *buf, size_t bufsiz, unsigned int flags)
++static int tpm_request_locality(struct tpm_chip *chip)
++{
++	int rc;
++
++	if (!chip->ops->request_locality)
++		return 0;
++
++	rc = chip->ops->request_locality(chip, 0);
++	if (rc < 0)
++		return rc;
++
++	chip->locality = rc;
++
++	return 0;
++}
++
++static void tpm_relinquish_locality(struct tpm_chip *chip)
++{
++	int rc;
++
++	if (!chip->ops->relinquish_locality)
++		return;
++
++	rc = chip->ops->relinquish_locality(chip, chip->locality);
++	if (rc)
++		dev_err(&chip->dev, "%s: : error %d\n", __func__, rc);
++
++	chip->locality = -1;
++}
++
++static ssize_t tpm_try_transmit(struct tpm_chip *chip,
++				struct tpm_space *space,
++				u8 *buf, size_t bufsiz,
++				unsigned int flags)
+ {
+ 	struct tpm_output_header *header = (void *)buf;
+ 	int rc;
+@@ -422,8 +442,6 @@ ssize_t tpm_transmit(struct tpm_chip *chip, struct tpm_space *space,
+ 	if (!(flags & TPM_TRANSMIT_UNLOCKED))
+ 		mutex_lock(&chip->tpm_mutex);
+ 
+-	if (chip->dev.parent)
+-		pm_runtime_get_sync(chip->dev.parent);
+ 
+ 	if (chip->ops->clk_enable != NULL)
+ 		chip->ops->clk_enable(chip, true);
+@@ -431,14 +449,15 @@ ssize_t tpm_transmit(struct tpm_chip *chip, struct tpm_space *space,
+ 	/* Store the decision as chip->locality will be changed. */
+ 	need_locality = chip->locality == -1;
+ 
+-	if (!(flags & TPM_TRANSMIT_RAW) &&
+-	    need_locality && chip->ops->request_locality)  {
+-		rc = chip->ops->request_locality(chip, 0);
++	if (!(flags & TPM_TRANSMIT_RAW) && need_locality) {
++		rc = tpm_request_locality(chip);
+ 		if (rc < 0)
+ 			goto out_no_locality;
+-		chip->locality = rc;
+ 	}
+ 
++	if (chip->dev.parent)
++		pm_runtime_get_sync(chip->dev.parent);
++
+ 	rc = tpm2_prepare_space(chip, space, ordinal, buf);
+ 	if (rc)
+ 		goto out;
+@@ -499,27 +518,83 @@ ssize_t tpm_transmit(struct tpm_chip *chip, struct tpm_space *space,
+ 	rc = tpm2_commit_space(chip, space, ordinal, buf, &len);
+ 
+ out:
+-	if (need_locality && chip->ops->relinquish_locality) {
+-		chip->ops->relinquish_locality(chip, chip->locality);
+-		chip->locality = -1;
+-	}
++	if (chip->dev.parent)
++		pm_runtime_put_sync(chip->dev.parent);
++
++	if (need_locality)
++		tpm_relinquish_locality(chip);
++
+ out_no_locality:
+ 	if (chip->ops->clk_enable != NULL)
+ 		chip->ops->clk_enable(chip, false);
+ 
+-	if (chip->dev.parent)
+-		pm_runtime_put_sync(chip->dev.parent);
+-
+ 	if (!(flags & TPM_TRANSMIT_UNLOCKED))
+ 		mutex_unlock(&chip->tpm_mutex);
+ 	return rc ? rc : len;
+ }
+ 
+ /**
+- * tmp_transmit_cmd - send a tpm command to the device
++ * tpm_transmit - Internal kernel interface to transmit TPM commands.
++ *
++ * @chip: TPM chip to use
++ * @space: tpm space
++ * @buf: TPM command buffer
++ * @bufsiz: length of the TPM command buffer
++ * @flags: tpm transmit flags - bitmap
++ *
++ * A wrapper around tpm_try_transmit that handles TPM2_RC_RETRY
++ * returns from the TPM and retransmits the command after a delay up
++ * to a maximum wait of TPM2_DURATION_LONG.
++ *
++ * Note: TPM1 never returns TPM2_RC_RETRY so the retry logic is TPM2
++ * only
++ *
++ * Return:
++ *     the length of the return when the operation is successful.
++ *     A negative number for system errors (errno).
++ */
++ssize_t tpm_transmit(struct tpm_chip *chip, struct tpm_space *space,
++		     u8 *buf, size_t bufsiz, unsigned int flags)
++{
++	struct tpm_output_header *header = (struct tpm_output_header *)buf;
++	/* space for header and handles */
++	u8 save[TPM_HEADER_SIZE + 3*sizeof(u32)];
++	unsigned int delay_msec = TPM2_DURATION_SHORT;
++	u32 rc = 0;
++	ssize_t ret;
++	const size_t save_size = min(space ? sizeof(save) : TPM_HEADER_SIZE,
++				     bufsiz);
++
++	/*
++	 * Subtlety here: if we have a space, the handles will be
++	 * transformed, so when we restore the header we also have to
++	 * restore the handles.
++	 */
++	memcpy(save, buf, save_size);
++
++	for (;;) {
++		ret = tpm_try_transmit(chip, space, buf, bufsiz, flags);
++		if (ret < 0)
++			break;
++		rc = be32_to_cpu(header->return_code);
++		if (rc != TPM2_RC_RETRY)
++			break;
++		delay_msec *= 2;
++		if (delay_msec > TPM2_DURATION_LONG) {
++			dev_err(&chip->dev, "TPM is in retry loop\n");
++			break;
++		}
++		tpm_msleep(delay_msec);
++		memcpy(buf, save, save_size);
++	}
++	return ret;
++}
++/**
++ * tpm_transmit_cmd - send a tpm command to the device
+  *    The function extracts tpm out header return code
+  *
+  * @chip: TPM chip to use
++ * @space: tpm space
+  * @buf: TPM command buffer
+  * @bufsiz: length of the buffer
+  * @min_rsp_body_length: minimum expected length of response body
+diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h
+index f895fba4e20d..d73f3fb81b42 100644
+--- a/drivers/char/tpm/tpm.h
++++ b/drivers/char/tpm/tpm.h
+@@ -108,6 +108,7 @@ enum tpm2_return_codes {
+ 	TPM2_RC_COMMAND_CODE    = 0x0143,
+ 	TPM2_RC_TESTING		= 0x090A, /* RC_WARN */
+ 	TPM2_RC_REFERENCE_H0	= 0x0910,
++	TPM2_RC_RETRY		= 0x0922,
+ };
+ 
+ enum tpm2_algorithms {
+diff --git a/drivers/char/tpm/tpm_crb.c b/drivers/char/tpm/tpm_crb.c
+index 7b3c2a8aa9de..497edd9848cd 100644
+--- a/drivers/char/tpm/tpm_crb.c
++++ b/drivers/char/tpm/tpm_crb.c
+@@ -112,6 +112,25 @@ struct tpm2_crb_smc {
+ 	u32 smc_func_id;
+ };
+ 
++static bool crb_wait_for_reg_32(u32 __iomem *reg, u32 mask, u32 value,
++				unsigned long timeout)
++{
++	ktime_t start;
++	ktime_t stop;
++
++	start = ktime_get();
++	stop = ktime_add(start, ms_to_ktime(timeout));
++
++	do {
++		if ((ioread32(reg) & mask) == value)
++			return true;
++
++		usleep_range(50, 100);
++	} while (ktime_before(ktime_get(), stop));
++
++	return ((ioread32(reg) & mask) == value);
++}
++
+ /**
+  * crb_go_idle - request tpm crb device to go the idle state
+  *
+@@ -128,7 +147,7 @@ struct tpm2_crb_smc {
+  *
+  * Return: 0 always
+  */
+-static int __maybe_unused crb_go_idle(struct device *dev, struct crb_priv *priv)
++static int crb_go_idle(struct device *dev, struct crb_priv *priv)
+ {
+ 	if ((priv->sm == ACPI_TPM2_START_METHOD) ||
+ 	    (priv->sm == ACPI_TPM2_COMMAND_BUFFER_WITH_START_METHOD) ||
+@@ -136,30 +155,17 @@ static int __maybe_unused crb_go_idle(struct device *dev, struct crb_priv *priv)
+ 		return 0;
+ 
+ 	iowrite32(CRB_CTRL_REQ_GO_IDLE, &priv->regs_t->ctrl_req);
+-	/* we don't really care when this settles */
+ 
++	if (!crb_wait_for_reg_32(&priv->regs_t->ctrl_req,
++				 CRB_CTRL_REQ_GO_IDLE/* mask */,
++				 0, /* value */
++				 TPM2_TIMEOUT_C)) {
++		dev_warn(dev, "goIdle timed out\n");
++		return -ETIME;
++	}
+ 	return 0;
+ }
+ 
+-static bool crb_wait_for_reg_32(u32 __iomem *reg, u32 mask, u32 value,
+-				unsigned long timeout)
+-{
+-	ktime_t start;
+-	ktime_t stop;
+-
+-	start = ktime_get();
+-	stop = ktime_add(start, ms_to_ktime(timeout));
+-
+-	do {
+-		if ((ioread32(reg) & mask) == value)
+-			return true;
+-
+-		usleep_range(50, 100);
+-	} while (ktime_before(ktime_get(), stop));
+-
+-	return false;
+-}
+-
+ /**
+  * crb_cmd_ready - request tpm crb device to enter ready state
+  *
+@@ -175,8 +181,7 @@ static bool crb_wait_for_reg_32(u32 __iomem *reg, u32 mask, u32 value,
+  *
+  * Return: 0 on success -ETIME on timeout;
+  */
+-static int __maybe_unused crb_cmd_ready(struct device *dev,
+-					struct crb_priv *priv)
++static int crb_cmd_ready(struct device *dev, struct crb_priv *priv)
+ {
+ 	if ((priv->sm == ACPI_TPM2_START_METHOD) ||
+ 	    (priv->sm == ACPI_TPM2_COMMAND_BUFFER_WITH_START_METHOD) ||
+@@ -195,11 +200,11 @@ static int __maybe_unused crb_cmd_ready(struct device *dev,
+ 	return 0;
+ }
+ 
+-static int crb_request_locality(struct tpm_chip *chip, int loc)
++static int __crb_request_locality(struct device *dev,
++				  struct crb_priv *priv, int loc)
+ {
+-	struct crb_priv *priv = dev_get_drvdata(&chip->dev);
+ 	u32 value = CRB_LOC_STATE_LOC_ASSIGNED |
+-		CRB_LOC_STATE_TPM_REG_VALID_STS;
++		    CRB_LOC_STATE_TPM_REG_VALID_STS;
+ 
+ 	if (!priv->regs_h)
+ 		return 0;
+@@ -207,21 +212,45 @@ static int crb_request_locality(struct tpm_chip *chip, int loc)
+ 	iowrite32(CRB_LOC_CTRL_REQUEST_ACCESS, &priv->regs_h->loc_ctrl);
+ 	if (!crb_wait_for_reg_32(&priv->regs_h->loc_state, value, value,
+ 				 TPM2_TIMEOUT_C)) {
+-		dev_warn(&chip->dev, "TPM_LOC_STATE_x.requestAccess timed out\n");
++		dev_warn(dev, "TPM_LOC_STATE_x.requestAccess timed out\n");
+ 		return -ETIME;
+ 	}
+ 
+ 	return 0;
+ }
+ 
+-static void crb_relinquish_locality(struct tpm_chip *chip, int loc)
++static int crb_request_locality(struct tpm_chip *chip, int loc)
+ {
+ 	struct crb_priv *priv = dev_get_drvdata(&chip->dev);
+ 
++	return __crb_request_locality(&chip->dev, priv, loc);
++}
++
++static int __crb_relinquish_locality(struct device *dev,
++				     struct crb_priv *priv, int loc)
++{
++	u32 mask = CRB_LOC_STATE_LOC_ASSIGNED |
++		   CRB_LOC_STATE_TPM_REG_VALID_STS;
++	u32 value = CRB_LOC_STATE_TPM_REG_VALID_STS;
++
+ 	if (!priv->regs_h)
+-		return;
++		return 0;
+ 
+ 	iowrite32(CRB_LOC_CTRL_RELINQUISH, &priv->regs_h->loc_ctrl);
++	if (!crb_wait_for_reg_32(&priv->regs_h->loc_state, mask, value,
++				 TPM2_TIMEOUT_C)) {
++		dev_warn(dev, "TPM_LOC_STATE_x.requestAccess timed out\n");
++		return -ETIME;
++	}
++
++	return 0;
++}
++
++static int crb_relinquish_locality(struct tpm_chip *chip, int loc)
++{
++	struct crb_priv *priv = dev_get_drvdata(&chip->dev);
++
++	return __crb_relinquish_locality(&chip->dev, priv, loc);
+ }
+ 
+ static u8 crb_status(struct tpm_chip *chip)
+@@ -475,6 +504,10 @@ static int crb_map_io(struct acpi_device *device, struct crb_priv *priv,
+ 			dev_warn(dev, FW_BUG "Bad ACPI memory layout");
+ 	}
+ 
++	ret = __crb_request_locality(dev, priv, 0);
++	if (ret)
++		return ret;
++
+ 	priv->regs_t = crb_map_res(dev, priv, &io_res, buf->control_address,
+ 				   sizeof(struct crb_regs_tail));
+ 	if (IS_ERR(priv->regs_t))
+@@ -531,6 +564,8 @@ static int crb_map_io(struct acpi_device *device, struct crb_priv *priv,
+ 
+ 	crb_go_idle(dev, priv);
+ 
++	__crb_relinquish_locality(dev, priv, 0);
++
+ 	return ret;
+ }
+ 
+@@ -588,10 +623,14 @@ static int crb_acpi_add(struct acpi_device *device)
+ 	chip->acpi_dev_handle = device->handle;
+ 	chip->flags = TPM_CHIP_FLAG_TPM2;
+ 
+-	rc  = crb_cmd_ready(dev, priv);
++	rc = __crb_request_locality(dev, priv, 0);
+ 	if (rc)
+ 		return rc;
+ 
++	rc  = crb_cmd_ready(dev, priv);
++	if (rc)
++		goto out;
++
+ 	pm_runtime_get_noresume(dev);
+ 	pm_runtime_set_active(dev);
+ 	pm_runtime_enable(dev);
+@@ -601,12 +640,15 @@ static int crb_acpi_add(struct acpi_device *device)
+ 		crb_go_idle(dev, priv);
+ 		pm_runtime_put_noidle(dev);
+ 		pm_runtime_disable(dev);
+-		return rc;
++		goto out;
+ 	}
+ 
+-	pm_runtime_put(dev);
++	pm_runtime_put_sync(dev);
+ 
+-	return 0;
++out:
++	__crb_relinquish_locality(dev, priv, 0);
++
++	return rc;
+ }
+ 
+ static int crb_acpi_remove(struct acpi_device *device)
+diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c
+index da074e3db19b..5a1f47b43947 100644
+--- a/drivers/char/tpm/tpm_tis_core.c
++++ b/drivers/char/tpm/tpm_tis_core.c
+@@ -143,11 +143,13 @@ static bool check_locality(struct tpm_chip *chip, int l)
+ 	return false;
+ }
+ 
+-static void release_locality(struct tpm_chip *chip, int l)
++static int release_locality(struct tpm_chip *chip, int l)
+ {
+ 	struct tpm_tis_data *priv = dev_get_drvdata(&chip->dev);
+ 
+ 	tpm_tis_write8(priv, TPM_ACCESS(l), TPM_ACCESS_ACTIVE_LOCALITY);
++
++	return 0;
+ }
+ 
+ static int request_locality(struct tpm_chip *chip, int l)
+diff --git a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c
+index a38db40ce990..b2447ee3b245 100644
+--- a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c
++++ b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c
+@@ -1637,6 +1637,8 @@ static void dw_hdmi_clear_overflow(struct dw_hdmi *hdmi)
+ 	 * (and possibly on the platform). So far only i.MX6Q (v1.30a) and
+ 	 * i.MX6DL (v1.31a) have been identified as needing the workaround, with
+ 	 * 4 and 1 iterations respectively.
++	 * The Amlogic Meson GX SoCs (v2.01a) have been identified as needing
++	 * the workaround with a single iteration.
+ 	 */
+ 
+ 	switch (hdmi->version) {
+@@ -1644,6 +1646,7 @@ static void dw_hdmi_clear_overflow(struct dw_hdmi *hdmi)
+ 		count = 4;
+ 		break;
+ 	case 0x131a:
++	case 0x201a:
+ 		count = 1;
+ 		break;
+ 	default:
+diff --git a/drivers/hwmon/k10temp.c b/drivers/hwmon/k10temp.c
+index 051a72eecb24..d2cc55e21374 100644
+--- a/drivers/hwmon/k10temp.c
++++ b/drivers/hwmon/k10temp.c
+@@ -40,6 +40,10 @@ static DEFINE_MUTEX(nb_smu_ind_mutex);
+ #define PCI_DEVICE_ID_AMD_17H_DF_F3	0x1463
+ #endif
+ 
++#ifndef PCI_DEVICE_ID_AMD_17H_RR_NB
++#define PCI_DEVICE_ID_AMD_17H_RR_NB	0x15d0
++#endif
++
+ /* CPUID function 0x80000001, ebx */
+ #define CPUID_PKGTYPE_MASK	0xf0000000
+ #define CPUID_PKGTYPE_F		0x00000000
+@@ -72,6 +76,7 @@ struct k10temp_data {
+ 	struct pci_dev *pdev;
+ 	void (*read_tempreg)(struct pci_dev *pdev, u32 *regval);
+ 	int temp_offset;
++	u32 temp_adjust_mask;
+ };
+ 
+ struct tctl_offset {
+@@ -84,6 +89,7 @@ static const struct tctl_offset tctl_offset_table[] = {
+ 	{ 0x17, "AMD Ryzen 5 1600X", 20000 },
+ 	{ 0x17, "AMD Ryzen 7 1700X", 20000 },
+ 	{ 0x17, "AMD Ryzen 7 1800X", 20000 },
++	{ 0x17, "AMD Ryzen 7 2700X", 10000 },
+ 	{ 0x17, "AMD Ryzen Threadripper 1950X", 27000 },
+ 	{ 0x17, "AMD Ryzen Threadripper 1920X", 27000 },
+ 	{ 0x17, "AMD Ryzen Threadripper 1900X", 27000 },
+@@ -129,6 +135,8 @@ static ssize_t temp1_input_show(struct device *dev,
+ 
+ 	data->read_tempreg(data->pdev, &regval);
+ 	temp = (regval >> 21) * 125;
++	if (regval & data->temp_adjust_mask)
++		temp -= 49000;
+ 	if (temp > data->temp_offset)
+ 		temp -= data->temp_offset;
+ 	else
+@@ -259,12 +267,14 @@ static int k10temp_probe(struct pci_dev *pdev,
+ 	data->pdev = pdev;
+ 
+ 	if (boot_cpu_data.x86 == 0x15 && (boot_cpu_data.x86_model == 0x60 ||
+-					  boot_cpu_data.x86_model == 0x70))
++					  boot_cpu_data.x86_model == 0x70)) {
+ 		data->read_tempreg = read_tempreg_nb_f15;
+-	else if (boot_cpu_data.x86 == 0x17)
++	} else if (boot_cpu_data.x86 == 0x17) {
++		data->temp_adjust_mask = 0x80000;
+ 		data->read_tempreg = read_tempreg_nb_f17;
+-	else
++	} else {
+ 		data->read_tempreg = read_tempreg_pci;
++	}
+ 
+ 	for (i = 0; i < ARRAY_SIZE(tctl_offset_table); i++) {
+ 		const struct tctl_offset *entry = &tctl_offset_table[i];
+@@ -292,6 +302,7 @@ static const struct pci_device_id k10temp_id_table[] = {
+ 	{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_16H_NB_F3) },
+ 	{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_16H_M30H_NB_F3) },
+ 	{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_17H_DF_F3) },
++	{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_17H_RR_NB) },
+ 	{}
+ };
+ MODULE_DEVICE_TABLE(pci, k10temp_id_table);
+diff --git a/drivers/message/fusion/mptsas.c b/drivers/message/fusion/mptsas.c
+index 439ee9c5f535..c59b5da85321 100644
+--- a/drivers/message/fusion/mptsas.c
++++ b/drivers/message/fusion/mptsas.c
+@@ -1994,6 +1994,7 @@ static struct scsi_host_template mptsas_driver_template = {
+ 	.cmd_per_lun			= 7,
+ 	.use_clustering			= ENABLE_CLUSTERING,
+ 	.shost_attrs			= mptscsih_host_attrs,
++	.no_write_same			= 1,
+ };
+ 
+ static int mptsas_get_linkerrors(struct sas_phy *phy)
+diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
+index b7b113018853..718e4914e3a0 100644
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -1660,8 +1660,7 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev,
+ 	} /* switch(bond_mode) */
+ 
+ #ifdef CONFIG_NET_POLL_CONTROLLER
+-	slave_dev->npinfo = bond->dev->npinfo;
+-	if (slave_dev->npinfo) {
++	if (bond->dev->npinfo) {
+ 		if (slave_enable_netpoll(new_slave)) {
+ 			netdev_info(bond_dev, "master_dev is using netpoll, but new slave device does not support netpoll\n");
+ 			res = -EBUSY;
+diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-common.h b/drivers/net/ethernet/amd/xgbe/xgbe-common.h
+index 7ea72ef11a55..d272dc6984ac 100644
+--- a/drivers/net/ethernet/amd/xgbe/xgbe-common.h
++++ b/drivers/net/ethernet/amd/xgbe/xgbe-common.h
+@@ -1321,6 +1321,10 @@
+ #define MDIO_VEND2_AN_STAT		0x8002
+ #endif
+ 
++#ifndef MDIO_VEND2_PMA_CDR_CONTROL
++#define MDIO_VEND2_PMA_CDR_CONTROL	0x8056
++#endif
++
+ #ifndef MDIO_CTRL1_SPEED1G
+ #define MDIO_CTRL1_SPEED1G		(MDIO_CTRL1_SPEED10G & ~BMCR_SPEED100)
+ #endif
+@@ -1369,6 +1373,10 @@
+ #define XGBE_AN_CL37_TX_CONFIG_MASK	0x08
+ #define XGBE_AN_CL37_MII_CTRL_8BIT	0x0100
+ 
++#define XGBE_PMA_CDR_TRACK_EN_MASK	0x01
++#define XGBE_PMA_CDR_TRACK_EN_OFF	0x00
++#define XGBE_PMA_CDR_TRACK_EN_ON	0x01
++
+ /* Bit setting and getting macros
+  *  The get macro will extract the current bit field value from within
+  *  the variable
+diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-debugfs.c b/drivers/net/ethernet/amd/xgbe/xgbe-debugfs.c
+index 7d128be61310..b91143947ed2 100644
+--- a/drivers/net/ethernet/amd/xgbe/xgbe-debugfs.c
++++ b/drivers/net/ethernet/amd/xgbe/xgbe-debugfs.c
+@@ -519,6 +519,22 @@ void xgbe_debugfs_init(struct xgbe_prv_data *pdata)
+ 				   "debugfs_create_file failed\n");
+ 	}
+ 
++	if (pdata->vdata->an_cdr_workaround) {
++		pfile = debugfs_create_bool("an_cdr_workaround", 0600,
++					    pdata->xgbe_debugfs,
++					    &pdata->debugfs_an_cdr_workaround);
++		if (!pfile)
++			netdev_err(pdata->netdev,
++				   "debugfs_create_bool failed\n");
++
++		pfile = debugfs_create_bool("an_cdr_track_early", 0600,
++					    pdata->xgbe_debugfs,
++					    &pdata->debugfs_an_cdr_track_early);
++		if (!pfile)
++			netdev_err(pdata->netdev,
++				   "debugfs_create_bool failed\n");
++	}
++
+ 	kfree(buf);
+ }
+ 
+diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-main.c b/drivers/net/ethernet/amd/xgbe/xgbe-main.c
+index d91fa595be98..e31d9d1fb6a6 100644
+--- a/drivers/net/ethernet/amd/xgbe/xgbe-main.c
++++ b/drivers/net/ethernet/amd/xgbe/xgbe-main.c
+@@ -349,6 +349,7 @@ int xgbe_config_netdev(struct xgbe_prv_data *pdata)
+ 	XGMAC_SET_BITS(pdata->rss_options, MAC_RSSCR, UDP4TE, 1);
+ 
+ 	/* Call MDIO/PHY initialization routine */
++	pdata->debugfs_an_cdr_workaround = pdata->vdata->an_cdr_workaround;
+ 	ret = pdata->phy_if.phy_init(pdata);
+ 	if (ret)
+ 		return ret;
+diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
+index 072b9f664597..1b45cd73a258 100644
+--- a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
++++ b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
+@@ -432,11 +432,16 @@ static void xgbe_an73_disable(struct xgbe_prv_data *pdata)
+ 	xgbe_an73_set(pdata, false, false);
+ 	xgbe_an73_disable_interrupts(pdata);
+ 
++	pdata->an_start = 0;
++
+ 	netif_dbg(pdata, link, pdata->netdev, "CL73 AN disabled\n");
+ }
+ 
+ static void xgbe_an_restart(struct xgbe_prv_data *pdata)
+ {
++	if (pdata->phy_if.phy_impl.an_pre)
++		pdata->phy_if.phy_impl.an_pre(pdata);
++
+ 	switch (pdata->an_mode) {
+ 	case XGBE_AN_MODE_CL73:
+ 	case XGBE_AN_MODE_CL73_REDRV:
+@@ -453,6 +458,9 @@ static void xgbe_an_restart(struct xgbe_prv_data *pdata)
+ 
+ static void xgbe_an_disable(struct xgbe_prv_data *pdata)
+ {
++	if (pdata->phy_if.phy_impl.an_post)
++		pdata->phy_if.phy_impl.an_post(pdata);
++
+ 	switch (pdata->an_mode) {
+ 	case XGBE_AN_MODE_CL73:
+ 	case XGBE_AN_MODE_CL73_REDRV:
+@@ -505,11 +513,11 @@ static enum xgbe_an xgbe_an73_tx_training(struct xgbe_prv_data *pdata,
+ 		XMDIO_WRITE(pdata, MDIO_MMD_PMAPMD, MDIO_PMA_10GBR_PMD_CTRL,
+ 			    reg);
+ 
+-		if (pdata->phy_if.phy_impl.kr_training_post)
+-			pdata->phy_if.phy_impl.kr_training_post(pdata);
+-
+ 		netif_dbg(pdata, link, pdata->netdev,
+ 			  "KR training initiated\n");
++
++		if (pdata->phy_if.phy_impl.kr_training_post)
++			pdata->phy_if.phy_impl.kr_training_post(pdata);
+ 	}
+ 
+ 	return XGBE_AN_PAGE_RECEIVED;
+@@ -637,11 +645,11 @@ static enum xgbe_an xgbe_an73_incompat_link(struct xgbe_prv_data *pdata)
+ 			return XGBE_AN_NO_LINK;
+ 	}
+ 
+-	xgbe_an73_disable(pdata);
++	xgbe_an_disable(pdata);
+ 
+ 	xgbe_switch_mode(pdata);
+ 
+-	xgbe_an73_restart(pdata);
++	xgbe_an_restart(pdata);
+ 
+ 	return XGBE_AN_INCOMPAT_LINK;
+ }
+@@ -820,6 +828,9 @@ static void xgbe_an37_state_machine(struct xgbe_prv_data *pdata)
+ 		pdata->an_result = pdata->an_state;
+ 		pdata->an_state = XGBE_AN_READY;
+ 
++		if (pdata->phy_if.phy_impl.an_post)
++			pdata->phy_if.phy_impl.an_post(pdata);
++
+ 		netif_dbg(pdata, link, pdata->netdev, "CL37 AN result: %s\n",
+ 			  xgbe_state_as_string(pdata->an_result));
+ 	}
+@@ -903,6 +914,9 @@ static void xgbe_an73_state_machine(struct xgbe_prv_data *pdata)
+ 		pdata->kx_state = XGBE_RX_BPA;
+ 		pdata->an_start = 0;
+ 
++		if (pdata->phy_if.phy_impl.an_post)
++			pdata->phy_if.phy_impl.an_post(pdata);
++
+ 		netif_dbg(pdata, link, pdata->netdev, "CL73 AN result: %s\n",
+ 			  xgbe_state_as_string(pdata->an_result));
+ 	}
+diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-pci.c b/drivers/net/ethernet/amd/xgbe/xgbe-pci.c
+index eb23f9ba1a9a..82d1f416ee2a 100644
+--- a/drivers/net/ethernet/amd/xgbe/xgbe-pci.c
++++ b/drivers/net/ethernet/amd/xgbe/xgbe-pci.c
+@@ -456,6 +456,7 @@ static const struct xgbe_version_data xgbe_v2a = {
+ 	.irq_reissue_support		= 1,
+ 	.tx_desc_prefetch		= 5,
+ 	.rx_desc_prefetch		= 5,
++	.an_cdr_workaround		= 1,
+ };
+ 
+ static const struct xgbe_version_data xgbe_v2b = {
+@@ -470,6 +471,7 @@ static const struct xgbe_version_data xgbe_v2b = {
+ 	.irq_reissue_support		= 1,
+ 	.tx_desc_prefetch		= 5,
+ 	.rx_desc_prefetch		= 5,
++	.an_cdr_workaround		= 1,
+ };
+ 
+ static const struct pci_device_id xgbe_pci_table[] = {
+diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c b/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c
+index 3304a291aa96..aac884314000 100644
+--- a/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c
++++ b/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c
+@@ -147,6 +147,14 @@
+ /* Rate-change complete wait/retry count */
+ #define XGBE_RATECHANGE_COUNT		500
+ 
++/* CDR delay values for KR support (in usec) */
++#define XGBE_CDR_DELAY_INIT		10000
++#define XGBE_CDR_DELAY_INC		10000
++#define XGBE_CDR_DELAY_MAX		100000
++
++/* RRC frequency during link status check */
++#define XGBE_RRC_FREQUENCY		10
++
+ enum xgbe_port_mode {
+ 	XGBE_PORT_MODE_RSVD = 0,
+ 	XGBE_PORT_MODE_BACKPLANE,
+@@ -245,6 +253,10 @@ enum xgbe_sfp_speed {
+ #define XGBE_SFP_BASE_VENDOR_SN			4
+ #define XGBE_SFP_BASE_VENDOR_SN_LEN		16
+ 
++#define XGBE_SFP_EXTD_OPT1			1
++#define XGBE_SFP_EXTD_OPT1_RX_LOS		BIT(1)
++#define XGBE_SFP_EXTD_OPT1_TX_FAULT		BIT(3)
++
+ #define XGBE_SFP_EXTD_DIAG			28
+ #define XGBE_SFP_EXTD_DIAG_ADDR_CHANGE		BIT(2)
+ 
+@@ -324,6 +336,7 @@ struct xgbe_phy_data {
+ 
+ 	unsigned int sfp_gpio_address;
+ 	unsigned int sfp_gpio_mask;
++	unsigned int sfp_gpio_inputs;
+ 	unsigned int sfp_gpio_rx_los;
+ 	unsigned int sfp_gpio_tx_fault;
+ 	unsigned int sfp_gpio_mod_absent;
+@@ -355,6 +368,10 @@ struct xgbe_phy_data {
+ 	unsigned int redrv_addr;
+ 	unsigned int redrv_lane;
+ 	unsigned int redrv_model;
++
++	/* KR AN support */
++	unsigned int phy_cdr_notrack;
++	unsigned int phy_cdr_delay;
+ };
+ 
+ /* I2C, MDIO and GPIO lines are muxed, so only one device at a time */
+@@ -974,6 +991,49 @@ static void xgbe_phy_sfp_external_phy(struct xgbe_prv_data *pdata)
+ 	phy_data->sfp_phy_avail = 1;
+ }
+ 
++static bool xgbe_phy_check_sfp_rx_los(struct xgbe_phy_data *phy_data)
++{
++	u8 *sfp_extd = phy_data->sfp_eeprom.extd;
++
++	if (!(sfp_extd[XGBE_SFP_EXTD_OPT1] & XGBE_SFP_EXTD_OPT1_RX_LOS))
++		return false;
++
++	if (phy_data->sfp_gpio_mask & XGBE_GPIO_NO_RX_LOS)
++		return false;
++
++	if (phy_data->sfp_gpio_inputs & (1 << phy_data->sfp_gpio_rx_los))
++		return true;
++
++	return false;
++}
++
++static bool xgbe_phy_check_sfp_tx_fault(struct xgbe_phy_data *phy_data)
++{
++	u8 *sfp_extd = phy_data->sfp_eeprom.extd;
++
++	if (!(sfp_extd[XGBE_SFP_EXTD_OPT1] & XGBE_SFP_EXTD_OPT1_TX_FAULT))
++		return false;
++
++	if (phy_data->sfp_gpio_mask & XGBE_GPIO_NO_TX_FAULT)
++		return false;
++
++	if (phy_data->sfp_gpio_inputs & (1 << phy_data->sfp_gpio_tx_fault))
++		return true;
++
++	return false;
++}
++
++static bool xgbe_phy_check_sfp_mod_absent(struct xgbe_phy_data *phy_data)
++{
++	if (phy_data->sfp_gpio_mask & XGBE_GPIO_NO_MOD_ABSENT)
++		return false;
++
++	if (phy_data->sfp_gpio_inputs & (1 << phy_data->sfp_gpio_mod_absent))
++		return true;
++
++	return false;
++}
++
+ static bool xgbe_phy_belfuse_parse_quirks(struct xgbe_prv_data *pdata)
+ {
+ 	struct xgbe_phy_data *phy_data = pdata->phy_data;
+@@ -1019,6 +1079,10 @@ static void xgbe_phy_sfp_parse_eeprom(struct xgbe_prv_data *pdata)
+ 	if (sfp_base[XGBE_SFP_BASE_EXT_ID] != XGBE_SFP_EXT_ID_SFP)
+ 		return;
+ 
++	/* Update transceiver signals (eeprom extd/options) */
++	phy_data->sfp_tx_fault = xgbe_phy_check_sfp_tx_fault(phy_data);
++	phy_data->sfp_rx_los = xgbe_phy_check_sfp_rx_los(phy_data);
++
+ 	if (xgbe_phy_sfp_parse_quirks(pdata))
+ 		return;
+ 
+@@ -1184,7 +1248,6 @@ static int xgbe_phy_sfp_read_eeprom(struct xgbe_prv_data *pdata)
+ static void xgbe_phy_sfp_signals(struct xgbe_prv_data *pdata)
+ {
+ 	struct xgbe_phy_data *phy_data = pdata->phy_data;
+-	unsigned int gpio_input;
+ 	u8 gpio_reg, gpio_ports[2];
+ 	int ret;
+ 
+@@ -1199,23 +1262,9 @@ static void xgbe_phy_sfp_signals(struct xgbe_prv_data *pdata)
+ 		return;
+ 	}
+ 
+-	gpio_input = (gpio_ports[1] << 8) | gpio_ports[0];
+-
+-	if (phy_data->sfp_gpio_mask & XGBE_GPIO_NO_MOD_ABSENT) {
+-		/* No GPIO, just assume the module is present for now */
+-		phy_data->sfp_mod_absent = 0;
+-	} else {
+-		if (!(gpio_input & (1 << phy_data->sfp_gpio_mod_absent)))
+-			phy_data->sfp_mod_absent = 0;
+-	}
+-
+-	if (!(phy_data->sfp_gpio_mask & XGBE_GPIO_NO_RX_LOS) &&
+-	    (gpio_input & (1 << phy_data->sfp_gpio_rx_los)))
+-		phy_data->sfp_rx_los = 1;
++	phy_data->sfp_gpio_inputs = (gpio_ports[1] << 8) | gpio_ports[0];
+ 
+-	if (!(phy_data->sfp_gpio_mask & XGBE_GPIO_NO_TX_FAULT) &&
+-	    (gpio_input & (1 << phy_data->sfp_gpio_tx_fault)))
+-		phy_data->sfp_tx_fault = 1;
++	phy_data->sfp_mod_absent = xgbe_phy_check_sfp_mod_absent(phy_data);
+ }
+ 
+ static void xgbe_phy_sfp_mod_absent(struct xgbe_prv_data *pdata)
+@@ -2361,7 +2410,7 @@ static int xgbe_phy_link_status(struct xgbe_prv_data *pdata, int *an_restart)
+ 		return 1;
+ 
+ 	/* No link, attempt a receiver reset cycle */
+-	if (phy_data->rrc_count++) {
++	if (phy_data->rrc_count++ > XGBE_RRC_FREQUENCY) {
+ 		phy_data->rrc_count = 0;
+ 		xgbe_phy_rrc(pdata);
+ 	}
+@@ -2669,6 +2718,103 @@ static bool xgbe_phy_port_enabled(struct xgbe_prv_data *pdata)
+ 	return true;
+ }
+ 
++static void xgbe_phy_cdr_track(struct xgbe_prv_data *pdata)
++{
++	struct xgbe_phy_data *phy_data = pdata->phy_data;
++
++	if (!pdata->debugfs_an_cdr_workaround)
++		return;
++
++	if (!phy_data->phy_cdr_notrack)
++		return;
++
++	usleep_range(phy_data->phy_cdr_delay,
++		     phy_data->phy_cdr_delay + 500);
++
++	XMDIO_WRITE_BITS(pdata, MDIO_MMD_PMAPMD, MDIO_VEND2_PMA_CDR_CONTROL,
++			 XGBE_PMA_CDR_TRACK_EN_MASK,
++			 XGBE_PMA_CDR_TRACK_EN_ON);
++
++	phy_data->phy_cdr_notrack = 0;
++}
++
++static void xgbe_phy_cdr_notrack(struct xgbe_prv_data *pdata)
++{
++	struct xgbe_phy_data *phy_data = pdata->phy_data;
++
++	if (!pdata->debugfs_an_cdr_workaround)
++		return;
++
++	if (phy_data->phy_cdr_notrack)
++		return;
++
++	XMDIO_WRITE_BITS(pdata, MDIO_MMD_PMAPMD, MDIO_VEND2_PMA_CDR_CONTROL,
++			 XGBE_PMA_CDR_TRACK_EN_MASK,
++			 XGBE_PMA_CDR_TRACK_EN_OFF);
++
++	xgbe_phy_rrc(pdata);
++
++	phy_data->phy_cdr_notrack = 1;
++}
++
++static void xgbe_phy_kr_training_post(struct xgbe_prv_data *pdata)
++{
++	if (!pdata->debugfs_an_cdr_track_early)
++		xgbe_phy_cdr_track(pdata);
++}
++
++static void xgbe_phy_kr_training_pre(struct xgbe_prv_data *pdata)
++{
++	if (pdata->debugfs_an_cdr_track_early)
++		xgbe_phy_cdr_track(pdata);
++}
++
++static void xgbe_phy_an_post(struct xgbe_prv_data *pdata)
++{
++	struct xgbe_phy_data *phy_data = pdata->phy_data;
++
++	switch (pdata->an_mode) {
++	case XGBE_AN_MODE_CL73:
++	case XGBE_AN_MODE_CL73_REDRV:
++		if (phy_data->cur_mode != XGBE_MODE_KR)
++			break;
++
++		xgbe_phy_cdr_track(pdata);
++
++		switch (pdata->an_result) {
++		case XGBE_AN_READY:
++		case XGBE_AN_COMPLETE:
++			break;
++		default:
++			if (phy_data->phy_cdr_delay < XGBE_CDR_DELAY_MAX)
++				phy_data->phy_cdr_delay += XGBE_CDR_DELAY_INC;
++			else
++				phy_data->phy_cdr_delay = XGBE_CDR_DELAY_INIT;
++			break;
++		}
++		break;
++	default:
++		break;
++	}
++}
++
++static void xgbe_phy_an_pre(struct xgbe_prv_data *pdata)
++{
++	struct xgbe_phy_data *phy_data = pdata->phy_data;
++
++	switch (pdata->an_mode) {
++	case XGBE_AN_MODE_CL73:
++	case XGBE_AN_MODE_CL73_REDRV:
++		if (phy_data->cur_mode != XGBE_MODE_KR)
++			break;
++
++		xgbe_phy_cdr_notrack(pdata);
++		break;
++	default:
++		break;
++	}
++}
++
+ static void xgbe_phy_stop(struct xgbe_prv_data *pdata)
+ {
+ 	struct xgbe_phy_data *phy_data = pdata->phy_data;
+@@ -2680,6 +2826,9 @@ static void xgbe_phy_stop(struct xgbe_prv_data *pdata)
+ 	xgbe_phy_sfp_reset(phy_data);
+ 	xgbe_phy_sfp_mod_absent(pdata);
+ 
++	/* Reset CDR support */
++	xgbe_phy_cdr_track(pdata);
++
+ 	/* Power off the PHY */
+ 	xgbe_phy_power_off(pdata);
+ 
+@@ -2712,6 +2861,9 @@ static int xgbe_phy_start(struct xgbe_prv_data *pdata)
+ 	/* Start in highest supported mode */
+ 	xgbe_phy_set_mode(pdata, phy_data->start_mode);
+ 
++	/* Reset CDR support */
++	xgbe_phy_cdr_track(pdata);
++
+ 	/* After starting the I2C controller, we can check for an SFP */
+ 	switch (phy_data->port_mode) {
+ 	case XGBE_PORT_MODE_SFP:
+@@ -3019,6 +3171,8 @@ static int xgbe_phy_init(struct xgbe_prv_data *pdata)
+ 		}
+ 	}
+ 
++	phy_data->phy_cdr_delay = XGBE_CDR_DELAY_INIT;
++
+ 	/* Register for driving external PHYs */
+ 	mii = devm_mdiobus_alloc(pdata->dev);
+ 	if (!mii) {
+@@ -3071,4 +3225,10 @@ void xgbe_init_function_ptrs_phy_v2(struct xgbe_phy_if *phy_if)
+ 	phy_impl->an_advertising	= xgbe_phy_an_advertising;
+ 
+ 	phy_impl->an_outcome		= xgbe_phy_an_outcome;
++
++	phy_impl->an_pre		= xgbe_phy_an_pre;
++	phy_impl->an_post		= xgbe_phy_an_post;
++
++	phy_impl->kr_training_pre	= xgbe_phy_kr_training_pre;
++	phy_impl->kr_training_post	= xgbe_phy_kr_training_post;
+ }
+diff --git a/drivers/net/ethernet/amd/xgbe/xgbe.h b/drivers/net/ethernet/amd/xgbe/xgbe.h
+index ad102c8bac7b..95d4b56448c6 100644
+--- a/drivers/net/ethernet/amd/xgbe/xgbe.h
++++ b/drivers/net/ethernet/amd/xgbe/xgbe.h
+@@ -833,6 +833,7 @@ struct xgbe_hw_if {
+ /* This structure represents implementation specific routines for an
+  * implementation of a PHY. All routines are required unless noted below.
+  *   Optional routines:
++ *     an_pre, an_post
+  *     kr_training_pre, kr_training_post
+  */
+ struct xgbe_phy_impl_if {
+@@ -875,6 +876,10 @@ struct xgbe_phy_impl_if {
+ 	/* Process results of auto-negotiation */
+ 	enum xgbe_mode (*an_outcome)(struct xgbe_prv_data *);
+ 
++	/* Pre/Post auto-negotiation support */
++	void (*an_pre)(struct xgbe_prv_data *);
++	void (*an_post)(struct xgbe_prv_data *);
++
+ 	/* Pre/Post KR training enablement support */
+ 	void (*kr_training_pre)(struct xgbe_prv_data *);
+ 	void (*kr_training_post)(struct xgbe_prv_data *);
+@@ -989,6 +994,7 @@ struct xgbe_version_data {
+ 	unsigned int irq_reissue_support;
+ 	unsigned int tx_desc_prefetch;
+ 	unsigned int rx_desc_prefetch;
++	unsigned int an_cdr_workaround;
+ };
+ 
+ struct xgbe_vxlan_data {
+@@ -1257,6 +1263,9 @@ struct xgbe_prv_data {
+ 	unsigned int debugfs_xprop_reg;
+ 
+ 	unsigned int debugfs_xi2c_reg;
++
++	bool debugfs_an_cdr_workaround;
++	bool debugfs_an_cdr_track_early;
+ };
+ 
+ /* Function prototypes*/
+diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
+index c96a92118b8b..32f6d2e24d66 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
++++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
+@@ -951,9 +951,11 @@ void aq_nic_shutdown(struct aq_nic_s *self)
+ 
+ 	netif_device_detach(self->ndev);
+ 
+-	err = aq_nic_stop(self);
+-	if (err < 0)
+-		goto err_exit;
++	if (netif_running(self->ndev)) {
++		err = aq_nic_stop(self);
++		if (err < 0)
++			goto err_exit;
++	}
+ 	aq_nic_deinit(self);
+ 
+ err_exit:
+diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c
+index d3b847ec7465..c58b2c227260 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c
++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c
+@@ -48,6 +48,8 @@
+ #define FORCE_FLASHLESS 0
+ 
+ static int hw_atl_utils_ver_match(u32 ver_expected, u32 ver_actual);
++static int hw_atl_utils_mpi_set_state(struct aq_hw_s *self,
++				      enum hal_atl_utils_fw_state_e state);
+ 
+ int hw_atl_utils_initfw(struct aq_hw_s *self, const struct aq_fw_ops **fw_ops)
+ {
+@@ -247,6 +249,20 @@ int hw_atl_utils_soft_reset(struct aq_hw_s *self)
+ 
+ 	self->rbl_enabled = (boot_exit_code != 0);
+ 
++	/* FW 1.x may bootup in an invalid POWER state (WOL feature).
++	 * We should work around this by forcing its state back to DEINIT
++	 */
++	if (!hw_atl_utils_ver_match(HW_ATL_FW_VER_1X,
++				    aq_hw_read_reg(self,
++						   HW_ATL_MPI_FW_VERSION))) {
++		int err = 0;
++
++		hw_atl_utils_mpi_set_state(self, MPI_DEINIT);
++		AQ_HW_WAIT_FOR((aq_hw_read_reg(self, HW_ATL_MPI_STATE_ADR) &
++			       HW_ATL_MPI_STATE_MSK) == MPI_DEINIT,
++			       10, 1000U);
++	}
++
+ 	if (self->rbl_enabled)
+ 		return hw_atl_utils_soft_reset_rbl(self);
+ 	else
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+index 1801582076be..9442605f4fd4 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+@@ -1874,22 +1874,39 @@ static char *bnxt_parse_pkglog(int desired_field, u8 *data, size_t datalen)
+ 	return retval;
+ }
+ 
+-static char *bnxt_get_pkgver(struct net_device *dev, char *buf, size_t buflen)
++static void bnxt_get_pkgver(struct net_device *dev)
+ {
++	struct bnxt *bp = netdev_priv(dev);
+ 	u16 index = 0;
+-	u32 datalen;
++	char *pkgver;
++	u32 pkglen;
++	u8 *pkgbuf;
++	int len;
+ 
+ 	if (bnxt_find_nvram_item(dev, BNX_DIR_TYPE_PKG_LOG,
+ 				 BNX_DIR_ORDINAL_FIRST, BNX_DIR_EXT_NONE,
+-				 &index, NULL, &datalen) != 0)
+-		return NULL;
++				 &index, NULL, &pkglen) != 0)
++		return;
+ 
+-	memset(buf, 0, buflen);
+-	if (bnxt_get_nvram_item(dev, index, 0, datalen, buf) != 0)
+-		return NULL;
++	pkgbuf = kzalloc(pkglen, GFP_KERNEL);
++	if (!pkgbuf) {
++		dev_err(&bp->pdev->dev, "Unable to allocate memory for pkg version, length = %u\n",
++			pkglen);
++		return;
++	}
++
++	if (bnxt_get_nvram_item(dev, index, 0, pkglen, pkgbuf))
++		goto err;
+ 
+-	return bnxt_parse_pkglog(BNX_PKG_LOG_FIELD_IDX_PKG_VERSION, buf,
+-		datalen);
++	pkgver = bnxt_parse_pkglog(BNX_PKG_LOG_FIELD_IDX_PKG_VERSION, pkgbuf,
++				   pkglen);
++	if (pkgver && *pkgver != 0 && isdigit(*pkgver)) {
++		len = strlen(bp->fw_ver_str);
++		snprintf(bp->fw_ver_str + len, FW_VER_STR_LEN - len - 1,
++			 "/pkg %s", pkgver);
++	}
++err:
++	kfree(pkgbuf);
+ }
+ 
+ static int bnxt_get_eeprom(struct net_device *dev,
+@@ -2558,22 +2575,10 @@ void bnxt_ethtool_init(struct bnxt *bp)
+ 	struct hwrm_selftest_qlist_input req = {0};
+ 	struct bnxt_test_info *test_info;
+ 	struct net_device *dev = bp->dev;
+-	char *pkglog;
+ 	int i, rc;
+ 
+-	pkglog = kzalloc(BNX_PKG_LOG_MAX_LENGTH, GFP_KERNEL);
+-	if (pkglog) {
+-		char *pkgver;
+-		int len;
++	bnxt_get_pkgver(dev);
+ 
+-		pkgver = bnxt_get_pkgver(dev, pkglog, BNX_PKG_LOG_MAX_LENGTH);
+-		if (pkgver && *pkgver != 0 && isdigit(*pkgver)) {
+-			len = strlen(bp->fw_ver_str);
+-			snprintf(bp->fw_ver_str + len, FW_VER_STR_LEN - len - 1,
+-				 "/pkg %s", pkgver);
+-		}
+-		kfree(pkglog);
+-	}
+ 	if (bp->hwrm_spec_code < 0x10704 || !BNXT_SINGLE_PF(bp))
+ 		return;
+ 
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_nvm_defs.h b/drivers/net/ethernet/broadcom/bnxt/bnxt_nvm_defs.h
+index 73f2249555b5..83444811d3c6 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_nvm_defs.h
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_nvm_defs.h
+@@ -59,8 +59,6 @@ enum bnxt_nvm_directory_type {
+ #define BNX_DIR_ATTR_NO_CHKSUM			(1 << 0)
+ #define BNX_DIR_ATTR_PROP_STREAM		(1 << 1)
+ 
+-#define BNX_PKG_LOG_MAX_LENGTH			4096
+-
+ enum bnxnvm_pkglog_field_index {
+ 	BNX_PKG_LOG_FIELD_IDX_INSTALLED_TIMESTAMP	= 0,
+ 	BNX_PKG_LOG_FIELD_IDX_PKG_DESCRIPTION		= 1,
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+index e9309fb9084b..21a21934e5bf 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+@@ -2889,6 +2889,7 @@ int i40e_ndo_set_vf_mac(struct net_device *netdev, int vf_id, u8 *mac)
+ 	int ret = 0;
+ 	struct hlist_node *h;
+ 	int bkt;
++	u8 i;
+ 
+ 	/* validate the request */
+ 	if (vf_id >= pf->num_alloc_vfs) {
+@@ -2900,6 +2901,16 @@ int i40e_ndo_set_vf_mac(struct net_device *netdev, int vf_id, u8 *mac)
+ 
+ 	vf = &(pf->vf[vf_id]);
+ 	vsi = pf->vsi[vf->lan_vsi_idx];
++
++	/* When the VF is resetting wait until it is done.
++	 * It can take up to 200 milliseconds,
++	 * but wait for up to 300 milliseconds to be safe.
++	 */
++	for (i = 0; i < 15; i++) {
++		if (test_bit(I40E_VF_STATE_INIT, &vf->vf_states))
++			break;
++		msleep(20);
++	}
+ 	if (!test_bit(I40E_VF_STATE_INIT, &vf->vf_states)) {
+ 		dev_err(&pf->pdev->dev, "VF %d still in reset. Try again.\n",
+ 			vf_id);
+diff --git a/drivers/net/ethernet/marvell/mvpp2.c b/drivers/net/ethernet/marvell/mvpp2.c
+index 5a1668cdb461..7f1083ce23da 100644
+--- a/drivers/net/ethernet/marvell/mvpp2.c
++++ b/drivers/net/ethernet/marvell/mvpp2.c
+@@ -838,6 +838,8 @@ enum mvpp2_bm_type {
+ 
+ #define MVPP2_MIB_COUNTERS_STATS_DELAY		(1 * HZ)
+ 
++#define MVPP2_DESC_DMA_MASK	DMA_BIT_MASK(40)
++
+ /* Definitions */
+ 
+ /* Shared Packet Processor resources */
+@@ -1336,7 +1338,7 @@ static dma_addr_t mvpp2_txdesc_dma_addr_get(struct mvpp2_port *port,
+ 	if (port->priv->hw_version == MVPP21)
+ 		return tx_desc->pp21.buf_dma_addr;
+ 	else
+-		return tx_desc->pp22.buf_dma_addr_ptp & GENMASK_ULL(40, 0);
++		return tx_desc->pp22.buf_dma_addr_ptp & MVPP2_DESC_DMA_MASK;
+ }
+ 
+ static void mvpp2_txdesc_dma_addr_set(struct mvpp2_port *port,
+@@ -1354,7 +1356,7 @@ static void mvpp2_txdesc_dma_addr_set(struct mvpp2_port *port,
+ 	} else {
+ 		u64 val = (u64)addr;
+ 
+-		tx_desc->pp22.buf_dma_addr_ptp &= ~GENMASK_ULL(40, 0);
++		tx_desc->pp22.buf_dma_addr_ptp &= ~MVPP2_DESC_DMA_MASK;
+ 		tx_desc->pp22.buf_dma_addr_ptp |= val;
+ 		tx_desc->pp22.packet_offset = offset;
+ 	}
+@@ -1414,7 +1416,7 @@ static dma_addr_t mvpp2_rxdesc_dma_addr_get(struct mvpp2_port *port,
+ 	if (port->priv->hw_version == MVPP21)
+ 		return rx_desc->pp21.buf_dma_addr;
+ 	else
+-		return rx_desc->pp22.buf_dma_addr_key_hash & GENMASK_ULL(40, 0);
++		return rx_desc->pp22.buf_dma_addr_key_hash & MVPP2_DESC_DMA_MASK;
+ }
+ 
+ static unsigned long mvpp2_rxdesc_cookie_get(struct mvpp2_port *port,
+@@ -1423,7 +1425,7 @@ static unsigned long mvpp2_rxdesc_cookie_get(struct mvpp2_port *port,
+ 	if (port->priv->hw_version == MVPP21)
+ 		return rx_desc->pp21.buf_cookie;
+ 	else
+-		return rx_desc->pp22.buf_cookie_misc & GENMASK_ULL(40, 0);
++		return rx_desc->pp22.buf_cookie_misc & MVPP2_DESC_DMA_MASK;
+ }
+ 
+ static size_t mvpp2_rxdesc_size_get(struct mvpp2_port *port,
+@@ -8347,7 +8349,7 @@ static int mvpp2_probe(struct platform_device *pdev)
+ 	}
+ 
+ 	if (priv->hw_version == MVPP22) {
+-		err = dma_set_mask(&pdev->dev, DMA_BIT_MASK(40));
++		err = dma_set_mask(&pdev->dev, MVPP2_DESC_DMA_MASK);
+ 		if (err)
+ 			goto err_mg_clk;
+ 		/* Sadly, the BM pools all share the same register to
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4.h b/drivers/net/ethernet/stmicro/stmmac/dwmac4.h
+index 7761a26ec9c5..e7565416639b 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4.h
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4.h
+@@ -343,7 +343,7 @@ enum power_event {
+ #define MTL_RX_OVERFLOW_INT		BIT(16)
+ 
+ /* Default operating mode of the MAC */
+-#define GMAC_CORE_INIT (GMAC_CONFIG_JD | GMAC_CONFIG_PS | GMAC_CONFIG_ACS | \
++#define GMAC_CORE_INIT (GMAC_CONFIG_JD | GMAC_CONFIG_PS | \
+ 			GMAC_CONFIG_BE | GMAC_CONFIG_DCRS)
+ 
+ /* To dump the core regs excluding  the Address Registers */
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
+index 63795ecafc8d..26dfb75e927a 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
+@@ -30,13 +30,6 @@ static void dwmac4_core_init(struct mac_device_info *hw,
+ 
+ 	value |= GMAC_CORE_INIT;
+ 
+-	/* Clear ACS bit because Ethernet switch tagging formats such as
+-	 * Broadcom tags can look like invalid LLC/SNAP packets and cause the
+-	 * hardware to truncate packets on reception.
+-	 */
+-	if (netdev_uses_dsa(dev))
+-		value &= ~GMAC_CONFIG_ACS;
+-
+ 	if (mtu > 1500)
+ 		value |= GMAC_CONFIG_2K;
+ 	if (mtu > 2000)
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+index 7ad841434ec8..3ea343b45d93 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -3435,8 +3435,13 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue)
+ 
+ 			/* ACS is set; GMAC core strips PAD/FCS for IEEE 802.3
+ 			 * Type frames (LLC/LLC-SNAP)
++			 *
++			 * llc_snap is never checked in GMAC >= 4, so this ACS
++			 * feature is always disabled and packets need to be
++			 * stripped manually.
+ 			 */
+-			if (unlikely(status != llc_snap))
++			if (unlikely(priv->synopsys_id >= DWMAC_CORE_4_00) ||
++			    unlikely(status != llc_snap))
+ 				frame_len -= ETH_FCS_LEN;
+ 
+ 			if (netif_msg_rx_status(priv)) {
+diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
+index b2b30c9df037..33c35b2df7d5 100644
+--- a/drivers/net/ethernet/ti/cpsw.c
++++ b/drivers/net/ethernet/ti/cpsw.c
+@@ -125,7 +125,7 @@ do {								\
+ 
+ #define RX_PRIORITY_MAPPING	0x76543210
+ #define TX_PRIORITY_MAPPING	0x33221100
+-#define CPDMA_TX_PRIORITY_MAP	0x01234567
++#define CPDMA_TX_PRIORITY_MAP	0x76543210
+ 
+ #define CPSW_VLAN_AWARE		BIT(1)
+ #define CPSW_ALE_VLAN_AWARE	1
+diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c
+index 9cbb0c8a896a..7de88b33d5b9 100644
+--- a/drivers/net/macsec.c
++++ b/drivers/net/macsec.c
+@@ -3277,7 +3277,7 @@ static int macsec_newlink(struct net *net, struct net_device *dev,
+ 
+ 	err = netdev_upper_dev_link(real_dev, dev, extack);
+ 	if (err < 0)
+-		goto put_dev;
++		goto unregister;
+ 
+ 	/* need to be already registered so that ->init has run and
+ 	 * the MAC addr is set
+@@ -3316,8 +3316,7 @@ static int macsec_newlink(struct net *net, struct net_device *dev,
+ 	macsec_del_dev(macsec);
+ unlink:
+ 	netdev_upper_dev_unlink(real_dev, dev);
+-put_dev:
+-	dev_put(real_dev);
++unregister:
+ 	unregister_netdevice(dev);
+ 	return err;
+ }
+diff --git a/drivers/net/ppp/pppoe.c b/drivers/net/ppp/pppoe.c
+index 5aa59f41bf8c..71e2aef6b7a1 100644
+--- a/drivers/net/ppp/pppoe.c
++++ b/drivers/net/ppp/pppoe.c
+@@ -620,6 +620,10 @@ static int pppoe_connect(struct socket *sock, struct sockaddr *uservaddr,
+ 	lock_sock(sk);
+ 
+ 	error = -EINVAL;
++
++	if (sockaddr_len != sizeof(struct sockaddr_pppox))
++		goto end;
++
+ 	if (sp->sa_protocol != PX_PROTO_OE)
+ 		goto end;
+ 
+diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
+index befed2d22bf4..3175f7410baf 100644
+--- a/drivers/net/team/team.c
++++ b/drivers/net/team/team.c
+@@ -261,6 +261,17 @@ static void __team_option_inst_mark_removed_port(struct team *team,
+ 	}
+ }
+ 
++static bool __team_option_inst_tmp_find(const struct list_head *opts,
++					const struct team_option_inst *needle)
++{
++	struct team_option_inst *opt_inst;
++
++	list_for_each_entry(opt_inst, opts, tmp_list)
++		if (opt_inst == needle)
++			return true;
++	return false;
++}
++
+ static int __team_options_register(struct team *team,
+ 				   const struct team_option *option,
+ 				   size_t option_count)
+@@ -1061,14 +1072,11 @@ static void team_port_leave(struct team *team, struct team_port *port)
+ }
+ 
+ #ifdef CONFIG_NET_POLL_CONTROLLER
+-static int team_port_enable_netpoll(struct team *team, struct team_port *port)
++static int __team_port_enable_netpoll(struct team_port *port)
+ {
+ 	struct netpoll *np;
+ 	int err;
+ 
+-	if (!team->dev->npinfo)
+-		return 0;
+-
+ 	np = kzalloc(sizeof(*np), GFP_KERNEL);
+ 	if (!np)
+ 		return -ENOMEM;
+@@ -1082,6 +1090,14 @@ static int team_port_enable_netpoll(struct team *team, struct team_port *port)
+ 	return err;
+ }
+ 
++static int team_port_enable_netpoll(struct team_port *port)
++{
++	if (!port->team->dev->npinfo)
++		return 0;
++
++	return __team_port_enable_netpoll(port);
++}
++
+ static void team_port_disable_netpoll(struct team_port *port)
+ {
+ 	struct netpoll *np = port->np;
+@@ -1096,7 +1112,7 @@ static void team_port_disable_netpoll(struct team_port *port)
+ 	kfree(np);
+ }
+ #else
+-static int team_port_enable_netpoll(struct team *team, struct team_port *port)
++static int team_port_enable_netpoll(struct team_port *port)
+ {
+ 	return 0;
+ }
+@@ -1204,7 +1220,7 @@ static int team_port_add(struct team *team, struct net_device *port_dev)
+ 		goto err_vids_add;
+ 	}
+ 
+-	err = team_port_enable_netpoll(team, port);
++	err = team_port_enable_netpoll(port);
+ 	if (err) {
+ 		netdev_err(dev, "Failed to enable netpoll on device %s\n",
+ 			   portname);
+@@ -1901,7 +1917,7 @@ static int team_netpoll_setup(struct net_device *dev,
+ 
+ 	mutex_lock(&team->lock);
+ 	list_for_each_entry(port, &team->port_list, list) {
+-		err = team_port_enable_netpoll(team, port);
++		err = __team_port_enable_netpoll(port);
+ 		if (err) {
+ 			__team_netpoll_cleanup(team);
+ 			break;
+@@ -2562,6 +2578,14 @@ static int team_nl_cmd_options_set(struct sk_buff *skb, struct genl_info *info)
+ 			if (err)
+ 				goto team_put;
+ 			opt_inst->changed = true;
++
++			/* dumb/evil user-space can send us duplicate opt,
++			 * keep only the last one
++			 */
++			if (__team_option_inst_tmp_find(&opt_inst_list,
++							opt_inst))
++				continue;
++
+ 			list_add(&opt_inst->tmp_list, &opt_inst_list);
+ 		}
+ 		if (!opt_found) {
+diff --git a/drivers/net/tun.c b/drivers/net/tun.c
+index 28cfa642e39a..6c7bdd0c361a 100644
+--- a/drivers/net/tun.c
++++ b/drivers/net/tun.c
+@@ -1094,12 +1094,7 @@ static netdev_tx_t tun_net_xmit(struct sk_buff *skb, struct net_device *dev)
+ 		goto drop;
+ 
+ 	len = run_ebpf_filter(tun, skb, len);
+-
+-	/* Trim extra bytes since we may insert vlan proto & TCI
+-	 * in tun_put_user().
+-	 */
+-	len -= skb_vlan_tag_present(skb) ? sizeof(struct veth) : 0;
+-	if (len <= 0 || pskb_trim(skb, len))
++	if (len == 0 || pskb_trim(skb, len))
+ 		goto drop;
+ 
+ 	if (unlikely(skb_orphan_frags_rx(skb, GFP_ATOMIC)))
+diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
+index ca066b785e9f..c853e7410f5a 100644
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -1107,6 +1107,7 @@ static const struct usb_device_id products[] = {
+ 	{QMI_FIXED_INTF(0x1435, 0xd181, 3)},	/* Wistron NeWeb D18Q1 */
+ 	{QMI_FIXED_INTF(0x1435, 0xd181, 4)},	/* Wistron NeWeb D18Q1 */
+ 	{QMI_FIXED_INTF(0x1435, 0xd181, 5)},	/* Wistron NeWeb D18Q1 */
++	{QMI_FIXED_INTF(0x1435, 0xd191, 4)},	/* Wistron NeWeb D19Q1 */
+ 	{QMI_FIXED_INTF(0x16d8, 0x6003, 0)},	/* CMOTech 6003 */
+ 	{QMI_FIXED_INTF(0x16d8, 0x6007, 0)},	/* CMOTech CHE-628S */
+ 	{QMI_FIXED_INTF(0x16d8, 0x6008, 0)},	/* CMOTech CMU-301 */
+diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
+index 23374603e4d9..aa21b2225679 100644
+--- a/drivers/net/virtio_net.c
++++ b/drivers/net/virtio_net.c
+@@ -147,6 +147,17 @@ struct receive_queue {
+ 	struct xdp_rxq_info xdp_rxq;
+ };
+ 
++/* Control VQ buffers: protected by the rtnl lock */
++struct control_buf {
++	struct virtio_net_ctrl_hdr hdr;
++	virtio_net_ctrl_ack status;
++	struct virtio_net_ctrl_mq mq;
++	u8 promisc;
++	u8 allmulti;
++	__virtio16 vid;
++	u64 offloads;
++};
++
+ struct virtnet_info {
+ 	struct virtio_device *vdev;
+ 	struct virtqueue *cvq;
+@@ -192,14 +203,7 @@ struct virtnet_info {
+ 	struct hlist_node node;
+ 	struct hlist_node node_dead;
+ 
+-	/* Control VQ buffers: protected by the rtnl lock */
+-	struct virtio_net_ctrl_hdr ctrl_hdr;
+-	virtio_net_ctrl_ack ctrl_status;
+-	struct virtio_net_ctrl_mq ctrl_mq;
+-	u8 ctrl_promisc;
+-	u8 ctrl_allmulti;
+-	u16 ctrl_vid;
+-	u64 ctrl_offloads;
++	struct control_buf *ctrl;
+ 
+ 	/* Ethtool settings */
+ 	u8 duplex;
+@@ -1269,7 +1273,9 @@ static int virtnet_poll(struct napi_struct *napi, int budget)
+ {
+ 	struct receive_queue *rq =
+ 		container_of(napi, struct receive_queue, napi);
+-	unsigned int received;
++	struct virtnet_info *vi = rq->vq->vdev->priv;
++	struct send_queue *sq;
++	unsigned int received, qp;
+ 	bool xdp_xmit = false;
+ 
+ 	virtnet_poll_cleantx(rq);
+@@ -1280,8 +1286,13 @@ static int virtnet_poll(struct napi_struct *napi, int budget)
+ 	if (received < budget)
+ 		virtqueue_napi_complete(napi, rq->vq, received);
+ 
+-	if (xdp_xmit)
++	if (xdp_xmit) {
++		qp = vi->curr_queue_pairs - vi->xdp_queue_pairs +
++		     smp_processor_id();
++		sq = &vi->sq[qp];
++		virtqueue_kick(sq->vq);
+ 		xdp_do_flush_map();
++	}
+ 
+ 	return received;
+ }
+@@ -1454,25 +1465,25 @@ static bool virtnet_send_command(struct virtnet_info *vi, u8 class, u8 cmd,
+ 	/* Caller should know better */
+ 	BUG_ON(!virtio_has_feature(vi->vdev, VIRTIO_NET_F_CTRL_VQ));
+ 
+-	vi->ctrl_status = ~0;
+-	vi->ctrl_hdr.class = class;
+-	vi->ctrl_hdr.cmd = cmd;
++	vi->ctrl->status = ~0;
++	vi->ctrl->hdr.class = class;
++	vi->ctrl->hdr.cmd = cmd;
+ 	/* Add header */
+-	sg_init_one(&hdr, &vi->ctrl_hdr, sizeof(vi->ctrl_hdr));
++	sg_init_one(&hdr, &vi->ctrl->hdr, sizeof(vi->ctrl->hdr));
+ 	sgs[out_num++] = &hdr;
+ 
+ 	if (out)
+ 		sgs[out_num++] = out;
+ 
+ 	/* Add return status. */
+-	sg_init_one(&stat, &vi->ctrl_status, sizeof(vi->ctrl_status));
++	sg_init_one(&stat, &vi->ctrl->status, sizeof(vi->ctrl->status));
+ 	sgs[out_num] = &stat;
+ 
+ 	BUG_ON(out_num + 1 > ARRAY_SIZE(sgs));
+ 	virtqueue_add_sgs(vi->cvq, sgs, out_num, 1, vi, GFP_ATOMIC);
+ 
+ 	if (unlikely(!virtqueue_kick(vi->cvq)))
+-		return vi->ctrl_status == VIRTIO_NET_OK;
++		return vi->ctrl->status == VIRTIO_NET_OK;
+ 
+ 	/* Spin for a response, the kick causes an ioport write, trapping
+ 	 * into the hypervisor, so the request should be handled immediately.
+@@ -1481,7 +1492,7 @@ static bool virtnet_send_command(struct virtnet_info *vi, u8 class, u8 cmd,
+ 	       !virtqueue_is_broken(vi->cvq))
+ 		cpu_relax();
+ 
+-	return vi->ctrl_status == VIRTIO_NET_OK;
++	return vi->ctrl->status == VIRTIO_NET_OK;
+ }
+ 
+ static int virtnet_set_mac_address(struct net_device *dev, void *p)
+@@ -1593,8 +1604,8 @@ static int _virtnet_set_queues(struct virtnet_info *vi, u16 queue_pairs)
+ 	if (!vi->has_cvq || !virtio_has_feature(vi->vdev, VIRTIO_NET_F_MQ))
+ 		return 0;
+ 
+-	vi->ctrl_mq.virtqueue_pairs = cpu_to_virtio16(vi->vdev, queue_pairs);
+-	sg_init_one(&sg, &vi->ctrl_mq, sizeof(vi->ctrl_mq));
++	vi->ctrl->mq.virtqueue_pairs = cpu_to_virtio16(vi->vdev, queue_pairs);
++	sg_init_one(&sg, &vi->ctrl->mq, sizeof(vi->ctrl->mq));
+ 
+ 	if (!virtnet_send_command(vi, VIRTIO_NET_CTRL_MQ,
+ 				  VIRTIO_NET_CTRL_MQ_VQ_PAIRS_SET, &sg)) {
+@@ -1653,22 +1664,22 @@ static void virtnet_set_rx_mode(struct net_device *dev)
+ 	if (!virtio_has_feature(vi->vdev, VIRTIO_NET_F_CTRL_RX))
+ 		return;
+ 
+-	vi->ctrl_promisc = ((dev->flags & IFF_PROMISC) != 0);
+-	vi->ctrl_allmulti = ((dev->flags & IFF_ALLMULTI) != 0);
++	vi->ctrl->promisc = ((dev->flags & IFF_PROMISC) != 0);
++	vi->ctrl->allmulti = ((dev->flags & IFF_ALLMULTI) != 0);
+ 
+-	sg_init_one(sg, &vi->ctrl_promisc, sizeof(vi->ctrl_promisc));
++	sg_init_one(sg, &vi->ctrl->promisc, sizeof(vi->ctrl->promisc));
+ 
+ 	if (!virtnet_send_command(vi, VIRTIO_NET_CTRL_RX,
+ 				  VIRTIO_NET_CTRL_RX_PROMISC, sg))
+ 		dev_warn(&dev->dev, "Failed to %sable promisc mode.\n",
+-			 vi->ctrl_promisc ? "en" : "dis");
++			 vi->ctrl->promisc ? "en" : "dis");
+ 
+-	sg_init_one(sg, &vi->ctrl_allmulti, sizeof(vi->ctrl_allmulti));
++	sg_init_one(sg, &vi->ctrl->allmulti, sizeof(vi->ctrl->allmulti));
+ 
+ 	if (!virtnet_send_command(vi, VIRTIO_NET_CTRL_RX,
+ 				  VIRTIO_NET_CTRL_RX_ALLMULTI, sg))
+ 		dev_warn(&dev->dev, "Failed to %sable allmulti mode.\n",
+-			 vi->ctrl_allmulti ? "en" : "dis");
++			 vi->ctrl->allmulti ? "en" : "dis");
+ 
+ 	uc_count = netdev_uc_count(dev);
+ 	mc_count = netdev_mc_count(dev);
+@@ -1714,8 +1725,8 @@ static int virtnet_vlan_rx_add_vid(struct net_device *dev,
+ 	struct virtnet_info *vi = netdev_priv(dev);
+ 	struct scatterlist sg;
+ 
+-	vi->ctrl_vid = vid;
+-	sg_init_one(&sg, &vi->ctrl_vid, sizeof(vi->ctrl_vid));
++	vi->ctrl->vid = cpu_to_virtio16(vi->vdev, vid);
++	sg_init_one(&sg, &vi->ctrl->vid, sizeof(vi->ctrl->vid));
+ 
+ 	if (!virtnet_send_command(vi, VIRTIO_NET_CTRL_VLAN,
+ 				  VIRTIO_NET_CTRL_VLAN_ADD, &sg))
+@@ -1729,8 +1740,8 @@ static int virtnet_vlan_rx_kill_vid(struct net_device *dev,
+ 	struct virtnet_info *vi = netdev_priv(dev);
+ 	struct scatterlist sg;
+ 
+-	vi->ctrl_vid = vid;
+-	sg_init_one(&sg, &vi->ctrl_vid, sizeof(vi->ctrl_vid));
++	vi->ctrl->vid = cpu_to_virtio16(vi->vdev, vid);
++	sg_init_one(&sg, &vi->ctrl->vid, sizeof(vi->ctrl->vid));
+ 
+ 	if (!virtnet_send_command(vi, VIRTIO_NET_CTRL_VLAN,
+ 				  VIRTIO_NET_CTRL_VLAN_DEL, &sg))
+@@ -2126,9 +2137,9 @@ static int virtnet_restore_up(struct virtio_device *vdev)
+ static int virtnet_set_guest_offloads(struct virtnet_info *vi, u64 offloads)
+ {
+ 	struct scatterlist sg;
+-	vi->ctrl_offloads = cpu_to_virtio64(vi->vdev, offloads);
++	vi->ctrl->offloads = cpu_to_virtio64(vi->vdev, offloads);
+ 
+-	sg_init_one(&sg, &vi->ctrl_offloads, sizeof(vi->ctrl_offloads));
++	sg_init_one(&sg, &vi->ctrl->offloads, sizeof(vi->ctrl->offloads));
+ 
+ 	if (!virtnet_send_command(vi, VIRTIO_NET_CTRL_GUEST_OFFLOADS,
+ 				  VIRTIO_NET_CTRL_GUEST_OFFLOADS_SET, &sg)) {
+@@ -2351,6 +2362,7 @@ static void virtnet_free_queues(struct virtnet_info *vi)
+ 
+ 	kfree(vi->rq);
+ 	kfree(vi->sq);
++	kfree(vi->ctrl);
+ }
+ 
+ static void _free_receive_bufs(struct virtnet_info *vi)
+@@ -2543,6 +2555,9 @@ static int virtnet_alloc_queues(struct virtnet_info *vi)
+ {
+ 	int i;
+ 
++	vi->ctrl = kzalloc(sizeof(*vi->ctrl), GFP_KERNEL);
++	if (!vi->ctrl)
++		goto err_ctrl;
+ 	vi->sq = kzalloc(sizeof(*vi->sq) * vi->max_queue_pairs, GFP_KERNEL);
+ 	if (!vi->sq)
+ 		goto err_sq;
+@@ -2571,6 +2586,8 @@ static int virtnet_alloc_queues(struct virtnet_info *vi)
+ err_rq:
+ 	kfree(vi->sq);
+ err_sq:
++	kfree(vi->ctrl);
++err_ctrl:
+ 	return -ENOMEM;
+ }
+ 
+diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
+index e04937f44f33..9ebe2a689966 100644
+--- a/drivers/net/vmxnet3/vmxnet3_drv.c
++++ b/drivers/net/vmxnet3/vmxnet3_drv.c
+@@ -1218,6 +1218,7 @@ vmxnet3_get_hdr_len(struct vmxnet3_adapter *adapter, struct sk_buff *skb,
+ 	union {
+ 		void *ptr;
+ 		struct ethhdr *eth;
++		struct vlan_ethhdr *veth;
+ 		struct iphdr *ipv4;
+ 		struct ipv6hdr *ipv6;
+ 		struct tcphdr *tcp;
+@@ -1228,16 +1229,24 @@ vmxnet3_get_hdr_len(struct vmxnet3_adapter *adapter, struct sk_buff *skb,
+ 	if (unlikely(sizeof(struct iphdr) + sizeof(struct tcphdr) > maplen))
+ 		return 0;
+ 
++	if (skb->protocol == cpu_to_be16(ETH_P_8021Q) ||
++	    skb->protocol == cpu_to_be16(ETH_P_8021AD))
++		hlen = sizeof(struct vlan_ethhdr);
++	else
++		hlen = sizeof(struct ethhdr);
++
+ 	hdr.eth = eth_hdr(skb);
+ 	if (gdesc->rcd.v4) {
+-		BUG_ON(hdr.eth->h_proto != htons(ETH_P_IP));
+-		hdr.ptr += sizeof(struct ethhdr);
++		BUG_ON(hdr.eth->h_proto != htons(ETH_P_IP) &&
++		       hdr.veth->h_vlan_encapsulated_proto != htons(ETH_P_IP));
++		hdr.ptr += hlen;
+ 		BUG_ON(hdr.ipv4->protocol != IPPROTO_TCP);
+ 		hlen = hdr.ipv4->ihl << 2;
+ 		hdr.ptr += hdr.ipv4->ihl << 2;
+ 	} else if (gdesc->rcd.v6) {
+-		BUG_ON(hdr.eth->h_proto != htons(ETH_P_IPV6));
+-		hdr.ptr += sizeof(struct ethhdr);
++		BUG_ON(hdr.eth->h_proto != htons(ETH_P_IPV6) &&
++		       hdr.veth->h_vlan_encapsulated_proto != htons(ETH_P_IPV6));
++		hdr.ptr += hlen;
+ 		/* Use an estimated value, since we also need to handle
+ 		 * TSO case.
+ 		 */
+diff --git a/drivers/net/vmxnet3/vmxnet3_int.h b/drivers/net/vmxnet3/vmxnet3_int.h
+index 59ec34052a65..a3326463b71f 100644
+--- a/drivers/net/vmxnet3/vmxnet3_int.h
++++ b/drivers/net/vmxnet3/vmxnet3_int.h
+@@ -69,10 +69,10 @@
+ /*
+  * Version numbers
+  */
+-#define VMXNET3_DRIVER_VERSION_STRING   "1.4.13.0-k"
++#define VMXNET3_DRIVER_VERSION_STRING   "1.4.14.0-k"
+ 
+ /* a 32-bit int, each byte encode a verion number in VMXNET3_DRIVER_VERSION */
+-#define VMXNET3_DRIVER_VERSION_NUM      0x01040d00
++#define VMXNET3_DRIVER_VERSION_NUM      0x01040e00
+ 
+ #if defined(CONFIG_PCI_MSI)
+ 	/* RSS only makes sense if MSI-X is supported. */
+diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
+index ebb3f1b046f3..800a86e2d671 100644
+--- a/drivers/net/wireless/ath/ath10k/mac.c
++++ b/drivers/net/wireless/ath/ath10k/mac.c
+@@ -6028,9 +6028,8 @@ static void ath10k_sta_rc_update_wk(struct work_struct *wk)
+ 				    sta->addr, smps, err);
+ 	}
+ 
+-	if (changed & IEEE80211_RC_SUPP_RATES_CHANGED ||
+-	    changed & IEEE80211_RC_NSS_CHANGED) {
+-		ath10k_dbg(ar, ATH10K_DBG_MAC, "mac update sta %pM supp rates/nss\n",
++	if (changed & IEEE80211_RC_SUPP_RATES_CHANGED) {
++		ath10k_dbg(ar, ATH10K_DBG_MAC, "mac update sta %pM supp rates\n",
+ 			   sta->addr);
+ 
+ 		err = ath10k_station_assoc(ar, arvif->vif, sta, true);
+diff --git a/drivers/pinctrl/intel/pinctrl-intel.c b/drivers/pinctrl/intel/pinctrl-intel.c
+index 96e73e30204e..5f111f0ee7ca 100644
+--- a/drivers/pinctrl/intel/pinctrl-intel.c
++++ b/drivers/pinctrl/intel/pinctrl-intel.c
+@@ -425,18 +425,6 @@ static void __intel_gpio_set_direction(void __iomem *padcfg0, bool input)
+ 	writel(value, padcfg0);
+ }
+ 
+-static void intel_gpio_set_gpio_mode(void __iomem *padcfg0)
+-{
+-	u32 value;
+-
+-	/* Put the pad into GPIO mode */
+-	value = readl(padcfg0) & ~PADCFG0_PMODE_MASK;
+-	/* Disable SCI/SMI/NMI generation */
+-	value &= ~(PADCFG0_GPIROUTIOXAPIC | PADCFG0_GPIROUTSCI);
+-	value &= ~(PADCFG0_GPIROUTSMI | PADCFG0_GPIROUTNMI);
+-	writel(value, padcfg0);
+-}
+-
+ static int intel_gpio_request_enable(struct pinctrl_dev *pctldev,
+ 				     struct pinctrl_gpio_range *range,
+ 				     unsigned pin)
+@@ -444,6 +432,7 @@ static int intel_gpio_request_enable(struct pinctrl_dev *pctldev,
+ 	struct intel_pinctrl *pctrl = pinctrl_dev_get_drvdata(pctldev);
+ 	void __iomem *padcfg0;
+ 	unsigned long flags;
++	u32 value;
+ 
+ 	raw_spin_lock_irqsave(&pctrl->lock, flags);
+ 
+@@ -453,7 +442,13 @@ static int intel_gpio_request_enable(struct pinctrl_dev *pctldev,
+ 	}
+ 
+ 	padcfg0 = intel_get_padcfg(pctrl, pin, PADCFG0);
+-	intel_gpio_set_gpio_mode(padcfg0);
++	/* Put the pad into GPIO mode */
++	value = readl(padcfg0) & ~PADCFG0_PMODE_MASK;
++	/* Disable SCI/SMI/NMI generation */
++	value &= ~(PADCFG0_GPIROUTIOXAPIC | PADCFG0_GPIROUTSCI);
++	value &= ~(PADCFG0_GPIROUTSMI | PADCFG0_GPIROUTNMI);
++	writel(value, padcfg0);
++
+ 	/* Disable TX buffer and enable RX (this will be input) */
+ 	__intel_gpio_set_direction(padcfg0, true);
+ 
+@@ -973,8 +968,6 @@ static int intel_gpio_irq_type(struct irq_data *d, unsigned type)
+ 
+ 	raw_spin_lock_irqsave(&pctrl->lock, flags);
+ 
+-	intel_gpio_set_gpio_mode(reg);
+-
+ 	value = readl(reg);
+ 
+ 	value &= ~(PADCFG0_RXEVCFG_MASK | PADCFG0_RXINV);
+diff --git a/drivers/s390/block/dasd_alias.c b/drivers/s390/block/dasd_alias.c
+index 62f5f04d8f61..5e963fe0e38d 100644
+--- a/drivers/s390/block/dasd_alias.c
++++ b/drivers/s390/block/dasd_alias.c
+@@ -592,13 +592,22 @@ static int _schedule_lcu_update(struct alias_lcu *lcu,
+ int dasd_alias_add_device(struct dasd_device *device)
+ {
+ 	struct dasd_eckd_private *private = device->private;
+-	struct alias_lcu *lcu;
++	__u8 uaddr = private->uid.real_unit_addr;
++	struct alias_lcu *lcu = private->lcu;
+ 	unsigned long flags;
+ 	int rc;
+ 
+-	lcu = private->lcu;
+ 	rc = 0;
+ 	spin_lock_irqsave(&lcu->lock, flags);
++	/*
++	 * Check if device and lcu type differ. If so, the uac data may be
++	 * outdated and needs to be updated.
++	 */
++	if (private->uid.type !=  lcu->uac->unit[uaddr].ua_type) {
++		lcu->flags |= UPDATE_PENDING;
++		DBF_DEV_EVENT(DBF_WARNING, device, "%s",
++			      "uid type mismatch - trigger rescan");
++	}
+ 	if (!(lcu->flags & UPDATE_PENDING)) {
+ 		rc = _add_device_to_lcu(lcu, device, device);
+ 		if (rc)
+diff --git a/drivers/s390/cio/chsc.c b/drivers/s390/cio/chsc.c
+index c08fc5a8df0c..aea0b25eff29 100644
+--- a/drivers/s390/cio/chsc.c
++++ b/drivers/s390/cio/chsc.c
+@@ -452,6 +452,7 @@ static void chsc_process_sei_link_incident(struct chsc_sei_nt0_area *sei_area)
+ 
+ static void chsc_process_sei_res_acc(struct chsc_sei_nt0_area *sei_area)
+ {
++	struct channel_path *chp;
+ 	struct chp_link link;
+ 	struct chp_id chpid;
+ 	int status;
+@@ -464,10 +465,17 @@ static void chsc_process_sei_res_acc(struct chsc_sei_nt0_area *sei_area)
+ 	chpid.id = sei_area->rsid;
+ 	/* allocate a new channel path structure, if needed */
+ 	status = chp_get_status(chpid);
+-	if (status < 0)
+-		chp_new(chpid);
+-	else if (!status)
++	if (!status)
+ 		return;
++
++	if (status < 0) {
++		chp_new(chpid);
++	} else {
++		chp = chpid_to_chp(chpid);
++		mutex_lock(&chp->lock);
++		chp_update_desc(chp);
++		mutex_unlock(&chp->lock);
++	}
+ 	memset(&link, 0, sizeof(struct chp_link));
+ 	link.chpid = chpid;
+ 	if ((sei_area->vf & 0xc0) != 0) {
+diff --git a/drivers/s390/net/qeth_core.h b/drivers/s390/net/qeth_core.h
+index 959c65cf75d9..e338ce823c44 100644
+--- a/drivers/s390/net/qeth_core.h
++++ b/drivers/s390/net/qeth_core.h
+@@ -565,7 +565,6 @@ enum qeth_ip_types {
+ enum qeth_cmd_buffer_state {
+ 	BUF_STATE_FREE,
+ 	BUF_STATE_LOCKED,
+-	BUF_STATE_PROCESSED,
+ };
+ 
+ enum qeth_cq {
+@@ -609,7 +608,6 @@ struct qeth_channel {
+ 	struct qeth_cmd_buffer iob[QETH_CMD_BUFFER_NO];
+ 	atomic_t irq_pending;
+ 	int io_buf_no;
+-	int buf_no;
+ };
+ 
+ /**
+diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
+index 3653bea38470..c11a083cd956 100644
+--- a/drivers/s390/net/qeth_core_main.c
++++ b/drivers/s390/net/qeth_core_main.c
+@@ -821,7 +821,6 @@ void qeth_clear_cmd_buffers(struct qeth_channel *channel)
+ 
+ 	for (cnt = 0; cnt < QETH_CMD_BUFFER_NO; cnt++)
+ 		qeth_release_buffer(channel, &channel->iob[cnt]);
+-	channel->buf_no = 0;
+ 	channel->io_buf_no = 0;
+ }
+ EXPORT_SYMBOL_GPL(qeth_clear_cmd_buffers);
+@@ -927,7 +926,6 @@ static int qeth_setup_channel(struct qeth_channel *channel)
+ 			kfree(channel->iob[cnt].data);
+ 		return -ENOMEM;
+ 	}
+-	channel->buf_no = 0;
+ 	channel->io_buf_no = 0;
+ 	atomic_set(&channel->irq_pending, 0);
+ 	spin_lock_init(&channel->iob_lock);
+@@ -1103,11 +1101,9 @@ static void qeth_irq(struct ccw_device *cdev, unsigned long intparm,
+ {
+ 	int rc;
+ 	int cstat, dstat;
+-	struct qeth_cmd_buffer *buffer;
+ 	struct qeth_channel *channel;
+ 	struct qeth_card *card;
+ 	struct qeth_cmd_buffer *iob;
+-	__u8 index;
+ 
+ 	if (__qeth_check_irb_error(cdev, intparm, irb))
+ 		return;
+@@ -1185,25 +1181,18 @@ static void qeth_irq(struct ccw_device *cdev, unsigned long intparm,
+ 		channel->state = CH_STATE_RCD_DONE;
+ 		goto out;
+ 	}
+-	if (intparm) {
+-		buffer = (struct qeth_cmd_buffer *) __va((addr_t)intparm);
+-		buffer->state = BUF_STATE_PROCESSED;
+-	}
+ 	if (channel == &card->data)
+ 		return;
+ 	if (channel == &card->read &&
+ 	    channel->state == CH_STATE_UP)
+ 		__qeth_issue_next_read(card);
+ 
+-	iob = channel->iob;
+-	index = channel->buf_no;
+-	while (iob[index].state == BUF_STATE_PROCESSED) {
+-		if (iob[index].callback != NULL)
+-			iob[index].callback(channel, iob + index);
+-
+-		index = (index + 1) % QETH_CMD_BUFFER_NO;
++	if (intparm) {
++		iob = (struct qeth_cmd_buffer *) __va((addr_t)intparm);
++		if (iob->callback)
++			iob->callback(iob->channel, iob);
+ 	}
+-	channel->buf_no = index;
++
+ out:
+ 	wake_up(&card->wait_q);
+ 	return;
+@@ -2217,7 +2206,6 @@ int qeth_send_control_data(struct qeth_card *card, int len,
+ error:
+ 	atomic_set(&card->write.irq_pending, 0);
+ 	qeth_release_buffer(iob->channel, iob);
+-	card->write.buf_no = (card->write.buf_no + 1) % QETH_CMD_BUFFER_NO;
+ 	rc = reply->rc;
+ 	qeth_put_reply(reply);
+ 	return rc;
+@@ -3037,28 +3025,23 @@ static int qeth_send_startlan(struct qeth_card *card)
+ 	return rc;
+ }
+ 
+-static int qeth_default_setadapterparms_cb(struct qeth_card *card,
+-		struct qeth_reply *reply, unsigned long data)
++static int qeth_setadpparms_inspect_rc(struct qeth_ipa_cmd *cmd)
+ {
+-	struct qeth_ipa_cmd *cmd;
+-
+-	QETH_CARD_TEXT(card, 4, "defadpcb");
+-
+-	cmd = (struct qeth_ipa_cmd *) data;
+-	if (cmd->hdr.return_code == 0)
++	if (!cmd->hdr.return_code)
+ 		cmd->hdr.return_code =
+ 			cmd->data.setadapterparms.hdr.return_code;
+-	return 0;
++	return cmd->hdr.return_code;
+ }
+ 
+ static int qeth_query_setadapterparms_cb(struct qeth_card *card,
+ 		struct qeth_reply *reply, unsigned long data)
+ {
+-	struct qeth_ipa_cmd *cmd;
++	struct qeth_ipa_cmd *cmd = (struct qeth_ipa_cmd *) data;
+ 
+ 	QETH_CARD_TEXT(card, 3, "quyadpcb");
++	if (qeth_setadpparms_inspect_rc(cmd))
++		return 0;
+ 
+-	cmd = (struct qeth_ipa_cmd *) data;
+ 	if (cmd->data.setadapterparms.data.query_cmds_supp.lan_type & 0x7f) {
+ 		card->info.link_type =
+ 		      cmd->data.setadapterparms.data.query_cmds_supp.lan_type;
+@@ -3066,7 +3049,7 @@ static int qeth_query_setadapterparms_cb(struct qeth_card *card,
+ 	}
+ 	card->options.adp.supported_funcs =
+ 		cmd->data.setadapterparms.data.query_cmds_supp.supported_cmds;
+-	return qeth_default_setadapterparms_cb(card, reply, (unsigned long)cmd);
++	return 0;
+ }
+ 
+ static struct qeth_cmd_buffer *qeth_get_adapter_cmd(struct qeth_card *card,
+@@ -3158,22 +3141,20 @@ EXPORT_SYMBOL_GPL(qeth_query_ipassists);
+ static int qeth_query_switch_attributes_cb(struct qeth_card *card,
+ 				struct qeth_reply *reply, unsigned long data)
+ {
+-	struct qeth_ipa_cmd *cmd;
+-	struct qeth_switch_info *sw_info;
++	struct qeth_ipa_cmd *cmd = (struct qeth_ipa_cmd *) data;
+ 	struct qeth_query_switch_attributes *attrs;
++	struct qeth_switch_info *sw_info;
+ 
+ 	QETH_CARD_TEXT(card, 2, "qswiatcb");
+-	cmd = (struct qeth_ipa_cmd *) data;
+-	sw_info = (struct qeth_switch_info *)reply->param;
+-	if (cmd->data.setadapterparms.hdr.return_code == 0) {
+-		attrs = &cmd->data.setadapterparms.data.query_switch_attributes;
+-		sw_info->capabilities = attrs->capabilities;
+-		sw_info->settings = attrs->settings;
+-		QETH_CARD_TEXT_(card, 2, "%04x%04x", sw_info->capabilities,
+-							sw_info->settings);
+-	}
+-	qeth_default_setadapterparms_cb(card, reply, (unsigned long) cmd);
++	if (qeth_setadpparms_inspect_rc(cmd))
++		return 0;
+ 
++	sw_info = (struct qeth_switch_info *)reply->param;
++	attrs = &cmd->data.setadapterparms.data.query_switch_attributes;
++	sw_info->capabilities = attrs->capabilities;
++	sw_info->settings = attrs->settings;
++	QETH_CARD_TEXT_(card, 2, "%04x%04x", sw_info->capabilities,
++			sw_info->settings);
+ 	return 0;
+ }
+ 
+@@ -4211,16 +4192,13 @@ EXPORT_SYMBOL_GPL(qeth_do_send_packet);
+ static int qeth_setadp_promisc_mode_cb(struct qeth_card *card,
+ 		struct qeth_reply *reply, unsigned long data)
+ {
+-	struct qeth_ipa_cmd *cmd;
++	struct qeth_ipa_cmd *cmd = (struct qeth_ipa_cmd *) data;
+ 	struct qeth_ipacmd_setadpparms *setparms;
+ 
+ 	QETH_CARD_TEXT(card, 4, "prmadpcb");
+ 
+-	cmd = (struct qeth_ipa_cmd *) data;
+ 	setparms = &(cmd->data.setadapterparms);
+-
+-	qeth_default_setadapterparms_cb(card, reply, (unsigned long)cmd);
+-	if (cmd->hdr.return_code) {
++	if (qeth_setadpparms_inspect_rc(cmd)) {
+ 		QETH_CARD_TEXT_(card, 4, "prmrc%x", cmd->hdr.return_code);
+ 		setparms->data.mode = SET_PROMISC_MODE_OFF;
+ 	}
+@@ -4290,18 +4268,18 @@ EXPORT_SYMBOL_GPL(qeth_get_stats);
+ static int qeth_setadpparms_change_macaddr_cb(struct qeth_card *card,
+ 		struct qeth_reply *reply, unsigned long data)
+ {
+-	struct qeth_ipa_cmd *cmd;
++	struct qeth_ipa_cmd *cmd = (struct qeth_ipa_cmd *) data;
+ 
+ 	QETH_CARD_TEXT(card, 4, "chgmaccb");
++	if (qeth_setadpparms_inspect_rc(cmd))
++		return 0;
+ 
+-	cmd = (struct qeth_ipa_cmd *) data;
+ 	if (!card->options.layer2 ||
+ 	    !(card->info.mac_bits & QETH_LAYER2_MAC_READ)) {
+ 		ether_addr_copy(card->dev->dev_addr,
+ 				cmd->data.setadapterparms.data.change_addr.addr);
+ 		card->info.mac_bits |= QETH_LAYER2_MAC_READ;
+ 	}
+-	qeth_default_setadapterparms_cb(card, reply, (unsigned long) cmd);
+ 	return 0;
+ }
+ 
+@@ -4332,13 +4310,15 @@ EXPORT_SYMBOL_GPL(qeth_setadpparms_change_macaddr);
+ static int qeth_setadpparms_set_access_ctrl_cb(struct qeth_card *card,
+ 		struct qeth_reply *reply, unsigned long data)
+ {
+-	struct qeth_ipa_cmd *cmd;
++	struct qeth_ipa_cmd *cmd = (struct qeth_ipa_cmd *) data;
+ 	struct qeth_set_access_ctrl *access_ctrl_req;
+ 	int fallback = *(int *)reply->param;
+ 
+ 	QETH_CARD_TEXT(card, 4, "setaccb");
++	if (cmd->hdr.return_code)
++		return 0;
++	qeth_setadpparms_inspect_rc(cmd);
+ 
+-	cmd = (struct qeth_ipa_cmd *) data;
+ 	access_ctrl_req = &cmd->data.setadapterparms.data.set_access_ctrl;
+ 	QETH_DBF_TEXT_(SETUP, 2, "setaccb");
+ 	QETH_DBF_TEXT_(SETUP, 2, "%s", card->gdev->dev.kobj.name);
+@@ -4411,7 +4391,6 @@ static int qeth_setadpparms_set_access_ctrl_cb(struct qeth_card *card,
+ 			card->options.isolation = card->options.prev_isolation;
+ 		break;
+ 	}
+-	qeth_default_setadapterparms_cb(card, reply, (unsigned long) cmd);
+ 	return 0;
+ }
+ 
+@@ -4699,14 +4678,15 @@ static int qeth_snmp_command(struct qeth_card *card, char __user *udata)
+ static int qeth_setadpparms_query_oat_cb(struct qeth_card *card,
+ 		struct qeth_reply *reply, unsigned long data)
+ {
+-	struct qeth_ipa_cmd *cmd;
++	struct qeth_ipa_cmd *cmd = (struct qeth_ipa_cmd *)data;
+ 	struct qeth_qoat_priv *priv;
+ 	char *resdata;
+ 	int resdatalen;
+ 
+ 	QETH_CARD_TEXT(card, 3, "qoatcb");
++	if (qeth_setadpparms_inspect_rc(cmd))
++		return 0;
+ 
+-	cmd = (struct qeth_ipa_cmd *)data;
+ 	priv = (struct qeth_qoat_priv *)reply->param;
+ 	resdatalen = cmd->data.setadapterparms.hdr.cmdlength;
+ 	resdata = (char *)data + 28;
+@@ -4800,21 +4780,18 @@ static int qeth_query_oat_command(struct qeth_card *card, char __user *udata)
+ static int qeth_query_card_info_cb(struct qeth_card *card,
+ 				   struct qeth_reply *reply, unsigned long data)
+ {
+-	struct qeth_ipa_cmd *cmd;
++	struct carrier_info *carrier_info = (struct carrier_info *)reply->param;
++	struct qeth_ipa_cmd *cmd = (struct qeth_ipa_cmd *)data;
+ 	struct qeth_query_card_info *card_info;
+-	struct carrier_info *carrier_info;
+ 
+ 	QETH_CARD_TEXT(card, 2, "qcrdincb");
+-	carrier_info = (struct carrier_info *)reply->param;
+-	cmd = (struct qeth_ipa_cmd *)data;
+-	card_info = &cmd->data.setadapterparms.data.card_info;
+-	if (cmd->data.setadapterparms.hdr.return_code == 0) {
+-		carrier_info->card_type = card_info->card_type;
+-		carrier_info->port_mode = card_info->port_mode;
+-		carrier_info->port_speed = card_info->port_speed;
+-	}
++	if (qeth_setadpparms_inspect_rc(cmd))
++		return 0;
+ 
+-	qeth_default_setadapterparms_cb(card, reply, (unsigned long) cmd);
++	card_info = &cmd->data.setadapterparms.data.card_info;
++	carrier_info->card_type = card_info->card_type;