Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Conflicts:
	include/net/inetpeer.h
	net/ipv6/output_core.c

Changes in net were fixing bugs in code removed in net-next.

Signed-off-by: David S. Miller <davem@davemloft.net>

78 files changed, 816 insertions, 602 deletions

diff --git a/drivers/acpi/thermal.c b/drivers/acpi/thermal.c
index c1e31a41f949..25bbc55dca89 100644
--- a/drivers/acpi/thermal.c
+++ b/drivers/acpi/thermal.c
@@ -1278,8 +1278,8 @@ static int __init acpi_thermal_init(void)
 
 static void __exit acpi_thermal_exit(void)
 {
-        destroy_workqueue(acpi_thermal_pm_queue);
         acpi_bus_unregister_driver(&acpi_thermal_driver);
+        destroy_workqueue(acpi_thermal_pm_queue);
 
         return;
 }
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index ea83828bfea9..18d97d5c7d90 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -4224,10 +4224,10 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
         { "PIONEER DVD-RW  DVR-216D",   NULL,   ATA_HORKAGE_NOSETXFER },
 
         /* devices that don't properly handle queued TRIM commands */
-        { "Micron_M500*",               "MU0[1-4]*",    ATA_HORKAGE_NO_NCQ_TRIM, },
-        { "Crucial_CT???M500SSD*",      "MU0[1-4]*",    ATA_HORKAGE_NO_NCQ_TRIM, },
-        { "Micron_M550*",               NULL,           ATA_HORKAGE_NO_NCQ_TRIM, },
-        { "Crucial_CT???M550SSD*",      NULL,           ATA_HORKAGE_NO_NCQ_TRIM, },
+        { "Micron_M500*",               NULL,   ATA_HORKAGE_NO_NCQ_TRIM, },
+        { "Crucial_CT???M500SSD*",      NULL,   ATA_HORKAGE_NO_NCQ_TRIM, },
+        { "Micron_M550*",               NULL,   ATA_HORKAGE_NO_NCQ_TRIM, },
+        { "Crucial_CT???M550SSD*",      NULL,   ATA_HORKAGE_NO_NCQ_TRIM, },
 
         /*
          * Some WD SATA-I drives spin up and down erratically when the link
diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
index 6d8a87f252de..cb9b1f8326c3 100644
--- a/drivers/block/virtio_blk.c
+++ b/drivers/block/virtio_blk.c
@@ -144,11 +144,11 @@ static void virtblk_done(struct virtqueue *vq)
                 if (unlikely(virtqueue_is_broken(vq)))
                         break;
         } while (!virtqueue_enable_cb(vq));
-        spin_unlock_irqrestore(&vblk->vq_lock, flags);
 
         /* In case queue is stopped waiting for more buffers. */
         if (req_done)
                 blk_mq_start_stopped_hw_queues(vblk->disk->queue);
+        spin_unlock_irqrestore(&vblk->vq_lock, flags);
 }
 
 static int virtio_queue_rq(struct blk_mq_hw_ctx *hctx, struct request *req)
@@ -202,8 +202,8 @@ static int virtio_queue_rq(struct blk_mq_hw_ctx *hctx, struct request *req)
         err = __virtblk_add_req(vblk->vq, vbr, vbr->sg, num);
         if (err) {
                 virtqueue_kick(vblk->vq);
-                spin_unlock_irqrestore(&vblk->vq_lock, flags);
                 blk_mq_stop_hw_queue(hctx);
+                spin_unlock_irqrestore(&vblk->vq_lock, flags);
                 /* Out of mem doesn't actually happen, since we fall back
                  * to direct descriptors */
                 if (err == -ENOMEM || err == -ENOSPC)
diff --git a/drivers/clk/clk-divider.c b/drivers/clk/clk-divider.c
index 4637697c139f..3fbee4540228 100644
--- a/drivers/clk/clk-divider.c
+++ b/drivers/clk/clk-divider.c
@@ -147,7 +147,7 @@ static bool _is_valid_div(struct clk_divider *divider, unsigned int div)
 static int _round_up_table(const struct clk_div_table *table, int div)
 {
         const struct clk_div_table *clkt;
-        int up = _get_table_maxdiv(table);
+        int up = INT_MAX;
 
         for (clkt = table; clkt->div; clkt++) {
                 if (clkt->div == div)
diff --git a/drivers/clk/st/clkgen-pll.c b/drivers/clk/st/clkgen-pll.c
index bca0a0badbfa..a886702f7c8b 100644
--- a/drivers/clk/st/clkgen-pll.c
+++ b/drivers/clk/st/clkgen-pll.c
@@ -521,8 +521,10 @@ static struct clk * __init clkgen_odf_register(const char *parent_name,
         gate->lock = odf_lock;
 
         div = kzalloc(sizeof(*div), GFP_KERNEL);
-        if (!div)
+        if (!div) {
+                kfree(gate);
                 return ERR_PTR(-ENOMEM);
+        }
 
         div->flags = CLK_DIVIDER_ONE_BASED | CLK_DIVIDER_ALLOW_ZERO;
         div->reg = reg + pll_data->odf[odf].offset;
diff --git a/drivers/clk/tegra/clk-pll.c b/drivers/clk/tegra/clk-pll.c
index e1769addf435..6aad8abc69a2 100644
--- a/drivers/clk/tegra/clk-pll.c
+++ b/drivers/clk/tegra/clk-pll.c
@@ -58,9 +58,9 @@
 #define PLLDU_LFCON_SET_DIVN 600
 
 #define PLLE_BASE_DIVCML_SHIFT 24
-#define PLLE_BASE_DIVCML_WIDTH 4
+#define PLLE_BASE_DIVCML_MASK 0xf
 #define PLLE_BASE_DIVP_SHIFT 16
-#define PLLE_BASE_DIVP_WIDTH 7
+#define PLLE_BASE_DIVP_WIDTH 6
 #define PLLE_BASE_DIVN_SHIFT 8
 #define PLLE_BASE_DIVN_WIDTH 8
 #define PLLE_BASE_DIVM_SHIFT 0
@@ -183,6 +183,14 @@
 #define divp_mask(p) (p->params->flags & TEGRA_PLLU ? PLLU_POST_DIVP_MASK :\
                       mask(p->params->div_nmp->divp_width))
 
+#define divm_shift(p) (p)->params->div_nmp->divm_shift
+#define divn_shift(p) (p)->params->div_nmp->divn_shift
+#define divp_shift(p) (p)->params->div_nmp->divp_shift
+
+#define divm_mask_shifted(p) (divm_mask(p) << divm_shift(p))
+#define divn_mask_shifted(p) (divn_mask(p) << divn_shift(p))
+#define divp_mask_shifted(p) (divp_mask(p) << divp_shift(p))
+
 #define divm_max(p) (divm_mask(p))
 #define divn_max(p) (divn_mask(p))
 #define divp_max(p) (1 << (divp_mask(p)))
@@ -476,13 +484,12 @@ static void _update_pll_mnp(struct tegra_clk_pll *pll,
         } else {
                 val = pll_readl_base(pll);
 
-                val &= ~((divm_mask(pll) << div_nmp->divm_shift) |
-                 (divn_mask(pll) << div_nmp->divn_shift) |
-                 (divp_mask(pll) << div_nmp->divp_shift));
+                val &= ~(divm_mask_shifted(pll) | divn_mask_shifted(pll) |
+                         divp_mask_shifted(pll));
 
-                val |= ((cfg->m << div_nmp->divm_shift) |
-                        (cfg->n << div_nmp->divn_shift) |
-                        (cfg->p << div_nmp->divp_shift));
+                val |= (cfg->m << divm_shift(pll)) |
+                       (cfg->n << divn_shift(pll)) |
+                       (cfg->p << divp_shift(pll));
 
                 pll_writel_base(val, pll);
         }
@@ -730,11 +737,12 @@ static int clk_plle_enable(struct clk_hw *hw)
         if (pll->params->flags & TEGRA_PLLE_CONFIGURE) {
                 /* configure dividers */
                 val = pll_readl_base(pll);
-                val &= ~(divm_mask(pll) | divn_mask(pll) | divp_mask(pll));
-                val &= ~(PLLE_BASE_DIVCML_WIDTH << PLLE_BASE_DIVCML_SHIFT);
-                val |= sel.m << pll->params->div_nmp->divm_shift;
-                val |= sel.n << pll->params->div_nmp->divn_shift;
-                val |= sel.p << pll->params->div_nmp->divp_shift;
+                val &= ~(divp_mask_shifted(pll) | divn_mask_shifted(pll) |
+                         divm_mask_shifted(pll));
+                val &= ~(PLLE_BASE_DIVCML_MASK << PLLE_BASE_DIVCML_SHIFT);
+                val |= sel.m << divm_shift(pll);
+                val |= sel.n << divn_shift(pll);
+                val |= sel.p << divp_shift(pll);
                 val |= sel.cpcon << PLLE_BASE_DIVCML_SHIFT;
                 pll_writel_base(val, pll);
         }
@@ -745,10 +753,11 @@ static int clk_plle_enable(struct clk_hw *hw)
         pll_writel_misc(val, pll);
 
         val = readl(pll->clk_base + PLLE_SS_CTRL);
+        val &= ~PLLE_SS_COEFFICIENTS_MASK;
         val |= PLLE_SS_DISABLE;
         writel(val, pll->clk_base + PLLE_SS_CTRL);
 
-        val |= pll_readl_base(pll);
+        val = pll_readl_base(pll);
         val |= (PLL_BASE_BYPASS | PLL_BASE_ENABLE);
         pll_writel_base(val, pll);
 
@@ -1292,10 +1301,11 @@ static int clk_plle_tegra114_enable(struct clk_hw *hw)
         pll_writel(val, PLLE_SS_CTRL, pll);
 
         val = pll_readl_base(pll);
-        val &= ~(divm_mask(pll) | divn_mask(pll) | divp_mask(pll));
-        val &= ~(PLLE_BASE_DIVCML_WIDTH << PLLE_BASE_DIVCML_SHIFT);
-        val |= sel.m << pll->params->div_nmp->divm_shift;
-        val |= sel.n << pll->params->div_nmp->divn_shift;
+        val &= ~(divp_mask_shifted(pll) | divn_mask_shifted(pll) |
+                 divm_mask_shifted(pll));
+        val &= ~(PLLE_BASE_DIVCML_MASK << PLLE_BASE_DIVCML_SHIFT);
+        val |= sel.m << divm_shift(pll);
+        val |= sel.n << divn_shift(pll);
         val |= sel.cpcon << PLLE_BASE_DIVCML_SHIFT;
         pll_writel_base(val, pll);
         udelay(1);
@@ -1410,6 +1420,15 @@ struct clk *tegra_clk_register_pll(const char *name, const char *parent_name,
         return clk;
 }
 
+static struct div_nmp pll_e_nmp = {
+        .divn_shift = PLLE_BASE_DIVN_SHIFT,
+        .divn_width = PLLE_BASE_DIVN_WIDTH,
+        .divm_shift = PLLE_BASE_DIVM_SHIFT,
+        .divm_width = PLLE_BASE_DIVM_WIDTH,
+        .divp_shift = PLLE_BASE_DIVP_SHIFT,
+        .divp_width = PLLE_BASE_DIVP_WIDTH,
+};
+
 struct clk *tegra_clk_register_plle(const char *name, const char *parent_name,
                 void __iomem *clk_base, void __iomem *pmc,
                 unsigned long flags, struct tegra_clk_pll_params *pll_params,
@@ -1420,6 +1439,10 @@ struct clk *tegra_clk_register_plle(const char *name, const char *parent_name,
 
         pll_params->flags |= TEGRA_PLL_LOCK_MISC | TEGRA_PLL_BYPASS;
         pll_params->flags |= TEGRA_PLL_HAS_LOCK_ENABLE;
+
+        if (!pll_params->div_nmp)
+                pll_params->div_nmp = &pll_e_nmp;
+
         pll = _tegra_init_pll(clk_base, pmc, pll_params, lock);
         if (IS_ERR(pll))
                 return ERR_CAST(pll);
@@ -1557,9 +1580,8 @@ struct clk *tegra_clk_register_pllre(const char *name, const char *parent_name,
                 int m;
 
                 m = _pll_fixed_mdiv(pll_params, parent_rate);
-                val = m << PLL_BASE_DIVM_SHIFT;
-                val |= (pll_params->vco_min / parent_rate)
-                                << PLL_BASE_DIVN_SHIFT;
+                val = m << divm_shift(pll);
+                val |= (pll_params->vco_min / parent_rate) << divn_shift(pll);
                 pll_writel_base(val, pll);
         }
 
diff --git a/drivers/clocksource/tcb_clksrc.c b/drivers/clocksource/tcb_clksrc.c
index 00fdd1170284..a8d7ea14f183 100644
--- a/drivers/clocksource/tcb_clksrc.c
+++ b/drivers/clocksource/tcb_clksrc.c
@@ -100,7 +100,7 @@ static void tc_mode(enum clock_event_mode m, struct clock_event_device *d)
                         || tcd->clkevt.mode == CLOCK_EVT_MODE_ONESHOT) {
                 __raw_writel(0xff, regs + ATMEL_TC_REG(2, IDR));
                 __raw_writel(ATMEL_TC_CLKDIS, regs + ATMEL_TC_REG(2, CCR));
-                clk_disable_unprepare(tcd->clk);
+                clk_disable(tcd->clk);
         }
 
         switch (m) {
@@ -109,7 +109,7 @@ static void tc_mode(enum clock_event_mode m, struct clock_event_device *d)
          * of oneshot, we get lower overhead and improved accuracy.
          */
         case CLOCK_EVT_MODE_PERIODIC:
-                clk_prepare_enable(tcd->clk);
+                clk_enable(tcd->clk);
 
                 /* slow clock, count up to RC, then irq and restart */
                 __raw_writel(timer_clock
@@ -126,7 +126,7 @@ static void tc_mode(enum clock_event_mode m, struct clock_event_device *d)
                 break;
 
         case CLOCK_EVT_MODE_ONESHOT:
-                clk_prepare_enable(tcd->clk);
+                clk_enable(tcd->clk);
 
                 /* slow clock, count up to RC, then irq and stop */
                 __raw_writel(timer_clock | ATMEL_TC_CPCSTOP
@@ -194,7 +194,7 @@ static int __init setup_clkevents(struct atmel_tc *tc, int clk32k_divisor_idx)
         ret = clk_prepare_enable(t2_clk);
         if (ret)
                 return ret;
-        clk_disable_unprepare(t2_clk);
+        clk_disable(t2_clk);
 
         clkevt.regs = tc->regs;
         clkevt.clk = t2_clk;
diff --git a/drivers/clocksource/timer-marco.c b/drivers/clocksource/timer-marco.c
index b52e1c078b99..7f5374dbefd9 100644
--- a/drivers/clocksource/timer-marco.c
+++ b/drivers/clocksource/timer-marco.c
@@ -199,7 +199,7 @@ static int sirfsoc_local_timer_setup(struct clock_event_device *ce)
 
         action->dev_id = ce;
         BUG_ON(setup_irq(ce->irq, action));
-        irq_set_affinity(action->irq, cpumask_of(cpu));
+        irq_force_affinity(action->irq, cpumask_of(cpu));
 
         clockevents_register_device(ce);
         return 0;
diff --git a/drivers/cpufreq/cpufreq-cpu0.c b/drivers/cpufreq/cpufreq-cpu0.c
index 1bf6bbac3e03..09b9129c7bd3 100644
--- a/drivers/cpufreq/cpufreq-cpu0.c
+++ b/drivers/cpufreq/cpufreq-cpu0.c
@@ -130,7 +130,7 @@ static int cpu0_cpufreq_probe(struct platform_device *pdev)
                 return -ENOENT;
         }
 
-        cpu_reg = devm_regulator_get_optional(cpu_dev, "cpu0");
+        cpu_reg = regulator_get_optional(cpu_dev, "cpu0");
         if (IS_ERR(cpu_reg)) {
                 /*
                  * If cpu0 regulator supply node is present, but regulator is
@@ -145,23 +145,23 @@ static int cpu0_cpufreq_probe(struct platform_device *pdev)
                         PTR_ERR(cpu_reg));
         }
 
-        cpu_clk = devm_clk_get(cpu_dev, NULL);
+        cpu_clk = clk_get(cpu_dev, NULL);
         if (IS_ERR(cpu_clk)) {
                 ret = PTR_ERR(cpu_clk);
                 pr_err("failed to get cpu0 clock: %d\n", ret);
-                goto out_put_node;
+                goto out_put_reg;
         }
 
         ret = of_init_opp_table(cpu_dev);
         if (ret) {
                 pr_err("failed to init OPP table: %d\n", ret);
-                goto out_put_node;
+                goto out_put_clk;
         }
 
         ret = dev_pm_opp_init_cpufreq_table(cpu_dev, &freq_table);
         if (ret) {
                 pr_err("failed to init cpufreq table: %d\n", ret);
-                goto out_put_node;
+                goto out_put_clk;
         }
 
         of_property_read_u32(np, "voltage-tolerance", &voltage_tolerance);
@@ -216,6 +216,12 @@ static int cpu0_cpufreq_probe(struct platform_device *pdev)
 
 out_free_table:
         dev_pm_opp_free_cpufreq_table(cpu_dev, &freq_table);
+out_put_clk:
+        if (!IS_ERR(cpu_clk))
+                clk_put(cpu_clk);
+out_put_reg:
+        if (!IS_ERR(cpu_reg))
+                regulator_put(cpu_reg);
 out_put_node:
         of_node_put(np);
         return ret;
diff --git a/drivers/cpufreq/cpufreq_governor.c b/drivers/cpufreq/cpufreq_governor.c
index ba43991ba98a..e1c6433b16e0 100644
--- a/drivers/cpufreq/cpufreq_governor.c
+++ b/drivers/cpufreq/cpufreq_governor.c
@@ -366,6 +366,11 @@ int cpufreq_governor_dbs(struct cpufreq_policy *policy,
                 break;
 
         case CPUFREQ_GOV_LIMITS:
+                mutex_lock(&dbs_data->mutex);
+                if (!cpu_cdbs->cur_policy) {
+                        mutex_unlock(&dbs_data->mutex);
+                        break;
+                }
                 mutex_lock(&cpu_cdbs->timer_mutex);
                 if (policy->max < cpu_cdbs->cur_policy->cur)
                         __cpufreq_driver_target(cpu_cdbs->cur_policy,
@@ -375,6 +380,7 @@ int cpufreq_governor_dbs(struct cpufreq_policy *policy,
                                         policy->min, CPUFREQ_RELATION_L);
                 dbs_check_cpu(dbs_data, cpu);
                 mutex_unlock(&cpu_cdbs->timer_mutex);
+                mutex_unlock(&dbs_data->mutex);
                 break;
         }
         return 0;
diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c
index a886713937fd..d5d30ed863ce 100644
--- a/drivers/dma/dmaengine.c
+++ b/drivers/dma/dmaengine.c
@@ -1009,6 +1009,7 @@ static void dmaengine_unmap(struct kref *kref)
                 dma_unmap_page(dev, unmap->addr[i], unmap->len,
                                DMA_BIDIRECTIONAL);
         }
+        cnt = unmap->map_cnt;
         mempool_free(unmap, __get_unmap_pool(cnt)->pool);
 }
 
@@ -1074,6 +1075,7 @@ dmaengine_get_unmap_data(struct device *dev, int nr, gfp_t flags)
         memset(unmap, 0, sizeof(*unmap));
         kref_init(&unmap->kref);
         unmap->dev = dev;
+        unmap->map_cnt = nr;
 
         return unmap;
 }
diff --git a/drivers/dma/dw/core.c b/drivers/dma/dw/core.c
index cfdbb92aae1d..7a740769c2fa 100644
--- a/drivers/dma/dw/core.c
+++ b/drivers/dma/dw/core.c
@@ -1548,11 +1548,6 @@ int dw_dma_probe(struct dw_dma_chip *chip, struct dw_dma_platform_data *pdata)
         /* Disable BLOCK interrupts as well */
         channel_clear_bit(dw, MASK.BLOCK, dw->all_chan_mask);
 
-        err = devm_request_irq(chip->dev, chip->irq, dw_dma_interrupt,
-                               IRQF_SHARED, "dw_dmac", dw);
-        if (err)
-                return err;
-
         /* Create a pool of consistent memory blocks for hardware descriptors */
         dw->desc_pool = dmam_pool_create("dw_dmac_desc_pool", chip->dev,
                                          sizeof(struct dw_desc), 4, 0);
@@ -1563,6 +1558,11 @@ int dw_dma_probe(struct dw_dma_chip *chip, struct dw_dma_platform_data *pdata)
 
         tasklet_init(&dw->tasklet, dw_dma_tasklet, (unsigned long)dw);
 
+        err = request_irq(chip->irq, dw_dma_interrupt, IRQF_SHARED,
+                          "dw_dmac", dw);
+        if (err)
+                return err;
+
         INIT_LIST_HEAD(&dw->dma.channels);
         for (i = 0; i < nr_channels; i++) {
                 struct dw_dma_chan      *dwc = &dw->chan[i];
@@ -1667,6 +1667,7 @@ int dw_dma_remove(struct dw_dma_chip *chip)
         dw_dma_off(dw);
         dma_async_device_unregister(&dw->dma);
 
+        free_irq(chip->irq, dw);
         tasklet_kill(&dw->tasklet);
 
         list_for_each_entry_safe(dwc, _dwc, &dw->dma.channels,
diff --git a/drivers/dma/mv_xor.c b/drivers/dma/mv_xor.c
index 766b68ed505c..394cbc5c93e3 100644
--- a/drivers/dma/mv_xor.c
+++ b/drivers/dma/mv_xor.c
@@ -191,12 +191,10 @@ static void mv_set_mode(struct mv_xor_chan *chan,
 
 static void mv_chan_activate(struct mv_xor_chan *chan)
 {
-        u32 activation;
-
         dev_dbg(mv_chan_to_devp(chan), " activate chan.\n");
-        activation = readl_relaxed(XOR_ACTIVATION(chan));
-        activation |= 0x1;
-        writel_relaxed(activation, XOR_ACTIVATION(chan));
+
+        /* writel ensures all descriptors are flushed before activation */
+        writel(BIT(0), XOR_ACTIVATION(chan));
 }
 
 static char mv_chan_is_busy(struct mv_xor_chan *chan)
diff --git a/drivers/dma/sa11x0-dma.c b/drivers/dma/sa11x0-dma.c
index ab26d46bbe15..5ebdfbc1051e 100644
--- a/drivers/dma/sa11x0-dma.c
+++ b/drivers/dma/sa11x0-dma.c
@@ -113,11 +113,9 @@ struct sa11x0_dma_phy {
         struct sa11x0_dma_desc  *txd_load;
         unsigned                sg_done;
         struct sa11x0_dma_desc  *txd_done;
-#ifdef CONFIG_PM_SLEEP
         u32                     dbs[2];
         u32                     dbt[2];
         u32                     dcsr;
-#endif
 };
 
 struct sa11x0_dma_dev {
@@ -984,7 +982,6 @@ static int sa11x0_dma_remove(struct platform_device *pdev)
         return 0;
 }
 
-#ifdef CONFIG_PM_SLEEP
 static int sa11x0_dma_suspend(struct device *dev)
 {
         struct sa11x0_dma_dev *d = dev_get_drvdata(dev);
@@ -1054,7 +1051,6 @@ static int sa11x0_dma_resume(struct device *dev)
 
         return 0;
 }
-#endif
 
 static const struct dev_pm_ops sa11x0_dma_pm_ops = {
         .suspend_noirq = sa11x0_dma_suspend,
diff --git a/drivers/firewire/core.h b/drivers/firewire/core.h
index c98764aeeec6..f477308b6e9c 100644
--- a/drivers/firewire/core.h
+++ b/drivers/firewire/core.h
@@ -237,8 +237,8 @@ static inline bool is_next_generation(int new_generation, int old_generation)
 
 #define LOCAL_BUS 0xffc0
 
-/* arbitrarily chosen maximum range for physical DMA: 128 TB */
-#define FW_MAX_PHYSICAL_RANGE           (128ULL << 40)
+/* OHCI-1394's default upper bound for physical DMA: 4 GB */
+#define FW_MAX_PHYSICAL_RANGE           (1ULL << 32)
 
 void fw_core_handle_request(struct fw_card *card, struct fw_packet *request);
 void fw_core_handle_response(struct fw_card *card, struct fw_packet *packet);
diff --git a/drivers/firewire/ohci.c b/drivers/firewire/ohci.c
index 8db663219560..586f2f7f6993 100644
--- a/drivers/firewire/ohci.c
+++ b/drivers/firewire/ohci.c
@@ -3716,7 +3716,7 @@ static int pci_probe(struct pci_dev *dev,
                     version >> 16, version & 0xff, ohci->card.index,
                     ohci->n_ir, ohci->n_it, ohci->quirks,
                     reg_read(ohci, OHCI1394_PhyUpperBound) ?
-                        ", >4 GB phys DMA" : "");
+                        ", physUB" : "");
 
         return 0;
 
diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
index 96177eec0a0e..eedb023af27d 100644
--- a/drivers/gpu/drm/i915/i915_dma.c
+++ b/drivers/gpu/drm/i915/i915_dma.c
@@ -1833,7 +1833,6 @@ int i915_driver_unload(struct drm_device *dev)
                 flush_workqueue(dev_priv->wq);
 
                 mutex_lock(&dev->struct_mutex);
-                i915_gem_free_all_phys_object(dev);
                 i915_gem_cleanup_ringbuffer(dev);
                 i915_gem_context_fini(dev);
                 WARN_ON(dev_priv->mm.aliasing_ppgtt);
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index 108e1ec2fa4b..388c028e223c 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -242,18 +242,6 @@ struct intel_ddi_plls {
 #define WATCH_LISTS     0
 #define WATCH_GTT       0
 
-#define I915_GEM_PHYS_CURSOR_0 1
-#define I915_GEM_PHYS_CURSOR_1 2
-#define I915_GEM_PHYS_OVERLAY_REGS 3
-#define I915_MAX_PHYS_OBJECT (I915_GEM_PHYS_OVERLAY_REGS)
-
-struct drm_i915_gem_phys_object {
-        int id;
-        struct page **page_list;
-        drm_dma_handle_t *handle;
-        struct drm_i915_gem_object *cur_obj;
-};
-
 struct opregion_header;
 struct opregion_acpi;
 struct opregion_swsci;
@@ -1187,9 +1175,6 @@ struct i915_gem_mm {
         /** Bit 6 swizzling required for Y tiling */
         uint32_t bit_6_swizzle_y;
 
-        /* storage for physical objects */
-        struct drm_i915_gem_phys_object *phys_objs[I915_MAX_PHYS_OBJECT];
-
         /* accounting, useful for userland debugging */
         spinlock_t object_stat_lock;
         size_t object_memory;
@@ -1769,7 +1754,7 @@ struct drm_i915_gem_object {
         struct drm_file *pin_filp;
 
         /** for phy allocated objects */
-        struct drm_i915_gem_phys_object *phys_obj;
+        drm_dma_handle_t *phys_handle;
 };
 
 #define to_intel_bo(x) container_of(x, struct drm_i915_gem_object, base)
@@ -2204,10 +2189,12 @@ void i915_gem_vma_destroy(struct i915_vma *vma);
 #define PIN_MAPPABLE 0x1
 #define PIN_NONBLOCK 0x2
 #define PIN_GLOBAL 0x4
+#define PIN_OFFSET_BIAS 0x8
+#define PIN_OFFSET_MASK (~4095)
 int __must_check i915_gem_object_pin(struct drm_i915_gem_object *obj,
                                      struct i915_address_space *vm,
                                      uint32_t alignment,
-                                     unsigned flags);
+                                     uint64_t flags);
 int __must_check i915_vma_unbind(struct i915_vma *vma);
 int i915_gem_object_put_pages(struct drm_i915_gem_object *obj);
 void i915_gem_release_all_mmaps(struct drm_i915_private *dev_priv);
@@ -2334,13 +2321,8 @@ i915_gem_object_pin_to_display_plane(struct drm_i915_gem_object *obj,
                                      u32 alignment,
                                      struct intel_ring_buffer *pipelined);
 void i915_gem_object_unpin_from_display_plane(struct drm_i915_gem_object *obj);
-int i915_gem_attach_phys_object(struct drm_device *dev,
-                                struct drm_i915_gem_object *obj,
-                                int id,
+int i915_gem_object_attach_phys(struct drm_i915_gem_object *obj,
                                 int align);
-void i915_gem_detach_phys_object(struct drm_device *dev,
-                                 struct drm_i915_gem_object *obj);
-void i915_gem_free_all_phys_object(struct drm_device *dev);
 int i915_gem_open(struct drm_device *dev, struct drm_file *file);
 void i915_gem_release(struct drm_device *dev, struct drm_file *file);
 
@@ -2465,6 +2447,8 @@ int __must_check i915_gem_evict_something(struct drm_device *dev,
                                           int min_size,
                                           unsigned alignment,
                                           unsigned cache_level,
+                                          unsigned long start,
+                                          unsigned long end,
                                           unsigned flags);
 int i915_gem_evict_vm(struct i915_address_space *vm, bool do_idle);
 int i915_gem_evict_everything(struct drm_device *dev);
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 2871ce75f438..3326770c9ed2 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -43,10 +43,6 @@ static void i915_gem_object_flush_cpu_write_domain(struct drm_i915_gem_object *o
 static __must_check int
 i915_gem_object_wait_rendering(struct drm_i915_gem_object *obj,
                                bool readonly);
-static int i915_gem_phys_pwrite(struct drm_device *dev,
-                                struct drm_i915_gem_object *obj,
-                                struct drm_i915_gem_pwrite *args,
-                                struct drm_file *file);
 
 static void i915_gem_write_fence(struct drm_device *dev, int reg,
                                  struct drm_i915_gem_object *obj);
@@ -209,6 +205,128 @@ i915_gem_get_aperture_ioctl(struct drm_device *dev, void *data,
         return 0;
 }
 
+static void i915_gem_object_detach_phys(struct drm_i915_gem_object *obj)
+{
+        drm_dma_handle_t *phys = obj->phys_handle;
+
+        if (!phys)
+                return;
+
+        if (obj->madv == I915_MADV_WILLNEED) {
+                struct address_space *mapping = file_inode(obj->base.filp)->i_mapping;
+                char *vaddr = phys->vaddr;
+                int i;
+
+                for (i = 0; i < obj->base.size / PAGE_SIZE; i++) {
+                        struct page *page = shmem_read_mapping_page(mapping, i);
+                        if (!IS_ERR(page)) {
+                                char *dst = kmap_atomic(page);
+                                memcpy(dst, vaddr, PAGE_SIZE);
+                                drm_clflush_virt_range(dst, PAGE_SIZE);
+                                kunmap_atomic(dst);
+
+                                set_page_dirty(page);
+                                mark_page_accessed(page);
+                                page_cache_release(page);
+                        }
+                        vaddr += PAGE_SIZE;
+                }
+                i915_gem_chipset_flush(obj->base.dev);
+        }
+
+#ifdef CONFIG_X86
+        set_memory_wb((unsigned long)phys->vaddr, phys->size / PAGE_SIZE);
+#endif
+        drm_pci_free(obj->base.dev, phys);
+        obj->phys_handle = NULL;
+}
+
+int
+i915_gem_object_attach_phys(struct drm_i915_gem_object *obj,
+                            int align)
+{
+        drm_dma_handle_t *phys;
+        struct address_space *mapping;
+        char *vaddr;
+        int i;
+
+        if (obj->phys_handle) {
+                if ((unsigned long)obj->phys_handle->vaddr & (align -1))
+                        return -EBUSY;
+
+                return 0;
+        }
+
+        if (obj->madv != I915_MADV_WILLNEED)
+                return -EFAULT;
+
+        if (obj->base.filp == NULL)
+                return -EINVAL;
+
+        /* create a new object */
+        phys = drm_pci_alloc(obj->base.dev, obj->base.size, align);
+        if (!phys)
+                return -ENOMEM;
+
+        vaddr = phys->vaddr;
+#ifdef CONFIG_X86
+        set_memory_wc((unsigned long)vaddr, phys->size / PAGE_SIZE);
+#endif
+        mapping = file_inode(obj->base.filp)->i_mapping;
+        for (i = 0; i < obj->base.size / PAGE_SIZE; i++) {
+                struct page *page;
+                char *src;
+
+                page = shmem_read_mapping_page(mapping, i);
+                if (IS_ERR(page)) {
+#ifdef CONFIG_X86
+                        set_memory_wb((unsigned long)phys->vaddr, phys->size / PAGE_SIZE);
+#endif
+                        drm_pci_free(obj->base.dev, phys);
+                        return PTR_ERR(page);
+                }
+
+                src = kmap_atomic(page);
+                memcpy(vaddr, src, PAGE_SIZE);
+                kunmap_atomic(src);
+
+                mark_page_accessed(page);
+                page_cache_release(page);
+
+                vaddr += PAGE_SIZE;
+        }
+
+        obj->phys_handle = phys;
+        return 0;
+}
+
+static int
+i915_gem_phys_pwrite(struct drm_i915_gem_object *obj,
+                     struct drm_i915_gem_pwrite *args,
+                     struct drm_file *file_priv)
+{
+        struct drm_device *dev = obj->base.dev;
+        void *vaddr = obj->phys_handle->vaddr + args->offset;
+        char __user *user_data = to_user_ptr(args->data_ptr);
+
+        if (__copy_from_user_inatomic_nocache(vaddr, user_data, args->size)) {
+                unsigned long unwritten;
+
+                /* The physical object once assigned is fixed for the lifetime
+                 * of the obj, so we can safely drop the lock and continue
+                 * to access vaddr.
+                 */
+                mutex_unlock(&dev->struct_mutex);
+                unwritten = copy_from_user(vaddr, user_data, args->size);
+                mutex_lock(&dev->struct_mutex);
+                if (unwritten)
+                        return -EFAULT;
+        }
+
+        i915_gem_chipset_flush(dev);
+        return 0;
+}
+
 void *i915_gem_object_alloc(struct drm_device *dev)
 {
         struct drm_i915_private *dev_priv = dev->dev_private;
@@ -921,8 +1039,8 @@ i915_gem_pwrite_ioctl(struct drm_device *dev, void *data,
          * pread/pwrite currently are reading and writing from the CPU
          * perspective, requiring manual detiling by the client.
          */
-        if (obj->phys_obj) {
-                ret = i915_gem_phys_pwrite(dev, obj, args, file);
+        if (obj->phys_handle) {
+                ret = i915_gem_phys_pwrite(obj, args, file);
                 goto out;
         }
 
@@ -3208,12 +3326,14 @@ static struct i915_vma *
 i915_gem_object_bind_to_vm(struct drm_i915_gem_object *obj,
                            struct i915_address_space *vm,
                            unsigned alignment,
-                           unsigned flags)
+                           uint64_t flags)
 {
         struct drm_device *dev = obj->base.dev;
         struct drm_i915_private *dev_priv = dev->dev_private;
         u32 size, fence_size, fence_alignment, unfenced_alignment;
-        size_t gtt_max =
+        unsigned long start =
+                flags & PIN_OFFSET_BIAS ? flags & PIN_OFFSET_MASK : 0;
+        unsigned long end =
                 flags & PIN_MAPPABLE ? dev_priv->gtt.mappable_end : vm->total;
         struct i915_vma *vma;
         int ret;
@@ -3242,11 +3362,11 @@ i915_gem_object_bind_to_vm(struct drm_i915_gem_object *obj,
         /* If the object is bigger than the entire aperture, reject it early
          * before evicting everything in a vain attempt to find space.
          */
-        if (obj->base.size > gtt_max) {
-                DRM_DEBUG("Attempting to bind an object larger than the aperture: object=%zd > %s aperture=%zu\n",
+        if (obj->base.size > end) {
+                DRM_DEBUG("Attempting to bind an object larger than the aperture: object=%zd > %s aperture=%lu\n",
                           obj->base.size,
                           flags & PIN_MAPPABLE ? "mappable" : "total",
-                          gtt_max);
+                          end);
                 return ERR_PTR(-E2BIG);
         }
 
@@ -3263,12 +3383,15 @@ i915_gem_object_bind_to_vm(struct drm_i915_gem_object *obj,
 search_free:
         ret = drm_mm_insert_node_in_range_generic(&vm->mm, &vma->node,
                                                   size, alignment,
-                                                  obj->cache_level, 0, gtt_max,
+                                                  obj->cache_level,
+                                                  start, end,
                                                   DRM_MM_SEARCH_DEFAULT,
                                                   DRM_MM_CREATE_DEFAULT);
         if (ret) {
                 ret = i915_gem_evict_something(dev, vm, size, alignment,
-                                               obj->cache_level, flags);
+                                               obj->cache_level,
+                                               start, end,
+                                               flags);
                 if (ret == 0)
                         goto search_free;
 
@@ -3828,11 +3951,30 @@ i915_gem_ring_throttle(struct drm_device *dev, struct drm_file *file)
         return ret;
 }
 
+static bool
+i915_vma_misplaced(struct i915_vma *vma, uint32_t alignment, uint64_t flags)
+{
+        struct drm_i915_gem_object *obj = vma->obj;
+
+        if (alignment &&
+            vma->node.start & (alignment - 1))
+                return true;
+
+        if (flags & PIN_MAPPABLE && !obj->map_and_fenceable)
+                return true;
+
+        if (flags & PIN_OFFSET_BIAS &&
+            vma->node.start < (flags & PIN_OFFSET_MASK))
+                return true;
+
+        return false;
+}
+
 int
 i915_gem_object_pin(struct drm_i915_gem_object *obj,
                     struct i915_address_space *vm,
                     uint32_t alignment,
-                    unsigned flags)
+                    uint64_t flags)
 {
         struct i915_vma *vma;
         int ret;
@@ -3845,15 +3987,13 @@ i915_gem_object_pin(struct drm_i915_gem_object *obj,
                 if (WARN_ON(vma->pin_count == DRM_I915_GEM_OBJECT_MAX_PIN_COUNT))
                         return -EBUSY;
 
-                if ((alignment &&
-                     vma->node.start & (alignment - 1)) ||
-                    (flags & PIN_MAPPABLE && !obj->map_and_fenceable)) {
+                if (i915_vma_misplaced(vma, alignment, flags)) {
                         WARN(vma->pin_count,
                              "bo is already pinned with incorrect alignment:"
                              " offset=%lx, req.alignment=%x, req.map_and_fenceable=%d,"
                              " obj->map_and_fenceable=%d\n",
                              i915_gem_obj_offset(obj, vm), alignment,
-                             flags & PIN_MAPPABLE,
+                             !!(flags & PIN_MAPPABLE),
                              obj->map_and_fenceable);
                         ret = i915_vma_unbind(vma);
                         if (ret)
@@ -4163,9 +4303,6 @@ void i915_gem_free_object(struct drm_gem_object *gem_obj)
 
         trace_i915_gem_object_destroy(obj);
 
-        if (obj->phys_obj)
-                i915_gem_detach_phys_object(dev, obj);
-
         list_for_each_entry_safe(vma, next, &obj->vma_list, vma_link) {
                 int ret;
 
@@ -4183,6 +4320,8 @@ void i915_gem_free_object(struct drm_gem_object *gem_obj)
                 }
         }
 
+        i915_gem_object_detach_phys(obj);
+
         /* Stolen objects don't hold a ref, but do hold pin count. Fix that up
          * before progressing. */
         if (obj->stolen)
@@ -4646,190 +4785,6 @@ i915_gem_load(struct drm_device *dev)
         register_shrinker(&dev_priv->mm.inactive_shrinker);
 }
 
-/*
- * Create a physically contiguous memory object for this object
- * e.g. for cursor + overlay regs
- */
-static int i915_gem_init_phys_object(struct drm_device *dev,
-                                     int id, int size, int align)
-{
-        struct drm_i915_private *dev_priv = dev->dev_private;
-        struct drm_i915_gem_phys_object *phys_obj;
-        int ret;
-
-        if (dev_priv->mm.phys_objs[id - 1] || !size)
-                return 0;
-
-        phys_obj = kzalloc(sizeof(*phys_obj), GFP_KERNEL);
-        if (!phys_obj)
-                return -ENOMEM;
-
-        phys_obj->id = id;
-
-        phys_obj->handle = drm_pci_alloc(dev, size, align);
-        if (!phys_obj->handle) {
-                ret = -ENOMEM;
-                goto kfree_obj;
-        }
-#ifdef CONFIG_X86
-        set_memory_wc((unsigned long)phys_obj->handle->vaddr, phys_obj->handle->size / PAGE_SIZE);
-#endif
-
-        dev_priv->mm.phys_objs[id - 1] = phys_obj;
-
-        return 0;
-kfree_obj:
-        kfree(phys_obj);
-        return ret;
-}
-
-static void i915_gem_free_phys_object(struct drm_device *dev, int id)
-{
-        struct drm_i915_private *dev_priv = dev->dev_private;
-        struct drm_i915_gem_phys_object *phys_obj;
-
-        if (!dev_priv->mm.phys_objs[id - 1])
-                return;
-
-        phys_obj = dev_priv->mm.phys_objs[id - 1];
-        if (phys_obj->cur_obj) {
-                i915_gem_detach_phys_object(dev, phys_obj->cur_obj);
-        }
-
-#ifdef CONFIG_X86
-        set_memory_wb((unsigned long)phys_obj->handle->vaddr, phys_obj->handle->size / PAGE_SIZE);
-#endif
-        drm_pci_free(dev, phys_obj->handle);
-        kfree(phys_obj);
-        dev_priv->mm.phys_objs[id - 1] = NULL;
-}
-
-void i915_gem_free_all_phys_object(struct drm_device *dev)
-{
-        int i;
-
-        for (i = I915_GEM_PHYS_CURSOR_0; i <= I915_MAX_PHYS_OBJECT; i++)
-                i915_gem_free_phys_object(dev, i);
-}
-
-void i915_gem_detach_phys_object(struct drm_device *dev,
-                                 struct drm_i915_gem_object *obj)
-{
-        struct address_space *mapping = file_inode(obj->base.filp)->i_mapping;
-        char *vaddr;
-        int i;
-        int page_count;
-
-        if (!obj->phys_obj)
-                return;
-        vaddr = obj->phys_obj->handle->vaddr;
-
-        page_count = obj->base.size / PAGE_SIZE;
-        for (i = 0; i < page_count; i++) {
-                struct page *page = shmem_read_mapping_page(mapping, i);
-                if (!IS_ERR(page)) {
-                        char *dst = kmap_atomic(page);
-                        memcpy(dst, vaddr + i*PAGE_SIZE, PAGE_SIZE);
-                        kunmap_atomic(dst);
-
-                        drm_clflush_pages(&page, 1);
-
-                        set_page_dirty(page);
-                        mark_page_accessed(page);
-                        page_cache_release(page);
-                }
-        }
-        i915_gem_chipset_flush(dev);
-
-        obj->phys_obj->cur_obj = NULL;
-        obj->phys_obj = NULL;
-}
-
-int
-i915_gem_attach_phys_object(struct drm_device *dev,
-                            struct drm_i915_gem_object *obj,
-                            int id,
-                            int align)
-{
-        struct address_space *mapping = file_inode(obj->base.filp)->i_mapping;
-        struct drm_i915_private *dev_priv = dev->dev_private;
-        int ret = 0;
-        int page_count;
-        int i;
-
-        if (id > I915_MAX_PHYS_OBJECT)
-                return -EINVAL;
-
-        if (obj->phys_obj) {
-                if (obj->phys_obj->id == id)
-                        return 0;
-                i915_gem_detach_phys_object(dev, obj);
-        }
-
-        /* create a new object */
-        if (!dev_priv->mm.phys_objs[id - 1]) {
-                ret = i915_gem_init_phys_object(dev, id,
-                                                obj->base.size, align);
-                if (ret) {
-                        DRM_ERROR("failed to init phys object %d size: %zu\n",
-                                  id, obj->base.size);
-                        return ret;
-                }
-        }
-
-        /* bind to the object */
-        obj->phys_obj = dev_priv->mm.phys_objs[id - 1];
-        obj->phys_obj->cur_obj = obj;
-
-        page_count = obj->base.size / PAGE_SIZE;
-
-        for (i = 0; i < page_count; i++) {
-                struct page *page;
-                char *dst, *src;
-
-                page = shmem_read_mapping_page(mapping, i);
-                if (IS_ERR(page))
-                        return PTR_ERR(page);
-
-                src = kmap_atomic(page);
-                dst = obj->phys_obj->handle->vaddr + (i * PAGE_SIZE);
-                memcpy(dst, src, PAGE_SIZE);
-                kunmap_atomic(src);
-
-                mark_page_accessed(page);
-                page_cache_release(page);
-        }
-
-        return 0;
-}
-
-static int
-i915_gem_phys_pwrite(struct drm_device *dev,
-                     struct drm_i915_gem_object *obj,
-                     struct drm_i915_gem_pwrite *args,
-                     struct drm_file *file_priv)
-{
-        void *vaddr = obj->phys_obj->handle->vaddr + args->offset;
-        char __user *user_data = to_user_ptr(args->data_ptr);
-
-        if (__copy_from_user_inatomic_nocache(vaddr, user_data, args->size)) {
-                unsigned long unwritten;
-
-                /* The physical object once assigned is fixed for the lifetime
-                 * of the obj, so we can safely drop the lock and continue
-                 * to access vaddr.
-                 */
-                mutex_unlock(&dev->struct_mutex);
-                unwritten = copy_from_user(vaddr, user_data, args->size);
-                mutex_lock(&dev->struct_mutex);
-                if (unwritten)
-                        return -EFAULT;
-        }
-
-        i915_gem_chipset_flush(dev);
-        return 0;
-}
-
 void i915_gem_release(struct drm_device *dev, struct drm_file *file)
 {
         struct drm_i915_file_private *file_priv = file->driver_priv;
diff --git a/drivers/gpu/drm/i915/i915_gem_evict.c b/drivers/gpu/drm/i915/i915_gem_evict.c
index 75fca63dc8c1..bbf4b12d842e 100644
--- a/drivers/gpu/drm/i915/i915_gem_evict.c
+++ b/drivers/gpu/drm/i915/i915_gem_evict.c
@@ -68,9 +68,9 @@ mark_free(struct i915_vma *vma, struct list_head *unwind)
 int
 i915_gem_evict_something(struct drm_device *dev, struct i915_address_space *vm,
                          int min_size, unsigned alignment, unsigned cache_level,
+                         unsigned long start, unsigned long end,
                          unsigned flags)
 {
-        struct drm_i915_private *dev_priv = dev->dev_private;
         struct list_head eviction_list, unwind_list;
         struct i915_vma *vma;
         int ret = 0;
@@ -102,11 +102,10 @@ i915_gem_evict_something(struct drm_device *dev, struct i915_address_space *vm,
          */
 
         INIT_LIST_HEAD(&unwind_list);
-        if (flags & PIN_MAPPABLE) {
-                BUG_ON(!i915_is_ggtt(vm));
+        if (start != 0 || end != vm->total) {
                 drm_mm_init_scan_with_range(&vm->mm, min_size,
-                                            alignment, cache_level, 0,
-                                            dev_priv->gtt.mappable_end);
+                                            alignment, cache_level,
+                                            start, end);
         } else
                 drm_mm_init_scan(&vm->mm, min_size, alignment, cache_level);
 
diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
index 2c9d9cbaf653..20fef6c50267 100644
--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
@@ -35,6 +35,9 @@
 
 #define  __EXEC_OBJECT_HAS_PIN (1<<31)
 #define  __EXEC_OBJECT_HAS_FENCE (1<<30)
+#define  __EXEC_OBJECT_NEEDS_BIAS (1<<28)
+
+#define BATCH_OFFSET_BIAS (256*1024)
 
 struct eb_vmas {
         struct list_head vmas;
@@ -545,7 +548,7 @@ i915_gem_execbuffer_reserve_vma(struct i915_vma *vma,
         struct drm_i915_gem_exec_object2 *entry = vma->exec_entry;
         bool has_fenced_gpu_access = INTEL_INFO(ring->dev)->gen < 4;
         bool need_fence;
-        unsigned flags;
+        uint64_t flags;
         int ret;
 
         flags = 0;
@@ -559,6 +562,8 @@ i915_gem_execbuffer_reserve_vma(struct i915_vma *vma,
 
         if (entry->flags & EXEC_OBJECT_NEEDS_GTT)
                 flags |= PIN_GLOBAL;
+        if (entry->flags & __EXEC_OBJECT_NEEDS_BIAS)
+                flags |= BATCH_OFFSET_BIAS | PIN_OFFSET_BIAS;
 
         ret = i915_gem_object_pin(obj, vma->vm, entry->alignment, flags);
         if (ret)
@@ -592,6 +597,36 @@ i915_gem_execbuffer_reserve_vma(struct i915_vma *vma,
         return 0;
 }
 
+static bool
+eb_vma_misplaced(struct i915_vma *vma, bool has_fenced_gpu_access)
+{
+        struct drm_i915_gem_exec_object2 *entry = vma->exec_entry;
+        struct drm_i915_gem_object *obj = vma->obj;
+        bool need_fence, need_mappable;
+
+        need_fence =
+                has_fenced_gpu_access &&
+                entry->flags & EXEC_OBJECT_NEEDS_FENCE &&
+                obj->tiling_mode != I915_TILING_NONE;
+        need_mappable = need_fence || need_reloc_mappable(vma);
+
+        WARN_ON((need_mappable || need_fence) &&
+               !i915_is_ggtt(vma->vm));
+
+        if (entry->alignment &&
+            vma->node.start & (entry->alignment - 1))
+                return true;
+
+        if (need_mappable && !obj->map_and_fenceable)
+                return true;
+
+        if (entry->flags & __EXEC_OBJECT_NEEDS_BIAS &&
+            vma->node.start < BATCH_OFFSET_BIAS)
+                return true;
+
+        return false;
+}
+
 static int
 i915_gem_execbuffer_reserve(struct intel_ring_buffer *ring,
                             struct list_head *vmas,
@@ -653,26 +688,10 @@ i915_gem_execbuffer_reserve(struct intel_ring_buffer *ring,
 
                 /* Unbind any ill-fitting objects or pin. */
                 list_for_each_entry(vma, vmas, exec_list) {
-                        struct drm_i915_gem_exec_object2 *entry = vma->exec_entry;
-                        bool need_fence, need_mappable;
-
-                        obj = vma->obj;
-
                         if (!drm_mm_node_allocated(&vma->node))
                                 continue;
 
-                        need_fence =
-                                has_fenced_gpu_access &&
-                                entry->flags & EXEC_OBJECT_NEEDS_FENCE &&
-                                obj->tiling_mode != I915_TILING_NONE;
-                        need_mappable = need_fence || need_reloc_mappable(vma);
-
-                        WARN_ON((need_mappable || need_fence) &&
-                               !i915_is_ggtt(vma->vm));
-
-                        if ((entry->alignment &&
-                             vma->node.start & (entry->alignment - 1)) ||
-                            (need_mappable && !obj->map_and_fenceable))
+                        if (eb_vma_misplaced(vma, has_fenced_gpu_access))
                                 ret = i915_vma_unbind(vma);
                         else
                                 ret = i915_gem_execbuffer_reserve_vma(vma, ring, need_relocs);
@@ -773,9 +792,9 @@ i915_gem_execbuffer_relocate_slow(struct drm_device *dev,
                  * relocations were valid.
                  */
                 for (j = 0; j < exec[i].relocation_count; j++) {
-                        if (copy_to_user(&user_relocs[j].presumed_offset,
-                                         &invalid_offset,
-                                         sizeof(invalid_offset))) {
+                        if (__copy_to_user(&user_relocs[j].presumed_offset,
+                                           &invalid_offset,
+                                           sizeof(invalid_offset))) {
                                 ret = -EFAULT;
                                 mutex_lock(&dev->struct_mutex);
                                 goto err;
@@ -999,6 +1018,25 @@ i915_reset_gen7_sol_offsets(struct drm_device *dev,
         return 0;
 }
 
+static struct drm_i915_gem_object *
+eb_get_batch(struct eb_vmas *eb)
+{
+        struct i915_vma *vma = list_entry(eb->vmas.prev, typeof(*vma), exec_list);
+
+        /*
+         * SNA is doing fancy tricks with compressing batch buffers, which leads
+         * to negative relocation deltas. Usually that works out ok since the
+         * relocate address is still positive, except when the batch is placed
+         * very low in the GTT. Ensure this doesn't happen.
+         *
+         * Note that actual hangs have only been observed on gen7, but for
+         * paranoia do it everywhere.
+         */
+        vma->exec_entry->flags |= __EXEC_OBJECT_NEEDS_BIAS;
+
+        return vma->obj;
+}
+
 static int
 i915_gem_do_execbuffer(struct drm_device *dev, void *data,
                        struct drm_file *file,
@@ -1153,7 +1191,7 @@ i915_gem_do_execbuffer(struct drm_device *dev, void *data,
                 goto err;
 
         /* take note of the batch buffer before we might reorder the lists */
-        batch_obj = list_entry(eb->vmas.prev, struct i915_vma, exec_list)->obj;
+        batch_obj = eb_get_batch(eb);
 
         /* Move the objects en-masse into the GTT, evicting if necessary. */
         need_relocs = (args->flags & I915_EXEC_NO_RELOC) == 0;
@@ -1355,18 +1393,21 @@ i915_gem_execbuffer(struct drm_device *dev, void *data,
 
         ret = i915_gem_do_execbuffer(dev, data, file, &exec2, exec2_list);
         if (!ret) {
+                struct drm_i915_gem_exec_object __user *user_exec_list =
+                        to_user_ptr(args->buffers_ptr);
+
                 /* Copy the new buffer offsets back to the user's exec list. */
-                for (i = 0; i < args->buffer_count; i++)
-                        exec_list[i].offset = exec2_list[i].offset;
-                /* ... and back out to userspace */
-                ret = copy_to_user(to_user_ptr(args->buffers_ptr),
-                                   exec_list,
-                                   sizeof(*exec_list) * args->buffer_count);
-                if (ret) {
-                        ret = -EFAULT;
-                        DRM_DEBUG("failed to copy %d exec entries "
-                                  "back to user (%d)\n",
-                                  args->buffer_count, ret);
+                for (i = 0; i < args->buffer_count; i++) {
+                        ret = __copy_to_user(&user_exec_list[i].offset,
+                                             &exec2_list[i].offset,
+                                             sizeof(user_exec_list[i].offset));
+                        if (ret) {
+                                ret = -EFAULT;
+                                DRM_DEBUG("failed to copy %d exec entries "
+                                          "back to user (%d)\n",
+                                          args->buffer_count, ret);
+                                break;
+                        }
                 }
         }
 
@@ -1412,14 +1453,21 @@ i915_gem_execbuffer2(struct drm_device *dev, void *data,
         ret = i915_gem_do_execbuffer(dev, data, file, args, exec2_list);
         if (!ret) {
                 /* Copy the new buffer offsets back to the user's exec list. */
-                ret = copy_to_user(to_user_ptr(args->buffers_ptr),
-                                   exec2_list,
-                                   sizeof(*exec2_list) * args->buffer_count);
-                if (ret) {
-                        ret = -EFAULT;
-                        DRM_DEBUG("failed to copy %d exec entries "
-                                  "back to user (%d)\n",
-                                  args->buffer_count, ret);
+                struct drm_i915_gem_exec_object2 *user_exec_list =
+                                   to_user_ptr(args->buffers_ptr);
+                int i;
+
+                for (i = 0; i < args->buffer_count; i++) {
+                        ret = __copy_to_user(&user_exec_list[i].offset,
+                                             &exec2_list[i].offset,
+                                             sizeof(user_exec_list[i].offset));
+                        if (ret) {
+                                ret = -EFAULT;
+                                DRM_DEBUG("failed to copy %d exec entries "
+                                          "back to user\n",
+                                          args->buffer_count);
+                                break;
+                        }
                 }
         }
 
diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.c b/drivers/gpu/drm/i915/i915_gem_gtt.c
index 154b0f8bb88d..5deb22864c52 100644
--- a/drivers/gpu/drm/i915/i915_gem_gtt.c
+++ b/drivers/gpu/drm/i915/i915_gem_gtt.c
@@ -1089,7 +1089,9 @@ alloc:
         if (ret == -ENOSPC && !retried) {
                 ret = i915_gem_evict_something(dev, &dev_priv->gtt.base,
                                                GEN6_PD_SIZE, GEN6_PD_ALIGN,
-                                               I915_CACHE_NONE, 0);
+                                               I915_CACHE_NONE,
+                                               0, dev_priv->gtt.base.total,
+                                               0);
                 if (ret)
                         return ret;
 
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 48aa516a1ac0..5b60e25baa32 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -7825,14 +7825,12 @@ static int intel_crtc_cursor_set(struct drm_crtc *crtc,
                 addr = i915_gem_obj_ggtt_offset(obj);
         } else {
                 int align = IS_I830(dev) ? 16 * 1024 : 256;
-                ret = i915_gem_attach_phys_object(dev, obj,
-                                                  (intel_crtc->pipe == 0) ? I915_GEM_PHYS_CURSOR_0 : I915_GEM_PHYS_CURSOR_1,
-                                                  align);
+                ret = i915_gem_object_attach_phys(obj, align);
                 if (ret) {
                         DRM_DEBUG_KMS("failed to attach phys object\n");
                         goto fail_locked;
                 }
-                addr = obj->phys_obj->handle->busaddr;
+                addr = obj->phys_handle->busaddr;
         }
 
         if (IS_GEN2(dev))
@@ -7840,10 +7838,7 @@ static int intel_crtc_cursor_set(struct drm_crtc *crtc,
 
  finish:
         if (intel_crtc->cursor_bo) {
-                if (INTEL_INFO(dev)->cursor_needs_physical) {
-                        if (intel_crtc->cursor_bo != obj)
-                                i915_gem_detach_phys_object(dev, intel_crtc->cursor_bo);
-                } else
+                if (!INTEL_INFO(dev)->cursor_needs_physical)
                         i915_gem_object_unpin_from_display_plane(intel_crtc->cursor_bo);
                 drm_gem_object_unreference(&intel_crtc->cursor_bo->base);
         }
diff --git a/drivers/gpu/drm/i915/intel_overlay.c b/drivers/gpu/drm/i915/intel_overlay.c
index d8adc9104dca..129db0c7d835 100644
--- a/drivers/gpu/drm/i915/intel_overlay.c
+++ b/drivers/gpu/drm/i915/intel_overlay.c
@@ -193,7 +193,7 @@ intel_overlay_map_regs(struct intel_overlay *overlay)
         struct overlay_registers __iomem *regs;
 
         if (OVERLAY_NEEDS_PHYSICAL(overlay->dev))
-                regs = (struct overlay_registers __iomem *)overlay->reg_bo->phys_obj->handle->vaddr;
+                regs = (struct overlay_registers __iomem *)overlay->reg_bo->phys_handle->vaddr;
         else
                 regs = io_mapping_map_wc(dev_priv->gtt.mappable,
                                          i915_gem_obj_ggtt_offset(overlay->reg_bo));
@@ -1340,14 +1340,12 @@ void intel_setup_overlay(struct drm_device *dev)
         overlay->reg_bo = reg_bo;
 
         if (OVERLAY_NEEDS_PHYSICAL(dev)) {
-                ret = i915_gem_attach_phys_object(dev, reg_bo,
-                                                  I915_GEM_PHYS_OVERLAY_REGS,
-                                                  PAGE_SIZE);
+                ret = i915_gem_object_attach_phys(reg_bo, PAGE_SIZE);
                 if (ret) {
                         DRM_ERROR("failed to attach phys overlay regs\n");
                         goto out_free_bo;
                 }
-                overlay->flip_addr = reg_bo->phys_obj->handle->busaddr;
+                overlay->flip_addr = reg_bo->phys_handle->busaddr;
         } else {
                 ret = i915_gem_obj_ggtt_pin(reg_bo, PAGE_SIZE, PIN_MAPPABLE);
                 if (ret) {
@@ -1428,7 +1426,7 @@ intel_overlay_map_regs_atomic(struct intel_overlay *overlay)
                 /* Cast to make sparse happy, but it's wc memory anyway, so
                  * equivalent to the wc io mapping on X86. */
                 regs = (struct overlay_registers __iomem *)
-                        overlay->reg_bo->phys_obj->handle->vaddr;
+                        overlay->reg_bo->phys_handle->vaddr;
         else
                 regs = io_mapping_map_atomic_wc(dev_priv->gtt.mappable,
                                                 i915_gem_obj_ggtt_offset(overlay->reg_bo));
@@ -1462,7 +1460,7 @@ intel_overlay_capture_error_state(struct drm_device *dev)
         error->dovsta = I915_READ(DOVSTA);
         error->isr = I915_READ(ISR);
         if (OVERLAY_NEEDS_PHYSICAL(overlay->dev))
-                error->base = (__force long)overlay->reg_bo->phys_obj->handle->vaddr;
+                error->base = (__force long)overlay->reg_bo->phys_handle->vaddr;
         else
                 error->base = i915_gem_obj_ggtt_offset(overlay->reg_bo);
 
diff --git a/drivers/gpu/drm/radeon/radeon_cs.c b/drivers/gpu/drm/radeon/radeon_cs.c
index 2b6e0ebcc13a..41ecf8a60611 100644
--- a/drivers/gpu/drm/radeon/radeon_cs.c
+++ b/drivers/gpu/drm/radeon/radeon_cs.c
@@ -152,6 +152,12 @@ static int radeon_cs_parser_relocs(struct radeon_cs_parser *p)
                         uint32_t domain = r->write_domain ?
                                 r->write_domain : r->read_domains;
 
+                        if (domain & RADEON_GEM_DOMAIN_CPU) {
+                                DRM_ERROR("RADEON_GEM_DOMAIN_CPU is not valid "
+                                          "for command submission\n");
+                                return -EINVAL;
+                        }
+
                         p->relocs[i].domain = domain;
                         if (domain == RADEON_GEM_DOMAIN_VRAM)
                                 domain |= RADEON_GEM_DOMAIN_GTT;
@@ -342,10 +348,17 @@ int radeon_cs_parser_init(struct radeon_cs_parser *p, void *data)
                         return -EINVAL;
 
                 /* we only support VM on some SI+ rings */
-                if ((p->rdev->asic->ring[p->ring]->cs_parse == NULL) &&
-                   ((p->cs_flags & RADEON_CS_USE_VM) == 0)) {
-                        DRM_ERROR("Ring %d requires VM!\n", p->ring);
-                        return -EINVAL;
+                if ((p->cs_flags & RADEON_CS_USE_VM) == 0) {
+                        if (p->rdev->asic->ring[p->ring]->cs_parse == NULL) {
+                                DRM_ERROR("Ring %d requires VM!\n", p->ring);
+                                return -EINVAL;
+                        }
+                } else {
+                        if (p->rdev->asic->ring[p->ring]->ib_parse == NULL) {
+                                DRM_ERROR("VM not supported on ring %d!\n",
+                                          p->ring);
+                                return -EINVAL;
+                        }
                 }
         }
 
diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
index 0e770bbf7e29..14671406212f 100644
--- a/drivers/gpu/drm/radeon/radeon_device.c
+++ b/drivers/gpu/drm/radeon/radeon_device.c
@@ -1533,11 +1533,6 @@ int radeon_resume_kms(struct drm_device *dev, bool resume, bool fbcon)
 
         radeon_restore_bios_scratch_regs(rdev);
 
-        if (fbcon) {
-                radeon_fbdev_set_suspend(rdev, 0);
-                console_unlock();
-        }
-
         /* init dig PHYs, disp eng pll */
         if (rdev->is_atom_bios) {
                 radeon_atom_encoder_init(rdev);
@@ -1562,6 +1557,12 @@ int radeon_resume_kms(struct drm_device *dev, bool resume, bool fbcon)
         }
 
         drm_kms_helper_poll_enable(dev);
+
+        if (fbcon) {
+                radeon_fbdev_set_suspend(rdev, 0);
+                console_unlock();
+        }
+
         return 0;
 }
 
diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c
index f00dbbf4d806..356b733caafe 100644
--- a/drivers/gpu/drm/radeon/radeon_display.c
+++ b/drivers/gpu/drm/radeon/radeon_display.c
@@ -862,7 +862,7 @@ static void avivo_get_fb_ref_div(unsigned nom, unsigned den, unsigned post_div,
                                  unsigned *fb_div, unsigned *ref_div)
 {
         /* limit reference * post divider to a maximum */
-        ref_div_max = min(128 / post_div, ref_div_max);
+        ref_div_max = max(min(100 / post_div, ref_div_max), 1u);
 
         /* get matching reference and feedback divider */
         *ref_div = min(max(DIV_ROUND_CLOSEST(den, post_div), 1u), ref_div_max);
diff --git a/drivers/gpu/drm/radeon/radeon_vm.c b/drivers/gpu/drm/radeon/radeon_vm.c
index d9ab99f47612..1f426696de36 100644
--- a/drivers/gpu/drm/radeon/radeon_vm.c
+++ b/drivers/gpu/drm/radeon/radeon_vm.c
@@ -130,10 +130,10 @@ struct radeon_cs_reloc *radeon_vm_get_bos(struct radeon_device *rdev,
                                           struct list_head *head)
 {
         struct radeon_cs_reloc *list;
-        unsigned i, idx, size;
+        unsigned i, idx;
 
-        size = (radeon_vm_num_pdes(rdev) + 1) * sizeof(struct radeon_cs_reloc);
-        list = kmalloc(size, GFP_KERNEL);
+        list = kmalloc_array(vm->max_pde_used + 1,
+                             sizeof(struct radeon_cs_reloc), GFP_KERNEL);
         if (!list)
                 return NULL;
 
diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig
index bc196f49ec53..4af0da96c2e2 100644
--- a/drivers/hwmon/Kconfig
+++ b/drivers/hwmon/Kconfig
@@ -1053,7 +1053,7 @@ config SENSORS_PC87427
 
 config SENSORS_NTC_THERMISTOR
         tristate "NTC thermistor support"
-        depends on (!OF && !IIO) || (OF && IIO)
+        depends on !OF || IIO=n || IIO
         help
           This driver supports NTC thermistors sensor reading and its
           interpretation. The driver can also monitor the temperature and
diff --git a/drivers/hwmon/ntc_thermistor.c b/drivers/hwmon/ntc_thermistor.c
index 8a17f01e8672..e76feb86a1d4 100644
--- a/drivers/hwmon/ntc_thermistor.c
+++ b/drivers/hwmon/ntc_thermistor.c
@@ -44,6 +44,7 @@ struct ntc_compensation {
         unsigned int    ohm;
 };
 
+/* Order matters, ntc_match references the entries by index */
 static const struct platform_device_id ntc_thermistor_id[] = {
         { "ncp15wb473", TYPE_NCPXXWB473 },
         { "ncp18wb473", TYPE_NCPXXWB473 },
@@ -141,7 +142,7 @@ struct ntc_data {
         char name[PLATFORM_NAME_SIZE];
 };
 
-#ifdef CONFIG_OF
+#if defined(CONFIG_OF) && IS_ENABLED(CONFIG_IIO)
 static int ntc_adc_iio_read(struct ntc_thermistor_platform_data *pdata)
 {
         struct iio_channel *channel = pdata->chan;
@@ -163,15 +164,15 @@ static int ntc_adc_iio_read(struct ntc_thermistor_platform_data *pdata)
 
 static const struct of_device_id ntc_match[] = {
         { .compatible = "ntc,ncp15wb473",
-                .data = &ntc_thermistor_id[TYPE_NCPXXWB473] },
+                .data = &ntc_thermistor_id[0] },
         { .compatible = "ntc,ncp18wb473",
-                .data = &ntc_thermistor_id[TYPE_NCPXXWB473] },
+                .data = &ntc_thermistor_id[1] },
         { .compatible = "ntc,ncp21wb473",
-                .data = &ntc_thermistor_id[TYPE_NCPXXWB473] },
+                .data = &ntc_thermistor_id[2] },
         { .compatible = "ntc,ncp03wb473",
-                .data = &ntc_thermistor_id[TYPE_NCPXXWB473] },
+                .data = &ntc_thermistor_id[3] },
         { .compatible = "ntc,ncp15wl333",
-                .data = &ntc_thermistor_id[TYPE_NCPXXWL333] },
+                .data = &ntc_thermistor_id[4] },
         { },
 };
 MODULE_DEVICE_TABLE(of, ntc_match);
@@ -223,6 +224,8 @@ ntc_thermistor_parse_dt(struct platform_device *pdev)
         return NULL;
 }
 
+#define ntc_match       NULL
+
 static void ntc_iio_channel_release(struct ntc_thermistor_platform_data *pdata)
 { }
 #endif
diff --git a/drivers/input/keyboard/Kconfig b/drivers/input/keyboard/Kconfig
index 76842d7dc2e3..ffc7ad3a2c88 100644
--- a/drivers/input/keyboard/Kconfig
+++ b/drivers/input/keyboard/Kconfig
@@ -71,7 +71,7 @@ config KEYBOARD_ATKBD
         default y
         select SERIO
         select SERIO_LIBPS2
-        select SERIO_I8042 if X86
+        select SERIO_I8042 if ARCH_MIGHT_HAVE_PC_SERIO
         select SERIO_GSCPS2 if GSC
         help
           Say Y here if you want to use a standard AT or PS/2 keyboard. Usually
diff --git a/drivers/input/keyboard/pxa27x_keypad.c b/drivers/input/keyboard/pxa27x_keypad.c
index d8241ba0afa0..a15063bea700 100644
--- a/drivers/input/keyboard/pxa27x_keypad.c
+++ b/drivers/input/keyboard/pxa27x_keypad.c
@@ -111,6 +111,8 @@ struct pxa27x_keypad {
         unsigned short keycodes[MAX_KEYPAD_KEYS];
         int rotary_rel_code[2];
 
+        unsigned int row_shift;
+
         /* state row bits of each column scan */
         uint32_t matrix_key_state[MAX_MATRIX_KEY_COLS];
         uint32_t direct_key_state;
@@ -467,7 +469,8 @@ scan:
                         if ((bits_changed & (1 << row)) == 0)
                                 continue;
 
-                        code = MATRIX_SCAN_CODE(row, col, MATRIX_ROW_SHIFT);
+                        code = MATRIX_SCAN_CODE(row, col, keypad->row_shift);
+
                         input_event(input_dev, EV_MSC, MSC_SCAN, code);
                         input_report_key(input_dev, keypad->keycodes[code],
                                          new_state[col] & (1 << row));
@@ -802,6 +805,8 @@ static int pxa27x_keypad_probe(struct platform_device *pdev)
                 goto failed_put_clk;
         }
 
+        keypad->row_shift = get_count_order(pdata->matrix_key_cols);
+
         if ((pdata->enable_rotary0 && keypad->rotary_rel_code[0] != -1) ||
             (pdata->enable_rotary1 && keypad->rotary_rel_code[1] != -1)) {
                 input_dev->evbit[0] |= BIT_MASK(EV_REL);
diff --git a/drivers/input/mouse/Kconfig b/drivers/input/mouse/Kconfig
index effa9c5f2c5c..6b8441f7bc32 100644
--- a/drivers/input/mouse/Kconfig
+++ b/drivers/input/mouse/Kconfig
@@ -17,7 +17,7 @@ config MOUSE_PS2
         default y
         select SERIO
         select SERIO_LIBPS2
-        select SERIO_I8042 if X86
+        select SERIO_I8042 if ARCH_MIGHT_HAVE_PC_SERIO
         select SERIO_GSCPS2 if GSC
         help
           Say Y here if you have a PS/2 mouse connected to your system. This
diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
index d68d33fb5ac2..c5ec703c727e 100644
--- a/drivers/input/mouse/synaptics.c
+++ b/drivers/input/mouse/synaptics.c
@@ -117,6 +117,31 @@ void synaptics_reset(struct psmouse *psmouse)
 }
 
 #ifdef CONFIG_MOUSE_PS2_SYNAPTICS
+struct min_max_quirk {
+        const char * const *pnp_ids;
+        int x_min, x_max, y_min, y_max;
+};
+
+static const struct min_max_quirk min_max_pnpid_table[] = {
+        {
+                (const char * const []){"LEN0033", NULL},
+                1024, 5052, 2258, 4832
+        },
+        {
+                (const char * const []){"LEN0035", "LEN0042", NULL},
+                1232, 5710, 1156, 4696
+        },
+        {
+                (const char * const []){"LEN0034", "LEN0036", "LEN2004", NULL},
+                1024, 5112, 2024, 4832
+        },
+        {
+                (const char * const []){"LEN2001", NULL},
+                1024, 5022, 2508, 4832
+        },
+        { }
+};
+
 /* This list has been kindly provided by Synaptics. */
 static const char * const topbuttonpad_pnp_ids[] = {
         "LEN0017",
@@ -129,7 +154,7 @@ static const char * const topbuttonpad_pnp_ids[] = {
         "LEN002D",
         "LEN002E",
         "LEN0033", /* Helix */
-        "LEN0034", /* T431s, T540, X1 Carbon 2nd */
+        "LEN0034", /* T431s, L440, L540, T540, W540, X1 Carbon 2nd */
         "LEN0035", /* X240 */
         "LEN0036", /* T440 */
         "LEN0037",
@@ -142,7 +167,7 @@ static const char * const topbuttonpad_pnp_ids[] = {
         "LEN0048",
         "LEN0049",
         "LEN2000",
-        "LEN2001",
+        "LEN2001", /* Edge E431 */
         "LEN2002",
         "LEN2003",
         "LEN2004", /* L440 */
@@ -156,6 +181,18 @@ static const char * const topbuttonpad_pnp_ids[] = {
         NULL
 };
 
+static bool matches_pnp_id(struct psmouse *psmouse, const char * const ids[])
+{
+        int i;
+
+        if (!strncmp(psmouse->ps2dev.serio->firmware_id, "PNP:", 4))
+                for (i = 0; ids[i]; i++)
+                        if (strstr(psmouse->ps2dev.serio->firmware_id, ids[i]))
+                                return true;
+
+        return false;
+}
+
 /*****************************************************************************
  *      Synaptics communications functions
  ****************************************************************************/
@@ -304,20 +341,20 @@ static int synaptics_identify(struct psmouse *psmouse)
  * Resolution is left zero if touchpad does not support the query
  */
 
-static const int *quirk_min_max;
-
 static int synaptics_resolution(struct psmouse *psmouse)
 {
         struct synaptics_data *priv = psmouse->private;
         unsigned char resp[3];
+        int i;
 
-        if (quirk_min_max) {
-                priv->x_min = quirk_min_max[0];
-                priv->x_max = quirk_min_max[1];
-                priv->y_min = quirk_min_max[2];
-                priv->y_max = quirk_min_max[3];
-                return 0;
-        }
+        for (i = 0; min_max_pnpid_table[i].pnp_ids; i++)
+                if (matches_pnp_id(psmouse, min_max_pnpid_table[i].pnp_ids)) {
+                        priv->x_min = min_max_pnpid_table[i].x_min;
+                        priv->x_max = min_max_pnpid_table[i].x_max;
+                        priv->y_min = min_max_pnpid_table[i].y_min;
+                        priv->y_max = min_max_pnpid_table[i].y_max;
+                        return 0;
+                }
 
         if (SYN_ID_MAJOR(priv->identity) < 4)
                 return 0;
@@ -1365,17 +1402,8 @@ static void set_input_params(struct psmouse *psmouse,
 
         if (SYN_CAP_CLICKPAD(priv->ext_cap_0c)) {
                 __set_bit(INPUT_PROP_BUTTONPAD, dev->propbit);
-                /* See if this buttonpad has a top button area */
-                if (!strncmp(psmouse->ps2dev.serio->firmware_id, "PNP:", 4)) {
-                        for (i = 0; topbuttonpad_pnp_ids[i]; i++) {
-                                if (strstr(psmouse->ps2dev.serio->firmware_id,
-                                           topbuttonpad_pnp_ids[i])) {
-                                        __set_bit(INPUT_PROP_TOPBUTTONPAD,
-                                                  dev->propbit);
-                                        break;
-                                }
-                        }
-                }
+                if (matches_pnp_id(psmouse, topbuttonpad_pnp_ids))
+                        __set_bit(INPUT_PROP_TOPBUTTONPAD, dev->propbit);
                 /* Clickpads report only left button */
                 __clear_bit(BTN_RIGHT, dev->keybit);
                 __clear_bit(BTN_MIDDLE, dev->keybit);
@@ -1547,104 +1575,10 @@ static const struct dmi_system_id olpc_dmi_table[] __initconst = {
         { }
 };
 
-static const struct dmi_system_id min_max_dmi_table[] __initconst = {
-#if defined(CONFIG_DMI)
-        {
-                /* Lenovo ThinkPad Helix */
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-                        DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad Helix"),
-                },
-                .driver_data = (int []){1024, 5052, 2258, 4832},
-        },
-        {
-                /* Lenovo ThinkPad X240 */
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-                        DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad X240"),
-                },
-                .driver_data = (int []){1232, 5710, 1156, 4696},
-        },
-        {
-                /* Lenovo ThinkPad Edge E431 */
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-                        DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad Edge E431"),
-                },
-                .driver_data = (int []){1024, 5022, 2508, 4832},
-        },
-        {
-                /* Lenovo ThinkPad T431s */
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-                        DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T431"),
-                },
-                .driver_data = (int []){1024, 5112, 2024, 4832},
-        },
-        {
-                /* Lenovo ThinkPad T440s */
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-                        DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T440"),
-                },
-                .driver_data = (int []){1024, 5112, 2024, 4832},
-        },
-        {
-                /* Lenovo ThinkPad L440 */
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-                        DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad L440"),
-                },
-                .driver_data = (int []){1024, 5112, 2024, 4832},
-        },
-        {
-                /* Lenovo ThinkPad T540p */
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-                        DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T540"),
-                },
-                .driver_data = (int []){1024, 5056, 2058, 4832},
-        },
-        {
-                /* Lenovo ThinkPad L540 */
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-                        DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad L540"),
-                },
-                .driver_data = (int []){1024, 5112, 2024, 4832},
-        },
-        {
-                /* Lenovo Yoga S1 */
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-                        DMI_EXACT_MATCH(DMI_PRODUCT_VERSION,
-                                        "ThinkPad S1 Yoga"),
-                },
-                .driver_data = (int []){1232, 5710, 1156, 4696},
-        },
-        {
-                /* Lenovo ThinkPad X1 Carbon Haswell (3rd generation) */
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-                        DMI_MATCH(DMI_PRODUCT_VERSION,
-                                        "ThinkPad X1 Carbon 2nd"),
-                },
-                .driver_data = (int []){1024, 5112, 2024, 4832},
-        },
-#endif
-        { }
-};
-
 void __init synaptics_module_init(void)
 {
-        const struct dmi_system_id *min_max_dmi;
-
         impaired_toshiba_kbc = dmi_check_system(toshiba_dmi_table);
         broken_olpc_ec = dmi_check_system(olpc_dmi_table);
-
-        min_max_dmi = dmi_first_match(min_max_dmi_table);
-        if (min_max_dmi)
-                quirk_min_max = min_max_dmi->driver_data;
 }
 
 static int __synaptics_init(struct psmouse *psmouse, bool absolute_mode)
diff --git a/drivers/input/serio/ambakmi.c b/drivers/input/serio/ambakmi.c
index 762b08432de0..8b748d99b934 100644
--- a/drivers/input/serio/ambakmi.c
+++ b/drivers/input/serio/ambakmi.c
@@ -79,7 +79,8 @@ static int amba_kmi_open(struct serio *io)
         writeb(divisor, KMICLKDIV);
         writeb(KMICR_EN, KMICR);
 
-        ret = request_irq(kmi->irq, amba_kmi_int, 0, "kmi-pl050", kmi);
+        ret = request_irq(kmi->irq, amba_kmi_int, IRQF_SHARED, "kmi-pl050",
+                          kmi);
         if (ret) {
                 printk(KERN_ERR "kmi: failed to claim IRQ%d\n", kmi->irq);
                 writeb(0, KMICR);
diff --git a/drivers/input/touchscreen/Kconfig b/drivers/input/touchscreen/Kconfig
index 68edc9db2c64..b845e9370871 100644
--- a/drivers/input/touchscreen/Kconfig
+++ b/drivers/input/touchscreen/Kconfig
@@ -640,7 +640,7 @@ config TOUCHSCREEN_WM9713
 
 config TOUCHSCREEN_WM97XX_ATMEL
         tristate "WM97xx Atmel accelerated touch"
-        depends on TOUCHSCREEN_WM97XX && (AVR32 || ARCH_AT91)
+        depends on TOUCHSCREEN_WM97XX && AVR32
         help
           Say Y here for support for streaming mode with WM97xx touchscreens
           on Atmel AT91 or AVR32 systems with an AC97C module.
diff --git a/drivers/md/dm-cache-target.c b/drivers/md/dm-cache-target.c
index 9380be7b1895..5f054c44b485 100644
--- a/drivers/md/dm-cache-target.c
+++ b/drivers/md/dm-cache-target.c
@@ -2178,6 +2178,8 @@ static int cache_create(struct cache_args *ca, struct cache **result)
         ti->num_discard_bios = 1;
         ti->discards_supported = true;
         ti->discard_zeroes_data_unsupported = true;
+        /* Discard bios must be split on a block boundary */
+        ti->split_discard_bios = true;
 
         cache->features = ca->features;
         ti->per_bio_data_size = get_per_bio_data_size(cache);
diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
index fa0f6cbd6a41..ebfa411d1a7d 100644
--- a/drivers/md/dm-mpath.c
+++ b/drivers/md/dm-mpath.c
@@ -445,11 +445,11 @@ static int queue_if_no_path(struct multipath *m, unsigned queue_if_no_path,
         else
                 m->saved_queue_if_no_path = queue_if_no_path;
         m->queue_if_no_path = queue_if_no_path;
-        if (!m->queue_if_no_path)
-                dm_table_run_md_queue_async(m->ti->table);
-
         spin_unlock_irqrestore(&m->lock, flags);
 
+        if (!queue_if_no_path)
+                dm_table_run_md_queue_async(m->ti->table);
+
         return 0;
 }
 
@@ -954,7 +954,7 @@ out:
  */
 static int reinstate_path(struct pgpath *pgpath)
 {
-        int r = 0;
+        int r = 0, run_queue = 0;
         unsigned long flags;
         struct multipath *m = pgpath->pg->m;
 
@@ -978,7 +978,7 @@ static int reinstate_path(struct pgpath *pgpath)
 
         if (!m->nr_valid_paths++) {
                 m->current_pgpath = NULL;
-                dm_table_run_md_queue_async(m->ti->table);
+                run_queue = 1;
         } else if (m->hw_handler_name && (m->current_pg == pgpath->pg)) {
                 if (queue_work(kmpath_handlerd, &pgpath->activate_path.work))
                         m->pg_init_in_progress++;
@@ -991,6 +991,8 @@ static int reinstate_path(struct pgpath *pgpath)
 
 out:
         spin_unlock_irqrestore(&m->lock, flags);
+        if (run_queue)
+                dm_table_run_md_queue_async(m->ti->table);
 
         return r;
 }
@@ -1566,8 +1568,8 @@ static int multipath_ioctl(struct dm_target *ti, unsigned int cmd,
                 }
                 if (m->pg_init_required)
                         __pg_init_all_paths(m);
-                dm_table_run_md_queue_async(m->ti->table);
                 spin_unlock_irqrestore(&m->lock, flags);
+                dm_table_run_md_queue_async(m->ti->table);
         }
 
         return r ? : __blkdev_driver_ioctl(bdev, mode, cmd, arg);
diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
index 2e71de8e0048..242ac2ea5f29 100644
--- a/drivers/md/dm-thin.c
+++ b/drivers/md/dm-thin.c
@@ -27,7 +27,9 @@
 #define MAPPING_POOL_SIZE 1024
 #define PRISON_CELLS 1024
 #define COMMIT_PERIOD HZ
-#define NO_SPACE_TIMEOUT (HZ * 60)
+#define NO_SPACE_TIMEOUT_SECS 60
+
+static unsigned no_space_timeout_secs = NO_SPACE_TIMEOUT_SECS;
 
 DECLARE_DM_KCOPYD_THROTTLE_WITH_MODULE_PARM(snapshot_copy_throttle,
                 "A percentage of time allocated for copy on write");
@@ -1670,6 +1672,7 @@ static void set_pool_mode(struct pool *pool, enum pool_mode new_mode)
         struct pool_c *pt = pool->ti->private;
         bool needs_check = dm_pool_metadata_needs_check(pool->pmd);
         enum pool_mode old_mode = get_pool_mode(pool);
+        unsigned long no_space_timeout = ACCESS_ONCE(no_space_timeout_secs) * HZ;
 
         /*
          * Never allow the pool to transition to PM_WRITE mode if user
@@ -1732,8 +1735,8 @@ static void set_pool_mode(struct pool *pool, enum pool_mode new_mode)
                 pool->process_prepared_mapping = process_prepared_mapping;
                 pool->process_prepared_discard = process_prepared_discard_passdown;
 
-                if (!pool->pf.error_if_no_space)
-                        queue_delayed_work(pool->wq, &pool->no_space_timeout, NO_SPACE_TIMEOUT);
+                if (!pool->pf.error_if_no_space && no_space_timeout)
+                        queue_delayed_work(pool->wq, &pool->no_space_timeout, no_space_timeout);
                 break;
 
         case PM_WRITE:
@@ -3508,6 +3511,9 @@ static void dm_thin_exit(void)
 module_init(dm_thin_init);
 module_exit(dm_thin_exit);
 
+module_param_named(no_space_timeout, no_space_timeout_secs, uint, S_IRUGO | S_IWUSR);
+MODULE_PARM_DESC(no_space_timeout, "Out of data space queue IO timeout in seconds");
+
 MODULE_DESCRIPTION(DM_NAME " thin provisioning target");
 MODULE_AUTHOR("Joe Thornber <dm-devel@redhat.com>");
 MODULE_LICENSE("GPL");
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 237b7e0ddc7a..2382cfc9bb3f 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -7381,8 +7381,10 @@ void md_do_sync(struct md_thread *thread)
         /* just incase thread restarts... */
         if (test_bit(MD_RECOVERY_DONE, &mddev->recovery))
                 return;
-        if (mddev->ro) /* never try to sync a read-only array */
+        if (mddev->ro) {/* never try to sync a read-only array */
+                set_bit(MD_RECOVERY_INTR, &mddev->recovery);
                 return;
+        }
 
         if (test_bit(MD_RECOVERY_SYNC, &mddev->recovery)) {
                 if (test_bit(MD_RECOVERY_CHECK, &mddev->recovery)) {
@@ -7824,6 +7826,7 @@ void md_check_recovery(struct mddev *mddev)
                         /* There is no thread, but we need to call
                          * ->spare_active and clear saved_raid_disk
                          */
+                        set_bit(MD_RECOVERY_INTR, &mddev->recovery);
                         md_reap_sync_thread(mddev);
                         clear_bit(MD_RECOVERY_NEEDED, &mddev->recovery);
                         goto unlock;
diff --git a/drivers/net/can/led.c b/drivers/net/can/led.c
index a3d99a8fd2d1..ab7f1b01be49 100644
--- a/drivers/net/can/led.c
+++ b/drivers/net/can/led.c
@@ -97,6 +97,9 @@ static int can_led_notifier(struct notifier_block *nb, unsigned long msg,
         if (!priv)
                 return NOTIFY_DONE;
 
+        if (!priv->tx_led_trig || !priv->rx_led_trig)
+                return NOTIFY_DONE;
+
         if (msg == NETDEV_CHANGENAME) {
                 snprintf(name, sizeof(name), "%s-tx", netdev->name);
                 led_trigger_rename_static(name, priv->tx_led_trig);
diff --git a/drivers/net/ethernet/Kconfig b/drivers/net/ethernet/Kconfig
index f0e2a4d4f621..edb718661850 100644
--- a/drivers/net/ethernet/Kconfig
+++ b/drivers/net/ethernet/Kconfig
@@ -39,6 +39,7 @@ source "drivers/net/ethernet/cisco/Kconfig"
 config CX_ECAT
         tristate "Beckhoff CX5020 EtherCAT master support"
         depends on PCI
+        depends on X86 || COMPILE_TEST
         ---help---
           Driver for EtherCAT master module located on CCAT FPGA
           that can be found on Beckhoff CX5020, and possibly other of CX
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
index d18441ebe944..23da47925fa3 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
@@ -906,6 +906,18 @@ static int bnx2x_rx_int(struct bnx2x_fastpath *fp, int budget)
                 bd_prod = RX_BD(bd_prod);
                 bd_cons = RX_BD(bd_cons);
 
+                /* A rmb() is required to ensure that the CQE is not read
+                 * before it is written by the adapter DMA.  PCI ordering
+                 * rules will make sure the other fields are written before
+                 * the marker at the end of struct eth_fast_path_rx_cqe
+                 * but without rmb() a weakly ordered processor can process
+                 * stale data.  Without the barrier TPA state-machine might
+                 * enter inconsistent state and kernel stack might be
+                 * provided with incorrect packet description - these lead
+                 * to various kernel crashed.
+                 */
+                rmb();
+
                 cqe_fp_flags = cqe_fp->type_error_flags;
                 cqe_fp_type = cqe_fp_flags & ETH_FAST_PATH_RX_CQE_TYPE;
 
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index ff2bdd80f0aa..cf14218697e4 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -13283,8 +13283,8 @@ static int bnx2x_eeh_nic_unload(struct bnx2x *bp)
         netdev_reset_tc(bp->dev);
 
         del_timer_sync(&bp->timer);
-        cancel_delayed_work(&bp->sp_task);
-        cancel_delayed_work(&bp->period_task);
+        cancel_delayed_work_sync(&bp->sp_task);
+        cancel_delayed_work_sync(&bp->period_task);
 
         spin_lock_bh(&bp->stats_lock);
         bp->stats_state = STATS_STATE_DISABLED;
diff --git a/drivers/net/ethernet/broadcom/cnic.c b/drivers/net/ethernet/broadcom/cnic.c
index 09f3fefcbf9c..a4b25bc7113a 100644
--- a/drivers/net/ethernet/broadcom/cnic.c
+++ b/drivers/net/ethernet/broadcom/cnic.c
@@ -608,6 +608,10 @@ static int cnic_unregister_device(struct cnic_dev *dev, int ulp_type)
                 pr_err("%s: Bad type %d\n", __func__, ulp_type);
                 return -EINVAL;
         }
+
+        if (ulp_type == CNIC_ULP_ISCSI)
+                cnic_send_nlmsg(cp, ISCSI_KEVENT_IF_DOWN, NULL);
+
         mutex_lock(&cnic_lock);
         if (rcu_dereference(cp->ulp_ops[ulp_type])) {
                 RCU_INIT_POINTER(cp->ulp_ops[ulp_type], NULL);
@@ -620,9 +624,7 @@ static int cnic_unregister_device(struct cnic_dev *dev, int ulp_type)
         }
         mutex_unlock(&cnic_lock);
 
-        if (ulp_type == CNIC_ULP_ISCSI)
-                cnic_send_nlmsg(cp, ISCSI_KEVENT_IF_DOWN, NULL);
-        else if (ulp_type == CNIC_ULP_FCOE)
+        if (ulp_type == CNIC_ULP_FCOE)
                 dev->fcoe_cap = NULL;
 
         synchronize_rcu();
@@ -1039,21 +1041,17 @@ static int cnic_alloc_uio_rings(struct cnic_dev *dev, int pages)
         struct cnic_local *cp = dev->cnic_priv;
         struct cnic_uio_dev *udev;
 
-        read_lock(&cnic_dev_lock);
         list_for_each_entry(udev, &cnic_udev_list, list) {
                 if (udev->pdev == dev->pcidev) {
                         udev->dev = dev;
                         if (__cnic_alloc_uio_rings(udev, pages)) {
                                 udev->dev = NULL;
-                                read_unlock(&cnic_dev_lock);
                                 return -ENOMEM;
                         }
                         cp->udev = udev;
-                        read_unlock(&cnic_dev_lock);
                         return 0;
                 }
         }
-        read_unlock(&cnic_dev_lock);
 
         udev = kzalloc(sizeof(struct cnic_uio_dev), GFP_ATOMIC);
         if (!udev)
@@ -1067,9 +1065,7 @@ static int cnic_alloc_uio_rings(struct cnic_dev *dev, int pages)
         if (__cnic_alloc_uio_rings(udev, pages))
                 goto err_udev;
 
-        write_lock(&cnic_dev_lock);
         list_add(&udev->list, &cnic_udev_list);
-        write_unlock(&cnic_dev_lock);
 
         pci_dev_get(udev->pdev);
 
@@ -5624,20 +5620,27 @@ static void cnic_rcv_netevent(struct cnic_local *cp, unsigned long event,
 {
         int if_type;
 
-        rcu_read_lock();
         for (if_type = 0; if_type < MAX_CNIC_ULP_TYPE; if_type++) {
                 struct cnic_ulp_ops *ulp_ops;
                 void *ctx;
 
-                ulp_ops = rcu_dereference(cp->ulp_ops[if_type]);
-                if (!ulp_ops || !ulp_ops->indicate_netevent)
+                mutex_lock(&cnic_lock);
+                ulp_ops = rcu_dereference_protected(cp->ulp_ops[if_type],
+                                                lockdep_is_held(&cnic_lock));
+                if (!ulp_ops || !ulp_ops->indicate_netevent) {
+                        mutex_unlock(&cnic_lock);
                         continue;
+                }
 
                 ctx = cp->ulp_handle[if_type];
 
+                set_bit(ULP_F_CALL_PENDING, &cp->ulp_flags[if_type]);
+                mutex_unlock(&cnic_lock);
+
                 ulp_ops->indicate_netevent(ctx, event, vlan_id);
+
+                clear_bit(ULP_F_CALL_PENDING, &cp->ulp_flags[if_type]);
         }
-        rcu_read_unlock();
 }
 
 /* netdev event handler */
diff --git a/drivers/net/ethernet/ibm/emac/mal.c b/drivers/net/ethernet/ibm/emac/mal.c
index 9d75fef6396f..63eb959a28aa 100644
--- a/drivers/net/ethernet/ibm/emac/mal.c
+++ b/drivers/net/ethernet/ibm/emac/mal.c
@@ -682,10 +682,7 @@ static int mal_probe(struct platform_device *ofdev)
                 goto fail6;
 
         /* Enable all MAL SERR interrupt sources */
-        if (mal->version == 2)
-                set_mal_dcrn(mal, MAL_IER, MAL2_IER_EVENTS);
-        else
-                set_mal_dcrn(mal, MAL_IER, MAL1_IER_EVENTS);
+        set_mal_dcrn(mal, MAL_IER, MAL_IER_EVENTS);
 
         /* Enable EOB interrupt */
         mal_enable_eob_irq(mal);
diff --git a/drivers/net/ethernet/ibm/emac/mal.h b/drivers/net/ethernet/ibm/emac/mal.h
index e431a32e3d69..eeade2ea8334 100644
--- a/drivers/net/ethernet/ibm/emac/mal.h
+++ b/drivers/net/ethernet/ibm/emac/mal.h
@@ -95,24 +95,20 @@
 
 
 #define MAL_IER                 0x02
+/* MAL IER bits */
 #define   MAL_IER_DE            0x00000010
 #define   MAL_IER_OTE           0x00000004
 #define   MAL_IER_OE            0x00000002
 #define   MAL_IER_PE            0x00000001
-/* MAL V1 IER bits */
-#define   MAL1_IER_NWE          0x00000008
-#define   MAL1_IER_SOC_EVENTS   MAL1_IER_NWE
-#define   MAL1_IER_EVENTS       (MAL1_IER_SOC_EVENTS | MAL_IER_DE | \
-                                 MAL_IER_OTE | MAL_IER_OE | MAL_IER_PE)
 
-/* MAL V2 IER bits */
-#define   MAL2_IER_PT           0x00000080
-#define   MAL2_IER_PRE          0x00000040
-#define   MAL2_IER_PWE          0x00000020
-#define   MAL2_IER_SOC_EVENTS   (MAL2_IER_PT | MAL2_IER_PRE | MAL2_IER_PWE)
-#define   MAL2_IER_EVENTS       (MAL2_IER_SOC_EVENTS | MAL_IER_DE | \
-                                 MAL_IER_OTE | MAL_IER_OE | MAL_IER_PE)
+/* PLB read/write/timeout errors */
+#define   MAL_IER_PTE           0x00000080
+#define   MAL_IER_PRE           0x00000040
+#define   MAL_IER_PWE           0x00000020
 
+#define   MAL_IER_SOC_EVENTS    (MAL_IER_PTE | MAL_IER_PRE | MAL_IER_PWE)
+#define   MAL_IER_EVENTS        (MAL_IER_SOC_EVENTS | MAL_IER_DE | \
+                                 MAL_IER_OTE | MAL_IER_OE | MAL_IER_PE)
 
 #define MAL_TXCASR              0x04
 #define MAL_TXCARR              0x05
diff --git a/drivers/net/ethernet/ibm/emac/rgmii.c b/drivers/net/ethernet/ibm/emac/rgmii.c
index 4fb2f96da23b..a01182cce965 100644
--- a/drivers/net/ethernet/ibm/emac/rgmii.c
+++ b/drivers/net/ethernet/ibm/emac/rgmii.c
@@ -45,6 +45,7 @@
 
 /* RGMIIx_SSR */
 #define RGMII_SSR_MASK(idx)     (0x7 << ((idx) * 8))
+#define RGMII_SSR_10(idx)       (0x1 << ((idx) * 8))
 #define RGMII_SSR_100(idx)      (0x2 << ((idx) * 8))
 #define RGMII_SSR_1000(idx)     (0x4 << ((idx) * 8))
 
@@ -139,6 +140,8 @@ void rgmii_set_speed(struct platform_device *ofdev, int input, int speed)
                 ssr |= RGMII_SSR_1000(input);
         else if (speed == SPEED_100)
                 ssr |= RGMII_SSR_100(input);
+        else if (speed == SPEED_10)
+                ssr |= RGMII_SSR_10(input);
 
         out_be32(&p->ssr, ssr);
 
diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
index 38e9a4c9099c..19606a44672b 100644
--- a/drivers/net/ethernet/mellanox/mlx4/main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/main.c
@@ -2012,6 +2012,7 @@ static int mlx4_init_port_info(struct mlx4_dev *dev, int port)
         if (!mlx4_is_slave(dev)) {
                 mlx4_init_mac_table(dev, &info->mac_table);
                 mlx4_init_vlan_table(dev, &info->vlan_table);
+                mlx4_init_roce_gid_table(dev, &info->gid_table);
                 info->base_qpn = mlx4_get_base_qpn(dev, port);
         }
 
diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4.h b/drivers/net/ethernet/mellanox/mlx4/mlx4.h
index 9dd1b30ea757..4b416edb4c1e 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mlx4.h
+++ b/drivers/net/ethernet/mellanox/mlx4/mlx4.h
@@ -696,6 +696,17 @@ struct mlx4_mac_table {
         int                     max;
 };
 
+#define MLX4_ROCE_GID_ENTRY_SIZE        16
+
+struct mlx4_roce_gid_entry {
+        u8 raw[MLX4_ROCE_GID_ENTRY_SIZE];
+};
+
+struct mlx4_roce_gid_table {
+        struct mlx4_roce_gid_entry      roce_gids[MLX4_ROCE_MAX_GIDS];
+        struct mutex                    mutex;
+};
+
 #define MLX4_MAX_VLAN_NUM       128
 #define MLX4_VLAN_TABLE_SIZE    (MLX4_MAX_VLAN_NUM << 2)
 
@@ -759,6 +770,7 @@ struct mlx4_port_info {
         struct device_attribute port_mtu_attr;
         struct mlx4_mac_table   mac_table;
         struct mlx4_vlan_table  vlan_table;
+        struct mlx4_roce_gid_table gid_table;
         int                     base_qpn;
 };
 
@@ -789,10 +801,6 @@ enum {
         MLX4_USE_RR     = 1,
 };
 
-struct mlx4_roce_gid_entry {
-        u8 raw[16];
-};
-
 struct mlx4_priv {
         struct mlx4_dev         dev;
 
@@ -840,7 +848,6 @@ struct mlx4_priv {
         int                     fs_hash_mode;
         u8 virt2phys_pkey[MLX4_MFUNC_MAX][MLX4_MAX_PORTS][MLX4_MAX_PORT_PKEYS];
         __be64                  slave_node_guids[MLX4_MFUNC_MAX];
-        struct mlx4_roce_gid_entry roce_gids[MLX4_MAX_PORTS][MLX4_ROCE_MAX_GIDS];
 
         atomic_t                opreq_count;
         struct work_struct      opreq_task;
@@ -1141,6 +1148,8 @@ int mlx4_change_port_types(struct mlx4_dev *dev,
 
 void mlx4_init_mac_table(struct mlx4_dev *dev, struct mlx4_mac_table *table);
 void mlx4_init_vlan_table(struct mlx4_dev *dev, struct mlx4_vlan_table *table);
+void mlx4_init_roce_gid_table(struct mlx4_dev *dev,
+                              struct mlx4_roce_gid_table *table);
 void __mlx4_unregister_vlan(struct mlx4_dev *dev, u8 port, u16 vlan);
 int __mlx4_register_vlan(struct mlx4_dev *dev, u8 port, u16 vlan, int *index);
 
@@ -1150,6 +1159,7 @@ int mlx4_get_slave_from_resource_id(struct mlx4_dev *dev,
                                     enum mlx4_resource resource_type,
                                     u64 resource_id, int *slave);
 void mlx4_delete_all_resources_for_slave(struct mlx4_dev *dev, int slave_id);
+void mlx4_reset_roce_gids(struct mlx4_dev *dev, int slave);
 int mlx4_init_resource_tracker(struct mlx4_dev *dev);
 
 void mlx4_free_resource_tracker(struct mlx4_dev *dev,
diff --git a/drivers/net/ethernet/mellanox/mlx4/port.c b/drivers/net/ethernet/mellanox/mlx4/port.c
index 376f2f1d445e..7ab97174886d 100644
--- a/drivers/net/ethernet/mellanox/mlx4/port.c
+++ b/drivers/net/ethernet/mellanox/mlx4/port.c
@@ -75,6 +75,16 @@ void mlx4_init_vlan_table(struct mlx4_dev *dev, struct mlx4_vlan_table *table)
         table->total = 0;
 }
 
+void mlx4_init_roce_gid_table(struct mlx4_dev *dev,
+                              struct mlx4_roce_gid_table *table)
+{
+        int i;
+
+        mutex_init(&table->mutex);
+        for (i = 0; i < MLX4_ROCE_MAX_GIDS; i++)
+                memset(table->roce_gids[i].raw, 0, MLX4_ROCE_GID_ENTRY_SIZE);
+}
+
 static int validate_index(struct mlx4_dev *dev,
                           struct mlx4_mac_table *table, int index)
 {
@@ -583,6 +593,84 @@ int mlx4_get_base_gid_ix(struct mlx4_dev *dev, int slave, int port)
 }
 EXPORT_SYMBOL_GPL(mlx4_get_base_gid_ix);
 
+static int mlx4_reset_roce_port_gids(struct mlx4_dev *dev, int slave,
+                                     int port, struct mlx4_cmd_mailbox *mailbox)
+{
+        struct mlx4_roce_gid_entry *gid_entry_mbox;
+        struct mlx4_priv *priv = mlx4_priv(dev);
+        int num_gids, base, offset;
+        int i, err;
+
+        num_gids = mlx4_get_slave_num_gids(dev, slave, port);
+        base = mlx4_get_base_gid_ix(dev, slave, port);
+
+        memset(mailbox->buf, 0, MLX4_MAILBOX_SIZE);
+
+        mutex_lock(&(priv->port[port].gid_table.mutex));
+        /* Zero-out gids belonging to that slave in the port GID table */
+        for (i = 0, offset = base; i < num_gids; offset++, i++)
+                memcpy(priv->port[port].gid_table.roce_gids[offset].raw,
+                       zgid_entry.raw, MLX4_ROCE_GID_ENTRY_SIZE);
+
+        /* Now, copy roce port gids table to mailbox for passing to FW */
+        gid_entry_mbox = (struct mlx4_roce_gid_entry *)mailbox->buf;
+        for (i = 0; i < MLX4_ROCE_MAX_GIDS; gid_entry_mbox++, i++)
+                memcpy(gid_entry_mbox->raw,
+                       priv->port[port].gid_table.roce_gids[i].raw,
+                       MLX4_ROCE_GID_ENTRY_SIZE);
+
+        err = mlx4_cmd(dev, mailbox->dma,
+                       ((u32)port) | (MLX4_SET_PORT_GID_TABLE << 8), 1,
+                       MLX4_CMD_SET_PORT, MLX4_CMD_TIME_CLASS_B,
+                       MLX4_CMD_NATIVE);
+        mutex_unlock(&(priv->port[port].gid_table.mutex));
+        return err;
+}
+
+
+void mlx4_reset_roce_gids(struct mlx4_dev *dev, int slave)
+{
+        struct mlx4_active_ports actv_ports;
+        struct mlx4_cmd_mailbox *mailbox;
+        int num_eth_ports, err;
+        int i;
+
+        if (slave < 0 || slave > dev->num_vfs)
+                return;
+
+        actv_ports = mlx4_get_active_ports(dev, slave);
+
+        for (i = 0, num_eth_ports = 0; i < dev->caps.num_ports; i++) {
+                if (test_bit(i, actv_ports.ports)) {
+                        if (dev->caps.port_type[i + 1] != MLX4_PORT_TYPE_ETH)
+                                continue;
+                        num_eth_ports++;
+                }
+        }
+
+        if (!num_eth_ports)
+                return;
+
+        /* have ETH ports.  Alloc mailbox for SET_PORT command */
+        mailbox = mlx4_alloc_cmd_mailbox(dev);
+        if (IS_ERR(mailbox))
+                return;
+
+        for (i = 0; i < dev->caps.num_ports; i++) {
+                if (test_bit(i, actv_ports.ports)) {
+                        if (dev->caps.port_type[i + 1] != MLX4_PORT_TYPE_ETH)
+                                continue;
+                        err = mlx4_reset_roce_port_gids(dev, slave, i + 1, mailbox);
+                        if (err)
+                                mlx4_warn(dev, "Could not reset ETH port GID table for slave %d, port %d (%d)\n",
+                                          slave, i + 1, err);
+                }
+        }
+
+        mlx4_free_cmd_mailbox(dev, mailbox);
+        return;
+}
+
 static int mlx4_common_set_port(struct mlx4_dev *dev, int slave, u32 in_mod,
                                 u8 op_mod, struct mlx4_cmd_mailbox *inbox)
 {
@@ -691,10 +779,12 @@ static int mlx4_common_set_port(struct mlx4_dev *dev, int slave, u32 in_mod,
                         /* 2. Check that do not have duplicates in OTHER
                          *    entries in the port GID table
                          */
+
+                        mutex_lock(&(priv->port[port].gid_table.mutex));
                         for (i = 0; i < MLX4_ROCE_MAX_GIDS; i++) {
                                 if (i >= base && i < base + num_gids)
                                         continue; /* don't compare to slave's current gids */
-                                gid_entry_tbl = &priv->roce_gids[port - 1][i];
+                                gid_entry_tbl = &priv->port[port].gid_table.roce_gids[i];
                                 if (!memcmp(gid_entry_tbl->raw, zgid_entry.raw, sizeof(zgid_entry)))
                                         continue;
                                 gid_entry_mbox = (struct mlx4_roce_gid_entry *)(inbox->buf);
@@ -707,6 +797,7 @@ static int mlx4_common_set_port(struct mlx4_dev *dev, int slave, u32 in_mod,
                                                 /* found duplicate */
                                                 mlx4_warn(dev, "requested gid entry for slave:%d is a duplicate of gid at index %d\n",
                                                           slave, i);
+                                                mutex_unlock(&(priv->port[port].gid_table.mutex));
                                                 return -EINVAL;
                                         }
                                 }
@@ -715,16 +806,24 @@ static int mlx4_common_set_port(struct mlx4_dev *dev, int slave, u32 in_mod,
                         /* insert slave GIDs with memcpy, starting at slave's base index */
                         gid_entry_mbox = (struct mlx4_roce_gid_entry *)(inbox->buf);
                         for (i = 0, offset = base; i < num_gids; gid_entry_mbox++, offset++, i++)
-                                memcpy(priv->roce_gids[port - 1][offset].raw, gid_entry_mbox->raw, 16);
+                                memcpy(priv->port[port].gid_table.roce_gids[offset].raw,
+                                       gid_entry_mbox->raw, MLX4_ROCE_GID_ENTRY_SIZE);
 
                         /* Now, copy roce port gids table to current mailbox for passing to FW */
                         gid_entry_mbox = (struct mlx4_roce_gid_entry *)(inbox->buf);
                         for (i = 0; i < MLX4_ROCE_MAX_GIDS; gid_entry_mbox++, i++)
-                                memcpy(gid_entry_mbox->raw, priv->roce_gids[port - 1][i].raw, 16);
-
-                        break;
+                                memcpy(gid_entry_mbox->raw,
+                                       priv->port[port].gid_table.roce_gids[i].raw,
+                                       MLX4_ROCE_GID_ENTRY_SIZE);
+
+                        err = mlx4_cmd(dev, inbox->dma, in_mod & 0xffff, op_mod,
+                                       MLX4_CMD_SET_PORT, MLX4_CMD_TIME_CLASS_B,
+                                       MLX4_CMD_NATIVE);
+                        mutex_unlock(&(priv->port[port].gid_table.mutex));
+                        return err;
                 }
-                return mlx4_cmd(dev, inbox->dma, in_mod, op_mod,
+
+                return mlx4_cmd(dev, inbox->dma, in_mod & 0xffff, op_mod,
                                 MLX4_CMD_SET_PORT, MLX4_CMD_TIME_CLASS_B,
                                 MLX4_CMD_NATIVE);
         }
@@ -1097,7 +1196,8 @@ int mlx4_get_slave_from_roce_gid(struct mlx4_dev *dev, int port, u8 *gid,
         num_vfs = bitmap_weight(slaves_pport.slaves, dev->num_vfs + 1) - 1;
 
         for (i = 0; i < MLX4_ROCE_MAX_GIDS; i++) {
-                if (!memcmp(priv->roce_gids[port - 1][i].raw, gid, 16)) {
+                if (!memcmp(priv->port[port].gid_table.roce_gids[i].raw, gid,
+                            MLX4_ROCE_GID_ENTRY_SIZE)) {
                         found_ix = i;
                         break;
                 }
@@ -1185,7 +1285,8 @@ int mlx4_get_roce_gid_from_slave(struct mlx4_dev *dev, int port, int slave_id,
         if (!mlx4_is_master(dev))
                 return -EINVAL;
 
-        memcpy(gid, priv->roce_gids[port - 1][slave_id].raw, 16);
+        memcpy(gid, priv->port[port].gid_table.roce_gids[slave_id].raw,
+               MLX4_ROCE_GID_ENTRY_SIZE);
         return 0;
 }
 EXPORT_SYMBOL(mlx4_get_roce_gid_from_slave);
diff --git a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
index dd821b363686..b6cddef24391 100644
--- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
+++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
@@ -586,6 +586,7 @@ void mlx4_free_resource_tracker(struct mlx4_dev *dev,
                         }
                         /* free master's vlans */
                         i = dev->caps.function;
+                        mlx4_reset_roce_gids(dev, i);
                         mutex_lock(&priv->mfunc.master.res_tracker.slave_list[i].mutex);
                         rem_slave_vlans(dev, i);
                         mutex_unlock(&priv->mfunc.master.res_tracker.slave_list[i].mutex);
@@ -4672,7 +4673,7 @@ static void rem_slave_xrcdns(struct mlx4_dev *dev, int slave)
 void mlx4_delete_all_resources_for_slave(struct mlx4_dev *dev, int slave)
 {
         struct mlx4_priv *priv = mlx4_priv(dev);
-
+        mlx4_reset_roce_gids(dev, slave);
         mutex_lock(&priv->mfunc.master.res_tracker.slave_list[slave].mutex);
         rem_slave_vlans(dev, slave);
         rem_slave_macs(dev, slave);
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.c
index a51fe18f09a8..561cb11ca58c 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.c
@@ -1020,6 +1020,7 @@ static int qlcnic_dcb_peer_app_info(struct net_device *netdev,
         struct qlcnic_dcb_cee *peer;
         int i;
 
+        memset(info, 0, sizeof(*info));
         *app_count = 0;
 
         if (!test_bit(QLCNIC_DCB_STATE, &adapter->dcb->state))
diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
index 6a94ede699b4..b19a323c8647 100644
--- a/drivers/net/ethernet/renesas/sh_eth.c
+++ b/drivers/net/ethernet/renesas/sh_eth.c
@@ -307,6 +307,27 @@ static const u16 sh_eth_offset_fast_sh4[SH_ETH_MAX_REGISTER_OFFSET] = {
 };
 
 static const u16 sh_eth_offset_fast_sh3_sh2[SH_ETH_MAX_REGISTER_OFFSET] = {
+        [EDMR]          = 0x0000,
+        [EDTRR]         = 0x0004,
+        [EDRRR]         = 0x0008,
+        [TDLAR]         = 0x000c,
+        [RDLAR]         = 0x0010,
+        [EESR]          = 0x0014,
+        [EESIPR]        = 0x0018,
+        [TRSCER]        = 0x001c,
+        [RMFCR]         = 0x0020,
+        [TFTR]          = 0x0024,
+        [FDR]           = 0x0028,
+        [RMCR]          = 0x002c,
+        [EDOCR]         = 0x0030,
+        [FCFTR]         = 0x0034,
+        [RPADIR]        = 0x0038,
+        [TRIMD]         = 0x003c,
+        [RBWAR]         = 0x0040,
+        [RDFAR]         = 0x0044,
+        [TBRAR]         = 0x004c,
+        [TDFAR]         = 0x0050,
+
         [ECMR]          = 0x0160,
         [ECSR]          = 0x0164,
         [ECSIPR]        = 0x0168,
@@ -546,7 +567,6 @@ static struct sh_eth_cpu_data sh7757_data = {
         .register_type  = SH_ETH_REG_FAST_SH4,
 
         .eesipr_value   = DMAC_M_RFRMER | DMAC_M_ECI | 0x003fffff,
-        .rmcr_value     = RMCR_RNC,
 
         .tx_check       = EESR_FTC | EESR_CND | EESR_DLC | EESR_CD | EESR_RTO,
         .eesr_err_check = EESR_TWB | EESR_TABT | EESR_RABT | EESR_RFE |
@@ -624,7 +644,6 @@ static struct sh_eth_cpu_data sh7757_data_giga = {
                           EESR_RFE | EESR_RDE | EESR_RFRMER | EESR_TFE |
                           EESR_TDE | EESR_ECI,
         .fdr_value      = 0x0000072f,
-        .rmcr_value     = RMCR_RNC,
 
         .irq_flags      = IRQF_SHARED,
         .apr            = 1,
@@ -752,7 +771,6 @@ static struct sh_eth_cpu_data r8a7740_data = {
                           EESR_RFE | EESR_RDE | EESR_RFRMER | EESR_TFE |
                           EESR_TDE | EESR_ECI,
         .fdr_value      = 0x0000070f,
-        .rmcr_value     = RMCR_RNC,
 
         .apr            = 1,
         .mpr            = 1,
@@ -784,7 +802,6 @@ static struct sh_eth_cpu_data r7s72100_data = {
                           EESR_RFE | EESR_RDE | EESR_RFRMER | EESR_TFE |
                           EESR_TDE | EESR_ECI,
         .fdr_value      = 0x0000070f,
-        .rmcr_value     = RMCR_RNC,
 
         .no_psr         = 1,
         .apr            = 1,
@@ -833,9 +850,6 @@ static void sh_eth_set_default_cpu_data(struct sh_eth_cpu_data *cd)
         if (!cd->fdr_value)
                 cd->fdr_value = DEFAULT_FDR_INIT;
 
-        if (!cd->rmcr_value)
-                cd->rmcr_value = DEFAULT_RMCR_VALUE;
-
         if (!cd->tx_check)
                 cd->tx_check = DEFAULT_TX_CHECK;
 
@@ -1287,8 +1301,8 @@ static int sh_eth_dev_init(struct net_device *ndev, bool start)
         sh_eth_write(ndev, mdp->cd->fdr_value, FDR);
         sh_eth_write(ndev, 0, TFTR);
 
-        /* Frame recv control */
-        sh_eth_write(ndev, mdp->cd->rmcr_value, RMCR);
+        /* Frame recv control (enable multiple-packets per rx irq) */
+        sh_eth_write(ndev, RMCR_RNC, RMCR);
 
         sh_eth_write(ndev, DESC_I_RINT8 | DESC_I_RINT5 | DESC_I_TINT2, TRSCER);
 
diff --git a/drivers/net/ethernet/renesas/sh_eth.h b/drivers/net/ethernet/renesas/sh_eth.h
index d55e37cd5fec..b37c427144ee 100644
--- a/drivers/net/ethernet/renesas/sh_eth.h
+++ b/drivers/net/ethernet/renesas/sh_eth.h
@@ -319,7 +319,6 @@ enum TD_STS_BIT {
 enum RMCR_BIT {
         RMCR_RNC = 0x00000001,
 };
-#define DEFAULT_RMCR_VALUE      0x00000000
 
 /* ECMR */
 enum FELIC_MODE_BIT {
@@ -466,7 +465,6 @@ struct sh_eth_cpu_data {
         unsigned long fdr_value;
         unsigned long fcftr_value;
         unsigned long rpadir_value;
-        unsigned long rmcr_value;
 
         /* interrupt checking mask */
         unsigned long tx_check;
diff --git a/drivers/net/ethernet/smsc/smsc911x.c b/drivers/net/ethernet/smsc/smsc911x.c
index a0fc151da40d..5e13fa5524ae 100644
--- a/drivers/net/ethernet/smsc/smsc911x.c
+++ b/drivers/net/ethernet/smsc/smsc911x.c
@@ -2477,6 +2477,8 @@ static int smsc911x_drv_probe(struct platform_device *pdev)
                 goto out_disable_resources;
         }
 
+        netif_carrier_off(dev);
+
         retval = register_netdev(dev);
         if (retval) {
                 SMSC_WARN(pdata, probe, "Error %i registering device", retval);
diff --git a/drivers/net/ethernet/ti/davinci_emac.c b/drivers/net/ethernet/ti/davinci_emac.c
index f32d730f55cc..35a139e9a833 100644
--- a/drivers/net/ethernet/ti/davinci_emac.c
+++ b/drivers/net/ethernet/ti/davinci_emac.c
@@ -1567,7 +1567,6 @@ static int emac_dev_open(struct net_device *ndev)
         while ((res = platform_get_resource(priv->pdev, IORESOURCE_IRQ,
                                             res_num))) {
                 for (irq_num = res->start; irq_num <= res->end; irq_num++) {
-                        dev_err(emac_dev, "Request IRQ %d\n", irq_num);
                         if (request_irq(irq_num, emac_irq, 0, ndev->name,
                                         ndev)) {
                                 dev_err(emac_dev,
diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
index 9a9ce8debefa..b4958c7ffa84 100644
--- a/drivers/net/team/team.c
+++ b/drivers/net/team/team.c
@@ -1724,6 +1724,7 @@ static int team_change_mtu(struct net_device *dev, int new_mtu)
          * to traverse list in reverse under rcu_read_lock
          */
         mutex_lock(&team->lock);
+        team->port_mtu_change_allowed = true;
         list_for_each_entry(port, &team->port_list, list) {
                 err = dev_set_mtu(port->dev, new_mtu);
                 if (err) {
@@ -1732,6 +1733,7 @@ static int team_change_mtu(struct net_device *dev, int new_mtu)
                         goto unwind;
                 }
         }
+        team->port_mtu_change_allowed = false;
         mutex_unlock(&team->lock);
 
         dev->mtu = new_mtu;
@@ -1741,6 +1743,7 @@ static int team_change_mtu(struct net_device *dev, int new_mtu)
 unwind:
         list_for_each_entry_continue_reverse(port, &team->port_list, list)
                 dev_set_mtu(port->dev, dev->mtu);
+        team->port_mtu_change_allowed = false;
         mutex_unlock(&team->lock);
 
         return err;
@@ -2851,7 +2854,9 @@ static int team_device_event(struct notifier_block *unused,
                 break;
         case NETDEV_PRECHANGEMTU:
                 /* Forbid to change mtu of underlaying device */
-                return NOTIFY_BAD;
+                if (!port->team->port_mtu_change_allowed)
+                        return NOTIFY_BAD;
+                break;
         case NETDEV_PRE_TYPE_CHANGE:
                 /* Forbid to change type of underlaying device */
                 return NOTIFY_BAD;
diff --git a/drivers/net/usb/ipheth.c b/drivers/net/usb/ipheth.c
index f72570708edb..76465b117b72 100644
--- a/drivers/net/usb/ipheth.c
+++ b/drivers/net/usb/ipheth.c
@@ -59,6 +59,8 @@
 #define USB_PRODUCT_IPHONE_3GS  0x1294
 #define USB_PRODUCT_IPHONE_4    0x1297
 #define USB_PRODUCT_IPAD 0x129a
+#define USB_PRODUCT_IPAD_2      0x12a2
+#define USB_PRODUCT_IPAD_3      0x12a6
 #define USB_PRODUCT_IPAD_MINI    0x12ab
 #define USB_PRODUCT_IPHONE_4_VZW 0x129c
 #define USB_PRODUCT_IPHONE_4S   0x12a0
@@ -107,6 +109,14 @@ static struct usb_device_id ipheth_table[] = {
                 IPHETH_USBINTF_CLASS, IPHETH_USBINTF_SUBCLASS,
                 IPHETH_USBINTF_PROTO) },
         { USB_DEVICE_AND_INTERFACE_INFO(
+                USB_VENDOR_APPLE, USB_PRODUCT_IPAD_2,
+                IPHETH_USBINTF_CLASS, IPHETH_USBINTF_SUBCLASS,
+                IPHETH_USBINTF_PROTO) },
+        { USB_DEVICE_AND_INTERFACE_INFO(
+                USB_VENDOR_APPLE, USB_PRODUCT_IPAD_3,
+                IPHETH_USBINTF_CLASS, IPHETH_USBINTF_SUBCLASS,
+                IPHETH_USBINTF_PROTO) },
+        { USB_DEVICE_AND_INTERFACE_INFO(
                 USB_VENDOR_APPLE, USB_PRODUCT_IPAD_MINI,
                 IPHETH_USBINTF_CLASS, IPHETH_USBINTF_SUBCLASS,
                 IPHETH_USBINTF_PROTO) },
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index 83208d4fdc59..dc4bf06948c7 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -748,11 +748,15 @@ static const struct usb_device_id products[] = {
         {QMI_FIXED_INTF(0x1199, 0x68a2, 19)},   /* Sierra Wireless MC7710 in QMI mode */
         {QMI_FIXED_INTF(0x1199, 0x68c0, 8)},    /* Sierra Wireless MC73xx */
         {QMI_FIXED_INTF(0x1199, 0x68c0, 10)},   /* Sierra Wireless MC73xx */
-        {QMI_FIXED_INTF(0x1199, 0x68c0, 11)},   /* Sierra Wireless MC73xx */
         {QMI_FIXED_INTF(0x1199, 0x901c, 8)},    /* Sierra Wireless EM7700 */
         {QMI_FIXED_INTF(0x1199, 0x901f, 8)},    /* Sierra Wireless EM7355 */
         {QMI_FIXED_INTF(0x1199, 0x9041, 8)},    /* Sierra Wireless MC7305/MC7355 */
         {QMI_FIXED_INTF(0x1199, 0x9051, 8)},    /* Netgear AirCard 340U */
+        {QMI_FIXED_INTF(0x1199, 0x9053, 8)},    /* Sierra Wireless Modem */
+        {QMI_FIXED_INTF(0x1199, 0x9054, 8)},    /* Sierra Wireless Modem */
+        {QMI_FIXED_INTF(0x1199, 0x9055, 8)},    /* Netgear AirCard 341U */
+        {QMI_FIXED_INTF(0x1199, 0x9056, 8)},    /* Sierra Wireless Modem */
+        {QMI_FIXED_INTF(0x1199, 0x9061, 8)},    /* Sierra Wireless Modem */
         {QMI_FIXED_INTF(0x1bbb, 0x011e, 4)},    /* Telekom Speedstick LTE II (Alcatel One Touch L100V LTE) */
         {QMI_FIXED_INTF(0x1bbb, 0x0203, 2)},    /* Alcatel L800MA */
         {QMI_FIXED_INTF(0x2357, 0x0201, 4)},    /* TP-LINK HSUPA Modem MA180 */
diff --git a/drivers/pinctrl/vt8500/pinctrl-wmt.c b/drivers/pinctrl/vt8500/pinctrl-wmt.c
index 9802b67040cc..2c61281bebd7 100644
--- a/drivers/pinctrl/vt8500/pinctrl-wmt.c
+++ b/drivers/pinctrl/vt8500/pinctrl-wmt.c
@@ -523,17 +523,6 @@ static int wmt_gpio_get_direction(struct gpio_chip *chip, unsigned offset)
                 return GPIOF_DIR_IN;
 }
 
-static int wmt_gpio_direction_input(struct gpio_chip *chip, unsigned offset)
-{
-        return pinctrl_gpio_direction_input(chip->base + offset);
-}
-
-static int wmt_gpio_direction_output(struct gpio_chip *chip, unsigned offset,
-                                     int value)
-{
-        return pinctrl_gpio_direction_output(chip->base + offset);
-}
-
 static int wmt_gpio_get_value(struct gpio_chip *chip, unsigned offset)
 {
         struct wmt_pinctrl_data *data = dev_get_drvdata(chip->dev);
@@ -568,6 +557,18 @@ static void wmt_gpio_set_value(struct gpio_chip *chip, unsigned offset,
                 wmt_clearbits(data, reg_data_out, BIT(bit));
 }
 
+static int wmt_gpio_direction_input(struct gpio_chip *chip, unsigned offset)
+{
+        return pinctrl_gpio_direction_input(chip->base + offset);
+}
+
+static int wmt_gpio_direction_output(struct gpio_chip *chip, unsigned offset,
+                                     int value)
+{
+        wmt_gpio_set_value(chip, offset, value);
+        return pinctrl_gpio_direction_output(chip->base + offset);
+}
+
 static struct gpio_chip wmt_gpio_chip = {
         .label = "gpio-wmt",
         .owner = THIS_MODULE,
diff --git a/drivers/scsi/scsi_transport_sas.c b/drivers/scsi/scsi_transport_sas.c
index 1b681427dde0..c341f855fadc 100644
--- a/drivers/scsi/scsi_transport_sas.c
+++ b/drivers/scsi/scsi_transport_sas.c
@@ -1621,8 +1621,6 @@ void sas_rphy_free(struct sas_rphy *rphy)
         list_del(&rphy->list);
         mutex_unlock(&sas_host->lock);
 
-        sas_bsg_remove(shost, rphy);
-
         transport_destroy_device(dev);
 
         put_device(dev);
@@ -1681,6 +1679,7 @@ sas_rphy_remove(struct sas_rphy *rphy)
         }
 
         sas_rphy_unlink(rphy);
+        sas_bsg_remove(NULL, rphy);
         transport_remove_device(dev);
         device_del(dev);
 }
diff --git a/drivers/staging/comedi/drivers/ni_daq_700.c b/drivers/staging/comedi/drivers/ni_daq_700.c
index 171a71d20c88..728bf7f14f7b 100644
--- a/drivers/staging/comedi/drivers/ni_daq_700.c
+++ b/drivers/staging/comedi/drivers/ni_daq_700.c
@@ -139,6 +139,8 @@ static int daq700_ai_rinsn(struct comedi_device *dev,
         /* write channel to multiplexer */
         /* set mask scan bit high to disable scanning */
         outb(chan | 0x80, dev->iobase + CMD_R1);
+        /* mux needs 2us to really settle [Fred Brooks]. */
+        udelay(2);
 
         /* convert n samples */
         for (n = 0; n < insn->n; n++) {
diff --git a/drivers/staging/rtl8192e/rtllib_tx.c b/drivers/staging/rtl8192e/rtllib_tx.c
index 11d0a9d8ee59..b7dd1539bbc4 100644
--- a/drivers/staging/rtl8192e/rtllib_tx.c
+++ b/drivers/staging/rtl8192e/rtllib_tx.c
@@ -171,7 +171,7 @@ inline int rtllib_put_snap(u8 *data, u16 h_proto)
         snap->oui[1] = oui[1];
         snap->oui[2] = oui[2];
 
-        *(u16 *)(data + SNAP_SIZE) = h_proto;
+        *(__be16 *)(data + SNAP_SIZE) = htons(h_proto);
 
         return SNAP_SIZE + sizeof(u16);
 }
diff --git a/drivers/staging/speakup/main.c b/drivers/staging/speakup/main.c
index 3b6e5358c723..7de79d59a4cd 100644
--- a/drivers/staging/speakup/main.c
+++ b/drivers/staging/speakup/main.c
@@ -2218,6 +2218,7 @@ static void __exit speakup_exit(void)
         unregister_keyboard_notifier(&keyboard_notifier_block);
         unregister_vt_notifier(&vt_notifier_block);
         speakup_unregister_devsynth();
+        speakup_cancel_paste();
         del_timer(&cursor_timer);
         kthread_stop(speakup_task);
         speakup_task = NULL;
diff --git a/drivers/staging/speakup/selection.c b/drivers/staging/speakup/selection.c
index f0fb00392d6b..ca04d3669acc 100644
--- a/drivers/staging/speakup/selection.c
+++ b/drivers/staging/speakup/selection.c
@@ -4,6 +4,10 @@
 #include <linux/sched.h>
 #include <linux/device.h> /* for dev_warn */
 #include <linux/selection.h>
+#include <linux/workqueue.h>
+#include <linux/tty.h>
+#include <linux/tty_flip.h>
+#include <asm/cmpxchg.h>
 
 #include "speakup.h"
 
@@ -121,31 +125,61 @@ int speakup_set_selection(struct tty_struct *tty)
         return 0;
 }
 
-/* TODO: move to some helper thread, probably.  That'd fix having to check for
- * in_atomic().  */
-int speakup_paste_selection(struct tty_struct *tty)
+struct speakup_paste_work {
+        struct work_struct work;
+        struct tty_struct *tty;
+};
+
+static void __speakup_paste_selection(struct work_struct *work)
 {
+        struct speakup_paste_work *spw =
+                container_of(work, struct speakup_paste_work, work);
+        struct tty_struct *tty = xchg(&spw->tty, NULL);
         struct vc_data *vc = (struct vc_data *) tty->driver_data;
         int pasted = 0, count;
+        struct tty_ldisc *ld;
         DECLARE_WAITQUEUE(wait, current);
+
+        ld = tty_ldisc_ref_wait(tty);
+        tty_buffer_lock_exclusive(&vc->port);
+
         add_wait_queue(&vc->paste_wait, &wait);
         while (sel_buffer && sel_buffer_lth > pasted) {
                 set_current_state(TASK_INTERRUPTIBLE);
                 if (test_bit(TTY_THROTTLED, &tty->flags)) {
-                        if (in_atomic())
-                                /* if we are in an interrupt handler, abort */
-                                break;
                         schedule();
                         continue;
                 }
                 count = sel_buffer_lth - pasted;
-                count = min_t(int, count, tty->receive_room);
-                tty->ldisc->ops->receive_buf(tty, sel_buffer + pasted,
-                        NULL, count);
+                count = tty_ldisc_receive_buf(ld, sel_buffer + pasted, NULL,
+                                              count);
                 pasted += count;
         }
         remove_wait_queue(&vc->paste_wait, &wait);
         current->state = TASK_RUNNING;
+
+        tty_buffer_unlock_exclusive(&vc->port);
+        tty_ldisc_deref(ld);
+        tty_kref_put(tty);
+}
+
+static struct speakup_paste_work speakup_paste_work = {
+        .work = __WORK_INITIALIZER(speakup_paste_work.work,
+                                   __speakup_paste_selection)
+};
+
+int speakup_paste_selection(struct tty_struct *tty)
+{
+        if (cmpxchg(&speakup_paste_work.tty, NULL, tty) != NULL)
+                return -EBUSY;
+
+        tty_kref_get(tty);
+        schedule_work_on(WORK_CPU_UNBOUND, &speakup_paste_work.work);
         return 0;
 }
 
+void speakup_cancel_paste(void)
+{
+        cancel_work_sync(&speakup_paste_work.work);
+        tty_kref_put(speakup_paste_work.tty);
+}
diff --git a/drivers/staging/speakup/speakup.h b/drivers/staging/speakup/speakup.h
index a7bcceec436a..898dce5e1243 100644
--- a/drivers/staging/speakup/speakup.h
+++ b/drivers/staging/speakup/speakup.h
@@ -75,6 +75,7 @@ extern void synth_buffer_clear(void);
 extern void speakup_clear_selection(void);
 extern int speakup_set_selection(struct tty_struct *tty);
 extern int speakup_paste_selection(struct tty_struct *tty);
+extern void speakup_cancel_paste(void);
 extern void speakup_register_devsynth(void);
 extern void speakup_unregister_devsynth(void);
 extern void synth_write(const char *buf, size_t count);
diff --git a/drivers/staging/speakup/speakup_acntsa.c b/drivers/staging/speakup/speakup_acntsa.c
index c7f014ed9628..5079dbd5d7ad 100644
--- a/drivers/staging/speakup/speakup_acntsa.c
+++ b/drivers/staging/speakup/speakup_acntsa.c
@@ -60,15 +60,15 @@ static struct kobj_attribute vol_attribute =
         __ATTR(vol, S_IWUGO|S_IRUGO, spk_var_show, spk_var_store);
 
 static struct kobj_attribute delay_time_attribute =
-        __ATTR(delay_time, S_IRUSR|S_IRUGO, spk_var_show, spk_var_store);
+        __ATTR(delay_time, S_IWUSR|S_IRUGO, spk_var_show, spk_var_store);
 static struct kobj_attribute direct_attribute =
         __ATTR(direct, S_IWUGO|S_IRUGO, spk_var_show, spk_var_store);
 static struct kobj_attribute full_time_attribute =
-        __ATTR(full_time, S_IRUSR|S_IRUGO, spk_var_show, spk_var_store);
+        __ATTR(full_time, S_IWUSR|S_IRUGO, spk_var_show, spk_var_store);
 static struct kobj_attribute jiffy_delta_attribute =
-        __ATTR(jiffy_delta, S_IRUSR|S_IRUGO, spk_var_show, spk_var_store);
+        __ATTR(jiffy_delta, S_IWUSR|S_IRUGO, spk_var_show, spk_var_store);
 static struct kobj_attribute trigger_time_attribute =
-        __ATTR(trigger_time, S_IRUSR|S_IRUGO, spk_var_show, spk_var_store);
+        __ATTR(trigger_time, S_IWUSR|S_IRUGO, spk_var_show, spk_var_store);
 
 /*
  * Create a group of attributes so that we can create and destroy them all
diff --git a/drivers/tty/tty_buffer.c b/drivers/tty/tty_buffer.c
index cf78d1985cd8..143deb62467d 100644
--- a/drivers/tty/tty_buffer.c
+++ b/drivers/tty/tty_buffer.c
@@ -60,6 +60,7 @@ void tty_buffer_lock_exclusive(struct tty_port *port)
         atomic_inc(&buf->priority);
         mutex_lock(&buf->lock);
 }
+EXPORT_SYMBOL_GPL(tty_buffer_lock_exclusive);
 
 void tty_buffer_unlock_exclusive(struct tty_port *port)
 {
@@ -73,6 +74,7 @@ void tty_buffer_unlock_exclusive(struct tty_port *port)
         if (restart)
                 queue_work(system_unbound_wq, &buf->work);
 }
+EXPORT_SYMBOL_GPL(tty_buffer_unlock_exclusive);
 
 /**
  *      tty_buffer_space_avail  -       return unused buffer space
diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
index 888881e5f292..4aeb10034de7 100644
--- a/drivers/usb/core/driver.c
+++ b/drivers/usb/core/driver.c
@@ -1822,10 +1822,13 @@ int usb_runtime_suspend(struct device *dev)
         if (status == -EAGAIN || status == -EBUSY)
                 usb_mark_last_busy(udev);
 
-        /* The PM core reacts badly unless the return code is 0,
-         * -EAGAIN, or -EBUSY, so always return -EBUSY on an error.
+        /*
+         * The PM core reacts badly unless the return code is 0,
+         * -EAGAIN, or -EBUSY, so always return -EBUSY on an error
+         * (except for root hubs, because they don't suspend through
+         * an upstream port like other USB devices).
          */
-        if (status != 0)
+        if (status != 0 && udev->parent)
                 return -EBUSY;
         return status;
 }
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 090469ebfcff..229a73f64304 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -1691,8 +1691,19 @@ static int hub_probe(struct usb_interface *intf, const struct usb_device_id *id)
          */
         pm_runtime_set_autosuspend_delay(&hdev->dev, 0);
 
-        /* Hubs have proper suspend/resume support. */
-        usb_enable_autosuspend(hdev);
+        /*
+         * Hubs have proper suspend/resume support, except for root hubs
+         * where the controller driver doesn't have bus_suspend and
+         * bus_resume methods.
+         */
+        if (hdev->parent) {             /* normal device */
+                usb_enable_autosuspend(hdev);
+        } else {                        /* root hub */
+                const struct hc_driver *drv = bus_to_hcd(hdev->bus)->driver;
+
+                if (drv->bus_suspend && drv->bus_resume)
+                        usb_enable_autosuspend(hdev);
+        }
 
         if (hdev->level == MAX_TOPO_LEVEL) {
                 dev_err(&intf->dev,
diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c
index 00661d305143..4a6d3dd68572 100644
--- a/drivers/usb/host/pci-quirks.c
+++ b/drivers/usb/host/pci-quirks.c
@@ -847,6 +847,13 @@ void usb_enable_intel_xhci_ports(struct pci_dev *xhci_pdev)
         bool            ehci_found = false;
         struct pci_dev  *companion = NULL;
 
+        /* Sony VAIO t-series with subsystem device ID 90a8 is not capable of
+         * switching ports from EHCI to xHCI
+         */
+        if (xhci_pdev->subsystem_vendor == PCI_VENDOR_ID_SONY &&
+            xhci_pdev->subsystem_device == 0x90a8)
+                return;
+
         /* make sure an intel EHCI controller exists */
         for_each_pci_dev(companion) {
                 if (companion->class == PCI_CLASS_SERIAL_USB_EHCI &&
diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
index c089668308ad..b1a8a5f4bbb8 100644
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -1822,6 +1822,16 @@ void xhci_mem_cleanup(struct xhci_hcd *xhci)
                 kfree(cur_cd);
         }
 
+        num_ports = HCS_MAX_PORTS(xhci->hcs_params1);
+        for (i = 0; i < num_ports; i++) {
+                struct xhci_interval_bw_table *bwt = &xhci->rh_bw[i].bw_table;
+                for (j = 0; j < XHCI_MAX_INTERVAL; j++) {
+                        struct list_head *ep = &bwt->interval_bw[j].endpoints;
+                        while (!list_empty(ep))
+                                list_del_init(ep->next);
+                }
+        }
+
         for (i = 1; i < MAX_HC_SLOTS; ++i)
                 xhci_free_virt_device(xhci, i);
 
@@ -1857,16 +1867,6 @@ void xhci_mem_cleanup(struct xhci_hcd *xhci)
         if (!xhci->rh_bw)
                 goto no_bw;
 
-        num_ports = HCS_MAX_PORTS(xhci->hcs_params1);
-        for (i = 0; i < num_ports; i++) {
-                struct xhci_interval_bw_table *bwt = &xhci->rh_bw[i].bw_table;
-                for (j = 0; j < XHCI_MAX_INTERVAL; j++) {
-                        struct list_head *ep = &bwt->interval_bw[j].endpoints;
-                        while (!list_empty(ep))
-                                list_del_init(ep->next);
-                }
-        }
-
         for (i = 0; i < num_ports; i++) {
                 struct xhci_tt_bw_info *tt, *n;
                 list_for_each_entry_safe(tt, n, &xhci->rh_bw[i].tts, tt_list) {
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 7c6e1dedeb06..edf3b124583c 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -580,6 +580,8 @@ static const struct usb_device_id id_table_combined[] = {
         { USB_DEVICE(FTDI_VID, FTDI_TAVIR_STK500_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_TIAO_UMPA_PID),
                 .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+        { USB_DEVICE(FTDI_VID, FTDI_NT_ORIONLXM_PID),
+                .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
         /*
          * ELV devices:
          */
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
index 993c93df6874..500474c48f4b 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -538,6 +538,11 @@
  */
 #define FTDI_TIAO_UMPA_PID      0x8a98  /* TIAO/DIYGADGET USB Multi-Protocol Adapter */
 
+/*
+ * NovaTech product ids (FTDI_VID)
+ */
+#define FTDI_NT_ORIONLXM_PID    0x7c90  /* OrionLXm Substation Automation Platform */
+
 
 /********************************/
 /** third-party VID/PID combos **/
diff --git a/drivers/usb/serial/io_ti.c b/drivers/usb/serial/io_ti.c
index df90dae53eb9..c0a42e9e6777 100644
--- a/drivers/usb/serial/io_ti.c
+++ b/drivers/usb/serial/io_ti.c
@@ -821,7 +821,7 @@ static int build_i2c_fw_hdr(__u8 *header, struct device *dev)
         firmware_rec =  (struct ti_i2c_firmware_rec*)i2c_header->Data;
 
         i2c_header->Type        = I2C_DESC_TYPE_FIRMWARE_BLANK;
-        i2c_header->Size        = (__u16)buffer_size;
+        i2c_header->Size        = cpu_to_le16(buffer_size);
         i2c_header->CheckSum    = cs;
         firmware_rec->Ver_Major = OperationalMajorVersion;
         firmware_rec->Ver_Minor = OperationalMinorVersion;
diff --git a/drivers/usb/serial/io_usbvend.h b/drivers/usb/serial/io_usbvend.h
index 51f83fbb73bb..6f6a856bc37c 100644
--- a/drivers/usb/serial/io_usbvend.h
+++ b/drivers/usb/serial/io_usbvend.h
@@ -594,7 +594,7 @@ struct edge_boot_descriptor {
 
 struct ti_i2c_desc {
         __u8    Type;                   // Type of descriptor
-        __u16   Size;                   // Size of data only not including header
+        __le16  Size;                   // Size of data only not including header
         __u8    CheckSum;               // Checksum (8 bit sum of data only)
         __u8    Data[0];                // Data starts here
 } __attribute__((packed));
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index f213ee978516..948a19f0cdf7 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -161,6 +161,7 @@ static void option_instat_callback(struct urb *urb);
 #define NOVATELWIRELESS_PRODUCT_HSPA_EMBEDDED_FULLSPEED 0x9000
 #define NOVATELWIRELESS_PRODUCT_HSPA_EMBEDDED_HIGHSPEED 0x9001
 #define NOVATELWIRELESS_PRODUCT_E362            0x9010
+#define NOVATELWIRELESS_PRODUCT_E371            0x9011
 #define NOVATELWIRELESS_PRODUCT_G2              0xA010
 #define NOVATELWIRELESS_PRODUCT_MC551           0xB001
 
@@ -1012,6 +1013,7 @@ static const struct usb_device_id option_ids[] = {
         /* Novatel Ovation MC551 a.k.a. Verizon USB551L */
         { USB_DEVICE_AND_INTERFACE_INFO(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_MC551, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_E362, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_E371, 0xff, 0xff, 0xff) },
 
         { USB_DEVICE(AMOI_VENDOR_ID, AMOI_PRODUCT_H01) },
         { USB_DEVICE(AMOI_VENDOR_ID, AMOI_PRODUCT_H01A) },