Merge tag '6AO.1.1' into 6AO.1.0-lcard-revb6AO.1.1-lcard-revb

Change-Id: Ic07856859ae494d89ebddbed039e77bba979bc82

1271 files changed, 16345 insertions, 6476 deletions

diff --git a/Documentation/ABI/testing/sysfs-devices-system-cpu b/Documentation/ABI/testing/sysfs-devices-system-cpu
index b683e8ee69ec..ea6a043f5beb 100644
--- a/Documentation/ABI/testing/sysfs-devices-system-cpu
+++ b/Documentation/ABI/testing/sysfs-devices-system-cpu
@@ -271,3 +271,19 @@ Description:	Parameters for the CPU cache attributes
                         - WriteBack: data is written only to the cache line and
                                      the modified cache line is written to main
                                      memory only when it is replaced
+
+What:           /sys/devices/system/cpu/vulnerabilities
+                /sys/devices/system/cpu/vulnerabilities/meltdown
+                /sys/devices/system/cpu/vulnerabilities/spectre_v1
+                /sys/devices/system/cpu/vulnerabilities/spectre_v2
+Date:           January 2018
+Contact:        Linux kernel mailing list <linux-kernel@vger.kernel.org>
+Description:    Information about CPU vulnerabilities
+
+                The files are named after the code names of CPU
+                vulnerabilities. The output of those files reflects the
+                state of the CPUs in the system. Possible output values:
+
+                "Not affected"    CPU is not affected by the vulnerability
+                "Vulnerable"      CPU is affected and no mitigation in effect
+                "Mitigation: $M"  CPU is affected and mitigation $M is in effect
diff --git a/Documentation/devicetree/bindings/display/bridge/ti,ths8135.txt b/Documentation/devicetree/bindings/display/bridge/ti,ths8135.txt
deleted file mode 100644
index 6ec1a880ac18..000000000000
--- a/Documentation/devicetree/bindings/display/bridge/ti,ths8135.txt
+++ /dev/null
@@ -1,46 +0,0 @@
-THS8135 Video DAC
------------------
-
-This is the binding for Texas Instruments THS8135 Video DAC bridge.
-
-Required properties:
-
-- compatible: Must be "ti,ths8135"
-
-Required nodes:
-
-This device has two video ports. Their connections are modelled using the OF
-graph bindings specified in Documentation/devicetree/bindings/graph.txt.
-
-- Video port 0 for RGB input
-- Video port 1 for VGA output
-
-Example
--------
-
-vga-bridge {
-        compatible = "ti,ths8135";
-        #address-cells = <1>;
-        #size-cells = <0>;
-
-        ports {
-                #address-cells = <1>;
-                #size-cells = <0>;
-
-                port@0 {
-                        reg = <0>;
-
-                        vga_bridge_in: endpoint {
-                                remote-endpoint = <&lcdc_out_vga>;
-                        };
-                };
-
-                port@1 {
-                        reg = <1>;
-
-                        vga_bridge_out: endpoint {
-                                remote-endpoint = <&vga_con_in>;
-                        };
-                };
-        };
-};
diff --git a/Documentation/devicetree/bindings/dma/snps-dma.txt b/Documentation/devicetree/bindings/dma/snps-dma.txt
index c261598164a7..17d43ca27f41 100644
--- a/Documentation/devicetree/bindings/dma/snps-dma.txt
+++ b/Documentation/devicetree/bindings/dma/snps-dma.txt
@@ -58,6 +58,6 @@ Example:
                 interrupts = <0 35 0x4>;
                 status = "disabled";
                 dmas = <&dmahost 12 0 1>,
-                        <&dmahost 13 0 1 0>;
+                        <&dmahost 13 1 0>;
                 dma-names = "rx", "rx";
         };
diff --git a/Documentation/filesystems/ext4.txt b/Documentation/filesystems/ext4.txt
index 6c0108eb0137..2139ea253142 100644
--- a/Documentation/filesystems/ext4.txt
+++ b/Documentation/filesystems/ext4.txt
@@ -233,7 +233,7 @@ data_err=ignore(*)	Just print an error message if an error occurs
 data_err=abort          Abort the journal if an error occurs in a file
                         data buffer in ordered mode.
 
-grpid                   Give objects the same group ID as their creator.
+grpid                   New objects have the group ID of their parent.
 bsdgroups
 
 nogrpid         (*)     New objects have the group ID of their creator.
diff --git a/Documentation/kdump/gdbmacros.txt b/Documentation/kdump/gdbmacros.txt
index 9b9b454b048a..35f6a982a0d5 100644
--- a/Documentation/kdump/gdbmacros.txt
+++ b/Documentation/kdump/gdbmacros.txt
@@ -15,15 +15,16 @@
 
 define bttnobp
         set $tasks_off=((size_t)&((struct task_struct *)0)->tasks)
-        set $pid_off=((size_t)&((struct task_struct *)0)->pids[1].pid_list.next)
+        set $pid_off=((size_t)&((struct task_struct *)0)->thread_group.next)
         set $init_t=&init_task
         set $next_t=(((char *)($init_t->tasks).next) - $tasks_off)
+        set var $stacksize = sizeof(union thread_union)
         while ($next_t != $init_t)
                 set $next_t=(struct task_struct *)$next_t
                 printf "\npid %d; comm %s:\n", $next_t.pid, $next_t.comm
                 printf "===================\n"
-                set var $stackp = $next_t.thread.esp
-                set var $stack_top = ($stackp & ~4095) + 4096
+                set var $stackp = $next_t.thread.sp
+                set var $stack_top = ($stackp & ~($stacksize - 1)) + $stacksize
 
                 while ($stackp < $stack_top)
                         if (*($stackp) > _stext && *($stackp) < _sinittext)
@@ -31,13 +32,13 @@ define bttnobp
                         end
                         set $stackp += 4
                 end
-                set $next_th=(((char *)$next_t->pids[1].pid_list.next) - $pid_off)
+                set $next_th=(((char *)$next_t->thread_group.next) - $pid_off)
                 while ($next_th != $next_t)
                         set $next_th=(struct task_struct *)$next_th
                         printf "\npid %d; comm %s:\n", $next_t.pid, $next_t.comm
                         printf "===================\n"
-                        set var $stackp = $next_t.thread.esp
-                        set var $stack_top = ($stackp & ~4095) + 4096
+                        set var $stackp = $next_t.thread.sp
+                        set var $stack_top = ($stackp & ~($stacksize - 1)) + stacksize
 
                         while ($stackp < $stack_top)
                                 if (*($stackp) > _stext && *($stackp) < _sinittext)
@@ -45,7 +46,7 @@ define bttnobp
                                 end
                                 set $stackp += 4
                         end
-                        set $next_th=(((char *)$next_th->pids[1].pid_list.next) - $pid_off)
+                        set $next_th=(((char *)$next_th->thread_group.next) - $pid_off)
                 end
                 set $next_t=(char *)($next_t->tasks.next) - $tasks_off
         end
@@ -54,42 +55,44 @@ document bttnobp
         dump all thread stack traces on a kernel compiled with !CONFIG_FRAME_POINTER
 end
 
+define btthreadstack
+        set var $pid_task = $arg0
+
+        printf "\npid %d; comm %s:\n", $pid_task.pid, $pid_task.comm
+        printf "task struct: "
+        print $pid_task
+        printf "===================\n"
+        set var $stackp = $pid_task.thread.sp
+        set var $stacksize = sizeof(union thread_union)
+        set var $stack_top = ($stackp & ~($stacksize - 1)) + $stacksize
+        set var $stack_bot = ($stackp & ~($stacksize - 1))
+
+        set $stackp = *((unsigned long *) $stackp)
+        while (($stackp < $stack_top) && ($stackp > $stack_bot))
+                set var $addr = *(((unsigned long *) $stackp) + 1)
+                info symbol $addr
+                set $stackp = *((unsigned long *) $stackp)
+        end
+end
+document btthreadstack
+         dump a thread stack using the given task structure pointer
+end
+
+
 define btt
         set $tasks_off=((size_t)&((struct task_struct *)0)->tasks)
-        set $pid_off=((size_t)&((struct task_struct *)0)->pids[1].pid_list.next)
+        set $pid_off=((size_t)&((struct task_struct *)0)->thread_group.next)
         set $init_t=&init_task
         set $next_t=(((char *)($init_t->tasks).next) - $tasks_off)
         while ($next_t != $init_t)
                 set $next_t=(struct task_struct *)$next_t
-                printf "\npid %d; comm %s:\n", $next_t.pid, $next_t.comm
-                printf "===================\n"
-                set var $stackp = $next_t.thread.esp
-                set var $stack_top = ($stackp & ~4095) + 4096
-                set var $stack_bot = ($stackp & ~4095)
-
-                set $stackp = *($stackp)
-                while (($stackp < $stack_top) && ($stackp > $stack_bot))
-                        set var $addr = *($stackp + 4)
-                        info symbol $addr
-                        set $stackp = *($stackp)
-                end
+                btthreadstack $next_t
 
-                set $next_th=(((char *)$next_t->pids[1].pid_list.next) - $pid_off)
+                set $next_th=(((char *)$next_t->thread_group.next) - $pid_off)
                 while ($next_th != $next_t)
                         set $next_th=(struct task_struct *)$next_th
-                        printf "\npid %d; comm %s:\n", $next_t.pid, $next_t.comm
-                        printf "===================\n"
-                        set var $stackp = $next_t.thread.esp
-                        set var $stack_top = ($stackp & ~4095) + 4096
-                        set var $stack_bot = ($stackp & ~4095)
-
-                        set $stackp = *($stackp)
-                        while (($stackp < $stack_top) && ($stackp > $stack_bot))
-                                set var $addr = *($stackp + 4)
-                                info symbol $addr
-                                set $stackp = *($stackp)
-                        end
-                        set $next_th=(((char *)$next_th->pids[1].pid_list.next) - $pid_off)
+                        btthreadstack $next_th
+                        set $next_th=(((char *)$next_th->thread_group.next) - $pid_off)
                 end
                 set $next_t=(char *)($next_t->tasks.next) - $tasks_off
         end
@@ -101,7 +104,7 @@ end
 define btpid
         set var $pid = $arg0
         set $tasks_off=((size_t)&((struct task_struct *)0)->tasks)
-        set $pid_off=((size_t)&((struct task_struct *)0)->pids[1].pid_list.next)
+        set $pid_off=((size_t)&((struct task_struct *)0)->thread_group.next)
         set $init_t=&init_task
         set $next_t=(((char *)($init_t->tasks).next) - $tasks_off)
         set var $pid_task = 0
@@ -113,29 +116,18 @@ define btpid
                         set $pid_task = $next_t
                 end
 
-                set $next_th=(((char *)$next_t->pids[1].pid_list.next) - $pid_off)
+                set $next_th=(((char *)$next_t->thread_group.next) - $pid_off)
                 while ($next_th != $next_t)
                         set $next_th=(struct task_struct *)$next_th
                         if ($next_th.pid == $pid)
                                 set $pid_task = $next_th
                         end
-                        set $next_th=(((char *)$next_th->pids[1].pid_list.next) - $pid_off)
+                        set $next_th=(((char *)$next_th->thread_group.next) - $pid_off)
                 end
                 set $next_t=(char *)($next_t->tasks.next) - $tasks_off
         end
 
-        printf "\npid %d; comm %s:\n", $pid_task.pid, $pid_task.comm
-        printf "===================\n"
-        set var $stackp = $pid_task.thread.esp
-        set var $stack_top = ($stackp & ~4095) + 4096
-        set var $stack_bot = ($stackp & ~4095)
-
-        set $stackp = *($stackp)
-        while (($stackp < $stack_top) && ($stackp > $stack_bot))
-                set var $addr = *($stackp + 4)
-                info symbol $addr
-                set $stackp = *($stackp)
-        end
+        btthreadstack $pid_task
 end
 document btpid
         backtrace of pid
@@ -145,7 +137,7 @@ end
 define trapinfo
         set var $pid = $arg0
         set $tasks_off=((size_t)&((struct task_struct *)0)->tasks)
-        set $pid_off=((size_t)&((struct task_struct *)0)->pids[1].pid_list.next)
+        set $pid_off=((size_t)&((struct task_struct *)0)->thread_group.next)
         set $init_t=&init_task
         set $next_t=(((char *)($init_t->tasks).next) - $tasks_off)
         set var $pid_task = 0
@@ -157,13 +149,13 @@ define trapinfo
                         set $pid_task = $next_t
                 end
 
-                set $next_th=(((char *)$next_t->pids[1].pid_list.next) - $pid_off)
+                set $next_th=(((char *)$next_t->thread_group.next) - $pid_off)
                 while ($next_th != $next_t)
                         set $next_th=(struct task_struct *)$next_th
                         if ($next_th.pid == $pid)
                                 set $pid_task = $next_th
                         end
-                        set $next_th=(((char *)$next_th->pids[1].pid_list.next) - $pid_off)
+                        set $next_th=(((char *)$next_th->thread_group.next) - $pid_off)
                 end
                 set $next_t=(char *)($next_t->tasks.next) - $tasks_off
         end
diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index 21321b9acfb0..9fee3a90deaa 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -2458,6 +2458,11 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
 
         nohugeiomap     [KNL,x86] Disable kernel huge I/O mappings.
 
+        nospectre_v2    [X86] Disable all mitigations for the Spectre variant 2
+                        (indirect branch prediction) vulnerability. System may
+                        allow data leaks with this option, which is equivalent
+                        to spectre_v2=off.
+
         noxsave         [BUGS=X86] Disables x86 extended register state save
                         and restore using xsave. The kernel will fallback to
                         enabling legacy floating-point and sse state.
@@ -2525,6 +2530,8 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
 
         nointroute      [IA-64]
 
+        noinvpcid       [X86] Disable the INVPCID cpu feature.
+
         nojitter        [IA-64] Disables jitter checking for ITC timers.
 
         no-kvmclock     [X86,KVM] Disable paravirtualized KVM clock driver
@@ -2559,6 +2566,8 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
         nopat           [X86] Disable PAT (page attribute table extension of
                         pagetables) support.
 
+        nopcid          [X86-64] Disable the PCID cpu feature.
+
         norandmaps      Don't use address space randomization.  Equivalent to
                         echo 0 > /proc/sys/kernel/randomize_va_space
 
@@ -3056,6 +3065,21 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
         pt.             [PARIDE]
                         See Documentation/blockdev/paride.txt.
 
+        pti=            [X86_64] Control Page Table Isolation of user and
+                        kernel address spaces.  Disabling this feature
+                        removes hardening, but improves performance of
+                        system calls and interrupts.
+
+                        on   - unconditionally enable
+                        off  - unconditionally disable
+                        auto - kernel detects whether your CPU model is
+                               vulnerable to issues that PTI mitigates
+
+                        Not specifying this option is equivalent to pti=auto.
+
+        nopti           [X86_64]
+                        Equivalent to pti=off
+
         pty.legacy_count=
                         [KNL] Number of legacy pty's. Overwrites compiled-in
                         default number.
@@ -3585,6 +3609,29 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
         sonypi.*=       [HW] Sony Programmable I/O Control Device driver
                         See Documentation/laptops/sonypi.txt
 
+        spectre_v2=     [X86] Control mitigation of Spectre variant 2
+                        (indirect branch speculation) vulnerability.
+
+                        on   - unconditionally enable
+                        off  - unconditionally disable
+                        auto - kernel detects whether your CPU model is
+                               vulnerable
+
+                        Selecting 'on' will, and 'auto' may, choose a
+                        mitigation method at run time according to the
+                        CPU, the available microcode, the setting of the
+                        CONFIG_RETPOLINE configuration option, and the
+                        compiler with which the kernel was built.
+
+                        Specific mitigations can also be selected manually:
+
+                        retpoline         - replace indirect branches
+                        retpoline,generic - google's original retpoline
+                        retpoline,amd     - AMD-specific minimal thunk
+
+                        Not specifying this option is equivalent to
+                        spectre_v2=auto.
+
         spia_io_base=   [HW,MTD]
         spia_fio_base=
         spia_pedr=
diff --git a/Documentation/x86/pti.txt b/Documentation/x86/pti.txt
new file mode 100644
index 000000000000..5cd58439ad2d
--- /dev/null
+++ b/Documentation/x86/pti.txt
@@ -0,0 +1,186 @@
+Overview
+========
+
+Page Table Isolation (pti, previously known as KAISER[1]) is a
+countermeasure against attacks on the shared user/kernel address
+space such as the "Meltdown" approach[2].
+
+To mitigate this class of attacks, we create an independent set of
+page tables for use only when running userspace applications.  When
+the kernel is entered via syscalls, interrupts or exceptions, the
+page tables are switched to the full "kernel" copy.  When the system
+switches back to user mode, the user copy is used again.
+
+The userspace page tables contain only a minimal amount of kernel
+data: only what is needed to enter/exit the kernel such as the
+entry/exit functions themselves and the interrupt descriptor table
+(IDT).  There are a few strictly unnecessary things that get mapped
+such as the first C function when entering an interrupt (see
+comments in pti.c).
+
+This approach helps to ensure that side-channel attacks leveraging
+the paging structures do not function when PTI is enabled.  It can be
+enabled by setting CONFIG_PAGE_TABLE_ISOLATION=y at compile time.
+Once enabled at compile-time, it can be disabled at boot with the
+'nopti' or 'pti=' kernel parameters (see kernel-parameters.txt).
+
+Page Table Management
+=====================
+
+When PTI is enabled, the kernel manages two sets of page tables.
+The first set is very similar to the single set which is present in
+kernels without PTI.  This includes a complete mapping of userspace
+that the kernel can use for things like copy_to_user().
+
+Although _complete_, the user portion of the kernel page tables is
+crippled by setting the NX bit in the top level.  This ensures
+that any missed kernel->user CR3 switch will immediately crash
+userspace upon executing its first instruction.
+
+The userspace page tables map only the kernel data needed to enter
+and exit the kernel.  This data is entirely contained in the 'struct
+cpu_entry_area' structure which is placed in the fixmap which gives
+each CPU's copy of the area a compile-time-fixed virtual address.
+
+For new userspace mappings, the kernel makes the entries in its
+page tables like normal.  The only difference is when the kernel
+makes entries in the top (PGD) level.  In addition to setting the
+entry in the main kernel PGD, a copy of the entry is made in the
+userspace page tables' PGD.
+
+This sharing at the PGD level also inherently shares all the lower
+layers of the page tables.  This leaves a single, shared set of
+userspace page tables to manage.  One PTE to lock, one set of
+accessed bits, dirty bits, etc...
+
+Overhead
+========
+
+Protection against side-channel attacks is important.  But,
+this protection comes at a cost:
+
+1. Increased Memory Use
+  a. Each process now needs an order-1 PGD instead of order-0.
+     (Consumes an additional 4k per process).
+  b. The 'cpu_entry_area' structure must be 2MB in size and 2MB
+     aligned so that it can be mapped by setting a single PMD
+     entry.  This consumes nearly 2MB of RAM once the kernel
+     is decompressed, but no space in the kernel image itself.
+
+2. Runtime Cost
+  a. CR3 manipulation to switch between the page table copies
+     must be done at interrupt, syscall, and exception entry
+     and exit (it can be skipped when the kernel is interrupted,
+     though.)  Moves to CR3 are on the order of a hundred
+     cycles, and are required at every entry and exit.
+  b. A "trampoline" must be used for SYSCALL entry.  This
+     trampoline depends on a smaller set of resources than the
+     non-PTI SYSCALL entry code, so requires mapping fewer
+     things into the userspace page tables.  The downside is
+     that stacks must be switched at entry time.
+  c. Global pages are disabled for all kernel structures not
+     mapped into both kernel and userspace page tables.  This
+     feature of the MMU allows different processes to share TLB
+     entries mapping the kernel.  Losing the feature means more
+     TLB misses after a context switch.  The actual loss of
+     performance is very small, however, never exceeding 1%.
+  d. Process Context IDentifiers (PCID) is a CPU feature that
+     allows us to skip flushing the entire TLB when switching page
+     tables by setting a special bit in CR3 when the page tables
+     are changed.  This makes switching the page tables (at context
+     switch, or kernel entry/exit) cheaper.  But, on systems with
+     PCID support, the context switch code must flush both the user
+     and kernel entries out of the TLB.  The user PCID TLB flush is
+     deferred until the exit to userspace, minimizing the cost.
+     See intel.com/sdm for the gory PCID/INVPCID details.
+  e. The userspace page tables must be populated for each new
+     process.  Even without PTI, the shared kernel mappings
+     are created by copying top-level (PGD) entries into each
+     new process.  But, with PTI, there are now *two* kernel
+     mappings: one in the kernel page tables that maps everything
+     and one for the entry/exit structures.  At fork(), we need to
+     copy both.
+  f. In addition to the fork()-time copying, there must also
+     be an update to the userspace PGD any time a set_pgd() is done
+     on a PGD used to map userspace.  This ensures that the kernel
+     and userspace copies always map the same userspace
+     memory.
+  g. On systems without PCID support, each CR3 write flushes
+     the entire TLB.  That means that each syscall, interrupt
+     or exception flushes the TLB.
+  h. INVPCID is a TLB-flushing instruction which allows flushing
+     of TLB entries for non-current PCIDs.  Some systems support
+     PCIDs, but do not support INVPCID.  On these systems, addresses
+     can only be flushed from the TLB for the current PCID.  When
+     flushing a kernel address, we need to flush all PCIDs, so a
+     single kernel address flush will require a TLB-flushing CR3
+     write upon the next use of every PCID.
+
+Possible Future Work
+====================
+1. We can be more careful about not actually writing to CR3
+   unless its value is actually changed.
+2. Allow PTI to be enabled/disabled at runtime in addition to the
+   boot-time switching.
+
+Testing
+========
+
+To test stability of PTI, the following test procedure is recommended,
+ideally doing all of these in parallel:
+
+1. Set CONFIG_DEBUG_ENTRY=y
+2. Run several copies of all of the tools/testing/selftests/x86/ tests
+   (excluding MPX and protection_keys) in a loop on multiple CPUs for
+   several minutes.  These tests frequently uncover corner cases in the
+   kernel entry code.  In general, old kernels might cause these tests
+   themselves to crash, but they should never crash the kernel.
+3. Run the 'perf' tool in a mode (top or record) that generates many
+   frequent performance monitoring non-maskable interrupts (see "NMI"
+   in /proc/interrupts).  This exercises the NMI entry/exit code which
+   is known to trigger bugs in code paths that did not expect to be
+   interrupted, including nested NMIs.  Using "-c" boosts the rate of
+   NMIs, and using two -c with separate counters encourages nested NMIs
+   and less deterministic behavior.
+
+        while true; do perf record -c 10000 -e instructions,cycles -a sleep 10; done
+
+4. Launch a KVM virtual machine.
+5. Run 32-bit binaries on systems supporting the SYSCALL instruction.
+   This has been a lightly-tested code path and needs extra scrutiny.
+
+Debugging
+=========
+
+Bugs in PTI cause a few different signatures of crashes
+that are worth noting here.
+
+ * Failures of the selftests/x86 code.  Usually a bug in one of the
+   more obscure corners of entry_64.S
+ * Crashes in early boot, especially around CPU bringup.  Bugs
+   in the trampoline code or mappings cause these.
+ * Crashes at the first interrupt.  Caused by bugs in entry_64.S,
+   like screwing up a page table switch.  Also caused by
+   incorrectly mapping the IRQ handler entry code.
+ * Crashes at the first NMI.  The NMI code is separate from main
+   interrupt handlers and can have bugs that do not affect
+   normal interrupts.  Also caused by incorrectly mapping NMI
+   code.  NMIs that interrupt the entry code must be very
+   careful and can be the cause of crashes that show up when
+   running perf.
+ * Kernel crashes at the first exit to userspace.  entry_64.S
+   bugs, or failing to map some of the exit code.
+ * Crashes at first interrupt that interrupts userspace. The paths
+   in entry_64.S that return to userspace are sometimes separate
+   from the ones that return to the kernel.
+ * Double faults: overflowing the kernel stack because of page
+   faults upon page faults.  Caused by touching non-pti-mapped
+   data in the entry code, or forgetting to switch to kernel
+   CR3 before calling into C functions which are not pti-mapped.
+ * Userspace segfaults early in boot, sometimes manifesting
+   as mount(8) failing to mount the rootfs.  These have
+   tended to be TLB invalidation issues.  Usually invalidating
+   the wrong PCID, or otherwise missing an invalidation.
+
+1. https://gruss.cc/files/kaiser.pdf
+2. https://meltdownattack.com/meltdown.pdf
diff --git a/Makefile b/Makefile
index 0b037152f590..82e25459fdf9 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 VERSION = 4
 PATCHLEVEL = 4
-SUBLEVEL = 91
+SUBLEVEL = 117
 EXTRAVERSION =
 NAME = Blurry Fish Butt
 
@@ -782,6 +782,9 @@ KBUILD_CFLAGS += $(call cc-disable-warning, pointer-sign)
 # disable invalid "can't wrap" optimizations for signed / pointers
 KBUILD_CFLAGS   += $(call cc-option,-fno-strict-overflow)
 
+# Make sure -fstack-check isn't enabled (like gentoo apparently did)
+KBUILD_CFLAGS  += $(call cc-option,-fno-stack-check,)
+
 # conserve stack if available
 KBUILD_CFLAGS   += $(call cc-option,-fconserve-stack)
 
diff --git a/arch/alpha/include/asm/mmu_context.h b/arch/alpha/include/asm/mmu_context.h
index 4c51c05333c6..4cafffa80e2c 100644
--- a/arch/alpha/include/asm/mmu_context.h
+++ b/arch/alpha/include/asm/mmu_context.h
@@ -7,6 +7,7 @@
  * Copyright (C) 1996, Linus Torvalds
  */
 
+#include <linux/sched.h>
 #include <asm/machvec.h>
 #include <asm/compiler.h>
 #include <asm-generic/mm_hooks.h>
diff --git a/arch/alpha/kernel/pci_impl.h b/arch/alpha/kernel/pci_impl.h
index 2b0ac429f5eb..412bb3c24f36 100644
--- a/arch/alpha/kernel/pci_impl.h
+++ b/arch/alpha/kernel/pci_impl.h
@@ -143,7 +143,8 @@ struct pci_iommu_arena
 };
 
 #if defined(CONFIG_ALPHA_SRM) && \
-    (defined(CONFIG_ALPHA_CIA) || defined(CONFIG_ALPHA_LCA))
+    (defined(CONFIG_ALPHA_CIA) || defined(CONFIG_ALPHA_LCA) || \
+     defined(CONFIG_ALPHA_AVANTI))
 # define NEED_SRM_SAVE_RESTORE
 #else
 # undef NEED_SRM_SAVE_RESTORE
diff --git a/arch/alpha/kernel/process.c b/arch/alpha/kernel/process.c
index 84d13263ce46..8095fb2c5c94 100644
--- a/arch/alpha/kernel/process.c
+++ b/arch/alpha/kernel/process.c
@@ -273,12 +273,13 @@ copy_thread(unsigned long clone_flags, unsigned long usp,
            application calling fork.  */
         if (clone_flags & CLONE_SETTLS)
                 childti->pcb.unique = regs->r20;
+        else
+                regs->r20 = 0;  /* OSF/1 has some strange fork() semantics.  */
         childti->pcb.usp = usp ?: rdusp();
         *childregs = *regs;
         childregs->r0 = 0;
         childregs->r19 = 0;
         childregs->r20 = 1;     /* OSF/1 has some strange fork() semantics.  */
-        regs->r20 = 0;
         stack = ((struct switch_stack *) regs) - 1;
         *childstack = *stack;
         childstack->r26 = (unsigned long) ret_from_fork;
diff --git a/arch/arc/include/asm/uaccess.h b/arch/arc/include/asm/uaccess.h
index d4d8df706efa..57387b567f34 100644
--- a/arch/arc/include/asm/uaccess.h
+++ b/arch/arc/include/asm/uaccess.h
@@ -673,6 +673,7 @@ __arc_strncpy_from_user(char *dst, const char __user *src, long count)
                 return 0;
 
         __asm__ __volatile__(
+        "       mov     lp_count, %5            \n"
         "       lp      3f                      \n"
         "1:     ldb.ab  %3, [%2, 1]             \n"
         "       breq.d  %3, 0, 3f               \n"
@@ -689,8 +690,8 @@ __arc_strncpy_from_user(char *dst, const char __user *src, long count)
         "       .word   1b, 4b                  \n"
         "       .previous                       \n"
         : "+r"(res), "+r"(dst), "+r"(src), "=r"(val)
-        : "g"(-EFAULT), "l"(count)
-        : "memory");
+        : "g"(-EFAULT), "r"(count)
+        : "lp_count", "lp_start", "lp_end", "memory");
 
         return res;
 }
diff --git a/arch/arm/boot/dts/Makefile b/arch/arm/boot/dts/Makefile
index 4255537981b2..4d40f497e12c 100644
--- a/arch/arm/boot/dts/Makefile
+++ b/arch/arm/boot/dts/Makefile
@@ -530,7 +530,8 @@ dtb-$(CONFIG_SOC_DRA7XX) += \
         dra7-evm-late-attach.dtb \
         dra72-evm-late-attach.dtb \
         dra71-evm-late-attach.dtb \
-        dra76-evm-late-attach.dtb
+        dra76-evm-late-attach.dtb \
+        dra76-evm-tfp410.dtb
 dtb-$(CONFIG_ARCH_ORION5X) += \
         orion5x-lacie-d2-network.dtb \
         orion5x-lacie-ethernet-disk-mini-v2.dtb \
diff --git a/arch/arm/boot/dts/am33xx.dtsi b/arch/arm/boot/dts/am33xx.dtsi
index 1f65a9881fe9..cef4bf4a40ad 100644
--- a/arch/arm/boot/dts/am33xx.dtsi
+++ b/arch/arm/boot/dts/am33xx.dtsi
@@ -217,10 +217,11 @@
                                 };
 
                                 scm_conf: scm_conf@0 {
-                                        compatible = "syscon";
+                                        compatible = "syscon", "simple-bus";
                                         reg = <0x0 0x800>;
                                         #address-cells = <1>;
                                         #size-cells = <1>;
+                                        ranges = <0 0 0x800>;
 
                                         scm_clocks: clocks {
                                                 #address-cells = <1>;
diff --git a/arch/arm/boot/dts/armada-375.dtsi b/arch/arm/boot/dts/armada-375.dtsi
index cc952cf8ec30..024f1b75b0a3 100644
--- a/arch/arm/boot/dts/armada-375.dtsi
+++ b/arch/arm/boot/dts/armada-375.dtsi
@@ -176,9 +176,9 @@
                                 reg = <0x8000 0x1000>;
                                 cache-unified;
                                 cache-level = <2>;
-                                arm,double-linefill-incr = <1>;
+                                arm,double-linefill-incr = <0>;
                                 arm,double-linefill-wrap = <0>;
-                                arm,double-linefill = <1>;
+                                arm,double-linefill = <0>;
                                 prefetch-data = <1>;
                         };
 
diff --git a/arch/arm/boot/dts/armada-38x.dtsi b/arch/arm/boot/dts/armada-38x.dtsi
index e8b7f6726772..bf20918f1fad 100644
--- a/arch/arm/boot/dts/armada-38x.dtsi
+++ b/arch/arm/boot/dts/armada-38x.dtsi
@@ -143,9 +143,9 @@
                                 reg = <0x8000 0x1000>;
                                 cache-unified;
                                 cache-level = <2>;
-                                arm,double-linefill-incr = <1>;
+                                arm,double-linefill-incr = <0>;
                                 arm,double-linefill-wrap = <0>;
-                                arm,double-linefill = <1>;
+                                arm,double-linefill = <0>;
                                 prefetch-data = <1>;
                         };
 
diff --git a/arch/arm/boot/dts/armada-39x.dtsi b/arch/arm/boot/dts/armada-39x.dtsi
index dc6efd386dbc..e67f1fd7a4d1 100644
--- a/arch/arm/boot/dts/armada-39x.dtsi
+++ b/arch/arm/boot/dts/armada-39x.dtsi
@@ -104,9 +104,9 @@
                                 reg = <0x8000 0x1000>;
                                 cache-unified;
                                 cache-level = <2>;
-                                arm,double-linefill-incr = <1>;
+                                arm,double-linefill-incr = <0>;
                                 arm,double-linefill-wrap = <0>;
-                                arm,double-linefill = <1>;
+                                arm,double-linefill = <0>;
                                 prefetch-data = <1>;
                         };
 
diff --git a/arch/arm/boot/dts/dm814x.dtsi b/arch/arm/boot/dts/dm814x.dtsi
index 63f109796046..fc06801776cd 100644
--- a/arch/arm/boot/dts/dm814x.dtsi
+++ b/arch/arm/boot/dts/dm814x.dtsi
@@ -138,7 +138,7 @@
                         };
 
                         uart1: uart@20000 {
-                                compatible = "ti,omap3-uart";
+                                compatible = "ti,am3352-uart", "ti,omap3-uart";
                                 ti,hwmods = "uart1";
                                 reg = <0x20000 0x2000>;
                                 clock-frequency = <48000000>;
@@ -148,7 +148,7 @@
                         };
 
                         uart2: uart@22000 {
-                                compatible = "ti,omap3-uart";
+                                compatible = "ti,am3352-uart", "ti,omap3-uart";
                                 ti,hwmods = "uart2";
                                 reg = <0x22000 0x2000>;
                                 clock-frequency = <48000000>;
@@ -158,7 +158,7 @@
                         };
 
                         uart3: uart@24000 {
-                                compatible = "ti,omap3-uart";
+                                compatible = "ti,am3352-uart", "ti,omap3-uart";
                                 ti,hwmods = "uart3";
                                 reg = <0x24000 0x2000>;
                                 clock-frequency = <48000000>;
@@ -189,10 +189,11 @@
                                 ranges = <0 0x160000 0x16d000>;
 
                                 scm_conf: scm_conf@0 {
-                                        compatible = "syscon";
+                                        compatible = "syscon", "simple-bus";
                                         reg = <0x0 0x800>;
                                         #address-cells = <1>;
                                         #size-cells = <1>;
+                                        ranges = <0 0 0x800>;
 
                                         scm_clocks: clocks {
                                                 #address-cells = <1>;
diff --git a/arch/arm/boot/dts/dm816x.dtsi b/arch/arm/boot/dts/dm816x.dtsi
index 4fa3a4cf3ac5..336ded693208 100644
--- a/arch/arm/boot/dts/dm816x.dtsi
+++ b/arch/arm/boot/dts/dm816x.dtsi
@@ -351,7 +351,7 @@
                 };
 
                 uart1: uart@48020000 {
-                        compatible = "ti,omap3-uart";
+                        compatible = "ti,am3352-uart", "ti,omap3-uart";
                         ti,hwmods = "uart1";
                         reg = <0x48020000 0x2000>;
                         clock-frequency = <48000000>;
@@ -361,7 +361,7 @@
                 };
 
                 uart2: uart@48022000 {
-                        compatible = "ti,omap3-uart";
+                        compatible = "ti,am3352-uart", "ti,omap3-uart";
                         ti,hwmods = "uart2";
                         reg = <0x48022000 0x2000>;
                         clock-frequency = <48000000>;
@@ -371,7 +371,7 @@
                 };
 
                 uart3: uart@48024000 {
-                        compatible = "ti,omap3-uart";
+                        compatible = "ti,am3352-uart", "ti,omap3-uart";
                         ti,hwmods = "uart3";
                         reg = <0x48024000 0x2000>;
                         clock-frequency = <48000000>;
diff --git a/arch/arm/boot/dts/dra7-evm-common.dtsi b/arch/arm/boot/dts/dra7-evm-common.dtsi
index 1f9008d8e14e..c1bee515079f 100644
--- a/arch/arm/boot/dts/dra7-evm-common.dtsi
+++ b/arch/arm/boot/dts/dra7-evm-common.dtsi
@@ -292,3 +292,19 @@
 &pcie1_rc {
         status = "okay";
 };
+
+&mmc4 {
+        bus-width = <4>;
+        cap-power-off-card;
+        keep-power-in-suspend;
+        ti,non-removable;
+
+        #address-cells = <1>;
+        #size-cells = <0>;
+        wlcore: wlcore@2 {
+                compatible = "ti,wl1835";
+                reg = <2>;
+                interrupt-parent = <&gpio5>;
+                interrupts = <7 IRQ_TYPE_EDGE_RISING>;
+        };
+};
diff --git a/arch/arm/boot/dts/dra7-evm.dts b/arch/arm/boot/dts/dra7-evm.dts
index 3f27909b7b46..25070a073a94 100644
--- a/arch/arm/boot/dts/dra7-evm.dts
+++ b/arch/arm/boot/dts/dra7-evm.dts
@@ -907,10 +907,6 @@ i2c_p3_exp: &i2c2 {
 &mmc4 {
         status = "okay";
         vmmc-supply = <&vmmcwl_fixed>;
-        bus-width = <4>;
-        cap-power-off-card;
-        keep-power-in-suspend;
-        ti,non-removable;
 
         pinctrl-names = "default-rev11", "default", "hs-rev11", "hs", "sdr12-rev11", "sdr12", "sdr25-rev11", "sdr25";
         pinctrl-0 = <&mmc4_pins_default &mmc4_iodelay_ds_rev11_conf>;
@@ -921,15 +917,6 @@ i2c_p3_exp: &i2c2 {
         pinctrl-5 = <&mmc4_pins_sdr12 &mmc4_iodelay_sdr12_hs_sdr25_rev20_conf>;
         pinctrl-6 = <&mmc4_pins_sdr25 &mmc4_iodelay_sdr12_hs_sdr25_rev11_conf>;
         pinctrl-7 = <&mmc4_pins_sdr25 &mmc4_iodelay_sdr12_hs_sdr25_rev20_conf>;
-
-        #address-cells = <1>;
-        #size-cells = <0>;
-        wlcore: wlcore@2 {
-                compatible = "ti,wl1835";
-                reg = <2>;
-                interrupt-parent = <&gpio5>;
-                interrupts = <7 IRQ_TYPE_LEVEL_HIGH>;
-        };
 };
 
 &oppdm_mpu {
diff --git a/arch/arm/boot/dts/dra7.dtsi b/arch/arm/boot/dts/dra7.dtsi
index 4fa2eedc71f4..9f49f96e6f93 100644
--- a/arch/arm/boot/dts/dra7.dtsi
+++ b/arch/arm/boot/dts/dra7.dtsi
@@ -308,6 +308,7 @@
                                 device_type = "pci";
                                 ranges = <0x81000000 0 0          0x03000 0 0x00010000
                                           0x82000000 0 0x20013000 0x13000 0 0xffed000>;
+                                bus-range = <0x00 0xff>;
                                 #interrupt-cells = <1>;
                                 num-lanes = <1>;
                                 linux,pci-domain = <0>;
@@ -360,6 +361,7 @@
                                 device_type = "pci";
                                 ranges = <0x81000000 0 0          0x03000 0 0x00010000
                                           0x82000000 0 0x30013000 0x13000 0 0xffed000>;
+                                bus-range = <0x00 0xff>;
                                 #interrupt-cells = <1>;
                                 num-lanes = <1>;
                                 linux,pci-domain = <1>;
@@ -2386,4 +2388,24 @@
         polling-delay = <500>; /* milliseconds */
 };
 
+&cpu_crit {
+        temperature = <120000>; /* milli Celsius */
+};
+
+&core_crit {
+        temperature = <120000>; /* milli Celsius */
+};
+
+&gpu_crit {
+        temperature = <120000>; /* milli Celsius */
+};
+
+&dspeve_crit {
+        temperature = <120000>; /* milli Celsius */
+};
+
+&iva_crit {
+        temperature = <120000>; /* milli Celsius */
+};
+
 /include/ "dra7xx-clocks.dtsi"
diff --git a/arch/arm/boot/dts/dra76-evm-tfp410.dts b/arch/arm/boot/dts/dra76-evm-tfp410.dts
new file mode 100644
index 000000000000..77390c0277ce
--- /dev/null
+++ b/arch/arm/boot/dts/dra76-evm-tfp410.dts
@@ -0,0 +1,105 @@
+/*
+ * Copyright (C) 2017 Texas Instruments Incorporated - http://www.ti.com/
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+#include <dra76-evm.dts>
+
+/ {
+        tfp410: encoder@0 {
+                compatible = "ti,tfp410";
+
+                ports {
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+
+                        port@0 {
+                                reg = <0>;
+                                tfp410_in: endpoint@0 {
+                                        remote-endpoint = <&dpi_out>;
+                                };
+                        };
+
+                        port@1 {
+                                reg = <1>;
+
+                                tfp410_out: endpoint@0 {
+                                        remote-endpoint = <&dvi_connector_in>;
+                                };
+                        };
+                };
+        };
+
+        dvi0: connector@0 {
+                compatible = "dvi-connector";
+                label = "dvi";
+
+                digital;
+
+                ddc-i2c-bus = <&i2c3>;
+
+                hpd-gpios = <&gpio1 2 GPIO_ACTIVE_HIGH>;        /* wakeup2/sys_nirq2/gpio1_2 HPD */
+
+                port {
+                        dvi_connector_in: endpoint {
+                                remote-endpoint = <&tfp410_out>;
+                        };
+                };
+        };
+};
+
+&dss {
+        status = "ok";
+        ports {
+                #address-cells = <1>;
+                #size-cells = <0>;
+                status = "ok";
+
+                port {
+                        reg = <0>;
+
+                        dpi_out: endpoint {
+                                remote-endpoint = <&tfp410_in>;
+                                data-lines = <24>;
+                        };
+                };
+        };
+};
+
+&gpio3 {
+        p1 {
+                /* GPIO3_1 CON_LCD_PWR_DN */
+                /* This affects the TFP410 and the USB */
+                gpio-hog;
+                gpios = <1 GPIO_ACTIVE_HIGH>;
+                output-low;
+                line-name = "CON_LCD_PWR_DN";
+        };
+};
+
+&i2c3 {
+        clock-frequency = <100000>;
+
+        pcf_tfp: pcf8757@20 {
+                compatible = "ti,pcf8575", "nxp,pcf8575";
+                reg = <0x27>;
+                gpio-controller;
+                #gpio-cells = <2>;
+
+                p2 {
+                        gpio-hog;
+                        gpios = <2 GPIO_ACTIVE_HIGH>;
+                        output-high;
+                        line-name = "ct_hpd";
+                };
+
+                p3 {
+                        gpio-hog;
+                        gpios = <3 GPIO_ACTIVE_HIGH>;
+                        output-high;
+                        line-name = "ls_oe";
+                };
+        };
+};
diff --git a/arch/arm/boot/dts/dra76-evm.dts b/arch/arm/boot/dts/dra76-evm.dts
index c852a76ec21d..9012e7677e52 100644
--- a/arch/arm/boot/dts/dra76-evm.dts
+++ b/arch/arm/boot/dts/dra76-evm.dts
@@ -119,6 +119,16 @@
                 vin-supply = <&smps5_reg>;
         };
 
+        vmmcwl_fixed: fixedregulator-mmcwl {
+                compatible = "regulator-fixed";
+                regulator-name = "vmmcwl_fixed";
+                regulator-min-microvolt = <1800000>;
+                regulator-max-microvolt = <1800000>;
+                gpio = <&gpio5 8 0>;    /* gpio5_8 */
+                startup-delay-us = <70000>;
+                enable-active-high;
+        };
+
         vtt_fixed: fixedregulator-vtt {
                 compatible = "regulator-fixed";
                 regulator-name = "vtt_fixed";
@@ -147,6 +157,7 @@
                 compatible = "ti,tps65917";
                 reg = <0x58>;
                 ti,system-power-controller;
+                ti,palmas-override-powerhold;
                 interrupt-controller;
                 #interrupt-cells = <2>;
 
@@ -427,6 +438,17 @@
         pinctrl-3 = <&mmc2_pins_hs200 &mmc2_iodelay_hs200_conf>;
 };
 
+&mmc4 {
+        status = "okay";
+        vmmc-supply = <&vmmcwl_fixed>;
+
+        pinctrl-names = "default", "hs", "sdr12", "sdr25";
+        pinctrl-0 = <&mmc4_pins_hs &mmc4_iodelay_default_conf>;
+        pinctrl-1 = <&mmc4_pins_hs &mmc4_iodelay_manual1_conf>;
+        pinctrl-2 = <&mmc4_pins_hs &mmc4_iodelay_manual1_conf>;
+        pinctrl-3 = <&mmc4_pins_hs &mmc4_iodelay_manual1_conf>;
+};
+
 &oppdm_mpu {
         vdd-supply = <&buck10_reg>;
 };
diff --git a/arch/arm/boot/dts/kirkwood-openblocks_a7.dts b/arch/arm/boot/dts/kirkwood-openblocks_a7.dts
index d5e3bc518968..d57f48543f76 100644
--- a/arch/arm/boot/dts/kirkwood-openblocks_a7.dts
+++ b/arch/arm/boot/dts/kirkwood-openblocks_a7.dts
@@ -53,7 +53,8 @@
                 };
 
                 pinctrl: pin-controller@10000 {
-                        pinctrl-0 = <&pmx_dip_switches &pmx_gpio_header>;
+                        pinctrl-0 = <&pmx_dip_switches &pmx_gpio_header
+                                     &pmx_gpio_header_gpo>;
                         pinctrl-names = "default";
 
                         pmx_uart0: pmx-uart0 {
@@ -85,11 +86,16 @@
                          * ground.
                          */
                         pmx_gpio_header: pmx-gpio-header {
-                                marvell,pins = "mpp17", "mpp7", "mpp29", "mpp28",
+                                marvell,pins = "mpp17", "mpp29", "mpp28",
                                                "mpp35", "mpp34", "mpp40";
                                 marvell,function = "gpio";
                         };
 
+                        pmx_gpio_header_gpo: pxm-gpio-header-gpo {
+                                marvell,pins = "mpp7";
+                                marvell,function = "gpo";
+                        };
+
                         pmx_gpio_init: pmx-init {
                                 marvell,pins = "mpp38";
                                 marvell,function = "gpio";
diff --git a/arch/arm/boot/dts/logicpd-torpedo-37xx-devkit.dts b/arch/arm/boot/dts/logicpd-torpedo-37xx-devkit.dts
index 059de2f8b024..3c8078876508 100644
--- a/arch/arm/boot/dts/logicpd-torpedo-37xx-devkit.dts
+++ b/arch/arm/boot/dts/logicpd-torpedo-37xx-devkit.dts
@@ -89,7 +89,7 @@
         interrupts-extended = <&intc 83 &omap3_pmx_core 0x11a>;
         pinctrl-names = "default";
         pinctrl-0 = <&mmc1_pins &mmc1_cd>;
-        cd-gpios = <&gpio4 31 IRQ_TYPE_LEVEL_LOW>;              /* gpio127 */
+        cd-gpios = <&gpio4 31 GPIO_ACTIVE_LOW>;         /* gpio127 */
         vmmc-supply = <&vmmc1>;
         bus-width = <4>;
         cap-power-off-card;
diff --git a/arch/arm/boot/dts/s5pv210.dtsi b/arch/arm/boot/dts/s5pv210.dtsi
index 8344a0ee2b86..b03fe747b98c 100644
--- a/arch/arm/boot/dts/s5pv210.dtsi
+++ b/arch/arm/boot/dts/s5pv210.dtsi
@@ -461,6 +461,7 @@
                         compatible = "samsung,exynos4210-ohci";
                         reg = <0xec300000 0x100>;
                         interrupts = <23>;
+                        interrupt-parent = <&vic1>;
                         clocks = <&clocks CLK_USB_HOST>;
                         clock-names = "usbhost";
                         #address-cells = <1>;
diff --git a/arch/arm/boot/dts/spear1310-evb.dts b/arch/arm/boot/dts/spear1310-evb.dts
index e48857249ce7..3d83992efd90 100644
--- a/arch/arm/boot/dts/spear1310-evb.dts
+++ b/arch/arm/boot/dts/spear1310-evb.dts
@@ -349,7 +349,7 @@
                         spi0: spi@e0100000 {
                                 status = "okay";
                                 num-cs = <3>;
-                                cs-gpios = <&gpio1 7 0>, <&spics 0>, <&spics 1>;
+                                cs-gpios = <&gpio1 7 0>, <&spics 0 0>, <&spics 1 0>;
 
                                 stmpe610@0 {
                                         compatible = "st,stmpe610";
diff --git a/arch/arm/boot/dts/spear1340.dtsi b/arch/arm/boot/dts/spear1340.dtsi
index df2232d767ed..6361cbfcbe5e 100644
--- a/arch/arm/boot/dts/spear1340.dtsi
+++ b/arch/arm/boot/dts/spear1340.dtsi
@@ -141,8 +141,8 @@
                                 reg = <0xb4100000 0x1000>;
                                 interrupts = <0 105 0x4>;
                                 status = "disabled";
-                                dmas = <&dwdma0 0x600 0 0 1>, /* 0xC << 11 */
-                                        <&dwdma0 0x680 0 1 0>; /* 0xD << 7 */
+                                dmas = <&dwdma0 12 0 1>,
+                                        <&dwdma0 13 1 0>;
                                 dma-names = "tx", "rx";
                         };
 
diff --git a/arch/arm/boot/dts/spear13xx.dtsi b/arch/arm/boot/dts/spear13xx.dtsi
index 14594ce8c18a..8fd8a3328acb 100644
--- a/arch/arm/boot/dts/spear13xx.dtsi
+++ b/arch/arm/boot/dts/spear13xx.dtsi
@@ -100,7 +100,7 @@
                         reg = <0xb2800000 0x1000>;
                         interrupts = <0 29 0x4>;
                         status = "disabled";
-                        dmas = <&dwdma0 0 0 0 0>;
+                        dmas = <&dwdma0 0 0 0>;
                         dma-names = "data";
                 };
 
@@ -288,8 +288,8 @@
                                 #size-cells = <0>;
                                 interrupts = <0 31 0x4>;
                                 status = "disabled";
-                                dmas = <&dwdma0 0x2000 0 0 0>, /* 0x4 << 11 */
-                                        <&dwdma0 0x0280 0 0 0>;  /* 0x5 << 7 */
+                                dmas = <&dwdma0 4 0 0>,
+                                        <&dwdma0 5 0 0>;
                                 dma-names = "tx", "rx";
                         };
 
diff --git a/arch/arm/boot/dts/spear600.dtsi b/arch/arm/boot/dts/spear600.dtsi
index 9f60a7b6a42b..bd379034993c 100644
--- a/arch/arm/boot/dts/spear600.dtsi
+++ b/arch/arm/boot/dts/spear600.dtsi
@@ -194,6 +194,7 @@
                         rtc@fc900000 {
                                 compatible = "st,spear600-rtc";
                                 reg = <0xfc900000 0x1000>;
+                                interrupt-parent = <&vic0>;
                                 interrupts = <10>;
                                 status = "disabled";
                         };
diff --git a/arch/arm/boot/dts/stih407.dtsi b/arch/arm/boot/dts/stih407.dtsi
index d60f0d8add26..e4b508ce38a2 100644
--- a/arch/arm/boot/dts/stih407.dtsi
+++ b/arch/arm/boot/dts/stih407.dtsi
@@ -8,6 +8,7 @@
  */
 #include "stih407-clock.dtsi"
 #include "stih407-family.dtsi"
+#include <dt-bindings/gpio/gpio.h>
 / {
         soc {
                 sti-display-subsystem {
@@ -112,7 +113,7 @@
                                          <&clk_s_d2_quadfs 0>,
                                          <&clk_s_d2_quadfs 1>;
 
-                                hdmi,hpd-gpio = <&pio5 3>;
+                                hdmi,hpd-gpio = <&pio5 3 GPIO_ACTIVE_LOW>;
                                 reset-names = "hdmi";
                                 resets = <&softreset STIH407_HDMI_TX_PHY_SOFTRESET>;
                                 ddc = <&hdmiddc>;
diff --git a/arch/arm/boot/dts/stih410.dtsi b/arch/arm/boot/dts/stih410.dtsi
index 40318869c733..3c32fb8cdcac 100644
--- a/arch/arm/boot/dts/stih410.dtsi
+++ b/arch/arm/boot/dts/stih410.dtsi
@@ -9,6 +9,7 @@
 #include "stih410-clock.dtsi"
 #include "stih407-family.dtsi"
 #include "stih410-pinctrl.dtsi"
+#include <dt-bindings/gpio/gpio.h>
 / {
         aliases {
                 bdisp0 = &bdisp0;
@@ -203,7 +204,7 @@
                                          <&clk_s_d2_quadfs 0>,
                                          <&clk_s_d2_quadfs 1>;
 
-                                hdmi,hpd-gpio = <&pio5 3>;
+                                hdmi,hpd-gpio = <&pio5 3 GPIO_ACTIVE_LOW>;
                                 reset-names = "hdmi";
                                 resets = <&softreset STIH407_HDMI_TX_PHY_SOFTRESET>;
                                 ddc = <&hdmiddc>;
diff --git a/arch/arm/configs/omap2plus_defconfig b/arch/arm/configs/omap2plus_defconfig
index c5e1943e5427..09ebd37e01e0 100644
--- a/arch/arm/configs/omap2plus_defconfig
+++ b/arch/arm/configs/omap2plus_defconfig
@@ -221,6 +221,7 @@ CONFIG_SERIO=m
 CONFIG_SERIAL_8250=y
 CONFIG_SERIAL_8250_CONSOLE=y
 CONFIG_SERIAL_8250_NR_UARTS=32
+CONFIG_SERIAL_8250_RUNTIME_UARTS=6
 CONFIG_SERIAL_8250_EXTENDED=y
 CONFIG_SERIAL_8250_MANY_PORTS=y
 CONFIG_SERIAL_8250_SHARE_IRQ=y
diff --git a/arch/arm/crypto/aesbs-glue.c b/arch/arm/crypto/aesbs-glue.c
index 6d685298690e..648d5fac9cbf 100644
--- a/arch/arm/crypto/aesbs-glue.c
+++ b/arch/arm/crypto/aesbs-glue.c
@@ -357,7 +357,7 @@ static struct crypto_alg aesbs_algs[] = { {
 }, {
         .cra_name               = "cbc(aes)",
         .cra_driver_name        = "cbc-aes-neonbs",
-        .cra_priority           = 300,
+        .cra_priority           = 250,
         .cra_flags              = CRYPTO_ALG_TYPE_ABLKCIPHER|CRYPTO_ALG_ASYNC,
         .cra_blocksize          = AES_BLOCK_SIZE,
         .cra_ctxsize            = sizeof(struct async_helper_ctx),
@@ -377,7 +377,7 @@ static struct crypto_alg aesbs_algs[] = { {
 }, {
         .cra_name               = "ctr(aes)",
         .cra_driver_name        = "ctr-aes-neonbs",
-        .cra_priority           = 300,
+        .cra_priority           = 250,
         .cra_flags              = CRYPTO_ALG_TYPE_ABLKCIPHER|CRYPTO_ALG_ASYNC,
         .cra_blocksize          = 1,
         .cra_ctxsize            = sizeof(struct async_helper_ctx),
@@ -397,7 +397,7 @@ static struct crypto_alg aesbs_algs[] = { {
 }, {
         .cra_name               = "xts(aes)",
         .cra_driver_name        = "xts-aes-neonbs",
-        .cra_priority           = 300,
+        .cra_priority           = 250,
         .cra_flags              = CRYPTO_ALG_TYPE_ABLKCIPHER|CRYPTO_ALG_ASYNC,
         .cra_blocksize          = AES_BLOCK_SIZE,
         .cra_ctxsize            = sizeof(struct async_helper_ctx),
diff --git a/arch/arm/include/asm/Kbuild b/arch/arm/include/asm/Kbuild
index bd425302c97a..628a38a11a70 100644
--- a/arch/arm/include/asm/Kbuild
+++ b/arch/arm/include/asm/Kbuild
@@ -36,4 +36,3 @@ generic-y += termbits.h
 generic-y += termios.h
 generic-y += timex.h
 generic-y += trace_clock.h
-generic-y += unaligned.h
diff --git a/arch/arm/include/asm/assembler.h b/arch/arm/include/asm/assembler.h
index b2bc8e11471d..2c16d9e7c03c 100644
--- a/arch/arm/include/asm/assembler.h
+++ b/arch/arm/include/asm/assembler.h
@@ -512,4 +512,22 @@ THUMB(	orr	\reg , \reg , #PSR_T_BIT	)
 #endif
         .endm
 
+        .macro  bug, msg, line
+#ifdef CONFIG_THUMB2_KERNEL
+1:      .inst   0xde02
+#else
+1:      .inst   0xe7f001f2
+#endif
+#ifdef CONFIG_DEBUG_BUGVERBOSE
+        .pushsection .rodata.str, "aMS", %progbits, 1
+2:      .asciz  "\msg"
+        .popsection
+        .pushsection __bug_table, "aw"
+        .align  2
+        .word   1b, 2b
+        .hword  \line
+        .popsection
+#endif
+        .endm
+
 #endif /* __ASM_ASSEMBLER_H__ */
diff --git a/arch/arm/include/asm/elf.h b/arch/arm/include/asm/elf.h
index f13ae153fb24..d2315ffd8f12 100644
--- a/arch/arm/include/asm/elf.h
+++ b/arch/arm/include/asm/elf.h
@@ -112,8 +112,12 @@ int dump_task_regs(struct task_struct *t, elf_gregset_t *elfregs);
 #define CORE_DUMP_USE_REGSET
 #define ELF_EXEC_PAGESIZE       4096
 
-/* This is the base location for PIE (ET_DYN with INTERP) loads. */
-#define ELF_ET_DYN_BASE         0x400000UL
+/* This is the location that an ET_DYN program is loaded if exec'ed.  Typical
+   use of this is to invoke "./ld.so someprog" to test out a new version of
+   the loader.  We need to make sure that it is out of the way of the program
+   that it will "exec", and that there is sufficient room for the brk.  */
+
+#define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
 
 /* When the program starts, a1 contains a pointer to a function to be 
    registered with atexit, as per the SVR4 ABI.  A value of 0 means we 
diff --git a/arch/arm/include/asm/kvm_arm.h b/arch/arm/include/asm/kvm_arm.h
index e22089fb44dc..48e6ee2d4f5c 100644
--- a/arch/arm/include/asm/kvm_arm.h
+++ b/arch/arm/include/asm/kvm_arm.h
@@ -161,8 +161,7 @@
 #else
 #define VTTBR_X         (5 - KVM_T0SZ)
 #endif
-#define VTTBR_BADDR_SHIFT (VTTBR_X - 1)
-#define VTTBR_BADDR_MASK  (((_AC(1, ULL) << (40 - VTTBR_X)) - 1) << VTTBR_BADDR_SHIFT)
+#define VTTBR_BADDR_MASK  (((1LLU << (40 - VTTBR_X)) - 1) << VTTBR_X)
 #define VTTBR_VMID_SHIFT  _AC(48, ULL)
 #define VTTBR_VMID_MASK(size)   (_AT(u64, (1 << size) - 1) << VTTBR_VMID_SHIFT)
 
@@ -209,6 +208,7 @@
 #define HSR_EC_IABT_HYP (0x21)
 #define HSR_EC_DABT     (0x24)
 #define HSR_EC_DABT_HYP (0x25)
+#define HSR_EC_MAX      (0x3f)
 
 #define HSR_WFI_IS_WFE          (_AC(1, UL) << 0)
 
diff --git a/arch/arm/include/asm/mmu_context.h b/arch/arm/include/asm/mmu_context.h
index 9b32f76bb0dd..10f662498eb7 100644
--- a/arch/arm/include/asm/mmu_context.h
+++ b/arch/arm/include/asm/mmu_context.h
@@ -61,6 +61,7 @@ static inline void check_and_switch_context(struct mm_struct *mm,
                 cpu_switch_mm(mm->pgd, mm);
 }
 
+#ifndef MODULE
 #define finish_arch_post_lock_switch \
         finish_arch_post_lock_switch
 static inline void finish_arch_post_lock_switch(void)
@@ -82,6 +83,7 @@ static inline void finish_arch_post_lock_switch(void)
                 preempt_enable_no_resched();
         }
 }
+#endif /* !MODULE */
 
 #endif  /* CONFIG_MMU */
 
diff --git a/arch/arm/include/asm/unaligned.h b/arch/arm/include/asm/unaligned.h
new file mode 100644
index 000000000000..ab905ffcf193
--- /dev/null
+++ b/arch/arm/include/asm/unaligned.h
@@ -0,0 +1,27 @@
+#ifndef __ASM_ARM_UNALIGNED_H
+#define __ASM_ARM_UNALIGNED_H
+
+/*
+ * We generally want to set CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS on ARMv6+,
+ * but we don't want to use linux/unaligned/access_ok.h since that can lead
+ * to traps on unaligned stm/ldm or strd/ldrd.
+ */
+#include <asm/byteorder.h>
+
+#if defined(__LITTLE_ENDIAN)
+# include <linux/unaligned/le_struct.h>
+# include <linux/unaligned/be_byteshift.h>
+# include <linux/unaligned/generic.h>
+# define get_unaligned  __get_unaligned_le
+# define put_unaligned  __put_unaligned_le
+#elif defined(__BIG_ENDIAN)
+# include <linux/unaligned/be_struct.h>
+# include <linux/unaligned/le_byteshift.h>
+# include <linux/unaligned/generic.h>
+# define get_unaligned  __get_unaligned_be
+# define put_unaligned  __put_unaligned_be
+#else
+# error need to define endianess
+#endif
+
+#endif /* __ASM_ARM_UNALIGNED_H */
diff --git a/arch/arm/kernel/entry-header.S b/arch/arm/kernel/entry-header.S
index 0d22ad206d52..6d243e830516 100644
--- a/arch/arm/kernel/entry-header.S
+++ b/arch/arm/kernel/entry-header.S
@@ -295,6 +295,8 @@
         mov     r2, sp
         ldr     r1, [r2, #\offset + S_PSR]      @ get calling cpsr
         ldr     lr, [r2, #\offset + S_PC]!      @ get pc
+        tst     r1, #PSR_I_BIT | 0x0f
+        bne     1f
         msr     spsr_cxsf, r1                   @ save in spsr_svc
 #if defined(CONFIG_CPU_V6) || defined(CONFIG_CPU_32v6K)
         @ We must avoid clrex due to Cortex-A15 erratum #830321
@@ -309,6 +311,7 @@
                                                 @ after ldm {}^
         add     sp, sp, #\offset + S_FRAME_SIZE
         movs    pc, lr                          @ return & move spsr_svc into cpsr
+1:      bug     "Returning to usermode but unexpected PSR bits set?", \@
 #elif defined(CONFIG_CPU_V7M)
         @ V7M restore.
         @ Note that we don't need to do clrex here as clearing the local
@@ -324,6 +327,8 @@
         ldr     r1, [sp, #\offset + S_PSR]      @ get calling cpsr
         ldr     lr, [sp, #\offset + S_PC]       @ get pc
         add     sp, sp, #\offset + S_SP
+        tst     r1, #PSR_I_BIT | 0x0f
+        bne     1f
         msr     spsr_cxsf, r1                   @ save in spsr_svc
 
         @ We must avoid clrex due to Cortex-A15 erratum #830321
@@ -336,6 +341,7 @@
         .endif
         add     sp, sp, #S_FRAME_SIZE - S_SP
         movs    pc, lr                          @ return & move spsr_svc into cpsr
+1:      bug     "Returning to usermode but unexpected PSR bits set?", \@
 #endif  /* !CONFIG_THUMB2_KERNEL */
         .endm
 
diff --git a/arch/arm/kernel/traps.c b/arch/arm/kernel/traps.c
index bc698383e822..c92b535150a0 100644
--- a/arch/arm/kernel/traps.c
+++ b/arch/arm/kernel/traps.c
@@ -132,30 +132,26 @@ static void dump_mem(const char *lvl, const char *str, unsigned long bottom,
         set_fs(fs);
 }
 
-static void dump_instr(const char *lvl, struct pt_regs *regs)
+static void __dump_instr(const char *lvl, struct pt_regs *regs)
 {
         unsigned long addr = instruction_pointer(regs);
         const int thumb = thumb_mode(regs);
         const int width = thumb ? 4 : 8;
-        mm_segment_t fs;
         char str[sizeof("00000000 ") * 5 + 2 + 1], *p = str;
         int i;
 
         /*
-         * We need to switch to kernel mode so that we can use __get_user
-         * to safely read from kernel space.  Note that we now dump the
-         * code first, just in case the backtrace kills us.
+         * Note that we now dump the code first, just in case the backtrace
+         * kills us.
          */
-        fs = get_fs();
-        set_fs(KERNEL_DS);
 
         for (i = -4; i < 1 + !!thumb; i++) {
                 unsigned int val, bad;
 
                 if (thumb)
-                        bad = __get_user(val, &((u16 *)addr)[i]);
+                        bad = get_user(val, &((u16 *)addr)[i]);
                 else
-                        bad = __get_user(val, &((u32 *)addr)[i]);
+                        bad = get_user(val, &((u32 *)addr)[i]);
 
                 if (!bad)
                         p += sprintf(p, i == 0 ? "(%0*x) " : "%0*x ",
@@ -166,8 +162,20 @@ static void dump_instr(const char *lvl, struct pt_regs *regs)
                 }
         }
         printk("%sCode: %s\n", lvl, str);
+}
 
-        set_fs(fs);
+static void dump_instr(const char *lvl, struct pt_regs *regs)
+{
+        mm_segment_t fs;
+
+        if (!user_mode(regs)) {
+                fs = get_fs();
+                set_fs(KERNEL_DS);
+                __dump_instr(lvl, regs);
+                set_fs(fs);
+        } else {
+                __dump_instr(lvl, regs);
+        }
 }
 
 #ifdef CONFIG_ARM_UNWIND
diff --git a/arch/arm/kvm/handle_exit.c b/arch/arm/kvm/handle_exit.c
index 95f12b2ccdcb..05b2f8294968 100644
--- a/arch/arm/kvm/handle_exit.c
+++ b/arch/arm/kvm/handle_exit.c
@@ -45,7 +45,7 @@ static int handle_hvc(struct kvm_vcpu *vcpu, struct kvm_run *run)
 
         ret = kvm_psci_call(vcpu);
         if (ret < 0) {
-                kvm_inject_undefined(vcpu);
+                vcpu_set_reg(vcpu, 0, ~0UL);
                 return 1;
         }
 
@@ -54,7 +54,16 @@ static int handle_hvc(struct kvm_vcpu *vcpu, struct kvm_run *run)
 
 static int handle_smc(struct kvm_vcpu *vcpu, struct kvm_run *run)
 {
-        kvm_inject_undefined(vcpu);
+        /*
+         * "If an SMC instruction executed at Non-secure EL1 is
+         * trapped to EL2 because HCR_EL2.TSC is 1, the exception is a
+         * Trap exception, not a Secure Monitor Call exception [...]"
+         *
+         * We need to advance the PC after the trap, as it would
+         * otherwise return to the same address...
+         */
+        vcpu_set_reg(vcpu, 0, ~0UL);
+        kvm_skip_instr(vcpu, kvm_vcpu_trap_il_is32bit(vcpu));
         return 1;
 }
 
@@ -100,7 +109,19 @@ static int kvm_handle_wfx(struct kvm_vcpu *vcpu, struct kvm_run *run)
         return 1;
 }
 
+static int kvm_handle_unknown_ec(struct kvm_vcpu *vcpu, struct kvm_run *run)
+{
+        u32 hsr = kvm_vcpu_get_hsr(vcpu);
+
+        kvm_pr_unimpl("Unknown exception class: hsr: %#08x\n",
+                      hsr);
+
+        kvm_inject_undefined(vcpu);
+        return 1;
+}
+
 static exit_handle_fn arm_exit_handlers[] = {
+        [0 ... HSR_EC_MAX]      = kvm_handle_unknown_ec,
         [HSR_EC_WFI]            = kvm_handle_wfx,
         [HSR_EC_CP15_32]        = kvm_handle_cp15_32,
         [HSR_EC_CP15_64]        = kvm_handle_cp15_64,
@@ -122,13 +143,6 @@ static exit_handle_fn kvm_get_exit_handler(struct kvm_vcpu *vcpu)
 {
         u8 hsr_ec = kvm_vcpu_trap_get_class(vcpu);
 
-        if (hsr_ec >= ARRAY_SIZE(arm_exit_handlers) ||
-            !arm_exit_handlers[hsr_ec]) {
-                kvm_err("Unknown exception class: hsr: %#08x\n",
-                        (unsigned int)kvm_vcpu_get_hsr(vcpu));
-                BUG();
-        }
-
         return arm_exit_handlers[hsr_ec];
 }
 
diff --git a/arch/arm/kvm/mmio.c b/arch/arm/kvm/mmio.c
index 3a10c9f1d0a4..387ee2a11e36 100644
--- a/arch/arm/kvm/mmio.c
+++ b/arch/arm/kvm/mmio.c
@@ -113,7 +113,7 @@ int kvm_handle_mmio_return(struct kvm_vcpu *vcpu, struct kvm_run *run)
                 }
 
                 trace_kvm_mmio(KVM_TRACE_MMIO_READ, len, run->mmio.phys_addr,
-                               data);
+                               &data);
                 data = vcpu_data_host_to_guest(vcpu, data, len);
                 vcpu_set_reg(vcpu, vcpu->arch.mmio_decode.rt, data);
         }
@@ -189,14 +189,14 @@ int io_mem_abort(struct kvm_vcpu *vcpu, struct kvm_run *run,
                 data = vcpu_data_guest_to_host(vcpu, vcpu_get_reg(vcpu, rt),
                                                len);
 
-                trace_kvm_mmio(KVM_TRACE_MMIO_WRITE, len, fault_ipa, data);
+                trace_kvm_mmio(KVM_TRACE_MMIO_WRITE, len, fault_ipa, &data);
                 mmio_write_buf(data_buf, len, data);
 
                 ret = kvm_io_bus_write(vcpu, KVM_MMIO_BUS, fault_ipa, len,
                                        data_buf);
         } else {
                 trace_kvm_mmio(KVM_TRACE_MMIO_READ_UNSATISFIED, len,
-                               fault_ipa, 0);
+                               fault_ipa, NULL);
 
                 ret = kvm_io_bus_read(vcpu, KVM_MMIO_BUS, fault_ipa, len,
                                       data_buf);
diff --git a/arch/arm/mach-omap1/dma.c b/arch/arm/mach-omap1/dma.c
index f6ba589cd312..c821c1d5610e 100644
--- a/arch/arm/mach-omap1/dma.c
+++ b/arch/arm/mach-omap1/dma.c
@@ -32,7 +32,6 @@
 #include "soc.h"
 
 #define OMAP1_DMA_BASE                  (0xfffed800)
-#define OMAP1_LOGICAL_DMA_CH_COUNT      17
 
 static u32 enable_1510_mode;
 
@@ -348,8 +347,6 @@ static int __init omap1_system_dma_init(void)
                 goto exit_iounmap;
         }
 
-        d->lch_count            = OMAP1_LOGICAL_DMA_CH_COUNT;
-
         /* Valid attributes for omap1 plus processors */
         if (cpu_is_omap15xx())
                 d->dev_caps = ENABLE_1510_MODE;
@@ -366,13 +363,14 @@ static int __init omap1_system_dma_init(void)
         d->dev_caps             |= CLEAR_CSR_ON_READ;
         d->dev_caps             |= IS_WORD_16;
 
-        if (cpu_is_omap15xx())
-                d->chan_count = 9;
-        else if (cpu_is_omap16xx() || cpu_is_omap7xx()) {
-                if (!(d->dev_caps & ENABLE_1510_MODE))
-                        d->chan_count = 16;
+        /* available logical channels */
+        if (cpu_is_omap15xx()) {
+                d->lch_count = 9;
+        } else {
+                if (d->dev_caps & ENABLE_1510_MODE)
+                        d->lch_count = 9;
                 else
-                        d->chan_count = 9;
+                        d->lch_count = 16;
         }
 
         p = dma_plat_info;
diff --git a/arch/arm/mach-omap2/gpmc-onenand.c b/arch/arm/mach-omap2/gpmc-onenand.c
index 8633c703546a..2944af820558 100644
--- a/arch/arm/mach-omap2/gpmc-onenand.c
+++ b/arch/arm/mach-omap2/gpmc-onenand.c
@@ -367,7 +367,7 @@ static int gpmc_onenand_setup(void __iomem *onenand_base, int *freq_ptr)
         return ret;
 }
 
-void gpmc_onenand_init(struct omap_onenand_platform_data *_onenand_data)
+int gpmc_onenand_init(struct omap_onenand_platform_data *_onenand_data)
 {
         int err;
         struct device *dev = &gpmc_onenand_device.dev;