Merge branch 'p-ti-lsk-android-linux-4.4.y' of git://git.omapzoom.org/kernel/omap into 6AM.1.3-rvc-video6AM.1.3-rvc-video

* 'p-ti-lsk-android-linux-4.4.y' of git://git.omapzoom.org/kernel/omap: (2048 commits)
  ARM: dts: dra7: Remove deprecated PCI compatible string
  ARM: dts: dra76-evm: Enable x2 PCIe lanes
  ARM: dts: DRA72x: Use PCIe compatible specific to dra72
  ARM: dts: DRA74x: Use PCIe compatible specific to dra74
  ARM: dts: dra7: Add properties to enable PCIe x2 lane mode
  PCI: dwc: pci-dra7xx: Enable x2 mode support
  PCI: dwc: dra7xx: Add support for SoC specific compatible strings
  dt-bindings: PCI: dra7xx: Add properties to enable x2 lane in dra7
  dt-bindings: PCI: dra7xx: Add SoC specific compatible strings
  ARM: dts: dra7-evm: Move pcie RC node to common file
  ARM: dts: dra76-evm: add higher speed MMC/SD modes
  Linux 4.4.84
  usb: qmi_wwan: add D-Link DWM-222 device ID
  usb: optimize acpi companion search for usb port devices
  perf/x86: Fix LBR related crashes on Intel Atom
  pids: make task_tgid_nr_ns() safe
  Sanitize 'move_pages()' permission checks
  irqchip/atmel-aic: Fix unbalanced refcount in aic_common_rtc_irq_fixup()
  irqchip/atmel-aic: Fix unbalanced of_node_put() in aic_common_irq_fixup()
  x86/asm/64: Clear AC on NMI entries
  ...

Signed-off-by: Praneeth Bajjuri <praneeth@ti.com>

Conflicts:
	arch/arm/boot/dts/Makefile
	drivers/gpu/drm/omapdrm/dss/dispc.c

342 files changed, 6762 insertions, 2266 deletions

diff --git a/arch/alpha/kernel/osf_sys.c b/arch/alpha/kernel/osf_sys.c
index 6cc08166ff00..63f06a2b1f7f 100644
--- a/arch/alpha/kernel/osf_sys.c
+++ b/arch/alpha/kernel/osf_sys.c
@@ -1188,8 +1188,10 @@ SYSCALL_DEFINE4(osf_wait4, pid_t, pid, int __user *, ustatus, int, options,
         if (!access_ok(VERIFY_WRITE, ur, sizeof(*ur)))
                 return -EFAULT;
 
-        err = 0;
-        err |= put_user(status, ustatus);
+        err = put_user(status, ustatus);
+        if (ret < 0)
+                return err ? err : ret;
+
         err |= __put_user(r.ru_utime.tv_sec, &ur->ru_utime.tv_sec);
         err |= __put_user(r.ru_utime.tv_usec, &ur->ru_utime.tv_usec);
         err |= __put_user(r.ru_stime.tv_sec, &ur->ru_stime.tv_sec);
diff --git a/arch/arc/include/asm/delay.h b/arch/arc/include/asm/delay.h
index a36e8601114d..d5da2115d78a 100644
--- a/arch/arc/include/asm/delay.h
+++ b/arch/arc/include/asm/delay.h
@@ -26,7 +26,9 @@ static inline void __delay(unsigned long loops)
         "       lp  1f                  \n"
         "       nop                     \n"
         "1:                             \n"
-        : : "r"(loops));
+        :
+        : "r"(loops)
+        : "lp_count");
 }
 
 extern void __bad_udelay(void);
diff --git a/arch/arc/include/asm/entry-arcv2.h b/arch/arc/include/asm/entry-arcv2.h
index b5ff87e6f4b7..aee1a77934cf 100644
--- a/arch/arc/include/asm/entry-arcv2.h
+++ b/arch/arc/include/asm/entry-arcv2.h
@@ -16,6 +16,7 @@
         ;
         ; Now manually save: r12, sp, fp, gp, r25
 
+        PUSH    r30
         PUSH    r12
 
         ; Saving pt_regs->sp correctly requires some extra work due to the way
@@ -72,6 +73,7 @@
         POPAX   AUX_USER_SP
 1:
         POP     r12
+        POP     r30
 
 .endm
 
diff --git a/arch/arc/include/asm/ptrace.h b/arch/arc/include/asm/ptrace.h
index 69095da1fcfd..47111d565a95 100644
--- a/arch/arc/include/asm/ptrace.h
+++ b/arch/arc/include/asm/ptrace.h
@@ -84,7 +84,7 @@ struct pt_regs {
         unsigned long fp;
         unsigned long sp;       /* user/kernel sp depending on where we came from  */
 
-        unsigned long r12;
+        unsigned long r12, r30;
 
         /*------- Below list auto saved by h/w -----------*/
         unsigned long r0, r1, r2, r3, r4, r5, r6, r7, r8, r9, r10, r11;
diff --git a/arch/arc/kernel/unaligned.c b/arch/arc/kernel/unaligned.c
index abd961f3e763..5f69c3bd59bb 100644
--- a/arch/arc/kernel/unaligned.c
+++ b/arch/arc/kernel/unaligned.c
@@ -241,8 +241,9 @@ int misaligned_fixup(unsigned long address, struct pt_regs *regs,
         if (state.fault)
                 goto fault;
 
+        /* clear any remanants of delay slot */
         if (delay_mode(regs)) {
-                regs->ret = regs->bta;
+                regs->ret = regs->bta & ~1U;
                 regs->status32 &= ~STATUS_DE_MASK;
         } else {
                 regs->ret += state.instr_len;
diff --git a/arch/arc/mm/mmap.c b/arch/arc/mm/mmap.c
index 2e06d56e987b..cf4ae6958240 100644
--- a/arch/arc/mm/mmap.c
+++ b/arch/arc/mm/mmap.c
@@ -64,7 +64,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
 
                 vma = find_vma(mm, addr);
                 if (TASK_SIZE - len >= addr &&
-                    (!vma || addr + len <= vma->vm_start))
+                    (!vma || addr + len <= vm_start_gap(vma)))
                         return addr;
         }
 
diff --git a/arch/arm/boot/dts/Makefile b/arch/arm/boot/dts/Makefile
index c1bff8a87485..4e037366a62f 100644
--- a/arch/arm/boot/dts/Makefile
+++ b/arch/arm/boot/dts/Makefile
@@ -494,11 +494,13 @@ dtb-$(CONFIG_SOC_OMAP5) += \
 dtb-$(CONFIG_SOC_DRA7XX) += \
         dra7-evm.dtb \
         dra7-evm-lcd-lg.dtb \
+        dra7-evm-fpd-lg.dtb \
         dra7-evm-lcd-lg-late-attach.dtb \
         dra7-evm-lcd-lg-late-attach-no-map.dtb \
         dra7-evm-lcd-osd.dtb \
         dra7-evm-lcd-osd101t2587.dtb \
         dra7-evm-lcd-osd-late-attach.dtb \
+        dra7-evm-fpd-auo-g101evn01.0.dtb \
         dra7-evm-vision.dtb \
         dra7-evm-robust-rvc.dtb \
         dra7-evm-early-video.dtb \
@@ -516,6 +518,7 @@ dtb-$(CONFIG_SOC_DRA7XX) += \
         dra72-evm-lcd-lg.dtb \
         dra72-evm-lcd-osd.dtb \
         dra72-evm-lcd-osd101t2587.dtb \
+        dra72-evm-fpd-lg.dtb \
         dra72-evm-revc.dtb \
         dra72-evm-revc-lcd-osd101t2045.dtb \
         dra72-evm-revc-lcd-osd101t2587.dtb \
@@ -524,7 +527,9 @@ dtb-$(CONFIG_SOC_DRA7XX) += \
         dra71-evm.dtb \
         dra71-evm-lcd-auo-g101evn01.0.dtb \
         dra71-evm-robust-rvc.dtb \
-        dra71-evm-early-video.dtb
+        dra71-evm-early-video.dtb \
+        dra76-evm.dtb \
+        dra76-evm-fpd-auo-g101evn01.0.dtb
 dtb-$(CONFIG_ARCH_ORION5X) += \
         orion5x-lacie-d2-network.dtb \
         orion5x-lacie-ethernet-disk-mini-v2.dtb \
diff --git a/arch/arm/boot/dts/armada-388-gp.dts b/arch/arm/boot/dts/armada-388-gp.dts
index cd316021d6ce..6c1b45c1af66 100644
--- a/arch/arm/boot/dts/armada-388-gp.dts
+++ b/arch/arm/boot/dts/armada-388-gp.dts
@@ -89,7 +89,7 @@
                                         pinctrl-names = "default";
                                         pinctrl-0 = <&pca0_pins>;
                                         interrupt-parent = <&gpio0>;
-                                        interrupts = <18 IRQ_TYPE_EDGE_FALLING>;
+                                        interrupts = <18 IRQ_TYPE_LEVEL_LOW>;
                                         gpio-controller;
                                         #gpio-cells = <2>;
                                         interrupt-controller;
@@ -101,7 +101,7 @@
                                         compatible = "nxp,pca9555";
                                         pinctrl-names = "default";
                                         interrupt-parent = <&gpio0>;
-                                        interrupts = <18 IRQ_TYPE_EDGE_FALLING>;
+                                        interrupts = <18 IRQ_TYPE_LEVEL_LOW>;
                                         gpio-controller;
                                         #gpio-cells = <2>;
                                         interrupt-controller;
diff --git a/arch/arm/boot/dts/at91-sama5d2_xplained.dts b/arch/arm/boot/dts/at91-sama5d2_xplained.dts
index e74df327cdd3..20618a897c99 100644
--- a/arch/arm/boot/dts/at91-sama5d2_xplained.dts
+++ b/arch/arm/boot/dts/at91-sama5d2_xplained.dts
@@ -122,6 +122,8 @@
                         uart1: serial@f8020000 {
                                 pinctrl-names = "default";
                                 pinctrl-0 = <&pinctrl_uart1_default>;
+                                atmel,use-dma-rx;
+                                atmel,use-dma-tx;
                                 status = "okay";
                         };
 
diff --git a/arch/arm/boot/dts/at91-sama5d3_xplained.dts b/arch/arm/boot/dts/at91-sama5d3_xplained.dts
index f3e2b96c06a3..0bd325c314e1 100644
--- a/arch/arm/boot/dts/at91-sama5d3_xplained.dts
+++ b/arch/arm/boot/dts/at91-sama5d3_xplained.dts
@@ -162,9 +162,10 @@
                         };
 
                         adc0: adc@f8018000 {
+                                atmel,adc-vref = <3300>;
+                                atmel,adc-channels-used = <0xfe>;
                                 pinctrl-0 = <
                                         &pinctrl_adc0_adtrg
-                                        &pinctrl_adc0_ad0
                                         &pinctrl_adc0_ad1
                                         &pinctrl_adc0_ad2
                                         &pinctrl_adc0_ad3
@@ -172,8 +173,6 @@
                                         &pinctrl_adc0_ad5
                                         &pinctrl_adc0_ad6
                                         &pinctrl_adc0_ad7
-                                        &pinctrl_adc0_ad8
-                                        &pinctrl_adc0_ad9
                                         >;
                                 status = "okay";
                         };
diff --git a/arch/arm/boot/dts/at91-sama5d4_xplained.dts b/arch/arm/boot/dts/at91-sama5d4_xplained.dts
index da84e65b56ef..e27024cdf48b 100644
--- a/arch/arm/boot/dts/at91-sama5d4_xplained.dts
+++ b/arch/arm/boot/dts/at91-sama5d4_xplained.dts
@@ -110,6 +110,8 @@
                         };
 
                         usart3: serial@fc00c000 {
+                                atmel,use-dma-rx;
+                                atmel,use-dma-tx;
                                 status = "okay";
                         };
 
diff --git a/arch/arm/boot/dts/bcm5301x.dtsi b/arch/arm/boot/dts/bcm5301x.dtsi
index 6f50f672efbd..de8ac998604d 100644
--- a/arch/arm/boot/dts/bcm5301x.dtsi
+++ b/arch/arm/boot/dts/bcm5301x.dtsi
@@ -54,14 +54,14 @@
                 timer@0200 {
                         compatible = "arm,cortex-a9-global-timer";
                         reg = <0x0200 0x100>;
-                        interrupts = <GIC_PPI 11 IRQ_TYPE_LEVEL_HIGH>;
+                        interrupts = <GIC_PPI 11 IRQ_TYPE_EDGE_RISING>;
                         clocks = <&clk_periph>;
                 };
 
                 local-timer@0600 {
                         compatible = "arm,cortex-a9-twd-timer";
                         reg = <0x0600 0x100>;
-                        interrupts = <GIC_PPI 13 IRQ_TYPE_LEVEL_HIGH>;
+                        interrupts = <GIC_PPI 13 IRQ_TYPE_EDGE_RISING>;
                         clocks = <&clk_periph>;
                 };
 
diff --git a/arch/arm/boot/dts/dra7-evm-common.dtsi b/arch/arm/boot/dts/dra7-evm-common.dtsi
new file mode 100644
index 000000000000..2bbc04791628
--- /dev/null
+++ b/arch/arm/boot/dts/dra7-evm-common.dtsi
@@ -0,0 +1,393 @@
+/*
+ * Copyright (C) 2017 Texas Instruments Incorporated - http://www.ti.com/
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/clk/ti-dra7-atl.h>
+#include <dt-bindings/input/input.h>
+
+/ {
+        aliases {
+                display0 = &hdmi0;
+                sound0 = &sound0;
+                sound1 = &hdmi;
+        };
+
+        chosen {
+                stdout-path = &uart1;
+        };
+
+        sound0: sound0 {
+                compatible = "simple-audio-card";
+                simple-audio-card,name = "DRA7xx-EVM";
+                simple-audio-card,widgets =
+                        "Headphone", "Headphone Jack",
+                        "Line", "Line Out",
+                        "Microphone", "Mic Jack",
+                        "Line", "Line In";
+                simple-audio-card,routing =
+                        "Headphone Jack",       "HPLOUT",
+                        "Headphone Jack",       "HPROUT",
+                        "Line Out",             "LLOUT",
+                        "Line Out",             "RLOUT",
+                        "MIC3L",                "Mic Jack",
+                        "MIC3R",                "Mic Jack",
+                        "Mic Jack",             "Mic Bias",
+                        "LINE1L",               "Line In",
+                        "LINE1R",               "Line In";
+                simple-audio-card,format = "dsp_b";
+                simple-audio-card,bitclock-master = <&sound0_master>;
+                simple-audio-card,frame-master = <&sound0_master>;
+                simple-audio-card,bitclock-inversion;
+
+                sound0_master: simple-audio-card,cpu {
+                        sound-dai = <&mcasp3>;
+                        system-clock-frequency = <11289600>;
+                };
+
+                simple-audio-card,codec {
+                        sound-dai = <&tlv320aic3106>;
+                        clocks = <&atl_clkin2_ck>;
+                };
+        };
+
+        extcon_usb1: extcon_usb1 {
+                compatible = "linux,extcon-usb-gpio";
+                id-gpio = <&pcf_gpio_21 1 GPIO_ACTIVE_HIGH>;
+        };
+
+        leds {
+                compatible = "gpio-leds";
+                led0 {
+                        label = "dra7:usr1";
+                        gpios = <&pcf_lcd 4 GPIO_ACTIVE_LOW>;
+                        default-state = "off";
+                };
+
+                led1 {
+                        label = "dra7:usr2";
+                        gpios = <&pcf_lcd 5 GPIO_ACTIVE_LOW>;
+                        default-state = "off";
+                };
+
+                led2 {
+                        label = "dra7:usr3";
+                        gpios = <&pcf_lcd 6 GPIO_ACTIVE_LOW>;
+                        default-state = "off";
+                };
+
+                led3 {
+                        label = "dra7:usr4";
+                        gpios = <&pcf_lcd 7 GPIO_ACTIVE_LOW>;
+                        default-state = "off";
+                };
+        };
+
+        gpio_keys {
+                compatible = "gpio-keys";
+                #address-cells = <1>;
+                #size-cells = <0>;
+                autorepeat;
+
+                USER1 {
+                        label = "btnUser1";
+                        linux,code = <BTN_0>;
+                        gpios = <&pcf_lcd 2 GPIO_ACTIVE_LOW>;
+                };
+
+                USER2 {
+                        label = "btnUser2";
+                        linux,code = <BTN_1>;
+                        gpios = <&pcf_lcd 3 GPIO_ACTIVE_LOW>;
+                };
+        };
+
+        hdmi0: connector@1 {
+                compatible = "hdmi-connector";
+                label = "hdmi";
+
+                type = "a";
+
+                port {
+                        hdmi_connector_in: endpoint {
+                                remote-endpoint = <&tpd12s015_out>;
+                        };
+                };
+        };
+
+        tpd12s015: encoder@1 {
+                ports {
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+
+                        port@0 {
+                                reg = <0>;
+
+                                tpd12s015_in: endpoint {
+                                        remote-endpoint = <&hdmi_out>;
+                                };
+                        };
+
+                        port@1 {
+                                reg = <1>;
+
+                                tpd12s015_out: endpoint {
+                                        remote-endpoint = <&hdmi_connector_in>;
+                                };
+                        };
+                };
+        };
+
+        clk_ov10633_fixed: clk_ov10633_fixed {
+                #clock-cells = <0>;
+                compatible = "fixed-clock";
+                clock-frequency = <24000000>;
+        };
+};
+
+&dra7_pmx_core {
+        dcan1_pins_default: dcan1_pins_default {
+                pinctrl-single,pins = <
+                        0x3d0   (PIN_OUTPUT_PULLUP | MUX_MODE0) /* dcan1_tx */
+                        0x418   (PULL_UP | MUX_MODE1) /* wakeup0.dcan1_rx */
+                >;
+        };
+
+        dcan1_pins_sleep: dcan1_pins_sleep {
+                pinctrl-single,pins = <
+                        0x3d0   (MUX_MODE15 | PULL_UP)  /* dcan1_tx.off */
+                        0x418   (MUX_MODE15 | PULL_UP)  /* wakeup0.off */
+                >;
+        };
+};
+
+&i2c3 {
+        status = "okay";
+        clock-frequency = <400000>;
+};
+
+&mcspi1 {
+        status = "okay";
+};
+
+&mcspi2 {
+        status = "okay";
+};
+
+&uart1 {
+        status = "okay";
+        interrupts-extended = <&crossbar_mpu GIC_SPI 67 IRQ_TYPE_LEVEL_HIGH>,
+                              <&dra7_pmx_core 0x3e0>;
+};
+
+&uart2 {
+        status = "okay";
+};
+
+&uart3 {
+        status = "okay";
+};
+
+&qspi {
+        status = "okay";
+
+        spi-max-frequency = <76800000>;
+        m25p80@0 {
+                compatible = "s25fl256s1";
+                spi-max-frequency = <76800000>;
+                reg = <0>;
+                spi-tx-bus-width = <1>;
+                spi-rx-bus-width = <4>;
+                #address-cells = <1>;
+                #size-cells = <1>;
+
+                /* MTD partition table.
+                 * The ROM checks the first four physical blocks
+                 * for a valid file to boot and the flash here is
+                 * 64KiB block size.
+                 */
+                partition@0 {
+                        label = "QSPI.SPL";
+                        reg = <0x00000000 0x000040000>;
+                };
+                partition@1 {
+                        label = "QSPI.u-boot";
+                        reg = <0x00040000 0x00100000>;
+                };
+                partition@2 {
+                        label = "QSPI.u-boot-spl-os";
+                        reg = <0x00140000 0x00080000>;
+                };
+                partition@3 {
+                        label = "QSPI.u-boot-env";
+                        reg = <0x001c0000 0x00010000>;
+                };
+                partition@4 {
+                        label = "QSPI.u-boot-env.backup1";
+                        reg = <0x001d0000 0x0010000>;
+                };
+                partition@5 {
+                        label = "QSPI.kernel";
+                        reg = <0x001e0000 0x0800000>;
+                };
+                partition@6 {
+                        label = "QSPI.file-system";
+                        reg = <0x009e0000 0x01620000>;
+                };
+        };
+};
+
+&omap_dwc3_1 {
+        extcon = <&extcon_usb1>;
+};
+
+&usb1 {
+        dr_mode = "otg";
+};
+
+&usb2 {
+        dr_mode = "host";
+};
+
+&dcan1 {
+        status = "ok";
+        pinctrl-names = "default", "sleep", "active";
+        pinctrl-0 = <&dcan1_pins_sleep>;
+        pinctrl-1 = <&dcan1_pins_sleep>;
+        pinctrl-2 = <&dcan1_pins_default>;
+};
+
+&atl {
+        assigned-clocks = <&abe_dpll_sys_clk_mux>,
+                          <&atl_gfclk_mux>,
+                          <&dpll_abe_ck>,
+                          <&dpll_abe_m2x2_ck>,
+                          <&atl_clkin1_ck>,
+                          <&atl_clkin2_ck>;
+        assigned-clock-parents = <&sys_clkin2>, <&dpll_abe_m2_ck>;
+        assigned-clock-rates = <0>, <0>, <180633600>, <361267200>,
+                                <11289600>, <11289600>;
+
+        status = "okay";
+
+        atl2 {
+                bws = <DRA7_ATL_WS_MCASP2_FSX>;
+                aws = <DRA7_ATL_WS_MCASP3_FSX>;
+        };
+};
+
+&mcasp3 {
+        #sound-dai-cells = <0>;
+
+        assigned-clocks = <&mcasp3_ahclkx_mux>;
+        assigned-clock-parents = <&atl_clkin2_ck>;
+
+        status = "okay";
+
+        op-mode = <0>;          /* MCASP_IIS_MODE */
+        tdm-slots = <2>;
+        /* 4 serializer */
+        serial-dir = <  /* 0: INACTIVE, 1: TX, 2: RX */
+                1 2 0 0
+        >;
+        tx-num-evt = <32>;
+        rx-num-evt = <32>;
+};
+
+&mailbox5 {
+        status = "okay";
+        mbox_ipu1_ipc3x: mbox_ipu1_ipc3x {
+                status = "okay";
+        };
+        mbox_dsp1_ipc3x: mbox_dsp1_ipc3x {
+                status = "okay";
+        };
+};
+
+&mailbox6 {
+        status = "okay";
+        mbox_ipu2_ipc3x: mbox_ipu2_ipc3x {
+                status = "okay";
+        };
+        mbox_dsp2_ipc3x: mbox_dsp2_ipc3x {
+                status = "okay";
+        };
+};
+
+&mmu0_dsp1 {
+        status = "okay";
+};
+
+&mmu1_dsp1 {
+        status = "okay";
+};
+
+&mmu0_dsp2 {
+        status = "okay";
+};
+
+&mmu1_dsp2 {
+        status = "okay";
+};
+
+&mmu_ipu1 {
+        status = "okay";
+};
+
+&mmu_ipu2 {
+        status = "okay";
+};
+
+&ipu2 {
+        status = "okay";
+        memory-region = <&ipu2_cma_pool>;
+        mboxes = <&mailbox6 &mbox_ipu2_ipc3x>;
+        timers = <&timer3>;
+        watchdog-timers = <&timer4>, <&timer9>;
+};
+
+&ipu1 {
+        status = "okay";
+        memory-region = <&ipu1_cma_pool>;
+        mboxes = <&mailbox5 &mbox_ipu1_ipc3x>;
+        timers = <&timer11>;
+        watchdog-timers = <&timer7>, <&timer8>;
+};
+
+&dsp1 {
+        status = "okay";
+        memory-region = <&dsp1_cma_pool>;
+        mboxes = <&mailbox5 &mbox_dsp1_ipc3x>;
+        timers = <&timer5>;
+        watchdog-timers = <&timer10>;
+};
+
+&dsp2 {
+        status = "okay";
+        memory-region = <&dsp2_cma_pool>;
+        mboxes = <&mailbox6 &mbox_dsp2_ipc3x>;
+        timers = <&timer6>;
+        watchdog-timers = <&timer13>;
+};
+
+&vip1 {
+        status = "okay";
+};
+
+&hdmi {
+        status = "okay";
+
+        port {
+                hdmi_out: endpoint {
+                        remote-endpoint = <&tpd12s015_in>;
+                };
+        };
+};
+
+&pcie1_rc {
+        status = "okay";
+};
diff --git a/arch/arm/boot/dts/dra7-evm-fpd-auo-g101evn01.0.dts b/arch/arm/boot/dts/dra7-evm-fpd-auo-g101evn01.0.dts
new file mode 100644
index 000000000000..64e79754bb22
--- /dev/null
+++ b/arch/arm/boot/dts/dra7-evm-fpd-auo-g101evn01.0.dts
@@ -0,0 +1,37 @@
+#include "dra7-evm.dts"
+#include "dra7x-evm-fpd-auo-g101evn01.0.dtsi"
+
+/ {
+        aliases {
+                display0 = &fpd_disp;
+                display1 = &hdmi0;
+        };
+};
+
+&dss {
+        ports {
+                status = "ok";
+        };
+};
+
+&disp_ser {
+        status = "ok";
+        ranges = <0x0 0x2d>;
+};
+
+/* Tie the end points of DSS and FPDLink together */
+
+&fpd_in {
+        remote-endpoint = <&dpi_out3>;
+};
+
+&dpi_out3 {
+        remote-endpoint = <&fpd_in>;
+};
+
+&lcd_fpd {
+        enable-gpios = <&pcf_gpio_21 0 GPIO_ACTIVE_LOW>;
+        /* P0, SEL_GPMC_AD_VID_S0 */
+
+        status = "ok";
+};
diff --git a/arch/arm/boot/dts/dra7-evm-fpd-lg.dts b/arch/arm/boot/dts/dra7-evm-fpd-lg.dts
new file mode 100644
index 000000000000..b8df0766ecff
--- /dev/null
+++ b/arch/arm/boot/dts/dra7-evm-fpd-lg.dts
@@ -0,0 +1,38 @@
+#include "dra7-evm.dts"
+#include "dra7x-evm-fpd-lg.dtsi"
+
+/ {
+        aliases {
+                display0 = &fpd_disp;
+                display1 = &hdmi0;
+        };
+};
+
+&dss {
+        ports {
+                status = "ok";
+        };
+};
+
+&disp_ser {
+        status = "ok";
+        ranges = <0x2c 0x2c>,
+                <0x1c 0x1c>;
+};
+
+/* Tie the end points of DSS and FPDLink together */
+
+&fpd_in {
+        remote-endpoint = <&dpi_out3>;
+};
+
+&dpi_out3 {
+        remote-endpoint = <&fpd_in>;
+};
+
+&lcd_fpd {
+        enable-gpios = <&pcf_gpio_21 0 GPIO_ACTIVE_LOW>;
+        /* P0, SEL_GPMC_AD_VID_S0 */
+
+        status = "ok";
+};
diff --git a/arch/arm/boot/dts/dra7-evm-lcd-lg.dts b/arch/arm/boot/dts/dra7-evm-lcd-lg.dts
index f67beaa8ff01..2b09d3a8839f 100644
--- a/arch/arm/boot/dts/dra7-evm-lcd-lg.dts
+++ b/arch/arm/boot/dts/dra7-evm-lcd-lg.dts
@@ -14,3 +14,11 @@
         interrupts = <2 IRQ_TYPE_LEVEL_HIGH>;
 };
 
+
+/* Uncomment the below lines to enable the FPDLink display */
+
+/*
+&lcd_fpd {
+        status = "okay";
+};
+*/
diff --git a/arch/arm/boot/dts/dra7-evm.dts b/arch/arm/boot/dts/dra7-evm.dts
index c2af973a17c2..4a8697306e7a 100644
--- a/arch/arm/boot/dts/dra7-evm.dts
+++ b/arch/arm/boot/dts/dra7-evm.dts
@@ -8,9 +8,7 @@
 /dts-v1/;
 
 #include "dra74x.dtsi"
-#include <dt-bindings/gpio/gpio.h>
-#include <dt-bindings/clk/ti-dra7-atl.h>
-#include <dt-bindings/input/input.h>
+#include "dra7-evm-common.dtsi"
 
 / {
         model = "TI DRA742";
@@ -56,13 +54,17 @@
         };
 
         aliases {
-                display0 = &hdmi0;
-                display1 = &fpd_disp;
-                sound0 = &snd0;
-                sound1 = &hdmi;
                 i2c7 = &disp_ser;
         };
 
+        evm_1v8_sw: fixedregulator-evm_1v8 {
+                compatible = "regulator-fixed";
+                regulator-name = "evm_1v8";
+                vin-supply = <&smps9_reg>;
+                regulator-min-microvolt = <1800000>;
+                regulator-max-microvolt = <1800000>;
+        };
+
         evm_3v3_sd: fixedregulator-sd {
                 compatible = "regulator-fixed";
                 regulator-name = "evm_3v3_sd";
@@ -99,16 +101,6 @@
                 enable-active-high;
         };
 
-        extcon_usb1: extcon_usb1 {
-                compatible = "linux,extcon-usb-gpio";
-                id-gpio = <&pcf_gpio_21 1 GPIO_ACTIVE_HIGH>;
-        };
-
-        extcon_usb2: extcon_usb2 {
-                compatible = "linux,extcon-usb-gpio";
-                id-gpio = <&pcf_gpio_21 2 GPIO_ACTIVE_HIGH>;
-        };
-
         vtt_fixed: fixedregulator-vtt {
                 compatible = "regulator-fixed";
                 regulator-name = "vtt_fixed";
@@ -121,151 +113,28 @@
                 gpio = <&gpio7 11 GPIO_ACTIVE_HIGH>;
         };
 
-        snd0: sound@0 {
-                compatible = "simple-audio-card";
-                simple-audio-card,name = "DRA7xx-EVM";
-                simple-audio-card,widgets =
-                        "Headphone", "Headphone Jack",
-                        "Line", "Line Out",
-                        "Microphone", "Mic Jack",
-                        "Line", "Line In";
-                simple-audio-card,routing =
-                        "Headphone Jack",       "HPLOUT",
-                        "Headphone Jack",       "HPROUT",
-                        "Line Out",             "LLOUT",
-                        "Line Out",             "RLOUT",
-                        "MIC3L",                "Mic Jack",
-                        "MIC3R",                "Mic Jack",
-                        "Mic Jack",             "Mic Bias",
-                        "LINE1L",               "Line In",
-                        "LINE1R",               "Line In";
-                simple-audio-card,format = "dsp_b";
-                simple-audio-card,bitclock-master = <&sound0_master>;
-                simple-audio-card,frame-master = <&sound0_master>;
-                simple-audio-card,bitclock-inversion;
-
-                sound0_master: simple-audio-card,cpu {
-                        sound-dai = <&mcasp3>;
-                        system-clock-frequency = <11289600>;
-                };
-
-                simple-audio-card,codec {
-                        sound-dai = <&tlv320aic3106>;
-                        clocks = <&atl_clkin2_ck>;
-                };
-        };
-
-        leds {
-                compatible = "gpio-leds";
-                led@0 {
-                        label = "dra7:usr1";
-                        gpios = <&pcf_lcd 4 GPIO_ACTIVE_LOW>;
-                        default-state = "off";
-                };
-
-                led@1 {
-                        label = "dra7:usr2";
-                        gpios = <&pcf_lcd 5 GPIO_ACTIVE_LOW>;
-                        default-state = "off";
-                };
-
-                led@2 {
-                        label = "dra7:usr3";
-                        gpios = <&pcf_lcd 6 GPIO_ACTIVE_LOW>;
-                        default-state = "off";
-                };
-
-                led@3 {
-                        label = "dra7:usr4";
-                        gpios = <&pcf_lcd 7 GPIO_ACTIVE_LOW>;
-                        default-state = "off";
-                };
-        };
-
-        gpio_keys {
-                compatible = "gpio-keys";
-                #address-cells = <1>;
-                #size-cells = <0>;
-                autorepeat;
-
-                USER1 {
-                        label = "btnUser1";
-                        linux,code = <BTN_0>;
-                        gpios = <&pcf_lcd 2 GPIO_ACTIVE_LOW>;
-                };
-
-                USER2 {
-                        label = "btnUser2";
-                        linux,code = <BTN_1>;
-                        gpios = <&pcf_lcd 3 GPIO_ACTIVE_LOW>;
-                };
-        };
-
-        hdmi0: connector@1 {
-                compatible = "hdmi-connector";
-                label = "hdmi";
-
-                type = "a";
-
-                port {
-                        hdmi_connector_in: endpoint {
-                                remote-endpoint = <&tpd12s015_out>;
-                        };
-                };
+        extcon_usb2: extcon_usb2 {
+                compatible = "linux,extcon-usb-gpio";
+                id-gpio = <&pcf_gpio_21 2 GPIO_ACTIVE_HIGH>;
         };
 
-        tpd12s015: encoder@1 {
-                compatible = "ti,dra7evm-tpd12s015";
-
-                pinctrl-names = "i2c", "ddc";
-                pinctrl-0 = <&hdmi_i2c_sel_pin &hdmi_i2c_pins_i2c>;
-                pinctrl-1 = <&hdmi_i2c_sel_pin &hdmi_i2c_pins_ddc>;
-
-                ddc-i2c-bus = <&i2c2>;
-                mcasp-gpio = <&mcasp8>;
-
-                gpios = <&pcf_hdmi 4 0>,        /* P4, CT CP HPD */
-                        <&pcf_hdmi 5 0>,        /* P5, LS OE */
-                        <&gpio7 12 0>;  /* gpio7_12/sp1_cs2, HPD */
-
-                ports {
-                        #address-cells = <1>;
-                        #size-cells = <0>;
-
-                        port@0 {
-                                reg = <0>;
+};
 
-                                tpd12s015_in: endpoint@0 {
-                                        remote-endpoint = <&hdmi_out>;
-                                };
-                        };
+&tpd12s015 {
+        compatible = "ti,dra7evm-tpd12s015";
+        pinctrl-names = "i2c", "ddc";
+        pinctrl-0 = <&hdmi_i2c_sel_pin &hdmi_i2c_pins_i2c>;
+        pinctrl-1 = <&hdmi_i2c_sel_pin &hdmi_i2c_pins_ddc>;
 
-                        port@1 {
-                                reg = <1>;
+        gpios = <&pcf_hdmi 4 GPIO_ACTIVE_HIGH>, /* P4, CT CP HPD */
+                <&pcf_hdmi 5 GPIO_ACTIVE_HIGH>, /* P5, LS OE */
+                <&gpio7 12 GPIO_ACTIVE_HIGH>;   /* gpio7_12/sp1_cs2, HPD */
 
-                                tpd12s015_out: endpoint@0 {
-                                        remote-endpoint = <&hdmi_connector_in>;
-                                };
-                        };
-                };
-        };
+        ddc-i2c-bus = <&i2c2>;
+        mcasp-gpio = <&mcasp8>;
 };
 
 &dra7_pmx_core {
-        dcan1_pins_default: dcan1_pins_default {
-                pinctrl-single,pins = <
-                        0x3d0   (PIN_OUTPUT_PULLUP | MUX_MODE0) /* dcan1_tx */
-                        0x418   (PULL_UP | MUX_MODE1) /* wakeup0.dcan1_rx */
-                >;
-        };
-
-        dcan1_pins_sleep: dcan1_pins_sleep {
-                pinctrl-single,pins = <
-                        0x3d0   (MUX_MODE15 | PULL_UP)  /* dcan1_tx.off */
-                        0x418   (MUX_MODE15 | PULL_UP)  /* wakeup0.off */
-                >;
-        };
-
         hdmi_i2c_sel_pin: pinmux_hdmi_i2c_sel_pin {
                 pinctrl-single,pins = <
                         /* this pin is used as a GPIO via mcasp */
@@ -758,6 +627,8 @@
         tps659038: tps659038@58 {
                 compatible = "ti,tps659038";
                 reg = <0x58>;
+                ti,palmas-override-powerhold;
+                ti,system-power-controller;
 
                 tps659038_pmic {
                         compatible = "ti,tps659038-pmic";
@@ -978,59 +849,10 @@ i2c_p3_exp: &i2c2 {
 
                 #address-cells = <1>;
                 #size-cells = <0>;
-                ranges = <0x2c 0x2c>,
-                        <0x1c 0x1c>;
-
-                disp_des: deserializer@2c {
-                        compatible = "ti,ds90uh928q";
-                        reg = <0x2c>;
-                        slave-mode;
-                };
-
-                /* TLC chip for LCD panel power and backlight */
-                fpd_disp: tlc59108@1c {
-                        status = "disabled";
-                        reg = <0x1c>;
-                        compatible = "ti,tlc59108-fpddisp";
-                        enable-gpios = <&pcf_gpio_21 0 GPIO_ACTIVE_LOW>;
-                        /* P0, SEL_GPMC_AD_VID_S0 */
-
-                        port@lcd3 {
-                                        fpd_in: endpoint {
-                                        remote-endpoint = <&dpi_out3>;
-                                };
-                        };
-                };
+                status = "disabled";
         };
 };
 
-&i2c3 {
-        status = "okay";
-        clock-frequency = <400000>;
-};
-
-&mcspi1 {
-        status = "okay";
-};
-
-&mcspi2 {
-        status = "okay";
-};
-
-&uart1 {
-        status = "okay";
-        interrupts-extended = <&crossbar_mpu GIC_SPI 67 IRQ_TYPE_LEVEL_HIGH>,
-                              <&dra7_pmx_core 0x3e0>;
-};
-
-&uart2 {
-        status = "okay";
-};
-
-&uart3 {
-        status = "okay";
-};
-
 &mmc1 {
         status = "okay";
         vmmc-supply = <&evm_3v3_sd>;
@@ -1088,7 +910,7 @@ i2c_p3_exp: &i2c2 {
 
         #address-cells = <1>;
         #size-cells = <0>;
-        wlcore: wlcore@0 {
+        wlcore: wlcore@2 {
                 compatible = "ti,wl1835";
                 reg = <2>;
                 interrupt-parent = <&gpio5>;
@@ -1116,75 +938,10 @@ i2c_p3_exp: &i2c2 {
         vdd-supply = <&smps7_reg>;
 };
 
-&pcie1_rc {
-        status = "okay";
-};
-
-&qspi {
-        status = "okay";
-
-        spi-max-frequency = <76800000>;
-        m25p80@0 {
-                compatible = "s25fl256s1";
-                spi-max-frequency = <76800000>;
-                reg = <0>;
-                spi-tx-bus-width = <1>;
-                spi-rx-bus-width = <4>;
-                #address-cells = <1>;
-                #size-cells = <1>;
-
-                /* MTD partition table.
-                 * The ROM checks the first four physical blocks
-                 * for a valid file to boot and the flash here is
-                 * 64KiB block size.
-                 */
-                partition@0 {
-                        label = "QSPI.SPL";
-                        reg = <0x00000000 0x000040000>;
-                };
-                partition@1 {
-                        label = "QSPI.u-boot";
-                        reg = <0x00040000 0x00100000>;
-                };
-                partition@2 {
-                        label = "QSPI.u-boot-spl-os";
-                        reg = <0x00140000 0x00080000>;
-                };
-                partition@3 {
-                        label = "QSPI.u-boot-env";
-                        reg = <0x001c0000 0x00010000>;
-                };
-                partition@4 {
-                        label = "QSPI.u-boot-env.backup1";
-                        reg = <0x001d0000 0x0010000>;
-                };
-                partition@5 {
-                        label = "QSPI.kernel";
-                        reg = <0x001e0000 0x0800000>;
-                };
-                partition@6 {
-                        label = "QSPI.file-system";
-                        reg = <0x009e0000 0x01620000>;
-                };
-        };
-};
-
-&omap_dwc3_1 {
-        extcon = <&extcon_usb1>;
-};
-
 &omap_dwc3_2 {
         extcon = <&extcon_usb2>;
 };
 
-&usb1 {
-        dr_mode = "otg";
-};
-
-&usb2 {
-        dr_mode = "host";
-};
-
 &elm {
         status = "okay";
 };
@@ -1301,131 +1058,6 @@ i2c_p3_exp: &i2c2 {
         dual_emac_res_vlan = <2>;
 };
 
-&dcan1 {
-        status = "ok";
-        pinctrl-names = "default", "sleep", "active";
-        pinctrl-0 = <&dcan1_pins_sleep>;
-        pinctrl-1 = <&dcan1_pins_sleep>;
-        pinctrl-2 = <&dcan1_pins_default>;
-};
-
-&atl {
-        assigned-clocks = <&abe_dpll_sys_clk_mux>,
-                          <&atl_gfclk_mux>,
-                          <&dpll_abe_ck>,
-                          <&dpll_abe_m2x2_ck>,
-                          <&atl_clkin1_ck>,
-                          <&atl_clkin2_ck>;
-        assigned-clock-parents = <&sys_clkin2>, <&dpll_abe_m2_ck>;
-        assigned-clock-rates = <0>, <0>, <180633600>, <361267200>,
-                               <11289600>, <11289600>;
-
-        status = "okay";
-
-        atl2 {
-                bws = <DRA7_ATL_WS_MCASP2_FSX>;
-                aws = <DRA7_ATL_WS_MCASP3_FSX>;
-        };
-};
-
-&mcasp3 {
-        #sound-dai-cells = <0>;
-
-        assigned-clocks = <&mcasp3_ahclkx_mux>;
-        assigned-clock-parents = <&atl_clkin2_ck>;
-
-        status = "okay";
-
-        op-mode = <0>;          /* MCASP_IIS_MODE */
-        tdm-slots = <2>;
-        /* 4 serializer */
-        serial-dir = <  /* 0: INACTIVE, 1: TX, 2: RX */
-                1 2 0 0
-        >;
-        tx-num-evt = <32>;
-        rx-num-evt = <32>;
-};
-
-&mcasp8 {
-        /* not used for audio. only the AXR2 pin is used as GPIO */
-        status = "okay";
-};
-
-&mailbox5 {
-        status = "okay";
-        mbox_ipu1_ipc3x: mbox_ipu1_ipc3x {
-                status = "okay";
-        };
-        mbox_dsp1_ipc3x: mbox_dsp1_ipc3x {
-                status = "okay";
-        };
-};
-
-&mailbox6 {
-        status = "okay";
-        mbox_ipu2_ipc3x: mbox_ipu2_ipc3x {
-                status = "okay";
-        };
-        mbox_dsp2_ipc3x: mbox_dsp2_ipc3x {
-                status = "okay";
-        };
-};
-
-&mmu0_dsp1 {
-        status = "okay";
-};
-
-&mmu1_dsp1 {
-        status = "okay";
-};
-
-&mmu0_dsp2 {
-        status = "okay";
-};
-
-&mmu1_dsp2 {
-        status = "okay";
-};
-
-&mmu_ipu1 {
-        status = "okay";
-};
-
-&mmu_ipu2 {
-        status = "okay";
-};
-
-&ipu2 {
-        status = "okay";
-        memory-region = <&ipu2_cma_pool>;
-        mboxes = <&mailbox6 &mbox_ipu2_ipc3x>;
-        timers = <&timer3>;
-        watchdog-timers = <&timer4>, <&timer9>;
-};
-
-&ipu1 {
-        status = "okay";
-        memory-region = <&ipu1_cma_pool>;
-        mboxes = <&mailbox5 &mbox_ipu1_ipc3x>;
-        timers = <&timer11>;
-        watchdog-timers = <&timer7>, <&timer8>;
-};
-
-&dsp1 {
-        status = "okay";
-        memory-region = <&dsp1_cma_pool>;
-        mboxes = <&mailbox5 &mbox_dsp1_ipc3x>;
-        timers = <&timer5>;
-        watchdog-timers = <&timer10>;
-};
-
-&dsp2 {
-        status = "okay";
-        memory-region = <&dsp2_cma_pool>;
-        mboxes = <&mailbox6 &mbox_dsp2_ipc3x>;
-        timers = <&timer6>;
-};
-
 &dss {
         status = "okay";
 
@@ -1440,29 +1072,18 @@ i2c_p3_exp: &i2c2 {
                         reg = <2>;
 
                         dpi_out3: endpoint {
-                                remote-endpoint = <&fpd_in>;
                                 data-lines = <24>;
                         };
                 };
         };
 };
 
-&bb2d {
-        status = "okay";
-};
-
 &hdmi {
-        status = "ok";
         vdda-supply = <&ldo3_reg>;
-
-        port {
-                hdmi_out: endpoint {
-                        remote-endpoint = <&tpd12s015_in>;
-                };
-        };
 };
 
-&vip1 {
+&mcasp8 {
+        /* not used for audio. only the AXR2 pin is used as GPIO */
         status = "okay";
 };
 
@@ -1474,6 +1095,10 @@ video_in: &vin1a {
         };
 };
 
+&bb2d {
+        status = "okay";
+};
+
 #include "dra7xx-jamr3.dtsi"
 &tvp_5158{
         mux-gpios = <&pcf_hdmi 3 GPIO_ACTIVE_HIGH>,     /*CAM_FPD_MUX_S0*/
diff --git a/arch/arm/boot/dts/dra7.dtsi b/arch/arm/boot/dts/dra7.dtsi
index 4a2b643bd60d..43316d454d41 100644
--- a/arch/arm/boot/dts/dra7.dtsi
+++ b/arch/arm/boot/dts/dra7.dtsi
@@ -300,7 +300,6 @@
                          * node and enable pcie1_ep mode.
                          */
                         pcie1_rc: pcie_rc@51000000 {
-                                compatible = "ti,dra7-pcie";
                                 reg = <0x51000000 0x2000>, <0x51002000 0x14c>, <0x1000 0x2000>;
                                 reg-names = "rc_dbics", "ti_conf", "config";
                                 interrupts = <0 232 0x4>, <0 233 0x4>;
@@ -315,6 +314,8 @@
                                 ti,hwmods = "pcie1";
                                 phys = <&pcie1_phy>;
                                 phy-names = "pcie-phy0";
+                                syscon-lane-conf = <&scm_conf 0x558>;
+                                syscon-lane-sel = <&scm_conf_pcie 0x18>;
                                 interrupt-map-mask = <0 0 0 7>;
                                 interrupt-map = <0 0 0 1 &pcie1_intc 1>,
                                                 <0 0 0 2 &pcie1_intc 2>,
@@ -329,7 +330,6 @@
                         };
 
                         pcie1_ep: pcie_ep@51000000 {
-                                compatible = "ti,dra7-pcie-ep";
                                 reg = <0x51000000 0x28>, <0x51002000 0x14c>, <0x51001000 0x28>, <0x1000 0x10000000>;
                                 reg-names = "ep_dbics", "ti_conf", "ep_dbics2", "addr_space";
                                 interrupts = <0 232 0x4>;
@@ -351,8 +351,7 @@
                         ranges = <0x51800000 0x51800000 0x3000
                                   0x0        0x30000000 0x10000000>;
                         status = "disabled";
-                        pcie@51800000 {
-                                compatible = "ti,dra7-pcie";
+                        pcie2_rc: pcie@51800000 {
                                 reg = <0x51800000 0x2000>, <0x51802000 0x14c>, <0x1000 0x2000>;
                                 reg-names = "rc_dbics", "ti_conf", "config";
                                 interrupts = <0 355 0x4>, <0 356 0x4>;
diff --git a/arch/arm/boot/dts/dra72-evm-common.dtsi b/arch/arm/boot/dts/dra72-evm-common.dtsi
index 4ff5187da184..aa3b8abde63d 100644
--- a/arch/arm/boot/dts/dra72-evm-common.dtsi
+++ b/arch/arm/boot/dts/dra72-evm-common.dtsi
@@ -16,7 +16,6 @@
 
         aliases {
                 display0 = &hdmi0;
-                display1 = &fpd_disp;
                 sound0 = &snd0;
                 sound1 = &hdmi;
                 i2c7 = &disp_ser;
@@ -589,35 +588,14 @@ i2c_p3_exp: &i2c5 {
         disp_ser: serializer@1b {
                 compatible = "ti,ds90uh925q";
                 reg = <0x1b>;
+                status = "disabled";
 
                 #address-cells = <1>;
                 #size-cells = <0>;
-                ranges = <0x2c 0x2c>,
-                        <0x1c 0x1c>;
-
-                disp_des: deserializer@2c {
-                        compatible = "ti,ds90uh928q";
-                        reg = <0x2c>;
-                        slave-mode;
-                };
-
-                /* TLC chip for LCD panel power and backlight */
-                fpd_disp: tlc59108@1c {
-                        status = "disabled";
-                        reg = <0x1c>;
-                        compatible = "ti,tlc59108-fpddisp";
-                        enable-gpios = <&pcf_gpio_21 0 GPIO_ACTIVE_LOW>;
-                        /* P0, SEL_GPMC_AD_VID_S0 */
-
-                        port@lcd3 {
-                                        fpd_in: endpoint {
-                                        remote-endpoint = <&dpi_out3>;
-                                };
-                        };
-                };
         };
 };
 
+
 &dss {
         status = "ok";
         vdda_video-supply = <&ldo5_reg>;
@@ -630,7 +608,6 @@ i2c_p3_exp: &i2c5 {
                         reg = <2>;
 
                         dpi_out3: endpoint {
-                                remote-endpoint = <&fpd_in>;
                                 data-lines = <24>;
                         };
                 };
diff --git a/arch/arm/boot/dts/dra72-evm-fpd-lg.dts b/arch/arm/boot/dts/dra72-evm-fpd-lg.dts
new file mode 100644
index 000000000000..9ed0f66fdb76
--- /dev/null
+++ b/arch/arm/boot/dts/dra72-evm-fpd-lg.dts
@@ -0,0 +1,39 @@
+#include "dra72-evm.dts"
+#include "dra7x-evm-fpd-lg.dtsi"
+
+/* Set display aliases for use by Android */
+/ {
+        aliases {
+                display0 = &fpd_disp;
+                display1 = &hdmi0;
+        };
+};
+
+&dss {
+        ports {
+                status = "ok";
+        };
+};
+
+&disp_ser {
+        status = "ok";
+        ranges = <0x2c 0x2c>,
+                <0x1c 0x1c>;
+};
+
+/* Tie the end points of DSS and FPDLink together */
+
+&fpd_in {
+        remote-endpoint = <&dpi_out3>;
+};
+
+&dpi_out3 {
+        remote-endpoint = <&fpd_in>;
+};
+
+&lcd_fpd {
+        enable-gpios = <&pcf_gpio_21 0 GPIO_ACTIVE_LOW>;
+        /* P0, SEL_GPMC_AD_VID_S0 */
+
+        status = "ok";
+};
diff --git a/arch/arm/boot/dts/dra72-evm.dts b/arch/arm/boot/dts/dra72-evm.dts
index deef9b8520b2..cc108d2f9b09 100644
--- a/arch/arm/boot/dts/dra72-evm.dts
+++ b/arch/arm/boot/dts/dra72-evm.dts
@@ -11,7 +11,6 @@
 
         aliases {
                 display0 = &hdmi0;
-                display1 = &fpd_disp;
                 sound1 = &hdmi;
                 i2c7 = &disp_ser;
         };
@@ -215,39 +214,6 @@
         };
 };
 
-&i2c5 {
-        disp_ser: serializer@1b {
-                compatible = "ti,ds90uh925q";
-                reg = <0x1b>;
-
-                #address-cells = <1>;
-                #size-cells = <0>;
-                ranges = <0x2c 0x2c>,
-                        <0x1c 0x1c>;
-
-                disp_des: deserializer@2c {
-                        compatible = "ti,ds90uh928q";
-                        reg = <0x2c>;
-                        slave-mode;
-                };
-
-                /* TLC chip for LCD panel power and backlight */
-                fpd_disp: tlc59108@1c {
-                        status = "disabled";
-                        reg = <0x1c>;
-                        compatible = "ti,tlc59108-fpddisp";
-                        enable-gpios = <&pcf_gpio_21 0 GPIO_ACTIVE_LOW>;
-                        /* P0, SEL_GPMC_AD_VID_S0 */
-
-                        port@lcd3 {
-                                        fpd_in: endpoint {
-                                        remote-endpoint = <&dpi_out3>;
-                                };
-                        };
-                };
-        };
-};
-
 &hdmi {
         vdda_video-supply = <&ldo5_reg>;
 };
diff --git a/arch/arm/boot/dts/dra72x.dtsi b/arch/arm/boot/dts/dra72x.dtsi
index 68341c30beb1..29705754460c 100644
--- a/arch/arm/boot/dts/dra72x.dtsi
+++ b/arch/arm/boot/dts/dra72x.dtsi
@@ -140,3 +140,15 @@
                 status = "disabled";
         };
 };
+
+&pcie1_rc {
+        compatible = "ti,dra726-pcie-rc";
+};
+
+&pcie1_ep {
+        compatible = "ti,dra726-pcie-ep";
+};
+
+&pcie2_rc {
+        compatible = "ti,dra726-pcie-rc";
+};
diff --git a/arch/arm/boot/dts/dra74x.dtsi b/arch/arm/boot/dts/dra74x.dtsi
index b96f6c7f77d0..a95a1d17ad2d 100644
--- a/arch/arm/boot/dts/dra74x.dtsi
+++ b/arch/arm/boot/dts/dra74x.dtsi
@@ -259,3 +259,15 @@
                 status = "disabled";
         };
 };
+
+&pcie1_rc {
+        compatible = "ti,dra746-pcie-rc";
+};
+
+&pcie1_ep {
+        compatible = "ti,dra746-pcie-ep";
+};
+
+&pcie2_rc {
+        compatible = "ti,dra746-pcie-rc";
+};
diff --git a/arch/arm/boot/dts/dra76-evm-fpd-auo-g101evn01.0.dts b/arch/arm/boot/dts/dra76-evm-fpd-auo-g101evn01.0.dts
new file mode 100644
index 000000000000..69983d70d1f4
--- /dev/null
+++ b/arch/arm/boot/dts/dra76-evm-fpd-auo-g101evn01.0.dts
@@ -0,0 +1,67 @@
+#include "dra76-evm.dts"
+#include "dra7x-evm-fpd-auo-g101evn01.0.dtsi"
+
+/ {
+        aliases {
+                display0 = &fpd_disp;
+                display1 = &hdmi0;
+        };
+};
+
+&dss {
+        ports {
+                status = "ok";
+        };
+};
+
+&disp_ser {
+        status = "ok";
+        ranges = <0x0 0x2d>;
+};
+
+/* Tie the end points of DSS and FPDLink together */
+&fpd_in {
+        remote-endpoint = <&dpi_out3>;
+};
+
+&dpi_out3 {
+        remote-endpoint = <&fpd_in>;
+};
+
+&lcd_fpd {
+        status = "ok";
+};
+
+/* U21 on the EVM */
+/* gpmc_ad_vid_s0: high: GPMC , low: VOUT3 */
+&pcf_gpio_21 {
+        p0 {
+                gpio-hog;
+                gpios = <0 GPIO_ACTIVE_HIGH>;
+                output-low;
+                line-name = "gpmc_ad_vid_s0";
+        };
+};
+
+
+/* U110 on the EVM. For Rev A boards */
+/*
+&pcf_hdmi {
+        p11 {
+                gpio-hog;
+                gpios = <11 GPIO_ACTIVE_HIGH>;
+                output-low;
+                line-name = "disp1_vpoc_onn";
+        };
+};
+*/
+
+/* For supplying power to the display via FPDLink */
+&gpio2 {
+        p2 {
+                gpio-hog;
+                gpios =  <2 GPIO_ACTIVE_HIGH>;
+                output-low;
+                line-name = "disp1_vpoc_onn";
+        };
+};
diff --git a/arch/arm/boot/dts/dra76-evm.dts b/arch/arm/boot/dts/dra76-evm.dts
new file mode 100644
index 000000000000..213f4b53f965
--- /dev/null
+++ b/arch/arm/boot/dts/dra76-evm.dts
@@ -0,0 +1,498 @@
+/*
+ * Copyright (C) 2017 Texas Instruments Incorporated - http://www.ti.com/
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+/dts-v1/;
+
+#include "dra76x.dtsi"
+#include "dra7-evm-common.dtsi"
+#include "dra76x-mmc-iodelay.dtsi"
+#include <dt-bindings/net/ti-dp83867.h>
+
+/ {
+        model = "TI DRA762 EVM";
+        compatible = "ti,dra76-evm", "ti,dra76", "ti,dra7";
+
+        memory {
+                device_type = "memory";
+                reg = <0x0 0x80000000 0x0 0x80000000>;
+        };
+
+        reserved-memory {
+                #address-cells = <2>;
+                #size-cells = <2>;
+                ranges;
+
+                ipu2_cma_pool: ipu2_cma@95800000 {
+                        compatible = "shared-dma-pool";
+                        reg = <0x0 0x95800000 0x0 0x3800000>;
+                        reusable;
+                        status = "okay";
+                };
+
+                dsp1_cma_pool: dsp1_cma@99000000 {
+                        compatible = "shared-dma-pool";
+                        reg = <0x0 0x99000000 0x0 0x4000000>;
+                        reusable;
+                        status = "okay";
+                };
+
+                ipu1_cma_pool: ipu1_cma@9d000000 {
+                        compatible = "shared-dma-pool";
+                        reg = <0x0 0x9d000000 0x0 0x2000000>;
+                        reusable;
+                        status = "okay";
+                };
+
+                dsp2_cma_pool: dsp2_cma@9f000000 {
+                        compatible = "shared-dma-pool";
+                        reg = <0x0 0x9f000000 0x0 0x800000>;
+                        reusable;
+                        status = "okay";
+                };
+        };
+
+        aliases {
+                i2c7 = &disp_ser;
+        };
+
+        vsys_12v0: fixedregulator-vsys12v0 {
+                /* main supply */
+                compatible = "regulator-fixed";
+                regulator-name = "vsys_12v0";
+                regulator-min-microvolt = <12000000>;
+                regulator-max-microvolt = <12000000>;
+                regulator-always-on;
+                regulator-boot-on;
+        };
+
+        vsys_5v0: fixedregulator-vsys5v0 {
+                /* Output of Cntlr B of TPS43351-Q1 on dra76-evm */
+                compatible = "regulator-fixed";
+                regulator-name = "vsys_5v0";
+                regulator-min-microvolt = <5000000>;
+                regulator-max-microvolt = <5000000>;
+                vin-supply = <&vsys_12v0>;
+                regulator-always-on;
+                regulator-boot-on;
+        };
+
+        vsys_3v3: fixedregulator-vsys3v3 {
+                /* Output of Cntlr A of TPS43351-Q1 on dra76-evm */
+                compatible = "regulator-fixed";
+                regulator-name = "vsys_3v3";
+                regulator-min-microvolt = <3300000>;
+                regulator-max-microvolt = <3300000>;
+                vin-supply = <&vsys_12v0>;
+                regulator-always-on;
+                regulator-boot-on;
+        };
+
+        vio_3v3: fixedregulator-vio_3v3 {
+                compatible = "regulator-fixed";
+                regulator-name = "vio_3v3";
+                regulator-min-microvolt = <3300000>;
+                regulator-max-microvolt = <3300000>;
+                vin-supply = <&vsys_3v3>;
+                regulator-always-on;
+                regulator-boot-on;
+        };
+
+        vio_3v3_sd: fixedregulator-sd {
+                compatible = "regulator-fixed";
+                regulator-name = "vio_3v3_sd";
+                regulator-min-microvolt = <3300000>;
+                regulator-max-microvolt = <3300000>;
+                vin-supply = <&vio_3v3>;
+                enable-active-high;
+                gpio = <&gpio4 21 GPIO_ACTIVE_HIGH>;
+        };
+
+        vio_1v8: fixedregulator-vio_1v8 {
+                compatible = "regulator-fixed";
+                regulator-name = "vio_1v8";
+                regulator-min-microvolt = <1800000>;
+                regulator-max-microvolt = <1800000>;
+                vin-supply = <&smps5_reg>;
+        };
+
+        vtt_fixed: fixedregulator-vtt {
+                compatible = "regulator-fixed";
+                regulator-name = "vtt_fixed";
+                regulator-min-microvolt = <1350000>;
+                regulator-max-microvolt = <1350000>;
+                vin-supply = <&vsys_3v3>;
+                regulator-always-on;
+                regulator-boot-on;
+        };
+
+        aic_dvdd: fixedregulator-aic_dvdd {
+                /* TPS77018DBVT */
+                compatible = "regulator-fixed";
+                regulator-name = "aic_dvdd";
+                vin-supply = <&vio_3v3>;
+                regulator-min-microvolt = <1800000>;
+                regulator-max-microvolt = <1800000>;
+        };
+};
+
+&i2c1 {
+        status = "okay";
+        clock-frequency = <400000>;
+
+        tps65917: tps65917@58 {
+                compatible = "ti,tps65917";
+                reg = <0x58>;
+                ti,system-power-controller;
+                interrupt-controller;
+                #interrupt-cells = <2>;
+
+                tps65917_pmic {
+                        compatible = "ti,tps65917-pmic";
+
+                        smps12-in-supply = <&vsys_3v3>;
+                        smps3-in-supply = <&vsys_3v3>;
+                        smps4-in-supply = <&vsys_3v3>;
+                        smps5-in-supply = <&vsys_3v3>;
+                        ldo1-in-supply = <&vsys_3v3>;
+                        ldo2-in-supply = <&vsys_3v3>;
+                        ldo3-in-supply = <&vsys_5v0>;
+                        ldo4-in-supply = <&vsys_5v0>;
+                        ldo5-in-supply = <&vsys_3v3>;
+
+                        tps65917_regulators: regulators {
+                                smps12_reg: smps12 {
+                                        /* VDD_DSPEVE */
+                                        regulator-name = "smps12";
+                                        regulator-min-microvolt = <850000>;
+                                        regulator-max-microvolt = <1250000>;
+                                        regulator-always-on;
+                                        regulator-boot-on;
+                                };
+
+                                smps3_reg: smps3 {
+                                        /* VDD_CORE */
+                                        regulator-name = "smps3";
+                                        regulator-min-microvolt = <850000>;
+                                        regulator-max-microvolt = <1250000>;
+                                        regulator-boot-on;
+                                        regulator-always-on;
+                                };
+
+                                smps4_reg: smps4 {
+                                        /* VDD_IVA */
+                                        regulator-name = "smps4";
+                                        regulator-min-microvolt = <850000>;
+                                        regulator-max-microvolt = <1250000>;
+                                        regulator-always-on;
+                                        regulator-boot-on;
+                                };
+
+                                smps5_reg: smps5 {
+                                        /* VDDS1V8 */
+                                        regulator-name = "smps5";
+                                        regulator-min-microvolt = <1800000>;
+                                        regulator-max-microvolt = <1800000>;
+                                        regulator-boot-on;
+                                        regulator-always-on;
+                                };
+
+                                ldo1_reg: ldo1 {
+                                        /* LDO1_OUT --> VDA_PHY1_1V8  */
+                                        regulator-name = "ldo1";
+                                        regulator-min-microvolt = <1800000>;
+                                        regulator-max-microvolt = <1800000>;
+                                        regulator-always-on;
+                                        regulator-boot-on;
+                                        regulator-allow-bypass;
+                                };
+
+                                ldo2_reg: ldo2 {
+                                        /* LDO2_OUT --> VDA_PHY2_1V8 */
+                                        regulator-name = "ldo2";
+                                        regulator-min-microvolt = <1800000>;
+                                        regulator-max-microvolt = <1800000>;
+                                        regulator-allow-bypass;
+                                        regulator-always-on;
+                                };
+
+                                ldo3_reg: ldo3 {
+                                        /* VDA_USB_3V3 */
+                                        regulator-name = "ldo3";
+                                        regulator-min-microvolt = <3300000>;
+                                        regulator-max-microvolt = <3300000>;
+                                        regulator-boot-on;
+                                        regulator-always-on;
+                                };
+
+                                ldo5_reg: ldo5 {
+                                        /* VDDA_1V8_PLL */
+                                        regulator-name = "ldo5";
+                                        regulator-min-microvolt = <1800000>;
+                                        regulator-max-microvolt = <1800000>;
+                                        regulator-always-on;
+                                        regulator-boot-on;
+                                };
+
+                                ldo4_reg: ldo4 {
+                                        /* VDD_SDIO_DV */
+                                        regulator-name = "ldo4";
+                                        regulator-min-microvolt = <1800000>;
+                                        regulator-max-microvolt = <3300000>;
+                                        regulator-boot-on;
+                                        regulator-always-on;
+                                };
+                        };
+                };
+
+                tps65917_power_button {
+                        compatible = "ti,palmas-pwrbutton";
+                        interrupt-parent = <&tps65917>;
+                        interrupts = <1 IRQ_TYPE_NONE>;
+                        wakeup-source;
+                        ti,palmas-long-press-seconds = <6>;
+                };
+        };
+
+        lp87565: lp87565@60 {
+                compatible = "ti,lp87565-q1";
+                reg = <0x60>;
+
+                buck10-in-supply =<&vsys_3v3>;
+                buck23-in-supply =<&vsys_3v3>;
+
+                regulators: regulators {
+                        buck10_reg: buck10 {
+                                /*VDD_MPU*/
+                                regulator-name = "buck10";
+                                regulator-min-microvolt = <850000>;
+                                regulator-max-microvolt = <1250000>;
+                                regulator-always-on;
+                                regulator-boot-on;
+                        };
+
+                        buck23_reg: buck23 {
+                                /* VDD_GPU*/
+                                regulator-name = "buck23";
+                                regulator-min-microvolt = <850000>;
+                                regulator-max-microvolt = <1250000>;
+                                regulator-boot-on;
+                                regulator-always-on;
+                        };
+                };
+        };
+
+        pcf_lcd: pcf8757@20 {
+                compatible = "ti,pcf8575", "nxp,pcf8575";
+                reg = <0x20>;
+                gpio-controller;
+                #gpio-cells = <2>;
+                interrupt-controller;
+                #interrupt-cells = <2>;
+                interrupt-parent = <&gpio1>;
+                interrupts = <3 IRQ_TYPE_EDGE_FALLING>;
+        };
+
+        pcf_gpio_21: pcf8757@21 {
+                compatible = "ti,pcf8575", "nxp,pcf8575";
+                reg = <0x21>;
+                gpio-controller;
+                #gpio-cells = <2>;
+                interrupt-parent = <&gpio1>;
+                interrupts = <3 IRQ_TYPE_EDGE_FALLING>;
+                interrupt-controller;
+                #interrupt-cells = <2>;
+        };
+
+        pcf_hdmi: pcf8575@26 {
+                compatible = "ti,pcf8575", "nxp,pcf8575";
+                reg = <0x26>;
+                gpio-controller;
+                #gpio-cells = <2>;
+                p1 {
+                        /* vin6_sel_s0: high: VIN6, low: audio */
+                        gpio-hog;
+                        gpios = <1 GPIO_ACTIVE_HIGH>;
+                        output-low;
+                        line-name = "vin6_sel_s0";
+                };
+        };
+
+        tlv320aic3106: tlv320aic3106@19 {
+                #sound-dai-cells = <0>;
+                compatible = "ti,tlv320aic3106";
+                reg = <0x19>;
+                adc-settle-ms = <40>;
+                ai3x-micbias-vg = <1>;          /* 2.0V */
+                status = "okay";
+
+                /* Regulators */
+                AVDD-supply = <&vio_3v3>;
+                IOVDD-supply = <&vio_3v3>;
+                DRVDD-supply = <&vio_3v3>;
+                DVDD-supply = <&aic_dvdd>;
+        };
+};
+
+&tpd12s015 {
+        compatible = "ti,tpd12s015";
+
+        gpios = <&gpio7 30 GPIO_ACTIVE_HIGH>,   /* gpio7_30, CT CP HPD */
+                <&gpio7 31 GPIO_ACTIVE_HIGH>,   /* gpio7_31, LS OE */
+                <&gpio7 12 GPIO_ACTIVE_HIGH>;   /* gpio7_12/sp1_cs2, HPD */
+
+};
+
+&mmc1 {
+        status = "okay";
+        vmmc-supply = <&vio_3v3_sd>;
+        vmmc_aux-supply = <&ldo4_reg>;
+        bus-width = <4>;
+        /*
+         * SDCD signal is not being used here - using the fact that GPIO mode
+         * is always hardwired.
+         */
+        cd-gpios = <&gpio6 27 GPIO_ACTIVE_LOW>;
+        max-frequency = <192000000>;
+        pinctrl-names = "default", "hs";
+        pinctrl-0 = <&mmc1_pins_default>;
+        pinctrl-1 = <&mmc1_pins_hs>;
+};
+
+&mmc2 {
+        status = "okay";
+        vmmc-supply = <&vio_1v8>;
+        bus-width = <8>;
+        max-frequency = <192000000>;
+        pinctrl-names = "default", "hs", "ddr_1_8v", "hs200_1_8v";
+        pinctrl-0 = <&mmc2_pins_default>;
+        pinctrl-1 = <&mmc2_pins_hs>;
+        pinctrl-2 = <&mmc2_pins_ddr>;
+        pinctrl-3 = <&mmc2_pins_hs200 &mmc2_iodelay_hs200_conf>;
+};
+
+&oppdm_mpu {
+        vdd-supply = <&buck10_reg>;
+};
+
+&oppdm_dspeve {
+        vdd-supply = <&smps12_reg>;
+};
+
+&oppdm_gpu {
+        vdd-supply = <&buck23_reg>;
+};
+
+&oppdm_ivahd {
+        vdd-supply = <&smps4_reg>;
+};
+
+&oppdm_core {
+        vdd-supply = <&smps3_reg>;
+};
+
+/* No RTC on this device */
+&rtc {
+        status = "disabled";
+};
+
+&mac {
+        status = "okay";
+
+        dual_emac;
+};
+
+&cpsw_emac0 {
+        phy_id = <&davinci_mdio>, <2>;
+        phy-mode = "rgmii-id";
+        dual_emac_res_vlan = <1>;
+};
+
+&cpsw_emac1 {
+        phy_id = <&davinci_mdio>, <3>;
+        phy-mode = "rgmii-id";
+        dual_emac_res_vlan = <2>;
+};
+
+&davinci_mdio {
+        dp83867_0: ethernet-phy@2 {
+                reg = <2>;
+                ti,rx-internal-delay = <DP83867_RGMIIDCTL_2_25_NS>;
+                ti,tx-internal-delay = <DP83867_RGMIIDCTL_250_PS>;
+                ti,fifo-depth = <DP83867_PHYCR_FIFO_DEPTH_8_B_NIB>;
+                ti,min-output-impedance;
+                ti,dp83867-rxctrl-strap-quirk;
+        };
+
+        dp83867_1: ethernet-phy@3 {
+                reg = <3>;
+                ti,rx-internal-delay = <DP83867_RGMIIDCTL_2_25_NS>;
+                ti,tx-internal-delay = <DP83867_RGMIIDCTL_250_PS>;
+                ti,fifo-depth = <DP83867_PHYCR_FIFO_DEPTH_8_B_NIB>;
+                ti,min-output-impedance;
+                ti,dp83867-rxctrl-strap-quirk;
+        };
+};
+
+&usb2_phy1 {
+        phy-supply = <&ldo3_reg>;
+};
+
+&usb2_phy2 {
+        phy-supply = <&ldo3_reg>;
+};
+
+&i2c3 {
+        disp_ser: serializer@0c {
+                compatible = "ti,ds90ub921q";
+                reg = <0x0c>;
+
+                #address-cells = <1>;
+                #size-cells = <0>;
+                status = "disabled";
+        };
+};
+
+&dss {
+        status = "ok";
+        vdda_video-supply = <&ldo5_reg>;
+
+        ports {
+                #address-cells = <1>;
+                #size-cells = <0>;
+
+                status = "disabled";
+
+                port@lcd3 {
+                        reg = <2>;
+
+                        dpi_out3: endpoint {
+                                data-lines = <24>;
+                        };
+                };
+        };
+};
+
+&hdmi {
+        vdda-supply = <&ldo1_reg>;
+};
+
+&qspi {
+        spi-max-frequency = <96000000>;
+        m25p80@0 {
+                spi-max-frequency = <96000000>;
+        };
+};
+
+&pcie2_phy {
+        status = "okay";
+};
+
+&pcie1_rc {
+        num-lanes = <2>;
+        phys = <&pcie1_phy>, <&pcie2_phy>;
+        phy-names = "pcie-phy0", "pcie-phy1";
+};
diff --git a/arch/arm/boot/dts/dra76x-mmc-iodelay.dtsi b/arch/arm/boot/dts/dra76x-mmc-iodelay.dtsi
new file mode 100644
index 000000000000..c95a8a1091ab
--- /dev/null
+++ b/arch/arm/boot/dts/dra76x-mmc-iodelay.dtsi
@@ -0,0 +1,435 @@
+/*
+ * MMC IOdelay values for TI's DRA76x and AM576x SoCs.
+ *
+ * Copyright (C) 2017 Texas Instruments Incorporated - http://www.ti.com/
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation version 2.
+ *
+ * This program is distributed "as is" WITHOUT ANY WARRANTY of any
+ * kind, whether express or implied; without even the implied warranty
+ * of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/*
+ * Rules for modifying this file:
+ * a) Update of this file should typically correspond to a datamanual revision.
+ *    Datamanual revision that was used should be updated in comment below.
+ *    If there is no update to datamanual, do not update the values. If you
+ *    need to use values different from that recommended by the datamanual
+ *    for your design, then you should consider adding values to the device-
+ *    -tree file for your board directly.
+ * b) We keep the mode names as close to the datamanual as possible. So
+ *    if the manual calls a mode, DDR50, or DDR or DDR 1.8v or DDR 3.3v,
+ *    we follow that in code too.
+ * c) If the values change between multiple revisions of silicon, we add
+ *    a revision tag to both the new and old entry. Use 'rev11' for PG 1.1,
+ *    'rev20' for PG 2.0 and so on.
+ * d) The node name and node label should be the exact same string. This is
+ *    to curb naming creativity and achieve consistency.
+ *
+ * Datamanual Revisions:
+ *
+ * DRA76x Silicon Revision 1.0: SPRS993A, Revised July 2017
+ *
+ */
+
+&dra7_pmx_core {
+        mmc1_pins_default: mmc1_pins_default {
+                pinctrl-single,pins = <
+                        DRA7XX_CORE_IOPAD(0x3754, PIN_INPUT_PULLUP | MUX_MODE0) /* mmc1_clk.clk */
+                        DRA7XX_CORE_IOPAD(0x3758, PIN_INPUT_PULLUP | MUX_MODE0) /* mmc1_cmd.cmd */
+                        DRA7XX_CORE_IOPAD(0x375c, PIN_INPUT_PULLUP | MUX_MODE0) /* mmc1_dat0.dat0 */
+                        DRA7XX_CORE_IOPAD(0x3760, PIN_INPUT_PULLUP | MUX_MODE0) /* mmc1_dat1.dat1 */
+                        DRA7XX_CORE_IOPAD(0x3764, PIN_INPUT_PULLUP | MUX_MODE0) /* mmc1_dat2.dat2 */
+                        DRA7XX_CORE_IOPAD(0x3768, PIN_INPUT_PULLUP | MUX_MODE0) /* mmc1_dat3.dat3 */
+                >;
+        };
+
+        mmc1_pins_sdr12: mmc1_pins_sdr12 {
+                pinctrl-single,pins = <
+                        DRA7XX_CORE_IOPAD(0x3754, PIN_INPUT_PULLUP | MUX_MODE0) /* mmc1_clk.clk */
+                        DRA7XX_CORE_IOPAD(0x3758, PIN_INPUT_PULLUP | MUX_MODE0) /* mmc1_cmd.cmd */
+                        DRA7XX_CORE_IOPAD(0x375c, PIN_INPUT_PULLUP | MUX_MODE0) /* mmc1_dat0.dat0 */
+                        DRA7XX_CORE_IOPAD(0x3760, PIN_INPUT_PULLUP | MUX_MODE0) /* mmc1_dat1.dat1 */
+                        DRA7XX_CORE_IOPAD(0x3764, PIN_INPUT_PULLUP | MUX_MODE0) /* mmc1_dat2.dat2 */
+                        DRA7XX_CORE_IOPAD(0x3768, PIN_INPUT_PULLUP | MUX_MODE0) /* mmc1_dat3.dat3 */
+                >;
+        };
+
+        mmc1_pins_hs: mmc1_pins_hs {
+                pinctrl-single,pins = <
+                        DRA7XX_CORE_IOPAD(0x3754, PIN_INPUT_PULLUP | MUX_VIRTUAL_MODE11 | MUX_MODE0) /* mmc1_clk.clk */
+                        DRA7XX_CORE_IOPAD(0x3758, PIN_INPUT_PULLUP | MUX_VIRTUAL_MODE11 | MUX_MODE0) /* mmc1_cmd.cmd */
+                        DRA7XX_CORE_IOPAD(0x375c, PIN_INPUT_PULLUP | MUX_VIRTUAL_MODE11 | MUX_MODE0) /* mmc1_dat0.dat0 */
+                        DRA7XX_CORE_IOPAD(0x3760, PIN_INPUT_PULLUP | MUX_VIRTUAL_MODE11 | MUX_MODE0) /* mmc1_dat1.dat1 */
+                        DRA7XX_CORE_IOPAD(0x3764, PIN_INPUT_PULLUP | MUX_VIRTUAL_MODE11 | MUX_MODE0) /* mmc1_dat2.dat2 */
+                        DRA7XX_CORE_IOPAD(0x3768, PIN_INPUT_PULLUP | MUX_VIRTUAL_MODE11 | MUX_MODE0) /* mmc1_dat3.dat3 */
+                >;
+        };
+
+        mmc1_pins_sdr25: mmc1_pins_sdr25 {
+                pinctrl-single,pins = <
+                        DRA7XX_CORE_IOPAD(0x3754, PIN_INPUT_PULLUP | MUX_VIRTUAL_MODE11 | MUX_MODE0)    /* mmc1_clk.clk */
+                        DRA7XX_CORE_IOPAD(0x3758, PIN_INPUT_PULLUP | MUX_VIRTUAL_MODE11 | MUX_MODE0)    /* mmc1_cmd.cmd */
+                        DRA7XX_CORE_IOPAD(0x375c, PIN_INPUT_PULLUP | MUX_VIRTUAL_MODE11 | MUX_MODE0)    /* mmc1_dat0.dat0 */
+                        DRA7XX_CORE_IOPAD(0x3760, PIN_INPUT_PULLUP | MUX_VIRTUAL_MODE11 | MUX_MODE0)    /* mmc1_dat1.dat1 */
+                        DRA7XX_CORE_IOPAD(0x3764, PIN_INPUT_PULLUP | MUX_VIRTUAL_MODE11 | MUX_MODE0)    /* mmc1_dat2.dat2 */
+                        DRA7XX_CORE_IOPAD(0x3768, PIN_INPUT_PULLUP | MUX_VIRTUAL_MODE11 | MUX_MODE0)    /* mmc1_dat3.dat3 */
+                >;
+        };
+
+        mmc1_pins_sdr50: mmc1_pins_sdr50 {
+                pinctrl-single,pins = <
+                        DRA7XX_CORE_IOPAD(0x3754, PIN_INPUT_PULLUP | MUX_VIRTUAL_MODE10 | MUX_MODE0)    /* mmc1_clk.clk */
+                        DRA7XX_CORE_IOPAD(0x3758, PIN_INPUT_PULLUP | MUX_VIRTUAL_MODE10 | MUX_MODE0)    /* mmc1_cmd.cmd */
+                        DRA7XX_CORE_IOPAD(0x375c, PIN_INPUT_PULLUP | MUX_VIRTUAL_MODE10 | MUX_MODE0)    /* mmc1_dat0.dat0 */
+                        DRA7XX_CORE_IOPAD(0x3760, PIN_INPUT_PULLUP | MUX_VIRTUAL_MODE10 | MUX_MODE0)    /* mmc1_dat1.dat1 */
+                        DRA7XX_CORE_IOPAD(0x3764, PIN_INPUT_PULLUP | MUX_VIRTUAL_MODE10 | MUX_MODE0)    /* mmc1_dat2.dat2 */
+                        DRA7XX_CORE_IOPAD(0x3768, PIN_INPUT_PULLUP | MUX_VIRTUAL_MODE10 | MUX_MODE0)    /* mmc1_dat3.dat3 */
+                >;
+        };
+
+        mmc1_pins_ddr50: mmc1_pins_ddr50 {
+                pinctrl-single,pins = <
+                        DRA7XX_CORE_IOPAD(0x3754, PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)   /* mmc1_clk.clk */
+                        DRA7XX_CORE_IOPAD(0x3758, PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)   /* mmc1_cmd.cmd */
+                        DRA7XX_CORE_IOPAD(0x375c, PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)   /* mmc1_dat0.dat0 */
+                        DRA7XX_CORE_IOPAD(0x3760, PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)   /* mmc1_dat1.dat1 */
+                        DRA7XX_CORE_IOPAD(0x3764, PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)   /* mmc1_dat2.dat2 */
+                        DRA7XX_CORE_IOPAD(0x3768, PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)   /* mmc1_dat3.dat3 */
+                >;
+        };
+
+        mmc1_pins_sdr104: mmc1_pins_sdr104 {
+                pinctrl-single,pins = <
+                        DRA7XX_CORE_IOPAD(0x3754, PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)   /* mmc1_clk.clk */
+                        DRA7XX_CORE_IOPAD(0x3758, PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)   /* mmc1_cmd.cmd */
+                        DRA7XX_CORE_IOPAD(0x375c, PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)   /* mmc1_dat0.dat0 */
+                        DRA7XX_CORE_IOPAD(0x3760, PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)   /* mmc1_dat1.dat1 */
+                        DRA7XX_CORE_IOPAD(0x3764, PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)   /* mmc1_dat2.dat2 */
+                        DRA7XX_CORE_IOPAD(0x3768, PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)   /* mmc1_dat3.dat3 */
+                >;
+        };
+
+        mmc2_pins_default: mmc2_pins_default {
+                pinctrl-single,pins = <
+                        DRA7XX_CORE_IOPAD(0x349c, PIN_INPUT_PULLUP | MUX_MODE1) /* gpmc_a23.mmc2_clk */
+                        DRA7XX_CORE_IOPAD(0x34b0, PIN_INPUT_PULLUP | MUX_MODE1) /* gpmc_cs1.mmc2_cmd */
+                        DRA7XX_CORE_IOPAD(0x34a0, PIN_INPUT_PULLUP | MUX_MODE1) /* gpmc_a24.mmc2_dat0 */
+                        DRA7XX_CORE_IOPAD(0x34a4, PIN_INPUT_PULLUP | MUX_MODE1) /* gpmc_a25.mmc2_dat1 */
+                        DRA7XX_CORE_IOPAD(0x34a8, PIN_INPUT_PULLUP | MUX_MODE1) /* gpmc_a26.mmc2_dat2 */
+                        DRA7XX_CORE_IOPAD(0x34ac, PIN_INPUT_PULLUP | MUX_MODE1) /* gpmc_a27.mmc2_dat3 */
+                        DRA7XX_CORE_IOPAD(0x348c, PIN_INPUT_PULLUP | MUX_MODE1) /* gpmc_a19.mmc2_dat4 */
+                        DRA7XX_CORE_IOPAD(0x3490, PIN_INPUT_PULLUP | MUX_MODE1) /* gpmc_a20.mmc2_dat5 */
+                        DRA7XX_CORE_IOPAD(0x3494, PIN_INPUT_PULLUP | MUX_MODE1) /* gpmc_a21.mmc2_dat6 */
+                        DRA7XX_CORE_IOPAD(0x3498, PIN_INPUT_PULLUP | MUX_MODE1) /* gpmc_a22.mmc2_dat7 */
+                >;
+        };
+
+        mmc2_pins_hs: mmc2_pins_hs {
+                pinctrl-single,pins = <
+                        DRA7XX_CORE_IOPAD(0x349c, PIN_INPUT_PULLUP | MUX_MODE1) /* gpmc_a23.mmc2_clk */
+                        DRA7XX_CORE_IOPAD(0x34b0, PIN_INPUT_PULLUP | MUX_MODE1) /* gpmc_cs1.mmc2_cmd */
+                        DRA7XX_CORE_IOPAD(0x34a0, PIN_INPUT_PULLUP | MUX_MODE1) /* gpmc_a24.mmc2_dat0 */
+                        DRA7XX_CORE_IOPAD(0x34a4, PIN_INPUT_PULLUP | MUX_MODE1) /* gpmc_a25.mmc2_dat1 */
+                        DRA7XX_CORE_IOPAD(0x34a8, PIN_INPUT_PULLUP | MUX_MODE1) /* gpmc_a26.mmc2_dat2 */
+                        DRA7XX_CORE_IOPAD(0x34ac, PIN_INPUT_PULLUP | MUX_MODE1) /* gpmc_a27.mmc2_dat3 */
+                        DRA7XX_CORE_IOPAD(0x348c, PIN_INPUT_PULLUP | MUX_MODE1) /* gpmc_a19.mmc2_dat4 */
+                        DRA7XX_CORE_IOPAD(0x3490, PIN_INPUT_PULLUP | MUX_MODE1) /* gpmc_a20.mmc2_dat5 */
+                        DRA7XX_CORE_IOPAD(0x3494, PIN_INPUT_PULLUP | MUX_MODE1) /* gpmc_a21.mmc2_dat6 */
+                        DRA7XX_CORE_IOPAD(0x3498, PIN_INPUT_PULLUP | MUX_MODE1) /* gpmc_a22.mmc2_dat7 */
+                >;
+        };
+
+        mmc2_pins_ddr: mmc2_pins_ddr {
+                pinctrl-single,pins = <
+                        DRA7XX_CORE_IOPAD(0x349c, PIN_INPUT_PULLUP | MUX_MODE1) /* gpmc_a23.mmc2_clk */
+                        DRA7XX_CORE_IOPAD(0x34b0, PIN_INPUT_PULLUP | MUX_MODE1) /* gpmc_cs1.mmc2_cmd */
+                        DRA7XX_CORE_IOPAD(0x34a0, PIN_INPUT_PULLUP | MUX_MODE1) /* gpmc_a24.mmc2_dat0 */
+                        DRA7XX_CORE_IOPAD(0x34a4, PIN_INPUT_PULLUP | MUX_MODE1) /* gpmc_a25.mmc2_dat1 */
+                        DRA7XX_CORE_IOPAD(0x34a8, PIN_INPUT_PULLUP | MUX_MODE1) /* gpmc_a26.mmc2_dat2 */
+                        DRA7XX_CORE_IOPAD(0x34ac, PIN_INPUT_PULLUP | MUX_MODE1) /* gpmc_a27.mmc2_dat3 */
+                        DRA7XX_CORE_IOPAD(0x348c, PIN_INPUT_PULLUP | MUX_MODE1) /* gpmc_a19.mmc2_dat4 */
+                        DRA7XX_CORE_IOPAD(0x3490, PIN_INPUT_PULLUP | MUX_MODE1) /* gpmc_a20.mmc2_dat5 */
+                        DRA7XX_CORE_IOPAD(0x3494, PIN_INPUT_PULLUP | MUX_MODE1) /* gpmc_a21.mmc2_dat6 */
+                        DRA7XX_CORE_IOPAD(0x3498, PIN_INPUT_PULLUP | MUX_MODE1) /* gpmc_a22.mmc2_dat7 */
+                >;
+        };
+
+        mmc2_pins_hs200: mmc2_pins_hs200 {
+                pinctrl-single,pins = <
+                        DRA7XX_CORE_IOPAD(0x349c, PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE1) /* gpmc_a23.mmc2_clk */
+                        DRA7XX_CORE_IOPAD(0x34b0, PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE1) /* gpmc_cs1.mmc2_cmd */
+                        DRA7XX_CORE_IOPAD(0x34a0, PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE1) /* gpmc_a24.mmc2_dat0 */
+                        DRA7XX_CORE_IOPAD(0x34a4, PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE1) /* gpmc_a25.mmc2_dat1 */
+                        DRA7XX_CORE_IOPAD(0x34a8, PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE1) /* gpmc_a26.mmc2_dat2 */
+                        DRA7XX_CORE_IOPAD(0x34ac, PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE1) /* gpmc_a27.mmc2_dat3 */
+                        DRA7XX_CORE_IOPAD(0x348c, PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE1) /* gpmc_a19.mmc2_dat4 */
+                        DRA7XX_CORE_IOPAD(0x3490, PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE1) /* gpmc_a20.mmc2_dat5 */
+                        DRA7XX_CORE_IOPAD(0x3494, PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE1) /* gpmc_a21.mmc2_dat6 */
+                        DRA7XX_CORE_IOPAD(0x3498, PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE1) /* gpmc_a22.mmc2_dat7 */
+                >;
+        };
+
+        mmc3_pins_default: mmc3_pins_default {
+                pinctrl-single,pins = <
+                        DRA7XX_CORE_IOPAD(0x377c, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_clk.mmc3_clk */
+                        DRA7XX_CORE_IOPAD(0x3780, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_cmd.mmc3_cmd */
+                        DRA7XX_CORE_IOPAD(0x3784, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_dat0.mmc3_dat0 */
+                        DRA7XX_CORE_IOPAD(0x3788, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_dat1.mmc3_dat1 */
+                        DRA7XX_CORE_IOPAD(0x378c, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_dat2.mmc3_dat2 */
+                        DRA7XX_CORE_IOPAD(0x3790, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_dat3.mmc3_dat3 */
+                >;
+        };
+
+        mmc3_pins_hs: mmc3_pins_hs {
+                pinctrl-single,pins = <
+                        DRA7XX_CORE_IOPAD(0x377c, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_clk.mmc3_clk */
+                        DRA7XX_CORE_IOPAD(0x3780, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_cmd.mmc3_cmd */
+                        DRA7XX_CORE_IOPAD(0x3784, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_dat0.mmc3_dat0 */
+                        DRA7XX_CORE_IOPAD(0x3788, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_dat1.mmc3_dat1 */
+                        DRA7XX_CORE_IOPAD(0x378c, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_dat2.mmc3_dat2 */
+                        DRA7XX_CORE_IOPAD(0x3790, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_dat3.mmc3_dat3 */
+                >;
+        };
+
+        mmc3_pins_sdr12: mmc3_pins_sdr12 {
+                pinctrl-single,pins = <
+                        DRA7XX_CORE_IOPAD(0x377c, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_clk.mmc3_clk */
+                        DRA7XX_CORE_IOPAD(0x3780, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_cmd.mmc3_cmd */
+                        DRA7XX_CORE_IOPAD(0x3784, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_dat0.mmc3_dat0 */
+                        DRA7XX_CORE_IOPAD(0x3788, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_dat1.mmc3_dat1 */
+                        DRA7XX_CORE_IOPAD(0x378c, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_dat2.mmc3_dat2 */
+                        DRA7XX_CORE_IOPAD(0x3790, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_dat3.mmc3_dat3 */
+                >;
+        };
+
+        mmc3_pins_sdr25: mmc3_pins_sdr25 {
+                pinctrl-single,pins = <
+                        DRA7XX_CORE_IOPAD(0x377c, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_clk.mmc3_clk */
+                        DRA7XX_CORE_IOPAD(0x3780, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_cmd.mmc3_cmd */
+                        DRA7XX_CORE_IOPAD(0x3784, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_dat0.mmc3_dat0 */
+                        DRA7XX_CORE_IOPAD(0x3788, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_dat1.mmc3_dat1 */
+                        DRA7XX_CORE_IOPAD(0x378c, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_dat2.mmc3_dat2 */
+                        DRA7XX_CORE_IOPAD(0x3790, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_dat3.mmc3_dat3 */
+                >;
+        };
+
+        mmc3_pins_sdr50: mmc3_pins_sdr50 {
+                pinctrl-single,pins = <
+                        DRA7XX_CORE_IOPAD(0x377c, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_clk.mmc3_clk */
+                        DRA7XX_CORE_IOPAD(0x3780, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_cmd.mmc3_cmd */
+                        DRA7XX_CORE_IOPAD(0x3784, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_dat0.mmc3_dat0 */
+                        DRA7XX_CORE_IOPAD(0x3788, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_dat1.mmc3_dat1 */
+                        DRA7XX_CORE_IOPAD(0x378c, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_dat2.mmc3_dat2 */
+                        DRA7XX_CORE_IOPAD(0x3790, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_dat3.mmc3_dat3 */
+                >;
+        };
+
+        mmc4_pins_default: mmc4_pins_default {
+                pinctrl-single,pins = <
+                        DRA7XX_CORE_IOPAD(0x37e8, PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE3) /* uart1_ctsn.mmc4_clk */
+                        DRA7XX_CORE_IOPAD(0x37ec, PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE3) /* uart1_rtsn.mmc4_cmd */
+                        DRA7XX_CORE_IOPAD(0x37f0, PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE3) /* uart2_rxd.mmc4_dat0 */
+                        DRA7XX_CORE_IOPAD(0x37f4, PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE3) /* uart2_txd.mmc4_dat1 */
+                        DRA7XX_CORE_IOPAD(0x37f8, PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE3) /* uart2_ctsn.mmc4_dat2 */
+                        DRA7XX_CORE_IOPAD(0x37fc, PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE3) /* uart2_rtsn.mmc4_dat3 */
+                >;
+        };
+
+        mmc4_pins_sdr12: mmc4_pins_sdr12 {
+                pinctrl-single,pins = <
+                        DRA7XX_CORE_IOPAD(0x37e8, PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE3) /* uart1_ctsn.mmc4_clk */
+                        DRA7XX_CORE_IOPAD(0x37ec, PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE3) /* uart1_rtsn.mmc4_cmd */
+                        DRA7XX_CORE_IOPAD(0x37f0, PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE3) /* uart2_rxd.mmc4_dat0 */
+                        DRA7XX_CORE_IOPAD(0x37f4, PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE3) /* uart2_txd.mmc4_dat1 */
+                        DRA7XX_CORE_IOPAD(0x37f8, PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE3) /* uart2_ctsn.mmc4_dat2 */
+                        DRA7XX_CORE_IOPAD(0x37fc, PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE3) /* uart2_rtsn.mmc4_dat3 */
+                >;
+        };
+
+        mmc4_pins_hs: mmc4_pins_hs {
+                pinctrl-single,pins = <
+                        DRA7XX_CORE_IOPAD(0x37e8, PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE3) /* uart1_ctsn.mmc4_clk */
+                        DRA7XX_CORE_IOPAD(0x37ec, PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE3) /* uart1_rtsn.mmc4_cmd */
+                        DRA7XX_CORE_IOPAD(0x37f0, PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE3) /* uart2_rxd.mmc4_dat0 */
+                        DRA7XX_CORE_IOPAD(0x37f4, PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE3) /* uart2_txd.mmc4_dat1 */
+                        DRA7XX_CORE_IOPAD(0x37f8, PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE3) /* uart2_ctsn.mmc4_dat2 */
+                        DRA7XX_CORE_IOPAD(0x37fc, PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE3) /* uart2_rtsn.mmc4_dat3 */
+                >;
+        };
+
+        mmc4_pins_sdr25: mmc4_pins_sdr25 {
+                pinctrl-single,pins = <
+                        DRA7XX_CORE_IOPAD(0x37e8, PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE3) /* uart1_ctsn.mmc4_clk */
+                        DRA7XX_CORE_IOPAD(0x37ec, PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE3) /* uart1_rtsn.mmc4_cmd */
+                        DRA7XX_CORE_IOPAD(0x37f0, PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE3) /* uart2_rxd.mmc4_dat0 */
+                        DRA7XX_CORE_IOPAD(0x37f4, PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE3) /* uart2_txd.mmc4_dat1 */
+                        DRA7XX_CORE_IOPAD(0x37f8, PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE3) /* uart2_ctsn.mmc4_dat2 */
+                        DRA7XX_CORE_IOPAD(0x37fc, PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE3) /* uart2_rtsn.mmc4_dat3 */
+                >;
+        };
+};
+
+&dra7_iodelay_core {
+
+        /* Corresponds to MMC1_DDR_MANUAL1 in datamanual */
+        mmc1_iodelay_ddr_conf: mmc1_iodelay_ddr_conf {
+                pinctrl-single,pins = <
+                        0x618 (A_DELAY(489) | G_DELAY(0))       /* CFG_MMC1_CLK_IN */
+                        0x624 (A_DELAY(0) | G_DELAY(0)) /* CFG_MMC1_CMD_IN */
+                        0x630 (A_DELAY(374) | G_DELAY(0))       /* CFG_MMC1_DAT0_IN */
+                        0x63c (A_DELAY(31) | G_DELAY(0))        /* CFG_MMC1_DAT1_IN */
+                        0x648 (A_DELAY(56) | G_DELAY(0))        /* CFG_MMC1_DAT2_IN */
+                        0x654 (A_DELAY(0) | G_DELAY(0)) /* CFG_MMC1_DAT3_IN */
+                        0x620 (A_DELAY(1355) | G_DELAY(0))      /* CFG_MMC1_CLK_OUT */
+                        0x628 (A_DELAY(0) | G_DELAY(0)) /* CFG_MMC1_CMD_OEN */
+                        0x62c (A_DELAY(0) | G_DELAY(0)) /* CFG_MMC1_CMD_OUT */
+                        0x634 (A_DELAY(0) | G_DELAY(0)) /* CFG_MMC1_DAT0_OEN */
+                        0x638 (A_DELAY(0) | G_DELAY(4)) /* CFG_MMC1_DAT0_OUT */
+                        0x640 (A_DELAY(0) | G_DELAY(0)) /* CFG_MMC1_DAT1_OEN */
+                        0x644 (A_DELAY(0) | G_DELAY(0)) /* CFG_MMC1_DAT1_OUT */
+                        0x64c (A_DELAY(0) | G_DELAY(0)) /* CFG_MMC1_DAT2_OEN */
+                        0x650 (A_DELAY(0) | G_DELAY(0)) /* CFG_MMC1_DAT2_OUT */
+                        0x658 (A_DELAY(0) | G_DELAY(0)) /* CFG_MMC1_DAT3_OEN */
+                        0x65c (A_DELAY(0) | G_DELAY(0)) /* CFG_MMC1_DAT3_OUT */
+                >;
+        };
+
+        /* Corresponds to MMC1_SDR104_MANUAL1 in datamanual */
+        mmc1_iodelay_sdr104_conf: mmc1_iodelay_sdr104_conf {
+                pinctrl-single,pins = <
+                        0x620 (A_DELAY(892) | G_DELAY(0))       /* CFG_MMC1_CLK_OUT */
+                        0x628 (A_DELAY(0) | G_DELAY(0)) /* CFG_MMC1_CMD_OEN */
+                        0x62c (A_DELAY(0) | G_DELAY(0)) /* CFG_MMC1_CMD_OUT */
+                        0x634 (A_DELAY(0) | G_DELAY(0)) /* CFG_MMC1_DAT0_OEN */
+                        0x638 (A_DELAY(0) | G_DELAY(0)) /* CFG_MMC1_DAT0_OUT */
+                        0x640 (A_DELAY(0) | G_DELAY(0)) /* CFG_MMC1_DAT1_OEN */
+                        0x644 (A_DELAY(0) | G_DELAY(0)) /* CFG_MMC1_DAT1_OUT */
+                        0x64c (A_DELAY(0) | G_DELAY(0)) /* CFG_MMC1_DAT2_OEN */
+                        0x650 (A_DELAY(0) | G_DELAY(0)) /* CFG_MMC1_DAT2_OUT */
+                        0x658 (A_DELAY(0) | G_DELAY(0)) /* CFG_MMC1_DAT3_OEN */
+                        0x65c (A_DELAY(0) | G_DELAY(0)) /* CFG_MMC1_DAT3_OUT */
+                >;
+        };
+
+        /* Corresponds to MMC2_HS200_MANUAL1 in datamanual */
+        mmc2_iodelay_hs200_conf: mmc2_iodelay_hs200_conf {
+                pinctrl-single,pins = <
+                        0x190 (A_DELAY(384) | G_DELAY(0))       /* CFG_GPMC_A19_OEN */
+                        0x194 (A_DELAY(0) | G_DELAY(174))       /* CFG_GPMC_A19_OUT */
+                        0x1a8 (A_DELAY(410) | G_DELAY(0))       /* CFG_GPMC_A20_OEN */
+                        0x1ac (A_DELAY(85) | G_DELAY(0))        /* CFG_GPMC_A20_OUT */
+                        0x1b4 (A_DELAY(468) | G_DELAY(0))       /* CFG_GPMC_A21_OEN */
+                        0x1b8 (A_DELAY(139) | G_DELAY(0))       /* CFG_GPMC_A21_OUT */
+                        0x1c0 (A_DELAY(676) | G_DELAY(0))       /* CFG_GPMC_A22_OEN */
+                        0x1c4 (A_DELAY(69) | G_DELAY(0))        /* CFG_GPMC_A22_OUT */
+                        0x1d0 (A_DELAY(1062) | G_DELAY(154))    /* CFG_GPMC_A23_OUT */
+                        0x1d8 (A_DELAY(640) | G_DELAY(0))       /* CFG_GPMC_A24_OEN */
+                        0x1dc (A_DELAY(0) | G_DELAY(0))         /* CFG_GPMC_A24_OUT */
+                        0x1e4 (A_DELAY(356) | G_DELAY(0))       /* CFG_GPMC_A25_OEN */
+                        0x1e8 (A_DELAY(0) | G_DELAY(0))         /* CFG_GPMC_A25_OUT */
+                        0x1f0 (A_DELAY(579) | G_DELAY(0))       /* CFG_GPMC_A26_OEN */
+                        0x1f4 (A_DELAY(0) | G_DELAY(0))         /* CFG_GPMC_A26_OUT */
+                        0x1fc (A_DELAY(435) | G_DELAY(0))       /* CFG_GPMC_A27_OEN */
+                        0x200 (A_DELAY(36) | G_DELAY(0))        /* CFG_GPMC_A27_OUT */
+                        0x364 (A_DELAY(759) | G_DELAY(0))       /* CFG_GPMC_CS1_OEN */
+                        0x368 (A_DELAY(72) | G_DELAY(0))        /* CFG_GPMC_CS1_OUT */
+              >;
+        };
+
+        /* Corresponds to MMC3_MANUAL1 in datamanual */
+        mmc3_iodelay_manual1_conf: mmc3_iodelay_manual1_conf {
+                pinctrl-single,pins = <
+                        0x678 (A_DELAY(0) | G_DELAY(386))       /* CFG_MMC3_CLK_IN */
+                        0x680 (A_DELAY(605) | G_DELAY(0))       /* CFG_MMC3_CLK_OUT */
+                        0x684 (A_DELAY(0) | G_DELAY(0)) /* CFG_MMC3_CMD_IN */
+                        0x688 (A_DELAY(0) | G_DELAY(0)) /* CFG_MMC3_CMD_OEN */
+                        0x68c (A_DELAY(0) | G_DELAY(0)) /* CFG_MMC3_CMD_OUT */
+                        0x690 (A_DELAY(171) | G_DELAY(0))       /* CFG_MMC3_DAT0_IN */
+                        0x694 (A_DELAY(0) | G_DELAY(0)) /* CFG_MMC3_DAT0_OEN */
+                        0x698 (A_DELAY(0) | G_DELAY(0)) /* CFG_MMC3_DAT0_OUT */
+                        0x69c (A_DELAY(221) | G_DELAY(0))       /* CFG_MMC3_DAT1_IN */
+                        0x6a0 (A_DELAY(0) | G_DELAY(0)) /* CFG_MMC3_DAT1_OEN */
+                        0x6a4 (A_DELAY(0) | G_DELAY(0)) /* CFG_MMC3_DAT1_OUT */
+                        0x6a8 (A_DELAY(0) | G_DELAY(0)) /* CFG_MMC3_DAT2_IN */
+                        0x6ac (A_DELAY(0) | G_DELAY(0)) /* CFG_MMC3_DAT2_OEN */
+                        0x6b0 (A_DELAY(0) | G_DELAY(0)) /* CFG_MMC3_DAT2_OUT */
+                        0x6b4 (A_DELAY(474) | G_DELAY(0))       /* CFG_MMC3_DAT3_IN */
+                        0x6b8 (A_DELAY(0) | G_DELAY(0)) /* CFG_MMC3_DAT3_OEN */
+                        0x6bc (A_DELAY(0) | G_DELAY(0)) /* CFG_MMC3_DAT3_OUT */
+                >;
+        };
+
+        /* Corresponds to MMC3_MANUAL2 in datamanual */
+        mmc3_iodelay_sdr50_conf: mmc3_iodelay_sdr50_conf {
+                pinctrl-single,pins = <
+                        0x678 (A_DELAY(852) | G_DELAY(0))       /* CFG_MMC3_CLK_IN */
+                        0x680 (A_DELAY(94) | G_DELAY(0))        /* CFG_MMC3_CLK_OUT */
+                        0x684 (A_DELAY(122) | G_DELAY(0))       /* CFG_MMC3_CMD_IN */
+                        0x688 (A_DELAY(0) | G_DELAY(0)) /* CFG_MMC3_CMD_OEN */
+                        0x68c (A_DELAY(0) | G_DELAY(0)) /* CFG_MMC3_CMD_OUT */
+                        0x690 (A_DELAY(91) | G_DELAY(0))        /* CFG_MMC3_DAT0_IN */
+                        0x694 (A_DELAY(0) | G_DELAY(0)) /* CFG_MMC3_DAT0_OEN */
+                        0x698 (A_DELAY(0) | G_DELAY(0)) /* CFG_MMC3_DAT0_OUT */
+                        0x69c (A_DELAY(57) | G_DELAY(0))        /* CFG_MMC3_DAT1_IN */
+                        0x6a0 (A_DELAY(0) | G_DELAY(0)) /* CFG_MMC3_DAT1_OEN */
+                        0x6a4 (A_DELAY(0) | G_DELAY(0)) /* CFG_MMC3_DAT1_OUT */
+                        0x6a8 (A_DELAY(0) | G_DELAY(0)) /* CFG_MMC3_DAT2_IN */
+                        0x6ac (A_DELAY(0) | G_DELAY(0)) /* CFG_MMC3_DAT2_OEN */
+                        0x6b0 (A_DELAY(0) | G_DELAY(0)) /* CFG_MMC3_DAT2_OUT */
+                        0x6b4 (A_DELAY(375) | G_DELAY(0))       /* CFG_MMC3_DAT3_IN */
+                        0x6b8 (A_DELAY(0) | G_DELAY(0)) /* CFG_MMC3_DAT3_OEN */
+                        0x6bc (A_DELAY(0) | G_DELAY(0)) /* CFG_MMC3_DAT3_OUT */
+                >;
+        };
+
+        /* Corresponds to MMC4_MANUAL1 in datamanual */
+        mmc4_iodelay_manual1_conf: mmc4_iodelay_manual1_conf {
+                pinctrl-single,pins = <
+                        0x840 (A_DELAY(0) | G_DELAY(0)) /* CFG_UART1_CTSN_IN */
+                        0x848 (A_DELAY(1147) | G_DELAY(0))      /* CFG_UART1_CTSN_OUT */
+                        0x84c (A_DELAY(1834) | G_DELAY(0))      /* CFG_UART1_RTSN_IN */
+                        0x850 (A_DELAY(0) | G_DELAY(0)) /* CFG_UART1_RTSN_OEN */
+                        0x854 (A_DELAY(0) | G_DELAY(0)) /* CFG_UART1_RTSN_OUT */
+                        0x870 (A_DELAY(2165) | G_DELAY(0))      /* CFG_UART2_CTSN_IN */
+                        0x874 (A_DELAY(0) | G_DELAY(0)) /* CFG_UART2_CTSN_OEN */
+                        0x878 (A_DELAY(0) | G_DELAY(0)) /* CFG_UART2_CTSN_OUT */
+                        0x87c (A_DELAY(1929) | G_DELAY(64))     /* CFG_UART2_RTSN_IN */
+                        0x880 (A_DELAY(0) | G_DELAY(0)) /* CFG_UART2_RTSN_OEN */
+                        0x884 (A_DELAY(0) | G_DELAY(0)) /* CFG_UART2_RTSN_OUT */
+                        0x888 (A_DELAY(1935) | G_DELAY(128))    /* CFG_UART2_RXD_IN */
+                        0x88c (A_DELAY(0) | G_DELAY(0)) /* CFG_UART2_RXD_OEN */
+                        0x890 (A_DELAY(0) | G_DELAY(0)) /* CFG_UART2_RXD_OUT */
+                        0x894 (A_DELAY(2172) | G_DELAY(44))     /* CFG_UART2_TXD_IN */
+                        0x898 (A_DELAY(0) | G_DELAY(0)) /* CFG_UART2_TXD_OEN */
+                        0x89c (A_DELAY(0) | G_DELAY(0)) /* CFG_UART2_TXD_OUT */
+                >;
+        };
+
+        /* Corresponds to MMC4_DS_MANUAL1 in datamanual */
+        mmc4_iodelay_default_conf: mmc4_iodelay_default_conf {
+                pinctrl-single,pins = <
+                        0x840 (A_DELAY(0) | G_DELAY(0)) /* CFG_UART1_CTSN_IN */
+                        0x848 (A_DELAY(0) | G_DELAY(0)) /* CFG_UART1_CTSN_OUT */
+                        0x84c (A_DELAY(307) | G_DELAY(0))       /* CFG_UART1_RTSN_IN */
+                        0x850 (A_DELAY(0) | G_DELAY(0)) /* CFG_UART1_RTSN_OEN */
+                        0x854 (A_DELAY(0) | G_DELAY(0)) /* CFG_UART1_RTSN_OUT */
+                        0x870 (A_DELAY(785) | G_DELAY(0))       /* CFG_UART2_CTSN_IN */
+                        0x874 (A_DELAY(0) | G_DELAY(0)) /* CFG_UART2_CTSN_OEN */
+                        0x878 (A_DELAY(0) | G_DELAY(0)) /* CFG_UART2_CTSN_OUT */
+                        0x87c (A_DELAY(613) | G_DELAY(0))       /* CFG_UART2_RTSN_IN */
+                        0x880 (A_DELAY(0) | G_DELAY(0)) /* CFG_UART2_RTSN_OEN */
+                        0x884 (A_DELAY(0) | G_DELAY(0)) /* CFG_UART2_RTSN_OUT */
+                        0x888 (A_DELAY(683) | G_DELAY(0))       /* CFG_UART2_RXD_IN */
+                        0x88c (A_DELAY(0) | G_DELAY(0)) /* CFG_UART2_RXD_OEN */
+                        0x890 (A_DELAY(0) | G_DELAY(0)) /* CFG_UART2_RXD_OUT */
+                        0x894 (A_DELAY(835) | G_DELAY(0))       /* CFG_UART2_TXD_IN */
+                        0x898 (A_DELAY(0) | G_DELAY(0)) /* CFG_UART2_TXD_OEN */
+                        0x89c (A_DELAY(0) | G_DELAY(0)) /* CFG_UART2_TXD_OUT */
+                >;
+        };
+};
diff --git a/arch/arm/boot/dts/dra76x.dtsi b/arch/arm/boot/dts/dra76x.dtsi
new file mode 100644
index 000000000000..6edc1d40fe19
--- /dev/null
+++ b/arch/arm/boot/dts/dra76x.dtsi
@@ -0,0 +1,81 @@
+/*
+ * Copyright (C) 2017 Texas Instruments Incorporated - http://www.ti.com/
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include "dra74x.dtsi"
+
+/ {
+        compatible = "ti,dra762", "ti,dra7";
+
+        ocp {
+                cal: cal@4845b000 {
+                        compatible = "ti,dra72-cal";
+                        ti,hwmods = "cal";
+                        reg = <0x489B0000 0x400>,
+                              <0x489B0800 0x40>,
+                              <0x489B0900 0x40>,
+                              <0x4A0026DC 0x4>;
+                                reg-names = "cal_top",
+                                            "cal_rx_core0",
+                                            "cal_rx_core1",
+                                            "camerrx_control";
+                        interrupts = <GIC_SPI 353 IRQ_TYPE_LEVEL_HIGH>;
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+                        status = "disabled";
+
+                        ports {
+                                #address-cells = <1>;
+                                #size-cells = <0>;
+
+                                csi2_0: port@0 {
+                                        reg = <0>;
+                                };
+                                csi2_1: port@1 {
+                                        reg = <1>;
+                                };
+                        };
+                };
+        };
+};
+
+/* MCAN interrupts are hard-wired to irqs 67, 68 */
+&crossbar_mpu {
+        ti,irqs-skip = <10 67 68 133 139 140>;
+};
+
+&cpu0_opp_table {
+        opp_plus@1800000000 {
+                opp-hz = /bits/ 64 <1800000000>;
+                opp-microvolt = <1250000 950000 1250000>;
+                opp-supported-hw = <0xFF 0x08>;
+        };
+};
+
+&oppdm_mpu {
+        ti,efuse-settings = <
+        /* uV   offset */
+        1060000 0x0
+        1160000 0x4
+        1210000 0x8
+        1250000 0xC
+        >;
+};
+
+&abb_mpu {
+        ti,abb_info = <
+        /*uV            ABB     efuse   rbb_m fbb_m     vset_m*/
+        1060000         0       0x0     0 0x02000000 0x01F00000
+        1160000         0       0x4     0 0x02000000 0x01F00000
+        1210000         0       0x8     0 0x02000000 0x01F00000
+        1250000         0       0xC     0 0x02000000 0x01F00000
+        >;
+};
+
+&mmc3 {
+        max-frequency = <96000000>;
+};
diff --git a/arch/arm/boot/dts/dra7x-evm-fpd-auo-g101evn01.0.dtsi b/arch/arm/boot/dts/dra7x-evm-fpd-auo-g101evn01.0.dtsi
new file mode 100644
index 000000000000..c928be92c1ac
--- /dev/null
+++ b/arch/arm/boot/dts/dra7x-evm-fpd-auo-g101evn01.0.dtsi
@@ -0,0 +1,107 @@
+/*
+ * Copyright (C) 2017 Texas Instruments Incorporated - http://www.ti.com/
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+/ {
+        backlight {
+                compatible = "led-backlight";
+                leds = <&backlight_led>;
+                brightness-levels = <0 2 38 74 110 146 182 218 255>;
+                default-brightness-level = <8>;
+
+                enable-gpios = <&pcf_display_board 0 GPIO_ACTIVE_LOW>;
+        };
+
+        lcd_fpd: display {
+                compatible = "auo,g101evn01.0", "panel-dpi";
+
+                label = "lcd_fpd";
+                status = "disabled";
+
+                panel-timing {
+                        clock-frequency = <68930000>;
+                        hactive = <1280>;
+                        vactive = <800>;
+
+                        hfront-porch = <48>;
+                        hsync-len = <32>;
+                        hback-porch = <48>;
+
+                        vfront-porch = <4>;
+                        vsync-len = <4>;
+                        vback-porch = <8>;
+
+                        hsync-active = <0>;
+                        vsync-active = <0>;
+                        de-active = <1>;
+                        pixelclk-active = <1>;
+                };
+
+                port {
+                        fpd_in: endpoint {
+                        };
+                };
+        };
+};
+
+&disp_ser {
+
+        /*
+        * 0x2c - deserializer
+        * 0x40 - TLC59108
+        * 0x27 - PCF8575
+        * 0x57 - EEPROM
+        * 0x14 - Goodix Touch Controller
+        * 0x28 - RF430CL330H
+        */
+
+        disp_des: deserializer@2c {
+                #address-cells = <1>;
+                #size-cells = <0>;
+                compatible = "ti,ds90ub924q";
+                reg = <0x2c>;
+                slave-mode;
+        };
+
+        /* TLC chip for LCD panel power and backlight */
+        fpd_disp: tlc59108@40 {
+                #address-cells = <1>;
+                #size-cells = <0>;
+                compatible = "ti,tlc59108";
+                reg = <0x40>;
+
+                backlight_led: bl@2 {
+                        label = "backlight";
+                        reg = <0x2>;
+                };
+        };
+
+        pcf_display_board: gpio@27 {
+                compatible = "nxp,pcf8575";
+                reg = <0x27>;
+                gpio-controller;
+                #gpio-cells = <2>;
+        };
+
+        touchscreen: goodix-gt9271@14 {
+                status = "okay";
+                compatible = "goodix,gt9271";
+                reg = <0x14>;
+
+                touchscreen-size-x = <1280>;
+                touchscreen-size-y = <800>;
+                touchscreen-inverted-y;
+
+                /* Reset gpio line is inverted before going to touch panel */
+                reset-gpios = <&pcf_display_board 5 GPIO_ACTIVE_LOW>;
+                irq-gpios = <&pcf_display_board 6 GPIO_ACTIVE_HIGH>;
+        };
+
+        /* Below two slaves on the I2C bus are not yet defined */
+        /* ID EEPROM 0x57 */
+        /* RF430CL330H 0x28 */
+};
diff --git a/arch/arm/boot/dts/dra7x-evm-fpd-lg.dtsi b/arch/arm/boot/dts/dra7x-evm-fpd-lg.dtsi
new file mode 100644
index 000000000000..b4760b4efdad
--- /dev/null
+++ b/arch/arm/boot/dts/dra7x-evm-fpd-lg.dtsi
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2017 Texas Instruments Incorporated - http://www.ti.com/
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <dt-bindings/gpio/gpio.h>
+
+
+/ {
+        lcd_fpd: display_fpd {
+                /*
+                * This is not really a dpi panel, but panel-dpi driver
+                * works as dummy panel driver.
+                */
+                compatible = "lg,lp101wx2", "panel-dpi";
+
+                label = "lcd_fpd";
+                status = "disabled";
+
+                panel-timing {
+                        clock-frequency = <69300404>;
+                        hactive = <1280>;
+                        vactive = <800>;
+
+                        hfront-porch = <48>;
+                        hback-porch = <44>;
+                        hsync-len = <32>;
+
+                        vfront-porch = <4>;
+                        vback-porch = <7>;
+                        vsync-len = <12>;
+
+                        hsync-active = <0>;
+                        vsync-active = <0>;
+                        de-active = <1>;
+                        pixelclk-active = <0>;
+                };
+
+                port {
+                        fpd_in: endpoint {
+                        };
+                };
+        };
+};
+
+&disp_ser {
+        disp_des: deserializer@2c {
+                compatible = "ti,ds90uh928q";
+                reg = <0x2c>;
+                slave-mode;
+        };
+        fpd_disp: tlc59108@1c {
+                compatible = "ti,tlc59108";
+                reg = <0x1c>;
+        };
+};
diff --git a/arch/arm/boot/dts/dra7x-evm-lcd-lg.dtsi b/arch/arm/boot/dts/dra7x-evm-lcd-lg.dtsi
index 97939eef7b94..23268b7a474f 100644
--- a/arch/arm/boot/dts/dra7x-evm-lcd-lg.dtsi
+++ b/arch/arm/boot/dts/dra7x-evm-lcd-lg.dtsi
@@ -12,7 +12,6 @@
         aliases {
                 display0 = &tlc59108;
                 display1 = &hdmi0;
-                display2 = &fpd_disp;
         };
 
         backlight {
@@ -51,7 +50,7 @@
                         hsync-active = <0>;
                         vsync-active = <0>;
                         de-active = <1>;
-                        pixelclk-active = <1>;
+                        pixelclk-active = <0>;
                 };
 
                 port {
diff --git a/arch/arm/boot/dts/dra7x-evm-lcd-osd.dtsi b/arch/arm/boot/dts/dra7x-evm-lcd-osd.dtsi
index 219e4f953797..7dc9c986a73a 100644
--- a/arch/arm/boot/dts/dra7x-evm-lcd-osd.dtsi
+++ b/arch/arm/boot/dts/dra7x-evm-lcd-osd.dtsi
@@ -10,7 +10,6 @@
         aliases {
                 display0 = &lcd;
                 display1 = &hdmi0;
-                display2 = &fpd_disp;
         };
 
         lcd_bl: backlight {
diff --git a/arch/arm/boot/dts/dra7xx-jamr3.dtsi b/arch/arm/boot/dts/dra7xx-jamr3.dtsi
index 994c6e735789..894e97f93775 100644
--- a/arch/arm/boot/dts/dra7xx-jamr3.dtsi
+++ b/arch/arm/boot/dts/dra7xx-jamr3.dtsi
@@ -47,7 +47,17 @@
                           <&hwspinlock 6>,
                           <&hwspinlock 7>,
                           <&hwspinlock 8>,
-                          <&hwspinlock 9>;
+                          <&hwspinlock 9>,
+                          <&hwspinlock 10>,
+                          <&hwspinlock 11>,
+                          <&hwspinlock 12>,
+                          <&hwspinlock 13>,
+                          <&hwspinlock 14>,
+                          <&hwspinlock 15>,
+                          <&hwspinlock 16>,
+                          <&hwspinlock 17>,
+                          <&hwspinlock 18>,
+                          <&hwspinlock 19>;
         };
 
         sr0 {
diff --git a/arch/arm/boot/dts/imx6dl.dtsi b/arch/arm/boot/dts/imx6dl.dtsi
index 4b0ec0703825..8ca9217204a0 100644
--- a/arch/arm/boot/dts/imx6dl.dtsi
+++ b/arch/arm/boot/dts/imx6dl.dtsi
@@ -30,7 +30,7 @@
                                 /* kHz    uV */
                                 996000  1250000
                                 792000  1175000
-                                396000  1075000
+                                396000  1150000
                         >;
                         fsl,soc-operating-points = <
                                 /* ARM kHz  SOC-PU uV */
diff --git a/arch/arm/boot/dts/omap3-n900.dts b/arch/arm/boot/dts/omap3-n900.dts
index 5f5e0f3d5b64..27cd4abfc74d 100644
--- a/arch/arm/boot/dts/omap3-n900.dts
+++ b/arch/arm/boot/dts/omap3-n900.dts
@@ -697,6 +697,8 @@
         vmmc_aux-supply = <&vsim>;
         bus-width = <8>;
         non-removable;
+        no-sdio;
+        no-sd;
 };
 
 &mmc3 {
diff --git a/arch/arm/boot/dts/omap5.dtsi b/arch/arm/boot/dts/omap5.dtsi
index f648ec2dd5a6..304bcf9b630e 100644
--- a/arch/arm/boot/dts/omap5.dtsi
+++ b/arch/arm/boot/dts/omap5.dtsi
@@ -1022,6 +1022,7 @@
                         phy-names = "sata-phy";
                         clocks = <&sata_ref_clk>;
                         ti,hwmods = "sata";
+                        ports-implemented = <0x1>;
                 };
 
                 dss: dss@58000000 {
diff --git a/arch/arm/boot/dts/sama5d2.dtsi b/arch/arm/boot/dts/sama5d2.dtsi
index 4dfca8fc49b3..1bc61ece2589 100644
--- a/arch/arm/boot/dts/sama5d2.dtsi
+++ b/arch/arm/boot/dts/sama5d2.dtsi
@@ -856,6 +856,13 @@
                                 compatible = "atmel,at91sam9260-usart";
                                 reg = <0xf801c000 0x100>;
                                 interrupts = <24 IRQ_TYPE_LEVEL_HIGH 7>;
+                                dmas = <&dma0
+                                        (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1) |
+                                         AT91_XDMAC_DT_PERID(35))>,
+                                       <&dma0
+                                        (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1) |
+                                         AT91_XDMAC_DT_PERID(36))>;
+                                dma-names = "tx", "rx";
                                 clocks = <&uart0_clk>;
                                 clock-names = "usart";
                                 status = "disabled";
@@ -865,6 +872,13 @@
                                 compatible = "atmel,at91sam9260-usart";
                                 reg = <0xf8020000 0x100>;
                                 interrupts = <25 IRQ_TYPE_LEVEL_HIGH 7>;
+                                dmas = <&dma0
+                                        (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1) |
+                                         AT91_XDMAC_DT_PERID(37))>,
+                                       <&dma0
+                                        (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1) |
+                                         AT91_XDMAC_DT_PERID(38))>;
+                                dma-names = "tx", "rx";
                                 clocks = <&uart1_clk>;
                                 clock-names = "usart";
                                 status = "disabled";
@@ -874,6 +888,13 @@
                                 compatible = "atmel,at91sam9260-usart";
                                 reg = <0xf8024000 0x100>;
                                 interrupts = <26 IRQ_TYPE_LEVEL_HIGH 7>;
+                                dmas = <&dma0
+                                        (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1) |
+                                         AT91_XDMAC_DT_PERID(39))>,
+                                       <&dma0
+                                        (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1) |
+                                         AT91_XDMAC_DT_PERID(40))>;
+                                dma-names = "tx", "rx";
                                 clocks = <&uart2_clk>;
                                 clock-names = "usart";
                                 status = "disabled";
@@ -985,6 +1006,13 @@
                                 compatible = "atmel,at91sam9260-usart";
                                 reg = <0xfc008000 0x100>;
                                 interrupts = <27 IRQ_TYPE_LEVEL_HIGH 7>;
+                                dmas = <&dma0
+                                        (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1) |
+                                         AT91_XDMAC_DT_PERID(41))>,
+                                       <&dma0
+                                        (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1) |
+                                         AT91_XDMAC_DT_PERID(42))>;
+                                dma-names = "tx", "rx";
                                 clocks = <&uart3_clk>;
                                 clock-names = "usart";
                                 status = "disabled";
@@ -993,6 +1021,13 @@
                         uart4: serial@fc00c000 {
                                 compatible = "atmel,at91sam9260-usart";
                                 reg = <0xfc00c000 0x100>;
+                                dmas = <&dma0
+                                        (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1) |
+                                         AT91_XDMAC_DT_PERID(43))>,
+                                       <&dma0
+                                        (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1) |
+                                         AT91_XDMAC_DT_PERID(44))>;
+                                dma-names = "tx", "rx";
                                 interrupts = <28 IRQ_TYPE_LEVEL_HIGH 7>;
                                 clocks = <&uart4_clk>;
                                 clock-names = "usart";
diff --git a/arch/arm/boot/dts/tegra20-paz00.dts b/arch/arm/boot/dts/tegra20-paz00.dts
index ed7e1009326c..d9ee0fd817e9 100644
--- a/arch/arm/boot/dts/tegra20-paz00.dts
+++ b/arch/arm/boot/dts/tegra20-paz00.dts
@@ -565,6 +565,7 @@
                         regulator-name = "+3VS,vdd_pnl";
                         regulator-min-microvolt = <3300000>;
                         regulator-max-microvolt = <3300000>;
+                        regulator-boot-on;
                         gpio = <&gpio TEGRA_GPIO(A, 4) GPIO_ACTIVE_HIGH>;
                         enable-active-high;
                 };
diff --git a/arch/arm/configs/s3c2410_defconfig b/arch/arm/configs/s3c2410_defconfig
index f3142369f594..01116ee1284b 100644
--- a/arch/arm/configs/s3c2410_defconfig
+++ b/arch/arm/configs/s3c2410_defconfig
@@ -87,9 +87,9 @@ CONFIG_IPV6_TUNNEL=m
 CONFIG_NETFILTER=y
 CONFIG_NF_CONNTRACK=m
 CONFIG_NF_CONNTRACK_EVENTS=y
-CONFIG_NF_CT_PROTO_DCCP=m
-CONFIG_NF_CT_PROTO_SCTP=m
-CONFIG_NF_CT_PROTO_UDPLITE=m
+CONFIG_NF_CT_PROTO_DCCP=y
+CONFIG_NF_CT_PROTO_SCTP=y
+CONFIG_NF_CT_PROTO_UDPLITE=y
 CONFIG_NF_CONNTRACK_AMANDA=m
 CONFIG_NF_CONNTRACK_FTP=m
 CONFIG_NF_CONNTRACK_H323=m
diff --git a/arch/arm/crypto/aes-ce-glue.c b/arch/arm/crypto/aes-ce-glue.c
index 679c589c4828..1f7b98e1a00d 100644
--- a/arch/arm/crypto/aes-ce-glue.c
+++ b/arch/arm/crypto/aes-ce-glue.c
@@ -369,7 +369,7 @@ static struct crypto_alg aes_algs[] = { {
         .cra_blkcipher = {
                 .min_keysize    = AES_MIN_KEY_SIZE,
                 .max_keysize    = AES_MAX_KEY_SIZE,
-                .ivsize         = AES_BLOCK_SIZE,
+                .ivsize         = 0,
                 .setkey         = ce_aes_setkey,
                 .encrypt        = ecb_encrypt,
                 .decrypt        = ecb_decrypt,
@@ -446,7 +446,7 @@ static struct crypto_alg aes_algs[] = { {
         .cra_ablkcipher = {
                 .min_keysize    = AES_MIN_KEY_SIZE,
                 .max_keysize    = AES_MAX_KEY_SIZE,
-                .ivsize         = AES_BLOCK_SIZE,
+                .ivsize         = 0,
                 .setkey         = ablk_set_key,
                 .encrypt        = ablk_encrypt,
                 .decrypt        = ablk_decrypt,
diff --git a/arch/arm/include/asm/elf.h b/arch/arm/include/asm/elf.h
index d2315ffd8f12..f13ae153fb24 100644
--- a/arch/arm/include/asm/elf.h
+++ b/arch/arm/include/asm/elf.h
@@ -112,12 +112,8 @@ int dump_task_regs(struct task_struct *t, elf_gregset_t *elfregs);
 #define CORE_DUMP_USE_REGSET
 #define ELF_EXEC_PAGESIZE       4096
 
-/* This is the location that an ET_DYN program is loaded if exec'ed.  Typical
-   use of this is to invoke "./ld.so someprog" to test out a new version of
-   the loader.  We need to make sure that it is out of the way of the program
-   that it will "exec", and that there is sufficient room for the brk.  */
-
-#define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
+/* This is the base location for PIE (ET_DYN with INTERP) loads. */
+#define ELF_ET_DYN_BASE         0x400000UL
 
 /* When the program starts, a1 contains a pointer to a function to be 
    registered with atexit, as per the SVR4 ABI.  A value of 0 means we 
diff --git a/arch/arm/include/asm/ftrace.h b/arch/arm/include/asm/ftrace.h
index bfe2a2f5a644..22b73112b75f 100644
--- a/arch/arm/include/asm/ftrace.h
+++ b/arch/arm/include/asm/ftrace.h
@@ -54,6 +54,24 @@ static inline void *return_address(unsigned int level)
 
 #define ftrace_return_address(n) return_address(n)
 
+#define ARCH_HAS_SYSCALL_MATCH_SYM_NAME
+
+static inline bool arch_syscall_match_sym_name(const char *sym,
+                                               const char *name)
+{
+        if (!strcmp(sym, "sys_mmap2"))
+                sym = "sys_mmap_pgoff";
+        else if (!strcmp(sym, "sys_statfs64_wrapper"))
+                sym = "sys_statfs64";
+        else if (!strcmp(sym, "sys_fstatfs64_wrapper"))
+                sym = "sys_fstatfs64";
+        else if (!strcmp(sym, "sys_arm_fadvise64_64"))
+                sym = "sys_fadvise64_64";
+
+        /* Ignore case since sym may start with "SyS" instead of "sys" */
+        return !strcasecmp(sym, name);
+}
+
 #endif /* ifndef __ASSEMBLY__ */
 
 #endif /* _ASM_ARM_FTRACE */
diff --git a/arch/arm/include/asm/kvm_mmu.h b/arch/arm/include/asm/kvm_mmu.h
index c7ba9a42e857..ebf866a3a8c8 100644
--- a/arch/arm/include/asm/kvm_mmu.h
+++ b/arch/arm/include/asm/kvm_mmu.h
@@ -205,18 +205,12 @@ static inline void __coherent_cache_guest_page(struct kvm_vcpu *vcpu, pfn_t pfn,
          * and iterate over the range.
          */
 
-        bool need_flush = !vcpu_has_cache_enabled(vcpu) || ipa_uncached;
-
         VM_BUG_ON(size & ~PAGE_MASK);
 
-        if (!need_flush && !icache_is_pipt())
-                goto vipt_cache;
-
         while (size) {
                 void *va = kmap_atomic_pfn(pfn);
 
-                if (need_flush)
-                        kvm_flush_dcache_to_poc(va, PAGE_SIZE);
+                kvm_flush_dcache_to_poc(va, PAGE_SIZE);
 
                 if (icache_is_pipt())
                         __cpuc_coherent_user_range((unsigned long)va,
@@ -228,7 +222,6 @@ static inline void __coherent_cache_guest_page(struct kvm_vcpu *vcpu, pfn_t pfn,
                 kunmap_atomic(va);
         }
 
-vipt_cache:
         if (!icache_is_pipt() && !icache_is_vivt_asid_tagged()) {
                 /* any kind of VIPT cache */
                 __flush_icache_all();
diff --git a/arch/arm/kernel/Makefile b/arch/arm/kernel/Makefile
index 80856def2465..82bdac0f2804 100644
--- a/arch/arm/kernel/Makefile
+++ b/arch/arm/kernel/Makefile
@@ -73,7 +73,6 @@ obj-$(CONFIG_IWMMXT)		+= iwmmxt.o
 obj-$(CONFIG_PERF_EVENTS)       += perf_regs.o perf_callchain.o
 obj-$(CONFIG_HW_PERF_EVENTS)    += perf_event_xscale.o perf_event_v6.o \
                                    perf_event_v7.o
-CFLAGS_pj4-cp0.o                := -marm
 AFLAGS_iwmmxt.o                 := -Wa,-mcpu=iwmmxt
 obj-$(CONFIG_ARM_CPU_TOPOLOGY)  += topology.o
 obj-$(CONFIG_VDSO)              += vdso.o
diff --git a/arch/arm/kernel/pj4-cp0.c b/arch/arm/kernel/pj4-cp0.c
index 8153e36b2491..7c9248b74d3f 100644
--- a/arch/arm/kernel/pj4-cp0.c
+++ b/arch/arm/kernel/pj4-cp0.c
@@ -66,9 +66,13 @@ static void __init pj4_cp_access_write(u32 value)
 
         __asm__ __volatile__ (
                 "mcr    p15, 0, %1, c1, c0, 2\n\t"
+#ifdef CONFIG_THUMB2_KERNEL
+                "isb\n\t"
+#else
                 "mrc    p15, 0, %0, c1, c0, 2\n\t"
                 "mov    %0, %0\n\t"
                 "sub    pc, pc, #4\n\t"
+#endif
                 : "=r" (temp) : "r" (value));
 }
 
diff --git a/arch/arm/kernel/ptrace.c b/arch/arm/kernel/ptrace.c
index 4d9375814b53..d54c53b7ab63 100644
--- a/arch/arm/kernel/ptrace.c
+++ b/arch/arm/kernel/ptrace.c
@@ -600,7 +600,7 @@ static int gpr_set(struct task_struct *target,
                    const void *kbuf, const void __user *ubuf)
 {
         int ret;
-        struct pt_regs newregs;
+        struct pt_regs newregs = *task_pt_regs(target);
 
         ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf,
                                  &newregs,
diff --git a/arch/arm/kernel/vdso.c b/arch/arm/kernel/vdso.c
index 54a5aeab988d..bbbffe946122 100644
--- a/arch/arm/kernel/vdso.c
+++ b/arch/arm/kernel/vdso.c
@@ -17,6 +17,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
+#include <linux/cache.h>
 #include <linux/elf.h>
 #include <linux/err.h>
 #include <linux/kernel.h>
@@ -39,7 +40,7 @@
 static struct page **vdso_text_pagelist;
 
 /* Total number of pages needed for the data and text portions of the VDSO. */
-unsigned int vdso_total_pages __read_mostly;
+unsigned int vdso_total_pages __ro_after_init;
 
 /*
  * The VDSO data page.
@@ -47,13 +48,13 @@ unsigned int vdso_total_pages __read_mostly;
 static union vdso_data_store vdso_data_store __page_aligned_data;
 static struct vdso_data *vdso_data = &vdso_data_store.data;
 
-static struct page *vdso_data_page;
-static struct vm_special_mapping vdso_data_mapping = {
+static struct page *vdso_data_page __ro_after_init;
+static const struct vm_special_mapping vdso_data_mapping = {
         .name = "[vvar]",
         .pages = &vdso_data_page,
 };
 
-static struct vm_special_mapping vdso_text_mapping = {
+static struct vm_special_mapping vdso_text_mapping __ro_after_init = {
         .name = "[vdso]",
 };
 
@@ -67,7 +68,7 @@ struct elfinfo {
 /* Cached result of boot-time check for whether the arch timer exists,
  * and if so, whether the virtual counter is useable.
  */
-static bool cntvct_ok __read_mostly;
+static bool cntvct_ok __ro_after_init;
 
 static bool __init cntvct_functional(void)
 {
@@ -224,7 +225,7 @@ static int install_vvar(struct mm_struct *mm, unsigned long addr)
                                        VM_READ | VM_MAYREAD,
                                        &vdso_data_mapping);
 
-        return IS_ERR(vma) ? PTR_ERR(vma) : 0;
+        return PTR_ERR_OR_ZERO(vma);
 }
 
 /* assumes mmap_sem is write-locked */
diff --git a/arch/arm/kvm/init.S b/arch/arm/kvm/init.S
index 3988e72d16ff..bfc5aae0c280 100644
--- a/arch/arm/kvm/init.S
+++ b/arch/arm/kvm/init.S
@@ -110,7 +110,6 @@ __do_hyp_init:
         @  - Write permission implies XN: disabled
         @  - Instruction cache: enabled
         @  - Data/Unified cache: enabled
-        @  - Memory alignment checks: enabled
         @  - MMU: enabled (this code must be run from an identity mapping)
         mrc     p15, 4, r0, c1, c0, 0   @ HSCR
         ldr     r2, =HSCTLR_MASK
@@ -118,8 +117,8 @@ __do_hyp_init:
         mrc     p15, 0, r1, c1, c0, 0   @ SCTLR
         ldr     r2, =(HSCTLR_EE | HSCTLR_FI | HSCTLR_I | HSCTLR_C)
         and     r1, r1, r2
- ARM(   ldr     r2, =(HSCTLR_M | HSCTLR_A)                      )
- THUMB( ldr     r2, =(HSCTLR_M | HSCTLR_A | HSCTLR_TE)          )
+ ARM(   ldr     r2, =(HSCTLR_M)                                 )
+ THUMB( ldr     r2, =(HSCTLR_M | HSCTLR_TE)                     )
         orr     r1, r1, r2
         orr     r0, r0, r1
         isb
diff --git a/arch/arm/kvm/mmu.c b/arch/arm/kvm/mmu.c
index 767872411d97..360cea172b06 100644
--- a/arch/arm/kvm/mmu.c
+++ b/arch/arm/kvm/mmu.c
@@ -301,6 +301,14 @@ static void unmap_range(struct kvm *kvm, pgd_t *pgdp,
                 next = kvm_pgd_addr_end(addr, end);
                 if (!pgd_none(*pgd))
                         unmap_puds(kvm, pgd, addr, next);
+                /*
+                 * If we are dealing with a large range in
+                 * stage2 table, release the kvm->mmu_lock
+                 * to prevent starvation and lockup detector
+                 * warnings.
+                 */
+                if (kvm && (next != end))
+                        cond_resched_lock(&kvm->mmu_lock);
         } while (pgd++, addr = next, addr != end);
 }
 
@@ -745,6 +753,7 @@ int kvm_alloc_stage2_pgd(struct kvm *kvm)
  */
 static void unmap_stage2_range(struct kvm *kvm, phys_addr_t start, u64 size)
 {
+        assert_spin_locked(&kvm->mmu_lock);
         unmap_range(kvm, kvm->arch.pgd, start, size);
 }
 
@@ -803,6 +812,7 @@ void stage2_unmap_vm(struct kvm *kvm)
         int idx;
 
         idx = srcu_read_lock(&kvm->srcu);
+        down_read(&current->mm->mmap_sem);
         spin_lock(&kvm->mmu_lock);
 
         slots = kvm_memslots(kvm);
@@ -810,6 +820,7 @@ void stage2_unmap_vm(struct kvm *kvm)
                 stage2_unmap_memslot(kvm, memslot);
 
         spin_unlock(&kvm->mmu_lock);
+        up_read(&current->mm->mmap_sem);
         srcu_read_unlock(&kvm->srcu, idx);
 }
 
@@ -829,7 +840,10 @@ void kvm_free_stage2_pgd(struct kvm *kvm)
         if (kvm->arch.pgd == NULL)
                 return;
 
+        spin_lock(&kvm->mmu_lock);
         unmap_stage2_range(kvm, 0, KVM_PHYS_SIZE);
+        spin_unlock(&kvm->mmu_lock);
+
         kvm_free_hwpgd(kvm_get_hwpgd(kvm));
         if (KVM_PREALLOC_LEVEL > 0)
                 kfree(kvm->arch.pgd);
@@ -862,6 +876,9 @@ static pmd_t *stage2_get_pmd(struct kvm *kvm, struct kvm_mmu_memory_cache *cache
         pmd_t *pmd;
 
         pud = stage2_get_pud(kvm, cache, addr);
+        if (!pud)
+                return NULL;
+
         if (pud_none(*pud)) {
                 if (!cache)
                         return NULL;
@@ -1619,12 +1636,16 @@ static int kvm_test_age_hva_handler(struct kvm *kvm, gpa_t gpa, void *data)
 
 int kvm_age_hva(struct kvm *kvm, unsigned long start, unsigned long end)
 {
+        if (!kvm->arch.pgd)
+                return 0;
         trace_kvm_age_hva(start, end);
         return handle_hva_to_gpa(kvm, start, end, kvm_age_hva_handler, NULL);
 }
 
 int kvm_test_age_hva(struct kvm *kvm, unsigned long hva)
 {
+        if (!kvm->arch.pgd)
+                return 0;
         trace_kvm_test_age_hva(hva);
         return handle_hva_to_gpa(kvm, hva, hva, kvm_test_age_hva_handler, NULL);
 }
@@ -1771,6 +1792,7 @@ int kvm_arch_prepare_memory_region(struct kvm *kvm,
             (KVM_PHYS_SIZE >> PAGE_SHIFT))
                 return -EFAULT;
 
+        down_read(&current->mm->mmap_sem);
         /*
          * A memory region could potentially cover multiple VMAs, and any holes
          * between them, so iterate over all of them to find out if we can map
@@ -1814,8 +1836,10 @@ int kvm_arch_prepare_memory_region(struct kvm *kvm,
                         pa += vm_start - vma->vm_start;
 
                         /* IO region dirty page logging not allowed */
-                        if (memslot->flags & KVM_MEM_LOG_DIRTY_PAGES)
-                                return -EINVAL;
+                        if (memslot->flags & KVM_MEM_LOG_DIRTY_PAGES) {
+                                ret = -EINVAL;
+                                goto out;
+                        }
 
                         ret = kvm_phys_addr_ioremap(kvm, gpa, pa,
                                                     vm_end - vm_start,
@@ -1827,7 +1851,7 @@ int kvm_arch_prepare_memory_region(struct kvm *kvm,
         } while (hva < reg_end);
 
         if (change == KVM_MR_FLAGS_ONLY)
-                return ret;
+                goto out;
 
         spin_lock(&kvm->mmu_lock);
         if (ret)
@@ -1835,6 +1859,8 @@ int kvm_arch_prepare_memory_region(struct kvm *kvm,
         else
                 stage2_flush_memslot(kvm, memslot);
         spin_unlock(&kvm->mmu_lock);
+out:
+        up_read(&current->mm->mmap_sem);
         return ret;
 }
 
diff --git a/arch/arm/kvm/psci.c b/arch/arm/kvm/psci.c
index a9b3b905e661..443db0c43d7c 100644
--- a/arch/arm/kvm/psci.c
+++ b/arch/arm/kvm/psci.c
@@ -208,9 +208,10 @@ int kvm_psci_version(struct kvm_vcpu *vcpu)
 
 static int kvm_psci_0_2_call(struct kvm_vcpu *vcpu)
 {
-        int ret = 1;
+        struct kvm *kvm = vcpu->kvm;
         unsigned long psci_fn = vcpu_get_reg(vcpu, 0) & ~((u32) 0);
         unsigned long val;
+        int ret = 1;
 
         switch (psci_fn) {
         case PSCI_0_2_FN_PSCI_VERSION:
@@ -230,7 +231,9 @@ static int kvm_psci_0_2_call(struct kvm_vcpu *vcpu)
                 break;
         case PSCI_0_2_FN_CPU_ON:
         case PSCI_0_2_FN64_CPU_ON:
+                mutex_lock(&kvm->lock);
                 val = kvm_psci_vcpu_on(vcpu);
+                mutex_unlock(&kvm->lock);
                 break;
         case PSCI_0_2_FN_AFFINITY_INFO:
         case PSCI_0_2_FN64_AFFINITY_INFO:
@@ -279,6 +282,7 @@ static int kvm_psci_0_2_call(struct kvm_vcpu *vcpu)
 
 static int kvm_psci_0_1_call(struct kvm_vcpu *vcpu)
 {
+        struct kvm *kvm = vcpu->kvm;
         unsigned long psci_fn = vcpu_get_reg(vcpu, 0) & ~((u32) 0);
         unsigned long val;
 
@@ -288,7 +292,9 @@ static int kvm_psci_0_1_call(struct kvm_vcpu *vcpu)
                 val = PSCI_RET_SUCCESS;
                 break;
         case KVM_PSCI_FN_CPU_ON:
+                mutex_lock(&kvm->lock);
                 val = kvm_psci_vcpu_on(vcpu);
+                mutex_unlock(&kvm->lock);
                 break;
         default:
                 val = PSCI_RET_NOT_SUPPORTED;
diff --git a/arch/arm/lib/getuser.S b/arch/arm/lib/getuser.S
index 8ecfd15c3a02..df73914e81c8 100644
--- a/arch/arm/lib/getuser.S
+++ b/arch/arm/lib/getuser.S
@@ -67,7 +67,7 @@ ENTRY(__get_user_4)
 ENDPROC(__get_user_4)
 
 ENTRY(__get_user_8)
-        check_uaccess r0, 8, r1, r2, __get_user_bad
+        check_uaccess r0, 8, r1, r2, __get_user_bad8
 #ifdef CONFIG_THUMB2_KERNEL
 5: TUSER(ldr)   r2, [r0]
 6: TUSER(ldr)   r3, [r0, #4]
diff --git a/arch/arm/mach-at91/pm.c b/arch/arm/mach-at91/pm.c
index 23726fb31741..d687f860a2da 100644
--- a/arch/arm/mach-at91/pm.c
+++ b/arch/arm/mach-at91/pm.c
@@ -286,6 +286,22 @@ static void at91_ddr_standby(void)
                 at91_ramc_write(1, AT91_DDRSDRC_LPR, saved_lpr1);
 }
 
+static void sama5d3_ddr_standby(void)
+{
+        u32 lpr0;
+        u32 saved_lpr0;
+
+        saved_lpr0 = at91_ramc_read(0, AT91_DDRSDRC_LPR);
+        lpr0 = saved_lpr0 & ~AT91_DDRSDRC_LPCB;
+        lpr0 |= AT91_DDRSDRC_LPCB_POWER_DOWN;
+
+        at91_ramc_write(0, AT91_DDRSDRC_LPR, lpr0);
+
+        cpu_do_idle();
+
+        at91_ramc_write(0, AT91_DDRSDRC_LPR, saved_lpr0);
+}
+
 /* We manage both DDRAM/SDRAM controllers, we need more than one value to
  * remember.
  */
@@ -320,7 +336,7 @@ static const struct of_device_id const ramc_ids[] __initconst = {
         { .compatible = "atmel,at91rm9200-sdramc", .data = at91rm9200_standby },
         { .compatible = "atmel,at91sam9260-sdramc", .data = at91sam9_sdram_standby },
         { .compatible = "atmel,at91sam9g45-ddramc", .data = at91_ddr_standby },
-        { .compatible = "atmel,sama5d3-ddramc", .data = at91_ddr_standby },
+        { .compatible = "atmel,sama5d3-ddramc", .data = sama5d3_ddr_standby },
         { /*sentinel*/ }
 };
 
diff --git a/arch/arm/mach-omap2/board-generic.c b/arch/arm/mach-omap2/board-generic.c
index e71fcd7b5acb..0cef41dc85e2 100644
--- a/arch/arm/mach-omap2/board-generic.c
+++ b/arch/arm/mach-omap2/board-generic.c
@@ -284,6 +284,7 @@ MACHINE_END
 
 #ifdef CONFIG_SOC_DRA7XX
 static const char *const dra74x_boards_compat[] __initconst = {
+        "ti,dra76",
         "ti,am5728",
         "ti,am5726",
         "ti,dra742",
diff --git a/arch/arm/mach-omap2/id.c b/arch/arm/mach-omap2/id.c
index 84ee6027e20c..5a357f5a1b6c 100644
--- a/arch/arm/mach-omap2/id.c
+++ b/arch/arm/mach-omap2/id.c
@@ -647,6 +647,15 @@ void __init dra7xxx_check_revision(void)
         hawkeye = (idcode >> 12) & 0xffff;
         rev = (idcode >> 28) & 0xff;
         switch (hawkeye) {
+        case 0xbb50:
+                switch (rev) {
+                case 0:
+                default:
+                        omap_revision = DRA762_REV_ES1_0;
+                        break;
+                }
+                break;
+
         case 0xb990:
                 switch (rev) {
                 case 0:
@@ -668,9 +677,12 @@ void __init dra7xxx_check_revision(void)
                         omap_revision = DRA722_REV_ES1_0;
                         break;
                 case 1:
-                default:
                         omap_revision = DRA722_REV_ES2_0;
                         break;
+                case 2:
+                default:
+                        omap_revision = DRA722_REV_ES2_1;
+                        break;
                 }
                 break;
 
diff --git a/arch/arm/mach-omap2/omap-headsmp.S b/arch/arm/mach-omap2/omap-headsmp.S
index 6d1dffca6c7b..748dde9fa4a5 100644
--- a/arch/arm/mach-omap2/omap-headsmp.S
+++ b/arch/arm/mach-omap2/omap-headsmp.S
@@ -17,6 +17,7 @@
 
 #include <linux/linkage.h>
 #include <linux/init.h>
+#include <asm/assembler.h>
 
 #include "omap44xx.h"
 
@@ -56,7 +57,7 @@ wait_2:	ldr	r2, =AUX_CORE_BOOT0_PA	@ read from AuxCoreBoot0
         cmp     r0, r4
         bne     wait_2
         ldr     r12, =API_HYP_ENTRY
-        adr     r0, hyp_boot
+        badr    r0, hyp_boot
         smc     #0
 hyp_boot:
         b       secondary_startup
diff --git a/arch/arm/mach-omap2/omap-smp.c b/arch/arm/mach-omap2/omap-smp.c
index acc38a3213e7..6c3d89694b14 100644
--- a/arch/arm/mach-omap2/omap-smp.c
+++ b/arch/arm/mach-omap2/omap-smp.c
@@ -254,7 +254,7 @@ static void __init omap4_smp_prepare_cpus(unsigned int max_cpus)
 
         if (cpu_is_omap446x())
                 startup_addr = omap4460_secondary_startup;
-        if (soc_is_dra74x() || soc_is_omap54xx())
+        if (soc_is_dra74x() || soc_is_omap54xx() || soc_is_dra76x())
                 omap5_erratum_workaround_801819();
 
         /*
diff --git a/arch/arm/mach-omap2/omap_hwmod_7xx_data.c b/arch/arm/mach-omap2/omap_hwmod_7xx_data.c
index adcfe4642a04..2028a81e13e6 100644
--- a/arch/arm/mach-omap2/omap_hwmod_7xx_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_7xx_data.c
@@ -375,6 +375,21 @@ static struct omap_hwmod dra7xx_cal_hwmod = {
         },
 };
 
+static struct omap_hwmod dra76x_cal_hwmod = {
+        .name           = "cal",
+        .class          = &dra7xx_cal_hwmod_class,
+        .clkdm_name     = "cam_clkdm",
+        .main_clk       = "vip3_gclk_mux",
+        .flags          = (HWMOD_SWSUP_SIDLE | HWMOD_SWSUP_MSTANDBY),
+        .prcm = {
+                .omap4 = {
+                        .clkctrl_offs = DRA7XX_CM_CAM_VIP3_CLKCTRL_OFFSET,
+                        .context_offs = DRA7XX_RM_CAM_VIP3_CONTEXT_OFFSET,
+                        .modulemode   = MODULEMODE_HWCTRL,
+                },
+        },
+};
+
 /*
  * 'counter' class
  *
@@ -3276,6 +3291,28 @@ static struct omap_hwmod dra7xx_wd_timer2_hwmod = {
         },
 };
 
+/*
+ * 'mcan' class
+ *
+ */
+static struct omap_hwmod_class dra76x_mcan_hwmod_class = {
+        .name   = "mcan",
+};
+
+/* mcan */
+static struct omap_hwmod dra76x_mcan_hwmod = {
+        .name           = "mcan",
+        .class          = &dra76x_mcan_hwmod_class,
+        .clkdm_name     = "wkupaon_clkdm",
+        .main_clk       = "mcan_clk",
+        .prcm = {
+                .omap4 = {
+                        .clkctrl_offs = DRA7XX_CM_WKUPAON_ADC_CLKCTRL_OFFSET,
+                        .context_offs = DRA7XX_RM_WKUPAON_ADC_CONTEXT_OFFSET,
+                        .modulemode   = MODULEMODE_SWCTRL,
+                },
+        },
+};
 
 /*
  * Interfaces
@@ -4542,6 +4579,14 @@ static struct omap_hwmod_ocp_if dra7xx_l4_per3__cal = {
         .user           = OCP_USER_MPU | OCP_USER_SDMA,
 };
 
+/* l4_per3 -> dra76x_cal */
+static struct omap_hwmod_ocp_if dra76x_l4_per3__cal = {
+        .master         = &dra7xx_l4_per3_hwmod,
+        .slave          = &dra76x_cal_hwmod,
+        .clk            = "l3_iclk_div",
+        .user           = OCP_USER_MPU | OCP_USER_SDMA,
+};
+
 /* l4_wkup -> wd_timer2 */
 static struct omap_hwmod_ocp_if dra7xx_l4_wkup__wd_timer2 = {
         .master         = &dra7xx_l4_wkup_hwmod,
@@ -4550,6 +4595,14 @@ static struct omap_hwmod_ocp_if dra7xx_l4_wkup__wd_timer2 = {
         .user           = OCP_USER_MPU | OCP_USER_SDMA,
 };
 
+/* l3_main_1 -> mcan */
+static struct omap_hwmod_ocp_if dra76x_l3_main_1__mcan = {
+        .master         = &dra7xx_l3_main_1_hwmod,
+        .slave          = &dra76x_mcan_hwmod,
+        .clk            = "l3_iclk_div",
+        .user           = OCP_USER_MPU | OCP_USER_SDMA,
+};
+
 static struct omap_hwmod_ocp_if *dra7xx_hwmod_ocp_ifs[] __initdata = {
         &dra7xx_l3_main_1__dmm,
         &dra7xx_l3_main_2__l3_instr,
@@ -4700,6 +4753,17 @@ static struct omap_hwmod_ocp_if *dra7xx_gp_hwmod_ocp_ifs[] __initdata = {
 };
 
 /* SoC variant specific hwmod links */
+static struct omap_hwmod_ocp_if *dra76x_hwmod_ocp_ifs[] __initdata = {
+        &dra7xx_l4_per3__usb_otg_ss4,
+        &dra7xx_l4_per3__vip2,
+        &dra7xx_l3_main_1__mmu0_dsp2,
+        &dra7xx_l3_main_1__mmu1_dsp2,
+        &dra7xx_dsp2__l3_main_1,
+        &dra76x_l3_main_1__mcan,
+        &dra76x_l4_per3__cal,
+        NULL,
+};
+
 static struct omap_hwmod_ocp_if *dra74x_hwmod_ocp_ifs[] __initdata = {
         &dra7xx_l4_per3__usb_otg_ss4,
         &dra7xx_l4_per3__vip2,
@@ -4731,12 +4795,14 @@ int __init dra7xx_hwmod_init(void)
                 ret = omap_hwmod_register_links(dra74x_hwmod_ocp_ifs);
         else if (!ret && soc_is_dra72x())
                 ret = omap_hwmod_register_links(dra72x_hwmod_ocp_ifs);
+        else if (!ret && soc_is_dra76x())
+                ret = omap_hwmod_register_links(dra76x_hwmod_ocp_ifs);
 
         if (!ret && omap_type() == OMAP2_DEVICE_TYPE_GP)
                 ret = omap_hwmod_register_links(dra7xx_gp_hwmod_ocp_ifs);
 
-        /* now for the IPs *NOT* in dra71 */
-        if (!ret && !of_machine_is_compatible("ti,dra718"))
+        /* now for the IPs available only in dra74 and dra72 */
+        if (!ret && !of_machine_is_compatible("ti,dra718") && !soc_is_dra76x())
                 ret = omap_hwmod_register_links(dra74x_dra72x_hwmod_ocp_ifs);
 
         return ret;
diff --git a/arch/arm/mach-omap2/powerdomains7xx_data.c b/arch/arm/mach-omap2/powerdomains7xx_data.c
index 0a6caa6e14e5..2497e6f04ea0 100644
--- a/arch/arm/mach-omap2/powerdomains7xx_data.c
+++ b/arch/arm/mach-omap2/powerdomains7xx_data.c
@@ -29,6 +29,7 @@
 #include "prcm44xx.h"
 #include "prm7xx.h"
 #include "prcm_mpu7xx.h"
+#include "soc.h"
 
 /* iva_7xx_pwrdm: IVA-HD power domain */
 static struct powerdomain iva_7xx_pwrdm = {
@@ -63,6 +64,14 @@ static struct powerdomain custefuse_7xx_pwrdm = {
         .flags            = PWRDM_HAS_LOWPOWERSTATECHANGE,
 };
 
+/* custefuse_aon_7xx_pwrdm: Customer efuse controller power domain */
+static struct powerdomain custefuse_aon_7xx_pwrdm = {
+        .name             = "custefuse_pwrdm",
+        .prcm_offs        = DRA7XX_PRM_CUSTEFUSE_INST,
+        .prcm_partition   = DRA7XX_PRM_PARTITION,
+        .pwrsts           = PWRSTS_ON,
+};
+
 /* ipu_7xx_pwrdm: Audio back end power domain */
 static struct powerdomain ipu_7xx_pwrdm = {
         .name             = "ipu_pwrdm",
@@ -350,7 +359,6 @@ static struct powerdomain eve1_7xx_pwrdm = {
 static struct powerdomain *powerdomains_dra7xx[] __initdata = {
         &iva_7xx_pwrdm,
         &rtc_7xx_pwrdm,
-        &custefuse_7xx_pwrdm,
         &ipu_7xx_pwrdm,
         &dss_7xx_pwrdm,
         &l4per_7xx_pwrdm,
@@ -374,9 +382,32 @@ static struct powerdomain *powerdomains_dra7xx[] __initdata = {
         NULL
 };
 
+static struct powerdomain *powerdomains_dra76x[] __initdata = {
+        &custefuse_aon_7xx_pwrdm,
+        NULL
+};
+
+static struct powerdomain *powerdomains_dra74x[] __initdata = {
+        &custefuse_7xx_pwrdm,
+        NULL
+};
+
+static struct powerdomain *powerdomains_dra72x[] __initdata = {
+        &custefuse_aon_7xx_pwrdm,
+        NULL
+};
+
 void __init dra7xx_powerdomains_init(void)
 {
         pwrdm_register_platform_funcs(&omap4_pwrdm_operations);
         pwrdm_register_pwrdms(powerdomains_dra7xx);
+
+        if (soc_is_dra76x())
+                pwrdm_register_pwrdms(powerdomains_dra76x);
+        else if (soc_is_dra74x())
+                pwrdm_register_pwrdms(powerdomains_dra74x);
+        else if (soc_is_dra72x())
+                pwrdm_register_pwrdms(powerdomains_dra72x);
+
         pwrdm_complete_init();
 }
diff --git a/arch/arm/mach-omap2/soc.h b/arch/arm/mach-omap2/soc.h
index 1e11307fd766..1ae1b6fe0370 100644
--- a/arch/arm/mach-omap2/soc.h
+++ b/arch/arm/mach-omap2/soc.h
@@ -239,6 +239,7 @@ IS_TI_SUBCLASS(816x, 0x816)
 IS_TI_SUBCLASS(814x, 0x814)
 IS_AM_SUBCLASS(335x, 0x335)
 IS_AM_SUBCLASS(437x, 0x437)
+IS_DRA_SUBCLASS(76x, 0x76)
 IS_DRA_SUBCLASS(75x, 0x75)
 IS_DRA_SUBCLASS(72x, 0x72)
 
@@ -262,6 +263,7 @@ IS_DRA_SUBCLASS(72x, 0x72)
 #define soc_is_omap54xx()               0
 #define soc_is_omap543x()               0
 #define soc_is_dra7xx()                 0
+#define soc_is_dra76x()                 0
 #define soc_is_dra74x()                 0
 #define soc_is_dra72x()                 0
 
@@ -412,9 +414,11 @@ IS_OMAP_TYPE(3430, 0x3430)
 
 #if defined(CONFIG_SOC_DRA7XX)
 #undef soc_is_dra7xx
+#undef soc_is_dra76x
 #undef soc_is_dra74x
 #undef soc_is_dra72x
 #define soc_is_dra7xx() is_dra7xx()
+#define soc_is_dra76x() is_dra76x()
 #define soc_is_dra74x() is_dra75x()
 #define soc_is_dra72x() is_dra72x()
 #endif
@@ -484,11 +488,13 @@ IS_OMAP_TYPE(3430, 0x3430)
 #define OMAP5432_REV_ES2_0      (OMAP54XX_CLASS | (0x32 << 16) | (0x20 << 8))
 
 #define DRA7XX_CLASS            0x07000000
+#define DRA762_REV_ES1_0        (DRA7XX_CLASS | (0x62 << 16) | (0x10 << 8))
 #define DRA752_REV_ES1_0        (DRA7XX_CLASS | (0x52 << 16) | (0x10 << 8))
 #define DRA752_REV_ES1_1        (DRA7XX_CLASS | (0x52 << 16) | (0x11 << 8))
 #define DRA752_REV_ES2_0        (DRA7XX_CLASS | (0x52 << 16) | (0x20 << 8))
 #define DRA722_REV_ES1_0        (DRA7XX_CLASS | (0x22 << 16) | (0x10 << 8))
 #define DRA722_REV_ES2_0        (DRA7XX_CLASS | (0x22 << 16) | (0x20 << 8))
+#define DRA722_REV_ES2_1        (DRA7XX_CLASS | (0x22 << 16) | (0x21 << 8))
 
 void omap2xxx_check_revision(void);
 void omap3xxx_check_revision(void);
diff --git a/arch/arm/mach-omap2/timer.c b/arch/arm/mach-omap2/timer.c
index 25f0eee33869..a67af98e532b 100644
--- a/arch/arm/mach-omap2/timer.c
+++ b/arch/arm/mach-omap2/timer.c
@@ -561,8 +561,7 @@ void __init omap_init_time(void)
         __omap_sync32k_timer_init(1, "timer_32k_ck", "ti,timer-alwon",
                         2, "timer_sys_ck", NULL, false);
 
-        if (of_have_populated_dt())
-                clocksource_probe();
+        clocksource_probe();
 }
 
 #if defined(CONFIG_ARCH_OMAP3) || defined(CONFIG_SOC_AM43XX)
@@ -570,6 +569,8 @@ void __init omap3_secure_sync32k_timer_init(void)
 {
         __omap_sync32k_timer_init(12, "secure_32k_fck", "ti,timer-secure",
                         2, "timer_sys_ck", NULL, false);
+
+        clocksource_probe();
 }
 #endif /* CONFIG_ARCH_OMAP3 */
 
@@ -579,6 +580,7 @@ void __init omap3_gptimer_timer_init(void)
 {
         __omap_sync32k_timer_init(2, "timer_sys_ck", NULL,
                         1, "timer_sys_ck", "ti,timer-alwon", true);
+
         if (of_have_populated_dt())
                 clocksource_probe();
 }
diff --git a/arch/arm/mm/fault.c b/arch/arm/mm/fault.c
index 506c225c66cc..c73f10c1984f 100644
--- a/arch/arm/mm/fault.c
+++ b/arch/arm/mm/fault.c
@@ -610,9 +610,9 @@ static int __init early_abort_handler(unsigned long addr, unsigned int fsr,
 
 void __init early_abt_enable(void)
 {
-        fsr_info[22].fn = early_abort_handler;
+        fsr_info[FSR_FS_AEA].fn = early_abort_handler;
         local_abt_enable();
-        fsr_info[22].fn = do_bad;
+        fsr_info[FSR_FS_AEA].fn = do_bad;
 }
 
 #ifndef CONFIG_ARM_LPAE
diff --git a/arch/arm/mm/fault.h b/arch/arm/mm/fault.h
index 05ec5e0df32d..78830657cab3 100644
--- a/arch/arm/mm/fault.h
+++ b/arch/arm/mm/fault.h
@@ -11,11 +11,15 @@
 #define FSR_FS5_0               (0x3f)
 
 #ifdef CONFIG_ARM_LPAE
+#define FSR_FS_AEA              17
+
 static inline int fsr_fs(unsigned int fsr)
 {
         return fsr & FSR_FS5_0;
 }
 #else
+#define FSR_FS_AEA              22
+
 static inline int fsr_fs(unsigned int fsr)
 {
         return (fsr & FSR_FS3_0) | (fsr & FSR_FS4) >> 6;
diff --git a/arch/arm/mm/mmap.c b/arch/arm/mm/mmap.c
index 66353caa35b9..641334ebf46d 100644
--- a/arch/arm/mm/mmap.c
+++ b/arch/arm/mm/mmap.c
@@ -89,7 +89,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
 
                 vma = find_vma(mm, addr);
                 if (TASK_SIZE - len >= addr &&
-                    (!vma || addr + len <= vma->vm_start))
+                    (!vma || addr + len <= vm_start_gap(vma)))
                         return addr;
         }
 
@@ -140,7 +140,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
                         addr = PAGE_ALIGN(addr);
                 vma = find_vma(mm, addr);
                 if (TASK_SIZE - len >= addr &&
-                                (!vma || addr + len <= vma->vm_start))
+                                (!vma || addr + len <= vm_start_gap(vma)))
                         return addr;
         }
 
diff --git a/arch/arm/mm/mmu.c b/arch/arm/mm/mmu.c
index de9f8921e407..aead23f15213 100644
--- a/arch/arm/mm/mmu.c
+++ b/arch/arm/mm/mmu.c
@@ -1184,15 +1184,15 @@ void __init sanity_check_meminfo(void)
 
         high_memory = __va(arm_lowmem_limit - 1) + 1;
 
+        if (!memblock_limit)
+                memblock_limit = arm_lowmem_limit;
+
         /*
          * Round the memblock limit down to a pmd size.  This
          * helps to ensure that we will allocate memory from the
          * last full pmd, which should be mapped.
          */
-        if (memblock_limit)
-                memblock_limit = round_down(memblock_limit, PMD_SIZE);
-        if (!memblock_limit)
-                memblock_limit = arm_lowmem_limit;
+        memblock_limit = round_down(memblock_limit, PMD_SIZE);
 
         memblock_set_current_limit(memblock_limit);
 }
diff --git a/arch/arm/vdso/Makefile b/arch/arm/vdso/Makefile
index 1160434eece0..59a8fa7b8a3b 100644
--- a/arch/arm/vdso/Makefile
+++ b/arch/arm/vdso/Makefile
@@ -74,5 +74,5 @@ $(MODLIB)/vdso: FORCE
         @mkdir -p $(MODLIB)/vdso
 
 PHONY += vdso_install
-vdso_install: $(obj)/vdso.so.dbg $(MODLIB)/vdso FORCE
+vdso_install: $(obj)/vdso.so.dbg $(MODLIB)/vdso
         $(call cmd,vdso_install)
diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
index 2543791ce8c2..049335584e0c 100644
--- a/arch/arm64/Kconfig
+++ b/arch/arm64/Kconfig
@@ -141,6 +141,18 @@ config ARCH_MMAP_RND_COMPAT_BITS_MIN
 config ARCH_MMAP_RND_COMPAT_BITS_MAX
        default 16
 
+config ARM64_PAGE_SHIFT
+        int
+        default 16 if ARM64_64K_PAGES
+        default 14 if ARM64_16K_PAGES
+        default 12
+
+config ARM64_CONT_SHIFT
+        int
+        default 5 if ARM64_64K_PAGES
+        default 7 if ARM64_16K_PAGES
+        default 4
+
 config NO_IOPORT_MAP
         def_bool y if !PCI
 
@@ -569,6 +581,7 @@ source kernel/Kconfig.preempt
 source kernel/Kconfig.hz
 
 config ARCH_SUPPORTS_DEBUG_PAGEALLOC
+        depends on !HIBERNATION
         def_bool y
 
 config ARCH_HAS_HOLES_MEMORYMODEL
@@ -618,6 +631,27 @@ config SECCOMP
           and the task is only allowed to execute a few safe syscalls
           defined by each seccomp mode.
 
+config KEXEC
+        depends on PM_SLEEP_SMP
+        select KEXEC_CORE
+        bool "kexec system call"
+        ---help---
+          kexec is a system call that implements the ability to shutdown your
+          current kernel, and to start another kernel.  It is like a reboot
+          but it is independent of the system firmware.   And like a reboot
+          you can start any kernel with it, not just Linux.
+
+config CRASH_DUMP
+        bool "Build kdump crash kernel"
+        help
+          Generate crash dump after being started by kexec. This should
+          be normally only set in special crash dump kernels which are
+          loaded in the main kernel with kexec-tools into a specially
+          reserved region and then later executed after a crash by
+          kdump/kexec.
+
+          For more details see Documentation/kdump/kdump.txt
+
 config XEN_DOM0
         def_bool y
         depends on XEN
@@ -720,7 +754,7 @@ config SETEND_EMULATION
 endif
 
 config ARM64_SW_TTBR0_PAN
-        bool "Emulate Priviledged Access Never using TTBR0_EL1 switching"
+        bool "Emulate Privileged Access Never using TTBR0_EL1 switching"
         help
           Enabling this option prevents the kernel from accessing
           user-space memory directly by pointing TTBR0_EL1 to a reserved
@@ -934,6 +968,26 @@ config BUILD_ARM64_APPENDED_DTB_IMAGE
           DTBs to be built by default (instead of a standalone Image.gz.)
           The image will built in arch/arm64/boot/Image.gz-dtb
 
+choice
+        prompt "Appended DTB Kernel Image name"
+        depends on BUILD_ARM64_APPENDED_DTB_IMAGE
+        help
+          Enabling this option will cause a specific kernel image Image or
+          Image.gz to be used for final image creation.
+          The image will built in arch/arm64/boot/IMAGE-NAME-dtb
+
+        config IMG_GZ_DTB
+                bool "Image.gz-dtb"
+        config IMG_DTB
+                bool "Image-dtb"
+endchoice
+
+config BUILD_ARM64_APPENDED_KERNEL_IMAGE_NAME
+        string
+        depends on BUILD_ARM64_APPENDED_DTB_IMAGE
+        default "Image.gz-dtb" if IMG_GZ_DTB
+        default "Image-dtb" if IMG_DTB
+
 config BUILD_ARM64_APPENDED_DTB_IMAGE_NAMES
         string "Default dtb names"
         depends on BUILD_ARM64_APPENDED_DTB_IMAGE
diff --git a/arch/arm64/Makefile b/arch/arm64/Makefile
index 101632379b8b..f1d8a05727cf 100644
--- a/arch/arm64/Makefile
+++ b/arch/arm64/Makefile
@@ -61,7 +61,9 @@ head-y		:= arch/arm64/kernel/head.o
 
 # The byte offset of the kernel image in RAM from the start of RAM.
 ifeq ($(CONFIG_ARM64_RANDOMIZE_TEXT_OFFSET), y)
-TEXT_OFFSET := $(shell awk 'BEGIN {srand(); printf "0x%03x000\n", int(512 * rand())}')
+TEXT_OFFSET := $(shell awk "BEGIN {srand(); printf \"0x%06x\n\", \
+                 int(2 * 1024 * 1024 / (2 ^ $(CONFIG_ARM64_PAGE_SHIFT)) * \
+                 rand()) * (2 ^ $(CONFIG_ARM64_PAGE_SHIFT))}")
 else
 TEXT_OFFSET := 0x00080000
 endif
@@ -85,7 +87,7 @@ core-$(CONFIG_EFI_STUB) += $(objtree)/drivers/firmware/efi/libstub/lib.a
 
 # Default target when executing plain make
 ifeq ($(CONFIG_BUILD_ARM64_APPENDED_DTB_IMAGE),y)
-KBUILD_IMAGE    := Image.gz-dtb
+KBUILD_IMAGE    := $(subst $\",,$(CONFIG_BUILD_ARM64_APPENDED_KERNEL_IMAGE_NAME))
 else
 KBUILD_IMAGE    := Image.gz
 endif
@@ -128,6 +130,16 @@ archclean:
         $(Q)$(MAKE) $(clean)=$(boot)
         $(Q)$(MAKE) $(clean)=$(boot)/dts
 
+# We need to generate vdso-offsets.h before compiling certain files in kernel/.
+# In order to do that, we should use the archprepare target, but we can't since
+# asm-offsets.h is included in some files used to generate vdso-offsets.h, and
+# asm-offsets.h is built in prepare0, for which archprepare is a dependency.
+# Therefore we need to generate the header after prepare0 has been made, hence
+# this hack.
+prepare: vdso_prepare
+vdso_prepare: prepare0
+        $(Q)$(MAKE) $(build)=arch/arm64/kernel/vdso include/generated/vdso-offsets.h
+
 define archhelp
   echo  '* Image.gz      - Compressed kernel image (arch/$(ARCH)/boot/Image.gz)'
   echo  '  Image         - Uncompressed kernel image (arch/$(ARCH)/boot/Image)'
diff --git a/arch/arm64/boot/dts/arm/juno-r1.dts b/arch/arm64/boot/dts/arm/juno-r1.dts
index 93bc3d7d51c0..29315af22147 100644
--- a/arch/arm64/boot/dts/arm/juno-r1.dts
+++ b/arch/arm64/boot/dts/arm/juno-r1.dts
@@ -60,6 +60,28 @@
                         };
                 };
 
+                idle-states {
+                        entry-method = "arm,psci";
+
+                        CPU_SLEEP_0: cpu-sleep-0 {
+                                compatible = "arm,idle-state";
+                                arm,psci-suspend-param = <0x0010000>;
+                                local-timer-stop;
+                                entry-latency-us = <300>;
+                                exit-latency-us = <1200>;
+                                min-residency-us = <2000>;
+                        };
+
+                        CLUSTER_SLEEP_0: cluster-sleep-0 {
+                                compatible = "arm,idle-state";
+                                arm,psci-suspend-param = <0x1010000>;
+                                local-timer-stop;
+                                entry-latency-us = <400>;
+                                exit-latency-us = <1200>;
+                                min-residency-us = <2500>;
+                        };
+                };
+
                 A57_0: cpu@0 {
                         compatible = "arm,cortex-a57","arm,armv8";
                         reg = <0x0 0x0>;
@@ -67,6 +89,7 @@
                         enable-method = "psci";
                         next-level-cache = <&A57_L2>;
                         clocks = <&scpi_dvfs 0>;
+                        cpu-idle-states = <&CPU_SLEEP_0 &CLUSTER_SLEEP_0>;
                 };
 
                 A57_1: cpu@1 {
@@ -76,6 +99,7 @@
                         enable-method = "psci";
                         next-level-cache = <&A57_L2>;
                         clocks = <&scpi_dvfs 0>;
+                        cpu-idle-states = <&CPU_SLEEP_0 &CLUSTER_SLEEP_0>;
                 };
 
                 A53_0: cpu@100 {
@@ -85,6 +109,7 @@
                         enable-method = "psci";
                         next-level-cache = <&A53_L2>;
                         clocks = <&scpi_dvfs 1>;
+                        cpu-idle-states = <&CPU_SLEEP_0 &CLUSTER_SLEEP_0>;
                 };
 
                 A53_1: cpu@101 {
@@ -94,6 +119,7 @@
                         enable-method = "psci";
                         next-level-cache = <&A53_L2>;
                         clocks = <&scpi_dvfs 1>;
+                        cpu-idle-states = <&CPU_SLEEP_0 &CLUSTER_SLEEP_0>;
                 };
 
                 A53_2: cpu@102 {
@@ -103,6 +129,7 @@
                         enable-method = "psci";
                         next-level-cache = <&A53_L2>;
                         clocks = <&scpi_dvfs 1>;
+                        cpu-idle-states = <&CPU_SLEEP_0 &CLUSTER_SLEEP_0>;
                 };
 
                 A53_3: cpu@103 {
@@ -112,6 +139,7 @@
                         enable-method = "psci";
                         next-level-cache = <&A53_L2>;
                         clocks = <&scpi_dvfs 1>;
+                        cpu-idle-states = <&CPU_SLEEP_0 &CLUSTER_SLEEP_0>;
                 };
 
                 A57_L2: l2-cache0 {
diff --git a/arch/arm64/boot/dts/arm/juno-sched-energy.dtsi b/arch/arm64/boot/dts/arm/juno-sched-energy.dtsi
new file mode 100644
index 000000000000..38207e4391ab
--- /dev/null
+++ b/arch/arm64/boot/dts/arm/juno-sched-energy.dtsi
@@ -0,0 +1,147 @@
+/*
+ * ARM JUNO specific energy cost model data. There are no unit requirements for
+ * the data. Data can be normalized to any reference point, but the
+ * normalization must be consistent. That is, one bogo-joule/watt must be the
+ * same quantity for all data, but we don't care what it is.
+ */
+
+/* static struct idle_state idle_states_cluster_a53[] = { */
+/*        { .power = 56 }, /\* arch_cpu_idle() (active idle) = WFI *\/ */
+/*        { .power = 56 }, /\* WFI *\/ */
+/*        { .power = 56 }, /\* cpu-sleep-0 *\/ */
+/*        { .power = 17 }, /\* cluster-sleep-0 *\/ */
+/* }; */
+
+/* static struct idle_state idle_states_cluster_a57[] = { */
+/*        { .power = 65 }, /\* arch_cpu_idle() (active idle) = WFI *\/ */
+/*        { .power = 65 }, /\* WFI *\/ */
+/*        { .power = 65 }, /\* cpu-sleep-0 *\/ */
+/*        { .power = 24 }, /\* cluster-sleep-0 *\/ */
+/* }; */
+
+/* static struct capacity_state cap_states_cluster_a53[] = { */
+/*         /\* Power per cluster *\/ */
+/*        { .cap =  235, .power = 26, }, /\*  450 MHz *\/ */
+/*        { .cap =  303, .power = 30, }, /\*  575 MHz *\/ */
+/*        { .cap =  368, .power = 39, }, /\*  700 MHz *\/ */
+/*        { .cap =  406, .power = 47, }, /\*  775 MHz *\/ */
+/*        { .cap =  447, .power = 57, }, /\*  850 Mhz *\/ */
+/* }; */
+
+/* static struct capacity_state cap_states_cluster_a57[] = { */
+/*         /\* Power per cluster *\/ */
+/*        { .cap =  417, .power = 24, }, /\*  450 MHz *\/ */
+/*        { .cap =  579, .power = 32, }, /\*  625 MHz *\/ */
+/*        { .cap =  744, .power = 43, }, /\*  800 MHz *\/ */
+/*        { .cap =  883, .power = 49, }, /\*  950 MHz *\/ */
+/*        { .cap = 1024, .power = 64, }, /\* 1100 MHz *\/ */
+/* }; */
+
+/* static struct sched_group_energy energy_cluster_a53 = { */
+/*        .nr_idle_states = ARRAY_SIZE(idle_states_cluster_a53), */
+/*        .idle_states    = idle_states_cluster_a53, */
+/*        .nr_cap_states  = ARRAY_SIZE(cap_states_cluster_a53), */
+/*        .cap_states     = cap_states_cluster_a53, */
+/* }; */
+
+/* static struct sched_group_energy energy_cluster_a57 = { */
+/*        .nr_idle_states = ARRAY_SIZE(idle_states_cluster_a57), */
+/*        .idle_states    = idle_states_cluster_a57, */
+/*        .nr_cap_states  = ARRAY_SIZE(cap_states_cluster_a57), */
+/*        .cap_states     = cap_states_cluster_a57, */
+/* }; */
+
+/* static struct idle_state idle_states_core_a53[] = { */
+/*        { .power = 6 }, /\* arch_cpu_idle() (active idle) = WFI *\/ */
+/*        { .power = 6 }, /\* WFI *\/ */
+/*        { .power = 0 }, /\* cpu-sleep-0 *\/ */
+/*        { .power = 0 }, /\* cluster-sleep-0 *\/ */
+/* }; */
+
+/* static struct idle_state idle_states_core_a57[] = { */
+/*        { .power = 15 }, /\* arch_cpu_idle() (active idle) = WFI *\/ */
+/*        { .power = 15 }, /\* WFI *\/ */
+/*        { .power = 0  }, /\* cpu-sleep-0 *\/ */
+/*        { .power = 0  }, /\* cluster-sleep-0 *\/ */
+/* }; */
+
+/* static struct capacity_state cap_states_core_a53[] = { */
+/*         /\* Power per cpu *\/ */
+/*        { .cap =  235, .power =  33, }, /\*  450 MHz *\/ */
+/*        { .cap =  302, .power =  46, }, /\*  575 MHz *\/ */
+/*        { .cap =  368, .power =  61, }, /\*  700 MHz *\/ */
+/*        { .cap =  406, .power =  76, }, /\*  775 MHz *\/ */
+/*        { .cap =  447, .power =  93, }, /\*  850 Mhz *\/ */
+/* }; */
+
+/* static struct capacity_state cap_states_core_a57[] = { */
+/*         /\* Power per cpu *\/ */
+/*        { .cap =  417, .power = 168, }, /\*  450 MHz *\/ */
+/*        { .cap =  579, .power = 251, }, /\*  625 MHz *\/ */
+/*        { .cap =  744, .power = 359, }, /\*  800 MHz *\/ */
+/*        { .cap =  883, .power = 479, }, /\*  950 MHz *\/ */
+/*        { .cap = 1024, .power = 616, }, /\* 1100 MHz *\/ */
+/* }; */
+
+energy-costs {
+        CPU_COST_A57: core-cost0 {
+                busy-cost-data = <
+                        417   168
+                        579   251
+                        744   359
+                        883   479
+                       1023   616
+                >;
+                idle-cost-data = <
+                      15
+                      15
+                       0
+                       0
+                >;
+        };
+        CPU_COST_A53: core-cost1 {
+                busy-cost-data = <
+                        235    33
+                        302    46
+                        368    61
+                        406    76
+                        447    93
+                >;
+                idle-cost-data = <
+                      6
+                      6
+                      0
+                      0
+                >;
+        };
+        CLUSTER_COST_A57: cluster-cost0 {
+                busy-cost-data = <
+                        417    24
+                        579    32
+                        744    43
+                        883    49
+                       1024    64
+                >;
+                idle-cost-data = <
+                         65
+                         65
+                         65
+                         24
+                >;
+        };
+        CLUSTER_COST_A53: cluster-cost1 {
+                busy-cost-data = <
+                        235    26
+                        303    30
+                        368    39
+                        406    47
+                        447    57
+                >;
+                idle-cost-data = <
+                        56
+                        56
+                        56
+                        17
+                >;
+        };
+};
diff --git a/arch/arm64/boot/dts/arm/juno.dts b/arch/arm64/boot/dts/arm/juno.dts
index 3e1a84b01b50..68816f71fa51 100644
--- a/arch/arm64/boot/dts/arm/juno.dts
+++ b/arch/arm64/boot/dts/arm/juno.dts
@@ -60,6 +60,28 @@
                         };
                 };
 
+                idle-states {
+                        entry-method = "arm,psci";
+
+                        CPU_SLEEP_0: cpu-sleep-0 {
+                                compatible = "arm,idle-state";
+                                arm,psci-suspend-param = <0x0010000>;
+                                local-timer-stop;
+                                entry-latency-us = <300>;
+                                exit-latency-us = <1200>;
+                                min-residency-us = <2000>;
+                        };
+
+                        CLUSTER_SLEEP_0: cluster-sleep-0 {
+                                compatible = "arm,idle-state";
+                                arm,psci-suspend-param = <0x1010000>;
+                                local-timer-stop;
+                                entry-latency-us = <400>;
+                                exit-latency-us = <1200>;
+                                min-residency-us = <2500>;
+                        };
+                };
+
                 A57_0: cpu@0 {
                         compatible = "arm,cortex-a57","arm,armv8";
                         reg = <0x0 0x0>;
@@ -67,6 +89,8 @@
                         enable-method = "psci";
                         next-level-cache = <&A57_L2>;
                         clocks = <&scpi_dvfs 0>;
+                        cpu-idle-states = <&CPU_SLEEP_0 &CLUSTER_SLEEP_0>;
+                        sched-energy-costs = <&CPU_COST_A57 &CLUSTER_COST_A57>;
                 };
 
                 A57_1: cpu@1 {
@@ -76,6 +100,8 @@
                         enable-method = "psci";
                         next-level-cache = <&A57_L2>;
                         clocks = <&scpi_dvfs 0>;
+                        cpu-idle-states = <&CPU_SLEEP_0 &CLUSTER_SLEEP_0>;
+                        sched-energy-costs = <&CPU_COST_A57 &CLUSTER_COST_A57>;
                 };
 
                 A53_0: cpu@100 {
@@ -85,6 +111,8 @@
                         enable-method = "psci";
                         next-level-cache = <&A53_L2>;
                         clocks = <&scpi_dvfs 1>;
+                        cpu-idle-states = <&CPU_SLEEP_0 &CLUSTER_SLEEP_0>;
+                        sched-energy-costs = <&CPU_COST_A53 &CLUSTER_COST_A53>;
                 };
 
                 A53_1: cpu@101 {
@@ -94,6 +122,8 @@
                         enable-method = "psci";
                         next-level-cache = <&A53_L2>;
                         clocks = <&scpi_dvfs 1>;
+                        cpu-idle-states = <&CPU_SLEEP_0 &CLUSTER_SLEEP_0>;
+                        sched-energy-costs = <&CPU_COST_A53 &CLUSTER_COST_A53>;
                 };
 
                 A53_2: cpu@102 {
@@ -103,6 +133,8 @@
                         enable-method = "psci";
                         next-level-cache = <&A53_L2>;
                         clocks = <&scpi_dvfs 1>;
+                        cpu-idle-states = <&CPU_SLEEP_0 &CLUSTER_SLEEP_0>;
+                        sched-energy-costs = <&CPU_COST_A53 &CLUSTER_COST_A53>;
                 };
 
                 A53_3: cpu@103 {
@@ -112,6 +144,8 @@
                         enable-method = "psci";
                         next-level-cache = <&A53_L2>;
                         clocks = <&scpi_dvfs 1>;
+                        cpu-idle-states = <&CPU_SLEEP_0 &CLUSTER_SLEEP_0>;
+                        sched-energy-costs = <&CPU_COST_A53 &CLUSTER_COST_A53>;
                 };
 
                 A57_L2: l2-cache0 {
@@ -121,6 +155,8 @@
                 A53_L2: l2-cache1 {
                         compatible = "cache";
                 };
+
+                /include/ "juno-sched-energy.dtsi"
         };
 
         pmu_a57 {
diff --git a/arch/arm64/boot/dts/xilinx/zynqmp-ep108.dts b/arch/arm64/boot/dts/xilinx/zynqmp-ep108.dts
index ce5d848251fa..7b34822d61e9 100644
--- a/arch/arm64/boot/dts/xilinx/zynqmp-ep108.dts
+++ b/arch/arm64/boot/dts/xilinx/zynqmp-ep108.dts
@@ -26,7 +26,7 @@
                 stdout-path = "serial0:115200n8";
         };
 
-        memory {
+        memory@0 {
                 device_type = "memory";
                 reg = <0x0 0x0 0x40000000>;
         };
diff --git a/arch/arm64/boot/dts/xilinx/zynqmp.dtsi b/arch/arm64/boot/dts/xilinx/zynqmp.dtsi
index 857eda5c7217..172402cc1a0f 100644
--- a/arch/arm64/boot/dts/xilinx/zynqmp.dtsi
+++ b/arch/arm64/boot/dts/xilinx/zynqmp.dtsi
@@ -71,7 +71,7 @@
                              <1 10 0xf01>;
         };
 
-        amba_apu {
+        amba_apu: amba_apu@0 {
                 compatible = "simple-bus";
                 #address-cells = <2>;
                 #size-cells = <1>;
@@ -191,7 +191,7 @@
                 };
 
                 i2c0: i2c@ff020000 {
-                        compatible = "cdns,i2c-r1p10";
+                        compatible = "cdns,i2c-r1p14", "cdns,i2c-r1p10";
                         status = "disabled";
                         interrupt-parent = <&gic>;
                         interrupts = <0 17 4>;
@@ -202,7 +202,7 @@
                 };
 
                 i2c1: i2c@ff030000 {
-                        compatible = "cdns,i2c-r1p10";
+                        compatible = "cdns,i2c-r1p14", "cdns,i2c-r1p10";
                         status = "disabled";
                         interrupt-parent = <&gic>;
                         interrupts = <0 18 4>;
diff --git a/arch/arm64/configs/defconfig b/arch/arm64/configs/defconfig
index 79717faf2161..7dc5e58f7b7a 100644
--- a/arch/arm64/configs/defconfig
+++ b/arch/arm64/configs/defconfig
@@ -58,6 +58,8 @@ CONFIG_PREEMPT=y
 CONFIG_KSM=y
 CONFIG_TRANSPARENT_HUGEPAGE=y
 CONFIG_CMA=y
+CONFIG_KEXEC=y
+CONFIG_CRASH_DUMP=y
 CONFIG_CMDLINE="console=ttyAMA0"
 # CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set
 CONFIG_COMPAT=y
diff --git a/arch/arm64/crypto/Kconfig b/arch/arm64/crypto/Kconfig
index 2cf32e9887e1..de1aab4b5da8 100644
--- a/arch/arm64/crypto/Kconfig
+++ b/arch/arm64/crypto/Kconfig
@@ -23,6 +23,11 @@ config CRYPTO_GHASH_ARM64_CE
         depends on ARM64 && KERNEL_MODE_NEON
         select CRYPTO_HASH
 
+config CRYPTO_POLY_HASH_ARM64_CE
+        tristate "poly_hash (for HEH encryption mode) using ARMv8 Crypto Extensions"
+        depends on ARM64 && KERNEL_MODE_NEON
+        select CRYPTO_HASH
+
 config CRYPTO_AES_ARM64_CE
         tristate "AES core cipher using ARMv8 Crypto Extensions"
         depends on ARM64 && KERNEL_MODE_NEON
diff --git a/arch/arm64/crypto/Makefile b/arch/arm64/crypto/Makefile
index abb79b3cfcfe..f0a8f2475ea3 100644
--- a/arch/arm64/crypto/Makefile
+++ b/arch/arm64/crypto/Makefile
@@ -17,6 +17,9 @@ sha2-ce-y := sha2-ce-glue.o sha2-ce-core.o
 obj-$(CONFIG_CRYPTO_GHASH_ARM64_CE) += ghash-ce.o
 ghash-ce-y := ghash-ce-glue.o ghash-ce-core.o
 
+obj-$(CONFIG_CRYPTO_POLY_HASH_ARM64_CE) += poly-hash-ce.o
+poly-hash-ce-y := poly-hash-ce-glue.o poly-hash-ce-core.o
+
 obj-$(CONFIG_CRYPTO_AES_ARM64_CE) += aes-ce-cipher.o
 CFLAGS_aes-ce-cipher.o += -march=armv8-a+crypto
 
diff --git a/arch/arm64/crypto/aes-glue.c b/arch/arm64/crypto/aes-glue.c
index 6a51dfccfe71..448b874a4826 100644
--- a/arch/arm64/crypto/aes-glue.c
+++ b/arch/arm64/crypto/aes-glue.c
@@ -294,7 +294,7 @@ static struct crypto_alg aes_algs[] = { {
         .cra_blkcipher = {
                 .min_keysize    = AES_MIN_KEY_SIZE,
                 .max_keysize    = AES_MAX_KEY_SIZE,
-                .ivsize         = AES_BLOCK_SIZE,
+                .ivsize         = 0,
                 .setkey         = aes_setkey,
                 .encrypt        = ecb_encrypt,
                 .decrypt        = ecb_decrypt,
@@ -371,7 +371,7 @@ static struct crypto_alg aes_algs[] = { {
         .cra_ablkcipher = {
                 .min_keysize    = AES_MIN_KEY_SIZE,
                 .max_keysize    = AES_MAX_KEY_SIZE,
-                .ivsize         = AES_BLOCK_SIZE,
+                .ivsize         = 0,
                 .setkey         = ablk_set_key,
                 .encrypt        = ablk_encrypt,
                 .decrypt        = ablk_decrypt,
diff --git a/arch/arm64/crypto/aes-modes.S b/arch/arm64/crypto/aes-modes.S
index c53dbeae79f2..838dad5c209f 100644
--- a/arch/arm64/crypto/aes-modes.S
+++ b/arch/arm64/crypto/aes-modes.S
@@ -193,15 +193,16 @@ AES_ENTRY(aes_cbc_encrypt)
         cbz             w6, .Lcbcencloop
 
         ld1             {v0.16b}, [x5]                  /* get iv */
-        enc_prepare     w3, x2, x5
+        enc_prepare     w3, x2, x6
 
 .Lcbcencloop:
         ld1             {v1.16b}, [x1], #16             /* get next pt block */
         eor             v0.16b, v0.16b, v1.16b          /* ..and xor with iv */
-        encrypt_block   v0, w3, x2, x5, w6
+        encrypt_block   v0, w3, x2, x6, w7
         st1             {v0.16b}, [x0], #16
         subs            w4, w4, #1
         bne             .Lcbcencloop
+        st1             {v0.16b}, [x5]                  /* return iv */
         ret
 AES_ENDPROC(aes_cbc_encrypt)
 
@@ -211,7 +212,7 @@ AES_ENTRY(aes_cbc_decrypt)
         cbz             w6, .LcbcdecloopNx
 
         ld1             {v7.16b}, [x5]                  /* get iv */
-        dec_prepare     w3, x2, x5
+        dec_prepare     w3, x2, x6
 
 .LcbcdecloopNx:
 #if INTERLEAVE >= 2
@@ -248,7 +249,7 @@ AES_ENTRY(aes_cbc_decrypt)
 .Lcbcdecloop:
         ld1             {v1.16b}, [x1], #16             /* get next ct block */
         mov             v0.16b, v1.16b                  /* ...and copy to v0 */
-        decrypt_block   v0, w3, x2, x5, w6
+        decrypt_block   v0, w3, x2, x6, w7
         eor             v0.16b, v0.16b, v7.16b          /* xor with iv => pt */
         mov             v7.16b, v1.16b                  /* ct is next iv */
         st1             {v0.16b}, [x0], #16
@@ -256,6 +257,7 @@ AES_ENTRY(aes_cbc_decrypt)
         bne             .Lcbcdecloop
 .Lcbcdecout:
         FRAME_POP
+        st1             {v7.16b}, [x5]                  /* return iv */
         ret
 AES_ENDPROC(aes_cbc_decrypt)
 
@@ -267,24 +269,15 @@ AES_ENDPROC(aes_cbc_decrypt)
 
 AES_ENTRY(aes_ctr_encrypt)
         FRAME_PUSH
-        cbnz            w6, .Lctrfirst          /* 1st time around? */
-        umov            x5, v4.d[1]             /* keep swabbed ctr in reg */
-        rev             x5, x5
-#if INTERLEAVE >= 2
-        cmn             w5, w4                  /* 32 bit overflow? */
-        bcs             .Lctrinc
-        add             x5, x5, #1              /* increment BE ctr */
-        b               .LctrincNx
-#else
-        b               .Lctrinc
-#endif
-.Lctrfirst:
+        cbz             w6, .Lctrnotfirst       /* 1st time around? */
         enc_prepare     w3, x2, x6
         ld1             {v4.16b}, [x5]
-        umov            x5, v4.d[1]             /* keep swabbed ctr in reg */
-        rev             x5, x5
+
+.Lctrnotfirst:
+        umov            x8, v4.d[1]             /* keep swabbed ctr in reg */
+        rev             x8, x8
 #if INTERLEAVE >= 2
-        cmn             w5, w4                  /* 32 bit overflow? */
+        cmn             w8, w4                  /* 32 bit overflow? */
         bcs             .Lctrloop
 .LctrloopNx:
         subs            w4, w4, #INTERLEAVE
@@ -292,11 +285,11 @@ AES_ENTRY(aes_ctr_encrypt)
 #if INTERLEAVE == 2
         mov             v0.8b, v4.8b
         mov             v1.8b, v4.8b
-        rev             x7, x5
-        add             x5, x5, #1
+        rev             x7, x8
+        add             x8, x8, #1
         ins             v0.d[1], x7
-        rev             x7, x5
-        add             x5, x5, #1
+        rev             x7, x8
+        add             x8, x8, #1
         ins             v1.d[1], x7
         ld1             {v2.16b-v3.16b}, [x1], #32      /* get 2 input blocks */
         do_encrypt_block2x
@@ -305,7 +298,7 @@ AES_ENTRY(aes_ctr_encrypt)
         st1             {v0.16b-v1.16b}, [x0], #32
 #else
         ldr             q8, =0x30000000200000001        /* addends 1,2,3[,0] */
-        dup             v7.4s, w5
+        dup             v7.4s, w8
         mov             v0.16b, v4.16b
         add             v7.4s, v7.4s, v8.4s
         mov             v1.16b, v4.16b
@@ -323,18 +316,12 @@ AES_ENTRY(aes_ctr_encrypt)
         eor             v2.16b, v7.16b, v2.16b
         eor             v3.16b, v5.16b, v3.16b
         st1             {v0.16b-v3.16b}, [x0], #64
-        add             x5, x5, #INTERLEAVE
+        add             x8, x8, #INTERLEAVE
 #endif
-        cbz             w4, .LctroutNx
-.LctrincNx:
-        rev             x7, x5
+        rev             x7, x8
         ins             v4.d[1], x7
+        cbz             w4, .Lctrout
         b               .LctrloopNx
-.LctroutNx:
-        sub             x5, x5, #1
-        rev             x7, x5
-        ins             v4.d[1], x7
-        b               .Lctrout
 .Lctr1x:
         adds            w4, w4, #INTERLEAVE
         beq             .Lctrout
@@ -342,30 +329,39 @@ AES_ENTRY(aes_ctr_encrypt)
 .Lctrloop:
         mov             v0.16b, v4.16b
         encrypt_block   v0, w3, x2, x6, w7
+
+        adds            x8, x8, #1              /* increment BE ctr */
+        rev             x7, x8
+        ins             v4.d[1], x7
+        bcs             .Lctrcarry              /* overflow? */
+
+.Lctrcarrydone:
         subs            w4, w4, #1
         bmi             .Lctrhalfblock          /* blocks < 0 means 1/2 block */
         ld1             {v3.16b}, [x1], #16
         eor             v3.16b, v0.16b, v3.16b
         st1             {v3.16b}, [x0], #16
-        beq             .Lctrout
-.Lctrinc:
-        adds            x5, x5, #1              /* increment BE ctr */
-        rev             x7, x5
-        ins             v4.d[1], x7
-        bcc             .Lctrloop               /* no overflow? */
-        umov            x7, v4.d[0]             /* load upper word of ctr  */
-        rev             x7, x7                  /* ... to handle the carry */
-        add             x7, x7, #1
-        rev             x7, x7
-        ins             v4.d[0], x7
-        b               .Lctrloop
+        bne             .Lctrloop
+
+.Lctrout:
+        st1             {v4.16b}, [x5]          /* return next CTR value */
+        FRAME_POP
+        ret
+
 .Lctrhalfblock:
         ld1             {v3.8b}, [x1]
         eor             v3.8b, v0.8b, v3.8b
         st1             {v3.8b}, [x0]
-.Lctrout:
         FRAME_POP
         ret
+
+.Lctrcarry:
+        umov            x7, v4.d[0]             /* load upper word of ctr  */
+        rev             x7, x7                  /* ... to handle the carry */
+        add             x7, x7, #1
+        rev             x7, x7
+        ins             v4.d[0], x7
+        b               .Lctrcarrydone
 AES_ENDPROC(aes_ctr_encrypt)
         .ltorg
 
diff --git a/arch/arm64/crypto/poly-hash-ce-core.S b/arch/arm64/crypto/poly-hash-ce-core.S
new file mode 100644
index 000000000000..8ccb544c5526
--- /dev/null
+++ b/arch/arm64/crypto/poly-hash-ce-core.S
@@ -0,0 +1,163 @@
+/*
+ * Accelerated poly_hash implementation with ARMv8 PMULL instructions.
+ *
+ * Based on ghash-ce-core.S.
+ *
+ * Copyright (C) 2014 Linaro Ltd. <ard.biesheuvel@linaro.org>
+ * Copyright (C) 2017 Google, Inc. <ebiggers@google.com>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published
+ * by the Free Software Foundation.
+ */
+
+#include <linux/linkage.h>
+#include <asm/assembler.h>
+
+        KEY     .req    v0
+        KEY2    .req    v1
+        T1      .req    v2
+        T2      .req    v3
+        GSTAR   .req    v4
+        XL      .req    v5
+        XM      .req    v6
+        XH      .req    v7
+
+        .text
+        .arch           armv8-a+crypto
+
+        /* 16-byte aligned (2**4 = 16); not required, but might as well */
+        .align          4
+.Lgstar:
+        .quad           0x87, 0x87
+
+/*
+ * void pmull_poly_hash_update(le128 *digest, const le128 *key,
+ *                             const u8 *src, unsigned int blocks,
+ *                             unsigned int partial);
+ */
+ENTRY(pmull_poly_hash_update)
+
+        /* Load digest into XL */
+        ld1             {XL.16b}, [x0]
+
+        /* Load key into KEY */
+        ld1             {KEY.16b}, [x1]
+
+        /* Load g*(x) = g(x) + x^128 = x^7 + x^2 + x + 1 into both halves of
+         * GSTAR */
+        adr             x1, .Lgstar
+        ld1             {GSTAR.2d}, [x1]
+
+        /* Set KEY2 to (KEY[1]+KEY[0]):(KEY[1]+KEY[0]).  This is needed for
+         * Karatsuba multiplication. */
+        ext             KEY2.16b, KEY.16b, KEY.16b, #8
+        eor             KEY2.16b, KEY2.16b, KEY.16b
+
+        /* If 'partial' is nonzero, then we're finishing a pending block and
+         * should go right to the multiplication. */
+        cbnz            w4, 1f
+
+0:
+        /* Add the next block from 'src' to the digest */
+        ld1             {T1.16b}, [x2], #16
+        eor             XL.16b, XL.16b, T1.16b
+        sub             w3, w3, #1
+
+1:
+        /*
+         * Multiply the current 128-bit digest (a1:a0, in XL) by the 128-bit key
+         * (b1:b0, in KEY) using Karatsuba multiplication.
+         */
+
+        /* T1 = (a1+a0):(a1+a0) */
+        ext             T1.16b, XL.16b, XL.16b, #8
+        eor             T1.16b, T1.16b, XL.16b
+
+        /* XH = a1 * b1 */
+        pmull2          XH.1q, XL.2d, KEY.2d
+
+        /* XL = a0 * b0 */
+        pmull           XL.1q, XL.1d, KEY.1d
+
+        /* XM = (a1+a0) * (b1+b0) */
+        pmull           XM.1q, T1.1d, KEY2.1d
+
+        /* XM += (XH[0]:XL[1]) + XL + XH */
+        ext             T1.16b, XL.16b, XH.16b, #8
+        eor             T2.16b, XL.16b, XH.16b
+        eor             XM.16b, XM.16b, T1.16b
+        eor             XM.16b, XM.16b, T2.16b
+
+        /*
+         * Now the 256-bit product is in XH[1]:XM:XL[0].  It represents a
+         * polynomial over GF(2) with degree as large as 255.  We need to
+         * compute its remainder modulo g(x) = x^128+x^7+x^2+x+1.  For this it
+         * is sufficient to compute the remainder of the high half 'c(x)x^128'
+         * add it to the low half.  To reduce the high half we use the Barrett
+         * reduction method.  The basic idea is that we can express the
+         * remainder p(x) as g(x)q(x) mod x^128, where q(x) = (c(x)x^128)/g(x).
+         * As detailed in [1], to avoid having to divide by g(x) at runtime the
+         * following equivalent expression can be derived:
+         *
+         *      p(x) = [ g*(x)((c(x)q+(x))/x^128) ] mod x^128
+         *
+         * where g*(x) = x^128+g(x) = x^7+x^2+x+1, and q+(x) = x^256/g(x) = g(x)
+         * in this case.  This is also equivalent to:
+         *
+         *      p(x) = [ g*(x)((c(x)(x^128 + g*(x)))/x^128) ] mod x^128
+         *           = [ g*(x)(c(x) + (c(x)g*(x))/x^128) ] mod x^128
+         *
+         * Since deg g*(x) < 64:
+         *
+         *      p(x) = [ g*(x)(c(x) + ((c(x)/x^64)g*(x))/x^64) ] mod x^128
+         *           = [ g*(x)((c(x)/x^64)x^64 + (c(x) mod x^64) +
+         *                              ((c(x)/x^64)g*(x))/x^64) ] mod x^128
+         *
+         * Letting t(x) = g*(x)(c(x)/x^64):
+         *
+         *      p(x) = [ t(x)x^64 + g*(x)((c(x) mod x^64) + t(x)/x^64) ] mod x^128
+         *
+         * Therefore, to do the reduction we only need to issue two 64-bit =>
+         * 128-bit carryless multiplications: g*(x) times c(x)/x^64, and g*(x)
+         * times ((c(x) mod x^64) + t(x)/x^64).  (Multiplication by x^64 doesn't
+         * count since it is simply a shift or move.)
+         *
+         * An alternate reduction method, also based on Barrett reduction and
+         * described in [1], uses only shifts and XORs --- no multiplications.
+         * However, the method with multiplications requires fewer instructions
+         * and is faster on processors with fast carryless multiplication.
+         *
+         * [1] "Intel Carry-Less Multiplication Instruction and its Usage for
+         * Computing the GCM Mode",
+         * https://software.intel.com/sites/default/files/managed/72/cc/clmul-wp-rev-2.02-2014-04-20.pdf
+         */
+
+        /* 256-bit product is XH[1]:XM:XL[0], so c(x) is XH[1]:XM[1] */
+
+        /* T1 = t(x) = g*(x)(c(x)/x^64) */
+        pmull2          T1.1q, GSTAR.2d, XH.2d
+
+        /* T2 = g*(x)((c(x) mod x^64) + t(x)/x^64) */
+        eor             T2.16b, XM.16b, T1.16b
+        pmull2          T2.1q, GSTAR.2d, T2.2d
+
+        /* Make XL[0] be the low half of the 128-bit result by adding the low 64
+         * bits of the T2 term to what was already there.  The 't(x)x^64' term
+         * makes no difference, so skip it. */
+        eor             XL.16b, XL.16b, T2.16b
+
+        /* Make XL[1] be the high half of the 128-bit result by adding the high
+         * 64 bits of the 't(x)x^64' and T2 terms to what was already in XM[0],
+         * then moving XM[0] to XL[1]. */
+        eor             XM.16b, XM.16b, T1.16b
+        ext             T2.16b, T2.16b, T2.16b, #8
+        eor             XM.16b, XM.16b, T2.16b
+        mov             XL.d[1], XM.d[0]
+
+        /* If more blocks remain, then loop back to process the next block;
+         * else, store the digest and return. */
+        cbnz            w3, 0b
+        st1             {XL.16b}, [x0]
+        ret
+ENDPROC(pmull_poly_hash_update)
diff --git a/arch/arm64/crypto/poly-hash-ce-glue.c b/arch/arm64/crypto/poly-hash-ce-glue.c
new file mode 100644
index 000000000000..e195740c9ecf
--- /dev/null
+++ b/arch/arm64/crypto/poly-hash-ce-glue.c
@@ -0,0 +1,166 @@
+/*
+ * Accelerated poly_hash implementation with ARMv8 PMULL instructions.
+ *
+ * Based on ghash-ce-glue.c.
+ *
+ * poly_hash is part of the HEH (Hash-Encrypt-Hash) encryption mode, proposed in
+ * Internet Draft https://tools.ietf.org/html/draft-cope-heh-01.
+ *
+ * poly_hash is very similar to GHASH: both algorithms are keyed hashes which
+ * interpret their input data as coefficients of a polynomial over GF(2^128),
+ * then calculate a hash value by evaluating that polynomial at the point given
+ * by the key, e.g. using Horner's rule.  The difference is that poly_hash uses
+ * the more natural "ble" convention to represent GF(2^128) elements, whereas
+ * GHASH uses the less natural "lle" convention (see include/crypto/gf128mul.h).
+ * The ble convention makes it simpler to implement GF(2^128) multiplication.
+ *
+ * Copyright (C) 2014 Linaro Ltd. <ard.biesheuvel@linaro.org>
+ * Copyright (C) 2017 Google Inc. <ebiggers@google.com>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published
+ * by the Free Software Foundation.
+ */
+
+#include <asm/neon.h>
+#include <crypto/b128ops.h>
+#include <crypto/internal/hash.h>
+#include <linux/cpufeature.h>
+#include <linux/crypto.h>
+#include <linux/module.h>
+
+/*
+ * Note: in this algorithm we currently use 'le128' to represent GF(2^128)
+ * elements, even though poly_hash-generic uses 'be128'.  Both types are
+ * actually "wrong" because the elements are actually in 'ble' format, and there
+ * should be a ble type to represent this --- as well as lle, bbe, and lbe types
+ * for the other conventions for representing GF(2^128) elements.  But
+ * practically it doesn't matter which type we choose here, so we just use le128
+ * since it's arguably more accurate, while poly_hash-generic still has to use
+ * be128 because the generic GF(2^128) multiplication functions all take be128.
+ */
+
+struct poly_hash_desc_ctx {
+        le128 digest;
+        unsigned int count;
+};
+
+asmlinkage void pmull_poly_hash_update(le128 *digest, const le128 *key,
+                                       const u8 *src, unsigned int blocks,
+                                       unsigned int partial);
+
+static int poly_hash_setkey(struct crypto_shash *tfm,
+                            const u8 *key, unsigned int keylen)
+{
+        if (keylen != sizeof(le128)) {
+                crypto_shash_set_flags(tfm, CRYPTO_TFM_RES_BAD_KEY_LEN);
+                return -EINVAL;
+        }
+
+        memcpy(crypto_shash_ctx(tfm), key, sizeof(le128));
+        return 0;
+}
+
+static int poly_hash_init(struct shash_desc *desc)
+{
+        struct poly_hash_desc_ctx *ctx = shash_desc_ctx(desc);
+
+        ctx->digest = (le128) { 0 };
+        ctx->count = 0;
+        return 0;
+}
+
+static int poly_hash_update(struct shash_desc *desc, const u8 *src,
+                            unsigned int len)
+{
+        struct poly_hash_desc_ctx *ctx = shash_desc_ctx(desc);
+        unsigned int partial = ctx->count % sizeof(le128);
+        u8 *dst = (u8 *)&ctx->digest + partial;
+
+        ctx->count += len;
+
+        /* Finishing at least one block? */
+        if (partial + len >= sizeof(le128)) {
+                const le128 *key = crypto_shash_ctx(desc->tfm);
+
+                if (partial) {
+                        /* Finish the pending block. */
+                        unsigned int n = sizeof(le128) - partial;
+
+                        len -= n;
+                        do {
+                                *dst++ ^= *src++;
+                        } while (--n);
+                }
+
+                /*
+                 * Do the real work.  If 'partial' is nonzero, this starts by
+                 * multiplying 'digest' by 'key'.  Then for each additional full
+                 * block it adds the block to 'digest' and multiplies by 'key'.
+                 */
+                kernel_neon_begin_partial(8);
+                pmull_poly_hash_update(&ctx->digest, key, src,
+                                       len / sizeof(le128), partial);
+                kernel_neon_end();
+
+                src += len - (len % sizeof(le128));
+                len %= sizeof(le128);
+                dst = (u8 *)&ctx->digest;
+        }
+
+        /* Continue adding the next block to 'digest'. */
+        while (len--)
+                *dst++ ^= *src++;
+        return 0;
+}
+
+static int poly_hash_final(struct shash_desc *desc, u8 *out)
+{
+        struct poly_hash_desc_ctx *ctx = shash_desc_ctx(desc);
+        unsigned int partial = ctx->count % sizeof(le128);
+
+        /* Finish the last block if needed. */
+        if (partial) {
+                const le128 *key = crypto_shash_ctx(desc->tfm);
+
+                kernel_neon_begin_partial(8);
+                pmull_poly_hash_update(&ctx->digest, key, NULL, 0, partial);
+                kernel_neon_end();
+        }
+
+        memcpy(out, &ctx->digest, sizeof(le128));
+        return 0;
+}
+
+static struct shash_alg poly_hash_alg = {
+        .digestsize     = sizeof(le128),
+        .init           = poly_hash_init,
+        .update         = poly_hash_update,
+        .final          = poly_hash_final,
+        .setkey         = poly_hash_setkey,
+        .descsize       = sizeof(struct poly_hash_desc_ctx),
+        .base           = {
+                .cra_name               = "poly_hash",
+                .cra_driver_name        = "poly_hash-ce",
+                .cra_priority           = 300,
+                .cra_ctxsize            = sizeof(le128),
+                .cra_module             = THIS_MODULE,
+        },
+};
+
+static int __init poly_hash_ce_mod_init(void)
+{
+        return crypto_register_shash(&poly_hash_alg);
+}
+
+static void __exit poly_hash_ce_mod_exit(void)
+{
+        crypto_unregister_shash(&poly_hash_alg);
+}
+
+MODULE_DESCRIPTION("Polynomial evaluation hash using ARMv8 Crypto Extensions");
+MODULE_AUTHOR("Eric Biggers <ebiggers@google.com>");
+MODULE_LICENSE("GPL v2");
+
+module_cpu_feature_match(PMULL, poly_hash_ce_mod_init);
+module_exit(poly_hash_ce_mod_exit);
diff --git a/arch/arm64/include/asm/acpi.h b/arch/arm64/include/asm/acpi.h
index aee323b13802..0a11cd502dbc 100644
--- a/arch/arm64/include/asm/acpi.h
+++ b/arch/arm64/include/asm/acpi.h
@@ -22,9 +22,9 @@
 #define ACPI_MADT_GICC_LENGTH   \
         (acpi_gbl_FADT.header.revision < 6 ? 76 : 80)
 
-#define BAD_MADT_GICC_ENTRY(entry, end)                                         \
-        (!(entry) || (unsigned long)(entry) + sizeof(*(entry)) > (end) ||       \
-         (entry)->header.length != ACPI_MADT_GICC_LENGTH)
+#define BAD_MADT_GICC_ENTRY(entry, end)                                 \
+        (!(entry) || (entry)->header.length != ACPI_MADT_GICC_LENGTH || \
+        (unsigned long)(entry) + ACPI_MADT_GICC_LENGTH > (end))
 
 /* Basic configuration for ACPI */
 #ifdef  CONFIG_ACPI
diff --git a/arch/arm64/include/asm/alternative.h b/arch/arm64/include/asm/alternative.h
index 8746ff6abd77..55101bd86b98 100644
--- a/arch/arm64/include/asm/alternative.h
+++ b/arch/arm64/include/asm/alternative.h
@@ -2,6 +2,7 @@
 #define __ASM_ALTERNATIVE_H
 
 #include <asm/cpufeature.h>
+#include <asm/insn.h>
 
 #ifndef __ASSEMBLY__
 
@@ -90,34 +91,55 @@ void apply_alternatives(void *start, size_t length);
 .endm
 
 /*
- * Begin an alternative code sequence.
+ * Alternative sequences
+ *
+ * The code for the case where the capability is not present will be
+ * assembled and linked as normal. There are no restrictions on this
+ * code.
+ *
+ * The code for the case where the capability is present will be
+ * assembled into a special section to be used for dynamic patching.
+ * Code for that case must:
+ *
+ * 1. Be exactly the same length (in bytes) as the default code
+ *    sequence.
  *
- * The code that follows this macro will be assembled and linked as
- * normal. There are no restrictions on this code.
+ * 2. Not contain a branch target that is used outside of the
+ *    alternative sequence it is defined in (branches into an
+ *    alternative sequence are not fixed up).
+ */
+
+/*
+ * Begin an alternative code sequence.
  */
 .macro alternative_if_not cap
+        .set .Lasm_alt_mode, 0
         .pushsection .altinstructions, "a"
         altinstruction_entry 661f, 663f, \cap, 662f-661f, 664f-663f
         .popsection
 661:
 .endm
 
+.macro alternative_if cap
+        .set .Lasm_alt_mode, 1
+        .pushsection .altinstructions, "a"
+        altinstruction_entry 663f, 661f, \cap, 664f-663f, 662f-661f
+        .popsection
+        .pushsection .altinstr_replacement, "ax"
+        .align 2        /* So GAS knows label 661 is suitably aligned */
+661:
+.endm
+
 /*
- * Provide the alternative code sequence.
- *
- * The code that follows this macro is assembled into a special
- * section to be used for dynamic patching. Code that follows this
- * macro must:
- *
- * 1. Be exactly the same length (in bytes) as the default code
- *    sequence.
- *
- * 2. Not contain a branch target that is used outside of the
- *    alternative sequence it is defined in (branches into an
- *    alternative sequence are not fixed up).
+ * Provide the other half of the alternative code sequence.
  */
 .macro alternative_else
-662:    .pushsection .altinstr_replacement, "ax"
+662:
+        .if .Lasm_alt_mode==0
+        .pushsection .altinstr_replacement, "ax"
+        .else
+        .popsection
+        .endif
 663:
 .endm
 
@@ -125,11 +147,25 @@ void apply_alternatives(void *start, size_t length);
  * Complete an alternative code sequence.
  */
 .macro alternative_endif
-664:    .popsection
+664:
+        .if .Lasm_alt_mode==0
+        .popsection
+        .endif
         .org    . - (664b-663b) + (662b-661b)
         .org    . - (662b-661b) + (664b-663b)
 .endm
 
+/*
+ * Provides a trivial alternative or default sequence consisting solely
+ * of NOPs. The number of NOPs is chosen automatically to match the
+ * previous case.
+ */
+.macro alternative_else_nop_endif
+alternative_else
+        nops    (662b-661b) / AARCH64_INSN_SIZE
+alternative_endif
+.endm
+
 #define _ALTERNATIVE_CFG(insn1, insn2, cap, cfg, ...)   \
         alternative_insn insn1, insn2, cap, IS_ENABLED(cfg)
 
diff --git a/arch/arm64/include/asm/asm-uaccess.h b/arch/arm64/include/asm/asm-uaccess.h
new file mode 100644
index 000000000000..be2d2347d995
--- /dev/null
+++ b/arch/arm64/include/asm/asm-uaccess.h
@@ -0,0 +1,13 @@
+#ifndef __ASM_ASM_UACCESS_H
+#define __ASM_ASM_UACCESS_H
+
+/*
+ * Remove the address tag from a virtual address, if present.
+ */
+        .macro  clear_address_tag, dst, addr
+        tst     \addr, #(1 << 55)
+        bic     \dst, \addr, #(0xff << 56)
+        csel    \dst, \dst, \addr, eq
+        .endm
+
+#endif
diff --git a/arch/arm64/include/asm/assembler.h b/arch/arm64/include/asm/assembler.h
index aeb4554b3af3..d8855ca6068a 100644
--- a/arch/arm64/include/asm/assembler.h
+++ b/arch/arm64/include/asm/assembler.h
@@ -108,6 +108,15 @@
         .endm
 
 /*
+ * NOP sequence
+ */
+        .macro  nops, num
+        .rept   \num
+        nop
+        .endr
+        .endm
+
+/*
  * Emit an entry into the exception table
  */
         .macro          _asm_extable, from, to
@@ -383,15 +392,11 @@ alternative_endif
  */
         .macro  post_ttbr0_update_workaround
 #ifdef CONFIG_CAVIUM_ERRATUM_27456
-alternative_if_not ARM64_WORKAROUND_CAVIUM_27456
-        nop
-        nop
-        nop
-alternative_else
+alternative_if ARM64_WORKAROUND_CAVIUM_27456
         ic      iallu
         dsb     nsh
         isb
-alternative_endif
+alternative_else_nop_endif
 #endif
         .endm
 
diff --git a/arch/arm64/include/asm/barrier.h b/arch/arm64/include/asm/barrier.h
index 9622eb48f894..0671711b46ab 100644
--- a/arch/arm64/include/asm/barrier.h
+++ b/arch/arm64/include/asm/barrier.h
@@ -20,6 +20,9 @@
 
 #ifndef __ASSEMBLY__
 
+#define __nops(n)       ".rept  " #n "\nnop\n.endr\n"
+#define nops(n)         asm volatile(__nops(n))
+
 #define sev()           asm volatile("sev" : : : "memory")
 #define wfe()           asm volatile("wfe" : : : "memory")
 #define wfi()           asm volatile("wfi" : : : "memory")
@@ -41,23 +44,33 @@
 
 #define smp_store_release(p, v)                                         \
 do {                                                                    \
+        union { typeof(*p) __val; char __c[1]; } __u =                  \
+                { .__val = (__force typeof(*p)) (v) };                  \
         compiletime_assert_atomic_type(*p);                             \
         switch (sizeof(*p)) {                                           \
         case 1:                                                         \
                 asm volatile ("stlrb %w1, %0"                           \
-                                : "=Q" (*p) : "r" (v) : "memory");      \
+                                : "=Q" (*p)                             \
+                                : "r" (*(__u8 *)__u.__c)                \
+                                : "memory");                            \
                 break;                                                  \
         case 2:                                                         \
                 asm volatile ("stlrh %w1, %0"                           \
-                                : "=Q" (*p) : "r" (v) : "memory");      \
+                                : "=Q" (*p)                             \
+                                : "r" (*(__u16 *)__u.__c)               \
+                                : "memory");                            \
                 break;                                                  \
         case 4:                                                         \
                 asm volatile ("stlr %w1, %0"                            \
-                                : "=Q" (*p) : "r" (v) : "memory");      \
+                                : "=Q" (*p)                             \
+                                : "r" (*(__u32 *)__u.__c)               \
+                                : "memory");                            \
                 break;                                                  \
         case 8:                                                         \
                 asm volatile ("stlr %1, %0"                             \
-                                : "=Q" (*p) : "r" (v) : "memory");      \
+                                : "=Q" (*p)                             \
+                                : "r" (*(__u64 *)__u.__c)               \
+                                : "memory");                            \
                 break;                                                  \
         }                                                               \
 } while (0)
diff --git a/arch/arm64/include/asm/cacheflush.h b/arch/arm64/include/asm/cacheflush.h
index 22dda613f9c9..22aabdeacc24 100644
--- a/arch/arm64/include/asm/cacheflush.h
+++ b/arch/arm64/include/asm/cacheflush.h
@@ -155,5 +155,6 @@ int set_memory_ro(unsigned long addr, int numpages);
 int set_memory_rw(unsigned long addr, int numpages);
 int set_memory_x(unsigned long addr, int numpages);
 int set_memory_nx(unsigned long addr, int numpages);
+int set_memory_valid(unsigned long addr, unsigned long size, int enable);
 
 #endif
diff --git a/arch/arm64/include/asm/cmpxchg.h b/arch/arm64/include/asm/cmpxchg.h
index 510c7b404454..270c6b7b0a61 100644
--- a/arch/arm64/include/asm/cmpxchg.h
+++ b/arch/arm64/include/asm/cmpxchg.h
@@ -48,7 +48,7 @@ static inline unsigned long __xchg_case_##name(unsigned long x,		\
         "       swp" #acq_lse #rel #sz "\t%" #w "3, %" #w "0, %2\n"     \
         "       nop\n"                                                  \
         "       " #nop_lse)                                             \
-        : "=&r" (ret), "=&r" (tmp), "+Q" (*(u8 *)ptr)                   \
+        : "=&r" (ret), "=&r" (tmp), "+Q" (*(unsigned long *)ptr)        \
         : "r" (x)                                                       \
         : cl);                                                          \
                                                                         \
diff --git a/arch/arm64/include/asm/elf.h b/arch/arm64/include/asm/elf.h
index 7875c886ad24..cd3dfa346649 100644
--- a/arch/arm64/include/asm/elf.h
+++ b/arch/arm64/include/asm/elf.h
@@ -113,12 +113,11 @@
 #define ELF_EXEC_PAGESIZE       PAGE_SIZE
 
 /*
- * This is the location that an ET_DYN program is loaded if exec'ed.  Typical
- * use of this is to invoke "./ld.so someprog" to test out a new version of
- * the loader.  We need to make sure that it is out of the way of the program
- * that it will "exec", and that there is sufficient room for the brk.
+ * This is the base location for PIE (ET_DYN with INTERP) loads. On
+ * 64-bit, this is above 4GB to leave the entire 32-bit address
+ * space open for things that want to use the area for 32-bit pointers.
  */
-#define ELF_ET_DYN_BASE (2 * TASK_SIZE_64 / 3)
+#define ELF_ET_DYN_BASE         (2 * TASK_SIZE_64 / 3)
 
 #ifndef __ASSEMBLY__
 
@@ -169,7 +168,8 @@ extern int arch_setup_additional_pages(struct linux_binprm *bprm,
 
 #ifdef CONFIG_COMPAT
 
-#define COMPAT_ELF_ET_DYN_BASE          (2 * TASK_SIZE_32 / 3)
+/* PIE load location for compat arm. Must match ARM ELF_ET_DYN_BASE. */
+#define COMPAT_ELF_ET_DYN_BASE          0x000400000UL
 
 /* AArch32 registers. */
 #define COMPAT_ELF_NGREG                18
diff --git a/arch/arm64/include/asm/futex.h b/arch/arm64/include/asm/futex.h
index c93023dc42cd..2cd3b3251d3c 100644
--- a/arch/arm64/include/asm/futex.h
+++ b/arch/arm64/include/asm/futex.h
@@ -21,10 +21,7 @@
 #include <linux/futex.h>
 #include <linux/uaccess.h>
 
-#include <asm/alternative.h>
-#include <asm/cpufeature.h>
 #include <asm/errno.h>
-#include <asm/sysreg.h>
 
 #define __futex_atomic_op(insn, ret, oldval, uaddr, tmp, oparg)         \
 do {                                                                    \
diff --git a/arch/arm64/include/asm/hardirq.h b/arch/arm64/include/asm/hardirq.h
index 8740297dac77..1473fc2f7ab7 100644
--- a/arch/arm64/include/asm/hardirq.h
+++ b/arch/arm64/include/asm/hardirq.h
@@ -20,7 +20,7 @@
 #include <linux/threads.h>
 #include <asm/irq.h>
 
-#define NR_IPI  6
+#define NR_IPI  7
 
 typedef struct {
         unsigned int __softirq_pending;
diff --git a/arch/arm64/include/asm/hw_breakpoint.h b/arch/arm64/include/asm/hw_breakpoint.h
index 9732908bfc8a..c72b8e201ab4 100644
--- a/arch/arm64/include/asm/hw_breakpoint.h
+++ b/arch/arm64/include/asm/hw_breakpoint.h
@@ -68,7 +68,11 @@ static inline void decode_ctrl_reg(u32 reg,
 /* Lengths */
 #define ARM_BREAKPOINT_LEN_1    0x1
 #define ARM_BREAKPOINT_LEN_2    0x3
+#define ARM_BREAKPOINT_LEN_3    0x7
 #define ARM_BREAKPOINT_LEN_4    0xf
+#define ARM_BREAKPOINT_LEN_5    0x1f
+#define ARM_BREAKPOINT_LEN_6    0x3f
+#define ARM_BREAKPOINT_LEN_7    0x7f
 #define ARM_BREAKPOINT_LEN_8    0xff
 
 /* Kernel stepping */
@@ -110,7 +114,7 @@ struct perf_event;
 struct pmu;
 
 extern int arch_bp_generic_fields(struct arch_hw_breakpoint_ctrl ctrl,
-                                  int *gen_len, int *gen_type);
+                                  int *gen_len, int *gen_type, int *offset);
 extern int arch_check_bp_in_kernelspace(struct perf_event *bp);
 extern int arch_validate_hwbkpt_settings(struct perf_event *bp);
 extern int hw_breakpoint_exceptions_notify(struct notifier_block *unused,
diff --git a/arch/arm64/include/asm/kexec.h b/arch/arm64/include/asm/kexec.h
new file mode 100644
index 000000000000..e17f0529a882
--- /dev/null
+++ b/arch/arm64/include/asm/kexec.h
@@ -0,0 +1,98 @@
+/*
+ * kexec for arm64
+ *
+ * Copyright (C) Linaro.
+ * Copyright (C) Huawei Futurewei Technologies.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#ifndef _ARM64_KEXEC_H
+#define _ARM64_KEXEC_H
+
+/* Maximum physical address we can use pages from */
+
+#define KEXEC_SOURCE_MEMORY_LIMIT (-1UL)
+
+/* Maximum address we can reach in physical address mode */
+
+#define KEXEC_DESTINATION_MEMORY_LIMIT (-1UL)
+
+/* Maximum address we can use for the control code buffer */
+
+#define KEXEC_CONTROL_MEMORY_LIMIT (-1UL)
+
+#define KEXEC_CONTROL_PAGE_SIZE 4096
+
+#define KEXEC_ARCH KEXEC_ARCH_AARCH64
+
+#ifndef __ASSEMBLY__
+
+/**
+ * crash_setup_regs() - save registers for the panic kernel
+ *
+ * @newregs: registers are saved here
+ * @oldregs: registers to be saved (may be %NULL)
+ */
+
+static inline void crash_setup_regs(struct pt_regs *newregs,
+                                    struct pt_regs *oldregs)
+{
+        if (oldregs) {
+                memcpy(newregs, oldregs, sizeof(*newregs));
+        } else {
+                u64 tmp1, tmp2;
+
+                __asm__ __volatile__ (
+                        "stp     x0,   x1, [%2, #16 *  0]\n"
+                        "stp     x2,   x3, [%2, #16 *  1]\n"
+                        "stp     x4,   x5, [%2, #16 *  2]\n"
+                        "stp     x6,   x7, [%2, #16 *  3]\n"
+                        "stp     x8,   x9, [%2, #16 *  4]\n"
+                        "stp    x10,  x11, [%2, #16 *  5]\n"
+                        "stp    x12,  x13, [%2, #16 *  6]\n"
+                        "stp    x14,  x15, [%2, #16 *  7]\n"
+                        "stp    x16,  x17, [%2, #16 *  8]\n"
+                        "stp    x18,  x19, [%2, #16 *  9]\n"
+                        "stp    x20,  x21, [%2, #16 * 10]\n"
+                        "stp    x22,  x23, [%2, #16 * 11]\n"
+                        "stp    x24,  x25, [%2, #16 * 12]\n"
+                        "stp    x26,  x27, [%2, #16 * 13]\n"
+                        "stp    x28,  x29, [%2, #16 * 14]\n"
+                        "mov     %0,  sp\n"
+                        "stp    x30,  %0,  [%2, #16 * 15]\n"
+
+                        "/* faked current PSTATE */\n"
+                        "mrs     %0, CurrentEL\n"
+                        "mrs     %1, SPSEL\n"
+                        "orr     %0, %0, %1\n"
+                        "mrs     %1, DAIF\n"
+                        "orr     %0, %0, %1\n"
+                        "mrs     %1, NZCV\n"
+                        "orr     %0, %0, %1\n"
+                        /* pc */
+                        "adr     %1, 1f\n"
+                "1:\n"
+                        "stp     %1, %0,   [%2, #16 * 16]\n"
+                        : "=&r" (tmp1), "=&r" (tmp2)
+                        : "r" (newregs)
+                        : "memory"
+                );
+        }
+}
+
+#if defined(CONFIG_KEXEC_CORE) && defined(CONFIG_HIBERNATION)
+extern bool crash_is_nosave(unsigned long pfn);
+extern void crash_prepare_suspend(void);
+extern void crash_post_resume(void);
+#else
+static inline bool crash_is_nosave(unsigned long pfn) {return false; }
+static inline void crash_prepare_suspend(void) {}
+static inline void crash_post_resume(void) {}
+#endif
+
+#endif /* __ASSEMBLY__ */
+
+#endif
diff --git a/arch/arm64/include/asm/kvm_mmu.h b/arch/arm64/include/asm/kvm_mmu.h
index 342a5ac2f3da..320dc9c7e4f4 100644
--- a/arch/arm64/include/asm/kvm_mmu.h
+++ b/arch/arm64/include/asm/kvm_mmu.h
@@ -237,8 +237,7 @@ static inline void __coherent_cache_guest_page(struct kvm_vcpu *vcpu, pfn_t pfn,
 {
         void *va = page_address(pfn_to_page(pfn));
 
-        if (!vcpu_has_cache_enabled(vcpu) || ipa_uncached)
-                kvm_flush_dcache_to_poc(va, size);
+        kvm_flush_dcache_to_poc(va, size);
 
         if (!icache_is_aliasing()) {            /* PIPT */
                 flush_icache_range((unsigned long)va,
diff --git a/arch/arm64/include/asm/mmu.h b/arch/arm64/include/asm/mmu.h
index 990124a67eeb..5472251c8e6c 100644
--- a/arch/arm64/include/asm/mmu.h
+++ b/arch/arm64/include/asm/mmu.h
@@ -33,7 +33,7 @@ extern void __iomem *early_io_map(phys_addr_t phys, unsigned long virt);
 extern void init_mem_pgprot(void);
 extern void create_pgd_mapping(struct mm_struct *mm, phys_addr_t phys,
                                unsigned long virt, phys_addr_t size,
-                               pgprot_t prot);
+                               pgprot_t prot, bool allow_block_mappings);
 extern void *fixmap_remap_fdt(phys_addr_t dt_phys);
 
 #endif
diff --git a/arch/arm64/include/asm/mmu_context.h b/arch/arm64/include/asm/mmu_context.h
index 4a32fd5f101d..e53d30c6f779 100644
--- a/arch/arm64/include/asm/mmu_context.h
+++ b/arch/arm64/include/asm/mmu_context.h
@@ -218,9 +218,11 @@ switch_mm(struct mm_struct *prev, struct mm_struct *next,
          * Update the saved TTBR0_EL1 of the scheduled-in task as the previous
          * value may have not been initialised yet (activate_mm caller) or the
          * ASID has changed since the last run (following the context switch
-         * of another thread of the same process).
+         * of another thread of the same process). Avoid setting the reserved
+         * TTBR0_EL1 to swapper_pg_dir (init_mm; e.g. via idle_task_exit).
          */
-        update_saved_ttbr0(tsk, next);
+        if (next != &init_mm)
+                update_saved_ttbr0(tsk, next);
 }
 
 #define deactivate_mm(tsk,mm)   do { } while (0)
diff --git a/arch/arm64/include/asm/page.h b/arch/arm64/include/asm/page.h
index fbafd0ad16df..fb2617df2de9 100644
--- a/arch/arm64/include/asm/page.h
+++ b/arch/arm64/include/asm/page.h
@@ -23,16 +23,8 @@
 
 /* PAGE_SHIFT determines the page size */
 /* CONT_SHIFT determines the number of pages which can be tracked together  */
-#ifdef CONFIG_ARM64_64K_PAGES
-#define PAGE_SHIFT              16
-#define CONT_SHIFT              5
-#elif defined(CONFIG_ARM64_16K_PAGES)
-#define PAGE_SHIFT              14
-#define CONT_SHIFT              7
-#else
-#define PAGE_SHIFT              12
-#define CONT_SHIFT              4
-#endif
+#define PAGE_SHIFT              CONFIG_ARM64_PAGE_SHIFT
+#define CONT_SHIFT              CONFIG_ARM64_CONT_SHIFT
 #define PAGE_SIZE               (_AC(1, UL) << PAGE_SHIFT)
 #define PAGE_MASK               (~(PAGE_SIZE-1))
 
diff --git a/arch/arm64/include/asm/ptrace.h b/arch/arm64/include/asm/ptrace.h
index 5eedfd83acc7..1528d52eb8c0 100644
--- a/arch/arm64/include/asm/ptrace.h
+++ b/arch/arm64/include/asm/ptrace.h
@@ -21,8 +21,6 @@
 
 #include <uapi/asm/ptrace.h>
 
-#define _PSR_PAN_BIT            22
-
 /* Current Exception Level values, as contained in CurrentEL */
 #define CurrentEL_EL1           (1 << 2)
 #define CurrentEL_EL2           (2 << 2)
diff --git a/arch/arm64/include/asm/smp.h b/arch/arm64/include/asm/smp.h
index 2013a4dc5124..1d3ff7e4a6c2 100644
--- a/arch/arm64/include/asm/smp.h
+++ b/arch/arm64/include/asm/smp.h
@@ -16,6 +16,19 @@
 #ifndef __ASM_SMP_H
 #define __ASM_SMP_H
 
+/* Values for secondary_data.status */
+
+#define CPU_MMU_OFF             (-1)
+#define CPU_BOOT_SUCCESS        (0)
+/* The cpu invoked ops->cpu_die, synchronise it with cpu_kill */
+#define CPU_KILL_ME             (1)
+/* The cpu couldn't die gracefully and is looping in the kernel */
+#define CPU_STUCK_IN_KERNEL     (2)
+/* Fatal system error detected by secondary CPU, crash the system */
+#define CPU_PANIC_KERNEL        (3)
+
+#ifndef __ASSEMBLY__
+
 #include <linux/threads.h>
 #include <linux/cpumask.h>
 #include <linux/thread_info.h>
@@ -54,11 +67,17 @@ asmlinkage void secondary_start_kernel(void);
 
 /*
  * Initial data for bringing up a secondary CPU.
+ * @stack  - sp for the secondary CPU
+ * @status - Result passed back from the secondary CPU to
+ *           indicate failure.
  */
 struct secondary_data {
         void *stack;
+        long status;
 };
+
 extern struct secondary_data secondary_data;
+extern long __early_cpu_boot_status;
 extern void secondary_entry(void);
 
 extern void arch_send_call_function_single_ipi(int cpu);
@@ -77,5 +96,38 @@ extern int __cpu_disable(void);
 
 extern void __cpu_die(unsigned int cpu);
 extern void cpu_die(void);
+extern void cpu_die_early(void);
+
+static inline void cpu_park_loop(void)
+{
+        for (;;) {
+                wfe();
+                wfi();
+        }
+}
+
+static inline void update_cpu_boot_status(int val)
+{
+        WRITE_ONCE(secondary_data.status, val);
+        /* Ensure the visibility of the status update */
+        dsb(ishst);
+}
+
+/*
+ * If a secondary CPU enters the kernel but fails to come online,
+ * (e.g. due to mismatched features), and cannot exit the kernel,
+ * we increment cpus_stuck_in_kernel and leave the CPU in a
+ * quiesecent loop within the kernel text. The memory containing
+ * this loop must not be re-used for anything else as the 'stuck'
+ * core is executing it.
+ *
+ * This function is used to inhibit features like kexec and hibernate.
+ */
+bool cpus_are_stuck_in_kernel(void);
+
+extern void smp_send_crash_stop(void);
+extern bool smp_crash_stop_failed(void);
+
+#endif /* ifndef __ASSEMBLY__ */
 
 #endif /* ifndef __ASM_SMP_H */
diff --git a/arch/arm64/include/asm/spinlock.h b/arch/arm64/include/asm/spinlock.h
index 43a66881fd57..73f5d548bba1 100644
--- a/arch/arm64/include/asm/spinlock.h
+++ b/arch/arm64/include/asm/spinlock.h
@@ -31,6 +31,12 @@ static inline void arch_spin_unlock_wait(arch_spinlock_t *lock)
         unsigned int tmp;
         arch_spinlock_t lockval;
 
+        /*
+         * Ensure prior spin_lock operations to other locks have completed
+         * on this CPU before we test whether "lock" is locked.
+         */
+        smp_mb();
+
         asm volatile(
 "       sevl\n"
 "1:     wfe\n"
@@ -152,6 +158,7 @@ static inline int arch_spin_value_unlocked(arch_spinlock_t lock)
 
 static inline int arch_spin_is_locked(arch_spinlock_t *lock)
 {
+        smp_mb(); /* See arch_spin_unlock_wait */
         return !arch_spin_value_unlocked(READ_ONCE(*lock));
 }
 
diff --git a/arch/arm64/include/asm/thread_info.h b/arch/arm64/include/asm/thread_info.h
index b3325a9cb90f..794d22603f04 100644
--- a/arch/arm64/include/asm/thread_info.h
+++ b/arch/arm64/include/asm/thread_info.h
@@ -47,10 +47,10 @@ typedef unsigned long mm_segment_t;
 struct thread_info {
         unsigned long           flags;          /* low level flags */
         mm_segment_t            addr_limit;     /* address limit */
+        struct task_struct      *task;          /* main task structure */
 #ifdef CONFIG_ARM64_SW_TTBR0_PAN
         u64                     ttbr0;          /* saved TTBR0_EL1 */
 #endif
-        struct task_struct      *task;          /* main task structure */
         int                     preempt_count;  /* 0 => preemptable, <0 => bug */
         int                     cpu;            /* cpu */
 };
diff --git a/arch/arm64/include/asm/uaccess.h b/arch/arm64/include/asm/uaccess.h
index c37c064d7cdd..064cef9ae2d1 100644
--- a/arch/arm64/include/asm/uaccess.h
+++ b/arch/arm64/include/asm/uaccess.h
@@ -18,19 +18,21 @@
 #ifndef __ASM_UACCESS_H
 #define __ASM_UACCESS_H
 
+#include <asm/alternative.h>
+#include <asm/kernel-pgtable.h>
+#include <asm/sysreg.h>
+
 #ifndef __ASSEMBLY__
 
 /*
  * User space memory access functions
  */
+#include <linux/bitops.h>
 #include <linux/string.h>
 #include <linux/thread_info.h>
 
-#include <asm/alternative.h>
 #include <asm/cpufeature.h>
-#include <asm/kernel-pgtable.h>
 #include <asm/ptrace.h>
-#include <asm/sysreg.h>
 #include <asm/errno.h>
 #include <asm/memory.h>
 #include <asm/compiler.h>
@@ -107,16 +109,24 @@ static inline void set_fs(mm_segment_t fs)
  */
 #define __range_ok(addr, size)                                          \
 ({                                                                      \
+        unsigned long __addr = (unsigned long __force)(addr);           \
         unsigned long flag, roksum;                                     \
         __chk_user_ptr(addr);                                           \
         asm("adds %1, %1, %3; ccmp %1, %4, #2, cc; cset %0, ls"         \
                 : "=&r" (flag), "=&r" (roksum)                          \
-                : "1" (addr), "Ir" (size),                              \
+                : "1" (__addr), "Ir" (size),                            \
                   "r" (current_thread_info()->addr_limit)               \
                 : "cc");                                                \
         flag;                                                           \
 })
 
+/*
+ * When dealing with data aborts, watchpoints, or instruction traps we may end
+ * up with a tagged userland pointer. Clear the tag to get a sane pointer to
+ * pass on to access_ok(), for instance.
+ */
+#define untagged_addr(addr)             sign_extend64(addr, 55)
+
 #define access_ok(type, addr, size)     __range_ok(addr, size)
 #define user_addr_max                   get_fs
 
@@ -130,7 +140,7 @@ static inline void set_fs(mm_segment_t fs)
  * User access enabling/disabling.
  */
 #ifdef CONFIG_ARM64_SW_TTBR0_PAN
-static inline void uaccess_ttbr0_disable(void)
+static inline void __uaccess_ttbr0_disable(void)
 {
         unsigned long ttbr;
 
@@ -140,7 +150,7 @@ static inline void uaccess_ttbr0_disable(void)
         isb();
 }
 
-static inline void uaccess_ttbr0_enable(void)
+static inline void __uaccess_ttbr0_enable(void)
 {
         unsigned long flags;
 
@@ -154,30 +164,44 @@ static inline void uaccess_ttbr0_enable(void)
         isb();
         local_irq_restore(flags);
 }
+
+static inline bool uaccess_ttbr0_disable(void)
+{
+        if (!system_uses_ttbr0_pan())
+                return false;
+        __uaccess_ttbr0_disable();
+        return true;
+}
+
+static inline bool uaccess_ttbr0_enable(void)
+{
+        if (!system_uses_ttbr0_pan())
+                return false;
+        __uaccess_ttbr0_enable();
+        return true;
+}
 #else
-static inline void uaccess_ttbr0_disable(void)
+static inline bool uaccess_ttbr0_disable(void)
 {
+        return false;
 }
 
-static inline void uaccess_ttbr0_enable(void)
+static inline bool uaccess_ttbr0_enable(void)
 {
+        return false;
 }
 #endif
 
 #define __uaccess_disable(alt)                                          \
 do {                                                                    \
-        if (system_uses_ttbr0_pan())                                    \
-                uaccess_ttbr0_disable();                                \
-        else                                                            \
+        if (!uaccess_ttbr0_disable())                                   \
                 asm(ALTERNATIVE("nop", SET_PSTATE_PAN(1), alt,          \
                                 CONFIG_ARM64_PAN));                     \
 } while (0)
 
 #define __uaccess_enable(alt)                                           \
 do {                                                                    \
-        if (system_uses_ttbr0_pan())                                    \
-                uaccess_ttbr0_enable();                                 \
-        else                                                            \
+        if (!uaccess_ttbr0_enable())                                    \
                 asm(ALTERNATIVE("nop", SET_PSTATE_PAN(0), alt,          \
                                 CONFIG_ARM64_PAN));                     \
 } while (0)
@@ -407,69 +431,62 @@ extern __must_check long strnlen_user(const char __user *str, long n);
 
 #else   /* __ASSEMBLY__ */
 
-#include <asm/alternative.h>
 #include <asm/assembler.h>
-#include <asm/kernel-pgtable.h>
 
 /*
  * User access enabling/disabling macros.
  */
-        .macro  uaccess_ttbr0_disable, tmp1
+#ifdef CONFIG_ARM64_SW_TTBR0_PAN
+        .macro  __uaccess_ttbr0_disable, tmp1
         mrs     \tmp1, ttbr1_el1                // swapper_pg_dir
         add     \tmp1, \tmp1, #SWAPPER_DIR_SIZE // reserved_ttbr0 at the end of swapper_pg_dir
         msr     ttbr0_el1, \tmp1                // set reserved TTBR0_EL1
         isb
         .endm
 
-        .macro  uaccess_ttbr0_enable, tmp1
+        .macro  __uaccess_ttbr0_enable, tmp1
         get_thread_info \tmp1
-        ldr     \tmp1, [\tmp1, #TI_TTBR0]       // load saved TTBR0_EL1
+        ldr     \tmp1, [\tmp1, #TSK_TI_TTBR0]   // load saved TTBR0_EL1
         msr     ttbr0_el1, \tmp1                // set the non-PAN TTBR0_EL1
         isb
         .endm
 
+        .macro  uaccess_ttbr0_disable, tmp1
+alternative_if_not ARM64_HAS_PAN
+        __uaccess_ttbr0_disable \tmp1
+alternative_else_nop_endif
+        .endm
+
+        .macro  uaccess_ttbr0_enable, tmp1, tmp2
+alternative_if_not ARM64_HAS_PAN
+        save_and_disable_irq \tmp2              // avoid preemption
+        __uaccess_ttbr0_enable \tmp1
+        restore_irq \tmp2
+alternative_else_nop_endif
+        .endm
+#else
+        .macro  uaccess_ttbr0_disable, tmp1
+        .endm
+
+        .macro  uaccess_ttbr0_enable, tmp1, tmp2
+        .endm
+#endif
+
 /*
  * These macros are no-ops when UAO is present.
  */
         .macro  uaccess_disable_not_uao, tmp1
-#ifdef CONFIG_ARM64_SW_TTBR0_PAN
-alternative_if_not ARM64_HAS_PAN
         uaccess_ttbr0_disable \tmp1
-alternative_else
-        nop
-        nop
-        nop
-        nop
-alternative_endif
-#endif
-alternative_if_not ARM64_ALT_PAN_NOT_UAO
-        nop
-alternative_else
+alternative_if ARM64_ALT_PAN_NOT_UAO
         SET_PSTATE_PAN(1)
-alternative_endif
+alternative_else_nop_endif
         .endm
 
         .macro  uaccess_enable_not_uao, tmp1, tmp2
-#ifdef CONFIG_ARM64_SW_TTBR0_PAN
-alternative_if_not ARM64_HAS_PAN
-        save_and_disable_irq \tmp2              // avoid preemption
-        uaccess_ttbr0_enable \tmp1
-        restore_irq \tmp2
-alternative_else
-        nop
-        nop
-        nop
-        nop
-        nop
-        nop
-        nop
-alternative_endif
-#endif
-alternative_if_not ARM64_ALT_PAN_NOT_UAO
-        nop
-alternative_else
+        uaccess_ttbr0_enable \tmp1, \tmp2
+alternative_if ARM64_ALT_PAN_NOT_UAO
         SET_PSTATE_PAN(0)
-alternative_endif
+alternative_else_nop_endif
         .endm
 
 #endif  /* __ASSEMBLY__ */
diff --git a/arch/arm64/include/asm/vdso_datapage.h b/arch/arm64/include/asm/vdso_datapage.h
index de66199673d7..2b9a63771eda 100644
--- a/arch/arm64/include/asm/vdso_datapage.h
+++ b/arch/arm64/include/asm/vdso_datapage.h
@@ -22,6 +22,8 @@
 
 struct vdso_data {
         __u64 cs_cycle_last;    /* Timebase at clocksource init */
+        __u64 raw_time_sec;     /* Raw time */
+        __u64 raw_time_nsec;
         __u64 xtime_clock_sec;  /* Kernel time */
         __u64 xtime_clock_nsec;
         __u64 xtime_coarse_sec; /* Coarse time */
@@ -29,8 +31,10 @@ struct vdso_data {
         __u64 wtm_clock_sec;    /* Wall to monotonic time */
         __u64 wtm_clock_nsec;
         __u32 tb_seq_count;     /* Timebase sequence counter */
-        __u32 cs_mult;          /* Clocksource multiplier */
-        __u32 cs_shift;         /* Clocksource shift */
+        /* cs_* members must be adjacent and in this order (ldp accesses) */
+        __u32 cs_mono_mult;     /* NTP-adjusted clocksource multiplier */
+        __u32 cs_shift;         /* Clocksource shift (mono = raw) */
+        __u32 cs_raw_mult;      /* Raw clocksource multiplier */
         __u32 tz_minuteswest;   /* Whacky timezone stuff */
         __u32 tz_dsttime;
         __u32 use_syscall;
diff --git a/arch/arm64/include/asm/virt.h b/arch/arm64/include/asm/virt.h
index 06e6a5238c4c..e6c27b8ce311 100644
--- a/arch/arm64/include/asm/virt.h
+++ b/arch/arm64/include/asm/virt.h
@@ -34,6 +34,11 @@
  */
 #define HVC_SET_VECTORS 1
 
+/*
+ * HVC_SOFT_RESTART - CPU soft reset, used by the cpu_soft_restart routine.
+ */
+#define HVC_SOFT_RESTART 2
+
 #define BOOT_CPU_MODE_EL1       (0xe11)
 #define BOOT_CPU_MODE_EL2       (0xe12)
 
diff --git a/arch/arm64/kernel/Makefile b/arch/arm64/kernel/Makefile
index 20bcc2db06bf..01c0b3881f88 100644
--- a/arch/arm64/kernel/Makefile
+++ b/arch/arm64/kernel/Makefile
@@ -44,13 +44,11 @@ arm64-obj-$(CONFIG_ACPI)		+= acpi.o
 arm64-obj-$(CONFIG_RANDOMIZE_BASE)      += kaslr.o
 arm64-obj-$(CONFIG_HIBERNATION)         += hibernate.o hibernate-asm.o
 arm64-obj-$(CONFIG_ARM64_ACPI_PARKING_PROTOCOL) += acpi_parking_protocol.o
-arm64-obj-$(CONFIG_PARAVIRT)            += paravirt.o
+arm64-obj-$(CONFIG_KEXEC)               += machine_kexec.o relocate_kernel.o    \
+                                           cpu-reset.o
+arm64-obj-$(CONFIG_CRASH_DUMP)          += crash_dump.o
 
 obj-y                                   += $(arm64-obj-y) vdso/ probes/
 obj-m                                   += $(arm64-obj-m)
 head-y                                  := head.o
 extra-y                                 += $(head-y) vmlinux.lds
-
-# vDSO - this must be built first to generate the symbol offsets
-$(call objectify,$(arm64-obj-y)): $(obj)/vdso/vdso-offsets.h
-$(obj)/vdso/vdso-offsets.h: $(obj)/vdso
diff --git a/arch/arm64/kernel/armv8_deprecated.c b/arch/arm64/kernel/armv8_deprecated.c
index a0a0f2b20608..57e7d6e44c8b 100644
--- a/arch/arm64/kernel/armv8_deprecated.c
+++ b/arch/arm64/kernel/armv8_deprecated.c
@@ -14,7 +14,6 @@
 #include <linux/slab.h>
 #include <linux/sysctl.h>
 
-#include <asm/alternative.h>
 #include <asm/cpufeature.h>
 #include <asm/insn.h>
 #include <asm/opcodes.h>
@@ -300,8 +299,9 @@ do {								\
         _ASM_EXTABLE(0b, 4b)                                    \
         _ASM_EXTABLE(1b, 4b)                                    \
         : "=&r" (res), "+r" (data), "=&r" (temp)                \
-        : "r" (addr), "i" (-EAGAIN), "i" (-EFAULT)              \
-        : "memory");                                            \
+        : "r" ((unsigned long)addr), "i" (-EAGAIN),             \
+          "i" (-EFAULT)                                         \
+        : "memory")                                             \
         uaccess_disable();                                      \
 } while (0)
 
diff --git a/arch/arm64/kernel/asm-offsets.c b/arch/arm64/kernel/asm-offsets.c
index dac70c160289..7a3f34b15fb0 100644
--- a/arch/arm64/kernel/asm-offsets.c
+++ b/arch/arm64/kernel/asm-offsets.c
@@ -38,11 +38,11 @@ int main(void)
   DEFINE(TI_FLAGS,              offsetof(struct thread_info, flags));
   DEFINE(TI_PREEMPT,            offsetof(struct thread_info, preempt_count));
   DEFINE(TI_ADDR_LIMIT,         offsetof(struct thread_info, addr_limit));
-#ifdef CONFIG_ARM64_SW_TTBR0_PAN
-  DEFINE(TI_TTBR0,              offsetof(struct thread_info, ttbr0));
-#endif
   DEFINE(TI_TASK,               offsetof(struct thread_info, task));
   DEFINE(TI_CPU,                offsetof(struct thread_info, cpu));
+#ifdef CONFIG_ARM64_SW_TTBR0_PAN
+  DEFINE(TSK_TI_TTBR0,          offsetof(struct thread_info, ttbr0));
+#endif
   BLANK();
   DEFINE(THREAD_CPU_CONTEXT,    offsetof(struct task_struct, thread.cpu_context));
   BLANK();
@@ -92,6 +92,7 @@ int main(void)
   BLANK();
   DEFINE(CLOCK_REALTIME,        CLOCK_REALTIME);
   DEFINE(CLOCK_MONOTONIC,       CLOCK_MONOTONIC);
+  DEFINE(CLOCK_MONOTONIC_RAW,   CLOCK_MONOTONIC_RAW);
   DEFINE(CLOCK_REALTIME_RES,    MONOTONIC_RES_NSEC);
   DEFINE(CLOCK_REALTIME_COARSE, CLOCK_REALTIME_COARSE);
   DEFINE(CLOCK_MONOTONIC_COARSE,CLOCK_MONOTONIC_COARSE);
@@ -99,6 +100,8 @@ int main(void)
   DEFINE(NSEC_PER_SEC,          NSEC_PER_SEC);
   BLANK();
   DEFINE(VDSO_CS_CYCLE_LAST,    offsetof(struct vdso_data, cs_cycle_last));
+  DEFINE(VDSO_RAW_TIME_SEC,     offsetof(struct vdso_data, raw_time_sec));
+  DEFINE(VDSO_RAW_TIME_NSEC,    offsetof(struct vdso_data, raw_time_nsec));
   DEFINE(VDSO_XTIME_CLK_SEC,    offsetof(struct vdso_data, xtime_clock_sec));
   DEFINE(VDSO_XTIME_CLK_NSEC,   offsetof(struct vdso_data, xtime_clock_nsec));
   DEFINE(VDSO_XTIME_CRS_SEC,    offsetof(struct vdso_data, xtime_coarse_sec));
@@ -106,7 +109,8 @@ int main(void)
   DEFINE(VDSO_WTM_CLK_SEC,      offsetof(struct vdso_data, wtm_clock_sec));
   DEFINE(VDSO_WTM_CLK_NSEC,     offsetof(struct vdso_data, wtm_clock_nsec));
   DEFINE(VDSO_TB_SEQ_COUNT,     offsetof(struct vdso_data, tb_seq_count));
-  DEFINE(VDSO_CS_MULT,          offsetof(struct vdso_data, cs_mult));
+  DEFINE(VDSO_CS_MONO_MULT,     offsetof(struct vdso_data, cs_mono_mult));
+  DEFINE(VDSO_CS_RAW_MULT,      offsetof(struct vdso_data, cs_raw_mult));
   DEFINE(VDSO_CS_SHIFT,         offsetof(struct vdso_data, cs_shift));
   DEFINE(VDSO_TZ_MINWEST,       offsetof(struct vdso_data, tz_minuteswest));
   DEFINE(VDSO_TZ_DSTTIME,       offsetof(struct vdso_data, tz_dsttime));
@@ -120,6 +124,8 @@ int main(void)
   DEFINE(TZ_MINWEST,            offsetof(struct timezone, tz_minuteswest));
   DEFINE(TZ_DSTTIME,            offsetof(struct timezone, tz_dsttime));
   BLANK();
+  DEFINE(CPU_BOOT_STACK,        offsetof(struct secondary_data, stack));
+  BLANK();
 #ifdef CONFIG_KVM_ARM_HOST
   DEFINE(VCPU_CONTEXT,          offsetof(struct kvm_vcpu, arch.ctxt));
   DEFINE(CPU_GP_REGS,           offsetof(struct kvm_cpu_context, gp_regs));
diff --git a/arch/arm64/kernel/cpu-reset.S b/arch/arm64/kernel/cpu-reset.S
new file mode 100644
index 000000000000..65f42d257414
--- /dev/null
+++ b/arch/arm64/kernel/cpu-reset.S
@@ -0,0 +1,54 @@
+/*
+ * CPU reset routines
+ *
+ * Copyright (C) 2001 Deep Blue Solutions Ltd.
+ * Copyright (C) 2012 ARM Ltd.
+ * Copyright (C) 2015 Huawei Futurewei Technologies.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/linkage.h>
+#include <asm/assembler.h>
+#include <asm/sysreg.h>
+#include <asm/virt.h>
+
+.text
+.pushsection    .idmap.text, "ax"
+
+/*
+ * __cpu_soft_restart(el2_switch, entry, arg0, arg1, arg2) - Helper for
+ * cpu_soft_restart.
+ *
+ * @el2_switch: Flag to indicate a swich to EL2 is needed.
+ * @entry: Location to jump to for soft reset.
+ * arg0: First argument passed to @entry.
+ * arg1: Second argument passed to @entry.
+ * arg2: Third argument passed to @entry.
+ *
+ * Put the CPU into the same state as it would be if it had been reset, and
+ * branch to what would be the reset vector. It must be executed with the
+ * flat identity mapping.
+ */
+ENTRY(__cpu_soft_restart)
+        /* Clear sctlr_el1 flags. */
+        mrs     x12, sctlr_el1
+        ldr     x13, =SCTLR_ELx_FLAGS
+        bic     x12, x12, x13
+        msr     sctlr_el1, x12
+        isb
+
+        cbz     x0, 1f                          // el2_switch?
+        mov     x0, #HVC_SOFT_RESTART
+        hvc     #0                              // no return
+
+1:      mov     x18, x1                         // entry
+        mov     x0, x2                          // arg0
+        mov     x1, x3                          // arg1
+        mov     x2, x4                          // arg2
+        br      x18
+ENDPROC(__cpu_soft_restart)
+
+.popsection
diff --git a/arch/arm64/kernel/cpu-reset.h b/arch/arm64/kernel/cpu-reset.h
new file mode 100644
index 000000000000..d4e9ecb264f0
--- /dev/null
+++ b/arch/arm64/kernel/cpu-reset.h
@@ -0,0 +1,34 @@
+/*
+ * CPU reset routines
+ *
+ * Copyright (C) 2015 Huawei Futurewei Technologies.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#ifndef _ARM64_CPU_RESET_H
+#define _ARM64_CPU_RESET_H
+
+#include <asm/virt.h>
+
+void __cpu_soft_restart(unsigned long el2_switch, unsigned long entry,
+        unsigned long arg0, unsigned long arg1, unsigned long arg2);
+
+static inline void __noreturn cpu_soft_restart(unsigned long el2_switch,
+        unsigned long entry, unsigned long arg0, unsigned long arg1,
+        unsigned long arg2)
+{
+        typeof(__cpu_soft_restart) *restart;
+
+        el2_switch = el2_switch && !is_kernel_in_hyp_mode() &&
+                is_hyp_mode_available();
+        restart = (void *)virt_to_phys(__cpu_soft_restart);
+
+        cpu_install_idmap();
+        restart(el2_switch, entry, arg0, arg1, arg2);
+        unreachable();
+}
+
+#endif
diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c
index cdf1dca64133..53fab76d3c39 100644
--- a/arch/arm64/kernel/cpufeature.c
+++ b/arch/arm64/kernel/cpufeature.c
@@ -895,28 +895,6 @@ static u64 __raw_read_system_reg(u32 sys_id)
 }
 
 /*
- * Park the CPU which doesn't have the capability as advertised
- * by the system.
- */
-static void fail_incapable_cpu(char *cap_type,
-                                 const struct arm64_cpu_capabilities *cap)
-{
-        int cpu = smp_processor_id();
-
-        pr_crit("CPU%d: missing %s : %s\n", cpu, cap_type, cap->desc);
-        /* Mark this CPU absent */
-        set_cpu_present(cpu, 0);
-
-        /* Check if we can park ourselves */
-        if (cpu_ops[cpu] && cpu_ops[cpu]->cpu_die)
-                cpu_ops[cpu]->cpu_die(cpu);
-        asm(
-        "1:     wfe\n"
-        "       wfi\n"
-        "       b       1b");
-}
-
-/*
  * Run through the enabled system capabilities and enable() it on this CPU.
  * The capabilities were decided based on the available CPUs at the boot time.
  * Any new CPU should match the system wide status of the capability. If the
@@ -944,8 +922,11 @@ void verify_local_cpu_capabilities(void)
                  * If the new CPU misses an advertised feature, we cannot proceed
                  * further, park the cpu.
                  */
-                if (!feature_matches(__raw_read_system_reg(caps[i].sys_reg), &caps[i]))
-                        fail_incapable_cpu("arm64_features", &caps[i]);
+                if (!feature_matches(__raw_read_system_reg(caps[i].sys_reg), &caps[i])) {
+                        pr_crit("CPU%d: missing feature: %s\n",
+                                        smp_processor_id(), caps[i].desc);
+                        cpu_die_early();
+                }
                 if (caps[i].enable)
                         caps[i].enable(NULL);
         }
@@ -953,8 +934,11 @@ void verify_local_cpu_capabilities(void)
         for (i = 0, caps = arm64_hwcaps; caps[i].matches; i++) {
                 if (!cpus_have_hwcap(&caps[i]))
                         continue;
-                if (!feature_matches(__raw_read_system_reg(caps[i].sys_reg), &caps[i]))
-                        fail_incapable_cpu("arm64_hwcaps", &caps[i]);
+                if (!feature_matches(__raw_read_system_reg(caps[i].sys_reg), &caps[i])) {
+                        pr_crit("CPU%d: missing HWCAP: %s\n",
+                                        smp_processor_id(), caps[i].desc);
+                        cpu_die_early();
+                }
         }
 }
 
diff --git a/arch/arm64/kernel/crash_dump.c b/arch/arm64/kernel/crash_dump.c
new file mode 100644
index 000000000000..f46d57c31443
--- /dev/null
+++ b/arch/arm64/kernel/crash_dump.c
@@ -0,0 +1,71 @@
+/*
+ * Routines for doing kexec-based kdump
+ *
+ * Copyright (C) 2017 Linaro Limited
+ * Author: AKASHI Takahiro <takahiro.akashi@linaro.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/crash_dump.h>
+#include <linux/errno.h>
+#include <linux/io.h>
+#include <linux/memblock.h>
+#include <linux/uaccess.h>
+#include <asm/memory.h>
+
+/**
+ * copy_oldmem_page() - copy one page from old kernel memory
+ * @pfn: page frame number to be copied
+ * @buf: buffer where the copied page is placed
+ * @csize: number of bytes to copy
+ * @offset: offset in bytes into the page
+ * @userbuf: if set, @buf is in a user address space
+ *
+ * This function copies one page from old kernel memory into buffer pointed by
+ * @buf. If @buf is in userspace, set @userbuf to %1. Returns number of bytes
+ * copied or negative error in case of failure.
+ */
+ssize_t copy_oldmem_page(unsigned long pfn, char *buf,
+                         size_t csize, unsigned long offset,
+                         int userbuf)
+{
+        void *vaddr;
+
+        if (!csize)
+                return 0;
+
+        vaddr = memremap(__pfn_to_phys(pfn), PAGE_SIZE, MEMREMAP_WB);
+        if (!vaddr)
+                return -ENOMEM;
+
+        if (userbuf) {
+                if (copy_to_user((char __user *)buf, vaddr + offset, csize)) {
+                        memunmap(vaddr);
+                        return -EFAULT;
+                }
+        } else {
+                memcpy(buf, vaddr + offset, csize);
+        }
+
+        memunmap(vaddr);
+
+        return csize;
+}
+
+/**
+ * elfcorehdr_read - read from ELF core header
+ * @buf: buffer where the data is placed
+ * @csize: number of bytes to read
+ * @ppos: address in the memory
+ *
+ * This function reads @count bytes from elf core header which exists
+ * on crash dump kernel's memory.
+ */
+ssize_t elfcorehdr_read(char *buf, size_t count, u64 *ppos)
+{
+        memcpy(buf, phys_to_virt((phys_addr_t)*ppos), count);
+        return count;
+}
diff --git a/arch/arm64/kernel/entry.S b/arch/arm64/kernel/entry.S
index db8a09331f2b..5472cedfe750 100644
--- a/arch/arm64/kernel/entry.S
+++ b/arch/arm64/kernel/entry.S
@@ -32,6 +32,7 @@
 #include <asm/ptrace.h>
 #include <asm/thread_info.h>
 #include <asm/uaccess.h>
+#include <asm/asm-uaccess.h>
 #include <asm/unistd.h>
 
 /*
@@ -120,11 +121,9 @@
          * feature as all TTBR0_EL1 accesses are disabled, not just those to
          * user mappings.
          */
-alternative_if_not ARM64_HAS_PAN
-        nop
-alternative_else
+alternative_if ARM64_HAS_PAN
         b       1f                              // skip TTBR0 PAN
-alternative_endif
+alternative_else_nop_endif
 
         .if     \el != 0
         mrs     x21, ttbr0_el1
@@ -134,7 +133,7 @@ alternative_endif
         and     x23, x23, #~PSR_PAN_BIT         // Clear the emulated PAN in the saved SPSR
         .endif
 
-        uaccess_ttbr0_disable x21
+        __uaccess_ttbr0_disable x21
 1:
 #endif
 
@@ -181,17 +180,15 @@ alternative_endif
          * Restore access to TTBR0_EL1. If returning to EL0, no need for SPSR
          * PAN bit checking.
          */
-alternative_if_not ARM64_HAS_PAN
-        nop
-alternative_else
+alternative_if ARM64_HAS_PAN
         b       2f                              // skip TTBR0 PAN
-alternative_endif
+alternative_else_nop_endif
 
         .if     \el != 0
-        tbnz    x22, #_PSR_PAN_BIT, 1f          // Skip re-enabling TTBR0 access if previously disabled
+        tbnz    x22, #22, 1f                    // Skip re-enabling TTBR0 access if the PSR_PAN_BIT is set
         .endif
 
-        uaccess_ttbr0_enable x0
+        __uaccess_ttbr0_enable x0
 
         .if     \el == 0
         /*
@@ -435,12 +432,13 @@ el1_da:
         /*
          * Data abort handling
          */
-        mrs     x0, far_el1
+        mrs     x3, far_el1
         enable_dbg
         // re-enable interrupts if they were enabled in the aborted context
         tbnz    x23, #7, 1f                     // PSR_I_BIT
         enable_irq
 1:
+        clear_address_tag x0, x3
         mov     x2, sp                          // struct pt_regs
         bl      do_mem_abort
 
@@ -602,7 +600,7 @@ el0_da:
         // enable interrupts before calling the main handler
         enable_dbg_and_irq
         ct_user_exit
-        bic     x0, x26, #(0xff << 56)
+        clear_address_tag x0, x26
         mov     x1, x25
         mov     x2, sp
         bl      do_mem_abort
diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S
index 8cfd5ab37743..9c2e1564e9a7 100644
--- a/arch/arm64/kernel/head.S
+++ b/arch/arm64/kernel/head.S
@@ -36,6 +36,7 @@
 #include <asm/pgtable-hwdef.h>
 #include <asm/pgtable.h>
 #include <asm/page.h>
+#include <asm/smp.h>
 #include <asm/sysreg.h>
 #include <asm/thread_info.h>
 #include <asm/virt.h>
@@ -643,7 +644,8 @@ __secondary_switched:
         msr     vbar_el1, x5
         isb
 
-        ldr_l   x0, secondary_data              // get secondary_data.stack
+        adr_l   x0, secondary_data
+        ldr     x0, [x0, #CPU_BOOT_STACK]       // get secondary_data.stack
         mov     sp, x0
         and     x0, x0, #~(THREAD_SIZE - 1)
         msr     sp_el0, x0                      // save thread_info
@@ -652,6 +654,29 @@ __secondary_switched:
 ENDPROC(__secondary_switched)
 
 /*
+ * The booting CPU updates the failed status @__early_cpu_boot_status,
+ * with MMU turned off.
+ *
+ * update_early_cpu_boot_status tmp, status
+ *  - Corrupts tmp1, tmp2
+ *  - Writes 'status' to __early_cpu_boot_status and makes sure
+ *    it is committed to memory.
+ */
+
+        .macro  update_early_cpu_boot_status status, tmp1, tmp2
+        mov     \tmp2, #\status
+        str_l   \tmp2, __early_cpu_boot_status, \tmp1
+        dmb     sy
+        dc      ivac, \tmp1                     // Invalidate potentially stale cache line
+        .endm
+
+        .pushsection    .data..cacheline_aligned
+        .align  L1_CACHE_SHIFT
+ENTRY(__early_cpu_boot_status)
+        .long   0
+        .popsection
+
+/*
  * Enable the MMU.
  *
  *  x0  = SCTLR_EL1 value for turning on the MMU.
@@ -669,6 +694,7 @@ ENTRY(__enable_mmu)
         ubfx    x2, x1, #ID_AA64MMFR0_TGRAN_SHIFT, 4
         cmp     x2, #ID_AA64MMFR0_TGRAN_SUPPORTED
         b.ne    __no_granule_support
+        update_early_cpu_boot_status 0, x1, x2
         msr     ttbr0_el1, x25                  // load TTBR0
         msr     ttbr1_el1, x26                  // load TTBR1
         isb
@@ -708,8 +734,12 @@ ENTRY(__enable_mmu)
 ENDPROC(__enable_mmu)
 
 __no_granule_support:
+        /* Indicate that this CPU can't boot and is stuck in the kernel */
+        update_early_cpu_boot_status CPU_STUCK_IN_KERNEL, x1, x2
+1:
         wfe
-        b __no_granule_support
+        wfi
+        b 1b
 ENDPROC(__no_granule_support)
 
 __primary_switch:
diff --git a/arch/arm64/kernel/hibernate.c b/arch/arm64/kernel/hibernate.c
index f8df75d740f4..35a33d705536 100644
--- a/arch/arm64/kernel/hibernate.c
+++ b/arch/arm64/kernel/hibernate.c
@@ -27,6 +27,7 @@
 #include <asm/barrier.h>
 #include <asm/cacheflush.h>
 #include <asm/irqflags.h>
+#include <asm/kexec.h>
 #include <asm/memory.h>
 #include <asm/mmu_context.h>
 #include <asm/pgalloc.h>
@@ -34,6 +35,7 @@
 #include <asm/pgtable-hwdef.h>
 #include <asm/sections.h>
 #include <asm/suspend.h>
+#include <asm/sysreg.h>
 #include <asm/virt.h>
 
 /*
@@ -99,7 +101,8 @@ int pfn_is_nosave(unsigned long pfn)
         unsigned long nosave_begin_pfn = virt_to_pfn(&__nosave_begin);
         unsigned long nosave_end_pfn = virt_to_pfn(&__nosave_end - 1);
 
-        return (pfn >= nosave_begin_pfn) && (pfn <= nosave_end_pfn);
+        return ((pfn >= nosave_begin_pfn) && (pfn <= nosave_end_pfn)) ||
+                crash_is_nosave(pfn);
 }
 
 void notrace save_processor_state(void)
@@ -216,12 +219,22 @@ static int create_safe_exec_page(void *src_start, size_t length,
         set_pte(pte, __pte(virt_to_phys((void *)dst) |
                          pgprot_val(PAGE_KERNEL_EXEC)));
 
-        /* Load our new page tables */
-        asm volatile("msr       ttbr0_el1, %0;"
-                     "isb;"
-                     "tlbi      vmalle1is;"
-                     "dsb       ish;"
-                     "isb" : : "r"(virt_to_phys(pgd)));
+        /*
+         * Load our new page tables. A strict BBM approach requires that we
+         * ensure that TLBs are free of any entries that may overlap with the
+         * global mappings we are about to install.
+         *
+         * For a real hibernate/resume cycle TTBR0 currently points to a zero
+         * page, but TLBs may contain stale ASID-tagged entries (e.g. for EFI
+         * runtime services), while for a userspace-driven test_resume cycle it
+         * points to userspace page tables (and we must point it at a zero page
+         * ourselves). Elsewhere we only (un)install the idmap with preemption
+         * disabled, so T0SZ should be as required regardless.
+         */
+        cpu_set_reserved_ttbr0();
+        local_flush_tlb_all();
+        write_sysreg(virt_to_phys(pgd), ttbr0_el1);
+        isb();
 
         *phys_dst_addr = virt_to_phys((void *)dst);
 
@@ -239,11 +252,17 @@ int swsusp_arch_suspend(void)
         local_dbg_save(flags);
 
         if (__cpu_suspend_enter(&state)) {
+                /* make the crash dump kernel image visible/saveable */
+                crash_prepare_suspend();
+
                 ret = swsusp_save();
         } else {
                 /* Clean kernel to PoC for secondary core startup */
                 __flush_dcache_area(LMADDR(KERNEL_START), KERNEL_END - KERNEL_START);
 
+                /* make the crash dump kernel image protected again */
+                crash_post_resume();
+
                 /*
                  * Tell the hibernation core that we've just restored
                  * the memory
@@ -388,6 +407,38 @@ int swsusp_arch_resume(void)
                                           void *, phys_addr_t, phys_addr_t);
 
         /*
+         * Restoring the memory image will overwrite the ttbr1 page tables.
+         * Create a second copy of just the linear map, and use this when
+         * restoring.
+         */
+        tmp_pg_dir = (pgd_t *)get_safe_page(GFP_ATOMIC);
+        if (!tmp_pg_dir) {
+                pr_err("Failed to allocate memory for temporary page tables.");
+                rc = -ENOMEM;
+                goto out;
+        }
+        rc = copy_page_tables(tmp_pg_dir, PAGE_OFFSET, 0);
+        if (rc)
+                goto out;
+
+        /*
+         * Since we only copied the linear map, we need to find restore_pblist's
+         * linear map address.
+         */
+        lm_restore_pblist = LMADDR(restore_pblist);
+
+        /*
+         * We need a zero page that is zero before & after resume in order to
+         * to break before make on the ttbr1 page tables.
+         */
+        zero_page = (void *)get_safe_page(GFP_ATOMIC);
+        if (!zero_page) {
+                pr_err("Failed to allocate zero page.");
+                rc = -ENOMEM;
+                goto out;
+        }
+
+        /*
          * Locate the exit code in the bottom-but-one page, so that *NULL
          * still has disastrous affects.
          */
@@ -413,27 +464,6 @@ int swsusp_arch_resume(void)
         __flush_dcache_area(hibernate_exit, exit_size);
 
         /*
-         * Restoring the memory image will overwrite the ttbr1 page tables.
-         * Create a second copy of just the linear map, and use this when
-         * restoring.
-         */
-        tmp_pg_dir = (pgd_t *)get_safe_page(GFP_ATOMIC);
-        if (!tmp_pg_dir) {
-                pr_err("Failed to allocate memory for temporary page tables.");
-                rc = -ENOMEM;
-                goto out;
-        }
-        rc = copy_page_tables(tmp_pg_dir, PAGE_OFFSET, 0);
-        if (rc)
-                goto out;
-
-        /*
-         * Since we only copied the linear map, we need to find restore_pblist's
-         * linear map address.
-         */
-        lm_restore_pblist = LMADDR(restore_pblist);
-
-        /*
          * KASLR will cause the el2 vectors to be in a different location in
          * the resumed kernel. Load hibernate's temporary copy into el2.
          *
@@ -447,12 +477,6 @@ int swsusp_arch_resume(void)
                 __hyp_set_vectors(el2_vectors);
         }
 
-        /*
-         * We need a zero page that is zero before & after resume in order to
-         * to break before make on the ttbr1 page tables.
-         */
-        zero_page = (void *)get_safe_page(GFP_ATOMIC);
-
         hibernate_exit(virt_to_phys(tmp_pg_dir), resume_hdr.ttbr1_el1,
                        resume_hdr.reenter_kernel, lm_restore_pblist,
                        resume_hdr.__hyp_stub_vectors, virt_to_phys(zero_page));
diff --git a/arch/arm64/kernel/hw_breakpoint.c b/arch/arm64/kernel/hw_breakpoint.c
index 367a954f9937..1c694f3c643c 100644
--- a/arch/arm64/kernel/hw_breakpoint.c
+++ b/arch/arm64/kernel/hw_breakpoint.c
@@ -36,6 +36,7 @@
 #include <asm/traps.h>
 #include <asm/cputype.h>
 #include <asm/system_misc.h>
+#include <asm/uaccess.h>
 
 /* Breakpoint currently in use for each BRP. */
 static DEFINE_PER_CPU(struct perf_event *, bp_on_reg[ARM_MAX_BRP]);
@@ -317,9 +318,21 @@ static int get_hbp_len(u8 hbp_len)
         case ARM_BREAKPOINT_LEN_2:
                 len_in_bytes = 2;
                 break;
+        case ARM_BREAKPOINT_LEN_3:
+                len_in_bytes = 3;
+                break;
         case ARM_BREAKPOINT_LEN_4:
                 len_in_bytes = 4;
                 break;
+        case ARM_BREAKPOINT_LEN_5:
+                len_in_bytes = 5;
+                break;
+        case ARM_BREAKPOINT_LEN_6:
+                len_in_bytes = 6;
+                break;
+        case ARM_BREAKPOINT_LEN_7:
+                len_in_bytes = 7;
+                break;
         case ARM_BREAKPOINT_LEN_8:
                 len_in_bytes = 8;
                 break;
@@ -349,7 +362,7 @@ int arch_check_bp_in_kernelspace(struct perf_event *bp)
  * to generic breakpoint descriptions.
  */
 int arch_bp_generic_fields(struct arch_hw_breakpoint_ctrl ctrl,
-                           int *gen_len, int *gen_type)
+                           int *gen_len, int *gen_type, int *offset)
 {
         /* Type */
         switch (ctrl.type) {
@@ -369,17 +382,33 @@ int arch_bp_generic_fields(struct arch_hw_breakpoint_ctrl ctrl,
                 return -EINVAL;
         }
 
+        if (!ctrl.len)
+                return -EINVAL;
+        *offset = __ffs(ctrl.len);
+
         /* Len */
-        switch (ctrl.len) {
+        switch (ctrl.len >> *offset) {
         case ARM_BREAKPOINT_LEN_1:
                 *gen_len = HW_BREAKPOINT_LEN_1;
                 break;
         case ARM_BREAKPOINT_LEN_2:
                 *gen_len = HW_BREAKPOINT_LEN_2;
                 break;
+        case ARM_BREAKPOINT_LEN_3:
+                *gen_len = HW_BREAKPOINT_LEN_3;
+                break;
         case ARM_BREAKPOINT_LEN_4:
                 *gen_len = HW_BREAKPOINT_LEN_4;
                 break;
+        case ARM_BREAKPOINT_LEN_5:
+                *gen_len = HW_BREAKPOINT_LEN_5;
+                break;
+        case ARM_BREAKPOINT_LEN_6:
+                *gen_len = HW_BREAKPOINT_LEN_6;
+                break;
+        case ARM_BREAKPOINT_LEN_7:
+                *gen_len = HW_BREAKPOINT_LEN_7;
+                break;
         case ARM_BREAKPOINT_LEN_8:
                 *gen_len = HW_BREAKPOINT_LEN_8;
                 break;
@@ -423,9 +452,21 @@ static int arch_build_bp_info(struct perf_event *bp)
         case HW_BREAKPOINT_LEN_2:
                 info->ctrl.len = ARM_BREAKPOINT_LEN_2;
                 break;
+        case HW_BREAKPOINT_LEN_3:
+                info->ctrl.len = ARM_BREAKPOINT_LEN_3;
+                break;
         case HW_BREAKPOINT_LEN_4:
                 info->ctrl.len = ARM_BREAKPOINT_LEN_4;
                 break;
+        case HW_BREAKPOINT_LEN_5:
+                info->ctrl.len = ARM_BREAKPOINT_LEN_5;
+                break;
+        case HW_BREAKPOINT_LEN_6:
+                info->ctrl.len = ARM_BREAKPOINT_LEN_6;
+                break;
+        case HW_BREAKPOINT_LEN_7:
+                info->ctrl.len = ARM_BREAKPOINT_LEN_7;
+                break;
         case HW_BREAKPOINT_LEN_8:
                 info->ctrl.len = ARM_BREAKPOINT_LEN_8;
                 break;
@@ -517,18 +558,17 @@ int arch_validate_hwbkpt_settings(struct perf_event *bp)
                 default:
                         return -EINVAL;
                 }
-
-                info->address &= ~alignment_mask;
-                info->ctrl.len <<= offset;
         } else {
                 if (info->ctrl.type == ARM_BREAKPOINT_EXECUTE)
                         alignment_mask = 0x3;
                 else
                         alignment_mask = 0x7;
-                if (info->address & alignment_mask)
-                        return -EINVAL;
+                offset = info->address & alignment_mask;
         }
 
+        info->address &= ~alignment_mask;
+        info->ctrl.len <<= offset;
+
         /*
          * Disallow per-task kernel breakpoints since these would
          * complicate the stepping code.
@@ -661,12 +701,47 @@ unlock:
 }
 NOKPROBE_SYMBOL(breakpoint_handler);
 
+/*
+ * Arm64 hardware does not always report a watchpoint hit address that matches
+ * one of the watchpoints set. It can also report an address "near" the
+ * watchpoint if a single instruction access both watched and unwatched
+ * addresses. There is no straight-forward way, short of disassembling the
+ * offending instruction, to map that address back to the watchpoint. This
+ * function computes the distance of the memory access from the watchpoint as a
+ * heuristic for the likelyhood that a given access triggered the watchpoint.
+ *
+ * See Section D2.10.5 "Determining the memory location that caused a Watchpoint
+ * exception" of ARMv8 Architecture Reference Manual for details.
+ *
+ * The function returns the distance of the address from the bytes watched by
+ * the watchpoint. In case of an exact match, it returns 0.
+ */
+static u64 get_distance_from_watchpoint(unsigned long addr, u64 val,
+                                        struct arch_hw_breakpoint_ctrl *ctrl)
+{
+        u64 wp_low, wp_high;
+        u32 lens, lene;
+
+        lens = __ffs(ctrl->len);
+        lene = __fls(ctrl->len);
+
+        wp_low = val + lens;
+        wp_high = val + lene;
+        if (addr < wp_low)
+                return wp_low - addr;
+        else if (addr > wp_high)
+                return addr - wp_high;
+        else
+                return 0;
+}
+
 static int watchpoint_handler(unsigned long addr, unsigned int esr,
                               struct pt_regs *regs)
 {
-        int i, step = 0, *kernel_step, access;
+        int i, step = 0, *kernel_step, access, closest_match = 0;
+        u64 min_dist = -1, dist;
         u32 ctrl_reg;
-        u64 val, alignment_mask;
+        u64 val;
         struct perf_event *wp, **slots;
         struct debug_info *debug_info;
         struct arch_hw_breakpoint *info;
@@ -675,35 +750,15 @@ static int watchpoint_handler(unsigned long addr, unsigned int esr,
         slots = this_cpu_ptr(wp_on_reg);
         debug_info = &current->thread.debug;
 
+        /*
+         * Find all watchpoints that match the reported address. If no exact
+         * match is found. Attribute the hit to the closest watchpoint.
+         */
+        rcu_read_lock();
         for (i = 0; i < core_num_wrps; ++i) {
-                rcu_read_lock();
-
                 wp = slots[i];
-
                 if (wp == NULL)
-                        goto unlock;
-
-                info = counter_arch_bp(wp);
-                /* AArch32 watchpoints are either 4 or 8 bytes aligned. */
-                if (is_compat_task()) {
-                        if (info->ctrl.len == ARM_BREAKPOINT_LEN_8)
-                                alignment_mask = 0x7;
-                        else
-                                alignment_mask = 0x3;
-                } else {
-                        alignment_mask = 0x7;
-                }
-
-                /* Check if the watchpoint value matches. */
-                val = read_wb_reg(AARCH64_DBG_REG_WVR, i);
-                if (val != (addr & ~alignment_mask))
-                        goto unlock;
-
-                /* Possible match, check the byte address select to confirm. */
-                ctrl_reg = read_wb_reg(AARCH64_DBG_REG_WCR, i);
-                decode_ctrl_reg(ctrl_reg, &ctrl);
-                if (!((1 << (addr & alignment_mask)) & ctrl.len))
-                        goto unlock;
+                        continue;
 
                 /*
                  * Check that the access type matches.
@@ -712,18 +767,41 @@ static int watchpoint_handler(unsigned long addr, unsigned int esr,
                 access = (esr & AARCH64_ESR_ACCESS_MASK) ? HW_BREAKPOINT_W :
                          HW_BREAKPOINT_R;
                 if (!(access & hw_breakpoint_type(wp)))
-                        goto unlock;
+                        continue;
 
+                /* Check if the watchpoint value and byte select match. */
+                val = read_wb_reg(AARCH64_DBG_REG_WVR, i);
+                ctrl_reg = read_wb_reg(AARCH64_DBG_REG_WCR, i);
+                decode_ctrl_reg(ctrl_reg, &ctrl);
+                dist = get_distance_from_watchpoint(addr, val, &ctrl);
+                if (dist < min_dist) {
+                        min_dist = dist;
+                        closest_match = i;
+                }
+                /* Is this an exact match? */
+                if (dist != 0)
+                        continue;
+
+                info = counter_arch_bp(wp);
                 info->trigger = addr;
                 perf_bp_event(wp, regs);
 
                 /* Do we need to handle the stepping? */
                 if (!wp->overflow_handler)
                         step = 1;
+        }
+        if (min_dist > 0 && min_dist != -1) {
+                /* No exact match found. */
+                wp = slots[closest_match];
+                info = counter_arch_bp(wp);
+                info->trigger = addr;
+                perf_bp_event(wp, regs);
 
-unlock:
-                rcu_read_unlock();
+                /* Do we need to handle the stepping? */
+                if (!wp->overflow_handler)
+                        step = 1;
         }
+        rcu_read_unlock();
 
         if (!step)
                 return 0;
diff --git a/arch/arm64/kernel/hyp-stub.S b/arch/arm64/kernel/hyp-stub.S
index 8727f4490772..d3b5f75e652e 100644
--- a/arch/arm64/kernel/hyp-stub.S
+++ b/arch/arm64/kernel/hyp-stub.S
@@ -71,8 +71,16 @@ el1_sync:
         msr     vbar_el2, x1
         b       9f
 
+2:      cmp     x0, #HVC_SOFT_RESTART
+        b.ne    3f
+        mov     x0, x2
+        mov     x2, x4
+        mov     x4, x1
+        mov     x1, x3
+        br      x4                              // no return
+
         /* Someone called kvm_call_hyp() against the hyp-stub... */
-2:      mov     x0, #ARM_EXCEPTION_HYP_GONE
+3:      mov     x0, #ARM_EXCEPTION_HYP_GONE
 
 9:      eret
 ENDPROC(el1_sync)
diff --git a/arch/arm64/kernel/machine_kexec.c b/arch/arm64/kernel/machine_kexec.c
new file mode 100644
index 000000000000..481f54a866c5
--- /dev/null
+++ b/arch/arm64/kernel/machine_kexec.c
@@ -0,0 +1,364 @@
+/*
+ * kexec for arm64
+ *
+ * Copyright (C) Linaro.
+ * Copyright (C) Huawei Futurewei Technologies.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/interrupt.h>
+#include <linux/irq.h>
+#include <linux/kernel.h>
+#include <linux/kexec.h>
+#include <linux/page-flags.h>
+#include <linux/smp.h>
+
+#include <asm/cacheflush.h>
+#include <asm/cpu_ops.h>
+#include <asm/memory.h>
+#include <asm/mmu.h>
+#include <asm/mmu_context.h>
+#include <asm/page.h>
+
+#include "cpu-reset.h"
+
+/* Global variables for the arm64_relocate_new_kernel routine. */
+extern const unsigned char arm64_relocate_new_kernel[];
+extern const unsigned long arm64_relocate_new_kernel_size;
+
+/**
+ * kexec_image_info - For debugging output.
+ */
+#define kexec_image_info(_i) _kexec_image_info(__func__, __LINE__, _i)
+static void _kexec_image_info(const char *func, int line,
+        const struct kimage *kimage)
+{
+        unsigned long i;
+
+        pr_debug("%s:%d:\n", func, line);
+        pr_debug("  kexec kimage info:\n");
+        pr_debug("    type:        %d\n", kimage->type);
+        pr_debug("    start:       %lx\n", kimage->start);
+        pr_debug("    head:        %lx\n", kimage->head);
+        pr_debug("    nr_segments: %lu\n", kimage->nr_segments);
+
+        for (i = 0; i < kimage->nr_segments; i++) {
+                pr_debug("      segment[%lu]: %016lx - %016lx, 0x%lx bytes, %lu pages\n",
+                        i,
+                        kimage->segment[i].mem,
+                        kimage->segment[i].mem + kimage->segment[i].memsz,
+                        kimage->segment[i].memsz,
+                        kimage->segment[i].memsz /  PAGE_SIZE);
+        }
+}
+
+void machine_kexec_cleanup(struct kimage *kimage)
+{
+        /* Empty routine needed to avoid build errors. */
+}
+
+/**
+ * machine_kexec_prepare - Prepare for a kexec reboot.
+ *
+ * Called from the core kexec code when a kernel image is loaded.
+ * Forbid loading a kexec kernel if we have no way of hotplugging cpus or cpus
+ * are stuck in the kernel. This avoids a panic once we hit machine_kexec().
+ */
+int machine_kexec_prepare(struct kimage *kimage)
+{
+        kexec_image_info(kimage);
+
+        if (kimage->type != KEXEC_TYPE_CRASH && cpus_are_stuck_in_kernel()) {
+                pr_err("Can't kexec: CPUs are stuck in the kernel.\n");
+                return -EBUSY;
+        }
+
+        return 0;
+}
+
+/**
+ * kexec_list_flush - Helper to flush the kimage list and source pages to PoC.
+ */
+static void kexec_list_flush(struct kimage *kimage)
+{
+        kimage_entry_t *entry;
+
+        for (entry = &kimage->head; ; entry++) {
+                unsigned int flag;
+                void *addr;
+
+                /* flush the list entries. */
+                __flush_dcache_area(entry, sizeof(kimage_entry_t));
+
+                flag = *entry & IND_FLAGS;
+                if (flag == IND_DONE)
+                        break;
+
+                addr = phys_to_virt(*entry & PAGE_MASK);
+
+                switch (flag) {
+                case IND_INDIRECTION:
+                        /* Set entry point just before the new list page. */
+                        entry = (kimage_entry_t *)addr - 1;
+                        break;
+                case IND_SOURCE:
+                        /* flush the source pages. */
+                        __flush_dcache_area(addr, PAGE_SIZE);
+                        break;
+                case IND_DESTINATION:
+                        break;
+                default:
+                        BUG();
+                }
+        }
+}
+
+/**
+ * kexec_segment_flush - Helper to flush the kimage segments to PoC.
+ */
+static void kexec_segment_flush(const struct kimage *kimage)
+{
+        unsigned long i;
+
+        pr_debug("%s:\n", __func__);
+
+        for (i = 0; i < kimage->nr_segments; i++) {
+                pr_debug("  segment[%lu]: %016lx - %016lx, 0x%lx bytes, %lu pages\n",
+                        i,
+                        kimage->segment[i].mem,
+                        kimage->segment[i].mem + kimage->segment[i].memsz,
+                        kimage->segment[i].memsz,
+                        kimage->segment[i].memsz /  PAGE_SIZE);
+
+                __flush_dcache_area(phys_to_virt(kimage->segment[i].mem),
+                        kimage->segment[i].memsz);
+        }
+}
+
+/**
+ * machine_kexec - Do the kexec reboot.
+ *
+ * Called from the core kexec code for a sys_reboot with LINUX_REBOOT_CMD_KEXEC.
+ */
+void machine_kexec(struct kimage *kimage)
+{
+        phys_addr_t reboot_code_buffer_phys;
+        void *reboot_code_buffer;
+        bool in_kexec_crash = (kimage == kexec_crash_image);
+        bool stuck_cpus = cpus_are_stuck_in_kernel();
+
+        /*
+         * New cpus may have become stuck_in_kernel after we loaded the image.
+         */
+        BUG_ON(!in_kexec_crash && (stuck_cpus || (num_online_cpus() > 1)));
+        WARN(in_kexec_crash && (stuck_cpus || smp_crash_stop_failed()),
+                "Some CPUs may be stale, kdump will be unreliable.\n");
+
+        reboot_code_buffer_phys = page_to_phys(kimage->control_code_page);
+        reboot_code_buffer = phys_to_virt(reboot_code_buffer_phys);
+
+        kexec_image_info(kimage);
+
+        pr_debug("%s:%d: control_code_page:        %p\n", __func__, __LINE__,
+                kimage->control_code_page);
+        pr_debug("%s:%d: reboot_code_buffer_phys:  %pa\n", __func__, __LINE__,
+                &reboot_code_buffer_phys);
+        pr_debug("%s:%d: reboot_code_buffer:       %p\n", __func__, __LINE__,
+                reboot_code_buffer);
+        pr_debug("%s:%d: relocate_new_kernel:      %p\n", __func__, __LINE__,
+                arm64_relocate_new_kernel);
+        pr_debug("%s:%d: relocate_new_kernel_size: 0x%lx(%lu) bytes\n",
+                __func__, __LINE__, arm64_relocate_new_kernel_size,
+                arm64_relocate_new_kernel_size);
+
+        /*
+         * Copy arm64_relocate_new_kernel to the reboot_code_buffer for use
+         * after the kernel is shut down.
+         */
+        memcpy(reboot_code_buffer, arm64_relocate_new_kernel,
+                arm64_relocate_new_kernel_size);
+
+        /* Flush the reboot_code_buffer in preparation for its execution. */
+        __flush_dcache_area(reboot_code_buffer, arm64_relocate_new_kernel_size);
+        flush_icache_range((uintptr_t)reboot_code_buffer,
+                arm64_relocate_new_kernel_size);
+
+        /* Flush the kimage list and its buffers. */
+        kexec_list_flush(kimage);
+
+        /* Flush the new image if already in place. */
+        if ((kimage != kexec_crash_image) && (kimage->head & IND_DONE))
+                kexec_segment_flush(kimage);
+
+        pr_info("Bye!\n");
+
+        /* Disable all DAIF exceptions. */
+        asm volatile ("msr daifset, #0xf" : : : "memory");
+
+        /*
+         * cpu_soft_restart will shutdown the MMU, disable data caches, then
+         * transfer control to the reboot_code_buffer which contains a copy of
+         * the arm64_relocate_new_kernel routine.  arm64_relocate_new_kernel
+         * uses physical addressing to relocate the new image to its final
+         * position and transfers control to the image entry point when the
+         * relocation is complete.
+         */
+
+        cpu_soft_restart(kimage != kexec_crash_image,
+                reboot_code_buffer_phys, kimage->head, kimage->start, 0);
+
+        BUG(); /* Should never get here. */
+}
+
+static void machine_kexec_mask_interrupts(void)
+{
+        unsigned int i;
+        struct irq_desc *desc;
+
+        for_each_irq_desc(i, desc) {
+                struct irq_chip *chip;
+                int ret;
+
+                chip = irq_desc_get_chip(desc);
+                if (!chip)
+                        continue;
+
+                /*
+                 * First try to remove the active state. If this
+                 * fails, try to EOI the interrupt.
+                 */
+                ret = irq_set_irqchip_state(i, IRQCHIP_STATE_ACTIVE, false);
+
+                if (ret && irqd_irq_inprogress(&desc->irq_data) &&
+                    chip->irq_eoi)
+                        chip->irq_eoi(&desc->irq_data);
+
+                if (chip->irq_mask)
+                        chip->irq_mask(&desc->irq_data);
+
+                if (chip->irq_disable && !irqd_irq_disabled(&desc->irq_data))
+                        chip->irq_disable(&desc->irq_data);
+        }
+}
+
+/**
+ * machine_crash_shutdown - shutdown non-crashing cpus and save registers
+ */
+void machine_crash_shutdown(struct pt_regs *regs)
+{
+        local_irq_disable();
+
+        /* shutdown non-crashing cpus */
+        smp_send_crash_stop();
+
+        /* for crashing cpu */
+        crash_save_cpu(regs, smp_processor_id());
+        machine_kexec_mask_interrupts();
+
+        pr_info("Starting crashdump kernel...\n");
+}
+
+void arch_kexec_protect_crashkres(void)
+{
+        int i;
+
+        kexec_segment_flush(kexec_crash_image);
+
+        for (i = 0; i < kexec_crash_image->nr_segments; i++)
+                set_memory_valid(
+                        __phys_to_virt(kexec_crash_image->segment[i].mem),
+                        kexec_crash_image->segment[i].memsz >> PAGE_SHIFT, 0);
+}
+
+void arch_kexec_unprotect_crashkres(void)
+{
+        int i;
+
+        for (i = 0; i < kexec_crash_image->nr_segments; i++)
+                set_memory_valid(
+                        __phys_to_virt(kexec_crash_image->segment[i].mem),
+                        kexec_crash_image->segment[i].memsz >> PAGE_SHIFT, 1);
+}
+
+#ifdef CONFIG_HIBERNATION
+/*
+ * To preserve the crash dump kernel image, the relevant memory segments
+ * should be mapped again around the hibernation.
+ */
+void crash_prepare_suspend(void)
+{
+        if (kexec_crash_image)
+                arch_kexec_unprotect_crashkres();
+}
+
+void crash_post_resume(void)
+{
+        if (kexec_crash_image)
+                arch_kexec_protect_crashkres();
+}
+
+/*
+ * crash_is_nosave
+ *
+ * Return true only if a page is part of reserved memory for crash dump kernel,
+ * but does not hold any data of loaded kernel image.
+ *
+ * Note that all the pages in crash dump kernel memory have been initially
+ * marked as Reserved in kexec_reserve_crashkres_pages().
+ *
+ * In hibernation, the pages which are Reserved and yet "nosave" are excluded
+ * from the hibernation iamge. crash_is_nosave() does thich check for crash
+ * dump kernel and will reduce the total size of hibernation image.
+ */
+
+bool crash_is_nosave(unsigned long pfn)
+{
+        int i;
+        phys_addr_t addr;
+
+        if (!crashk_res.end)
+                return false;
+
+        /* in reserved memory? */
+        addr = __pfn_to_phys(pfn);
+        if ((addr < crashk_res.start) || (crashk_res.end < addr))
+                return false;
+
+        if (!kexec_crash_image)
+                return true;
+
+        /* not part of loaded kernel image? */
+        for (i = 0; i < kexec_crash_image->nr_segments; i++)
+                if (addr >= kexec_crash_image->segment[i].mem &&
+                                addr < (kexec_crash_image->segment[i].mem +
+                                        kexec_crash_image->segment[i].memsz))
+                        return false;
+
+        return true;
+}
+
+void crash_free_reserved_phys_range(unsigned long begin, unsigned long end)
+{
+        unsigned long addr;
+        struct page *page;
+
+        for (addr = begin; addr < end; addr += PAGE_SIZE) {
+                page = phys_to_page(addr);
+                ClearPageReserved(page);
+                free_reserved_page(page);
+        }
+}
+#endif /* CONFIG_HIBERNATION */
+
+void arch_crash_save_vmcoreinfo(void)
+{
+        VMCOREINFO_NUMBER(VA_BITS);
+        /* Please note VMCOREINFO_NUMBER() uses "%d", not "%x" */
+        vmcoreinfo_append_str("NUMBER(kimage_voffset)=0x%llx\n",
+                                                kimage_voffset);
+        vmcoreinfo_append_str("NUMBER(PHYS_OFFSET)=0x%llx\n",
+                                                PHYS_OFFSET);
+}
diff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c
index c5ef05959813..6204b7600d1b 100644
--- a/arch/arm64/kernel/ptrace.c
+++ b/arch/arm64/kernel/ptrace.c
@@ -327,13 +327,13 @@ static int ptrace_hbp_fill_attr_ctrl(unsigned int note_type,
                                      struct arch_hw_breakpoint_ctrl ctrl,
                                      struct perf_event_attr *attr)
 {
-        int err, len, type, disabled = !ctrl.enabled;
+        int err, len, type, offset, disabled = !ctrl.enabled;
 
         attr->disabled = disabled;
         if (disabled)
                 return 0;
 
-        err = arch_bp_generic_fields(ctrl, &len, &type);
+        err = arch_bp_generic_fields(ctrl, &len, &type, &offset);
         if (err)
                 return err;
 
@@ -352,6 +352,7 @@ static int ptrace_hbp_fill_attr_ctrl(unsigned int note_type,
 
         attr->bp_len    = len;
         attr->bp_type   = type;
+        attr->bp_addr   += offset;
 
         return 0;
 }
@@ -404,7 +405,7 @@ static int ptrace_hbp_get_addr(unsigned int note_type,
         if (IS_ERR(bp))
                 return PTR_ERR(bp);
 
-        *addr = bp ? bp->attr.bp_addr : 0;
+        *addr = bp ? counter_arch_bp(bp)->address : 0;
         return 0;
 }
 
diff --git a/arch/arm64/kernel/relocate_kernel.S b/arch/arm64/kernel/relocate_kernel.S
new file mode 100644
index 000000000000..51b73cdde287
--- /dev/null
+++ b/arch/arm64/kernel/relocate_kernel.S
@@ -0,0 +1,130 @@
+/*
+ * kexec for arm64
+ *
+ * Copyright (C) Linaro.
+ * Copyright (C) Huawei Futurewei Technologies.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/kexec.h>
+#include <linux/linkage.h>
+
+#include <asm/assembler.h>
+#include <asm/kexec.h>
+#include <asm/page.h>
+#include <asm/sysreg.h>
+
+/*
+ * arm64_relocate_new_kernel - Put a 2nd stage image in place and boot it.
+ *
+ * The memory that the old kernel occupies may be overwritten when coping the
+ * new image to its final location.  To assure that the
+ * arm64_relocate_new_kernel routine which does that copy is not overwritten,
+ * all code and data needed by arm64_relocate_new_kernel must be between the
+ * symbols arm64_relocate_new_kernel and arm64_relocate_new_kernel_end.  The
+ * machine_kexec() routine will copy arm64_relocate_new_kernel to the kexec
+ * control_code_page, a special page which has been set up to be preserved
+ * during the copy operation.
+ */
+ENTRY(arm64_relocate_new_kernel)
+
+        /* Setup the list loop variables. */
+        mov     x17, x1                         /* x17 = kimage_start */
+        mov     x16, x0                         /* x16 = kimage_head */
+        dcache_line_size x15, x0                /* x15 = dcache line size */
+        mov     x14, xzr                        /* x14 = entry ptr */
+        mov     x13, xzr                        /* x13 = copy dest */
+
+        /* Clear the sctlr_el2 flags. */
+        mrs     x0, CurrentEL
+        cmp     x0, #CurrentEL_EL2
+        b.ne    1f
+        mrs     x0, sctlr_el2
+        ldr     x1, =SCTLR_ELx_FLAGS
+        bic     x0, x0, x1
+        msr     sctlr_el2, x0
+        isb
+1:
+
+        /* Check if the new image needs relocation. */
+        tbnz    x16, IND_DONE_BIT, .Ldone
+
+.Lloop:
+        and     x12, x16, PAGE_MASK             /* x12 = addr */
+
+        /* Test the entry flags. */
+.Ltest_source:
+        tbz     x16, IND_SOURCE_BIT, .Ltest_indirection
+
+        /* Invalidate dest page to PoC. */
+        mov     x0, x13
+        add     x20, x0, #PAGE_SIZE
+        sub     x1, x15, #1
+        bic     x0, x0, x1
+2:      dc      ivac, x0
+        add     x0, x0, x15
+        cmp     x0, x20
+        b.lo    2b
+        dsb     sy
+
+        mov x20, x13
+        mov x21, x12
+        copy_page x20, x21, x0, x1, x2, x3, x4, x5, x6, x7
+
+        /* dest += PAGE_SIZE */
+        add     x13, x13, PAGE_SIZE
+        b       .Lnext
+
+.Ltest_indirection:
+        tbz     x16, IND_INDIRECTION_BIT, .Ltest_destination
+
+        /* ptr = addr */
+        mov     x14, x12
+        b       .Lnext
+
+.Ltest_destination:
+        tbz     x16, IND_DESTINATION_BIT, .Lnext
+
+        /* dest = addr */
+        mov     x13, x12
+
+.Lnext:
+        /* entry = *ptr++ */
+        ldr     x16, [x14], #8
+
+        /* while (!(entry & DONE)) */
+        tbz     x16, IND_DONE_BIT, .Lloop
+
+.Ldone:
+        /* wait for writes from copy_page to finish */
+        dsb     nsh
+        ic      iallu
+        dsb     nsh
+        isb
+
+        /* Start new image. */
+        mov     x0, xzr
+        mov     x1, xzr
+        mov     x2, xzr
+        mov     x3, xzr
+        br      x17
+
+ENDPROC(arm64_relocate_new_kernel)
+
+.ltorg
+
+.align 3        /* To keep the 64-bit values below naturally aligned. */
+
+.Lcopy_end:
+.org    KEXEC_CONTROL_PAGE_SIZE
+
+/*
+ * arm64_relocate_new_kernel_size - Number of bytes to copy to the
+ * control_code_page.
+ */
+.globl arm64_relocate_new_kernel_size
+arm64_relocate_new_kernel_size:
+        .quad   .Lcopy_end - arm64_relocate_new_kernel
diff --git a/arch/arm64/kernel/setup.c b/arch/arm64/kernel/setup.c
index 0153c0d8ddb1..19749870c757 100644
--- a/arch/arm64/kernel/setup.c
+++ b/arch/arm64/kernel/setup.c
@@ -31,7 +31,6 @@
 #include <linux/screen_info.h>
 #include <linux/init.h>
 #include <linux/kexec.h>
-#include <linux/crash_dump.h>
 #include <linux/root_dev.h>
 #include <linux/cpu.h>
 #include <linux/interrupt.h>
@@ -220,6 +219,12 @@ static void __init request_standard_resources(void)
                 if (kernel_data.start >= res->start &&
                     kernel_data.end <= res->end)
                         request_resource(res, &kernel_data);
+#ifdef CONFIG_KEXEC_CORE
+                /* Userspace will find "Crash kernel" region in /proc/iomem. */
+                if (crashk_res.end && crashk_res.start >= res->start &&
+                    crashk_res.end <= res->end)
+                        request_resource(res, &crashk_res);
+#endif
         }
 }
 
diff --git a/arch/arm64/kernel/smp.c b/arch/arm64/kernel/smp.c
index a84623d91410..a1d06fc42048 100644
--- a/arch/arm64/kernel/smp.c
+++ b/arch/arm64/kernel/smp.c
@@ -37,6 +37,7 @@
 #include <linux/completion.h>
 #include <linux/of.h>
 #include <linux/irq_work.h>
+#include <linux/kexec.h>
 
 #include <asm/alternative.h>
 #include <asm/atomic.h>
@@ -63,16 +64,29 @@
  * where to place its SVC stack
  */
 struct secondary_data secondary_data;
+/* Number of CPUs which aren't online, but looping in kernel text. */
+int cpus_stuck_in_kernel;
 
 enum ipi_msg_type {
         IPI_RESCHEDULE,
         IPI_CALL_FUNC,
         IPI_CPU_STOP,
+        IPI_CPU_CRASH_STOP,
         IPI_TIMER,
         IPI_IRQ_WORK,
         IPI_WAKEUP
 };
 
+#ifdef CONFIG_HOTPLUG_CPU
+static int op_cpu_kill(unsigned int cpu);
+#else
+static inline int op_cpu_kill(unsigned int cpu)
+{
+        return -ENOSYS;
+}
+#endif
+
+
 /*
  * Boot a secondary CPU, and assign it the specified idle task.
  * This also gives us the initial stack to use for this CPU.
@@ -90,12 +104,14 @@ static DECLARE_COMPLETION(cpu_running);
 int __cpu_up(unsigned int cpu, struct task_struct *idle)
 {
         int ret;
+        long status;
 
         /*
          * We need to tell the secondary core where to find its stack and the
          * page tables.
          */
         secondary_data.stack = task_stack_page(idle) + THREAD_START_SP;
+        update_cpu_boot_status(CPU_MMU_OFF);
         __flush_dcache_area(&secondary_data, sizeof(secondary_data));
 
         /*
@@ -119,6 +135,32 @@ int __cpu_up(unsigned int cpu, struct task_struct *idle)
         }
 
         secondary_data.stack = NULL;
+        status = READ_ONCE(secondary_data.status);
+        if (ret && status) {
+
+                if (status == CPU_MMU_OFF)
+                        status = READ_ONCE(__early_cpu_boot_status);
+
+                switch (status) {
+                default:
+                        pr_err("CPU%u: failed in unknown state : 0x%lx\n",
+                                        cpu, status);
+                        break;
+                case CPU_KILL_ME:
+                        if (!op_cpu_kill(cpu)) {
+                                pr_crit("CPU%u: died during early boot\n", cpu);
+                                break;
+                        }
+                        /* Fall through */
+                        pr_crit("CPU%u: may not have shut down cleanly\n", cpu);
+                case CPU_STUCK_IN_KERNEL:
+                        pr_crit("CPU%u: is stuck in kernel\n", cpu);
+                        cpus_stuck_in_kernel++;
+                        break;
+                case CPU_PANIC_KERNEL:
+                        panic("CPU%u detected unsupported configuration\n", cpu);
+                }
+        }
 
         return ret;
 }
@@ -184,6 +226,9 @@ asmlinkage void secondary_start_kernel(void)
          */
         pr_info("CPU%u: Booted secondary processor [%08x]\n",
                                          cpu, read_cpuid_id());
+        update_cpu_boot_status(CPU_BOOT_SUCCESS);
+        /* Make sure the status update is visible before we complete */
+        smp_wmb();
         set_cpu_online(cpu, true);
         complete(&cpu_running);
 
@@ -311,6 +356,30 @@ void cpu_die(void)
 }
 #endif
 
+/*
+ * Kill the calling secondary CPU, early in bringup before it is turned
+ * online.
+ */
+void cpu_die_early(void)
+{
+        int cpu = smp_processor_id();
+
+        pr_crit("CPU%d: will not boot\n", cpu);
+
+        /* Mark this CPU absent */
+        set_cpu_present(cpu, 0);
+
+#ifdef CONFIG_HOTPLUG_CPU
+        update_cpu_boot_status(CPU_KILL_ME);
+        /* Check if we can park ourselves */
+        if (cpu_ops[cpu] && cpu_ops[cpu]->cpu_die)
+                cpu_ops[cpu]->cpu_die(cpu);
+#endif
+        update_cpu_boot_status(CPU_STUCK_IN_KERNEL);
+
+        cpu_park_loop();
+}
+
 static void __init hyp_mode_check(void)
 {
         if (is_hyp_mode_available())
@@ -634,6 +703,7 @@ static const char *ipi_types[NR_IPI] __tracepoint_string = {
         S(IPI_RESCHEDULE, "Rescheduling interrupts"),
         S(IPI_CALL_FUNC, "Function call interrupts"),
         S(IPI_CPU_STOP, "CPU stop interrupts"),
+        S(IPI_CPU_CRASH_STOP, "CPU stop (for crash dump) interrupts"),
         S(IPI_TIMER, "Timer broadcast interrupts"),
         S(IPI_IRQ_WORK, "IRQ work interrupts"),
         S(IPI_WAKEUP, "CPU wake-up interrupts"),
@@ -718,6 +788,29 @@ static void ipi_cpu_stop(unsigned int cpu)
                 cpu_relax();
 }
 
+#ifdef CONFIG_KEXEC_CORE
+static atomic_t waiting_for_crash_ipi = ATOMIC_INIT(0);
+#endif
+
+static void ipi_cpu_crash_stop(unsigned int cpu, struct pt_regs *regs)
+{
+#ifdef CONFIG_KEXEC_CORE
+        crash_save_cpu(regs, cpu);
+
+        atomic_dec(&waiting_for_crash_ipi);
+
+        local_irq_disable();
+
+#ifdef CONFIG_HOTPLUG_CPU
+        if (cpu_ops[cpu]->cpu_die)
+                cpu_ops[cpu]->cpu_die(cpu);
+#endif
+
+        /* just in case */
+        cpu_park_loop();
+#endif
+}
+
 /*
  * Main handler for inter-processor interrupts
  */
@@ -748,6 +841,15 @@ void handle_IPI(int ipinr, struct pt_regs *regs)
                 irq_exit();
                 break;
 
+        case IPI_CPU_CRASH_STOP:
+                if (IS_ENABLED(CONFIG_KEXEC_CORE)) {
+                        irq_enter();
+                        ipi_cpu_crash_stop(cpu, regs);
+
+                        unreachable();
+                }
+                break;
+
 #ifdef CONFIG_GENERIC_CLOCKEVENTS_BROADCAST
         case IPI_TIMER:
                 irq_enter();
@@ -816,6 +918,39 @@ void smp_send_stop(void)
                 pr_warning("SMP: failed to stop secondary CPUs\n");
 }
 
+#ifdef CONFIG_KEXEC_CORE
+void smp_send_crash_stop(void)
+{
+        cpumask_t mask;
+        unsigned long timeout;
+
+        if (num_online_cpus() == 1)
+                return;
+
+        cpumask_copy(&mask, cpu_online_mask);
+        cpumask_clear_cpu(smp_processor_id(), &mask);
+
+        atomic_set(&waiting_for_crash_ipi, num_online_cpus() - 1);
+
+        pr_crit("SMP: stopping secondary CPUs\n");
+        smp_cross_call(&mask, IPI_CPU_CRASH_STOP);
+
+        /* Wait up to one second for other CPUs to stop */
+        timeout = USEC_PER_SEC;
+        while ((atomic_read(&waiting_for_crash_ipi) > 0) && timeout--)
+                udelay(1);
+
+        if (atomic_read(&waiting_for_crash_ipi) > 0)
+                pr_warning("SMP: failed to stop secondary CPUs %*pbl\n",
+                           cpumask_pr_args(&mask));
+}
+
+bool smp_crash_stop_failed(void)
+{
+        return (atomic_read(&waiting_for_crash_ipi) > 0);
+}
+#endif
+
 /*
  * not supported here
  */
@@ -823,3 +958,21 @@ int setup_profiling_timer(unsigned int multiplier)
 {
         return -EINVAL;
 }
+
+static bool have_cpu_die(void)
+{
+#ifdef CONFIG_HOTPLUG_CPU
+        int any_cpu = raw_smp_processor_id();
+
+        if (cpu_ops[any_cpu]->cpu_die)
+                return true;
+#endif
+        return false;
+}
+
+bool cpus_are_stuck_in_kernel(void)
+{
+        bool smp_spin_tables = (num_possible_cpus() > 1 && !have_cpu_die());
+
+        return !!cpus_stuck_in_kernel || smp_spin_tables;
+}
diff --git a/arch/arm64/kernel/stacktrace.c b/arch/arm64/kernel/stacktrace.c
index cfd46c227c8c..a99eff9afc1f 100644
--- a/arch/arm64/kernel/stacktrace.c
+++ b/arch/arm64/kernel/stacktrace.c
@@ -43,6 +43,9 @@ int notrace unwind_frame(struct task_struct *tsk, struct stackframe *frame)
         unsigned long fp = frame->fp;
         unsigned long irq_stack_ptr;
 
+        if (!tsk)
+                tsk = current;
+
         /*
          * Switching between stacks is valid when tracing current and in
          * non-preemptible context.
@@ -67,7 +70,7 @@ int notrace unwind_frame(struct task_struct *tsk, struct stackframe *frame)
         frame->pc = *(unsigned long *)(fp + 8);
 
 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
-        if (tsk && tsk->ret_stack &&
+        if (tsk->ret_stack &&
                         (frame->pc == (unsigned long)return_to_handler)) {
                 /*
                  * This is a case where function graph tracer has
diff --git a/arch/arm64/kernel/traps.c b/arch/arm64/kernel/traps.c
index f5c82c76cf7c..a1cfcaa562a2 100644
--- a/arch/arm64/kernel/traps.c
+++ b/arch/arm64/kernel/traps.c
@@ -149,6 +149,11 @@ static void dump_backtrace(struct pt_regs *regs, struct task_struct *tsk)
         unsigned long irq_stack_ptr;
         int skip;
 
+        pr_debug("%s(regs = %p tsk = %p)\n", __func__, regs, tsk);
+
+        if (!tsk)
+                tsk = current;
+
         /*
          * Switching between stacks is valid when tracing current and in
          * non-preemptible context.
@@ -158,11 +163,6 @@ static void dump_backtrace(struct pt_regs *regs, struct task_struct *tsk)
         else
                 irq_stack_ptr = 0;
 
-        pr_debug("%s(regs = %p tsk = %p)\n", __func__, regs, tsk);
-
-        if (!tsk)
-                tsk = current;
-
         if (tsk == current) {
                 frame.fp = (unsigned long)__builtin_frame_address(0);
                 frame.sp = current_stack_pointer;
diff --git a/arch/arm64/kernel/vdso.c b/arch/arm64/kernel/vdso.c
index 97bc68f4c689..3b8acfae7797 100644
--- a/arch/arm64/kernel/vdso.c
+++ b/arch/arm64/kernel/vdso.c
@@ -55,7 +55,7 @@ struct vdso_data *vdso_data = &vdso_data_store.data;
  */
 static struct page *vectors_page[1];
 
-static int alloc_vectors_page(void)
+static int __init alloc_vectors_page(void)
 {
         extern char __kuser_helper_start[], __kuser_helper_end[];
         extern char __aarch32_sigret_code_start[], __aarch32_sigret_code_end[];
@@ -88,7 +88,7 @@ int aarch32_setup_vectors_page(struct linux_binprm *bprm, int uses_interp)
 {
         struct mm_struct *mm = current->mm;
         unsigned long addr = AARCH32_VECTORS_BASE;
-        static struct vm_special_mapping spec = {
+        static const struct vm_special_mapping spec = {
                 .name   = "[vectors]",
                 .pages  = vectors_page,
 
@@ -212,10 +212,16 @@ void update_vsyscall(struct timekeeper *tk)
         vdso_data->wtm_clock_nsec               = tk->wall_to_monotonic.tv_nsec;
 
         if (!use_syscall) {
+                /* tkr_mono.cycle_last == tkr_raw.cycle_last */
                 vdso_data->cs_cycle_last        = tk->tkr_mono.cycle_last;
+                vdso_data->raw_time_sec         = tk->raw_time.tv_sec;
+                vdso_data->raw_time_nsec        = tk->raw_time.tv_nsec;
                 vdso_data->xtime_clock_sec      = tk->xtime_sec;
                 vdso_data->xtime_clock_nsec     = tk->tkr_mono.xtime_nsec;
-                vdso_data->cs_mult              = tk->tkr_mono.mult;
+                /* tkr_raw.xtime_nsec == 0 */
+                vdso_data->cs_mono_mult         = tk->tkr_mono.mult;
+                vdso_data->cs_raw_mult          = tk->tkr_raw.mult;
+                /* tkr_mono.shift == tkr_raw.shift */
                 vdso_data->cs_shift             = tk->tkr_mono.shift;
         }
 
diff --git a/arch/arm64/kernel/vdso/Makefile b/arch/arm64/kernel/vdso/Makefile
index b467fd0a384b..62c84f7cb01b 100644
--- a/arch/arm64/kernel/vdso/Makefile
+++ b/arch/arm64/kernel/vdso/Makefile
@@ -23,7 +23,7 @@ GCOV_PROFILE := n
 ccflags-y += -Wl,-shared
 
 obj-y += vdso.o
-extra-y += vdso.lds vdso-offsets.h
+extra-y += vdso.lds
 CPPFLAGS_vdso.lds += -P -C -U$(ARCH)
 
 # Force dependency (incbin is bad)
@@ -42,11 +42,10 @@ $(obj)/%.so: $(obj)/%.so.dbg FORCE
 gen-vdsosym := $(srctree)/$(src)/gen_vdso_offsets.sh
 quiet_cmd_vdsosym = VDSOSYM $@
 define cmd_vdsosym
-        $(NM) $< | $(gen-vdsosym) | LC_ALL=C sort > $@ && \
-        cp $@ include/generated/
+        $(NM) $< | $(gen-vdsosym) | LC_ALL=C sort > $@
 endef
 
-$(obj)/vdso-offsets.h: $(obj)/vdso.so.dbg FORCE
+include/generated/vdso-offsets.h: $(obj)/vdso.so.dbg FORCE
         $(call if_changed,vdsosym)
 
 # Assembly rules for the .S files
diff --git a/arch/arm64/kernel/vdso/gettimeofday.S b/arch/arm64/kernel/vdso/gettimeofday.S
index efa79e8d4196..e00b4671bd7c 100644
--- a/arch/arm64/kernel/vdso/gettimeofday.S
+++ b/arch/arm64/kernel/vdso/gettimeofday.S
@@ -26,24 +26,109 @@
 #define NSEC_PER_SEC_HI16       0x3b9a
 
 vdso_data       .req    x6
-use_syscall     .req    w7
-seqcnt          .req    w8
+seqcnt          .req    w7
+w_tmp           .req    w8
+x_tmp           .req    x8
+
+/*
+ * Conventions for macro arguments:
+ * - An argument is write-only if its name starts with "res".
+ * - All other arguments are read-only, unless otherwise specified.
+ */
 
         .macro  seqcnt_acquire
 9999:   ldr     seqcnt, [vdso_data, #VDSO_TB_SEQ_COUNT]
         tbnz    seqcnt, #0, 9999b
         dmb     ishld
-        ldr     use_syscall, [vdso_data, #VDSO_USE_SYSCALL]
         .endm
 
-        .macro  seqcnt_read, cnt
+        .macro  seqcnt_check fail
         dmb     ishld
-        ldr     \cnt, [vdso_data, #VDSO_TB_SEQ_COUNT]
+        ldr     w_tmp, [vdso_data, #VDSO_TB_SEQ_COUNT]
+        cmp     w_tmp, seqcnt
+        b.ne    \fail
         .endm
 
-        .macro  seqcnt_check, cnt, fail
-        cmp     \cnt, seqcnt
-        b.ne    \fail
+        .macro  syscall_check fail
+        ldr     w_tmp, [vdso_data, #VDSO_USE_SYSCALL]
+        cbnz    w_tmp, \fail
+        .endm
+
+        .macro get_nsec_per_sec res
+        mov     \res, #NSEC_PER_SEC_LO16
+        movk    \res, #NSEC_PER_SEC_HI16, lsl #16
+        .endm
+
+        /*
+         * Returns the clock delta, in nanoseconds left-shifted by the clock
+         * shift.
+         */
+        .macro  get_clock_shifted_nsec res, cycle_last, mult
+        /* Read the virtual counter. */
+        isb
+        mrs     x_tmp, cntvct_el0
+        /* Calculate cycle delta and convert to ns. */
+        sub     \res, x_tmp, \cycle_last
+        /* We can only guarantee 56 bits of precision. */
+        movn    x_tmp, #0xff00, lsl #48
+        and     \res, x_tmp, \res
+        mul     \res, \res, \mult
+        .endm
+
+        /*
+         * Returns in res_{sec,nsec} the REALTIME timespec, based on the
+         * "wall time" (xtime) and the clock_mono delta.
+         */
+        .macro  get_ts_realtime res_sec, res_nsec, \
+                        clock_nsec, xtime_sec, xtime_nsec, nsec_to_sec
+        add     \res_nsec, \clock_nsec, \xtime_nsec
+        udiv    x_tmp, \res_nsec, \nsec_to_sec
+        add     \res_sec, \xtime_sec, x_tmp
+        msub    \res_nsec, x_tmp, \nsec_to_sec, \res_nsec
+        .endm
+
+        /*
+         * Returns in res_{sec,nsec} the timespec based on the clock_raw delta,
+         * used for CLOCK_MONOTONIC_RAW.
+         */
+        .macro  get_ts_clock_raw res_sec, res_nsec, clock_nsec, nsec_to_sec
+        udiv    \res_sec, \clock_nsec, \nsec_to_sec
+        msub    \res_nsec, \res_sec, \nsec_to_sec, \clock_nsec
+        .endm
+
+        /* sec and nsec are modified in place. */
+        .macro add_ts sec, nsec, ts_sec, ts_nsec, nsec_to_sec
+        /* Add timespec. */
+        add     \sec, \sec, \ts_sec
+        add     \nsec, \nsec, \ts_nsec
+
+        /* Normalise the new timespec. */
+        cmp     \nsec, \nsec_to_sec
+        b.lt    9999f
+        sub     \nsec, \nsec, \nsec_to_sec
+        add     \sec, \sec, #1
+9999:
+        cmp     \nsec, #0
+        b.ge    9998f
+        add     \nsec, \nsec, \nsec_to_sec
+        sub     \sec, \sec, #1
+9998:
+        .endm
+
+        .macro clock_gettime_return, shift=0
+        .if \shift == 1
+        lsr     x11, x11, x12
+        .endif
+        stp     x10, x11, [x1, #TSPEC_TV_SEC]
+        mov     x0, xzr
+        ret
+        .endm
+
+        .macro jump_slot jumptable, index, label
+        .if (. - \jumptable) != 4 * (\index)
+        .error "Jump slot index mismatch"
+        .endif
+        b       \label
         .endm
 
         .text
@@ -51,18 +136,25 @@ seqcnt		.req	w8
 /* int __kernel_gettimeofday(struct timeval *tv, struct timezone *tz); */
 ENTRY(__kernel_gettimeofday)
         .cfi_startproc
-        mov     x2, x30
-        .cfi_register x30, x2
-
-        /* Acquire the sequence counter and get the timespec. */
         adr     vdso_data, _vdso_data
-1:      seqcnt_acquire
-        cbnz    use_syscall, 4f
-
         /* If tv is NULL, skip to the timezone code. */
         cbz     x0, 2f
-        bl      __do_get_tspec
-        seqcnt_check w9, 1b
+
+        /* Compute the time of day. */
+1:      seqcnt_acquire
+        syscall_check fail=4f
+        ldr     x10, [vdso_data, #VDSO_CS_CYCLE_LAST]
+        /* w11 = cs_mono_mult, w12 = cs_shift */
+        ldp     w11, w12, [vdso_data, #VDSO_CS_MONO_MULT]
+        ldp     x13, x14, [vdso_data, #VDSO_XTIME_CLK_SEC]
+        seqcnt_check fail=1b
+
+        get_nsec_per_sec res=x9
+        lsl     x9, x9, x12
+
+        get_clock_shifted_nsec res=x15, cycle_last=x10, mult=x11
+        get_ts_realtime res_sec=x10, res_nsec=x11, \
+                clock_nsec=x15, xtime_sec=x13, xtime_nsec=x14, nsec_to_sec=x9
 
         /* Convert ns to us. */
         mov     x13, #1000
@@ -76,95 +168,126 @@ ENTRY(__kernel_gettimeofday)
         stp     w4, w5, [x1, #TZ_MINWEST]
 3:
         mov     x0, xzr
-        ret     x2
+        ret
 4:
         /* Syscall fallback. */
         mov     x8, #__NR_gettimeofday
         svc     #0
-        ret     x2
+        ret
         .cfi_endproc
 ENDPROC(__kernel_gettimeofday)
 
+#define JUMPSLOT_MAX CLOCK_MONOTONIC_COARSE
+
 /* int __kernel_clock_gettime(clockid_t clock_id, struct timespec *tp); */
 ENTRY(__kernel_clock_gettime)
         .cfi_startproc
-        cmp     w0, #CLOCK_REALTIME
-        ccmp    w0, #CLOCK_MONOTONIC, #0x4, ne
-        b.ne    2f
+        cmp     w0, #JUMPSLOT_MAX
+        b.hi    syscall
+        adr     vdso_data, _vdso_data
+        adr     x_tmp, jumptable
+        add     x_tmp, x_tmp, w0, uxtw #2
+        br      x_tmp
+
+        ALIGN
+jumptable:
+        jump_slot jumptable, CLOCK_REALTIME, realtime
+        jump_slot jumptable, CLOCK_MONOTONIC, monotonic
+        b       syscall
+        b       syscall
+        jump_slot jumptable, CLOCK_MONOTONIC_RAW, monotonic_raw
+        jump_slot jumptable, CLOCK_REALTIME_COARSE, realtime_coarse
+        jump_slot jumptable, CLOCK_MONOTONIC_COARSE, monotonic_coarse
+
+        .if (. - jumptable) != 4 * (JUMPSLOT_MAX + 1)
+        .error  "Wrong jumptable size"
+        .endif
+
+        ALIGN
+realtime:
+        seqcnt_acquire
+        syscall_check fail=syscall
+        ldr     x10, [vdso_data, #VDSO_CS_CYCLE_LAST]
+        /* w11 = cs_mono_mult, w12 = cs_shift */
+        ldp     w11, w12, [vdso_data, #VDSO_CS_MONO_MULT]
+        ldp     x13, x14, [vdso_data, #VDSO_XTIME_CLK_SEC]
+        seqcnt_check fail=realtime
 
-        mov     x2, x30
-        .cfi_register x30, x2
+        /* All computations are done with left-shifted nsecs. */
+        get_nsec_per_sec res=x9
+        lsl     x9, x9, x12
 
-        /* Get kernel timespec. */
-        adr     vdso_data, _vdso_data
-1:      seqcnt_acquire
-        cbnz    use_syscall, 7f
+        get_clock_shifted_nsec res=x15, cycle_last=x10, mult=x11
+        get_ts_realtime res_sec=x10, res_nsec=x11, \
+                clock_nsec=x15, xtime_sec=x13, xtime_nsec=x14, nsec_to_sec=x9
+        clock_gettime_return, shift=1
 
-        bl      __do_get_tspec
-        seqcnt_check w9, 1b
+        ALIGN
+monotonic:
+        seqcnt_acquire
+        syscall_check fail=syscall
+        ldr     x10, [vdso_data, #VDSO_CS_CYCLE_LAST]
+        /* w11 = cs_mono_mult, w12 = cs_shift */
+        ldp     w11, w12, [vdso_data, #VDSO_CS_MONO_MULT]
+        ldp     x13, x14, [vdso_data, #VDSO_XTIME_CLK_SEC]
+        ldp     x3, x4, [vdso_data, #VDSO_WTM_CLK_SEC]
+        seqcnt_check fail=monotonic
 
-        mov     x30, x2
+        /* All computations are done with left-shifted nsecs. */
+        lsl     x4, x4, x12
+        get_nsec_per_sec res=x9
+        lsl     x9, x9, x12
 
-        cmp     w0, #CLOCK_MONOTONIC
-        b.ne    6f
+        get_clock_shifted_nsec res=x15, cycle_last=x10, mult=x11
+        get_ts_realtime res_sec=x10, res_nsec=x11, \
+                clock_nsec=x15, xtime_sec=x13, xtime_nsec=x14, nsec_to_sec=x9
 
-        /* Get wtm timespec. */
-        ldp     x13, x14, [vdso_data, #VDSO_WTM_CLK_SEC]
+        add_ts sec=x10, nsec=x11, ts_sec=x3, ts_nsec=x4, nsec_to_sec=x9
+        clock_gettime_return, shift=1
 
-        /* Check the sequence counter. */
-        seqcnt_read w9
-        seqcnt_check w9, 1b
-        b       4f
-2:
-        cmp     w0, #CLOCK_REALTIME_COARSE
-        ccmp    w0, #CLOCK_MONOTONIC_COARSE, #0x4, ne
-        b.ne    8f
+        ALIGN
+monotonic_raw:
+        seqcnt_acquire
+        syscall_check fail=syscall
+        ldr     x10, [vdso_data, #VDSO_CS_CYCLE_LAST]
+        /* w11 = cs_raw_mult, w12 = cs_shift */
+        ldp     w12, w11, [vdso_data, #VDSO_CS_SHIFT]
+        ldp     x13, x14, [vdso_data, #VDSO_RAW_TIME_SEC]
+        seqcnt_check fail=monotonic_raw
 
-        /* xtime_coarse_nsec is already right-shifted */
-        mov     x12, #0
+        /* All computations are done with left-shifted nsecs. */
+        lsl     x14, x14, x12
+        get_nsec_per_sec res=x9
+        lsl     x9, x9, x12
 
-        /* Get coarse timespec. */
-        adr     vdso_data, _vdso_data
-3:      seqcnt_acquire
+        get_clock_shifted_nsec res=x15, cycle_last=x10, mult=x11
+        get_ts_clock_raw res_sec=x10, res_nsec=x11, \
+                clock_nsec=x15, nsec_to_sec=x9
+
+        add_ts sec=x10, nsec=x11, ts_sec=x13, ts_nsec=x14, nsec_to_sec=x9
+        clock_gettime_return, shift=1
+
+        ALIGN
+realtime_coarse:
+        seqcnt_acquire
         ldp     x10, x11, [vdso_data, #VDSO_XTIME_CRS_SEC]
+        seqcnt_check fail=realtime_coarse
+        clock_gettime_return
 
-        /* Get wtm timespec. */
+        ALIGN
+monotonic_coarse:
+        seqcnt_acquire
+        ldp     x10, x11, [vdso_data, #VDSO_XTIME_CRS_SEC]
         ldp     x13, x14, [vdso_data, #VDSO_WTM_CLK_SEC]
+        seqcnt_check fail=monotonic_coarse
 
-        /* Check the sequence counter. */
-        seqcnt_read w9
-        seqcnt_check w9, 3b
+        /* Computations are done in (non-shifted) nsecs. */
+        get_nsec_per_sec res=x9
+        add_ts sec=x10, nsec=x11, ts_sec=x13, ts_nsec=x14, nsec_to_sec=x9
+        clock_gettime_return
 
-        cmp     w0, #CLOCK_MONOTONIC_COARSE
-        b.ne    6f
-4:
-        /* Add on wtm timespec. */
-        add     x10, x10, x13
-        lsl     x14, x14, x12
-        add     x11, x11, x14
-
-        /* Normalise the new timespec. */
-        mov     x15, #NSEC_PER_SEC_LO16
-        movk    x15, #NSEC_PER_SEC_HI16, lsl #16
-        lsl     x15, x15, x12
-        cmp     x11, x15
-        b.lt    5f
-        sub     x11, x11, x15
-        add     x10, x10, #1
-5:
-        cmp     x11, #0
-        b.ge    6f
-        add     x11, x11, x15
-        sub     x10, x10, #1
-
-6:      /* Store to the user timespec. */
-        lsr     x11, x11, x12
-        stp     x10, x11, [x1, #TSPEC_TV_SEC]
-        mov     x0, xzr
-        ret
-7:
-        mov     x30, x2
-8:      /* Syscall fallback. */
+        ALIGN
+syscall: /* Syscall fallback. */
         mov     x8, #__NR_clock_gettime
         svc     #0
         ret
@@ -176,6 +299,7 @@ ENTRY(__kernel_clock_getres)
         .cfi_startproc
         cmp     w0, #CLOCK_REALTIME
         ccmp    w0, #CLOCK_MONOTONIC, #0x4, ne
+        ccmp    w0, #CLOCK_MONOTONIC_RAW, #0x4, ne
         b.ne    1f
 
         ldr     x2, 5f
@@ -203,46 +327,3 @@ ENTRY(__kernel_clock_getres)
         .quad   CLOCK_COARSE_RES
         .cfi_endproc
 ENDPROC(__kernel_clock_getres)
-
-/*
- * Read the current time from the architected counter.
- * Expects vdso_data to be initialised.
- * Clobbers the temporary registers (x9 - x15).
- * Returns:
- *  - w9                = vDSO sequence counter
- *  - (x10, x11)        = (ts->tv_sec, shifted ts->tv_nsec)
- *  - w12               = cs_shift
- */
-ENTRY(__do_get_tspec)
-        .cfi_startproc
-
-        /* Read from the vDSO data page. */
-        ldr     x10, [vdso_data, #VDSO_CS_CYCLE_LAST]
-        ldp     x13, x14, [vdso_data, #VDSO_XTIME_CLK_SEC]
-        ldp     w11, w12, [vdso_data, #VDSO_CS_MULT]
-        seqcnt_read w9
-
-        /* Read the virtual counter. */
-        isb
-        mrs     x15, cntvct_el0
-
-        /* Calculate cycle delta and convert to ns. */
-        sub     x10, x15, x10
-        /* We can only guarantee 56 bits of precision. */
-        movn    x15, #0xff00, lsl #48
-        and     x10, x15, x10
-        mul     x10, x10, x11
-
-        /* Use the kernel time to calculate the new timespec. */
-        mov     x11, #NSEC_PER_SEC_LO16
-        movk    x11, #NSEC_PER_SEC_HI16, lsl #16
-        lsl     x11, x11, x12
-        add     x15, x10, x14
-        udiv    x14, x15, x11
-        add     x10, x13, x14
-        mul     x13, x14, x11
-        sub     x11, x15, x13
-
-        ret
-        .cfi_endproc
-ENDPROC(__do_get_tspec)
diff --git a/arch/arm64/kvm/hyp/Makefile b/arch/arm64/kvm/hyp/Makefile
index 826032bc3945..acde4782621a 100644
--- a/arch/arm64/kvm/hyp/Makefile
+++ b/arch/arm64/kvm/hyp/Makefile
@@ -12,3 +12,7 @@ obj-$(CONFIG_KVM_ARM_HOST) += switch.o
 obj-$(CONFIG_KVM_ARM_HOST) += fpsimd.o
 obj-$(CONFIG_KVM_ARM_HOST) += tlb.o
 obj-$(CONFIG_KVM_ARM_HOST) += hyp-entry.o
+
+GCOV_PROFILE    := n
+KASAN_SANITIZE  := n
+UBSAN_SANITIZE  := n
diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c
index eec3598b4184..3ff507c177a5 100644
--- a/arch/arm64/kvm/sys_regs.c
+++ b/arch/arm64/kvm/sys_regs.c
@@ -1055,8 +1055,8 @@ static int kvm_handle_cp_64(struct kvm_vcpu *vcpu,
 {
         struct sys_reg_params params;
         u32 hsr = kvm_vcpu_get_hsr(vcpu);
-        int Rt = (hsr >> 5) & 0xf;
-        int Rt2 = (hsr >> 10) & 0xf;
+        int Rt = (hsr >> 5) & 0x1f;
+        int Rt2 = (hsr >> 10) & 0x1f;
 
         params.is_aarch32 = true;
         params.is_32bit = false;
@@ -1107,7 +1107,7 @@ static int kvm_handle_cp_32(struct kvm_vcpu *vcpu,
 {
         struct sys_reg_params params;
         u32 hsr = kvm_vcpu_get_hsr(vcpu);
-        int Rt  = (hsr >> 5) & 0xf;
+        int Rt  = (hsr >> 5) & 0x1f;
 
         params.is_aarch32 = true;
         params.is_32bit = true;
diff --git a/arch/arm64/lib/clear_user.S b/arch/arm64/lib/clear_user.S
index 08b5f18ba604..d7150e30438a 100644
--- a/arch/arm64/lib/clear_user.S
+++ b/arch/arm64/lib/clear_user.S
@@ -17,9 +17,6 @@
  */
 #include <linux/linkage.h>
 
-#include <asm/assembler.h>
-#include <asm/cpufeature.h>
-#include <asm/sysreg.h>
 #include <asm/uaccess.h>
 
         .text
diff --git a/arch/arm64/lib/copy_from_user.S b/arch/arm64/lib/copy_from_user.S
index 6505ec81f1da..90154f3f7f2a 100644
--- a/arch/arm64/lib/copy_from_user.S
+++ b/arch/arm64/lib/copy_from_user.S
@@ -16,10 +16,7 @@
 
 #include <linux/linkage.h>
 
-#include <asm/assembler.h>
 #include <asm/cache.h>
-#include <asm/cpufeature.h>
-#include <asm/sysreg.h>
 #include <asm/uaccess.h>
 
 /*
diff --git a/arch/arm64/lib/copy_in_user.S b/arch/arm64/lib/copy_in_user.S
index 9b04ff3ab610..718b1c4e2f85 100644
--- a/arch/arm64/lib/copy_in_user.S
+++ b/arch/arm64/lib/copy_in_user.S
@@ -18,10 +18,7 @@
 
 #include <linux/linkage.h>
 
-#include <asm/assembler.h>
 #include <asm/cache.h>
-#include <asm/cpufeature.h>
-#include <asm/sysreg.h>
 #include <asm/uaccess.h>
 
 /*
diff --git a/arch/arm64/lib/copy_to_user.S b/arch/arm64/lib/copy_to_user.S
index 8077e4f34d56..e99e31c9acac 100644
--- a/arch/arm64/lib/copy_to_user.S
+++ b/arch/arm64/lib/copy_to_user.S
@@ -16,10 +16,7 @@
 
 #include <linux/linkage.h>
 
-#include <asm/assembler.h>
 #include <asm/cache.h>
-#include <asm/cpufeature.h>
-#include <asm/sysreg.h>
 #include <asm/uaccess.h>
 
 /*
diff --git a/arch/arm64/mm/cache.S b/arch/arm64/mm/cache.S
index 07d7352d7c38..3be2cda5dbda 100644
--- a/arch/arm64/mm/cache.S
+++ b/arch/arm64/mm/cache.S
@@ -23,6 +23,7 @@
 #include <asm/assembler.h>
 #include <asm/cpufeature.h>
 #include <asm/alternative.h>
+#include <asm/uaccess.h>
 
 /*
  *      flush_icache_range(start,end)
@@ -48,6 +49,7 @@ ENTRY(flush_icache_range)
  *      - end     - virtual end address of region
  */
 ENTRY(__flush_cache_user_range)
+        uaccess_ttbr0_enable x2, x3
         dcache_line_size x2, x3
         sub     x3, x2, #1
         bic     x4, x0, x3
@@ -69,10 +71,12 @@ USER(9f, ic	ivau, x4	)		// invalidate I line PoU
         dsb     ish
         isb
         mov     x0, #0
+1:
+        uaccess_ttbr0_disable x1
         ret
 9:
         mov     x0, #-EFAULT
-        ret
+        b       1b
 ENDPROC(flush_icache_range)
 ENDPROC(__flush_cache_user_range)
 
diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c
index 380e02941691..c7809f41d9d1 100644
--- a/arch/arm64/mm/fault.c
+++ b/arch/arm64/mm/fault.c
@@ -88,21 +88,21 @@ void show_pte(struct mm_struct *mm, unsigned long addr)
                         break;
 
                 pud = pud_offset(pgd, addr);
-                printk(", *pud=%016llx", pud_val(*pud));
+                pr_cont(", *pud=%016llx", pud_val(*pud));
                 if (pud_none(*pud) || pud_bad(*pud))
                         break;
 
                 pmd = pmd_offset(pud, addr);
-                printk(", *pmd=%016llx", pmd_val(*pmd));
+                pr_cont(", *pmd=%016llx", pmd_val(*pmd));
                 if (pmd_none(*pmd) || pmd_bad(*pmd))
                         break;
 
                 pte = pte_offset_map(pmd, addr);
-                printk(", *pte=%016llx", pte_val(*pte));
+                pr_cont(", *pte=%016llx", pte_val(*pte));
                 pte_unmap(pte);
         } while(0);
 
-        printk("\n");
+        pr_cont("\n");
 }
 
 #ifdef CONFIG_ARM64_HW_AFDBM
@@ -510,10 +510,10 @@ static const struct fault_info {
         { do_bad,               SIGBUS,  0,             "unknown 17"                    },
         { do_bad,               SIGBUS,  0,             "unknown 18"                    },
         { do_bad,               SIGBUS,  0,             "unknown 19"                    },
-        { do_bad,               SIGBUS,  0,             "synchronous external abort (translation table walk)" },
-        { do_bad,               SIGBUS,  0,             "synchronous external abort (translation table walk)" },
-        { do_bad,               SIGBUS,  0,             "synchronous external abort (translation table walk)" },
-        { do_bad,               SIGBUS,  0,             "synchronous external abort (translation table walk)" },
+        { do_bad,               SIGBUS,  0,             "synchronous abort (translation table walk)" },
+        { do_bad,               SIGBUS,  0,             "synchronous abort (translation table walk)" },
+        { do_bad,               SIGBUS,  0,             "synchronous abort (translation table walk)" },
+        { do_bad,               SIGBUS,  0,             "synchronous abort (translation table walk)" },
         { do_bad,               SIGBUS,  0,             "synchronous parity error"      },
         { do_bad,               SIGBUS,  0,             "unknown 25"                    },
         { do_bad,               SIGBUS,  0,             "unknown 26"                    },
@@ -686,5 +686,6 @@ int cpu_enable_pan(void *__unused)
 int cpu_enable_uao(void *__unused)
 {
         asm(SET_PSTATE_UAO(1));
+        return 0;
 }
 #endif /* CONFIG_ARM64_UAO */
diff --git a/arch/arm64/mm/hugetlbpage.c b/arch/arm64/mm/hugetlbpage.c
index da30529bb1f6..019f13637fae 100644
--- a/arch/arm64/mm/hugetlbpage.c
+++ b/arch/arm64/mm/hugetlbpage.c
@@ -51,20 +51,8 @@ static int find_num_contig(struct mm_struct *mm, unsigned long addr,
         *pgsize = PAGE_SIZE;
         if (!pte_cont(pte))
                 return 1;
-        if (!pgd_present(*pgd)) {
-                VM_BUG_ON(!pgd_present(*pgd));
-                return 1;
-        }
         pud = pud_offset(pgd, addr);
-        if (!pud_present(*pud)) {
-                VM_BUG_ON(!pud_present(*pud));
-                return 1;
-        }
         pmd = pmd_offset(pud, addr);
-        if (!pmd_present(*pmd)) {
-                VM_BUG_ON(!pmd_present(*pmd));
-                return 1;
-        }
         if ((pte_t *)pmd == ptep) {
                 *pgsize = PMD_SIZE;
                 return CONT_PMDS;
@@ -212,7 +200,7 @@ pte_t huge_ptep_get_and_clear(struct mm_struct *mm,
                 ncontig = find_num_contig(mm, addr, cpte, *cpte, &pgsize);
                 /* save the 1st pte to return */
                 pte = ptep_get_and_clear(mm, addr, cpte);
-                for (i = 1; i < ncontig; ++i) {
+                for (i = 1, addr += pgsize; i < ncontig; ++i, addr += pgsize) {
                         /*
                          * If HW_AFDBM is enabled, then the HW could
                          * turn on the dirty bit for any of the page
@@ -250,8 +238,8 @@ int huge_ptep_set_access_flags(struct vm_area_struct *vma,
                 pfn = pte_pfn(*cpte);
                 ncontig = find_num_contig(vma->vm_mm, addr, cpte,
                                           *cpte, &pgsize);
-                for (i = 0; i < ncontig; ++i, ++cpte) {
-                        changed = ptep_set_access_flags(vma, addr, cpte,
+                for (i = 0; i < ncontig; ++i, ++cpte, addr += pgsize) {
+                        changed |= ptep_set_access_flags(vma, addr, cpte,
                                                         pfn_pte(pfn,
                                                                 hugeprot),
                                                         dirty);
@@ -273,7 +261,7 @@ void huge_ptep_set_wrprotect(struct mm_struct *mm,
 
                 cpte = huge_pte_offset(mm, addr);
                 ncontig = find_num_contig(mm, addr, cpte, *cpte, &pgsize);
-                for (i = 0; i < ncontig; ++i, ++cpte)
+                for (i = 0; i < ncontig; ++i, ++cpte, addr += pgsize)
                         ptep_set_wrprotect(mm, addr, cpte);
         } else {
                 ptep_set_wrprotect(mm, addr, ptep);
@@ -291,7 +279,7 @@ void huge_ptep_clear_flush(struct vm_area_struct *vma,
                 cpte = huge_pte_offset(vma->vm_mm, addr);
                 ncontig = find_num_contig(vma->vm_mm, addr, cpte,
                                           *cpte, &pgsize);
-                for (i = 0; i < ncontig; ++i, ++cpte)
+                for (i = 0; i < ncontig; ++i, ++cpte, addr += pgsize)
                         ptep_clear_flush(vma, addr, cpte);
         } else {
                 ptep_clear_flush(vma, addr, ptep);
diff --git a/arch/arm64/mm/init.c b/arch/arm64/mm/init.c
index 678878077996..74ac8a90ba3f 100644
--- a/arch/arm64/mm/init.c
+++ b/arch/arm64/mm/init.c
@@ -29,11 +29,14 @@
 #include <linux/gfp.h>
 #include <linux/memblock.h>
 #include <linux/sort.h>
+#include <linux/of.h>
 #include <linux/of_fdt.h>
 #include <linux/dma-mapping.h>
 #include <linux/dma-contiguous.h>
 #include <linux/efi.h>
 #include <linux/swiotlb.h>
+#include <linux/kexec.h>
+#include <linux/crash_dump.h>
 
 #include <asm/boot.h>
 #include <asm/fixmap.h>
@@ -75,6 +78,142 @@ static int __init early_initrd(char *p)
 early_param("initrd", early_initrd);
 #endif
 
+#ifdef CONFIG_KEXEC_CORE
+/*
+ * reserve_crashkernel() - reserves memory for crash kernel
+ *
+ * This function reserves memory area given in "crashkernel=" kernel command
+ * line parameter. The memory reserved is used by dump capture kernel when
+ * primary kernel is crashing.
+ */
+static void __init reserve_crashkernel(void)
+{
+        unsigned long long crash_base, crash_size;
+        int ret;
+
+        ret = parse_crashkernel(boot_command_line, memblock_phys_mem_size(),
+                                &crash_size, &crash_base);
+        /* no crashkernel= or invalid value specified */
+        if (ret || !crash_size)
+                return;
+
+        crash_size = PAGE_ALIGN(crash_size);
+
+        if (crash_base == 0) {
+                /* Current arm64 boot protocol requires 2MB alignment */
+                crash_base = memblock_find_in_range(0, ARCH_LOW_ADDRESS_LIMIT,
+                                crash_size, SZ_2M);
+                if (crash_base == 0) {
+                        pr_warn("cannot allocate crashkernel (size:0x%llx)\n",
+                                crash_size);
+                        return;
+                }
+        } else {
+                /* User specifies base address explicitly. */
+                if (!memblock_is_region_memory(crash_base, crash_size)) {
+                        pr_warn("cannot reserve crashkernel: region is not memory\n");
+                        return;
+                }
+
+                if (memblock_is_region_reserved(crash_base, crash_size)) {
+                        pr_warn("cannot reserve crashkernel: region overlaps reserved memory\n");
+                        return;
+                }
+
+                if (!IS_ALIGNED(crash_base, SZ_2M)) {
+                        pr_warn("cannot reserve crashkernel: base address is not 2MB aligned\n");
+                        return;
+                }
+        }
+        memblock_reserve(crash_base, crash_size);
+
+        pr_info("crashkernel reserved: 0x%016llx - 0x%016llx (%lld MB)\n",
+                crash_base, crash_base + crash_size, crash_size >> 20);
+
+        crashk_res.start = crash_base;
+        crashk_res.end = crash_base + crash_size - 1;
+}
+
+static void __init kexec_reserve_crashkres_pages(void)
+{
+#ifdef CONFIG_HIBERNATION
+        phys_addr_t addr;
+        struct page *page;
+
+        if (!crashk_res.end)
+                return;
+
+        /*
+         * To reduce the size of hibernation image, all the pages are
+         * marked as Reserved initially.
+         */
+        for (addr = crashk_res.start; addr < (crashk_res.end + 1);
+                        addr += PAGE_SIZE) {
+                page = phys_to_page(addr);
+                SetPageReserved(page);
+        }
+#endif
+}
+#else
+static void __init reserve_crashkernel(void)
+{
+}
+
+static void __init kexec_reserve_crashkres_pages(void)
+{
+}
+#endif /* CONFIG_KEXEC_CORE */
+
+#ifdef CONFIG_CRASH_DUMP
+static int __init early_init_dt_scan_elfcorehdr(unsigned long node,
+                const char *uname, int depth, void *data)
+{
+        const __be32 *reg;
+        int len;
+
+        if (depth != 1 || strcmp(uname, "chosen") != 0)
+                return 0;
+
+        reg = of_get_flat_dt_prop(node, "linux,elfcorehdr", &len);
+        if (!reg || (len < (dt_root_addr_cells + dt_root_size_cells)))
+                return 1;
+
+        elfcorehdr_addr = dt_mem_next_cell(dt_root_addr_cells, &reg);
+        elfcorehdr_size = dt_mem_next_cell(dt_root_size_cells, &reg);
+
+        return 1;
+}
+
+/*
+ * reserve_elfcorehdr() - reserves memory for elf core header
+ *
+ * This function reserves the memory occupied by an elf core header
+ * described in the device tree. This region contains all the
+ * information about primary kernel's core image and is used by a dump
+ * capture kernel to access the system memory on primary kernel.
+ */
+static void __init reserve_elfcorehdr(void)
+{
+        of_scan_flat_dt(early_init_dt_scan_elfcorehdr, NULL);
+
+        if (!elfcorehdr_size)
+                return;
+
+        if (memblock_is_region_reserved(elfcorehdr_addr, elfcorehdr_size)) {
+                pr_warn("elfcorehdr is overlapped\n");
+                return;
+        }
+
+        memblock_reserve(elfcorehdr_addr, elfcorehdr_size);
+
+        pr_info("Reserving %lldKB of memory at 0x%llx for elfcorehdr\n",
+                elfcorehdr_size >> 10, elfcorehdr_addr);
+}
+#else
+static void __init reserve_elfcorehdr(void)
+{
+}
+#endif /* CONFIG_CRASH_DUMP */
 /*
  * Return the maximum physical address for ZONE_DMA (DMA_BIT_MASK(32)). It
  * currently assumes that for memory starting above 4G, 32-bit devices will
@@ -168,10 +307,45 @@ static int __init early_mem(char *p)
 }
 early_param("mem", early_mem);
 
+static int __init early_init_dt_scan_usablemem(unsigned long node,
+                const char *uname, int depth, void *data)
+{
+        struct memblock_region *usablemem = data;
+        const __be32 *reg;
+        int len;
+
+        if (depth != 1 || strcmp(uname, "chosen") != 0)
+                return 0;
+
+        reg = of_get_flat_dt_prop(node, "linux,usable-memory-range", &len);
+        if (!reg || (len < (dt_root_addr_cells + dt_root_size_cells)))
+                return 1;
+
+        usablemem->base = dt_mem_next_cell(dt_root_addr_cells, &reg);
+        usablemem->size = dt_mem_next_cell(dt_root_size_cells, &reg);
+
+        return 1;
+}
+
+static void __init fdt_enforce_memory_region(void)
+{
+        struct memblock_region reg = {
+                .size = 0,
+        };
+
+        of_scan_flat_dt(early_init_dt_scan_usablemem, &reg);
+
+        if (reg.size)
+                memblock_cap_memory_range(reg.base, reg.size);
+}
+
 void __init arm64_memblock_init(void)
 {
         const s64 linear_region_size = -(s64)PAGE_OFFSET;
 
+        /* Handle linux,usable-memory-range property */
+        fdt_enforce_memory_region();
+
         /*
          * Ensure that the linear region takes up exactly half of the kernel
          * virtual address space. This way, we can distinguish a linear address
@@ -248,6 +422,11 @@ void __init arm64_memblock_init(void)
                 arm64_dma_phys_limit = max_zone_dma_phys();
         else
                 arm64_dma_phys_limit = PHYS_MASK + 1;
+
+        reserve_crashkernel();
+
+        reserve_elfcorehdr();
+
         dma_contiguous_reserve(arm64_dma_phys_limit);
 
         memblock_allow_resize();
@@ -361,6 +540,8 @@ void __init mem_init(void)
         /* this will put all unused low memory onto the freelists */
         free_all_bootmem();
 
+        kexec_reserve_crashkres_pages();
+
         mem_init_print_info(NULL);
 
 #define MLK(b, t) b, t, ((t) - (b)) >> 10
diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c
index 1cab2703f5a8..aeadc2c0a6c8 100644
--- a/arch/arm64/mm/mmu.c
+++ b/arch/arm64/mm/mmu.c
@@ -21,6 +21,8 @@
 #include <linux/kernel.h>
 #include <linux/errno.h>
 #include <linux/init.h>
+#include <linux/ioport.h>
+#include <linux/kexec.h>
 #include <linux/libfdt.h>
 #include <linux/mman.h>
 #include <linux/nodemask.h>
@@ -156,29 +158,10 @@ static void split_pud(pud_t *old_pud, pmd_t *pmd)
         } while (pmd++, i++, i < PTRS_PER_PMD);
 }
 
-#ifdef CONFIG_DEBUG_PAGEALLOC
-static bool block_mappings_allowed(phys_addr_t (*pgtable_alloc)(void))
-{
-
-        /*
-         * If debug_page_alloc is enabled we must map the linear map
-         * using pages. However, other mappings created by
-         * create_mapping_noalloc must use sections in some cases. Allow
-         * sections to be used in those cases, where no pgtable_alloc
-         * function is provided.
-         */
-        return !pgtable_alloc || !debug_pagealloc_enabled();
-}
-#else
-static bool block_mappings_allowed(phys_addr_t (*pgtable_alloc)(void))
-{
-        return true;
-}
-#endif
-
 static void alloc_init_pmd(pud_t *pud, unsigned long addr, unsigned long end,
                                   phys_addr_t phys, pgprot_t prot,
-                                  phys_addr_t (*pgtable_alloc)(void))
+                                  phys_addr_t (*pgtable_alloc)(void),
+                                  bool allow_block_mappings)
 {
         pmd_t *pmd;
         unsigned long next;
@@ -209,7 +192,7 @@ static void alloc_init_pmd(pud_t *pud, unsigned long addr, unsigned long end,
                 next = pmd_addr_end(addr, end);
                 /* try section mapping first */
                 if (((addr | next | phys) & ~SECTION_MASK) == 0 &&
-                      block_mappings_allowed(pgtable_alloc)) {
+                      (!pgtable_alloc || allow_block_mappings)) {
                         pmd_t old_pmd =*pmd;
                         pmd_set_huge(pmd, phys, prot);
                         /*
@@ -248,7 +231,8 @@ static inline bool use_1G_block(unsigned long addr, unsigned long next,
 
 static void alloc_init_pud(pgd_t *pgd, unsigned long addr, unsigned long end,
                                   phys_addr_t phys, pgprot_t prot,
-                                  phys_addr_t (*pgtable_alloc)(void))
+                                  phys_addr_t (*pgtable_alloc)(void),
+                                  bool allow_block_mappings)
 {
         pud_t *pud;
         unsigned long next;
@@ -269,7 +253,7 @@ static void alloc_init_pud(pgd_t *pgd, unsigned long addr, unsigned long end,
                  * For 4K granule only, attempt to put down a 1GB block
                  */
                 if (use_1G_block(addr, next, phys) &&
-                    block_mappings_allowed(pgtable_alloc)) {
+                      (!pgtable_alloc || allow_block_mappings)) {
                         pud_t old_pud = *pud;
                         pud_set_huge(pud, phys, prot);
 
@@ -290,7 +274,7 @@ static void alloc_init_pud(pgd_t *pgd, unsigned long addr, unsigned long end,
                         }
                 } else {
                         alloc_init_pmd(pud, addr, next, phys, prot,
-                                       pgtable_alloc);
+                                       pgtable_alloc, allow_block_mappings);
                 }
                 phys += next - addr;
         } while (pud++, addr = next, addr != end);
@@ -304,7 +288,8 @@ static void alloc_init_pud(pgd_t *pgd, unsigned long addr, unsigned long end,
  */
 static void init_pgd(pgd_t *pgd, phys_addr_t phys, unsigned long virt,
                                     phys_addr_t size, pgprot_t prot,
-                                    phys_addr_t (*pgtable_alloc)(void))
+                                    phys_addr_t (*pgtable_alloc)(void),
+                                    bool allow_block_mappings)
 {
         unsigned long addr, length, end, next;
 
@@ -322,7 +307,8 @@ static void init_pgd(pgd_t *pgd, phys_addr_t phys, unsigned long virt,
         end = addr + length;
         do {
                 next = pgd_addr_end(addr, end);
-                alloc_init_pud(pgd, addr, next, phys, prot, pgtable_alloc);
+                alloc_init_pud(pgd, addr, next, phys, prot, pgtable_alloc,
+                              (!pgtable_alloc || allow_block_mappings));
                 phys += next - addr;
         } while (pgd++, addr = next, addr != end);
 }
@@ -340,9 +326,11 @@ static phys_addr_t late_pgtable_alloc(void)
 static void __create_pgd_mapping(pgd_t *pgdir, phys_addr_t phys,
                                  unsigned long virt, phys_addr_t size,
                                  pgprot_t prot,
-                                 phys_addr_t (*alloc)(void))
+                                 phys_addr_t (*alloc)(void),
+                                 bool allow_block_mappings)
 {
-        init_pgd(pgd_offset_raw(pgdir, virt), phys, virt, size, prot, alloc);
+        init_pgd(pgd_offset_raw(pgdir, virt), phys, virt, size, prot, alloc,
+                 allow_block_mappings);
 }
 
 /*
@@ -358,16 +346,15 @@ static void __init create_mapping_noalloc(phys_addr_t phys, unsigned long virt,
                         &phys, virt);
                 return;
         }
-        __create_pgd_mapping(init_mm.pgd, phys, virt, size, prot,
-                             NULL);
+        __create_pgd_mapping(init_mm.pgd, phys, virt, size, prot, NULL, true);
 }
 
 void __init create_pgd_mapping(struct mm_struct *mm, phys_addr_t phys,
                                unsigned long virt, phys_addr_t size,
-                               pgprot_t prot)
+                               pgprot_t prot, bool allow_block_mappings)
 {
         __create_pgd_mapping(mm->pgd, phys, virt, size, prot,
-                             late_pgtable_alloc);
+                             late_pgtable_alloc, allow_block_mappings);
 }
 
 static void create_mapping_late(phys_addr_t phys, unsigned long virt,
@@ -380,10 +367,18 @@ static void create_mapping_late(phys_addr_t phys, unsigned long virt,
         }
 
         __create_pgd_mapping(init_mm.pgd, phys, virt, size, prot,
-                             late_pgtable_alloc);
+                             late_pgtable_alloc, !debug_pagealloc_enabled());
+}
+
+static void __init __map_memblock(pgd_t *pgd, phys_addr_t start,
+                                  phys_addr_t end, pgprot_t prot,
+                                  bool allow_block_mappings)
+{
+        __create_pgd_mapping(pgd, start, __phys_to_virt(start), end - start,
+                             prot, early_pgtable_alloc, allow_block_mappings);
 }
 
-static void __init __map_memblock(pgd_t *pgd, phys_addr_t start, phys_addr_t end)
+static void __init map_mem(pgd_t *pgd)
 {
         unsigned long kernel_start = __pa(_text);
         unsigned long kernel_end = __pa(__init_begin);
@@ -391,45 +386,15 @@ static void __init __map_memblock(pgd_t *pgd, phys_addr_t start, phys_addr_t end
         /*
          * Take care not to create a writable alias for the
          * read-only text and rodata sections of the kernel image.
+         * So temporarily mark them as NOMAP to skip mappings in
+         * the following for-loop
          */
-
-        /* No overlap with the kernel text/rodata */
-        if (end < kernel_start || start >= kernel_end) {
-                __create_pgd_mapping(pgd, start, __phys_to_virt(start),
-                                     end - start, PAGE_KERNEL,
-                                     early_pgtable_alloc);
-                return;
-        }
-
-        /*
-         * This block overlaps the kernel text/rodata mappings.
-         * Map the portion(s) which don't overlap.
-         */
-        if (start < kernel_start)
-                __create_pgd_mapping(pgd, start,
-                                     __phys_to_virt(start),
-                                     kernel_start - start, PAGE_KERNEL,
-                                     early_pgtable_alloc);
-        if (kernel_end < end)
-                __create_pgd_mapping(pgd, kernel_end,
-                                     __phys_to_virt(kernel_end),
-                                     end - kernel_end, PAGE_KERNEL,
-                                     early_pgtable_alloc);
-
-        /*
-         * Map the linear alias of the [_text, __init_begin) interval as
-         * read-only/non-executable. This makes the contents of the
-         * region accessible to subsystems such as hibernate, but
-         * protects it from inadvertent modification or execution.
-         */
-        __create_pgd_mapping(pgd, kernel_start, __phys_to_virt(kernel_start),
-                             kernel_end - kernel_start, PAGE_KERNEL_RO,
-                             early_pgtable_alloc);
-}
-
-static void __init map_mem(pgd_t *pgd)
-{
-        struct memblock_region *reg;
+        memblock_mark_nomap(kernel_start, kernel_end - kernel_start);
+#ifdef CONFIG_KEXEC_CORE
+        if (crashk_res.end)
+                memblock_mark_nomap(crashk_res.start,
+                                    resource_size(&crashk_res));
+#endif
 
         /* map all the memory banks */
         for_each_memblock(memory, reg) {
@@ -441,8 +406,33 @@ static void __init map_mem(pgd_t *pgd)
                 if (memblock_is_nomap(reg))
                         continue;
 
-                __map_memblock(pgd, start, end);
+                __map_memblock(pgd, start, end,
+                               PAGE_KERNEL, !debug_pagealloc_enabled());
         }
+
+        /*
+         * Map the linear alias of the [_text, __init_begin) interval as
+         * read-only/non-executable. This makes the contents of the
+         * region accessible to subsystems such as hibernate, but
+         * protects it from inadvertent modification or execution.
+         */
+        __map_memblock(pgd, kernel_start, kernel_end,
+                       PAGE_KERNEL_RO, !debug_pagealloc_enabled());
+        memblock_clear_nomap(kernel_start, kernel_end - kernel_start);
+
+#ifdef CONFIG_KEXEC_CORE
+        /*
+         * Use page-level mappings here so that we can shrink the region
+         * in page granularity and put back unused memory to buddy system
+         * through /sys/kernel/kexec_crash_size interface.
+         */
+        if (crashk_res.end) {
+                __map_memblock(pgd, crashk_res.start, crashk_res.end + 1,
+                               PAGE_KERNEL, false);
+                memblock_clear_nomap(crashk_res.start,
+                                     resource_size(&crashk_res));
+        }
+#endif
 }
 
 void mark_rodata_ro(void)
@@ -481,7 +471,7 @@ static void __init map_kernel_segment(pgd_t *pgd, void *va_start, void *va_end,
         BUG_ON(!PAGE_ALIGNED(size));
 
         __create_pgd_mapping(pgd, pa_start, (unsigned long)va_start, size, prot,
-                             early_pgtable_alloc);
+                             early_pgtable_alloc, !debug_pagealloc_enabled());
 
         vma->addr       = va_start;
         vma->phys_addr  = pa_start;
diff --git a/arch/arm64/mm/pageattr.c b/arch/arm64/mm/pageattr.c
index ca6d268e3313..f4e39dbdd36b 100644
--- a/arch/arm64/mm/pageattr.c
+++ b/arch/arm64/mm/pageattr.c
@@ -125,6 +125,19 @@ int set_memory_x(unsigned long addr, int numpages)
 }
 EXPORT_SYMBOL_GPL(set_memory_x);
 
+
+int set_memory_valid(unsigned long addr, int numpages, int enable)
+{
+        if (enable)
+                return __change_memory_common(addr, PAGE_SIZE * numpages,
+                                        __pgprot(PTE_VALID),
+                                        __pgprot(0));
+        else
+                return __change_memory_common(addr, PAGE_SIZE * numpages,
+                                        __pgprot(0),
+                                        __pgprot(PTE_VALID));
+}
+
 #ifdef CONFIG_DEBUG_PAGEALLOC
 void __kernel_map_pages(struct page *page, int numpages, int enable)
 {
diff --git a/arch/arm64/mm/proc.S b/arch/arm64/mm/proc.S
index 8292784d44c9..d88a2a80ada8 100644
--- a/arch/arm64/mm/proc.S
+++ b/arch/arm64/mm/proc.S
@@ -100,7 +100,16 @@ ENTRY(cpu_do_resume)
 
         msr     tcr_el1, x8
         msr     vbar_el1, x9
+
+        /*
+         * __cpu_setup() cleared MDSCR_EL1.MDE and friends, before unmasking
+         * debug exceptions. By restoring MDSCR_EL1 here, we may take a debug
+         * exception. Mask them until local_dbg_restore() in cpu_suspend()
+         * resets them.
+         */
+        disable_dbg
         msr     mdscr_el1, x10
+
         msr     sctlr_el1, x12
         /*
          * Restore oslsr_el1 by writing oslar_el1
diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c
index b162ad70effc..6297140dd84f 100644
--- a/arch/arm64/net/bpf_jit_comp.c
+++ b/arch/arm64/net/bpf_jit_comp.c
@@ -728,14 +728,14 @@ static int build_body(struct jit_ctx *ctx)
                 int ret;
 
                 ret = build_insn(insn, ctx);
-
-                if (ctx->image == NULL)
-                        ctx->offset[i] = ctx->idx;
-
                 if (ret > 0) {
                         i++;
+                        if (ctx->image == NULL)
+                                ctx->offset[i] = ctx->idx;
                         continue;
                 }
+                if (ctx->image == NULL)
+                        ctx->offset[i] = ctx->idx;
                 if (ret)
                         return ret;
         }
diff --git a/arch/arm64/xen/hypercall.S b/arch/arm64/xen/hypercall.S
index 6d6e4af1a4bf..b96db5dafec4 100644
--- a/arch/arm64/xen/hypercall.S
+++ b/arch/arm64/xen/hypercall.S
@@ -90,7 +90,6 @@ ENTRY(privcmd_call)
         mov x2, x3
         mov x3, x4
         mov x4, x5
-#ifdef CONFIG_ARM64_SW_TTBR0_PAN
         /*
          * Privcmd calls are issued by the userspace. The kernel needs to
          * enable access to TTBR0_EL1 as the hypervisor would issue stage 1
@@ -99,15 +98,12 @@ ENTRY(privcmd_call)
          * need the explicit uaccess_enable/disable if the TTBR0 PAN emulation
          * is enabled (it implies that hardware UAO and PAN disabled).
          */
-        uaccess_enable_not_uao x6, x7
-#endif
+        uaccess_ttbr0_enable x6, x7
         hvc XEN_IMM
 
-#ifdef CONFIG_ARM64_SW_TTBR0_PAN
         /*
          * Disable userspace access from kernel once the hyp call completed.
          */
-        uaccess_disable_not_uao x6
-#endif
+        uaccess_ttbr0_disable x6
         ret
 ENDPROC(privcmd_call);
diff --git a/arch/c6x/kernel/ptrace.c b/arch/c6x/kernel/ptrace.c
index 3c494e84444d..a511ac16a8e3 100644
--- a/arch/c6x/kernel/ptrace.c
+++ b/arch/c6x/kernel/ptrace.c
@@ -69,46 +69,6 @@ static int gpr_get(struct task_struct *target,
                                    0, sizeof(*regs));
 }
 
-static int gpr_set(struct task_struct *target,
-                   const struct user_regset *regset,
-                   unsigned int pos, unsigned int count,
-                   const void *kbuf, const void __user *ubuf)
-{
-        int ret;
-        struct pt_regs *regs = task_pt_regs(target);
-
-        /* Don't copyin TSR or CSR */
-        ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf,
-                                 &regs,
-                                 0, PT_TSR * sizeof(long));
-        if (ret)
-                return ret;
-
-        ret = user_regset_copyin_ignore(&pos, &count, &kbuf, &ubuf,
-                                        PT_TSR * sizeof(long),
-                                        (PT_TSR + 1) * sizeof(long));
-        if (ret)
-                return ret;
-
-        ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf,
-                                 &regs,
-                                 (PT_TSR + 1) * sizeof(long),
-                                 PT_CSR * sizeof(long));
-        if (ret)
-                return ret;
-
-        ret = user_regset_copyin_ignore(&pos, &count, &kbuf, &ubuf,
-                                        PT_CSR * sizeof(long),
-                                        (PT_CSR + 1) * sizeof(long));
-        if (ret)
-                return ret;
-
-        ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf,
-                                 &regs,
-                                 (PT_CSR + 1) * sizeof(long), -1);
-        return ret;
-}
-
 enum c6x_regset {
         REGSET_GPR,
 };
@@ -120,7 +80,6 @@ static const struct user_regset c6x_regsets[] = {
                 .size = sizeof(u32),
                 .align = sizeof(u32),
                 .get = gpr_get,
-                .set = gpr_set
         },
 };
 
diff --git a/arch/frv/mm/elf-fdpic.c b/arch/frv/mm/elf-fdpic.c
index 836f14707a62..efa59f1f8022 100644
--- a/arch/frv/mm/elf-fdpic.c
+++ b/arch/frv/mm/elf-fdpic.c
@@ -74,7 +74,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
                 addr = PAGE_ALIGN(addr);
                 vma = find_vma(current->mm, addr);
                 if (TASK_SIZE - len >= addr &&
-                    (!vma || addr + len <= vma->vm_start))
+                    (!vma || addr + len <= vm_start_gap(vma)))
                         goto success;
         }
 
diff --git a/arch/h8300/kernel/ptrace.c b/arch/h8300/kernel/ptrace.c
index 92075544a19a..0dc1c8f622bc 100644
--- a/arch/h8300/kernel/ptrace.c
+++ b/arch/h8300/kernel/ptrace.c
@@ -95,7 +95,8 @@ static int regs_get(struct task_struct *target,
         long *reg = (long *)&regs;
 
         /* build user regs in buffer */
-        for (r = 0; r < ARRAY_SIZE(register_offset); r++)
+        BUILD_BUG_ON(sizeof(regs) % sizeof(long) != 0);
+        for (r = 0; r < sizeof(regs) / sizeof(long); r++)
                 *reg++ = h8300_get_reg(target, r);
 
         return user_regset_copyout(&pos, &count, &kbuf, &ubuf,
@@ -113,7 +114,8 @@ static int regs_set(struct task_struct *target,
         long *reg;
 
         /* build user regs in buffer */
-        for (reg = (long *)&regs, r = 0; r < ARRAY_SIZE(register_offset); r++)
+        BUILD_BUG_ON(sizeof(regs) % sizeof(long) != 0);
+        for (reg = (long *)&regs, r = 0; r < sizeof(regs) / sizeof(long); r++)
                 *reg++ = h8300_get_reg(target, r);
 
         ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf,
@@ -122,7 +124,7 @@ static int regs_set(struct task_struct *target,
                 return ret;
 
         /* write back to pt_regs */
-        for (reg = (long *)&regs, r = 0; r < ARRAY_SIZE(register_offset); r++)
+        for (reg = (long *)&regs, r = 0; r < sizeof(regs) / sizeof(long); r++)
                 h8300_put_reg(target, r, *reg++);
         return 0;
 }
diff --git a/arch/ia64/Makefile b/arch/ia64/Makefile
index 970d0bd99621..648f1cef33fa 100644
--- a/arch/ia64/Makefile
+++ b/arch/ia64/Makefile
@@ -95,8 +95,8 @@ define archhelp
   echo '* unwcheck      - Check vmlinux for invalid unwind info'
 endef
 
-archprepare: make_nr_irqs_h FORCE
+archprepare: make_nr_irqs_h
 PHONY += make_nr_irqs_h FORCE
 
-make_nr_irqs_h: FORCE
+make_nr_irqs_h:
         $(Q)$(MAKE) $(build)=arch/ia64/kernel include/generated/nr-irqs.h
diff --git a/arch/metag/include/asm/uaccess.h b/arch/metag/include/asm/uaccess.h
index 273e61225c27..3db381205928 100644
--- a/arch/metag/include/asm/uaccess.h
+++ b/arch/metag/include/asm/uaccess.h
@@ -28,24 +28,32 @@
 
 #define segment_eq(a, b)        ((a).seg == (b).seg)
 
-#define __kernel_ok (segment_eq(get_fs(), KERNEL_DS))
-/*
- * Explicitly allow NULL pointers here. Parts of the kernel such
- * as readv/writev use access_ok to validate pointers, but want
- * to allow NULL pointers for various reasons. NULL pointers are
- * safe to allow through because the first page is not mappable on
- * Meta.
- *
- * We also wish to avoid letting user code access the system area
- * and the kernel half of the address space.
- */
-#define __user_bad(addr, size) (((addr) > 0 && (addr) < META_MEMORY_BASE) || \
-                                ((addr) > PAGE_OFFSET &&                \
-                                 (addr) < LINCORE_BASE))
-
 static inline int __access_ok(unsigned long addr, unsigned long size)
 {
-        return __kernel_ok || !__user_bad(addr, size);
+        /*
+         * Allow access to the user mapped memory area, but not the system area
+         * before it. The check extends to the top of the address space when
+         * kernel access is allowed (there's no real reason to user copy to the
+         * system area in any case).
+         */
+        if (likely(addr >= META_MEMORY_BASE && addr < get_fs().seg &&
+                   size <= get_fs().seg - addr))
+                return true;
+        /*
+         * Explicitly allow NULL pointers here. Parts of the kernel such
+         * as readv/writev use access_ok to validate pointers, but want
+         * to allow NULL pointers for various reasons. NULL pointers are
+         * safe to allow through because the first page is not mappable on
+         * Meta.
+         */
+        if (!addr)
+                return true;
+        /* Allow access to core code memory area... */
+        if (addr >= LINCORE_CODE_BASE && addr <= LINCORE_CODE_LIMIT &&
+            size <= LINCORE_CODE_LIMIT + 1 - addr)
+                return true;
+        /* ... but no other areas. */
+        return false;
 }
 
 #define access_ok(type, addr, size) __access_ok((unsigned long)(addr),  \
@@ -186,8 +194,13 @@ do {                                                            \
 extern long __must_check __strncpy_from_user(char *dst, const char __user *src,
                                              long count);
 
-#define strncpy_from_user(dst, src, count) __strncpy_from_user(dst, src, count)
-
+static inline long
+strncpy_from_user(char *dst, const char __user *src, long count)
+{
+        if (!access_ok(VERIFY_READ, src, 1))
+                return -EFAULT;
+        return __strncpy_from_user(dst, src, count);
+}
 /*
  * Return the size of a string (including the ending 0)
  *
@@ -197,20 +210,21 @@ extern long __must_check strnlen_user(const char __user *src, long count);
 
 #define strlen_user(str) strnlen_user(str, 32767)
 
-extern unsigned long __must_check __copy_user_zeroing(void *to,
-                                                      const void __user *from,
-                                                      unsigned long n);
+extern unsigned long raw_copy_from_user(void *to, const void __user *from,
+                                        unsigned long n);
 
 static inline unsigned long
 copy_from_user(void *to, const void __user *from, unsigned long n)
 {
+        unsigned long res = n;
         if (likely(access_ok(VERIFY_READ, from, n)))
-                return __copy_user_zeroing(to, from, n);
-        memset(to, 0, n);
-        return n;
+                res = raw_copy_from_user(to, from, n);
+        if (unlikely(res))
+                memset(to + (n - res), 0, res);
+        return res;
 }
 
-#define __copy_from_user(to, from, n) __copy_user_zeroing(to, from, n)
+#define __copy_from_user(to, from, n) raw_copy_from_user(to, from, n)
 #define __copy_from_user_inatomic __copy_from_user
 
 extern unsigned long __must_check __copy_user(void __user *to,
diff --git a/arch/metag/kernel/ptrace.c b/arch/metag/kernel/ptrace.c
index 7563628822bd..5e2dc7defd2c 100644
--- a/arch/metag/kernel/ptrace.c
+++ b/arch/metag/kernel/ptrace.c
@@ -24,6 +24,16 @@
  * user_regset definitions.
  */
 
+static unsigned long user_txstatus(const struct pt_regs *regs)
+{
+        unsigned long data = (unsigned long)regs->ctx.Flags;
+
+        if (regs->ctx.SaveMask & TBICTX_CBUF_BIT)
+                data |= USER_GP_REGS_STATUS_CATCH_BIT;
+
+        return data;
+}
+
 int metag_gp_regs_copyout(const struct pt_regs *regs,
                           unsigned int pos, unsigned int count,
                           void *kbuf, void __user *ubuf)
@@ -62,9 +72,7 @@ int metag_gp_regs_copyout(const struct pt_regs *regs,
         if (ret)
                 goto out;
         /* TXSTATUS */
-        data = (unsigned long)regs->ctx.Flags;
-        if (regs->ctx.SaveMask & TBICTX_CBUF_BIT)
-                data |= USER_GP_REGS_STATUS_CATCH_BIT;
+        data = user_txstatus(regs);
         ret = user_regset_copyout(&pos, &count, &kbuf, &ubuf,
                                   &data, 4*25, 4*26);
         if (ret)
@@ -119,6 +127,7 @@ int metag_gp_regs_copyin(struct pt_regs *regs,
         if (ret)
                 goto out;
         /* TXSTATUS */
+        data = user_txstatus(regs);
         ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf,
                                  &data, 4*25, 4*26);
         if (ret)
@@ -244,6 +253,8 @@ int metag_rp_state_copyin(struct pt_regs *regs,
         unsigned long long *ptr;
         int ret, i;
 
+        if (count < 4*13)
+                return -EINVAL;
         /* Read the entire pipeline before making any changes */
         ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf,
                                  &rp, 0, 4*13);
@@ -303,7 +314,7 @@ static int metag_tls_set(struct task_struct *target,
                         const void *kbuf, const void __user *ubuf)
 {
         int ret;
-        void __user *tls;
+        void __user *tls = target->thread.tls_ptr;
 
         ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &tls, 0, -1);
         if (ret)
diff --git a/arch/metag/lib/usercopy.c b/arch/metag/lib/usercopy.c
index b3ebfe9c8e88..2792fc621088 100644
--- a/arch/metag/lib/usercopy.c
+++ b/arch/metag/lib/usercopy.c
@@ -29,7 +29,6 @@
                 COPY                                             \
                 "1:\n"                                           \
                 "       .section .fixup,\"ax\"\n"                \
-                "       MOV D1Ar1,#0\n"                          \
                 FIXUP                                            \
                 "       MOVT    D1Ar1,#HI(1b)\n"                 \
                 "       JUMP    D1Ar1,#LO(1b)\n"                 \
@@ -260,27 +259,31 @@
                 "MGETL  D0FrT, D0.5, D0.6, D0.7, [%1++]\n"              \
                 "22:\n"                                                 \
                 "MSETL  [%0++], D0FrT, D0.5, D0.6, D0.7\n"              \
-                "SUB    %3, %3, #32\n"                                  \
                 "23:\n"                                                 \
-                "MGETL  D0FrT, D0.5, D0.6, D0.7, [%1++]\n"              \
+                "SUB    %3, %3, #32\n"                                  \
                 "24:\n"                                                 \
+                "MGETL  D0FrT, D0.5, D0.6, D0.7, [%1++]\n"              \
+                "25:\n"                                                 \
                 "MSETL  [%0++], D0FrT, D0.5, D0.6, D0.7\n"              \
+                "26:\n"                                                 \
                 "SUB    %3, %3, #32\n"                                  \
                 "DCACHE [%1+#-64], D0Ar6\n"                             \
                 "BR     $Lloop"id"\n"                                   \
                                                                         \
                 "MOV    RAPF, %1\n"                                     \
-                "25:\n"                                                 \
+                "27:\n"                                                 \
                 "MGETL  D0FrT, D0.5, D0.6, D0.7, [%1++]\n"              \
-                "26:\n"                                                 \
+                "28:\n"                                                 \
                 "MSETL  [%0++], D0FrT, D0.5, D0.6, D0.7\n"              \
+                "29:\n"                                                 \
                 "SUB    %3, %3, #32\n"                                  \
-                "27:\n"                                                 \
+                "30:\n"                                                 \
                 "MGETL  D0FrT, D0.5, D0.6, D0.7, [%1++]\n"              \
-                "28:\n"                                                 \
+                "31:\n"                                                 \
                 "MSETL  [%0++], D0FrT, D0.5, D0.6, D0.7\n"              \
+                "32:\n"                                                 \
                 "SUB    %0, %0, #8\n"                                   \
-                "29:\n"                                                 \
+                "33:\n"                                                 \
                 "SETL   [%0++], D0.7, D1.7\n"                           \
                 "SUB    %3, %3, #32\n"                                  \
                 "1:"                                                    \
@@ -312,11 +315,15 @@
                 "       .long 26b,3b\n"                                 \
                 "       .long 27b,3b\n"                                 \
                 "       .long 28b,3b\n"                                 \
-                "       .long 29b,4b\n"                                 \
+                "       .long 29b,3b\n"                                 \
+                "       .long 30b,3b\n"                                 \
+                "       .long 31b,3b\n"                                 \
+                "       .long 32b,3b\n"                                 \
+                "       .long 33b,4b\n"                                 \
                 "       .previous\n"                                    \
                 : "=r" (to), "=r" (from), "=r" (ret), "=d" (n)          \
                 : "0" (to), "1" (from), "2" (ret), "3" (n)              \
-                : "D1Ar1", "D0Ar2", "memory")
+                : "D1Ar1", "D0Ar2", "cc", "memory")
 
 /*      rewind 'to' and 'from'  pointers when a fault occurs
  *
@@ -342,7 +349,7 @@
 #define __asm_copy_to_user_64bit_rapf_loop(to,  from, ret, n, id)\
         __asm_copy_user_64bit_rapf_loop(to, from, ret, n, id,           \
                 "LSR    D0Ar2, D0Ar2, #8\n"                             \
-                "AND    D0Ar2, D0Ar2, #0x7\n"                           \
+                "ANDS   D0Ar2, D0Ar2, #0x7\n"                           \
                 "ADDZ   D0Ar2, D0Ar2, #4\n"                             \
                 "SUB    D0Ar2, D0Ar2, #1\n"                             \
                 "MOV    D1Ar1, #4\n"                                    \
@@ -403,47 +410,55 @@
                 "MGETD  D0FrT, D0.5, D0.6, D0.7, [%1++]\n"              \
                 "22:\n"                                                 \
                 "MSETD  [%0++], D0FrT, D0.5, D0.6, D0.7\n"              \
-                "SUB    %3, %3, #16\n"                                  \
                 "23:\n"                                                 \
-                "MGETD  D0FrT, D0.5, D0.6, D0.7, [%1++]\n"              \
-                "24:\n"                                                 \
-                "MSETD  [%0++], D0FrT, D0.5, D0.6, D0.7\n"              \
                 "SUB    %3, %3, #16\n"                                  \
-                "25:\n"                                                 \
+                "24:\n"                                                 \
                 "MGETD  D0FrT, D0.5, D0.6, D0.7, [%1++]\n"              \
-                "26:\n"                                                 \
+                "25:\n"                                                 \
                 "MSETD  [%0++], D0FrT, D0.5, D0.6, D0.7\n"              \
+                "26:\n"                                                 \
                 "SUB    %3, %3, #16\n"                                  \
                 "27:\n"                                                 \
                 "MGETD  D0FrT, D0.5, D0.6, D0.7, [%1++]\n"              \
                 "28:\n"                                                 \
                 "MSETD  [%0++], D0FrT, D0.5, D0.6, D0.7\n"              \
+                "29:\n"                                                 \
+                "SUB    %3, %3, #16\n"                                  \
+                "30:\n"                                                 \
+                "MGETD  D0FrT, D0.5, D0.6, D0.7, [%1++]\n"              \
+                "31:\n"                                                 \
+                "MSETD  [%0++], D0FrT, D0.5, D0.6, D0.7\n"              \
+                "32:\n"                                                 \
                 "SUB    %3, %3, #16\n"                                  \
                 "DCACHE [%1+#-64], D0Ar6\n"                             \
                 "BR     $Lloop"id"\n"                                   \
                                                                         \
                 "MOV    RAPF, %1\n"                                     \
-                "29:\n"                                                 \
+                "33:\n"                                                 \
                 "MGETD  D0FrT, D0.5, D0.6, D0.7, [%1++]\n"              \
-                "30:\n"                                                 \
+                "34:\n"                                                 \
                 "MSETD  [%0++], D0FrT, D0.5, D0.6, D0.7\n"              \
+                "35:\n"                                                 \
                 "SUB    %3, %3, #16\n"                                  \
-                "31:\n"                                                 \
+                "36:\n"                                                 \
                 "MGETD  D0FrT, D0.5, D0.6, D0.7, [%1++]\n"              \
-                "32:\n"                                                 \
+                "37:\n"                                                 \
                 "MSETD  [%0++], D0FrT, D0.5, D0.6, D0.7\n"              \
+                "38:\n"                                                 \
                 "SUB    %3, %3, #16\n"                                  \
-                "33:\n"                                                 \
+                "39:\n"                                                 \
                 "MGETD  D0FrT, D0.5, D0.6, D0.7, [%1++]\n"              \
-                "34:\n"                                                 \
+                "40:\n"                                                 \
                 "MSETD  [%0++], D0FrT, D0.5, D0.6, D0.7\n"              \
+                "41:\n"                                                 \
                 "SUB    %3, %3, #16\n"                                  \
-                "35:\n"                                                 \
+                "42:\n"                                                 \
                 "MGETD  D0FrT, D0.5, D0.6, D0.7, [%1++]\n"              \
-                "36:\n"                                                 \
+                "43:\n"                                                 \
                 "MSETD  [%0++], D0FrT, D0.5, D0.6, D0.7\n"              \
+                "44:\n"                                                 \
                 "SUB    %0, %0, #4\n"                                   \
-                "37:\n"                                                 \
+                "45:\n"                                                 \
                 "SETD   [%0++], D0.7\n"                                 \
                 "SUB    %3, %3, #16\n"                                  \
                 "1:"                                                    \
@@ -483,11 +498,19 @@
                 "       .long 34b,3b\n"                                 \
                 "       .long 35b,3b\n"                                 \
                 "       .long 36b,3b\n"                                 \
-                "       .long 37b,4b\n"                                 \
+                "       .long 37b,3b\n"                                 \
+                "       .long 38b,3b\n"                                 \
+                "       .long 39b,3b\n"                                 \
+                "       .long 40b,3b\n"                                 \
+                "       .long 41b,3b\n"                                 \
+                "       .long 42b,3b\n"                                 \
+                "       .long 43b,3b\n"                                 \
+                "       .long 44b,3b\n"                                 \
+                "       .long 45b,4b\n"                                 \
                 "       .previous\n"                                    \
                 : "=r" (to), "=r" (from), "=r" (ret), "=d" (n)          \
                 : "0" (to), "1" (from), "2" (ret), "3" (n)              \
-                : "D1Ar1", "D0Ar2", "memory")
+                : "D1Ar1", "D0Ar2", "cc", "memory")
 
 /*      rewind 'to' and 'from'  pointers when a fault occurs
  *
@@ -513,7 +536,7 @@
 #define __asm_copy_to_user_32bit_rapf_loop(to, from, ret, n, id)\
         __asm_copy_user_32bit_rapf_loop(to, from, ret, n, id,           \
                 "LSR    D0Ar2, D0Ar2, #8\n"                             \
-                "AND    D0Ar2, D0Ar2, #0x7\n"                           \
+                "ANDS   D0Ar2, D0Ar2, #0x7\n"                           \
                 "ADDZ   D0Ar2, D0Ar2, #4\n"                             \
                 "SUB    D0Ar2, D0Ar2, #1\n"                             \
                 "MOV    D1Ar1, #4\n"                                    \
@@ -538,23 +561,31 @@ unsigned long __copy_user(void __user *pdst, const void *psrc,
         if ((unsigned long) src & 1) {
                 __asm_copy_to_user_1(dst, src, retn);
                 n--;
+                if (retn)
+                        return retn + n;
         }
         if ((unsigned long) dst & 1) {
                 /* Worst case - byte copy */
                 while (n > 0) {
                         __asm_copy_to_user_1(dst, src, retn);
                         n--;
+                        if (retn)
+                                return retn + n;
                 }
         }
         if (((unsigned long) src & 2) && n >= 2) {
                 __asm_copy_to_user_2(dst, src, retn);
                 n -= 2;
+                if (retn)
+                        return retn + n;
         }
         if ((unsigned long) dst & 2) {
                 /* Second worst case - word copy */
                 while (n >= 2) {
                         __asm_copy_to_user_2(dst, src, retn);
                         n -= 2;
+                        if (retn)
+                                return retn + n;
                 }
         }
 
@@ -569,6 +600,8 @@ unsigned long __copy_user(void __user *pdst, const void *psrc,
                 while (n >= 8) {
                         __asm_copy_to_user_8x64(dst, src, retn);
                         n -= 8;
+                        if (retn)
+                                return retn + n;
                 }
         }
         if (n >= RAPF_MIN_BUF_SIZE) {
@@ -581,6 +614,8 @@ unsigned long __copy_user(void __user *pdst, const void *psrc,
                 while (n >= 8) {
                         __asm_copy_to_user_8x64(dst, src, retn);
                         n -= 8;
+                        if (retn)
+                                return retn + n;
                 }
         }
 #endif
@@ -588,11 +623,15 @@ unsigned long __copy_user(void __user *pdst, const void *psrc,
         while (n >= 16) {
                 __asm_copy_to_user_16(dst, src, retn);
                 n -= 16;
+                if (retn)
+                        return retn + n;
         }
 
         while (n >= 4) {
                 __asm_copy_to_user_4(dst, src, retn);
                 n -= 4;
+                if (retn)
+                        return retn + n;
         }
 
         switch (n) {
@@ -609,6 +648,10 @@ unsigned long __copy_user(void __user *pdst, const void *psrc,
                 break;
         }
 
+        /*
+         * If we get here, retn correctly reflects the number of failing
+         * bytes.
+         */
         return retn;
 }
 EXPORT_SYMBOL(__copy_user);
@@ -617,16 +660,14 @@ EXPORT_SYMBOL(__copy_user);
         __asm_copy_user_cont(to, from, ret,     \
                 "       GETB D1Ar1,[%1++]\n"    \
                 "2:     SETB [%0++],D1Ar1\n",   \
-                "3:     ADD  %2,%2,#1\n"        \
-                "       SETB [%0++],D1Ar1\n",   \
+                "3:     ADD  %2,%2,#1\n",       \
                 "       .long 2b,3b\n")
 
 #define __asm_copy_from_user_2x_cont(to, from, ret, COPY, FIXUP, TENTRY) \
         __asm_copy_user_cont(to, from, ret,             \
                 "       GETW D1Ar1,[%1++]\n"            \
                 "2:     SETW [%0++],D1Ar1\n" COPY,      \
-                "3:     ADD  %2,%2,#2\n"                \
-                "       SETW [%0++],D1Ar1\n" FIXUP,     \
+                "3:     ADD  %2,%2,#2\n" FIXUP,         \
                 "       .long 2b,3b\n" TENTRY)
 
 #define __asm_copy_from_user_2(to, from, ret) \
@@ -636,145 +677,26 @@ EXPORT_SYMBOL(__copy_user);
         __asm_copy_from_user_2x_cont(to, from, ret,     \
                 "       GETB D1Ar1,[%1++]\n"            \
                 "4:     SETB [%0++],D1Ar1\n",           \
-                "5:     ADD  %2,%2,#1\n"                \
-                "       SETB [%0++],D1Ar1\n",           \
+                "5:     ADD  %2,%2,#1\n",               \
                 "       .long 4b,5b\n")
 
 #define __asm_copy_from_user_4x_cont(to, from, ret, COPY, FIXUP, TENTRY) \
         __asm_copy_user_cont(to, from, ret,             \
                 "       GETD D1Ar1,[%1++]\n"            \
                 "2:     SETD [%0++],D1Ar1\n" COPY,      \
-                "3:     ADD  %2,%2,#4\n"                \
-                "       SETD [%0++],D1Ar1\n" FIXUP,     \
+                "3:     ADD  %2,%2,#4\n" FIXUP,         \
                 "       .long 2b,3b\n" TENTRY)
 
 #define __asm_copy_from_user_4(to, from, ret) \
         __asm_copy_from_user_4x_cont(to, from, ret, "", "", "")
 
-#define __asm_copy_from_user_5(to, from, ret) \
-        __asm_copy_from_user_4x_cont(to, from, ret,     \
-                "       GETB D1Ar1,[%1++]\n"            \
-                "4:     SETB [%0++],D1Ar1\n",           \
-                "5:     ADD  %2,%2,#1\n"                \
-                "       SETB [%0++],D1Ar1\n",           \
-                "       .long 4b,5b\n")
-
-#define __asm_copy_from_user_6x_cont(to, from, ret, COPY, FIXUP, TENTRY) \
-        __asm_copy_from_user_4x_cont(to, from, ret,     \
-                "       GETW D1Ar1,[%1++]\n"            \
-                "4:     SETW [%0++],D1Ar1\n" COPY,      \
-                "5:     ADD  %2,%2,#2\n"                \
-                "       SETW [%0++],D1Ar1\n" FIXUP,     \
-                "       .long 4b,5b\n" TENTRY)
-
-#define __asm_copy_from_user_6(to, from, ret) \
-        __asm_copy_from_user_6x_cont(to, from, ret, "", "", "")
-
-#define __asm_copy_from_user_7(to, from, ret) \
-        __asm_copy_from_user_6x_cont(to, from, ret,     \
-                "       GETB D1Ar1,[%1++]\n"            \
-                "6:     SETB [%0++],D1Ar1\n",           \
-                "7:     ADD  %2,%2,#1\n"                \
-                "       SETB [%0++],D1Ar1\n",           \
-                "       .long 6b,7b\n")
-
-#define __asm_copy_from_user_8x_cont(to, from, ret, COPY, FIXUP, TENTRY) \
-        __asm_copy_from_user_4x_cont(to, from, ret,     \
-                "       GETD D1Ar1,[%1++]\n"            \
-                "4:     SETD [%0++],D1Ar1\n" COPY,      \
-                "5:     ADD  %2,%2,#4\n"                        \
-                "       SETD [%0++],D1Ar1\n" FIXUP,             \
-                "       .long 4b,5b\n" TENTRY)
-
-#define __asm_copy_from_user_8(to, from, ret) \
-        __asm_copy_from_user_8x_cont(to, from, ret, "", "", "")
-
-#define __asm_copy_from_user_9(to, from, ret) \
-        __asm_copy_from_user_8x_cont(to, from, ret,     \
-                "       GETB D1Ar1,[%1++]\n"            \
-                "6:     SETB [%0++],D1Ar1\n",           \
-                "7:     ADD  %2,%2,#1\n"                \
-                "       SETB [%0++],D1Ar1\n",           \
-                "       .long 6b,7b\n")
-
-#define __asm_copy_from_user_10x_cont(to, from, ret, COPY, FIXUP, TENTRY) \
-        __asm_copy_from_user_8x_cont(to, from, ret,     \
-                "       GETW D1Ar1,[%1++]\n"            \
-                "6:     SETW [%0++],D1Ar1\n" COPY,      \
-                "7:     ADD  %2,%2,#2\n"                \
-                "       SETW [%0++],D1Ar1\n" FIXUP,     \
-                "       .long 6b,7b\n" TENTRY)
-
-#define __asm_copy_from_user_10(to, from, ret) \
-        __asm_copy_from_user_10x_cont(to, from, ret, "", "", "")
-
-#define __asm_copy_from_user_11(to, from, ret)          \
-        __asm_copy_from_user_10x_cont(to, from, ret,    \
-                "       GETB D1Ar1,[%1++]\n"            \
-                "8:     SETB [%0++],D1Ar1\n",           \
-                "9:     ADD  %2,%2,#1\n"                \
-                "       SETB [%0++],D1Ar1\n",           \
-                "       .long 8b,9b\n")
-
-#define __asm_copy_from_user_12x_cont(to, from, ret, COPY, FIXUP, TENTRY) \
-        __asm_copy_from_user_8x_cont(to, from, ret,     \
-                "       GETD D1Ar1,[%1++]\n"            \
-                "6:     SETD [%0++],D1Ar1\n" COPY,      \
-                "7:     ADD  %2,%2,#4\n"                \
-                "       SETD [%0++],D1Ar1\n" FIXUP,     \
-                "       .long 6b,7b\n" TENTRY)
-
-#define __asm_copy_from_user_12(to, from, ret) \
-        __asm_copy_from_user_12x_cont(to, from, ret, "", "", "")
-
-#define __asm_copy_from_user_13(to, from, ret) \
-        __asm_copy_from_user_12x_cont(to, from, ret,    \
-                "       GETB D1Ar1,[%1++]\n"            \
-                "8:     SETB [%0++],D1Ar1\n",           \
-                "9:     ADD  %2,%2,#1\n"                \
-                "       SETB [%0++],D1Ar1\n",           \
-                "       .long 8b,9b\n")
-
-#define __asm_copy_from_user_14x_cont(to, from, ret, COPY, FIXUP, TENTRY) \
-        __asm_copy_from_user_12x_cont(to, from, ret,    \
-                "       GETW D1Ar1,[%1++]\n"            \
-                "8:     SETW [%0++],D1Ar1\n" COPY,      \
-                "9:     ADD  %2,%2,#2\n"                \
-                "       SETW [%0++],D1Ar1\n" FIXUP,     \
-                "       .long 8b,9b\n" TENTRY)
-
-#define __asm_copy_from_user_14(to, from, ret) \
-        __asm_copy_from_user_14x_cont(to, from, ret, "", "", "")
-
-#define __asm_copy_from_user_15(to, from, ret) \
-        __asm_copy_from_user_14x_cont(to, from, ret,    \
-                "       GETB D1Ar1,[%1++]\n"            \
-                "10:    SETB [%0++],D1Ar1\n",           \
-                "11:    ADD  %2,%2,#1\n"                \
-                "       SETB [%0++],D1Ar1\n",           \
-                "       .long 10b,11b\n")
-
-#define __asm_copy_from_user_16x_cont(to, from, ret, COPY, FIXUP, TENTRY) \
-        __asm_copy_from_user_12x_cont(to, from, ret,    \
-                "       GETD D1Ar1,[%1++]\n"            \
-                "8:     SETD [%0++],D1Ar1\n" COPY,      \
-                "9:     ADD  %2,%2,#4\n"                \
-                "       SETD [%0++],D1Ar1\n" FIXUP,     \
-                "       .long 8b,9b\n" TENTRY)
-
-#define __asm_copy_from_user_16(to, from, ret) \
-        __asm_copy_from_user_16x_cont(to, from, ret, "", "", "")
-
 #define __asm_copy_from_user_8x64(to, from, ret) \
         asm volatile (                          \
                 "       GETL D0Ar2,D1Ar1,[%1++]\n"      \
                 "2:     SETL [%0++],D0Ar2,D1Ar1\n"      \
                 "1:\n"                                  \
                 "       .section .fixup,\"ax\"\n"       \
-                "       MOV D1Ar1,#0\n"                 \
-                "       MOV D0Ar2,#0\n"                 \
                 "3:     ADD  %2,%2,#8\n"                \
-                "       SETL [%0++],D0Ar2,D1Ar1\n"      \
                 "       MOVT    D0Ar2,#HI(1b)\n"        \
                 "       JUMP    D0Ar2,#LO(1b)\n"        \
                 "       .previous\n"                    \
@@ -789,36 +711,57 @@ EXPORT_SYMBOL(__copy_user);
  *
  *      Rationale:
  *              A fault occurs while reading from user buffer, which is the
- *              source. Since the fault is at a single address, we only
- *              need to rewind by 8 bytes.
+ *              source.
  *              Since we don't write to kernel buffer until we read first,
  *              the kernel buffer is at the right state and needn't be
- *              corrected.
+ *              corrected, but the source must be rewound to the beginning of
+ *              the block, which is LSM_STEP*8 bytes.
+ *              LSM_STEP is bits 10:8 in TXSTATUS which is already read
+ *              and stored in D0Ar2
+ *
+ *              NOTE: If a fault occurs at the last operation in M{G,S}ETL
+ *                      LSM_STEP will be 0. ie: we do 4 writes in our case, if
+ *                      a fault happens at the 4th write, LSM_STEP will be 0
+ *                      instead of 4. The code copes with that.
  */
 #define __asm_copy_from_user_64bit_rapf_loop(to, from, ret, n, id)      \
         __asm_copy_user_64bit_rapf_loop(to, from, ret, n, id,           \
-                "SUB    %1, %1, #8\n")
+                "LSR    D0Ar2, D0Ar2, #5\n"                             \
+                "ANDS   D0Ar2, D0Ar2, #0x38\n"                          \
+                "ADDZ   D0Ar2, D0Ar2, #32\n"                            \
+                "SUB    %1, %1, D0Ar2\n")
 
 /*      rewind 'from' pointer when a fault occurs
  *
  *      Rationale:
  *              A fault occurs while reading from user buffer, which is the
- *              source. Since the fault is at a single address, we only
- *              need to rewind by 4 bytes.
+ *              source.
  *              Since we don't write to kernel buffer until we read first,
  *              the kernel buffer is at the right state and needn't be
- *              corrected.
+ *              corrected, but the source must be rewound to the beginning of
+ *              the block, which is LSM_STEP*4 bytes.
+ *              LSM_STEP is bits 10:8 in TXSTATUS which is already read
+ *              and stored in D0Ar2
+ *
+ *              NOTE: If a fault occurs at the last operation in M{G,S}ETL
+ *                      LSM_STEP will be 0. ie: we do 4 writes in our case, if
+ *                      a fault happens at the 4th write, LSM_STEP will be 0
+ *                      instead of 4. The code copes with that.
  */
 #define __asm_copy_from_user_32bit_rapf_loop(to, from, ret, n, id)      \
         __asm_copy_user_32bit_rapf_loop(to, from, ret, n, id,           \
-                "SUB    %1, %1, #4\n")
+                "LSR    D0Ar2, D0Ar2, #6\n"                             \
+                "ANDS   D0Ar2, D0Ar2, #0x1c\n"                          \
+                "ADDZ   D0Ar2, D0Ar2, #16\n"                            \
+                "SUB    %1, %1, D0Ar2\n")
 
 
-/* Copy from user to kernel, zeroing the bytes that were inaccessible in
-   userland.  The return-value is the number of bytes that were
-   inaccessible.  */
-unsigned long __copy_user_zeroing(void *pdst, const void __user *psrc,
-                                  unsigned long n)
+/*
+ * Copy from user to kernel. The return-value is the number of bytes that were
+ * inaccessible.
+ */
+unsigned long raw_copy_from_user(void *pdst, const void __user *psrc,
+                                 unsigned long n)
 {
         register char *dst asm ("A0.2") = pdst;
         register const char __user *src asm ("A1.2") = psrc;
@@ -830,6 +773,8 @@ unsigned long __copy_user_zeroing(void *pdst, const void __user *psrc,
         if ((unsigned long) src & 1) {
                 __asm_copy_from_user_1(dst, src, retn);
                 n--;
+                if (retn)
+                        return retn + n;
         }
         if ((unsigned long) dst & 1) {
                 /* Worst case - byte copy */
@@ -837,12 +782,14 @@ unsigned long __copy_user_zeroing(void *pdst, const void __user *psrc,
                         __asm_copy_from_user_1(dst, src, retn);
                         n--;
                         if (retn)
-                                goto copy_exception_bytes;
+                                return retn + n;
                 }
         }
         if (((unsigned long) src & 2) && n >= 2) {
                 __asm_copy_from_user_2(dst, src, retn);
                 n -= 2;
+                if (retn)
+                        return retn + n;
         }
         if ((unsigned long) dst & 2) {
                 /* Second worst case - word copy */
@@ -850,16 +797,10 @@ unsigned long __copy_user_zeroing(void *pdst, const void __user *psrc,
                         __asm_copy_from_user_2(dst, src, retn);
                         n -= 2;
                         if (retn)
-                                goto copy_exception_bytes;
+                                return retn + n;
                 }
         }
 
-        /* We only need one check after the unalignment-adjustments,
-           because if both adjustments were done, either both or
-           neither reference had an exception.  */
-        if (retn != 0)
-                goto copy_exception_bytes;
-
 #ifdef USE_RAPF
         /* 64 bit copy loop */
         if (!(((unsigned long) src | (unsigned long) dst) & 7)) {
@@ -872,7 +813,7 @@ unsigned long __copy_user_zeroing(void *pdst, const void __user *psrc,
                         __asm_copy_from_user_8x64(dst, src, retn);
                         n -= 8;
                         if (retn)
-                                goto copy_exception_bytes;
+                                return retn + n;
                 }
         }
 
@@ -888,7 +829,7 @@ unsigned long __copy_user_zeroing(void *pdst, const void __user *psrc,
                         __asm_copy_from_user_8x64(dst, src, retn);
                         n -= 8;
                         if (retn)
-                                goto copy_exception_bytes;
+                                return retn + n;
                 }
         }
 #endif
@@ -898,7 +839,7 @@ unsigned long __copy_user_zeroing(void *pdst, const void __user *psrc,
                 n -= 4;
 
                 if (retn)
-                        goto copy_exception_bytes;
+                        return retn + n;
         }
 
         /* If we get here, there were no memory read faults.  */
@@ -924,21 +865,8 @@ unsigned long __copy_user_zeroing(void *pdst, const void __user *psrc,
         /* If we get here, retn correctly reflects the number of failing
            bytes.  */
         return retn;
-
- copy_exception_bytes:
-        /* We already have "retn" bytes cleared, and need to clear the
-           remaining "n" bytes.  A non-optimized simple byte-for-byte in-line
-           memset is preferred here, since this isn't speed-critical code and
-           we'd rather have this a leaf-function than calling memset.  */
-        {
-                char *endp;
-                for (endp = dst + n; dst < endp; dst++)
-                        *dst = 0;
-        }
-
-        return retn + n;
 }
-EXPORT_SYMBOL(__copy_user_zeroing);
+EXPORT_SYMBOL(raw_copy_from_user);
 
 #define __asm_clear_8x64(to, ret) \
         asm volatile (                                  \
diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index db459612de44..8b0424abc84c 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -9,6 +9,7 @@ config MIPS
         select HAVE_CONTEXT_TRACKING
         select HAVE_GENERIC_DMA_COHERENT
         select HAVE_IDE
+        select HAVE_IRQ_EXIT_ON_IRQ_STACK
         select HAVE_OPROFILE
         select HAVE_PERF_EVENTS
         select PERF_USE_VMALLOC
@@ -1463,7 +1464,7 @@ config CPU_MIPS64_R6
         select CPU_SUPPORTS_HIGHMEM
         select CPU_SUPPORTS_MSA
         select GENERIC_CSUM
-        select MIPS_O32_FP64_SUPPORT if MIPS32_O32
+        select MIPS_O32_FP64_SUPPORT if 32BIT || MIPS32_O32
         help
           Choose this option to build a kernel for release 6 or later of the
           MIPS64 architecture.  New MIPS processors, starting with the Warrior
diff --git a/arch/mips/ath79/common.c b/arch/mips/ath79/common.c
index 3cedd1f95e0f..8ae4067a5eda 100644
--- a/arch/mips/ath79/common.c
+++ b/arch/mips/ath79/common.c
@@ -76,14 +76,14 @@ void ath79_ddr_set_pci_windows(void)
 {
         BUG_ON(!ath79_ddr_pci_win_base);
 
-        __raw_writel(AR71XX_PCI_WIN0_OFFS, ath79_ddr_pci_win_base + 0);
-        __raw_writel(AR71XX_PCI_WIN1_OFFS, ath79_ddr_pci_win_base + 1);
-        __raw_writel(AR71XX_PCI_WIN2_OFFS, ath79_ddr_pci_win_base + 2);
-        __raw_writel(AR71XX_PCI_WIN3_OFFS, ath79_ddr_pci_win_base + 3);
-        __raw_writel(AR71XX_PCI_WIN4_OFFS, ath79_ddr_pci_win_base + 4);
-        __raw_writel(AR71XX_PCI_WIN5_OFFS, ath79_ddr_pci_win_base + 5);
-        __raw_writel(AR71XX_PCI_WIN6_OFFS, ath79_ddr_pci_win_base + 6);
-        __raw_writel(AR71XX_PCI_WIN7_OFFS, ath79_ddr_pci_win_base + 7);
+        __raw_writel(AR71XX_PCI_WIN0_OFFS, ath79_ddr_pci_win_base + 0x0);
+        __raw_writel(AR71XX_PCI_WIN1_OFFS, ath79_ddr_pci_win_base + 0x4);
+        __raw_writel(AR71XX_PCI_WIN2_OFFS, ath79_ddr_pci_win_base + 0x8);
+        __raw_writel(AR71XX_PCI_WIN3_OFFS, ath79_ddr_pci_win_base + 0xc);
+        __raw_writel(AR71XX_PCI_WIN4_OFFS, ath79_ddr_pci_win_base + 0x10);
+        __raw_writel(AR71XX_PCI_WIN5_OFFS, ath79_ddr_pci_win_base + 0x14);
+        __raw_writel(AR71XX_PCI_WIN6_OFFS, ath79_ddr_pci_win_base + 0x18);
+        __raw_writel(AR71XX_PCI_WIN7_OFFS, ath79_ddr_pci_win_base + 0x1c);
 }
 EXPORT_SYMBOL_GPL(ath79_ddr_set_pci_windows);
 
diff --git a/arch/mips/bcm47xx/buttons.c b/arch/mips/bcm47xx/buttons.c
index 52caa75bfe4e..e2f50d690624 100644
--- a/arch/mips/bcm47xx/buttons.c
+++ b/arch/mips/bcm47xx/buttons.c
@@ -17,6 +17,12 @@
                 .active_low     = 1,                                    \
         }
 
+#define BCM47XX_GPIO_KEY_H(_gpio, _code)                                \
+        {                                                               \
+                .code           = _code,                                \
+                .gpio           = _gpio,                                \
+        }
+
 /* Asus */
 
 static const struct gpio_keys_button
@@ -79,8 +85,8 @@ bcm47xx_buttons_asus_wl500gpv2[] __initconst = {
 
 static const struct gpio_keys_button
 bcm47xx_buttons_asus_wl500w[] __initconst = {
-        BCM47XX_GPIO_KEY(6, KEY_RESTART),
-        BCM47XX_GPIO_KEY(7, KEY_WPS_BUTTON),
+        BCM47XX_GPIO_KEY_H(6, KEY_RESTART),
+        BCM47XX_GPIO_KEY_H(7, KEY_WPS_BUTTON),
 };
 
 static const struct gpio_keys_button
diff --git a/arch/mips/cavium-octeon/octeon-memcpy.S b/arch/mips/cavium-octeon/octeon-memcpy.S
index 64e08df51d65..8b7004132491 100644
--- a/arch/mips/cavium-octeon/octeon-memcpy.S
+++ b/arch/mips/cavium-octeon/octeon-memcpy.S
@@ -208,18 +208,18 @@ EXC(	STORE	t2, UNIT(6)(dst),	s_exc_p10u)
         ADD     src, src, 16*NBYTES
 EXC(    STORE   t3, UNIT(7)(dst),       s_exc_p9u)
         ADD     dst, dst, 16*NBYTES
-EXC(    LOAD    t0, UNIT(-8)(src),      l_exc_copy)
-EXC(    LOAD    t1, UNIT(-7)(src),      l_exc_copy)
-EXC(    LOAD    t2, UNIT(-6)(src),      l_exc_copy)
-EXC(    LOAD    t3, UNIT(-5)(src),      l_exc_copy)
+EXC(    LOAD    t0, UNIT(-8)(src),      l_exc_copy_rewind16)
+EXC(    LOAD    t1, UNIT(-7)(src),      l_exc_copy_rewind16)
+EXC(    LOAD    t2, UNIT(-6)(src),      l_exc_copy_rewind16)
+EXC(    LOAD    t3, UNIT(-5)(src),      l_exc_copy_rewind16)
 EXC(    STORE   t0, UNIT(-8)(dst),      s_exc_p8u)
 EXC(    STORE   t1, UNIT(-7)(dst),      s_exc_p7u)
 EXC(    STORE   t2, UNIT(-6)(dst),      s_exc_p6u)
 EXC(    STORE   t3, UNIT(-5)(dst),      s_exc_p5u)
-EXC(    LOAD    t0, UNIT(-4)(src),      l_exc_copy)
-EXC(    LOAD    t1, UNIT(-3)(src),      l_exc_copy)
-EXC(    LOAD    t2, UNIT(-2)(src),      l_exc_copy)
-EXC(    LOAD    t3, UNIT(-1)(src),      l_exc_copy)
+EXC(    LOAD    t0, UNIT(-4)(src),      l_exc_copy_rewind16)
+EXC(    LOAD    t1, UNIT(-3)(src),      l_exc_copy_rewind16)
+EXC(    LOAD    t2, UNIT(-2)(src),      l_exc_copy_rewind16)
+EXC(    LOAD    t3, UNIT(-1)(src),      l_exc_copy_rewind16)
 EXC(    STORE   t0, UNIT(-4)(dst),      s_exc_p4u)
 EXC(    STORE   t1, UNIT(-3)(dst),      s_exc_p3u)
 EXC(    STORE   t2, UNIT(-2)(dst),      s_exc_p2u)
@@ -383,6 +383,10 @@ done:
          nop
         END(memcpy)
 
+l_exc_copy_rewind16:
+        /* Rewind src and dst by 16*NBYTES for l_exc_copy */
+        SUB     src, src, 16*NBYTES
+        SUB     dst, dst, 16*NBYTES
 l_exc_copy:
         /*
          * Copy bytes from src until faulting load address (or until a
diff --git a/arch/mips/configs/ip22_defconfig b/arch/mips/configs/ip22_defconfig
index 57ed466e00db..2f140d75d01c 100644
--- a/arch/mips/configs/ip22_defconfig
+++ b/arch/mips/configs/ip22_defconfig
@@ -68,8 +68,8 @@ CONFIG_NETFILTER_NETLINK_QUEUE=m
 CONFIG_NF_CONNTRACK=m
 CONFIG_NF_CONNTRACK_SECMARK=y
 CONFIG_NF_CONNTRACK_EVENTS=y
-CONFIG_NF_CT_PROTO_DCCP=m
-CONFIG_NF_CT_PROTO_UDPLITE=m
+CONFIG_NF_CT_PROTO_DCCP=y
+CONFIG_NF_CT_PROTO_UDPLITE=y
 CONFIG_NF_CONNTRACK_AMANDA=m
 CONFIG_NF_CONNTRACK_FTP=m
 CONFIG_NF_CONNTRACK_H323=m
diff --git a/arch/mips/configs/ip27_defconfig b/arch/mips/configs/ip27_defconfig
index 48e16d98b2cc..b15508447366 100644
--- a/arch/mips/configs/ip27_defconfig
+++ b/arch/mips/configs/ip27_defconfig
@@ -134,7 +134,7 @@ CONFIG_LIBFC=m
 CONFIG_SCSI_QLOGIC_1280=y
 CONFIG_SCSI_PMCRAID=m
 CONFIG_SCSI_BFA_FC=m
-CONFIG_SCSI_DH=m
+CONFIG_SCSI_DH=y
 CONFIG_SCSI_DH_RDAC=m
 CONFIG_SCSI_DH_HP_SW=m
 CONFIG_SCSI_DH_EMC=m
@@ -206,7 +206,6 @@ CONFIG_MLX4_EN=m
 # CONFIG_MLX4_DEBUG is not set
 CONFIG_TEHUTI=m
 CONFIG_BNX2X=m
-CONFIG_QLGE=m
 CONFIG_SFC=m
 CONFIG_BE2NET=m
 CONFIG_LIBERTAS_THINFIRM=m
diff --git a/arch/mips/configs/lemote2f_defconfig b/arch/mips/configs/lemote2f_defconfig
index 004cf52d1b7d..c24b87819ccb 100644
--- a/arch/mips/configs/lemote2f_defconfig
+++ b/arch/mips/configs/lemote2f_defconfig
@@ -39,7 +39,7 @@ CONFIG_HIBERNATION=y
 CONFIG_PM_STD_PARTITION="/dev/hda3"
 CONFIG_CPU_FREQ=y
 CONFIG_CPU_FREQ_DEBUG=y
-CONFIG_CPU_FREQ_STAT=m
+CONFIG_CPU_FREQ_STAT=y
 CONFIG_CPU_FREQ_STAT_DETAILS=y
 CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND=y
 CONFIG_CPU_FREQ_GOV_POWERSAVE=m
diff --git a/arch/mips/configs/malta_defconfig b/arch/mips/configs/malta_defconfig
index 5afb4840aec7..739ccd0dca64 100644
--- a/arch/mips/configs/malta_defconfig
+++ b/arch/mips/configs/malta_defconfig
@@ -59,8 +59,8 @@ CONFIG_NETFILTER=y
 CONFIG_NF_CONNTRACK=m
 CONFIG_NF_CONNTRACK_SECMARK=y
 CONFIG_NF_CONNTRACK_EVENTS=y
-CONFIG_NF_CT_PROTO_DCCP=m
-CONFIG_NF_CT_PROTO_UDPLITE=m
+CONFIG_NF_CT_PROTO_DCCP=y
+CONFIG_NF_CT_PROTO_UDPLITE=y
 CONFIG_NF_CONNTRACK_AMANDA=m
 CONFIG_NF_CONNTRACK_FTP=m
 CONFIG_NF_CONNTRACK_H323=m
diff --git a/arch/mips/configs/malta_kvm_defconfig b/arch/mips/configs/malta_kvm_defconfig
index 98f13879bb8f..47f4ecf125ba 100644
--- a/arch/mips/configs/malta_kvm_defconfig
+++ b/arch/mips/configs/malta_kvm_defconfig
@@ -60,8 +60,8 @@ CONFIG_NETFILTER=y
 CONFIG_NF_CONNTRACK=m
 CONFIG_NF_CONNTRACK_SECMARK=y
 CONFIG_NF_CONNTRACK_EVENTS=y
-CONFIG_NF_CT_PROTO_DCCP=m
-CONFIG_NF_CT_PROTO_UDPLITE=m
+CONFIG_NF_CT_PROTO_DCCP=y
+CONFIG_NF_CT_PROTO_UDPLITE=y
 CONFIG_NF_CONNTRACK_AMANDA=m
 CONFIG_NF_CONNTRACK_FTP=m
 CONFIG_NF_CONNTRACK_H323=m
diff --git a/arch/mips/configs/malta_kvm_guest_defconfig b/arch/mips/configs/malta_kvm_guest_defconfig
index 3b5d5913f548..e79d325aa085 100644
--- a/arch/mips/configs/malta_kvm_guest_defconfig
+++ b/arch/mips/configs/malta_kvm_guest_defconfig
@@ -59,8 +59,8 @@ CONFIG_NETFILTER=y
 CONFIG_NF_CONNTRACK=m
 CONFIG_NF_CONNTRACK_SECMARK=y
 CONFIG_NF_CONNTRACK_EVENTS=y
-CONFIG_NF_CT_PROTO_DCCP=m
-CONFIG_NF_CT_PROTO_UDPLITE=m
+CONFIG_NF_CT_PROTO_DCCP=y
+CONFIG_NF_CT_PROTO_UDPLITE=y
 CONFIG_NF_CONNTRACK_AMANDA=m
 CONFIG_NF_CONNTRACK_FTP=m
 CONFIG_NF_CONNTRACK_H323=m
diff --git a/arch/mips/configs/maltaup_xpa_defconfig b/arch/mips/configs/maltaup_xpa_defconfig
index 732215732751..ae87ad86243b 100644
--- a/arch/mips/configs/maltaup_xpa_defconfig
+++ b/arch/mips/configs/maltaup_xpa_defconfig
@@ -61,8 +61,8 @@ CONFIG_NETFILTER=y
 CONFIG_NF_CONNTRACK=m
 CONFIG_NF_CONNTRACK_SECMARK=y
 CONFIG_NF_CONNTRACK_EVENTS=y
-CONFIG_NF_CT_PROTO_DCCP=m
-CONFIG_NF_CT_PROTO_UDPLITE=m
+CONFIG_NF_CT_PROTO_DCCP=y
+CONFIG_NF_CT_PROTO_UDPLITE=y
 CONFIG_NF_CONNTRACK_AMANDA=m
 CONFIG_NF_CONNTRACK_FTP=m
 CONFIG_NF_CONNTRACK_H323=m
diff --git a/arch/mips/configs/nlm_xlp_defconfig b/arch/mips/configs/nlm_xlp_defconfig
index b3d1d37f85ea..47492fee2952 100644
--- a/arch/mips/configs/nlm_xlp_defconfig
+++ b/arch/mips/configs/nlm_xlp_defconfig
@@ -111,7 +111,7 @@ CONFIG_NETFILTER=y
 CONFIG_NF_CONNTRACK=m
 CONFIG_NF_CONNTRACK_SECMARK=y
 CONFIG_NF_CONNTRACK_EVENTS=y
-CONFIG_NF_CT_PROTO_UDPLITE=m
+CONFIG_NF_CT_PROTO_UDPLITE=y
 CONFIG_NF_CONNTRACK_AMANDA=m
 CONFIG_NF_CONNTRACK_FTP=m
 CONFIG_NF_CONNTRACK_H323=m
diff --git a/arch/mips/configs/nlm_xlr_defconfig b/arch/mips/configs/nlm_xlr_defconfig
index 3d8016d6cf3e..472a818f1eb8 100644
--- a/arch/mips/configs/nlm_xlr_defconfig
+++ b/arch/mips/configs/nlm_xlr_defconfig
@@ -91,7 +91,7 @@ CONFIG_NETFILTER=y
 CONFIG_NF_CONNTRACK=m
 CONFIG_NF_CONNTRACK_SECMARK=y
 CONFIG_NF_CONNTRACK_EVENTS=y
-CONFIG_NF_CT_PROTO_UDPLITE=m
+CONFIG_NF_CT_PROTO_UDPLITE=y
 CONFIG_NF_CONNTRACK_AMANDA=m
 CONFIG_NF_CONNTRACK_FTP=m
 CONFIG_NF_CONNTRACK_H323=m
diff --git a/arch/mips/dec/int-handler.S b/arch/mips/dec/int-handler.S
index 8c6f508e59de..554d1da97743 100644
--- a/arch/mips/dec/int-handler.S
+++ b/arch/mips/dec/int-handler.S
@@ -146,7 +146,25 @@
                 /*
                  * Find irq with highest priority
                  */
-                 PTR_LA t1,cpu_mask_nr_tbl
+                # open coded PTR_LA t1, cpu_mask_nr_tbl
+#if (_MIPS_SZPTR == 32)
+                # open coded la t1, cpu_mask_nr_tbl
+                lui     t1, %hi(cpu_mask_nr_tbl)
+                addiu   t1, %lo(cpu_mask_nr_tbl)
+
+#endif
+#if (_MIPS_SZPTR == 64)
+                # open coded dla t1, cpu_mask_nr_tbl
+                .set    push
+                .set    noat
+                lui     t1, %highest(cpu_mask_nr_tbl)
+                lui     AT, %hi(cpu_mask_nr_tbl)
+                daddiu  t1, t1, %higher(cpu_mask_nr_tbl)
+                daddiu  AT, AT, %lo(cpu_mask_nr_tbl)
+                dsll    t1, 32
+                daddu   t1, t1, AT
+                .set    pop
+#endif
 1:              lw      t2,(t1)
                 nop
                 and     t2,t0
@@ -195,7 +213,25 @@
                 /*
                  * Find irq with highest priority
                  */
-                 PTR_LA t1,asic_mask_nr_tbl
+                # open coded PTR_LA t1,asic_mask_nr_tbl
+#if (_MIPS_SZPTR == 32)
+                # open coded la t1, asic_mask_nr_tbl
+                lui     t1, %hi(asic_mask_nr_tbl)
+                addiu   t1, %lo(asic_mask_nr_tbl)
+
+#endif
+#if (_MIPS_SZPTR == 64)
+                # open coded dla t1, asic_mask_nr_tbl
+                .set    push
+                .set    noat
+                lui     t1, %highest(asic_mask_nr_tbl)
+                lui     AT, %hi(asic_mask_nr_tbl)
+                daddiu  t1, t1, %higher(asic_mask_nr_tbl)
+                daddiu  AT, AT, %lo(asic_mask_nr_tbl)
+                dsll    t1, 32
+                daddu   t1, t1, AT
+                .set    pop
+#endif
 2:              lw      t2,(t1)
                 nop
                 and     t2,t0
diff --git a/arch/mips/include/asm/branch.h b/arch/mips/include/asm/branch.h
index de781cf54bc7..da80878f2c0d 100644
--- a/arch/mips/include/asm/branch.h
+++ b/arch/mips/include/asm/branch.h
@@ -74,10 +74,7 @@ static inline int compute_return_epc(struct pt_regs *regs)
                         return __microMIPS_compute_return_epc(regs);
                 if (cpu_has_mips16)
                         return __MIPS16e_compute_return_epc(regs);
-                return regs->cp0_epc;
-        }
-
-        if (!delay_slot(regs)) {
+        } else if (!delay_slot(regs)) {
                 regs->cp0_epc += 4;
                 return 0;
         }
diff --git a/arch/mips/include/asm/checksum.h b/arch/mips/include/asm/checksum.h
index 3ceacde5eb6e..17f89f9670b2 100644
--- a/arch/mips/include/asm/checksum.h
+++ b/arch/mips/include/asm/checksum.h
@@ -186,7 +186,9 @@ static inline __wsum csum_tcpudp_nofold(__be32 saddr,
         "       daddu   %0, %4          \n"
         "       dsll32  $1, %0, 0       \n"
         "       daddu   %0, $1          \n"
+        "       sltu    $1, %0, $1      \n"
         "       dsra32  %0, %0, 0       \n"
+        "       addu    %0, $1          \n"
 #endif
         "       .set    pop"
         : "=r" (sum)
diff --git a/arch/mips/include/asm/irq.h b/arch/mips/include/asm/irq.h
index 15e0fecbc300..ebb9efb02502 100644
--- a/arch/mips/include/asm/irq.h
+++ b/arch/mips/include/asm/irq.h
@@ -17,6 +17,18 @@
 
 #include <irq.h>
 
+#define IRQ_STACK_SIZE                  THREAD_SIZE
+
+extern void *irq_stack[NR_CPUS];
+
+static inline bool on_irq_stack(int cpu, unsigned long sp)
+{
+        unsigned long low = (unsigned long)irq_stack[cpu];
+        unsigned long high = low + IRQ_STACK_SIZE;
+
+        return (low <= sp && sp <= high);
+}
+
 #ifdef CONFIG_I8259
 static inline int irq_canonicalize(int irq)
 {
diff --git a/arch/mips/include/asm/spinlock.h b/arch/mips/include/asm/spinlock.h
index 40196bebe849..2365ce0ad8f2 100644
--- a/arch/mips/include/asm/spinlock.h
+++ b/arch/mips/include/asm/spinlock.h
@@ -112,7 +112,7 @@ static inline void arch_spin_lock(arch_spinlock_t *lock)
                 "       andi    %[ticket], %[ticket], 0xffff            \n"
                 "       bne     %[ticket], %[my_ticket], 4f             \n"
                 "        subu   %[ticket], %[my_ticket], %[ticket]      \n"
-                "2:                                                     \n"
+                "2:     .insn                                           \n"
                 "       .subsection 2                                   \n"
                 "4:     andi    %[ticket], %[ticket], 0xffff            \n"
                 "       sll     %[ticket], 5                            \n"
@@ -187,7 +187,7 @@ static inline unsigned int arch_spin_trylock(arch_spinlock_t *lock)
                 "       sc      %[ticket], %[ticket_ptr]                \n"
                 "       beqz    %[ticket], 1b                           \n"
                 "        li     %[ticket], 1                            \n"
-                "2:                                                     \n"
+                "2:     .insn                                           \n"
                 "       .subsection 2                                   \n"
                 "3:     b       2b                                      \n"
                 "        li     %[ticket], 0                            \n"
@@ -367,7 +367,7 @@ static inline int arch_read_trylock(arch_rwlock_t *rw)
                 "       .set    reorder                                 \n"
                 __WEAK_LLSC_MB
                 "       li      %2, 1                                   \n"
-                "2:                                                     \n"
+                "2:     .insn                                           \n"
                 : "=" GCC_OFF_SMALL_ASM() (rw->lock), "=&r" (tmp), "=&r" (ret)
                 : GCC_OFF_SMALL_ASM() (rw->lock)
                 : "memory");
@@ -407,7 +407,7 @@ static inline int arch_write_trylock(arch_rwlock_t *rw)
                         "       lui     %1, 0x8000                      \n"
                         "       sc      %1, %0                          \n"
                         "       li      %2, 1                           \n"
-                        "2:                                             \n"
+                        "2:     .insn                                   \n"
                         : "=" GCC_OFF_SMALL_ASM() (rw->lock), "=&r" (tmp),
                           "=&r" (ret)
                         : GCC_OFF_SMALL_ASM() (rw->lock)
diff --git a/arch/mips/include/asm/stackframe.h b/arch/mips/include/asm/stackframe.h
index a71da576883c..5347f130f536 100644
--- a/arch/mips/include/asm/stackframe.h
+++ b/arch/mips/include/asm/stackframe.h
@@ -216,12 +216,19 @@
                 LONG_S  $25, PT_R25(sp)
                 LONG_S  $28, PT_R28(sp)
                 LONG_S  $31, PT_R31(sp)
+
+                /* Set thread_info if we're coming from user mode */
+                mfc0    k0, CP0_STATUS
+                sll     k0, 3           /* extract cu0 bit */
+                bltz    k0, 9f
+
                 ori     $28, sp, _THREAD_MASK
                 xori    $28, _THREAD_MASK
 #ifdef CONFIG_CPU_CAVIUM_OCTEON
                 .set    mips64
                 pref    0, 0($28)       /* Prefetch the current pointer */
 #endif
+9:
                 .set    pop
                 .endm
 
diff --git a/arch/mips/kernel/asm-offsets.c b/arch/mips/kernel/asm-offsets.c
index 154e2039ea5e..ec053ce7bb38 100644
--- a/arch/mips/kernel/asm-offsets.c
+++ b/arch/mips/kernel/asm-offsets.c
@@ -101,6 +101,7 @@ void output_thread_info_defines(void)
         OFFSET(TI_REGS, thread_info, regs);
         DEFINE(_THREAD_SIZE, THREAD_SIZE);
         DEFINE(_THREAD_MASK, THREAD_MASK);
+        DEFINE(_IRQ_STACK_SIZE, IRQ_STACK_SIZE);
         BLANK();
 }
 
diff --git a/arch/mips/kernel/branch.c b/arch/mips/kernel/branch.c
index d8f9b357b222..71e8f4c0b8da 100644
--- a/arch/mips/kernel/branch.c
+++ b/arch/mips/kernel/branch.c
@@ -399,7 +399,7 @@ int __MIPS16e_compute_return_epc(struct pt_regs *regs)
  *
  * @regs:       Pointer to pt_regs
  * @insn:       branch instruction to decode
- * @returns:    -EFAULT on error and forces SIGBUS, and on success
+ * @returns:    -EFAULT on error and forces SIGILL, and on success
  *              returns 0 or BRANCH_LIKELY_TAKEN as appropriate after
  *              evaluating the branch.
  *
@@ -431,7 +431,7 @@ int __compute_return_epc_for_insn(struct pt_regs *regs,
                         /* Fall through */
                 case jr_op:
                         if (NO_R6EMU && insn.r_format.func == jr_op)
-                                goto sigill_r6;
+                                goto sigill_r2r6;
                         regs->cp0_epc = regs->regs[insn.r_format.rs];
                         break;
                 }
@@ -446,7 +446,7 @@ int __compute_return_epc_for_insn(struct pt_regs *regs,
                 switch (insn.i_format.rt) {
                 case bltzl_op:
                         if (NO_R6EMU)
-                                goto sigill_r6;
+                                goto sigill_r2r6;
                 case bltz_op:
                         if ((long)regs->regs[insn.i_format.rs] < 0) {
                                 epc = epc + 4 + (insn.i_format.simmediate << 2);
@@ -459,7 +459,7 @@ int __compute_return_epc_for_insn(struct pt_regs *regs,
 
                 case bgezl_op:
                         if (NO_R6EMU)
-                                goto sigill_r6;
+                                goto sigill_r2r6;
                 case bgez_op:
                         if ((long)regs->regs[insn.i_format.rs] >= 0) {
                                 epc = epc + 4 + (insn.i_format.simmediate << 2);
@@ -473,10 +473,8 @@ int __compute_return_epc_for_insn(struct pt_regs *regs,
                 case bltzal_op:
                 case bltzall_op:
                         if (NO_R6EMU && (insn.i_format.rs ||
-                            insn.i_format.rt == bltzall_op)) {
-                                ret = -SIGILL;
-                                break;
-                        }
+                            insn.i_format.rt == bltzall_op))
+                                goto sigill_r2r6;
                         regs->regs[31] = epc + 8;
                         /*
                          * OK we are here either because we hit a NAL
@@ -507,10 +505,8 @@ int __compute_return_epc_for_insn(struct pt_regs *regs,
                 case bgezal_op:
                 case bgezall_op:
                         if (NO_R6EMU && (insn.i_format.rs ||
-                            insn.i_format.rt == bgezall_op)) {
-                                ret = -SIGILL;
-                                break;
-                        }
+                            insn.i_format.rt == bgezall_op))
+                                goto sigill_r2r6;
                         regs->regs[31] = epc + 8;
                         /*
                          * OK we are here either because we hit a BAL
@@ -556,6 +552,7 @@ int __compute_return_epc_for_insn(struct pt_regs *regs,
         /*
          * These are unconditional and in j_format.
          */
+        case jalx_op:
         case jal_op:
                 regs->regs[31] = regs->cp0_epc + 8;
         case j_op:
@@ -573,7 +570,7 @@ int __compute_return_epc_for_insn(struct pt_regs *regs,
          */
         case beql_op:
                 if (NO_R6EMU)
-                        goto sigill_r6;
+                        goto sigill_r2r6;
         case beq_op:
                 if (regs->regs[insn.i_format.rs] ==
                     regs->regs[insn.i_format.rt]) {
@@ -587,7 +584,7 @@ int __compute_return_epc_for_insn(struct pt_regs *regs,
 
         case bnel_op:
                 if (NO_R6EMU)
-                        goto sigill_r6;
+                        goto sigill_r2r6;
         case bne_op:
                 if (regs->regs[insn.i_format.rs] !=
                     regs->regs[insn.i_format.rt]) {
@@ -601,7 +598,7 @@ int __compute_return_epc_for_insn(struct pt_regs *regs,
 
         case blezl_op: /* not really i_format */
                 if (!insn.i_format.rt && NO_R6EMU)
-                        goto sigill_r6;
+                        goto sigill_r2r6;
         case blez_op:
                 /*
                  * Compact branches for R6 for the
@@ -636,7 +633,7 @@ int __compute_return_epc_for_insn(struct pt_regs *regs,
 
         case bgtzl_op:
                 if (!insn.i_format.rt && NO_R6EMU)
-                        goto sigill_r6;
+                        goto sigill_r2r6;
         case bgtz_op:
                 /*
                  * Compact branches for R6 for the
@@ -816,8 +813,10 @@ int __compute_return_epc_for_insn(struct pt_regs *regs,
                         break;
                 }
                 /* Compact branch: BNEZC || JIALC */
-                if (insn.i_format.rs)
+                if (!insn.i_format.rs) {
+                        /* JIALC: set $31/ra */
                         regs->regs[31] = epc + 4;
+                }
                 regs->cp0_epc += 8;
                 break;
 #endif
@@ -841,11 +840,12 @@ int __compute_return_epc_for_insn(struct pt_regs *regs,
         return ret;
 
 sigill_dsp:
-        printk("%s: DSP branch but not DSP ASE - sending SIGBUS.\n", current->comm);
-        force_sig(SIGBUS, current);
+        pr_info("%s: DSP branch but not DSP ASE - sending SIGILL.\n",
+                current->comm);
+        force_sig(SIGILL, current);
         return -EFAULT;
-sigill_r6:
-        pr_info("%s: R2 branch but r2-to-r6 emulator is not preset - sending SIGILL.\n",
+sigill_r2r6:
+        pr_info("%s: R2 branch but r2-to-r6 emulator is not present - sending SIGILL.\n",
                 current->comm);
         force_sig(SIGILL, current);
         return -EFAULT;
diff --git a/arch/mips/kernel/crash.c b/arch/mips/kernel/crash.c
index d434d5d5ae6e..610f0f3bdb34 100644
--- a/arch/mips/kernel/crash.c
+++ b/arch/mips/kernel/crash.c
@@ -14,12 +14,22 @@ static int crashing_cpu = -1;
 static cpumask_t cpus_in_crash = CPU_MASK_NONE;
 
 #ifdef CONFIG_SMP
-static void crash_shutdown_secondary(void *ignore)
+static void crash_shutdown_secondary(void *passed_regs)
 {
-        struct pt_regs *regs;
+        struct pt_regs *regs = passed_regs;
         int cpu = smp_processor_id();
 
-        regs = task_pt_regs(current);
+        /*
+         * If we are passed registers, use those.  Otherwise get the
+         * regs from the last interrupt, which should be correct, as
+         * we are in an interrupt.  But if the regs are not there,
+         * pull them from the top of the stack.  They are probably
+         * wrong, but we need something to keep from crashing again.
+         */
+        if (!regs)
+                regs = get_irq_regs();
+        if (!regs)
+                regs = task_pt_regs(current);
 
         if (!cpu_online(cpu))
                 return;
diff --git a/arch/mips/kernel/elf.c b/arch/mips/kernel/elf.c
index 4a4d9e067c89..3afffc30ee12 100644
--- a/arch/mips/kernel/elf.c
+++ b/arch/mips/kernel/elf.c
@@ -206,7 +206,7 @@ int arch_check_elf(void *_ehdr, bool has_interpreter,
         else if ((prog_req.fr1 && prog_req.frdefault) ||
                  (prog_req.single && !prog_req.frdefault))
                 /* Make sure 64-bit MIPS III/IV/64R1 will not pick FR1 */
-                state->overall_fp_mode = ((current_cpu_data.fpu_id & MIPS_FPIR_F64) &&
+                state->overall_fp_mode = ((raw_current_cpu_data.fpu_id & MIPS_FPIR_F64) &&
                                           cpu_has_mips_r2_r6) ?
                                           FP_FR1 : FP_FR0;
         else if (prog_req.fr1)
diff --git a/arch/mips/kernel/entry.S b/arch/mips/kernel/entry.S
index 7791840cf22c..db07793f7b43 100644
--- a/arch/mips/kernel/entry.S
+++ b/arch/mips/kernel/entry.S
@@ -11,6 +11,7 @@
 #include <asm/asm.h>
 #include <asm/asmmacro.h>
 #include <asm/compiler.h>
+#include <asm/irqflags.h>
 #include <asm/regdef.h>
 #include <asm/mipsregs.h>
 #include <asm/stackframe.h>
@@ -137,6 +138,7 @@ work_pending:
         andi    t0, a2, _TIF_NEED_RESCHED # a2 is preloaded with TI_FLAGS
         beqz    t0, work_notifysig
 work_resched:
+        TRACE_IRQS_OFF
         jal     schedule
 
         local_irq_disable               # make sure need_resched and
@@ -173,6 +175,7 @@ syscall_exit_work:
         beqz    t0, work_pending        # trace bit set?
         local_irq_enable                # could let syscall_trace_leave()
                                         # call schedule() instead
+        TRACE_IRQS_ON
         move    a0, sp
         jal     syscall_trace_leave
         b       resume_userspace
diff --git a/arch/mips/kernel/genex.S b/arch/mips/kernel/genex.S
index baa7b6fc0a60..619e30e2c4f0 100644
--- a/arch/mips/kernel/genex.S
+++ b/arch/mips/kernel/genex.S
@@ -188,9 +188,44 @@ NESTED(handle_int, PT_SIZE, sp)
 
         LONG_L  s0, TI_REGS($28)
         LONG_S  sp, TI_REGS($28)
-        PTR_LA  ra, ret_from_irq
-        PTR_LA  v0, plat_irq_dispatch
-        jr      v0
+
+        /*
+         * SAVE_ALL ensures we are using a valid kernel stack for the thread.
+         * Check if we are already using the IRQ stack.
+         */
+        move    s1, sp # Preserve the sp
+
+        /* Get IRQ stack for this CPU */
+        ASM_CPUID_MFC0  k0, ASM_SMP_CPUID_REG
+#if defined(CONFIG_32BIT) || defined(KBUILD_64BIT_SYM32)
+        lui     k1, %hi(irq_stack)
+#else
+        lui     k1, %highest(irq_stack)
+        daddiu  k1, %higher(irq_stack)
+        dsll    k1, 16
+        daddiu  k1, %hi(irq_stack)
+        dsll    k1, 16
+#endif
+        LONG_SRL        k0, SMP_CPUID_PTRSHIFT
+        LONG_ADDU       k1, k0
+        LONG_L  t0, %lo(irq_stack)(k1)
+
+        # Check if already on IRQ stack
+        PTR_LI  t1, ~(_THREAD_SIZE-1)
+        and     t1, t1, sp
+        beq     t0, t1, 2f
+
+        /* Switch to IRQ stack */
+        li      t1, _IRQ_STACK_SIZE
+        PTR_ADD sp, t0, t1
+
+2:
+        jal     plat_irq_dispatch
+
+        /* Restore sp */
+        move    sp, s1
+
+        j       ret_from_irq
 #ifdef CONFIG_CPU_MICROMIPS
         nop
 #endif
@@ -263,8 +298,44 @@ NESTED(except_vec_vi_handler, 0, sp)
 
         LONG_L  s0, TI_REGS($28)
         LONG_S  sp, TI_REGS($28)
-        PTR_LA  ra, ret_from_irq
-        jr      v0
+
+        /*
+         * SAVE_ALL ensures we are using a valid kernel stack for the thread.
+         * Check if we are already using the IRQ stack.
+         */
+        move    s1, sp # Preserve the sp
+
+        /* Get IRQ stack for this CPU */
+        ASM_CPUID_MFC0  k0, ASM_SMP_CPUID_REG
+#if defined(CONFIG_32BIT) || defined(KBUILD_64BIT_SYM32)
+        lui     k1, %hi(irq_stack)
+#else
+        lui     k1, %highest(irq_stack)
+        daddiu  k1, %higher(irq_stack)
+        dsll    k1, 16
+        daddiu  k1, %hi(irq_stack)
+        dsll    k1, 16
+#endif
+        LONG_SRL        k0, SMP_CPUID_PTRSHIFT
+        LONG_ADDU       k1, k0
+        LONG_L  t0, %lo(irq_stack)(k1)
+
+        # Check if already on IRQ stack
+        PTR_LI  t1, ~(_THREAD_SIZE-1)
+        and     t1, t1, sp
+        beq     t0, t1, 2f
+
+        /* Switch to IRQ stack */
+        li      t1, _IRQ_STACK_SIZE
+        PTR_ADD sp, t0, t1
+
+2:
+        jalr    v0
+
+        /* Restore sp */
+        move    sp, s1
+
+        j       ret_from_irq
         END(except_vec_vi_handler)
 
 /*
diff --git a/arch/mips/kernel/irq.c b/arch/mips/kernel/irq.c
index 8eb5af805964..dc1180a8bfa1 100644
--- a/arch/mips/kernel/irq.c
+++ b/arch/mips/kernel/irq.c
@@ -25,6 +25,8 @@
 #include <linux/atomic.h>
 #include <asm/uaccess.h>
 
+void *irq_stack[NR_CPUS];
+
 /*
  * 'what should we do if we get a hw irq event on an illegal vector'.
  * each architecture has to answer this themselves.
@@ -55,6 +57,15 @@ void __init init_IRQ(void)
                 irq_set_noprobe(i);
 
         arch_init_irq();
+
+        for_each_possible_cpu(i) {
+                int irq_pages = IRQ_STACK_SIZE / PAGE_SIZE;
+                void *s = (void *)__get_free_pages(GFP_KERNEL, irq_pages);
+
+                irq_stack[i] = s;
+                pr_debug("CPU%d IRQ stack at 0x%p - 0x%p\n", i,
+                        irq_stack[i], irq_stack[i] + IRQ_STACK_SIZE);
+        }
 }
 
 #ifdef CONFIG_DEBUG_STACKOVERFLOW
diff --git a/arch/mips/kernel/kgdb.c b/arch/mips/kernel/kgdb.c
index de63d36af895..732d6171ac6a 100644
--- a/arch/mips/kernel/kgdb.c
+++ b/arch/mips/kernel/kgdb.c
@@ -244,9 +244,6 @@ static int compute_signal(int tt)
 void sleeping_thread_to_gdb_regs(unsigned long *gdb_regs, struct task_struct *p)
 {
         int reg;
-        struct thread_info *ti = task_thread_info(p);
-        unsigned long ksp = (unsigned long)ti + THREAD_SIZE - 32;
-        struct pt_regs *regs = (struct pt_regs *)ksp - 1;
 #if (KGDB_GDB_REG_SIZE == 32)
         u32 *ptr = (u32 *)gdb_regs;
 #else
@@ -254,25 +251,46 @@ void sleeping_thread_to_gdb_regs(unsigned long *gdb_regs, struct task_struct *p)
 #endif
 
         for (reg = 0; reg < 16; reg++)
-                *(ptr++) = regs->regs[reg];
+                *(ptr++) = 0;
 
         /* S0 - S7 */
-        for (reg = 16; reg < 24; reg++)
-                *(ptr++) = regs->regs[reg];
+        *(ptr++) = p->thread.reg16;
+        *(ptr++) = p->thread.reg17;
+        *(ptr++) = p->thread.reg18;
+        *(ptr++) = p->thread.reg19;
+        *(ptr++) = p->thread.reg20;
+        *(ptr++) = p->thread.reg21;
+        *(ptr++) = p->thread.reg22;
+        *(ptr++) = p->thread.reg23;
 
         for (reg = 24; reg < 28; reg++)
                 *(ptr++) = 0;
 
         /* GP, SP, FP, RA */
-        for (reg = 28; reg < 32; reg++)
-                *(ptr++) = regs->regs[reg];
-
-        *(ptr++) = regs->cp0_status;
-        *(ptr++) = regs->lo;
-        *(ptr++) = regs->hi;
-        *(ptr++) = regs->cp0_badvaddr;
-        *(ptr++) = regs->cp0_cause;
-        *(ptr++) = regs->cp0_epc;
+        *(ptr++) = (long)p;
+        *(ptr++) = p->thread.reg29;
+        *(ptr++) = p->thread.reg30;
+        *(ptr++) = p->thread.reg31;
+
+        *(ptr++) = p->thread.cp0_status;
+
+        /* lo, hi */
+        *(ptr++) = 0;
+        *(ptr++) = 0;
+
+        /*
+         * BadVAddr, Cause
+         * Ideally these would come from the last exception frame up the stack
+         * but that requires unwinding, otherwise we can't know much for sure.
+         */
+        *(ptr++) = 0;
+        *(ptr++) = 0;
+
+        /*
+         * PC
+         * use return address (RA), i.e. the moment after return from resume()
+         */
+        *(ptr++) = p->thread.reg31;
 }
 
 void kgdb_arch_set_pc(struct pt_regs *regs, unsigned long pc)
diff --git a/arch/mips/kernel/mips-r2-to-r6-emul.c b/arch/mips/kernel/mips-r2-to-r6-emul.c
index af27334d6809..e3384065f5e7 100644
--- a/arch/mips/kernel/mips-r2-to-r6-emul.c
+++ b/arch/mips/kernel/mips-r2-to-r6-emul.c
@@ -434,8 +434,8 @@ static int multu_func(struct pt_regs *regs, u32 ir)
         rs = regs->regs[MIPSInst_RS(ir)];
         res = (u64)rt * (u64)rs;
         rt = res;
-        regs->lo = (s64)rt;
-        regs->hi = (s64)(res >> 32);
+        regs->lo = (s64)(s32)rt;
+        regs->hi = (s64)(s32)(res >> 32);
 
         MIPS_R2_STATS(muls);
 
@@ -671,9 +671,9 @@ static int maddu_func(struct pt_regs *regs, u32 ir)
         res += ((((s64)rt) << 32) | (u32)rs);
 
         rt = res;
-        regs->lo = (s64)rt;
+        regs->lo = (s64)(s32)rt;
         rs = res >> 32;
-        regs->hi = (s64)rs;
+        regs->hi = (s64)(s32)rs;
 
         MIPS_R2_STATS(dsps);
 
@@ -729,9 +729,9 @@ static int msubu_func(struct pt_regs *regs, u32 ir)
         res = ((((s64)rt) << 32) | (u32)rs) - res;
 
         rt = res;
-        regs->lo = (s64)rt;
+        regs->lo = (s64)(s32)rt;
         rs = res >> 32;
-        regs->hi = (s64)rs;
+        regs->hi = (s64)(s32)rs;
 
         MIPS_R2_STATS(dsps);
 
diff --git a/arch/mips/kernel/pm-cps.c b/arch/mips/kernel/pm-cps.c
index f63a289977cc..0b3e58a3189f 100644
--- a/arch/mips/kernel/pm-cps.c
+++ b/arch/mips/kernel/pm-cps.c
@@ -55,7 +55,6 @@ DECLARE_BITMAP(state_support, CPS_PM_STATE_COUNT);
  * state. Actually per-core rather than per-CPU.
  */
 static DEFINE_PER_CPU_ALIGNED(u32*, ready_count);
-static DEFINE_PER_CPU_ALIGNED(void*, ready_count_alloc);
 
 /* Indicates online CPUs coupled with the current CPU */
 static DEFINE_PER_CPU_ALIGNED(cpumask_t, online_coupled);
@@ -625,7 +624,6 @@ static int __init cps_gen_core_entries(unsigned cpu)
 {
         enum cps_pm_state state;
         unsigned core = cpu_data[cpu].core;
-        unsigned dlinesz = cpu_data[cpu].dcache.linesz;
         void *entry_fn, *core_rc;
 
         for (state = CPS_PM_NC_WAIT; state < CPS_PM_STATE_COUNT; state++) {
@@ -645,16 +643,11 @@ static int __init cps_gen_core_entries(unsigned cpu)
         }
 
         if (!per_cpu(ready_count, core)) {
-                core_rc = kmalloc(dlinesz * 2, GFP_KERNEL);
+                core_rc = kmalloc(sizeof(u32), GFP_KERNEL);
                 if (!core_rc) {
                         pr_err("Failed allocate core %u ready_count\n", core);
                         return -ENOMEM;
                 }
-                per_cpu(ready_count_alloc, core) = core_rc;
-
-                /* Ensure ready_count is aligned to a cacheline boundary */
-                core_rc += dlinesz - 1;
-                core_rc = (void *)((unsigned long)core_rc & ~(dlinesz - 1));
                 per_cpu(ready_count, core) = core_rc;
         }
 
diff --git a/arch/mips/kernel/proc.c b/arch/mips/kernel/proc.c
index 298b2b773d12..f1fab6ff53e6 100644
--- a/arch/mips/kernel/proc.c
+++ b/arch/mips/kernel/proc.c
@@ -83,7 +83,7 @@ static int show_cpuinfo(struct seq_file *m, void *v)
         }
 
         seq_printf(m, "isa\t\t\t:"); 
-        if (cpu_has_mips_r1)
+        if (cpu_has_mips_1)
                 seq_printf(m, " mips1");
         if (cpu_has_mips_2)
                 seq_printf(m, "%s", " mips2");
diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c
index 44a6f25e902e..8c26ecac930d 100644
--- a/arch/mips/kernel/process.c
+++ b/arch/mips/kernel/process.c
@@ -32,6 +32,7 @@
 #include <asm/cpu.h>
 #include <asm/dsp.h>
 #include <asm/fpu.h>
+#include <asm/irq.h>
 #include <asm/msa.h>
 #include <asm/pgtable.h>
 #include <asm/mipsregs.h>
@@ -191,11 +192,9 @@ struct mips_frame_info {
 #define J_TARGET(pc,target)     \
                 (((unsigned long)(pc) & 0xf0000000) | ((target) << 2))
 
-static inline int is_ra_save_ins(union mips_instruction *ip)
+static inline int is_ra_save_ins(union mips_instruction *ip, int *poff)
 {
 #ifdef CONFIG_CPU_MICROMIPS
-        union mips_instruction mmi;
-
         /*
          * swsp ra,offset
          * swm16 reglist,offset(sp)
@@ -205,29 +204,71 @@ static inline int is_ra_save_ins(union mips_instruction *ip)
          *
          * microMIPS is way more fun...
          */
-        if (mm_insn_16bit(ip->halfword[0])) {
-                mmi.word = (ip->halfword[0] << 16);
-                return (mmi.mm16_r5_format.opcode == mm_swsp16_op &&
-                        mmi.mm16_r5_format.rt == 31) ||
-                       (mmi.mm16_m_format.opcode == mm_pool16c_op &&
-                        mmi.mm16_m_format.func == mm_swm16_op);
+        if (mm_insn_16bit(ip->halfword[1])) {
+                switch (ip->mm16_r5_format.opcode) {
+                case mm_swsp16_op:
+                        if (ip->mm16_r5_format.rt != 31)
+                                return 0;
+
+                        *poff = ip->mm16_r5_format.simmediate;
+                        *poff = (*poff << 2) / sizeof(ulong);
+                        return 1;
+
+                case mm_pool16c_op:
+                        switch (ip->mm16_m_format.func) {
+                        case mm_swm16_op:
+                                *poff = ip->mm16_m_format.imm;
+                                *poff += 1 + ip->mm16_m_format.rlist;
+                                *poff = (*poff << 2) / sizeof(ulong);
+                                return 1;
+
+                        default:
+                                return 0;
+                        }
+
+                default:
+                        return 0;
+                }
         }
-        else {
-                mmi.halfword[0] = ip->halfword[1];
-                mmi.halfword[1] = ip->halfword[0];
-                return (mmi.mm_m_format.opcode == mm_pool32b_op &&
-                        mmi.mm_m_format.rd > 9 &&
-                        mmi.mm_m_format.base == 29 &&
-                        mmi.mm_m_format.func == mm_swm32_func) ||
-                       (mmi.i_format.opcode == mm_sw32_op &&
-                        mmi.i_format.rs == 29 &&
-                        mmi.i_format.rt == 31);
+
+        switch (ip->i_format.opcode) {
+        case mm_sw32_op:
+                if (ip->i_format.rs != 29)
+                        return 0;
+                if (ip->i_format.rt != 31)
+                        return 0;
+
+                *poff = ip->i_format.simmediate / sizeof(ulong);
+                return 1;
+
+        case mm_pool32b_op:
+                switch (ip->mm_m_format.func) {
+                case mm_swm32_func:
+                        if (ip->mm_m_format.rd < 0x10)
+                                return 0;
+                        if (ip->mm_m_format.base != 29)
+                                return 0;
+
+                        *poff = ip->mm_m_format.simmediate;
+                        *poff += (ip->mm_m_format.rd & 0xf) * sizeof(u32);
+                        *poff /= sizeof(ulong);
+                        return 1;
+                default:
+                        return 0;
+                }
+
+        default:
+                return 0;
         }
 #else
         /* sw / sd $ra, offset($sp) */
-        return (ip->i_format.opcode == sw_op || ip->i_format.opcode == sd_op) &&
-                ip->i_format.rs == 29 &&
-                ip->i_format.rt == 31;
+        if ((ip->i_format.opcode == sw_op || ip->i_format.opcode == sd_op) &&
+                ip->i_format.rs == 29 && ip->i_format.rt == 31) {
+                *poff = ip->i_format.simmediate / sizeof(ulong);
+                return 1;
+        }
+
+        return 0;
 #endif
 }
 
@@ -242,13 +283,16 @@ static inline int is_jump_ins(union mips_instruction *ip)
          *
          * microMIPS is kind of more fun...
          */
-        union mips_instruction mmi;
-
-        mmi.word = (ip->halfword[0] << 16);
+        if (mm_insn_16bit(ip->halfword[1])) {
+                if ((ip->mm16_r5_format.opcode == mm_pool16c_op &&
+                    (ip->mm16_r5_format.rt & mm_jr16_op) == mm_jr16_op))
+                        return 1;
+                return 0;
+        }
 
-        if ((mmi.mm16_r5_format.opcode == mm_pool16c_op &&
-            (mmi.mm16_r5_format.rt & mm_jr16_op) == mm_jr16_op) ||
-            ip->j_format.opcode == mm_jal32_op)
+        if (ip->j_format.opcode == mm_j32_op)
+                return 1;
+        if (ip->j_format.opcode == mm_jal32_op)
                 return 1;
         if (ip->r_format.opcode != mm_pool32a_op ||
                         ip->r_format.func != mm_pool32axf_op)
@@ -276,15 +320,13 @@ static inline int is_sp_move_ins(union mips_instruction *ip)
          *
          * microMIPS is not more fun...
          */
-        if (mm_insn_16bit(ip->halfword[0])) {
-                union mips_instruction mmi;
-
-                mmi.word = (ip->halfword[0] << 16);
-                return (mmi.mm16_r3_format.opcode == mm_pool16d_op &&
-                        mmi.mm16_r3_format.simmediate && mm_addiusp_func) ||
-                       (mmi.mm16_r5_format.opcode == mm_pool16d_op &&
-                        mmi.mm16_r5_format.rt == 29);
+        if (mm_insn_16bit(ip->halfword[1])) {
+                return (ip->mm16_r3_format.opcode == mm_pool16d_op &&
+                        ip->mm16_r3_format.simmediate && mm_addiusp_func) ||
+                       (ip->mm16_r5_format.opcode == mm_pool16d_op &&
+                        ip->mm16_r5_format.rt == 29);
         }
+
         return ip->mm_i_format.opcode == mm_addiu32_op &&
                ip->mm_i_format.rt == 29 && ip->mm_i_format.rs == 29;
 #else
@@ -299,30 +341,36 @@ static inline int is_sp_move_ins(union mips_instruction *ip)
 
 static int get_frame_info(struct mips_frame_info *info)
 {
-#ifdef CONFIG_CPU_MICROMIPS
-        union mips_instruction *ip = (void *) (((char *) info->func) - 1);
-#else
-        union mips_instruction *ip = info->func;
-#endif
-        unsigned max_insns = info->func_size / sizeof(union mips_instruction);
-        unsigned i;
+        bool is_mmips = IS_ENABLED(CONFIG_CPU_MICROMIPS);
+        union mips_instruction insn, *ip, *ip_end;
+        const unsigned int max_insns = 128;
+        unsigned int i;
 
         info->pc_offset = -1;
         info->frame_size = 0;
 
+        ip = (void *)msk_isa16_mode((ulong)info->func);
         if (!ip)
                 goto err;
 
-        if (max_insns == 0)
-                max_insns = 128U;       /* unknown function size */
-        max_insns = min(128U, max_insns);
+        ip_end = (void *)ip + info->func_size;
 
-        for (i = 0; i < max_insns; i++, ip++) {
+        for (i = 0; i < max_insns && ip < ip_end; i++, ip++) {
+                if (is_mmips && mm_insn_16bit(ip->halfword[0])) {
+                        insn.halfword[0] = 0;
+                        insn.halfword[1] = ip->halfword[0];
+                } else if (is_mmips) {
+                        insn.halfword[0] = ip->halfword[1];
+                        insn.halfword[1] = ip->halfword[0];
+                } else {
+                        insn.word = ip->word;
+                }
 
-                if (is_jump_ins(ip))
+                if (is_jump_ins(&insn))
                         break;
+
                 if (!info->frame_size) {
-                        if (is_sp_move_ins(ip))
+                        if (is_sp_move_ins(&insn))
                         {
 #ifdef CONFIG_CPU_MICROMIPS
                                 if (mm_insn_16bit(ip->halfword[0]))
@@ -345,11 +393,9 @@ static int get_frame_info(struct mips_frame_info *info)
                         }
                         continue;
                 }
-                if (info->pc_offset == -1 && is_ra_save_ins(ip)) {
-                        info->pc_offset =
-                                ip->i_format.simmediate / sizeof(long);
+                if (info->pc_offset == -1 &&
+                    is_ra_save_ins(&insn, &info->pc_offset))
                         break;
-                }
         }
         if (info->frame_size && info->pc_offset >= 0) /* nested */
                 return 0;
@@ -507,7 +553,19 @@ EXPORT_SYMBOL(unwind_stack_by_address);
 unsigned long unwind_stack(struct task_struct *task, unsigned long *sp,
                            unsigned long pc, unsigned long *ra)
 {
-        unsigned long stack_page = (unsigned long)task_stack_page(task);
+        unsigned long stack_page = 0;
+        int cpu;
+
+        for_each_possible_cpu(cpu) {
+                if (on_irq_stack(cpu, *sp)) {
+                        stack_page = (unsigned long)irq_stack[cpu];
+                        break;
+                }
+        }
+
+        if (!stack_page)
+                stack_page = (unsigned long)task_stack_page(task);
+
         return unwind_stack_by_address(stack_page, sp, pc, ra);
 }
 #endif
diff --git a/arch/mips/kernel/ptrace.c b/arch/mips/kernel/ptrace.c
index 74d581569778..24c115a0721a 100644
--- a/arch/mips/kernel/ptrace.c
+++ b/arch/mips/kernel/ptrace.c
@@ -485,7 +485,8 @@ static int fpr_set(struct task_struct *target,
                                           &target->thread.fpu,
                                           0, sizeof(elf_fpregset_t));
 
-        for (i = 0; i < NUM_FPU_REGS; i++) {
+        BUILD_BUG_ON(sizeof(fpr_val) != sizeof(elf_fpreg_t));
+        for (i = 0; i < NUM_FPU_REGS && count >= sizeof(elf_fpreg_t); i++) {
                 err = user_regset_copyin(&pos, &count, &kbuf, &ubuf,
                                          &fpr_val, i * sizeof(elf_fpreg_t),
                                          (i + 1) * sizeof(elf_fpreg_t));
@@ -926,7 +927,7 @@ asmlinkage void syscall_trace_leave(struct pt_regs *regs)
         audit_syscall_exit(regs);
 
         if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
-                trace_sys_exit(regs, regs->regs[2]);
+                trace_sys_exit(regs, regs_return_value(regs));
 
         if (test_thread_flag(TIF_SYSCALL_TRACE))
                 tracehook_report_syscall_exit(regs, 0);
diff --git a/arch/mips/kernel/scall32-o32.S b/arch/mips/kernel/scall32-o32.S
index 2d23c834ba96..29b0c5f978e4 100644
--- a/arch/mips/kernel/scall32-o32.S
+++ b/arch/mips/kernel/scall32-o32.S
@@ -372,7 +372,7 @@ EXPORT(sys_call_table)
         PTR     sys_writev
         PTR     sys_cacheflush
         PTR     sys_cachectl
-        PTR     sys_sysmips
+        PTR     __sys_sysmips
         PTR     sys_ni_syscall                  /* 4150 */
         PTR     sys_getsid
         PTR     sys_fdatasync
diff --git a/arch/mips/kernel/scall64-64.S b/arch/mips/kernel/scall64-64.S
index deac63315d0e..a6323a969919 100644
--- a/arch/mips/kernel/scall64-64.S
+++ b/arch/mips/kernel/scall64-64.S
@@ -312,7 +312,7 @@ EXPORT(sys_call_table)
         PTR     sys_sched_getaffinity
         PTR     sys_cacheflush
         PTR     sys_cachectl
-        PTR     sys_sysmips
+        PTR     __sys_sysmips
         PTR     sys_io_setup                    /* 5200 */
         PTR     sys_io_destroy
         PTR     sys_io_getevents
diff --git a/arch/mips/kernel/scall64-n32.S b/arch/mips/kernel/scall64-n32.S
index ee93d5fe61d7..e0fdca8d3abe 100644
--- a/arch/mips/kernel/scall64-n32.S
+++ b/arch/mips/kernel/scall64-n32.S
@@ -298,7 +298,7 @@ EXPORT(sysn32_call_table)
         PTR     compat_sys_sched_getaffinity
         PTR     sys_cacheflush
         PTR     sys_cachectl
-        PTR     sys_sysmips
+        PTR     __sys_sysmips
         PTR     compat_sys_io_setup                     /* 6200 */
         PTR     sys_io_destroy
         PTR     compat_sys_io_getevents
diff --git a/arch/mips/kernel/scall64-o32.S b/arch/mips/kernel/scall64-o32.S
index b77052ec6fb2..87c697181d25 100644
--- a/arch/mips/kernel/scall64-o32.S
+++ b/arch/mips/kernel/scall64-o32.S
@@ -367,7 +367,7 @@ EXPORT(sys32_call_table)
         PTR     compat_sys_writev
         PTR     sys_cacheflush
         PTR     sys_cachectl
-        PTR     sys_sysmips
+        PTR     __sys_sysmips
         PTR     sys_ni_syscall                  /* 4150 */
         PTR     sys_getsid
         PTR     sys_fdatasync
diff --git a/arch/mips/kernel/syscall.c b/arch/mips/kernel/syscall.c
index 53a7ef9a8f32..4234b2d726c5 100644
--- a/arch/mips/kernel/syscall.c
+++ b/arch/mips/kernel/syscall.c
@@ -28,6 +28,7 @@
 #include <linux/elf.h>
 
 #include <asm/asm.h>
+#include <asm/asm-eva.h>
 #include <asm/branch.h>
 #include <asm/cachectl.h>
 #include <asm/cacheflush.h>
@@ -138,10 +139,12 @@ static inline int mips_atomic_set(unsigned long addr, unsigned long new)
                 __asm__ __volatile__ (
                 "       .set    "MIPS_ISA_ARCH_LEVEL"                   \n"
                 "       li      %[err], 0                               \n"
-                "1:     ll      %[old], (%[addr])                       \n"
+                "1:                                                     \n"
+                user_ll("%[old]", "(%[addr])")
                 "       move    %[tmp], %[new]                          \n"
-                "2:     sc      %[tmp], (%[addr])                       \n"
-                "       bnez    %[tmp], 4f                              \n"
+                "2:                                                     \n"
+                user_sc("%[tmp]", "(%[addr])")
+                "       beqz    %[tmp], 4f                              \n"
                 "3:                                                     \n"
                 "       .insn                                           \n"
                 "       .subsection 2                                   \n"
@@ -199,6 +202,12 @@ static inline int mips_atomic_set(unsigned long addr, unsigned long new)
         unreachable();
 }
 
+/*
+ * mips_atomic_set() normally returns directly via syscall_exit potentially
+ * clobbering static registers, so be sure to preserve them.
+ */
+save_static_function(sys_sysmips);
+
 SYSCALL_DEFINE3(sysmips, long, cmd, long, arg1, long, arg2)
 {
         switch (cmd) {
diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c
index 99a402231f4d..31ca2edd7218 100644
--- a/arch/mips/kernel/traps.c
+++ b/arch/mips/kernel/traps.c
@@ -194,6 +194,8 @@ void show_stack(struct task_struct *task, unsigned long *sp)
 {
         struct pt_regs regs;
         mm_segment_t old_fs = get_fs();
+
+        regs.cp0_status = KSU_KERNEL;
         if (sp) {
                 regs.regs[29] = (unsigned long)sp;
                 regs.regs[31] = 0;
diff --git a/arch/mips/lantiq/xway/sysctrl.c b/arch/mips/lantiq/xway/sysctrl.c
index 80554e8f6037..daf580ce5ca2 100644
--- a/arch/mips/lantiq/xway/sysctrl.c
+++ b/arch/mips/lantiq/xway/sysctrl.c
@@ -467,7 +467,7 @@ void __init ltq_soc_init(void)
 
                 if (!np_xbar)
                         panic("Failed to load xbar nodes from devicetree");
-                if (of_address_to_resource(np_pmu, 0, &res_xbar))
+                if (of_address_to_resource(np_xbar, 0, &res_xbar))
                         panic("Failed to get xbar resources");
                 if (request_mem_region(res_xbar.start, resource_size(&res_xbar),
                         res_xbar.name) < 0)
@@ -545,7 +545,7 @@ void __init ltq_soc_init(void)
                 clkdev_add_pmu("1a800000.pcie", "msi", 1, 1, PMU1_PCIE2_MSI);
                 clkdev_add_pmu("1a800000.pcie", "pdi", 1, 1, PMU1_PCIE2_PDI);
                 clkdev_add_pmu("1a800000.pcie", "ctl", 1, 1, PMU1_PCIE2_CTL);
-                clkdev_add_pmu("1e108000.eth", NULL, 1, 0, PMU_SWITCH | PMU_PPE_DP);
+                clkdev_add_pmu("1e108000.eth", NULL, 0, 0, PMU_SWITCH | PMU_PPE_DP);
                 clkdev_add_pmu("1da00000.usif", "NULL", 1, 0, PMU_USIF);
                 clkdev_add_pmu("1e103100.deu", NULL, 1, 0, PMU_DEU);
         } else if (of_machine_is_compatible("lantiq,ar10")) {
@@ -553,7 +553,7 @@ void __init ltq_soc_init(void)
                                   ltq_ar10_fpi_hz(), ltq_ar10_pp32_hz());
                 clkdev_add_pmu("1e101000.usb", "ctl", 1, 0, PMU_USB0);
                 clkdev_add_pmu("1e106000.usb", "ctl", 1, 0, PMU_USB1);
-                clkdev_add_pmu("1e108000.eth", NULL, 1, 0, PMU_SWITCH |
+                clkdev_add_pmu("1e108000.eth", NULL, 0, 0, PMU_SWITCH |
                                PMU_PPE_DP | PMU_PPE_TC);
                 clkdev_add_pmu("1da00000.usif", "NULL", 1, 0, PMU_USIF);
                 clkdev_add_pmu("1f203000.rcu", "gphy", 1, 0, PMU_GPHY);
@@ -575,11 +575,11 @@ void __init ltq_soc_init(void)
                 clkdev_add_pmu(NULL, "ahb", 1, 0, PMU_AHBM | PMU_AHBS);
 
                 clkdev_add_pmu("1da00000.usif", "NULL", 1, 0, PMU_USIF);
-                clkdev_add_pmu("1e108000.eth", NULL, 1, 0,
+                clkdev_add_pmu("1e108000.eth", NULL, 0, 0,
                                 PMU_SWITCH | PMU_PPE_DPLUS | PMU_PPE_DPLUM |
                                 PMU_PPE_EMA | PMU_PPE_TC | PMU_PPE_SLL01 |
                                 PMU_PPE_QSB | PMU_PPE_TOP);
-                clkdev_add_pmu("1f203000.rcu", "gphy", 1, 0, PMU_GPHY);
+                clkdev_add_pmu("1f203000.rcu", "gphy", 0, 0, PMU_GPHY);
                 clkdev_add_pmu("1e103000.sdio", NULL, 1, 0, PMU_SDIO);
                 clkdev_add_pmu("1e103100.deu", NULL, 1, 0, PMU_DEU);
                 clkdev_add_pmu("1e116000.mei", "dfe", 1, 0, PMU_DFE);
diff --git a/arch/mips/math-emu/cp1emu.c b/arch/mips/math-emu/cp1emu.c
index 734a2c7665ec..6da2e4a6ba39 100644
--- a/arch/mips/math-emu/cp1emu.c
+++ b/arch/mips/math-emu/cp1emu.c
@@ -2496,6 +2496,35 @@ dcopuop:
         return 0;
 }
 
+/*
+ * Emulate FPU instructions.
+ *
+ * If we use FPU hardware, then we have been typically called to handle
+ * an unimplemented operation, such as where an operand is a NaN or
+ * denormalized.  In that case exit the emulation loop after a single
+ * iteration so as to let hardware execute any subsequent instructions.
+ *
+ * If we have no FPU hardware or it has been disabled, then continue
+ * emulating floating-point instructions until one of these conditions
+ * has occurred:
+ *
+ * - a non-FPU instruction has been encountered,
+ *
+ * - an attempt to emulate has ended with a signal,
+ *
+ * - the ISA mode has been switched.
+ *
+ * We need to terminate the emulation loop if we got switched to the
+ * MIPS16 mode, whether supported or not, so that we do not attempt
+ * to emulate a MIPS16 instruction as a regular MIPS FPU instruction.
+ * Similarly if we got switched to the microMIPS mode and only the
+ * regular MIPS mode is supported, so that we do not attempt to emulate
+ * a microMIPS instruction as a regular MIPS FPU instruction.  Or if
+ * we got switched to the regular MIPS mode and only the microMIPS mode
+ * is supported, so that we do not attempt to emulate a regular MIPS
+ * instruction that should cause an Address Error exception instead.
+ * For simplicity we always terminate upon an ISA mode switch.
+ */
 int fpu_emulator_cop1Handler(struct pt_regs *xcp, struct mips_fpu_struct *ctx,
         int has_fpu, void *__user *fault_addr)
 {
@@ -2581,6 +2610,15 @@ int fpu_emulator_cop1Handler(struct pt_regs *xcp, struct mips_fpu_struct *ctx,
                         break;
                 if (sig)
                         break;
+                /*
+                 * We have to check for the ISA bit explicitly here,
+                 * because `get_isa16_mode' may return 0 if support
+                 * for code compression has been globally disabled,
+                 * or otherwise we may produce the wrong signal or
+                 * even proceed successfully where we must not.
+                 */
+                if ((xcp->cp0_epc ^ prevepc) & 0x1)
+                        break;
 
                 cond_resched();
         } while (xcp->cp0_epc > prevepc);
diff --git a/arch/mips/mm/mmap.c b/arch/mips/mm/mmap.c
index 353037699512..c5fdea5debe5 100644
--- a/arch/mips/mm/mmap.c
+++ b/arch/mips/mm/mmap.c
@@ -92,7 +92,7 @@ static unsigned long arch_get_unmapped_area_common(struct file *filp,
 
                 vma = find_vma(mm, addr);
                 if (TASK_SIZE - len >= addr &&
-                    (!vma || addr + len <= vma->vm_start))
+                    (!vma || addr + len <= vm_start_gap(vma)))
                         return addr;
         }
 
diff --git a/arch/mips/mm/sc-ip22.c b/arch/mips/mm/sc-ip22.c
index dc7c5a5214a9..efaf364fe581 100644
--- a/arch/mips/mm/sc-ip22.c
+++ b/arch/mips/mm/sc-ip22.c
@@ -31,26 +31,40 @@ static inline void indy_sc_wipe(unsigned long first, unsigned long last)
         unsigned long tmp;
 
         __asm__ __volatile__(
-        ".set\tpush\t\t\t# indy_sc_wipe\n\t"
-        ".set\tnoreorder\n\t"
-        ".set\tmips3\n\t"
-        ".set\tnoat\n\t"
-        "mfc0\t%2, $12\n\t"
-        "li\t$1, 0x80\t\t\t# Go 64 bit\n\t"
-        "mtc0\t$1, $12\n\t"
-
-        "dli\t$1, 0x9000000080000000\n\t"
-        "or\t%0, $1\t\t\t# first line to flush\n\t"
-        "or\t%1, $1\t\t\t# last line to flush\n\t"
-        ".set\tat\n\t"
-
-        "1:\tsw\t$0, 0(%0)\n\t"
-        "bne\t%0, %1, 1b\n\t"
-        " daddu\t%0, 32\n\t"
-
-        "mtc0\t%2, $12\t\t\t# Back to 32 bit\n\t"
-        "nop; nop; nop; nop;\n\t"
-        ".set\tpop"
+        "       .set    push                    # indy_sc_wipe          \n"
+        "       .set    noreorder                                       \n"
+        "       .set    mips3                                           \n"
+        "       .set    noat                                            \n"
+        "       mfc0    %2, $12                                         \n"
+        "       li      $1, 0x80                # Go 64 bit             \n"
+        "       mtc0    $1, $12                                         \n"
+        "                                                               \n"
+        "       #                                                       \n"
+        "       # Open code a dli $1, 0x9000000080000000                \n"
+        "       #                                                       \n"
+        "       # Required because binutils 2.25 will happily accept    \n"
+        "       # 64 bit instructions in .set mips3 mode but puke on    \n"
+        "       # 64 bit constants when generating 32 bit ELF           \n"
+        "       #                                                       \n"
+        "       lui     $1,0x9000                                       \n"
+        "       dsll    $1,$1,0x10                                      \n"
+        "       ori     $1,$1,0x8000                                    \n"
+        "       dsll    $1,$1,0x10                                      \n"
+        "                                                               \n"
+        "       or      %0, $1                  # first line to flush   \n"
+        "       or      %1, $1                  # last line to flush    \n"
+        "       .set    at                                              \n"
+        "                                                               \n"
+        "1:     sw      $0, 0(%0)                                       \n"
+        "       bne     %0, %1, 1b                                      \n"
+        "        daddu  %0, 32                                          \n"
+        "                                                               \n"
+        "       mtc0    %2, $12                 # Back to 32 bit        \n"
+        "       nop                             # pipeline hazard       \n"
+        "       nop                                                     \n"
+        "       nop                                                     \n"
+        "       nop                                                     \n"
+        "       .set    pop                                             \n"
         : "=r" (first), "=r" (last), "=&r" (tmp)
         : "0" (first), "1" (last));
 }
diff --git a/arch/mips/mm/tlbex.c b/arch/mips/mm/tlbex.c
index 29f73e00253d..63b7d6f82d24 100644
--- a/arch/mips/mm/tlbex.c
+++ b/arch/mips/mm/tlbex.c
@@ -757,7 +757,8 @@ static void build_huge_update_entries(u32 **p, unsigned int pte,
 static void build_huge_handler_tail(u32 **p, struct uasm_reloc **r,
                                     struct uasm_label **l,
                                     unsigned int pte,
-                                    unsigned int ptr)
+                                    unsigned int ptr,
+                                    unsigned int flush)
 {
 #ifdef CONFIG_SMP
         UASM_i_SC(p, pte, 0, ptr);
@@ -766,6 +767,22 @@ static void build_huge_handler_tail(u32 **p, struct uasm_reloc **r,
 #else
         UASM_i_SW(p, pte, 0, ptr);
 #endif
+        if (cpu_has_ftlb && flush) {
+                BUG_ON(!cpu_has_tlbinv);
+
+                UASM_i_MFC0(p, ptr, C0_ENTRYHI);
+                uasm_i_ori(p, ptr, ptr, MIPS_ENTRYHI_EHINV);
+                UASM_i_MTC0(p, ptr, C0_ENTRYHI);
+                build_tlb_write_entry(p, l, r, tlb_indexed);
+
+                uasm_i_xori(p, ptr, ptr, MIPS_ENTRYHI_EHINV);
+                UASM_i_MTC0(p, ptr, C0_ENTRYHI);
+                build_huge_update_entries(p, pte, ptr);
+                build_huge_tlb_write_entry(p, l, r, pte, tlb_random, 0);
+
+                return;
+        }
+
         build_huge_update_entries(p, pte, ptr);
         build_huge_tlb_write_entry(p, l, r, pte, tlb_indexed, 0);
 }
@@ -2082,7 +2099,7 @@ static void build_r4000_tlb_load_handler(void)
                 uasm_l_tlbl_goaround2(&l, p);
         }
         uasm_i_ori(&p, wr.r1, wr.r1, (_PAGE_ACCESSED | _PAGE_VALID));
-        build_huge_handler_tail(&p, &r, &l, wr.r1, wr.r2);
+        build_huge_handler_tail(&p, &r, &l, wr.r1, wr.r2, 1);
 #endif
 
         uasm_l_nopage_tlbl(&l, p);
@@ -2137,7 +2154,7 @@ static void build_r4000_tlb_store_handler(void)
         build_tlb_probe_entry(&p);
         uasm_i_ori(&p, wr.r1, wr.r1,
                    _PAGE_ACCESSED | _PAGE_MODIFIED | _PAGE_VALID | _PAGE_DIRTY);
-        build_huge_handler_tail(&p, &r, &l, wr.r1, wr.r2);
+        build_huge_handler_tail(&p, &r, &l, wr.r1, wr.r2, 1);
 #endif
 
         uasm_l_nopage_tlbs(&l, p);
@@ -2193,7 +2210,7 @@ static void build_r4000_tlb_modify_handler(void)
         build_tlb_probe_entry(&p);
         uasm_i_ori(&p, wr.r1, wr.r1,
                    _PAGE_ACCESSED | _PAGE_MODIFIED | _PAGE_VALID | _PAGE_DIRTY);
-        build_huge_handler_tail(&p, &r, &l, wr.r1, wr.r2);
+        build_huge_handler_tail(&p, &r, &l, wr.r1, wr.r2, 0);
 #endif
 
         uasm_l_nopage_tlbm(&l, p);
diff --git a/arch/mips/netlogic/common/reset.S b/arch/mips/netlogic/common/reset.S
index edbab9b8691f..c474981a6c0d 100644
--- a/arch/mips/netlogic/common/reset.S
+++ b/arch/mips/netlogic/common/reset.S
@@ -50,7 +50,6 @@
 #include <asm/netlogic/xlp-hal/sys.h>
 #include <asm/netlogic/xlp-hal/cpucontrol.h>
 
-#define CP0_EBASE       $15
 #define SYS_CPU_COHERENT_BASE   CKSEG1ADDR(XLP_DEFAULT_IO_BASE) + \
                         XLP_IO_SYS_OFFSET(0) + XLP_IO_PCI_HDRSZ + \
                         SYS_CPU_NONCOHERENT_MODE * 4
@@ -92,7 +91,7 @@
  * registers. On XLPII CPUs, usual cache instructions work.
  */
 .macro  xlp_flush_l1_dcache
-        mfc0    t0, CP0_EBASE, 0
+        mfc0    t0, CP0_PRID
         andi    t0, t0, PRID_IMP_MASK
         slt     t1, t0, 0x1200
         beqz    t1, 15f
@@ -171,7 +170,7 @@ FEXPORT(nlm_reset_entry)
         nop
 
 1:      /* Entry point on core wakeup */
-        mfc0    t0, CP0_EBASE, 0        /* processor ID */
+        mfc0    t0, CP0_PRID            /* processor ID */
         andi    t0, PRID_IMP_MASK
         li      t1, 0x1500              /* XLP 9xx */
         beq     t0, t1, 2f              /* does not need to set coherent */
@@ -182,8 +181,8 @@ FEXPORT(nlm_reset_entry)
         nop
 
         /* set bit in SYS coherent register for the core */
-        mfc0    t0, CP0_EBASE, 1
-        mfc0    t1, CP0_EBASE, 1
+        mfc0    t0, CP0_EBASE
+        mfc0    t1, CP0_EBASE
         srl     t1, 5
         andi    t1, 0x3                 /* t1 <- node */
         li      t2, 0x40000
@@ -232,7 +231,7 @@ EXPORT(nlm_boot_siblings)
 
          * NOTE: All GPR contents are lost after the mtcr above!
          */
-        mfc0    v0, CP0_EBASE, 1
+        mfc0    v0, CP0_EBASE
         andi    v0, 0x3ff               /* v0 <- node/core */
 
         /*
diff --git a/arch/mips/netlogic/common/smpboot.S b/arch/mips/netlogic/common/smpboot.S
index 805355b0bd05..f0cc4c9de2bb 100644
--- a/arch/mips/netlogic/common/smpboot.S
+++ b/arch/mips/netlogic/common/smpboot.S
@@ -48,8 +48,6 @@
 #include <asm/netlogic/xlp-hal/sys.h>
 #include <asm/netlogic/xlp-hal/cpucontrol.h>
 
-#define CP0_EBASE       $15
-
         .set    noreorder
         .set    noat
         .set    arch=xlr                /* for mfcr/mtcr, XLR is sufficient */
@@ -86,7 +84,7 @@ NESTED(nlm_boot_secondary_cpus, 16, sp)
         PTR_L   gp, 0(t1)
 
         /* a0 has the processor id */
-        mfc0    a0, CP0_EBASE, 1
+        mfc0    a0, CP0_EBASE
         andi    a0, 0x3ff               /* a0 <- node/core */
         PTR_LA  t0, nlm_early_init_secondary
         jalr    t0
diff --git a/arch/mips/ralink/mt7620.c b/arch/mips/ralink/mt7620.c
index dfb04fcedb04..48d6349fd9d7 100644
--- a/arch/mips/ralink/mt7620.c
+++ b/arch/mips/ralink/mt7620.c
@@ -107,31 +107,31 @@ static struct rt2880_pmx_group mt7620a_pinmux_data[] = {
 };
 
 static struct rt2880_pmx_func pwm1_grp_mt7628[] = {
-        FUNC("sdcx", 3, 19, 1),
+        FUNC("sdxc d6", 3, 19, 1),
         FUNC("utif", 2, 19, 1),
         FUNC("gpio", 1, 19, 1),
-        FUNC("pwm", 0, 19, 1),
+        FUNC("pwm1", 0, 19, 1),
 };
 
 static struct rt2880_pmx_func pwm0_grp_mt7628[] = {
-        FUNC("sdcx", 3, 18, 1),
+        FUNC("sdxc d7", 3, 18, 1),
         FUNC("utif", 2, 18, 1),
         FUNC("gpio", 1, 18, 1),
-        FUNC("pwm", 0, 18, 1),
+        FUNC("pwm0", 0, 18, 1),
 };
 
 static struct rt2880_pmx_func uart2_grp_mt7628[] = {
-        FUNC("sdcx", 3, 20, 2),
+        FUNC("sdxc d5 d4", 3, 20, 2),
         FUNC("pwm", 2, 20, 2),
         FUNC("gpio", 1, 20, 2),
-        FUNC("uart", 0, 20, 2),
+        FUNC("uart2", 0, 20, 2),
 };
 
 static struct rt2880_pmx_func uart1_grp_mt7628[] = {
-        FUNC("sdcx", 3, 45, 2),
+        FUNC("sw_r", 3, 45, 2),
         FUNC("pwm", 2, 45, 2),
         FUNC("gpio", 1, 45, 2),
-        FUNC("uart", 0, 45, 2),
+        FUNC("uart1", 0, 45, 2),
 };
 
 static struct rt2880_pmx_func i2c_grp_mt7628[] = {
@@ -143,21 +143,21 @@ static struct rt2880_pmx_func i2c_grp_mt7628[] = {
 
 static struct rt2880_pmx_func refclk_grp_mt7628[] = { FUNC("reclk", 0, 36, 1) };
 static struct rt2880_pmx_func perst_grp_mt7628[] = { FUNC("perst", 0, 37, 1) };
-static struct rt2880_pmx_func wdt_grp_mt7628[] = { FUNC("wdt", 0, 15, 38) };
+static struct rt2880_pmx_func wdt_grp_mt7628[] = { FUNC("wdt", 0, 38, 1) };
 static struct rt2880_pmx_func spi_grp_mt7628[] = { FUNC("spi", 0, 7, 4) };
 
 static struct rt2880_pmx_func sd_mode_grp_mt7628[] = {
         FUNC("jtag", 3, 22, 8),
         FUNC("utif", 2, 22, 8),
         FUNC("gpio", 1, 22, 8),
-        FUNC("sdcx", 0, 22, 8),
+        FUNC("sdxc", 0, 22, 8),
 };
 
 static struct rt2880_pmx_func uart0_grp_mt7628[] = {
         FUNC("-", 3, 12, 2),
         FUNC("-", 2, 12, 2),
         FUNC("gpio", 1, 12, 2),
-        FUNC("uart", 0, 12, 2),
+        FUNC("uart0", 0, 12, 2),
 };
 
 static struct rt2880_pmx_func i2s_grp_mt7628[] = {
@@ -171,7 +171,7 @@ static struct rt2880_pmx_func spi_cs1_grp_mt7628[] = {
         FUNC("-", 3, 6, 1),
         FUNC("refclk", 2, 6, 1),
         FUNC("gpio", 1, 6, 1),
-        FUNC("spi", 0, 6, 1),
+        FUNC("spi cs1", 0, 6, 1),
 };
 
 static struct rt2880_pmx_func spis_grp_mt7628[] = {
@@ -188,28 +188,44 @@ static struct rt2880_pmx_func gpio_grp_mt7628[] = {
         FUNC("gpio", 0, 11, 1),
 };
 
-#define MT7628_GPIO_MODE_MASK   0x3
-
-#define MT7628_GPIO_MODE_PWM1   30
-#define MT7628_GPIO_MODE_PWM0   28
-#define MT7628_GPIO_MODE_UART2  26
-#define MT7628_GPIO_MODE_UART1  24
-#define MT7628_GPIO_MODE_I2C    20
-#define MT7628_GPIO_MODE_REFCLK 18
-#define MT7628_GPIO_MODE_PERST  16
-#define MT7628_GPIO_MODE_WDT    14
-#define MT7628_GPIO_MODE_SPI    12
-#define MT7628_GPIO_MODE_SDMODE 10
-#define MT7628_GPIO_MODE_UART0  8
-#define MT7628_GPIO_MODE_I2S    6
-#define MT7628_GPIO_MODE_CS1    4
-#define MT7628_GPIO_MODE_SPIS   2
-#define MT7628_GPIO_MODE_GPIO   0
+static struct rt2880_pmx_func wled_kn_grp_mt7628[] = {
+        FUNC("rsvd", 3, 35, 1),
+        FUNC("rsvd", 2, 35, 1),
+        FUNC("gpio", 1, 35, 1),
+        FUNC("wled_kn", 0, 35, 1),
+};
+
+static struct rt2880_pmx_func wled_an_grp_mt7628[] = {
+        FUNC("rsvd", 3, 44, 1),
+        FUNC("rsvd", 2, 44, 1),
+        FUNC("gpio", 1, 44, 1),
+        FUNC("wled_an", 0, 44, 1),
+};
+
+#define MT7628_GPIO_MODE_MASK           0x3
+
+#define MT7628_GPIO_MODE_WLED_KN        48
+#define MT7628_GPIO_MODE_WLED_AN        32
+#define MT7628_GPIO_MODE_PWM1           30
+#define MT7628_GPIO_MODE_PWM0           28
+#define MT7628_GPIO_MODE_UART2          26
+#define MT7628_GPIO_MODE_UART1          24
+#define MT7628_GPIO_MODE_I2C            20
+#define MT7628_GPIO_MODE_REFCLK         18
+#define MT7628_GPIO_MODE_PERST          16
+#define MT7628_GPIO_MODE_WDT            14
+#define MT7628_GPIO_MODE_SPI            12
+#define MT7628_GPIO_MODE_SDMODE         10
+#define MT7628_GPIO_MODE_UART0          8
+#define MT7628_GPIO_MODE_I2S            6
+#define MT7628_GPIO_MODE_CS1            4
+#define MT7628_GPIO_MODE_SPIS           2
+#define MT7628_GPIO_MODE_GPIO           0
 
 static struct rt2880_pmx_group mt7628an_pinmux_data[] = {
-        GRP_G("pmw1", pwm1_grp_mt7628, MT7628_GPIO_MODE_MASK,
+        GRP_G("pwm1", pwm1_grp_mt7628, MT7628_GPIO_MODE_MASK,
                                 1, MT7628_GPIO_MODE_PWM1),
-        GRP_G("pmw1", pwm0_grp_mt7628, MT7628_GPIO_MODE_MASK,
+        GRP_G("pwm0", pwm0_grp_mt7628, MT7628_GPIO_MODE_MASK,
                                 1, MT7628_GPIO_MODE_PWM0),
         GRP_G("uart2", uart2_grp_mt7628, MT7628_GPIO_MODE_MASK,
                                 1, MT7628_GPIO_MODE_UART2),
@@ -233,6 +249,10 @@ static struct rt2880_pmx_group mt7628an_pinmux_data[] = {
                                 1, MT7628_GPIO_MODE_SPIS),
         GRP_G("gpio", gpio_grp_mt7628, MT7628_GPIO_MODE_MASK,
                                 1, MT7628_GPIO_MODE_GPIO),
+        GRP_G("wled_an", wled_an_grp_mt7628, MT7628_GPIO_MODE_MASK,
+                                1, MT7628_GPIO_MODE_WLED_AN),
+        GRP_G("wled_kn", wled_kn_grp_mt7628, MT7628_GPIO_MODE_MASK,
+                                1, MT7628_GPIO_MODE_WLED_KN),
         { 0 }
 };
 
@@ -439,7 +459,7 @@ void __init ralink_clk_init(void)
         ralink_clk_add("10000c00.uartlite", periph_rate);
         ralink_clk_add("10180000.wmac", xtal_rate);
 
-        if (IS_ENABLED(CONFIG_USB) && is_mt76x8()) {
+        if (IS_ENABLED(CONFIG_USB) && !is_mt76x8()) {
                 /*
                  * When the CPU goes into sleep mode, the BUS clock will be
                  * too low for USB to function properly. Adjust the busses
diff --git a/arch/mips/ralink/prom.c b/arch/mips/ralink/prom.c
index 39a9142f71be..7ecb4af79b7b 100644
--- a/arch/mips/ralink/prom.c
+++ b/arch/mips/ralink/prom.c
@@ -30,8 +30,10 @@ const char *get_system_type(void)
         return soc_info.sys_type;
 }
 
-static __init void prom_init_cmdline(int argc, char **argv)
+static __init void prom_init_cmdline(void)
 {
+        int argc;
+        char **argv;
         int i;
 
         pr_debug("prom: fw_arg0=%08x fw_arg1=%08x fw_arg2=%08x fw_arg3=%08x\n",
@@ -60,14 +62,11 @@ static __init void prom_init_cmdline(int argc, char **argv)
 
 void __init prom_init(void)
 {
-        int argc;
-        char **argv;
-
         prom_soc_init(&soc_info);
 
         pr_info("SoC Type: %s\n", get_system_type());
 
-        prom_init_cmdline(argc, argv);
+        prom_init_cmdline();
 }
 
 void __init prom_free_prom_memory(void)
diff --git a/arch/mips/ralink/rt288x.c b/arch/mips/ralink/rt288x.c
index 844f5cd55c8f..9dd67749c592 100644
--- a/arch/mips/ralink/rt288x.c
+++ b/arch/mips/ralink/rt288x.c
@@ -40,16 +40,6 @@ static struct rt2880_pmx_group rt2880_pinmux_data_act[] = {
         { 0 }
 };
 
-static void rt288x_wdt_reset(void)
-{
-        u32 t;
-
-        /* enable WDT reset output on pin SRAM_CS_N */
-        t = rt_sysc_r32(SYSC_REG_CLKCFG);
-        t |= CLKCFG_SRAM_CS_N_WDT;
-        rt_sysc_w32(t, SYSC_REG_CLKCFG);
-}
-
 void __init ralink_clk_init(void)
 {
         unsigned long cpu_rate, wmac_rate = 40000000;
@@ -119,5 +109,5 @@ void prom_soc_init(struct ralink_soc_info *soc_info)
         soc_info->mem_size_max = RT2880_MEM_SIZE_MAX;
 
         rt2880_pinmux_data = rt2880_pinmux_data_act;
-        ralink_soc == RT2880_SOC;
+        ralink_soc = RT2880_SOC;
 }
diff --git a/arch/mips/ralink/rt305x.c b/arch/mips/ralink/rt305x.c
index 9e4572592065..15b32cd01906 100644
--- a/arch/mips/ralink/rt305x.c
+++ b/arch/mips/ralink/rt305x.c
@@ -89,17 +89,6 @@ static struct rt2880_pmx_group rt5350_pinmux_data[] = {
         { 0 }
 };
 
-static void rt305x_wdt_reset(void)
-{
-        u32 t;
-
-        /* enable WDT reset output on pin SRAM_CS_N */
-        t = rt_sysc_r32(SYSC_REG_SYSTEM_CONFIG);
-        t |= RT305X_SYSCFG_SRAM_CS0_MODE_WDT <<
-                RT305X_SYSCFG_SRAM_CS0_MODE_SHIFT;
-        rt_sysc_w32(t, SYSC_REG_SYSTEM_CONFIG);
-}
-
 static unsigned long rt5350_get_mem_size(void)
 {
         void __iomem *sysc = (void __iomem *) KSEG1ADDR(RT305X_SYSC_BASE);
diff --git a/arch/mips/ralink/rt3883.c b/arch/mips/ralink/rt3883.c
index 582995aaaf4e..3c575093f8f1 100644
--- a/arch/mips/ralink/rt3883.c
+++ b/arch/mips/ralink/rt3883.c
@@ -36,7 +36,7 @@ static struct rt2880_pmx_func uartlite_func[] = { FUNC("uartlite", 0, 15, 2) };
 static struct rt2880_pmx_func jtag_func[] = { FUNC("jtag", 0, 17, 5) };
 static struct rt2880_pmx_func mdio_func[] = { FUNC("mdio", 0, 22, 2) };
 static struct rt2880_pmx_func lna_a_func[] = { FUNC("lna a", 0, 32, 3) };
-static struct rt2880_pmx_func lna_g_func[] = { FUNC("lna a", 0, 35, 3) };
+static struct rt2880_pmx_func lna_g_func[] = { FUNC("lna g", 0, 35, 3) };
 static struct rt2880_pmx_func pci_func[] = {
         FUNC("pci-dev", 0, 40, 32),
         FUNC("pci-host2", 1, 40, 32),
@@ -44,7 +44,7 @@ static struct rt2880_pmx_func pci_func[] = {
         FUNC("pci-fnc", 3, 40, 32)
 };
 static struct rt2880_pmx_func ge1_func[] = { FUNC("ge1", 0, 72, 12) };
-static struct rt2880_pmx_func ge2_func[] = { FUNC("ge1", 0, 84, 12) };
+static struct rt2880_pmx_func ge2_func[] = { FUNC("ge2", 0, 84, 12) };
 
 static struct rt2880_pmx_group rt3883_pinmux_data[] = {
         GRP("i2c", i2c_func, 1, RT3883_GPIO_MODE_I2C),
@@ -63,16 +63,6 @@ static struct rt2880_pmx_group rt3883_pinmux_data[] = {
         { 0 }
 };
 
-static void rt3883_wdt_reset(void)
-{
-        u32 t;
-
-        /* enable WDT reset output on GPIO 2 */
-        t = rt_sysc_r32(RT3883_SYSC_REG_SYSCFG1);
-        t |= RT3883_SYSCFG1_GPIO2_AS_WDT_OUT;
-        rt_sysc_w32(t, RT3883_SYSC_REG_SYSCFG1);
-}
-
 void __init ralink_clk_init(void)
 {
         unsigned long cpu_rate, sys_rate;
diff --git a/arch/mips/sgi-ip22/Platform b/arch/mips/sgi-ip22/Platform
index b7a4b7e04c38..e8f6b3a42a48 100644
--- a/arch/mips/sgi-ip22/Platform
+++ b/arch/mips/sgi-ip22/Platform
@@ -25,7 +25,7 @@ endif
 # Simplified: what IP22 does at 128MB+ in ksegN, IP28 does at 512MB+ in xkphys
 #
 ifdef CONFIG_SGI_IP28
-  ifeq ($(call cc-option-yn,-mr10k-cache-barrier=store), n)
+  ifeq ($(call cc-option-yn,-march=r10000 -mr10k-cache-barrier=store), n)
       $(error gcc doesn't support needed option -mr10k-cache-barrier=store)
   endif
 endif
diff --git a/arch/nios2/kernel/prom.c b/arch/nios2/kernel/prom.c
index 718dd197909f..de73beb36910 100644
--- a/arch/nios2/kernel/prom.c
+++ b/arch/nios2/kernel/prom.c
@@ -48,6 +48,13 @@ void * __init early_init_dt_alloc_memory_arch(u64 size, u64 align)
         return alloc_bootmem_align(size, align);
 }
 
+int __init early_init_dt_reserve_memory_arch(phys_addr_t base, phys_addr_t size,
+                                             bool nomap)
+{
+        reserve_bootmem(base, size, BOOTMEM_DEFAULT);
+        return 0;
+}
+
 void __init early_init_devtree(void *params)
 {
         __be32 *dtb = (u32 *)__dtb_start;
diff --git a/arch/nios2/kernel/setup.c b/arch/nios2/kernel/setup.c
index a4ff86d58d5c..6c4e351a7930 100644
--- a/arch/nios2/kernel/setup.c
+++ b/arch/nios2/kernel/setup.c
@@ -195,6 +195,9 @@ void __init setup_arch(char **cmdline_p)
         }
 #endif /* CONFIG_BLK_DEV_INITRD */
 
+        early_init_fdt_reserve_self();
+        early_init_fdt_scan_reserved_mem();
+
         unflatten_and_copy_device_tree();
 
         setup_cpuinfo();
diff --git a/arch/openrisc/kernel/vmlinux.lds.S b/arch/openrisc/kernel/vmlinux.lds.S
index 2d69a853b742..3a08b55609b6 100644
--- a/arch/openrisc/kernel/vmlinux.lds.S
+++ b/arch/openrisc/kernel/vmlinux.lds.S
@@ -38,6 +38,8 @@ SECTIONS
         /* Read-only sections, merged into text segment: */
         . = LOAD_BASE ;
 
+        _text = .;
+
         /* _s_kernel_ro must be page aligned */
         . = ALIGN(PAGE_SIZE);
         _s_kernel_ro = .;
diff --git a/arch/parisc/include/asm/bitops.h b/arch/parisc/include/asm/bitops.h
index 3f9406d9b9d6..da87943328a5 100644
--- a/arch/parisc/include/asm/bitops.h
+++ b/arch/parisc/include/asm/bitops.h
@@ -6,7 +6,7 @@
 #endif
 
 #include <linux/compiler.h>
-#include <asm/types.h>          /* for BITS_PER_LONG/SHIFT_PER_LONG */
+#include <asm/types.h>
 #include <asm/byteorder.h>
 #include <asm/barrier.h>
 #include <linux/atomic.h>
@@ -17,6 +17,12 @@
  * to include/asm-i386/bitops.h or kerneldoc
  */
 
+#if __BITS_PER_LONG == 64
+#define SHIFT_PER_LONG 6
+#else
+#define SHIFT_PER_LONG 5
+#endif
+
 #define CHOP_SHIFTCOUNT(x) (((unsigned long) (x)) & (BITS_PER_LONG - 1))
 
 
diff --git a/arch/parisc/include/asm/dma-mapping.h b/arch/parisc/include/asm/dma-mapping.h
index d8d60a57183f..f53725202955 100644
--- a/arch/parisc/include/asm/dma-mapping.h
+++ b/arch/parisc/include/asm/dma-mapping.h
@@ -39,6 +39,8 @@ struct hppa_dma_ops {
 ** flush/purge and allocate "regular" cacheable pages for everything.
 */
 
+#define DMA_ERROR_CODE  (~(dma_addr_t)0)
+
 #ifdef CONFIG_PA11
 extern struct hppa_dma_ops pcxl_dma_ops;
 extern struct hppa_dma_ops pcx_dma_ops;
@@ -209,12 +211,13 @@ parisc_walk_tree(struct device *dev)
                         break;
                 }
         }
-        BUG_ON(!dev->platform_data);
         return dev->platform_data;
 }
-                
-#define GET_IOC(dev) (HBA_DATA(parisc_walk_tree(dev))->iommu)
-        
+
+#define GET_IOC(dev) ({                                 \
+        void *__pdata = parisc_walk_tree(dev);          \
+        __pdata ? HBA_DATA(__pdata)->iommu : NULL;      \
+})
 
 #ifdef CONFIG_IOMMU_CCIO
 struct parisc_device;
diff --git a/arch/parisc/include/asm/mmu_context.h b/arch/parisc/include/asm/mmu_context.h
index 59be25764433..a81226257878 100644
--- a/arch/parisc/include/asm/mmu_context.h
+++ b/arch/parisc/include/asm/mmu_context.h
@@ -49,15 +49,26 @@ static inline void load_context(mm_context_t context)
         mtctl(__space_to_prot(context), 8);
 }
 
-static inline void switch_mm(struct mm_struct *prev, struct mm_struct *next, struct task_struct *tsk)
+static inline void switch_mm_irqs_off(struct mm_struct *prev,
+                struct mm_struct *next, struct task_struct *tsk)
 {
-
         if (prev != next) {
                 mtctl(__pa(next->pgd), 25);
                 load_context(next->context);
         }
 }
 
+static inline void switch_mm(struct mm_struct *prev,
+                struct mm_struct *next, struct task_struct *tsk)
+{
+        unsigned long flags;
+
+        local_irq_save(flags);
+        switch_mm_irqs_off(prev, next, tsk);
+        local_irq_restore(flags);
+}
+#define switch_mm_irqs_off switch_mm_irqs_off
+
 #define deactivate_mm(tsk,mm)   do { } while (0)
 
 static inline void activate_mm(struct mm_struct *prev, struct mm_struct *next)
diff --git a/arch/parisc/include/uapi/asm/bitsperlong.h b/arch/parisc/include/uapi/asm/bitsperlong.h
index e0a23c7bdd43..07fa7e50bdc0 100644
--- a/arch/parisc/include/uapi/asm/bitsperlong.h
+++ b/arch/parisc/include/uapi/asm/bitsperlong.h
@@ -3,10 +3,8 @@
 
 #if defined(__LP64__)
 #define __BITS_PER_LONG 64
-#define SHIFT_PER_LONG 6
 #else
 #define __BITS_PER_LONG 32
-#define SHIFT_PER_LONG 5
 #endif
 
 #include <asm-generic/bitsperlong.h>
diff --git a/arch/parisc/include/uapi/asm/swab.h b/arch/parisc/include/uapi/asm/swab.h
index e78403b129ef..928e1bbac98f 100644
--- a/arch/parisc/include/uapi/asm/swab.h
+++ b/arch/parisc/include/uapi/asm/swab.h
@@ -1,6 +1,7 @@
 #ifndef _PARISC_SWAB_H
 #define _PARISC_SWAB_H
 
+#include <asm/bitsperlong.h>
 #include <linux/types.h>
 #include <linux/compiler.h>
 
@@ -38,7 +39,7 @@ static inline __attribute_const__ __u32 __arch_swab32(__u32 x)
 }
 #define __arch_swab32 __arch_swab32
 
-#if BITS_PER_LONG > 32
+#if __BITS_PER_LONG > 32
 /*
 ** From "PA-RISC 2.0 Architecture", HP Professional Books.
 ** See Appendix I page 8 , "Endian Byte Swapping".
@@ -61,6 +62,6 @@ static inline __attribute_const__ __u64 __arch_swab64(__u64 x)
         return x;
 }
 #define __arch_swab64 __arch_swab64
-#endif /* BITS_PER_LONG > 32 */
+#endif /* __BITS_PER_LONG > 32 */
 
 #endif /* _PARISC_SWAB_H */
diff --git a/arch/parisc/kernel/sys_parisc.c b/arch/parisc/kernel/sys_parisc.c
index 5aba01ac457f..4dda73c44fee 100644
--- a/arch/parisc/kernel/sys_parisc.c
+++ b/arch/parisc/kernel/sys_parisc.c
@@ -88,7 +88,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr,
                 unsigned long len, unsigned long pgoff, unsigned long flags)
 {
         struct mm_struct *mm = current->mm;
-        struct vm_area_struct *vma;
+        struct vm_area_struct *vma, *prev;
         unsigned long task_size = TASK_SIZE;
         int do_color_align, last_mmap;
         struct vm_unmapped_area_info info;
@@ -115,9 +115,10 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr,
                 else
                         addr = PAGE_ALIGN(addr);
 
-                vma = find_vma(mm, addr);
+                vma = find_vma_prev(mm, addr, &prev);
                 if (task_size - len >= addr &&
-                    (!vma || addr + len <= vma->vm_start))
+                    (!vma || addr + len <= vm_start_gap(vma)) &&
+                    (!prev || addr >= vm_end_gap(prev)))
                         goto found_addr;
         }
 
@@ -141,7 +142,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
                           const unsigned long len, const unsigned long pgoff,
                           const unsigned long flags)
 {
-        struct vm_area_struct *vma;
+        struct vm_area_struct *vma, *prev;
         struct mm_struct *mm = current->mm;
         unsigned long addr = addr0;
         int do_color_align, last_mmap;
@@ -175,9 +176,11 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
                         addr = COLOR_ALIGN(addr, last_mmap, pgoff);
                 else
                         addr = PAGE_ALIGN(addr);
-                vma = find_vma(mm, addr);
+
+                vma = find_vma_prev(mm, addr, &prev);
                 if (TASK_SIZE - len >= addr &&
-                    (!vma || addr + len <= vma->vm_start))
+                    (!vma || addr + len <= vm_start_gap(vma)) &&
+                    (!prev || addr >= vm_end_gap(prev)))
                         goto found_addr;
         }
 
diff --git a/arch/parisc/kernel/syscall_table.S b/arch/parisc/kernel/syscall_table.S
index d4ffcfbc9885..041e1f9ec129 100644
--- a/arch/parisc/kernel/syscall_table.S
+++ b/arch/parisc/kernel/syscall_table.S
@@ -361,7 +361,7 @@
         ENTRY_SAME(ni_syscall)  /* 263: reserved for vserver */
         ENTRY_SAME(add_key)
         ENTRY_SAME(request_key)         /* 265 */
-        ENTRY_SAME(keyctl)
+        ENTRY_COMP(keyctl)
         ENTRY_SAME(ioprio_set)
         ENTRY_SAME(ioprio_get)
         ENTRY_SAME(inotify_init)
diff --git a/arch/parisc/mm/fault.c b/arch/parisc/mm/fault.c
index 16dbe81c97c9..2f33a67bc531 100644
--- a/arch/parisc/mm/fault.c
+++ b/arch/parisc/mm/fault.c
@@ -298,7 +298,7 @@ bad_area:
                 case 15:        /* Data TLB miss fault/Data page fault */
                         /* send SIGSEGV when outside of vma */
                         if (!vma ||
-                            address < vma->vm_start || address > vma->vm_end) {
+                            address < vma->vm_start || address >= vma->vm_end) {
                                 si.si_signo = SIGSEGV;
                                 si.si_code = SEGV_MAPERR;
                                 break;
diff --git a/arch/powerpc/boot/zImage.lds.S b/arch/powerpc/boot/zImage.lds.S
index 861e72109df2..f080abfc2f83 100644
--- a/arch/powerpc/boot/zImage.lds.S
+++ b/arch/powerpc/boot/zImage.lds.S
@@ -68,6 +68,7 @@ SECTIONS
   }
 
 #ifdef CONFIG_PPC64_BOOT_WRAPPER
+  . = ALIGN(256);
   .got :
   {
     __toc_start = .;
diff --git a/arch/powerpc/include/asm/atomic.h b/arch/powerpc/include/asm/atomic.h
index 55f106ed12bf..039c4b910615 100644
--- a/arch/powerpc/include/asm/atomic.h
+++ b/arch/powerpc/include/asm/atomic.h
@@ -460,7 +460,7 @@ static __inline__ int atomic64_add_unless(atomic64_t *v, long a, long u)
  * Atomically increments @v by 1, so long as @v is non-zero.
  * Returns non-zero if @v was non-zero, and zero otherwise.
  */
-static __inline__ long atomic64_inc_not_zero(atomic64_t *v)
+static __inline__ int atomic64_inc_not_zero(atomic64_t *v)
 {
         long t1, t2;
 
@@ -479,7 +479,7 @@ static __inline__ long atomic64_inc_not_zero(atomic64_t *v)
         : "r" (&v->counter)
         : "cc", "xer", "memory");
 
-        return t1;
+        return t1 != 0;
 }
 
 #endif /* __powerpc64__ */
diff --git a/arch/powerpc/include/asm/elf.h b/arch/powerpc/include/asm/elf.h
index ee46ffef608e..743ad7a400d6 100644
--- a/arch/powerpc/include/asm/elf.h
+++ b/arch/powerpc/include/asm/elf.h
@@ -23,12 +23,13 @@
 #define CORE_DUMP_USE_REGSET
 #define ELF_EXEC_PAGESIZE       PAGE_SIZE
 
-/* This is the location that an ET_DYN program is loaded if exec'ed.  Typical
-   use of this is to invoke "./ld.so someprog" to test out a new version of
-   the loader.  We need to make sure that it is out of the way of the program
-   that it will "exec", and that there is sufficient room for the brk.  */
-
-#define ELF_ET_DYN_BASE 0x20000000
+/*
+ * This is the base location for PIE (ET_DYN with INTERP) loads. On
+ * 64-bit, this is raised to 4GB to leave the entire 32-bit address
+ * space open for things that want to use the area for 32-bit pointers.
+ */
+#define ELF_ET_DYN_BASE         (is_32bit_task() ? 0x000400000UL : \
+                                                   0x100000000UL)
 
 #define ELF_CORE_EFLAGS (is_elf2_task() ? 2 : 0)
 
diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h
index 627d129d7fcb..ca372bbc0ffe 100644
--- a/arch/powerpc/include/asm/reg.h
+++ b/arch/powerpc/include/asm/reg.h
@@ -1236,7 +1236,7 @@ static inline unsigned long mfvtb (void)
                                 "       .llong 0\n"                     \
                                 ".previous"                             \
                         : "=r" (rval) \
-                        : "i" (CPU_FTR_CELL_TB_BUG), "i" (SPRN_TBRL)); \
+                        : "i" (CPU_FTR_CELL_TB_BUG), "i" (SPRN_TBRL) : "cr0"); \
                         rval;})
 #else
 #define mftb()          ({unsigned long rval;   \
diff --git a/arch/powerpc/kernel/align.c b/arch/powerpc/kernel/align.c
index 86150fbb42c3..91e5c1758b5c 100644
--- a/arch/powerpc/kernel/align.c
+++ b/arch/powerpc/kernel/align.c
@@ -808,14 +808,25 @@ int fix_alignment(struct pt_regs *regs)
         nb = aligninfo[instr].len;
         flags = aligninfo[instr].flags;
 
-        /* ldbrx/stdbrx overlap lfs/stfs in the DSISR unfortunately */
-        if (IS_XFORM(instruction) && ((instruction >> 1) & 0x3ff) == 532) {
-                nb = 8;
-                flags = LD+SW;
-        } else if (IS_XFORM(instruction) &&
-                   ((instruction >> 1) & 0x3ff) == 660) {
-                nb = 8;
-                flags = ST+SW;
+        /*
+         * Handle some cases which give overlaps in the DSISR values.
+         */
+        if (IS_XFORM(instruction)) {
+                switch (get_xop(instruction)) {
+                case 532:       /* ldbrx */
+                        nb = 8;
+                        flags = LD+SW;
+                        break;
+                case 660:       /* stdbrx */
+                        nb = 8;
+                        flags = ST+SW;
+                        break;
+                case 20:        /* lwarx */
+                case 84:        /* ldarx */
+                case 116:       /* lharx */
+                case 276:       /* lqarx */
+                        return 0;       /* not emulated ever */
+                }
         }
 
         /* Byteswap little endian loads and stores */
diff --git a/arch/powerpc/kernel/eeh.c b/arch/powerpc/kernel/eeh.c
index 98949b0df00a..6696c1986844 100644
--- a/arch/powerpc/kernel/eeh.c
+++ b/arch/powerpc/kernel/eeh.c
@@ -304,9 +304,17 @@ void eeh_slot_error_detail(struct eeh_pe *pe, int severity)
          *
          * For pHyp, we have to enable IO for log retrieval. Otherwise,
          * 0xFF's is always returned from PCI config space.
+         *
+         * When the @severity is EEH_LOG_PERM, the PE is going to be
+         * removed. Prior to that, the drivers for devices included in
+         * the PE will be closed. The drivers rely on working IO path
+         * to bring the devices to quiet state. Otherwise, PCI traffic
+         * from those devices after they are removed is like to cause
+         * another unexpected EEH error.
          */
         if (!(pe->type & EEH_PE_PHB)) {
-                if (eeh_has_flag(EEH_ENABLE_IO_FOR_LOG))
+                if (eeh_has_flag(EEH_ENABLE_IO_FOR_LOG) ||
+                    severity == EEH_LOG_PERM)
                         eeh_pci_enable(pe, EEH_OPT_THAW_MMIO);
 
                 /*
diff --git a/arch/powerpc/kernel/eeh_driver.c b/arch/powerpc/kernel/eeh_driver.c
index 300382e5a2cc..9837c98caabe 100644
--- a/arch/powerpc/kernel/eeh_driver.c
+++ b/arch/powerpc/kernel/eeh_driver.c
@@ -485,7 +485,7 @@ static void *eeh_pe_detach_dev(void *data, void *userdata)
 static void *__eeh_clear_pe_frozen_state(void *data, void *flag)
 {
         struct eeh_pe *pe = (struct eeh_pe *)data;
-        bool *clear_sw_state = flag;
+        bool clear_sw_state = *(bool *)flag;
         int i, rc = 1;
 
         for (i = 0; rc && i < 3; i++)
@@ -655,7 +655,7 @@ static int eeh_reset_device(struct eeh_pe *pe, struct pci_bus *bus)
  */
 #define MAX_WAIT_FOR_RECOVERY 300
 
-static void eeh_handle_normal_event(struct eeh_pe *pe)
+static bool eeh_handle_normal_event(struct eeh_pe *pe)
 {
         struct pci_bus *frozen_bus;
         int rc = 0;
@@ -665,7 +665,7 @@ static void eeh_handle_normal_event(struct eeh_pe *pe)
         if (!frozen_bus) {
                 pr_err("%s: Cannot find PCI bus for PHB#%d-PE#%x\n",
                         __func__, pe->phb->global_number, pe->addr);
-                return;
+                return false;
         }
 
         eeh_pe_update_time_stamp(pe);
@@ -790,7 +790,7 @@ static void eeh_handle_normal_event(struct eeh_pe *pe)
         pr_info("EEH: Notify device driver to resume\n");
         eeh_pe_dev_traverse(pe, eeh_report_resume, NULL);
 
-        return;
+        return false;
 
 excess_failures:
         /*
@@ -831,7 +831,11 @@ perm_error:
                 pci_lock_rescan_remove();
                 pcibios_remove_pci_devices(frozen_bus);
                 pci_unlock_rescan_remove();
+
+                /* The passed PE should no longer be used */
+                return true;
         }
+        return false;
 }
 
 static void eeh_handle_special_event(void)
@@ -897,7 +901,14 @@ static void eeh_handle_special_event(void)
                  */
                 if (rc == EEH_NEXT_ERR_FROZEN_PE ||
                     rc == EEH_NEXT_ERR_FENCED_PHB) {
-                        eeh_handle_normal_event(pe);
+                        /*
+                         * eeh_handle_normal_event() can make the PE stale if it
+                         * determines that the PE cannot possibly be recovered.
+                         * Don't modify the PE state if that's the case.
+                         */
+                        if (eeh_handle_normal_event(pe))
+                                continue;
+
                         eeh_pe_state_clear(pe, EEH_PE_RECOVERING);
                 } else {
                         pci_lock_rescan_remove();
diff --git a/arch/powerpc/kernel/entry_64.S b/arch/powerpc/kernel/entry_64.S
index edba294620db..f6fd0332c3a2 100644
--- a/arch/powerpc/kernel/entry_64.S
+++ b/arch/powerpc/kernel/entry_64.S
@@ -716,7 +716,7 @@ resume_kernel:
 
         addi    r8,r1,INT_FRAME_SIZE    /* Get the kprobed function entry */
 
-        lwz     r3,GPR1(r1)
+        ld      r3,GPR1(r1)
         subi    r3,r3,INT_FRAME_SIZE    /* dst: Allocate a trampoline exception frame */
         mr      r4,r1                   /* src:  current exception frame */
         mr      r1,r3                   /* Reroute the trampoline frame to r1 */
@@ -730,8 +730,8 @@ resume_kernel:
         addi    r6,r6,8
         bdnz    2b
 
-        /* Do real store operation to complete stwu */
-        lwz     r5,GPR1(r1)
+        /* Do real store operation to complete stdu */
+        ld      r5,GPR1(r1)
         std     r8,0(r5)
 
         /* Clear _TIF_EMULATE_STACK_STORE flag */
diff --git a/arch/powerpc/kernel/exceptions-64e.S b/arch/powerpc/kernel/exceptions-64e.S
index 488e6314f993..5cc93f0b52ca 100644
--- a/arch/powerpc/kernel/exceptions-64e.S
+++ b/arch/powerpc/kernel/exceptions-64e.S
@@ -735,8 +735,14 @@ END_FTR_SECTION_IFSET(CPU_FTR_ALTIVEC)
         andis.  r15,r14,(DBSR_IC|DBSR_BT)@h
         beq+    1f
 
+#ifdef CONFIG_RELOCATABLE
+        ld      r15,PACATOC(r13)
+        ld      r14,interrupt_base_book3e@got(r15)
+        ld      r15,__end_interrupts@got(r15)
+#else
         LOAD_REG_IMMEDIATE(r14,interrupt_base_book3e)
         LOAD_REG_IMMEDIATE(r15,__end_interrupts)
+#endif
         cmpld   cr0,r10,r14
         cmpld   cr1,r10,r15
         blt+    cr0,1f
@@ -799,8 +805,14 @@ kernel_dbg_exc:
         andis.  r15,r14,(DBSR_IC|DBSR_BT)@h
         beq+    1f
 
+#ifdef CONFIG_RELOCATABLE
+        ld      r15,PACATOC(r13)
+        ld      r14,interrupt_base_book3e@got(r15)
+        ld      r15,__end_interrupts@got(r15)
+#else
         LOAD_REG_IMMEDIATE(r14,interrupt_base_book3e)
         LOAD_REG_IMMEDIATE(r15,__end_interrupts)
+#endif
         cmpld   cr0,r10,r14
         cmpld   cr1,r10,r15
         blt+    cr0,1f
diff --git a/arch/powerpc/kernel/hw_breakpoint.c b/arch/powerpc/kernel/hw_breakpoint.c
index 05e804cdecaa..fdf48785d3e9 100644
--- a/arch/powerpc/kernel/hw_breakpoint.c
+++ b/arch/powerpc/kernel/hw_breakpoint.c
@@ -227,8 +227,10 @@ int __kprobes hw_breakpoint_handler(struct die_args *args)
         rcu_read_lock();
 
         bp = __this_cpu_read(bp_per_reg);
-        if (!bp)
+        if (!bp) {
+                rc = NOTIFY_DONE;
                 goto out;
+        }
         info = counter_arch_bp(bp);
 
         /*
diff --git a/arch/powerpc/kernel/kprobes.c b/arch/powerpc/kernel/kprobes.c
index 7c053f281406..1138fec3dd65 100644
--- a/arch/powerpc/kernel/kprobes.c
+++ b/arch/powerpc/kernel/kprobes.c
@@ -514,6 +514,15 @@ int __kprobes setjmp_pre_handler(struct kprobe *p, struct pt_regs *regs)
 #endif
 #endif
 
+        /*
+         * jprobes use jprobe_return() which skips the normal return
+         * path of the function, and this messes up the accounting of the
+         * function graph tracer.
+         *
+         * Pause function graph tracing while performing the jprobe function.
+         */
+        pause_graph_tracing();
+
         return 1;
 }
 
@@ -536,6 +545,8 @@ int __kprobes longjmp_break_handler(struct kprobe *p, struct pt_regs *regs)
          * saved regs...
          */
         memcpy(regs, &kcb->jprobe_saved_regs, sizeof(struct pt_regs));
+        /* It's OK to start function graph tracing again */
+        unpause_graph_tracing();
         preempt_enable_no_resched();
         return 1;
 }
diff --git a/arch/powerpc/kernel/mce.c b/arch/powerpc/kernel/mce.c
index b2eb4686bd8f..da3c4c3f4ec8 100644
--- a/arch/powerpc/kernel/mce.c
+++ b/arch/powerpc/kernel/mce.c
@@ -204,6 +204,8 @@ static void machine_check_process_queued_event(struct irq_work *work)
 {
         int index;
 
+        add_taint(TAINT_MACHINE_CHECK, LOCKDEP_NOW_UNRELIABLE);
+
         /*
          * For now just print it to console.
          * TODO: log this error event to FSP or nvram.
diff --git a/arch/powerpc/kernel/prom_init.c b/arch/powerpc/kernel/prom_init.c
index 7b89e7b305e6..3139533640fc 100644
--- a/arch/powerpc/kernel/prom_init.c
+++ b/arch/powerpc/kernel/prom_init.c
@@ -2664,6 +2664,9 @@ static void __init prom_find_boot_cpu(void)
 
         cpu_pkg = call_prom("instance-to-package", 1, 1, prom_cpu);
 
+        if (!PHANDLE_VALID(cpu_pkg))
+                return;
+
         prom_getprop(cpu_pkg, "reg", &rval, sizeof(rval));
         prom.cpu = be32_to_cpu(rval);
 
diff --git a/arch/powerpc/kernel/setup_64.c b/arch/powerpc/kernel/setup_64.c
index 5c03a6a9b054..a20823210ac0 100644
--- a/arch/powerpc/kernel/setup_64.c
+++ b/arch/powerpc/kernel/setup_64.c
@@ -220,6 +220,15 @@ static void cpu_ready_for_interrupts(void)
                 unsigned long lpcr = mfspr(SPRN_LPCR);
                 mtspr(SPRN_LPCR, lpcr | LPCR_AIL_3);
         }
+
+        /*
+         * Fixup HFSCR:TM based on CPU features. The bit is set by our
+         * early asm init because at that point we haven't updated our
+         * CPU features from firmware and device-tree. Here we have,
+         * so let's do it.
+         */
+        if (cpu_has_feature(CPU_FTR_HVMODE) && !cpu_has_feature(CPU_FTR_TM_COMP))
+                mtspr(SPRN_HFSCR, mfspr(SPRN_HFSCR) & ~HFSCR_TM);
 }
 
 /*
diff --git a/arch/powerpc/kernel/traps.c b/arch/powerpc/kernel/traps.c
index 37de90f8a845..e4dcb0a43e3f 100644
--- a/arch/powerpc/kernel/traps.c
+++ b/arch/powerpc/kernel/traps.c
@@ -297,8 +297,6 @@ long machine_check_early(struct pt_regs *regs)
 
         __this_cpu_inc(irq_stat.mce_exceptions);
 
-        add_taint(TAINT_MACHINE_CHECK, LOCKDEP_NOW_UNRELIABLE);
-
         if (cur_cpu_spec && cur_cpu_spec->machine_check_early)
                 handled = cur_cpu_spec->machine_check_early(regs);
         return handled;
@@ -704,6 +702,8 @@ void machine_check_exception(struct pt_regs *regs)
 
         __this_cpu_inc(irq_stat.mce_exceptions);
 
+        add_taint(TAINT_MACHINE_CHECK, LOCKDEP_NOW_UNRELIABLE);
+
         /* See if any machine dependent calls. In theory, we would want
          * to call the CPU first, and call the ppc_md. one if the CPU
          * one returns a positive number. However there is existing code
diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c
index 3c3a367b6e59..428563b195c3 100644
--- a/arch/powerpc/kvm/book3s_hv.c
+++ b/arch/powerpc/kvm/book3s_hv.c
@@ -2687,12 +2687,38 @@ static int kvmppc_vcpu_run_hv(struct kvm_run *run, struct kvm_vcpu *vcpu)
 {
         int r;
         int srcu_idx;
+        unsigned long ebb_regs[3] = {}; /* shut up GCC */
+        unsigned long user_tar = 0;
+        unsigned long proc_fscr = 0;
+        unsigned int user_vrsave;
 
         if (!vcpu->arch.sane) {
                 run->exit_reason = KVM_EXIT_INTERNAL_ERROR;
                 return -EINVAL;
         }
 
+        /*
+         * Don't allow entry with a suspended transaction, because
+         * the guest entry/exit code will lose it.
+         * If the guest has TM enabled, save away their TM-related SPRs
+         * (they will get restored by the TM unavailable interrupt).
+         */
+#ifdef CONFIG_PPC_TRANSACTIONAL_MEM
+        if (cpu_has_feature(CPU_FTR_TM) && current->thread.regs &&
+            (current->thread.regs->msr & MSR_TM)) {
+                if (MSR_TM_ACTIVE(current->thread.regs->msr)) {
+                        run->exit_reason = KVM_EXIT_FAIL_ENTRY;
+                        run->fail_entry.hardware_entry_failure_reason = 0;
+                        return -EINVAL;
+                }
+                /* Enable TM so we can read the TM SPRs */
+                mtmsr(mfmsr() | MSR_TM);
+                current->thread.tm_tfhar = mfspr(SPRN_TFHAR);
+                current->thread.tm_tfiar = mfspr(SPRN_TFIAR);
+                current->thread.tm_texasr = mfspr(SPRN_TEXASR);
+        }
+#endif
+
         kvmppc_core_prepare_to_enter(vcpu);
 
         /* No need to go into the guest when all we'll do is come back out */
@@ -2715,6 +2741,17 @@ static int kvmppc_vcpu_run_hv(struct kvm_run *run, struct kvm_vcpu *vcpu)
         flush_fp_to_thread(current);
         flush_altivec_to_thread(current);
         flush_vsx_to_thread(current);
+
+        /* Save userspace EBB and other register values */
+        if (cpu_has_feature(CPU_FTR_ARCH_207S)) {
+                ebb_regs[0] = mfspr(SPRN_EBBHR);
+                ebb_regs[1] = mfspr(SPRN_EBBRR);
+                ebb_regs[2] = mfspr(SPRN_BESCR);
+                user_tar = mfspr(SPRN_TAR);
+                proc_fscr = mfspr(SPRN_FSCR);
+        }
+        user_vrsave = mfspr(SPRN_VRSAVE);
+
         vcpu->arch.wqp = &vcpu->arch.vcore->wq;
         vcpu->arch.pgdir = current->mm->pgd;
         vcpu->arch.state = KVMPPC_VCPU_BUSY_IN_HOST;
@@ -2736,6 +2773,29 @@ static int kvmppc_vcpu_run_hv(struct kvm_run *run, struct kvm_vcpu *vcpu)
                 }
         } while (is_kvmppc_resume_guest(r));
 
+        /* Restore userspace EBB and other register values */
+        if (cpu_has_feature(CPU_FTR_ARCH_207S)) {
+                mtspr(SPRN_EBBHR, ebb_regs[0]);
+                mtspr(SPRN_EBBRR, ebb_regs[1]);
+                mtspr(SPRN_BESCR, ebb_regs[2]);
+                mtspr(SPRN_TAR, user_tar);
+                mtspr(SPRN_FSCR, proc_fscr);
+        }
+        mtspr(SPRN_VRSAVE, user_vrsave);
+
+        /*
+         * Since we don't do lazy TM reload, we need to reload
+         * the TM registers here.
+         */
+#ifdef CONFIG_PPC_TRANSACTIONAL_MEM
+        if (cpu_has_feature(CPU_FTR_TM) && current->thread.regs &&
+            (current->thread.regs->msr & MSR_TM)) {
+                mtspr(SPRN_TFHAR, current->thread.tm_tfhar);
+                mtspr(SPRN_TFIAR, current->thread.tm_tfiar);
+                mtspr(SPRN_TEXASR, current->thread.tm_texasr);
+        }
+#endif
+
  out:
         vcpu->arch.state = KVMPPC_VCPU_NOTREADY;
         atomic_dec(&vcpu->kvm->arch.vcpus_running);
diff --git a/arch/powerpc/kvm/book3s_hv_rmhandlers.S b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
index 1a743f87b37d..ffab9269bfe4 100644
--- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S
+++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
@@ -36,6 +36,13 @@
 #define NAPPING_CEDE    1
 #define NAPPING_NOVCPU  2
 
+/* Stack frame offsets for kvmppc_hv_entry */
+#define SFS                     112
+#define STACK_SLOT_TRAP         (SFS-4)
+#define STACK_SLOT_CIABR        (SFS-16)
+#define STACK_SLOT_DAWR         (SFS-24)
+#define STACK_SLOT_DAWRX        (SFS-32)
+
 /*
  * Call kvmppc_hv_entry in real mode.
  * Must be called with interrupts hard-disabled.
@@ -274,10 +281,10 @@ kvm_novcpu_exit:
         bl      kvmhv_accumulate_time
 #endif
 13:     mr      r3, r12
-        stw     r12, 112-4(r1)
+        stw     r12, STACK_SLOT_TRAP(r1)
         bl      kvmhv_commence_exit
         nop
-        lwz     r12, 112-4(r1)
+        lwz     r12, STACK_SLOT_TRAP(r1)
         b       kvmhv_switch_to_host
 
 /*
@@ -489,7 +496,7 @@ kvmppc_hv_entry:
          */
         mflr    r0
         std     r0, PPC_LR_STKOFF(r1)
-        stdu    r1, -112(r1)
+        stdu    r1, -SFS(r1)
 
         /* Save R1 in the PACA */
         std     r1, HSTATE_HOST_R1(r13)
@@ -643,6 +650,16 @@ kvmppc_got_guest:
         mtspr   SPRN_PURR,r7
         mtspr   SPRN_SPURR,r8
 
+        /* Save host values of some registers */
+BEGIN_FTR_SECTION
+        mfspr   r5, SPRN_CIABR
+        mfspr   r6, SPRN_DAWR
+        mfspr   r7, SPRN_DAWRX
+        std     r5, STACK_SLOT_CIABR(r1)
+        std     r6, STACK_SLOT_DAWR(r1)
+        std     r7, STACK_SLOT_DAWRX(r1)
+END_FTR_SECTION_IFSET(CPU_FTR_ARCH_207S)
+
 BEGIN_FTR_SECTION
         /* Set partition DABR */
         /* Do this before re-enabling PMU to avoid P7 DABR corruption bug */
@@ -1266,8 +1283,7 @@ END_FTR_SECTION_IFCLR(CPU_FTR_ARCH_207S)
          */
         li      r0, 0
         mtspr   SPRN_IAMR, r0
-        mtspr   SPRN_CIABR, r0
-        mtspr   SPRN_DAWRX, r0
+        mtspr   SPRN_PSPB, r0
         mtspr   SPRN_TCSCR, r0
         mtspr   SPRN_WORT, r0
         /* Set MMCRS to 1<<31 to freeze and disable the SPMC counters */
@@ -1283,6 +1299,7 @@ END_FTR_SECTION_IFCLR(CPU_FTR_ARCH_207S)
         std     r6,VCPU_UAMOR(r9)
         li      r6,0
         mtspr   SPRN_AMR,r6
+        mtspr   SPRN_UAMOR, r6
 
         /* Switch DSCR back to host value */
         mfspr   r8, SPRN_DSCR
@@ -1424,6 +1441,16 @@ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_207S)
         slbia
         ptesync
 
+        /* Restore host values of some registers */
+BEGIN_FTR_SECTION
+        ld      r5, STACK_SLOT_CIABR(r1)
+        ld      r6, STACK_SLOT_DAWR(r1)
+        ld      r7, STACK_SLOT_DAWRX(r1)
+        mtspr   SPRN_CIABR, r5
+        mtspr   SPRN_DAWR, r6
+        mtspr   SPRN_DAWRX, r7
+END_FTR_SECTION_IFSET(CPU_FTR_ARCH_207S)
+
         /*
          * POWER7/POWER8 guest -> host partition switch code.
          * We don't have to lock against tlbies but we do
@@ -1533,8 +1560,8 @@ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_207S)
         li      r0, KVM_GUEST_MODE_NONE
         stb     r0, HSTATE_IN_GUEST(r13)
 
-        ld      r0, 112+PPC_LR_STKOFF(r1)
-        addi    r1, r1, 112
+        ld      r0, SFS+PPC_LR_STKOFF(r1)
+        addi    r1, r1, SFS
         mtlr    r0
         blr
 
diff --git a/arch/powerpc/kvm/emulate.c b/arch/powerpc/kvm/emulate.c
index 5cc2e7af3a7b..b379146de55b 100644
--- a/arch/powerpc/kvm/emulate.c
+++ b/arch/powerpc/kvm/emulate.c
@@ -302,7 +302,6 @@ int kvmppc_emulate_instruction(struct kvm_run *run, struct kvm_vcpu *vcpu)
                         advance = 0;
                         printk(KERN_ERR "Couldn't emulate instruction 0x%08x "
                                "(op %d xop %d)\n", inst, get_op(inst), get_xop(inst));
-                        kvmppc_core_queue_program(vcpu, 0);
                 }
         }
 
diff --git a/arch/powerpc/lib/sstep.c b/arch/powerpc/lib/sstep.c
index dc885b30f7a6..e37162d356d8 100644
--- a/arch/powerpc/lib/sstep.c
+++ b/arch/powerpc/lib/sstep.c
@@ -687,8 +687,10 @@ int __kprobes analyse_instr(struct instruction_op *op, struct pt_regs *regs,
         case 19:
                 switch ((instr >> 1) & 0x3ff) {
                 case 0:         /* mcrf */
-                        rd = (instr >> 21) & 0x1c;
-                        ra = (instr >> 16) & 0x1c;
+                        rd = 7 - ((instr >> 23) & 0x7);
+                        ra = 7 - ((instr >> 18) & 0x7);
+                        rd *= 4;
+                        ra *= 4;
                         val = (regs->ccr >> ra) & 0xf;
                         regs->ccr = (regs->ccr & ~(0xfUL << rd)) | (val << rd);
                         goto instr_done;
@@ -967,6 +969,19 @@ int __kprobes analyse_instr(struct instruction_op *op, struct pt_regs *regs,
 #endif
 
                 case 19:        /* mfcr */
+                        if ((instr >> 20) & 1) {
+                                imm = 0xf0000000UL;
+                                for (sh = 0; sh < 8; ++sh) {
+                                        if (instr & (0x80000 >> sh)) {
+                                                regs->gpr[rd] = regs->ccr & imm;
+                                                break;
+                                        }
+                                        imm >>= 4;
+                                }
+
+                                goto instr_done;
+                        }
+
                         regs->gpr[rd] = regs->ccr;
                         regs->gpr[rd] &= 0xffffffffUL;
                         goto instr_done;
@@ -1806,8 +1821,6 @@ int __kprobes emulate_step(struct pt_regs *regs, unsigned int instr)
                 goto instr_done;
 
         case LARX:
-                if (regs->msr & MSR_LE)
-                        return 0;
                 if (op.ea & (size - 1))
                         break;          /* can't handle misaligned */
                 err = -EFAULT;
@@ -1829,8 +1842,6 @@ int __kprobes emulate_step(struct pt_regs *regs, unsigned int instr)
                 goto ldst_done;
 
         case STCX:
-                if (regs->msr & MSR_LE)
-                        return 0;
                 if (op.ea & (size - 1))
                         break;          /* can't handle misaligned */
                 err = -EFAULT;
@@ -1854,8 +1865,6 @@ int __kprobes emulate_step(struct pt_regs *regs, unsigned int instr)
                 goto ldst_done;
 
         case LOAD:
-                if (regs->msr & MSR_LE)
-                        return 0;
                 err = read_mem(&regs->gpr[op.reg], op.ea, size, regs);
                 if (!err) {
                         if (op.type & SIGNEXT)
@@ -1867,8 +1876,6 @@ int __kprobes emulate_step(struct pt_regs *regs, unsigned int instr)
 
 #ifdef CONFIG_PPC_FPU
         case LOAD_FP:
-                if (regs->msr & MSR_LE)
-                        return 0;
                 if (size == 4)
                         err = do_fp_load(op.reg, do_lfs, op.ea, size, regs);
                 else
@@ -1877,15 +1884,11 @@ int __kprobes emulate_step(struct pt_regs *regs, unsigned int instr)
 #endif
 #ifdef CONFIG_ALTIVEC
         case LOAD_VMX:
-                if (regs->msr & MSR_LE)
-                        return 0;
                 err = do_vec_load(op.reg, do_lvx, op.ea & ~0xfUL, regs);
                 goto ldst_done;
 #endif
 #ifdef CONFIG_VSX
         case LOAD_VSX:
-                if (regs->msr & MSR_LE)
-                        return 0;
                 err = do_vsx_load(op.reg, do_lxvd2x, op.ea, regs);
                 goto ldst_done;
 #endif
@@ -1908,8 +1911,6 @@ int __kprobes emulate_step(struct pt_regs *regs, unsigned int instr)
                 goto instr_done;
 
         case STORE:
-                if (regs->msr & MSR_LE)
-                        return 0;
                 if ((op.type & UPDATE) && size == sizeof(long) &&
                     op.reg == 1 && op.update_reg == 1 &&
                     !(regs->msr & MSR_PR) &&
@@ -1922,8 +1923,6 @@ int __kprobes emulate_step(struct pt_regs *regs, unsigned int instr)
 
 #ifdef CONFIG_PPC_FPU
         case STORE_FP:
-                if (regs->msr & MSR_LE)
-                        return 0;
                 if (size == 4)
                         err = do_fp_store(op.reg, do_stfs, op.ea, size, regs);
                 else
@@ -1932,15 +1931,11 @@ int __kprobes emulate_step(struct pt_regs *regs, unsigned int instr)
 #endif
 #ifdef CONFIG_ALTIVEC
         case STORE_VMX:
-                if (regs->msr & MSR_LE)
-                        return 0;
                 err = do_vec_store(op.reg, do_stvx, op.ea & ~0xfUL, regs);
                 goto ldst_done;
 #endif
 #ifdef CONFIG_VSX
         case STORE_VSX:
-                if (regs->msr & MSR_LE)
-                        return 0;
                 err = do_vsx_store(op.reg, do_stxvd2x, op.ea, regs);
                 goto ldst_done;
 #endif
diff --git a/arch/powerpc/mm/hash_native_64.c b/arch/powerpc/mm/hash_native_64.c
index c8822af10a58..19d9b2d2d212 100644
--- a/arch/powerpc/mm/hash_native_64.c
+++ b/arch/powerpc/mm/hash_native_64.c
@@ -645,6 +645,10 @@ static void native_flush_hash_range(unsigned long number, int local)
         unsigned long psize = batch->psize;
         int ssize = batch->ssize;
         int i;
+        unsigned int use_local;
+
+        use_local = local && mmu_has_feature(MMU_FTR_TLBIEL) &&
+                mmu_psize_defs[psize].tlbiel && !cxl_ctx_in_use();
 
         local_irq_save(flags);
 
@@ -671,8 +675,7 @@ static void native_flush_hash_range(unsigned long number, int local)
                 } pte_iterate_hashed_end();
         }
 
-        if (mmu_has_feature(MMU_FTR_TLBIEL) &&
-            mmu_psize_defs[psize].tlbiel && local) {
+        if (use_local) {
                 asm volatile("ptesync":::"memory");
                 for (i = 0; i < number; i++) {
                         vpn = batch->vpn[i];
diff --git a/arch/powerpc/mm/slb_low.S b/arch/powerpc/mm/slb_low.S
index 4c48b487698c..0b48ce40d351 100644
--- a/arch/powerpc/mm/slb_low.S
+++ b/arch/powerpc/mm/slb_low.S
@@ -179,6 +179,16 @@ END_MMU_FTR_SECTION_IFSET(MMU_FTR_1T_SEGMENT)
         b       slb_finish_load
 
 8:      /* invalid EA */
+        /*
+         * It's possible the bad EA is too large to fit in the SLB cache, which
+         * would mean we'd fail to invalidate it on context switch. So mark the
+         * SLB cache as full so we force a full flush. We also set cr7+eq to
+         * mark the address as a kernel address, so slb_finish_load() skips
+         * trying to insert it into the SLB cache.
+         */
+        li      r9,SLB_CACHE_ENTRIES + 1
+        sth     r9,PACASLBCACHEPTR(r13)
+        crset   4*cr7+eq
         li      r10,0                   /* BAD_VSID */
         li      r9,0                    /* BAD_VSID */
         li      r11,SLB_VSID_USER       /* flags don't much matter */
diff --git a/arch/powerpc/mm/slice.c b/arch/powerpc/mm/slice.c
index 0f432a702870..6ad12b244770 100644
--- a/arch/powerpc/mm/slice.c
+++ b/arch/powerpc/mm/slice.c
@@ -105,7 +105,7 @@ static int slice_area_is_free(struct mm_struct *mm, unsigned long addr,
         if ((mm->task_size - len) < addr)
                 return 0;
         vma = find_vma(mm, addr);
-        return (!vma || (addr + len) <= vma->vm_start);
+        return (!vma || (addr + len) <= vm_start_gap(vma));
 }
 
 static int slice_low_has_vma(struct mm_struct *mm, unsigned long slice)
diff --git a/arch/powerpc/platforms/powernv/opal-wrappers.S b/arch/powerpc/platforms/powernv/opal-wrappers.S
index e45b88a5d7e0..ae877c7b3905 100644
--- a/arch/powerpc/platforms/powernv/opal-wrappers.S
+++ b/arch/powerpc/platforms/powernv/opal-wrappers.S
@@ -148,7 +148,7 @@ opal_tracepoint_entry:
 opal_tracepoint_return:
         std     r3,STK_REG(R31)(r1)
         mr      r4,r3
-        ld      r0,STK_REG(R23)(r1)
+        ld      r3,STK_REG(R23)(r1)
         bl      __trace_opal_exit
         ld      r3,STK_REG(R31)(r1)
         addi    r1,r1,STACKFRAMESIZE
diff --git a/arch/powerpc/platforms/pseries/dlpar.c b/arch/powerpc/platforms/pseries/dlpar.c
index f244dcb4f2cf..96536c969c9c 100644
--- a/arch/powerpc/platforms/pseries/dlpar.c
+++ b/arch/powerpc/platforms/pseries/dlpar.c
@@ -280,7 +280,6 @@ int dlpar_detach_node(struct device_node *dn)
         if (rc)
                 return rc;
 
-        of_node_put(dn); /* Must decrement the refcount */
         return 0;
 }
 
diff --git a/arch/powerpc/platforms/pseries/hotplug-memory.c b/arch/powerpc/platforms/pseries/hotplug-memory.c
index e9ff44cd5d86..e8b1027e1b5b 100644
--- a/arch/powerpc/platforms/pseries/hotplug-memory.c
+++ b/arch/powerpc/platforms/pseries/hotplug-memory.c
@@ -110,6 +110,7 @@ static struct property *dlpar_clone_drconf_property(struct device_node *dn)
         for (i = 0; i < num_lmbs; i++) {
                 lmbs[i].base_addr = be64_to_cpu(lmbs[i].base_addr);
                 lmbs[i].drc_index = be32_to_cpu(lmbs[i].drc_index);
+                lmbs[i].aa_index = be32_to_cpu(lmbs[i].aa_index);
                 lmbs[i].flags = be32_to_cpu(lmbs[i].flags);
         }
 
@@ -553,6 +554,7 @@ static void dlpar_update_drconf_property(struct device_node *dn,
         for (i = 0; i < num_lmbs; i++) {
                 lmbs[i].base_addr = cpu_to_be64(lmbs[i].base_addr);
                 lmbs[i].drc_index = cpu_to_be32(lmbs[i].drc_index);
+                lmbs[i].aa_index = cpu_to_be32(lmbs[i].aa_index);
                 lmbs[i].flags = cpu_to_be32(lmbs[i].flags);
         }
 
diff --git a/arch/powerpc/platforms/pseries/reconfig.c b/arch/powerpc/platforms/pseries/reconfig.c
index 7c7fcc042549..fb695f142563 100644
--- a/arch/powerpc/platforms/pseries/reconfig.c
+++ b/arch/powerpc/platforms/pseries/reconfig.c
@@ -82,7 +82,6 @@ static int pSeries_reconfig_remove_node(struct device_node *np)
 
         of_detach_node(np);
         of_node_put(parent);
-        of_node_put(np); /* Must decrement the refcount */
         return 0;
 }
 
diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig
index 60530fd93d6d..06176328f83d 100644
--- a/arch/s390/Kconfig
+++ b/arch/s390/Kconfig
@@ -62,6 +62,9 @@ config PCI_QUIRKS
 config ARCH_SUPPORTS_UPROBES
         def_bool y
 
+config DEBUG_RODATA
+        def_bool y
+
 config S390
         def_bool y
         select ARCH_HAS_ATOMIC64_DEC_IF_POSITIVE
diff --git a/arch/s390/boot/compressed/misc.c b/arch/s390/boot/compressed/misc.c
index 4da604ebf6fd..ca15613eaaa4 100644
--- a/arch/s390/boot/compressed/misc.c
+++ b/arch/s390/boot/compressed/misc.c
@@ -141,31 +141,34 @@ static void check_ipl_parmblock(void *start, unsigned long size)
 
 unsigned long decompress_kernel(void)
 {
-        unsigned long output_addr;
-        unsigned char *output;
+        void *output, *kernel_end;
 
-        output_addr = ((unsigned long) &_end + HEAP_SIZE + 4095UL) & -4096UL;
-        check_ipl_parmblock((void *) 0, output_addr + SZ__bss_start);
-        memset(&_bss, 0, &_ebss - &_bss);
-        free_mem_ptr = (unsigned long)&_end;
-        free_mem_end_ptr = free_mem_ptr + HEAP_SIZE;
-        output = (unsigned char *) output_addr;
+        output = (void *) ALIGN((unsigned long) &_end + HEAP_SIZE, PAGE_SIZE);
+        kernel_end = output + SZ__bss_start;
+        check_ipl_parmblock((void *) 0, (unsigned long) kernel_end);
 
 #ifdef CONFIG_BLK_DEV_INITRD
         /*
          * Move the initrd right behind the end of the decompressed
-         * kernel image.
+         * kernel image. This also prevents initrd corruption caused by
+         * bss clearing since kernel_end will always be located behind the
+         * current bss section..
          */
-        if (INITRD_START && INITRD_SIZE &&
-            INITRD_START < (unsigned long) output + SZ__bss_start) {
-                check_ipl_parmblock(output + SZ__bss_start,
-                                    INITRD_START + INITRD_SIZE);
-                memmove(output + SZ__bss_start,
-                        (void *) INITRD_START, INITRD_SIZE);
-                INITRD_START = (unsigned long) output + SZ__bss_start;
+        if (INITRD_START && INITRD_SIZE && kernel_end > (void *) INITRD_START) {
+                check_ipl_parmblock(kernel_end, INITRD_SIZE);
+                memmove(kernel_end, (void *) INITRD_START, INITRD_SIZE);
+                INITRD_START = (unsigned long) kernel_end;
         }
 #endif
 
+        /*
+         * Clear bss section. free_mem_ptr and free_mem_end_ptr need to be
+         * initialized afterwards since they reside in bss.
+         */
+        memset(&_bss, 0, &_ebss - &_bss);
+        free_mem_ptr = (unsigned long) &_end;
+        free_mem_end_ptr = free_mem_ptr + HEAP_SIZE;
+
         puts("Uncompressing Linux... ");
         __decompress(input_data, input_len, NULL, NULL, output, 0, NULL, error);
         puts("Ok, booting the kernel.\n");
diff --git a/arch/s390/include/asm/ctl_reg.h b/arch/s390/include/asm/ctl_reg.h
index d7697ab802f6..8e136b88cdf4 100644
--- a/arch/s390/include/asm/ctl_reg.h
+++ b/arch/s390/include/asm/ctl_reg.h
@@ -15,7 +15,9 @@
         BUILD_BUG_ON(sizeof(addrtype) != (high - low + 1) * sizeof(long));\
         asm volatile(                                                   \
                 "       lctlg   %1,%2,%0\n"                             \
-                : : "Q" (*(addrtype *)(&array)), "i" (low), "i" (high));\
+                :                                                       \
+                : "Q" (*(addrtype *)(&array)), "i" (low), "i" (high)    \
+                : "memory");                                            \
 }
 
 #define __ctl_store(array, low, high) {                                 \
diff --git a/arch/s390/include/asm/elf.h b/arch/s390/include/asm/elf.h
index bab6739a1154..b9eb7b1a49d2 100644
--- a/arch/s390/include/asm/elf.h
+++ b/arch/s390/include/asm/elf.h
@@ -154,14 +154,13 @@ extern unsigned int vdso_enabled;
 #define CORE_DUMP_USE_REGSET
 #define ELF_EXEC_PAGESIZE       4096
 
-/* This is the location that an ET_DYN program is loaded if exec'ed.  Typical
-   use of this is to invoke "./ld.so someprog" to test out a new version of
-   the loader.  We need to make sure that it is out of the way of the program
-   that it will "exec", and that there is sufficient room for the brk. 64-bit
-   tasks are aligned to 4GB. */
-#define ELF_ET_DYN_BASE (is_32bit_task() ? \
-                                (STACK_TOP / 3 * 2) : \
-                                (STACK_TOP / 3 * 2) & ~((1UL << 32) - 1))
+/*
+ * This is the base location for PIE (ET_DYN with INTERP) loads. On
+ * 64-bit, this is raised to 4GB to leave the entire 32-bit address
+ * space open for things that want to use the area for 32-bit pointers.
+ */
+#define ELF_ET_DYN_BASE         (is_compat_task() ? 0x000400000UL : \
+                                                    0x100000000UL)
 
 /* This yields a mask that user programs can use to figure out what
    instruction set this CPU supports. */
diff --git a/arch/s390/include/asm/pgtable.h b/arch/s390/include/asm/pgtable.h
index 024f85f947ae..e2c0e4eab037 100644
--- a/arch/s390/include/asm/pgtable.h
+++ b/arch/s390/include/asm/pgtable.h
@@ -829,6 +829,8 @@ static inline void set_pte_at(struct mm_struct *mm, unsigned long addr,
 {
         pgste_t pgste;
 
+        if (pte_present(entry))
+                pte_val(entry) &= ~_PAGE_UNUSED;
         if (mm_has_pgste(mm)) {
                 pgste = pgste_get_lock(ptep);
                 pgste_val(pgste) &= ~_PGSTE_GPS_ZERO;
diff --git a/arch/s390/include/asm/processor.h b/arch/s390/include/asm/processor.h
index c1ea67db8404..c61ed7890cef 100644
--- a/arch/s390/include/asm/processor.h
+++ b/arch/s390/include/asm/processor.h
@@ -74,7 +74,8 @@ extern void execve_tail(void);
  * User space process size: 2GB for 31 bit, 4TB or 8PT for 64 bit.
  */
 
-#define TASK_SIZE_OF(tsk)       ((tsk)->mm->context.asce_limit)
+#define TASK_SIZE_OF(tsk)       ((tsk)->mm ? \
+                                 (tsk)->mm->context.asce_limit : TASK_MAX_SIZE)
 #define TASK_UNMAPPED_BASE      (test_thread_flag(TIF_31BIT) ? \
                                         (1UL << 30) : (1UL << 41))
 #define TASK_SIZE               TASK_SIZE_OF(current)
diff --git a/arch/s390/include/asm/syscall.h b/arch/s390/include/asm/syscall.h
index 6ba0bf928909..6bc941be6921 100644
--- a/arch/s390/include/asm/syscall.h
+++ b/arch/s390/include/asm/syscall.h
@@ -64,6 +64,12 @@ static inline void syscall_get_arguments(struct task_struct *task,
 {
         unsigned long mask = -1UL;
 
+        /*
+         * No arguments for this syscall, there's nothing to do.
+         */
+        if (!n)
+                return;
+
         BUG_ON(i + n > 6);
 #ifdef CONFIG_COMPAT
         if (test_tsk_thread_flag(task, TIF_31BIT))
diff --git a/arch/s390/include/asm/uaccess.h b/arch/s390/include/asm/uaccess.h
index 5c7381c5ad7f..c8d837f0fbbc 100644
--- a/arch/s390/include/asm/uaccess.h
+++ b/arch/s390/include/asm/uaccess.h
@@ -150,7 +150,7 @@ unsigned long __must_check __copy_to_user(void __user *to, const void *from,
                 "       jg      2b\n"                           \
                 ".popsection\n"                                 \
                 EX_TABLE(0b,3b) EX_TABLE(1b,3b)                 \
-                : "=d" (__rc), "=Q" (*(to))                     \
+                : "=d" (__rc), "+Q" (*(to))                     \
                 : "d" (size), "Q" (*(from)),                    \
                   "d" (__reg0), "K" (-EFAULT)                   \
                 : "cc");                                        \
diff --git a/arch/s390/kernel/crash_dump.c b/arch/s390/kernel/crash_dump.c
index 171e09bb8ea2..df4685905015 100644
--- a/arch/s390/kernel/crash_dump.c
+++ b/arch/s390/kernel/crash_dump.c
@@ -23,6 +23,8 @@
 #define PTR_SUB(x, y) (((char *) (x)) - ((unsigned long) (y)))
 #define PTR_DIFF(x, y) ((unsigned long)(((char *) (x)) - ((unsigned long) (y))))
 
+#define LINUX_NOTE_NAME "LINUX"
+
 static struct memblock_region oldmem_region;
 
 static struct memblock_type oldmem_type = {
@@ -312,7 +314,7 @@ static void *nt_fpregset(void *ptr, struct save_area *sa)
 static void *nt_s390_timer(void *ptr, struct save_area *sa)
 {
         return nt_init(ptr, NT_S390_TIMER, &sa->timer, sizeof(sa->timer),
-                         KEXEC_CORE_NOTE_NAME);
+                         LINUX_NOTE_NAME);
 }
 
 /*
@@ -321,7 +323,7 @@ static void *nt_s390_timer(void *ptr, struct save_area *sa)
 static void *nt_s390_tod_cmp(void *ptr, struct save_area *sa)
 {
         return nt_init(ptr, NT_S390_TODCMP, &sa->clk_cmp,
-                       sizeof(sa->clk_cmp), KEXEC_CORE_NOTE_NAME);
+                       sizeof(sa->clk_cmp), LINUX_NOTE_NAME);
 }
 
 /*
@@ -330,7 +332,7 @@ static void *nt_s390_tod_cmp(void *ptr, struct save_area *sa)
 static void *nt_s390_tod_preg(void *ptr, struct save_area *sa)
 {
         return nt_init(ptr, NT_S390_TODPREG, &sa->tod_reg,
-                       sizeof(sa->tod_reg), KEXEC_CORE_NOTE_NAME);
+                       sizeof(sa->tod_reg), LINUX_NOTE_NAME);
 }
 
 /*
@@ -339,7 +341,7 @@ static void *nt_s390_tod_preg(void *ptr, struct save_area *sa)
 static void *nt_s390_ctrs(void *ptr, struct save_area *sa)
 {
         return nt_init(ptr, NT_S390_CTRS, &sa->ctrl_regs,
-                       sizeof(sa->ctrl_regs), KEXEC_CORE_NOTE_NAME);
+                       sizeof(sa->ctrl_regs), LINUX_NOTE_NAME);
 }
 
 /*
@@ -348,7 +350,7 @@ static void *nt_s390_ctrs(void *ptr, struct save_area *sa)
 static void *nt_s390_prefix(void *ptr, struct save_area *sa)
 {
         return nt_init(ptr, NT_S390_PREFIX, &sa->pref_reg,
-                         sizeof(sa->pref_reg), KEXEC_CORE_NOTE_NAME);
+                         sizeof(sa->pref_reg), LINUX_NOTE_NAME);
 }
 
 /*
@@ -357,7 +359,7 @@ static void *nt_s390_prefix(void *ptr, struct save_area *sa)
 static void *nt_s390_vx_high(void *ptr, __vector128 *vx_regs)
 {
         return nt_init(ptr, NT_S390_VXRS_HIGH, &vx_regs[16],
-                       16 * sizeof(__vector128), KEXEC_CORE_NOTE_NAME);
+                       16 * sizeof(__vector128), LINUX_NOTE_NAME);
 }
 
 /*
@@ -370,12 +372,12 @@ static void *nt_s390_vx_low(void *ptr, __vector128 *vx_regs)
         int i;
 
         note = (Elf64_Nhdr *)ptr;
-        note->n_namesz = strlen(KEXEC_CORE_NOTE_NAME) + 1;
+        note->n_namesz = strlen(LINUX_NOTE_NAME) + 1;
         note->n_descsz = 16 * 8;
         note->n_type = NT_S390_VXRS_LOW;
         len = sizeof(Elf64_Nhdr);
 
-        memcpy(ptr + len, KEXEC_CORE_NOTE_NAME, note->n_namesz);
+        memcpy(ptr + len, LINUX_NOTE_NAME, note->n_namesz);
         len = roundup(len + note->n_namesz, 4);
 
         ptr += len;
@@ -462,6 +464,20 @@ static void *nt_vmcoreinfo(void *ptr)
 }
 
 /*
+ * Initialize final note (needed for /proc/vmcore code)
+ */
+static void *nt_final(void *ptr)
+{
+        Elf64_Nhdr *note;
+
+        note = (Elf64_Nhdr *) ptr;
+        note->n_namesz = 0;
+        note->n_descsz = 0;
+        note->n_type = 0;
+        return PTR_ADD(ptr, sizeof(Elf64_Nhdr));
+}
+
+/*
  * Initialize ELF header (new kernel)
  */
 static void *ehdr_init(Elf64_Ehdr *ehdr, int mem_chunk_cnt)
@@ -551,6 +567,7 @@ static void *notes_init(Elf64_Phdr *phdr, void *ptr, u64 notes_offset)
                 ptr = fill_cpu_elf_notes(ptr, &sa_ext->sa, sa_ext->vx_regs);
         }
         ptr = nt_vmcoreinfo(ptr);
+        ptr = nt_final(ptr);
         memset(phdr, 0, sizeof(*phdr));
         phdr->p_type = PT_NOTE;
         phdr->p_offset = notes_offset;
diff --git a/arch/s390/kernel/entry.S b/arch/s390/kernel/entry.S
index 424e6809ad07..4612ed7ec2e5 100644
--- a/arch/s390/kernel/entry.S
+++ b/arch/s390/kernel/entry.S
@@ -229,12 +229,17 @@ ENTRY(sie64a)
         lctlg   %c1,%c1,__LC_USER_ASCE          # load primary asce
 .Lsie_done:
 # some program checks are suppressing. C code (e.g. do_protection_exception)
-# will rewind the PSW by the ILC, which is 4 bytes in case of SIE. Other
-# instructions between sie64a and .Lsie_done should not cause program
-# interrupts. So lets use a nop (47 00 00 00) as a landing pad.
+# will rewind the PSW by the ILC, which is often 4 bytes in case of SIE. There
+# are some corner cases (e.g. runtime instrumentation) where ILC is unpredictable.
+# Other instructions between sie64a and .Lsie_done should not cause program
+# interrupts. So lets use 3 nops as a landing pad for all possible rewinds.
 # See also .Lcleanup_sie
-.Lrewind_pad:
-        nop     0
+.Lrewind_pad6:
+        nopr    7
+.Lrewind_pad4:
+        nopr    7
+.Lrewind_pad2:
+        nopr    7
         .globl sie_exit
 sie_exit:
         lg      %r14,__SF_EMPTY+8(%r15)         # load guest register save area
@@ -247,7 +252,9 @@ sie_exit:
         stg     %r14,__SF_EMPTY+16(%r15)        # set exit reason code
         j       sie_exit
 
-        EX_TABLE(.Lrewind_pad,.Lsie_fault)
+        EX_TABLE(.Lrewind_pad6,.Lsie_fault)
+        EX_TABLE(.Lrewind_pad4,.Lsie_fault)
+        EX_TABLE(.Lrewind_pad2,.Lsie_fault)
         EX_TABLE(sie_exit,.Lsie_fault)
 #endif
 
@@ -308,6 +315,7 @@ ENTRY(system_call)
         lg      %r14,__LC_VDSO_PER_CPU
         lmg     %r0,%r10,__PT_R0(%r11)
         mvc     __LC_RETURN_PSW(16),__PT_PSW(%r11)
+.Lsysc_exit_timer:
         stpt    __LC_EXIT_TIMER
         mvc     __VDSO_ECTG_BASE(16,%r14),__LC_EXIT_TIMER
         lmg     %r11,%r15,__PT_R11(%r11)
@@ -593,6 +601,7 @@ ENTRY(io_int_handler)
         lg      %r14,__LC_VDSO_PER_CPU
         lmg     %r0,%r10,__PT_R0(%r11)
         mvc     __LC_RETURN_PSW(16),__PT_PSW(%r11)
+.Lio_exit_timer:
         stpt    __LC_EXIT_TIMER
         mvc     __VDSO_ECTG_BASE(16,%r14),__LC_EXIT_TIMER
         lmg     %r11,%r15,__PT_R11(%r11)
@@ -1118,15 +1127,23 @@ cleanup_critical:
         br      %r14
 
 .Lcleanup_sysc_restore:
+        # check if stpt has been executed
         clg     %r9,BASED(.Lcleanup_sysc_restore_insn)
+        jh      0f
+        mvc     __LC_EXIT_TIMER(8),__LC_ASYNC_ENTER_TIMER
+        cghi    %r11,__LC_SAVE_AREA_ASYNC
         je      0f
+        mvc     __LC_EXIT_TIMER(8),__LC_MCCK_ENTER_TIMER
+0:      clg     %r9,BASED(.Lcleanup_sysc_restore_insn+8)
+        je      1f
         lg      %r9,24(%r11)            # get saved pointer to pt_regs
         mvc     __LC_RETURN_PSW(16),__PT_PSW(%r9)
         mvc     0(64,%r11),__PT_R8(%r9)
         lmg     %r0,%r7,__PT_R0(%r9)
-0:      lmg     %r8,%r9,__LC_RETURN_PSW
+1:      lmg     %r8,%r9,__LC_RETURN_PSW
         br      %r14
 .Lcleanup_sysc_restore_insn:
+        .quad   .Lsysc_exit_timer
         .quad   .Lsysc_done - 4
 
 .Lcleanup_io_tif:
@@ -1134,15 +1151,20 @@ cleanup_critical:
         br      %r14
 
 .Lcleanup_io_restore:
+        # check if stpt has been executed
         clg     %r9,BASED(.Lcleanup_io_restore_insn)
-        je      0f
+        jh      0f
+        mvc     __LC_EXIT_TIMER(8),__LC_MCCK_ENTER_TIMER
+0:      clg     %r9,BASED(.Lcleanup_io_restore_insn+8)
+        je      1f
         lg      %r9,24(%r11)            # get saved r11 pointer to pt_regs
         mvc     __LC_RETURN_PSW(16),__PT_PSW(%r9)
         mvc     0(64,%r11),__PT_R8(%r9)
         lmg     %r0,%r7,__PT_R0(%r9)
-0:      lmg     %r8,%r9,__LC_RETURN_PSW
+1:      lmg     %r8,%r9,__LC_RETURN_PSW
         br      %r14
 .Lcleanup_io_restore_insn:
+        .quad   .Lio_exit_timer
         .quad   .Lio_done - 4
 
 .Lcleanup_idle:
diff --git a/arch/s390/kernel/ptrace.c b/arch/s390/kernel/ptrace.c
index 01c37b36caf9..02bd587b610b 100644
--- a/arch/s390/kernel/ptrace.c
+++ b/arch/s390/kernel/ptrace.c
@@ -963,6 +963,11 @@ static int s390_fpregs_set(struct task_struct *target,
         if (target == current)
                 save_fpu_regs();
 
+        if (MACHINE_HAS_VX)
+                convert_vx_to_fp(fprs, target->thread.fpu.vxrs);
+        else
+                memcpy(&fprs, target->thread.fpu.fprs, sizeof(fprs));
+
         /* If setting FPC, must validate it first. */
         if (count > 0 && pos < offsetof(s390_fp_regs, fprs)) {
                 u32 ufpc[2] = { target->thread.fpu.fpc, 0 };
@@ -1067,6 +1072,9 @@ static int s390_vxrs_low_set(struct task_struct *target,
         if (target == current)
                 save_fpu_regs();
 
+        for (i = 0; i < __NUM_VXRS_LOW; i++)
+                vxrs[i] = *((__u64 *)(target->thread.fpu.vxrs + i) + 1);
+
         rc = user_regset_copyin(&pos, &count, &kbuf, &ubuf, vxrs, 0, -1);
         if (rc == 0)
                 for (i = 0; i < __NUM_VXRS_LOW; i++)
diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c
index 1f581eb61bc2..d097d71685df 100644
--- a/arch/s390/kernel/setup.c
+++ b/arch/s390/kernel/setup.c
@@ -805,10 +805,10 @@ static void __init setup_randomness(void)
 {
         struct sysinfo_3_2_2 *vmms;
 
-        vmms = (struct sysinfo_3_2_2 *) alloc_page(GFP_KERNEL);
-        if (vmms && stsi(vmms, 3, 2, 2) == 0 && vmms->count)
-                add_device_randomness(&vmms, vmms->count);
-        free_page((unsigned long) vmms);
+        vmms = (struct sysinfo_3_2_2 *) memblock_alloc(PAGE_SIZE, PAGE_SIZE);
+        if (stsi(vmms, 3, 2, 2) == 0 && vmms->count)
+                add_device_randomness(&vmms->vm, sizeof(vmms->vm[0]) * vmms->count);
+        memblock_free((unsigned long) vmms, PAGE_SIZE);
 }
 
 /*
diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
index 575dc123bda2..23e3f5d77a24 100644
--- a/arch/s390/kvm/kvm-s390.c
+++ b/arch/s390/kvm/kvm-s390.c
@@ -295,6 +295,9 @@ int kvm_vm_ioctl_get_dirty_log(struct kvm *kvm,
         struct kvm_memory_slot *memslot;
         int is_dirty = 0;
 
+        if (kvm_is_ucontrol(kvm))
+                return -EINVAL;
+
         mutex_lock(&kvm->slots_lock);
 
         r = -EINVAL;
diff --git a/arch/s390/mm/init.c b/arch/s390/mm/init.c
index feff9caf89b5..91376d9e4286 100644
--- a/arch/s390/mm/init.c
+++ b/arch/s390/mm/init.c
@@ -109,6 +109,13 @@ void __init paging_init(void)
         free_area_init_nodes(max_zone_pfns);
 }
 
+void mark_rodata_ro(void)
+{
+        /* Text and rodata are already protected. Nothing to do here. */
+        pr_info("Write protecting the kernel read-only data: %luk\n",
+                ((unsigned long)&_eshared - (unsigned long)&_stext) >> 10);
+}
+
 void __init mem_init(void)
 {
         if (MACHINE_HAS_TLB_LC)
@@ -127,9 +134,6 @@ void __init mem_init(void)
         setup_zero_pages();     /* Setup zeroed pages. */
 
         mem_init_print_info(NULL);
-        printk("Write protected kernel read-only data: %#lx - %#lx\n",
-               (unsigned long)&_stext,
-               PFN_ALIGN((unsigned long)&_eshared) - 1);
 }
 
 void free_initmem(void)
diff --git a/arch/s390/mm/mmap.c b/arch/s390/mm/mmap.c
index f2b6b1d9c804..126c4a9b9bf9 100644
--- a/arch/s390/mm/mmap.c
+++ b/arch/s390/mm/mmap.c
@@ -97,7 +97,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
                 addr = PAGE_ALIGN(addr);
                 vma = find_vma(mm, addr);
                 if (TASK_SIZE - len >= addr && addr >= mmap_min_addr &&
-                    (!vma || addr + len <= vma->vm_start))
+                    (!vma || addr + len <= vm_start_gap(vma)))
                         return addr;
         }
 
@@ -135,7 +135,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
                 addr = PAGE_ALIGN(addr);
                 vma = find_vma(mm, addr);
                 if (TASK_SIZE - len >= addr && addr >= mmap_min_addr &&
-                                (!vma || addr + len <= vma->vm_start))
+                                (!vma || addr + len <= vm_start_gap(vma)))
                         return addr;
         }
 
diff --git a/arch/s390/mm/pgtable.c b/arch/s390/mm/pgtable.c
index 8345ae1f117d..05ae254f84cf 100644
--- a/arch/s390/mm/pgtable.c
+++ b/arch/s390/mm/pgtable.c
@@ -1237,11 +1237,28 @@ EXPORT_SYMBOL_GPL(s390_reset_cmma);
  */
 bool gmap_test_and_clear_dirty(unsigned long address, struct gmap *gmap)
 {
+        pgd_t *pgd;
+        pud_t *pud;
+        pmd_t *pmd;
         pte_t *pte;
         spinlock_t *ptl;
         bool dirty = false;
 
-        pte = get_locked_pte(gmap->mm, address, &ptl);
+        pgd = pgd_offset(gmap->mm, address);
+        pud = pud_alloc(gmap->mm, pgd, address);
+        if (!pud)
+                return false;
+        pmd = pmd_alloc(gmap->mm, pud, address);
+        if (!pmd)
+                return false;
+        /* We can't run guests backed by huge pages, but userspace can
+         * still set them up and then try to migrate them without any
+         * migration support.
+         */
+        if (pmd_large(*pmd))
+                return true;
+
+        pte = pte_alloc_map_lock(gmap->mm, pmd, address, &ptl);
         if (unlikely(!pte))
                 return false;
 
diff --git a/arch/s390/mm/vmem.c b/arch/s390/mm/vmem.c
index ef7d6c8fea66..f354fd84adeb 100644
--- a/arch/s390/mm/vmem.c
+++ b/arch/s390/mm/vmem.c
@@ -372,7 +372,7 @@ void __init vmem_map_init(void)
         ro_end = (unsigned long)&_eshared & PAGE_MASK;
         for_each_memblock(memory, reg) {
                 start = reg->base;
-                end = reg->base + reg->size - 1;
+                end = reg->base + reg->size;
                 if (start >= ro_end || end <= ro_start)
                         vmem_add_mem(start, end - start, 0);
                 else if (start >= ro_start && end <= ro_end)
diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c
index 0e2919dd8df3..1395eeb6005f 100644
--- a/arch/s390/net/bpf_jit_comp.c
+++ b/arch/s390/net/bpf_jit_comp.c
@@ -1250,7 +1250,8 @@ static int bpf_jit_prog(struct bpf_jit *jit, struct bpf_prog *fp)
                 insn_count = bpf_jit_insn(jit, fp, i);
                 if (insn_count < 0)
                         return -1;
-                jit->addrs[i + 1] = jit->prg; /* Next instruction address */
+                /* Next instruction address */
+                jit->addrs[i + insn_count] = jit->prg;
         }
         bpf_jit_epilogue(jit);
 
diff --git a/arch/s390/pci/pci_dma.c b/arch/s390/pci/pci_dma.c
index 3a40f718baef..4004e03267cd 100644
--- a/arch/s390/pci/pci_dma.c
+++ b/arch/s390/pci/pci_dma.c
@@ -455,7 +455,7 @@ int zpci_dma_init_device(struct zpci_dev *zdev)
         zdev->dma_table = dma_alloc_cpu_table();
         if (!zdev->dma_table) {
                 rc = -ENOMEM;
-                goto out_clean;
+                goto out;
         }
 
         /*
@@ -475,18 +475,22 @@ int zpci_dma_init_device(struct zpci_dev *zdev)
         zdev->iommu_bitmap = vzalloc(zdev->iommu_pages / 8);
         if (!zdev->iommu_bitmap) {
                 rc = -ENOMEM;
-                goto out_reg;
+                goto free_dma_table;
         }
 
         rc = zpci_register_ioat(zdev, 0, zdev->start_dma, zdev->end_dma,
                                 (u64) zdev->dma_table);
         if (rc)
-                goto out_reg;
-        return 0;
+                goto free_bitmap;
 
-out_reg:
+        return 0;
+free_bitmap:
+        vfree(zdev->iommu_bitmap);
+        zdev->iommu_bitmap = NULL;
+free_dma_table:
         dma_free_cpu_table(zdev->dma_table);
-out_clean:
+        zdev->dma_table = NULL;
+out:
         return rc;
 }
 
diff --git a/arch/sh/mm/mmap.c b/arch/sh/mm/mmap.c
index 6777177807c2..7df7d5944188 100644
--- a/arch/sh/mm/mmap.c
+++ b/arch/sh/mm/mmap.c
@@ -63,7 +63,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr,
 
                 vma = find_vma(mm, addr);
                 if (TASK_SIZE - len >= addr &&
-                    (!vma || addr + len <= vma->vm_start))
+                    (!vma || addr + len <= vm_start_gap(vma)))
                         return addr;
         }
 
@@ -113,7 +113,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
 
                 vma = find_vma(mm, addr);
                 if (TASK_SIZE - len >= addr &&
-                    (!vma || addr + len <= vma->vm_start))
+                    (!vma || addr + len <= vm_start_gap(vma)))
                         return addr;
         }
 
diff --git a/arch/sparc/Kconfig b/arch/sparc/Kconfig
index 3736be630113..894bcaed002e 100644
--- a/arch/sparc/Kconfig
+++ b/arch/sparc/Kconfig
@@ -183,9 +183,9 @@ config NR_CPUS
         int "Maximum number of CPUs"
         depends on SMP
         range 2 32 if SPARC32
-        range 2 1024 if SPARC64
+        range 2 4096 if SPARC64
         default 32 if SPARC32
-        default 64 if SPARC64
+        default 4096 if SPARC64
 
 source kernel/Kconfig.hz
 
diff --git a/arch/sparc/include/asm/mmu_64.h b/arch/sparc/include/asm/mmu_64.h
index f7de0dbc38af..83b36a5371ff 100644
--- a/arch/sparc/include/asm/mmu_64.h
+++ b/arch/sparc/include/asm/mmu_64.h
@@ -52,7 +52,7 @@
 #define CTX_NR_MASK             TAG_CONTEXT_BITS
 #define CTX_HW_MASK             (CTX_NR_MASK | CTX_PGSZ_MASK)
 
-#define CTX_FIRST_VERSION       ((_AC(1,UL) << CTX_VERSION_SHIFT) + _AC(1,UL))
+#define CTX_FIRST_VERSION       BIT(CTX_VERSION_SHIFT)
 #define CTX_VALID(__ctx)        \
          (!(((__ctx.sparc64_ctx_val) ^ tlb_context_cache) & CTX_VERSION_MASK))
 #define CTX_HWBITS(__ctx)       ((__ctx.sparc64_ctx_val) & CTX_HW_MASK)
diff --git a/arch/sparc/include/asm/mmu_context_64.h b/arch/sparc/include/asm/mmu_context_64.h
index b84be675e507..0cdeb2b483a0 100644
--- a/arch/sparc/include/asm/mmu_context_64.h
+++ b/arch/sparc/include/asm/mmu_context_64.h
@@ -17,22 +17,19 @@ extern spinlock_t ctx_alloc_lock;
 extern unsigned long tlb_context_cache;
 extern unsigned long mmu_context_bmap[];
 
+DECLARE_PER_CPU(struct mm_struct *, per_cpu_secondary_mm);
 void get_new_mmu_context(struct mm_struct *mm);
-#ifdef CONFIG_SMP
-void smp_new_mmu_context_version(void);
-#else
-#define smp_new_mmu_context_version() do { } while (0)
-#endif
-
 int init_new_context(struct task_struct *tsk, struct mm_struct *mm);
 void destroy_context(struct mm_struct *mm);
 
 void __tsb_context_switch(unsigned long pgd_pa,
                           struct tsb_config *tsb_base,
                           struct tsb_config *tsb_huge,
-                          unsigned long tsb_descr_pa);
+                          unsigned long tsb_descr_pa,
+                          unsigned long secondary_ctx);
 
-static inline void tsb_context_switch(struct mm_struct *mm)
+static inline void tsb_context_switch_ctx(struct mm_struct *mm,
+                                          unsigned long ctx)
 {
         __tsb_context_switch(__pa(mm->pgd),
                              &mm->context.tsb_block[0],
@@ -43,9 +40,12 @@ static inline void tsb_context_switch(struct mm_struct *mm)
 #else
                              NULL
 #endif
-                             , __pa(&mm->context.tsb_descr[0]));
+                             , __pa(&mm->context.tsb_descr[0]),
+                             ctx);
 }
 
+#define tsb_context_switch(X) tsb_context_switch_ctx(X, 0)
+
 void tsb_grow(struct mm_struct *mm,
               unsigned long tsb_index,
               unsigned long mm_rss);
@@ -74,8 +74,9 @@ void __flush_tlb_mm(unsigned long, unsigned long);
 static inline void switch_mm(struct mm_struct *old_mm, struct mm_struct *mm, struct task_struct *tsk)
 {
         unsigned long ctx_valid, flags;
-        int cpu;
+        int cpu = smp_processor_id();
 
+        per_cpu(per_cpu_secondary_mm, cpu) = mm;
         if (unlikely(mm == &init_mm))
                 return;
 
@@ -114,14 +115,12 @@ static inline void switch_mm(struct mm_struct *old_mm, struct mm_struct *mm, str
          * cpu0 to update it's TSB because at that point the cpu_vm_mask
          * only had cpu1 set in it.
          */
-        load_secondary_context(mm);
-        tsb_context_switch(mm);
+        tsb_context_switch_ctx(mm, CTX_HWBITS(mm->context));
 
         /* Any time a processor runs a context on an address space
          * for the first time, we must flush that context out of the
          * local TLB.
          */
-        cpu = smp_processor_id();
         if (!ctx_valid || !cpumask_test_cpu(cpu, mm_cpumask(mm))) {
                 cpumask_set_cpu(cpu, mm_cpumask(mm));
                 __flush_tlb_mm(CTX_HWBITS(mm->context),
@@ -131,26 +130,7 @@ static inline void switch_mm(struct mm_struct *old_mm, struct mm_struct *mm, str
 }
 
 #define deactivate_mm(tsk,mm)   do { } while (0)
-
-/* Activate a new MM instance for the current task. */
-static inline void activate_mm(struct mm_struct *active_mm, struct mm_struct *mm)
-{
-        unsigned long flags;
-        int cpu;
-
-        spin_lock_irqsave(&mm->context.lock, flags);
-        if (!CTX_VALID(mm->context))
-                get_new_mmu_context(mm);
-        cpu = smp_processor_id();
-        if (!cpumask_test_cpu(cpu, mm_cpumask(mm)))
-                cpumask_set_cpu(cpu, mm_cpumask(mm));
-
-        load_secondary_context(mm);
-        __flush_tlb_mm(CTX_HWBITS(mm->context), SECONDARY_CONTEXT);
-        tsb_context_switch(mm);
-        spin_unlock_irqrestore(&mm->context.lock, flags);
-}
-
+#define activate_mm(active_mm, mm) switch_mm(active_mm, mm, NULL)
 #endif /* !(__ASSEMBLY__) */
 
 #endif /* !(__SPARC64_MMU_CONTEXT_H) */
diff --git a/arch/sparc/include/asm/pgtable_32.h b/arch/sparc/include/asm/pgtable_32.h
index 91b963a887b7..29c3b400f949 100644
--- a/arch/sparc/include/asm/pgtable_32.h
+++ b/arch/sparc/include/asm/pgtable_32.h
@@ -91,9 +91,9 @@ extern unsigned long pfn_base;
  * ZERO_PAGE is a global shared page that is always zero: used
  * for zero-mapped memory areas etc..
  */
-extern unsigned long empty_zero_page;
+extern unsigned long empty_zero_page[PAGE_SIZE / sizeof(unsigned long)];
 
-#define ZERO_PAGE(vaddr) (virt_to_page(&empty_zero_page))
+#define ZERO_PAGE(vaddr) (virt_to_page(empty_zero_page))
 
 /*
  * In general all page table modifications should use the V8 atomic
diff --git a/arch/sparc/include/asm/pgtable_64.h b/arch/sparc/include/asm/pgtable_64.h
index 408b715c95a5..9d81579f3d54 100644
--- a/arch/sparc/include/asm/pgtable_64.h
+++ b/arch/sparc/include/asm/pgtable_64.h
@@ -668,26 +668,27 @@ static inline unsigned long pmd_pfn(pmd_t pmd)
         return pte_pfn(pte);
 }
 
-#ifdef CONFIG_TRANSPARENT_HUGEPAGE
-static inline unsigned long pmd_dirty(pmd_t pmd)
+#define __HAVE_ARCH_PMD_WRITE
+static inline unsigned long pmd_write(pmd_t pmd)
 {
         pte_t pte = __pte(pmd_val(pmd));
 
-        return pte_dirty(pte);
+        return pte_write(pte);
 }
 
-static inline unsigned long pmd_young(pmd_t pmd)
+#ifdef CONFIG_TRANSPARENT_HUGEPAGE
+static inline unsigned long pmd_dirty(pmd_t pmd)
 {
         pte_t pte = __pte(pmd_val(pmd));
 
-        return pte_young(pte);
+        return pte_dirty(pte);
 }
 
-static inline unsigned long pmd_write(pmd_t pmd)
+static inline unsigned long pmd_young(pmd_t pmd)
 {
         pte_t pte = __pte(pmd_val(pmd));
 
-        return pte_write(pte);
+        return pte_young(pte);
 }
 
 static inline unsigned long pmd_trans_huge(pmd_t pmd)
diff --git a/arch/sparc/include/asm/pil.h b/arch/sparc/include/asm/pil.h
index 266937030546..522b43db2ed3 100644
--- a/arch/sparc/include/asm/pil.h
+++ b/arch/sparc/include/asm/pil.h
@@ -20,7 +20,6 @@
 #define PIL_SMP_CALL_FUNC       1
 #define PIL_SMP_RECEIVE_SIGNAL  2
 #define PIL_SMP_CAPTURE         3
-#define PIL_SMP_CTX_NEW_VERSION 4
 #define PIL_DEVICE_IRQ          5
 #define PIL_SMP_CALL_FUNC_SNGL  6
 #define PIL_DEFERRED_PCR_WORK   7
diff --git a/arch/sparc/include/asm/setup.h b/arch/sparc/include/asm/setup.h
index 29d64b1758ed..be0cc1beed41 100644
--- a/arch/sparc/include/asm/setup.h
+++ b/arch/sparc/include/asm/setup.h
@@ -16,7 +16,7 @@ extern char reboot_command[];
  */
 extern unsigned char boot_cpu_id;
 
-extern unsigned long empty_zero_page;
+extern unsigned long empty_zero_page[PAGE_SIZE / sizeof(unsigned long)];
 
 extern int serial_console;
 static inline int con_is_present(void)
diff --git a/arch/sparc/include/asm/trap_block.h b/arch/sparc/include/asm/trap_block.h
index ec9c04de3664..ff05992dae7a 100644
--- a/arch/sparc/include/asm/trap_block.h
+++ b/arch/sparc/include/asm/trap_block.h
@@ -54,6 +54,7 @@ extern struct trap_per_cpu trap_block[NR_CPUS];
 void init_cur_cpu_trap(struct thread_info *);
 void setup_tba(void);
 extern int ncpus_probed;
+extern u64 cpu_mondo_counter[NR_CPUS];
 
 unsigned long real_hard_smp_processor_id(void);
 
diff --git a/arch/sparc/include/asm/vio.h b/arch/sparc/include/asm/vio.h
index 8174f6cdbbbb..9dca7a892978 100644
--- a/arch/sparc/include/asm/vio.h
+++ b/arch/sparc/include/asm/vio.h
@@ -327,6 +327,7 @@ struct vio_dev {
         int                     compat_len;
 
         u64                     dev_no;
+        u64                     id;
 
         unsigned long           channel_id;
 
diff --git a/arch/sparc/kernel/irq_64.c b/arch/sparc/kernel/irq_64.c
index e22416ce56ea..bfbde8c4ffb2 100644
--- a/arch/sparc/kernel/irq_64.c
+++ b/arch/sparc/kernel/irq_64.c
@@ -1034,17 +1034,26 @@ static void __init init_cpu_send_mondo_info(struct trap_per_cpu *tb)
 {
 #ifdef CONFIG_SMP
         unsigned long page;
+        void *mondo, *p;
 
-        BUILD_BUG_ON((NR_CPUS * sizeof(u16)) > (PAGE_SIZE - 64));
+        BUILD_BUG_ON((NR_CPUS * sizeof(u16)) > PAGE_SIZE);
+
+        /* Make sure mondo block is 64byte aligned */
+        p = kzalloc(127, GFP_KERNEL);
+        if (!p) {
+                prom_printf("SUN4V: Error, cannot allocate mondo block.\n");
+                prom_halt();
+        }
+        mondo = (void *)(((unsigned long)p + 63) & ~0x3f);
+        tb->cpu_mondo_block_pa = __pa(mondo);
 
         page = get_zeroed_page(GFP_KERNEL);
         if (!page) {
-                prom_printf("SUN4V: Error, cannot allocate cpu mondo page.\n");
+                prom_printf("SUN4V: Error, cannot allocate cpu list page.\n");
                 prom_halt();
         }
 
-        tb->cpu_mondo_block_pa = __pa(page);
-        tb->cpu_list_pa = __pa(page + 64);
+        tb->cpu_list_pa = __pa(page);
 #endif
 }
 
diff --git a/arch/sparc/kernel/kernel.h b/arch/sparc/kernel/kernel.h
index e7f652be9e61..44f32dd4477f 100644
--- a/arch/sparc/kernel/kernel.h
+++ b/arch/sparc/kernel/kernel.h
@@ -37,7 +37,6 @@ void handle_stdfmna(struct pt_regs *regs, unsigned long sfar, unsigned long sfsr
 /* smp_64.c */
 void __irq_entry smp_call_function_client(int irq, struct pt_regs *regs);
 void __irq_entry smp_call_function_single_client(int irq, struct pt_regs *regs);
-void __irq_entry smp_new_mmu_context_version_client(int irq, struct pt_regs *regs);
 void __irq_entry smp_penguin_jailcell(int irq, struct pt_regs *regs);
 void __irq_entry smp_receive_signal_client(int irq, struct pt_regs *regs);
 
diff --git a/arch/sparc/kernel/ptrace_64.c b/arch/sparc/kernel/ptrace_64.c
index 9ddc4928a089..c1566170964f 100644
--- a/arch/sparc/kernel/ptrace_64.c
+++ b/arch/sparc/kernel/ptrace_64.c
@@ -311,7 +311,7 @@ static int genregs64_set(struct task_struct *target,
         }
 
         if (!ret) {
-                unsigned long y;
+                unsigned long y = regs->y;
 
                 ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf,
                                          &y,
diff --git a/arch/sparc/kernel/smp_64.c b/arch/sparc/kernel/smp_64.c
index 19cd08d18672..4511caa3b7e9 100644
--- a/arch/sparc/kernel/smp_64.c
+++ b/arch/sparc/kernel/smp_64.c
@@ -617,22 +617,48 @@ retry:
         }
 }
 
-/* Multi-cpu list version.  */
+#define CPU_MONDO_COUNTER(cpuid)        (cpu_mondo_counter[cpuid])
+#define MONDO_USEC_WAIT_MIN             2
+#define MONDO_USEC_WAIT_MAX             100
+#define MONDO_RETRY_LIMIT               500000
+
+/* Multi-cpu list version.
+ *
+ * Deliver xcalls to 'cnt' number of cpus in 'cpu_list'.
+ * Sometimes not all cpus receive the mondo, requiring us to re-send
+ * the mondo until all cpus have received, or cpus are truly stuck
+ * unable to receive mondo, and we timeout.
+ * Occasionally a target cpu strand is borrowed briefly by hypervisor to
+ * perform guest service, such as PCIe error handling. Consider the
+ * service time, 1 second overall wait is reasonable for 1 cpu.
+ * Here two in-between mondo check wait time are defined: 2 usec for
+ * single cpu quick turn around and up to 100usec for large cpu count.
+ * Deliver mondo to large number of cpus could take longer, we adjusts
+ * the retry count as long as target cpus are making forward progress.
+ */
 static void hypervisor_xcall_deliver(struct trap_per_cpu *tb, int cnt)
 {
-        int retries, this_cpu, prev_sent, i, saw_cpu_error;
+        int this_cpu, tot_cpus, prev_sent, i, rem;
+        int usec_wait, retries, tot_retries;
+        u16 first_cpu = 0xffff;
+        unsigned long xc_rcvd = 0;
         unsigned long status;
+        int ecpuerror_id = 0;
+        int enocpu_id = 0;
         u16 *cpu_list;
+        u16 cpu;
 
         this_cpu = smp_processor_id();
-
         cpu_list = __va(tb->cpu_list_pa);
-
-        saw_cpu_error = 0;
-        retries = 0;
+        usec_wait = cnt * MONDO_USEC_WAIT_MIN;
+        if (usec_wait > MONDO_USEC_WAIT_MAX)
+                usec_wait = MONDO_USEC_WAIT_MAX;
+        retries = tot_retries = 0;
+        tot_cpus = cnt;
         prev_sent = 0;
+
         do {
-                int forward_progress, n_sent;
+                int n_sent, mondo_delivered, target_cpu_busy;
 
                 status = sun4v_cpu_mondo_send(cnt,
                                               tb->cpu_list_pa,
@@ -640,94 +666,113 @@ static void hypervisor_xcall_deliver(struct trap_per_cpu *tb, int cnt)
 
                 /* HV_EOK means all cpus received the xcall, we're done.  */
                 if (likely(status == HV_EOK))
-                        break;
+                        goto xcall_done;
+
+                /* If not these non-fatal errors, panic */
+                if (unlikely((status != HV_EWOULDBLOCK) &&
+                        (status != HV_ECPUERROR) &&
+                        (status != HV_ENOCPU)))
+                        goto fatal_errors;
 
                 /* First, see if we made any forward progress.
                  *
+                 * Go through the cpu_list, count the target cpus that have
+                 * received our mondo (n_sent), and those that did not (rem).
+                 * Re-pack cpu_list with the cpus remain to be retried in the
+                 * front - this simplifies tracking the truly stalled cpus.
+                 *
                  * The hypervisor indicates successful sends by setting
                  * cpu list entries to the value 0xffff.
+                 *
+                 * EWOULDBLOCK means some target cpus did not receive the
+                 * mondo and retry usually helps.
+                 *
+                 * ECPUERROR means at least one target cpu is in error state,
+                 * it's usually safe to skip the faulty cpu and retry.
+                 *
+                 * ENOCPU means one of the target cpu doesn't belong to the
+                 * domain, perhaps offlined which is unexpected, but not
+                 * fatal and it's okay to skip the offlined cpu.
                  */
+                rem = 0;
                 n_sent = 0;
                 for (i = 0; i < cnt; i++) {
-                        if (likely(cpu_list[i] == 0xffff))
+                        cpu = cpu_list[i];
+                        if (likely(cpu == 0xffff)) {
                                 n_sent++;
+                        } else if ((status == HV_ECPUERROR) &&
+                                (sun4v_cpu_state(cpu) == HV_CPU_STATE_ERROR)) {
+                                ecpuerror_id = cpu + 1;
+                        } else if (status == HV_ENOCPU && !cpu_online(cpu)) {
+                                enocpu_id = cpu + 1;
+                        } else {
+                                cpu_list[rem++] = cpu;
+                        }
                 }
 
-                forward_progress = 0;
-                if (n_sent > prev_sent)
-                        forward_progress = 1;
+                /* No cpu remained, we're done. */
+                if (rem == 0)
+                        break;
 
-                prev_sent = n_sent;
+                /* Otherwise, update the cpu count for retry. */
+                cnt = rem;
 
-                /* If we get a HV_ECPUERROR, then one or more of the cpus
-                 * in the list are in error state.  Use the cpu_state()
-                 * hypervisor call to find out which cpus are in error state.
+                /* Record the overall number of mondos received by the
+                 * first of the remaining cpus.
                  */
-                if (unlikely(status == HV_ECPUERROR)) {
-                        for (i = 0; i < cnt; i++) {
-                                long err;
-                                u16 cpu;
+                if (first_cpu != cpu_list[0]) {
+                        first_cpu = cpu_list[0];
+                        xc_rcvd = CPU_MONDO_COUNTER(first_cpu);
+                }
 
-                                cpu = cpu_list[i];
-                                if (cpu == 0xffff)
-                                        continue;
+                /* Was any mondo delivered successfully? */
+                mondo_delivered = (n_sent > prev_sent);
+                prev_sent = n_sent;
 
-                                err = sun4v_cpu_state(cpu);
-                                if (err == HV_CPU_STATE_ERROR) {
-                                        saw_cpu_error = (cpu + 1);
-                                        cpu_list[i] = 0xffff;
-                                }
-                        }
-                } else if (unlikely(status != HV_EWOULDBLOCK))
-                        goto fatal_mondo_error;
+                /* or, was any target cpu busy processing other mondos? */
+                target_cpu_busy = (xc_rcvd < CPU_MONDO_COUNTER(first_cpu));
+                xc_rcvd = CPU_MONDO_COUNTER(first_cpu);
 
-                /* Don't bother rewriting the CPU list, just leave the
-                 * 0xffff and non-0xffff entries in there and the
-                 * hypervisor will do the right thing.
-                 *
-                 * Only advance timeout state if we didn't make any
-                 * forward progress.
+                /* Retry count is for no progress. If we're making progress,
+                 * reset the retry count.
                  */
-                if (unlikely(!forward_progress)) {
-                        if (unlikely(++retries > 10000))
-                                goto fatal_mondo_timeout;
-
-                        /* Delay a little bit to let other cpus catch up
-                         * on their cpu mondo queue work.
-                         */
-                        udelay(2 * cnt);
+                if (likely(mondo_delivered || target_cpu_busy)) {
+                        tot_retries += retries;
+                        retries = 0;
+                } else if (unlikely(retries > MONDO_RETRY_LIMIT)) {
+                        goto fatal_mondo_timeout;
                 }
-        } while (1);
 
-        if (unlikely(saw_cpu_error))
-                goto fatal_mondo_cpu_error;
+                /* Delay a little bit to let other cpus catch up on
+                 * their cpu mondo queue work.
+                 */
+                if (!mondo_delivered)
+                        udelay(usec_wait);
 
-        return;
+                retries++;
+        } while (1);
 
-fatal_mondo_cpu_error:
-        printk(KERN_CRIT "CPU[%d]: SUN4V mondo cpu error, some target cpus "
-               "(including %d) were in error state\n",
-               this_cpu, saw_cpu_error - 1);
+xcall_done:
+        if (unlikely(ecpuerror_id > 0)) {
+                pr_crit("CPU[%d]: SUN4V mondo cpu error, target cpu(%d) was in error state\n",
+                       this_cpu, ecpuerror_id - 1);
+        } else if (unlikely(enocpu_id > 0)) {
+                pr_crit("CPU[%d]: SUN4V mondo cpu error, target cpu(%d) does not belong to the domain\n",
+                       this_cpu, enocpu_id - 1);
+        }
         return;
 
+fatal_errors:
+        /* fatal errors include bad alignment, etc */
+        pr_crit("CPU[%d]: Args were cnt(%d) cpulist_pa(%lx) mondo_block_pa(%lx)\n",
+               this_cpu, tot_cpus, tb->cpu_list_pa, tb->cpu_mondo_block_pa);
+        panic("Unexpected SUN4V mondo error %lu\n", status);
+
 fatal_mondo_timeout:
-        printk(KERN_CRIT "CPU[%d]: SUN4V mondo timeout, no forward "
-               " progress after %d retries.\n",
-               this_cpu, retries);
-        goto dump_cpu_list_and_out;
-
-fatal_mondo_error:
-        printk(KERN_CRIT "CPU[%d]: Unexpected SUN4V mondo error %lu\n",
-               this_cpu, status);
-        printk(KERN_CRIT "CPU[%d]: Args were cnt(%d) cpulist_pa(%lx) "
-               "mondo_block_pa(%lx)\n",
-               this_cpu, cnt, tb->cpu_list_pa, tb->cpu_mondo_block_pa);
-
-dump_cpu_list_and_out:
-        printk(KERN_CRIT "CPU[%d]: CPU list [ ", this_cpu);
-        for (i = 0; i < cnt; i++)
-                printk("%u ", cpu_list[i]);
-        printk("]\n");
+        /* some cpus being non-responsive to the cpu mondo */
+        pr_crit("CPU[%d]: SUN4V mondo timeout, cpu(%d) made no forward progress after %d retries. Total target cpus(%d).\n",
+               this_cpu, first_cpu, (tot_retries + retries), tot_cpus);
+        panic("SUN4V mondo timeout panic\n");
 }
 
 static void (*xcall_deliver_impl)(struct trap_per_cpu *, int);
@@ -959,37 +1004,6 @@ void flush_dcache_page_all(struct mm_struct *mm, struct page *page)
         preempt_enable();
 }
 
-void __irq_entry smp_new_mmu_context_version_client(int irq, struct pt_regs *regs)
-{
-        struct mm_struct *mm;
-        unsigned long flags;
-
-        clear_softint(1 << irq);
-
-        /* See if we need to allocate a new TLB context because
-         * the version of the one we are using is now out of date.
-         */
-        mm = current->active_mm;
-        if (unlikely(!mm || (mm == &init_mm)))
-                return;
-
-        spin_lock_irqsave(&mm->context.lock, flags);
-
-        if (unlikely(!CTX_VALID(mm->context)))
-                get_new_mmu_context(mm);
-
-        spin_unlock_irqrestore(&mm->context.lock, flags);
-
-        load_secondary_context(mm);
-        __flush_tlb_mm(CTX_HWBITS(mm->context),
-                       SECONDARY_CONTEXT);
-}
-
-void smp_new_mmu_context_version(void)
-{
-        smp_cross_call(&xcall_new_mmu_context_version, 0, 0, 0);
-}
-
 #ifdef CONFIG_KGDB
 void kgdb_roundup_cpus(unsigned long flags)
 {
diff --git a/arch/sparc/kernel/sun4v_ivec.S b/arch/sparc/kernel/sun4v_ivec.S
index 559bc5e9c199..34631995859a 100644
--- a/arch/sparc/kernel/sun4v_ivec.S
+++ b/arch/sparc/kernel/sun4v_ivec.S
@@ -26,6 +26,21 @@ sun4v_cpu_mondo:
         ldxa    [%g0] ASI_SCRATCHPAD, %g4
         sub     %g4, TRAP_PER_CPU_FAULT_INFO, %g4
 
+        /* Get smp_processor_id() into %g3 */
+        sethi   %hi(trap_block), %g5
+        or      %g5, %lo(trap_block), %g5
+        sub     %g4, %g5, %g3
+        srlx    %g3, TRAP_BLOCK_SZ_SHIFT, %g3
+
+        /* Increment cpu_mondo_counter[smp_processor_id()] */
+        sethi   %hi(cpu_mondo_counter), %g5
+        or      %g5, %lo(cpu_mondo_counter), %g5
+        sllx    %g3, 3, %g3
+        add     %g5, %g3, %g5
+        ldx     [%g5], %g3
+        add     %g3, 1, %g3
+        stx     %g3, [%g5]
+
         /* Get CPU mondo queue base phys address into %g7.  */
         ldx     [%g4 + TRAP_PER_CPU_CPU_MONDO_PA], %g7
 
diff --git a/arch/sparc/kernel/sys_sparc_64.c b/arch/sparc/kernel/sys_sparc_64.c
index b489e9759518..98a5cf313d39 100644
--- a/arch/sparc/kernel/sys_sparc_64.c
+++ b/arch/sparc/kernel/sys_sparc_64.c
@@ -118,7 +118,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
 
                 vma = find_vma(mm, addr);
                 if (task_size - len >= addr &&
-                    (!vma || addr + len <= vma->vm_start))
+                    (!vma || addr + len <= vm_start_gap(vma)))
                         return addr;
         }
 
@@ -181,7 +181,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
 
                 vma = find_vma(mm, addr);
                 if (task_size - len >= addr &&
-                    (!vma || addr + len <= vma->vm_start))
+                    (!vma || addr + len <= vm_start_gap(vma)))
                         return addr;
         }
 
diff --git a/arch/sparc/kernel/traps_64.c b/arch/sparc/kernel/traps_64.c
index d21cd625c0de..d883c5951e8b 100644
--- a/arch/sparc/kernel/traps_64.c
+++ b/arch/sparc/kernel/traps_64.c
@@ -85,7 +85,7 @@ static void dump_tl1_traplog(struct tl1_traplog *p)
 
 void bad_trap(struct pt_regs *regs, long lvl)
 {
-        char buffer[32];
+        char buffer[36];
         siginfo_t info;
 
         if (notify_die(DIE_TRAP, "bad trap", regs,
@@ -116,7 +116,7 @@ void bad_trap(struct pt_regs *regs, long lvl)
 
 void bad_trap_tl1(struct pt_regs *regs, long lvl)
 {
-        char buffer[32];
+        char buffer[36];
         
         if (notify_die(DIE_TRAP_TL1, "bad trap tl1", regs,
                        0, lvl, SIGTRAP) == NOTIFY_STOP)
@@ -2659,6 +2659,7 @@ void do_getpsr(struct pt_regs *regs)
         }
 }
 
+u64 cpu_mondo_counter[NR_CPUS] = {0};
 struct trap_per_cpu trap_block[NR_CPUS];
 EXPORT_SYMBOL(trap_block);
 
diff --git a/arch/sparc/kernel/tsb.S b/arch/sparc/kernel/tsb.S
index d568c8207af7..7d961f6e3907 100644
--- a/arch/sparc/kernel/tsb.S
+++ b/arch/sparc/kernel/tsb.S
@@ -375,6 +375,7 @@ tsb_flush:
          * %o1: TSB base config pointer
          * %o2: TSB huge config pointer, or NULL if none
          * %o3: Hypervisor TSB descriptor physical address
+         * %o4: Secondary context to load, if non-zero
          *
          * We have to run this whole thing with interrupts
          * disabled so that the current cpu doesn't change
@@ -387,6 +388,17 @@ __tsb_context_switch:
         rdpr    %pstate, %g1
         wrpr    %g1, PSTATE_IE, %pstate
 
+        brz,pn  %o4, 1f
+         mov    SECONDARY_CONTEXT, %o5
+
+661:    stxa    %o4, [%o5] ASI_DMMU
+        .section .sun4v_1insn_patch, "ax"
+        .word   661b
+        stxa    %o4, [%o5] ASI_MMU
+        .previous
+        flush   %g6
+
+1:
         TRAP_LOAD_TRAP_BLOCK(%g2, %g3)
 
         stx     %o0, [%g2 + TRAP_PER_CPU_PGD_PADDR]
@@ -470,13 +482,16 @@ __tsb_context_switch:
         .type   copy_tsb,#function
 copy_tsb:               /* %o0=old_tsb_base, %o1=old_tsb_size
                          * %o2=new_tsb_base, %o3=new_tsb_size
+                         * %o4=page_size_shift
                          */
         sethi           %uhi(TSB_PASS_BITS), %g7
         srlx            %o3, 4, %o3
-        add             %o0, %o1, %g1   /* end of old tsb */
+        add             %o0, %o1, %o1   /* end of old tsb */
         sllx            %g7, 32, %g7
         sub             %o3, 1, %o3     /* %o3 == new tsb hash mask */
 
+        mov             %o4, %g1        /* page_size_shift */
+
 661:    prefetcha       [%o0] ASI_N, #one_read
         .section        .tsb_phys_patch, "ax"
         .word           661b
@@ -501,9 +516,9 @@ copy_tsb:		/* %o0=old_tsb_base, %o1=old_tsb_size
         /* This can definitely be computed faster... */
         srlx            %o0, 4, %o5     /* Build index */
         and             %o5, 511, %o5   /* Mask index */
-        sllx            %o5, PAGE_SHIFT, %o5 /* Put into vaddr position */
+        sllx            %o5, %g1, %o5   /* Put into vaddr position */
         or              %o4, %o5, %o4   /* Full VADDR. */
-        srlx            %o4, PAGE_SHIFT, %o4 /* Shift down to create index */
+        srlx            %o4, %g1, %o4   /* Shift down to create index */
         and             %o4, %o3, %o4   /* Mask with new_tsb_nents-1 */
         sllx            %o4, 4, %o4     /* Shift back up into tsb ent offset */
         TSB_STORE(%o2 + %o4, %g2)       /* Store TAG */
@@ -511,7 +526,7 @@ copy_tsb:		/* %o0=old_tsb_base, %o1=old_tsb_size
         TSB_STORE(%o2 + %o4, %g3)       /* Store TTE */
 
 80:     add             %o0, 16, %o0
-        cmp             %o0, %g1
+        cmp             %o0, %o1
         bne,pt          %xcc, 90b
          nop
 
diff --git a/arch/sparc/kernel/ttable_64.S b/arch/sparc/kernel/ttable_64.S
index c6dfdaa29e20..170ead662f2a 100644
--- a/arch/sparc/kernel/ttable_64.S
+++ b/arch/sparc/kernel/ttable_64.S
@@ -50,7 +50,7 @@ tl0_resv03e:	BTRAP(0x3e) BTRAP(0x3f) BTRAP(0x40)
 tl0_irq1:       TRAP_IRQ(smp_call_function_client, 1)
 tl0_irq2:       TRAP_IRQ(smp_receive_signal_client, 2)
 tl0_irq3:       TRAP_IRQ(smp_penguin_jailcell, 3)
-tl0_irq4:       TRAP_IRQ(smp_new_mmu_context_version_client, 4)
+tl0_irq4:       BTRAP(0x44)
 #else
 tl0_irq1:       BTRAP(0x41)
 tl0_irq2:       BTRAP(0x42)
diff --git a/arch/sparc/kernel/vio.c b/arch/sparc/kernel/vio.c
index cb5789c9f961..34824ca396f0 100644
--- a/arch/sparc/kernel/vio.c
+++ b/arch/sparc/kernel/vio.c
@@ -284,13 +284,16 @@ static struct vio_dev *vio_create_one(struct mdesc_handle *hp, u64 mp,
         if (!id) {
                 dev_set_name(&vdev->dev, "%s", bus_id_name);
                 vdev->dev_no = ~(u64)0;
+                vdev->id = ~(u64)0;
         } else if (!cfg_handle) {
                 dev_set_name(&vdev->dev, "%s-%llu", bus_id_name, *id);
                 vdev->dev_no = *id;
+                vdev->id = ~(u64)0;
         } else {
                 dev_set_name(&vdev->dev, "%s-%llu-%llu", bus_id_name,
                              *cfg_handle, *id);
                 vdev->dev_no = *cfg_handle;
+                vdev->id = *id;
         }
 
         vdev->dev.parent = parent;
@@ -333,27 +336,84 @@ static void vio_add(struct mdesc_handle *hp, u64 node)
         (void) vio_create_one(hp, node, &root_vdev->dev);
 }
 
+struct vio_md_node_query {
+        const char *type;
+        u64 dev_no;
+        u64 id;
+};
+
 static int vio_md_node_match(struct device *dev, void *arg)
 {
+        struct vio_md_node_query *query = (struct vio_md_node_query *) arg;
         struct vio_dev *vdev = to_vio_dev(dev);
 
-        if (vdev->mp == (u64) arg)
-                return 1;
+        if (vdev->dev_no != query->dev_no)
+                return 0;
+        if (vdev->id != query->id)
+                return 0;
+        if (strcmp(vdev->type, query->type))
+                return 0;
 
-        return 0;
+        return 1;
 }
 
 static void vio_remove(struct mdesc_handle *hp, u64 node)
 {
+        const char *type;
+        const u64 *id, *cfg_handle;
+        u64 a;
+        struct vio_md_node_query query;
         struct device *dev;
 
-        dev = device_find_child(&root_vdev->dev, (void *) node,
+        type = mdesc_get_property(hp, node, "device-type", NULL);
+        if (!type) {
+                type = mdesc_get_property(hp, node, "name", NULL);
+                if (!type)
+                        type = mdesc_node_name(hp, node);
+        }
+
+        query.type = type;
+
+        id = mdesc_get_property(hp, node, "id", NULL);
+        cfg_handle = NULL;
+        mdesc_for_each_arc(a, hp, node, MDESC_ARC_TYPE_BACK) {
+                u64 target;
+
+                target = mdesc_arc_target(hp, a);
+                cfg_handle = mdesc_get_property(hp, target,
+                                                "cfg-handle", NULL);
+                if (cfg_handle)
+                        break;
+        }
+
+        if (!id) {
+                query.dev_no = ~(u64)0;
+                query.id = ~(u64)0;
+        } else if (!cfg_handle) {
+                query.dev_no = *id;
+                query.id = ~(u64)0;
+        } else {
+                query.dev_no = *cfg_handle;
+                query.id = *id;
+        }
+
+        dev = device_find_child(&root_vdev->dev, &query,
                                 vio_md_node_match);
         if (dev) {
                 printk(KERN_INFO "VIO: Removing device %s\n", dev_name(dev));
 
                 device_unregister(dev);
                 put_device(dev);
+        } else {
+                if (!id)
+                        printk(KERN_ERR "VIO: Removed unknown %s node.\n",
+                               type);
+                else if (!cfg_handle)
+                        printk(KERN_ERR "VIO: Removed unknown %s node %llu.\n",
+                               type, *id);
+                else
+                        printk(KERN_ERR "VIO: Removed unknown %s node %llu-%llu.\n",
+                               type, *cfg_handle, *id);
         }
 }
 
diff --git a/arch/sparc/mm/hugetlbpage.c b/arch/sparc/mm/hugetlbpage.c
index da1142401bf4..ffa842b4d7d4 100644
--- a/arch/sparc/mm/hugetlbpage.c
+++ b/arch/sparc/mm/hugetlbpage.c
@@ -115,7 +115,7 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
                 addr = ALIGN(addr, HPAGE_SIZE);
                 vma = find_vma(mm, addr);
                 if (task_size - len >= addr &&
-                    (!vma || addr + len <= vma->vm_start))
+                    (!vma || addr + len <= vm_start_gap(vma)))
                         return addr;
         }
         if (mm->get_unmapped_area == arch_get_unmapped_area)
diff --git a/arch/sparc/mm/init_32.c b/arch/sparc/mm/init_32.c
index eb8287155279..3b7092d9ea8f 100644
--- a/arch/sparc/mm/init_32.c
+++ b/arch/sparc/mm/init_32.c
@@ -301,7 +301,7 @@ void __init mem_init(void)
 
 
         /* Saves us work later. */
-        memset((void *)&empty_zero_page, 0, PAGE_SIZE);
+        memset((void *)empty_zero_page, 0, PAGE_SIZE);
 
         i = last_valid_pfn >> ((20 - PAGE_SHIFT) + 5);
         i += 1;
diff --git a/arch/sparc/mm/init_64.c b/arch/sparc/mm/init_64.c
index 3d3414c14792..384aba109d7c 100644
--- a/arch/sparc/mm/init_64.c
+++ b/arch/sparc/mm/init_64.c
@@ -656,10 +656,58 @@ EXPORT_SYMBOL(__flush_dcache_range);
 
 /* get_new_mmu_context() uses "cache + 1".  */
 DEFINE_SPINLOCK(ctx_alloc_lock);
-unsigned long tlb_context_cache = CTX_FIRST_VERSION - 1;
+unsigned long tlb_context_cache = CTX_FIRST_VERSION;
 #define MAX_CTX_NR      (1UL << CTX_NR_BITS)
 #define CTX_BMAP_SLOTS  BITS_TO_LONGS(MAX_CTX_NR)
 DECLARE_BITMAP(mmu_context_bmap, MAX_CTX_NR);
+DEFINE_PER_CPU(struct mm_struct *, per_cpu_secondary_mm) = {0};
+
+static void mmu_context_wrap(void)
+{
+        unsigned long old_ver = tlb_context_cache & CTX_VERSION_MASK;
+        unsigned long new_ver, new_ctx, old_ctx;
+        struct mm_struct *mm;
+        int cpu;
+
+        bitmap_zero(mmu_context_bmap, 1 << CTX_NR_BITS);
+
+        /* Reserve kernel context */
+        set_bit(0, mmu_context_bmap);
+
+        new_ver = (tlb_context_cache & CTX_VERSION_MASK) + CTX_FIRST_VERSION;
+        if (unlikely(new_ver == 0))
+                new_ver = CTX_FIRST_VERSION;
+        tlb_context_cache = new_ver;
+
+        /*
+         * Make sure that any new mm that are added into per_cpu_secondary_mm,
+         * are going to go through get_new_mmu_context() path.
+         */
+        mb();
+
+        /*
+         * Updated versions to current on those CPUs that had valid secondary
+         * contexts
+         */
+        for_each_online_cpu(cpu) {
+                /*
+                 * If a new mm is stored after we took this mm from the array,
+                 * it will go into get_new_mmu_context() path, because we
+                 * already bumped the version in tlb_context_cache.
+                 */
+                mm = per_cpu(per_cpu_secondary_mm, cpu);
+
+                if (unlikely(!mm || mm == &init_mm))
+                        continue;
+
+                old_ctx = mm->context.sparc64_ctx_val;
+                if (likely((old_ctx & CTX_VERSION_MASK) == old_ver)) {
+                        new_ctx = (old_ctx & ~CTX_VERSION_MASK) | new_ver;
+                        set_bit(new_ctx & CTX_NR_MASK, mmu_context_bmap);
+                        mm->context.sparc64_ctx_val = new_ctx;
+                }
+        }
+}
 
 /* Caller does TLB context flushing on local CPU if necessary.
  * The caller also ensures that CTX_VALID(mm->context) is false.
@@ -675,48 +723,30 @@ void get_new_mmu_context(struct mm_struct *mm)
 {
         unsigned long ctx, new_ctx;
         unsigned long orig_pgsz_bits;
-        int new_version;
 
         spin_lock(&ctx_alloc_lock);
+retry:
+        /* wrap might have happened, test again if our context became valid */
+        if (unlikely(CTX_VALID(mm->context)))
+                goto out;
         orig_pgsz_bits = (mm->context.sparc64_ctx_val & CTX_PGSZ_MASK);
         ctx = (tlb_context_cache + 1) & CTX_NR_MASK;
         new_ctx = find_next_zero_bit(mmu_context_bmap, 1 << CTX_NR_BITS, ctx);
-        new_version = 0;
         if (new_ctx >= (1 << CTX_NR_BITS)) {
                 new_ctx = find_next_zero_bit(mmu_context_bmap, ctx, 1);
                 if (new_ctx >= ctx) {
-                        int i;
-                        new_ctx = (tlb_context_cache & CTX_VERSION_MASK) +
-                                CTX_FIRST_VERSION;
-                        if (new_ctx == 1)
-                                new_ctx = CTX_FIRST_VERSION;
-
-                        /* Don't call memset, for 16 entries that's just
-                         * plain silly...
-                         */
-                        mmu_context_bmap[0] = 3;
-                        mmu_context_bmap[1] = 0;
-                        mmu_context_bmap[2] = 0;
-                        mmu_context_bmap[3] = 0;
-                        for (i = 4; i < CTX_BMAP_SLOTS; i += 4) {
-                                mmu_context_bmap[i + 0] = 0;
-                                mmu_context_bmap[i + 1] = 0;
-                                mmu_context_bmap[i + 2] = 0;
-                                mmu_context_bmap[i + 3] = 0;
-                        }
-                        new_version = 1;
-                        goto out;
+                        mmu_context_wrap();
+                        goto retry;
                 }
         }
+        if (mm->context.sparc64_ctx_val)
+                cpumask_clear(mm_cpumask(mm));
         mmu_context_bmap[new_ctx>>6] |= (1UL << (new_ctx & 63));
         new_ctx |= (tlb_context_cache & CTX_VERSION_MASK);
-out:
         tlb_context_cache = new_ctx;
         mm->context.sparc64_ctx_val = new_ctx | orig_pgsz_bits;
+out:
         spin_unlock(&ctx_alloc_lock);
-
-        if (unlikely(new_version))
-                smp_new_mmu_context_version();
 }
 
 static int numa_enabled = 1;
@@ -1493,7 +1523,7 @@ bool kern_addr_valid(unsigned long addr)
         if ((long)addr < 0L) {
                 unsigned long pa = __pa(addr);
 
-                if ((addr >> max_phys_bits) != 0UL)
+                if ((pa >> max_phys_bits) != 0UL)
                         return false;
 
                 return pfn_valid(pa >> PAGE_SHIFT);
diff --git a/arch/sparc/mm/tsb.c b/arch/sparc/mm/tsb.c
index 9cdeca0fa955..266411291634 100644
--- a/arch/sparc/mm/tsb.c
+++ b/arch/sparc/mm/tsb.c
@@ -451,7 +451,8 @@ retry_tsb_alloc:
                 extern void copy_tsb(unsigned long old_tsb_base,
                                      unsigned long old_tsb_size,
                                      unsigned long new_tsb_base,
-                                     unsigned long new_tsb_size);
+                                     unsigned long new_tsb_size,
+                                     unsigned long page_size_shift);
                 unsigned long old_tsb_base = (unsigned long) old_tsb;
                 unsigned long new_tsb_base = (unsigned long) new_tsb;
 
@@ -459,7 +460,9 @@ retry_tsb_alloc:
                         old_tsb_base = __pa(old_tsb_base);
                         new_tsb_base = __pa(new_tsb_base);
                 }
-                copy_tsb(old_tsb_base, old_size, new_tsb_base, new_size);
+                copy_tsb(old_tsb_base, old_size, new_tsb_base, new_size,
+                        tsb_index == MM_TSB_BASE ?
+                        PAGE_SHIFT : REAL_HPAGE_SHIFT);
         }
 
         mm->context.tsb_block[tsb_index].tsb = new_tsb;
diff --git a/arch/sparc/mm/ultra.S b/arch/sparc/mm/ultra.S
index 5d2fd6cd3189..fcf4d27a38fb 100644
--- a/arch/sparc/mm/ultra.S
+++ b/arch/sparc/mm/ultra.S
@@ -971,11 +971,6 @@ xcall_capture:
         wr              %g0, (1 << PIL_SMP_CAPTURE), %set_softint
         retry
 
-        .globl          xcall_new_mmu_context_version
-xcall_new_mmu_context_version:
-        wr              %g0, (1 << PIL_SMP_CTX_NEW_VERSION), %set_softint
-        retry
-
 #ifdef CONFIG_KGDB
         .globl          xcall_kgdb_capture
 xcall_kgdb_capture:
diff --git a/arch/sparc/power/hibernate.c b/arch/sparc/power/hibernate.c
index 17bd2e167e07..df707a8ad311 100644
--- a/arch/sparc/power/hibernate.c
+++ b/arch/sparc/power/hibernate.c
@@ -35,6 +35,5 @@ void restore_processor_state(void)
 {
         struct mm_struct *mm = current->active_mm;
 
-        load_secondary_context(mm);
-        tsb_context_switch(mm);
+        tsb_context_switch_ctx(mm, CTX_HWBITS(mm->context));
 }
diff --git a/arch/tile/kernel/ptrace.c b/arch/tile/kernel/ptrace.c
index bdc126faf741..6239aa155f6d 100644
--- a/arch/tile/kernel/ptrace.c
+++ b/arch/tile/kernel/ptrace.c
@@ -111,7 +111,7 @@ static int tile_gpr_set(struct task_struct *target,
                           const void *kbuf, const void __user *ubuf)
 {
         int ret;
-        struct pt_regs regs;
+        struct pt_regs regs = *task_pt_regs(target);
 
         ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &regs, 0,
                                  sizeof(regs));
diff --git a/arch/tile/mm/hugetlbpage.c b/arch/tile/mm/hugetlbpage.c
index c034dc3fe2d4..c97ee6c7f949 100644
--- a/arch/tile/mm/hugetlbpage.c
+++ b/arch/tile/mm/hugetlbpage.c
@@ -232,7 +232,7 @@ unsigned long hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
                 addr = ALIGN(addr, huge_page_size(h));
                 vma = find_vma(mm, addr);
                 if (TASK_SIZE - len >= addr &&
-                    (!vma || addr + len <= vma->vm_start))
+                    (!vma || addr + len <= vm_start_gap(vma)))
                         return addr;
         }
         if (current->mm->get_unmapped_area == arch_get_unmapped_area)
diff --git a/arch/x86/boot/boot.h b/arch/x86/boot/boot.h
index 9011a88353de..ed1e9206f830 100644
--- a/arch/x86/boot/boot.h
+++ b/arch/x86/boot/boot.h
@@ -16,7 +16,7 @@
 #ifndef BOOT_BOOT_H
 #define BOOT_BOOT_H
 
-#define STACK_SIZE      512     /* Minimum number of bytes for stack */
+#define STACK_SIZE      1024    /* Minimum number of bytes for stack */
 
 #ifndef __ASSEMBLY__
 
diff --git a/arch/x86/boot/string.c b/arch/x86/boot/string.c
index 318b8465d302..06ceddb3a22e 100644
--- a/arch/x86/boot/string.c
+++ b/arch/x86/boot/string.c
@@ -14,6 +14,7 @@
 
 #include <linux/types.h>
 #include "ctype.h"
+#include "string.h"
 
 int memcmp(const void *s1, const void *s2, size_t len)
 {
diff --git a/arch/x86/boot/string.h b/arch/x86/boot/string.h
index 725e820602b1..113588ddb43f 100644
--- a/arch/x86/boot/string.h
+++ b/arch/x86/boot/string.h
@@ -18,4 +18,13 @@ int memcmp(const void *s1, const void *s2, size_t len);
 #define memset(d,c,l) __builtin_memset(d,c,l)
 #define memcmp  __builtin_memcmp
 
+extern int strcmp(const char *str1, const char *str2);
+extern int strncmp(const char *cs, const char *ct, size_t count);
+extern size_t strlen(const char *s);
+extern char *strstr(const char *s1, const char *s2);
+extern size_t strnlen(const char *s, size_t maxlen);
+extern unsigned int atou(const char *s);
+extern unsigned long long simple_strtoull(const char *cp, char **endp,
+                                          unsigned int base);
+
 #endif /* BOOT_STRING_H */
diff --git a/arch/x86/crypto/ghash-clmulni-intel_glue.c b/arch/x86/crypto/ghash-clmulni-intel_glue.c
index 440df0c7a2ee..a69321a77783 100644
--- a/arch/x86/crypto/ghash-clmulni-intel_glue.c
+++ b/arch/x86/crypto/ghash-clmulni-intel_glue.c
@@ -219,6 +219,29 @@ static int ghash_async_final(struct ahash_request *req)
         }
 }
 
+static int ghash_async_import(struct ahash_request *req, const void *in)
+{
+        struct ahash_request *cryptd_req = ahash_request_ctx(req);
+        struct shash_desc *desc = cryptd_shash_desc(cryptd_req);
+        struct ghash_desc_ctx *dctx = shash_desc_ctx(desc);
+
+        ghash_async_init(req);
+        memcpy(dctx, in, sizeof(*dctx));
+        return 0;
+
+}
+
+static int ghash_async_export(struct ahash_request *req, void *out)
+{
+        struct ahash_request *cryptd_req = ahash_request_ctx(req);
+        struct shash_desc *desc = cryptd_shash_desc(cryptd_req);
+        struct ghash_desc_ctx *dctx = shash_desc_ctx(desc);
+
+        memcpy(out, dctx, sizeof(*dctx));
+        return 0;
+
+}
+
 static int ghash_async_digest(struct ahash_request *req)
 {
         struct crypto_ahash *tfm = crypto_ahash_reqtfm(req);
@@ -288,8 +311,11 @@ static struct ahash_alg ghash_async_alg = {
         .final          = ghash_async_final,
         .setkey         = ghash_async_setkey,
         .digest         = ghash_async_digest,
+        .export         = ghash_async_export,
+        .import         = ghash_async_import,
         .halg = {
                 .digestsize     = GHASH_DIGEST_SIZE,
+                .statesize = sizeof(struct ghash_desc_ctx),
                 .base = {
                         .cra_name               = "ghash",
                         .cra_driver_name        = "ghash-clmulni",
diff --git a/arch/x86/crypto/sha1_avx2_x86_64_asm.S b/arch/x86/crypto/sha1_avx2_x86_64_asm.S
index 1cd792db15ef..1eab79c9ac48 100644
--- a/arch/x86/crypto/sha1_avx2_x86_64_asm.S
+++ b/arch/x86/crypto/sha1_avx2_x86_64_asm.S
@@ -117,11 +117,10 @@
         .set T1, REG_T1
 .endm
 
-#define K_BASE          %r8
 #define HASH_PTR        %r9
+#define BLOCKS_CTR      %r8
 #define BUFFER_PTR      %r10
 #define BUFFER_PTR2     %r13
-#define BUFFER_END      %r11
 
 #define PRECALC_BUF     %r14
 #define WK_BUF          %r15
@@ -205,14 +204,14 @@
                  * blended AVX2 and ALU instruction scheduling
                  * 1 vector iteration per 8 rounds
                  */
-                vmovdqu ((i * 2) + PRECALC_OFFSET)(BUFFER_PTR), W_TMP
+                vmovdqu (i * 2)(BUFFER_PTR), W_TMP
         .elseif ((i & 7) == 1)
-                vinsertf128 $1, (((i-1) * 2)+PRECALC_OFFSET)(BUFFER_PTR2),\
+                vinsertf128 $1, ((i-1) * 2)(BUFFER_PTR2),\
                          WY_TMP, WY_TMP
         .elseif ((i & 7) == 2)
                 vpshufb YMM_SHUFB_BSWAP, WY_TMP, WY
         .elseif ((i & 7) == 4)
-                vpaddd  K_XMM(K_BASE), WY, WY_TMP
+                vpaddd  K_XMM + K_XMM_AR(%rip), WY, WY_TMP
         .elseif ((i & 7) == 7)
                 vmovdqu  WY_TMP, PRECALC_WK(i&~7)
 
@@ -255,7 +254,7 @@
                 vpxor   WY, WY_TMP, WY_TMP
         .elseif ((i & 7) == 7)
                 vpxor   WY_TMP2, WY_TMP, WY
-                vpaddd  K_XMM(K_BASE), WY, WY_TMP
+                vpaddd  K_XMM + K_XMM_AR(%rip), WY, WY_TMP
                 vmovdqu WY_TMP, PRECALC_WK(i&~7)
 
                 PRECALC_ROTATE_WY
@@ -291,7 +290,7 @@
                 vpsrld  $30, WY, WY
                 vpor    WY, WY_TMP, WY
         .elseif ((i & 7) == 7)
-                vpaddd  K_XMM(K_BASE), WY, WY_TMP
+                vpaddd  K_XMM + K_XMM_AR(%rip), WY, WY_TMP
                 vmovdqu WY_TMP, PRECALC_WK(i&~7)
 
                 PRECALC_ROTATE_WY
@@ -446,6 +445,16 @@
 
 .endm
 
+/* Add constant only if (%2 > %3) condition met (uses RTA as temp)
+ * %1 + %2 >= %3 ? %4 : 0
+ */
+.macro ADD_IF_GE a, b, c, d
+        mov     \a, RTA
+        add     $\d, RTA
+        cmp     $\c, \b
+        cmovge  RTA, \a
+.endm
+
 /*
  * macro implements 80 rounds of SHA-1, for multiple blocks with s/w pipelining
  */
@@ -463,13 +472,16 @@
         lea     (2*4*80+32)(%rsp), WK_BUF
 
         # Precalc WK for first 2 blocks
-        PRECALC_OFFSET = 0
+        ADD_IF_GE BUFFER_PTR2, BLOCKS_CTR, 2, 64
         .set i, 0
         .rept    160
                 PRECALC i
                 .set i, i + 1
         .endr
-        PRECALC_OFFSET = 128
+
+        /* Go to next block if needed */
+        ADD_IF_GE BUFFER_PTR, BLOCKS_CTR, 3, 128
+        ADD_IF_GE BUFFER_PTR2, BLOCKS_CTR, 4, 128
         xchg    WK_BUF, PRECALC_BUF
 
         .align 32
@@ -479,8 +491,8 @@ _loop:
          * we use K_BASE value as a signal of a last block,
          * it is set below by: cmovae BUFFER_PTR, K_BASE
          */
-        cmp     K_BASE, BUFFER_PTR
-        jne     _begin
+        test BLOCKS_CTR, BLOCKS_CTR
+        jnz _begin
         .align 32
         jmp     _end
         .align 32
@@ -512,10 +524,10 @@ _loop0:
                 .set j, j+2
         .endr
 
-        add     $(2*64), BUFFER_PTR       /* move to next odd-64-byte block */
-        cmp     BUFFER_END, BUFFER_PTR    /* is current block the last one? */
-        cmovae  K_BASE, BUFFER_PTR      /* signal the last iteration smartly */
-
+        /* Update Counter */
+        sub $1, BLOCKS_CTR
+        /* Move to the next block only if needed*/
+        ADD_IF_GE BUFFER_PTR, BLOCKS_CTR, 4, 128
         /*
          * rounds
          * 60,62,64,66,68
@@ -532,8 +544,8 @@ _loop0:
         UPDATE_HASH     12(HASH_PTR), D
         UPDATE_HASH     16(HASH_PTR), E
 
-        cmp     K_BASE, BUFFER_PTR      /* is current block the last one? */
-        je      _loop
+        test    BLOCKS_CTR, BLOCKS_CTR
+        jz      _loop
 
         mov     TB, B
 
@@ -575,10 +587,10 @@ _loop2:
                 .set j, j+2
         .endr
 
-        add     $(2*64), BUFFER_PTR2      /* move to next even-64-byte block */
-
-        cmp     BUFFER_END, BUFFER_PTR2   /* is current block the last one */
-        cmovae  K_BASE, BUFFER_PTR       /* signal the last iteration smartly */
+        /* update counter */
+        sub     $1, BLOCKS_CTR
+        /* Move to the next block only if needed*/
+        ADD_IF_GE BUFFER_PTR2, BLOCKS_CTR, 4, 128
 
         jmp     _loop3
 _loop3:
@@ -641,19 +653,12 @@ _loop3:
 
         avx2_zeroupper
 
-        lea     K_XMM_AR(%rip), K_BASE
-
+        /* Setup initial values */
         mov     CTX, HASH_PTR
         mov     BUF, BUFFER_PTR
-        lea     64(BUF), BUFFER_PTR2
-
-        shl     $6, CNT                 /* mul by 64 */
-        add     BUF, CNT
-        add     $64, CNT
-        mov     CNT, BUFFER_END
 
-        cmp     BUFFER_END, BUFFER_PTR2
-        cmovae  K_BASE, BUFFER_PTR2
+        mov     BUF, BUFFER_PTR2
+        mov     CNT, BLOCKS_CTR
 
         xmm_mov BSWAP_SHUFB_CTL(%rip), YMM_SHUFB_BSWAP
 
diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S
index a55697d19824..cc0f2f5da19b 100644
--- a/arch/x86/entry/entry_64.S
+++ b/arch/x86/entry/entry_64.S
@@ -1190,6 +1190,8 @@ ENTRY(nmi)
          * other IST entries.
          */
 
+        ASM_CLAC
+
         /* Use %rdx as our temp variable throughout */
         pushq   %rdx
 
diff --git a/arch/x86/entry/vdso/Makefile b/arch/x86/entry/vdso/Makefile
index 265c0ed68118..7af017a8958f 100644
--- a/arch/x86/entry/vdso/Makefile
+++ b/arch/x86/entry/vdso/Makefile
@@ -187,10 +187,10 @@ vdso_img_insttargets := $(vdso_img_sodbg:%.dbg=install_%)
 $(MODLIB)/vdso: FORCE
         @mkdir -p $(MODLIB)/vdso
 
-$(vdso_img_insttargets): install_%: $(obj)/%.dbg $(MODLIB)/vdso FORCE
+$(vdso_img_insttargets): install_%: $(obj)/%.dbg $(MODLIB)/vdso
         $(call cmd,vdso_install)
 
 PHONY += vdso_install $(vdso_img_insttargets)
-vdso_install: $(vdso_img_insttargets) FORCE
+vdso_install: $(vdso_img_insttargets)
 
 clean-files := vdso32.so vdso32.so.dbg vdso64* vdso-image-*.c vdsox32.so*
diff --git a/arch/x86/entry/vdso/vdso32-setup.c b/arch/x86/entry/vdso/vdso32-setup.c
index 08a317a9ae4b..a7508d7e20b7 100644
--- a/arch/x86/entry/vdso/vdso32-setup.c
+++ b/arch/x86/entry/vdso/vdso32-setup.c
@@ -31,8 +31,10 @@ static int __init vdso32_setup(char *s)
 {
         vdso32_enabled = simple_strtoul(s, NULL, 0);
 
-        if (vdso32_enabled > 1)
+        if (vdso32_enabled > 1) {
                 pr_warn("vdso32 values other than 0 and 1 are no longer allowed; vdso disabled\n");
+                vdso32_enabled = 0;
+        }
 
         return 1;
 }
@@ -63,13 +65,18 @@ subsys_initcall(sysenter_setup);
 /* Register vsyscall32 into the ABI table */
 #include <linux/sysctl.h>
 
+static const int zero;
+static const int one = 1;
+
 static struct ctl_table abi_table2[] = {
         {
                 .procname       = "vsyscall32",
                 .data           = &vdso32_enabled,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = proc_dointvec
+                .proc_handler   = proc_dointvec_minmax,
+                .extra1         = (int *)&zero,
+                .extra2         = (int *)&one,
         },
         {}
 };
diff --git a/arch/x86/include/asm/elf.h b/arch/x86/include/asm/elf.h
index 1514753fd435..bcd3d6199464 100644
--- a/arch/x86/include/asm/elf.h
+++ b/arch/x86/include/asm/elf.h
@@ -245,12 +245,13 @@ extern int force_personality32;
 #define CORE_DUMP_USE_REGSET
 #define ELF_EXEC_PAGESIZE       4096
 
-/* This is the location that an ET_DYN program is loaded if exec'ed.  Typical
-   use of this is to invoke "./ld.so someprog" to test out a new version of
-   the loader.  We need to make sure that it is out of the way of the program
-   that it will "exec", and that there is sufficient room for the brk.  */
-
-#define ELF_ET_DYN_BASE         (TASK_SIZE / 3 * 2)
+/*
+ * This is the base location for PIE (ET_DYN with INTERP) loads. On
+ * 64-bit, this is above 4GB to leave the entire 32-bit address
+ * space open for things that want to use the area for 32-bit pointers.
+ */
+#define ELF_ET_DYN_BASE         (mmap_is_ia32() ? 0x000400000UL : \
+                                                  (TASK_SIZE / 3 * 2))
 
 /* This yields a mask that user programs can use to figure out what
    instruction set this CPU supports.  This could be done in user space,
@@ -278,7 +279,7 @@ struct task_struct;
 
 #define ARCH_DLINFO_IA32                                                \
 do {                                                                    \
-        if (vdso32_enabled) {                                           \
+        if (VDSO_CURRENT_BASE) {                                        \
                 NEW_AUX_ENT(AT_SYSINFO, VDSO_ENTRY);                    \
                 NEW_AUX_ENT(AT_SYSINFO_EHDR, VDSO_CURRENT_BASE);        \
         }                                                               \
diff --git a/arch/x86/include/asm/kvm_emulate.h b/arch/x86/include/asm/kvm_emulate.h
index e9cd7befcb76..19d14ac23ef9 100644
--- a/arch/x86/include/asm/kvm_emulate.h
+++ b/arch/x86/include/asm/kvm_emulate.h
@@ -221,6 +221,9 @@ struct x86_emulate_ops {
         void (*get_cpuid)(struct x86_emulate_ctxt *ctxt,
                           u32 *eax, u32 *ebx, u32 *ecx, u32 *edx);
         void (*set_nmi_mask)(struct x86_emulate_ctxt *ctxt, bool masked);
+
+        unsigned (*get_hflags)(struct x86_emulate_ctxt *ctxt);
+        void (*set_hflags)(struct x86_emulate_ctxt *ctxt, unsigned hflags);
 };
 
 typedef u32 __attribute__((vector_size(16))) sse128_t;
@@ -290,7 +293,6 @@ struct x86_emulate_ctxt {
 
         /* interruptibility state, as a result of execution of STI or MOV SS */
         int interruptibility;
-        int emul_flags;
 
         bool perm_ok; /* do not check permissions if true */
         bool ud;        /* inject an #UD if host doesn't support insn */
diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h
index 690b4027e17c..37db36fddc88 100644
--- a/arch/x86/include/asm/msr-index.h
+++ b/arch/x86/include/asm/msr-index.h
@@ -405,6 +405,8 @@
 #define MSR_IA32_TSC_ADJUST             0x0000003b
 #define MSR_IA32_BNDCFGS                0x00000d90
 
+#define MSR_IA32_BNDCFGS_RSVD           0x00000ffc
+
 #define MSR_IA32_XSS                    0x00000da0
 
 #define FEATURE_CONTROL_LOCKED                          (1<<0)
diff --git a/arch/x86/include/asm/pat.h b/arch/x86/include/asm/pat.h
index 0b1ff4c1c14e..fffb2794dd89 100644
--- a/arch/x86/include/asm/pat.h
+++ b/arch/x86/include/asm/pat.h
@@ -7,6 +7,7 @@
 bool pat_enabled(void);
 void pat_disable(const char *reason);
 extern void pat_init(void);
+extern void init_cache_modes(void);
 
 extern int reserve_memtype(u64 start, u64 end,
                 enum page_cache_mode req_pcm, enum page_cache_mode *ret_pcm);
diff --git a/arch/x86/include/asm/pmem.h b/arch/x86/include/asm/pmem.h
index d8ce3ec816ab..6503526d7b24 100644
--- a/arch/x86/include/asm/pmem.h
+++ b/arch/x86/include/asm/pmem.h
@@ -72,8 +72,8 @@ static inline void arch_wmb_pmem(void)
  * @size:       number of bytes to write back
  *
  * Write back a cache range using the CLWB (cache line write back)
- * instruction.  This function requires explicit ordering with an
- * arch_wmb_pmem() call.  This API is internal to the x86 PMEM implementation.
+ * instruction. Note that @size is internally rounded up to be cache
+ * line size aligned.
  */
 static inline void __arch_wb_cache_pmem(void *vaddr, size_t size)
 {
@@ -87,15 +87,6 @@ static inline void __arch_wb_cache_pmem(void *vaddr, size_t size)
                 clwb(p);
 }
 
-/*
- * copy_from_iter_nocache() on x86 only uses non-temporal stores for iovec
- * iterators, so for other types (bvec & kvec) we must do a cache write-back.
- */
-static inline bool __iter_needs_pmem_wb(struct iov_iter *i)
-{
-        return iter_is_iovec(i) == false;
-}
-
 /**
  * arch_copy_from_iter_pmem - copy data from an iterator to PMEM
  * @addr:       PMEM destination address
@@ -114,8 +105,36 @@ static inline size_t arch_copy_from_iter_pmem(void __pmem *addr, size_t bytes,
         /* TODO: skip the write-back by always using non-temporal stores */
         len = copy_from_iter_nocache(vaddr, bytes, i);
 
-        if (__iter_needs_pmem_wb(i))
-                __arch_wb_cache_pmem(vaddr, bytes);
+        /*
+         * In the iovec case on x86_64 copy_from_iter_nocache() uses
+         * non-temporal stores for the bulk of the transfer, but we need
+         * to manually flush if the transfer is unaligned. A cached
+         * memory copy is used when destination or size is not naturally
+         * aligned. That is:
+         *   - Require 8-byte alignment when size is 8 bytes or larger.
+         *   - Require 4-byte alignment when size is 4 bytes.
+         *
+         * In the non-iovec case the entire destination needs to be
+         * flushed.
+         */
+        if (iter_is_iovec(i)) {
+                unsigned long flushed, dest = (unsigned long) addr;
+
+                if (bytes < 8) {
+                        if (!IS_ALIGNED(dest, 4) || (bytes != 4))
+                                __arch_wb_cache_pmem(addr, bytes);
+                } else {
+                        if (!IS_ALIGNED(dest, 8)) {
+                                dest = ALIGN(dest, boot_cpu_data.x86_clflush_size);
+                                __arch_wb_cache_pmem(addr, 1);
+                        }
+
+                        flushed = dest - (unsigned long) addr;
+                        if (bytes > flushed && !IS_ALIGNED(bytes - flushed, 8))
+                                __arch_wb_cache_pmem(addr + bytes - 1, 1);
+                }
+        } else
+                __arch_wb_cache_pmem(addr, bytes);
 
         return len;
 }
diff --git a/arch/x86/include/asm/xen/hypercall.h b/arch/x86/include/asm/xen/hypercall.h
index 4c20dd333412..85133b2b8e99 100644
--- a/arch/x86/include/asm/xen/hypercall.h
+++ b/arch/x86/include/asm/xen/hypercall.h
@@ -43,6 +43,7 @@
 
 #include <asm/page.h>
 #include <asm/pgtable.h>
+#include <asm/smap.h>
 
 #include <xen/interface/xen.h>
 #include <xen/interface/sched.h>
@@ -213,10 +214,12 @@ privcmd_call(unsigned call,
         __HYPERCALL_DECLS;
         __HYPERCALL_5ARG(a1, a2, a3, a4, a5);
 
+        stac();
         asm volatile("call *%[call]"
                      : __HYPERCALL_5PARAM
                      : [call] "a" (&hypercall_page[call])
                      : __HYPERCALL_CLOBBER5);
+        clac();
 
         return (long)__res;
 }
diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c
index e75907601a41..1e5eb9f2ff5f 100644
--- a/arch/x86/kernel/acpi/boot.c
+++ b/arch/x86/kernel/acpi/boot.c
@@ -329,6 +329,14 @@ static void __init mp_override_legacy_irq(u8 bus_irq, u8 polarity, u8 trigger,
         struct mpc_intsrc mp_irq;
 
         /*
+         * Check bus_irq boundary.
+         */
+        if (bus_irq >= NR_IRQS_LEGACY) {
+                pr_warn("Invalid bus_irq %u for legacy override\n", bus_irq);
+                return;
+        }
+
+        /*
          * Convert 'gsi' to 'ioapic.pin'.
          */
         ioapic = mp_find_ioapic(gsi);
diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
index aaacbd667212..fc91c98bee01 100644
--- a/arch/x86/kernel/apic/io_apic.c
+++ b/arch/x86/kernel/apic/io_apic.c
@@ -2115,8 +2115,9 @@ static inline void __init check_timer(void)
                         int idx;
                         idx = find_irq_entry(apic1, pin1, mp_INT);
                         if (idx != -1 && irq_trigger(idx))
-                                unmask_ioapic_irq(irq_get_chip_data(0));
+                                unmask_ioapic_irq(irq_get_irq_data(0));
                 }
+                irq_domain_deactivate_irq(irq_data);
                 irq_domain_activate_irq(irq_data);
                 if (timer_irq_works()) {
                         if (disable_timer_pin_1 > 0)
@@ -2138,6 +2139,7 @@ static inline void __init check_timer(void)
                  * legacy devices should be connected to IO APIC #0
                  */
                 replace_pin_at_irq_node(data, node, apic1, pin1, apic2, pin2);
+                irq_domain_deactivate_irq(irq_data);
                 irq_domain_activate_irq(irq_data);
                 legacy_pic->unmask(0);
                 if (timer_irq_works()) {
diff --git a/arch/x86/kernel/cpu/mcheck/mce_amd.c b/arch/x86/kernel/cpu/mcheck/mce_amd.c
index e99b15077e94..2116176c1721 100644
--- a/arch/x86/kernel/cpu/mcheck/mce_amd.c
+++ b/arch/x86/kernel/cpu/mcheck/mce_amd.c
@@ -53,7 +53,7 @@ static const char * const th_names[] = {
         "load_store",
         "insn_fetch",
         "combined_unit",
-        "",
+        "decode_unit",
         "northbridge",
         "execution_unit",
 };
@@ -682,6 +682,9 @@ static int threshold_create_bank(unsigned int cpu, unsigned int bank)
         const char *name = th_names[bank];
         int err = 0;
 
+        if (!dev)
+                return -ENODEV;
+
         if (is_shared_bank(bank)) {
                 nb = node_to_amd_nb(amd_get_nb_id(cpu));
 
diff --git a/arch/x86/kernel/cpu/mshyperv.c b/arch/x86/kernel/cpu/mshyperv.c
index cfc4a966e2b9..83b5f7a323a9 100644
--- a/arch/x86/kernel/cpu/mshyperv.c
+++ b/arch/x86/kernel/cpu/mshyperv.c
@@ -30,6 +30,7 @@
 #include <asm/apic.h>
 #include <asm/timer.h>
 #include <asm/reboot.h>
+#include <asm/nmi.h>
 
 struct ms_hyperv_info ms_hyperv;
 EXPORT_SYMBOL_GPL(ms_hyperv);
@@ -157,6 +158,26 @@ static unsigned char hv_get_nmi_reason(void)
         return 0;
 }
 
+#ifdef CONFIG_X86_LOCAL_APIC
+/*
+ * Prior to WS2016 Debug-VM sends NMIs to all CPUs which makes
+ * it dificult to process CHANNELMSG_UNLOAD in case of crash. Handle
+ * unknown NMI on the first CPU which gets it.
+ */
+static int hv_nmi_unknown(unsigned int val, struct pt_regs *regs)
+{
+        static atomic_t nmi_cpu = ATOMIC_INIT(-1);
+
+        if (!unknown_nmi_panic)
+                return NMI_DONE;
+
+        if (atomic_cmpxchg(&nmi_cpu, -1, raw_smp_processor_id()) != -1)
+                return NMI_HANDLED;
+
+        return NMI_DONE;
+}
+#endif
+
 static void __init ms_hyperv_init_platform(void)
 {
         /*
@@ -182,6 +203,9 @@ static void __init ms_hyperv_init_platform(void)
                 printk(KERN_INFO "HyperV: LAPIC Timer Frequency: %#x\n",
                                 lapic_timer_frequency);
         }
+
+        register_nmi_handler(NMI_UNKNOWN, hv_nmi_unknown, NMI_FLAG_FIRST,
+                             "hv_nmi_unknown");
 #endif
 
         if (ms_hyperv.features & HV_X64_MSR_TIME_REF_COUNT_AVAILABLE)
diff --git a/arch/x86/kernel/cpu/perf_event.c b/arch/x86/kernel/cpu/perf_event.c
index 1a8256dd6729..5b2f2306fbcc 100644
--- a/arch/x86/kernel/cpu/perf_event.c
+++ b/arch/x86/kernel/cpu/perf_event.c
@@ -1996,8 +1996,8 @@ static int x86_pmu_event_init(struct perf_event *event)
 
 static void refresh_pce(void *ignored)
 {
-        if (current->mm)
-                load_mm_cr4(current->mm);
+        if (current->active_mm)
+                load_mm_cr4(current->active_mm);
 }
 
 static void x86_pmu_event_mapped(struct perf_event *event)
diff --git a/arch/x86/kernel/cpu/perf_event_intel_lbr.c b/arch/x86/kernel/cpu/perf_event_intel_lbr.c
index 659f01e165d5..2cdae69d7e0b 100644
--- a/arch/x86/kernel/cpu/perf_event_intel_lbr.c
+++ b/arch/x86/kernel/cpu/perf_event_intel_lbr.c
@@ -153,7 +153,7 @@ static void __intel_pmu_lbr_enable(bool pmi)
          */
         if (cpuc->lbr_sel)
                 lbr_select = cpuc->lbr_sel->config;
-        if (!pmi)
+        if (!pmi && cpuc->lbr_sel)
                 wrmsrl(MSR_LBR_SELECT, lbr_select);
 
         rdmsrl(MSR_IA32_DEBUGCTLMSR, debugctl);
@@ -410,6 +410,9 @@ static void intel_pmu_lbr_read_32(struct cpu_hw_events *cpuc)
                 cpuc->lbr_entries[i].to         = msr_lastbranch.to;
                 cpuc->lbr_entries[i].mispred    = 0;
                 cpuc->lbr_entries[i].predicted  = 0;
+                cpuc->lbr_entries[i].in_tx      = 0;
+                cpuc->lbr_entries[i].abort      = 0;
+                cpuc->lbr_entries[i].cycles     = 0;
                 cpuc->lbr_entries[i].reserved   = 0;
         }
         cpuc->lbr_stack.nr = i;
@@ -429,8 +432,10 @@ static void intel_pmu_lbr_read_64(struct cpu_hw_events *cpuc)
         int out = 0;
         int num = x86_pmu.lbr_nr;
 
-        if (cpuc->lbr_sel->config & LBR_CALL_STACK)
-                num = tos;
+        if (cpuc->lbr_sel) {
+                if (cpuc->lbr_sel->config & LBR_CALL_STACK)
+                        num = tos;
+        }
 
         for (i = 0; i < num; i++) {
                 unsigned long lbr_idx = (tos - i) & mask;
diff --git a/arch/x86/kernel/fpu/init.c b/arch/x86/kernel/fpu/init.c
index be39b5fde4b9..1011c05b1bd5 100644
--- a/arch/x86/kernel/fpu/init.c
+++ b/arch/x86/kernel/fpu/init.c
@@ -96,6 +96,7 @@ static void fpu__init_system_early_generic(struct cpuinfo_x86 *c)
  * Boot time FPU feature detection code:
  */
 unsigned int mxcsr_feature_mask __read_mostly = 0xffffffffu;
+EXPORT_SYMBOL_GPL(mxcsr_feature_mask);
 
 static void __init fpu__init_system_mxcsr(void)
 {
diff --git a/arch/x86/kernel/ftrace.c b/arch/x86/kernel/ftrace.c
index eb6bd34582c6..1b96bfe09d42 100644
--- a/arch/x86/kernel/ftrace.c
+++ b/arch/x86/kernel/ftrace.c
@@ -977,6 +977,18 @@ void prepare_ftrace_return(unsigned long self_addr, unsigned long *parent,
         unsigned long return_hooker = (unsigned long)
                                 &return_to_handler;
 
+        /*
+         * When resuming from suspend-to-ram, this function can be indirectly
+         * called from early CPU startup code while the CPU is in real mode,
+         * which would fail miserably.  Make sure the stack pointer is a
+         * virtual address.
+         *
+         * This check isn't as accurate as virt_addr_valid(), but it should be
+         * good enough for this purpose, and it's fast.
+         */
+        if (unlikely((long)__builtin_frame_address(0) >= 0))
+                return;
+
         if (unlikely(ftrace_graph_is_dead()))
                 return;
 
diff --git a/arch/x86/kernel/head64.c b/arch/x86/kernel/head64.c
index f129a9af6357..b6b0077da1af 100644
--- a/arch/x86/kernel/head64.c
+++ b/arch/x86/kernel/head64.c
@@ -4,6 +4,7 @@
  *  Copyright (C) 2000 Andrea Arcangeli <andrea@suse.de> SuSE
  */
 
+#define DISABLE_BRANCH_PROFILING
 #include <linux/init.h>
 #include <linux/linkage.h>
 #include <linux/types.h>
diff --git a/arch/x86/kernel/hpet.c b/arch/x86/kernel/hpet.c
index b8e6ff5cd5d0..acc9b8f19ca8 100644
--- a/arch/x86/kernel/hpet.c
+++ b/arch/x86/kernel/hpet.c
@@ -351,6 +351,7 @@ static int hpet_resume(struct clock_event_device *evt, int timer)
         } else {
                 struct hpet_dev *hdev = EVT_TO_HPET_DEV(evt);
 
+                irq_domain_deactivate_irq(irq_get_irq_data(hdev->irq));
                 irq_domain_activate_irq(irq_get_irq_data(hdev->irq));
                 disable_irq(hdev->irq);
                 irq_set_affinity(hdev->irq, cpumask_of(hdev->cpu));
diff --git a/arch/x86/kernel/kprobes/common.h b/arch/x86/kernel/kprobes/common.h
index c6ee63f927ab..d688826e5736 100644
--- a/arch/x86/kernel/kprobes/common.h
+++ b/arch/x86/kernel/kprobes/common.h
@@ -67,7 +67,7 @@
 #endif
 
 /* Ensure if the instruction can be boostable */
-extern int can_boost(kprobe_opcode_t *instruction);
+extern int can_boost(kprobe_opcode_t *instruction, void *addr);
 /* Recover instruction if given address is probed */
 extern unsigned long recover_probed_instruction(kprobe_opcode_t *buf,
                                          unsigned long addr);
diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c
index 023c442c33bb..99d293ea2b49 100644
--- a/arch/x86/kernel/kprobes/core.c
+++ b/arch/x86/kernel/kprobes/core.c
@@ -163,12 +163,12 @@ NOKPROBE_SYMBOL(skip_prefixes);
  * Returns non-zero if opcode is boostable.
  * RIP relative instructions are adjusted at copying time in 64 bits mode
  */
-int can_boost(kprobe_opcode_t *opcodes)
+int can_boost(kprobe_opcode_t *opcodes, void *addr)
 {
         kprobe_opcode_t opcode;
         kprobe_opcode_t *orig_opcodes = opcodes;
 
-        if (search_exception_tables((unsigned long)opcodes))
+        if (search_exception_tables((unsigned long)addr))
                 return 0;       /* Page fault may occur on this address. */
 
 retry:
@@ -413,7 +413,7 @@ static int arch_copy_kprobe(struct kprobe *p)
          * __copy_instruction can modify the displacement of the instruction,
          * but it doesn't affect boostable check.
          */
-        if (can_boost(p->ainsn.insn))
+        if (can_boost(p->ainsn.insn, p->addr))
                 p->ainsn.boostable = 0;
         else
                 p->ainsn.boostable = -1;
diff --git a/arch/x86/kernel/kprobes/opt.c b/arch/x86/kernel/kprobes/opt.c
index 7b3b9d15c47a..c9d488f3e4cd 100644
--- a/arch/x86/kernel/kprobes/opt.c
+++ b/arch/x86/kernel/kprobes/opt.c
@@ -177,7 +177,7 @@ static int copy_optimized_instructions(u8 *dest, u8 *src)
 
         while (len < RELATIVEJUMP_SIZE) {
                 ret = __copy_instruction(dest + len, src + len);
-                if (!ret || !can_boost(dest + len))
+                if (!ret || !can_boost(dest + len, src + len))
                         return -EINVAL;
                 len += ret;
         }
diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c
index 47190bd399e7..32187f8a49b4 100644
--- a/arch/x86/kernel/kvm.c
+++ b/arch/x86/kernel/kvm.c
@@ -151,6 +151,8 @@ void kvm_async_pf_task_wait(u32 token)
                 if (hlist_unhashed(&n.link))
                         break;
 
+                rcu_irq_exit();
+
                 if (!n.halted) {
                         local_irq_enable();
                         schedule();
@@ -159,11 +161,11 @@ void kvm_async_pf_task_wait(u32 token)
                         /*
                          * We cannot reschedule. So halt.
                          */
-                        rcu_irq_exit();
                         native_safe_halt();
-                        rcu_irq_enter();
                         local_irq_disable();
                 }
+
+                rcu_irq_enter();
         }
         if (!n.halted)
                 finish_wait(&n.wq, &wait);
diff --git a/arch/x86/kernel/pci-calgary_64.c b/arch/x86/kernel/pci-calgary_64.c
index 0497f719977d..c055e9a4e547 100644
--- a/arch/x86/kernel/pci-calgary_64.c
+++ b/arch/x86/kernel/pci-calgary_64.c
@@ -296,7 +296,7 @@ static void iommu_free(struct iommu_table *tbl, dma_addr_t dma_addr,
 
         /* were we called with bad_dma_address? */
         badend = DMA_ERROR_CODE + (EMERGENCY_PAGES * PAGE_SIZE);
-        if (unlikely((dma_addr >= DMA_ERROR_CODE) && (dma_addr < badend))) {
+        if (unlikely(dma_addr < badend)) {
                 WARN(1, KERN_ERR "Calgary: driver tried unmapping bad DMA "
                        "address 0x%Lx\n", dma_addr);
                 return;
diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
index d2bbe343fda7..e67b834279b2 100644
--- a/arch/x86/kernel/setup.c
+++ b/arch/x86/kernel/setup.c
@@ -1048,6 +1048,13 @@ void __init setup_arch(char **cmdline_p)
         if (mtrr_trim_uncached_memory(max_pfn))
                 max_pfn = e820_end_of_ram_pfn();
 
+        /*
+         * This call is required when the CPU does not support PAT. If
+         * mtrr_bp_init() invoked it already via pat_init() the call has no
+         * effect.
+         */
+        init_cache_modes();
+
 #ifdef CONFIG_X86_32
         /* max_low_pfn get updated here */
         find_low_pfn_range();
diff --git a/arch/x86/kernel/sys_x86_64.c b/arch/x86/kernel/sys_x86_64.c
index 10e0272d789a..136ad7c1ce7b 100644
--- a/arch/x86/kernel/sys_x86_64.c
+++ b/arch/x86/kernel/sys_x86_64.c
@@ -143,7 +143,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
                 addr = PAGE_ALIGN(addr);
                 vma = find_vma(mm, addr);
                 if (end - len >= addr &&
-                    (!vma || addr + len <= vma->vm_start))
+                    (!vma || addr + len <= vm_start_gap(vma)))
                         return addr;
         }
 
@@ -186,7 +186,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
                 addr = PAGE_ALIGN(addr);
                 vma = find_vma(mm, addr);
                 if (TASK_SIZE - len >= addr &&
-                                (!vma || addr + len <= vma->vm_start))
+                                (!vma || addr + len <= vm_start_gap(vma)))
                         return addr;
         }
 
diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c
index 2e1fd586b895..83d6369c45f5 100644
--- a/arch/x86/kvm/cpuid.c
+++ b/arch/x86/kvm/cpuid.c
@@ -46,11 +46,18 @@ static u32 xstate_required_size(u64 xstate_bv, bool compacted)
         return ret;
 }
 
+bool kvm_mpx_supported(void)
+{
+        return ((host_xcr0 & (XFEATURE_MASK_BNDREGS | XFEATURE_MASK_BNDCSR))
+                 && kvm_x86_ops->mpx_supported());
+}
+EXPORT_SYMBOL_GPL(kvm_mpx_supported);
+
 u64 kvm_supported_xcr0(void)
 {
         u64 xcr0 = KVM_SUPPORTED_XCR0 & host_xcr0;
 
-        if (!kvm_x86_ops->mpx_supported())
+        if (!kvm_mpx_supported())
                 xcr0 &= ~(XFEATURE_MASK_BNDREGS | XFEATURE_MASK_BNDCSR);
 
         return xcr0;
@@ -97,7 +104,7 @@ int kvm_update_cpuid(struct kvm_vcpu *vcpu)
         if (best && (best->eax & (F(XSAVES) | F(XSAVEC))))
                 best->ebx = xstate_required_size(vcpu->arch.xcr0, true);
 
-        vcpu->arch.eager_fpu = use_eager_fpu() || guest_cpuid_has_mpx(vcpu);
+        vcpu->arch.eager_fpu = use_eager_fpu();
         if (vcpu->arch.eager_fpu)
                 kvm_x86_ops->fpu_activate(vcpu);
 
@@ -295,7 +302,7 @@ static inline int __do_cpuid_ent(struct kvm_cpuid_entry2 *entry, u32 function,
 #endif
         unsigned f_rdtscp = kvm_x86_ops->rdtscp_supported() ? F(RDTSCP) : 0;
         unsigned f_invpcid = kvm_x86_ops->invpcid_supported() ? F(INVPCID) : 0;
-        unsigned f_mpx = kvm_x86_ops->mpx_supported() ? F(MPX) : 0;
+        unsigned f_mpx = kvm_mpx_supported() ? F(MPX) : 0;
         unsigned f_xsaves = kvm_x86_ops->xsaves_supported() ? F(XSAVES) : 0;
 
         /* cpuid 1.edx */
@@ -737,18 +744,20 @@ out:
 static int move_to_next_stateful_cpuid_entry(struct kvm_vcpu *vcpu, int i)
 {
         struct kvm_cpuid_entry2 *e = &vcpu->arch.cpuid_entries[i];
-        int j, nent = vcpu->arch.cpuid_nent;
+        struct kvm_cpuid_entry2 *ej;
+        int j = i;
+        int nent = vcpu->arch.cpuid_nent;
 
         e->flags &= ~KVM_CPUID_FLAG_STATE_READ_NEXT;
         /* when no next entry is found, the current entry[i] is reselected */
-        for (j = i + 1; ; j = (j + 1) % nent) {
-                struct kvm_cpuid_entry2 *ej = &vcpu->arch.cpuid_entries[j];
-                if (ej->function == e->function) {
-                        ej->flags |= KVM_CPUID_FLAG_STATE_READ_NEXT;
-                        return j;
-                }
-        }
-        return 0; /* silence gcc, even though control never reaches here */
+        do {
+                j = (j + 1) % nent;
+                ej = &vcpu->arch.cpuid_entries[j];
+        } while (ej->function != e->function);
+
+        ej->flags |= KVM_CPUID_FLAG_STATE_READ_NEXT;
+
+        return j;
 }
 
 /* find an entry with matching function, matching index (if needed), and that
@@ -818,12 +827,6 @@ void kvm_cpuid(struct kvm_vcpu *vcpu, u32 *eax, u32 *ebx, u32 *ecx, u32 *edx)
         if (!best)
                 best = check_cpuid_limit(vcpu, function, index);
 
-        /*
-         * Perfmon not yet supported for L2 guest.
-         */
-        if (is_guest_mode(vcpu) && function == 0xa)
-                best = NULL;
-
         if (best) {
                 *eax = best->eax;
                 *ebx = best->ebx;
diff --git a/arch/x86/kvm/cpuid.h b/arch/x86/kvm/cpuid.h
index 3f5c48ddba45..d1534feefcfe 100644
--- a/arch/x86/kvm/cpuid.h
+++ b/arch/x86/kvm/cpuid.h
@@ -4,6 +4,7 @@
 #include "x86.h"
 
 int kvm_update_cpuid(struct kvm_vcpu *vcpu);
+bool kvm_mpx_supported(void);
 struct kvm_cpuid_entry2 *kvm_find_cpuid_entry(struct kvm_vcpu *vcpu,
                                               u32 function, u32 index);
 int kvm_dev_ioctl_get_cpuid(struct kvm_cpuid2 *cpuid,
@@ -134,20 +135,20 @@ static inline bool guest_cpuid_has_rtm(struct kvm_vcpu *vcpu)
         return best && (best->ebx & bit(X86_FEATURE_RTM));
 }
 
-static inline bool guest_cpuid_has_mpx(struct kvm_vcpu *vcpu)
+static inline bool guest_cpuid_has_pcommit(struct kvm_vcpu *vcpu)
 {
         struct kvm_cpuid_entry2 *best;
 
         best = kvm_find_cpuid_entry(vcpu, 7, 0);
-        return best && (best->ebx & bit(X86_FEATURE_MPX));
+        return best && (best->ebx & bit(X86_FEATURE_PCOMMIT));
 }
 
-static inline bool guest_cpuid_has_pcommit(struct kvm_vcpu *vcpu)
+static inline bool guest_cpuid_has_mpx(struct kvm_vcpu *vcpu)
 {
         struct kvm_cpuid_entry2 *best;
 
         best = kvm_find_cpuid_entry(vcpu, 7, 0);
-        return best && (best->ebx & bit(X86_FEATURE_PCOMMIT));
+        return best && (best->ebx & bit(X86_FEATURE_MPX));
 }
 
 static inline bool guest_cpuid_has_rdtscp(struct kvm_vcpu *vcpu)
diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
index 1dcea225977d..04b2f3cad7ba 100644
--- a/arch/x86/kvm/emulate.c
+++ b/arch/x86/kvm/emulate.c
@@ -2531,7 +2531,7 @@ static int em_rsm(struct x86_emulate_ctxt *ctxt)
         u64 smbase;
         int ret;
 
-        if ((ctxt->emul_flags & X86EMUL_SMM_MASK) == 0)
+        if ((ctxt->ops->get_hflags(ctxt) & X86EMUL_SMM_MASK) == 0)
                 return emulate_ud(ctxt);
 
         /*
@@ -2580,11 +2580,11 @@ static int em_rsm(struct x86_emulate_ctxt *ctxt)
                 return X86EMUL_UNHANDLEABLE;
         }
 
-        if ((ctxt->emul_flags & X86EMUL_SMM_INSIDE_NMI_MASK) == 0)
+        if ((ctxt->ops->get_hflags(ctxt) & X86EMUL_SMM_INSIDE_NMI_MASK) == 0)
                 ctxt->ops->set_nmi_mask(ctxt, false);
 
-        ctxt->emul_flags &= ~X86EMUL_SMM_INSIDE_NMI_MASK;
-        ctxt->emul_flags &= ~X86EMUL_SMM_MASK;
+        ctxt->ops->set_hflags(ctxt, ctxt->ops->get_hflags(ctxt) &
+                ~(X86EMUL_SMM_INSIDE_NMI_MASK | X86EMUL_SMM_MASK));
         return X86EMUL_CONTINUE;
 }
 
@@ -5296,6 +5296,7 @@ int x86_emulate_insn(struct x86_emulate_ctxt *ctxt)
         const struct x86_emulate_ops *ops = ctxt->ops;
         int rc = X86EMUL_CONTINUE;
         int saved_dst_type = ctxt->dst.type;
+        unsigned emul_flags;
 
         ctxt->mem_read.pos = 0;
 
@@ -5310,6 +5311,7 @@ int x86_emulate_insn(struct x86_emulate_ctxt *ctxt)
                 goto done;
         }
 
+        emul_flags = ctxt->ops->get_hflags(ctxt);
         if (unlikely(ctxt->d &
                      (No64|Undefined|Sse|Mmx|Intercept|CheckPerm|Priv|Prot|String))) {
                 if ((ctxt->mode == X86EMUL_MODE_PROT64 && (ctxt->d & No64)) ||
@@ -5343,7 +5345,7 @@ int x86_emulate_insn(struct x86_emulate_ctxt *ctxt)
                                 fetch_possible_mmx_operand(ctxt, &ctxt->dst);
                 }
 
-                if (unlikely(ctxt->emul_flags & X86EMUL_GUEST_MASK) && ctxt->intercept) {
+                if (unlikely(emul_flags & X86EMUL_GUEST_MASK) && ctxt->intercept) {
                         rc = emulator_check_intercept(ctxt, ctxt->intercept,
                                                       X86_ICPT_PRE_EXCEPT);
                         if (rc != X86EMUL_CONTINUE)
@@ -5372,7 +5374,7 @@ int x86_emulate_insn(struct x86_emulate_ctxt *ctxt)
                                 goto done;
                 }
 
-                if (unlikely(ctxt->emul_flags & X86EMUL_GUEST_MASK) && (ctxt->d & Intercept)) {
+                if (unlikely(emul_flags & X86EMUL_GUEST_MASK) && (ctxt->d & Intercept)) {
                         rc = emulator_check_intercept(ctxt, ctxt->intercept,
                                                       X86_ICPT_POST_EXCEPT);
                         if (rc != X86EMUL_CONTINUE)
@@ -5426,7 +5428,7 @@ int x86_emulate_insn(struct x86_emulate_ctxt *ctxt)
 
 special_insn:
 
-        if (unlikely(ctxt->emul_flags & X86EMUL_GUEST_MASK) && (ctxt->d & Intercept)) {
+        if (unlikely(emul_flags & X86EMUL_GUEST_MASK) && (ctxt->d & Intercept)) {
                 rc = emulator_check_intercept(ctxt, ctxt->intercept,
                                               X86_ICPT_POST_MEMACCESS);
                 if (rc != X86EMUL_CONTINUE)
diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
index 8eb8a934b531..1049c3c9b877 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -3433,12 +3433,15 @@ static int kvm_arch_setup_async_pf(struct kvm_vcpu *vcpu, gva_t gva, gfn_t gfn)
         return kvm_setup_async_pf(vcpu, gva, kvm_vcpu_gfn_to_hva(vcpu, gfn), &arch);
 }
 
-static bool can_do_async_pf(struct kvm_vcpu *vcpu)
+bool kvm_can_do_async_pf(struct kvm_vcpu *vcpu)
 {
         if (unlikely(!lapic_in_kernel(vcpu) ||
                      kvm_event_needs_reinjection(vcpu)))
                 return false;
 
+        if (is_guest_mode(vcpu))
+                return false;
+
         return kvm_x86_ops->interrupt_allowed(vcpu);
 }
 
@@ -3454,7 +3457,7 @@ static bool try_async_pf(struct kvm_vcpu *vcpu, bool prefault, gfn_t gfn,
         if (!async)
                 return false; /* *pfn has correct page already */
 
-        if (!prefault && can_do_async_pf(vcpu)) {
+        if (!prefault && kvm_can_do_async_pf(vcpu)) {
                 trace_kvm_try_async_get_page(gva, gfn);
                 if (kvm_find_async_pf_gfn(vcpu, gfn)) {
                         trace_kvm_async_pf_doublefault(gva, gfn);
diff --git a/arch/x86/kvm/mmu.h b/arch/x86/kvm/mmu.h
index 55ffb7b0f95e..e60fc80f8a9c 100644
--- a/arch/x86/kvm/mmu.h
+++ b/arch/x86/kvm/mmu.h
@@ -74,6 +74,7 @@ enum {
 int handle_mmio_page_fault(struct kvm_vcpu *vcpu, u64 addr, bool direct);
 void kvm_init_shadow_mmu(struct kvm_vcpu *vcpu);
 void kvm_init_shadow_ept_mmu(struct kvm_vcpu *vcpu, bool execonly);
+bool kvm_can_do_async_pf(struct kvm_vcpu *vcpu);
 
 static inline unsigned int kvm_mmu_available_pages(struct kvm *kvm)
 {
diff --git a/arch/x86/kvm/pmu_intel.c b/arch/x86/kvm/pmu_intel.c
index ab38af4f4947..23a7c7ba377a 100644
--- a/arch/x86/kvm/pmu_intel.c
+++ b/arch/x86/kvm/pmu_intel.c
@@ -294,7 +294,7 @@ static void intel_pmu_refresh(struct kvm_vcpu *vcpu)
                         ((u64)1 << edx.split.bit_width_fixed) - 1;
         }
 
-        pmu->global_ctrl = ((1 << pmu->nr_arch_gp_counters) - 1) |
+        pmu->global_ctrl = ((1ull << pmu->nr_arch_gp_counters) - 1) |
                 (((1ull << pmu->nr_arch_fixed_counters) - 1) << INTEL_PMC_IDX_FIXED);
         pmu->global_ctrl_mask = ~pmu->global_ctrl;
 
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index bb620df05d0d..b12391119ce8 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -863,7 +863,6 @@ static unsigned long nested_ept_get_cr3(struct kvm_vcpu *vcpu);
 static u64 construct_eptp(unsigned long root_hpa);
 static void kvm_cpu_vmxon(u64 addr);
 static void kvm_cpu_vmxoff(void);
-static bool vmx_mpx_supported(void);
 static bool vmx_xsaves_supported(void);
 static int vmx_cpu_uses_apicv(struct kvm_vcpu *vcpu);
 static int vmx_set_tss_addr(struct kvm *kvm, unsigned int addr);
@@ -2264,7 +2263,7 @@ static int nested_vmx_check_exception(struct kvm_vcpu *vcpu, unsigned nr)
         if (!(vmcs12->exception_bitmap & (1u << nr)))
                 return 0;
 
-        nested_vmx_vmexit(vcpu, to_vmx(vcpu)->exit_reason,
+        nested_vmx_vmexit(vcpu, EXIT_REASON_EXCEPTION_NMI,
                           vmcs_read32(VM_EXIT_INTR_INFO),
                           vmcs_readl(EXIT_QUALIFICATION));
         return 1;
@@ -2541,7 +2540,7 @@ static void nested_vmx_setup_ctls_msrs(struct vcpu_vmx *vmx)
                 VM_EXIT_LOAD_IA32_EFER | VM_EXIT_SAVE_IA32_EFER |
                 VM_EXIT_SAVE_VMX_PREEMPTION_TIMER | VM_EXIT_ACK_INTR_ON_EXIT;
 
-        if (vmx_mpx_supported())
+        if (kvm_mpx_supported())
                 vmx->nested.nested_vmx_exit_ctls_high |= VM_EXIT_CLEAR_BNDCFGS;
 
         /* We support free control of debug control saving. */
@@ -2562,7 +2561,7 @@ static void nested_vmx_setup_ctls_msrs(struct vcpu_vmx *vmx)
                 VM_ENTRY_LOAD_IA32_PAT;
         vmx->nested.nested_vmx_entry_ctls_high |=
                 (VM_ENTRY_ALWAYSON_WITHOUT_TRUE_MSR | VM_ENTRY_LOAD_IA32_EFER);
-        if (vmx_mpx_supported())
+        if (kvm_mpx_supported())
                 vmx->nested.nested_vmx_entry_ctls_high |= VM_ENTRY_LOAD_BNDCFGS;
 
         /* We support free control of debug control loading. */
@@ -2813,7 +2812,8 @@ static int vmx_get_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
                 msr_info->data = vmcs_readl(GUEST_SYSENTER_ESP);
                 break;
         case MSR_IA32_BNDCFGS:
-                if (!vmx_mpx_supported())
+                if (!kvm_mpx_supported() ||
+                    (!msr_info->host_initiated && !guest_cpuid_has_mpx(vcpu)))
                         return 1;
                 msr_info->data = vmcs_read64(GUEST_BNDCFGS);
                 break;
@@ -2890,7 +2890,11 @@ static int vmx_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
                 vmcs_writel(GUEST_SYSENTER_ESP, data);
                 break;
         case MSR_IA32_BNDCFGS:
-                if (!vmx_mpx_supported())
+                if (!kvm_mpx_supported() ||
+                    (!msr_info->host_initiated && !guest_cpuid_has_mpx(vcpu)))
+                        return 1;
+                if (is_noncanonical_address(data & PAGE_MASK) ||
+                    (data & MSR_IA32_BNDCFGS_RSVD))
                         return 1;
                 vmcs_write64(GUEST_BNDCFGS, data);
                 break;
@@ -3363,7 +3367,7 @@ static void init_vmcs_shadow_fields(void)
         for (i = j = 0; i < max_shadow_read_write_fields; i++) {
                 switch (shadow_read_write_fields[i]) {
                 case GUEST_BNDCFGS:
-                        if (!vmx_mpx_supported())
+                        if (!kvm_mpx_supported())
                                 continue;
                         break;
                 default:
@@ -3499,7 +3503,7 @@ static void fix_rmode_seg(int seg, struct kvm_segment *save)
         }
 
         vmcs_write16(sf->selector, var.selector);
-        vmcs_write32(sf->base, var.base);
+        vmcs_writel(sf->base, var.base);
         vmcs_write32(sf->limit, var.limit);
         vmcs_write32(sf->ar_bytes, vmx_segment_access_rights(&var));
 }
@@ -4867,6 +4871,12 @@ static int vmx_vcpu_setup(struct vcpu_vmx *vmx)
         if (vmx_xsaves_supported())
                 vmcs_write64(XSS_EXIT_BITMAP, VMX_XSS_EXIT_BITMAP);
 
+        if (enable_pml) {
+                ASSERT(vmx->pml_pg);
+                vmcs_write64(PML_ADDRESS, page_to_phys(vmx->pml_pg));
+                vmcs_write16(GUEST_PML_INDEX, PML_ENTITY_NUM - 1);
+        }
+
         return 0;
 }
 
@@ -6247,7 +6257,6 @@ static __init int hardware_setup(void)
         vmx_disable_intercept_for_msr(MSR_IA32_SYSENTER_CS, false);
         vmx_disable_intercept_for_msr(MSR_IA32_SYSENTER_ESP, false);
         vmx_disable_intercept_for_msr(MSR_IA32_SYSENTER_EIP, false);
-        vmx_disable_intercept_for_msr(MSR_IA32_BNDCFGS, true);
 
         memcpy(vmx_msr_bitmap_legacy_x2apic,
                         vmx_msr_bitmap_legacy, PAGE_SIZE);
@@ -6672,14 +6681,20 @@ static int nested_vmx_check_vmptr(struct kvm_vcpu *vcpu, int exit_reason,
                 }
 
                 page = nested_get_page(vcpu, vmptr);
-                if (page == NULL ||
-                    *(u32 *)kmap(page) != VMCS12_REVISION) {
+                if (page == NULL) {
                         nested_vmx_failInvalid(vcpu);
+                        skip_emulated_instruction(vcpu);
+                        return 1;
+                }
+                if (*(u32 *)kmap(page) != VMCS12_REVISION) {
                         kunmap(page);
+                        nested_release_page_clean(page);
+                        nested_vmx_failInvalid(vcpu);
                         skip_emulated_instruction(vcpu);
                         return 1;
                 }
                 kunmap(page);
+                nested_release_page_clean(page);
                 vmx->nested.vmxon_ptr = vmptr;
                 break;
         case EXIT_REASON_VMCLEAR:
@@ -7742,8 +7757,6 @@ static bool nested_vmx_exit_handled(struct kvm_vcpu *vcpu)
         case EXIT_REASON_TASK_SWITCH:
                 return true;
         case EXIT_REASON_CPUID:
-                if (kvm_register_read(vcpu, VCPU_REGS_RAX) == 0xa)
-                        return false;
                 return true;
         case EXIT_REASON_HLT:
                 return nested_cpu_has(vmcs12, CPU_BASED_HLT_EXITING);
@@ -7828,6 +7841,9 @@ static bool nested_vmx_exit_handled(struct kvm_vcpu *vcpu)
                 return nested_cpu_has2(vmcs12, SECONDARY_EXEC_XSAVES);
         case EXIT_REASON_PCOMMIT:
                 return nested_cpu_has2(vmcs12, SECONDARY_EXEC_PCOMMIT);
+        case EXIT_REASON_PML_FULL:
+                /* We don't expose PML support to L1. */
+                return false;
         default:
                 return true;
         }
@@ -7839,22 +7855,6 @@ static void vmx_get_exit_info(struct kvm_vcpu *vcpu, u64 *info1, u64 *info2)
         *info2 = vmcs_read32(VM_EXIT_INTR_INFO);
 }
 
-static int vmx_create_pml_buffer(struct vcpu_vmx *vmx)
-{
-        struct page *pml_pg;
-
-        pml_pg = alloc_page(GFP_KERNEL | __GFP_ZERO);
-        if (!pml_pg)
-                return -ENOMEM;
-
-        vmx->pml_pg = pml_pg;
-
-        vmcs_write64(PML_ADDRESS, page_to_phys(vmx->pml_pg));
-        vmcs_write16(GUEST_PML_INDEX, PML_ENTITY_NUM - 1);
-
-        return 0;
-}
-
 static void vmx_destroy_pml_buffer(struct vcpu_vmx *vmx)
 {
         if (vmx->pml_pg) {
@@ -7915,7 +7915,7 @@ static void kvm_flush_pml_buffers(struct kvm *kvm)
 static void vmx_dump_sel(char *name, uint32_t sel)
 {
         pr_err("%s sel=0x%04x, attr=0x%05x, limit=0x%08x, base=0x%016lx\n",
-               name, vmcs_read32(sel),
+               name, vmcs_read16(sel),
                vmcs_read32(sel + GUEST_ES_AR_BYTES - GUEST_ES_SELECTOR),
                vmcs_read32(sel + GUEST_ES_LIMIT - GUEST_ES_SELECTOR),
                vmcs_readl(sel + GUEST_ES_BASE - GUEST_ES_SELECTOR));
@@ -8789,14 +8789,26 @@ static struct kvm_vcpu *vmx_create_vcpu(struct kvm *kvm, unsigned int id)
         if (err)
                 goto free_vcpu;
 
+        err = -ENOMEM;
+
+        /*
+         * If PML is turned on, failure on enabling PML just results in failure
+         * of creating the vcpu, therefore we can simplify PML logic (by
+         * avoiding dealing with cases, such as enabling PML partially on vcpus
+         * for the guest, etc.
+         */
+        if (enable_pml) {
+                vmx->pml_pg = alloc_page(GFP_KERNEL | __GFP_ZERO);
+                if (!vmx->pml_pg)
+                        goto uninit_vcpu;
+        }
+
         vmx->guest_msrs = kmalloc(PAGE_SIZE, GFP_KERNEL);
         BUILD_BUG_ON(ARRAY_SIZE(vmx_msr_index) * sizeof(vmx->guest_msrs[0])
                      > PAGE_SIZE);
 
-        err = -ENOMEM;
-        if (!vmx->guest_msrs) {
-                goto uninit_vcpu;
-        }
+        if (!vmx->guest_msrs)
+                goto free_pml;
 
         vmx->loaded_vmcs = &vmx->vmcs01;
         vmx->loaded_vmcs->vmcs = alloc_vmcs();
@@ -8840,18 +8852,6 @@ static struct kvm_vcpu *vmx_create_vcpu(struct kvm *kvm, unsigned int id)
         vmx->nested.current_vmptr = -1ull;
         vmx->nested.current_vmcs12 = NULL;
 
-        /*
-         * If PML is turned on, failure on enabling PML just results in failure
-         * of creating the vcpu, therefore we can simplify PML logic (by
-         * avoiding dealing with cases, such as enabling PML partially on vcpus
-         * for the guest, etc.
-         */
-        if (enable_pml) {
-                err = vmx_create_pml_buffer(vmx);
-                if (err)
-                        goto free_vmcs;
-        }
-
         return &vmx->vcpu;
 
 free_vmcs:
@@ -8859,6 +8859,8 @@ free_vmcs:
         free_loaded_vmcs(vmx->loaded_vmcs);
 free_msrs:
         kfree(vmx->guest_msrs);
+free_pml:
+        vmx_destroy_pml_buffer(vmx);
 uninit_vcpu:
         kvm_vcpu_uninit(&vmx->vcpu);
 free_vcpu:
@@ -9761,6 +9763,18 @@ static void prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12)
 
         }
 
+        if (enable_pml) {
+                /*
+                 * Conceptually we want to copy the PML address and index from
+                 * vmcs01 here, and then back to vmcs01 on nested vmexit. But,
+                 * since we always flush the log on each vmexit, this happens
+                 * to be equivalent to simply resetting the fields in vmcs02.
+                 */
+                ASSERT(vmx->pml_pg);
+                vmcs_write64(PML_ADDRESS, page_to_phys(vmx->pml_pg));
+                vmcs_write16(GUEST_PML_INDEX, PML_ENTITY_NUM - 1);
+        }
+
         if (nested_cpu_has_ept(vmcs12)) {
                 kvm_mmu_unload(vcpu);
                 nested_ept_init_mmu_context(vcpu);
@@ -10254,7 +10268,7 @@ static void prepare_vmcs12(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12,
         vmcs12->guest_sysenter_cs = vmcs_read32(GUEST_SYSENTER_CS);
         vmcs12->guest_sysenter_esp = vmcs_readl(GUEST_SYSENTER_ESP);
         vmcs12->guest_sysenter_eip = vmcs_readl(GUEST_SYSENTER_EIP);
-        if (vmx_mpx_supported())
+        if (kvm_mpx_supported())
                 vmcs12->guest_bndcfgs = vmcs_read64(GUEST_BNDCFGS);
         if (nested_cpu_has_xsaves(vmcs12))
                 vmcs12->xss_exit_bitmap = vmcs_read64(XSS_EXIT_BITMAP);
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 25a6efcfdf7f..8e526c6fd784 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -2960,6 +2960,12 @@ static int kvm_vcpu_ioctl_x86_set_vcpu_events(struct kvm_vcpu *vcpu,
                               | KVM_VCPUEVENT_VALID_SMM))
                 return -EINVAL;
 
+        /* INITs are latched while in SMM */
+        if (events->flags & KVM_VCPUEVENT_VALID_SMM &&
+            (events->smi.smm || events->smi.pending) &&
+            vcpu->arch.mp_state == KVM_MP_STATE_INIT_RECEIVED)
+                return -EINVAL;
+
         process_nmi(vcpu);
         vcpu->arch.exception.pending = events->exception.injected;
         vcpu->arch.exception.nr = events->exception.nr;
@@ -3057,6 +3063,7 @@ static void fill_xsave(u8 *dest, struct kvm_vcpu *vcpu)
         memcpy(dest, xsave, XSAVE_HDR_OFFSET);
 
         /* Set XSTATE_BV */
+        xstate_bv &= vcpu->arch.guest_supported_xcr0 | XFEATURE_MASK_FPSSE;
         *(u64 *)(dest + XSAVE_HDR_OFFSET) = xstate_bv;
 
         /*
@@ -3133,11 +3140,14 @@ static void kvm_vcpu_ioctl_x86_get_xsave(struct kvm_vcpu *vcpu,
         }
 }
 
+#define XSAVE_MXCSR_OFFSET 24
+
 static int kvm_vcpu_ioctl_x86_set_xsave(struct kvm_vcpu *vcpu,
                                         struct kvm_xsave *guest_xsave)
 {
         u64 xstate_bv =
                 *(u64 *)&guest_xsave->region[XSAVE_HDR_OFFSET / sizeof(u32)];
+        u32 mxcsr = *(u32 *)&guest_xsave->region[XSAVE_MXCSR_OFFSET / sizeof(u32)];
 
         if (cpu_has_xsave) {
                 /*
@@ -3145,11 +3155,13 @@ static int kvm_vcpu_ioctl_x86_set_xsave(struct kvm_vcpu *vcpu,
                  * CPUID leaf 0xD, index 0, EDX:EAX.  This is for compatibility
                  * with old userspace.
                  */
-                if (xstate_bv & ~kvm_supported_xcr0())
+                if (xstate_bv & ~kvm_supported_xcr0() ||
+                        mxcsr & ~mxcsr_feature_mask)
                         return -EINVAL;
                 load_xsave(vcpu, (u8 *)guest_xsave->region);
         } else {
-                if (xstate_bv & ~XFEATURE_MASK_FPSSE)
+                if (xstate_bv & ~XFEATURE_MASK_FPSSE ||
+                        mxcsr & ~mxcsr_feature_mask)
                         return -EINVAL;
                 memcpy(&vcpu->arch.guest_fpu.state.fxsave,
                         guest_xsave->region, sizeof(struct fxregs_state));
@@ -4596,16 +4608,20 @@ emul_write:
 
 static int kernel_pio(struct kvm_vcpu *vcpu, void *pd)
 {
-        /* TODO: String I/O for in kernel device */
-        int r;
+        int r = 0, i;
 
-        if (vcpu->arch.pio.in)
-                r = kvm_io_bus_read(vcpu, KVM_PIO_BUS, vcpu->arch.pio.port,
-                                    vcpu->arch.pio.size, pd);
-        else
-                r = kvm_io_bus_write(vcpu, KVM_PIO_BUS,
-                                     vcpu->arch.pio.port, vcpu->arch.pio.size,
-                                     pd);
+        for (i = 0; i < vcpu->arch.pio.count; i++) {
+                if (vcpu->arch.pio.in)
+                        r = kvm_io_bus_read(vcpu, KVM_PIO_BUS, vcpu->arch.pio.port,
+                                            vcpu->arch.pio.size, pd);
+                else
+                        r = kvm_io_bus_write(vcpu, KVM_PIO_BUS,
+                                             vcpu->arch.pio.port, vcpu->arch.pio.size,
+                                             pd);
+                if (r)
+                        break;
+                pd += vcpu->arch.pio.size;
+        }
         return r;
 }
 
@@ -4643,6 +4659,8 @@ static int emulator_pio_in_emulated(struct x86_emulate_ctxt *ctxt,
         if (vcpu->arch.pio.count)
                 goto data_avail;
 
+        memset(vcpu->arch.pio_data, 0, size * count);
+
         ret = emulator_pio_in_out(vcpu, size, port, val, count, true);
         if (ret) {
 data_avail:
@@ -4826,6 +4844,8 @@ static bool emulator_get_segment(struct x86_emulate_ctxt *ctxt, u16 *selector,
 
         if (var.unusable) {
                 memset(desc, 0, sizeof(*desc));
+                if (base3)
+                        *base3 = 0;
                 return false;
         }
 
@@ -4981,6 +5001,16 @@ static void emulator_set_nmi_mask(struct x86_emulate_ctxt *ctxt, bool masked)
         kvm_x86_ops->set_nmi_mask(emul_to_vcpu(ctxt), masked);
 }
 
+static unsigned emulator_get_hflags(struct x86_emulate_ctxt *ctxt)
+{
+        return emul_to_vcpu(ctxt)->arch.hflags;
+}
+
+static void emulator_set_hflags(struct x86_emulate_ctxt *ctxt, unsigned emul_flags)
+{
+        kvm_set_hflags(emul_to_vcpu(ctxt), emul_flags);
+}
+
 static const struct x86_emulate_ops emulate_ops = {
         .read_gpr            = emulator_read_gpr,
         .write_gpr           = emulator_write_gpr,
@@ -5020,6 +5050,8 @@ static const struct x86_emulate_ops emulate_ops = {
         .intercept           = emulator_intercept,
         .get_cpuid           = emulator_get_cpuid,
         .set_nmi_mask        = emulator_set_nmi_mask,
+        .get_hflags          = emulator_get_hflags,
+        .set_hflags          = emulator_set_hflags,
 };
 
 static void toggle_interruptibility(struct kvm_vcpu *vcpu, u32 mask)
@@ -5072,7 +5104,6 @@ static void init_emulate_ctxt(struct kvm_vcpu *vcpu)
         BUILD_BUG_ON(HF_GUEST_MASK != X86EMUL_GUEST_MASK);
         BUILD_BUG_ON(HF_SMM_MASK != X86EMUL_SMM_MASK);
         BUILD_BUG_ON(HF_SMM_INSIDE_NMI_MASK != X86EMUL_SMM_INSIDE_NMI_MASK);
-        ctxt->emul_flags = vcpu->arch.hflags;
 
         init_decode_cache(ctxt);
         vcpu->arch.emulate_regs_need_sync_from_vcpu = false;
@@ -5468,8 +5499,6 @@ restart:
                 unsigned long rflags = kvm_x86_ops->get_rflags(vcpu);
                 toggle_interruptibility(vcpu, ctxt->interruptibility);
                 vcpu->arch.emulate_regs_need_sync_to_vcpu = false;
-                if (vcpu->arch.hflags != ctxt->emul_flags)
-                        kvm_set_hflags(vcpu, ctxt->emul_flags);
                 kvm_rip_write(vcpu, ctxt->eip);
                 if (r == EMULATE_DONE)
                         kvm_vcpu_check_singlestep(vcpu, rflags, &r);
@@ -5956,7 +5985,8 @@ static int emulator_fix_hypercall(struct x86_emulate_ctxt *ctxt)
 
         kvm_x86_ops->patch_hypercall(vcpu, instruction);
 
-        return emulator_write_emulated(ctxt, rip, instruction, 3, NULL);
+        return emulator_write_emulated(ctxt, rip, instruction, 3,
+                &ctxt->exception);
 }
 
 static int dm_request_for_irq_injection(struct kvm_vcpu *vcpu)
@@ -6992,6 +7022,12 @@ int kvm_arch_vcpu_ioctl_set_mpstate(struct kvm_vcpu *vcpu,
             mp_state->mp_state != KVM_MP_STATE_RUNNABLE)
                 return -EINVAL;
 
+        /* INITs are latched while in SMM */
+        if ((is_smm(vcpu) || vcpu->arch.smi_pending) &&
+            (mp_state->mp_state == KVM_MP_STATE_SIPI_RECEIVED ||
+             mp_state->mp_state == KVM_MP_STATE_INIT_RECEIVED))
+                return -EINVAL;
+
         if (mp_state->mp_state == KVM_MP_STATE_SIPI_RECEIVED) {
                 vcpu->arch.mp_state = KVM_MP_STATE_INIT_RECEIVED;
                 set_bit(KVM_APIC_SIPI, &vcpu->arch.apic->pending_events);
@@ -8221,8 +8257,7 @@ bool kvm_arch_can_inject_async_page_present(struct kvm_vcpu *vcpu)
         if (!(vcpu->arch.apf.msr_val & KVM_ASYNC_PF_ENABLED))
                 return true;
         else
-                return !kvm_event_needs_reinjection(vcpu) &&
-                        kvm_x86_ops->interrupt_allowed(vcpu);
+                return kvm_can_do_async_pf(vcpu);
 }
 
 void kvm_arch_start_assignment(struct kvm *kvm)
diff --git a/arch/x86/lib/copy_user_64.S b/arch/x86/lib/copy_user_64.S
index 27f89c79a44b..423644c230e7 100644
--- a/arch/x86/lib/copy_user_64.S
+++ b/arch/x86/lib/copy_user_64.S
@@ -80,7 +80,7 @@ ENTRY(copy_user_generic_unrolled)
         movl %edx,%ecx
         andl $63,%edx
         shrl $6,%ecx
-        jz 17f
+        jz .L_copy_short_string
 1:      movq (%rsi),%r8
 2:      movq 1*8(%rsi),%r9
 3:      movq 2*8(%rsi),%r10
@@ -101,7 +101,8 @@ ENTRY(copy_user_generic_unrolled)
         leaq 64(%rdi),%rdi
         decl %ecx
         jnz 1b
-17:     movl %edx,%ecx
+.L_copy_short_string:
+        movl %edx,%ecx
         andl $7,%edx
         shrl $3,%ecx
         jz 20f
@@ -215,6 +216,8 @@ ENDPROC(copy_user_generic_string)
  */
 ENTRY(copy_user_enhanced_fast_string)
         ASM_STAC
+        cmpl $64,%edx
+        jb .L_copy_short_string /* less then 64 bytes, avoid the costly 'rep' */
         movl %edx,%ecx
 1:      rep
         movsb
diff --git a/arch/x86/mm/hugetlbpage.c b/arch/x86/mm/hugetlbpage.c
index 42982b26e32b..39bdaf3ac44a 100644
--- a/arch/x86/mm/hugetlbpage.c
+++ b/arch/x86/mm/hugetlbpage.c
@@ -144,7 +144,7 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
                 addr = ALIGN(addr, huge_page_size(h));
                 vma = find_vma(mm, addr);
                 if (TASK_SIZE - len >= addr &&
-                    (!vma || addr + len <= vma->vm_start))
+                    (!vma || addr + len <= vm_start_gap(vma)))
                         return addr;
         }
         if (mm->get_unmapped_area == arch_get_unmapped_area)
diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c
index 493f54172b4a..3aebbd6c6f5f 100644
--- a/arch/x86/mm/init.c
+++ b/arch/x86/mm/init.c
@@ -628,21 +628,40 @@ void __init init_mem_mapping(void)
  * devmem_is_allowed() checks to see if /dev/mem access to a certain address
  * is valid. The argument is a physical page number.
  *
- *
- * On x86, access has to be given to the first megabyte of ram because that area
- * contains BIOS code and data regions used by X and dosemu and similar apps.
- * Access has to be given to non-kernel-ram areas as well, these contain the PCI
- * mmio resources as well as potential bios/acpi data regions.
+ * On x86, access has to be given to the first megabyte of RAM because that
+ * area traditionally contains BIOS code and data regions used by X, dosemu,
+ * and similar apps. Since they map the entire memory range, the whole range
+ * must be allowed (for mapping), but any areas that would otherwise be
+ * disallowed are flagged as being "zero filled" instead of rejected.
+ * Access has to be given to non-kernel-ram areas as well, these contain the
+ * PCI mmio resources as well as potential bios/acpi data regions.
  */
 int devmem_is_allowed(unsigned long pagenr)
 {
-        if (pagenr < 256)
-                return 1;
-        if (iomem_is_exclusive(pagenr << PAGE_SHIFT))
+        if (page_is_ram(pagenr)) {
+                /*
+                 * For disallowed memory regions in the low 1MB range,
+                 * request that the page be shown as all zeros.
+                 */
+                if (pagenr < 256)
+                        return 2;
+
+                return 0;
+        }
+
+        /*
+         * This must follow RAM test, since System RAM is considered a
+         * restricted resource under CONFIG_STRICT_IOMEM.
+         */
+        if (iomem_is_exclusive(pagenr << PAGE_SHIFT)) {
+                /* Low 1MB bypasses iomem restrictions. */
+                if (pagenr < 256)
+                        return 1;
+
                 return 0;
-        if (!page_is_ram(pagenr))
-                return 1;
-        return 0;
+        }
+
+        return 1;
 }
 
 void free_init_pages(char *what, unsigned long begin, unsigned long end)
diff --git a/arch/x86/mm/kasan_init_64.c b/arch/x86/mm/kasan_init_64.c
index d470cf219a2d..4e5ac46adc9d 100644
--- a/arch/x86/mm/kasan_init_64.c
+++ b/arch/x86/mm/kasan_init_64.c
@@ -1,3 +1,4 @@
+#define DISABLE_BRANCH_PROFILING
 #define pr_fmt(fmt) "kasan: " fmt
 #include <linux/bootmem.h>
 #include <linux/kasan.h>
diff --git a/arch/x86/mm/mpx.c b/arch/x86/mm/mpx.c
index ef05755a1900..7ed47b1e6f42 100644
--- a/arch/x86/mm/mpx.c
+++ b/arch/x86/mm/mpx.c
@@ -293,7 +293,7 @@ siginfo_t *mpx_generate_siginfo(struct pt_regs *regs)
          * We were not able to extract an address from the instruction,
          * probably because there was something invalid in it.
          */
-        if (info->si_addr == (void *)-1) {
+        if (info->si_addr == (void __user *)-1) {
                 err = -EINVAL;
                 goto err_out;
         }
@@ -525,15 +525,7 @@ int mpx_handle_bd_fault(void)
         if (!kernel_managing_mpx_tables(current->mm))
                 return -EINVAL;
 
-        if (do_mpx_bt_fault()) {
-                force_sig(SIGSEGV, current);
-                /*
-                 * The force_sig() is essentially "handling" this
-                 * exception, so we do not pass up the error
-                 * from do_mpx_bt_fault().
-                 */
-        }
-        return 0;
+        return do_mpx_bt_fault();
 }
 
 /*
diff --git a/arch/x86/mm/numa_32.c b/arch/x86/mm/numa_32.c
index 47b6436e41c2..3686a1db25b2 100644
--- a/arch/x86/mm/numa_32.c
+++ b/arch/x86/mm/numa_32.c
@@ -100,5 +100,6 @@ void __init initmem_init(void)
         printk(KERN_DEBUG "High memory starts at vaddr %08lx\n",
                         (ulong) pfn_to_kaddr(highstart_pfn));
 
+        __vmalloc_start_set = true;
         setup_bootmem_allocator();
 }
diff --git a/arch/x86/mm/pat.c b/arch/x86/mm/pat.c
index 6ad687d104ca..3f1bb4f93a5a 100644
--- a/arch/x86/mm/pat.c
+++ b/arch/x86/mm/pat.c
@@ -36,14 +36,14 @@
 #undef pr_fmt
 #define pr_fmt(fmt) "" fmt
 
-static bool boot_cpu_done;
-
-static int __read_mostly __pat_enabled = IS_ENABLED(CONFIG_X86_PAT);
-static void init_cache_modes(void);
+static bool __read_mostly boot_cpu_done;
+static bool __read_mostly pat_disabled = !IS_ENABLED(CONFIG_X86_PAT);
+static bool __read_mostly pat_initialized;
+static bool __read_mostly init_cm_done;
 
 void pat_disable(const char *reason)
 {
-        if (!__pat_enabled)
+        if (pat_disabled)
                 return;
 
         if (boot_cpu_done) {
@@ -51,10 +51,8 @@ void pat_disable(const char *reason)
                 return;
         }
 
-        __pat_enabled = 0;
+        pat_disabled = true;
         pr_info("x86/PAT: %s\n", reason);
-
-        init_cache_modes();
 }
 
 static int __init nopat(char *str)
@@ -66,7 +64,7 @@ early_param("nopat", nopat);
 
 bool pat_enabled(void)
 {
-        return !!__pat_enabled;
+        return pat_initialized;
 }
 EXPORT_SYMBOL_GPL(pat_enabled);
 
@@ -204,6 +202,8 @@ static void __init_cache_modes(u64 pat)
                 update_cache_mode_entry(i, cache);
         }
         pr_info("x86/PAT: Configuration [0-7]: %s\n", pat_msg);
+
+        init_cm_done = true;
 }
 
 #define PAT(x, y)       ((u64)PAT_ ## y << ((x)*8))
@@ -224,6 +224,7 @@ static void pat_bsp_init(u64 pat)
         }
 
         wrmsrl(MSR_IA32_CR_PAT, pat);
+        pat_initialized = true;
 
         __init_cache_modes(pat);
 }
@@ -241,10 +242,9 @@ static void pat_ap_init(u64 pat)
         wrmsrl(MSR_IA32_CR_PAT, pat);
 }
 
-static void init_cache_modes(void)
+void init_cache_modes(void)
 {
         u64 pat = 0;
-        static int init_cm_done;
 
         if (init_cm_done)
                 return;
@@ -286,8 +286,6 @@ static void init_cache_modes(void)
         }
 
         __init_cache_modes(pat);
-
-        init_cm_done = 1;
 }
 
 /**
@@ -305,10 +303,8 @@ void pat_init(void)
         u64 pat;
         struct cpuinfo_x86 *c = &boot_cpu_data;
 
-        if (!pat_enabled()) {
-                init_cache_modes();
+        if (pat_disabled)
                 return;
-        }
 
         if ((c->x86_vendor == X86_VENDOR_INTEL) &&
             (((c->x86 == 0x6) && (c->x86_model <= 0xd)) ||
diff --git a/arch/x86/mm/tlb.c b/arch/x86/mm/tlb.c
index 5fb6adaaa796..5a760fd66bec 100644
--- a/arch/x86/mm/tlb.c
+++ b/arch/x86/mm/tlb.c
@@ -134,8 +134,6 @@ void native_flush_tlb_others(const struct cpumask *cpumask,
 {
         struct flush_tlb_info info;
 
-        if (end == 0)
-                end = start + PAGE_SIZE;
         info.flush_mm = mm;
         info.flush_start = start;
         info.flush_end = end;
@@ -264,7 +262,7 @@ void flush_tlb_page(struct vm_area_struct *vma, unsigned long start)
         }
 
         if (cpumask_any_but(mm_cpumask(mm), smp_processor_id()) < nr_cpu_ids)
-                flush_tlb_others(mm_cpumask(mm), mm, start, 0UL);
+                flush_tlb_others(mm_cpumask(mm), mm, start, start + PAGE_SIZE);
 
         preempt_enable();
 }
diff --git a/arch/x86/pci/xen.c b/arch/x86/pci/xen.c
index c6d6efed392a..7575f0798194 100644
--- a/arch/x86/pci/xen.c
+++ b/arch/x86/pci/xen.c
@@ -231,23 +231,14 @@ static int xen_hvm_setup_msi_irqs(struct pci_dev *dev, int nvec, int type)
                 return 1;
 
         for_each_pci_msi_entry(msidesc, dev) {
-                __pci_read_msi_msg(msidesc, &msg);
-                pirq = MSI_ADDR_EXT_DEST_ID(msg.address_hi) |
-                        ((msg.address_lo >> MSI_ADDR_DEST_ID_SHIFT) & 0xff);
-                if (msg.data != XEN_PIRQ_MSI_DATA ||
-                    xen_irq_from_pirq(pirq) < 0) {
-                        pirq = xen_allocate_pirq_msi(dev, msidesc);
-                        if (pirq < 0) {
-                                irq = -ENODEV;
-                                goto error;
-                        }
-                        xen_msi_compose_msg(dev, pirq, &msg);
-                        __pci_write_msi_msg(msidesc, &msg);
-                        dev_dbg(&dev->dev, "xen: msi bound to pirq=%d\n", pirq);
-                } else {
-                        dev_dbg(&dev->dev,
-                                "xen: msi already bound to pirq=%d\n", pirq);
+                pirq = xen_allocate_pirq_msi(dev, msidesc);
+                if (pirq < 0) {
+                        irq = -ENODEV;
+                        goto error;
                 }
+                xen_msi_compose_msg(dev, pirq, &msg);
+                __pci_write_msi_msg(msidesc, &msg);
+                dev_dbg(&dev->dev, "xen: msi bound to pirq=%d\n", pirq);
                 irq = xen_bind_pirq_msi_to_irq(dev, msidesc, pirq,
                                                (type == PCI_CAP_ID_MSI) ? nvec : 1,
                                                (type == PCI_CAP_ID_MSIX) ?
diff --git a/arch/x86/platform/goldfish/goldfish.c b/arch/x86/platform/goldfish/goldfish.c
index 1693107a518e..0d17c0aafeb1 100644
--- a/arch/x86/platform/goldfish/goldfish.c
+++ b/arch/x86/platform/goldfish/goldfish.c
@@ -42,10 +42,22 @@ static struct resource goldfish_pdev_bus_resources[] = {
         }
 };
 
+static bool goldfish_enable __initdata;
+
+static int __init goldfish_setup(char *str)
+{
+        goldfish_enable = true;
+        return 0;
+}
+__setup("goldfish", goldfish_setup);
+
 static int __init goldfish_init(void)
 {
+        if (!goldfish_enable)
+                return -ENODEV;
+
         platform_device_register_simple("goldfish_pdev_bus", -1,
-                                                goldfish_pdev_bus_resources, 2);
+                                        goldfish_pdev_bus_resources, 2);
         return 0;
 }
 device_initcall(goldfish_init);
diff --git a/arch/x86/platform/intel-mid/device_libs/platform_wdt.c b/arch/x86/platform/intel-mid/device_libs/platform_wdt.c
index de734134bc8d..40c616495da7 100644
--- a/arch/x86/platform/intel-mid/device_libs/platform_wdt.c
+++ b/arch/x86/platform/intel-mid/device_libs/platform_wdt.c
@@ -17,7 +17,7 @@
 #include <asm/intel-mid.h>
 #include <asm/io_apic.h>
 
-#define TANGIER_EXT_TIMER0_MSI 15
+#define TANGIER_EXT_TIMER0_MSI 12
 
 static struct platform_device wdt_dev = {
         .name = "intel_mid_wdt",
diff --git a/arch/x86/tools/relocs.c b/arch/x86/tools/relocs.c
index 0c2fae8d929d..73eb7fd4aec4 100644
--- a/arch/x86/tools/relocs.c
+++ b/arch/x86/tools/relocs.c
@@ -992,11 +992,12 @@ static void emit_relocs(int as_text, int use_real_mode)
                 die("Segment relocations found but --realmode not specified\n");
 
         /* Order the relocations for more efficient processing */
-        sort_relocs(&relocs16);
         sort_relocs(&relocs32);
 #if ELF_BITS == 64
         sort_relocs(&relocs32neg);
         sort_relocs(&relocs64);
+#else
+        sort_relocs(&relocs16);
 #endif
 
         /* Print the relocations */
diff --git a/arch/x86/um/ptrace_64.c b/arch/x86/um/ptrace_64.c
index a629694ee750..e14c43a2d187 100644
--- a/arch/x86/um/ptrace_64.c
+++ b/arch/x86/um/ptrace_64.c
@@ -121,7 +121,7 @@ int poke_user(struct task_struct *child, long addr, long data)
         else if ((addr >= offsetof(struct user, u_debugreg[0])) &&
                 (addr <= offsetof(struct user, u_debugreg[7]))) {
                 addr -= offsetof(struct user, u_debugreg[0]);
-                addr = addr >> 2;
+                addr = addr >> 3;
                 if ((addr == 4) || (addr == 5))
                         return -EIO;
                 child->thread.arch.debugregs[addr] = data;
diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c
index 1e56ff583459..63146c378f1e 100644
--- a/arch/x86/xen/mmu.c
+++ b/arch/x86/xen/mmu.c
@@ -2038,7 +2038,8 @@ static unsigned long __init xen_read_phys_ulong(phys_addr_t addr)
 
 /*
  * Translate a virtual address to a physical one without relying on mapped
- * page tables.
+ * page tables. Don't rely on big pages being aligned in (guest) physical
+ * space!
  */
 static phys_addr_t __init xen_early_virt_to_phys(unsigned long vaddr)
 {
@@ -2059,7 +2060,7 @@ static phys_addr_t __init xen_early_virt_to_phys(unsigned long vaddr)
                                                        sizeof(pud)));
         if (!pud_present(pud))
                 return 0;
-        pa = pud_pfn(pud) << PAGE_SHIFT;
+        pa = pud_val(pud) & PTE_PFN_MASK;
         if (pud_large(pud))
                 return pa + (vaddr & ~PUD_MASK);
 
@@ -2067,7 +2068,7 @@ static phys_addr_t __init xen_early_virt_to_phys(unsigned long vaddr)
                                                        sizeof(pmd)));
         if (!pmd_present(pmd))
                 return 0;
-        pa = pmd_pfn(pmd) << PAGE_SHIFT;
+        pa = pmd_val(pmd) & PTE_PFN_MASK;
         if (pmd_large(pmd))
                 return pa + (vaddr & ~PMD_MASK);
 
diff --git a/arch/x86/xen/setup.c b/arch/x86/xen/setup.c
index e345891450c3..df8844a1853a 100644
--- a/arch/x86/xen/setup.c
+++ b/arch/x86/xen/setup.c
@@ -713,10 +713,9 @@ static void __init xen_reserve_xen_mfnlist(void)
                 size = PFN_PHYS(xen_start_info->nr_p2m_frames);
         }
 
-        if (!xen_is_e820_reserved(start, size)) {
-                memblock_reserve(start, size);
+        memblock_reserve(start, size);
+        if (!xen_is_e820_reserved(start, size))
                 return;
-        }
 
 #ifdef CONFIG_X86_32
         /*
@@ -727,6 +726,7 @@ static void __init xen_reserve_xen_mfnlist(void)
         BUG();
 #else
         xen_relocate_p2m();
+        memblock_free(start, size);
 #endif
 }
 
diff --git a/arch/x86/xen/spinlock.c b/arch/x86/xen/spinlock.c
index 9e2ba5c6e1dd..f42e78de1e10 100644
--- a/arch/x86/xen/spinlock.c
+++ b/arch/x86/xen/spinlock.c
@@ -27,6 +27,12 @@ static bool xen_pvspin = true;
 
 static void xen_qlock_kick(int cpu)
 {
+        int irq = per_cpu(lock_kicker_irq, cpu);
+
+        /* Don't kick if the target's kicker interrupt is not initialized. */
+        if (irq == -1)
+                return;
+
         xen_send_IPI_one(cpu, XEN_SPIN_UNLOCK_VECTOR);
 }
 
diff --git a/arch/x86/xen/time.c b/arch/x86/xen/time.c
index f1ba6a092854..8846257d8792 100644
--- a/arch/x86/xen/time.c
+++ b/arch/x86/xen/time.c
@@ -343,11 +343,11 @@ static int xen_vcpuop_set_next_event(unsigned long delta,
         WARN_ON(!clockevent_state_oneshot(evt));
 
         single.timeout_abs_ns = get_abs_timeout(delta);
-        single.flags = VCPU_SSHOTTMR_future;
+        /* Get an event anyway, even if the timeout is already expired */
+        single.flags = 0;
 
         ret = HYPERVISOR_vcpu_op(VCPUOP_set_singleshot_timer, cpu, &single);
-
-        BUG_ON(ret != 0 && ret != -ETIME);
+        BUG_ON(ret != 0);
 
         return ret;
 }
diff --git a/arch/xtensa/include/asm/irq.h b/arch/xtensa/include/asm/irq.h
index f71f88ea7646..19707db966f1 100644
--- a/arch/xtensa/include/asm/irq.h
+++ b/arch/xtensa/include/asm/irq.h
@@ -29,7 +29,8 @@ static inline void variant_irq_disable(unsigned int irq) { }
 # define PLATFORM_NR_IRQS 0
 #endif
 #define XTENSA_NR_IRQS XCHAL_NUM_INTERRUPTS
-#define NR_IRQS (XTENSA_NR_IRQS + VARIANT_NR_IRQS + PLATFORM_NR_IRQS)
+#define NR_IRQS (XTENSA_NR_IRQS + VARIANT_NR_IRQS + PLATFORM_NR_IRQS + 1)
+#define XTENSA_PIC_LINUX_IRQ(hwirq) ((hwirq) + 1)
 
 #if VARIANT_NR_IRQS == 0
 static inline void variant_init_irq(void) { }
diff --git a/arch/xtensa/kernel/irq.c b/arch/xtensa/kernel/irq.c
index 4ac3d23161cf..441694464b1e 100644
--- a/arch/xtensa/kernel/irq.c
+++ b/arch/xtensa/kernel/irq.c
@@ -34,11 +34,6 @@ asmlinkage void do_IRQ(int hwirq, struct pt_regs *regs)
 {
         int irq = irq_find_mapping(NULL, hwirq);
 
-        if (hwirq >= NR_IRQS) {
-                printk(KERN_EMERG "%s: cannot handle IRQ %d\n",
-                                __func__, hwirq);
-        }
-
 #ifdef CONFIG_DEBUG_STACKOVERFLOW
         /* Debugging check for stack overflow: is there less than 1KB free? */
         {
diff --git a/arch/xtensa/kernel/setup.c b/arch/xtensa/kernel/setup.c
index 9735691f37f1..49ccbd9022f6 100644
--- a/arch/xtensa/kernel/setup.c
+++ b/arch/xtensa/kernel/setup.c
@@ -133,6 +133,8 @@ static int __init parse_tag_initrd(const bp_tag_t* tag)
 
 __tagtable(BP_TAG_INITRD, parse_tag_initrd);
 
+#endif /* CONFIG_BLK_DEV_INITRD */
+
 #ifdef CONFIG_OF
 
 static int __init parse_tag_fdt(const bp_tag_t *tag)
@@ -145,8 +147,6 @@ __tagtable(BP_TAG_FDT, parse_tag_fdt);
 
 #endif /* CONFIG_OF */
 
-#endif /* CONFIG_BLK_DEV_INITRD */
-
 static int __init parse_tag_cmdline(const bp_tag_t* tag)
 {
         strlcpy(command_line, (char *)(tag->data), COMMAND_LINE_SIZE);
diff --git a/arch/xtensa/kernel/syscall.c b/arch/xtensa/kernel/syscall.c
index 83cf49685373..3aaaae18417c 100644
--- a/arch/xtensa/kernel/syscall.c
+++ b/arch/xtensa/kernel/syscall.c
@@ -87,7 +87,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr,
                 /* At this point:  (!vmm || addr < vmm->vm_end). */
                 if (TASK_SIZE - len < addr)
                         return -ENOMEM;
-                if (!vmm || addr + len <= vmm->vm_start)
+                if (!vmm || addr + len <= vm_start_gap(vmm))
                         return addr;
                 addr = vmm->vm_end;
                 if (flags & MAP_SHARED)
diff --git a/arch/xtensa/platforms/xtfpga/include/platform/hardware.h b/arch/xtensa/platforms/xtfpga/include/platform/hardware.h
index dbeea2b440a1..1fda7e20dfcb 100644
--- a/arch/xtensa/platforms/xtfpga/include/platform/hardware.h
+++ b/arch/xtensa/platforms/xtfpga/include/platform/hardware.h
@@ -24,16 +24,18 @@
 
 /* Interrupt configuration. */
 
-#define PLATFORM_NR_IRQS        10
+#define PLATFORM_NR_IRQS        0
 
 /* Default assignment of LX60 devices to external interrupts. */
 
 #ifdef CONFIG_XTENSA_MX
 #define DUART16552_INTNUM       XCHAL_EXTINT3_NUM
 #define OETH_IRQ                XCHAL_EXTINT4_NUM
+#define C67X00_IRQ              XCHAL_EXTINT8_NUM
 #else
 #define DUART16552_INTNUM       XCHAL_EXTINT0_NUM
 #define OETH_IRQ                XCHAL_EXTINT1_NUM
+#define C67X00_IRQ              XCHAL_EXTINT5_NUM
 #endif
 
 /*
@@ -63,5 +65,5 @@
 
 #define C67X00_PADDR            (XCHAL_KIO_PADDR + 0x0D0D0000)
 #define C67X00_SIZE             0x10
-#define C67X00_IRQ              5
+
 #endif /* __XTENSA_XTAVNET_HARDWARE_H */
diff --git a/arch/xtensa/platforms/xtfpga/setup.c b/arch/xtensa/platforms/xtfpga/setup.c
index e9f65f79cf2e..d1e9439fad45 100644
--- a/arch/xtensa/platforms/xtfpga/setup.c
+++ b/arch/xtensa/platforms/xtfpga/setup.c
@@ -209,8 +209,8 @@ static struct resource ethoc_res[] = {
                 .flags = IORESOURCE_MEM,
         },
         [2] = { /* IRQ number */
-                .start = OETH_IRQ,
-                .end   = OETH_IRQ,
+                .start = XTENSA_PIC_LINUX_IRQ(OETH_IRQ),
+                .end   = XTENSA_PIC_LINUX_IRQ(OETH_IRQ),
                 .flags = IORESOURCE_IRQ,
         },
 };
@@ -246,8 +246,8 @@ static struct resource c67x00_res[] = {
                 .flags = IORESOURCE_MEM,
         },
         [1] = { /* IRQ number */
-                .start = C67X00_IRQ,
-                .end   = C67X00_IRQ,
+                .start = XTENSA_PIC_LINUX_IRQ(C67X00_IRQ),
+                .end   = XTENSA_PIC_LINUX_IRQ(C67X00_IRQ),
                 .flags = IORESOURCE_IRQ,
         },
 };
@@ -280,7 +280,7 @@ static struct resource serial_resource = {
 static struct plat_serial8250_port serial_platform_data[] = {
         [0] = {
                 .mapbase        = DUART16552_PADDR,
-                .irq            = DUART16552_INTNUM,
+                .irq            = XTENSA_PIC_LINUX_IRQ(DUART16552_INTNUM),
                 .flags          = UPF_BOOT_AUTOCONF | UPF_SKIP_TEST |
                                   UPF_IOREMAP,
                 .iotype         = UPIO_MEM32,