99 files changed, 820 insertions, 474 deletions
diff --git a/Documentation/00-INDEX b/Documentation/00-INDEX
index 1750fcef1ab4..cd077ca0e1b8 100644
--- a/Documentation/00-INDEX
+++ b/Documentation/00-INDEX
@@ -29,8 +29,6 @@ DMA-ISA-LPC.txt
        - How to do DMA with ISA (and LPC) devices.
 DMA-attributes.txt
        - listing of the various possible attributes a DMA region can have
-dmatest.txt
-        - how to compile, configure and use the dmatest system.
 DocBook/
        - directory with DocBook templates etc. for kernel documentation.
 EDID/
@@ -163,8 +161,6 @@ digsig.txt
        -info on the Digital Signature Verification API
 dma-buf-sharing.txt
        - the DMA Buffer Sharing API Guide
-dmaengine.txt
-        -the DMA Engine API Guide
 dontdiff
        - file containing a list of files that should never be diff'ed.
 driver-model/
@@ -209,6 +205,8 @@ hid/
        - directory with information on human interface devices
 highuid.txt
        - notes on the change from 16 bit to 32 bit user/group IDs.
+hsi.txt
+        - HSI subsystem overview.
 hwspinlock.txt
        - hardware spinlock provides hardware assistance for synchronization
 timers/
@@ -277,6 +275,8 @@ kprobes.txt
        - documents the kernel probes debugging feature.
 kref.txt
        - docs on adding reference counters (krefs) to kernel objects.
+kselftest.txt
+        - small unittests for (some) individual codepaths in the kernel.
 laptops/
        - directory with laptop related info and laptop driver documentation.
 ldm.txt
@@ -285,22 +285,22 @@ leds/
        - directory with info about LED handling under Linux.
 local_ops.txt
        - semantics and behavior of local atomic operations.
-lockdep-design.txt
-        - documentation on the runtime locking correctness validator.
 locking/
        - directory with info about kernel locking primitives
-lockstat.txt
-        - info on collecting statistics on locks (and contention).
 lockup-watchdogs.txt
        - info on soft and hard lockup detectors (aka nmi_watchdog).
 logo.gif
        - full colour GIF image of Linux logo (penguin - Tux).
 logo.txt
        - info on creator of above logo & site to get additional images from.
+lzo.txt
+        - kernel LZO decompressor input formats
 m68k/
        - directory with info about Linux on Motorola 68k architecture.
 magic-number.txt
        - list of magic numbers used to mark/protect kernel data structures.
+mailbox.txt
+        - How to write drivers for the common mailbox framework (IPC).
 md.txt
        - info on boot arguments for the multiple devices driver.
 media-framework.txt
@@ -327,8 +327,6 @@ mtd/
        - directory with info about memory technology devices (flash)
 mono.txt
        - how to execute Mono-based .NET binaries with the help of BINFMT_MISC.
-mutex-design.txt
-        - info on the generic mutex subsystem.
 namespaces/
        - directory with various information about namespaces
 netlabel/
@@ -395,10 +393,6 @@ robust-futexes.txt
        - a description of what robust futexes are.
 rpmsg.txt
        - info on the Remote Processor Messaging (rpmsg) Framework
-rt-mutex-design.txt
-        - description of the RealTime mutex implementation design.
-rt-mutex.txt
-        - desc. of RT-mutex subsystem with PI (Priority Inheritance) support.
 rtc.txt
        - notes on how to use the Real Time Clock (aka CMOS clock) driver.
 s390/
@@ -425,8 +419,6 @@ sparse.txt
        - info on how to obtain and use the sparse tool for typechecking.
 spi/
        - overview of Linux kernel Serial Peripheral Interface (SPI) support.
-spinlocks.txt
-        - info on using spinlocks to provide exclusive access in kernel.
 stable_api_nonsense.txt
        - info on why the kernel does not have a stable in-kernel api or abi.
 stable_kernel_rules.txt
@@ -483,10 +475,10 @@ wimax/
        - directory with info about Intel Wireless Wimax Connections
 workqueue.txt
        - information on the Concurrency Managed Workqueue implementation
-ww-mutex-design.txt
-        - Intro to Mutex wait/would deadlock handling.s
 x86/x86_64/
        - directory with info on Linux support for AMD x86-64 (Hammer) machines.
+xillybus.txt
+        - Overview and basic ui of xillybus driver
 xtensa/
        - directory with documents relating to arch/xtensa port/implementation
 xz.txt
diff --git a/Documentation/Changes b/Documentation/Changes
index 74bdda9272a4..646cdaa6e9d1 100644
--- a/Documentation/Changes
+++ b/Documentation/Changes
@@ -21,8 +21,8 @@ running a Linux kernel.  Also, not all tools are necessary on all
 systems; obviously, if you don't have any ISDN hardware, for example,
 you probably needn't concern yourself with isdn4k-utils.
-o  Gnu C                  3.2                     # gcc --version
+o  GNU C                  3.2                     # gcc --version
-o  Gnu make               3.80                    # make --version
+o  GNU make               3.80                    # make --version
 o  binutils               2.12                    # ld -v
 o  util-linux             2.10o                   # fdformat --version
 o  module-init-tools      0.9.10                  # depmod -V
@@ -57,7 +57,7 @@ computer.
 Make
 ----
-You will need Gnu make 3.80 or later to build the kernel.
+You will need GNU make 3.80 or later to build the kernel.
 Binutils
 --------
diff --git a/Documentation/CodingStyle b/Documentation/CodingStyle
index 618a33c940df..449a8a19fc21 100644
--- a/Documentation/CodingStyle
+++ b/Documentation/CodingStyle
@@ -527,6 +527,7 @@ values.  To do the latter, you can stick the following in your .emacs file:
                         (string-match (expand-file-name "~/src/linux-trees")
                                       filename))
                (setq indent-tabs-mode t)
+                (setq show-trailing-whitespace t)
                (c-set-style "linux-tabs-only")))))
 This will make emacs go better with the kernel coding style for C
diff --git a/Documentation/DocBook/Makefile b/Documentation/DocBook/Makefile
index 9c7d92d03f62..b6a6a2e0dd3b 100644
--- a/Documentation/DocBook/Makefile
+++ b/Documentation/DocBook/Makefile
@@ -56,7 +56,7 @@ htmldocs: $(HTML)
 MAN := $(patsubst %.xml, %.9, $(BOOKS))
 mandocs: $(MAN)
-        $(if $(wildcard $(obj)/man/*.9),gzip -f $(obj)/man/*.9)
+        find $(obj)/man -name '*.9' | xargs gzip -f
 installmandocs: mandocs
        mkdir -p /usr/local/man/man9/
diff --git a/Documentation/SubmittingPatches b/Documentation/SubmittingPatches
index 40b619ef9b6a..447671bd2927 100644
--- a/Documentation/SubmittingPatches
+++ b/Documentation/SubmittingPatches
@@ -284,7 +284,7 @@ kernel-related lists hosted elsewhere as well, though.
 Do not send more than 15 patches at once to the vger mailing lists!!!
 Linus Torvalds is the final arbiter of all changes accepted into the
-Linux kernel.  His e-mail address is <torvalds@linux-foundation.org>. 
+Linux kernel.  His e-mail address is <torvalds@linux-foundation.org>.
 He gets a lot of e-mail, and, at this point, very few patches go through
 Linus directly, so typically you should do your best to -avoid-
 sending him e-mail.
@@ -437,11 +437,11 @@ can certify the below:
            person who certified (a), (b) or (c) and I have not modified
            it.
-        (d) I understand and agree that this project and the contribution
+        (d) I understand and agree that this project and the contribution
-            are public and that a record of the contribution (including all
+            are public and that a record of the contribution (including all
-            personal information I submit with it, including my sign-off) is
+            personal information I submit with it, including my sign-off) is
-            maintained indefinitely and may be redistributed consistent with
+            maintained indefinitely and may be redistributed consistent with
-            this project or the open source license(s) involved.
+            this project or the open source license(s) involved.
 then you just add a line saying
@@ -451,7 +451,7 @@ using your real name (sorry, no pseudonyms or anonymous contributions.)
 Some people also put extra tags at the end.  They'll just be ignored for
 now, but you can do this to mark internal company procedures or just
-point out some special detail about the sign-off. 
+point out some special detail about the sign-off.
 If you are a subsystem or branch maintainer, sometimes you need to slightly
 modify patches you receive in order to merge them, because the code is not
diff --git a/Documentation/arm/00-INDEX b/Documentation/arm/00-INDEX
index 3b08bc2b04cf..8edb9007844e 100644
--- a/Documentation/arm/00-INDEX
+++ b/Documentation/arm/00-INDEX
@@ -2,11 +2,15 @@
        - this file
 Booting
        - requirements for booting
+CCN.txt
+        - Cache Coherent Network ring-bus and perf PMU driver.
 Interrupts
        - ARM Interrupt subsystem documentation
 IXP4xx
        - Intel IXP4xx Network processor.
-msm
+Makefile
+        - Build sourcefiles as part of the Documentation-build for arm
+msm/
        - MSM specific documentation
 Netwinder
        - Netwinder specific documentation
@@ -18,11 +22,9 @@ README
        - General ARM documentation
 SA1100/
        - SA1100 documentation
-Samsung-S3C24XX
+Samsung-S3C24XX/
        - S3C24XX ARM Linux Overview
-Sharp-LH
+SPEAr/
-        - Linux on Sharp LH79524 and LH7A40X System On a Chip (SOC)
-SPEAr
        - ST SPEAr platform Linux Overview
 VFP/
        - Release notes for Linux Kernel Vector Floating Point support code
diff --git a/Documentation/blackfin/Makefile b/Documentation/blackfin/Makefile
index c7e6c99bad81..03f78059d6f5 100644
--- a/Documentation/blackfin/Makefile
+++ b/Documentation/blackfin/Makefile
@@ -1,3 +1,5 @@
 ifneq ($(CONFIG_BLACKFIN),)
+ifneq ($(CONFIG_BFIN_GPTIMERS,)
 obj-m := gptimers-example.o
 endif
+endif
diff --git a/Documentation/cgroups/00-INDEX b/Documentation/cgroups/00-INDEX
index bc461b6425a7..96ce071a3633 100644
--- a/Documentation/cgroups/00-INDEX
+++ b/Documentation/cgroups/00-INDEX
@@ -24,3 +24,5 @@ net_prio.txt
        - Network priority cgroups details and usages.
 resource_counter.txt
        - Resource Counter API.
+unified-hierarchy.txt
+        - Description the new/next cgroup interface.
diff --git a/Documentation/devicetree/bindings/arm/msm/timer.txt b/Documentation/devicetree/bindings/arm/msm/timer.txt
index c6ef8f13dc7e..74607b6c1117 100644
--- a/Documentation/devicetree/bindings/arm/msm/timer.txt
+++ b/Documentation/devicetree/bindings/arm/msm/timer.txt
@@ -8,7 +8,7 @@ Properties:
               "qcom,kpss-timer" - krait subsystem
               "qcom,scss-timer" - scorpion subsystem
- interrupts : Interrupts for the the debug timer, the first general purpose
+- interrupts : Interrupts for the debug timer, the first general purpose
               timer, and optionally a second general purpose timer in that
               order.
diff --git a/Documentation/devicetree/bindings/ata/cavium-compact-flash.txt b/Documentation/devicetree/bindings/ata/cavium-compact-flash.txt
index 93986a5a8018..3bacc8e0931e 100644
--- a/Documentation/devicetree/bindings/ata/cavium-compact-flash.txt
+++ b/Documentation/devicetree/bindings/ata/cavium-compact-flash.txt
@@ -9,7 +9,7 @@ Properties:
  Compatibility with many Cavium evaluation boards.
- reg: The base address of the the CF chip select banks.  Depending on
+- reg: The base address of the CF chip select banks.  Depending on
  the device configuration, there may be one or two banks.
 - cavium,bus-width: The width of the connection to the CF devices.  Valid
diff --git a/Documentation/devicetree/bindings/c6x/dscr.txt b/Documentation/devicetree/bindings/c6x/dscr.txt
index b0e97144cfb1..92672235de57 100644
--- a/Documentation/devicetree/bindings/c6x/dscr.txt
+++ b/Documentation/devicetree/bindings/c6x/dscr.txt
@@ -12,7 +12,7 @@ configuration register for writes. These configuration register may be used to
 enable (and disable in some cases) SoC pin drivers, select peripheral clock
 sources (internal or pin), etc. In some cases, a configuration register is
 write once or the individual bits are write once. In addition to device config,
-the DSCR block may provide registers which which are used to reset peripherals,
+the DSCR block may provide registers which are used to reset peripherals,
 provide device ID information, provide ethernet MAC addresses, as well as other
 miscellaneous functions.
diff --git a/Documentation/devicetree/bindings/dma/renesas,rcar-dmac.txt b/Documentation/devicetree/bindings/dma/renesas,rcar-dmac.txt
index df0f48bcf75a..f7e21b1c2a05 100644
--- a/Documentation/devicetree/bindings/dma/renesas,rcar-dmac.txt
+++ b/Documentation/devicetree/bindings/dma/renesas,rcar-dmac.txt
@@ -1,6 +1,6 @@
 * Renesas R-Car DMA Controller Device Tree bindings
-Renesas R-Car Generation 2 SoCs have have multiple multi-channel DMA
+Renesas R-Car Generation 2 SoCs have multiple multi-channel DMA
 controller instances named DMAC capable of serving multiple clients. Channels
 can be dedicated to specific clients or shared between a large number of
 clients.
diff --git a/Documentation/devicetree/bindings/gpio/gpio-pcf857x.txt b/Documentation/devicetree/bindings/gpio/gpio-pcf857x.txt
index d63194a2c848..ada4e2973323 100644
--- a/Documentation/devicetree/bindings/gpio/gpio-pcf857x.txt
+++ b/Documentation/devicetree/bindings/gpio/gpio-pcf857x.txt
@@ -39,7 +39,7 @@ Optional Properties:
  - lines-initial-states: Bitmask that specifies the initial state of each
  line. When a bit is set to zero, the corresponding line will be initialized to
  the input (pulled-up) state. When the  bit is set to one, the line will be
-  initialized the the low-level output state. If the property is not specified
+  initialized the low-level output state. If the property is not specified
  all lines will be initialized to the input state.
  The I/O expander can detect input state changes, and thus optionally act as
diff --git a/Documentation/devicetree/bindings/iio/adc/xilinx-xadc.txt b/Documentation/devicetree/bindings/iio/adc/xilinx-xadc.txt
index d9ee909d2b78..d71258e2d456 100644
--- a/Documentation/devicetree/bindings/iio/adc/xilinx-xadc.txt
+++ b/Documentation/devicetree/bindings/iio/adc/xilinx-xadc.txt
@@ -59,7 +59,7 @@ Optional properties:
          Each child node represents one channel and has the following
          properties:
                Required properties:
-                        * reg: Pair of pins the the channel is connected to.
+                        * reg: Pair of pins the channel is connected to.
                                0: VP/VN
                                1: VAUXP[0]/VAUXN[0]
                                2: VAUXP[1]/VAUXN[1]
diff --git a/Documentation/devicetree/bindings/mtd/fsmc-nand.txt b/Documentation/devicetree/bindings/mtd/fsmc-nand.txt
index ec42935f3908..5235cbc551b0 100644
--- a/Documentation/devicetree/bindings/mtd/fsmc-nand.txt
+++ b/Documentation/devicetree/bindings/mtd/fsmc-nand.txt
@@ -9,7 +9,7 @@ Required properties:
 Optional properties:
 - bank-width : Width (in bytes) of the device.  If not present, the width
  defaults to 1 byte
- nand-skip-bbtscan: Indicates the the BBT scanning should be skipped
+- nand-skip-bbtscan: Indicates the BBT scanning should be skipped
 - timings: array of 6 bytes for NAND timings. The meanings of these bytes
  are:
  byte 0 TCLR  : CLE to RE delay in number of AHB clock cycles, only 4 bits
diff --git a/Documentation/devicetree/bindings/net/broadcom-systemport.txt b/Documentation/devicetree/bindings/net/broadcom-systemport.txt
index aa7ad622259d..877da34145b0 100644
--- a/Documentation/devicetree/bindings/net/broadcom-systemport.txt
+++ b/Documentation/devicetree/bindings/net/broadcom-systemport.txt
@@ -3,7 +3,7 @@
 Required properties:
 - compatible: should be one of "brcm,systemport-v1.00" or "brcm,systemport"
 - reg: address and length of the register set for the device.
- interrupts: interrupts for the device, first cell must be for the the rx
+- interrupts: interrupts for the device, first cell must be for the rx
  interrupts, and the second cell should be for the transmit queues. An
  optional third interrupt cell for Wake-on-LAN can be specified
 - local-mac-address: Ethernet MAC address (48 bits) of this adapter
diff --git a/Documentation/devicetree/bindings/power/rockchip-io-domain.txt b/Documentation/devicetree/bindings/power/rockchip-io-domain.txt
index 6fbf6e7ecde6..8b70db103ca7 100644
--- a/Documentation/devicetree/bindings/power/rockchip-io-domain.txt
+++ b/Documentation/devicetree/bindings/power/rockchip-io-domain.txt
@@ -37,7 +37,7 @@ Required properties:
 You specify supplies using the standard regulator bindings by including
-a phandle the the relevant regulator.  All specified supplies must be able
+a phandle the relevant regulator.  All specified supplies must be able
 to report their voltage.  The IO Voltage Domain for any non-specified
 supplies will be not be touched.
diff --git a/Documentation/devicetree/overlay-notes.txt b/Documentation/devicetree/overlay-notes.txt
index 30ae758e3eef..d418a6ce9812 100644
--- a/Documentation/devicetree/overlay-notes.txt
+++ b/Documentation/devicetree/overlay-notes.txt
@@ -10,7 +10,7 @@ How overlays work
 -----------------
 A Device Tree's overlay purpose is to modify the kernel's live tree, and
-have the modification affecting the state of the the kernel in a way that
+have the modification affecting the state of the kernel in a way that
 is reflecting the changes.
 Since the kernel mainly deals with devices, any new device node that result
 in an active device should have it created while if the device node is either
@@ -80,7 +80,7 @@ result in foo+bar.dts
        };
 ---- foo+bar.dts -------------------------------------------------------------
-As a result of the the overlay, a new device node (bar) has been created
+As a result of the overlay, a new device node (bar) has been created
 so a bar platform device will be registered and if a matching device driver
 is loaded the device will be created as expected.
diff --git a/Documentation/dmaengine/00-INDEX b/Documentation/dmaengine/00-INDEX
new file mode 100644
index 000000000000..07de6573d22b
--- /dev/null
+++ b/Documentation/dmaengine/00-INDEX
@@ -0,0 +1,8 @@
+00-INDEX
+        - this file.
+client.txt
+        -the DMA Engine API Guide.
+dmatest.txt
+        - how to compile, configure and use the dmatest system.
+provider.txt
+        - the DMA controller API.
+\ No newline at end of file
diff --git a/Documentation/driver-model/bus.txt b/Documentation/driver-model/bus.txt
index 6754b2df8aa1..b577a45b93ea 100644
--- a/Documentation/driver-model/bus.txt
+++ b/Documentation/driver-model/bus.txt
@@ -45,7 +45,7 @@ them are inherently bus-specific. Drivers typically declare an array
 of device IDs of devices they support that reside in a bus-specific
 driver structure. 
-The purpose of the match callback is provide the bus an opportunity to
+The purpose of the match callback is to give the bus an opportunity to
 determine if a particular driver supports a particular device by
 comparing the device IDs the driver supports with the device ID of a
 particular device, without sacrificing bus-specific functionality or
diff --git a/Documentation/filesystems/proc.txt b/Documentation/filesystems/proc.txt
index aae9dd13c91f..79b3cc821e7b 100644
--- a/Documentation/filesystems/proc.txt
+++ b/Documentation/filesystems/proc.txt
@@ -28,7 +28,7 @@ Table of Contents
  1.6   Parallel port info in /proc/parport
  1.7   TTY info in /proc/tty
  1.8   Miscellaneous kernel statistics in /proc/stat
-  1.9 Ext4 file system parameters
+  1.9   Ext4 file system parameters
  2     Modifying System Parameters
diff --git a/Documentation/filesystems/seq_file.txt b/Documentation/filesystems/seq_file.txt
index b797ed38de46..9de4303201e1 100644
--- a/Documentation/filesystems/seq_file.txt
+++ b/Documentation/filesystems/seq_file.txt
@@ -194,16 +194,16 @@ which is in the string esc will be represented in octal form in the output.
 There are also a pair of functions for printing filenames:
-        int seq_path(struct seq_file *m, struct path *path, char *esc);
+        int seq_path(struct seq_file *m, const struct path *path,
-        int seq_path_root(struct seq_file *m, struct path *path,
+                     const char *esc);
-                          struct path *root, char *esc)
+        int seq_path_root(struct seq_file *m, const struct path *path,
+                          const struct path *root, const char *esc)
 Here, path indicates the file of interest, and esc is a set of characters
 which should be escaped in the output.  A call to seq_path() will output
 the path relative to the current process's filesystem root.  If a different
-root is desired, it can be used with seq_path_root().  Note that, if it
+root is desired, it can be used with seq_path_root().  If it turns out that
-turns out that path cannot be reached from root, the value of root will be
+path cannot be reached from root, seq_path_root() returns SEQ_SKIP.
-changed in seq_file_root() to a root which *does* work.
 A function producing complicated output may want to check
        bool seq_has_overflowed(struct seq_file *m);
diff --git a/Documentation/gpio/board.txt b/Documentation/gpio/board.txt
index 4452786225b8..8b35f51fe7b6 100644
--- a/Documentation/gpio/board.txt
+++ b/Documentation/gpio/board.txt
@@ -31,7 +31,7 @@ through gpiod_get(). For example:
                            <&gpio 16 GPIO_ACTIVE_HIGH>, /* green */
                            <&gpio 17 GPIO_ACTIVE_HIGH>; /* blue */
-                power-gpio = <&gpio 1 GPIO_ACTIVE_LOW>;
+                power-gpios = <&gpio 1 GPIO_ACTIVE_LOW>;
        };
 This property will make GPIOs 15, 16 and 17 available to the driver under the
diff --git a/Documentation/locking/00-INDEX b/Documentation/locking/00-INDEX
new file mode 100644
index 000000000000..c256c9bee2a4
--- /dev/null
+++ b/Documentation/locking/00-INDEX
@@ -0,0 +1,16 @@
+00-INDEX
+        - this file.
+lockdep-design.txt
+        - documentation on the runtime locking correctness validator.
+lockstat.txt
+        - info on collecting statistics on locks (and contention).
+mutex-design.txt
+        - info on the generic mutex subsystem.
+rt-mutex-design.txt
+        - description of the RealTime mutex implementation design.
+rt-mutex.txt
+        - desc. of RT-mutex subsystem with PI (Priority Inheritance) support.
+spinlocks.txt
+        - info on using spinlocks to provide exclusive access in kernel.
+ww-mutex-design.txt
+        - Intro to Mutex wait/would deadlock handling.s
diff --git a/Documentation/locking/lockstat.txt b/Documentation/locking/lockstat.txt
index 7428773a1e69..568bbbacee91 100644
--- a/Documentation/locking/lockstat.txt
+++ b/Documentation/locking/lockstat.txt
@@ -121,6 +121,11 @@ show the header with column descriptions. Lines 05-18 and 20-31 show the actual
 statistics. These statistics come in two parts; the actual stats separated by a
 short separator (line 08, 13) from the contention points.
+Lines 09-12 show the first 4 recorded contention points (the code
+which tries to get the lock) and lines 14-17 show the first 4 recorded
+contended points (the lock holder). It is possible that the max
+con-bounces point is missing in the statistics.
 The first lock (05-18) is a read/write lock, and shows two lines above the
 short separator. The contention points don't match the column descriptors,
 they have two: contentions and [<IP>] symbol. The second set of contention
diff --git a/Documentation/misc-devices/mei/mei-client-bus.txt b/Documentation/misc-devices/mei/mei-client-bus.txt
index f83910a8ce76..743be4ec8989 100644
--- a/Documentation/misc-devices/mei/mei-client-bus.txt
+++ b/Documentation/misc-devices/mei/mei-client-bus.txt
@@ -1,9 +1,10 @@
 Intel(R) Management Engine (ME) Client bus API
-===============================================
+==============================================
 Rationale
 =========
 MEI misc character device is useful for dedicated applications to send and receive
 data to the many FW appliance found in Intel's ME from the user space.
 However for some of the ME functionalities it make sense to leverage existing software
@@ -17,7 +18,8 @@ the existing code.
 MEI CL bus API
-===========
+==============
 A driver implementation for an MEI Client is very similar to existing bus
 based device drivers. The driver registers itself as an MEI CL bus driver through
 the mei_cl_driver structure:
@@ -55,6 +57,7 @@ received buffers.
 Example
 =======
 As a theoretical example let's pretend the ME comes with a "contact" NFC IP.
 The driver init and exit routines for this device would look like:
@@ -69,11 +72,11 @@ static struct mei_cl_device_id contact_mei_cl_tbl[] = {
 MODULE_DEVICE_TABLE(mei_cl, contact_mei_cl_tbl);
 static struct mei_cl_driver contact_driver = {
-       .id_table = contact_mei_tbl,
+        .id_table = contact_mei_tbl,
-       .name = CONTACT_DRIVER_NAME,
+        .name = CONTACT_DRIVER_NAME,
-       .probe = contact_probe,
+        .probe = contact_probe,
-       .remove = contact_remove,
+        .remove = contact_remove,
 };
 static int contact_init(void)
@@ -109,7 +112,7 @@ int contact_probe(struct mei_cl_device *dev, struct mei_cl_device_id *id)
        mei_cl_register_event_cb(dev, contact_event_cb, contact);
        return 0;
- }
+}
 In the probe routine the driver first enable the MEI device and then registers
 an ME bus event handler which is as close as it can get to registering a
diff --git a/Documentation/misc-devices/mei/mei.txt b/Documentation/misc-devices/mei/mei.txt
index 15bba1aeba9a..8d47501bba0a 100644
--- a/Documentation/misc-devices/mei/mei.txt
+++ b/Documentation/misc-devices/mei/mei.txt
@@ -1,8 +1,8 @@
 Intel(R) Management Engine Interface (Intel(R) MEI)
-=======================
+===================================================
 Introduction
-=======================
+============
 The Intel Management Engine (Intel ME) is an isolated and protected computing
 resource (Co-processor) residing inside certain Intel chipsets. The Intel ME
@@ -19,7 +19,7 @@ each client has its own protocol. The protocol is message-based with a
 header and payload up to 512 bytes.
 Prominent usage of the Intel ME Interface is to communicate with Intel(R)
-Active Management Technology (Intel AMT)implemented in firmware running on
+Active Management Technology (Intel AMT) implemented in firmware running on
 the Intel ME.
 Intel AMT provides the ability to manage a host remotely out-of-band (OOB)
@@ -44,8 +44,9 @@ HTTP/S that are received from a remote management console application.
 For more information about Intel AMT:
 http://software.intel.com/sites/manageability/AMT_Implementation_and_Reference_Guide
 Intel MEI Driver
-=======================
+================
 The driver exposes a misc device called /dev/mei.
@@ -91,8 +92,10 @@ A code snippet for an application communicating with Intel AMTHI client:
        [...]
        close(fd);
-IOCTL:
-======
+IOCTL
+=====
 The Intel MEI Driver supports the following IOCTL command:
        IOCTL_MEI_CONNECT_CLIENT        Connect to firmware Feature (client).
@@ -122,58 +125,61 @@ The Intel MEI Driver supports the following IOCTL command:
        data that can be sent or received. (e.g. if MTU=2K, can send
        requests up to bytes 2k and received responses up to 2k bytes).
-Intel ME Applications:
-==============
+Intel ME Applications
+=====================
-1) Intel Local Management Service (Intel LMS)
+        1) Intel Local Management Service (Intel LMS)
-        Applications running locally on the platform communicate with Intel AMT Release
-        2.0 and later releases in the same way that network applications do via SOAP
+           Applications running locally on the platform communicate with Intel AMT Release
-        over HTTP (deprecated starting with Release 6.0) or with WS-Management over
+           2.0 and later releases in the same way that network applications do via SOAP
-        SOAP over HTTP. This means that some Intel AMT features can be accessed from a
+           over HTTP (deprecated starting with Release 6.0) or with WS-Management over
-        local application using the same network interface as a remote application
+           SOAP over HTTP. This means that some Intel AMT features can be accessed from a
-        communicating with Intel AMT over the network.
+           local application using the same network interface as a remote application
+           communicating with Intel AMT over the network.
-        When a local application sends a message addressed to the local Intel AMT host
-        name, the Intel LMS, which listens for traffic directed to the host name,
+           When a local application sends a message addressed to the local Intel AMT host
-        intercepts the message and routes it to the Intel MEI.
+           name, the Intel LMS, which listens for traffic directed to the host name,
-        For more information:
+           intercepts the message and routes it to the Intel MEI.
-        http://software.intel.com/sites/manageability/AMT_Implementation_and_Reference_Guide
+           For more information:
-        Under "About Intel AMT" => "Local Access"
+           http://software.intel.com/sites/manageability/AMT_Implementation_and_Reference_Guide
+           Under "About Intel AMT" => "Local Access"
-        For downloading Intel LMS:
-        http://software.intel.com/en-us/articles/download-the-latest-intel-amt-open-source-drivers/
+           For downloading Intel LMS:
+           http://software.intel.com/en-us/articles/download-the-latest-intel-amt-open-source-drivers/
-        The Intel LMS opens a connection using the Intel MEI driver to the Intel LMS
-        firmware feature using a defined UUID and then communicates with the feature
+           The Intel LMS opens a connection using the Intel MEI driver to the Intel LMS
-        using a protocol called Intel AMT Port Forwarding Protocol(Intel APF protocol).
+           firmware feature using a defined UUID and then communicates with the feature
-        The protocol is used to maintain multiple sessions with Intel AMT from a
+           using a protocol called Intel AMT Port Forwarding Protocol (Intel APF protocol).
-        single application.
+           The protocol is used to maintain multiple sessions with Intel AMT from a
+           single application.
-        See the protocol specification in the Intel AMT Software Development Kit(SDK)
-        http://software.intel.com/sites/manageability/AMT_Implementation_and_Reference_Guide
+           See the protocol specification in the Intel AMT Software Development Kit (SDK)
-        Under "SDK Resources" => "Intel(R) vPro(TM) Gateway(MPS)"
+           http://software.intel.com/sites/manageability/AMT_Implementation_and_Reference_Guide
-        => "Information for Intel(R) vPro(TM) Gateway Developers"
+           Under "SDK Resources" => "Intel(R) vPro(TM) Gateway (MPS)"
-        => "Description of the Intel AMT Port Forwarding (APF)Protocol"
+           => "Information for Intel(R) vPro(TM) Gateway Developers"
+           => "Description of the Intel AMT Port Forwarding (APF) Protocol"
-  2) Intel AMT Remote configuration using a Local Agent
-        A Local Agent enables IT personnel to configure Intel AMT out-of-the-box
+        2) Intel AMT Remote configuration using a Local Agent
-        without requiring installing additional data to enable setup. The remote
-        configuration process may involve an ISV-developed remote configuration
+           A Local Agent enables IT personnel to configure Intel AMT out-of-the-box
-        agent that runs on the host.
+           without requiring installing additional data to enable setup. The remote
-        For more information:
+           configuration process may involve an ISV-developed remote configuration
-        http://software.intel.com/sites/manageability/AMT_Implementation_and_Reference_Guide
+           agent that runs on the host.
-        Under "Setup and Configuration of Intel AMT" =>
+           For more information:
-        "SDK Tools Supporting Setup and Configuration" =>
+           http://software.intel.com/sites/manageability/AMT_Implementation_and_Reference_Guide
-        "Using the Local Agent Sample"
+           Under "Setup and Configuration of Intel AMT" =>
+           "SDK Tools Supporting Setup and Configuration" =>
-        An open source Intel AMT configuration utility, implementing a local agent
+           "Using the Local Agent Sample"
-        that accesses the Intel MEI driver, can be found here:
-        http://software.intel.com/en-us/articles/download-the-latest-intel-amt-open-source-drivers/
+           An open source Intel AMT configuration utility,      implementing a local agent
+           that accesses the Intel MEI driver, can be found here:
+           http://software.intel.com/en-us/articles/download-the-latest-intel-amt-open-source-drivers/
-Intel AMT OS Health Watchdog:
-=============================
+Intel AMT OS Health Watchdog
+============================
 The Intel AMT Watchdog is an OS Health (Hang/Crash) watchdog.
 Whenever the OS hangs or crashes, Intel AMT will send an event
 to any subscriber to this event. This mechanism means that
@@ -192,8 +198,10 @@ watchdog is 120 seconds.
 If the Intel AMT Watchdog feature does not exist (i.e. the connection failed),
 the Intel MEI driver will disable the sending of heartbeats.
-Supported Chipsets:
+Supported Chipsets
 ==================
 7 Series Chipset Family
 6 Series Chipset Family
 5 Series Chipset Family
diff --git a/Documentation/networking/00-INDEX b/Documentation/networking/00-INDEX
index 557b6ef70c26..df27a1a50776 100644
--- a/Documentation/networking/00-INDEX
+++ b/Documentation/networking/00-INDEX
@@ -1,7 +1,5 @@
 00-INDEX
        - this file
-3c505.txt
-        - information on the 3Com EtherLink Plus (3c505) driver.
 3c509.txt
        - information on the 3Com Etherlink III Series Ethernet cards.
 6pack.txt
@@ -24,6 +22,8 @@ README.sb1000
        - info on General Instrument/NextLevel SURFboard1000 cable modem.
 alias.txt
        - info on using alias network devices.
+altera_tse.txt
+        - Altera Triple-Speed Ethernet controller.
 arcnet-hardware.txt
        - tons of info on ARCnet, hubs, jumper settings for ARCnet cards, etc.
 arcnet.txt
@@ -42,6 +42,8 @@ bridge.txt
        - where to get user space programs for ethernet bridging with Linux.
 can.txt
        - documentation on CAN protocol family.
+cdc_mbim.txt
+        - 3G/LTE USB modem (Mobile Broadband Interface Model)
 cops.txt
        - info on the COPS LocalTalk Linux driver
 cs89x0.txt
@@ -54,6 +56,8 @@ cxgb.txt
        - Release Notes for the Chelsio N210 Linux device driver.
 dccp.txt
        - the Datagram Congestion Control Protocol (DCCP) (RFC 4340..42).
+dctcp.txt
+        - DataCenter TCP congestion control
 de4x5.txt
        - the Digital EtherWORKS DE4?? and DE5?? PCI Ethernet driver
 decnet.txt
diff --git a/Documentation/sysctl/vm.txt b/Documentation/sysctl/vm.txt
index 4415aa915681..de3afef76837 100644
--- a/Documentation/sysctl/vm.txt
+++ b/Documentation/sysctl/vm.txt
@@ -728,7 +728,7 @@ The default value is 60.
 - user_reserve_kbytes
-When overcommit_memory is set to 2, "never overommit" mode, reserve
+When overcommit_memory is set to 2, "never overcommit" mode, reserve
 min(3% of current process size, user_reserve_kbytes) of free memory.
 This is intended to prevent a user from starting a single memory hogging
 process, such that they cannot recover (kill the hog).
diff --git a/MAINTAINERS b/MAINTAINERS
index ddb9ac8d32b3..76f9c0df3e73 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3207,6 +3207,7 @@ F:	Documentation/
 X:      Documentation/ABI/
 X:      Documentation/devicetree/
 X:      Documentation/[a-z][a-z]_[A-Z][A-Z]/
+T:      git git://git.lwn.net/linux-2.6.git docs-next
 DOUBLETALK DRIVER
 M:      "James R. Van Zandt" <jrv@vanzandt.mv.com>
diff --git a/Makefile b/Makefile
index b1c3254441f3..ef748e17702f 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 3
 PATCHLEVEL = 19
 SUBLEVEL = 0
-EXTRAVERSION = -rc1
+EXTRAVERSION = -rc2
 NAME = Diseased Newt
 # *DOCUMENTATION*
diff --git a/arch/arm64/configs/defconfig b/arch/arm64/configs/defconfig
index dd301be89ecc..5376d908eabe 100644
--- a/arch/arm64/configs/defconfig
+++ b/arch/arm64/configs/defconfig
@@ -1,6 +1,7 @@
 # CONFIG_LOCALVERSION_AUTO is not set
 CONFIG_SYSVIPC=y
 CONFIG_POSIX_MQUEUE=y
+CONFIG_FHANDLE=y
 CONFIG_AUDIT=y
 CONFIG_NO_HZ_IDLE=y
 CONFIG_HIGH_RES_TIMERS=y
@@ -13,14 +14,12 @@ CONFIG_TASK_IO_ACCOUNTING=y
 CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
-CONFIG_RESOURCE_COUNTERS=y
 CONFIG_MEMCG=y
 CONFIG_MEMCG_SWAP=y
 CONFIG_MEMCG_KMEM=y
 CONFIG_CGROUP_HUGETLB=y
 # CONFIG_UTS_NS is not set
 # CONFIG_IPC_NS is not set
-# CONFIG_PID_NS is not set
 # CONFIG_NET_NS is not set
 CONFIG_SCHED_AUTOGROUP=y
 CONFIG_BLK_DEV_INITRD=y
@@ -92,7 +91,6 @@ CONFIG_SERIAL_AMBA_PL011_CONSOLE=y
 CONFIG_SERIAL_OF_PLATFORM=y
 CONFIG_VIRTIO_CONSOLE=y
 # CONFIG_HW_RANDOM is not set
-# CONFIG_HMC_DRV is not set
 CONFIG_SPI=y
 CONFIG_SPI_PL022=y
 CONFIG_GPIO_PL061=y
@@ -133,6 +131,8 @@ CONFIG_EXT3_FS=y
 CONFIG_EXT4_FS=y
 CONFIG_FANOTIFY=y
 CONFIG_FANOTIFY_ACCESS_PERMISSIONS=y
+CONFIG_QUOTA=y
+CONFIG_AUTOFS4_FS=y
 CONFIG_FUSE_FS=y
 CONFIG_CUSE=y
 CONFIG_VFAT_FS=y
@@ -152,14 +152,15 @@ CONFIG_MAGIC_SYSRQ=y
 CONFIG_DEBUG_KERNEL=y
 CONFIG_LOCKUP_DETECTOR=y
 # CONFIG_SCHED_DEBUG is not set
+# CONFIG_DEBUG_PREEMPT is not set
 # CONFIG_FTRACE is not set
+CONFIG_KEYS=y
 CONFIG_SECURITY=y
 CONFIG_CRYPTO_ANSI_CPRNG=y
 CONFIG_ARM64_CRYPTO=y
 CONFIG_CRYPTO_SHA1_ARM64_CE=y
 CONFIG_CRYPTO_SHA2_ARM64_CE=y
 CONFIG_CRYPTO_GHASH_ARM64_CE=y
-CONFIG_CRYPTO_AES_ARM64_CE=y
 CONFIG_CRYPTO_AES_ARM64_CE_CCM=y
 CONFIG_CRYPTO_AES_ARM64_CE_BLK=y
 CONFIG_CRYPTO_AES_ARM64_NEON_BLK=y
diff --git a/arch/arm64/include/asm/dma-mapping.h b/arch/arm64/include/asm/dma-mapping.h
index d34189bceff7..9ce3e680ae1c 100644
--- a/arch/arm64/include/asm/dma-mapping.h
+++ b/arch/arm64/include/asm/dma-mapping.h
@@ -52,13 +52,14 @@ static inline void set_dma_ops(struct device *dev, struct dma_map_ops *ops)
        dev->archdata.dma_ops = ops;
 }
-static inline int set_arch_dma_coherent_ops(struct device *dev)
+static inline void arch_setup_dma_ops(struct device *dev, u64 dma_base, u64 size,
+                                      struct iommu_ops *iommu, bool coherent)
 {
-        dev->archdata.dma_coherent = true;
+        dev->archdata.dma_coherent = coherent;
-        set_dma_ops(dev, &coherent_swiotlb_dma_ops);
+        if (coherent)
-        return 0;
+                set_dma_ops(dev, &coherent_swiotlb_dma_ops);
 }
-#define set_arch_dma_coherent_ops       set_arch_dma_coherent_ops
+#define arch_setup_dma_ops      arch_setup_dma_ops
 /* do not use this function in a driver */
 static inline bool is_device_dma_coherent(struct device *dev)
diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h
index df22314f57cf..210d632aa5ad 100644
--- a/arch/arm64/include/asm/pgtable.h
+++ b/arch/arm64/include/asm/pgtable.h
@@ -298,7 +298,6 @@ void pmdp_splitting_flush(struct vm_area_struct *vma, unsigned long address,
 #define pfn_pmd(pfn,prot)       (__pmd(((phys_addr_t)(pfn) << PAGE_SHIFT) | pgprot_val(prot)))
 #define mk_pmd(page,prot)       pfn_pmd(page_to_pfn(page),prot)
-#define pmd_page(pmd)           pfn_to_page(__phys_to_pfn(pmd_val(pmd) & PHYS_MASK))
 #define pud_write(pud)          pte_write(pud_pte(pud))
 #define pud_pfn(pud)            (((pud_val(pud) & PUD_MASK) & PHYS_MASK) >> PAGE_SHIFT)
@@ -401,7 +400,7 @@ static inline pmd_t *pmd_offset(pud_t *pud, unsigned long addr)
        return (pmd_t *)pud_page_vaddr(*pud) + pmd_index(addr);
 }
-#define pud_page(pud)           pmd_page(pud_pmd(pud))
+#define pud_page(pud)           pfn_to_page(__phys_to_pfn(pud_val(pud) & PHYS_MASK))
 #endif  /* CONFIG_ARM64_PGTABLE_LEVELS > 2 */
@@ -437,6 +436,8 @@ static inline pud_t *pud_offset(pgd_t *pgd, unsigned long addr)
        return (pud_t *)pgd_page_vaddr(*pgd) + pud_index(addr);
 }
+#define pgd_page(pgd)           pfn_to_page(__phys_to_pfn(pgd_val(pgd) & PHYS_MASK))
 #endif  /* CONFIG_ARM64_PGTABLE_LEVELS > 3 */
 #define pgd_ERROR(pgd)          __pgd_error(__FILE__, __LINE__, pgd_val(pgd))
diff --git a/arch/arm64/kernel/suspend.c b/arch/arm64/kernel/suspend.c
index 3771b72b6569..2d6b6065fe7f 100644
--- a/arch/arm64/kernel/suspend.c
+++ b/arch/arm64/kernel/suspend.c
@@ -5,6 +5,7 @@
 #include <asm/debug-monitors.h>
 #include <asm/pgtable.h>
 #include <asm/memory.h>
+#include <asm/mmu_context.h>
 #include <asm/smp_plat.h>
 #include <asm/suspend.h>
 #include <asm/tlbflush.h>
@@ -98,7 +99,18 @@ int __cpu_suspend(unsigned long arg, int (*fn)(unsigned long))
         */
        ret = __cpu_suspend_enter(arg, fn);
        if (ret == 0) {
-                cpu_switch_mm(mm->pgd, mm);
+                /*
+                 * We are resuming from reset with TTBR0_EL1 set to the
+                 * idmap to enable the MMU; restore the active_mm mappings in
+                 * TTBR0_EL1 unless the active_mm == &init_mm, in which case
+                 * the thread entered __cpu_suspend with TTBR0_EL1 set to
+                 * reserved TTBR0 page tables and should be restored as such.
+                 */
+                if (mm == &init_mm)
+                        cpu_set_reserved_ttbr0();
+                else
+                        cpu_switch_mm(mm->pgd, mm);
                flush_tlb_all();
                /*
diff --git a/arch/parisc/include/asm/ldcw.h b/arch/parisc/include/asm/ldcw.h
index d2d11b7055ba..8121aa6db2ff 100644
--- a/arch/parisc/include/asm/ldcw.h
+++ b/arch/parisc/include/asm/ldcw.h
@@ -33,11 +33,18 @@
 #endif /*!CONFIG_PA20*/
-/* LDCW, the only atomic read-write operation PA-RISC has. *sigh*.  */
+/* LDCW, the only atomic read-write operation PA-RISC has. *sigh*.
+   We don't explicitly expose that "*a" may be written as reload
+   fails to find a register in class R1_REGS when "a" needs to be
+   reloaded when generating 64-bit PIC code.  Instead, we clobber
+   memory to indicate to the compiler that the assembly code reads
+   or writes to items other than those listed in the input and output
+   operands.  This may pessimize the code somewhat but __ldcw is
+   usually used within code blocks surrounded by memory barriors.  */
 #define __ldcw(a) ({                                            \
        unsigned __ret;                                         \
-        __asm__ __volatile__(__LDCW " 0(%2),%0"                 \
+        __asm__ __volatile__(__LDCW " 0(%1),%0"                 \
-                : "=r" (__ret), "+m" (*(a)) : "r" (a));         \
+                : "=r" (__ret) : "r" (a) : "memory");           \
        __ret;                                                  \
 })
diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
index 10fbed126b11..f83fc6c5e0ba 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -4448,7 +4448,7 @@ void kvm_mmu_invalidate_mmio_sptes(struct kvm *kvm)
         * zap all shadow pages.
         */
        if (unlikely(kvm_current_mmio_generation(kvm) == 0)) {
-                printk_ratelimited(KERN_INFO "kvm: zapping shadow pages for mmio generation wraparound\n");
+                printk_ratelimited(KERN_DEBUG "kvm: zapping shadow pages for mmio generation wraparound\n");
                kvm_mmu_invalidate_zap_all_pages(kvm);
        }
 }
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index feb852b04598..d4c58d884838 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -5840,53 +5840,10 @@ static __init int hardware_setup(void)
        memset(vmx_msr_bitmap_legacy, 0xff, PAGE_SIZE);
        memset(vmx_msr_bitmap_longmode, 0xff, PAGE_SIZE);
-        vmx_disable_intercept_for_msr(MSR_FS_BASE, false);
-        vmx_disable_intercept_for_msr(MSR_GS_BASE, false);
-        vmx_disable_intercept_for_msr(MSR_KERNEL_GS_BASE, true);
-        vmx_disable_intercept_for_msr(MSR_IA32_SYSENTER_CS, false);
-        vmx_disable_intercept_for_msr(MSR_IA32_SYSENTER_ESP, false);
-        vmx_disable_intercept_for_msr(MSR_IA32_SYSENTER_EIP, false);
-        vmx_disable_intercept_for_msr(MSR_IA32_BNDCFGS, true);
-        memcpy(vmx_msr_bitmap_legacy_x2apic,
-                        vmx_msr_bitmap_legacy, PAGE_SIZE);
-        memcpy(vmx_msr_bitmap_longmode_x2apic,
-                        vmx_msr_bitmap_longmode, PAGE_SIZE);
-        if (enable_apicv) {
-                for (msr = 0x800; msr <= 0x8ff; msr++)
-                        vmx_disable_intercept_msr_read_x2apic(msr);
-                /* According SDM, in x2apic mode, the whole id reg is used.
-                 * But in KVM, it only use the highest eight bits. Need to
-                 * intercept it */
-                vmx_enable_intercept_msr_read_x2apic(0x802);
-                /* TMCCT */
-                vmx_enable_intercept_msr_read_x2apic(0x839);
-                /* TPR */
-                vmx_disable_intercept_msr_write_x2apic(0x808);
-                /* EOI */
-                vmx_disable_intercept_msr_write_x2apic(0x80b);
-                /* SELF-IPI */
-                vmx_disable_intercept_msr_write_x2apic(0x83f);
-        }
-        if (enable_ept) {
-                kvm_mmu_set_mask_ptes(0ull,
-                        (enable_ept_ad_bits) ? VMX_EPT_ACCESS_BIT : 0ull,
-                        (enable_ept_ad_bits) ? VMX_EPT_DIRTY_BIT : 0ull,
-                        0ull, VMX_EPT_EXECUTABLE_MASK);
-                ept_set_mmio_spte_mask();
-                kvm_enable_tdp();
-        } else
-                kvm_disable_tdp();
-        update_ple_window_actual_max();
        if (setup_vmcs_config(&vmcs_config) < 0) {
                r = -EIO;
                goto out7;
-    }
+        }
        if (boot_cpu_has(X86_FEATURE_NX))
                kvm_enable_efer_bits(EFER_NX);
@@ -5945,6 +5902,49 @@ static __init int hardware_setup(void)
        if (nested)
                nested_vmx_setup_ctls_msrs();
+        vmx_disable_intercept_for_msr(MSR_FS_BASE, false);
+        vmx_disable_intercept_for_msr(MSR_GS_BASE, false);
+        vmx_disable_intercept_for_msr(MSR_KERNEL_GS_BASE, true);
+        vmx_disable_intercept_for_msr(MSR_IA32_SYSENTER_CS, false);
+        vmx_disable_intercept_for_msr(MSR_IA32_SYSENTER_ESP, false);
+        vmx_disable_intercept_for_msr(MSR_IA32_SYSENTER_EIP, false);
+        vmx_disable_intercept_for_msr(MSR_IA32_BNDCFGS, true);
+        memcpy(vmx_msr_bitmap_legacy_x2apic,
+                        vmx_msr_bitmap_legacy, PAGE_SIZE);
+        memcpy(vmx_msr_bitmap_longmode_x2apic,
+                        vmx_msr_bitmap_longmode, PAGE_SIZE);
+        if (enable_apicv) {
+                for (msr = 0x800; msr <= 0x8ff; msr++)
+                        vmx_disable_intercept_msr_read_x2apic(msr);
+                /* According SDM, in x2apic mode, the whole id reg is used.
+                 * But in KVM, it only use the highest eight bits. Need to
+                 * intercept it */
+                vmx_enable_intercept_msr_read_x2apic(0x802);
+                /* TMCCT */
+                vmx_enable_intercept_msr_read_x2apic(0x839);
+                /* TPR */
+                vmx_disable_intercept_msr_write_x2apic(0x808);
+                /* EOI */
+                vmx_disable_intercept_msr_write_x2apic(0x80b);
+                /* SELF-IPI */
+                vmx_disable_intercept_msr_write_x2apic(0x83f);
+        }
+        if (enable_ept) {
+                kvm_mmu_set_mask_ptes(0ull,
+                        (enable_ept_ad_bits) ? VMX_EPT_ACCESS_BIT : 0ull,
+                        (enable_ept_ad_bits) ? VMX_EPT_DIRTY_BIT : 0ull,
+                        0ull, VMX_EPT_EXECUTABLE_MASK);
+                ept_set_mmio_spte_mask();
+                kvm_enable_tdp();
+        } else
+                kvm_disable_tdp();
+        update_ple_window_actual_max();
        return alloc_kvm_area();
 out7:
diff --git a/drivers/char/agp/ali-agp.c b/drivers/char/agp/ali-agp.c
index 19db03667650..dcbbb4ea3cc1 100644
--- a/drivers/char/agp/ali-agp.c
+++ b/drivers/char/agp/ali-agp.c
@@ -417,6 +417,6 @@ static void __exit agp_ali_cleanup(void)
 module_init(agp_ali_init);
 module_exit(agp_ali_cleanup);
-MODULE_AUTHOR("Dave Jones <davej@redhat.com>");
+MODULE_AUTHOR("Dave Jones");
 MODULE_LICENSE("GPL and additional rights");
diff --git a/drivers/char/agp/amd64-agp.c b/drivers/char/agp/amd64-agp.c
index 3b47ed0310e1..0ef350010766 100644
--- a/drivers/char/agp/amd64-agp.c
+++ b/drivers/char/agp/amd64-agp.c
@@ -813,6 +813,6 @@ static void __exit agp_amd64_cleanup(void)
 module_init(agp_amd64_mod_init);
 module_exit(agp_amd64_cleanup);
-MODULE_AUTHOR("Dave Jones <davej@redhat.com>, Andi Kleen");
+MODULE_AUTHOR("Dave Jones, Andi Kleen");
 module_param(agp_try_unsupported, bool, 0);
 MODULE_LICENSE("GPL");
diff --git a/drivers/char/agp/ati-agp.c b/drivers/char/agp/ati-agp.c
index 18a7a6baa304..75a9786a77e6 100644
--- a/drivers/char/agp/ati-agp.c
+++ b/drivers/char/agp/ati-agp.c
@@ -579,6 +579,6 @@ static void __exit agp_ati_cleanup(void)
 module_init(agp_ati_init);
 module_exit(agp_ati_cleanup);
-MODULE_AUTHOR("Dave Jones <davej@redhat.com>");
+MODULE_AUTHOR("Dave Jones");
 MODULE_LICENSE("GPL and additional rights");
diff --git a/drivers/char/agp/backend.c b/drivers/char/agp/backend.c
index 317c28ce8328..38ffb281df97 100644
--- a/drivers/char/agp/backend.c
+++ b/drivers/char/agp/backend.c
@@ -356,7 +356,7 @@ static __init int agp_setup(char *s)
 __setup("agp=", agp_setup);
 #endif
-MODULE_AUTHOR("Dave Jones <davej@redhat.com>");
+MODULE_AUTHOR("Dave Jones, Jeff Hartmann");
 MODULE_DESCRIPTION("AGP GART driver");
 MODULE_LICENSE("GPL and additional rights");
 MODULE_ALIAS_MISCDEV(AGPGART_MINOR);
diff --git a/drivers/char/agp/intel-agp.c b/drivers/char/agp/intel-agp.c
index f9b9ca5d31b7..0a21daed5b62 100644
--- a/drivers/char/agp/intel-agp.c
+++ b/drivers/char/agp/intel-agp.c
@@ -920,5 +920,5 @@ static void __exit agp_intel_cleanup(void)
 module_init(agp_intel_init);
 module_exit(agp_intel_cleanup);
-MODULE_AUTHOR("Dave Jones <davej@redhat.com>");
+MODULE_AUTHOR("Dave Jones, Various @Intel");
 MODULE_LICENSE("GPL and additional rights");
diff --git a/drivers/char/agp/intel-gtt.c b/drivers/char/agp/intel-gtt.c
index f3334829e55a..92aa43fa8d70 100644
--- a/drivers/char/agp/intel-gtt.c
+++ b/drivers/char/agp/intel-gtt.c
@@ -1438,5 +1438,5 @@ void intel_gmch_remove(void)
 }
 EXPORT_SYMBOL(intel_gmch_remove);
-MODULE_AUTHOR("Dave Jones <davej@redhat.com>");
+MODULE_AUTHOR("Dave Jones, Various @Intel");
 MODULE_LICENSE("GPL and additional rights");
diff --git a/drivers/char/agp/nvidia-agp.c b/drivers/char/agp/nvidia-agp.c
index a1861b75eb31..6c8d39cb566e 100644
--- a/drivers/char/agp/nvidia-agp.c
+++ b/drivers/char/agp/nvidia-agp.c
@@ -1,7 +1,7 @@
 /*
 * Nvidia AGPGART routines.
 * Based upon a 2.4 agpgart diff by the folks from NVIDIA, and hacked up
- * to work in 2.5 by Dave Jones <davej@redhat.com>
+ * to work in 2.5 by Dave Jones.
 */
 #include <linux/module.h>
diff --git a/drivers/char/agp/via-agp.c b/drivers/char/agp/via-agp.c
index 228f20cddc05..a4961d35e940 100644
--- a/drivers/char/agp/via-agp.c
+++ b/drivers/char/agp/via-agp.c
@@ -595,4 +595,4 @@ module_init(agp_via_init);
 module_exit(agp_via_cleanup);
 MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Dave Jones <davej@redhat.com>");
+MODULE_AUTHOR("Dave Jones");
diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
index 5fa83f751378..6b65fa4e0c55 100644
--- a/drivers/char/ipmi/ipmi_msghandler.c
+++ b/drivers/char/ipmi/ipmi_msghandler.c
@@ -199,18 +199,6 @@ struct bmc_device {
        int                    guid_set;
        char                   name[16];
        struct kref            usecount;
-        /* bmc device attributes */
-        struct device_attribute device_id_attr;
-        struct device_attribute provides_dev_sdrs_attr;
-        struct device_attribute revision_attr;
-        struct device_attribute firmware_rev_attr;
-        struct device_attribute version_attr;
-        struct device_attribute add_dev_support_attr;
-        struct device_attribute manufacturer_id_attr;
-        struct device_attribute product_id_attr;
-        struct device_attribute guid_attr;
-        struct device_attribute aux_firmware_rev_attr;
 };
 #define to_bmc_device(x) container_of((x), struct bmc_device, pdev.dev)
@@ -2252,7 +2240,7 @@ static ssize_t device_id_show(struct device *dev,
        return snprintf(buf, 10, "%u\n", bmc->id.device_id);
 }
-DEVICE_ATTR(device_id, S_IRUGO, device_id_show, NULL);
+static DEVICE_ATTR(device_id, S_IRUGO, device_id_show, NULL);
 static ssize_t provides_device_sdrs_show(struct device *dev,
                                         struct device_attribute *attr,
@@ -2263,7 +2251,8 @@ static ssize_t provides_device_sdrs_show(struct device *dev,
        return snprintf(buf, 10, "%u\n",
                        (bmc->id.device_revision & 0x80) >> 7);
 }
-DEVICE_ATTR(provides_device_sdrs, S_IRUGO, provides_device_sdrs_show, NULL);
+static DEVICE_ATTR(provides_device_sdrs, S_IRUGO, provides_device_sdrs_show,
+                   NULL);
 static ssize_t revision_show(struct device *dev, struct device_attribute *attr,
                             char *buf)
@@ -2273,7 +2262,7 @@ static ssize_t revision_show(struct device *dev, struct device_attribute *attr,
        return snprintf(buf, 20, "%u\n",
                        bmc->id.device_revision & 0x0F);
 }
-DEVICE_ATTR(revision, S_IRUGO, revision_show, NULL);
+static DEVICE_ATTR(revision, S_IRUGO, revision_show, NULL);
 static ssize_t firmware_revision_show(struct device *dev,
                                      struct device_attribute *attr,
@@ -2284,7 +2273,7 @@ static ssize_t firmware_revision_show(struct device *dev,
        return snprintf(buf, 20, "%u.%x\n", bmc->id.firmware_revision_1,
                        bmc->id.firmware_revision_2);
 }
-DEVICE_ATTR(firmware_revision, S_IRUGO, firmware_revision_show, NULL);
+static DEVICE_ATTR(firmware_revision, S_IRUGO, firmware_revision_show, NULL);
 static ssize_t ipmi_version_show(struct device *dev,
                                 struct device_attribute *attr,
@@ -2296,7 +2285,7 @@ static ssize_t ipmi_version_show(struct device *dev,
                        ipmi_version_major(&bmc->id),
                        ipmi_version_minor(&bmc->id));
 }
-DEVICE_ATTR(ipmi_version, S_IRUGO, ipmi_version_show, NULL);
+static DEVICE_ATTR(ipmi_version, S_IRUGO, ipmi_version_show, NULL);
 static ssize_t add_dev_support_show(struct device *dev,
                                    struct device_attribute *attr,
@@ -2307,7 +2296,8 @@ static ssize_t add_dev_support_show(struct device *dev,
        return snprintf(buf, 10, "0x%02x\n",
                        bmc->id.additional_device_support);
 }
-DEVICE_ATTR(additional_device_support, S_IRUGO, add_dev_support_show, NULL);
+static DEVICE_ATTR(additional_device_support, S_IRUGO, add_dev_support_show,
+                   NULL);
 static ssize_t manufacturer_id_show(struct device *dev,
                                    struct device_attribute *attr,
@@ -2317,7 +2307,7 @@ static ssize_t manufacturer_id_show(struct device *dev,
        return snprintf(buf, 20, "0x%6.6x\n", bmc->id.manufacturer_id);
 }
-DEVICE_ATTR(manufacturer_id, S_IRUGO, manufacturer_id_show, NULL);
+static DEVICE_ATTR(manufacturer_id, S_IRUGO, manufacturer_id_show, NULL);
 static ssize_t product_id_show(struct device *dev,
                               struct device_attribute *attr,
@@ -2327,7 +2317,7 @@ static ssize_t product_id_show(struct device *dev,
        return snprintf(buf, 10, "0x%4.4x\n", bmc->id.product_id);
 }
-DEVICE_ATTR(product_id, S_IRUGO, product_id_show, NULL);
+static DEVICE_ATTR(product_id, S_IRUGO, product_id_show, NULL);
 static ssize_t aux_firmware_rev_show(struct device *dev,
                                     struct device_attribute *attr,
@@ -2341,7 +2331,7 @@ static ssize_t aux_firmware_rev_show(struct device *dev,
                        bmc->id.aux_firmware_revision[1],
                        bmc->id.aux_firmware_revision[0]);
 }
-DEVICE_ATTR(aux_firmware_revision, S_IRUGO, aux_firmware_rev_show, NULL);
+static DEVICE_ATTR(aux_firmware_revision, S_IRUGO, aux_firmware_rev_show, NULL);
 static ssize_t guid_show(struct device *dev, struct device_attribute *attr,
                         char *buf)
@@ -2352,7 +2342,7 @@ static ssize_t guid_show(struct device *dev, struct device_attribute *attr,
                        (long long) bmc->guid[0],
                        (long long) bmc->guid[8]);
 }
-DEVICE_ATTR(guid, S_IRUGO, guid_show, NULL);
+static DEVICE_ATTR(guid, S_IRUGO, guid_show, NULL);
 static struct attribute *bmc_dev_attrs[] = {
        &dev_attr_device_id.attr,
@@ -2392,10 +2382,10 @@ cleanup_bmc_device(struct kref *ref)
        if (bmc->id.aux_firmware_revision_set)
                device_remove_file(&bmc->pdev.dev,
-                                   &bmc->aux_firmware_rev_attr);
+                                   &dev_attr_aux_firmware_revision);
        if (bmc->guid_set)
                device_remove_file(&bmc->pdev.dev,
-                                   &bmc->guid_attr);
+                                   &dev_attr_guid);
        platform_device_unregister(&bmc->pdev);
 }
@@ -2422,16 +2412,14 @@ static int create_bmc_files(struct bmc_device *bmc)
        int err;
        if (bmc->id.aux_firmware_revision_set) {
-                bmc->aux_firmware_rev_attr.attr.name = "aux_firmware_revision";
                err = device_create_file(&bmc->pdev.dev,
-                                   &bmc->aux_firmware_rev_attr);
+                                         &dev_attr_aux_firmware_revision);
                if (err)
                        goto out;
        }
        if (bmc->guid_set) {
-                bmc->guid_attr.attr.name = "guid";
                err = device_create_file(&bmc->pdev.dev,
-                                   &bmc->guid_attr);
+                                         &dev_attr_guid);
                if (err)
                        goto out_aux_firm;
        }
@@ -2441,7 +2429,7 @@ static int create_bmc_files(struct bmc_device *bmc)
 out_aux_firm:
        if (bmc->id.aux_firmware_revision_set)
                device_remove_file(&bmc->pdev.dev,
-                                   &bmc->aux_firmware_rev_attr);
+                                   &dev_attr_aux_firmware_revision);
 out:
        return err;
 }
diff --git a/drivers/char/ipmi/ipmi_ssif.c b/drivers/char/ipmi/ipmi_ssif.c
index e178ac27e73c..fd5a5e85d7dc 100644
--- a/drivers/char/ipmi/ipmi_ssif.c
+++ b/drivers/char/ipmi/ipmi_ssif.c
@@ -52,6 +52,7 @@
 #include <linux/dmi.h>
 #include <linux/kthread.h>
 #include <linux/acpi.h>
+#include <linux/ctype.h>
 #define PFX "ipmi_ssif: "
 #define DEVICE_NAME "ipmi_ssif"
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
index 4f7b275f2f7b..7d4974b83af7 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
@@ -121,13 +121,9 @@ static int kfd_open(struct inode *inode, struct file *filep)
        if (IS_ERR(process))
                return PTR_ERR(process);
-        process->is_32bit_user_mode = is_32bit_user_mode;
        dev_dbg(kfd_device, "process %d opened, compat mode (32 bit) - %d\n",
                process->pasid, process->is_32bit_user_mode);
-        kfd_init_apertures(process);
        return 0;
 }
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_flat_memory.c b/drivers/gpu/drm/amd/amdkfd/kfd_flat_memory.c
index 66df4da01c29..e64aa99e5e41 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_flat_memory.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_flat_memory.c
@@ -299,13 +299,13 @@ int kfd_init_apertures(struct kfd_process *process)
        struct kfd_dev *dev;
        struct kfd_process_device *pdd;
-        mutex_lock(&process->mutex);
        /*Iterating over all devices*/
        while ((dev = kfd_topology_enum_kfd_devices(id)) != NULL &&
                id < NUM_OF_SUPPORTED_GPUS) {
                pdd = kfd_get_process_device_data(dev, process, 1);
+                if (!pdd)
+                        return -1;
                /*
                 * For 64 bit process aperture will be statically reserved in
@@ -348,8 +348,6 @@ int kfd_init_apertures(struct kfd_process *process)
                id++;
        }
-        mutex_unlock(&process->mutex);
        return 0;
 }
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_process.c b/drivers/gpu/drm/amd/amdkfd/kfd_process.c
index b85eb0b830b4..3c76ef05cbcf 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_process.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_process.c
@@ -26,6 +26,8 @@
 #include <linux/slab.h>
 #include <linux/amd-iommu.h>
 #include <linux/notifier.h>
+#include <linux/compat.h>
 struct mm_struct;
 #include "kfd_priv.h"
@@ -285,8 +287,15 @@ static struct kfd_process *create_process(const struct task_struct *thread)
        if (err != 0)
                goto err_process_pqm_init;
+        /* init process apertures*/
+        process->is_32bit_user_mode = is_compat_task();
+        if (kfd_init_apertures(process) != 0)
+                goto err_init_apretures;
        return process;
+err_init_apretures:
+        pqm_uninit(&process->pqm);
 err_process_pqm_init:
        hash_del_rcu(&process->kfd_processes);
        synchronize_rcu();
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
index 5733e2859e8a..b11792d7e70e 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
@@ -700,8 +700,6 @@ static ssize_t node_show(struct kobject *kobj, struct attribute *attr,
                                dev->node_props.simd_per_cu);
                sysfs_show_32bit_prop(buffer, "max_slots_scratch_cu",
                                dev->node_props.max_slots_scratch_cu);
-                sysfs_show_32bit_prop(buffer, "engine_id",
-                                dev->node_props.engine_id);
                sysfs_show_32bit_prop(buffer, "vendor_id",
                                dev->node_props.vendor_id);
                sysfs_show_32bit_prop(buffer, "device_id",
@@ -715,6 +713,12 @@ static ssize_t node_show(struct kobject *kobj, struct attribute *attr,
                                                dev->gpu->kgd));
                        sysfs_show_64bit_prop(buffer, "local_mem_size",
                                        kfd2kgd->get_vmem_size(dev->gpu->kgd));
+                        sysfs_show_32bit_prop(buffer, "fw_version",
+                                        kfd2kgd->get_fw_version(
+                                                        dev->gpu->kgd,
+                                                        KGD_ENGINE_MEC1));
                }
                ret = sysfs_show_32bit_prop(buffer, "max_engine_clk_ccompute",
diff --git a/drivers/gpu/drm/amd/include/kgd_kfd_interface.h b/drivers/gpu/drm/amd/include/kgd_kfd_interface.h
index 9c729dd8dd50..47b551970a14 100644
--- a/drivers/gpu/drm/amd/include/kgd_kfd_interface.h
+++ b/drivers/gpu/drm/amd/include/kgd_kfd_interface.h
@@ -45,6 +45,17 @@ enum kgd_memory_pool {
        KGD_POOL_FRAMEBUFFER = 3,
 };
+enum kgd_engine_type {
+        KGD_ENGINE_PFP = 1,
+        KGD_ENGINE_ME,
+        KGD_ENGINE_CE,
+        KGD_ENGINE_MEC1,
+        KGD_ENGINE_MEC2,
+        KGD_ENGINE_RLC,
+        KGD_ENGINE_SDMA,
+        KGD_ENGINE_MAX
+};
 struct kgd2kfd_shared_resources {
        /* Bit n == 1 means VMID n is available for KFD. */
        unsigned int compute_vmid_bitmap;
@@ -137,6 +148,8 @@ struct kgd2kfd_calls {
 *
 * @hqd_destroy: Destructs and preempts the queue assigned to that hqd slot.
 *
+ * @get_fw_version: Returns FW versions from the header
+ *
 * This structure contains function pointers to services that the kgd driver
 * provides to amdkfd driver.
 *
@@ -176,6 +189,8 @@ struct kfd2kgd_calls {
        int (*hqd_destroy)(struct kgd_dev *kgd, uint32_t reset_type,
                                unsigned int timeout, uint32_t pipe_id,
                                uint32_t queue_id);
+        uint16_t (*get_fw_version)(struct kgd_dev *kgd,
+                                enum kgd_engine_type type);
 };
 bool kgd2kfd_init(unsigned interface_version,
diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c
index 4a78a773151c..bbdbe4721573 100644
--- a/drivers/gpu/drm/drm_atomic_helper.c
+++ b/drivers/gpu/drm/drm_atomic_helper.c
@@ -61,7 +61,7 @@ drm_atomic_helper_plane_changed(struct drm_atomic_state *state,
        struct drm_crtc_state *crtc_state;
        if (plane->state->crtc) {
-                crtc_state = state->crtc_states[drm_crtc_index(plane->crtc)];
+                crtc_state = state->crtc_states[drm_crtc_index(plane->state->crtc)];
                if (WARN_ON(!crtc_state))
                        return;
diff --git a/drivers/gpu/drm/drm_irq.c b/drivers/gpu/drm/drm_irq.c
index f5a5f18efa5b..4d79dad9d44f 100644
--- a/drivers/gpu/drm/drm_irq.c
+++ b/drivers/gpu/drm/drm_irq.c
@@ -830,6 +830,8 @@ drm_get_last_vbltimestamp(struct drm_device *dev, int crtc,
 * vblank events since the system was booted, including lost events due to
 * modesetting activity.
 *
+ * This is the legacy version of drm_crtc_vblank_count().
+ *
 * Returns:
 * The software vblank counter.
 */
@@ -844,6 +846,25 @@ u32 drm_vblank_count(struct drm_device *dev, int crtc)
 EXPORT_SYMBOL(drm_vblank_count);
 /**
+ * drm_crtc_vblank_count - retrieve "cooked" vblank counter value
+ * @crtc: which counter to retrieve
+ *
+ * Fetches the "cooked" vblank count value that represents the number of
+ * vblank events since the system was booted, including lost events due to
+ * modesetting activity.
+ *
+ * This is the native KMS version of drm_vblank_count().
+ *
+ * Returns:
+ * The software vblank counter.
+ */
+u32 drm_crtc_vblank_count(struct drm_crtc *crtc)
+{
+        return drm_vblank_count(crtc->dev, drm_crtc_index(crtc));
+}
+EXPORT_SYMBOL(drm_crtc_vblank_count);
+/**
 * drm_vblank_count_and_time - retrieve "cooked" vblank counter value
 * and the system timestamp corresponding to that vblank counter value.
 *
@@ -904,6 +925,8 @@ static void send_vblank_event(struct drm_device *dev,
 *
 * Updates sequence # and timestamp on event, and sends it to userspace.
 * Caller must hold event lock.
+ *
+ * This is the legacy version of drm_crtc_send_vblank_event().
 */
 void drm_send_vblank_event(struct drm_device *dev, int crtc,
                struct drm_pending_vblank_event *e)
@@ -923,6 +946,23 @@ void drm_send_vblank_event(struct drm_device *dev, int crtc,
 EXPORT_SYMBOL(drm_send_vblank_event);
 /**
+ * drm_crtc_send_vblank_event - helper to send vblank event after pageflip
+ * @crtc: the source CRTC of the vblank event
+ * @e: the event to send
+ *
+ * Updates sequence # and timestamp on event, and sends it to userspace.
+ * Caller must hold event lock.
+ *
+ * This is the native KMS version of drm_send_vblank_event().
+ */
+void drm_crtc_send_vblank_event(struct drm_crtc *crtc,
+                                struct drm_pending_vblank_event *e)
+{
+        drm_send_vblank_event(crtc->dev, drm_crtc_index(crtc), e);
+}
+EXPORT_SYMBOL(drm_crtc_send_vblank_event);
+/**
 * drm_vblank_enable - enable the vblank interrupt on a CRTC
 * @dev: DRM device
 * @crtc: CRTC in question
@@ -1594,6 +1634,8 @@ static void drm_handle_vblank_events(struct drm_device *dev, int crtc)
 *
 * Drivers should call this routine in their vblank interrupt handlers to
 * update the vblank counter and send any signals that may be pending.
+ *
+ * This is the legacy version of drm_crtc_handle_vblank().
 */
 bool drm_handle_vblank(struct drm_device *dev, int crtc)
 {
@@ -1670,3 +1712,21 @@ bool drm_handle_vblank(struct drm_device *dev, int crtc)
        return true;
 }
 EXPORT_SYMBOL(drm_handle_vblank);
+/**
+ * drm_crtc_handle_vblank - handle a vblank event
+ * @crtc: where this event occurred
+ *
+ * Drivers should call this routine in their vblank interrupt handlers to
+ * update the vblank counter and send any signals that may be pending.
+ *
+ * This is the native KMS version of drm_handle_vblank().
+ *
+ * Returns:
+ * True if the event was successfully handled, false on failure.
+ */
+bool drm_crtc_handle_vblank(struct drm_crtc *crtc)
+{
+        return drm_handle_vblank(crtc->dev, drm_crtc_index(crtc));
+}
+EXPORT_SYMBOL(drm_crtc_handle_vblank);
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index f990ab4c3efb..574057cd1d09 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -811,6 +811,8 @@ int i915_reset(struct drm_device *dev)
        if (!i915.reset)
                return 0;
+        intel_reset_gt_powersave(dev);
        mutex_lock(&dev->struct_mutex);
        i915_gem_reset(dev);
@@ -880,7 +882,7 @@ int i915_reset(struct drm_device *dev)
                 * of re-init after reset.
                 */
                if (INTEL_INFO(dev)->gen > 5)
-                        intel_reset_gt_powersave(dev);
+                        intel_enable_gt_powersave(dev);
        } else {
                mutex_unlock(&dev->struct_mutex);
        }
@@ -1584,7 +1586,7 @@ static struct drm_driver driver = {
        .gem_prime_import = i915_gem_prime_import,
        .dumb_create = i915_gem_dumb_create,
-        .dumb_map_offset = i915_gem_dumb_map_offset,
+        .dumb_map_offset = i915_gem_mmap_gtt,
        .dumb_destroy = drm_gem_dumb_destroy,
        .ioctls = i915_ioctls,
        .fops = &i915_driver_fops,
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index 63bcda5541ec..70d0f0f06f1a 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -2501,9 +2501,8 @@ void i915_vma_move_to_active(struct i915_vma *vma,
 int i915_gem_dumb_create(struct drm_file *file_priv,
                         struct drm_device *dev,
                         struct drm_mode_create_dumb *args);
-int i915_gem_dumb_map_offset(struct drm_file *file_priv,
+int i915_gem_mmap_gtt(struct drm_file *file_priv, struct drm_device *dev,
-                             struct drm_device *dev, uint32_t handle,
+                      uint32_t handle, uint64_t *offset);
-                             uint64_t *offset);
 /**
 * Returns true if seq1 is later than seq2.
 */
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 4a9faea626db..52adcb680be3 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -401,7 +401,6 @@ static int
 i915_gem_create(struct drm_file *file,
                struct drm_device *dev,
                uint64_t size,
-                bool dumb,
                uint32_t *handle_p)
 {
        struct drm_i915_gem_object *obj;
@@ -417,7 +416,6 @@ i915_gem_create(struct drm_file *file,
        if (obj == NULL)
                return -ENOMEM;
-        obj->base.dumb = dumb;
        ret = drm_gem_handle_create(file, &obj->base, &handle);
        /* drop reference from allocate - handle holds it now */
        drm_gem_object_unreference_unlocked(&obj->base);
@@ -437,7 +435,7 @@ i915_gem_dumb_create(struct drm_file *file,
        args->pitch = ALIGN(args->width * DIV_ROUND_UP(args->bpp, 8), 64);
        args->size = args->pitch * args->height;
        return i915_gem_create(file, dev,
-                               args->size, true, &args->handle);
+                               args->size, &args->handle);
 }
 /**
@@ -450,7 +448,7 @@ i915_gem_create_ioctl(struct drm_device *dev, void *data,
        struct drm_i915_gem_create *args = data;
        return i915_gem_create(file, dev,
-                               args->size, false, &args->handle);
+                               args->size, &args->handle);
 }
 static inline int
@@ -1840,10 +1838,10 @@ static void i915_gem_object_free_mmap_offset(struct drm_i915_gem_object *obj)
        drm_gem_free_mmap_offset(&obj->base);
 }
-static int
+int
 i915_gem_mmap_gtt(struct drm_file *file,
                  struct drm_device *dev,
-                  uint32_t handle, bool dumb,
+                  uint32_t handle,
                  uint64_t *offset)
 {
        struct drm_i915_private *dev_priv = dev->dev_private;
@@ -1860,13 +1858,6 @@ i915_gem_mmap_gtt(struct drm_file *file,
                goto unlock;
        }
-        /*
-         * We don't allow dumb mmaps on objects created using another
-         * interface.
-         */
-        WARN_ONCE(dumb && !(obj->base.dumb || obj->base.import_attach),
-                  "Illegal dumb map of accelerated buffer.\n");
        if (obj->base.size > dev_priv->gtt.mappable_end) {
                ret = -E2BIG;
                goto out;
@@ -1891,15 +1882,6 @@ unlock:
        return ret;
 }
-int
-i915_gem_dumb_map_offset(struct drm_file *file,
-                         struct drm_device *dev,
-                         uint32_t handle,
-                         uint64_t *offset)
-{
-        return i915_gem_mmap_gtt(file, dev, handle, true, offset);
-}
 /**
 * i915_gem_mmap_gtt_ioctl - prepare an object for GTT mmap'ing
 * @dev: DRM device
@@ -1921,7 +1903,7 @@ i915_gem_mmap_gtt_ioctl(struct drm_device *dev, void *data,
 {
        struct drm_i915_gem_mmap_gtt *args = data;
-        return i915_gem_mmap_gtt(file, dev, args->handle, false, &args->offset);
+        return i915_gem_mmap_gtt(file, dev, args->handle, &args->offset);
 }
 static inline int
diff --git a/drivers/gpu/drm/i915/i915_gem_context.c b/drivers/gpu/drm/i915/i915_gem_context.c
index d17ff435f276..d011ec82ef1e 100644
--- a/drivers/gpu/drm/i915/i915_gem_context.c
+++ b/drivers/gpu/drm/i915/i915_gem_context.c
@@ -473,7 +473,12 @@ mi_set_context(struct intel_engine_cs *ring,
               u32 hw_flags)
 {
        u32 flags = hw_flags | MI_MM_SPACE_GTT;
-        int ret;
+        const int num_rings =
+                /* Use an extended w/a on ivb+ if signalling from other rings */
+                i915_semaphore_is_enabled(ring->dev) ?
+                hweight32(INTEL_INFO(ring->dev)->ring_mask) - 1 :
+                0;
+        int len, i, ret;
        /* w/a: If Flush TLB Invalidation Mode is enabled, driver must do a TLB
         * invalidation prior to MI_SET_CONTEXT. On GEN6 we don't set the value
@@ -490,15 +495,31 @@ mi_set_context(struct intel_engine_cs *ring,
        if (!IS_HASWELL(ring->dev) && INTEL_INFO(ring->dev)->gen < 8)
                flags |= (MI_SAVE_EXT_STATE_EN | MI_RESTORE_EXT_STATE_EN);
-        ret = intel_ring_begin(ring, 6);
+        len = 4;
+        if (INTEL_INFO(ring->dev)->gen >= 7)
+                len += 2 + (num_rings ? 4*num_rings + 2 : 0);
+        ret = intel_ring_begin(ring, len);
        if (ret)
                return ret;
        /* WaProgramMiArbOnOffAroundMiSetContext:ivb,vlv,hsw,bdw,chv */
-        if (INTEL_INFO(ring->dev)->gen >= 7)
+        if (INTEL_INFO(ring->dev)->gen >= 7) {
                intel_ring_emit(ring, MI_ARB_ON_OFF | MI_ARB_DISABLE);
-        else
+                if (num_rings) {
-                intel_ring_emit(ring, MI_NOOP);
+                        struct intel_engine_cs *signaller;
+                        intel_ring_emit(ring, MI_LOAD_REGISTER_IMM(num_rings));
+                        for_each_ring(signaller, to_i915(ring->dev), i) {
+                                if (signaller == ring)
+                                        continue;
+                                intel_ring_emit(ring, RING_PSMI_CTL(signaller->mmio_base));
+                                intel_ring_emit(ring, _MASKED_BIT_ENABLE(GEN6_PSMI_SLEEP_MSG_DISABLE));
+                        }
+                }
+        }
        intel_ring_emit(ring, MI_NOOP);
        intel_ring_emit(ring, MI_SET_CONTEXT);
@@ -510,10 +531,21 @@ mi_set_context(struct intel_engine_cs *ring,
         */
        intel_ring_emit(ring, MI_NOOP);
-        if (INTEL_INFO(ring->dev)->gen >= 7)
+        if (INTEL_INFO(ring->dev)->gen >= 7) {
+                if (num_rings) {
+                        struct intel_engine_cs *signaller;
+                        intel_ring_emit(ring, MI_LOAD_REGISTER_IMM(num_rings));
+                        for_each_ring(signaller, to_i915(ring->dev), i) {
+                                if (signaller == ring)
+                                        continue;
+                                intel_ring_emit(ring, RING_PSMI_CTL(signaller->mmio_base));
+                                intel_ring_emit(ring, _MASKED_BIT_DISABLE(GEN6_PSMI_SLEEP_MSG_DISABLE));
+                        }
+                }
                intel_ring_emit(ring, MI_ARB_ON_OFF | MI_ARB_ENABLE);
-        else
+        }
-                intel_ring_emit(ring, MI_NOOP);
        intel_ring_advance(ring);
diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
index f06027ba3ee5..11738316394a 100644
--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
@@ -121,9 +121,6 @@ eb_lookup_vmas(struct eb_vmas *eb,
                        goto err;
                }
-                WARN_ONCE(obj->base.dumb,
-                          "GPU use of dumb buffer is illegal.\n");
                drm_gem_object_reference(&obj->base);
                list_add_tail(&obj->obj_exec_link, &objects);
        }
diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
index 981834b0f9b6..996c2931c499 100644
--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
@@ -281,10 +281,14 @@ void gen6_enable_rps_interrupts(struct drm_device *dev)
        struct drm_i915_private *dev_priv = dev->dev_private;
        spin_lock_irq(&dev_priv->irq_lock);
        WARN_ON(dev_priv->rps.pm_iir);
        WARN_ON(I915_READ(gen6_pm_iir(dev_priv)) & dev_priv->pm_rps_events);
        dev_priv->rps.interrupts_enabled = true;
+        I915_WRITE(gen6_pm_ier(dev_priv), I915_READ(gen6_pm_ier(dev_priv)) |
+                                dev_priv->pm_rps_events);
        gen6_enable_pm_irq(dev_priv, dev_priv->pm_rps_events);
        spin_unlock_irq(&dev_priv->irq_lock);
 }
@@ -3307,8 +3311,10 @@ static void gen5_gt_irq_postinstall(struct drm_device *dev)
        GEN5_IRQ_INIT(GT, dev_priv->gt_irq_mask, gt_irqs);
        if (INTEL_INFO(dev)->gen >= 6) {
-                pm_irqs |= dev_priv->pm_rps_events;
+                /*
+                 * RPS interrupts will get enabled/disabled on demand when RPS
+                 * itself is enabled/disabled.
+                 */
                if (HAS_VEBOX(dev))
                        pm_irqs |= PM_VEBOX_USER_INTERRUPT;
@@ -3520,7 +3526,11 @@ static void gen8_gt_irq_postinstall(struct drm_i915_private *dev_priv)
        dev_priv->pm_irq_mask = 0xffffffff;
        GEN8_IRQ_INIT_NDX(GT, 0, ~gt_interrupts[0], gt_interrupts[0]);
        GEN8_IRQ_INIT_NDX(GT, 1, ~gt_interrupts[1], gt_interrupts[1]);
-        GEN8_IRQ_INIT_NDX(GT, 2, dev_priv->pm_irq_mask, dev_priv->pm_rps_events);
+        /*
+         * RPS interrupts will get enabled/disabled on demand when RPS itself
+         * is enabled/disabled.
+         */
+        GEN8_IRQ_INIT_NDX(GT, 2, dev_priv->pm_irq_mask, 0);
        GEN8_IRQ_INIT_NDX(GT, 3, ~gt_interrupts[3], gt_interrupts[3]);
 }
@@ -3609,7 +3619,7 @@ static void vlv_display_irq_uninstall(struct drm_i915_private *dev_priv)
        vlv_display_irq_reset(dev_priv);
-        dev_priv->irq_mask = 0;
+        dev_priv->irq_mask = ~0;
 }
 static void valleyview_irq_uninstall(struct drm_device *dev)
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index eefdc238f70b..172de3b3433b 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -395,6 +395,7 @@
 #define   PIPE_CONTROL_STORE_DATA_INDEX                 (1<<21)
 #define   PIPE_CONTROL_CS_STALL                         (1<<20)
 #define   PIPE_CONTROL_TLB_INVALIDATE                   (1<<18)
+#define   PIPE_CONTROL_MEDIA_STATE_CLEAR                (1<<16)
 #define   PIPE_CONTROL_QW_WRITE                         (1<<14)
 #define   PIPE_CONTROL_POST_SYNC_OP_MASK                (3<<14)
 #define   PIPE_CONTROL_DEPTH_STALL                      (1<<13)
@@ -1128,6 +1129,7 @@ enum punit_power_well {
 #define GEN6_VERSYNC    (RING_SYNC_1(VEBOX_RING_BASE))
 #define GEN6_VEVSYNC    (RING_SYNC_2(VEBOX_RING_BASE))
 #define GEN6_NOSYNC 0
+#define RING_PSMI_CTL(base)     ((base)+0x50)
 #define RING_MAX_IDLE(base)     ((base)+0x54)
 #define RING_HWS_PGA(base)      ((base)+0x80)
 #define RING_HWS_PGA_GEN6(base) ((base)+0x2080)
@@ -1458,6 +1460,7 @@ enum punit_power_well {
 #define   GEN6_BLITTER_FBC_NOTIFY                       (1<<3)
 #define GEN6_RC_SLEEP_PSMI_CONTROL      0x2050
+#define   GEN6_PSMI_SLEEP_MSG_DISABLE   (1 << 0)
 #define   GEN8_RC_SEMA_IDLE_MSG_DISABLE (1 << 12)
 #define   GEN8_FF_DOP_CLOCK_GATE_DISABLE        (1<<10)
diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
index 1f4b56e273c8..964b28e3c630 100644
--- a/drivers/gpu/drm/i915/intel_pm.c
+++ b/drivers/gpu/drm/i915/intel_pm.c
@@ -6191,6 +6191,20 @@ void intel_cleanup_gt_powersave(struct drm_device *dev)
                valleyview_cleanup_gt_powersave(dev);
 }
+static void gen6_suspend_rps(struct drm_device *dev)
+{
+        struct drm_i915_private *dev_priv = dev->dev_private;
+        flush_delayed_work(&dev_priv->rps.delayed_resume_work);
+        /*
+         * TODO: disable RPS interrupts on GEN9+ too once RPS support
+         * is added for it.
+         */
+        if (INTEL_INFO(dev)->gen < 9)
+                gen6_disable_rps_interrupts(dev);
+}
 /**
 * intel_suspend_gt_powersave - suspend PM work and helper threads
 * @dev: drm device
@@ -6206,14 +6220,7 @@ void intel_suspend_gt_powersave(struct drm_device *dev)
        if (INTEL_INFO(dev)->gen < 6)
                return;
-        flush_delayed_work(&dev_priv->rps.delayed_resume_work);
+        gen6_suspend_rps(dev);
-        /*
-         * TODO: disable RPS interrupts on GEN9+ too once RPS support
-         * is added for it.
-         */
-        if (INTEL_INFO(dev)->gen < 9)
-                gen6_disable_rps_interrupts(dev);
        /* Force GPU to min freq during suspend */
        gen6_rps_idle(dev_priv);
@@ -6316,8 +6323,11 @@ void intel_reset_gt_powersave(struct drm_device *dev)
 {
        struct drm_i915_private *dev_priv = dev->dev_private;
+        if (INTEL_INFO(dev)->gen < 6)
+                return;
+        gen6_suspend_rps(dev);
        dev_priv->rps.enabled = false;
-        intel_enable_gt_powersave(dev);
 }
 static void ibx_init_clock_gating(struct drm_device *dev)
diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c
index 9f445e9a75d1..c7bc93d28d84 100644
--- a/drivers/gpu/drm/i915/intel_ringbuffer.c
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
@@ -362,12 +362,15 @@ gen7_render_ring_flush(struct intel_engine_cs *ring,
                flags |= PIPE_CONTROL_VF_CACHE_INVALIDATE;
                flags |= PIPE_CONTROL_CONST_CACHE_INVALIDATE;
                flags |= PIPE_CONTROL_STATE_CACHE_INVALIDATE;
+                flags |= PIPE_CONTROL_MEDIA_STATE_CLEAR;
                /*
                 * TLB invalidate requires a post-sync write.
                 */
                flags |= PIPE_CONTROL_QW_WRITE;
                flags |= PIPE_CONTROL_GLOBAL_GTT_IVB;
+                flags |= PIPE_CONTROL_STALL_AT_SCOREBOARD;
                /* Workaround: we must issue a pipe_control with CS-stall bit
                 * set before a pipe_control command that has the state cache
                 * invalidate bit set. */
diff --git a/drivers/gpu/drm/msm/adreno/adreno_gpu.c b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
index aa873048308b..94a5bee69fe7 100644
--- a/drivers/gpu/drm/msm/adreno/adreno_gpu.c
+++ b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
@@ -386,9 +386,7 @@ void adreno_gpu_cleanup(struct adreno_gpu *gpu)
                        msm_gem_put_iova(gpu->memptrs_bo, gpu->base.id);
                drm_gem_object_unreference(gpu->memptrs_bo);
        }
-        if (gpu->pm4)
+        release_firmware(gpu->pm4);
-                release_firmware(gpu->pm4);
+        release_firmware(gpu->pfp);
-        if (gpu->pfp)
-                release_firmware(gpu->pfp);
        msm_gpu_cleanup(&gpu->base);
 }
diff --git a/drivers/gpu/drm/msm/hdmi/hdmi_connector.c b/drivers/gpu/drm/msm/hdmi/hdmi_connector.c
index fbebb0405d76..b4e70e0e3cfa 100644
--- a/drivers/gpu/drm/msm/hdmi/hdmi_connector.c
+++ b/drivers/gpu/drm/msm/hdmi/hdmi_connector.c
@@ -141,6 +141,15 @@ static int hpd_enable(struct hdmi_connector *hdmi_connector)
        uint32_t hpd_ctrl;
        int i, ret;
+        for (i = 0; i < config->hpd_reg_cnt; i++) {
+                ret = regulator_enable(hdmi->hpd_regs[i]);
+                if (ret) {
+                        dev_err(dev->dev, "failed to enable hpd regulator: %s (%d)\n",
+                                        config->hpd_reg_names[i], ret);
+                        goto fail;
+                }
+        }
        ret = gpio_config(hdmi, true);
        if (ret) {
                dev_err(dev->dev, "failed to configure GPIOs: %d\n", ret);
@@ -164,15 +173,6 @@ static int hpd_enable(struct hdmi_connector *hdmi_connector)
                }
        }
-        for (i = 0; i < config->hpd_reg_cnt; i++) {
-                ret = regulator_enable(hdmi->hpd_regs[i]);
-                if (ret) {
-                        dev_err(dev->dev, "failed to enable hpd regulator: %s (%d)\n",
-                                        config->hpd_reg_names[i], ret);
-                        goto fail;
-                }
-        }
        hdmi_set_mode(hdmi, false);
        phy->funcs->reset(phy);
        hdmi_set_mode(hdmi, true);
@@ -200,7 +200,7 @@ fail:
        return ret;
 }
-static int hdp_disable(struct hdmi_connector *hdmi_connector)
+static void hdp_disable(struct hdmi_connector *hdmi_connector)
 {
        struct hdmi *hdmi = hdmi_connector->hdmi;
        const struct hdmi_platform_config *config = hdmi->config;
@@ -212,28 +212,19 @@ static int hdp_disable(struct hdmi_connector *hdmi_connector)
        hdmi_set_mode(hdmi, false);
-        for (i = 0; i < config->hpd_reg_cnt; i++) {
-                ret = regulator_disable(hdmi->hpd_regs[i]);
-                if (ret) {
-                        dev_err(dev->dev, "failed to disable hpd regulator: %s (%d)\n",
-                                        config->hpd_reg_names[i], ret);
-                        goto fail;
-                }
-        }
        for (i = 0; i < config->hpd_clk_cnt; i++)
                clk_disable_unprepare(hdmi->hpd_clks[i]);
        ret = gpio_config(hdmi, false);
-        if (ret) {
+        if (ret)
-                dev_err(dev->dev, "failed to unconfigure GPIOs: %d\n", ret);
+                dev_warn(dev->dev, "failed to unconfigure GPIOs: %d\n", ret);
-                goto fail;
-        }
-        return 0;
-fail:
+        for (i = 0; i < config->hpd_reg_cnt; i++) {
-        return ret;
+                ret = regulator_disable(hdmi->hpd_regs[i]);
+                if (ret)
+                        dev_warn(dev->dev, "failed to disable hpd regulator: %s (%d)\n",
+                                        config->hpd_reg_names[i], ret);
+        }
 }
 static void
@@ -260,11 +251,11 @@ void hdmi_connector_irq(struct drm_connector *connector)
                        (hpd_int_status & HDMI_HPD_INT_STATUS_INT)) {
                bool detected = !!(hpd_int_status & HDMI_HPD_INT_STATUS_CABLE_DETECTED);
-                DBG("status=%04x, ctrl=%04x", hpd_int_status, hpd_int_ctrl);
+                /* ack & disable (temporarily) HPD events: */
-                /* ack the irq: */
                hdmi_write(hdmi, REG_HDMI_HPD_INT_CTRL,
-                                hpd_int_ctrl | HDMI_HPD_INT_CTRL_INT_ACK);
+                        HDMI_HPD_INT_CTRL_INT_ACK);
+                DBG("status=%04x, ctrl=%04x", hpd_int_status, hpd_int_ctrl);
                /* detect disconnect if we are connected or visa versa: */
                hpd_int_ctrl = HDMI_HPD_INT_CTRL_INT_EN;
diff --git a/drivers/gpu/drm/msm/mdp/mdp4/mdp4_crtc.c b/drivers/gpu/drm/msm/mdp/mdp4/mdp4_crtc.c
index a7672e100d8b..3449213f1e76 100644
--- a/drivers/gpu/drm/msm/mdp/mdp4/mdp4_crtc.c
+++ b/drivers/gpu/drm/msm/mdp/mdp4/mdp4_crtc.c
@@ -331,17 +331,8 @@ static int mdp4_crtc_atomic_check(struct drm_crtc *crtc,
                struct drm_crtc_state *state)
 {
        struct mdp4_crtc *mdp4_crtc = to_mdp4_crtc(crtc);
-        struct drm_device *dev = crtc->dev;
        DBG("%s: check", mdp4_crtc->name);
-        if (mdp4_crtc->event) {
-                dev_err(dev->dev, "already pending flip!\n");
-                return -EBUSY;
-        }
        // TODO anything else to check?
        return 0;
 }
@@ -357,7 +348,7 @@ static void mdp4_crtc_atomic_flush(struct drm_crtc *crtc)
        struct drm_device *dev = crtc->dev;
        unsigned long flags;
-        DBG("%s: flush", mdp4_crtc->name);
+        DBG("%s: event: %p", mdp4_crtc->name, crtc->state->event);
        WARN_ON(mdp4_crtc->event);
diff --git a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_crtc.c b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_crtc.c
index 0e9a2e3a82d7..f021f960a8a2 100644
--- a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_crtc.c
+++ b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_crtc.c
@@ -303,11 +303,6 @@ static int mdp5_crtc_atomic_check(struct drm_crtc *crtc,
        DBG("%s: check", mdp5_crtc->name);
-        if (mdp5_crtc->event) {
-                dev_err(dev->dev, "already pending flip!\n");
-                return -EBUSY;
-        }
        /* request a free CTL, if none is already allocated for this CRTC */
        if (state->enable && !mdp5_crtc->ctl) {
                mdp5_crtc->ctl = mdp5_ctlm_request(mdp5_kms->ctlm, crtc);
@@ -364,7 +359,7 @@ static void mdp5_crtc_atomic_flush(struct drm_crtc *crtc)
        struct drm_device *dev = crtc->dev;
        unsigned long flags;
-        DBG("%s: flush", mdp5_crtc->name);
+        DBG("%s: event: %p", mdp5_crtc->name, crtc->state->event);
        WARN_ON(mdp5_crtc->event);
@@ -460,10 +455,7 @@ void mdp5_crtc_set_intf(struct drm_crtc *crtc, int intf,
        /* now that we know what irq's we want: */
        mdp5_crtc->err.irqmask = intf2err(intf);
        mdp5_crtc->vblank.irqmask = intf2vblank(intf);
+        mdp_irq_update(&mdp5_kms->base);
-        /* when called from modeset_init(), skip the rest until later: */
-        if (!mdp5_kms)
-                return;
        spin_lock_irqsave(&mdp5_kms->resource_lock, flags);
        intf_sel = mdp5_read(mdp5_kms, REG_MDP5_DISP_INTF_SEL);
diff --git a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_kms.c b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_kms.c
index a11f1b80c488..9f01a4f21af2 100644
--- a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_kms.c
+++ b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_kms.c
@@ -216,17 +216,7 @@ static int modeset_init(struct mdp5_kms *mdp5_kms)
                goto fail;
        }
-        /* NOTE: the vsync and error irq's are actually associated with
+        encoder->possible_crtcs = (1 << priv->num_crtcs) - 1;;
-         * the INTF/encoder.. the easiest way to deal with this (ie. what
-         * we do now) is assume a fixed relationship between crtc's and
-         * encoders.  I'm not sure if there is ever a need to more freely
-         * assign crtcs to encoders, but if there is then we need to take
-         * care of error and vblank irq's that the crtc has registered,
-         * and also update user-requested vblank_mask.
-         */
-        encoder->possible_crtcs = BIT(0);
-        mdp5_crtc_set_intf(priv->crtcs[0], 3, INTF_HDMI);
        priv->encoders[priv->num_encoders++] = encoder;
        /* Construct bridge/connector for HDMI: */
diff --git a/drivers/gpu/drm/msm/mdp/mdp_kms.c b/drivers/gpu/drm/msm/mdp/mdp_kms.c
index 03455b64a245..2a731722d840 100644
--- a/drivers/gpu/drm/msm/mdp/mdp_kms.c
+++ b/drivers/gpu/drm/msm/mdp/mdp_kms.c
@@ -42,7 +42,10 @@ static void update_irq(struct mdp_kms *mdp_kms)
        mdp_kms->funcs->set_irqmask(mdp_kms, irqmask);
 }
-static void update_irq_unlocked(struct mdp_kms *mdp_kms)
+/* if an mdp_irq's irqmask has changed, such as when mdp5 crtc<->encoder
+ * link changes, this must be called to figure out the new global irqmask
+ */
+void mdp_irq_update(struct mdp_kms *mdp_kms)
 {
        unsigned long flags;
        spin_lock_irqsave(&list_lock, flags);
@@ -122,7 +125,7 @@ void mdp_irq_register(struct mdp_kms *mdp_kms, struct mdp_irq *irq)
        spin_unlock_irqrestore(&list_lock, flags);
        if (needs_update)
-                update_irq_unlocked(mdp_kms);
+                mdp_irq_update(mdp_kms);
 }
 void mdp_irq_unregister(struct mdp_kms *mdp_kms, struct mdp_irq *irq)
@@ -141,5 +144,5 @@ void mdp_irq_unregister(struct mdp_kms *mdp_kms, struct mdp_irq *irq)
        spin_unlock_irqrestore(&list_lock, flags);
        if (needs_update)
-                update_irq_unlocked(mdp_kms);
+                mdp_irq_update(mdp_kms);
 }
diff --git a/drivers/gpu/drm/msm/mdp/mdp_kms.h b/drivers/gpu/drm/msm/mdp/mdp_kms.h
index 99557b5ad4fd..b268ce95d394 100644
--- a/drivers/gpu/drm/msm/mdp/mdp_kms.h
+++ b/drivers/gpu/drm/msm/mdp/mdp_kms.h
@@ -75,7 +75,7 @@ void mdp_update_vblank_mask(struct mdp_kms *mdp_kms, uint32_t mask, bool enable)
 void mdp_irq_wait(struct mdp_kms *mdp_kms, uint32_t irqmask);
 void mdp_irq_register(struct mdp_kms *mdp_kms, struct mdp_irq *irq);
 void mdp_irq_unregister(struct mdp_kms *mdp_kms, struct mdp_irq *irq);
+void mdp_irq_update(struct mdp_kms *mdp_kms);
 /*
 * pixel format helpers:
diff --git a/drivers/gpu/drm/msm/msm_atomic.c b/drivers/gpu/drm/msm/msm_atomic.c
index f0de412e13dc..191968256c58 100644
--- a/drivers/gpu/drm/msm/msm_atomic.c
+++ b/drivers/gpu/drm/msm/msm_atomic.c
@@ -23,10 +23,41 @@ struct msm_commit {
        struct drm_atomic_state *state;
        uint32_t fence;
        struct msm_fence_cb fence_cb;
+        uint32_t crtc_mask;
 };
 static void fence_cb(struct msm_fence_cb *cb);
+/* block until specified crtcs are no longer pending update, and
+ * atomically mark them as pending update
+ */
+static int start_atomic(struct msm_drm_private *priv, uint32_t crtc_mask)
+{
+        int ret;
+        spin_lock(&priv->pending_crtcs_event.lock);
+        ret = wait_event_interruptible_locked(priv->pending_crtcs_event,
+                        !(priv->pending_crtcs & crtc_mask));
+        if (ret == 0) {
+                DBG("start: %08x", crtc_mask);
+                priv->pending_crtcs |= crtc_mask;
+        }
+        spin_unlock(&priv->pending_crtcs_event.lock);
+        return ret;
+}
+/* clear specified crtcs (no longer pending update)
+ */
+static void end_atomic(struct msm_drm_private *priv, uint32_t crtc_mask)
+{
+        spin_lock(&priv->pending_crtcs_event.lock);
+        DBG("end: %08x", crtc_mask);
+        priv->pending_crtcs &= ~crtc_mask;
+        wake_up_all_locked(&priv->pending_crtcs_event);
+        spin_unlock(&priv->pending_crtcs_event.lock);
+}
 static struct msm_commit *new_commit(struct drm_atomic_state *state)
 {
        struct msm_commit *c = kzalloc(sizeof(*c), GFP_KERNEL);
@@ -58,12 +89,27 @@ static void complete_commit(struct msm_commit *c)
        drm_atomic_helper_commit_post_planes(dev, state);
+        /* NOTE: _wait_for_vblanks() only waits for vblank on
+         * enabled CRTCs.  So we end up faulting when disabling
+         * due to (potentially) unref'ing the outgoing fb's
+         * before the vblank when the disable has latched.
+         *
+         * But if it did wait on disabled (or newly disabled)
+         * CRTCs, that would be racy (ie. we could have missed
+         * the irq.  We need some way to poll for pipe shut
+         * down.  Or just live with occasionally hitting the
+         * timeout in the CRTC disable path (which really should
+         * not be critical path)
+         */
        drm_atomic_helper_wait_for_vblanks(dev, state);
        drm_atomic_helper_cleanup_planes(dev, state);
        drm_atomic_state_free(state);
+        end_atomic(dev->dev_private, c->crtc_mask);
        kfree(c);
 }
@@ -97,8 +143,9 @@ static void add_fb(struct msm_commit *c, struct drm_framebuffer *fb)
 int msm_atomic_commit(struct drm_device *dev,
                struct drm_atomic_state *state, bool async)
 {
-        struct msm_commit *c;
        int nplanes = dev->mode_config.num_total_plane;
+        int ncrtcs = dev->mode_config.num_crtc;
+        struct msm_commit *c;
        int i, ret;
        ret = drm_atomic_helper_prepare_planes(dev, state);
@@ -106,6 +153,18 @@ int msm_atomic_commit(struct drm_device *dev,
                return ret;
        c = new_commit(state);
+        if (!c)
+                return -ENOMEM;
+        /*
+         * Figure out what crtcs we have:
+         */
+        for (i = 0; i < ncrtcs; i++) {
+                struct drm_crtc *crtc = state->crtcs[i];
+                if (!crtc)
+                        continue;
+                c->crtc_mask |= (1 << drm_crtc_index(crtc));
+        }
        /*
         * Figure out what fence to wait for:
@@ -122,6 +181,14 @@ int msm_atomic_commit(struct drm_device *dev,
        }
        /*
+         * Wait for pending updates on any of the same crtc's and then
+         * mark our set of crtc's as busy:
+         */
+        ret = start_atomic(dev->dev_private, c->crtc_mask);
+        if (ret)
+                return ret;
+        /*
         * This is the point of no return - everything below never fails except
         * when the hw goes bonghits. Which means we can commit the new state on
         * the software side now.
diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c
index c795217e1bfc..9a61546a0b05 100644
--- a/drivers/gpu/drm/msm/msm_drv.c
+++ b/drivers/gpu/drm/msm/msm_drv.c
@@ -193,6 +193,7 @@ static int msm_load(struct drm_device *dev, unsigned long flags)
        priv->wq = alloc_ordered_workqueue("msm", 0);
        init_waitqueue_head(&priv->fence_event);
+        init_waitqueue_head(&priv->pending_crtcs_event);
        INIT_LIST_HEAD(&priv->inactive_list);
        INIT_LIST_HEAD(&priv->fence_cbs);
diff --git a/drivers/gpu/drm/msm/msm_drv.h b/drivers/gpu/drm/msm/msm_drv.h
index 136303818436..b69ef2d5a26c 100644
--- a/drivers/gpu/drm/msm/msm_drv.h
+++ b/drivers/gpu/drm/msm/msm_drv.h
@@ -96,6 +96,10 @@ struct msm_drm_private {
        /* callbacks deferred until bo is inactive: */
        struct list_head fence_cbs;
+        /* crtcs pending async atomic updates: */
+        uint32_t pending_crtcs;
+        wait_queue_head_t pending_crtcs_event;
        /* registered MMUs: */
        unsigned int num_mmus;
        struct msm_mmu *mmus[NUM_DOMAINS];
diff --git a/drivers/gpu/drm/msm/msm_fbdev.c b/drivers/gpu/drm/msm/msm_fbdev.c
index 94d55e526b4e..1f3af13ccede 100644
--- a/drivers/gpu/drm/msm/msm_fbdev.c
+++ b/drivers/gpu/drm/msm/msm_fbdev.c
@@ -190,8 +190,7 @@ fail_unlock:
 fail:
        if (ret) {
-                if (fbi)
+                framebuffer_release(fbi);
-                        framebuffer_release(fbi);
                if (fb) {
                        drm_framebuffer_unregister_private(fb);
                        drm_framebuffer_remove(fb);
diff --git a/drivers/gpu/drm/msm/msm_gem.c b/drivers/gpu/drm/msm/msm_gem.c
index 4a6f0e49d5b5..49dea4fb55ac 100644
--- a/drivers/gpu/drm/msm/msm_gem.c
+++ b/drivers/gpu/drm/msm/msm_gem.c
@@ -535,8 +535,7 @@ void msm_gem_free_object(struct drm_gem_object *obj)
                        drm_free_large(msm_obj->pages);
        } else {
-                if (msm_obj->vaddr)
+                vunmap(msm_obj->vaddr);
-                        vunmap(msm_obj->vaddr);
                put_pages(obj);
        }
diff --git a/drivers/gpu/drm/nouveau/nouveau_display.c b/drivers/gpu/drm/nouveau/nouveau_display.c
index 5d93902a91ab..f8042433752b 100644
--- a/drivers/gpu/drm/nouveau/nouveau_display.c
+++ b/drivers/gpu/drm/nouveau/nouveau_display.c
@@ -876,7 +876,6 @@ nouveau_display_dumb_create(struct drm_file *file_priv, struct drm_device *dev,
        if (ret)
                return ret;
-        bo->gem.dumb = true;
        ret = drm_gem_handle_create(file_priv, &bo->gem, &args->handle);
        drm_gem_object_unreference_unlocked(&bo->gem);
        return ret;
@@ -892,14 +891,6 @@ nouveau_display_dumb_map_offset(struct drm_file *file_priv,
        gem = drm_gem_object_lookup(dev, file_priv, handle);
        if (gem) {
                struct nouveau_bo *bo = nouveau_gem_object(gem);
-                /*
-                 * We don't allow dumb mmaps on objects created using another
-                 * interface.
-                 */
-                WARN_ONCE(!(gem->dumb || gem->import_attach),
-                          "Illegal dumb map of accelerated buffer.\n");
                *poffset = drm_vma_node_offset_addr(&bo->bo.vma_node);
                drm_gem_object_unreference_unlocked(gem);
                return 0;
diff --git a/drivers/gpu/drm/nouveau/nouveau_gem.c b/drivers/gpu/drm/nouveau/nouveau_gem.c
index 28d51a22a4bf..42c34babc2e5 100644
--- a/drivers/gpu/drm/nouveau/nouveau_gem.c
+++ b/drivers/gpu/drm/nouveau/nouveau_gem.c
@@ -444,9 +444,6 @@ validate_list(struct nouveau_channel *chan, struct nouveau_cli *cli,
        list_for_each_entry(nvbo, list, entry) {
                struct drm_nouveau_gem_pushbuf_bo *b = &pbbo[nvbo->pbbo_index];
-                WARN_ONCE(nvbo->gem.dumb,
-                          "GPU use of dumb buffer is illegal.\n");
                ret = nouveau_gem_set_domain(&nvbo->gem, b->read_domains,
                                             b->write_domains,
                                             b->valid_domains);
diff --git a/drivers/gpu/drm/nouveau/nouveau_ttm.c b/drivers/gpu/drm/nouveau/nouveau_ttm.c
index 753a6def61e7..3d1cfcb96b6b 100644
--- a/drivers/gpu/drm/nouveau/nouveau_ttm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_ttm.c
@@ -28,6 +28,7 @@
 #include "nouveau_ttm.h"
 #include "nouveau_gem.h"
+#include "drm_legacy.h"
 static int
 nouveau_vram_manager_init(struct ttm_mem_type_manager *man, unsigned long psize)
 {
@@ -281,7 +282,7 @@ nouveau_ttm_mmap(struct file *filp, struct vm_area_struct *vma)
        struct nouveau_drm *drm = nouveau_drm(file_priv->minor->dev);
        if (unlikely(vma->vm_pgoff < DRM_FILE_PAGE_OFFSET))
-                return -EINVAL;
+                return drm_legacy_mmap(filp, vma);
        return ttm_bo_mmap(filp, vma, &drm->ttm.bdev);
 }
diff --git a/drivers/gpu/drm/radeon/radeon_gem.c b/drivers/gpu/drm/radeon/radeon_gem.c
index fe48f229043e..a46f73737994 100644
--- a/drivers/gpu/drm/radeon/radeon_gem.c
+++ b/drivers/gpu/drm/radeon/radeon_gem.c
@@ -394,10 +394,9 @@ int radeon_gem_set_domain_ioctl(struct drm_device *dev, void *data,
        return r;
 }
-static int radeon_mode_mmap(struct drm_file *filp,
+int radeon_mode_dumb_mmap(struct drm_file *filp,
-                            struct drm_device *dev,
+                          struct drm_device *dev,
-                            uint32_t handle, bool dumb,
+                          uint32_t handle, uint64_t *offset_p)
-                            uint64_t *offset_p)
 {
        struct drm_gem_object *gobj;
        struct radeon_bo *robj;
@@ -406,14 +405,6 @@ static int radeon_mode_mmap(struct drm_file *filp,
        if (gobj == NULL) {
                return -ENOENT;
        }
-        /*
-         * We don't allow dumb mmaps on objects created using another
-         * interface.
-         */
-        WARN_ONCE(dumb && !(gobj->dumb || gobj->import_attach),
-                "Illegal dumb map of GPU buffer.\n");
        robj = gem_to_radeon_bo(gobj);
        if (radeon_ttm_tt_has_userptr(robj->tbo.ttm)) {
                drm_gem_object_unreference_unlocked(gobj);
@@ -424,20 +415,12 @@ static int radeon_mode_mmap(struct drm_file *filp,
        return 0;
 }
-int radeon_mode_dumb_mmap(struct drm_file *filp,
-                          struct drm_device *dev,
-                          uint32_t handle, uint64_t *offset_p)
-{
-        return radeon_mode_mmap(filp, dev, handle, true, offset_p);
-}
 int radeon_gem_mmap_ioctl(struct drm_device *dev, void *data,
                          struct drm_file *filp)
 {
        struct drm_radeon_gem_mmap *args = data;
-        return radeon_mode_mmap(filp, dev, args->handle, false,
+        return radeon_mode_dumb_mmap(filp, dev, args->handle, &args->addr_ptr);
-                                &args->addr_ptr);
 }
 int radeon_gem_busy_ioctl(struct drm_device *dev, void *data,
@@ -763,7 +746,6 @@ int radeon_mode_dumb_create(struct drm_file *file_priv,
                return -ENOMEM;
        r = drm_gem_handle_create(file_priv, gobj, &handle);
-        gobj->dumb = true;
        /* drop reference from allocate - handle holds it now */
        drm_gem_object_unreference_unlocked(gobj);
        if (r) {
diff --git a/drivers/gpu/drm/radeon/radeon_kfd.c b/drivers/gpu/drm/radeon/radeon_kfd.c
index 065d02068ec3..242fd8b1b221 100644
--- a/drivers/gpu/drm/radeon/radeon_kfd.c
+++ b/drivers/gpu/drm/radeon/radeon_kfd.c
@@ -28,6 +28,8 @@
 #include "cikd.h"
 #include "cik_reg.h"
 #include "radeon_kfd.h"
+#include "radeon_ucode.h"
+#include <linux/firmware.h>
 #define CIK_PIPE_PER_MEC        (4)
@@ -49,6 +51,7 @@ static uint64_t get_vmem_size(struct kgd_dev *kgd);
 static uint64_t get_gpu_clock_counter(struct kgd_dev *kgd);
 static uint32_t get_max_engine_clock_in_mhz(struct kgd_dev *kgd);
+static uint16_t get_fw_version(struct kgd_dev *kgd, enum kgd_engine_type type);
 /*
 * Register access functions
@@ -91,6 +94,7 @@ static const struct kfd2kgd_calls kfd2kgd = {
        .hqd_load = kgd_hqd_load,
        .hqd_is_occupies = kgd_hqd_is_occupies,
        .hqd_destroy = kgd_hqd_destroy,
+        .get_fw_version = get_fw_version
 };
 static const struct kgd2kfd_calls *kgd2kfd;
@@ -561,3 +565,52 @@ static int kgd_hqd_destroy(struct kgd_dev *kgd, uint32_t reset_type,
        release_queue(kgd);
        return 0;
 }
+static uint16_t get_fw_version(struct kgd_dev *kgd, enum kgd_engine_type type)
+{
+        struct radeon_device *rdev = (struct radeon_device *) kgd;
+        const union radeon_firmware_header *hdr;
+        BUG_ON(kgd == NULL || rdev->mec_fw == NULL);
+        switch (type) {
+        case KGD_ENGINE_PFP:
+                hdr = (const union radeon_firmware_header *) rdev->pfp_fw->data;
+                break;
+        case KGD_ENGINE_ME:
+                hdr = (const union radeon_firmware_header *) rdev->me_fw->data;
+                break;
+        case KGD_ENGINE_CE:
+                hdr = (const union radeon_firmware_header *) rdev->ce_fw->data;
+                break;
+        case KGD_ENGINE_MEC1:
+                hdr = (const union radeon_firmware_header *) rdev->mec_fw->data;
+                break;
+        case KGD_ENGINE_MEC2:
+                hdr = (const union radeon_firmware_header *)
+                                                        rdev->mec2_fw->data;
+                break;
+        case KGD_ENGINE_RLC:
+                hdr = (const union radeon_firmware_header *) rdev->rlc_fw->data;
+                break;
+        case KGD_ENGINE_SDMA:
+                hdr = (const union radeon_firmware_header *)
+                                                        rdev->sdma_fw->data;
+                break;
+        default:
+                return 0;
+        }
+        if (hdr == NULL)
+                return 0;
+        /* Only 12 bit in use*/
+        return hdr->common.ucode_version;
+}
diff --git a/drivers/gpu/drm/radeon/radeon_object.c b/drivers/gpu/drm/radeon/radeon_object.c
index 7d68223eb469..86fc56434b28 100644
--- a/drivers/gpu/drm/radeon/radeon_object.c
+++ b/drivers/gpu/drm/radeon/radeon_object.c
@@ -529,9 +529,6 @@ int radeon_bo_list_validate(struct radeon_device *rdev,
                        u32 current_domain =
                                radeon_mem_type_to_domain(bo->tbo.mem.mem_type);
-                        WARN_ONCE(bo->gem_base.dumb,
-                                  "GPU use of dumb buffer is illegal.\n");
                        /* Check if this buffer will be moved and don't move it
                         * if we have moved too many buffers for this IB already.
                         *
diff --git a/drivers/gpu/drm/tegra/dc.c b/drivers/gpu/drm/tegra/dc.c
index 3367960286a6..978993fa3a36 100644
--- a/drivers/gpu/drm/tegra/dc.c
+++ b/drivers/gpu/drm/tegra/dc.c
@@ -168,7 +168,7 @@ static int tegra_dc_setup_window(struct tegra_dc *dc, unsigned int index,
                                 const struct tegra_dc_window *window)
 {
        unsigned h_offset, v_offset, h_size, v_size, h_dda, v_dda, bpp;
-        unsigned long value;
+        unsigned long value, flags;
        bool yuv, planar;
        /*
@@ -181,6 +181,8 @@ static int tegra_dc_setup_window(struct tegra_dc *dc, unsigned int index,
        else
                bpp = planar ? 1 : 2;
+        spin_lock_irqsave(&dc->lock, flags);
        value = WINDOW_A_SELECT << index;
        tegra_dc_writel(dc, value, DC_CMD_DISPLAY_WINDOW_HEADER);
@@ -273,6 +275,7 @@ static int tegra_dc_setup_window(struct tegra_dc *dc, unsigned int index,
                case TEGRA_BO_TILING_MODE_BLOCK:
                        DRM_ERROR("hardware doesn't support block linear mode\n");
+                        spin_unlock_irqrestore(&dc->lock, flags);
                        return -EINVAL;
                }
@@ -331,6 +334,8 @@ static int tegra_dc_setup_window(struct tegra_dc *dc, unsigned int index,
        tegra_dc_window_commit(dc, index);
+        spin_unlock_irqrestore(&dc->lock, flags);
        return 0;
 }
@@ -338,11 +343,14 @@ static int tegra_window_plane_disable(struct drm_plane *plane)
 {
        struct tegra_dc *dc = to_tegra_dc(plane->crtc);
        struct tegra_plane *p = to_tegra_plane(plane);
+        unsigned long flags;
        u32 value;
        if (!plane->crtc)
                return 0;
+        spin_lock_irqsave(&dc->lock, flags);
        value = WINDOW_A_SELECT << p->index;
        tegra_dc_writel(dc, value, DC_CMD_DISPLAY_WINDOW_HEADER);
@@ -352,6 +360,8 @@ static int tegra_window_plane_disable(struct drm_plane *plane)
        tegra_dc_window_commit(dc, p->index);
+        spin_unlock_irqrestore(&dc->lock, flags);
        return 0;
 }
@@ -699,14 +709,16 @@ static int tegra_dc_set_base(struct tegra_dc *dc, int x, int y,
        struct tegra_bo *bo = tegra_fb_get_plane(fb, 0);
        unsigned int h_offset = 0, v_offset = 0;
        struct tegra_bo_tiling tiling;
+        unsigned long value, flags;
        unsigned int format, swap;
-        unsigned long value;
        int err;
        err = tegra_fb_get_tiling(fb, &tiling);
        if (err < 0)
                return err;
+        spin_lock_irqsave(&dc->lock, flags);
        tegra_dc_writel(dc, WINDOW_A_SELECT, DC_CMD_DISPLAY_WINDOW_HEADER);
        value = fb->offsets[0] + y * fb->pitches[0] +
@@ -752,6 +764,7 @@ static int tegra_dc_set_base(struct tegra_dc *dc, int x, int y,
                case TEGRA_BO_TILING_MODE_BLOCK:
                        DRM_ERROR("hardware doesn't support block linear mode\n");
+                        spin_unlock_irqrestore(&dc->lock, flags);
                        return -EINVAL;
                }
@@ -778,6 +791,8 @@ static int tegra_dc_set_base(struct tegra_dc *dc, int x, int y,
        tegra_dc_writel(dc, value << 8, DC_CMD_STATE_CONTROL);
        tegra_dc_writel(dc, value, DC_CMD_STATE_CONTROL);
+        spin_unlock_irqrestore(&dc->lock, flags);
        return 0;
 }
@@ -814,23 +829,32 @@ static void tegra_dc_finish_page_flip(struct tegra_dc *dc)
        unsigned long flags, base;
        struct tegra_bo *bo;
-        if (!dc->event)
+        spin_lock_irqsave(&drm->event_lock, flags);
+        if (!dc->event) {
+                spin_unlock_irqrestore(&drm->event_lock, flags);
                return;
+        }
        bo = tegra_fb_get_plane(crtc->primary->fb, 0);
+        spin_lock_irqsave(&dc->lock, flags);
        /* check if new start address has been latched */
+        tegra_dc_writel(dc, WINDOW_A_SELECT, DC_CMD_DISPLAY_WINDOW_HEADER);
        tegra_dc_writel(dc, READ_MUX, DC_CMD_STATE_ACCESS);
        base = tegra_dc_readl(dc, DC_WINBUF_START_ADDR);
        tegra_dc_writel(dc, 0, DC_CMD_STATE_ACCESS);
+        spin_unlock_irqrestore(&dc->lock, flags);
        if (base == bo->paddr + crtc->primary->fb->offsets[0]) {
-                spin_lock_irqsave(&drm->event_lock, flags);
+                drm_crtc_send_vblank_event(crtc, dc->event);
-                drm_send_vblank_event(drm, dc->pipe, dc->event);
+                drm_crtc_vblank_put(crtc);
-                drm_vblank_put(drm, dc->pipe);
                dc->event = NULL;
-                spin_unlock_irqrestore(&drm->event_lock, flags);
        }
+        spin_unlock_irqrestore(&drm->event_lock, flags);
 }
 void tegra_dc_cancel_page_flip(struct drm_crtc *crtc, struct drm_file *file)
@@ -843,7 +867,7 @@ void tegra_dc_cancel_page_flip(struct drm_crtc *crtc, struct drm_file *file)
        if (dc->event && dc->event->base.file_priv == file) {
                dc->event->base.destroy(&dc->event->base);
-                drm_vblank_put(drm, dc->pipe);
+                drm_crtc_vblank_put(crtc);
                dc->event = NULL;
        }
@@ -853,16 +877,16 @@ void tegra_dc_cancel_page_flip(struct drm_crtc *crtc, struct drm_file *file)
 static int tegra_dc_page_flip(struct drm_crtc *crtc, struct drm_framebuffer *fb,
                              struct drm_pending_vblank_event *event, uint32_t page_flip_flags)
 {
+        unsigned int pipe = drm_crtc_index(crtc);
        struct tegra_dc *dc = to_tegra_dc(crtc);
-        struct drm_device *drm = crtc->dev;
        if (dc->event)
                return -EBUSY;
        if (event) {
-                event->pipe = dc->pipe;
+                event->pipe = pipe;
                dc->event = event;
-                drm_vblank_get(drm, dc->pipe);
+                drm_crtc_vblank_get(crtc);
        }
        tegra_dc_set_base(dc, 0, 0, fb);
@@ -1127,7 +1151,7 @@ static irqreturn_t tegra_dc_irq(int irq, void *data)
                /*
                dev_dbg(dc->dev, "%s(): vertical blank\n", __func__);
                */
-                drm_handle_vblank(dc->base.dev, dc->pipe);
+                drm_crtc_handle_vblank(&dc->base);
                tegra_dc_finish_page_flip(dc);
        }
diff --git a/drivers/gpu/drm/tegra/drm.c b/drivers/gpu/drm/tegra/drm.c
index e549afeece1f..d4f827593dfa 100644
--- a/drivers/gpu/drm/tegra/drm.c
+++ b/drivers/gpu/drm/tegra/drm.c
@@ -694,24 +694,28 @@ static const struct file_operations tegra_drm_fops = {
        .llseek = noop_llseek,
 };
-static struct drm_crtc *tegra_crtc_from_pipe(struct drm_device *drm, int pipe)
+static struct drm_crtc *tegra_crtc_from_pipe(struct drm_device *drm,
+                                             unsigned int pipe)
 {
        struct drm_crtc *crtc;
        list_for_each_entry(crtc, &drm->mode_config.crtc_list, head) {
-                struct tegra_dc *dc = to_tegra_dc(crtc);
+                if (pipe == drm_crtc_index(crtc))
-                if (dc->pipe == pipe)
                        return crtc;
        }
        return NULL;
 }
-static u32 tegra_drm_get_vblank_counter(struct drm_device *dev, int crtc)
+static u32 tegra_drm_get_vblank_counter(struct drm_device *drm, int pipe)
 {
+        struct drm_crtc *crtc = tegra_crtc_from_pipe(drm, pipe);
+        if (!crtc)
+                return 0;
        /* TODO: implement real hardware counter using syncpoints */
-        return drm_vblank_count(dev, crtc);
+        return drm_crtc_vblank_count(crtc);
 }
 static int tegra_drm_enable_vblank(struct drm_device *drm, int pipe)
diff --git a/drivers/gpu/drm/tegra/gem.c b/drivers/gpu/drm/tegra/gem.c
index da32086cbeaf..8777b7f75791 100644
--- a/drivers/gpu/drm/tegra/gem.c
+++ b/drivers/gpu/drm/tegra/gem.c
@@ -216,32 +216,58 @@ static void tegra_bo_free(struct drm_device *drm, struct tegra_bo *bo)
        }
 }
-static int tegra_bo_get_pages(struct drm_device *drm, struct tegra_bo *bo,
+static int tegra_bo_get_pages(struct drm_device *drm, struct tegra_bo *bo)
-                              size_t size)
 {
+        struct scatterlist *s;
+        struct sg_table *sgt;
+        unsigned int i;
        bo->pages = drm_gem_get_pages(&bo->gem);
        if (IS_ERR(bo->pages))
                return PTR_ERR(bo->pages);
-        bo->num_pages = size >> PAGE_SHIFT;
+        bo->num_pages = bo->gem.size >> PAGE_SHIFT;
-        bo->sgt = drm_prime_pages_to_sg(bo->pages, bo->num_pages);
+        sgt = drm_prime_pages_to_sg(bo->pages, bo->num_pages);
-        if (IS_ERR(bo->sgt)) {
+        if (IS_ERR(sgt))
-                drm_gem_put_pages(&bo->gem, bo->pages, false, false);
+                goto put_pages;
-                return PTR_ERR(bo->sgt);
+        /*
+         * Fake up the SG table so that dma_map_sg() can be used to flush the
+         * pages associated with it. Note that this relies on the fact that
+         * the DMA API doesn't hook into IOMMU on Tegra, therefore mapping is
+         * only cache maintenance.
+         *
+         * TODO: Replace this by drm_clflash_sg() once it can be implemented
+         * without relying on symbols that are not exported.
+         */
+        for_each_sg(sgt->sgl, s, sgt->nents, i)
+                sg_dma_address(s) = sg_phys(s);
+        if (dma_map_sg(drm->dev, sgt->sgl, sgt->nents, DMA_TO_DEVICE) == 0) {
+                sgt = ERR_PTR(-ENOMEM);
+                goto release_sgt;
        }
+        bo->sgt = sgt;
        return 0;
+release_sgt:
+        sg_free_table(sgt);
+        kfree(sgt);
+put_pages:
+        drm_gem_put_pages(&bo->gem, bo->pages, false, false);
+        return PTR_ERR(sgt);
 }
-static int tegra_bo_alloc(struct drm_device *drm, struct tegra_bo *bo,
+static int tegra_bo_alloc(struct drm_device *drm, struct tegra_bo *bo)
-                          size_t size)
 {
        struct tegra_drm *tegra = drm->dev_private;
        int err;
        if (tegra->domain) {
-                err = tegra_bo_get_pages(drm, bo, size);
+                err = tegra_bo_get_pages(drm, bo);
                if (err < 0)
                        return err;
@@ -251,6 +277,8 @@ static int tegra_bo_alloc(struct drm_device *drm, struct tegra_bo *bo,
                        return err;
                }
        } else {
+                size_t size = bo->gem.size;
                bo->vaddr = dma_alloc_writecombine(drm->dev, size, &bo->paddr,
                                                   GFP_KERNEL | __GFP_NOWARN);
                if (!bo->vaddr) {
@@ -274,7 +302,7 @@ struct tegra_bo *tegra_bo_create(struct drm_device *drm, size_t size,
        if (IS_ERR(bo))
                return bo;
-        err = tegra_bo_alloc(drm, bo, size);
+        err = tegra_bo_alloc(drm, bo);
        if (err < 0)
                goto release;
diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
index 8735543eacdb..493478989dbd 100644
--- a/drivers/md/dm-thin.c
+++ b/drivers/md/dm-thin.c
@@ -1127,6 +1127,24 @@ static void schedule_external_copy(struct thin_c *tc, dm_block_t virt_block,
                schedule_zero(tc, virt_block, data_dest, cell, bio);
 }
+static void set_pool_mode(struct pool *pool, enum pool_mode new_mode);
+static void check_for_space(struct pool *pool)
+{
+        int r;
+        dm_block_t nr_free;
+        if (get_pool_mode(pool) != PM_OUT_OF_DATA_SPACE)
+                return;
+        r = dm_pool_get_free_block_count(pool->pmd, &nr_free);
+        if (r)
+                return;
+        if (nr_free)
+                set_pool_mode(pool, PM_WRITE);
+}
 /*
 * A non-zero return indicates read_only or fail_io mode.
 * Many callers don't care about the return value.
@@ -1141,6 +1159,8 @@ static int commit(struct pool *pool)
        r = dm_pool_commit_metadata(pool->pmd);
        if (r)
                metadata_operation_failed(pool, "dm_pool_commit_metadata", r);
+        else
+                check_for_space(pool);
        return r;
 }
@@ -1159,8 +1179,6 @@ static void check_low_water_mark(struct pool *pool, dm_block_t free_blocks)
        }
 }
-static void set_pool_mode(struct pool *pool, enum pool_mode new_mode);
 static int alloc_data_block(struct thin_c *tc, dm_block_t *result)
 {
        int r;
@@ -2155,7 +2173,7 @@ static void set_pool_mode(struct pool *pool, enum pool_mode new_mode)
                pool->process_cell = process_cell_read_only;
                pool->process_discard_cell = process_discard_cell;
                pool->process_prepared_mapping = process_prepared_mapping;
-                pool->process_prepared_discard = process_prepared_discard_passdown;
+                pool->process_prepared_discard = process_prepared_discard;
                if (!pool->pf.error_if_no_space && no_space_timeout)
                        queue_delayed_work(pool->wq, &pool->no_space_timeout, no_space_timeout);
@@ -3814,6 +3832,8 @@ static int thin_ctr(struct dm_target *ti, unsigned argc, char **argv)
                r = -EINVAL;
                goto bad;
        }
+        atomic_set(&tc->refcount, 1);
+        init_completion(&tc->can_destroy);
        list_add_tail_rcu(&tc->list, &tc->pool->active_thins);
        spin_unlock_irqrestore(&tc->pool->lock, flags);
        /*
@@ -3826,9 +3846,6 @@ static int thin_ctr(struct dm_target *ti, unsigned argc, char **argv)
        dm_put(pool_md);
-        atomic_set(&tc->refcount, 1);
-        init_completion(&tc->can_destroy);
        return 0;
 bad:
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index 4c06585bf165..b98cd9d84435 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -899,7 +899,7 @@ static void disable_write_same(struct mapped_device *md)
 static void clone_endio(struct bio *bio, int error)
 {
-        int r = 0;
+        int r = error;
        struct dm_target_io *tio = container_of(bio, struct dm_target_io, clone);
        struct dm_io *io = tio->io;
        struct mapped_device *md = tio->io->md;
diff --git a/drivers/staging/lustre/lustre/llite/namei.c b/drivers/staging/lustre/lustre/llite/namei.c
index 1bf891bd321a..4f361b77c749 100644
--- a/drivers/staging/lustre/lustre/llite/namei.c
+++ b/drivers/staging/lustre/lustre/llite/namei.c
@@ -264,7 +264,7 @@ int ll_md_blocking_ast(struct ldlm_lock *lock, struct ldlm_lock_desc *desc,
                if ((bits & (MDS_INODELOCK_LOOKUP | MDS_INODELOCK_PERM)) &&
                    inode->i_sb->s_root != NULL &&
-                    is_root_inode(inode))
+                    !is_root_inode(inode))
                        ll_invalidate_aliases(inode);
                iput(inode);
diff --git a/include/drm/drmP.h b/include/drm/drmP.h
index 8ba35c622e22..e1b2e8b98af7 100644
--- a/include/drm/drmP.h
+++ b/include/drm/drmP.h
@@ -901,11 +901,15 @@ extern int drm_vblank_init(struct drm_device *dev, int num_crtcs);
 extern int drm_wait_vblank(struct drm_device *dev, void *data,
                           struct drm_file *filp);
 extern u32 drm_vblank_count(struct drm_device *dev, int crtc);
+extern u32 drm_crtc_vblank_count(struct drm_crtc *crtc);
 extern u32 drm_vblank_count_and_time(struct drm_device *dev, int crtc,
                                     struct timeval *vblanktime);
 extern void drm_send_vblank_event(struct drm_device *dev, int crtc,
                                     struct drm_pending_vblank_event *e);
+extern void drm_crtc_send_vblank_event(struct drm_crtc *crtc,
+                                       struct drm_pending_vblank_event *e);
 extern bool drm_handle_vblank(struct drm_device *dev, int crtc);
+extern bool drm_crtc_handle_vblank(struct drm_crtc *crtc);
 extern int drm_vblank_get(struct drm_device *dev, int crtc);
 extern void drm_vblank_put(struct drm_device *dev, int crtc);
 extern int drm_crtc_vblank_get(struct drm_crtc *crtc);
diff --git a/include/drm/drm_gem.h b/include/drm/drm_gem.h
index 780511a459c0..1e6ae1458f7a 100644
--- a/include/drm/drm_gem.h
+++ b/include/drm/drm_gem.h
@@ -119,13 +119,6 @@ struct drm_gem_object {
         * simply leave it as NULL.
         */
        struct dma_buf_attachment *import_attach;
-        /**
-         * dumb - created as dumb buffer
-         * Whether the gem object was created using the dumb buffer interface
-         * as such it may not be used for GPU rendering.
-         */
-        bool dumb;
 };
 void drm_gem_object_release(struct drm_gem_object *obj);
diff --git a/include/linux/audit.h b/include/linux/audit.h
index 0c04917c2f12..af84234e1f6e 100644
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -47,6 +47,7 @@ struct sk_buff;
 struct audit_krule {
        int                     vers_ops;
+        u32                     pflags;
        u32                     flags;
        u32                     listnr;
        u32                     action;
@@ -64,6 +65,9 @@ struct audit_krule {
        u64                     prio;
 };
+/* Flag to indicate legacy AUDIT_LOGINUID unset usage */
+#define AUDIT_LOGINUID_LEGACY           0x1
 struct audit_field {
        u32                             type;
        union {
diff --git a/kernel/audit.c b/kernel/audit.c
index f8f203e8018c..231b7dcb154b 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -429,7 +429,7 @@ static void kauditd_send_skb(struct sk_buff *skb)
 * This function doesn't consume an skb as might be expected since it has to
 * copy it anyways.
 */
-static void kauditd_send_multicast_skb(struct sk_buff *skb)
+static void kauditd_send_multicast_skb(struct sk_buff *skb, gfp_t gfp_mask)
 {
        struct sk_buff          *copy;
        struct audit_net        *aunet = net_generic(&init_net, audit_net_id);
@@ -448,11 +448,11 @@ static void kauditd_send_multicast_skb(struct sk_buff *skb)
         * no reason for new multicast clients to continue with this
         * non-compliance.
         */
-        copy = skb_copy(skb, GFP_KERNEL);
+        copy = skb_copy(skb, gfp_mask);
        if (!copy)
                return;
-        nlmsg_multicast(sock, copy, 0, AUDIT_NLGRP_READLOG, GFP_KERNEL);
+        nlmsg_multicast(sock, copy, 0, AUDIT_NLGRP_READLOG, gfp_mask);
 }
 /*
@@ -1940,7 +1940,7 @@ void audit_log_end(struct audit_buffer *ab)
                struct nlmsghdr *nlh = nlmsg_hdr(ab->skb);
                nlh->nlmsg_len = ab->skb->len;
-                kauditd_send_multicast_skb(ab->skb);
+                kauditd_send_multicast_skb(ab->skb, ab->gfp_mask);
                /*
                 * The original kaudit unicast socket sends up messages with
diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c
index 3598e13f2a65..4f68a326d92e 100644
--- a/kernel/auditfilter.c
+++ b/kernel/auditfilter.c
@@ -442,19 +442,7 @@ static struct audit_entry *audit_data_to_entry(struct audit_rule_data *data,
                if ((f->type == AUDIT_LOGINUID) && (f->val == AUDIT_UID_UNSET)) {
                        f->type = AUDIT_LOGINUID_SET;
                        f->val = 0;
-                }
+                        entry->rule.pflags |= AUDIT_LOGINUID_LEGACY;
-                if ((f->type == AUDIT_PID) || (f->type == AUDIT_PPID)) {
-                        struct pid *pid;
-                        rcu_read_lock();
-                        pid = find_vpid(f->val);
-                        if (!pid) {
-                                rcu_read_unlock();
-                                err = -ESRCH;
-                                goto exit_free;
-                        }
-                        f->val = pid_nr(pid);
-                        rcu_read_unlock();
                }
                err = audit_field_valid(entry, f);
@@ -630,6 +618,13 @@ static struct audit_rule_data *audit_krule_to_data(struct audit_krule *krule)
                        data->buflen += data->values[i] =
                                audit_pack_string(&bufp, krule->filterkey);
                        break;
+                case AUDIT_LOGINUID_SET:
+                        if (krule->pflags & AUDIT_LOGINUID_LEGACY && !f->val) {
+                                data->fields[i] = AUDIT_LOGINUID;
+                                data->values[i] = AUDIT_UID_UNSET;
+                                break;
+                        }
+                        /* fallthrough if set */
                default:
                        data->values[i] = f->val;
                }
@@ -646,6 +641,7 @@ static int audit_compare_rule(struct audit_krule *a, struct audit_krule *b)
        int i;
        if (a->flags != b->flags ||
+            a->pflags != b->pflags ||
            a->listnr != b->listnr ||
            a->action != b->action ||
            a->field_count != b->field_count)
@@ -764,6 +760,7 @@ struct audit_entry *audit_dupe_rule(struct audit_krule *old)
        new = &entry->rule;
        new->vers_ops = old->vers_ops;
        new->flags = old->flags;
+        new->pflags = old->pflags;
        new->listnr = old->listnr;
        new->action = old->action;
        for (i = 0; i < AUDIT_BITMASK_SIZE; i++)
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index c75522a83678..37c69ab561da 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -1877,12 +1877,18 @@ void __audit_inode(struct filename *name, const struct dentry *dentry,
        }
 out_alloc:
-        /* unable to find the name from a previous getname(). Allocate a new
+        /* unable to find an entry with both a matching name and type */
-         * anonymous entry.
+        n = audit_alloc_name(context, AUDIT_TYPE_UNKNOWN);
-         */
-        n = audit_alloc_name(context, AUDIT_TYPE_NORMAL);
        if (!n)
                return;
+        if (name)
+                /* since name is not NULL we know there is already a matching
+                 * name record, see audit_getname(), so there must be a type
+                 * mismatch; reuse the string path since the original name
+                 * record will keep the string valid until we free it in
+                 * audit_free_names() */
+                n->name = name;
 out:
        if (parent) {
                n->name_len = n->name ? parent_len(n->name->name) : AUDIT_NAME_FULL;
diff --git a/mm/memory.c b/mm/memory.c
index 649e7d440bd7..ca920d1fd314 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -2378,12 +2378,12 @@ void unmap_mapping_range(struct address_space *mapping,
                details.last_index = ULONG_MAX;
-        i_mmap_lock_read(mapping);
+        i_mmap_lock_write(mapping);
        if (unlikely(!RB_EMPTY_ROOT(&mapping->i_mmap)))
                unmap_mapping_range_tree(&mapping->i_mmap, &details);
        if (unlikely(!list_empty(&mapping->i_mmap_nonlinear)))
                unmap_mapping_range_list(&mapping->i_mmap_nonlinear, &details);
-        i_mmap_unlock_read(mapping);
+        i_mmap_unlock_write(mapping);
 }
 EXPORT_SYMBOL(unmap_mapping_range);
diff --git a/sound/pci/hda/hda_controller.c b/sound/pci/hda/hda_controller.c
index 8276a743e22e..0cfc9c8c4b4e 100644
--- a/sound/pci/hda/hda_controller.c
+++ b/sound/pci/hda/hda_controller.c
@@ -1922,10 +1922,18 @@ int azx_mixer_create(struct azx *chip)
 EXPORT_SYMBOL_GPL(azx_mixer_create);
+static bool is_input_stream(struct azx *chip, unsigned char index)
+{
+        return (index >= chip->capture_index_offset &&
+                index < chip->capture_index_offset + chip->capture_streams);
+}
 /* initialize SD streams */
 int azx_init_stream(struct azx *chip)
 {
        int i;
+        int in_stream_tag = 0;
+        int out_stream_tag = 0;
        /* initialize each stream (aka device)
         * assign the starting bdl address to each stream (device)
@@ -1938,9 +1946,21 @@ int azx_init_stream(struct azx *chip)
                azx_dev->sd_addr = chip->remap_addr + (0x20 * i + 0x80);
                /* int mask: SDI0=0x01, SDI1=0x02, ... SDO3=0x80 */
                azx_dev->sd_int_sta_mask = 1 << i;
-                /* stream tag: must be non-zero and unique */
                azx_dev->index = i;
-                azx_dev->stream_tag = i + 1;
+                /* stream tag must be unique throughout
+                 * the stream direction group,
+                 * valid values 1...15
+                 * use separate stream tag if the flag
+                 * AZX_DCAPS_SEPARATE_STREAM_TAG is used
+                 */
+                if (chip->driver_caps & AZX_DCAPS_SEPARATE_STREAM_TAG)
+                        azx_dev->stream_tag =
+                                is_input_stream(chip, i) ?
+                                ++in_stream_tag :
+                                ++out_stream_tag;
+                else
+                        azx_dev->stream_tag = i + 1;
        }
        return 0;
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index 2bf0b568e3de..d426a0bd6a5f 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -299,6 +299,9 @@ enum {
         AZX_DCAPS_PM_RUNTIME | AZX_DCAPS_I915_POWERWELL |\
         AZX_DCAPS_SNOOP_TYPE(SCH))
+#define AZX_DCAPS_INTEL_SKYLAKE \
+        (AZX_DCAPS_INTEL_PCH | AZX_DCAPS_SEPARATE_STREAM_TAG)
 /* quirks for ATI SB / AMD Hudson */
 #define AZX_DCAPS_PRESET_ATI_SB \
        (AZX_DCAPS_NO_TCSEL | AZX_DCAPS_SYNC_WRITE | AZX_DCAPS_POSFIX_LPIB |\
@@ -2027,7 +2030,7 @@ static const struct pci_device_id azx_ids[] = {
          .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH },
        /* Sunrise Point-LP */
        { PCI_DEVICE(0x8086, 0x9d70),
-          .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH },
+          .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_SKYLAKE },
        /* Haswell */
        { PCI_DEVICE(0x8086, 0x0a0c),
          .driver_data = AZX_DRIVER_HDMI | AZX_DCAPS_INTEL_HASWELL },
diff --git a/sound/pci/hda/hda_priv.h b/sound/pci/hda/hda_priv.h
index aa484fdf4338..166e3e84b963 100644
--- a/sound/pci/hda/hda_priv.h
+++ b/sound/pci/hda/hda_priv.h
@@ -171,6 +171,7 @@ enum { SDI0, SDI1, SDI2, SDI3, SDO0, SDO1, SDO2, SDO3 };
 #define AZX_DCAPS_I915_POWERWELL (1 << 27)      /* HSW i915 powerwell support */
 #define AZX_DCAPS_CORBRP_SELF_CLEAR (1 << 28)   /* CORBRP clears itself after reset */
 #define AZX_DCAPS_NO_MSI64      (1 << 29)       /* Stick to 32-bit MSIs */
+#define AZX_DCAPS_SEPARATE_STREAM_TAG   (1 << 30) /* capture and playback use separate stream tag */
 enum {
        AZX_SNOOP_TYPE_NONE ,
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index f5283438ee05..1cc6e2e19982 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -671,6 +671,7 @@ static void update_memslots(struct kvm_memslots *slots,
        WARN_ON(mslots[i].id != id);
        if (!new->npages) {
+                WARN_ON(!mslots[i].npages);
                new->base_gfn = 0;
                if (mslots[i].npages)
                        slots->used_slots--;
@@ -687,12 +688,25 @@ static void update_memslots(struct kvm_memslots *slots,
                slots->id_to_index[mslots[i].id] = i;
                i++;
        }
-        while (i > 0 &&
-               new->base_gfn > mslots[i - 1].base_gfn) {
+        /*
-                mslots[i] = mslots[i - 1];
+         * The ">=" is needed when creating a slot with base_gfn == 0,
-                slots->id_to_index[mslots[i].id] = i;
+         * so that it moves before all those with base_gfn == npages == 0.
-                i--;
+         *
-        }
+         * On the other hand, if new->npages is zero, the above loop has
+         * already left i pointing to the beginning of the empty part of
+         * mslots, and the ">=" would move the hole backwards in this
+         * case---which is wrong.  So skip the loop when deleting a slot.
+         */
+        if (new->npages) {
+                while (i > 0 &&
+                       new->base_gfn >= mslots[i - 1].base_gfn) {
+                        mslots[i] = mslots[i - 1];
+                        slots->id_to_index[mslots[i].id] = i;
+                        i--;
+                }
+        } else
+                WARN_ON_ONCE(i != slots->used_slots);
        mslots[i] = *new;
        slots->id_to_index[mslots[i].id] = i;