39 files changed, 209 insertions, 167 deletions

diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index 245058b3b0ef..88acf8bc1490 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -6,6 +6,7 @@ config ARM
         select ARCH_HAS_TICK_BROADCAST if GENERIC_CLOCKEVENTS_BROADCAST
         select ARCH_HAVE_CUSTOM_GPIO_H
         select ARCH_MIGHT_HAVE_PC_PARPORT
+        select ARCH_SUPPORTS_ATOMIC_RMW
         select ARCH_USE_BUILTIN_BSWAP
         select ARCH_USE_CMPXCHG_LOCKREF
         select ARCH_WANT_IPC_PARSE_VERSION
diff --git a/arch/arm/boot/dts/at91sam9n12.dtsi b/arch/arm/boot/dts/at91sam9n12.dtsi
index 287795985e32..b84bac5bada4 100644
--- a/arch/arm/boot/dts/at91sam9n12.dtsi
+++ b/arch/arm/boot/dts/at91sam9n12.dtsi
@@ -925,7 +925,7 @@
                         compatible = "atmel,at91rm9200-ohci", "usb-ohci";
                         reg = <0x00500000 0x00100000>;
                         interrupts = <22 IRQ_TYPE_LEVEL_HIGH 2>;
-                        clocks = <&usb>, <&uhphs_clk>, <&udphs_clk>,
+                        clocks = <&usb>, <&uhphs_clk>, <&uhphs_clk>,
                                  <&uhpck>;
                         clock-names = "usb_clk", "ohci_clk", "hclk", "uhpck";
                         status = "disabled";
diff --git a/arch/arm/boot/dts/at91sam9x5.dtsi b/arch/arm/boot/dts/at91sam9x5.dtsi
index 2ebc42140ea6..2c0d6ea3ab41 100644
--- a/arch/arm/boot/dts/at91sam9x5.dtsi
+++ b/arch/arm/boot/dts/at91sam9x5.dtsi
@@ -1124,6 +1124,7 @@
                                 compatible = "atmel,at91sam9rl-pwm";
                                 reg = <0xf8034000 0x300>;
                                 interrupts = <18 IRQ_TYPE_LEVEL_HIGH 4>;
+                                clocks = <&pwm_clk>;
                                 #pwm-cells = <3>;
                                 status = "disabled";
                         };
@@ -1155,8 +1156,7 @@
                         compatible = "atmel,at91rm9200-ohci", "usb-ohci";
                         reg = <0x00600000 0x100000>;
                         interrupts = <22 IRQ_TYPE_LEVEL_HIGH 2>;
-                        clocks = <&usb>, <&uhphs_clk>, <&udphs_clk>,
-                                 <&uhpck>;
+                        clocks = <&usb>, <&uhphs_clk>, <&uhphs_clk>, <&uhpck>;
                         clock-names = "usb_clk", "ohci_clk", "hclk", "uhpck";
                         status = "disabled";
                 };
diff --git a/arch/arm/mach-exynos/hotplug.c b/arch/arm/mach-exynos/hotplug.c
index 8a134d019cb3..920a4baa53cd 100644
--- a/arch/arm/mach-exynos/hotplug.c
+++ b/arch/arm/mach-exynos/hotplug.c
@@ -40,15 +40,17 @@ static inline void cpu_leave_lowpower(void)
 
 static inline void platform_do_lowpower(unsigned int cpu, int *spurious)
 {
+        u32 mpidr = cpu_logical_map(cpu);
+        u32 core_id = MPIDR_AFFINITY_LEVEL(mpidr, 0);
+
         for (;;) {
 
-                /* make cpu1 to be turned off at next WFI command */
-                if (cpu == 1)
-                        exynos_cpu_power_down(cpu);
+                /* Turn the CPU off on next WFI instruction. */
+                exynos_cpu_power_down(core_id);
 
                 wfi();
 
-                if (pen_release == cpu_logical_map(cpu)) {
+                if (pen_release == core_id) {
                         /*
                          * OK, proper wakeup, we're done
                          */
diff --git a/arch/arm/mach-exynos/platsmp.c b/arch/arm/mach-exynos/platsmp.c
index 1c8d31e39520..50b9aad5e27b 100644
--- a/arch/arm/mach-exynos/platsmp.c
+++ b/arch/arm/mach-exynos/platsmp.c
@@ -90,7 +90,8 @@ static void exynos_secondary_init(unsigned int cpu)
 static int exynos_boot_secondary(unsigned int cpu, struct task_struct *idle)
 {
         unsigned long timeout;
-        unsigned long phys_cpu = cpu_logical_map(cpu);
+        u32 mpidr = cpu_logical_map(cpu);
+        u32 core_id = MPIDR_AFFINITY_LEVEL(mpidr, 0);
         int ret = -ENOSYS;
 
         /*
@@ -104,17 +105,18 @@ static int exynos_boot_secondary(unsigned int cpu, struct task_struct *idle)
          * the holding pen - release it, then wait for it to flag
          * that it has been released by resetting pen_release.
          *
-         * Note that "pen_release" is the hardware CPU ID, whereas
+         * Note that "pen_release" is the hardware CPU core ID, whereas
          * "cpu" is Linux's internal ID.
          */
-        write_pen_release(phys_cpu);
+        write_pen_release(core_id);
 
-        if (!exynos_cpu_power_state(cpu)) {
-                exynos_cpu_power_up(cpu);
+        if (!exynos_cpu_power_state(core_id)) {
+                exynos_cpu_power_up(core_id);
                 timeout = 10;
 
                 /* wait max 10 ms until cpu1 is on */
-                while (exynos_cpu_power_state(cpu) != S5P_CORE_LOCAL_PWR_EN) {
+                while (exynos_cpu_power_state(core_id)
+                       != S5P_CORE_LOCAL_PWR_EN) {
                         if (timeout-- == 0)
                                 break;
 
@@ -145,20 +147,20 @@ static int exynos_boot_secondary(unsigned int cpu, struct task_struct *idle)
                  * Try to set boot address using firmware first
                  * and fall back to boot register if it fails.
                  */
-                ret = call_firmware_op(set_cpu_boot_addr, phys_cpu, boot_addr);
+                ret = call_firmware_op(set_cpu_boot_addr, core_id, boot_addr);
                 if (ret && ret != -ENOSYS)
                         goto fail;
                 if (ret == -ENOSYS) {
-                        void __iomem *boot_reg = cpu_boot_reg(phys_cpu);
+                        void __iomem *boot_reg = cpu_boot_reg(core_id);
 
                         if (IS_ERR(boot_reg)) {
                                 ret = PTR_ERR(boot_reg);
                                 goto fail;
                         }
-                        __raw_writel(boot_addr, cpu_boot_reg(phys_cpu));
+                        __raw_writel(boot_addr, cpu_boot_reg(core_id));
                 }
 
-                call_firmware_op(cpu_boot, phys_cpu);
+                call_firmware_op(cpu_boot, core_id);
 
                 arch_send_wakeup_ipi_mask(cpumask_of(cpu));
 
@@ -227,22 +229,24 @@ static void __init exynos_smp_prepare_cpus(unsigned int max_cpus)
          * boot register if it fails.
          */
         for (i = 1; i < max_cpus; ++i) {
-                unsigned long phys_cpu;
                 unsigned long boot_addr;
+                u32 mpidr;
+                u32 core_id;
                 int ret;
 
-                phys_cpu = cpu_logical_map(i);
+                mpidr = cpu_logical_map(i);
+                core_id = MPIDR_AFFINITY_LEVEL(mpidr, 0);
                 boot_addr = virt_to_phys(exynos4_secondary_startup);
 
-                ret = call_firmware_op(set_cpu_boot_addr, phys_cpu, boot_addr);
+                ret = call_firmware_op(set_cpu_boot_addr, core_id, boot_addr);
                 if (ret && ret != -ENOSYS)
                         break;
                 if (ret == -ENOSYS) {
-                        void __iomem *boot_reg = cpu_boot_reg(phys_cpu);
+                        void __iomem *boot_reg = cpu_boot_reg(core_id);
 
                         if (IS_ERR(boot_reg))
                                 break;
-                        __raw_writel(boot_addr, cpu_boot_reg(phys_cpu));
+                        __raw_writel(boot_addr, cpu_boot_reg(core_id));
                 }
         }
 }
diff --git a/arch/arm/mach-imx/clk-imx6q.c b/arch/arm/mach-imx/clk-imx6q.c
index 8e795dea02ec..8556c787e59c 100644
--- a/arch/arm/mach-imx/clk-imx6q.c
+++ b/arch/arm/mach-imx/clk-imx6q.c
@@ -70,7 +70,7 @@ static const char *cko_sels[] = { "cko1", "cko2", };
 static const char *lvds_sels[] = {
         "dummy", "dummy", "dummy", "dummy", "dummy", "dummy",
         "pll4_audio", "pll5_video", "pll8_mlb", "enet_ref",
-        "pcie_ref", "sata_ref",
+        "pcie_ref_125m", "sata_ref_100m",
 };
 
 enum mx6q_clks {
@@ -491,7 +491,7 @@ static void __init imx6q_clocks_init(struct device_node *ccm_node)
 
         /* All existing boards with PCIe use LVDS1 */
         if (IS_ENABLED(CONFIG_PCI_IMX6))
-                clk_set_parent(clk[lvds1_sel], clk[sata_ref]);
+                clk_set_parent(clk[lvds1_sel], clk[sata_ref_100m]);
 
         /* Set initial power mode */
         imx6q_set_lpm(WAIT_CLOCKED);
diff --git a/arch/arm/mach-mvebu/coherency.c b/arch/arm/mach-mvebu/coherency.c
index 477202fd39cc..2bdc3233abe2 100644
--- a/arch/arm/mach-mvebu/coherency.c
+++ b/arch/arm/mach-mvebu/coherency.c
@@ -292,6 +292,10 @@ static struct notifier_block mvebu_hwcc_nb = {
         .notifier_call = mvebu_hwcc_notifier,
 };
 
+static struct notifier_block mvebu_hwcc_pci_nb = {
+        .notifier_call = mvebu_hwcc_notifier,
+};
+
 static void __init armada_370_coherency_init(struct device_node *np)
 {
         struct resource res;
@@ -427,7 +431,7 @@ static int __init coherency_pci_init(void)
 {
         if (coherency_available())
                 bus_register_notifier(&pci_bus_type,
-                                       &mvebu_hwcc_nb);
+                                       &mvebu_hwcc_pci_nb);
         return 0;
 }
 
diff --git a/arch/arm/mach-mvebu/headsmp-a9.S b/arch/arm/mach-mvebu/headsmp-a9.S
index 5925366bc03c..da5bb292b91c 100644
--- a/arch/arm/mach-mvebu/headsmp-a9.S
+++ b/arch/arm/mach-mvebu/headsmp-a9.S
@@ -15,6 +15,8 @@
 #include <linux/linkage.h>
 #include <linux/init.h>
 
+#include <asm/assembler.h>
+
         __CPUINIT
 #define CPU_RESUME_ADDR_REG 0xf10182d4
 
@@ -22,13 +24,18 @@
 .global armada_375_smp_cpu1_enable_code_end
 
 armada_375_smp_cpu1_enable_code_start:
-        ldr     r0, [pc, #4]
+ARM_BE8(setend  be)
+        adr     r0, 1f
+        ldr     r0, [r0]
         ldr     r1, [r0]
+ARM_BE8(rev     r1, r1)
         mov     pc, r1
+1:
         .word   CPU_RESUME_ADDR_REG
 armada_375_smp_cpu1_enable_code_end:
 
 ENTRY(mvebu_cortex_a9_secondary_startup)
+ARM_BE8(setend  be)
         bl      v7_invalidate_l1
         b       secondary_startup
 ENDPROC(mvebu_cortex_a9_secondary_startup)
diff --git a/arch/arm/mach-mvebu/pmsu.c b/arch/arm/mach-mvebu/pmsu.c
index a1d407c0febe..25aa8237d668 100644
--- a/arch/arm/mach-mvebu/pmsu.c
+++ b/arch/arm/mach-mvebu/pmsu.c
@@ -201,12 +201,12 @@ static noinline int do_armada_370_xp_cpu_suspend(unsigned long deepidle)
 
         /* Test the CR_C bit and set it if it was cleared */
         asm volatile(
-        "mrc    p15, 0, %0, c1, c0, 0 \n\t"
-        "tst    %0, #(1 << 2) \n\t"
-        "orreq  %0, %0, #(1 << 2) \n\t"
-        "mcreq  p15, 0, %0, c1, c0, 0 \n\t"
+        "mrc    p15, 0, r0, c1, c0, 0 \n\t"
+        "tst    r0, #(1 << 2) \n\t"
+        "orreq  r0, r0, #(1 << 2) \n\t"
+        "mcreq  p15, 0, r0, c1, c0, 0 \n\t"
         "isb    "
-        : : "r" (0));
+        : : : "r0");
 
         pr_warn("Failed to suspend the system\n");
 
diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
index a474de346be6..839f48c26ef0 100644
--- a/arch/arm64/Kconfig
+++ b/arch/arm64/Kconfig
@@ -4,6 +4,7 @@ config ARM64
         select ARCH_HAS_OPP
         select ARCH_HAS_TICK_BROADCAST if GENERIC_CLOCKEVENTS_BROADCAST
         select ARCH_USE_CMPXCHG_LOCKREF
+        select ARCH_SUPPORTS_ATOMIC_RMW
         select ARCH_WANT_OPTIONAL_GPIOLIB
         select ARCH_WANT_COMPAT_IPC_PARSE_VERSION
         select ARCH_WANT_FRAME_POINTERS
diff --git a/arch/arm64/kernel/efi-stub.c b/arch/arm64/kernel/efi-stub.c
index 60e98a639ac5..e786e6cdc400 100644
--- a/arch/arm64/kernel/efi-stub.c
+++ b/arch/arm64/kernel/efi-stub.c
@@ -12,8 +12,6 @@
 #include <linux/efi.h>
 #include <linux/libfdt.h>
 #include <asm/sections.h>
-#include <generated/compile.h>
-#include <generated/utsrelease.h>
 
 /*
  * AArch64 requires the DTB to be 8-byte aligned in the first 512MiB from
diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
index fefe7c8bf05f..80b94b0add1f 100644
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig
@@ -145,6 +145,7 @@ config PPC
         select HAVE_IRQ_EXIT_ON_IRQ_STACK
         select ARCH_USE_CMPXCHG_LOCKREF if PPC64
         select HAVE_ARCH_AUDITSYSCALL
+        select ARCH_SUPPORTS_ATOMIC_RMW
 
 config GENERIC_CSUM
         def_bool CPU_LITTLE_ENDIAN
diff --git a/arch/powerpc/include/asm/kvm_book3s_64.h b/arch/powerpc/include/asm/kvm_book3s_64.h
index fddb72b48ce9..d645428a65a4 100644
--- a/arch/powerpc/include/asm/kvm_book3s_64.h
+++ b/arch/powerpc/include/asm/kvm_book3s_64.h
@@ -198,8 +198,10 @@ static inline unsigned long compute_tlbie_rb(unsigned long v, unsigned long r,
         return rb;
 }
 
-static inline unsigned long hpte_page_size(unsigned long h, unsigned long l)
+static inline unsigned long __hpte_page_size(unsigned long h, unsigned long l,
+                                             bool is_base_size)
 {
+
         int size, a_psize;
         /* Look at the 8 bit LP value */
         unsigned int lp = (l >> LP_SHIFT) & ((1 << LP_BITS) - 1);
@@ -214,14 +216,27 @@ static inline unsigned long hpte_page_size(unsigned long h, unsigned long l)
                                 continue;
 
                         a_psize = __hpte_actual_psize(lp, size);
-                        if (a_psize != -1)
+                        if (a_psize != -1) {
+                                if (is_base_size)
+                                        return 1ul << mmu_psize_defs[size].shift;
                                 return 1ul << mmu_psize_defs[a_psize].shift;
+                        }
                 }
 
         }
         return 0;
 }
 
+static inline unsigned long hpte_page_size(unsigned long h, unsigned long l)
+{
+        return __hpte_page_size(h, l, 0);
+}
+
+static inline unsigned long hpte_base_page_size(unsigned long h, unsigned long l)
+{
+        return __hpte_page_size(h, l, 1);
+}
+
 static inline unsigned long hpte_rpn(unsigned long ptel, unsigned long psize)
 {
         return ((ptel & HPTE_R_RPN) & ~(psize - 1)) >> PAGE_SHIFT;
diff --git a/arch/powerpc/include/asm/ppc_asm.h b/arch/powerpc/include/asm/ppc_asm.h
index 9ea266eae33e..7e4612528546 100644
--- a/arch/powerpc/include/asm/ppc_asm.h
+++ b/arch/powerpc/include/asm/ppc_asm.h
@@ -277,6 +277,8 @@ n:
         .globl n;       \
 n:
 
+#define _GLOBAL_TOC(name) _GLOBAL(name)
+
 #define _KPROBE(n)      \
         .section ".kprobes.text","a";   \
         .globl  n;      \
diff --git a/arch/powerpc/kvm/book3s_64_mmu_hv.c b/arch/powerpc/kvm/book3s_64_mmu_hv.c
index 80561074078d..68468d695f12 100644
--- a/arch/powerpc/kvm/book3s_64_mmu_hv.c
+++ b/arch/powerpc/kvm/book3s_64_mmu_hv.c
@@ -1562,7 +1562,7 @@ static ssize_t kvm_htab_write(struct file *file, const char __user *buf,
                                 goto out;
                         }
                         if (!rma_setup && is_vrma_hpte(v)) {
-                                unsigned long psize = hpte_page_size(v, r);
+                                unsigned long psize = hpte_base_page_size(v, r);
                                 unsigned long senc = slb_pgsize_encoding(psize);
                                 unsigned long lpcr;
 
diff --git a/arch/powerpc/kvm/book3s_hv_rm_mmu.c b/arch/powerpc/kvm/book3s_hv_rm_mmu.c
index 6e6224318c36..5a24d3c2b6b8 100644
--- a/arch/powerpc/kvm/book3s_hv_rm_mmu.c
+++ b/arch/powerpc/kvm/book3s_hv_rm_mmu.c
@@ -814,13 +814,10 @@ long kvmppc_hv_find_lock_hpte(struct kvm *kvm, gva_t eaddr, unsigned long slb_v,
                         r = hpte[i+1];
 
                         /*
-                         * Check the HPTE again, including large page size
-                         * Since we don't currently allow any MPSS (mixed
-                         * page-size segment) page sizes, it is sufficient
-                         * to check against the actual page size.
+                         * Check the HPTE again, including base page size
                          */
                         if ((v & valid) && (v & mask) == val &&
-                            hpte_page_size(v, r) == (1ul << pshift))
+                            hpte_base_page_size(v, r) == (1ul << pshift))
                                 /* Return with the HPTE still locked */
                                 return (hash << 3) + (i >> 1);
 
diff --git a/arch/powerpc/kvm/book3s_hv_rmhandlers.S b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
index 868347ef09fd..558a67df8126 100644
--- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S
+++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
@@ -48,7 +48,7 @@
  *
  * LR = return address to continue at after eventually re-enabling MMU
  */
-_GLOBAL(kvmppc_hv_entry_trampoline)
+_GLOBAL_TOC(kvmppc_hv_entry_trampoline)
         mflr    r0
         std     r0, PPC_LR_STKOFF(r1)
         stdu    r1, -112(r1)
diff --git a/arch/powerpc/kvm/book3s_interrupts.S b/arch/powerpc/kvm/book3s_interrupts.S
index e2c29e381dc7..d044b8b7c69d 100644
--- a/arch/powerpc/kvm/book3s_interrupts.S
+++ b/arch/powerpc/kvm/book3s_interrupts.S
@@ -25,7 +25,11 @@
 #include <asm/exception-64s.h>
 
 #if defined(CONFIG_PPC_BOOK3S_64)
+#if defined(_CALL_ELF) && _CALL_ELF == 2
+#define FUNC(name)              name
+#else
 #define FUNC(name)              GLUE(.,name)
+#endif
 #define GET_SHADOW_VCPU(reg)    addi    reg, r13, PACA_SVCPU
 
 #elif defined(CONFIG_PPC_BOOK3S_32)
diff --git a/arch/powerpc/kvm/book3s_rmhandlers.S b/arch/powerpc/kvm/book3s_rmhandlers.S
index 9eec675220e6..16c4d88ba27d 100644
--- a/arch/powerpc/kvm/book3s_rmhandlers.S
+++ b/arch/powerpc/kvm/book3s_rmhandlers.S
@@ -36,7 +36,11 @@
 
 #if defined(CONFIG_PPC_BOOK3S_64)
 
+#if defined(_CALL_ELF) && _CALL_ELF == 2
+#define FUNC(name)              name
+#else
 #define FUNC(name)              GLUE(.,name)
+#endif
 
 #elif defined(CONFIG_PPC_BOOK3S_32)
 
@@ -146,7 +150,7 @@ kvmppc_handler_skip_ins:
  * On entry, r4 contains the guest shadow MSR
  * MSR.EE has to be 0 when calling this function
  */
-_GLOBAL(kvmppc_entry_trampoline)
+_GLOBAL_TOC(kvmppc_entry_trampoline)
         mfmsr   r5
         LOAD_REG_ADDR(r7, kvmppc_handler_trampoline_enter)
         toreal(r7)
diff --git a/arch/powerpc/kvm/book3s_rtas.c b/arch/powerpc/kvm/book3s_rtas.c
index edb14ba992b3..ef27fbd5d9c5 100644
--- a/arch/powerpc/kvm/book3s_rtas.c
+++ b/arch/powerpc/kvm/book3s_rtas.c
@@ -23,20 +23,20 @@ static void kvm_rtas_set_xive(struct kvm_vcpu *vcpu, struct rtas_args *args)
         u32 irq, server, priority;
         int rc;
 
-        if (args->nargs != 3 || args->nret != 1) {
+        if (be32_to_cpu(args->nargs) != 3 || be32_to_cpu(args->nret) != 1) {
                 rc = -3;
                 goto out;
         }
 
-        irq = args->args[0];
-        server = args->args[1];
-        priority = args->args[2];
+        irq = be32_to_cpu(args->args[0]);
+        server = be32_to_cpu(args->args[1]);
+        priority = be32_to_cpu(args->args[2]);
 
         rc = kvmppc_xics_set_xive(vcpu->kvm, irq, server, priority);
         if (rc)
                 rc = -3;
 out:
-        args->rets[0] = rc;
+        args->rets[0] = cpu_to_be32(rc);
 }
 
 static void kvm_rtas_get_xive(struct kvm_vcpu *vcpu, struct rtas_args *args)
@@ -44,12 +44,12 @@ static void kvm_rtas_get_xive(struct kvm_vcpu *vcpu, struct rtas_args *args)
         u32 irq, server, priority;
         int rc;
 
-        if (args->nargs != 1 || args->nret != 3) {
+        if (be32_to_cpu(args->nargs) != 1 || be32_to_cpu(args->nret) != 3) {
                 rc = -3;
                 goto out;
         }
 
-        irq = args->args[0];
+        irq = be32_to_cpu(args->args[0]);
 
         server = priority = 0;
         rc = kvmppc_xics_get_xive(vcpu->kvm, irq, &server, &priority);
@@ -58,10 +58,10 @@ static void kvm_rtas_get_xive(struct kvm_vcpu *vcpu, struct rtas_args *args)
                 goto out;
         }
 
-        args->rets[1] = server;
-        args->rets[2] = priority;
+        args->rets[1] = cpu_to_be32(server);
+        args->rets[2] = cpu_to_be32(priority);
 out:
-        args->rets[0] = rc;
+        args->rets[0] = cpu_to_be32(rc);
 }
 
 static void kvm_rtas_int_off(struct kvm_vcpu *vcpu, struct rtas_args *args)
@@ -69,18 +69,18 @@ static void kvm_rtas_int_off(struct kvm_vcpu *vcpu, struct rtas_args *args)
         u32 irq;
         int rc;
 
-        if (args->nargs != 1 || args->nret != 1) {
+        if (be32_to_cpu(args->nargs) != 1 || be32_to_cpu(args->nret) != 1) {
                 rc = -3;
                 goto out;
         }
 
-        irq = args->args[0];
+        irq = be32_to_cpu(args->args[0]);
 
         rc = kvmppc_xics_int_off(vcpu->kvm, irq);
         if (rc)
                 rc = -3;
 out:
-        args->rets[0] = rc;
+        args->rets[0] = cpu_to_be32(rc);
 }
 
 static void kvm_rtas_int_on(struct kvm_vcpu *vcpu, struct rtas_args *args)
@@ -88,18 +88,18 @@ static void kvm_rtas_int_on(struct kvm_vcpu *vcpu, struct rtas_args *args)
         u32 irq;
         int rc;
 
-        if (args->nargs != 1 || args->nret != 1) {
+        if (be32_to_cpu(args->nargs) != 1 || be32_to_cpu(args->nret) != 1) {
                 rc = -3;
                 goto out;
         }
 
-        irq = args->args[0];
+        irq = be32_to_cpu(args->args[0]);
 
         rc = kvmppc_xics_int_on(vcpu->kvm, irq);
         if (rc)
                 rc = -3;
 out:
-        args->rets[0] = rc;
+        args->rets[0] = cpu_to_be32(rc);
 }
 #endif /* CONFIG_KVM_XICS */
 
@@ -205,32 +205,6 @@ int kvm_vm_ioctl_rtas_define_token(struct kvm *kvm, void __user *argp)
         return rc;
 }
 
-static void kvmppc_rtas_swap_endian_in(struct rtas_args *args)
-{
-#ifdef __LITTLE_ENDIAN__
-        int i;
-
-        args->token = be32_to_cpu(args->token);
-        args->nargs = be32_to_cpu(args->nargs);
-        args->nret = be32_to_cpu(args->nret);
-        for (i = 0; i < args->nargs; i++)
-                args->args[i] = be32_to_cpu(args->args[i]);
-#endif
-}
-
-static void kvmppc_rtas_swap_endian_out(struct rtas_args *args)
-{
-#ifdef __LITTLE_ENDIAN__
-        int i;
-
-        for (i = 0; i < args->nret; i++)
-                args->args[i] = cpu_to_be32(args->args[i]);
-        args->token = cpu_to_be32(args->token);
-        args->nargs = cpu_to_be32(args->nargs);
-        args->nret = cpu_to_be32(args->nret);
-#endif
-}
-
 int kvmppc_rtas_hcall(struct kvm_vcpu *vcpu)
 {
         struct rtas_token_definition *d;
@@ -249,8 +223,6 @@ int kvmppc_rtas_hcall(struct kvm_vcpu *vcpu)
         if (rc)
                 goto fail;
 
-        kvmppc_rtas_swap_endian_in(&args);
-
         /*
          * args->rets is a pointer into args->args. Now that we've
          * copied args we need to fix it up to point into our copy,
@@ -258,13 +230,13 @@ int kvmppc_rtas_hcall(struct kvm_vcpu *vcpu)
          * value so we can restore it on the way out.
          */
         orig_rets = args.rets;
-        args.rets = &args.args[args.nargs];
+        args.rets = &args.args[be32_to_cpu(args.nargs)];
 
         mutex_lock(&vcpu->kvm->lock);
 
         rc = -ENOENT;
         list_for_each_entry(d, &vcpu->kvm->arch.rtas_tokens, list) {
-                if (d->token == args.token) {
+                if (d->token == be32_to_cpu(args.token)) {
                         d->handler->handler(vcpu, &args);
                         rc = 0;
                         break;
@@ -275,7 +247,6 @@ int kvmppc_rtas_hcall(struct kvm_vcpu *vcpu)
 
         if (rc == 0) {
                 args.rets = orig_rets;
-                kvmppc_rtas_swap_endian_out(&args);
                 rc = kvm_write_guest(vcpu->kvm, args_phys, &args, sizeof(args));
                 if (rc)
                         goto fail;
diff --git a/arch/powerpc/kvm/e500_mmu_host.c b/arch/powerpc/kvm/e500_mmu_host.c
index dd2cc03f406f..86903d3f5a03 100644
--- a/arch/powerpc/kvm/e500_mmu_host.c
+++ b/arch/powerpc/kvm/e500_mmu_host.c
@@ -473,7 +473,8 @@ static inline int kvmppc_e500_shadow_map(struct kvmppc_vcpu_e500 *vcpu_e500,
                 if (printk_ratelimit())
                         pr_err("%s: pte not present: gfn %lx, pfn %lx\n",
                                 __func__, (long)gfn, pfn);
-                return -EINVAL;
+                ret = -EINVAL;
+                goto out;
         }
         kvmppc_e500_ref_setup(ref, gtlbe, pfn, wimg);
 
diff --git a/arch/s390/include/asm/switch_to.h b/arch/s390/include/asm/switch_to.h
index df38c70cd59e..18ea9e3f8142 100644
--- a/arch/s390/include/asm/switch_to.h
+++ b/arch/s390/include/asm/switch_to.h
@@ -51,8 +51,8 @@ static inline int restore_fp_ctl(u32 *fpc)
                 return 0;
 
         asm volatile(
-                "0:     lfpc    %1\n"
-                "       la      %0,0\n"
+                "       lfpc    %1\n"
+                "0:     la      %0,0\n"
                 "1:\n"
                 EX_TABLE(0b,1b)
                 : "=d" (rc) : "Q" (*fpc), "0" (-EINVAL));
diff --git a/arch/s390/kernel/head.S b/arch/s390/kernel/head.S
index 7ba7d6784510..e88d35d74950 100644
--- a/arch/s390/kernel/head.S
+++ b/arch/s390/kernel/head.S
@@ -437,11 +437,11 @@ ENTRY(startup_kdump)
 
 #if defined(CONFIG_64BIT)
 #if defined(CONFIG_MARCH_ZEC12)
-        .long 3, 0xc100efea, 0xf46ce800, 0x00400000
+        .long 3, 0xc100eff2, 0xf46ce800, 0x00400000
 #elif defined(CONFIG_MARCH_Z196)
-        .long 2, 0xc100efea, 0xf46c0000
+        .long 2, 0xc100eff2, 0xf46c0000
 #elif defined(CONFIG_MARCH_Z10)
-        .long 2, 0xc100efea, 0xf0680000
+        .long 2, 0xc100eff2, 0xf0680000
 #elif defined(CONFIG_MARCH_Z9_109)
         .long 1, 0xc100efc2
 #elif defined(CONFIG_MARCH_Z990)
diff --git a/arch/s390/kernel/ptrace.c b/arch/s390/kernel/ptrace.c
index 2d716734b5b1..5dc7ad9e2fbf 100644
--- a/arch/s390/kernel/ptrace.c
+++ b/arch/s390/kernel/ptrace.c
@@ -334,9 +334,14 @@ static int __poke_user(struct task_struct *child, addr_t addr, addr_t data)
                         unsigned long mask = PSW_MASK_USER;
 
                         mask |= is_ri_task(child) ? PSW_MASK_RI : 0;
-                        if ((data & ~mask) != PSW_USER_BITS)
+                        if ((data ^ PSW_USER_BITS) & ~mask)
+                                /* Invalid psw mask. */
+                                return -EINVAL;
+                        if ((data & PSW_MASK_ASC) == PSW_ASC_HOME)
+                                /* Invalid address-space-control bits */
                                 return -EINVAL;
                         if ((data & PSW_MASK_EA) && !(data & PSW_MASK_BA))
+                                /* Invalid addressing mode bits */
                                 return -EINVAL;
                 }
                 *(addr_t *)((addr_t) &task_pt_regs(child)->psw + addr) = data;
@@ -672,9 +677,12 @@ static int __poke_user_compat(struct task_struct *child,
 
                         mask |= is_ri_task(child) ? PSW32_MASK_RI : 0;
                         /* Build a 64 bit psw mask from 31 bit mask. */
-                        if ((tmp & ~mask) != PSW32_USER_BITS)
+                        if ((tmp ^ PSW32_USER_BITS) & ~mask)
                                 /* Invalid psw mask. */
                                 return -EINVAL;
+                        if ((data & PSW32_MASK_ASC) == PSW32_ASC_HOME)
+                                /* Invalid address-space-control bits */
+                                return -EINVAL;
                         regs->psw.mask = (regs->psw.mask & ~PSW_MASK_USER) |
                                 (regs->psw.mask & PSW_MASK_BA) |
                                 (__u64)(tmp & mask) << 32;
diff --git a/arch/s390/pci/pci.c b/arch/s390/pci/pci.c
index 9ddc51eeb8d6..30de42730b2f 100644
--- a/arch/s390/pci/pci.c
+++ b/arch/s390/pci/pci.c
@@ -48,13 +48,10 @@
 static LIST_HEAD(zpci_list);
 static DEFINE_SPINLOCK(zpci_list_lock);
 
-static void zpci_enable_irq(struct irq_data *data);
-static void zpci_disable_irq(struct irq_data *data);
-
 static struct irq_chip zpci_irq_chip = {
         .name = "zPCI",
-        .irq_unmask = zpci_enable_irq,
-        .irq_mask = zpci_disable_irq,
+        .irq_unmask = unmask_msi_irq,
+        .irq_mask = mask_msi_irq,
 };
 
 static DECLARE_BITMAP(zpci_domain, ZPCI_NR_DEVICES);
@@ -244,43 +241,6 @@ static int zpci_cfg_store(struct zpci_dev *zdev, int offset, u32 val, u8 len)
         return rc;
 }
 
-static int zpci_msi_set_mask_bits(struct msi_desc *msi, u32 mask, u32 flag)
-{
-        int offset, pos;
-        u32 mask_bits;
-
-        if (msi->msi_attrib.is_msix) {
-                offset = msi->msi_attrib.entry_nr * PCI_MSIX_ENTRY_SIZE +
-                        PCI_MSIX_ENTRY_VECTOR_CTRL;
-                msi->masked = readl(msi->mask_base + offset);
-                writel(flag, msi->mask_base + offset);
-        } else if (msi->msi_attrib.maskbit) {
-                pos = (long) msi->mask_base;
-                pci_read_config_dword(msi->dev, pos, &mask_bits);
-                mask_bits &= ~(mask);
-                mask_bits |= flag & mask;
-                pci_write_config_dword(msi->dev, pos, mask_bits);
-        } else
-                return 0;
-
-        msi->msi_attrib.maskbit = !!flag;
-        return 1;
-}
-
-static void zpci_enable_irq(struct irq_data *data)
-{
-        struct msi_desc *msi = irq_get_msi_desc(data->irq);
-
-        zpci_msi_set_mask_bits(msi, 1, 0);
-}
-
-static void zpci_disable_irq(struct irq_data *data)
-{
-        struct msi_desc *msi = irq_get_msi_desc(data->irq);
-
-        zpci_msi_set_mask_bits(msi, 1, 1);
-}
-
 void pcibios_fixup_bus(struct pci_bus *bus)
 {
 }
@@ -487,7 +447,10 @@ void arch_teardown_msi_irqs(struct pci_dev *pdev)
 
         /* Release MSI interrupts */
         list_for_each_entry(msi, &pdev->msi_list, list) {
-                zpci_msi_set_mask_bits(msi, 1, 1);
+                if (msi->msi_attrib.is_msix)
+                        default_msix_mask_irq(msi, 1);
+                else
+                        default_msi_mask_irq(msi, 1, 1);
                 irq_set_msi_desc(msi->irq, NULL);
                 irq_free_desc(msi->irq);
                 msi->msg.address_lo = 0;
diff --git a/arch/sparc/Kconfig b/arch/sparc/Kconfig
index 29f2e988c56a..407c87d9879a 100644
--- a/arch/sparc/Kconfig
+++ b/arch/sparc/Kconfig
@@ -78,6 +78,7 @@ config SPARC64
         select HAVE_C_RECORDMCOUNT
         select NO_BOOTMEM
         select HAVE_ARCH_AUDITSYSCALL
+        select ARCH_SUPPORTS_ATOMIC_RMW
 
 config ARCH_DEFCONFIG
         string
diff --git a/arch/sparc/include/uapi/asm/unistd.h b/arch/sparc/include/uapi/asm/unistd.h
index b73274fb961a..42f2bca1d338 100644
--- a/arch/sparc/include/uapi/asm/unistd.h
+++ b/arch/sparc/include/uapi/asm/unistd.h
@@ -410,8 +410,9 @@
 #define __NR_finit_module       342
 #define __NR_sched_setattr      343
 #define __NR_sched_getattr      344
+#define __NR_renameat2          345
 
-#define NR_syscalls             345
+#define NR_syscalls             346
 
 /* Bitmask values returned from kern_features system call.  */
 #define KERN_FEATURE_MIXED_MODE_STACK   0x00000001
diff --git a/arch/sparc/kernel/sys32.S b/arch/sparc/kernel/sys32.S
index d066eb18650c..f834224208ed 100644
--- a/arch/sparc/kernel/sys32.S
+++ b/arch/sparc/kernel/sys32.S
@@ -48,6 +48,7 @@ SIGN1(sys32_futex, compat_sys_futex, %o1)
 SIGN1(sys32_recvfrom, compat_sys_recvfrom, %o0)
 SIGN1(sys32_recvmsg, compat_sys_recvmsg, %o0)
 SIGN1(sys32_sendmsg, compat_sys_sendmsg, %o0)
+SIGN2(sys32_renameat2, sys_renameat2, %o0, %o2)
 
         .globl          sys32_mmap2
 sys32_mmap2:
diff --git a/arch/sparc/kernel/systbls_32.S b/arch/sparc/kernel/systbls_32.S
index 151ace8766cc..85fe9b1087cd 100644
--- a/arch/sparc/kernel/systbls_32.S
+++ b/arch/sparc/kernel/systbls_32.S
@@ -86,3 +86,4 @@ sys_call_table:
 /*330*/ .long sys_fanotify_mark, sys_prlimit64, sys_name_to_handle_at, sys_open_by_handle_at, sys_clock_adjtime
 /*335*/ .long sys_syncfs, sys_sendmmsg, sys_setns, sys_process_vm_readv, sys_process_vm_writev
 /*340*/ .long sys_ni_syscall, sys_kcmp, sys_finit_module, sys_sched_setattr, sys_sched_getattr
+/*345*/ .long sys_renameat2
diff --git a/arch/sparc/kernel/systbls_64.S b/arch/sparc/kernel/systbls_64.S
index 4bd4e2bb26cf..33ecba2826ea 100644
--- a/arch/sparc/kernel/systbls_64.S
+++ b/arch/sparc/kernel/systbls_64.S
@@ -87,6 +87,7 @@ sys_call_table32:
 /*330*/ .word compat_sys_fanotify_mark, sys_prlimit64, sys_name_to_handle_at, compat_sys_open_by_handle_at, compat_sys_clock_adjtime
         .word sys_syncfs, compat_sys_sendmmsg, sys_setns, compat_sys_process_vm_readv, compat_sys_process_vm_writev
 /*340*/ .word sys_kern_features, sys_kcmp, sys_finit_module, sys_sched_setattr, sys_sched_getattr
+        .word sys32_renameat2
 
 #endif /* CONFIG_COMPAT */
 
@@ -165,3 +166,4 @@ sys_call_table:
 /*330*/ .word sys_fanotify_mark, sys_prlimit64, sys_name_to_handle_at, sys_open_by_handle_at, sys_clock_adjtime
         .word sys_syncfs, sys_sendmmsg, sys_setns, sys_process_vm_readv, sys_process_vm_writev
 /*340*/ .word sys_kern_features, sys_kcmp, sys_finit_module, sys_sched_setattr, sys_sched_getattr
+        .word sys_renameat2
diff --git a/arch/um/kernel/tlb.c b/arch/um/kernel/tlb.c
index 9472079471bb..f1b3eb14b855 100644
--- a/arch/um/kernel/tlb.c
+++ b/arch/um/kernel/tlb.c
@@ -12,6 +12,7 @@
 #include <mem_user.h>
 #include <os.h>
 #include <skas.h>
+#include <kern_util.h>
 
 struct host_vm_change {
         struct host_vm_op {
@@ -124,6 +125,9 @@ static int add_munmap(unsigned long addr, unsigned long len,
         struct host_vm_op *last;
         int ret = 0;
 
+        if ((addr >= STUB_START) && (addr < STUB_END))
+                return -EINVAL;
+
         if (hvc->index != 0) {
                 last = &hvc->ops[hvc->index - 1];
                 if ((last->type == MUNMAP) &&
@@ -283,8 +287,11 @@ void fix_range_common(struct mm_struct *mm, unsigned long start_addr,
         /* This is not an else because ret is modified above */
         if (ret) {
                 printk(KERN_ERR "fix_range_common: failed, killing current "
-                       "process\n");
+                       "process: %d\n", task_tgid_vnr(current));
+                /* We are under mmap_sem, release it such that current can terminate */
+                up_write(&current->mm->mmap_sem);
                 force_sig(SIGKILL, current);
+                do_signal();
         }
 }
 
diff --git a/arch/um/kernel/trap.c b/arch/um/kernel/trap.c
index 974b87474a99..5678c3571e7c 100644
--- a/arch/um/kernel/trap.c
+++ b/arch/um/kernel/trap.c
@@ -206,7 +206,7 @@ unsigned long segv(struct faultinfo fi, unsigned long ip, int is_user,
         int is_write = FAULT_WRITE(fi);
         unsigned long address = FAULT_ADDRESS(fi);
 
-        if (regs)
+        if (!is_user && regs)
                 current->thread.segv_regs = container_of(regs, struct pt_regs, regs);
 
         if (!is_user && (address >= start_vm) && (address < end_vm)) {
diff --git a/arch/um/os-Linux/skas/process.c b/arch/um/os-Linux/skas/process.c
index d531879a4617..908579f2b0ab 100644
--- a/arch/um/os-Linux/skas/process.c
+++ b/arch/um/os-Linux/skas/process.c
@@ -54,7 +54,7 @@ static int ptrace_dump_regs(int pid)
 
 void wait_stub_done(int pid)
 {
-        int n, status, err, bad_stop = 0;
+        int n, status, err;
 
         while (1) {
                 CATCH_EINTR(n = waitpid(pid, &status, WUNTRACED | __WALL));
@@ -74,8 +74,6 @@ void wait_stub_done(int pid)
 
         if (((1 << WSTOPSIG(status)) & STUB_DONE_MASK) != 0)
                 return;
-        else
-                bad_stop = 1;
 
 bad_wait:
         err = ptrace_dump_regs(pid);
@@ -85,10 +83,7 @@ bad_wait:
         printk(UM_KERN_ERR "wait_stub_done : failed to wait for SIGTRAP, "
                "pid = %d, n = %d, errno = %d, status = 0x%x\n", pid, n, errno,
                status);
-        if (bad_stop)
-                kill(pid, SIGKILL);
-        else
-                fatal_sigsegv();
+        fatal_sigsegv();
 }
 
 extern unsigned long current_stub_stack(void);
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index a8f749ef0fdc..d24887b645dc 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -131,6 +131,7 @@ config X86
         select HAVE_CC_STACKPROTECTOR
         select GENERIC_CPU_AUTOPROBE
         select HAVE_ARCH_AUDITSYSCALL
+        select ARCH_SUPPORTS_ATOMIC_RMW
 
 config INSTRUCTION_DECODER
         def_bool y
diff --git a/arch/x86/boot/header.S b/arch/x86/boot/header.S
index 84c223479e3c..7a6d43a554d7 100644
--- a/arch/x86/boot/header.S
+++ b/arch/x86/boot/header.S
@@ -91,10 +91,9 @@ bs_die:
 
         .section ".bsdata", "a"
 bugger_off_msg:
-        .ascii  "Direct floppy boot is not supported. "
-        .ascii  "Use a boot loader program instead.\r\n"
+        .ascii  "Use a boot loader.\r\n"
         .ascii  "\n"
-        .ascii  "Remove disk and press any key to reboot ...\r\n"
+        .ascii  "Remove disk and press any key to reboot...\r\n"
         .byte   0
 
 #ifdef CONFIG_EFI_STUB
@@ -108,7 +107,7 @@ coff_header:
 #else
         .word   0x8664                          # x86-64
 #endif
-        .word   3                               # nr_sections
+        .word   4                               # nr_sections
         .long   0                               # TimeDateStamp
         .long   0                               # PointerToSymbolTable
         .long   1                               # NumberOfSymbols
@@ -250,6 +249,25 @@ section_table:
         .word   0                               # NumberOfLineNumbers
         .long   0x60500020                      # Characteristics (section flags)
 
+        #
+        # The offset & size fields are filled in by build.c.
+        #
+        .ascii  ".bss"
+        .byte   0
+        .byte   0
+        .byte   0
+        .byte   0
+        .long   0
+        .long   0x0
+        .long   0                               # Size of initialized data
+                                                # on disk
+        .long   0x0
+        .long   0                               # PointerToRelocations
+        .long   0                               # PointerToLineNumbers
+        .word   0                               # NumberOfRelocations
+        .word   0                               # NumberOfLineNumbers
+        .long   0xc8000080                      # Characteristics (section flags)
+
 #endif /* CONFIG_EFI_STUB */
 
         # Kernel attributes; used by setup.  This is part 1 of the
diff --git a/arch/x86/boot/tools/build.c b/arch/x86/boot/tools/build.c
index 1a2f2121cada..a7661c430cd9 100644
--- a/arch/x86/boot/tools/build.c
+++ b/arch/x86/boot/tools/build.c
@@ -143,7 +143,7 @@ static void usage(void)
 
 #ifdef CONFIG_EFI_STUB
 
-static void update_pecoff_section_header(char *section_name, u32 offset, u32 size)
+static void update_pecoff_section_header_fields(char *section_name, u32 vma, u32 size, u32 datasz, u32 offset)
 {
         unsigned int pe_header;
         unsigned short num_sections;
@@ -164,10 +164,10 @@ static void update_pecoff_section_header(char *section_name, u32 offset, u32 siz
                         put_unaligned_le32(size, section + 0x8);
 
                         /* section header vma field */
-                        put_unaligned_le32(offset, section + 0xc);
+                        put_unaligned_le32(vma, section + 0xc);
 
                         /* section header 'size of initialised data' field */
-                        put_unaligned_le32(size, section + 0x10);
+                        put_unaligned_le32(datasz, section + 0x10);
 
                         /* section header 'file offset' field */
                         put_unaligned_le32(offset, section + 0x14);
@@ -179,6 +179,11 @@ static void update_pecoff_section_header(char *section_name, u32 offset, u32 siz
         }
 }
 
+static void update_pecoff_section_header(char *section_name, u32 offset, u32 size)
+{
+        update_pecoff_section_header_fields(section_name, offset, size, size, offset);
+}
+
 static void update_pecoff_setup_and_reloc(unsigned int size)
 {
         u32 setup_offset = 0x200;
@@ -203,9 +208,6 @@ static void update_pecoff_text(unsigned int text_start, unsigned int file_sz)
 
         pe_header = get_unaligned_le32(&buf[0x3c]);
 
-        /* Size of image */
-        put_unaligned_le32(file_sz, &buf[pe_header + 0x50]);
-
         /*
          * Size of code: Subtract the size of the first sector (512 bytes)
          * which includes the header.
@@ -220,6 +222,22 @@ static void update_pecoff_text(unsigned int text_start, unsigned int file_sz)
         update_pecoff_section_header(".text", text_start, text_sz);
 }
 
+static void update_pecoff_bss(unsigned int file_sz, unsigned int init_sz)
+{
+        unsigned int pe_header;
+        unsigned int bss_sz = init_sz - file_sz;
+
+        pe_header = get_unaligned_le32(&buf[0x3c]);
+
+        /* Size of uninitialized data */
+        put_unaligned_le32(bss_sz, &buf[pe_header + 0x24]);
+
+        /* Size of image */
+        put_unaligned_le32(init_sz, &buf[pe_header + 0x50]);
+
+        update_pecoff_section_header_fields(".bss", file_sz, bss_sz, 0, 0);
+}
+
 static int reserve_pecoff_reloc_section(int c)
 {
         /* Reserve 0x20 bytes for .reloc section */
@@ -259,6 +277,8 @@ static void efi_stub_entry_update(void)
 static inline void update_pecoff_setup_and_reloc(unsigned int size) {}
 static inline void update_pecoff_text(unsigned int text_start,
                                       unsigned int file_sz) {}
+static inline void update_pecoff_bss(unsigned int file_sz,
+                                     unsigned int init_sz) {}
 static inline void efi_stub_defaults(void) {}
 static inline void efi_stub_entry_update(void) {}
 
@@ -310,7 +330,7 @@ static void parse_zoffset(char *fname)
 
 int main(int argc, char ** argv)
 {
-        unsigned int i, sz, setup_sectors;
+        unsigned int i, sz, setup_sectors, init_sz;
         int c;
         u32 sys_size;
         struct stat sb;
@@ -376,7 +396,9 @@ int main(int argc, char ** argv)
         buf[0x1f1] = setup_sectors-1;
         put_unaligned_le32(sys_size, &buf[0x1f4]);
 
-        update_pecoff_text(setup_sectors * 512, sz + i + ((sys_size * 16) - sz));
+        update_pecoff_text(setup_sectors * 512, i + (sys_size * 16));
+        init_sz = get_unaligned_le32(&buf[0x260]);
+        update_pecoff_bss(i + (sys_size * 16), init_sz);
 
         efi_stub_entry_update();
 
diff --git a/arch/x86/kernel/apm_32.c b/arch/x86/kernel/apm_32.c
index f3a1f04ed4cb..584874451414 100644
--- a/arch/x86/kernel/apm_32.c
+++ b/arch/x86/kernel/apm_32.c
@@ -841,7 +841,6 @@ static int apm_do_idle(void)
         u32 eax;
         u8 ret = 0;
         int idled = 0;
-        int polling;
         int err = 0;
 
         if (!need_resched()) {
diff --git a/arch/x86/kernel/espfix_64.c b/arch/x86/kernel/espfix_64.c
index 6afbb16e9b79..94d857fb1033 100644
--- a/arch/x86/kernel/espfix_64.c
+++ b/arch/x86/kernel/espfix_64.c
@@ -175,7 +175,7 @@ void init_espfix_ap(void)
         if (!pud_present(pud)) {
                 pmd_p = (pmd_t *)__get_free_page(PGALLOC_GFP);
                 pud = __pud(__pa(pmd_p) | (PGTABLE_PROT & ptemask));
-                paravirt_alloc_pud(&init_mm, __pa(pmd_p) >> PAGE_SHIFT);
+                paravirt_alloc_pmd(&init_mm, __pa(pmd_p) >> PAGE_SHIFT);
                 for (n = 0; n < ESPFIX_PUD_CLONES; n++)
                         set_pud(&pud_p[n], pud);
         }
@@ -185,7 +185,7 @@ void init_espfix_ap(void)
         if (!pmd_present(pmd)) {
                 pte_p = (pte_t *)__get_free_page(PGALLOC_GFP);
                 pmd = __pmd(__pa(pte_p) | (PGTABLE_PROT & ptemask));
-                paravirt_alloc_pmd(&init_mm, __pa(pte_p) >> PAGE_SHIFT);
+                paravirt_alloc_pte(&init_mm, __pa(pte_p) >> PAGE_SHIFT);
                 for (n = 0; n < ESPFIX_PMD_CLONES; n++)
                         set_pmd(&pmd_p[n], pmd);
         }
@@ -193,7 +193,6 @@ void init_espfix_ap(void)
         pte_p = pte_offset_kernel(&pmd, addr);
         stack_page = (void *)__get_free_page(GFP_KERNEL);
         pte = __pte(__pa(stack_page) | (__PAGE_KERNEL_RO & ptemask));
-        paravirt_alloc_pte(&init_mm, __pa(stack_page) >> PAGE_SHIFT);
         for (n = 0; n < ESPFIX_PTE_CLONES; n++)
                 set_pte(&pte_p[n*PTE_STRIDE], pte);
 
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index f6449334ec45..ef432f891d30 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -5887,6 +5887,18 @@ static int inject_pending_event(struct kvm_vcpu *vcpu, bool req_int_win)
                         kvm_x86_ops->set_nmi(vcpu);
                 }
         } else if (kvm_cpu_has_injectable_intr(vcpu)) {
+                /*
+                 * Because interrupts can be injected asynchronously, we are
+                 * calling check_nested_events again here to avoid a race condition.
+                 * See https://lkml.org/lkml/2014/7/2/60 for discussion about this
+                 * proposal and current concerns.  Perhaps we should be setting
+                 * KVM_REQ_EVENT only on certain events and not unconditionally?
+                 */
+                if (is_guest_mode(vcpu) && kvm_x86_ops->check_nested_events) {
+                        r = kvm_x86_ops->check_nested_events(vcpu, req_int_win);
+                        if (r != 0)
+                                return r;
+                }
                 if (kvm_x86_ops->interrupt_allowed(vcpu)) {
                         kvm_queue_interrupt(vcpu, kvm_cpu_get_interrupt(vcpu),
                                             false);