47 files changed, 267 insertions, 281 deletions

diff --git a/arch/arm/crypto/aesbs-core.S_shipped b/arch/arm/crypto/aesbs-core.S_shipped
index 71e5fc7cfb18..1d1800f71c5b 100644
--- a/arch/arm/crypto/aesbs-core.S_shipped
+++ b/arch/arm/crypto/aesbs-core.S_shipped
@@ -58,14 +58,18 @@
 # define VFP_ABI_FRAME  0
 # define BSAES_ASM_EXTENDED_KEY
 # define XTS_CHAIN_TWEAK
-# define __ARM_ARCH__   7
+# define __ARM_ARCH__ __LINUX_ARM_ARCH__
+# define __ARM_MAX_ARCH__ 7
 #endif
 
 #ifdef __thumb__
 # define adrl adr
 #endif
 
-#if __ARM_ARCH__>=7
+#if __ARM_MAX_ARCH__>=7
+.arch   armv7-a
+.fpu    neon
+
 .text
 .syntax unified         @ ARMv7-capable assembler is expected to handle this
 #ifdef __thumb2__
@@ -74,8 +78,6 @@
 .code   32
 #endif
 
-.fpu    neon
-
 .type   _bsaes_decrypt8,%function
 .align  4
 _bsaes_decrypt8:
@@ -2095,9 +2097,11 @@ bsaes_xts_decrypt:
         vld1.8  {q8}, [r0]                      @ initial tweak
         adr     r2, .Lxts_magic
 
+#ifndef XTS_CHAIN_TWEAK
         tst     r9, #0xf                        @ if not multiple of 16
         it      ne                              @ Thumb2 thing, sanity check in ARM
         subne   r9, #0x10                       @ subtract another 16 bytes
+#endif
         subs    r9, #0x80
 
         blo     .Lxts_dec_short
diff --git a/arch/arm/crypto/bsaes-armv7.pl b/arch/arm/crypto/bsaes-armv7.pl
index be068db960ee..a4d3856e7d24 100644
--- a/arch/arm/crypto/bsaes-armv7.pl
+++ b/arch/arm/crypto/bsaes-armv7.pl
@@ -701,14 +701,18 @@ $code.=<<___;
 # define VFP_ABI_FRAME  0
 # define BSAES_ASM_EXTENDED_KEY
 # define XTS_CHAIN_TWEAK
-# define __ARM_ARCH__   7
+# define __ARM_ARCH__ __LINUX_ARM_ARCH__
+# define __ARM_MAX_ARCH__ 7
 #endif
 
 #ifdef __thumb__
 # define adrl adr
 #endif
 
-#if __ARM_ARCH__>=7
+#if __ARM_MAX_ARCH__>=7
+.arch   armv7-a
+.fpu    neon
+
 .text
 .syntax unified         @ ARMv7-capable assembler is expected to handle this
 #ifdef __thumb2__
@@ -717,8 +721,6 @@ $code.=<<___;
 .code   32
 #endif
 
-.fpu    neon
-
 .type   _bsaes_decrypt8,%function
 .align  4
 _bsaes_decrypt8:
@@ -2076,9 +2078,11 @@ bsaes_xts_decrypt:
         vld1.8  {@XMM[8]}, [r0]                 @ initial tweak
         adr     $magic, .Lxts_magic
 
+#ifndef XTS_CHAIN_TWEAK
         tst     $len, #0xf                      @ if not multiple of 16
         it      ne                              @ Thumb2 thing, sanity check in ARM
         subne   $len, #0x10                     @ subtract another 16 bytes
+#endif
         subs    $len, #0x80
 
         blo     .Lxts_dec_short
diff --git a/arch/arm/include/asm/kvm_mmu.h b/arch/arm/include/asm/kvm_mmu.h
index bf0fe99e8ca9..4cf48c3aca13 100644
--- a/arch/arm/include/asm/kvm_mmu.h
+++ b/arch/arm/include/asm/kvm_mmu.h
@@ -149,29 +149,28 @@ static inline bool kvm_s2pmd_readonly(pmd_t *pmd)
         (__boundary - 1 < (end) - 1)? __boundary: (end);                \
 })
 
+#define kvm_pgd_index(addr)                     pgd_index(addr)
+
 static inline bool kvm_page_empty(void *ptr)
 {
         struct page *ptr_page = virt_to_page(ptr);
         return page_count(ptr_page) == 1;
 }
 
-
 #define kvm_pte_table_empty(kvm, ptep) kvm_page_empty(ptep)
 #define kvm_pmd_table_empty(kvm, pmdp) kvm_page_empty(pmdp)
 #define kvm_pud_table_empty(kvm, pudp) (0)
 
 #define KVM_PREALLOC_LEVEL      0
 
-static inline int kvm_prealloc_hwpgd(struct kvm *kvm, pgd_t *pgd)
+static inline void *kvm_get_hwpgd(struct kvm *kvm)
 {
-        return 0;
+        return kvm->arch.pgd;
 }
 
-static inline void kvm_free_hwpgd(struct kvm *kvm) { }
-
-static inline void *kvm_get_hwpgd(struct kvm *kvm)
+static inline unsigned int kvm_get_hwpgd_size(void)
 {
-        return kvm->arch.pgd;
+        return PTRS_PER_S2_PGD * sizeof(pgd_t);
 }
 
 struct kvm;
diff --git a/arch/arm/kernel/setup.c b/arch/arm/kernel/setup.c
index e55408e96559..1d60bebea4b8 100644
--- a/arch/arm/kernel/setup.c
+++ b/arch/arm/kernel/setup.c
@@ -246,12 +246,9 @@ static int __get_cpu_architecture(void)
                 if (cpu_arch)
                         cpu_arch += CPU_ARCH_ARMv3;
         } else if ((read_cpuid_id() & 0x000f0000) == 0x000f0000) {
-                unsigned int mmfr0;
-
                 /* Revised CPUID format. Read the Memory Model Feature
                  * Register 0 and check for VMSAv7 or PMSAv7 */
-                asm("mrc        p15, 0, %0, c0, c1, 4"
-                    : "=r" (mmfr0));
+                unsigned int mmfr0 = read_cpuid_ext(CPUID_EXT_MMFR0);
                 if ((mmfr0 & 0x0000000f) >= 0x00000003 ||
                     (mmfr0 & 0x000000f0) >= 0x00000030)
                         cpu_arch = CPU_ARCH_ARMv7;
diff --git a/arch/arm/kvm/mmu.c b/arch/arm/kvm/mmu.c
index 3e6859bc3e11..5656d79c5a44 100644
--- a/arch/arm/kvm/mmu.c
+++ b/arch/arm/kvm/mmu.c
@@ -290,7 +290,7 @@ static void unmap_range(struct kvm *kvm, pgd_t *pgdp,
         phys_addr_t addr = start, end = start + size;
         phys_addr_t next;
 
-        pgd = pgdp + pgd_index(addr);
+        pgd = pgdp + kvm_pgd_index(addr);
         do {
                 next = kvm_pgd_addr_end(addr, end);
                 if (!pgd_none(*pgd))
@@ -355,7 +355,7 @@ static void stage2_flush_memslot(struct kvm *kvm,
         phys_addr_t next;
         pgd_t *pgd;
 
-        pgd = kvm->arch.pgd + pgd_index(addr);
+        pgd = kvm->arch.pgd + kvm_pgd_index(addr);
         do {
                 next = kvm_pgd_addr_end(addr, end);
                 stage2_flush_puds(kvm, pgd, addr, next);
@@ -632,6 +632,20 @@ int create_hyp_io_mappings(void *from, void *to, phys_addr_t phys_addr)
                                      __phys_to_pfn(phys_addr), PAGE_HYP_DEVICE);
 }
 
+/* Free the HW pgd, one page at a time */
+static void kvm_free_hwpgd(void *hwpgd)
+{
+        free_pages_exact(hwpgd, kvm_get_hwpgd_size());
+}
+
+/* Allocate the HW PGD, making sure that each page gets its own refcount */
+static void *kvm_alloc_hwpgd(void)
+{
+        unsigned int size = kvm_get_hwpgd_size();
+
+        return alloc_pages_exact(size, GFP_KERNEL | __GFP_ZERO);
+}
+
 /**
  * kvm_alloc_stage2_pgd - allocate level-1 table for stage-2 translation.
  * @kvm:        The KVM struct pointer for the VM.
@@ -645,15 +659,31 @@ int create_hyp_io_mappings(void *from, void *to, phys_addr_t phys_addr)
  */
 int kvm_alloc_stage2_pgd(struct kvm *kvm)
 {
-        int ret;
         pgd_t *pgd;
+        void *hwpgd;
 
         if (kvm->arch.pgd != NULL) {
                 kvm_err("kvm_arch already initialized?\n");
                 return -EINVAL;
         }
 
+        hwpgd = kvm_alloc_hwpgd();
+        if (!hwpgd)
+                return -ENOMEM;
+
+        /* When the kernel uses more levels of page tables than the
+         * guest, we allocate a fake PGD and pre-populate it to point
+         * to the next-level page table, which will be the real
+         * initial page table pointed to by the VTTBR.
+         *
+         * When KVM_PREALLOC_LEVEL==2, we allocate a single page for
+         * the PMD and the kernel will use folded pud.
+         * When KVM_PREALLOC_LEVEL==1, we allocate 2 consecutive PUD
+         * pages.
+         */
         if (KVM_PREALLOC_LEVEL > 0) {
+                int i;
+
                 /*
                  * Allocate fake pgd for the page table manipulation macros to
                  * work.  This is not used by the hardware and we have no
@@ -661,30 +691,32 @@ int kvm_alloc_stage2_pgd(struct kvm *kvm)
                  */
                 pgd = (pgd_t *)kmalloc(PTRS_PER_S2_PGD * sizeof(pgd_t),
                                        GFP_KERNEL | __GFP_ZERO);
+
+                if (!pgd) {
+                        kvm_free_hwpgd(hwpgd);
+                        return -ENOMEM;
+                }
+
+                /* Plug the HW PGD into the fake one. */
+                for (i = 0; i < PTRS_PER_S2_PGD; i++) {
+                        if (KVM_PREALLOC_LEVEL == 1)
+                                pgd_populate(NULL, pgd + i,
+                                             (pud_t *)hwpgd + i * PTRS_PER_PUD);
+                        else if (KVM_PREALLOC_LEVEL == 2)
+                                pud_populate(NULL, pud_offset(pgd, 0) + i,
+                                             (pmd_t *)hwpgd + i * PTRS_PER_PMD);
+                }
         } else {
                 /*
                  * Allocate actual first-level Stage-2 page table used by the
                  * hardware for Stage-2 page table walks.
                  */
-                pgd = (pgd_t *)__get_free_pages(GFP_KERNEL | __GFP_ZERO, S2_PGD_ORDER);
+                pgd = (pgd_t *)hwpgd;
         }
 
-        if (!pgd)
-                return -ENOMEM;
-
-        ret = kvm_prealloc_hwpgd(kvm, pgd);
-        if (ret)
-                goto out_err;
-
         kvm_clean_pgd(pgd);
         kvm->arch.pgd = pgd;
         return 0;
-out_err:
-        if (KVM_PREALLOC_LEVEL > 0)
-                kfree(pgd);
-        else
-                free_pages((unsigned long)pgd, S2_PGD_ORDER);
-        return ret;
 }
 
 /**
@@ -785,11 +817,10 @@ void kvm_free_stage2_pgd(struct kvm *kvm)
                 return;
 
         unmap_stage2_range(kvm, 0, KVM_PHYS_SIZE);
-        kvm_free_hwpgd(kvm);
+        kvm_free_hwpgd(kvm_get_hwpgd(kvm));
         if (KVM_PREALLOC_LEVEL > 0)
                 kfree(kvm->arch.pgd);
-        else
-                free_pages((unsigned long)kvm->arch.pgd, S2_PGD_ORDER);
+
         kvm->arch.pgd = NULL;
 }
 
@@ -799,7 +830,7 @@ static pud_t *stage2_get_pud(struct kvm *kvm, struct kvm_mmu_memory_cache *cache
         pgd_t *pgd;
         pud_t *pud;
 
-        pgd = kvm->arch.pgd + pgd_index(addr);
+        pgd = kvm->arch.pgd + kvm_pgd_index(addr);
         if (WARN_ON(pgd_none(*pgd))) {
                 if (!cache)
                         return NULL;
@@ -1089,7 +1120,7 @@ static void stage2_wp_range(struct kvm *kvm, phys_addr_t addr, phys_addr_t end)
         pgd_t *pgd;
         phys_addr_t next;
 
-        pgd = kvm->arch.pgd + pgd_index(addr);
+        pgd = kvm->arch.pgd + kvm_pgd_index(addr);
         do {
                 /*
                  * Release kvm_mmu_lock periodically if the memory region is
diff --git a/arch/arm/mm/cache-l2x0.c b/arch/arm/mm/cache-l2x0.c
index c6c7696b8db9..8f15f70622a6 100644
--- a/arch/arm/mm/cache-l2x0.c
+++ b/arch/arm/mm/cache-l2x0.c
@@ -1131,23 +1131,22 @@ static void __init l2c310_of_parse(const struct device_node *np,
         }
 
         ret = l2x0_cache_size_of_parse(np, aux_val, aux_mask, &assoc, SZ_512K);
-        if (ret)
-                return;
-
-        switch (assoc) {
-        case 16:
-                *aux_val &= ~L2X0_AUX_CTRL_ASSOC_MASK;
-                *aux_val |= L310_AUX_CTRL_ASSOCIATIVITY_16;
-                *aux_mask &= ~L2X0_AUX_CTRL_ASSOC_MASK;
-                break;
-        case 8:
-                *aux_val &= ~L2X0_AUX_CTRL_ASSOC_MASK;
-                *aux_mask &= ~L2X0_AUX_CTRL_ASSOC_MASK;
-                break;
-        default:
-                pr_err("L2C-310 OF cache associativity %d invalid, only 8 or 16 permitted\n",
-                       assoc);
-                break;
+        if (!ret) {
+                switch (assoc) {
+                case 16:
+                        *aux_val &= ~L2X0_AUX_CTRL_ASSOC_MASK;
+                        *aux_val |= L310_AUX_CTRL_ASSOCIATIVITY_16;
+                        *aux_mask &= ~L2X0_AUX_CTRL_ASSOC_MASK;
+                        break;
+                case 8:
+                        *aux_val &= ~L2X0_AUX_CTRL_ASSOC_MASK;
+                        *aux_mask &= ~L2X0_AUX_CTRL_ASSOC_MASK;
+                        break;
+                default:
+                        pr_err("L2C-310 OF cache associativity %d invalid, only 8 or 16 permitted\n",
+                               assoc);
+                        break;
+                }
         }
 
         prefetch = l2x0_saved_regs.prefetch_ctrl;
diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c
index 170a116d1b29..c27447653903 100644
--- a/arch/arm/mm/dma-mapping.c
+++ b/arch/arm/mm/dma-mapping.c
@@ -171,7 +171,7 @@ static int __dma_supported(struct device *dev, u64 mask, bool warn)
          */
         if (sizeof(mask) != sizeof(dma_addr_t) &&
             mask > (dma_addr_t)~0 &&
-            dma_to_pfn(dev, ~0) < max_pfn) {
+            dma_to_pfn(dev, ~0) < max_pfn - 1) {
                 if (warn) {
                         dev_warn(dev, "Coherent DMA mask %#llx is larger than dma_addr_t allows\n",
                                  mask);
diff --git a/arch/arm/mm/fault.c b/arch/arm/mm/fault.c
index a982dc3190df..6333d9c17875 100644
--- a/arch/arm/mm/fault.c
+++ b/arch/arm/mm/fault.c
@@ -552,6 +552,7 @@ do_DataAbort(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
 
         pr_alert("Unhandled fault: %s (0x%03x) at 0x%08lx\n",
                 inf->name, fsr, addr);
+        show_pte(current->mm, addr);
 
         info.si_signo = inf->sig;
         info.si_errno = 0;
diff --git a/arch/arm/mm/pageattr.c b/arch/arm/mm/pageattr.c
index 004e35cdcfff..cf30daff8932 100644
--- a/arch/arm/mm/pageattr.c
+++ b/arch/arm/mm/pageattr.c
@@ -49,7 +49,10 @@ static int change_memory_common(unsigned long addr, int numpages,
                 WARN_ON_ONCE(1);
         }
 
-        if (!is_module_address(start) || !is_module_address(end - 1))
+        if (start < MODULES_VADDR || start >= MODULES_END)
+                return -EINVAL;
+
+        if (end < MODULES_VADDR || start >= MODULES_END)
                 return -EINVAL;
 
         data.set_mask = set_mask;
diff --git a/arch/arm64/include/asm/kvm_arm.h b/arch/arm64/include/asm/kvm_arm.h
index 94674eb7e7bb..54bb4ba97441 100644
--- a/arch/arm64/include/asm/kvm_arm.h
+++ b/arch/arm64/include/asm/kvm_arm.h
@@ -129,6 +129,9 @@
  * 40 bits wide (T0SZ = 24).  Systems with a PARange smaller than 40 bits are
  * not known to exist and will break with this configuration.
  *
+ * VTCR_EL2.PS is extracted from ID_AA64MMFR0_EL1.PARange at boot time
+ * (see hyp-init.S).
+ *
  * Note that when using 4K pages, we concatenate two first level page tables
  * together.
  *
@@ -138,7 +141,6 @@
 #ifdef CONFIG_ARM64_64K_PAGES
 /*
  * Stage2 translation configuration:
- * 40bits output (PS = 2)
  * 40bits input  (T0SZ = 24)
  * 64kB pages (TG0 = 1)
  * 2 level page tables (SL = 1)
@@ -150,7 +152,6 @@
 #else
 /*
  * Stage2 translation configuration:
- * 40bits output (PS = 2)
  * 40bits input  (T0SZ = 24)
  * 4kB pages (TG0 = 0)
  * 3 level page tables (SL = 1)
diff --git a/arch/arm64/include/asm/kvm_mmu.h b/arch/arm64/include/asm/kvm_mmu.h
index 6458b5373142..bbfb600fa822 100644
--- a/arch/arm64/include/asm/kvm_mmu.h
+++ b/arch/arm64/include/asm/kvm_mmu.h
@@ -158,6 +158,8 @@ static inline bool kvm_s2pmd_readonly(pmd_t *pmd)
 #define PTRS_PER_S2_PGD         (1 << PTRS_PER_S2_PGD_SHIFT)
 #define S2_PGD_ORDER            get_order(PTRS_PER_S2_PGD * sizeof(pgd_t))
 
+#define kvm_pgd_index(addr)     (((addr) >> PGDIR_SHIFT) & (PTRS_PER_S2_PGD - 1))
+
 /*
  * If we are concatenating first level stage-2 page tables, we would have less
  * than or equal to 16 pointers in the fake PGD, because that's what the
@@ -171,43 +173,6 @@ static inline bool kvm_s2pmd_readonly(pmd_t *pmd)
 #define KVM_PREALLOC_LEVEL      (0)
 #endif
 
-/**
- * kvm_prealloc_hwpgd - allocate inital table for VTTBR
- * @kvm:        The KVM struct pointer for the VM.
- * @pgd:        The kernel pseudo pgd
- *
- * When the kernel uses more levels of page tables than the guest, we allocate
- * a fake PGD and pre-populate it to point to the next-level page table, which
- * will be the real initial page table pointed to by the VTTBR.
- *
- * When KVM_PREALLOC_LEVEL==2, we allocate a single page for the PMD and
- * the kernel will use folded pud.  When KVM_PREALLOC_LEVEL==1, we
- * allocate 2 consecutive PUD pages.
- */
-static inline int kvm_prealloc_hwpgd(struct kvm *kvm, pgd_t *pgd)
-{
-        unsigned int i;
-        unsigned long hwpgd;
-
-        if (KVM_PREALLOC_LEVEL == 0)
-                return 0;
-
-        hwpgd = __get_free_pages(GFP_KERNEL | __GFP_ZERO, PTRS_PER_S2_PGD_SHIFT);
-        if (!hwpgd)
-                return -ENOMEM;
-
-        for (i = 0; i < PTRS_PER_S2_PGD; i++) {
-                if (KVM_PREALLOC_LEVEL == 1)
-                        pgd_populate(NULL, pgd + i,
-                                     (pud_t *)hwpgd + i * PTRS_PER_PUD);
-                else if (KVM_PREALLOC_LEVEL == 2)
-                        pud_populate(NULL, pud_offset(pgd, 0) + i,
-                                     (pmd_t *)hwpgd + i * PTRS_PER_PMD);
-        }
-
-        return 0;
-}
-
 static inline void *kvm_get_hwpgd(struct kvm *kvm)
 {
         pgd_t *pgd = kvm->arch.pgd;
@@ -224,12 +189,11 @@ static inline void *kvm_get_hwpgd(struct kvm *kvm)
         return pmd_offset(pud, 0);
 }
 
-static inline void kvm_free_hwpgd(struct kvm *kvm)
+static inline unsigned int kvm_get_hwpgd_size(void)
 {
-        if (KVM_PREALLOC_LEVEL > 0) {
-                unsigned long hwpgd = (unsigned long)kvm_get_hwpgd(kvm);
-                free_pages(hwpgd, PTRS_PER_S2_PGD_SHIFT);
-        }
+        if (KVM_PREALLOC_LEVEL > 0)
+                return PTRS_PER_S2_PGD * PAGE_SIZE;
+        return PTRS_PER_S2_PGD * sizeof(pgd_t);
 }
 
 static inline bool kvm_page_empty(void *ptr)
diff --git a/arch/arm64/include/asm/proc-fns.h b/arch/arm64/include/asm/proc-fns.h
index 9a8fd84f8fb2..941c375616e2 100644
--- a/arch/arm64/include/asm/proc-fns.h
+++ b/arch/arm64/include/asm/proc-fns.h
@@ -39,7 +39,11 @@ extern u64 cpu_do_resume(phys_addr_t ptr, u64 idmap_ttbr);
 
 #include <asm/memory.h>
 
-#define cpu_switch_mm(pgd,mm) cpu_do_switch_mm(virt_to_phys(pgd),mm)
+#define cpu_switch_mm(pgd,mm)                           \
+do {                                                    \
+        BUG_ON(pgd == swapper_pg_dir);                  \
+        cpu_do_switch_mm(virt_to_phys(pgd),mm);         \
+} while (0)
 
 #define cpu_get_pgd()                                   \
 ({                                                      \
diff --git a/arch/arm64/kernel/efi.c b/arch/arm64/kernel/efi.c
index 2b8d70164428..ab21e0d58278 100644
--- a/arch/arm64/kernel/efi.c
+++ b/arch/arm64/kernel/efi.c
@@ -337,7 +337,11 @@ core_initcall(arm64_dmi_init);
 
 static void efi_set_pgd(struct mm_struct *mm)
 {
-        cpu_switch_mm(mm->pgd, mm);
+        if (mm == &init_mm)
+                cpu_set_reserved_ttbr0();
+        else
+                cpu_switch_mm(mm->pgd, mm);
+
         flush_tlb_all();
         if (icache_is_aivivt())
                 __flush_icache_all();
diff --git a/arch/arm64/mm/dma-mapping.c b/arch/arm64/mm/dma-mapping.c
index 58e0c2bdde04..ef7d112f5ce0 100644
--- a/arch/arm64/mm/dma-mapping.c
+++ b/arch/arm64/mm/dma-mapping.c
@@ -51,7 +51,7 @@ static int __init early_coherent_pool(char *p)
 }
 early_param("coherent_pool", early_coherent_pool);
 
-static void *__alloc_from_pool(size_t size, struct page **ret_page)
+static void *__alloc_from_pool(size_t size, struct page **ret_page, gfp_t flags)
 {
         unsigned long val;
         void *ptr = NULL;
@@ -67,6 +67,8 @@ static void *__alloc_from_pool(size_t size, struct page **ret_page)
 
                 *ret_page = phys_to_page(phys);
                 ptr = (void *)val;
+                if (flags & __GFP_ZERO)
+                        memset(ptr, 0, size);
         }
 
         return ptr;
@@ -101,6 +103,7 @@ static void *__dma_alloc_coherent(struct device *dev, size_t size,
                 flags |= GFP_DMA;
         if (IS_ENABLED(CONFIG_DMA_CMA) && (flags & __GFP_WAIT)) {
                 struct page *page;
+                void *addr;
 
                 size = PAGE_ALIGN(size);
                 page = dma_alloc_from_contiguous(dev, size >> PAGE_SHIFT,
@@ -109,7 +112,10 @@ static void *__dma_alloc_coherent(struct device *dev, size_t size,
                         return NULL;
 
                 *dma_handle = phys_to_dma(dev, page_to_phys(page));
-                return page_address(page);
+                addr = page_address(page);
+                if (flags & __GFP_ZERO)
+                        memset(addr, 0, size);
+                return addr;
         } else {
                 return swiotlb_alloc_coherent(dev, size, dma_handle, flags);
         }
@@ -146,7 +152,7 @@ static void *__dma_alloc(struct device *dev, size_t size,
 
         if (!coherent && !(flags & __GFP_WAIT)) {
                 struct page *page = NULL;
-                void *addr = __alloc_from_pool(size, &page);
+                void *addr = __alloc_from_pool(size, &page, flags);
 
                 if (addr)
                         *dma_handle = phys_to_dma(dev, page_to_phys(page));
diff --git a/arch/nios2/include/uapi/asm/Kbuild b/arch/nios2/include/uapi/asm/Kbuild
index 376131194cc3..e0bb972a50d7 100644
--- a/arch/nios2/include/uapi/asm/Kbuild
+++ b/arch/nios2/include/uapi/asm/Kbuild
@@ -1,6 +1,5 @@
 include include/uapi/asm-generic/Kbuild.asm
 
 header-y += elf.h
-header-y += ucontext.h
 
 generic-y += ucontext.h
diff --git a/arch/nios2/mm/fault.c b/arch/nios2/mm/fault.c
index 0d231adfe576..0c9b6afe69e9 100644
--- a/arch/nios2/mm/fault.c
+++ b/arch/nios2/mm/fault.c
@@ -126,7 +126,6 @@ good_area:
                 break;
         }
 
-survive:
         /*
          * If for any reason at all we couldn't handle the fault,
          * make sure we exit gracefully rather than endlessly redo
@@ -220,11 +219,6 @@ no_context:
  */
 out_of_memory:
         up_read(&mm->mmap_sem);
-        if (is_global_init(tsk)) {
-                yield();
-                down_read(&mm->mmap_sem);
-                goto survive;
-        }
         if (!user_mode(regs))
                 goto no_context;
         pagefault_out_of_memory();
diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
index f6579cfde2df..19e17bd7aec0 100644
--- a/arch/s390/kvm/kvm-s390.c
+++ b/arch/s390/kvm/kvm-s390.c
@@ -165,7 +165,6 @@ int kvm_vm_ioctl_check_extension(struct kvm *kvm, long ext)
         case KVM_CAP_ONE_REG:
         case KVM_CAP_ENABLE_CAP:
         case KVM_CAP_S390_CSS_SUPPORT:
-        case KVM_CAP_IRQFD:
         case KVM_CAP_IOEVENTFD:
         case KVM_CAP_DEVICE_CTRL:
         case KVM_CAP_ENABLE_CAP_VM:
diff --git a/arch/sparc/Kconfig b/arch/sparc/Kconfig
index 96ac69c5eba0..efb00ec75805 100644
--- a/arch/sparc/Kconfig
+++ b/arch/sparc/Kconfig
@@ -86,6 +86,9 @@ config ARCH_DEFCONFIG
         default "arch/sparc/configs/sparc32_defconfig" if SPARC32
         default "arch/sparc/configs/sparc64_defconfig" if SPARC64
 
+config ARCH_PROC_KCORE_TEXT
+        def_bool y
+
 config IOMMU_HELPER
         bool
         default y if SPARC64
diff --git a/arch/sparc/include/asm/io_64.h b/arch/sparc/include/asm/io_64.h
index 9b672be70dda..50d4840d9aeb 100644
--- a/arch/sparc/include/asm/io_64.h
+++ b/arch/sparc/include/asm/io_64.h
@@ -407,16 +407,16 @@ static inline void iounmap(volatile void __iomem *addr)
 {
 }
 
-#define ioread8(X)                      readb(X)
-#define ioread16(X)                     readw(X)
-#define ioread16be(X)                   __raw_readw(X)
-#define ioread32(X)                     readl(X)
-#define ioread32be(X)                   __raw_readl(X)
-#define iowrite8(val,X)                 writeb(val,X)
-#define iowrite16(val,X)                writew(val,X)
-#define iowrite16be(val,X)              __raw_writew(val,X)
-#define iowrite32(val,X)                writel(val,X)
-#define iowrite32be(val,X)              __raw_writel(val,X)
+#define ioread8                 readb
+#define ioread16                readw
+#define ioread16be              __raw_readw
+#define ioread32                readl
+#define ioread32be              __raw_readl
+#define iowrite8                writeb
+#define iowrite16               writew
+#define iowrite16be             __raw_writew
+#define iowrite32               writel
+#define iowrite32be             __raw_writel
 
 /* Create a virtual mapping cookie for an IO port range */
 void __iomem *ioport_map(unsigned long port, unsigned int nr);
diff --git a/arch/sparc/include/asm/starfire.h b/arch/sparc/include/asm/starfire.h
index c100dc27a0a9..176fa0ad19f1 100644
--- a/arch/sparc/include/asm/starfire.h
+++ b/arch/sparc/include/asm/starfire.h
@@ -12,7 +12,6 @@
 extern int this_is_starfire;
 
 void check_if_starfire(void);
-int starfire_hard_smp_processor_id(void);
 void starfire_hookup(int);
 unsigned int starfire_translate(unsigned long imap, unsigned int upaid);
 
diff --git a/arch/sparc/kernel/entry.h b/arch/sparc/kernel/entry.h
index 88d322b67fac..07cc49e541f4 100644
--- a/arch/sparc/kernel/entry.h
+++ b/arch/sparc/kernel/entry.h
@@ -98,11 +98,7 @@ void sun4v_do_mna(struct pt_regs *regs,
 void do_privop(struct pt_regs *regs);
 void do_privact(struct pt_regs *regs);
 void do_cee(struct pt_regs *regs);
-void do_cee_tl1(struct pt_regs *regs);
-void do_dae_tl1(struct pt_regs *regs);
-void do_iae_tl1(struct pt_regs *regs);
 void do_div0_tl1(struct pt_regs *regs);
-void do_fpdis_tl1(struct pt_regs *regs);
 void do_fpieee_tl1(struct pt_regs *regs);
 void do_fpother_tl1(struct pt_regs *regs);
 void do_ill_tl1(struct pt_regs *regs);
diff --git a/arch/sparc/kernel/smp_64.c b/arch/sparc/kernel/smp_64.c
index da6f1a7fc4db..61139d9924ca 100644
--- a/arch/sparc/kernel/smp_64.c
+++ b/arch/sparc/kernel/smp_64.c
@@ -1406,11 +1406,32 @@ void __irq_entry smp_receive_signal_client(int irq, struct pt_regs *regs)
         scheduler_ipi();
 }
 
-/* This is a nop because we capture all other cpus
- * anyways when making the PROM active.
- */
+static void stop_this_cpu(void *dummy)
+{
+        prom_stopself();
+}
+
 void smp_send_stop(void)
 {
+        int cpu;
+
+        if (tlb_type == hypervisor) {
+                for_each_online_cpu(cpu) {
+                        if (cpu == smp_processor_id())
+                                continue;
+#ifdef CONFIG_SUN_LDOMS
+                        if (ldom_domaining_enabled) {
+                                unsigned long hv_err;
+                                hv_err = sun4v_cpu_stop(cpu);
+                                if (hv_err)
+                                        printk(KERN_ERR "sun4v_cpu_stop() "
+                                               "failed err=%lu\n", hv_err);
+                        } else
+#endif
+                                prom_stopcpu_cpuid(cpu);
+                }
+        } else
+                smp_call_function(stop_this_cpu, NULL, 0);
 }
 
 /**
diff --git a/arch/sparc/kernel/starfire.c b/arch/sparc/kernel/starfire.c
index 82281a566bb8..167fdfd9c837 100644
--- a/arch/sparc/kernel/starfire.c
+++ b/arch/sparc/kernel/starfire.c
@@ -28,11 +28,6 @@ void check_if_starfire(void)
                 this_is_starfire = 1;
 }
 
-int starfire_hard_smp_processor_id(void)
-{
-        return upa_readl(0x1fff40000d0UL);
-}
-
 /*
  * Each Starfire board has 32 registers which perform translation
  * and delivery of traditional interrupt packets into the extended
diff --git a/arch/sparc/kernel/sys_sparc_64.c b/arch/sparc/kernel/sys_sparc_64.c
index c85403d0496c..30e7ddb27a3a 100644
--- a/arch/sparc/kernel/sys_sparc_64.c
+++ b/arch/sparc/kernel/sys_sparc_64.c
@@ -333,7 +333,7 @@ SYSCALL_DEFINE6(sparc_ipc, unsigned int, call, int, first, unsigned long, second
         long err;
 
         /* No need for backward compatibility. We can start fresh... */
-        if (call <= SEMCTL) {
+        if (call <= SEMTIMEDOP) {
                 switch (call) {
                 case SEMOP:
                         err = sys_semtimedop(first, ptr,
diff --git a/arch/sparc/kernel/traps_64.c b/arch/sparc/kernel/traps_64.c
index a27651e866e7..0e699745d643 100644
--- a/arch/sparc/kernel/traps_64.c
+++ b/arch/sparc/kernel/traps_64.c
@@ -2427,6 +2427,8 @@ void __noreturn die_if_kernel(char *str, struct pt_regs *regs)
                 }
                 user_instruction_dump ((unsigned int __user *) regs->tpc);
         }
+        if (panic_on_oops)
+                panic("Fatal exception");
         if (regs->tstate & TSTATE_PRIV)
                 do_exit(SIGKILL);
         do_exit(SIGSEGV);
@@ -2564,27 +2566,6 @@ void do_cee(struct pt_regs *regs)
         die_if_kernel("TL0: Cache Error Exception", regs);
 }
 
-void do_cee_tl1(struct pt_regs *regs)
-{
-        exception_enter();
-        dump_tl1_traplog((struct tl1_traplog *)(regs + 1));
-        die_if_kernel("TL1: Cache Error Exception", regs);
-}
-
-void do_dae_tl1(struct pt_regs *regs)
-{
-        exception_enter();
-        dump_tl1_traplog((struct tl1_traplog *)(regs + 1));
-        die_if_kernel("TL1: Data Access Exception", regs);
-}
-
-void do_iae_tl1(struct pt_regs *regs)
-{
-        exception_enter();
-        dump_tl1_traplog((struct tl1_traplog *)(regs + 1));
-        die_if_kernel("TL1: Instruction Access Exception", regs);
-}
-
 void do_div0_tl1(struct pt_regs *regs)
 {
         exception_enter();
@@ -2592,13 +2573,6 @@ void do_div0_tl1(struct pt_regs *regs)
         die_if_kernel("TL1: DIV0 Exception", regs);
 }
 
-void do_fpdis_tl1(struct pt_regs *regs)
-{
-        exception_enter();
-        dump_tl1_traplog((struct tl1_traplog *)(regs + 1));
-        die_if_kernel("TL1: FPU Disabled", regs);
-}
-
 void do_fpieee_tl1(struct pt_regs *regs)
 {
         exception_enter();
diff --git a/arch/sparc/mm/init_64.c b/arch/sparc/mm/init_64.c
index 3ea267c53320..4ca0d6ba5ec8 100644
--- a/arch/sparc/mm/init_64.c
+++ b/arch/sparc/mm/init_64.c
@@ -2820,7 +2820,7 @@ static int __init report_memory(void)
 
         return 0;
 }
-device_initcall(report_memory);
+arch_initcall(report_memory);
 
 #ifdef CONFIG_SMP
 #define do_flush_tlb_kernel_range       smp_flush_tlb_kernel_range
diff --git a/arch/x86/boot/compressed/aslr.c b/arch/x86/boot/compressed/aslr.c
index 7083c16cccba..bb1376381985 100644
--- a/arch/x86/boot/compressed/aslr.c
+++ b/arch/x86/boot/compressed/aslr.c
@@ -14,13 +14,6 @@
 static const char build_str[] = UTS_RELEASE " (" LINUX_COMPILE_BY "@"
                 LINUX_COMPILE_HOST ") (" LINUX_COMPILER ") " UTS_VERSION;
 
-struct kaslr_setup_data {
-        __u64 next;
-        __u32 type;
-        __u32 len;
-        __u8 data[1];
-} kaslr_setup_data;
-
 #define I8254_PORT_CONTROL      0x43
 #define I8254_PORT_COUNTER0     0x40
 #define I8254_CMD_READBACK      0xC0
@@ -302,29 +295,7 @@ static unsigned long find_random_addr(unsigned long minimum,
         return slots_fetch_random();
 }
 
-static void add_kaslr_setup_data(struct boot_params *params, __u8 enabled)
-{
-        struct setup_data *data;
-
-        kaslr_setup_data.type = SETUP_KASLR;
-        kaslr_setup_data.len = 1;
-        kaslr_setup_data.next = 0;
-        kaslr_setup_data.data[0] = enabled;
-
-        data = (struct setup_data *)(unsigned long)params->hdr.setup_data;
-
-        while (data && data->next)
-                data = (struct setup_data *)(unsigned long)data->next;
-
-        if (data)
-                data->next = (unsigned long)&kaslr_setup_data;
-        else
-                params->hdr.setup_data = (unsigned long)&kaslr_setup_data;
-
-}
-
-unsigned char *choose_kernel_location(struct boot_params *params,
-                                      unsigned char *input,
+unsigned char *choose_kernel_location(unsigned char *input,
                                       unsigned long input_size,
                                       unsigned char *output,
                                       unsigned long output_size)
@@ -335,17 +306,14 @@ unsigned char *choose_kernel_location(struct boot_params *params,
 #ifdef CONFIG_HIBERNATION
         if (!cmdline_find_option_bool("kaslr")) {
                 debug_putstr("KASLR disabled by default...\n");
-                add_kaslr_setup_data(params, 0);
                 goto out;
         }
 #else
         if (cmdline_find_option_bool("nokaslr")) {
                 debug_putstr("KASLR disabled by cmdline...\n");
-                add_kaslr_setup_data(params, 0);
                 goto out;
         }
 #endif
-        add_kaslr_setup_data(params, 1);
 
         /* Record the various known unsafe memory ranges. */
         mem_avoid_init((unsigned long)input, input_size,
diff --git a/arch/x86/boot/compressed/misc.c b/arch/x86/boot/compressed/misc.c
index 5903089c818f..a950864a64da 100644
--- a/arch/x86/boot/compressed/misc.c
+++ b/arch/x86/boot/compressed/misc.c
@@ -401,8 +401,7 @@ asmlinkage __visible void *decompress_kernel(void *rmode, memptr heap,
          * the entire decompressed kernel plus relocation table, or the
          * entire decompressed kernel plus .bss and .brk sections.
          */
-        output = choose_kernel_location(real_mode, input_data, input_len,
-                                        output,
+        output = choose_kernel_location(input_data, input_len, output,
                                         output_len > run_size ? output_len
                                                               : run_size);
 
diff --git a/arch/x86/boot/compressed/misc.h b/arch/x86/boot/compressed/misc.h
index ee3576b2666b..04477d68403f 100644
--- a/arch/x86/boot/compressed/misc.h
+++ b/arch/x86/boot/compressed/misc.h
@@ -57,8 +57,7 @@ int cmdline_find_option_bool(const char *option);
 
 #if CONFIG_RANDOMIZE_BASE
 /* aslr.c */
-unsigned char *choose_kernel_location(struct boot_params *params,
-                                      unsigned char *input,
+unsigned char *choose_kernel_location(unsigned char *input,
                                       unsigned long input_size,
                                       unsigned char *output,
                                       unsigned long output_size);
@@ -66,8 +65,7 @@ unsigned char *choose_kernel_location(struct boot_params *params,
 bool has_cpuflag(int flag);
 #else
 static inline
-unsigned char *choose_kernel_location(struct boot_params *params,
-                                      unsigned char *input,
+unsigned char *choose_kernel_location(unsigned char *input,
                                       unsigned long input_size,
                                       unsigned char *output,
                                       unsigned long output_size)
diff --git a/arch/x86/crypto/aesni-intel_glue.c b/arch/x86/crypto/aesni-intel_glue.c
index 947c6bf52c33..54f60ab41c63 100644
--- a/arch/x86/crypto/aesni-intel_glue.c
+++ b/arch/x86/crypto/aesni-intel_glue.c
@@ -1155,7 +1155,7 @@ static int __driver_rfc4106_decrypt(struct aead_request *req)
                 src = kmalloc(req->cryptlen + req->assoclen, GFP_ATOMIC);
                 if (!src)
                         return -ENOMEM;
-                assoc = (src + req->cryptlen + auth_tag_len);
+                assoc = (src + req->cryptlen);
                 scatterwalk_map_and_copy(src, req->src, 0, req->cryptlen, 0);
                 scatterwalk_map_and_copy(assoc, req->assoc, 0,
                         req->assoclen, 0);
@@ -1180,7 +1180,7 @@ static int __driver_rfc4106_decrypt(struct aead_request *req)
                 scatterwalk_done(&src_sg_walk, 0, 0);
                 scatterwalk_done(&assoc_sg_walk, 0, 0);
         } else {
-                scatterwalk_map_and_copy(dst, req->dst, 0, req->cryptlen, 1);
+                scatterwalk_map_and_copy(dst, req->dst, 0, tempCipherLen, 1);
                 kfree(src);
         }
         return retval;
diff --git a/arch/x86/include/asm/fpu-internal.h b/arch/x86/include/asm/fpu-internal.h
index 0dbc08282291..72ba21a8b5fc 100644
--- a/arch/x86/include/asm/fpu-internal.h
+++ b/arch/x86/include/asm/fpu-internal.h
@@ -370,7 +370,7 @@ static inline void drop_fpu(struct task_struct *tsk)
         preempt_disable();
         tsk->thread.fpu_counter = 0;
         __drop_fpu(tsk);
-        clear_used_math();
+        clear_stopped_child_used_math(tsk);
         preempt_enable();
 }
 
diff --git a/arch/x86/include/asm/page_types.h b/arch/x86/include/asm/page_types.h
index 95e11f79f123..f97fbe3abb67 100644
--- a/arch/x86/include/asm/page_types.h
+++ b/arch/x86/include/asm/page_types.h
@@ -51,8 +51,6 @@ extern int devmem_is_allowed(unsigned long pagenr);
 extern unsigned long max_low_pfn_mapped;
 extern unsigned long max_pfn_mapped;
 
-extern bool kaslr_enabled;
-
 static inline phys_addr_t get_max_mapped(void)
 {
         return (phys_addr_t)max_pfn_mapped << PAGE_SHIFT;
diff --git a/arch/x86/include/asm/pci_x86.h b/arch/x86/include/asm/pci_x86.h
index fa1195dae425..164e3f8d3c3d 100644
--- a/arch/x86/include/asm/pci_x86.h
+++ b/arch/x86/include/asm/pci_x86.h
@@ -93,6 +93,8 @@ extern raw_spinlock_t pci_config_lock;
 extern int (*pcibios_enable_irq)(struct pci_dev *dev);
 extern void (*pcibios_disable_irq)(struct pci_dev *dev);
 
+extern bool mp_should_keep_irq(struct device *dev);
+
 struct pci_raw_ops {
         int (*read)(unsigned int domain, unsigned int bus, unsigned int devfn,
                                                 int reg, int len, u32 *val);
diff --git a/arch/x86/include/uapi/asm/bootparam.h b/arch/x86/include/uapi/asm/bootparam.h
index 44e6dd7e36a2..225b0988043a 100644
--- a/arch/x86/include/uapi/asm/bootparam.h
+++ b/arch/x86/include/uapi/asm/bootparam.h
@@ -7,7 +7,6 @@
 #define SETUP_DTB                       2
 #define SETUP_PCI                       3
 #define SETUP_EFI                       4
-#define SETUP_KASLR                     5
 
 /* ram_size flags */
 #define RAMDISK_IMAGE_START_MASK        0x07FF
diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c
index 3d525c6124f6..803b684676ff 100644
--- a/arch/x86/kernel/acpi/boot.c
+++ b/arch/x86/kernel/acpi/boot.c
@@ -1338,6 +1338,26 @@ static int __init dmi_ignore_irq0_timer_override(const struct dmi_system_id *d)
 }
 
 /*
+ * ACPI offers an alternative platform interface model that removes
+ * ACPI hardware requirements for platforms that do not implement
+ * the PC Architecture.
+ *
+ * We initialize the Hardware-reduced ACPI model here:
+ */
+static void __init acpi_reduced_hw_init(void)
+{
+        if (acpi_gbl_reduced_hardware) {
+                /*
+                 * Override x86_init functions and bypass legacy pic
+                 * in Hardware-reduced ACPI mode
+                 */
+                x86_init.timers.timer_init      = x86_init_noop;
+                x86_init.irqs.pre_vector_init   = x86_init_noop;
+                legacy_pic                      = &null_legacy_pic;
+        }
+}
+
+/*
  * If your system is blacklisted here, but you find that acpi=force
  * works for you, please contact linux-acpi@vger.kernel.org
  */
@@ -1536,6 +1556,11 @@ int __init early_acpi_boot_init(void)
          */
         early_acpi_process_madt();
 
+        /*
+         * Hardware-reduced ACPI mode initialization:
+         */
+        acpi_reduced_hw_init();
+
         return 0;
 }
 
diff --git a/arch/x86/kernel/apic/apic_numachip.c b/arch/x86/kernel/apic/apic_numachip.c
index c2fd21fed002..017149cded07 100644
--- a/arch/x86/kernel/apic/apic_numachip.c
+++ b/arch/x86/kernel/apic/apic_numachip.c
@@ -37,10 +37,12 @@ static const struct apic apic_numachip;
 static unsigned int get_apic_id(unsigned long x)
 {
         unsigned long value;
-        unsigned int id;
+        unsigned int id = (x >> 24) & 0xff;
 
-        rdmsrl(MSR_FAM10H_NODE_ID, value);
-        id = ((x >> 24) & 0xffU) | ((value << 2) & 0xff00U);
+        if (static_cpu_has_safe(X86_FEATURE_NODEID_MSR)) {
+                rdmsrl(MSR_FAM10H_NODE_ID, value);
+                id |= (value << 2) & 0xff00;
+        }
 
         return id;
 }
@@ -155,10 +157,18 @@ static int __init numachip_probe(void)
 
 static void fixup_cpu_id(struct cpuinfo_x86 *c, int node)
 {
-        if (c->phys_proc_id != node) {
-                c->phys_proc_id = node;
-                per_cpu(cpu_llc_id, smp_processor_id()) = node;
+        u64 val;
+        u32 nodes = 1;
+
+        this_cpu_write(cpu_llc_id, node);
+
+        /* Account for nodes per socket in multi-core-module processors */
+        if (static_cpu_has_safe(X86_FEATURE_NODEID_MSR)) {
+                rdmsrl(MSR_FAM10H_NODE_ID, val);
+                nodes = ((val >> 3) & 7) + 1;
         }
+
+        c->phys_proc_id = node / nodes;
 }
 
 static int __init numachip_system_init(void)
diff --git a/arch/x86/kernel/module.c b/arch/x86/kernel/module.c
index 9bbb9b35c144..d1ac80b72c72 100644
--- a/arch/x86/kernel/module.c
+++ b/arch/x86/kernel/module.c
@@ -47,13 +47,21 @@ do {							\
 
 #ifdef CONFIG_RANDOMIZE_BASE
 static unsigned long module_load_offset;
+static int randomize_modules = 1;
 
 /* Mutex protects the module_load_offset. */
 static DEFINE_MUTEX(module_kaslr_mutex);
 
+static int __init parse_nokaslr(char *p)
+{
+        randomize_modules = 0;
+        return 0;
+}
+early_param("nokaslr", parse_nokaslr);
+
 static unsigned long int get_module_load_offset(void)
 {
-        if (kaslr_enabled) {
+        if (randomize_modules) {
                 mutex_lock(&module_kaslr_mutex);
                 /*
                  * Calculate the module_load_offset the first time this
diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
index 98dc9317286e..0a2421cca01f 100644
--- a/arch/x86/kernel/setup.c
+++ b/arch/x86/kernel/setup.c
@@ -122,8 +122,6 @@
 unsigned long max_low_pfn_mapped;
 unsigned long max_pfn_mapped;
 
-bool __read_mostly kaslr_enabled = false;
-
 #ifdef CONFIG_DMI
 RESERVE_BRK(dmi_alloc, 65536);
 #endif
@@ -427,11 +425,6 @@ static void __init reserve_initrd(void)
 }
 #endif /* CONFIG_BLK_DEV_INITRD */
 
-static void __init parse_kaslr_setup(u64 pa_data, u32 data_len)
-{
-        kaslr_enabled = (bool)(pa_data + sizeof(struct setup_data));
-}
-
 static void __init parse_setup_data(void)
 {
         struct setup_data *data;
@@ -457,9 +450,6 @@ static void __init parse_setup_data(void)
                 case SETUP_EFI:
                         parse_efi_setup(pa_data, data_len);
                         break;
-                case SETUP_KASLR:
-                        parse_kaslr_setup(pa_data, data_len);
-                        break;
                 default:
                         break;
                 }
@@ -842,14 +832,10 @@ static void __init trim_low_memory_range(void)
 static int
 dump_kernel_offset(struct notifier_block *self, unsigned long v, void *p)
 {
-        if (kaslr_enabled)
-                pr_emerg("Kernel Offset: 0x%lx from 0x%lx (relocation range: 0x%lx-0x%lx)\n",
-                         (unsigned long)&_text - __START_KERNEL,
-                         __START_KERNEL,
-                         __START_KERNEL_map,
-                         MODULES_VADDR-1);
-        else
-                pr_emerg("Kernel Offset: disabled\n");
+        pr_emerg("Kernel Offset: 0x%lx from 0x%lx "
+                 "(relocation range: 0x%lx-0x%lx)\n",
+                 (unsigned long)&_text - __START_KERNEL, __START_KERNEL,
+                 __START_KERNEL_map, MODULES_VADDR-1);
 
         return 0;
 }
diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
index 9d2073e2ecc9..4ff5d162ff9f 100644
--- a/arch/x86/kernel/traps.c
+++ b/arch/x86/kernel/traps.c
@@ -384,7 +384,7 @@ dotraplinkage void do_bounds(struct pt_regs *regs, long error_code)
                 goto exit;
         conditional_sti(regs);
 
-        if (!user_mode(regs))
+        if (!user_mode_vm(regs))
                 die("bounds", regs, error_code);
 
         if (!cpu_feature_enabled(X86_FEATURE_MPX)) {
@@ -637,7 +637,7 @@ dotraplinkage void do_debug(struct pt_regs *regs, long error_code)
          * then it's very likely the result of an icebp/int01 trap.
          * User wants a sigtrap for that.
          */
-        if (!dr6 && user_mode(regs))
+        if (!dr6 && user_mode_vm(regs))
                 user_icebp = 1;
 
         /* Catch kmemcheck conditions first of all! */
diff --git a/arch/x86/kernel/xsave.c b/arch/x86/kernel/xsave.c
index 34f66e58a896..cdc6cf903078 100644
--- a/arch/x86/kernel/xsave.c
+++ b/arch/x86/kernel/xsave.c
@@ -379,7 +379,7 @@ int __restore_xstate_sig(void __user *buf, void __user *buf_fx, int size)
                  * thread's fpu state, reconstruct fxstate from the fsave
                  * header. Sanitize the copied state etc.
                  */
-                struct xsave_struct *xsave = &tsk->thread.fpu.state->xsave;
+                struct fpu *fpu = &tsk->thread.fpu;
                 struct user_i387_ia32_struct env;
                 int err = 0;
 
@@ -393,14 +393,15 @@ int __restore_xstate_sig(void __user *buf, void __user *buf_fx, int size)
                  */
                 drop_fpu(tsk);
 
-                if (__copy_from_user(xsave, buf_fx, state_size) ||
+                if (__copy_from_user(&fpu->state->xsave, buf_fx, state_size) ||
                     __copy_from_user(&env, buf, sizeof(env))) {
+                        fpu_finit(fpu);
                         err = -1;
                 } else {
                         sanitize_restored_xstate(tsk, &env, xstate_bv, fx_only);
-                        set_used_math();
                 }
 
+                set_used_math();
                 if (use_eager_fpu()) {
                         preempt_disable();
                         math_state_restore();
diff --git a/arch/x86/kvm/i8259.c b/arch/x86/kvm/i8259.c
index cc31f7c06d3d..9541ba34126b 100644
--- a/arch/x86/kvm/i8259.c
+++ b/arch/x86/kvm/i8259.c
@@ -507,6 +507,7 @@ static int picdev_read(struct kvm_pic *s,
                 return -EOPNOTSUPP;
 
         if (len != 1) {
+                memset(val, 0, len);
                 pr_pic_unimpl("non byte read\n");
                 return 0;
         }
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index f7b20b417a3a..10a481b7674d 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -2168,7 +2168,10 @@ static void vmx_set_msr_bitmap(struct kvm_vcpu *vcpu)
 {
         unsigned long *msr_bitmap;
 
-        if (irqchip_in_kernel(vcpu->kvm) && apic_x2apic_mode(vcpu->arch.apic)) {
+        if (is_guest_mode(vcpu))
+                msr_bitmap = vmx_msr_bitmap_nested;
+        else if (irqchip_in_kernel(vcpu->kvm) &&
+                apic_x2apic_mode(vcpu->arch.apic)) {
                 if (is_long_mode(vcpu))
                         msr_bitmap = vmx_msr_bitmap_longmode_x2apic;
                 else
@@ -9218,9 +9221,9 @@ static void prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12)
         }
 
         if (cpu_has_vmx_msr_bitmap() &&
-            exec_control & CPU_BASED_USE_MSR_BITMAPS &&
-            nested_vmx_merge_msr_bitmap(vcpu, vmcs12)) {
-                vmcs_write64(MSR_BITMAP, __pa(vmx_msr_bitmap_nested));
+            exec_control & CPU_BASED_USE_MSR_BITMAPS) {
+                nested_vmx_merge_msr_bitmap(vcpu, vmcs12);
+                /* MSR_BITMAP will be set by following vmx_set_efer. */
         } else
                 exec_control &= ~CPU_BASED_USE_MSR_BITMAPS;
 
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index bd7a70be41b3..32bf19ef3115 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -2744,7 +2744,6 @@ int kvm_vm_ioctl_check_extension(struct kvm *kvm, long ext)
         case KVM_CAP_USER_NMI:
         case KVM_CAP_REINJECT_CONTROL:
         case KVM_CAP_IRQ_INJECT_STATUS:
-        case KVM_CAP_IRQFD:
         case KVM_CAP_IOEVENTFD:
         case KVM_CAP_IOEVENTFD_NO_LENGTH:
         case KVM_CAP_PIT2:
diff --git a/arch/x86/pci/common.c b/arch/x86/pci/common.c
index 3d2612b68694..2fb384724ebb 100644
--- a/arch/x86/pci/common.c
+++ b/arch/x86/pci/common.c
@@ -513,31 +513,6 @@ void __init pcibios_set_cache_line_size(void)
         }
 }
 
-/*
- * Some device drivers assume dev->irq won't change after calling
- * pci_disable_device(). So delay releasing of IRQ resource to driver
- * unbinding time. Otherwise it will break PM subsystem and drivers
- * like xen-pciback etc.
- */
-static int pci_irq_notifier(struct notifier_block *nb, unsigned long action,
-                            void *data)
-{
-        struct pci_dev *dev = to_pci_dev(data);
-
-        if (action != BUS_NOTIFY_UNBOUND_DRIVER)
-                return NOTIFY_DONE;
-
-        if (pcibios_disable_irq)
-                pcibios_disable_irq(dev);
-
-        return NOTIFY_OK;
-}
-
-static struct notifier_block pci_irq_nb = {
-        .notifier_call = pci_irq_notifier,
-        .priority = INT_MIN,
-};
-
 int __init pcibios_init(void)
 {
         if (!raw_pci_ops) {
@@ -550,9 +525,6 @@ int __init pcibios_init(void)
 
         if (pci_bf_sort >= pci_force_bf)
                 pci_sort_breadthfirst();
-
-        bus_register_notifier(&pci_bus_type, &pci_irq_nb);
-
         return 0;
 }
 
@@ -711,6 +683,12 @@ int pcibios_enable_device(struct pci_dev *dev, int mask)
         return 0;
 }
 
+void pcibios_disable_device (struct pci_dev *dev)
+{
+        if (!pci_dev_msi_enabled(dev) && pcibios_disable_irq)
+                pcibios_disable_irq(dev);
+}
+
 int pci_ext_cfg_avail(void)
 {
         if (raw_pci_ext_ops)
diff --git a/arch/x86/pci/intel_mid_pci.c b/arch/x86/pci/intel_mid_pci.c
index efb849323c74..852aa4c92da0 100644
--- a/arch/x86/pci/intel_mid_pci.c
+++ b/arch/x86/pci/intel_mid_pci.c
@@ -234,10 +234,10 @@ static int intel_mid_pci_irq_enable(struct pci_dev *dev)
 
 static void intel_mid_pci_irq_disable(struct pci_dev *dev)
 {
-        if (dev->irq_managed && dev->irq > 0) {
+        if (!mp_should_keep_irq(&dev->dev) && dev->irq_managed &&
+            dev->irq > 0) {
                 mp_unmap_irq(dev->irq);
                 dev->irq_managed = 0;
-                dev->irq = 0;
         }
 }
 
diff --git a/arch/x86/pci/irq.c b/arch/x86/pci/irq.c
index e71b3dbd87b8..5dc6ca5e1741 100644
--- a/arch/x86/pci/irq.c
+++ b/arch/x86/pci/irq.c
@@ -1256,9 +1256,22 @@ static int pirq_enable_irq(struct pci_dev *dev)
         return 0;
 }
 
+bool mp_should_keep_irq(struct device *dev)
+{
+        if (dev->power.is_prepared)
+                return true;
+#ifdef CONFIG_PM
+        if (dev->power.runtime_status == RPM_SUSPENDING)
+                return true;
+#endif
+
+        return false;
+}
+
 static void pirq_disable_irq(struct pci_dev *dev)
 {
-        if (io_apic_assign_pci_irqs && dev->irq_managed && dev->irq) {
+        if (io_apic_assign_pci_irqs && !mp_should_keep_irq(&dev->dev) &&
+            dev->irq_managed && dev->irq) {
                 mp_unmap_irq(dev->irq);
                 dev->irq = 0;
                 dev->irq_managed = 0;
diff --git a/arch/x86/vdso/vdso32/sigreturn.S b/arch/x86/vdso/vdso32/sigreturn.S
index 31776d0efc8c..d7ec4e251c0a 100644
--- a/arch/x86/vdso/vdso32/sigreturn.S
+++ b/arch/x86/vdso/vdso32/sigreturn.S
@@ -17,6 +17,7 @@
         .text
         .globl __kernel_sigreturn
         .type __kernel_sigreturn,@function
+        nop /* this guy is needed for .LSTARTFDEDLSI1 below (watch for HACK) */
         ALIGN
 __kernel_sigreturn:
 .LSTART_sigreturn: